Fix bugs discovered in v0.1.6

[santoshkal]

This PR fixes the bugs found in the latest release v0.1.6.
It mainly covers implementing a retry using failures for pull and push commands. Along with this there is a fix to goreleaser made for printing Changelogs on a new release.

[dryrunsecurity]

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security	Status	Findings
Server-Side Request Forgery Analyzer	✅	0 findings
Authn/Authz Analyzer	❕	10 findings
IDOR Analyzer	✅	0 findings
SQL Injection Analyzer	✅	0 findings
Configured Codepaths Analyzer	✅	0 findings
Secrets Analyzer	✅	0 findings
Sensitive Files Analyzer	✅	0 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖. Note that this summary is auto-generated and not meant to be a definitive list of security issues but rather a helpful summary from a security perspective.

Summary:

The code changes in this pull request cover several files and focus on improving the reliability, error handling, and security of the application's artifact push functionality. The key changes include:

1. Changelog Configuration: The changes to the .goreleaser.yaml file update the regular expression pattern for the "Updates" group in the changelog, which does not have any direct security implications.
2. Signing Configuration: The addition of the signs section in the .goreleaser.yaml file configures the signing of the released artifacts using the cosign tool, which is a recommended security practice.
3. Removal of context.Context parameter: The changes in the ociClient.go file remove the context.Context parameter from the GenerateCraneOptions function, which may impact the overall reliability and robustness of the code.
4. Improved error handling and retrying: The ociClient.go file includes a defaultRetryPredicate function that determines which errors should be retried, which can help improve the overall reliability of the system.
5. Handling of Credentials: The changes in the artifact_push.go file improve the handling of credentials, allowing users to provide their own credentials or fall back to the default system-wide credentials.
6. Artifact Signing with Cosign: The artifact_push.go file provides an option to sign the artifact using the Cosign tool, which is a security-conscious feature that helps ensure the integrity and authenticity of the artifact.

From an application security perspective, the changes in this pull request do not introduce any obvious security concerns. The modifications are primarily focused on improving the reliability, error handling, and security of the artifact push functionality, which is an important aspect of secure application development. However, it's important to thoroughly review the changes to ensure that they do not introduce any unintended security implications, such as improper handling of authentication and authorization, potential for denial-of-service attacks due to overly aggressive retrying, or incomplete error handling that could lead to information leakage or other security issues.

Files Changed:

1. .goreleaser.yaml: The changes in this file update the regular expression pattern for the "Updates" group in the changelog and add the signs section to configure the signing of the released artifacts using the cosign tool.
2. pkg/oci/ociClient.go: The changes in this file remove the context.Context parameter from the GenerateCraneOptions function, simplify the implementation, and improve the error handling and retrying logic.
3. cmd/artifact_push.go: The changes in this file remove the cmd.Context() from the oci.GenerateCraneOptions function call, improve the handling of credentials, and provide an option to sign the artifact using the Cosign tool.

Powered by DryRun Security