Repository: dexidp/dex
Pull request #3797 (2024-10-16 04:06:55)

build(deps): bump aquasecurity/trivy-action from 0.24.0 to 0.28.0
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.24.0 to 0.28.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/aquasecurity/trivy-action/releases">aquasecurity/trivy-action's releases</a>.</em></p>
<blockquote>
<h2>v0.28.0</h2>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): bump setup-trivy to v0.2.1 by <a href="https://github.com/DmitriyLewen"><code>@​DmitriyLewen</code></a> in <a href="https://redirect.github.com/aquasecurity/trivy-action/pull/411">aquasecurity/trivy-action#411</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/aquasecurity/trivy-action/compare/0.27.0...0.28.0">https://github.com/aquasecurity/trivy-action/compare/0.27.0...0.28.0</a></p>
<h2>v0.27.0</h2>
<h2>What's Changed</h2>
<ul>
<li>ci: use <code>setup-trivy</code> to install Trivy by <a href="https://github.com/DmitriyLewen"><code>@​DmitriyLewen</code></a> in <a href="https://redirect.github.com/aquasecurity/trivy-action/pull/406">aquasecurity/trivy-action#406</a></li>
<li>chore: update description for scanners and format inputs by <a href="https://github.com/nikpivkin"><code>@​nikpivkin</code></a> in <a href="https://redirect.github.com/aquasecurity/trivy-action/pull/407">aquasecurity/trivy-action#407</a></li>
<li>fix: set envs only when passed by <a href="https://github.com/knqyf263"><code>@​knqyf263</code></a> in <a href="https://redirect.github.com/aquasecurity/trivy-action/pull/405">aquasecurity/trivy-action#405</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/aquasecurity/trivy-action/compare/0.26.0...0.27.0">https://github.com/aquasecurity/trivy-action/compare/0.26.0...0.27.0</a></p>
<h2>v0.26.0</h2>
<h2>What's Changed</h2>
<ul>
<li>docs: add usage info about <code>action/cache</code> for trivy databases by <a href="https://github.com/DmitriyLewen"><code>@​DmitriyLewen</code></a> in <a href="https://redirect.github.com/aquasecurity/trivy-action/pull/397">aquasecurity/trivy-action#397</a></li>
<li>feat: store artifacts in cache by default by <a href="https://github.com/knqyf263"><code>@​knqyf263</code></a> in <a href="https://redirect.github.com/aquasecurity/trivy-action/pull/399">aquasecurity/trivy-action#399</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/aquasecurity/trivy-action/compare/0.25.0...0.26.0">https://github.com/aquasecurity/trivy-action/compare/0.25.0...0.26.0</a></p>
<h2>v0.25.0</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(Makefile): recursive option typo by <a href="https://github.com/chohner"><code>@​chohner</code></a> in <a href="https://redirect.github.com/aquasecurity/trivy-action/pull/371">aquasecurity/trivy-action#371</a></li>
<li>chore: use checks bundle snapshot from trivy-action by <a href="https://github.com/nikpivkin"><code>@​nikpivkin</code></a> in <a href="https://redirect.github.com/aquasecurity/trivy-action/pull/388">aquasecurity/trivy-action#388</a></li>
<li>Upgrade GitHub actions by <a href="https://github.com/obounaim"><code>@​obounaim</code></a> in <a href="https://redirect.github.com/aquasecurity/trivy-action/pull/374">aquasecurity/trivy-action#374</a></li>
<li>ci: sync trivy-checks version 1 by <a href="https://github.com/nikpivkin"><code>@​nikpivkin</code></a> in <a href="https://redirect.github.com/aquasecurity/trivy-action/pull/398">aquasecurity/trivy-action#398</a></li>
<li>feat(trivy): Bump to support v0.56.1 by <a href="https://github.com/simar7"><code>@​simar7</code></a> in <a href="https://redirect.github.com/aquasecurity/trivy-action/pull/387">aquasecurity/trivy-action#387</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/chohner"><code>@​chohner</code></a> made their first contribution in <a href="https://redirect.github.com/aquasecurity/trivy-action/pull/371">aquasecurity/trivy-action#371</a></li>
<li><a href="https://github.com/obounaim"><code>@​obounaim</code></a> made their first contribution in <a href="https://redirect.github.com/aquasecurity/trivy-action/pull/374">aquasecurity/trivy-action#374</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/aquasecurity/trivy-action/compare/0.24.0...0.25.0">https://github.com/aquasecurity/trivy-action/compare/0.24.0...0.25.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/aquasecurity/trivy-action/commit/915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2"><code>915b19b</code></a> chore(deps): bump setup-trivy to v0.2.1 (<a href="https://redirect.github.com/aquasecurity/trivy-action/issues/411">#411</a>)</li>
<li><a href="https://github.com/aquasecurity/trivy-action/commit/5681af892cd0f4997658e2bacc62bd0a894cf564"><code>5681af8</code></a> fix: set envs only when passed (<a href="https://redirect.github.com/aquasecurity/trivy-action/issues/405">#405</a>)</li>
<li><a href="https://github.com/aquasecurity/trivy-action/commit/807896715e16054f9ae275ea68a15ee3908f0124"><code>8078967</code></a> chore: update description for scanners and format inputs (<a href="https://redirect.github.com/aquasecurity/trivy-action/issues/407">#407</a>)</li>
<li><a href="https://github.com/aquasecurity/trivy-action/commit/0fa0cdb177a063429d52b85bca1bb4deb7b5c171"><code>0fa0cdb</code></a> ci: use <code>setup-trivy</code> to install Trivy (<a href="https://redirect.github.com/aquasecurity/trivy-action/issues/406">#406</a>)</li>
<li><a href="https://github.com/aquasecurity/trivy-action/commit/a20de5420d57c4102486cdd9578b45609c99d7eb"><code>a20de54</code></a> feat: store artifacts in cache by default (<a href="https://redirect.github.com/aquasecurity/trivy-action/issues/399">#399</a>)</li>
<li><a href="https://github.com/aquasecurity/trivy-action/commit/1b8b83dcc27a38f7d5506919fcea6945aa29b3b8"><code>1b8b83d</code></a> docs: add usage info about <code>action/cache</code> for trivy databases (<a href="https://redirect.github.com/aquasecurity/trivy-action/issues/397">#397</a>)</li>
<li><a href="https://github.com/aquasecurity/trivy-action/commit/f781cce5aab226378ee181d764ab90ea0be3cdd8"><code>f781cce</code></a> feat(trivy): Bump to support v0.56.1 (<a href="https://redirect.github.com/aquasecurity/trivy-action/issues/387">#387</a>)</li>
<li><a href="https://github.com/aquasecurity/trivy-action/commit/54f21d8382e6085148450a60ae9f75c608abcbcb"><code>54f21d8</code></a> ci: sync trivy-checks version 1 (<a href="https://redirect.github.com/aquasecurity/trivy-action/issues/398">#398</a>)</li>
<li><a href="https://github.com/aquasecurity/trivy-action/commit/89b14e517dd8699cba3d787e53d4355cad28605c"><code>89b14e5</code></a> Upgrade GitHub actions (<a href="https://redirect.github.com/aquasecurity/trivy-action/issues/374">#374</a>)</li>
<li><a href="https://github.com/aquasecurity/trivy-action/commit/97646fedde05bcd0961217c60b50e23f721e7ec7"><code>97646fe</code></a> chore: use checks bundle snapshot from trivy-action (<a href="https://redirect.github.com/aquasecurity/trivy-action/issues/388">#388</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/aquasecurity/trivy-action/compare/6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8...915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=aquasecurity/trivy-action&package-manager=github_actions&previous-version=0.24.0&new-version=0.28.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


Patch:
diff --git a/.github/workflows/artifacts.yaml b/.github/workflows/artifacts.yaml
index 606c655f..29d9d686 100644
--- a/.github/workflows/artifacts.yaml
+++ b/.github/workflows/artifacts.yaml
@@ -193,7 +193,7 @@ jobs:
         if: inputs.publish
 
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # 0.24.0
+        uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2 # 0.28.0
         with:
           input: image
           format: sarif
diff --git a/pkg/httpclient/httpclient.go b/pkg/httpclient/httpclient.go
index 04837a7d..671e0e77 100644
--- a/pkg/httpclient/httpclient.go
+++ b/pkg/httpclient/httpclient.go
@@ -3,6 +3,7 @@ package httpclient
 import (
 	"crypto/tls"
 	"crypto/x509"
+	"encoding/base64"
 	"fmt"
 	"net"
 	"net/http"
@@ -10,6 +11,26 @@ import (
 	"time"
 )
 
+func extractCAs(input []string) [][]byte {
+	result := make([][]byte, 0, len(input))
+	for _, ca := range input {
+		if ca == "" {
+			continue
+		}
+
+		pemData, err := os.ReadFile(ca)
+		if err != nil {
+			pemData, err = base64.StdEncoding.DecodeString(ca)
+			if err != nil {
+				pemData = []byte(ca)
+			}
+		}
+
+		result = append(result, pemData)
+	}
+	return result
+}
+
 func NewHTTPClient(rootCAs []string, insecureSkipVerify bool) (*http.Client, error) {
 	pool, err := x509.SystemCertPool()
 	if err != nil {
@@ -17,13 +38,11 @@ func NewHTTPClient(rootCAs []string, insecureSkipVerify bool) (*http.Client, err
 	}
 
 	tlsConfig := tls.Config{RootCAs: pool, InsecureSkipVerify: insecureSkipVerify}
-	for _, rootCA := range rootCAs {
-		rootCABytes, err := os.ReadFile(rootCA)
-		if err != nil {
-			return nil, fmt.Errorf("failed to read root-ca: %v", err)
-		}
+	for index, rootCABytes := range extractCAs(rootCAs) {
 		if !tlsConfig.RootCAs.AppendCertsFromPEM(rootCABytes) {
-			return nil, fmt.Errorf("no certs found in root CA file %q", rootCA)
+			return nil, fmt.Errorf("rootCAs.%d is not in PEM format, certificate must be "+
+				"a PEM encoded string, a base64 encoded bytes that contain PEM encoded string, "+
+				"or a path to a PEM encoded certificate", index)
 		}
 	}
 
diff --git a/server/server.go b/server/server.go
index e299e32f..5c5faa30 100644
--- a/server/server.go
+++ b/server/server.go
@@ -443,6 +443,20 @@ func newServer(ctx context.Context, c Config, rotationStrategy rotationStrategy)
 		return nil, err
 	}
 	handleWithCORS("/.well-known/openid-configuration", discoveryHandler)
+	// Handle the root path for the better user experience.
+	handleWithCORS("/", func(w http.ResponseWriter, r *http.Request) {
+		_, err := fmt.Fprintf(w, `<!DOCTYPE html>
+			<title>Dex</title>
+			<h1>Dex IdP</h1>
+			<h3>A Federated OpenID Connect Provider</h3>
+			<p><a href=%q>Discovery</a></p>`,
+			s.issuerURL.String()+"/.well-known/openid-configuration")
+		if err != nil {
+			s.logger.Error("failed to write response", "err", err)
+			s.renderError(r, w, http.StatusInternalServerError, "Handling the / path error.")
+			return
+		}
+	})
 
 	// TODO(ericchiang): rate limit certain paths based on IP.
 	handleWithCORS("/token", s.handleToken)


Test patch:
diff --git a/pkg/httpclient/httpclient_test.go b/pkg/httpclient/httpclient_test.go
index 07baea04..6f561c10 100644
--- a/pkg/httpclient/httpclient_test.go
+++ b/pkg/httpclient/httpclient_test.go
@@ -2,10 +2,12 @@ package httpclient_test
 
 import (
 	"crypto/tls"
+	"encoding/base64"
 	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -20,18 +22,31 @@ func TestRootCAs(t *testing.T) {
 	assert.Nil(t, err)
 	defer ts.Close()
 
-	rootCAs := []string{"testdata/rootCA.pem"}
-	testClient, err := httpclient.NewHTTPClient(rootCAs, false)
-	assert.Nil(t, err)
+	runTest := func(name string, certs []string) {
+		t.Run(name, func(t *testing.T) {
+			rootCAs := certs
+			testClient, err := httpclient.NewHTTPClient(rootCAs, false)
+			assert.Nil(t, err)
 
-	res, err := testClient.Get(ts.URL)
-	assert.Nil(t, err)
+			res, err := testClient.Get(ts.URL)
+			assert.Nil(t, err)
 
-	greeting, err := io.ReadAll(res.Body)
-	res.Body.Close()
-	assert.Nil(t, err)
+			greeting, err := io.ReadAll(res.Body)
+			res.Body.Close()
+			assert.Nil(t, err)
 
-	assert.Equal(t, "Hello, client", string(greeting))
+			assert.Equal(t, "Hello, client", string(greeting))
+		})
+	}
+
+	runTest("From file", []string{"testdata/rootCA.pem"})
+
+	content, err := os.ReadFile("testdata/rootCA.pem")
+	assert.NoError(t, err)
+	runTest("From string", []string{string(content)})
+
+	contentStr := base64.StdEncoding.EncodeToString(content)
+	runTest("From bytes", []string{contentStr})
 }
 
 func TestInsecureSkipVerify(t *testing.T) {