Set explicit TLS minimum version for Quay HTTP client

[MartinBasti]

Explicitly set MinVersion to TLS 1.2 on the tls.Config used for the Quay HTTP client as a defense-in-depth measure against potential TLS downgrade.

[qodo-code-review]

Review Summary by Qodo

Enforce TLS 1.2 minimum version for Quay client

✨ Enhancement

Walkthroughs

Description

• Enforce TLS 1.2 minimum version for Quay HTTP client
• Adds defense-in-depth protection against TLS downgrade attacks
• Improves security posture of client connections

Diagram

flowchart LR
  A["TLS Configuration"] -- "Add MinVersion constraint" --> B["TLS 1.2 minimum enforced"]
  B -- "Prevents downgrade attacks" --> C["Enhanced security"]

Loading

File Changes

1. cmd/main.go ✨ Enhancement +2/-1

Add TLS 1.2 minimum version enforcement

• Added MinVersion: tls.VersionTLS12 to the tls.Config struct in buildQuayHttpClient()
• Explicitly sets TLS 1.2 as the minimum protocol version for Quay HTTP client connections
• Provides defense-in-depth protection against potential TLS downgrade vulnerabilities
• Minor formatting adjustment to align struct field assignments

cmd/main.go

---

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

[MartinBasti]

/retest

[konflux-ci-qe-bot]

Scenario: konflux-e2e-image-controller
@MartinBasti: The following test has Failed, say /retest to rerun failed tests.

PipelineRun Name	Status	Rerun command	Build Log	Test Log
konflux-e2e-image-controller-n25v7	Failed	/retest	View Pipeline Log	View Test Logs

Inspecting Test Artifacts

To inspect your test artifacts, follow these steps:

1. Install ORAS (see the ORAS installation guide).
2. Download artifacts with the following commands:

mkdir -p oras-artifacts
cd oras-artifacts
oras pull quay.io/konflux-test-storage/konflux-team/image-controller:konflux-e2e-image-controller-n25v7

Test results analysis

🚨 Error occurred while running the E2E tests, list of failed Spec(s):

➡️ [failed] [It] Image Controller E2E tests PaC component build when a new component without specified branch is created and with visibility private correctly targets the default branch (that is not named 'main') with PaC [image-controller, github-webhook, pac-build, pipeline, pac-custom-default-branch]

Click to view logs

Unexpected error:
    <*errors.errorString | 0xc0003068f0>: 
    failed to create test namespace build-e2e-yapj: timeout waiting for service account konflux-integration-runner to be created in namespace build-e2e-yapj with error: context deadline exceeded
    {
        s: "failed to create test namespace build-e2e-yapj: timeout waiting for service account konflux-integration-runner to be created in namespace build-e2e-yapj with error: context deadline exceeded",
    }
occurred

---

OCI Artifact Browser URL

View in Artifact Browser