search

confidential-containers / guest-components

Confidential Containers Guest Tools and Components
Apache License 2.0
81 stars 89 forks source link

deps: upgrade oci-distribution to v0.12.0 #665

Closed burgerdev closed 1 month ago

burgerdev commented 1 month ago

This release contains a security fix for confidential pulling of unsigned images: https://github.com/oras-project/rust-oci-client/pull/152.

The upgrade is not trivial, because the crate has been renamed (https://github.com/oras-project/rust-oci-client/issues/142) and there are breaking changes:

Thus, I converted all annotation values from HashMap to BTreeMap, worked around the sigstore::registry::Auth conversion not being implemented for the new crate, and am now passing the stream wrapped by SizedStream.

Xynnn007 commented 1 month ago

@burgerdev Thanks for the patch!

burgerdev commented 1 month ago

I'll hold onto the formatting fix until the other tests ran through.