pulp-container 2.29.1__tar.gz → 2.29.2__tar.gz

{pulp_container-2.29.1 → pulp_container-2.29.2}/CHANGES.md

@@ -8,6 +8,14 @@
 
 [//]: # (towncrier release notes start)
 
+## 2.29.2 (2026-10-08) {: #2.29.2 }
+
+#### Bugfixes {: #2.29.2-bugfix }
+
+- Fixed global auth token leakage. CVE-2026-103868
+
+---
+
 ## 2.29.1 (2026-09-23) {: #2.29.1 }
 
 #### Bugfixes {: #2.29.1-bugfix }

{pulp_container-2.29.1 → pulp_container-2.29.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulp-container
-Version: 2.29.1
+Version: 2.29.2
 Summary: Container plugin for the Pulp Project
 Author-email: Pulp Team <pulp-list@redhat.com>
 Project-URL: Homepage, https://pulpproject.org
@@ -18,7 +18,7 @@ Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: jsonschema<4.27,>=4.4
-Requires-Dist: pulpcore<3.130,>=3.111.0
-Requires-Dist: pyjwt[crypto]<2.14,>=2.4
+Requires-Dist: pulpcore<3.130,>=3.118.0
+Requires-Dist: pyjwt[crypto]<2.16,>=2.4
 Requires-Dist: pysequoia<0.2.0,>=0.1.35
 Dynamic: license-file

{pulp_container-2.29.1 → pulp_container-2.29.2}/pulp_container/app/__init__.py

@@ -24,7 +24,7 @@ class PulpContainerPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_container.app"
     label = "container"
-    version = "2.29.1"
+    version = "2.29.2"
     python_package_name = "pulp-container"
     domain_compatible = True
 

{pulp_container-2.29.1 → pulp_container-2.29.2}/pulp_container/app/cache.py

@@ -40,9 +40,9 @@ class RegistryContentCache(RegistryCache, AsyncContentCache):
         key = ":".join(all_keys[k] for k in self.keys)
         return key
 
-    async def make_response(self, key, base_key):
+    async def make_response(self, key, base_key, *args, **kwargs):
         """Fix the Content-Type header to remove the charset."""
-        response = await super().make_response(key, base_key)
+        response = await super().make_response(key, base_key, *args, **kwargs)
         if response is not None:
             if content_type := response.headers.get("Content-Type"):
                 response.headers["Content-Type"] = content_type.split(";")[0]

{pulp_container-2.29.1 → pulp_container-2.29.2}/pulp_container/app/downloaders.py

@@ -25,15 +25,12 @@ class RegistryAuthHttpDownloader(HttpDownloader):
     Additionally, use custom headers from DeclarativeArtifact.extra_data['headers']
     """
 
-    registry_auth = {"bearer": None, "basic": None}
-    token_lock = asyncio.Lock()
-
     def __init__(self, *args, **kwargs):
         """
         Initialize the downloader.
         """
         self.remote = kwargs.pop("remote")
-
+        self.factory = kwargs.pop("factory")
         super().__init__(*args, **kwargs)
 
     async def _run(self, handle_401=True, extra_data=None):
@@ -57,8 +54,8 @@ class RegistryAuthHttpDownloader(HttpDownloader):
             headers = extra_data.get("headers", headers)
             repo_name = extra_data.get("repo_name", None)
         http_method = extra_data.get("http_method", "get") if extra_data is not None else "get"
-        this_token = self.registry_auth["bearer"]
-        basic_auth = self.registry_auth["basic"]
+        this_token = self.factory.registry_auth["bearer"]
+        basic_auth = self.factory.registry_auth["basic"]
         auth_headers = self.auth_header(this_token, basic_auth)
         headers.update(auth_headers)
         # aiohttps does not allow to send auth argument and auth header together
@@ -81,16 +78,16 @@ class RegistryAuthHttpDownloader(HttpDownloader):
                     if "bearer" in response_auth_header.lower():
                         # Token has not been updated during request
                         if (
-                            self.registry_auth["bearer"] is None
-                            or self.registry_auth["bearer"] == this_token
+                            self.factory.registry_auth["bearer"] is None
+                            or self.factory.registry_auth["bearer"] == this_token
                         ):
-                            self.registry_auth["bearer"] = None
+                            self.factory.registry_auth["bearer"] = None
                             await self.update_token(response_auth_header, this_token, repo_name)
                         return await self._run(handle_401=False, extra_data=extra_data)
                     elif "basic" in response_auth_header.lower():
                         if self.remote.username:
                             basic = aiohttp.BasicAuth(self.remote.username, self.remote.password)
-                            self.registry_auth["basic"] = basic.encode()
+                            self.factory.registry_auth["basic"] = basic.encode()
                         return await self._run(handle_401=False, extra_data=extra_data)
                 else:
                     raise
@@ -111,10 +108,10 @@ class RegistryAuthHttpDownloader(HttpDownloader):
         """
         Update the Bearer token to be used with all requests.
         """
-        async with self.token_lock:
+        async with self.factory.token_lock:
             if (
-                self.registry_auth["bearer"] is not None
-                and self.registry_auth["bearer"] == used_token
+                self.factory.registry_auth["bearer"] is not None
+                and self.factory.registry_auth["bearer"] == used_token
             ):
                 return
             log.info("Updating bearer token")
@@ -157,7 +154,7 @@ class RegistryAuthHttpDownloader(HttpDownloader):
 
             token_js = json.loads(token_data)
             token = token_js.get("token") or token_js.get("access_token")
-            self.registry_auth["bearer"] = token
+            self.factory.registry_auth["bearer"] = token
 
     @staticmethod
     def auth_header(token, basic_auth):
@@ -187,6 +184,21 @@ class RegistryAuthHttpDownloader(HttpDownloader):
         )
 
 
+class RegistryAuthDownloaderFactory(DownloaderFactory):
+    """
+    A downloader factory for registry access that can also share the authentication tokens.
+    """
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.registry_auth = {"bearer": None, "basic": None}
+        self.token_lock = asyncio.Lock()
+
+    def _http_or_https(self, download_class, url, **kwargs):
+        kwargs.setdefault("factory", self)
+        return super()._http_or_https(download_class, url, **kwargs)
+
+
 class NoAuthSignatureDownloader(HttpDownloader):
     """A downloader class suited for signature downloads."""
 

{pulp_container-2.29.1 → pulp_container-2.29.2}/pulp_container/app/models.py

@@ -13,7 +13,6 @@ from django.shortcuts import redirect
 from django_lifecycle import AFTER_CREATE, AFTER_DELETE, AFTER_UPDATE, hook
 
 from pulpcore.plugin.cache import SyncContentCache
-from pulpcore.plugin.download import DownloaderFactory
 from pulpcore.plugin.models import (
     Artifact,
     AutoAddObjPermsMixin,
@@ -510,17 +509,17 @@ class ContainerRemote(Remote, AutoAddObjPermsMixin):
         """
         Downloader Factory that maps to custom downloaders which support registry auth.
 
-        Upon first access, the DownloaderFactory is instantiated and saved internally.
+        Upon first access, the RegistryAuthDownloaderFactory is instantiated and saved internally.
 
         Returns:
-            DownloadFactory: The instantiated DownloaderFactory to be used by
+            DownloadFactory: The instantiated RegistryAuthDownloaderFactory to be used by
                 get_downloader()
 
         """
         try:
             return self._download_factory
         except AttributeError:
-            self._download_factory = DownloaderFactory(
+            self._download_factory = downloaders.RegistryAuthDownloaderFactory(
                 self,
                 downloader_overrides={
                     "http": downloaders.RegistryAuthHttpDownloader,

{pulp_container-2.29.1 → pulp_container-2.29.2}/pulp_container.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulp-container
-Version: 2.29.1
+Version: 2.29.2
 Summary: Container plugin for the Pulp Project
 Author-email: Pulp Team <pulp-list@redhat.com>
 Project-URL: Homepage, https://pulpproject.org
@@ -18,7 +18,7 @@ Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: jsonschema<4.27,>=4.4
-Requires-Dist: pulpcore<3.130,>=3.111.0
-Requires-Dist: pyjwt[crypto]<2.14,>=2.4
+Requires-Dist: pulpcore<3.130,>=3.118.0
+Requires-Dist: pyjwt[crypto]<2.16,>=2.4
 Requires-Dist: pysequoia<0.2.0,>=0.1.35
 Dynamic: license-file

pulp_container-2.29.2/pulp_container.egg-info/requires.txt

@@ -0,0 +1,4 @@
+jsonschema<4.27,>=4.4
+pulpcore<3.130,>=3.118.0
+pyjwt[crypto]<2.16,>=2.4
+pysequoia<0.2.0,>=0.1.35

{pulp_container-2.29.1 → pulp_container-2.29.2}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = 'setuptools.build_meta'
 
 [project]
 name = "pulp-container"
-version = "2.29.1"
+version = "2.29.2"
 description = "Container plugin for the Pulp Project"
 readme = "README.md"
 authors = [
@@ -24,8 +24,8 @@ classifiers=[
 requires-python = ">=3.11"
 dependencies = [
   "jsonschema>=4.4,<4.27",
-  "pulpcore>=3.111.0,<3.130",
-  "pyjwt[crypto]>=2.4,<2.14",
+  "pulpcore>=3.118.0,<3.130",
+  "pyjwt[crypto]>=2.4,<2.16",
   "pysequoia>=0.1.35,<0.2.0"
 ]
 
@@ -89,7 +89,7 @@ ignore = [
 [tool.bumpversion]
 # This section is managed by the plugin template. Do not edit manually.
 
-current_version = "2.29.1"
+current_version = "2.29.2"
 commit = false
 tag = false
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<alpha>0a)?(?P<patch>\\d+)(\\.(?P<release>[a-z]+))?"

pulp_container-2.29.1/pulp_container.egg-info/requires.txt

@@ -1,4 +0,0 @@
-jsonschema<4.27,>=4.4
-pulpcore<3.130,>=3.111.0
-pyjwt[crypto]<2.14,>=2.4
-pysequoia<0.2.0,>=0.1.35