chore: sync with upstream goharbor/harbor

[github-actions]

Automated PR to sync 4 new commit(s) from upstream goharbor/harbor main branch.

Merge strategy: Our changes in next are preserved on conflicts (upstream changes are additive only).

Note: The .github folder is preserved and not synced from upstream.

---

Summary by cubic

Sync with upstream Harbor to add per-endpoint CA certificate support for registry endpoints, introduce release signature verification docs, and improve user/group search accuracy and performance.

• New Features

  • Per-endpoint CA certificate for registries: API, DB (new ca_certificate column), HTTP transport, and UI support. PEM is validated server-side; custom CA overrides system CA; disabled when “insecure” is set.
  • Release artifacts are now documented for Cosign keyless signature verification, with a quick guide in README and a detailed doc.

• Bug Fixes

  • User and user group search now uses DB fuzzy queries with length/alphabetical ordering, removing the old in-code sorter and returning better results within page size limits.

^{Written for commit cd72ec3. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate failed

Failed conditions
5.8% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

[cubic-dev-ai]

7 issues found across 70 files

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="src/server/v2.0/handler/usergroup.go">

<violation number="1" location="src/server/v2.0/handler/usergroup.go:205">
P1: Pagination is broken: `SearchByName` only accepts `limitSize` and ignores `params.Page`. Users requesting page 2+ will receive the same results as page 1, while the response still includes pagination links and total count suggesting pagination works. Either pass pagination offset to `SearchByName` or remove the pagination response headers for this endpoint.</violation>
</file>

<file name="src/server/v2.0/handler/user.go">

<violation number="1" location="src/server/v2.0/handler/user.go:281">
P1: Pagination is broken: `SearchByName` only accepts `limitSize` and ignores the `params.Page` parameter. Requests for page 2+ will return the same results as page 1, while the response headers incorrectly indicate pagination is supported.</violation>
</file>

<file name="tests/apitests/python/library/cosign.py">

<violation number="1" location="tests/apitests/python/library/cosign.py:15">
P3: Typo in comment: "ennvironment" should be "environment".</violation>

<violation number="2" location="tests/apitests/python/library/cosign.py:17">
P3: Typo in print statement: "coisgn" should be "cosign".</violation>
</file>

<file name="src/portal/src/i18n/lang/zh-cn-lang.json">

<violation number="1" location="src/portal/src/i18n/lang/zh-cn-lang.json:671">
P1: Missing comma after the `PLACEHOLDER` property. Since new properties are added after it, JSON syntax requires a trailing comma on the `PLACEHOLDER` line. This will cause a JSON parse error.</violation>
</file>

<file name="src/pkg/usergroup/dao/dao.go">

<violation number="1" location="src/pkg/usergroup/dao/dao.go:176">
P2: LIKE pattern wildcards (`%`, `_`) in `name` are not escaped, allowing users to bypass fuzzy search restrictions. For example, searching for `%` matches all records. Consider escaping these characters using `strings.NewReplacer("%", "\\%", "_", "\\_").Replace(name)` and adding `ESCAPE '\\'` to the LIKE clause.</violation>
</file>

<file name="src/pkg/user/dao/dao.go">

<violation number="1" location="src/pkg/user/dao/dao.go:136">
P2: LIKE pattern characters (`%`, `_`) in user input are not escaped, which could lead to unexpected search results or allow users to craft patterns that match more users than intended. Consider escaping these characters before building the pattern.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: Pagination is broken: SearchByName only accepts limitSize and ignores params.Page. Users requesting page 2+ will receive the same results as page 1, while the response still includes pagination links and total count suggesting pagination works. Either pass pagination offset to SearchByName or remove the pagination response headers for this endpoint.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/server/v2.0/handler/usergroup.go, line 205:

<comment>Pagination is broken: `SearchByName` only accepts `limitSize` and ignores `params.Page`. Users requesting page 2+ will receive the same results as page 1, while the response still includes pagination links and total count suggesting pagination works. Either pass pagination offset to `SearchByName` or remove the pagination response headers for this endpoint.</comment>

<file context>
@@ -204,14 +202,11 @@ func (u *userGroupAPI) SearchUserGroups(ctx context.Context, params operation.Se
 		return operation.NewSearchUserGroupsOK().WithXTotalCount(0).WithPayload([]*models.UserGroupSearchItem{})
 	}
-	ug, err := u.ctl.List(ctx, query)
+	ug, err := u.ctl.SearchByName(ctx, params.Groupname, int(*params.PageSize))
 	if err != nil {
 		return u.SendError(ctx, err)
</file context>

[cubic-dev-ai]

P1: Pagination is broken: SearchByName only accepts limitSize and ignores the params.Page parameter. Requests for page 2+ will return the same results as page 1, while the response headers incorrectly indicate pagination is supported.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/server/v2.0/handler/user.go, line 281:

<comment>Pagination is broken: `SearchByName` only accepts `limitSize` and ignores the `params.Page` parameter. Requests for page 2+ will return the same results as page 1, while the response headers incorrectly indicate pagination is supported.</comment>

<file context>
@@ -279,7 +278,7 @@ func (u *usersAPI) SearchUsers(ctx context.Context, params operation.SearchUsers
 		return operation.NewSearchUsersOK().WithXTotalCount(0).WithPayload([]*models.UserSearchRespItem{})
 	}
-	l, err := u.ctl.List(ctx, query)
+	l, err := u.ctl.SearchByName(ctx, params.Username, int(*params.PageSize))
 	if err != nil {
 		return u.SendError(ctx, err)
</file context>

[cubic-dev-ai]

P1: Missing comma after the PLACEHOLDER property. Since new properties are added after it, JSON syntax requires a trailing comma on the PLACEHOLDER line. This will cause a JSON parse error.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/portal/src/i18n/lang/zh-cn-lang.json, line 671:

<comment>Missing comma after the `PLACEHOLDER` property. Since new properties are added after it, JSON syntax requires a trailing comma on the `PLACEHOLDER` line. This will cause a JSON parse error.</comment>

<file context>
@@ -668,6 +668,9 @@
         "DELETED_FAILED": "删除目标失败。",
         "CANNOT_EDIT": "当复制规则启用时目标无法修改。",
         "PLACEHOLDER": "未发现任何复制目标!"
+        "CA_CERTIFICATE": "CA 证书",
+        "CA_CERTIFICATE_TOOLTIP": "提供 PEM 编码的 CA 证书以验证仓库的 TLS 证书。留空将使用系统 CA 池。此字段仅在启用"验证远程证书"时可用。",
+        "CA_CERTIFICATE_HELPER": "可选。在此粘贴 PEM 编码的 CA 证书，以信任此端点的自签名或私有 CA 证书。如果留空，Harbor 将使用系统 CA 池。"
</file context>

[cubic-dev-ai]

P2: LIKE pattern wildcards (%, _) in name are not escaped, allowing users to bypass fuzzy search restrictions. For example, searching for % matches all records. Consider escaping these characters using strings.NewReplacer("%", "\\%", "_", "\\_").Replace(name) and adding ESCAPE '\\' to the LIKE clause.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/pkg/usergroup/dao/dao.go, line 176:

<comment>LIKE pattern wildcards (`%`, `_`) in `name` are not escaped, allowing users to bypass fuzzy search restrictions. For example, searching for `%` matches all records. Consider escaping these characters using `strings.NewReplacer("%", "\\%", "_", "\\_").Replace(name)` and adding `ESCAPE '\\'` to the LIKE clause.</comment>

<file context>
@@ -185,3 +164,19 @@ func (d *dao) Count(ctx context.Context, query *q.Query) (int64, error) {
+	var usergroups []*model.UserGroup
+	// use raw sql to return the most matched user first, then by alphabetic order
+	sql := "select id, group_name, group_type, ldap_group_dn, creation_time, update_time from user_group where group_name like ? order by length(group_name), group_name asc limit ?"
+	likePattern := "%" + name + "%"
+	_, err = o.Raw(sql, likePattern, limitSize).QueryRows(&usergroups)
+	if err != nil {
</file context>

[cubic-dev-ai]

P2: LIKE pattern characters (%, _) in user input are not escaped, which could lead to unexpected search results or allow users to craft patterns that match more users than intended. Consider escaping these characters before building the pattern.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/pkg/user/dao/dao.go, line 136:

<comment>LIKE pattern characters (`%`, `_`) in user input are not escaped, which could lead to unexpected search results or allow users to craft patterns that match more users than intended. Consider escaping these characters before building the pattern.</comment>

<file context>
@@ -122,3 +124,24 @@ func (d *dao) List(ctx context.Context, query *q.Query) ([]*commonmodels.User, e
+	var users []*User
+	// use raw sql to return the most matched user first, then by alphabetic order
+	sql := "select * from harbor_user where username like ? and deleted = false order by length(username), username asc limit ?"
+	likePattern := "%" + name + "%"
+	_, err = o.Raw(sql, likePattern, limitSize).QueryRows(&users)
+	if err != nil {
</file context>

[cubic-dev-ai]

P3: Typo in print statement: "coisgn" should be "cosign".

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At tests/apitests/python/library/cosign.py, line 17:

<comment>Typo in print statement: "coisgn" should be "cosign".</comment>

<file context>
@@ -11,11 +11,23 @@ def generate_key_pair():
+# known issue for proxy ennvironment https://github.com/sigstore/cosign/issues/3269
 def sign_artifact(artifact):
-    command = ["cosign", "sign", "-y", "--allow-insecure-registry", "--key", "cosign.key", artifact]
+    print("*******Start coisgn sign artifact********")
+    allow_insecure = base.getenv_bool("ALLOW_INSECURE", default=True)
+    if allow_insecure:
</file context>

Suggested change

	print("*******Start coisgn sign artifact********")
	print("*******Start cosign sign artifact********")

[cubic-dev-ai]

P3: Typo in comment: "ennvironment" should be "environment".

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At tests/apitests/python/library/cosign.py, line 15:

<comment>Typo in comment: "ennvironment" should be "environment".</comment>

<file context>
@@ -11,11 +11,23 @@ def generate_key_pair():
     base.run_command(command)
 
+
+# known issue for proxy ennvironment https://github.com/sigstore/cosign/issues/3269
 def sign_artifact(artifact):
-    command = ["cosign", "sign", "-y", "--allow-insecure-registry", "--key", "cosign.key", artifact]
</file context>

Suggested change

	# known issue for proxy ennvironment https://github.com/sigstore/cosign/issues/3269
	# known issue for proxy environment https://github.com/sigstore/cosign/issues/3269