Update reserved usernames list #18438

Gusted · 2022-01-28T03:17:06Z

Adding additional usernames which are already routes, it's safe to add them as any existing users should already have been "broken"(shouldn't be able to access profile etc.)

- Adding additional usernames which are already routes, it's safe to add them as any existing users should already have been "broken"(shouldn't be able to access profile etc.)

wxiaoguang · 2022-01-28T03:40:49Z

It's better to use the char ~ for all new paths in future, then we do not need to reserve anything more.

wxiaoguang · 2022-01-28T03:42:24Z

Why serviceworker.js was reserved, it's under /assets/

(I mean the old code, since we are improving the code, maybe we could improve the legacy together)

Gusted · 2022-01-28T03:45:47Z

Why serviceworker.js was reserved, it's under /assets/

Was introduced in #15834 #15834 (comment)

wxiaoguang · 2022-01-28T03:54:29Z

Why serviceworker.js was reserved, it's under /assets/

Was introduced in #15834 #15834 (comment)

I can not get the point why should we keep it in the latest code base, maybe it's time to remove it?

And "less" (maybe more) could also be removed.

Gusted · 2022-01-28T04:08:34Z

I can not get the point why should we keep it in the latest code base, maybe it's time to remove it?

🤷🏽‍♀️ I'm not sure, better to leave it in then or silverwind gives the green light.

models/user/user.go

lunny · 2022-01-28T06:52:12Z

help and plugins should be kept for future usage.

wxiaoguang · 2022-01-28T06:55:53Z

help and plugins should be kept for future usage.

What about using the char ~ for all new paths in future, then we do not need to reserve anything more.

For example: /~plugins/, no conflict anymore, no one would be hurt.

lunny · 2022-01-28T07:04:47Z

Or /-/ :)

wxiaoguang · 2022-01-28T07:43:39Z

Yep, /-/ is also widely used in many systems.

Gusted · 2022-01-28T10:29:38Z

So the removal of those "futured reserved names" is good?

lunny · 2022-01-28T13:58:23Z

So the removal of those "futured reserved names" is good?

After we have an agreement of /-/.

wxiaoguang · 2022-01-28T14:16:31Z

From my experience, if we say about "agreement", most people just keep silence, a few people just disagree for no reason explained, then many useful ideas cannot be made to an agreement.

Gusted · 2022-01-28T15:54:53Z

From my experience, if we say about "agreement", most people just keep silence, a few people just disagree for no reason explained, then many useful ideas cannot be made to an agreement.

Well, what about documenting a similar idea/process as Go has? https://github.com/golang/proposal#the-proposal-process whereby it's a "simple" agreed if nobody has a objection to it. Such that certain changes can be discussed and actually being worked on instead of being stalled because nobody wants to speak up.

wxiaoguang · 2022-01-28T16:11:46Z

Most communities have similar processes. besides Golang, there are Python PEP https://www.python.org/dev/peps/#meta-peps-peps-about-peps-or-processes , PHP RFC https://wiki.php.net/rfc , etc.

If Gitea can have such documents, it would help, however, such documents need an agreement again. I hope we can get right things done and move on.

wxiaoguang · 2022-01-29T03:07:33Z

Well, some comments are a liitle off-topic. Let back to this PR.

I think @lunny @Gusted and I all agree we can use /-/ in future and do not reserve any name, and remove the unused reserved names. Am I right?

And @go-gitea/maintainers , does any one have objection and new suggestions?

KN4CK3R · 2022-01-29T12:34:14Z

For the Docker/Open Container api I will need /v2/ (https://docs.docker.com/registry/spec/api/) and you can't change that to something else (like /<user>/v2).

zeripath · 2022-01-29T12:58:22Z

not even /api/v2?

KN4CK3R · 2022-01-29T13:09:34Z

The last time I checked this I did not find a way. Here is the Gitlab change for example: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/10422 But I will test it again tomorrow.

KN4CK3R · 2022-01-31T13:38:12Z

Tested it again. The official Docker server has support for a different endpoint but the Docker CLI does not support it.
The spec does not allow a prefix too: https://github.com/opencontainers/distribution-spec/blob/v1.0.0/spec.md#api

Compose file:

version: '3'

services:
  docker-registry:
    image: registry:2
    environment:
      - REGISTRY_HTTP_PREFIX=/test/sub/

Opening <domain>/test/sub/v2 in a browser yields the expected JSON response.

docker tag ubuntu:latest <domain>/test/sub/ubuntu:latest
docker push <domain>/test/sub/ubuntu:latest

results in

"GET /v2/ HTTP/1.1" 404 19 "" "docker/20.10.12 go/go1.16.12 git-commit/459d0df kernel/5.10.60.1-microsoft-standard-WSL2 os/linux arch/amd64 UpstreamClient(Docker-Client/20.10.12 \\(windows\\))"
"HEAD /v2/test/sub/ubuntu/blobs/sha256:f3ef4ff62e0da0ef761ec1c8a578f3035bef51043e53ae1b13a20b3e03726d17 HTTP/1.1" 404 19 "" "docker/20.10.12 go/go1.16.12 git-commit/459d0df kernel/5.10.60.1-microsoft-standard-WSL2 os/linux arch/amd64 UpstreamClient(Docker-Client/20.10.12 \\(windows\\))"
"POST /v2/test/sub/ubuntu/blobs/uploads/ HTTP/1.1" 404 19 "" "docker/20.10.12 go/go1.16.12 git-commit/459d0df kernel/5.10.60.1-microsoft-standard-WSL2 os/linux arch/amd64 UpstreamClient(Docker-Client/20.10.12 \\(windows\\))"

The CLI does not know about the prefix and prepends the v2.

References:
kubernetes/ingress-nginx#4027
https://stackoverflow.com/questions/65888391/docker-registry-with-prefix-has-problem-with-docker-login
docker/cli#3255

lunny · 2022-01-31T14:14:46Z

Tested it again. The official Docker server has support for a different endpoint but the Docker CLI does not support it. The spec does not allow a prefix too: https://github.com/opencontainers/distribution-spec/blob/v1.0.0/spec.md#api

Compose file:
version: '3'

services:
  docker-registry:
    image: registry:2
    environment:
      - REGISTRY_HTTP_PREFIX=/test/sub/
Opening <domain>/test/sub/v2 in a browser yields the expected JSON response.
docker tag ubuntu:latest <domain>/test/sub/ubuntu:latest
docker push <domain>/test/sub/ubuntu:latest
results in
"GET /v2/ HTTP/1.1" 404 19 "" "docker/20.10.12 go/go1.16.12 git-commit/459d0df kernel/5.10.60.1-microsoft-standard-WSL2 os/linux arch/amd64 UpstreamClient(Docker-Client/20.10.12 \\(windows\\))"
"HEAD /v2/test/sub/ubuntu/blobs/sha256:f3ef4ff62e0da0ef761ec1c8a578f3035bef51043e53ae1b13a20b3e03726d17 HTTP/1.1" 404 19 "" "docker/20.10.12 go/go1.16.12 git-commit/459d0df kernel/5.10.60.1-microsoft-standard-WSL2 os/linux arch/amd64 UpstreamClient(Docker-Client/20.10.12 \\(windows\\))"
"POST /v2/test/sub/ubuntu/blobs/uploads/ HTTP/1.1" 404 19 "" "docker/20.10.12 go/go1.16.12 git-commit/459d0df kernel/5.10.60.1-microsoft-standard-WSL2 os/linux arch/amd64 UpstreamClient(Docker-Client/20.10.12 \\(windows\\))"
The CLI does not know about the prefix and prepends the v2.

References: kubernetes/ingress-nginx#4027 https://stackoverflow.com/questions/65888391/docker-registry-with-prefix-has-problem-with-docker-login docker/cli#3255

So we need to add v2 as reserved name.

lunny · 2022-03-28T07:05:41Z

OK. Some instances may want to customize their reserved names list. So we may could also add a new list in ini configuration.

Gusted · 2022-03-28T11:16:15Z

OK. Some instances may want to customize their reserved names list. So we may could also add a new list in ini configuration.

Should that be added within this PR? Seems like a good idea.

lunny · 2022-03-28T11:48:37Z

OK. Some instances may want to customize their reserved names list. So we may could also add a new list in ini configuration.

Should that be added within this PR? Seems like a good idea.

A standalone PR maybe reviewed faster.

* giteaofficial/main: Update reserved usernames list (go-gitea#18438) Configure OpenSSH log level via Environment in Docker (go-gitea#19274) Use a more general (and faster) method to sanitize URLs with credentials (go-gitea#19239) [skip ci] Updated translations via Crowdin fix link to package registry docs (go-gitea#19268) Add Redis Sentinel Authentication Support (go-gitea#19213)

Update reserved usernames list

6e634cb

- Adding additional usernames which are already routes, it's safe to add them as any existing users should already have been "broken"(shouldn't be able to access profile etc.)

Gusted added the type/enhancement An improvement of existing functionality label Jan 28, 2022

Gusted added this to the 1.17.0 milestone Jan 28, 2022

Merge branch 'main' into update-reserved-usernames

0da0faf

GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Jan 28, 2022

wxiaoguang approved these changes Jan 28, 2022

View reviewed changes

GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Jan 28, 2022

Remove entries

71d3c3d

lafriks reviewed Jan 28, 2022

View reviewed changes

models/user/user.go Show resolved Hide resolved

zeripath added 2 commits March 4, 2022 22:21

Merge branch 'main' into update-reserved-usernames

b8017ed

Merge branch 'main' into update-reserved-usernames

873c8ac

Gusted mentioned this pull request Mar 27, 2022

Add repo-avatars to reserved usernames #19230

Closed

zeripath approved these changes Mar 27, 2022

View reviewed changes

GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Mar 27, 2022

zeripath added 2 commits March 27, 2022 13:54

Merge branch 'main' into update-reserved-usernames

d6bf1f0

Merge branch 'main' into update-reserved-usernames

3963ca7

lunny added the pr/breaking Merging this PR means builds will break. Needs a description what exactly breaks, and how to fix it! label Mar 28, 2022

Merge branch 'main' into update-reserved-usernames

3fb6e2a

Gusted and others added 3 commits March 28, 2022 14:41

Fix test

3caf5f8

Merge branch 'main' into update-reserved-usernames

b3ee342

Merge branch 'main' into update-reserved-usernames

cafa43b

6543 approved these changes Mar 29, 2022

View reviewed changes

lunny and others added 6 commits March 29, 2022 19:39

Merge branch 'main' into update-reserved-usernames

3a08550

Merge branch 'main' into update-reserved-usernames

0a86c98

Merge branch 'main' into update-reserved-usernames

be59dc6

Merge branch 'main' into update-reserved-usernames

63790a7

Merge branch 'main' into update-reserved-usernames

0565fb0

Merge branch 'main' into update-reserved-usernames

8834f69

wxiaoguang approved these changes Mar 31, 2022

View reviewed changes

wxiaoguang merged commit 43332a4 into go-gitea:main Mar 31, 2022

go-gitea locked and limited conversation to collaborators Apr 28, 2022

Gusted deleted the update-reserved-usernames branch July 30, 2022 19:57

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update reserved usernames list #18438

Update reserved usernames list #18438

Gusted commented Jan 28, 2022

wxiaoguang commented Jan 28, 2022

wxiaoguang commented Jan 28, 2022 •

edited

Gusted commented Jan 28, 2022

wxiaoguang commented Jan 28, 2022

Gusted commented Jan 28, 2022

lunny commented Jan 28, 2022

wxiaoguang commented Jan 28, 2022

lunny commented Jan 28, 2022

wxiaoguang commented Jan 28, 2022

Gusted commented Jan 28, 2022

lunny commented Jan 28, 2022

wxiaoguang commented Jan 28, 2022

Gusted commented Jan 28, 2022

wxiaoguang commented Jan 28, 2022

wxiaoguang commented Jan 29, 2022

KN4CK3R commented Jan 29, 2022

zeripath commented Jan 29, 2022

KN4CK3R commented Jan 29, 2022

KN4CK3R commented Jan 31, 2022

lunny commented Jan 31, 2022

lunny commented Mar 28, 2022

Gusted commented Mar 28, 2022

lunny commented Mar 28, 2022

Update reserved usernames list #18438

Update reserved usernames list #18438

Conversation

Gusted commented Jan 28, 2022

wxiaoguang commented Jan 28, 2022

wxiaoguang commented Jan 28, 2022 • edited

Gusted commented Jan 28, 2022

wxiaoguang commented Jan 28, 2022

Gusted commented Jan 28, 2022

lunny commented Jan 28, 2022

wxiaoguang commented Jan 28, 2022

lunny commented Jan 28, 2022

wxiaoguang commented Jan 28, 2022

Gusted commented Jan 28, 2022

lunny commented Jan 28, 2022

wxiaoguang commented Jan 28, 2022

Gusted commented Jan 28, 2022

wxiaoguang commented Jan 28, 2022

wxiaoguang commented Jan 29, 2022

KN4CK3R commented Jan 29, 2022

zeripath commented Jan 29, 2022

KN4CK3R commented Jan 29, 2022

KN4CK3R commented Jan 31, 2022

lunny commented Jan 31, 2022

lunny commented Mar 28, 2022

Gusted commented Mar 28, 2022

lunny commented Mar 28, 2022

wxiaoguang commented Jan 28, 2022 •

edited