pulp-container 2.29.1__tar.gz → 2.30.0__tar.gz

{pulp_container-2.29.1 → pulp_container-2.30.0}/CHANGES.md

@@ -8,6 +8,20 @@
 
 [//]: # (towncrier release notes start)
 
+## 2.30.0 (2026-10-08) {: #2.30.0 }
+
+#### Features {: #2.30.0-feature }
+
+- Pull-through manifest resolution now uses HEAD checks, reducing Docker Hub 429s for repeated tag resolutions.
+
+#### Bugfixes {: #2.30.0-bugfix }
+
+- Prevent container distributions from overlapping other distribution base paths. Pull-through distributions **NEED** to be fixed before upgrading pulpcore; run `pulpcore-manager container-repair-pull-through-distributions` to repair existing distributions.
+  [#2494](https://github.com/pulp/pulp_container/issues/2494)
+- Fixed global auth token leakage. CVE-2026-103868
+
+---
+
 ## 2.29.1 (2026-09-23) {: #2.29.1 }
 
 #### Bugfixes {: #2.29.1-bugfix }
@@ -107,6 +121,21 @@
 
 ---
 
+## 2.27.13 (2026-10-07) {: #2.27.13 }
+
+No significant changes.
+
+---
+
+## 2.27.12 (2026-09-23) {: #2.27.12 }
+
+#### Bugfixes {: #2.27.12-bugfix }
+
+- Prevent container distributions from overlapping other distribution base paths. Pull-through distributions **NEED** to be fixed before upgrading pulpcore; run `pulpcore-manager container-repair-pull-through-distributions` to repair existing distributions.
+  [#2494](https://github.com/pulp/pulp_container/issues/2494)
+
+---
+
 ## 2.27.11 (2026-07-29) {: #2.27.11 }
 
 No significant changes.
@@ -227,6 +256,21 @@ No significant changes.
 #### Misc {: #2.27.0-misc }
 
 
+---
+
+## 2.26.18 (2026-10-07) {: #2.26.18 }
+
+No significant changes.
+
+---
+
+## 2.26.17 (2026-09-23) {: #2.26.17 }
+
+#### Bugfixes {: #2.26.17-bugfix }
+
+- Prevent container distributions from overlapping other distribution base paths. Pull-through distributions **NEED** to be fixed before upgrading pulpcore; run `pulpcore-manager container-repair-pull-through-distributions` to repair existing distributions.
+  [#2494](https://github.com/pulp/pulp_container/issues/2494)
+
 ---
 
 ## 2.26.16 (2026-06-08) {: #2.26.16 }
@@ -435,6 +479,21 @@ No significant changes.
 
 ---
 
+## 2.24.14 (2026-10-07) {: #2.24.14 }
+
+No significant changes.
+
+---
+
+## 2.24.13 (2026-09-23) {: #2.24.13 }
+
+#### Bugfixes {: #2.24.13-bugfix }
+
+- Prevent container distributions from overlapping other distribution base paths. Pull-through distributions **NEED** to be fixed before upgrading pulpcore; run `pulpcore-manager container-repair-pull-through-distributions` to repair existing distributions.
+  [#2494](https://github.com/pulp/pulp_container/issues/2494)
+
+---
+
 ## 2.24.12 (2026-07-21) {: #2.24.12 }
 
 #### Bugfixes {: #2.24.12-bugfix }
@@ -573,6 +632,21 @@ No significant changes.
 
 ---
 
+## 2.22.12 (2026-10-07) {: #2.22.12 }
+
+No significant changes.
+
+---
+
+## 2.22.11 (2026-09-23) {: #2.22.11 }
+
+#### Bugfixes {: #2.22.11-bugfix }
+
+- Prevent container distributions from overlapping other distribution base paths. Pull-through distributions **NEED** to be fixed before upgrading pulpcore; run `pulpcore-manager container-repair-pull-through-distributions` to repair existing distributions.
+  [#2494](https://github.com/pulp/pulp_container/issues/2494)
+
+---
+
 ## 2.22.10 (2026-07-23) {: #2.22.10 }
 
 #### Bugfixes {: #2.22.10-bugfix }
@@ -766,6 +840,21 @@ No significant changes.
 
 ---
 
+## 2.20.13 (2026-10-07) {: #2.20.13 }
+
+No significant changes.
+
+---
+
+## 2.20.12 (2026-09-23) {: #2.20.12 }
+
+#### Bugfixes {: #2.20.12-bugfix }
+
+- Prevent container distributions from overlapping other distribution base paths. Pull-through distributions **NEED** to be fixed before upgrading pulpcore; run `pulpcore-manager container-repair-pull-through-distributions` to repair existing distributions.
+  [#2494](https://github.com/pulp/pulp_container/issues/2494)
+
+---
+
 ## 2.20.11 (2026-07-27) {: #2.20.11 }
 
 #### Bugfixes {: #2.20.11-bugfix }
@@ -907,6 +996,21 @@ No significant changes.
 
 ---
 
+## 2.19.15 (2026-10-07) {: #2.19.15 }
+
+No significant changes.
+
+---
+
+## 2.19.14 (2026-09-23) {: #2.19.14 }
+
+#### Bugfixes {: #2.19.14-bugfix }
+
+- Prevent container distributions from overlapping other distribution base paths. Pull-through distributions **NEED** to be fixed before upgrading pulpcore; run `pulpcore-manager container-repair-pull-through-distributions` to repair existing distributions.
+  [#2494](https://github.com/pulp/pulp_container/issues/2494)
+
+---
+
 ## 2.19.13 (2026-07-27) {: #2.19.13 }
 
 #### Bugfixes {: #2.19.13-bugfix }

{pulp_container-2.29.1 → pulp_container-2.30.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulp-container
-Version: 2.29.1
+Version: 2.30.0
 Summary: Container plugin for the Pulp Project
 Author-email: Pulp Team <pulp-list@redhat.com>
 Project-URL: Homepage, https://pulpproject.org
@@ -18,7 +18,7 @@ Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: jsonschema<4.27,>=4.4
-Requires-Dist: pulpcore<3.130,>=3.111.0
-Requires-Dist: pyjwt[crypto]<2.14,>=2.4
+Requires-Dist: pulpcore<3.130,>=3.118.0
+Requires-Dist: pyjwt[crypto]<2.16,>=2.4
 Requires-Dist: pysequoia<0.2.0,>=0.1.35
 Dynamic: license-file

{pulp_container-2.29.1 → pulp_container-2.30.0}/pulp_container/app/__init__.py

@@ -24,7 +24,7 @@ class PulpContainerPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_container.app"
     label = "container"
-    version = "2.29.1"
+    version = "2.30.0"
     python_package_name = "pulp-container"
     domain_compatible = True
 

{pulp_container-2.29.1 → pulp_container-2.30.0}/pulp_container/app/cache.py

@@ -40,9 +40,9 @@ class RegistryContentCache(RegistryCache, AsyncContentCache):
         key = ":".join(all_keys[k] for k in self.keys)
         return key
 
-    async def make_response(self, key, base_key):
+    async def make_response(self, key, base_key, *args, **kwargs):
         """Fix the Content-Type header to remove the charset."""
-        response = await super().make_response(key, base_key)
+        response = await super().make_response(key, base_key, *args, **kwargs)
         if response is not None:
             if content_type := response.headers.get("Content-Type"):
                 response.headers["Content-Type"] = content_type.split(";")[0]

{pulp_container-2.29.1 → pulp_container-2.30.0}/pulp_container/app/downloaders.py

@@ -25,15 +25,12 @@ class RegistryAuthHttpDownloader(HttpDownloader):
     Additionally, use custom headers from DeclarativeArtifact.extra_data['headers']
     """
 
-    registry_auth = {"bearer": None, "basic": None}
-    token_lock = asyncio.Lock()
-
     def __init__(self, *args, **kwargs):
         """
         Initialize the downloader.
         """
         self.remote = kwargs.pop("remote")
-
+        self.factory = kwargs.pop("factory")
         super().__init__(*args, **kwargs)
 
     async def _run(self, handle_401=True, extra_data=None):
@@ -57,8 +54,8 @@ class RegistryAuthHttpDownloader(HttpDownloader):
             headers = extra_data.get("headers", headers)
             repo_name = extra_data.get("repo_name", None)
         http_method = extra_data.get("http_method", "get") if extra_data is not None else "get"
-        this_token = self.registry_auth["bearer"]
-        basic_auth = self.registry_auth["basic"]
+        this_token = self.factory.registry_auth["bearer"]
+        basic_auth = self.factory.registry_auth["basic"]
         auth_headers = self.auth_header(this_token, basic_auth)
         headers.update(auth_headers)
         # aiohttps does not allow to send auth argument and auth header together
@@ -81,16 +78,16 @@ class RegistryAuthHttpDownloader(HttpDownloader):
                     if "bearer" in response_auth_header.lower():
                         # Token has not been updated during request
                         if (
-                            self.registry_auth["bearer"] is None
-                            or self.registry_auth["bearer"] == this_token
+                            self.factory.registry_auth["bearer"] is None
+                            or self.factory.registry_auth["bearer"] == this_token
                         ):
-                            self.registry_auth["bearer"] = None
+                            self.factory.registry_auth["bearer"] = None
                             await self.update_token(response_auth_header, this_token, repo_name)
                         return await self._run(handle_401=False, extra_data=extra_data)
                     elif "basic" in response_auth_header.lower():
                         if self.remote.username:
                             basic = aiohttp.BasicAuth(self.remote.username, self.remote.password)
-                            self.registry_auth["basic"] = basic.encode()
+                            self.factory.registry_auth["basic"] = basic.encode()
                         return await self._run(handle_401=False, extra_data=extra_data)
                 else:
                     raise
@@ -111,10 +108,10 @@ class RegistryAuthHttpDownloader(HttpDownloader):
         """
         Update the Bearer token to be used with all requests.
         """
-        async with self.token_lock:
+        async with self.factory.token_lock:
             if (
-                self.registry_auth["bearer"] is not None
-                and self.registry_auth["bearer"] == used_token
+                self.factory.registry_auth["bearer"] is not None
+                and self.factory.registry_auth["bearer"] == used_token
             ):
                 return
             log.info("Updating bearer token")
@@ -157,7 +154,7 @@ class RegistryAuthHttpDownloader(HttpDownloader):
 
             token_js = json.loads(token_data)
             token = token_js.get("token") or token_js.get("access_token")
-            self.registry_auth["bearer"] = token
+            self.factory.registry_auth["bearer"] = token
 
     @staticmethod
     def auth_header(token, basic_auth):
@@ -187,6 +184,21 @@ class RegistryAuthHttpDownloader(HttpDownloader):
         )
 
 
+class RegistryAuthDownloaderFactory(DownloaderFactory):
+    """
+    A downloader factory for registry access that can also share the authentication tokens.
+    """
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.registry_auth = {"bearer": None, "basic": None}
+        self.token_lock = asyncio.Lock()
+
+    def _http_or_https(self, download_class, url, **kwargs):
+        kwargs.setdefault("factory", self)
+        return super()._http_or_https(download_class, url, **kwargs)
+
+
 class NoAuthSignatureDownloader(HttpDownloader):
     """A downloader class suited for signature downloads."""
 

{pulp_container-2.29.1 → pulp_container-2.30.0}/pulp_container/app/models.py

@@ -13,7 +13,6 @@ from django.shortcuts import redirect
 from django_lifecycle import AFTER_CREATE, AFTER_DELETE, AFTER_UPDATE, hook
 
 from pulpcore.plugin.cache import SyncContentCache
-from pulpcore.plugin.download import DownloaderFactory
 from pulpcore.plugin.models import (
     Artifact,
     AutoAddObjPermsMixin,
@@ -510,17 +509,17 @@ class ContainerRemote(Remote, AutoAddObjPermsMixin):
         """
         Downloader Factory that maps to custom downloaders which support registry auth.
 
-        Upon first access, the DownloaderFactory is instantiated and saved internally.
+        Upon first access, the RegistryAuthDownloaderFactory is instantiated and saved internally.
 
         Returns:
-            DownloadFactory: The instantiated DownloaderFactory to be used by
+            DownloadFactory: The instantiated RegistryAuthDownloaderFactory to be used by
                 get_downloader()
 
         """
         try:
             return self._download_factory
         except AttributeError:
-            self._download_factory = DownloaderFactory(
+            self._download_factory = downloaders.RegistryAuthDownloaderFactory(
                 self,
                 downloader_overrides={
                     "http": downloaders.RegistryAuthHttpDownloader,

{pulp_container-2.29.1 → pulp_container-2.30.0}/pulp_container/app/registry_api.py

@@ -1477,14 +1477,43 @@ class Manifests(RedirectsMixin, ContainerRegistryApiMixin, ViewSet):
         Fetch a manifest from the upstream remote.
         Returns the local manifest, if it exists in Pulp, and the full response from upstream.
         Raises response errors if manifest is not found or the download fails.
+
+        A HEAD request is issued first to check the manifest's digest against what is already
+        stored in Pulp. Per Docker Hub's pull-rate accounting, a HEAD ("version check") does not
+        count as a pull, unlike a GET. If the manifest is already stored locally, the HEAD
+        response is returned as-is and the counted GET is skipped entirely.
         """
         relative_url = "/v2/{name}/manifests/{pk}".format(
             name=remote.namespaced_upstream_name, pk=pk
         )
         tag_url = urljoin(remote.url, relative_url)
+
+        head_response = self._fetch_manifest_response(remote, tag_url, pk, http_method="head")
+        digest = head_response.headers.get("docker-content-digest")
+        if digest:
+            manifest = models.Manifest.objects.filter(
+                digest=digest, pulp_domain=get_domain()
+            ).first()
+            if manifest is not None:
+                return manifest, head_response
+
+        # The manifest is not stored locally yet, or the upstream did not report a digest on the
+        # HEAD response; fall back to a full GET, identical to the previous behavior.
+        response = self._fetch_manifest_response(remote, tag_url, pk, http_method="get")
+        digest = response.headers.get("docker-content-digest")
+        return models.Manifest.objects.filter(
+            digest=digest, pulp_domain=get_domain()
+        ).first(), response
+
+    def _fetch_manifest_response(self, remote, tag_url, pk, http_method):
+        """
+        Issue a HEAD or GET request for a manifest and map response errors consistently.
+        """
         downloader = remote.get_downloader(url=tag_url)
         try:
-            response = downloader.fetch(extra_data={"headers": V2_ACCEPT_HEADERS})
+            return downloader.fetch(
+                extra_data={"headers": V2_ACCEPT_HEADERS, "http_method": http_method}
+            )
         except ClientResponseError as response_error:
             if response_error.status == 429:
                 # the client could request the manifest outside the docker hub pull limit;
@@ -1497,11 +1526,6 @@ class Manifests(RedirectsMixin, ContainerRegistryApiMixin, ViewSet):
         except (ClientConnectionError, TimeoutException):
             # The remote server is not available at the moment
             raise GatewayTimeout()
-        else:
-            digest = response.headers.get("docker-content-digest")
-            return models.Manifest.objects.filter(
-                digest=digest, pulp_domain=get_domain()
-            ).first(), response
 
     def put(self, request, path, pk=None):
         """

{pulp_container-2.29.1 → pulp_container-2.30.0}/pulp_container/app/viewsets.py

@@ -561,7 +561,7 @@ class TagOperationsMixin:
         responses={202: AsyncOperationResponseSerializer},
     )
     @action(detail=True, methods=["post"], serializer_class=serializers.TagImageSerializer)
-    def tag(self, request, pk):
+    def tag(self, request, pk, **kwargs):
         """
         Create a task which is responsible for creating a new tag.
         """
@@ -592,7 +592,7 @@ class TagOperationsMixin:
         responses={202: AsyncOperationResponseSerializer},
     )
     @action(detail=True, methods=["post"], serializer_class=serializers.UnTagImageSerializer)
-    def untag(self, request, pk):
+    def untag(self, request, pk, **kwargs):
         """
         Create a task which is responsible for untagging an image.
         """
@@ -622,7 +622,7 @@ class SignOperationsMixin:
         responses={202: AsyncOperationResponseSerializer},
     )
     @action(detail=True, methods=["post"], serializer_class=serializers.RepositorySignSerializer)
-    def sign(self, request, pk):
+    def sign(self, request, pk, **kwargs):
         """
         Signs manifests by tag in the repository.
         """
@@ -827,7 +827,7 @@ class ContainerRepositoryViewSet(
         methods=["post"],
         serializer_class=serializers.ContainerRepositorySyncURLSerializer,
     )
-    def sync(self, request, pk):
+    def sync(self, request, pk, **kwargs):
         """
         Synchronizes a repository. The ``repository`` field has to be provided.
         """
@@ -861,7 +861,7 @@ class ContainerRepositoryViewSet(
         responses={202: AsyncOperationResponseSerializer},
     )
     @action(detail=True, methods=["post"], serializer_class=serializers.RecursiveManageSerializer)
-    def add(self, request, pk):
+    def add(self, request, pk, **kwargs):
         """
         Queues a task that creates a new RepositoryVersion by adding content units.
         """
@@ -900,7 +900,7 @@ class ContainerRepositoryViewSet(
         responses={202: AsyncOperationResponseSerializer},
     )
     @action(detail=True, methods=["post"], serializer_class=serializers.RecursiveManageSerializer)
-    def remove(self, request, pk):
+    def remove(self, request, pk, **kwargs):
         """
         Queues a task that creates a new RepositoryVersion by removing content units.
         """
@@ -935,7 +935,7 @@ class ContainerRepositoryViewSet(
         responses={202: AsyncOperationResponseSerializer},
     )
     @action(detail=True, methods=["post"], serializer_class=serializers.TagCopySerializer)
-    def copy_tags(self, request, pk):
+    def copy_tags(self, request, pk, **kwargs):
         """
         Queues a task that creates a new RepositoryVersion by adding Tags.
         """
@@ -968,7 +968,7 @@ class ContainerRepositoryViewSet(
         responses={202: AsyncOperationResponseSerializer},
     )
     @action(detail=True, methods=["post"], serializer_class=serializers.ManifestCopySerializer)
-    def copy_manifests(self, request, pk):
+    def copy_manifests(self, request, pk, **kwargs):
         """
         Queues a task that creates a new RepositoryVersion by adding Manifests.
         """
@@ -1008,7 +1008,7 @@ class ContainerRepositoryViewSet(
         responses={202: AsyncOperationResponseSerializer},
     )
     @action(detail=True, methods=["post"], serializer_class=serializers.OCIBuildImageSerializer)
-    def build_image(self, request, pk):
+    def build_image(self, request, pk, **kwargs):
         """
         Create a task which is responsible for creating a new image and tag.
         """
@@ -1169,7 +1169,7 @@ class ContainerPushRepositoryViewSet(
     @action(
         detail=True, methods=["post"], serializer_class=serializers.MigratePushRepositorySerializer
     )
-    def migrate(self, request, pk):
+    def migrate(self, request, pk, **kwargs):
         """
         Create a task which converts a push repository into a container repository in place.
         """
@@ -1199,7 +1199,7 @@ class ContainerPushRepositoryViewSet(
         responses={202: AsyncOperationResponseSerializer},
     )
     @action(detail=True, methods=["post"], serializer_class=serializers.RemoveImageSerializer)
-    def remove_image(self, request, pk):
+    def remove_image(self, request, pk, **kwargs):
         """
         Create a task which deletes an image by the passed digest.
         """
@@ -1225,7 +1225,7 @@ class ContainerPushRepositoryViewSet(
         return OperationPostponedResponse(result, request)
 
     @action(detail=True, methods=["post"], serializer_class=serializers.RemoveSignaturesSerializer)
-    def remove_signatures(self, request, pk):
+    def remove_signatures(self, request, pk, **kwargs):
         """
         Create a task which deletes signatures by the passed key_id.
         """

{pulp_container-2.29.1 → pulp_container-2.30.0}/pulp_container.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulp-container
-Version: 2.29.1
+Version: 2.30.0
 Summary: Container plugin for the Pulp Project
 Author-email: Pulp Team <pulp-list@redhat.com>
 Project-URL: Homepage, https://pulpproject.org
@@ -18,7 +18,7 @@ Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: jsonschema<4.27,>=4.4
-Requires-Dist: pulpcore<3.130,>=3.111.0
-Requires-Dist: pyjwt[crypto]<2.14,>=2.4
+Requires-Dist: pulpcore<3.130,>=3.118.0
+Requires-Dist: pyjwt[crypto]<2.16,>=2.4
 Requires-Dist: pysequoia<0.2.0,>=0.1.35
 Dynamic: license-file

pulp_container-2.30.0/pulp_container.egg-info/requires.txt

@@ -0,0 +1,4 @@
+jsonschema<4.27,>=4.4
+pulpcore<3.130,>=3.118.0
+pyjwt[crypto]<2.16,>=2.4
+pysequoia<0.2.0,>=0.1.35

{pulp_container-2.29.1 → pulp_container-2.30.0}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = 'setuptools.build_meta'
 
 [project]
 name = "pulp-container"
-version = "2.29.1"
+version = "2.30.0"
 description = "Container plugin for the Pulp Project"
 readme = "README.md"
 authors = [
@@ -24,8 +24,8 @@ classifiers=[
 requires-python = ">=3.11"
 dependencies = [
   "jsonschema>=4.4,<4.27",
-  "pulpcore>=3.111.0,<3.130",
-  "pyjwt[crypto]>=2.4,<2.14",
+  "pulpcore>=3.118.0,<3.130",
+  "pyjwt[crypto]>=2.4,<2.16",
   "pysequoia>=0.1.35,<0.2.0"
 ]
 
@@ -89,7 +89,7 @@ ignore = [
 [tool.bumpversion]
 # This section is managed by the plugin template. Do not edit manually.
 
-current_version = "2.29.1"
+current_version = "2.30.0"
 commit = false
 tag = false
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<alpha>0a)?(?P<patch>\\d+)(\\.(?P<release>[a-z]+))?"

pulp_container-2.29.1/pulp_container.egg-info/requires.txt

@@ -1,4 +0,0 @@
-jsonschema<4.27,>=4.4
-pulpcore<3.130,>=3.111.0
-pyjwt[crypto]<2.14,>=2.4
-pysequoia<0.2.0,>=0.1.35