pulp-container 2.29.3__tar.gz → 2.30.1__tar.gz

{pulp_container-2.29.3 → pulp_container-2.30.1}/CHANGES.md

@@ -8,24 +8,29 @@
 
 [//]: # (towncrier release notes start)
 
-## 2.29.3 (2026-10-28) {: #2.29.3 }
+## 2.30.1 (2026-10-28) {: #2.30.1 }
 
-#### Bugfixes {: #2.29.3-bugfix }
+#### Bugfixes {: #2.30.1-bugfix }
 
 - Allow anonymous pull-through for public distributions
   [#1976](https://github.com/pulp/pulp_container/issues/1976)
 - Container blob downloads now respect each Domain's object storage redirect setting.
 - Fixed pull-through signature lookups failing with a 500 when the upstream registry (e.g. gcr.io) sends unquoted values in its bearer auth challenge.
-- Fixed the registry Authorization header leaking into a shared module-level headers dict, which could send one remote's credentials to another registry.
 - Retried GHCR requests that fail with 403 using a bearer token, and fell back to GET when a registry (e.g. ECR Public) rejects HEAD on blob endpoints.
 - Treat an explicitly empty Accept header like a missing header when retrieving registry blobs.
 
 ---
 
-## 2.29.2 (2026-10-08) {: #2.29.2 }
+## 2.30.0 (2026-10-08) {: #2.30.0 }
 
-#### Bugfixes {: #2.29.2-bugfix }
+#### Features {: #2.30.0-feature }
 
+- Pull-through manifest resolution now uses HEAD checks, reducing Docker Hub 429s for repeated tag resolutions.
+
+#### Bugfixes {: #2.30.0-bugfix }
+
+- Prevent container distributions from overlapping other distribution base paths. Pull-through distributions **NEED** to be fixed before upgrading pulpcore; run `pulpcore-manager container-repair-pull-through-distributions` to repair existing distributions.
+  [#2494](https://github.com/pulp/pulp_container/issues/2494)
 - Fixed global auth token leakage. CVE-2026-103868
 
 ---
@@ -129,6 +134,21 @@
 
 ---
 
+## 2.27.13 (2026-10-07) {: #2.27.13 }
+
+No significant changes.
+
+---
+
+## 2.27.12 (2026-09-23) {: #2.27.12 }
+
+#### Bugfixes {: #2.27.12-bugfix }
+
+- Prevent container distributions from overlapping other distribution base paths. Pull-through distributions **NEED** to be fixed before upgrading pulpcore; run `pulpcore-manager container-repair-pull-through-distributions` to repair existing distributions.
+  [#2494](https://github.com/pulp/pulp_container/issues/2494)
+
+---
+
 ## 2.27.11 (2026-07-29) {: #2.27.11 }
 
 No significant changes.
@@ -249,6 +269,21 @@ No significant changes.
 #### Misc {: #2.27.0-misc }
 
 
+---
+
+## 2.26.18 (2026-10-07) {: #2.26.18 }
+
+No significant changes.
+
+---
+
+## 2.26.17 (2026-09-23) {: #2.26.17 }
+
+#### Bugfixes {: #2.26.17-bugfix }
+
+- Prevent container distributions from overlapping other distribution base paths. Pull-through distributions **NEED** to be fixed before upgrading pulpcore; run `pulpcore-manager container-repair-pull-through-distributions` to repair existing distributions.
+  [#2494](https://github.com/pulp/pulp_container/issues/2494)
+
 ---
 
 ## 2.26.16 (2026-06-08) {: #2.26.16 }
@@ -457,6 +492,21 @@ No significant changes.
 
 ---
 
+## 2.24.14 (2026-10-07) {: #2.24.14 }
+
+No significant changes.
+
+---
+
+## 2.24.13 (2026-09-23) {: #2.24.13 }
+
+#### Bugfixes {: #2.24.13-bugfix }
+
+- Prevent container distributions from overlapping other distribution base paths. Pull-through distributions **NEED** to be fixed before upgrading pulpcore; run `pulpcore-manager container-repair-pull-through-distributions` to repair existing distributions.
+  [#2494](https://github.com/pulp/pulp_container/issues/2494)
+
+---
+
 ## 2.24.12 (2026-07-21) {: #2.24.12 }
 
 #### Bugfixes {: #2.24.12-bugfix }
@@ -595,6 +645,21 @@ No significant changes.
 
 ---
 
+## 2.22.12 (2026-10-07) {: #2.22.12 }
+
+No significant changes.
+
+---
+
+## 2.22.11 (2026-09-23) {: #2.22.11 }
+
+#### Bugfixes {: #2.22.11-bugfix }
+
+- Prevent container distributions from overlapping other distribution base paths. Pull-through distributions **NEED** to be fixed before upgrading pulpcore; run `pulpcore-manager container-repair-pull-through-distributions` to repair existing distributions.
+  [#2494](https://github.com/pulp/pulp_container/issues/2494)
+
+---
+
 ## 2.22.10 (2026-07-23) {: #2.22.10 }
 
 #### Bugfixes {: #2.22.10-bugfix }
@@ -788,6 +853,21 @@ No significant changes.
 
 ---
 
+## 2.20.13 (2026-10-07) {: #2.20.13 }
+
+No significant changes.
+
+---
+
+## 2.20.12 (2026-09-23) {: #2.20.12 }
+
+#### Bugfixes {: #2.20.12-bugfix }
+
+- Prevent container distributions from overlapping other distribution base paths. Pull-through distributions **NEED** to be fixed before upgrading pulpcore; run `pulpcore-manager container-repair-pull-through-distributions` to repair existing distributions.
+  [#2494](https://github.com/pulp/pulp_container/issues/2494)
+
+---
+
 ## 2.20.11 (2026-07-27) {: #2.20.11 }
 
 #### Bugfixes {: #2.20.11-bugfix }
@@ -929,6 +1009,21 @@ No significant changes.
 
 ---
 
+## 2.19.15 (2026-10-07) {: #2.19.15 }
+
+No significant changes.
+
+---
+
+## 2.19.14 (2026-09-23) {: #2.19.14 }
+
+#### Bugfixes {: #2.19.14-bugfix }
+
+- Prevent container distributions from overlapping other distribution base paths. Pull-through distributions **NEED** to be fixed before upgrading pulpcore; run `pulpcore-manager container-repair-pull-through-distributions` to repair existing distributions.
+  [#2494](https://github.com/pulp/pulp_container/issues/2494)
+
+---
+
 ## 2.19.13 (2026-07-27) {: #2.19.13 }
 
 #### Bugfixes {: #2.19.13-bugfix }

{pulp_container-2.29.3 → pulp_container-2.30.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulp-container
-Version: 2.29.3
+Version: 2.30.1
 Summary: Container plugin for the Pulp Project
 Author-email: Pulp Team <pulp-list@redhat.com>
 Project-URL: Homepage, https://pulpproject.org

{pulp_container-2.29.3 → pulp_container-2.30.1}/pulp_container/app/__init__.py

@@ -24,7 +24,7 @@ class PulpContainerPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_container.app"
     label = "container"
-    version = "2.29.3"
+    version = "2.30.1"
     python_package_name = "pulp-container"
     domain_compatible = True
 

{pulp_container-2.29.3 → pulp_container-2.30.1}/pulp_container/app/downloaders.py

@@ -51,7 +51,7 @@ class RegistryAuthHttpDownloader(HttpDownloader):
         headers = {}
         repo_name = None
         if extra_data is not None:
-            headers = dict(extra_data.get("headers", headers))
+            headers = extra_data.get("headers", headers)
             repo_name = extra_data.get("repo_name", None)
         http_method = extra_data.get("http_method", "get") if extra_data is not None else "get"
         this_token = self.factory.registry_auth["bearer"]

{pulp_container-2.29.3 → pulp_container-2.30.1}/pulp_container/app/registry_api.py

@@ -1510,14 +1510,43 @@ class Manifests(RedirectsMixin, ContainerRegistryApiMixin, ViewSet):
         Fetch a manifest from the upstream remote.
         Returns the local manifest, if it exists in Pulp, and the full response from upstream.
         Raises response errors if manifest is not found or the download fails.
+
+        A HEAD request is issued first to check the manifest's digest against what is already
+        stored in Pulp. Per Docker Hub's pull-rate accounting, a HEAD ("version check") does not
+        count as a pull, unlike a GET. If the manifest is already stored locally, the HEAD
+        response is returned as-is and the counted GET is skipped entirely.
         """
         relative_url = "/v2/{name}/manifests/{pk}".format(
             name=remote.namespaced_upstream_name, pk=pk
         )
         tag_url = urljoin(remote.url, relative_url)
+
+        head_response = self._fetch_manifest_response(remote, tag_url, pk, http_method="head")
+        digest = head_response.headers.get("docker-content-digest")
+        if digest:
+            manifest = models.Manifest.objects.filter(
+                digest=digest, pulp_domain=get_domain()
+            ).first()
+            if manifest is not None:
+                return manifest, head_response
+
+        # The manifest is not stored locally yet, or the upstream did not report a digest on the
+        # HEAD response; fall back to a full GET, identical to the previous behavior.
+        response = self._fetch_manifest_response(remote, tag_url, pk, http_method="get")
+        digest = response.headers.get("docker-content-digest")
+        return models.Manifest.objects.filter(
+            digest=digest, pulp_domain=get_domain()
+        ).first(), response
+
+    def _fetch_manifest_response(self, remote, tag_url, pk, http_method):
+        """
+        Issue a HEAD or GET request for a manifest and map response errors consistently.
+        """
         downloader = remote.get_downloader(url=tag_url)
         try:
-            response = downloader.fetch(extra_data={"headers": V2_ACCEPT_HEADERS})
+            return downloader.fetch(
+                extra_data={"headers": V2_ACCEPT_HEADERS, "http_method": http_method}
+            )
         except ClientResponseError as response_error:
             if response_error.status == 429:
                 # the client could request the manifest outside the docker hub pull limit;
@@ -1530,11 +1559,6 @@ class Manifests(RedirectsMixin, ContainerRegistryApiMixin, ViewSet):
         except (ClientConnectionError, TimeoutException):
             # The remote server is not available at the moment
             raise GatewayTimeout()
-        else:
-            digest = response.headers.get("docker-content-digest")
-            return models.Manifest.objects.filter(
-                digest=digest, pulp_domain=get_domain()
-            ).first(), response
 
     def put(self, request, path, pk=None):
         """

{pulp_container-2.29.3 → pulp_container-2.30.1}/pulp_container/app/viewsets.py

@@ -561,7 +561,7 @@ class TagOperationsMixin:
         responses={202: AsyncOperationResponseSerializer},
     )
     @action(detail=True, methods=["post"], serializer_class=serializers.TagImageSerializer)
-    def tag(self, request, pk):
+    def tag(self, request, pk, **kwargs):
         """
         Create a task which is responsible for creating a new tag.
         """
@@ -592,7 +592,7 @@ class TagOperationsMixin:
         responses={202: AsyncOperationResponseSerializer},
     )
     @action(detail=True, methods=["post"], serializer_class=serializers.UnTagImageSerializer)
-    def untag(self, request, pk):
+    def untag(self, request, pk, **kwargs):
         """
         Create a task which is responsible for untagging an image.
         """
@@ -622,7 +622,7 @@ class SignOperationsMixin:
         responses={202: AsyncOperationResponseSerializer},
     )
     @action(detail=True, methods=["post"], serializer_class=serializers.RepositorySignSerializer)
-    def sign(self, request, pk):
+    def sign(self, request, pk, **kwargs):
         """
         Signs manifests by tag in the repository.
         """
@@ -827,7 +827,7 @@ class ContainerRepositoryViewSet(
         methods=["post"],
         serializer_class=serializers.ContainerRepositorySyncURLSerializer,
     )
-    def sync(self, request, pk):
+    def sync(self, request, pk, **kwargs):
         """
         Synchronizes a repository. The ``repository`` field has to be provided.
         """
@@ -861,7 +861,7 @@ class ContainerRepositoryViewSet(
         responses={202: AsyncOperationResponseSerializer},
     )
     @action(detail=True, methods=["post"], serializer_class=serializers.RecursiveManageSerializer)
-    def add(self, request, pk):
+    def add(self, request, pk, **kwargs):
         """
         Queues a task that creates a new RepositoryVersion by adding content units.
         """
@@ -900,7 +900,7 @@ class ContainerRepositoryViewSet(
         responses={202: AsyncOperationResponseSerializer},
     )
     @action(detail=True, methods=["post"], serializer_class=serializers.RecursiveManageSerializer)
-    def remove(self, request, pk):
+    def remove(self, request, pk, **kwargs):
         """
         Queues a task that creates a new RepositoryVersion by removing content units.
         """
@@ -935,7 +935,7 @@ class ContainerRepositoryViewSet(
         responses={202: AsyncOperationResponseSerializer},
     )
     @action(detail=True, methods=["post"], serializer_class=serializers.TagCopySerializer)
-    def copy_tags(self, request, pk):
+    def copy_tags(self, request, pk, **kwargs):
         """
         Queues a task that creates a new RepositoryVersion by adding Tags.
         """
@@ -968,7 +968,7 @@ class ContainerRepositoryViewSet(
         responses={202: AsyncOperationResponseSerializer},
     )
     @action(detail=True, methods=["post"], serializer_class=serializers.ManifestCopySerializer)
-    def copy_manifests(self, request, pk):
+    def copy_manifests(self, request, pk, **kwargs):
         """
         Queues a task that creates a new RepositoryVersion by adding Manifests.
         """
@@ -1008,7 +1008,7 @@ class ContainerRepositoryViewSet(
         responses={202: AsyncOperationResponseSerializer},
     )
     @action(detail=True, methods=["post"], serializer_class=serializers.OCIBuildImageSerializer)
-    def build_image(self, request, pk):
+    def build_image(self, request, pk, **kwargs):
         """
         Create a task which is responsible for creating a new image and tag.
         """
@@ -1169,7 +1169,7 @@ class ContainerPushRepositoryViewSet(
     @action(
         detail=True, methods=["post"], serializer_class=serializers.MigratePushRepositorySerializer
     )
-    def migrate(self, request, pk):
+    def migrate(self, request, pk, **kwargs):
         """
         Create a task which converts a push repository into a container repository in place.
         """
@@ -1199,7 +1199,7 @@ class ContainerPushRepositoryViewSet(
         responses={202: AsyncOperationResponseSerializer},
     )
     @action(detail=True, methods=["post"], serializer_class=serializers.RemoveImageSerializer)
-    def remove_image(self, request, pk):
+    def remove_image(self, request, pk, **kwargs):
         """
         Create a task which deletes an image by the passed digest.
         """
@@ -1225,7 +1225,7 @@ class ContainerPushRepositoryViewSet(
         return OperationPostponedResponse(result, request)
 
     @action(detail=True, methods=["post"], serializer_class=serializers.RemoveSignaturesSerializer)
-    def remove_signatures(self, request, pk):
+    def remove_signatures(self, request, pk, **kwargs):
         """
         Create a task which deletes signatures by the passed key_id.
         """

{pulp_container-2.29.3 → pulp_container-2.30.1}/pulp_container.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulp-container
-Version: 2.29.3
+Version: 2.30.1
 Summary: Container plugin for the Pulp Project
 Author-email: Pulp Team <pulp-list@redhat.com>
 Project-URL: Homepage, https://pulpproject.org

{pulp_container-2.29.3 → pulp_container-2.30.1}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = 'setuptools.build_meta'
 
 [project]
 name = "pulp-container"
-version = "2.29.3"
+version = "2.30.1"
 description = "Container plugin for the Pulp Project"
 readme = "README.md"
 authors = [
@@ -89,7 +89,7 @@ ignore = [
 [tool.bumpversion]
 # This section is managed by the plugin template. Do not edit manually.
 
-current_version = "2.29.3"
+current_version = "2.30.1"
 commit = false
 tag = false
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<alpha>0a)?(?P<patch>\\d+)(\\.(?P<release>[a-z]+))?"