openSUSE Build Service

Overview Repositories Revisions Requests Users Attributes Meta

File portus.changes of Package portus

-------------------------------------------------------------------
Thu Sep 21 16:30:52 UTC 2017 - jmassaguerpla@suse.com

- fix bsc#1059664 - CVE-2017-14621: portus: XSS via the Team field,
  related to typeahead.
  add bsc_1059664.patch: contains the fix

-------------------------------------------------------------------
Tue Jan 31 13:12:16 UTC 2017 - jmassaguerpla@suse.com

- Update Portus to 2.2.0 (bsc#1022834)

Bug fixing:

* Remove auth/cover.js from precompilation (issue #1153)
  * Fix activities (issues #1104, #1106 and #899)
  * Portus will now properly update the image ID when a tag has been pushed. See PR #1054.
  * Fixed how image updates are handled. See PR #1031.
  * Follow a consistent order in the signup form. See PR #1119.
  * Hide passwords stored in webhooks. See PR #1111.
  * Removed reference of missing stylesheets. See PR #1114.

Features

* portusctl: it will show a warning when using the --local-registry flag but the package has not been installed. See PR #1096.
  * Portus now supports Docker Distribution 2.5. See PR #1068.
  * Allow docker-compose users to specify an alternative port. See PR #1094.

Documentation

* Avoid the confusion on the hostnames to be used. See PR #1056.
  * Clarified how the --local-registry flag works. PR #1052.

- add fix_ownership.patch: fix permissions under tmp/cache 
- fix_activity.patch: fix error on looking for activities from a deleted user

-------------------------------------------------------------------
Fri Oct 14 13:30:29 UTC 2016 - jmassaguerpla@suse.com

- Update Portus to 2.1.1 (bsc#1005594)
  * fix_assets_compilation.patch: fix assets compilation 
  * update.patch: run update commands
  * version-git.patch: remove because this code has been merged
  * Fixes
    - Use the full repository name in the `portus:update_tags` task
    - Fixed a regression on assets handling
    - Fixed the handling of the "*" action from the registry
  - Improvements
    - Notification messages are now more consistent
    - Order users by username on the admin panel

- Update Portus to 2.1
  * Featured
    - Fixes and improvements on Docker Distribution support
    - Implemented user removal
    - Implemented the removal of images and tags
    - Showing the image ID and the digest of docker images
    - Implemented webhook support
    - Introduce application tokens
  * Improvements and small features
    - Better reflect updates on Docker images
    - General improvements and fixes on the UI/UX
    - Allow the admin to provide extra filter options in LDAP lookup
    - Password length is no longer checked by Portus in LDAP
    - Relaxed the requirements for user names, and removed the conflicts of user names in LDAP
    - Introduce the `display_name` option
    - Allow administrators to turn off smtp authentication
    - Added an external hostname field to allow for events to come from other named services
    - Added a help section to the menu
    - Introduced more optional user restrictions
    - Added the registry.catalog_page option
    - Added option to disable change of visibility
    - The signup form can now be disabled, and users can be created by the admin directly
    - Added internal policy for namespaces
    - Added namespaces and teams to search
    - Admins can now change the ownership of a namespace
    - Display the git tag, branch/commit or version when possible
    - Now logs are redirected to the standard output
    - Added the ability to add comments on repositories
    - Virtual/hidden teams are no longer counted for the  "number of teams"-column under admin/users
    - Added rake tasks for creating a registry, updating digests and showing general information
    - Added man pages for portusctl
    - Register more activities
  * Fixes
    - Various fixes in LDAP support
    - Discard pagination for CSV activities
    - Make sure that Portus admins are always team owners
    - User names are no longer allowed to clash with teams
    - Redirect back to accessed page on successful login
    - Fixes on the crono job
    - Multiple fixes in portusctl
    - Multiple fixes in our RPM
    - Show the "I forgot my password" link when the signup is disabled
  * Breaking changes
    - Moved the machine FQDN from secrets.yml to config.yml
    - Deprecated the usage of "x.minutes" strings in configuration values. In future
      versions this syntax will be forbidden
  * Others

- All the improvements, features and bug fixes mentioned in the notes of 2.0.x releases.

-------------------------------------------------------------------
Thu Jun 16 14:59:16 UTC 2016 - jmassaguerpla@suse.com

- Added a patch that fixes github issue #936

This issue was discovered by QA and a commit has been merged in both the
`master` and `v2.0` branch. We are waiting for more commits before doing any
other release, so until then we are providing this patch.

version-git.patch: the above mentioned patch

-------------------------------------------------------------------
Tue May 24 10:48:52 UTC 2016 - jmassaguerpla@suse.com

- Update to 2.0.5 (bsc#981312)

- Improvements
    * The FQDN can now be specified from the configuration too. This is meant
      to help users to transition from 2.0.x to 2.1.
    * Portus is now more explicit on the allowed name format.
    * Portus is now more friendly on errors based on the namespace name.

- portusctl
    * Disable automatic generation of certificates. For this, now there are two
      new flags: --ssl-gen-self-signed-certs and --ssl-certs-dir <dir>.
    * Wrap crono with the exec command.

- Misc
    * Some fixes on the generation of the RPM in OBS.

Fixes:
  bsc#981312
  bsc#978658
  bsc#978661
  bnc#976113
  bsc#978374

-------------------------------------------------------------------
Fri May  6 13:48:16 UTC 2016 - jmassaguerpla@suse.com

- Update to 2.0.4 (bsc#979210)
  
  - RPM:
    * Automate Portus release. See commit.
    * Rename Portus to portus on the RPM. See commit.
    * Refactored RPM. See commit.
    * Wrap crono with the exec command in the RPM. See commit.
    * Require net-tools on the RPM. See commit.

- portusctl:
    * Use the proper make_admin task. See commit.
    * Don't configure mysql in Docker. See commit.
    * Added the portus:info task. See commit.

- Improvements:
    * Better Sub-URI handling & configurable config-local.yml path. See PR.
    * Update ruby versions on travis. See commit1 and commit2.

- Other fixes:
    * Logout button and search repository are now appearing in small devices. See commit.
    * Don't allow access to the hidden global team. See commit.

Fixes:
  bsc#979210
  bnc#967411
  bsc#976198
  bsc#976088

-------------------------------------------------------------------
Thu Mar 10 10:25:09 UTC 2016 - jmassaguerpla@suse.com

- Update to 2.0.3:

- Fixed crono job when a repository could not be found.
  - Fixed more issues on docker 1.10 and distribution 2.3.
  - Handle multiple scopes in token requests.
  - Add optional fields to token response.

- Update to 2.0.2:
  - Fixed notification events for distribution v2.3.

-------------------------------------------------------------------
Wed Mar  9 19:59:58 UTC 2016 - jmassaguerpla@suse.com

- update bundled gems to fix 
  bsc#969943 - CVE-2016-2098: rubygem-actionpack

-------------------------------------------------------------------
Tue Feb  2 16:45:17 UTC 2016 - jmassaguerpla@suse.com

- updated the bundles gems:
  bsc#963326 - CVE-2015-7578: rails-html-sanitizer
  bsc#963327 - CVE-2015-7579: rails-html-sanitizer
  bsc#963328 - CVE-2015-7580: rails-html-sanitizer
  bsc#963563 - CVE-2015-7576: rubygem-actionpack, rubygem-activesupport
  bsc#963604 - CVE-2015-7577: rubygem-activerecord
  bnc#963627 - CVE-2016-0751: actionpack
  bsc#963608 - CVE-2016-0752: rubygem-actionpack, rubygem-actionview
  bsc#963617 - CVE-2016-0753: rubygem-activemodel, rubygem-activesupport, rubygem-activerecord
  bsc#963625 - CVE-2015-7581: rubygem-actionpack

-------------------------------------------------------------------
Wed Jan 27 16:48:31 UTC 2016 - msabate@suse.com

- Updated to 2.0.1. Some highlights are:

* Paginate through the catalog properly.
  * Do not remove all the repos if fetching one fails.
  * Fixed SMTP setup.
  * Don't let crono overflow the `log` column on the DB.
  * Show the actual LDAP error on invalid login.
  * Fixed the location of crono logs.
  * Always use relative paths.
  * Set RUBYLIB when using portusctl.
  * Don't count hidden teams on the admin panel.
  * Warn developers on unsupported docker-compose versions.
  * Directly invalidate LDAP logins without name and password.
  * Don't show the "I forgot my password" link on LDAP.

For more info, check out the Changelog:
  https://github.com/SUSE/Portus/releases/tag/2.0.1

-------------------------------------------------------------------
Mon Nov 23 11:03:04 UTC 2015 - jmassaguerpla@suse.com

- Updated to v2.0.0 release. The highlights of this version are:

* LDAP support.
  * A much improved UI.
  * The RPM includes the "portusctl" utility.
  * Star/Unstar repositories.
  * Support for locking accounts.
  * Added a mechanism for password recovery.
  * Fixed lots of bugs from the previous version.

To see the full Changelog, go to:
  https://github.com/SUSE/Portus/blob/master/CHANGELOG.md#200

- This fixes bsc#956273
  - This partially implements FATE#318989

-------------------------------------------------------------------
Mon May 11 10:45:42 UTC 2015 - jmassaguerpla@suse.com

- initial commit

Places

File portus.changes of Package portus

Places