Add explicit size checks before casting long values to int in
Content.of(File) and LogUpdateEvent.read() to prevent silent data
corruption or NegativeArraySizeException when processing large files
or malformed Docker stream data.
See gh-50382
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
Update zip and tar handling in buildpack code to ensure that archive
entries cannot be written outside of the expected destination.
Although we consider buildpacks to be trusted, this update will help
protect against corrupt archives.
Closes gh-50141
Before this commit, "cmd /c" was never added to the final command,
which meant the Docker credential helper was not executed correctly.
See gh-48965
Signed-off-by: Dmytro Nosan <dimanosan@gmail.com>
Update `DockerApi` and `Builder` to support export of images with a
specified platform. This prevents 'NotFound: content digest sha256:'
errors when building an amd64 image on an arm64 machine.
Fixes gh-46665
Update `DockerApi` so that the URL uses version `v1.50` whenever
possible. Prior to this commit, `v1.24` was often used which breaks
recent Docker installs due to the dropping of API version v1.43 and
below.
If the actual API version running is less than `v1.50`, but greater
than the minimum required for the API call, it will be used instead.
This hopefully means that older versions of Docker will continue to
work as they did previously.
Fixes gh-48050
Prior to this commit, performing a build on a ARM Mac with the default
configuration and then building it again with the image platform set to
`linux/amd64` results in an "Image platform mismatch detected" failure.
This is due to the fact that `docker inspect` returns JSON for the
default platform, regardless of the fact that another architecture
has been pulled.
To solve the issue, the `inspect` API call on Docker 1.49+ can now
accept a platform query parameter which when specified returns platform
specific JSON.
At the time of this commit, the Docker API documentation hasn't been
updated, despite PR https://github.com/moby/moby/pull/49586 being
merged.
In addition to using the correct inspect JSON, we also need to pin
the run image we use to a specific digest. Without doing this,
buildpacks revert back to the default platform image and
"content digest not found" errors are thrown (similar to
https://github.com/buildpacks/docs/issues/818).
See gh-47292
Signed-off-by: hojooo <ghwn5833@gmail.com>
Refine error handling logic so that HTTP 407 (Proxy Authentication
Required) responses from the Docker daemon are treated as plain
text rather than JSON.
See gh-47180
Signed-off-by: Siva Sai Udayagiri <udayagirishivasai@gmail.com>
Before this commit, the credential helper used the serverUrl from
the Map.Entry<String,Auth> as a fallback. However, the helper only uses
the email from the auths.
See gh-45345
Signed-off-by: Dmytro Nosan <dimanosan@gmail.com>
Sebastien Tardif
Phillip Webb
Yanming Zhou
Andy Wilkinson
Dmytro Nosan
Stéphane Nicoll
高春晖
Johnny Lim
hojooo
SSUday
Vincent Potucek
Moritz Halbritter