Commit graph

158 commits

Author SHA1 Message Date
renovate[bot]
97a7438ab1
fix(deps): update module github.com/golang-jwt/jwt/v4 to v5 (#2449)
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [github.com/golang-jwt/jwt/v4](https://togithub.com/golang-jwt/jwt) |
require | major | `v4.5.0` -> `v5.0.0` |

---

### ⚠ Dependency Lookup Warnings ⚠

Warnings were logged while processing this repo. Please check the
Dependency Dashboard for more information.

---

### Release Notes

<details>
<summary>golang-jwt/jwt (github.com/golang-jwt/jwt/v4)</summary>

### [`v5.0.0`](https://togithub.com/golang-jwt/jwt/releases/tag/v5.0.0)

[Compare
Source](https://togithub.com/golang-jwt/jwt/compare/v4.5.0...v5.0.0)

### 🚀 New Major Version `v5` 🚀

It's finally here, the release you have been waiting for! We don't take
breaking changes lightly, but the changes outlined below were necessary
to address some of the challenges of the previous API. A big thanks for
[@&#8203;mfridman](https://togithub.com/mfridman) for all the reviews,
all contributors for their commits and of course
[@&#8203;dgrijalva](https://togithub.com/dgrijalva) for the original
code. I hope we kept some of the spirit of your original `v4` branch
alive in the approach we have taken here.
\~[@&#8203;oxisto](https://togithub.com/oxisto), on behalf of
[@&#8203;golang-jwt/maintainers](https://togithub.com/golang-jwt/maintainers)

Version `v5` contains a major rework of core functionalities in the
`jwt-go` library. This includes support for several validation options
as well as a re-design of the `Claims` interface. Lastly, we reworked
how errors work under the hood, which should provide a better overall
developer experience.

Starting from
[v5.0.0](https://togithub.com/golang-jwt/jwt/releases/tag/v5.0.0), the
import path will be:

    "github.com/golang-jwt/jwt/v5"

For most users, changing the import path *should* suffice. However,
since we intentionally changed and cleaned some of the public API,
existing programs might need to be updated. The following sections
describe significant changes and corresponding updates for existing
programs.

#### Parsing and Validation Options

Under the hood, a new `validator` struct takes care of validating the
claims. A long awaited feature has been the option to fine-tune the
validation of tokens. This is now possible with several `ParserOption`
functions that can be appended to most `Parse` functions, such as
`ParseWithClaims`. The most important options and changes are:

- Added `WithLeeway` to support specifying the leeway that is allowed
when validating time-based claims, such as `exp` or `nbf`.
- Changed default behavior to not check the `iat` claim. Usage of this
claim is OPTIONAL according to the JWT RFC. The claim itself is also
purely informational according to the RFC, so a strict validation
failure is not recommended. If you want to check for sensible values in
these claims, please use the `WithIssuedAt` parser option.
- Added `WithAudience`, `WithSubject` and `WithIssuer` to support
checking for expected `aud`, `sub` and `iss`.
- Added `WithStrictDecoding` and `WithPaddingAllowed` options to allow
previously global settings to enable base64 strict encoding and the
parsing of base64 strings with padding. The latter is strictly speaking
against the standard, but unfortunately some of the major identity
providers issue some of these incorrect tokens. Both options are
disabled by default.

#### Changes to the `Claims` interface

##### Complete Restructuring

Previously, the claims interface was satisfied with an implementation of
a `Valid() error` function. This had several issues:

- The different claim types (struct claims, map claims, etc.) then
contained similar (but not 100 % identical) code of how this validation
was done. This lead to a lot of (almost) duplicate code and was hard to
maintain
- It was not really semantically close to what a "claim" (or a set of
claims) really is; which is a list of defined key/value pairs with a
certain semantic meaning.

Since all the validation functionality is now extracted into the
validator, all `VerifyXXX` and `Valid` functions have been removed from
the `Claims` interface. Instead, the interface now represents a list of
getters to retrieve values with a specific meaning. This allows us to
completely decouple the validation logic with the underlying storage
representation of the claim, which could be a struct, a map or even
something stored in a database.

```go
type Claims interface {
	GetExpirationTime() (*NumericDate, error)
	GetIssuedAt() (*NumericDate, error)
	GetNotBefore() (*NumericDate, error)
	GetIssuer() (string, error)
	GetSubject() (string, error)
	GetAudience() (ClaimStrings, error)
}
```

##### Supported Claim Types and Removal of `StandardClaims`

The two standard claim types supported by this library, `MapClaims` and
`RegisteredClaims` both implement the necessary functions of this
interface. The old `StandardClaims` struct, which has already been
deprecated in `v4` is now removed.

Users using custom claims, in most cases, will not experience any
changes in the behavior as long as they embedded `RegisteredClaims`. If
they created a new claim type from scratch, they now need to implemented
the proper getter functions.

##### Migrating Application Specific Logic of the old `Valid`

Previously, users could override the `Valid` method in a custom claim,
for example to extend the validation with application-specific claims.
However, this was always very dangerous, since once could easily disable
the standard validation and signature checking.

In order to avoid that, while still supporting the use-case, a new
`ClaimsValidator` interface has been introduced. This interface consists
of the `Validate() error` function. If the validator sees, that a
`Claims` struct implements this interface, the errors returned to the
`Validate` function will be *appended* to the regular standard
validation. It is not possible to disable the standard validation
anymore (even only by accident).

Usage examples can be found in [example_test.go](./example_test.go), to
build claims structs like the following.

```go
// MyCustomClaims includes all registered claims, plus Foo.
type MyCustomClaims struct {
	Foo string `json:"foo"`
	jwt.RegisteredClaims
}

// Validate can be used to execute additional application-specific claims
// validation.
func (m MyCustomClaims) Validate() error {
	if m.Foo != "bar" {
		return errors.New("must be foobar")
	}

	return nil
}
```

#### Changes to the `Token` and `Parser` struct

The previously global functions `DecodeSegment` and `EncodeSegment` were
moved to the `Parser` and `Token` struct respectively. This will allow
us in the future to configure the behavior of these two based on options
supplied on the parser or the token (creation). This also removes two
previously global variables and moves them to parser options
`WithStrictDecoding` and `WithPaddingAllowed`.

In order to do that, we had to adjust the way signing methods work.
Previously they were given a base64 encoded signature in `Verify` and
were expected to return a base64 encoded version of the signature in
`Sign`, both as a `string`. However, this made it necessary to have
`DecodeSegment` and `EncodeSegment` global and was a less than perfect
design because we were repeating encoding/decoding steps for all signing
methods. Now, `Sign` and `Verify` operate on a decoded signature as a
`[]byte`, which feels more natural for a cryptographic operation anyway.
Lastly, `Parse` and `SignedString` take care of the final
encoding/decoding part.

In addition to that, we also changed the `Signature` field on `Token`
from a `string` to `[]byte` and this is also now populated with the
decoded form. This is also more consistent, because the other parts of
the JWT, mainly `Header` and `Claims` were already stored in decoded
form in `Token`. Only the signature was stored in base64 encoded form,
which was redundant with the information in the `Raw` field, which
contains the complete token as base64.

```go
type Token struct {
	Raw       string                 // Raw contains the raw token
	Method    SigningMethod          // Method is the signing method used or to be used
	Header    map[string]interface{} // Header is the first segment of the token in decoded form
	Claims    Claims                 // Claims is the second segment of the token in decoded form
	Signature []byte                 // Signature is the third segment of the token in decoded form
	Valid     bool                   // Valid specifies if the token is valid
}
```

Most (if not all) of these changes should not impact the normal usage of
this library. Only users directly accessing the `Signature` field as
well as developers of custom signing methods should be affected.

#### What's Changed

- Added GitHub Actions Markdown by
[@&#8203;oxisto](https://togithub.com/oxisto) in
[https://github.com/golang-jwt/jwt/pull/260](https://togithub.com/golang-jwt/jwt/pull/260)
- Remove `StandardClaims` in favor of `RegisteredClaims` by
[@&#8203;oxisto](https://togithub.com/oxisto) in
[#&#8203;235](https://togithub.com/golang-jwt/jwt/issues/235)
- Adding more coverage by [@&#8203;oxisto](https://togithub.com/oxisto)
in [#&#8203;268](https://togithub.com/golang-jwt/jwt/issues/268)
- More consistent way of handling validation errors by
[@&#8203;oxisto](https://togithub.com/oxisto) in
[#&#8203;274](https://togithub.com/golang-jwt/jwt/issues/274)
- New Validation API by [@&#8203;oxisto](https://togithub.com/oxisto) in
[https://github.com/golang-jwt/jwt/pull/236](https://togithub.com/golang-jwt/jwt/pull/236)
- `v5` Pre-Release by [@&#8203;oxisto](https://togithub.com/oxisto) in
[https://github.com/golang-jwt/jwt/pull/234](https://togithub.com/golang-jwt/jwt/pull/234)
- no need for string slice and call to strings.join by
[@&#8203;moneszarrugh](https://togithub.com/moneszarrugh) in
[https://github.com/golang-jwt/jwt/pull/115](https://togithub.com/golang-jwt/jwt/pull/115)
- Update MIGRATION_GUIDE.md by
[@&#8203;liam-verta](https://togithub.com/liam-verta) in
[https://github.com/golang-jwt/jwt/pull/289](https://togithub.com/golang-jwt/jwt/pull/289)
- Moving `DecodeSegement` to `Parser` by
[@&#8203;oxisto](https://togithub.com/oxisto) in
[https://github.com/golang-jwt/jwt/pull/278](https://togithub.com/golang-jwt/jwt/pull/278)
- Adjusting the error checking example by
[@&#8203;oxisto](https://togithub.com/oxisto) in
[https://github.com/golang-jwt/jwt/pull/270](https://togithub.com/golang-jwt/jwt/pull/270)
- add documentation to hmac `Verify` & `Sign` to detail why string is
not an advisable input for key by
[@&#8203;dillonstreator](https://togithub.com/dillonstreator) in
[https://github.com/golang-jwt/jwt/pull/249](https://togithub.com/golang-jwt/jwt/pull/249)
- Add golangci-lint by [@&#8203;mfridman](https://togithub.com/mfridman)
in
[https://github.com/golang-jwt/jwt/pull/279](https://togithub.com/golang-jwt/jwt/pull/279)
- Added dependabot updates for GitHub actions by
[@&#8203;oxisto](https://togithub.com/oxisto) in
[https://github.com/golang-jwt/jwt/pull/298](https://togithub.com/golang-jwt/jwt/pull/298)
- Bump actions/checkout from 2 to 3 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[https://github.com/golang-jwt/jwt/pull/299](https://togithub.com/golang-jwt/jwt/pull/299)
- Bump actions/setup-go from 3 to 4 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[https://github.com/golang-jwt/jwt/pull/300](https://togithub.com/golang-jwt/jwt/pull/300)
- Added coverage reporting by
[@&#8203;oxisto](https://togithub.com/oxisto) in
[https://github.com/golang-jwt/jwt/pull/304](https://togithub.com/golang-jwt/jwt/pull/304)
- Last Documentation cleanups for `v5` release by
[@&#8203;oxisto](https://togithub.com/oxisto) in
[https://github.com/golang-jwt/jwt/pull/291](https://togithub.com/golang-jwt/jwt/pull/291)
- enable jwt.ParsePublicKeyFromPEM to parse PKCS1 Public Key by
[@&#8203;twocs](https://togithub.com/twocs) in
[https://github.com/golang-jwt/jwt/pull/120](https://togithub.com/golang-jwt/jwt/pull/120)

#### New Contributors

- [@&#8203;moneszarrugh](https://togithub.com/moneszarrugh) made their
first contribution in
[https://github.com/golang-jwt/jwt/pull/115](https://togithub.com/golang-jwt/jwt/pull/115)
- [@&#8203;liam-verta](https://togithub.com/liam-verta) made their first
contribution in
[https://github.com/golang-jwt/jwt/pull/289](https://togithub.com/golang-jwt/jwt/pull/289)
- [@&#8203;dillonstreator](https://togithub.com/dillonstreator) made
their first contribution in
[https://github.com/golang-jwt/jwt/pull/249](https://togithub.com/golang-jwt/jwt/pull/249)
- [@&#8203;dependabot](https://togithub.com/dependabot) made their first
contribution in
[https://github.com/golang-jwt/jwt/pull/299](https://togithub.com/golang-jwt/jwt/pull/299)
- [@&#8203;twocs](https://togithub.com/twocs) made their first
contribution in
[https://github.com/golang-jwt/jwt/pull/120](https://togithub.com/golang-jwt/jwt/pull/120)

**Full Changelog**:
https://github.com/golang-jwt/jwt/compare/v4.5.0...v5.0.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/woodpecker-ci/woodpecker).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi44My4wIiwidXBkYXRlZEluVmVyIjoiMzYuODMuMCIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: qwerty287 <ndev@web.de>
2023-09-13 09:01:01 +02:00
6543
0563d7a30f
Bump default git clone plugin (#2215)
- and add alternate quay registry to trusted clone image
- add alternate registry for buildx plugin
2023-08-16 15:17:43 +02:00
6543
ada3659eb7
make EqualStringSlice to generic EqualSliceValues (#2179)
just a fly-by refactoring
2023-08-09 09:00:12 +02:00
6543
d253f8cc30
Make sure we dont have hidden options for backend and pipeline compiler (#2123)
move options based on **os.Getenv** into flags

---------
*Sponsored by Kithara Software GmbH*
2023-08-07 21:13:26 +02:00
Philipp
c96fc3f27a
Bump default clone image version to 2.1.0 (#2053)
We need v2.1.0 as it uses the CI_REPO_CLONE_URL and not the deprecated CI_REPO_REMOTE.
2023-07-28 20:36:08 +02:00
6543
f5a85d21be
Drop ".drone.yml" as default pipeline config (#1795)
it did make sense to have it still supported within v0.15.0,

but as we move future away and with the release of v1.0.0
we should not give the appearance of still support the original drone
v0.8 config
2023-05-31 16:02:20 +02:00
qwerty287
0f9188597e
Initiate Pagination Implementation for API and Infinite Scroll in UI (#1651)
- Add pagination support to the API endpoints that return lists of items
- Adjust UI to enable infinite scrolling via pagination
2023-04-30 03:40:13 +02:00
qwerty287
cfdb32ae45
Fully support .yaml (#1713)
Follow-up to https://github.com/woodpecker-ci/woodpecker/pull/1388
Closes https://github.com/woodpecker-ci/woodpecker/issues/1073

---------

Co-authored-by: 6543 <6543@obermui.de>
2023-04-29 10:12:36 +02:00
Lauris BH
46452fbd84
Update Go dependencies and minimal Go version to 1.20 (#1650)
Signed-off-by: 6543 <6543@obermui.de>
Co-authored-by: 6543 <6543@obermui.de>
2023-03-21 00:48:15 +01:00
6543
e28b43ab19
Only inject netrc to trusted clone plugins (#1352)
Co-authored-by: qwerty287 <ndev@web.de>
Co-authored-by: 6543 <6543@obermui.de>
2023-03-20 21:17:49 +01:00
Lauris BH
f26a87acce
Deduplicate step docker container volumes (#1571)
Try to fix #1495

It's very hard to reproduce it and only way to fix when it gets in this
state is woodpecker agent restart.

This anyway fixes problem if step mounts and
`WOODPECKER_BACKEND_DOCKER_VOLUMES` conflict
2023-01-31 21:33:40 +01:00
6543
f71142d162
Pin official default clone image (#1526)
address https://github.com/woodpecker-ci/woodpecker/issues/1508#issuecomment-1368007494
2023-01-10 17:34:21 +01:00
6543
7f5c3d3191
bump DefaultCloneImage version to v2.0.x 2022-12-23 18:02:07 +01:00
Josh Soref
023d03dd61
Spelling (#1405)
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>
2022-11-09 08:12:17 +01:00
Michael
2477d2e57f
Support .yaml as file-ending for workflow config too (#1388)
This implements #1073, adds .yaml to the accepted endings for woodpecker configs.

This currently adds some more lines to the duplication (tried to compensate by fixing the other duplication in the configFetcher) as the CLI and Server are still separate.
2022-11-03 19:12:40 +01:00
6543
47e212fd5e
bump DefaultCloneImage version to v1.6.0 2022-10-13 16:50:32 +02:00
6543
89466646d1
bump default clone image 2022-10-06 19:40:50 +02:00
6543
4e38a55c31
bump DefaultCloneImage version to v1.4.0 2022-08-30 22:28:33 +02:00
6543
f15b27aadf
Remove own copy of oauth2 implementation (#1127)
at some point (~7years ago) the oauth2 implementation was copied into the code-base and never touched.
We only use it for gitlab the rest is already back using std.

This migrates to the std oauth2 implementation
2022-08-26 21:42:41 +02:00
6543
ec6490e367
bump DefaultCloneImage version 2022-08-15 17:23:38 +02:00
Anbraten
93c96de2ac
use fix version to be able to update clone images (#1108) 2022-08-14 21:22:35 +02:00
6543
31bad81979
Use external lib to convert yaml to json (#1028)
this move shared/yml/* into an independent lib
2022-07-17 17:23:31 +02:00
John Olheiser
67d76248a3
Take in an io.Reader instead of file path (#885)
Signed-off-by: jolheiser <john.olheiser@gmail.com>
2022-04-19 10:40:48 +02:00
6543
58303dd2a7
Move value of default clone image into shared constant package (#873) 2022-04-06 15:30:49 +02:00
Johan Van de Wauw
8fa2a5efe4
Fix various typos (#835) 2022-03-09 01:44:08 +01:00
6543
a3ac393264
Use shared func for registering Sigterm on a context (#799) 2022-02-28 09:27:31 +01:00
6543
071bd7418a
Fix tests and pipeline (#732)
* fix pipeline

* use EqualStringSlice to compare slices in tests

* full test coverage

* tests: wait for mysql/postgres to sync ...
2022-01-31 14:39:53 +01:00
Anbraten
401072abb1
Support ChangedFiles for Github & Gitlab PRs and Gitlab pushes (#697) 2022-01-17 23:46:59 +01:00
6543
5a120db69d
remove "panic()" as much as posible from code (#682) 2022-01-09 23:27:30 +01:00
6543
2f91bdd4a0
gofumpt -w -l -extra . (#661) 2022-01-05 21:50:23 +01:00
6543
e8807c5e53
Add "woodpeckerci/plugin-docker-buildx" to privileged plugins (#623)
* refactor global const in own package

* add "woodpeckerci/plugin-docker-buildx" to privileged plugins

* add woodpeckerci/plugin-docker
2021-12-19 12:46:36 +01:00
Anbraten
ed0a9fd756
Use gitlab generic webhooks instead of drone-ci-service (#620)
Benefits:
- the webhook delivery history of the drone-ci-service is broken (no way to check if a webhook was successfully delivered by Gitlab)
- drone-ci-service has limited events support (for example no comment or branch deleted event)
- independent from drone integration in general
2021-12-19 01:12:09 +01:00
6543
1172dc3311
Write own yaml2json func (#570)
* fix regression of #384 
 * add more tests
2021-12-07 01:13:02 +01:00
Anbraten
ffed327564
Remove ghodss/yaml (#384) 2021-12-06 18:17:31 +00:00
Lukas
680d003a29
Add linter revive (#554)
* Add linter revive

* Add underscore to variable name to prevent shadowing

* Remove unnecessary leading underscore

* Revert changes to vendor file

* export ConfigFetcher as interface

* no 'yoda conditions'

* rename envsubst

Co-authored-by: 6543 <6543@obermui.de>
2021-12-01 14:22:06 +01:00
Lukas
25bf91bd37
Add linter whitespace (#531) 2021-11-24 01:31:11 +01:00
John Olheiser
4276a04f0c
Move entirely to zerolog (#426)
Completely switch to zerolog

(Remove usage of logrus and std logger)

Signed-off-by: jolheiser <john.olheiser@gmail.com>
Co-authored-by: 6543 <6543@obermui.de>
2021-10-12 09:25:13 +02:00
luzpaz
9b687a923e
Fix various typos (#416)
Fix various typos found via `codespell -q 3 -S vendor -L pullrequest,pullrequests`
2021-10-08 18:35:56 +02:00
6543
3837e03866
github.com/golang-jwt/jwt v3.2.2 -> v4.1.0 (#397) 2021-10-04 15:35:47 +02:00
6543
f81bd8c656
Extend Logging & Report to WebHook Caller back if pulls are disabled (#369)
* Add more logging 
* Format Code
* Add TODOs
* Fix nits
* Delete two unused functions
* Report to WebHook Caller back if pulls are disabled
2021-09-27 23:32:08 +02:00
Anbraten
0fa271f465
Add json schema and cli lint command (#342)
- Add json schema file
- Add tests to validate sample pipeline files
- Add new command `lint` to cli to test a directory or single file to use correct schema

Example:  `woodpecker-cli lint ./pipeline/schema/.woodpecker/`

---
close #275 
preparation for #276 


Co-authored-by: 6543 <6543@obermui.de>
2021-09-27 02:38:15 +02:00
6543
0bd10fa507
Cleanup Code (#348)
* Fix "Empty slice declaration using a literal"
* Fix "collides with imported package name"
* Remove unused code in pipeline
* Remove unused oauth2.providerAuthHeaderWorks()
* Add TODOs
* Format Code
* Cleanup doublestar import
* Migrate deprecated functions

Co-authored-by: Anbraten <anton@ju60.de>
2021-09-24 16:29:26 +02:00
6543
ac46ee9345
Migrate jwt token lib (#332)
* migrate from github.com/dgrijalva/jwt-go to github.com/golang-jwt/jwt

* migrate
2021-09-21 12:55:25 +02:00
Anbraten
1a67fc6e99
Use server-host as source for public links and warn if it is set to localhost (#251)
* Use server-host as source for public links

* use config and rm GetURL()

* fix: solve import cycle

Co-authored-by: 6543 <6543@obermui.de>
2021-08-20 16:32:52 +02:00
Thomas Boerger
7f49e69607
Just fixed format with go fmt ./... 2018-03-21 14:02:17 +01:00
Brad Rydzewski
580fe9abb7 add apache license header to files 2018-02-19 14:24:10 -08:00
Alexey Palazhchenko
e259c64bac Expose OAuth2 errors, avoid redirect loop.
Closes #1775.
2016-12-19 08:42:56 +03:00
Brad Rydzewski
f930545410 refactoring github package to increase test coverage 2016-05-02 17:47:58 -07:00
Brad Rydzewski
0fb4aeda3f bump to 0.5 in master 2016-05-02 12:21:25 -07:00
Brad Rydzewski
faf7ff675d use new .drone.sig signature file 2016-04-21 17:10:19 -07:00