From 4017e995b7ada3bcb54ba30b2a86a7559cbcf1a9 Mon Sep 17 00:00:00 2001 From: Wang Yan Date: Tue, 29 Jun 2021 15:08:52 +0800 Subject: [PATCH] roll back go for notary binary Fixes #14932 Harbor recompiles the notary v0.6.1 with go 1.15 from v2.2.0, which introduces an break change that leads to notary key not found after migration. [Root cause] Notary v0.6.1 consumed an old version dvsekhvalnov/jose2, which is not compatible with go 1.15. [References] https://github.com/dvsekhvalnov/jose2go/issues/26 https://github.com/golang/go/issues/41089 [Resolve] To resolve this issue, we have to roll back go vesrion to v1.14 for notary v0.6.1 binary and keep it until upstream have a patch release to support go 1.15 or above. [Break change] If you pushed and signed image using Harbor v2.2.0 ~ v2.2.2 and created new repository key in notary, you will encouter the same issue after migrate to v2.2.3(or above) or v2.3.1(or above) because of the go version downgrade. We will have a FAQ to help you to resovle this particular scenario. The influence path of the particular case: Harbor v2.1.0(or lower) --> [v2.2.0 ~ v2.2.2] --> v2.2.3(or above) Harbor v2.1.0(or lower) --> v2.3.0 --> v2.3.1(or above) The non influence path of the paticular case: Harbor v2.1.0(or lower) --> v2.2.3(or above) Harbor v2.1.0(or lower) --> v2.3.1(or above) [Fix in Version] Harbor v2.2.3 or above Harbor v2.3.1 or above [Note] If you're a heavy user of notary, avoid using v2.2.0, v2.2.1, v2.2.2 and v2.3.0, and use the fixed version for instead. Signed-off-by: Wang Yan --- make/photon/notary/binary.Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/make/photon/notary/binary.Dockerfile b/make/photon/notary/binary.Dockerfile index 43aa0d596..cd3255ed8 100644 --- a/make/photon/notary/binary.Dockerfile +++ b/make/photon/notary/binary.Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.15.12 +FROM golang:1.14.15 ARG NOTARY_VERSION ARG MIGRATE_VERSION