search

sonatype / nexus-public

Sonatype Nexus Repository Open-source codebase mirror
https://www.sonatype.com/products/repository-oss-download
Eclipse Public License 1.0
1.91k stars 565 forks source link

Failed to configure oci:// url #201

Open arnouthoebreckx opened 1 year ago

arnouthoebreckx commented 1 year ago

Nexus version: 3.38.1 Problem: using oci:// based URLs is not allowed by the UI, even though according to Nexus news OCI should be configurable. References:

We're trying to use "oci://quay.io" based urls to pull helm-charts and docker images from proxy repositories. However the UI interface indicates that http(s) urls should be used as can be seen in the screenshot.

image

Does anyone have any experience with this and/or an example that they can show me?

When using https:// instead of oci:// the repository remains empty and proxying does not work.

Sadly have not found a workaround for this.

nblair commented 1 year ago

Thanks @arnouthoebreckx for opening this issue. We do not currently have official support for oci:// urls through this capability. We'll keep this open to gauge demand and interest from the community.

arnouthoebreckx commented 1 year ago

Hi @nblair,

Is there any way around this? I read in the docs / release notes that there's OCI support, so I assume there's a workaround?

nblair commented 1 year ago

I went and tracked down the Jira issues linked in the release notes you referenced. The title of that Jira ticket is rather vague, but at the time in 2020 "OCI support" meant something different than it likely means today, 3 years later. What was implemented at that time was support for additional media types included in OCI containers. I don't have a workaround for you for oci:// urls at present.

chri4774 commented 11 months ago

Helm Charts from Bitnami have switched to OCI urls. We would appreciate it if Nexus would support this format in a future release.

eshackelford-ias commented 10 months ago

We have been asking Sonatype to implement this since April 2023. Still no sign of this feature.

JuryA commented 8 months ago

Howdy everyone!🙋‍♂️

IMHO: To succinctly convey my viewpoint, it appears that the development team may need a deeper understanding of practical requirements. I recognize the complexity of Nexus beyond a mere Container/OCI registry; however, the imperative need for enhanced OCI Helm Chart support is evident. The prompt integration of the oci:// protocol is essential, considering its advanced security features and alignment with contemporary infrastructure needs.

The current strategy of postponing action until there is wider community interest is somewhat discouraging. The oci:// protocol is notably more robust and secure compared to traditional Helm repositories. Embracing oci:// will markedly diminish the risk of security infringements and provide a more dependable distribution framework for our applications.

Traditionally, Helm repositories, particularly private ones, have the drawback of storing login credentials in an unencrypted format, posing a severe security risk. Prioritizing data confidentiality and integrity is crucial. Transitioning to oci:// will enable us to abandon these obsolete methods in favor of encrypted storage and transmission, thereby adhering to the highest standards of security and compliance in the industry.

augeivv commented 5 months ago

More and more Helm Charts are switching to oci urls. Is there already a plan when Nexus will support oci helm charts?

jastBytes commented 5 months ago

We really really need this feature to be supported. More and more Helm repos are switching to OCI.

tiberium commented 4 months ago

Any update? Important feature, more and more important.

chri4774 commented 4 months ago

We figured out, that you can use the Nexus docker-proxy functionality as a proxy for the oci helm charts. So for the bitnami helm charts where the oci charts are stored in dockerhub (oci://registry-1.docker.io/bitnamicharts/) we did the following:

JuryA commented 4 months ago

Based on Sonatype's current approach to this critical issue, it appears there is little interest in implementing OCI Helm charts. This is unfortunate because, with the growing popularity of Helm OCI and the increasing emphasis on security, combined with Sonatype's lack of active discussion on the matter, it is time to consider migrating to another solution. It is surprising that, although Helm OCI is commonly used with other Docker/OCI registries out of the box, Sonatype still has not adapted and continues to implement a solution that is not fully compatible with the OCI standard. This is indeed regrettable. Nobody wants to stay and wait—security and adherence to standards are crucial.