GO-2024-2472: Go package github.com/notaryproject/notation configured with permissive trust policies potentially susceptible to rollback attack from compromised registry

plugin

package

v1.3.2 Latest Latest Go to latest Published: Apr 24, 2025 License: Apache-2.0 Imports: 6 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/notaryproject/notation

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
Variables
func DownloadPluginFromURL(ctx context.Context, pluginURL string, tmpFile io.Writer) error
type PluginSourceType

Constants ¶

View Source

const (
	// MediaTypeZip means plugin file is zip
	MediaTypeZip = "application/zip"

	// MediaTypeGzip means plugin file is gzip
	MediaTypeGzip = "application/x-gzip"
)

View Source

const DownloadPluginFromURLTimeout = 10 * time.Minute

DownloadPluginFromURLTimeout is the timeout when downloading plugin from a URL

Variables ¶

View Source

var MaxPluginSourceBytes int64 = 256 * 1024 * 1024 // 256 MiB

MaxPluginSourceBytes specifies the limit on how many bytes are allowed in the server's response to the download from URL request.

The plugin source size must be strictly less than this value.

Functions ¶

func DownloadPluginFromURL ¶

func DownloadPluginFromURL(ctx context.Context, pluginURL string, tmpFile io.Writer) error

DownloadPluginFromURL downloads plugin source from url to a tmp file on file system

Types ¶

type PluginSourceType ¶

type PluginSourceType int

PluginSourceType is an enum for plugin source

const (
	// PluginSourceTypeFile means plugin source is file
	PluginSourceTypeFile PluginSourceType = 1 + iota

	// PluginSourceTypeURL means plugin source is URL
	PluginSourceTypeURL
)

Source Files ¶

View all Source files

plugin.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL