* go.mod: do not make a viral minimum go version

`go` version is the minimum possible go version that you can compile the
package with. This is viral; all importers inherint the version.

This package does NOT need 1.25.7 to build, and should not require such
a version.

Bumps the go-deps group with 2 updates in the / directory: [github.com/docker/cli](https://github.com/docker/cli) and [github.com/klauspost/compress](https://github.com/klauspost/compress).
Bumps the go-deps group with 2 updates in the /pkg/authn/k8schain directory: [k8s.io/api](https://github.com/kubernetes/api) and [k8s.io/client-go](https://github.com/kubernetes/client-go).
Bumps the go-deps group with 2 updates in the /pkg/authn/kubernetes directory: [k8s.io/api](https://github.com/kubernetes/api) and [k8s.io/client-go](https://github.com/kubernetes/client-go).


Updates `github.com/docker/cli` from 29.3.0+incompatible to 29.3.1+incompatible
- [Commits](docker/cli@v29.3.0...v29.3.1)

Updates `github.com/klauspost/compress` from 1.18.4 to 1.18.5
- [Release notes](https://github.com/klauspost/compress/releases)
- [Commits](klauspost/compress@v1.18.4...v1.18.5)

Updates `k8s.io/api` from 0.35.2 to 0.35.3
- [Commits](kubernetes/api@v0.35.2...v0.35.3)

Updates `k8s.io/client-go` from 0.35.2 to 0.35.3
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.35.2...v0.35.3)

Updates `k8s.io/api` from 0.35.2 to 0.35.3
- [Commits](kubernetes/api@v0.35.2...v0.35.3)

Updates `k8s.io/client-go` from 0.35.2 to 0.35.3
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.35.2...v0.35.3)

Updates `k8s.io/api` from 0.35.2 to 0.35.3
- [Commits](kubernetes/api@v0.35.2...v0.35.3)

Updates `k8s.io/client-go` from 0.35.2 to 0.35.3
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.35.2...v0.35.3)

Updates `k8s.io/api` from 0.35.2 to 0.35.3
- [Commits](kubernetes/api@v0.35.2...v0.35.3)

Updates `k8s.io/apimachinery` from 0.35.2 to 0.35.3
- [Commits](kubernetes/apimachinery@v0.35.2...v0.35.3)

Updates `k8s.io/client-go` from 0.35.2 to 0.35.3
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.35.2...v0.35.3)

---
updated-dependencies:
- dependency-name: github.com/docker/cli
  dependency-version: 29.3.1+incompatible
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/klauspost/compress
  dependency-version: 1.18.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: k8s.io/api
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: k8s.io/client-go
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: k8s.io/api
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: k8s.io/client-go
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: k8s.io/api
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: k8s.io/client-go
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: k8s.io/api
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: k8s.io/client-go
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Commit bf0f710 removed the patch
version from go.mod, but overlooked that the go-setup action in
github actions workflows were configured to use 'go.mod' for its
version.

Unfortunately, go-setup action (incorrectly) uses the specified
version as an exact version, not as minimum, which meant that
actions (and release flows) would now downgrade to go1.25.0;

    Run actions/setup-go@v6
    Setup go version spec 1.25.0
    Attempting to download 1.25.0...
    matching 1.25.0...
    Acquiring 1.25.0 from https://github.com/actions/go-versions/releases/download/1.25.0-16925932082/go-1.25.0-linux-x64.tar.gz
    Extracting Go...
    ...
    go version go1.25.0 linux/amd64

This patch:

- Adds a dedicated `.go-version` file, which specifies the version
  of go to use, independently from the version in `go.mod` (which
  defines the minimum supported version).
- Sets GOTOOLCHAIN=local to prevent changes in `go.mod` from implicitly
  updating the go version to a newer version.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

…2240)

Bumps the actions group with 1 update: [codecov/codecov-action](https://github.com/codecov/codecov-action).


Updates `codecov/codecov-action` from 5.5.2 to 5.5.3
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@v5.5.2...v5.5.3)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-version: 5.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…uashed) (#2248)

* fork distribution client v3 auth-challenge as an internal package

This forks the distribution's registry client auth-challenge code v3.0.0;
distribution/distribution@9ed95e7

The client code has moved to an internal package in the distribution project,
and is used to handle `WWW-Authenticate` headers. It was written a long time
ago, and only handles RFC 2617 (superseded by RFC 9110). Possibly there's more
current implementations for this, but this would introduce new dependencies, so
we can keep the status quo for now, and fork this code as an internal package.

Keeping it internal, due to the known limitations mentioned above, and to avoid
it being used by others assuming it's a general-purpose implementation.

This is the result of the following steps:

    # install filter-repo (https://github.com/newren/git-filter-repo/blob/main/INSTALL.md)
    brew install git-filter-repo

    # create a temporary clone of docker
    cd ~/Projects
    git clone https://github.com/distribution/distribution.git distribution_auth
    cd distribution_auth

    # switch to v3.0.0 (git-filter doesn't like multiple branches, so reset)
    git reset --hard v3.0.0

    # commit taken from
    git rev-parse --verify HEAD
    9ed95e7365224025ee89365e12cf128e1f1bf965

    git filter-repo --analyze

    # remove all code, except for 'internal/client/auth/challenge'
    # rename to 'pkg/v1/remote/internal/authchallenge'
    # include history of old location ('registry/client/auth/challenge')
    git filter-repo \
      --force \
      --path 'internal/client/auth/challenge' \
      --path 'registry/client/auth/challenge' \
      --path-rename internal/client/auth/challenge:pkg/v1/remote/internal/authchallenge

    # go to the target github.com/docker/docker repository
    cd ~/go/src/github.com/google/go-containerregistry

    # create a branch to work with
    git checkout -b fork_registryclient_authchallenge

    # add the temporary repository as an upstream and make sure it's up-to-date
    git remote add distribution_auth ~/Projects/distribution_auth
    git fetch distribution_auth

    # merge the upstream code
    git merge --allow-unrelated-histories --signoff -S distribution_auth/main

History was squashed:

- Refactor authorization challenges to its own package
  Split challenges into its own package. Avoids possible
  import cycle with challenges from client.
- Fix minor "Challanges" typo
- Fix gometalint errors
- Fix typo in NewSimpleManager() documentation
- Initial repo commit
- init
- format code with gofumpt

Move registry client internal

Our registry client is not currently in a good place to be used as the
reference OCI Distribution client implementation. But the registry proxy
currently depends on it. Make the registry client internal to the
distribution application to remove it from the API surface area (and any
implied compatibility promises) of distribution/v3@v3.0.0 without
breaking the proxy.

cleanup: move init funcs to the top of the source

We make sure they're not hiding at the bottom or in the middle
which makes debugging an utter nightmare!

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

* authchallenge: rename package and update imports

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

* pkg/v1/remote/internal/authchallenge: make manager-code a test-util

The Manager code is only used as part of tests; move it to _test files
to have a clearer separation between "production" code and test-code.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

* pkg/v1/remote/internal/authchallenge: cleanup manager code

As this code is now only used as a test-utility;

- Make the zero-value of simpleManager usable
- Remove the constructor and interface definition
- Un-export fields and mutex.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

* pkg/v1/remote/internal/authchallenge: cleanup URL-normalization

- change normalizeURL to not mutate the input URL.
- move lowercasing into canonicalAddr.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

* pkg/v1/remote/internal/authchallenge: modernize and linting

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

* pkg/v1/remote/internal/authchallenge: add boilerplating

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

---------

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

fromChallenge() stored the realm value from a WWW-Authenticate header
verbatim without validation. A malicious or MITM'd registry could supply
a realm pointing at a private/link-local address (e.g. 169.254.169.254)
or use a non-HTTP scheme, causing the client to make token-fetch requests
to internal services when pulling images.

Add validateRealmURL() which enforces:
- Scheme allowlist: only https is accepted for secure registries; http
  is additionally accepted when the registry is marked insecure.
- IP literal blocklist: loopback, link-local unicast/multicast, and
  private-range addresses are rejected. This blocks direct SSRF to cloud
  instance metadata services and RFC 1918 networks. DNS-based SSRF is
  out of scope and should be handled at the network layer.