pulp-container 2.26.18__tar.gz → 2.26.20__tar.gz

{pulp_container-2.26.18 → pulp_container-2.26.20}/CHANGES.md

@@ -8,6 +8,24 @@
 
 [//]: # (towncrier release notes start)
 
+## 2.26.20 (2026-10-28) {: #2.26.20 }
+
+#### Bugfixes {: #2.26.20-bugfix }
+
+- Container blob downloads now respect each Domain's object storage redirect setting.
+- Fixed pull-through signature lookups failing with a 500 when the upstream registry (e.g. gcr.io) sends unquoted values in its bearer auth challenge.
+- Fixed the registry Authorization header leaking into a shared module-level headers dict, which could send one remote's credentials to another registry.
+
+---
+
+## 2.26.19 (2026-10-08) {: #2.26.19 }
+
+#### Bugfixes {: #2.26.19-bugfix }
+
+- Fixed global auth token leakage. CVE-2026-103868
+
+---
+
 ## 2.26.18 (2026-10-07) {: #2.26.18 }
 
 No significant changes.

{pulp_container-2.26.18 → pulp_container-2.26.20}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulp-container
-Version: 2.26.18
+Version: 2.26.20
 Summary: Container plugin for the Pulp Project
 Author-email: Pulp Team <pulp-list@redhat.com>
 Project-URL: Homepage, https://pulpproject.org

{pulp_container-2.26.18 → pulp_container-2.26.20}/pulp_container/app/__init__.py

@@ -24,7 +24,7 @@ class PulpContainerPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_container.app"
     label = "container"
-    version = "2.26.18"
+    version = "2.26.20"
     python_package_name = "pulp-container"
     domain_compatible = True
 

{pulp_container-2.26.18 → pulp_container-2.26.20}/pulp_container/app/downloaders.py

@@ -27,15 +27,12 @@ class RegistryAuthHttpDownloader(HttpDownloader):
     Additionally, use custom headers from DeclarativeArtifact.extra_data['headers']
     """
 
-    registry_auth = {"bearer": None, "basic": None}
-    token_lock = asyncio.Lock()
-
     def __init__(self, *args, **kwargs):
         """
         Initialize the downloader.
         """
         self.remote = kwargs.pop("remote")
-
+        self.factory = kwargs.pop("factory")
         super().__init__(*args, **kwargs)
 
     async def _run(self, handle_401=True, extra_data=None):
@@ -60,11 +57,11 @@ class RegistryAuthHttpDownloader(HttpDownloader):
         headers = V2_ACCEPT_HEADERS
         repo_name = None
         if extra_data is not None:
-            headers = extra_data.get("headers", headers)
+            headers = dict(extra_data.get("headers", headers))
             repo_name = extra_data.get("repo_name", None)
         http_method = extra_data.get("http_method", "get") if extra_data is not None else "get"
-        this_token = self.registry_auth["bearer"]
-        basic_auth = self.registry_auth["basic"]
+        this_token = self.factory.registry_auth["bearer"]
+        basic_auth = self.factory.registry_auth["basic"]
         auth_headers = self.auth_header(this_token, basic_auth)
         headers.update(auth_headers)
         # aiohttps does not allow to send auth argument and auth header together
@@ -87,16 +84,16 @@ class RegistryAuthHttpDownloader(HttpDownloader):
                     if "bearer" in response_auth_header.lower():
                         # Token has not been updated during request
                         if (
-                            self.registry_auth["bearer"] is None
-                            or self.registry_auth["bearer"] == this_token
+                            self.factory.registry_auth["bearer"] is None
+                            or self.factory.registry_auth["bearer"] == this_token
                         ):
-                            self.registry_auth["bearer"] = None
+                            self.factory.registry_auth["bearer"] = None
                             await self.update_token(response_auth_header, this_token, repo_name)
                         return await self._run(handle_401=False, extra_data=extra_data)
                     elif "basic" in response_auth_header.lower():
                         if self.remote.username:
                             basic = aiohttp.BasicAuth(self.remote.username, self.remote.password)
-                            self.registry_auth["basic"] = basic.encode()
+                            self.factory.registry_auth["basic"] = basic.encode()
                         return await self._run(handle_401=False, extra_data=extra_data)
                 else:
                     raise
@@ -117,21 +114,14 @@ class RegistryAuthHttpDownloader(HttpDownloader):
         """
         Update the Bearer token to be used with all requests.
         """
-        async with self.token_lock:
+        async with self.factory.token_lock:
             if (
-                self.registry_auth["bearer"] is not None
-                and self.registry_auth["bearer"] == used_token
+                self.factory.registry_auth["bearer"] is not None
+                and self.factory.registry_auth["bearer"] == used_token
             ):
                 return
             log.info("Updating bearer token")
-            bearer_info_string = response_auth_header[len("Bearer ") :]
-            bearer_info_list = re.split(",(?=[^=,]+=)", bearer_info_string)
-
-            # The remaining string consists of comma seperated key=value pairs
-            auth_query_dict = {}
-            for key, value in (item.split("=") for item in bearer_info_list):
-                # The value is a string within a string, ex: '"value"'
-                auth_query_dict[key] = json.loads(value)
+            auth_query_dict = self.parse_auth_challenge(response_auth_header)
             try:
                 token_base_url = auth_query_dict.pop("realm")
             except KeyError:
@@ -163,7 +153,25 @@ class RegistryAuthHttpDownloader(HttpDownloader):
 
             token_js = json.loads(token_data)
             token = token_js.get("token") or token_js.get("access_token")
-            self.registry_auth["bearer"] = token
+            self.factory.registry_auth["bearer"] = token
+
+    @staticmethod
+    def parse_auth_challenge(response_auth_header):
+        """
+        Parse the parameters of a Bearer auth challenge into a dictionary.
+
+        Values may be quoted strings or plain tokens (RFC 7235), e.g. gcr.io responds with
+        'Bearer realm="https://gcr.io/v2/token",service=gcr.io'.
+        """
+        bearer_info_string = response_auth_header[len("Bearer ") :]
+        auth_query_dict = {}
+        for match in re.finditer(r'([^=,\s]+)=(?:"((?:[^"\\]|\\.)*)"|([^,]*))', bearer_info_string):
+            key, quoted, plain = match.groups()
+            if quoted is not None:
+                auth_query_dict[key] = re.sub(r"\\(.)", r"\1", quoted)
+            else:
+                auth_query_dict[key] = plain.strip()
+        return auth_query_dict
 
     @staticmethod
     def auth_header(token, basic_auth):
@@ -193,6 +201,21 @@ class RegistryAuthHttpDownloader(HttpDownloader):
         )
 
 
+class RegistryAuthDownloaderFactory(DownloaderFactory):
+    """
+    A downloader factory for registry access that can also share the authentication tokens.
+    """
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.registry_auth = {"bearer": None, "basic": None}
+        self.token_lock = asyncio.Lock()
+
+    def _http_or_https(self, download_class, url, **kwargs):
+        kwargs.setdefault("factory", self)
+        return super()._http_or_https(download_class, url, **kwargs)
+
+
 class NoAuthSignatureDownloader(HttpDownloader):
     """A downloader class suited for signature downloads."""
 

{pulp_container-2.26.18 → pulp_container-2.26.20}/pulp_container/app/models.py

@@ -12,7 +12,6 @@ from django.shortcuts import redirect
 from django_lifecycle import AFTER_CREATE, AFTER_DELETE, AFTER_UPDATE, hook
 
 from pulpcore.plugin.cache import SyncContentCache
-from pulpcore.plugin.download import DownloaderFactory
 from pulpcore.plugin.models import (
     Artifact,
     AutoAddObjPermsMixin,
@@ -498,17 +497,17 @@ class ContainerRemote(Remote, AutoAddObjPermsMixin):
         """
         Downloader Factory that maps to custom downloaders which support registry auth.
 
-        Upon first access, the DownloaderFactory is instantiated and saved internally.
+        Upon first access, the RegistryAuthDownloaderFactory is instantiated and saved internally.
 
         Returns:
-            DownloadFactory: The instantiated DownloaderFactory to be used by
+            DownloadFactory: The instantiated RegistryAuthDownloaderFactory to be used by
                 get_downloader()
 
         """
         try:
             return self._download_factory
         except AttributeError:
-            self._download_factory = DownloaderFactory(
+            self._download_factory = downloaders.RegistryAuthDownloaderFactory(
                 self,
                 downloader_overrides={
                     "http": downloaders.RegistryAuthHttpDownloader,

{pulp_container-2.26.18 → pulp_container-2.26.20}/pulp_container/app/registry_api.py

@@ -1031,7 +1031,7 @@ class RedirectsMixin:
         domain = get_domain()
         if (
             domain.storage_class == "pulpcore.app.models.storage.FileSystem"
-            or not settings.REDIRECT_TO_OBJECT_STORAGE
+            or not domain.redirect_to_object_storage
         ):
             self.redirects_class = FileStorageRedirects
         elif domain.storage_class == "storages.backends.s3boto3.S3Boto3Storage":

pulp_container-2.26.20/pulp_container/tests/unit/test_downloaders.py

@@ -0,0 +1,33 @@
+import pytest
+
+from pulp_container.app.downloaders import RegistryAuthHttpDownloader
+
+
+@pytest.mark.parametrize(
+    "header,expected",
+    [
+        (
+            'Bearer realm="https://auth.docker.io/token",service="registry.docker.io"',
+            {"realm": "https://auth.docker.io/token", "service": "registry.docker.io"},
+        ),
+        (
+            'Bearer realm="https://gcr.io/v2/token",service=gcr.io',
+            {"realm": "https://gcr.io/v2/token", "service": "gcr.io"},
+        ),
+        (
+            'Bearer realm="https://quay.io/v2/auth",service="quay.io",'
+            'scope="repository:foo/bar:pull,push"',
+            {
+                "realm": "https://quay.io/v2/auth",
+                "service": "quay.io",
+                "scope": "repository:foo/bar:pull,push",
+            },
+        ),
+        (
+            'Bearer realm="https://example.com/token", service=example.com, error="a \\"b\\""',
+            {"realm": "https://example.com/token", "service": "example.com", "error": 'a "b"'},
+        ),
+    ],
+)
+def test_parse_auth_challenge(header, expected):
+    assert RegistryAuthHttpDownloader.parse_auth_challenge(header) == expected

{pulp_container-2.26.18 → pulp_container-2.26.20}/pulp_container.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulp-container
-Version: 2.26.18
+Version: 2.26.20
 Summary: Container plugin for the Pulp Project
 Author-email: Pulp Team <pulp-list@redhat.com>
 Project-URL: Homepage, https://pulpproject.org

{pulp_container-2.26.18 → pulp_container-2.26.20}/pulp_container.egg-info/SOURCES.txt

@@ -137,6 +137,7 @@ pulp_container/tests/functional/api/test_sync_signatures.py
 pulp_container/tests/functional/api/test_tagging_images.py
 pulp_container/tests/functional/api/test_token_authentication.py
 pulp_container/tests/unit/__init__.py
+pulp_container/tests/unit/test_downloaders.py
 pulp_container/tests/unit/test_json_schemas.py
 pulp_container/tests/unit/test_models.py
 pulp_container/tests/unit/test_pull_through_repair.py

{pulp_container-2.26.18 → pulp_container-2.26.20}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = 'setuptools.build_meta'
 
 [project]
 name = "pulp-container"
-version = "2.26.18"
+version = "2.26.20"
 description = "Container plugin for the Pulp Project"
 readme = "README.md"
 authors = [
@@ -89,7 +89,7 @@ ignore = [
 [tool.bumpversion]
 # This section is managed by the plugin template. Do not edit manually.
 
-current_version = "2.26.18"
+current_version = "2.26.20"
 commit = false
 tag = false
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<alpha>0a)?(?P<patch>\\d+)(\\.(?P<release>[a-z]+))?"