Releases · SUSE/Portus

Highlight

Configuration changes

We have introduced quite some configurable options. Some of them are new, and some other are merely additions to existing ones.

First of all, we have expanded the configuration for the mailer. We are now providing more options so administrators have more flexibility in regards to how they manage SSL/TLS. You can read the update documentation of the mailer here.

Moreover, the delete option has now two new options:

You can allow contributors to delete namespaces/repositories/etc. with the delete.contributors option (it's set to false by default).
The background process can now automatically remove images that are older than a certain date, or that match a given tag. This is disabled by default and it's under the delete.garbage_collector option.

You can read more about this here.

LDAP has also seen some updates. First of all, this release includes the changes described in the 2.3.3 release when it comes to encryption, but it also adds the new timeout option, in which you can tune the timeout in seconds for LDAP lookups. You can read more about this here.

We have also expanded the user_permission section, so administrators can further tune what regular users can do. In more details:

We have added the create_webhook and the manage_webhook options, in order to restrict webhook management (it is not restricted by default).
We have added the push_images option, which accepts three possible values under its policy key:
- allow-teams: the default policy, which works as how Portus used to work up until now: owners and contributors of teams can push.
- allow-personal: team policy is removed, non-admin users will only be able to push into their personal namespaces.
- admin-only: only administrators are allowed to push images.

You can read a summary of the user_permission.push_images option here.

Furthermore, you can now also tune the pagination rule being applied to all UI elements which contain a list (e.g. the list of repositories).

Last but not least, we have increased the default value for the JWT token expiration time, since it has been reported that the default value was just too small.

Moved portusctl into another project

The portusctl tool has been rewritten and moved into its own project. This has allowed us to expand its possibilities, since now it will mainly interact with your Portus instance through the API. The interface of this tool has changed quite a lot, but we kept the ability to execute commands inside of your Portus instance (i.e. the existing exec command). This new tool is already included in Docker images based on this 2.4 version of Portus.

Changes on the API

We have added new endpoints, as you will see on the list below. We would like to highlight the bootstrap endpoint. This endpoint allows an administrator of a Portus instance to create the first admin user of Portus and to fetch an application token that has been created for this same user. This way, you no longer need the UI in order to perform the first steps of your instance.

Besides this, the Portus UI itself is using more and more this API, instead of using a more traditional approach. Last but not least, we have changed existing endpoints with more refined status codes, better response objects, etc. Make sure to visit the API documentation.

Added bots

We have introduced a new concept: bots. Bots are regular users that are created by administrators, but with some subtleties:

A bot doesn't own a personal namespace.
A bot cannot login via web.
A bot can only log in with application tokens (a token is generated
automatically when creating a bot).

Namespace deletion

After much delay, we have implemented namespace deletion. You don't have to change anything from your configuration in order to have this enabled (it depends on the same delete.enabled configuration).

Features

20c7e04 Local login form can be disabled (#1603)
23e4555 webhooks: added the name column (#1581)
53ce896 Allow contributors to delete repositories/tags (#1696)
0c0d46b config: added option to generally disable push access to non-admin users (#1705)
f0432d1 api: added bootstrap endpoint (#1681)
2fcbeda api: added update methods for namespaces and teams (#1794)
c9e3232 Added permissions on webhooks (#1806)
bf4e913 config: removed the deprecated ldap.method key (#1821)
7f82a44 Added the possibility to create bots (#1856)
5ee93c4 background: implemented garbage collector (#1864)
94f7837 Implemented namespace deletion (#1938)

Fixes

0b7a651 api: take the relative url root into account (#1610)
7b28926 api: removed slash duplication from ajax calls (#1628)
57d1f93 health: don't panic on malformed Clair URL (#1665)
e85ed51 Increased the text storage for vulnerabilities (#1670)
02d3873 sync: rollback if events have happened (#1675)
7e60b71 sync: added sync-strategy as a config value (#1675)
459c195 security: don't crash on clair timeouts (#1762)
640e48c security: fetch the manifest more safely (#1768)
b976361 sync: do not remove repositories on some errors (#1787)
83b4b3a ui: fixed hostname copied to clipboard on tags (#1792)
4625761 api: explicitly set 204 status instead of nothing (#1804)
ae80df2 ldap: fixed a couple of bugs around SSL support (#1817)
4c25b23 health: catch all exceptions for registries (#1831)
291b049 ldap: fixed a crash when search fails (#1834)
fc133a4 user: do not allow the update of the portus user (#1896)
cef7f4c passwords: don't allow the portus user to reset (#1896)
67ba269 user: skip validations when creating portus user (#1896)
9af3f22 Restrict deletes into the repository (#1973)

Improvements

9aa3ee2 api: added create and update methods to registries (#1663)
aa3ccb1 background: mark failed scans as re-schedulable (#1671)
54dade9 api: added endpoints for re-scheduling scanning (#1672)
cc6e504 background: add the possibility to disable background tasks (#1679)
e668306 config: make reply_to setting optional (#1699)
07d33f4 policies: added more fine-grained push policies (#1729)
02fec6d teams: improved team creation form with owner (#1776)
10ab345 security: added a table for vulnerabilities (#1778)
ee295ee ui: added users and registries into the sidebar (#1784)
d2d90d4 ui: splitted repositories into different panels (#1785)
6482ed7 ui: unified admin page with regular page (#1783)
6cd886a ui: show external hostname for registries (#1791)
49c6aef authentication: use a more fine-grained scope for Github (#1800)
c524f37 ui: added visibility to namespace edit form (#1826)
a80fbaa ui: added enabled toggle to webhooks edit form (#1827)
a6f6035 health: implemented check for LDAP (#1828)
ccdbd31 js: replaced typeahead.js w/ vue-multiselect (#1811)
ec6adb7 ui: improved and refactored namespace#show page (#1837)
6cd0af5 js: reduced bundle size (#1891)
f777a5e oauth/gitlab: allow to use private gitlab server (#1903)
f1e8a10 oauth/gitlab: be sure to load all groups (#1903)
10cb892 docker: allow Puma to bind to unix socket also in production (#1880)
4b57ad6 docker: make it possible to connect to a database socket (#1880)
82199e9 js: splitted into bundles and chunks (#1924)
990a04e config: raise the default puma workers number (#1938)
688cb50 config: expanded the mailer section (#1967)
bef0fe1 config: added pagination options (#1815)
35ba42f config: added LDAP timeout option (#1821)
6484507 Remind users to login again after password update (#1969)
914cc9e tasks: added portus:db:configure (#1970)
bc28c04 config: raised the value for JWT expiration time (#1979)

Packaging

279de0a Add "js()" to the bundled javascript libs (#1744)
66bcd6a Including gems as sources (#1948)
e3ddaa0 Require portusctl as a separate package (#1948)
a6a3a36 Add automatic generation of bundled js files (#1948)
89566d7 Do not recommend mariadb (#1948)
e350e0c Define rb_suffix before its usage in fix_sheb (#1948)
556778b Using the cpio strategy for adding/removing gems as sources (#1962)

Other

c97663b Removed deprecated code from 2.3 (#1604)
3b912eb help: point to the API documentation on production (#1647)
190edba Introduced unit testing for Javascript components (#1592)
ecca2d9 js: added unit tests for vue components and utils (#1661)
f297fd7 Re-implemented from scratch integration tests (#1716)
d534723 spec: added chrome headless as default js runner (#1866)

93df51c ldap: don't crash on search when guessing an email (#1832)
45814ba packaging: added new encryption options for LDAP
4892eb1 ldap: fixed a couple of bugs around SSL support (#1746, #1774, bsc#1073232)
dc769ad devise: use a more fine-grained scope for Github (#1790)
ae07ec4 sync: do not remove repositories on some errors (#1293, #1599)
17e82c0 lib: be explicit on the exceptions to be rescued
88553b8 portusctl: added Clair timeout to the options
fed2818 security: fetch the manifest more safely (#1743)
943c762 security: don't crash on clair timeouts (#1751)

Words of warning

Commits 45814ba and 4892eb1 introduce some new options for LDAP. In
particular, the following options have been added inside of the ldap
configuration:

  # Encryption options
  encryption:
    # Available methods: "plain", "simple_tls" and "start_tls".
    method: ""
    options:
      # The CA file to be accepted by the LDAP server. If none is provided, then
      # the default parameters from the host will be sent.
      ca_file: ""

      # Protocol version.
      ssl_version: "TLSv1_2"

Notice that the old ldap.method is getting deprecated and in later versions it
will be removed. Thus, you should use these options from now on.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Highlight

Configuration changes

Moved portusctl into another project

Changes on the API

Added bots

Namespace deletion

Features

Fixes

Improvements

Packaging

Other

Fixes

Words of warning

Security fixes

Releases: SUSE/Portus

2.4.3

2.4.2

2.4.1

2.3.7

2.4.0

Highlight

Configuration changes

Moved portusctl into another project

Changes on the API

Added bots

Namespace deletion

Features

Fixes

Improvements

Packaging

Other

2.3.6

Fixes

2.3.5

2.3.4

2.3.3

Words of warning

2.3.2

Security fixes