Harbor v2.15.12

Released 2026-10-15.

Supported until v2.17. Container Registry supports the current and previous minor releases; this version reaches end of support when the second newer minor (v2.17) is published.

Summary

Trusted issuers gain an audience column. The (issuer, project_id) uniqueness constraint is dropped.

Commercial Features

Federated Robot Accounts

• Reject deleting a trusted issuer’s aud or iss claim with 400; they are immutable like on create (container-registry/8gcr#522)
• Answer 400 for a trusted issuer id of 0 or less instead of 404 (container-registry/8gcr#522)
• A trusted issuer now declares its audience as a field; issuer plus audience is its identity, so several trusted issuers may share an issuer URL with different audiences, and aud or iss are no longer accepted as claim rules (container-registry/8gcr#527)

Upgrade Notes

Federated Robot Accounts: check every trusted issuer after upgrading. A trusted issuer left without an audience refuses every token, so all federated robot accounts on it stop authenticating until its audience is set.

A trusted issuer now has an audience field: the value the token’s aud claim must carry. Issuer URL plus audience identify a trusted issuer, so several trusted issuers may share an issuer URL with different audiences. aud and iss are no longer accepted as claim rules (container-registry/8gcr#527).

What the upgrade does. The database migration fills the audience of each existing trusted issuer from its legacy issuer-level aud claim rule (#1249), provided that rule has exactly one value and no other trusted issuer with the same issuer URL has, or would get, the same audience. The old aud claim rule rows stay in place.

What you have to do. Open Administration > Federated Robot Accounts (or GET /api/v2.0/trusted-issuers; project-level trusted issuers with ?q=Level=project,ProjectID=<id>) and look for trusted issuers with an empty audience. Tokens from such an issuer are refused with 401, and harbor-core logs:

trusted issuer <name> has no audience; set it before tokens from <issuer> can be accepted

Set the audience once, in the portal edit form or through the API:

curl -u admin -X PUT https://registry.example.com/api/v2.0/trusted-issuers/<id> \
  -H 'Content-Type: application/json' \
  -d '{"audience": "<the aud claim of your tokens>"}'

Robots and their claim rules need no change.

• Exact match, scheme included. The audience must equal the token’s aud exactly. A GitHub Actions workflow that requests its token with audience=https://registry.example.com needs the trusted issuer audience https://registry.example.com, not registry.example.com. Take the value from a decoded token. When aud is a list, one matching entry is enough.
• Set once. The audience can only be set while it is empty. A later change is refused with 400 cannot modify audience after it is set. To correct a wrong value, delete the trusted issuer and create it again. A trusted issuer with robots attached cannot be deleted (Please delete the associated robots before deleting the trusted issuer), so its federated robot accounts have to be recreated as well.
• New trusted issuers. Creating a trusted issuer without an audience is refused with 400 audience is required. A claim rule on aud or iss is refused with 400.

Fixes

• db: Add The Trusted Issuer Audience Column (backport #1236) (#1239)
• db: Fill The Trusted Issuer Audience From Its Legacy aud Claim (backport #1248) (#1249)

Reverts

• Drop The Project-Admin Grant Guard (backport #1137 revert) (#1227)

Container Images

Multi-arch images (linux/amd64, linux/arm64) signed with cosign.

Verify an image signature:

cosign verify \
  --certificate-identity "https://github.com/container-registry/harbor-next/.github/workflows/release-please.yml@refs/heads/release-2.15" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  8gears.container-registry.com/8gcr/harbor-core:v2.15.12