fix: add support for sha256 and sha512 in htpasswd #3497

rchincha · 2025-10-30T07:08:51Z

Fixes issue #3495

What type of PR is this?

Which issue does this PR fix:

What does this PR do / Why do we need it:

If an issue # is not available please add repro steps and logs showing the issue:

Testing done on this change:

Automation added to e2e:

Will this break upgrades or downgrades?

Does this PR introduce any user-facing change?:

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

codecov · 2025-10-30T07:27:31Z

Codecov Report

❌ Patch coverage is 72.05882% with 19 lines in your changes missing coverage. Please review.
✅ Project coverage is 91.66%. Comparing base (aaba362) to head (732b810).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/test/common/fs.go	76.74%	6 Missing and 4 partials ⚠️
pkg/api/htpasswd.go	64.00%	6 Missing and 3 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3497      +/-   ##
==========================================
- Coverage   91.71%   91.66%   -0.06%     
==========================================
  Files         185      185              
  Lines       25674    25736      +62     
==========================================
+ Hits        23547    23590      +43     
- Misses       1374     1386      +12     
- Partials      753      760       +7

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copilot

Pull Request Overview

This PR adds support for SHA-256 and SHA-512 password hashing algorithms to htpasswd authentication, particularly to support FIPS-140 compliance where bcrypt is not approved. The implementation adds dual-path authentication that uses bcrypt for existing hashes (but warns when FIPS-140 is enabled) and supports crypt-SHA hashes as FIPS-140 compliant alternatives.

Adds github.com/GehirnInc/crypt and github.com/tg123/go-htpasswd dependencies for SHA-256/512 support
Implements SHA-256 and SHA-512 credential generation functions
Updates authentication logic to detect hash types and use appropriate verification method with FIPS-140 awareness

Reviewed Changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
test/blackbox/helpers_zot.bash	Adds additional test user credentials for authentication testing
test/blackbox/fips140_authn.bats	New test suite for FIPS-140 authentication scenarios using regclient
pkg/test/image-utils/upload_test.go	Renames function calls to use `GetBcryptCredString` for clarity
pkg/test/common/fs_test.go	Updates test to use renamed `GetBcryptCredString` function
pkg/test/common/fs.go	Adds SHA-256/512 credential generation functions and renames bcrypt function
pkg/api/htpasswd_test.go	Updates all test cases to use renamed `GetBcryptCredString` function
pkg/api/htpasswd.go	Implements hash type detection and dual-path authentication with FIPS-140 support
go.sum	Adds checksums for new crypt and go-htpasswd dependencies
go.mod	Declares new dependencies for SHA-based password hashing

Comments suppressed due to low confidence (1)

pkg/api/htpasswd.go:24

The comment states that HTPasswd 'Currently supports only bcrypt hashes', but the code now supports SHA-256 and SHA-512 hashes as well. This documentation should be updated to reflect the new capabilities.

// HTPasswd user auth store
//
// Currently supports only bcrypt hashes.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

test/blackbox/helpers_zot.bash

pkg/api/htpasswd.go

pkg/test/common/fs.go

pkg/api/htpasswd.go

Copilot

Pull Request Overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 8 comments.

Comments suppressed due to low confidence (2)

pkg/api/htpasswd.go:23

The comment states that only bcrypt hashes are supported, but the code now also supports SHA-256 and SHA-512 hashes. Update this comment to reflect the current functionality.

// Currently supports only bcrypt hashes.

pkg/api/htpasswd.go:128

This statement is unreachable.

	return false, present

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

pkg/api/htpasswd.go

pkg/test/common/fs.go

test/blackbox/fips140_authn.bats

pkg/test/common/fs.go

Copilot

Pull Request Overview

Copilot reviewed 24 out of 25 changed files in this pull request and generated 6 comments.

Comments suppressed due to low confidence (1)

pkg/api/controller_test.go:735

The variable testString is undefined in this scope. It should use an element from the singleCredtests slice. Based on the loop structure, this should likely iterate over singleCredtests using for _, testString := range singleCredtests { or reference a specific test string from the slice.

				htpasswdPath := test.MakeHtpasswdFileFromString(testString)

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

pkg/test/common/fs.go

pkg/api/controller_test.go

pkg/api/htpasswd.go

test/blackbox/fips140_authn.bats

andaaron

Please resolve the copilot reviews if they are done.

examples/config-minimal.json

test/blackbox/fips140_authn.bats

Copilot

Pull Request Overview

Copilot reviewed 24 out of 25 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

pkg/test/common/fs.go

Copilot

Pull Request Overview

Copilot reviewed 24 out of 25 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

pkg/test/common/fs.go

test/blackbox/fips140_authn.bats

Copilot

Pull Request Overview

Copilot reviewed 24 out of 25 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

pkg/api/htpasswd.go:23

The comment states 'Currently supports only bcrypt hashes' but the implementation now supports bcrypt, SHA-256, and SHA-512 hashes. This documentation should be updated to reflect the new capabilities.

// HTPasswd user auth store
//
// Currently supports only bcrypt hashes.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

test/blackbox/fips140_authn.bats

Copilot

Pull Request Overview

Copilot reviewed 24 out of 25 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

test/blackbox/fips140_authn.bats

pkg/test/common/fs.go

test/blackbox/fips140_authn.bats

pkg/test/common/fs.go

test/blackbox/fips140_authn.bats

Copilot

Pull Request Overview

Copilot reviewed 25 out of 26 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

pkg/api/htpasswd.go:23

The comment states that HTPasswd 'Currently supports only bcrypt hashes', but the code now also supports SHA256 and SHA512 hashes. Update the comment to reflect the expanded support: 'Supports bcrypt, SHA256, and SHA512 hashes.'

// HTPasswd user auth store
//
// Currently supports only bcrypt hashes.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull Request Overview

Copilot reviewed 25 out of 26 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

test/blackbox/fips140_authn.bats

pkg/test/common/fs.go

test/blackbox/fips140_authn.bats

Fixes issue project-zot#3495 We currently support only bcrypt htpasswd hashes, however bcrypt is not FIPS-140 approved since it uses Blowfish. This PR adds support for sha256 and sha512 formats and enforces that bcrypt be disabled when fips140 mode is enabled. Signed-off-by: Ramkumar Chinchani <[email protected]>

rchincha force-pushed the issue-3495 branch from daeaee4 to d268163 Compare October 31, 2025 07:50

rchincha requested a review from Copilot October 31, 2025 08:01

Copilot AI reviewed Oct 31, 2025

View reviewed changes

test/blackbox/helpers_zot.bash Outdated Show resolved Hide resolved

pkg/api/htpasswd.go Outdated Show resolved Hide resolved

pkg/test/common/fs.go Outdated Show resolved Hide resolved

pkg/test/common/fs.go Outdated Show resolved Hide resolved

pkg/api/htpasswd.go Show resolved Hide resolved

rchincha force-pushed the issue-3495 branch from 0e1d1d7 to 81e6ac1 Compare November 1, 2025 02:03

rchincha requested a review from Copilot November 1, 2025 03:32

Copilot AI reviewed Nov 1, 2025

View reviewed changes

rchincha force-pushed the issue-3495 branch 13 times, most recently from 5b11a41 to 3d3c18d Compare November 5, 2025 08:23

rchincha marked this pull request as ready for review November 5, 2025 08:24

rchincha requested a review from andaaron as a code owner November 5, 2025 08:24

rchincha requested a review from Copilot November 5, 2025 08:27

Copilot AI reviewed Nov 5, 2025

View reviewed changes

rchincha force-pushed the issue-3495 branch 4 times, most recently from 8664860 to 01a3f15 Compare November 5, 2025 18:15

andaaron reviewed Nov 5, 2025

View reviewed changes

examples/config-minimal.json Show resolved Hide resolved

test/blackbox/fips140_authn.bats Outdated Show resolved Hide resolved

rchincha requested a review from Copilot November 5, 2025 22:43

Copilot AI reviewed Nov 7, 2025

View reviewed changes

pkg/test/common/fs.go Show resolved Hide resolved

rchincha force-pushed the issue-3495 branch 2 times, most recently from a0540c8 to bc34f19 Compare November 7, 2025 08:36

rchincha requested a review from Copilot November 7, 2025 08:36

Copilot AI reviewed Nov 7, 2025

View reviewed changes

pkg/test/common/fs.go Outdated Show resolved Hide resolved

test/blackbox/fips140_authn.bats Outdated Show resolved Hide resolved

rchincha force-pushed the issue-3495 branch 2 times, most recently from 05f8050 to 5eb6d8a Compare November 7, 2025 08:49

rchincha requested a review from Copilot November 7, 2025 08:49

Copilot AI reviewed Nov 7, 2025

View reviewed changes

test/blackbox/fips140_authn.bats Outdated Show resolved Hide resolved

rchincha force-pushed the issue-3495 branch from 1f2c42f to b215d85 Compare November 7, 2025 18:46

rchincha requested a review from Copilot November 7, 2025 18:56

Copilot AI reviewed Nov 7, 2025

View reviewed changes

test/blackbox/fips140_authn.bats Outdated Show resolved Hide resolved

pkg/test/common/fs.go Show resolved Hide resolved

test/blackbox/fips140_authn.bats Show resolved Hide resolved

pkg/test/common/fs.go Outdated Show resolved Hide resolved

andaaron reviewed Nov 7, 2025

View reviewed changes

test/blackbox/fips140_authn.bats Show resolved Hide resolved

rchincha force-pushed the issue-3495 branch 2 times, most recently from c08b846 to 4a70b81 Compare November 7, 2025 23:01

rchincha requested review from andaaron and Copilot November 7, 2025 23:01

Copilot AI reviewed Nov 7, 2025

View reviewed changes

rchincha force-pushed the issue-3495 branch from 4a70b81 to b59b301 Compare November 7, 2025 23:20

rchincha requested a review from Copilot November 8, 2025 05:21

Copilot AI reviewed Nov 8, 2025

View reviewed changes

rchincha force-pushed the issue-3495 branch from b59b301 to 5815d5f Compare November 8, 2025 06:44

andaaron previously approved these changes Nov 8, 2025

View reviewed changes

test/blackbox/fips140_authn.bats Show resolved Hide resolved

test/blackbox/fips140_authn.bats Show resolved Hide resolved

rchincha dismissed andaaron’s stale review via 732b810 November 8, 2025 15:22

rchincha force-pushed the issue-3495 branch from 5815d5f to 732b810 Compare November 8, 2025 15:22

rchincha requested a review from andaaron November 8, 2025 15:31

andaaron approved these changes Nov 9, 2025

View reviewed changes

andaaron merged commit 04ae0a9 into project-zot:main Nov 9, 2025
41 of 49 checks passed

rchincha mentioned this pull request Nov 9, 2025

[Bug]: FIPS mode using authorized hashing for passwords #3495

Closed

fix: add support for sha256 and sha512 in htpasswd #3497

fix: add support for sha256 and sha512 in htpasswd #3497

Uh oh!

Conversation

rchincha commented Oct 30, 2025

Uh oh!

codecov bot commented Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

andaaron left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

codecov bot commented Oct 30, 2025 •

edited

Loading