From 1c5e8bf0b876832af25ee8acd13685cd6e85dc94 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 10 Sep 2026 20:49:17 +0000 Subject: [PATCH] Update module github.com/buildpacks/lifecycle to v0.21.19 --- go.mod | 2 +- go.sum | 4 +-- .../buildpacks/lifecycle/auth/keychain.go | 33 ++++++++++++++++++- vendor/modules.txt | 2 +- 4 files changed, 36 insertions(+), 5 deletions(-) diff --git a/go.mod b/go.mod index 4c3e7322..eff205c4 100644 --- a/go.mod +++ b/go.mod @@ -8,7 +8,7 @@ require ( code.cloudfoundry.org/credhub-cli v0.0.0-20260907130120-567c46b571cd github.com/BurntSushi/toml v1.6.0 github.com/apex/log v1.9.0 - github.com/buildpacks/lifecycle v0.21.18 + github.com/buildpacks/lifecycle v0.21.19 github.com/buildpacks/pack v0.40.9 github.com/cespare/xxhash/v2 v2.3.0 github.com/google/go-containerregistry v0.22.1 diff --git a/go.sum b/go.sum index b83a6b0c..744af32f 100644 --- a/go.sum +++ b/go.sum @@ -165,8 +165,8 @@ github.com/breml/errchkjson v0.4.1 h1:keFSS8D7A2T0haP9kzZTi7o26r7kE3vymjZNeNDRDw github.com/breml/errchkjson v0.4.1/go.mod h1:a23OvR6Qvcl7DG/Z4o0el6BRAjKnaReoPQFciAl9U3s= github.com/buildpacks/imgutil v0.0.0-20260821195038-6047007ed8ea h1:oIHYIoJ1AvebKHBlu4QC+HR+pjp+7+D0eWO0KB6D3Vc= github.com/buildpacks/imgutil v0.0.0-20260821195038-6047007ed8ea/go.mod h1:EBy9ZOatKkTBAWOgN2Y0aNV4P40dOdGyzzB9q2a5HBE= -github.com/buildpacks/lifecycle v0.21.18 h1:x7LqIWbyjRM5OOwzr9eDNfHzFNpzVFeX3RMJkukRdUg= -github.com/buildpacks/lifecycle v0.21.18/go.mod h1:CxO2g38oLfT/bWjr/rXWjxC/KtLp7zZR1idzQbunKBE= +github.com/buildpacks/lifecycle v0.21.19 h1:3/K9+j6GZ9CoLcF0YJn8g48uCk3YI+IOj5nfttJChIU= +github.com/buildpacks/lifecycle v0.21.19/go.mod h1:BdjcYmS7rW8T5DyA6IGlomQJxsk5yQHzFX9J5h3shvQ= github.com/buildpacks/pack v0.40.9 h1:DNgCI19uIZuuQL9QEZA30xBdCVGx8G4tl01dkHwKOwg= github.com/buildpacks/pack v0.40.9/go.mod h1:X+FKtQMkkWcRdKLmICxgetDlccor+zbbu3jVAMKHCDc= github.com/butuzov/ireturn v0.4.1 h1:vWb3NO4t77iku/sjCQ/2pHTQeOmxEhjIriJqRLg1Y+I= diff --git a/vendor/github.com/buildpacks/lifecycle/auth/keychain.go b/vendor/github.com/buildpacks/lifecycle/auth/keychain.go index ef21accc..7fffb086 100644 --- a/vendor/github.com/buildpacks/lifecycle/auth/keychain.go +++ b/vendor/github.com/buildpacks/lifecycle/auth/keychain.go @@ -5,6 +5,7 @@ import ( "encoding/json" "fmt" "io" + "net/url" "os" "regexp" "strings" @@ -23,9 +24,39 @@ const EnvRegistryAuthKeychainSkipFormat = "CNB_REGISTRY_AUTH_KEYCHAIN_SKIP_%s" var ( amazonKeychain = authn.NewKeychainFromHelper(ecr.NewECRHelper(ecr.WithLogger(io.Discard))) - azureKeychain = authn.NewKeychainFromHelper(credhelper.NewACRCredentialsHelper()) + azureKeychain = &acrHostnameGuardedKeychain{ + keychain: authn.NewKeychainFromHelper(credhelper.NewACRCredentialsHelper()), + } ) +// acrHostnameMatcher matches genuine Azure Container Registry hostnames. +// It is anchored (unlike the check performed by the vendored +// github.com/chrismellard/docker-credential-acr-env credential helper, see GO-2026-6225) +// so that a spoofed registry such as "evil.azurecr.io.attacker.com" is not mistaken for +// a real ACR host. +var acrHostnameMatcher = regexp.MustCompile(`^([a-zA-Z0-9-]+\.)*azurecr\.(io|cn|de|us)$|^mcr\.microsoft\.com$`) + +// acrHostnameGuardedKeychain wraps an authn.Keychain backed by the ACR credential helper +// and only forwards resolution to it for hostnames that are genuinely Azure Container +// Registry hosts. The underlying helper validates hostnames with an unanchored regex, so +// without this guard a registry such as "evil.azurecr.io.attacker.com" would be treated +// as a real ACR host and would receive the Azure AD access token that ACR credential +// resolution acquires. +type acrHostnameGuardedKeychain struct { + keychain authn.Keychain +} + +func (k *acrHostnameGuardedKeychain) Resolve(resource authn.Resource) (authn.Authenticator, error) { + hostname := resource.RegistryStr() + if parsed, err := url.Parse("https://" + hostname); err == nil { + hostname = parsed.Hostname() + } + if !acrHostnameMatcher.MatchString(hostname) { + return authn.Anonymous, nil + } + return k.keychain.Resolve(resource) +} + // DefaultKeychain returns a keychain containing authentication configuration for the given images // from the following sources, if they exist, in order of precedence: // the provided environment variable diff --git a/vendor/modules.txt b/vendor/modules.txt index 6d6f5e07..d38b2aab 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -334,7 +334,7 @@ github.com/buildpacks/imgutil/layout github.com/buildpacks/imgutil/layout/sparse github.com/buildpacks/imgutil/local github.com/buildpacks/imgutil/remote -# github.com/buildpacks/lifecycle v0.21.18 +# github.com/buildpacks/lifecycle v0.21.19 ## explicit; go 1.26.6 github.com/buildpacks/lifecycle/api github.com/buildpacks/lifecycle/archive