starred/coolify
1
0
Fork 0
mirror of https://github.com/coollabsio/coolify.git synced 2026-11-06 21:18:11 -04:00
Code Issues Packages Projects Releases Wiki Activity

feat(scripts): harden the requests of the arch tag removal

Browse Source 
- Passes the logins to curl on stdin, which keeps them out of the process list
- Sends a token only to the host the script expects
- Checks the format of version ids and tags before they go into a request
This commit is contained in:
peaklabs-dev
2026-11-02 00:18:34 +01:00
parent 612df5a684
commit f0caf0d555
1 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/tmp-remove-arch-tags.sh
+9 -3
View File
@@ -98,6 +98,7 @@ remove_arch_tags() {
[ -s "$WORK_DIR/remove-$registry.txt" ] || continue
upload_empty_blob "$registry" || die "could not upload the empty blob of the placeholder to $registry/$IMAGE"
while read -r tag; do
[[ "$tag" =~ ^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$ ]] || die "the list names the tag '$tag' on $registry, expected a tag name"
curl -sSf --retry 3 -X PUT -o /dev/null -H "Authorization: Bearer $(registry_token "$registry" pull,push)" -H 'Content-Type: application/vnd.oci.image.manifest.v1+json' \
--data-binary "@$WORK_DIR/placeholder.json" "https://$(registry_host "$registry")/v2/$IMAGE/manifests/$tag" || die "could not move $tag on $registry to the placeholder"
ok "moved $BOLD$tag$RESET on $registry off its image to the placeholder"
@@ -156,6 +157,7 @@ upload_empty_blob() {
curl -sSf --head -o /dev/null -H "Authorization: Bearer $token" "https://$host/v2/$IMAGE/blobs/$EMPTY_BLOB" 2> /dev/null && return 0
location="$(curl -sSf -X POST -o /dev/null -w '%header{location}' -H "Authorization: Bearer $token" "https://$host/v2/$IMAGE/blobs/uploads/")" || return 1
[[ "$location" == http* ]] || location="https://$host$location"
[[ "$location" == "https://$host/"* ]] || die "$1 answered the blob upload with ${location%%\?*}, expected a URL on https://$host for the push token"
case "$location" in
*\?*) location="$location&digest=$EMPTY_BLOB" ;;
*) location="$location?digest=$EMPTY_BLOB" ;;
@@ -173,7 +175,7 @@ delete_placeholder() {
[ -z "$id" ] || break
sleep "$attempt"
done
[ -n "$id" ] || die "found no version for the placeholder $2 among the newest 100 on ghcr.io, it holds the moved tags until it is deleted in the package settings"
[[ "$id" =~ ^[0-9]+$ ]] || die "found no version for the placeholder $2 among the newest 100 on ghcr.io, it holds the moved tags until it is deleted in the package settings"
gh api -X DELETE "/orgs/${IMAGE%%/*}/packages/container/${IMAGE#*/}/versions/$id" > /dev/null \
|| die "could not delete the placeholder $2 (version $id) from ghcr.io, it holds the moved tags until it is deleted"
;;
@@ -201,11 +203,15 @@ request_manifests() {
registry_token() {
case "$1" in
ghcr.io) curl -sSf --retry 3 ${GHCR_TOKEN:+-u "x:$GHCR_TOKEN"} "https://ghcr.io/token?scope=repository:$IMAGE:$2" ;;
docker.io) curl -sSf --retry 3 -u "$DOCKERHUB_USERNAME:$DOCKERHUB_TOKEN" "https://auth.docker.io/token?service=registry.docker.io&scope=repository:$IMAGE:$2" ;;
ghcr.io) basic_auth "${GHCR_TOKEN:+x:$GHCR_TOKEN}" | curl -sSf --retry 3 -K - "https://ghcr.io/token?scope=repository:$IMAGE:$2" ;;
docker.io) basic_auth "$DOCKERHUB_USERNAME:$DOCKERHUB_TOKEN" | curl -sSf --retry 3 -K - "https://auth.docker.io/token?service=registry.docker.io&scope=repository:$IMAGE:$2" ;;
esac | jq -r .token
}
basic_auth() {
[ -z "$1" ] || printf 'header = "Authorization: Basic %s"\n' "$(printf '%s' "$1" | jq -Rrj @base64)"
}
hub_token() {
jq -n --arg identifier "$DOCKERHUB_USERNAME" --arg secret "$DOCKERHUB_TOKEN" '{identifier: $identifier, secret: $secret}' \
| curl -sSf --retry 3 -X POST -H 'Content-Type: application/json' --data-binary @- https://hub.docker.com/v2/auth/token | jq -er .access_token