mirror of
https://github.com/TecharoHQ/anubis.git
synced 2026-02-12 14:59:22 -06:00
b5ead0a68c
* fix(data): add ruleset to explicitly allow Docker / OCI clients Fixes #1252 This is technically a regression as these clients used to work in Anubis v1.22.0, however it is allowable to make this opt-in as most websites do not expect to be serving Docker / OCI registry client traffic. Signed-off-by: Xe Iaso <me@xeiaso.net> * Update metadata check-spelling run (pull_request) for Xe/gh-1252/docker-registry-client-fix Signed-off-by: check-spelling-bot <check-spelling-bot@users.noreply.github.com> on-behalf-of: @check-spelling <check-spelling-bot@check-spelling.dev> * test(docker-registry): export the right envvars Signed-off-by: Xe Iaso <me@xeiaso.net> * ci: add simdjson dependency for homebrew node Signed-off-by: Xe Iaso <me@xeiaso.net> * ci: install go/node without homebrew Signed-off-by: Xe Iaso <me@xeiaso.net> * test: use right github commit variable Signed-off-by: Xe Iaso <me@xeiaso.net> * ci: remove simdjson dependency Signed-off-by: Xe Iaso <me@xeiaso.net> * ci: install ko with an action Signed-off-by: Xe Iaso <me@xeiaso.net> * docs: add OCI registry caveat docs Signed-off-by: Xe Iaso <me@xeiaso.net> --------- Signed-off-by: Xe Iaso <me@xeiaso.net> Signed-off-by: check-spelling-bot <check-spelling-bot@users.noreply.github.com>
26 lines
688 B
YAML
26 lines
688 B
YAML
- name: allow-docker-client
|
|
action: ALLOW
|
|
expression:
|
|
all:
|
|
- path.startsWith("/v2/")
|
|
- userAgent.contains("docker/")
|
|
- userAgent.contains("git-commit/")
|
|
- '"Accept" in headers'
|
|
- headers["Accept"].contains("vnd.docker.distribution")
|
|
- '"Baggage" in headers'
|
|
- headers["Baggage"].contains("trigger")
|
|
|
|
- name: allow-crane-client
|
|
action: ALLOW
|
|
expression:
|
|
all:
|
|
- userAgent.contains("crane/")
|
|
- userAgent.contains("go-containerregistry/")
|
|
|
|
- name: allow-docker-distribution-api-client
|
|
action: ALLOW
|
|
expression:
|
|
all:
|
|
- '"Docker-Distribution-Api-Version" in headers'
|
|
- '!(userAgent.contains("Mozilla"))'
|