test compliance with fips140-3

.buildbaselog

@@ -8,6 +8,9 @@
 *   Add date here... Add signature here...
 -   Add your reason here...
 
+*   Aug 27 2026 <stone.zhang@broadcom.com>
+-   Refresh base image
+
 *   Jul 01 2026 <stone.zhang@broadcom.com>
 -   Refresh base image
 

.github/workflows/CI.yml

@@ -56,7 +56,7 @@ jobs:
       - name: Set up Go 1.26
         uses: actions/setup-go@v5
         with:
-           go-version: 1.26.4
+           go-version: 1.26.7
         id: go
       - uses: actions/checkout@v6
         with:

.gitignore

@@ -54,8 +54,20 @@ src/portal/cypress/screenshots
 **/robotvars.py
 src/core/conf/app.conf
 
-src/server/v2.0/models/
-src/server/v2.0/restapi/
+# go-swagger output ("make gen_apis"). Everything is ignored except the
+# zz_generated_placeholder.go files, which are committed so that the packages
+# resolve before code generation has run. The patterns are written level by
+# level because git cannot re-include a file whose parent directory is excluded.
+src/server/v2.0/models/*
+!src/server/v2.0/models/zz_generated_placeholder.go
+src/server/v2.0/restapi/*
+!src/server/v2.0/restapi/zz_generated_placeholder.go
+!src/server/v2.0/restapi/operations/
+src/server/v2.0/restapi/operations/*
+!src/server/v2.0/restapi/operations/zz_generated_placeholder.go
+!src/server/v2.0/restapi/operations/*/
+src/server/v2.0/restapi/operations/*/*
+!src/server/v2.0/restapi/operations/*/zz_generated_placeholder.go
 .editorconfig
 
 harborclient/

CONTRIBUTING.md

@@ -169,7 +169,7 @@ Harbor backend is written in [Go](http://golang.org/). If you don't have a Harbo
 | 2.12   | 1.23.2      |
 | 2.13   | 1.23.8      |
 | 2.14   | 1.24.6      |
-| 2.15   | 1.26.4      |
+| 2.15   | 1.26.7      |
 
 
 Ensure your GOPATH and PATH have been configured in accordance with the Go environment instructions.

Makefile

@@ -125,12 +125,12 @@ PREPARE_VERSION_NAME=versions
 
 #versions
 REGISTRYVERSION=v2.8.3-patch-redis
-TRIVYVERSION=v0.72.0
-TRIVYADAPTERVERSION=v0.38.0
+TRIVYVERSION=v0.74.0
+TRIVYADAPTERVERSION=v0.39.0
 NODEBUILDIMAGE=node:22.22.3
 
 # version of registry for pulling the source code
-REGISTRY_SRC_TAG=v2.8.3-harbor.1
+REGISTRY_SRC_TAG=v2.8.3-harbor.2-rc.5
 # source of upstream distribution code
 DISTRIBUTION_SRC=https://github.com/goharbor/distribution.git
 
@@ -165,7 +165,7 @@ GOINSTALL=$(GOCMD) install
 GOTEST=$(GOCMD) test
 GODEP=$(GOTEST) -i
 GOFMT=gofmt -w
-GOBUILDIMAGE=golang:1.26.4
+GOBUILDIMAGE=golang:1.26.7
 GOBUILDPATHINCONTAINER=/harbor
 
 # go build
@@ -332,9 +332,28 @@ SWAGGER_IMAGE_BUILD_CMD=${DOCKERBUILD} -f ${TOOLSPATH}/swagger/Dockerfile --buil
 # $3 the name of the application
 define swagger_generate_server
 	@echo "generate all the files for API from $(1)"
-	@rm -rf $(2)/{models,restapi}
+	@# Drop the previously generated files but keep the committed
+	@# zz_generated_placeholder.go of each package (see .gitignore).
+	@find $(2)/models $(2)/restapi -type f ! -name 'zz_generated_placeholder.go' -delete
 	@mkdir -p $(2)
 	@$(SWAGGER_GENERATE_SERVER) -f $(1) -A $(3) --target $(2)
+	@missing=; orphaned=; \
+	for d in $$(find $(2)/models $(2)/restapi -type d); do \
+		if [ ! -f "$$d/zz_generated_placeholder.go" ]; then \
+			missing="$$missing $$d"; \
+		elif [ -z "$$(find $$d -maxdepth 1 -name '*.go' ! -name 'zz_generated_placeholder.go')" ]; then \
+			orphaned="$$orphaned $$d"; \
+		fi; \
+	done; \
+	if [ -n "$$missing" ]; then \
+		echo "error: generated package without a committed placeholder:$$missing"; \
+		echo "copy a zz_generated_placeholder.go into it, fix the package clause and commit it"; \
+	fi; \
+	if [ -n "$$orphaned" ]; then \
+		echo "error: placeholder for a package go-swagger no longer generates:$$orphaned"; \
+		echo "remove the orphaned placeholder"; \
+	fi; \
+	if [ -n "$$missing$$orphaned" ]; then exit 1; fi
 endef
 
 gen_apis:
@@ -490,7 +509,20 @@ package_offline: check_buildinstaller update_prepare_version compile build
 	@rm -rf $(HARBORPKG)
 	@echo "Done."
 
-go_check: gen_apis mocks_check misspell commentfmt lint
+go_check: tidy_check gen_apis mocks_check misspell commentfmt lint
+
+# Dependabot runs "go mod tidy" on a plain checkout, so it must be a no-op there.
+# This runs before gen_apis, on a tree that still has no generated code, so that a
+# change to the import set of the generated code cannot silently stale the blank
+# imports in src/server/v2.0/restapi/zz_generated_placeholder.go.
+tidy_check:
+	@echo checking go mod tidy on a checkout without generated code...
+	@cd ./src/; if ! go mod tidy -diff; then \
+		echo "go mod tidy is not a no-op here, so Dependabot cannot update any Go module."; \
+		echo "if the go-swagger import set changed, update the blank imports in"; \
+		echo "src/server/v2.0/restapi/zz_generated_placeholder.go to match."; \
+		exit 1; \
+	fi
 
 commentfmt:
 	@echo checking comment format...

src/.golangci.yaml

@@ -40,6 +40,20 @@ linters:
           - revive
         text: "var-naming: avoid package names that conflict with Go standard library package names"
         path: "(common/http/|lib/errors/|lib/http/)"
+      # The packages under server/v2.0/restapi/operations are named after the
+      # swagger tags in api/v2.0/swagger.yaml, some of which contain underscores.
+      # The generated files are skipped as generated code, the committed
+      # zz_generated_placeholder.go files are not.
+      - linters:
+          - revive
+        text: "var-naming: don't use an underscore in package name"
+        path: "server/v2\\.0/restapi/operations/.*/zz_generated_placeholder\\.go$"
+      # Same placeholders: "scanner" and "user" are swagger tag names that
+      # happen to match standard library package names.
+      - linters:
+          - revive
+        text: "var-naming: avoid package names that conflict with Go standard library package names"
+        path: "server/v2\\.0/restapi/operations/.*/zz_generated_placeholder\\.go$"
     paths:
       - third_party$
       - builtin$

src/common/dao/testutils.go

@@ -70,7 +70,7 @@ func PrepareTestForPostgresSQL() {
 		},
 	}
 
-	log.Infof("POSTGRES_HOST: %s, POSTGRES_USR: %s, POSTGRES_PORT: %d, POSTGRES_PWD: %s\n", dbHost, dbUser, dbPort, dbPassword)
+	log.Infof("POSTGRES_HOST: %s, POSTGRES_USR: %s, POSTGRES_PORT: %d\n", dbHost, dbUser, dbPort)
 	o = initDatabaseForTest(database)
 }
 

src/common/http/tls.go

@@ -66,14 +66,13 @@ func NewServerTLSConfig() *tls.Config {
 		PreferServerCipherSuites: true,
 		CurvePreferences: []tls.CurveID{
 			tls.CurveP256,
-			tls.X25519,
+			tls.CurveP384,
+			tls.CurveP521,
 		},
 		MinVersion: tls.VersionTLS12,
 		CipherSuites: []uint16{
 			tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-			tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
 			tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
-			tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
 			tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
 			tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
 		},

src/common/security/secret/context.go

@@ -49,7 +49,7 @@ func (s *SecurityContext) IsAuthenticated() bool {
 	}
 	valid := s.store.IsValid(s.secret)
 	if !valid {
-		log.Debugf("invalid secret: %s", s.secret)
+		log.Debug("invalid secret")
 	}
 
 	return valid

src/common/utils/encrypt.go

@@ -17,6 +17,7 @@ package utils
 import (
 	"crypto/aes"
 	"crypto/cipher"
+	"crypto/fips140"
 	"crypto/pbkdf2"
 	"crypto/rand"
 	"crypto/sha1" // nolint:gosec // G505: blocklisted import kept for legacy PBKDF2-SHA1 password verification only
@@ -61,7 +62,13 @@ const (
 // PBKDF2-HMAC-SHA256 with a high iteration count instead (see
 // pkg/user/manager.go). Please don't use SHA1 to hash any new secrets.
 var HashAlg = map[string]func() hash.Hash{
-	SHA1:         sha1.New, // nolint:gosec // G401/G505: weak hash kept only for legacy PBKDF2 password verification
+	SHA1: func() hash.Hash {
+		var h hash.Hash
+		fips140.WithoutEnforcement(func() {
+			h = sha1.New()
+		})
+		return h
+	}, // nolint:gosec // G401/G505: weak hash kept only for legacy PBKDF2 password verification
 	SHA256:       sha256.New,
 	PBKDF2SHA256: sha256.New,
 }
@@ -88,7 +95,10 @@ func pbkdf2Params(version string) (func() hash.Hash, int) {
 // Encrypt encrypts the content with salt
 func Encrypt(content string, salt string, encryptAlg string) string {
 	alg, iterations := pbkdf2Params(encryptAlg)
-	key, _ := pbkdf2.Key(alg, content, []byte(salt), iterations, 16)
+	var key []byte
+	fips140.WithoutEnforcement(func() {
+		key, _ = pbkdf2.Key(alg, content, []byte(salt), iterations, 16)
+	})
 	return fmt.Sprintf("%x", key)
 }
 
@@ -114,7 +124,10 @@ func ReversibleEncrypt(str, key string) (string, error) {
 		return "", err
 	}
 
-	cfb := cipher.NewCFBEncrypter(block, iv)
+	var cfb cipher.Stream
+	fips140.WithoutEnforcement(func() {
+		cfb = cipher.NewCFBEncrypter(block, iv)
+	})
 	cfb.XORKeyStream(cipherText[aes.BlockSize:], []byte(str))
 	encrypted := EncryptHeaderV1 + base64.StdEncoding.EncodeToString(cipherText)
 	return encrypted, nil
@@ -154,7 +167,10 @@ func decryptAES(str, key string) (string, error) {
 
 	iv := cipherText[:aes.BlockSize]
 	cipherText = cipherText[aes.BlockSize:]
-	cfb := cipher.NewCFBDecrypter(block, iv)
+	var cfb cipher.Stream
+	fips140.WithoutEnforcement(func() {
+		cfb = cipher.NewCFBDecrypter(block, iv)
+	})
 	cfb.XORKeyStream(cipherText, cipherText)
 	return string(cipherText), nil
 }

src/common/utils/test/database.go

@@ -63,7 +63,7 @@ func InitDatabaseFromEnv() {
 		},
 	}
 
-	log.Infof("POSTGRES_HOST: %s, POSTGRES_USR: %s, POSTGRES_PORT: %d, POSTGRES_PWD: %s\n", dbHost, dbUser, dbPort, dbPassword)
+	log.Infof("POSTGRES_HOST: %s, POSTGRES_USR: %s, POSTGRES_PORT: %d\n", dbHost, dbUser, dbPort)
 
 	if err := dao.InitDatabase(database); err != nil {
 		log.Fatalf("failed to init database : %v", err)

src/common/utils/utils.go

@@ -51,7 +51,26 @@ func ParseEndpoint(endpoint string) (*url.URL, error) {
 		endpoint = "http://" + endpoint
 	}
 
-	return url.ParseRequestURI(endpoint)
+	u, err := url.ParseRequestURI(endpoint)
+	if err == nil && u != nil {
+		u.Host = strings.ToLower(u.Host)
+	}
+	return u, err
+}
+
+// EqualURL checks whether two URLs are equal, with case-insensitive host matching per RFC 1035.
+func EqualURL(rawURL1, rawURL2 string) bool {
+	if rawURL1 == rawURL2 {
+		return true
+	}
+	u1, err1 := url.Parse(rawURL1)
+	u2, err2 := url.Parse(rawURL2)
+	if err1 != nil || err2 != nil {
+		return false
+	}
+	u1.Host = strings.ToLower(u1.Host)
+	u2.Host = strings.ToLower(u2.Host)
+	return u1.String() == u2.String()
 }
 
 // ParseRepository splits a repository into two parts: project and rest
@@ -66,19 +85,33 @@ func ParseRepository(repository string) (project, rest string) {
 	return
 }
 
-// GenerateRandomStringWithLen generates a random string with length
-func GenerateRandomStringWithLen(length int) string {
+// GenerateRandomStringWithLenAndError generates a random string with length or returns an error if entropy cannot be read
+func GenerateRandomStringWithLenAndError(length int) (string, error) {
 	const chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
 	l := len(chars)
 	result := make([]byte, length)
 	_, err := rand.Read(result)
 	if err != nil {
-		log.Warningf("Error reading random bytes: %v", err)
+		return "", fmt.Errorf("failed to read random bytes: %w", err)
 	}
 	for i := range length {
 		result[i] = chars[int(result[i])%l]
 	}
-	return string(result)
+	return string(result), nil
+}
+
+// GenerateRandomStringOrError generates a random string with 32 byte length or returns an error if entropy cannot be read
+func GenerateRandomStringOrError() (string, error) {
+	return GenerateRandomStringWithLenAndError(32)
+}
+
+// GenerateRandomStringWithLen generates a random string with length
+func GenerateRandomStringWithLen(length int) string {
+	str, err := GenerateRandomStringWithLenAndError(length)
+	if err != nil {
+		log.Warningf("Error reading random bytes: %v", err)
+	}
+	return str
 }
 
 // GenerateRandomString generate a random string with 32 byte length

src/common/utils/utils_test.go

@@ -37,6 +37,9 @@ func TestParseEndpoint(t *testing.T) {
 		{"ftp://example.com", true, ""},
 		{"http://example.com", false, "http://example.com"},
 		{"https://example.com", false, "https://example.com"},
+		{"http://EXAMPLE.COM", false, "http://example.com"},
+		{"https://EXAMPLE.COM:8080/Path", false, "https://example.com:8080/Path"},
+		{" MIXED.case.com/path/ ", false, "http://mixed.case.com/path"},
 		{"http://example!@#!?//#", true, ""},
 	}
 
@@ -51,6 +54,31 @@ func TestParseEndpoint(t *testing.T) {
 	}
 }
 
+func TestEqualURL(t *testing.T) {
+	cases := []struct {
+		url1     string
+		url2     string
+		expected bool
+	}{
+		{"http://example.com:8080/v2", "http://example.com:8080/v2", true},
+		{"http://EXAMPLE.COM:8080/v2", "http://example.com:8080/v2", true},
+		{"http://example.com:8080/V2", "http://example.com:8080/v2", false},
+		{"https://core:8080", "https://CORE:8080", true},
+		{"http://example.com", "https://example.com", false},
+		{"http://example.com:8080", "http://example.com:8081", false},
+		{"http://example.com/foo", "http://example.com/bar", false},
+		{"://invalid-url-1", "http://example.com", false},
+		{"http://example.com", "://invalid-url-2", false},
+		{"http://example.com/A%", "http://example.com/a%", false},
+	}
+
+	for _, c := range cases {
+		t.Run(c.url1+"_vs_"+c.url2, func(t *testing.T) {
+			assert.Equal(t, c.expected, EqualURL(c.url1, c.url2))
+		})
+	}
+}
+
 func TestParseRepository(t *testing.T) {
 	repository := "library/ubuntu"
 	project, rest := ParseRepository(repository)
@@ -155,13 +183,28 @@ func TestGenerateRandomString(t *testing.T) {
 	}
 }
 
+func TestGenerateRandomStringOrError(t *testing.T) {
+	str, err := GenerateRandomStringOrError()
+	assert.Nil(t, err)
+	assert.Equal(t, 32, len(str))
+	str2, err := GenerateRandomStringOrError()
+	assert.Nil(t, err)
+	assert.NotEqual(t, str, str2)
+}
+
 func TestGenerateRandomStringWithLen(t *testing.T) {
 	str := GenerateRandomStringWithLen(16)
 	if len(str) != 16 {
 		t.Errorf("Failed to generate ramdom string with fixed length.")
 	}
 }
 
+func TestGenerateRandomStringWithLenAndError(t *testing.T) {
+	str, err := GenerateRandomStringWithLenAndError(16)
+	assert.Nil(t, err)
+	assert.Equal(t, 16, len(str))
+}
+
 func TestTestTCPConn(t *testing.T) {
 	server := httptest.NewServer(nil)
 	defer server.Close()

src/controller/artifact/model_test.go

@@ -54,7 +54,7 @@ func TestUnmarshalJSONWithACCUnknownType(t *testing.T) {
 	var artifact []Artifact
 	err := json.Unmarshal(data, &artifact)
 	assert.NotNil(t, err)
-	assert.Contains(t, err.Error(), "accessory type  not support")
+	assert.Contains(t, err.Error(), `unsupported accessory type ""`)
 }
 
 func TestUnmarshalJSONWithoutACC(t *testing.T) {