6484 use upstream registry 3.x

[danielhoherd]

Details

Instead of building registry, copy it from upstream. This PR solves the following CVEs:

• CVE-2021-44716
• CVE-2021-44717
• CVE-2022-1705
• CVE-2022-21698
• CVE-2022-23772
• CVE-2022-23806
• CVE-2022-24675
• CVE-2022-24921
• CVE-2022-27664
• CVE-2022-28131
• CVE-2022-28327
• CVE-2022-2880
• CVE-2022-29526
• CVE-2022-30629
• CVE-2022-30631
• CVE-2022-30632
• CVE-2022-30633
• CVE-2022-32148
• CVE-2022-32189
• CVE-2022-41715
• CVE-2022-41717
• CVE-2022-41723
• CVE-2022-41724
• CVE-2022-41725
• CVE-2023-24534
• CVE-2023-24536
• CVE-2023-24538
• CVE-2023-24539
• CVE-2023-24540
• CVE-2023-29400
• CVE-2023-29403
• CVE-2023-29406
• CVE-2023-29409
• CVE-2023-39318
• CVE-2023-39319
• CVE-2023-42366
• CVE-2023-45287
• CVE-2024-51744
• GHSA-77vh-xpmg-72qh
• PRISMA-2022-0164
• PRISMA-2023-0056

The only CVEs that remain are:

• CVE-2023-39325
• CVE-2023-39326
• CVE-2023-45283
• CVE-2023-45284
• CVE-2023-45288
• CVE-2024-12797
• CVE-2024-13176
• CVE-2024-24790
• CVE-2024-34156

Related Issues

• https://github.com/astronomer/issues/issues/6484
• https://github.com/astronomer/issues/issues/6991

Checklist

• version.txt was updated

[pgvishnuram]

@danielhoherd pls dont merge this change without any signoff this has a breaking change

[danielhoherd]

@pgvishnuram if this PR has a problem, we need a ticket describing our unique needs that are not being met by the upstream source code.

[pgvishnuram]

2024/02/05 13:53:18 traces export: Post "https://localhost:4318/v1/traces": dial tcp [::1]:4318: connect: connection refused

to resolve this set below env vars

OTEL_TRACES_EXPORTER=none

[pgvishnuram]

time="2025-04-07T14:28:31.236647995Z" level=error msg="retryingsink: error writing event, retrying" error="httpSink{}: error posting: Post \"\": unsupported protocol scheme \"\"" event="{cb07ad17-2120-44c2-a451-34823aa589e1 2025-04-07 11:28:02.848522344 +0000 UTC m=+180.285628091 push {{application/octet-stream sha256:bc5050d10d9a4450f51f11e34cd88853d4ce30eb4017b58c4a1609b8d2ae1897 5829 [] map[] [] <nil> } 5829 bright-corona-4831/airflow  https://xxxxxxv2/bright-corona-4831/airflow/blobs/sha256:bc5050d10d9a4450f51f11e34cd88853d4ce30eb4017b58c4a1609b8d2ae1897  []} {b0bf515d-b95d-44de-9fc9-bce5e40de407 10.10.5.89 xxxxxxx PUT docker/27.5.1 go/

https://github.com/distribution/distribution/blob/main/docs/content/about/notifications.md

the core problem here seems notification endpoint not being initialized properly

time="2025-04-08T05:08:09.773769171Z" level=info msg="configuring endpoint houston (http://xxxxx-houston:8871/v1/registry/events), timeout=30s, headers=map[Authorization:[XOEnGZ6ybz7VF9XOmw7itDLupxYKSieD]]" go.version=go1.15.15 instance.id=2e8bbfc2-4e6c-4eaa-a9e3-8fd902911ddc service=registry version=v2.7.0-333-g26bdf12d

with new registry

kubectl logs -f deploy/astronomer-registry        
time="2025-04-08T05:16:04.337122675Z" level=info msg="configuring endpoint  (), timeout=0s, headers=map[Authorization:[uHzgdV25z9fYvtMX303WEIkxFj6dJMre]]" go.version=go1.23.7 instance.id=17501583-f01a-40e1-8e34-e887e56a290d service=registry version=3.0.0

the untrusted key error is from code block

https://github.com/distribution/distribution/blob/main/registry/auth/token/token.go#L183-L189

[pgvishnuram]

This is a huge long standing change for us - after 2 years of v2 usage we are finally resynced with upstream

[danielhoherd]

This is a huge long standing change for us - after 2 years of v2 usage we are finally resynced with upstream

@pgvishnuram we've been using 2.x since the beginning, 2020-01-06!

$ git show $(git log --format="%H" -- registry/ | tail -n 1):registry/Dockerfile | grep FROM
FROM registry:2.7.1

[himabindu07]

LGTM