Upgrade self-tests to deal with github.com/oras-project/oras-go v2.6.2 security release: FAIL: TestPushSignature #587

Activity

1. jas4711

   added

   enhancementNew feature or requestNew feature or request

   triageNeeds evaluation for feasibility, timeline, etc.Needs evaluation for feasibility, timeline, etc.

   on Jul 28, 2026
2. Notary-Bot

   added this to Notary Project Planning Boardon Jul 28, 2026
3. github-project-automation

   moved this to Todo in Notary Project Planning Boardon Jul 28, 2026
4. siretart commented on Sep 25, 2026

   

   siretart

   on Sep 25, 2026

   Contributor

   More actions

   We investigated the root cause of this failure in Debian (tracking BTS #1148141).

   Root Cause

   In oras-go v2.6.2, PR #1152 added host validation on the Location header returned by the registry during blob uploads (completePushAfterInitialPost) to prevent credential leakage (GHSA-jxpm-75mh-9fp7).

   In registry/repository_test.go, mockRemoteClient.Do returned a mock http.Response for /v2/test/blobs/uploads/ with:

   Request: &http.Request{
       Header: map[string][]string{},
   },
   Header: map[string][]string{
       "Location": {"test"},
   },

   Because Request.URL is nil, Go's (*http.Response).Location() cannot resolve the relative URL "test" against the base request URL. This leaves location.Host == "" (location.Hostname() == ""), which fails sameUploadHost comparison against req.URL.Hostname() ("localhost"), triggering:

   error = blob upload Location "" is on a different host than the registry "localhost:5000", expectErr = false
   

   Fix

   Passing the incoming Request: req allows resp.Location() to resolve the URL relative to the request. Providing a path under /v2/test/blobs/uploads/test and returning 201 Created for the subsequent PUT satisfies oras-go's host and scheme checks.

   Here is the patch we applied in Debian, which resolves the failure and passes cleanly with both oras-go v2.5.0 and v2.6.2 (and should unblock #585):

   --- a/registry/repository_test.go
   +++ b/registry/repository_test.go
   @@ -156,11 +156,9 @@ func (c mockRemoteClient) Do(req *http.Request) (*http.Response, error) {
    		case validRegistry:
    			return &http.Response{
    				StatusCode: http.StatusAccepted,
    				Body:       io.NopCloser(bytes.NewReader([]byte(msg))),
   -				Request: &http.Request{
   -					Header: map[string][]string{},
   -				},
   +				Request:    req,
    				Header: map[string][]string{
   -					"Location": {"test"},
   +					"Location": {"/v2/test/blobs/uploads/test"},
    				},
    			}, nil
    		default:
   @@ -202,7 +200,7 @@ func (c mockRemoteClient) Do(req *http.Request) (*http.Response, error) {
    				URL:    &url.URL{Path: "/v2/test/referrers/" + zeroDigest},
    			},
    		}, nil
   -	case validRepo:
   +	case "/v2/test/blobs/uploads/test", validRepo:
    		return &http.Response{
    			StatusCode: http.StatusCreated,
    			Body:       io.NopCloser(bytes.NewReader([]byte(msg))),