secustor
e63f40f8b3
`token` and `username`/`password` are not meant to be configured together, but
rank merging of a broad and a specific rule produces a rule carrying both, and
every consumer decided for itself what to do with one. Resolve it once, in
`resolveAuth()`, under a single documented precedence: a `password` wins over a
`token`, with `username` optional because HTTP Basic permits an empty user.
Adopted at the four formatters which already preferred Basic: the HTTP layer's
`applyHostRule()`, the docker datasource, composer's `auth.json` and bundler's
`BUNDLE_*` variables. `basicUserinfo()` and `basicAuthHeaderValue()` replace the
hand-rolled base64 in `util/http/auth.ts` and the docker datasource.
The precedence itself is unchanged at all four. Unifying what counts as a usable
Basic credential does change two of them for a rule that sets `password` without
`username`:
- the docker datasource now sends `Basic base64(":<password>")` for such a rule,
where it previously fell through to the rule's `token`, or sent no credentials
at all - covered by "supports basic authentication for a password without a
username" in lib/modules/datasource/docker/index.spec.ts
- composer now writes an `http-basic` entry with an empty `username` for such a
rule, where it previously wrote nothing - covered by "uses hostRules to set
COMPOSER_AUTH" in lib/modules/manager/composer/artifacts.spec.ts
Both now match what the HTTP layer has always done for the same rule, which is
what authenticates the corresponding lookup. bundler is unaffected, as its
`findAllAuthenticatable()` filter still requires a `username` alongside the
`password`.
`add()` registers the base64 of a password-only credential for sanitizing too,
so the header the widened cases produce is redacted from logs.
This datasource identifies an image's source repository according to the pre-defined annotation keys of the OCI Image Format Specification.
This datasource looks for the metadata of the latest stable image found on the Docker registry and uses the value of the label org.opencontainers.image.source and org.label-schema.vcs-url as the sourceUrl.
Additionally, it uses the value of the label org.opencontainers.image.revision as the gitRef.
The Label Schema is superseded by OCI annotations, use the org.opencontainers.image.source label if possible.
If you maintain a Docker image and want Renovate to find your changelogs, add a org.opencontainers.image.source field to your Dockerfile.
The link must point to your GitHub or GitLab repository.
Here's an example from our renovate/renovate Dockerfile:
LABEL org.opencontainers.image.source="https://github.com/renovatebot/renovate"
If you use Harbor as a proxy cache for Docker Hub, then you must use Harbor version 2.5.0 or higher.