pulp-container 2.26.19__tar.gz → 2.26.20__tar.gz

{pulp_container-2.26.19 → pulp_container-2.26.20}/CHANGES.md

@@ -8,6 +8,16 @@
 
 [//]: # (towncrier release notes start)
 
+## 2.26.20 (2026-10-28) {: #2.26.20 }
+
+#### Bugfixes {: #2.26.20-bugfix }
+
+- Container blob downloads now respect each Domain's object storage redirect setting.
+- Fixed pull-through signature lookups failing with a 500 when the upstream registry (e.g. gcr.io) sends unquoted values in its bearer auth challenge.
+- Fixed the registry Authorization header leaking into a shared module-level headers dict, which could send one remote's credentials to another registry.
+
+---
+
 ## 2.26.19 (2026-10-08) {: #2.26.19 }
 
 #### Bugfixes {: #2.26.19-bugfix }

{pulp_container-2.26.19 → pulp_container-2.26.20}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulp-container
-Version: 2.26.19
+Version: 2.26.20
 Summary: Container plugin for the Pulp Project
 Author-email: Pulp Team <pulp-list@redhat.com>
 Project-URL: Homepage, https://pulpproject.org

{pulp_container-2.26.19 → pulp_container-2.26.20}/pulp_container/app/__init__.py

@@ -24,7 +24,7 @@ class PulpContainerPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_container.app"
     label = "container"
-    version = "2.26.19"
+    version = "2.26.20"
     python_package_name = "pulp-container"
     domain_compatible = True
 

{pulp_container-2.26.19 → pulp_container-2.26.20}/pulp_container/app/downloaders.py

@@ -57,7 +57,7 @@ class RegistryAuthHttpDownloader(HttpDownloader):
         headers = V2_ACCEPT_HEADERS
         repo_name = None
         if extra_data is not None:
-            headers = extra_data.get("headers", headers)
+            headers = dict(extra_data.get("headers", headers))
             repo_name = extra_data.get("repo_name", None)
         http_method = extra_data.get("http_method", "get") if extra_data is not None else "get"
         this_token = self.factory.registry_auth["bearer"]
@@ -121,14 +121,7 @@ class RegistryAuthHttpDownloader(HttpDownloader):
             ):
                 return
             log.info("Updating bearer token")
-            bearer_info_string = response_auth_header[len("Bearer ") :]
-            bearer_info_list = re.split(",(?=[^=,]+=)", bearer_info_string)
-
-            # The remaining string consists of comma seperated key=value pairs
-            auth_query_dict = {}
-            for key, value in (item.split("=") for item in bearer_info_list):
-                # The value is a string within a string, ex: '"value"'
-                auth_query_dict[key] = json.loads(value)
+            auth_query_dict = self.parse_auth_challenge(response_auth_header)
             try:
                 token_base_url = auth_query_dict.pop("realm")
             except KeyError:
@@ -162,6 +155,24 @@ class RegistryAuthHttpDownloader(HttpDownloader):
             token = token_js.get("token") or token_js.get("access_token")
             self.factory.registry_auth["bearer"] = token
 
+    @staticmethod
+    def parse_auth_challenge(response_auth_header):
+        """
+        Parse the parameters of a Bearer auth challenge into a dictionary.
+
+        Values may be quoted strings or plain tokens (RFC 7235), e.g. gcr.io responds with
+        'Bearer realm="https://gcr.io/v2/token",service=gcr.io'.
+        """
+        bearer_info_string = response_auth_header[len("Bearer ") :]
+        auth_query_dict = {}
+        for match in re.finditer(r'([^=,\s]+)=(?:"((?:[^"\\]|\\.)*)"|([^,]*))', bearer_info_string):
+            key, quoted, plain = match.groups()
+            if quoted is not None:
+                auth_query_dict[key] = re.sub(r"\\(.)", r"\1", quoted)
+            else:
+                auth_query_dict[key] = plain.strip()
+        return auth_query_dict
+
     @staticmethod
     def auth_header(token, basic_auth):
         """

{pulp_container-2.26.19 → pulp_container-2.26.20}/pulp_container/app/registry_api.py

@@ -1031,7 +1031,7 @@ class RedirectsMixin:
         domain = get_domain()
         if (
             domain.storage_class == "pulpcore.app.models.storage.FileSystem"
-            or not settings.REDIRECT_TO_OBJECT_STORAGE
+            or not domain.redirect_to_object_storage
         ):
             self.redirects_class = FileStorageRedirects
         elif domain.storage_class == "storages.backends.s3boto3.S3Boto3Storage":

pulp_container-2.26.20/pulp_container/tests/unit/test_downloaders.py

@@ -0,0 +1,33 @@
+import pytest
+
+from pulp_container.app.downloaders import RegistryAuthHttpDownloader
+
+
+@pytest.mark.parametrize(
+    "header,expected",
+    [
+        (
+            'Bearer realm="https://auth.docker.io/token",service="registry.docker.io"',
+            {"realm": "https://auth.docker.io/token", "service": "registry.docker.io"},
+        ),
+        (
+            'Bearer realm="https://gcr.io/v2/token",service=gcr.io',
+            {"realm": "https://gcr.io/v2/token", "service": "gcr.io"},
+        ),
+        (
+            'Bearer realm="https://quay.io/v2/auth",service="quay.io",'
+            'scope="repository:foo/bar:pull,push"',
+            {
+                "realm": "https://quay.io/v2/auth",
+                "service": "quay.io",
+                "scope": "repository:foo/bar:pull,push",
+            },
+        ),
+        (
+            'Bearer realm="https://example.com/token", service=example.com, error="a \\"b\\""',
+            {"realm": "https://example.com/token", "service": "example.com", "error": 'a "b"'},
+        ),
+    ],
+)
+def test_parse_auth_challenge(header, expected):
+    assert RegistryAuthHttpDownloader.parse_auth_challenge(header) == expected

{pulp_container-2.26.19 → pulp_container-2.26.20}/pulp_container.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulp-container
-Version: 2.26.19
+Version: 2.26.20
 Summary: Container plugin for the Pulp Project
 Author-email: Pulp Team <pulp-list@redhat.com>
 Project-URL: Homepage, https://pulpproject.org

{pulp_container-2.26.19 → pulp_container-2.26.20}/pulp_container.egg-info/SOURCES.txt

@@ -137,6 +137,7 @@ pulp_container/tests/functional/api/test_sync_signatures.py
 pulp_container/tests/functional/api/test_tagging_images.py
 pulp_container/tests/functional/api/test_token_authentication.py
 pulp_container/tests/unit/__init__.py
+pulp_container/tests/unit/test_downloaders.py
 pulp_container/tests/unit/test_json_schemas.py
 pulp_container/tests/unit/test_models.py
 pulp_container/tests/unit/test_pull_through_repair.py

{pulp_container-2.26.19 → pulp_container-2.26.20}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = 'setuptools.build_meta'
 
 [project]
 name = "pulp-container"
-version = "2.26.19"
+version = "2.26.20"
 description = "Container plugin for the Pulp Project"
 readme = "README.md"
 authors = [
@@ -89,7 +89,7 @@ ignore = [
 [tool.bumpversion]
 # This section is managed by the plugin template. Do not edit manually.
 
-current_version = "2.26.19"
+current_version = "2.26.20"
 commit = false
 tag = false
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<alpha>0a)?(?P<patch>\\d+)(\\.(?P<release>[a-z]+))?"