admin
3db9126121
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
69 lines
4.6 KiB
Markdown
69 lines
4.6 KiB
Markdown
# REPORT — v0.112.0: self-update without credentials (anonymous registry mode)
|
|
|
|
**Date:** 2026-07-10 · **Version:** v0.112.0 (from v0.111.0) · **Pairs with:** hub v0.43.1
|
|
**Spec:** TASK — controller self-update without credentials (anonymous registry mode)
|
|
|
|
## Root cause (live on Peti's box)
|
|
|
|
The updater piggybacked on the Git Sync credentials and REFUSED when absent (`queryRegistry` +
|
|
`pullImage` guards) — but the registry serves the public package anonymously (Docker v2 token dance,
|
|
verified empirically 2026-07-10). A fresh customer without a private catalog silently lost version
|
|
discovery + self-update for no reason. Credentials are now what they were meant to be: **optional,
|
|
private-catalog only**.
|
|
|
|
## What shipped
|
|
|
|
- **Part 1 — `queryRegistry` anonymous mode** (`internal/selfupdate/updater.go`): both creds empty →
|
|
plain GET; on 401 parse the `WWW-Authenticate` Bearer challenge (realm + service **from the header**
|
|
— never hardcoded; quoted/bare values, any order, commas-in-quotes handled); GET the realm with
|
|
`service` + `repository:<image>:pull` scope and NO credentials; retry tags/list with the Bearer.
|
|
Creds present → the BasicAuth path unchanged. Half-configured pair → loud
|
|
"hiányos registry hitelesítő adatok". A genuinely-denying registry →
|
|
**"registry denied anonymous access — a private registry requires Git Sync credentials"** (never the
|
|
old "credentials missing"). Registry base URL now derives from the image ref (was a hardcoded host).
|
|
- **Part 2 — `pullImage` without login:** no creds → the `docker login` step skipped entirely
|
|
(docker's native anonymous flow covers public packages); creds → login/pull/logout unchanged
|
|
(token still stdin-only). The old refuse-guard removed; a denied anonymous pull surfaces docker's
|
|
own error.
|
|
- **Part 3 — settings truthfulness:** "Verzió és frissítés" gains
|
|
"Registry: nyilvános (hitelesítés nélkül)" / "Registry: hitelesített"; credential-less is no longer
|
|
an error state; the Hiba row appears only on real failure. `DryRun.PullCapable` counts anonymous as
|
|
capable (false only on a half-configured pair).
|
|
- **Part 4 (hub v0.43.1):** Git Sync form hint — "Opcionális — csak privát alkalmazás-katalógushoz.
|
|
A verziófrissítés enélkül is működik." (one template string).
|
|
|
|
## Tests + red-proof (executed; failures verbatim)
|
|
|
|
- **Red-proof** — the old creds-required guard restored in `queryRegistry` → all three anonymous tests
|
|
FAILED with the old message visible:
|
|
`anonymous queryRegistry failed: registry hitelesítő adatok hiányoznak`. Restored → green.
|
|
- Non-hollow coverage (`registry_anon_test.go`, httptest fake registry + fake CLI runner): full token
|
|
dance with ZERO creds (token request carries NO Authorization, correct
|
|
`service`+`scope=repository:admin/felhom-controller:pull`, highest semver returned, non-semver tags
|
|
skipped); creds path unchanged (BasicAuth on tags/list, token endpoint never hit); BOTH denial paths
|
|
(token 401, tags-401-with-Bearer) → the new clear error and NOT the old one; `parseWWWAuthenticate`
|
|
table (quoted/bare/order/comma-inside-quotes/missing-realm/non-Bearer/empty); pull with no creds →
|
|
**no login/logout invocation recorded**, exactly one `docker pull`; creds → login→pull→logout order +
|
|
token via stdin; partial creds refuse everywhere with zero docker commands run.
|
|
- Green gate both repos (`go build && go vet && go test ./...`) + controller template gates
|
|
(`template_id_gate.py`, `emoji_gate.py`) pass.
|
|
|
|
## Deploy + live validation (demo, credential-less for real)
|
|
|
|
- Controller `0.112.0` → 9201 (bootstrap mechanism), `Up (healthy)`. Hub `0.43.1` → GitOps sync,
|
|
Synced/Healthy, rollout complete.
|
|
- The demo box's `controller.yaml` has `git.username: ""` / `git.token: ""` (verified quoted-empty →
|
|
parses to empty strings) — a genuinely credential-less box.
|
|
- **Live anonymous check against the real registry:** `POST /api/selfupdate/check` (in-guest, via the
|
|
container IP + Host header, hub-API-key bearer) →
|
|
`{"ok":true, "current_version":"0.112.0", "latest_version":"0.112.0", "update_available":false}` —
|
|
NO error. Pre-0.112.0 this exact call failed with "registry hitelesítő adatok hiányoznak".
|
|
- **Settings page live:** renders `Registry — nyilvános (hitelesítés nélkül)` and
|
|
`Legújabb verzió — 0.112.0`; no Hiba row.
|
|
|
|
## Pending operator step (per spec — Peti's box untouched by this task)
|
|
|
|
After Viktor's floor bump rolls Peti to 0.112.0: delete the temporary Git Sync creds from Peti's hub
|
|
config → next config pull → Peti's settings page should show a clean "Registry: nyilvános
|
|
(hitelesítés nélkül)" with zero credentials on the box.
|