Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[release/2.7 backport] Change should to must in v2 spec #3495

Merged
merged 1 commit into from Sep 8, 2021

Conversation

thaJeztah
Copy link
Member

@thaJeztah thaJeztah commented Sep 8, 2021

backport of #3487

We found some examples of manifests with URLs specififed that did
not provide a digest or size. This breaks the security model by allowing
the content to change, as it no longer provides a Merkle tree. This
was not intended, so explicitly disallow by tightening wording.

Signed-off-by: Justin Cormack justin.cormack@docker.com
(cherry picked from commit 1660df4)
Signed-off-by: Sebastiaan van Stijn github@gone.nl

We found some examples of manifests with URLs specififed that did
not provide a digest or size. This breaks the security model by allowing
the content to change, as it no longer provides a Merkle tree. This
was not intended, so explicitly disallow by tightening wording.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
(cherry picked from commit 1660df4)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@thaJeztah
Copy link
Member Author

thaJeztah commented Sep 8, 2021

@milosgajdos @justincormack PTAL

@milosgajdos milosgajdos merged commit 691e62e into distribution:release/2.7 Sep 8, 2021
2 checks passed
@thaJeztah thaJeztah deleted the 2.7_backport_must branch Sep 8, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants