Bump zot registry to v2.1.15 #293

Merged

eblume merged 2 commits from bump/zot-v2.1.15 into main

2026-03-14 10:00:40 -07:00

eblume commented

2026-03-14 09:22:46 -07:00

Owner

Summary

Upgrade zot OCI registry from v2.1.13 to v2.1.15 on indri
Addresses CVE-2025-30204 (golang-jwt memory) and open redirect via callback_ui
No config template changes needed (externalUrl is auto-allowlisted)
Requires Go 1.25.7 (bump from 1.25.6 via mise)

Data Safety

Data directory ~/erichblume/zot is NOT touched during build or deploy
No schema migrations in v2.1.14 or v2.1.15
Storage format remains OCI spec 1.1.0

Deployment Steps

SSH to indri: bump Go to 1.25.7 via mise use go@1.25.7
Fetch and checkout v2.1.15 in ~/code/3rd/zot
Build: mise x -- make binary
Restart LaunchAgent
Verify: curl -s http://localhost:5050/v2/ returns 200
Verify: curl -s https://registry.ops.eblu.me/v2/_catalog lists repos
Verify: mise run services-check

## Summary - Upgrade zot OCI registry from v2.1.13 to v2.1.15 on indri - Addresses CVE-2025-30204 (golang-jwt memory) and open redirect via callback_ui - No config template changes needed (externalUrl is auto-allowlisted) - Requires Go 1.25.7 (bump from 1.25.6 via mise) ## Data Safety - Data directory ~/erichblume/zot is NOT touched during build or deploy - No schema migrations in v2.1.14 or v2.1.15 - Storage format remains OCI spec 1.1.0 ## Deployment Steps - [ ] SSH to indri: bump Go to 1.25.7 via `mise use go@1.25.7` - [ ] Fetch and checkout v2.1.15 in ~/code/3rd/zot - [ ] Build: `mise x -- make binary` - [ ] Restart LaunchAgent - [ ] Verify: `curl -s http://localhost:5050/v2/` returns 200 - [ ] Verify: `curl -s https://registry.ops.eblu.me/v2/_catalog` lists repos - [ ] Verify: `mise run services-check`

eblume added 1 commit

2026-03-14 09:22:46 -07:00

Bump zot registry to v2.1.15 392aeaf66b

Upgrade from v2.1.13 to v2.1.15 for two security fixes:
- CVE-2025-30204 (golang-jwt excessive memory allocation)
- Open redirect via callback_ui

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

eblume added 1 commit

2026-03-14 09:54:25 -07:00

Fix trivy CVE DB downloads in zot LaunchAgent 3725d0873f

The LaunchAgent's default PATH (/usr/bin:/bin:/usr/sbin:/sbin) doesn't
include /usr/local/bin where docker-credential-desktop lives. Trivy's
OCI client reads ~/.docker/config.json which specifies credsStore:desktop,
then fails to find the credential helper. Add /usr/local/bin to PATH.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>