dependabot-docker 0.214.0 → 0.216.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b7aabb905dbb5a64638f936079c477b091dd8b2a05aad7cc070c10e11977cc97
-  data.tar.gz: 4cc6bbe0291ded5c2e975f2256561044700a6a5903f1d110815de0ff5a0da281
+  metadata.gz: f74b3c5969e731048741f4c9edd3d7d9043e029c6891473b9a22dbd03951c684
+  data.tar.gz: e180d84721d5c195361da30f1828bfd67d9b67075496ab220b6fb68f18b161f7
 SHA512:
-  metadata.gz: d2a1629644bf4dcc1a523aaef694b2601f0008361468dbde35008396bb9dfe6c225857946bdad4f6dad384f11b7c763357a50a8f27ab02fb8cde23f9ce6f7271
-  data.tar.gz: b5a6df5e91b49e9faa2d972ee74b4aba244f83051e076cf33dda73dc9f55deee7895f8ffc4e5e13ef4d309ae33e1d9a9ef0e710bf6b12dd35545d524ec7dca7b
+  metadata.gz: 5f3dd0e3877551516396ff747ef88bf6410fa84d470c985f6be7d3efaebb3e0cef8cd053bcbfd52f4be40e993be8078ef17076b53694b5360d26f15ed78ae27b
+  data.tar.gz: '0963bc6ed481191e012eeb029988e52275c8cbc79cf3c8008494cad0863fd9981915919c9e3cce8833ef533c2a610434548ed3b511a3331be433a086e7799495'

data/lib/dependabot/docker/file_parser.rb

@@ -6,7 +6,6 @@ require "dependabot/dependency"
 require "dependabot/file_parsers"
 require "dependabot/file_parsers/base"
 require "dependabot/errors"
-require "dependabot/docker/utils/credentials_finder"
 
 module Dependabot
   module Docker
@@ -25,15 +24,15 @@ module Dependabot
       FROM = /FROM/i
       PLATFORM = /--platform\=(?<platform>\S+)/
       TAG = /:(?<tag>[\w][\w.-]{0,127})/
-      DIGEST = /@(?<digest>[^\s]+)/
+      DIGEST = /(?<digest>[0-9a-f]{64})/
       NAME = /\s+AS\s+(?<name>[\w-]+)/
       FROM_LINE =
         %r{^#{FROM}\s+(#{PLATFORM}\s+)?(#{REGISTRY}/)?
-          #{IMAGE}#{TAG}?#{DIGEST}?#{NAME}?}x
+          #{IMAGE}#{TAG}?(?:@sha256:#{DIGEST})?#{NAME}?}x
 
       AWS_ECR_URL = /dkr\.ecr\.(?<region>[^.]+)\.amazonaws\.com/
 
-      IMAGE_SPEC = %r{^(#{REGISTRY}/)?#{IMAGE}#{TAG}?#{DIGEST}?#{NAME}?}x
+      IMAGE_SPEC = %r{^(#{REGISTRY}/)?#{IMAGE}#{TAG}?(?:@sha256:#{DIGEST})?#{NAME}?}x
 
       def parse
         dependency_set = DependencySet.new
@@ -77,13 +76,7 @@ module Dependabot
       end
 
       def version_from(parsed_from_line)
-        return parsed_from_line.fetch("tag") if parsed_from_line.fetch("tag")
-
-        version_from_digest(
-          registry: parsed_from_line.fetch("registry"),
-          image: parsed_from_line.fetch("image"),
-          digest: parsed_from_line.fetch("digest")
-        )
+        parsed_from_line.fetch("tag") || parsed_from_line.fetch("digest")
       end
 
       def source_from(parsed_from_line)
@@ -98,59 +91,6 @@ module Dependabot
         source
       end
 
-      def version_from_digest(registry:, image:, digest:)
-        return unless digest
-
-        registry_details = fetch_registry_details(registry)
-        repo = docker_repo_name(image, registry_details["registry"])
-        client = docker_registry_client(registry_details["registry"], registry_details["credentials"])
-        client.tags(repo, auto_paginate: true).fetch("tags").find do |tag|
-          digest == client.digest(repo, tag)
-        rescue DockerRegistry2::NotFound
-          # Shouldn't happen, but it does. Example of existing tag with
-          # no manifest is "library/python", "2-windowsservercore".
-          false
-        end
-      rescue DockerRegistry2::RegistryAuthenticationException,
-             RestClient::Forbidden
-        raise PrivateSourceAuthenticationFailure, registry_details["registry"]
-      rescue RestClient::Exceptions::OpenTimeout,
-             RestClient::Exceptions::ReadTimeout
-        raise if credentials_finder.using_dockerhub?(registry_details["registry"])
-
-        raise PrivateSourceTimedOut, registry_details["registry"]
-      end
-
-      def docker_repo_name(image, registry)
-        return image if image.include? "/"
-        return "library/#{image}" if credentials_finder.using_dockerhub?(registry)
-
-        image
-      end
-
-      def docker_registry_client(registry_hostname, registry_credentials)
-        unless credentials_finder.using_dockerhub?(registry_hostname)
-          return DockerRegistry2::Registry.new("https://#{registry_hostname}")
-        end
-
-        DockerRegistry2::Registry.new(
-          "https://#{registry_hostname}",
-          user: registry_credentials&.fetch("username", nil),
-          password: registry_credentials&.fetch("password", nil),
-          read_timeout: 10
-        )
-      end
-
-      def fetch_registry_details(registry)
-        registry ||= credentials_finder.base_registry
-        credentials = credentials_finder.credentials_for_registry(registry)
-        { "registry" => registry, "credentials" => credentials }
-      end
-
-      def credentials_finder
-        @credentials_finder ||= Utils::CredentialsFinder.new(credentials)
-      end
-
       def check_required_files
         # Just check if there are any files at all.
         return if dependency_files.any?

data/lib/dependabot/docker/file_updater.rb

@@ -56,119 +56,106 @@ module Dependabot
       end
 
       def updated_dockerfile_content(file)
-        updated_content =
-          if specified_with_digest?(file)
-            update_digest_and_tag(file)
-          else
-            update_tag(file)
-          end
+        old_sources = previous_sources(file)
+        new_sources = sources(file)
+
+        updated_content = file.content
+
+        old_sources.zip(new_sources).each do |old_source, new_source|
+          updated_content =
+            if specified_with_digest?(old_source)
+              update_digest_and_tag(updated_content, old_source, new_source)
+            else
+              update_tag(updated_content, old_source, new_source)
+            end
+        end
 
         raise "Expected content to change!" if updated_content == file.content
 
         updated_content
       end
 
-      def update_digest_and_tag(file)
-        old_declaration_regex = /^#{FROM_REGEX}\s+.*@#{old_digest(file)}/
+      def update_digest_and_tag(previous_content, old_source, new_source)
+        old_digest = old_source[:digest]
+        new_digest = new_source[:digest]
+
+        old_tag = old_source[:tag]
+        new_tag = new_source[:tag]
+
+        old_declaration_regex = /^#{FROM_REGEX}\s+.*@sha256:#{old_digest}/
 
-        file.content.gsub(old_declaration_regex) do |old_dec|
+        previous_content.gsub(old_declaration_regex) do |old_dec|
           old_dec.
-            gsub("@#{old_digest(file)}", "@#{new_digest(file)}").
-            gsub(":#{dependency.previous_version}",
-                 ":#{dependency.version}")
+            gsub("@sha256:#{old_digest}", "@sha256:#{new_digest}").
+            gsub(":#{old_tag}", ":#{new_tag}")
         end
       end
 
-      def update_tag(file)
-        old_tags = old_tags(file)
-        return if old_tags.empty?
-
-        modified_content = file.content
+      def update_tag(previous_content, old_source, new_source)
+        old_tag = old_source[:tag]
+        new_tag = new_source[:tag]
 
-        new_tags = new_tags(file)
-
-        old_tags.zip(new_tags).each do |old_tag, new_tag|
-          new_tag ||= new_tags.first
-
-          old_declaration =
-            if private_registry_url(file) then "#{private_registry_url(file)}/"
-            else
-              ""
-            end
-          old_declaration += "#{dependency.name}:#{old_tag}"
-          escaped_declaration = Regexp.escape(old_declaration)
-
-          old_declaration_regex =
-            %r{^#{FROM_REGEX}\s+(docker\.io/)?#{escaped_declaration}(?=\s|$)}
-
-          modified_content = modified_content.
-                             gsub(old_declaration_regex) do |old_dec|
-            old_dec.gsub(":#{old_tag}", ":#{new_tag}")
+        old_declaration =
+          if private_registry_url(old_source) then "#{private_registry_url(old_source)}/"
+          else
+            ""
           end
-        end
-
-        modified_content
-      end
+        old_declaration += "#{dependency.name}:#{old_tag}"
+        escaped_declaration = Regexp.escape(old_declaration)
 
-      def specified_with_digest?(file)
-        dependency.
-          requirements.
-          find { |r| r[:file] == file.name }.
-          fetch(:source)[:digest]
-      end
-
-      def new_digest(file)
-        return unless specified_with_digest?(file)
+        old_declaration_regex =
+          %r{^#{FROM_REGEX}\s+(docker\.io/)?#{escaped_declaration}(?=\s|$)}
 
-        dependency.requirements.
-          find { |r| r[:file] == file.name }.
-          fetch(:source).fetch(:digest)
+        previous_content.gsub(old_declaration_regex) do |old_dec|
+          old_dec.gsub(":#{old_tag}", ":#{new_tag}")
+        end
       end
 
-      def old_digest(file)
-        return unless specified_with_digest?(file)
-
-        dependency.previous_requirements.
-          find { |r| r[:file] == file.name }.
-          fetch(:source).fetch(:digest)
+      def specified_with_digest?(source)
+        source[:digest]
       end
 
       def new_tags(file)
-        dependency.requirements.
-          select { |r| r[:file] == file.name }.
+        requirements(file).
           map { |r| r.fetch(:source)[:tag] }
       end
 
       def old_tags(file)
-        dependency.
-          previous_requirements.
-          select { |r| r[:file] == file.name }.
+        previous_requirements(file).
           map { |r| r.fetch(:source)[:tag] }
       end
 
-      def private_registry_url(file)
-        dependency.requirements.
-          find { |r| r[:file] == file.name }.
-          fetch(:source)[:registry]
+      def private_registry_url(source)
+        source[:registry]
+      end
+
+      def sources(file)
+        requirements(file).map { |r| r.fetch(:source) }
+      end
+
+      def previous_sources(file)
+        previous_requirements(file).map { |r| r.fetch(:source) }
       end
 
       def updated_yaml_content(file)
-        updated_content = Utils.likely_helm_chart?(file) ? update_helm(file) : update_image(file)
+        updated_content = file.content
+        updated_content = update_helm(file, updated_content) if Utils.likely_helm_chart?(file)
+        updated_content = update_image(file, updated_content)
 
         raise "Expected content to change!" if updated_content == file.content
 
         updated_content
       end
 
-      def update_helm(file)
+      def update_helm(file, content)
         # TODO: this won't work if two images have the same tag version
         old_tags = old_helm_tags(file)
         return if old_tags.empty?
 
-        modified_content = file.content
+        modified_content = content
 
         old_tags.each do |old_tag|
-          old_tag_regex = /^\s+(?:-\s)?(?:tag|version):\s+#{old_tag}(?=\s|$)/
+          old_tag_regex = /^\s+(?:-\s)?(?:tag|version):\s+["']?#{old_tag}["']?(?=\s|$)/
           modified_content = modified_content.gsub(old_tag_regex) do |old_img_tag|
             old_img_tag.gsub(old_tag.to_s, new_yaml_tag(file).to_s)
           end
@@ -176,14 +163,14 @@ module Dependabot
         modified_content
       end
 
-      def update_image(file)
+      def update_image(file, content)
         old_images = old_yaml_images(file)
         return if old_images.empty?
 
-        modified_content = file.content
+        modified_content = content
 
         old_images.each do |old_image|
-          old_image_regex = /^\s+(?:-\s)?image:\s+#{old_image}(?=\s|$)/
+          old_image_regex = /^\s*(?:-\s)?image:\s+#{old_image}(?=\s|$)/
           modified_content = modified_content.gsub(old_image_regex) do |old_img|
             old_img.gsub(old_image.to_s, new_yaml_image(file).to_s)
           end
@@ -194,7 +181,7 @@ module Dependabot
       def new_yaml_image(file)
         element = dependency.requirements.find { |r| r[:file] == file.name }
         prefix = element.fetch(:source)[:registry] ? "#{element.fetch(:source)[:registry]}/" : ""
-        digest = element.fetch(:source)[:digest] ? "@#{element.fetch(:source)[:digest]}" : ""
+        digest = element.fetch(:source)[:digest] ? "@sha256:#{element.fetch(:source)[:digest]}" : ""
         tag = element.fetch(:source)[:tag] ? ":#{element.fetch(:source)[:tag]}" : ""
         "#{prefix}#{dependency.name}#{tag}#{digest}"
       end
@@ -205,22 +192,28 @@ module Dependabot
       end
 
       def old_yaml_images(file)
-        dependency.
-          previous_requirements.
-          select { |r| r[:file] == file.name }.map do |r|
-            prefix = r.fetch(:source)[:registry] ? "#{r.fetch(:source)[:registry]}/" : ""
-            digest = r.fetch(:source)[:digest] ? "@#{r.fetch(:source)[:digest]}" : ""
-            tag = r.fetch(:source)[:tag] ? ":#{r.fetch(:source)[:tag]}" : ""
-            "#{prefix}#{dependency.name}#{tag}#{digest}"
-          end
+        previous_requirements(file).map do |r|
+          prefix = r.fetch(:source)[:registry] ? "#{r.fetch(:source)[:registry]}/" : ""
+          digest = r.fetch(:source)[:digest] ? "@sha256:#{r.fetch(:source)[:digest]}" : ""
+          tag = r.fetch(:source)[:tag] ? ":#{r.fetch(:source)[:tag]}" : ""
+          "#{prefix}#{dependency.name}#{tag}#{digest}"
+        end
       end
 
       def old_helm_tags(file)
-        dependency.
-          previous_requirements.
-          select { |r| r[:file] == file.name }.map do |r|
-            r.fetch(:source)[:tag] || ""
-          end
+        previous_requirements(file).map do |r|
+          r.fetch(:source)[:tag] || ""
+        end
+      end
+
+      def requirements(file)
+        dependency.requirements.
+          select { |r| r[:file] == file.name }
+      end
+
+      def previous_requirements(file)
+        dependency.previous_requirements.
+          select { |r| r[:file] == file.name }
       end
     end
   end

data/lib/dependabot/docker/metadata_finder.rb

@@ -2,6 +2,7 @@
 
 require "dependabot/metadata_finders"
 require "dependabot/metadata_finders/base"
+require "dependabot/shared_helpers"
 
 module Dependabot
   module Docker
@@ -9,7 +10,20 @@ module Dependabot
       private
 
       def look_up_source
-        # TODO: Find a way to add links to PRs
+        return if dependency.requirements.empty?
+
+        new_source = dependency.requirements.first[:source]
+        return unless new_source && new_source[:registry] && new_source[:tag]
+
+        image_ref = "#{new_source[:registry]}/#{dependency.name}:#{new_source[:tag]}"
+        image_details_output = SharedHelpers.run_shell_command("regctl image inspect #{image_ref}")
+        image_details = JSON.parse(image_details_output)
+        image_source = image_details.dig("config", "Labels", "org.opencontainers.image.source")
+        return unless image_source
+
+        Dependabot::Source.from_url(image_source)
+      rescue StandardError => e
+        Dependabot.logger.warn("Error looking up Docker source: #{e.message}")
         nil
       end
     end

data/lib/dependabot/docker/tag.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+require "dependabot/docker/file_parser"
+
+module Dependabot
+  module Docker
+    class Tag
+      VERSION_REGEX = /v?(?<version>[0-9]+(?:\.[0-9]+)*(?:_[0-9]+|\.[a-z0-9]+|-(?:kb)?[0-9]+)*)/i
+      VERSION_WITH_SFX = /^#{VERSION_REGEX}(?<suffix>-[a-z][a-z0-9.\-]*)?$/i
+      VERSION_WITH_PFX = /^(?<prefix>[a-z][a-z0-9.\-]*-)?#{VERSION_REGEX}$/i
+      VERSION_WITH_PFX_AND_SFX = /^(?<prefix>[a-z\-]+-)?#{VERSION_REGEX}(?<suffix>-[a-z\-]+)?$/i
+      NAME_WITH_VERSION =
+        /
+          #{VERSION_WITH_PFX}|
+          #{VERSION_WITH_SFX}|
+          #{VERSION_WITH_PFX_AND_SFX}
+      /x
+
+      attr_reader :name
+
+      def initialize(name)
+        @name = name
+      end
+
+      def to_s
+        name
+      end
+
+      def digest?
+        name.match?(FileParser::DIGEST)
+      end
+
+      def comparable?
+        name.match?(NAME_WITH_VERSION)
+      end
+
+      def same_precision?(other)
+        other.precision == precision
+      end
+
+      def same_but_less_precise?(other)
+        other.segments.zip(segments).all? do |segment, other_segment|
+          segment == other_segment || other_segment.nil?
+        end
+      end
+
+      def canonical?
+        return false unless numeric_version
+        return true if name == numeric_version
+
+        # .NET tags are suffixed with -sdk
+        return true if name == numeric_version + "-sdk"
+
+        name == "jdk-" + numeric_version
+      end
+
+      def prefix
+        name.match(NAME_WITH_VERSION).named_captures.fetch("prefix")
+      end
+
+      def suffix
+        name.match(NAME_WITH_VERSION).named_captures.fetch("suffix")
+      end
+
+      def format
+        return :year_month if numeric_version.match?(/^[12]\d{3}(?:[.\-]|$)/)
+        return :year_month_day if numeric_version.match?(/^[12]\d{5}(?:[.\-]|$)/)
+        return :sha_suffixed if name.match?(/(^|\-g?)[0-9a-f]{7,}$/)
+        return :build_num if numeric_version.match?(/^\d+$/)
+
+        :normal
+      end
+
+      def numeric_version
+        return unless comparable?
+
+        name.match(NAME_WITH_VERSION).named_captures.fetch("version").downcase
+      end
+
+      def precision
+        segments.length
+      end
+
+      def segments
+        numeric_version.split(/[.-]/)
+      end
+    end
+  end
+end

data/lib/dependabot/docker/update_checker.rb

@@ -5,54 +5,15 @@ require "docker_registry2"
 require "dependabot/update_checkers"
 require "dependabot/update_checkers/base"
 require "dependabot/errors"
+require "dependabot/docker/tag"
+require "dependabot/docker/file_parser"
 require "dependabot/docker/version"
 require "dependabot/docker/requirement"
 require "dependabot/docker/utils/credentials_finder"
 
-module DockerRegistry2
-  class Registry
-    private
-
-    # By default the Docker Registry client sets the Accept header to
-    # `application/vnd.docker.distribution.manifest.v2+json`. This is fine for
-    # most images, but for multi-architecture images, it fetches the digest of a
-    # specific architecture instead of the digest for the multi-architecture
-    # image. We override the header to tell the Docker API to vary its behavior
-    # depending on whether the image is a uses a traditional (non-list) manifest
-    # or a manifest list. If the image uses a traditional manifest, the API will
-    # return the manifest digest. If the image uses a manifest list, the API
-    # will return the manifest list digest.
-    def headers(payload: nil, bearer_token: nil)
-      headers = {}
-      headers["Authorization"] = "Bearer #{bearer_token}" unless bearer_token.nil?
-      if payload.nil?
-        headers["Accept"] = %w(
-          application/vnd.docker.distribution.manifest.v2+json
-          application/vnd.docker.distribution.manifest.list.v2+json
-          application/json
-        ).join(",")
-      end
-      headers["Content-Type"] = "application/vnd.docker.distribution.manifest.v2+json" unless payload.nil?
-
-      headers
-    end
-  end
-end
-
 module Dependabot
   module Docker
     class UpdateChecker < Dependabot::UpdateCheckers::Base
-      VERSION_REGEX = /v?(?<version>[0-9]+(?:\.[0-9]+)*(?:_[0-9]+|\.[a-z0-9]+|-(?:kb)?[0-9]+)*)/i
-      VERSION_WITH_SFX = /^#{VERSION_REGEX}(?<suffix>-[a-z][a-z0-9.\-]*)?$/i
-      VERSION_WITH_PFX = /^(?<prefix>[a-z][a-z0-9.\-]*-)?#{VERSION_REGEX}$/i
-      VERSION_WITH_PFX_AND_SFX = /^(?<prefix>[a-z\-]+-)?#{VERSION_REGEX}(?<suffix>-[a-z\-]+)?$/i
-      NAME_WITH_VERSION =
-        /
-          #{VERSION_WITH_PFX}|
-          #{VERSION_WITH_SFX}|
-          #{VERSION_WITH_PFX_AND_SFX}
-      /x
-
       def latest_version
         latest_version_from(dependency.version)
       end
@@ -70,8 +31,17 @@ module Dependabot
       def updated_requirements
         dependency.requirements.map do |req|
           updated_source = req.fetch(:source).dup
-          updated_source[:digest] = updated_digest if req[:source][:digest]
-          updated_source[:tag] = latest_version_from(req[:source][:tag]) if req[:source][:tag]
+
+          tag = req[:source][:tag]
+          digest = req[:source][:digest]
+
+          if tag
+            updated_tag = latest_version_from(tag)
+            updated_source[:tag] = updated_tag
+            updated_source[:digest] = digest_of(updated_tag) if digest
+          elsif digest
+            updated_source[:digest] = digest_of("latest")
+          end
 
           req.merge(source: updated_source)
         end
@@ -89,148 +59,153 @@ module Dependabot
       end
 
       def version_can_update?(*)
-        !version_up_to_date?
+        if digest_requirements.any?
+          !digest_up_to_date?
+        else
+          !version_up_to_date?
+        end
       end
 
       def version_up_to_date?
-        # If the tag isn't up-to-date then we can definitely update
-        return false if version_tag_up_to_date?(dependency.version) == false
-        return false if dependency.requirements.any? do |req|
-                          version_tag_up_to_date?(req.fetch(:source, {})[:tag]) == false
-                        end
-
-        # Otherwise, if the Dockerfile specifies a digest check that that is
-        # up-to-date
-        digest_up_to_date?
+        if digest_requirements.any?
+          version_tag_up_to_date? && digest_up_to_date?
+        else
+          version_tag_up_to_date?
+        end
       end
 
-      def version_tag_up_to_date?(version)
-        return unless version&.match?(NAME_WITH_VERSION)
-
-        latest_version = fetch_latest_version(version)
+      def version_tag_up_to_date?
+        version = dependency.version
+        return unless version
 
-        old_v = numeric_version_from(version)
-        latest_v = numeric_version_from(latest_version)
+        return true unless version_tag.comparable?
 
-        return true if version_class.new(latest_v) <= version_class.new(old_v)
+        latest_tag = latest_tag_from(version)
 
-        # Check the precision of the potentially higher tag is the same as the
-        # one it would replace. In the event that it's not the same, check the
-        # digests are also unequal. Avoids 'updating' ruby-2 -> ruby-2.5.1
-        return false if precision_of(old_v) == precision_of(latest_v)
+        old_v = version_tag.numeric_version
+        latest_v = latest_tag.numeric_version
 
-        digest_of(version) == digest_of(latest_version)
+        version_class.new(latest_v) <= version_class.new(old_v)
       end
 
       def digest_up_to_date?
-        dependency.requirements.all? do |req|
-          next true unless req.fetch(:source)[:digest]
-          next true unless (new_digest = digest_of(dependency.version))
+        digest_requirements.all? do |req|
+          next true unless updated_digest
 
-          req.fetch(:source).fetch(:digest) == new_digest
+          req.fetch(:source).fetch(:digest) == updated_digest
         end
       end
 
       def latest_version_from(version)
-        @versions ||= {}
-        return @versions[version] if @versions.key?(version)
+        latest_tag_from(version).name
+      end
 
-        @versions[version] = fetch_latest_version(version)
+      def latest_tag_from(version)
+        @tags ||= {}
+        return @tags[version] if @tags.key?(version)
+
+        @tags[version] = fetch_latest_tag(Tag.new(version))
       end
 
-      # NOTE: It's important that this *always* returns a version (even if
+      # NOTE: It's important that this *always* returns a tag (even if
       # it's the existing one) as it is what we later check the digest of.
-      def fetch_latest_version(version)
-        return version unless version.match?(NAME_WITH_VERSION)
+      def fetch_latest_tag(version_tag)
+        return Tag.new(latest_digest) if version_tag.digest?
+        return version_tag unless version_tag.comparable?
 
         # Prune out any downgrade tags before checking for pre-releases
         # (which requires a call to the registry for each tag, so can be slow)
-        candidate_tags = comparable_tags_from_registry(version)
-        candidate_tags = remove_version_downgrades(candidate_tags, version)
-        candidate_tags = remove_prereleases(candidate_tags, version)
+        candidate_tags = comparable_tags_from_registry(version_tag)
+        candidate_tags = remove_version_downgrades(candidate_tags, version_tag)
+        candidate_tags = remove_prereleases(candidate_tags, version_tag)
         candidate_tags = filter_ignored(candidate_tags)
-        candidate_tags = sort_tags(candidate_tags, version)
+        candidate_tags = sort_tags(candidate_tags, version_tag)
 
         latest_tag = candidate_tags.last
+        return version_tag unless latest_tag
 
-        if latest_tag && same_precision?(latest_tag, version)
-          latest_tag
-        else
-          latest_same_precision_tag = remove_precision_changes(candidate_tags, version).last
+        return latest_tag if latest_tag.same_precision?(version_tag)
 
-          if latest_same_precision_tag && digest_of(latest_same_precision_tag) == digest_of(latest_tag)
-            latest_same_precision_tag
-          else
-            latest_tag || version
-          end
+        latest_same_precision_tag = remove_precision_changes(candidate_tags, version_tag).last
+        return latest_tag unless latest_same_precision_tag
+
+        latest_same_precision_digest = digest_of(latest_same_precision_tag.name)
+        latest_digest = digest_of(latest_tag.name)
+
+        # NOTE: Some registries don't provide digests (the API documents them as
+        # optional: https://docs.docker.com/registry/spec/api/#content-digests).
+        #
+        # In that case we can't know for sure whether the latest tag keeping
+        # existing precision is the same as the absolute latest tag.
+        #
+        # We can however, make a best-effort to avoid unwanted changes by
+        # directly looking at version numbers and checking whether the absolute
+        # latest tag is just a more precise version of the latest tag that keeps
+        # existing precision.
+
+        if latest_same_precision_digest == latest_digest && latest_same_precision_tag.same_but_less_precise?(latest_tag)
+          latest_same_precision_tag
+        else
+          latest_tag
         end
       end
 
-      def comparable_tags_from_registry(version)
-        original_prefix = prefix_of(version)
-        original_suffix = suffix_of(version)
-        original_format = format_of(version)
+      def comparable_tags_from_registry(original_tag)
+        original_prefix = original_tag.prefix
+        original_suffix = original_tag.suffix
+        original_format = original_tag.format
 
         candidate_tags =
           tags_from_registry.
-          select { |tag| tag.match?(NAME_WITH_VERSION) }.
-          select { |tag| prefix_of(tag) == original_prefix }.
-          select { |tag| format_of(tag) == original_format }
+          select(&:comparable?).
+          select { |tag| tag.prefix == original_prefix }.
+          select { |tag| tag.format == original_format }
         return candidate_tags if original_format == :sha_suffixed
 
-        candidate_tags.select { |tag| suffix_of(tag) == original_suffix }
+        candidate_tags.select { |tag| tag.suffix == original_suffix }
       end
 
-      def remove_version_downgrades(candidate_tags, version)
+      def remove_version_downgrades(candidate_tags, version_tag)
+        current_version = comparable_version_from(version_tag)
+
         candidate_tags.select do |tag|
-          comparable_version_from(tag) >=
-            comparable_version_from(version)
+          comparable_version_from(tag) >= current_version
         end
       end
 
-      def remove_prereleases(candidate_tags, version)
-        return candidate_tags if prerelease?(version)
+      def remove_prereleases(candidate_tags, version_tag)
+        return candidate_tags if prerelease?(version_tag)
 
         candidate_tags.reject { |tag| prerelease?(tag) }
       end
 
-      def remove_precision_changes(candidate_tags, version)
+      def remove_precision_changes(candidate_tags, version_tag)
         candidate_tags.select do |tag|
-          same_precision?(tag, version)
+          tag.same_precision?(version_tag)
         end
       end
 
-      def same_precision?(tag, another_tag)
-        precision_of(numeric_version_from(tag)) == precision_of(numeric_version_from(another_tag))
-      end
-
       def version_of_latest_tag
         return unless latest_digest
 
         candidate_tag =
           tags_from_registry.
-          select { |tag| canonical_version?(tag) }.
+          select(&:canonical?).
           sort_by { |t| comparable_version_from(t) }.
           reverse.
-          find { |t| digest_of(t) == latest_digest }
+          find { |t| digest_of(t.name) == latest_digest }
 
         return unless candidate_tag
 
         comparable_version_from(candidate_tag)
       end
 
-      def canonical_version?(tag)
-        return false unless numeric_version_from(tag)
-        return true if tag == numeric_version_from(tag)
-
-        # .NET tags are suffixed with -sdk
-        return true if tag == numeric_version_from(tag) + "-sdk"
-
-        tag == "jdk-" + numeric_version_from(tag)
-      end
-
       def updated_digest
-        @updated_digest ||= digest_of(latest_version)
+        @updated_digest ||= if latest_tag_from(dependency.version).digest?
+                              latest_digest
+                            else
+                              digest_of(latest_version)
+                            end
       end
 
       def tags_from_registry
@@ -238,7 +213,7 @@ module Dependabot
           begin
             client = docker_registry_client
 
-            client.tags(docker_repo_name, auto_paginate: true).fetch("tags")
+            client.tags(docker_repo_name, auto_paginate: true).fetch("tags").map { |name| Tag.new(name) }
           rescue *transient_docker_errors
             attempt ||= 1
             attempt += 1
@@ -257,7 +232,7 @@ module Dependabot
       end
 
       def latest_digest
-        return unless tags_from_registry.include?("latest")
+        return unless tags_from_registry.map(&:name).include?("latest")
 
         digest_of("latest")
       end
@@ -266,17 +241,18 @@ module Dependabot
         @digests ||= {}
         return @digests[tag] if @digests.key?(tag)
 
-        @digests[tag] =
-          begin
-            docker_registry_client.digest(docker_repo_name, tag)
-          rescue *transient_docker_errors => e
-            attempt ||= 1
-            attempt += 1
-            return if attempt > 3 && e.is_a?(DockerRegistry2::NotFound)
-            raise if attempt > 3
+        @digests[tag] = fetch_digest_of(tag)
+      end
 
-            retry
-          end
+      def fetch_digest_of(tag)
+        docker_registry_client.digest(docker_repo_name, tag)&.delete_prefix("sha256:")
+      rescue *transient_docker_errors => e
+        attempt ||= 1
+        attempt += 1
+        return if attempt > 3 && e.is_a?(DockerRegistry2::NotFound)
+        raise if attempt > 3
+
+        retry
       rescue DockerRegistry2::RegistryAuthenticationException,
              RestClient::Forbidden
         raise PrivateSourceAuthenticationFailure, registry_hostname
@@ -293,31 +269,12 @@ module Dependabot
         ]
       end
 
-      def prefix_of(tag)
-        tag.match(NAME_WITH_VERSION).named_captures.fetch("prefix")
-      end
-
-      def suffix_of(tag)
-        tag.match(NAME_WITH_VERSION).named_captures.fetch("suffix")
-      end
-
-      def format_of(tag)
-        version = numeric_version_from(tag)
-
-        return :year_month if version.match?(/^[12]\d{3}(?:[.\-]|$)/)
-        return :year_month_day if version.match?(/^[12]\d{5}(?:[.\-]|$)/)
-        return :sha_suffixed if tag.match?(/(^|\-g?)[0-9a-f]{7,}$/)
-        return :build_num if version.match?(/^\d+$/)
-
-        :normal
-      end
-
       def prerelease?(tag)
-        return true if numeric_version_from(tag).gsub(/kb/i, "").match?(/[a-zA-Z]/)
+        return true if tag.numeric_version.gsub(/kb/i, "").match?(/[a-zA-Z]/)
 
         # If we're dealing with a numeric version we can compare it against
         # the digest for the `latest` tag.
-        return false unless numeric_version_from(tag)
+        return false unless tag.numeric_version
         return false unless latest_digest
         return false unless version_of_latest_tag
 
@@ -325,13 +282,7 @@ module Dependabot
       end
 
       def comparable_version_from(tag)
-        version_class.new(numeric_version_from(tag))
-      end
-
-      def numeric_version_from(tag)
-        return unless tag.match?(NAME_WITH_VERSION)
-
-        tag.match(NAME_WITH_VERSION).named_captures.fetch("version").downcase
+        version_class.new(tag.numeric_version)
       end
 
       def registry_hostname
@@ -365,19 +316,20 @@ module Dependabot
             "https://#{registry_hostname}",
             user: registry_credentials&.fetch("username", nil),
             password: registry_credentials&.fetch("password", nil),
-            read_timeout: 10
+            read_timeout: 10,
+            http_options: { proxy: ENV.fetch("HTTPS_PROXY", nil) }
           )
       end
 
-      def sort_tags(candidate_tags, version)
+      def sort_tags(candidate_tags, version_tag)
         candidate_tags.sort do |tag_a, tag_b|
           if comparable_version_from(tag_a) > comparable_version_from(tag_b)
             1
           elsif comparable_version_from(tag_a) < comparable_version_from(tag_b)
             -1
-          elsif same_precision?(tag_a, version)
+          elsif tag_a.same_precision?(version_tag)
             1
-          elsif same_precision?(tag_b, version)
+          elsif tag_b.same_precision?(version_tag)
             -1
           else
             0
@@ -385,10 +337,6 @@ module Dependabot
         end
       end
 
-      def precision_of(version)
-        version.split(/[.-]/).length
-      end
-
       def filter_ignored(candidate_tags)
         filtered =
           candidate_tags.
@@ -396,7 +344,10 @@ module Dependabot
             version = comparable_version_from(tag)
             ignore_requirements.any? { |r| r.satisfied_by?(version) }
           end
-        if @raise_on_ignored && filter_lower_versions(filtered).empty? && filter_lower_versions(candidate_tags).any?
+        if @raise_on_ignored &&
+           filter_lower_versions(filtered).empty? &&
+           filter_lower_versions(candidate_tags).any? &&
+           digest_requirements.none?
           raise AllVersionsIgnored
         end
 
@@ -404,9 +355,19 @@ module Dependabot
       end
 
       def filter_lower_versions(tags)
-        versions_array = tags.map { |tag| comparable_version_from(tag) }
-        versions_array.
-          select { |version| version > comparable_version_from(dependency.version) }
+        tags.select do |tag|
+          comparable_version_from(tag) > comparable_version_from(version_tag)
+        end
+      end
+
+      def digest_requirements
+        dependency.requirements.select do |requirement|
+          requirement.dig(:source, :digest)
+        end
+      end
+
+      def version_tag
+        @version_tag ||= Tag.new(dependency.version)
       end
     end
   end

data/lib/dependabot/docker/utils/credentials_finder.rb

@@ -47,29 +47,33 @@ module Dependabot
           # If credentials have been generated from AWS we can just return them
           return registry_details if registry_details["username"] == "AWS"
 
-          # If we don't have credentials, we might get them from the proxy
-          return registry_details if registry_details["username"].nil?
-
-          # Otherwise, we need to use the provided Access Key ID and secret to
-          # generate a temporary username and password
+          # Build a client either with explicit creds or default creds
+          registry_hostname = registry_details.fetch("registry")
+          region = registry_hostname.match(AWS_ECR_URL).named_captures.fetch("region")
           aws_credentials = Aws::Credentials.new(
             registry_details["username"],
             registry_details["password"]
           )
 
-          registry_hostname = registry_details.fetch("registry")
-          region = registry_hostname.match(AWS_ECR_URL).
-                   named_captures.fetch("region")
+          ecr_client =
+            if aws_credentials.set?
+              Aws::ECR::Client.new(region: region, credentials: aws_credentials)
+            else
+              # Let the client check default locations for credentials
+              Aws::ECR::Client.new(region: region)
+            end
 
+          # If the client still lacks credentials, we might be running within GitHub's
+          # Dependabot Service, in which case we might get them from the proxy
+          return registry_details if ecr_client.config.credentials.nil?
+
+          # Otherwise, we need to use the provided Access Key ID and secret to
+          # generate a temporary username and password
           @authorization_tokens ||= {}
           @authorization_tokens[registry_hostname] ||=
-            Aws::ECR::Client.new(region: region, credentials: aws_credentials).
-            get_authorization_token.authorization_data.first.
-            authorization_token
-
+            ecr_client.get_authorization_token.authorization_data.first.authorization_token
           username, password =
             Base64.decode64(@authorization_tokens[registry_hostname]).split(":")
-
           registry_details.merge("username" => username, "password" => password)
         rescue Aws::Errors::MissingCredentialsError,
                Aws::ECR::Errors::UnrecognizedClientException,

data/lib/dependabot/docker/version.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "dependabot/version"
 require "dependabot/utils"
 
 module Dependabot
@@ -9,13 +10,28 @@ module Dependabot
     # See https://www.oracle.com/java/technologies/javase/versioning-naming.html
     # for a description of Java versions.
     #
-    class Version < Gem::Version
+    class Version < Dependabot::Version
       def initialize(version)
         release_part, update_part = version.split("_", 2)
 
-        @release_part = Gem::Version.new(release_part.tr("-", "."))
+        @release_part = Dependabot::Version.new(release_part.tr("-", "."))
 
-        @update_part = Gem::Version.new(update_part&.start_with?(/[0-9]/) ? update_part : 0)
+        @update_part = Dependabot::Version.new(update_part&.start_with?(/[0-9]/) ? update_part : 0)
+      end
+
+      def self.correct?(version)
+        super(new(version).to_semver)
+      rescue ArgumentError
+        # if we can't instantiate a version, it can't be correct
+        false
+      end
+
+      def to_semver
+        @release_part.to_semver
+      end
+
+      def segments
+        @release_part.segments
       end
 
       attr_reader :release_part

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.214.0
+  version: 0.216.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-12-01 00:00:00.000000000 Z
+date: 2023-04-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.214.0
+        version: 0.216.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.214.0
+        version: 0.216.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.0.0
+        version: 1.7.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.0.0
+        version: 1.7.1
 - !ruby/object:Gem::Dependency
   name: gpgme
   requirement: !ruby/object:Gem::Requirement
@@ -58,14 +58,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 4.0.0
+        version: 4.2.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 4.0.0
+        version: 4.2.0
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -86,70 +86,70 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.8'
+        version: '3.12'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.8'
+        version: '3.12'
 - !ruby/object:Gem::Dependency
   name: rspec-its
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.2'
+        version: '1.3'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.2'
+        version: '1.3'
 - !ruby/object:Gem::Dependency
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.39.0
+        version: 1.48.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.39.0
+        version: 1.48.0
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.15.0
+        version: 1.17.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.15.0
+        version: 1.17.1
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.21.0
+        version: 0.22.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.21.0
+        version: 0.22.0
 - !ruby/object:Gem::Dependency
   name: simplecov-console
   requirement: !ruby/object:Gem::Requirement
@@ -182,33 +182,34 @@ dependencies:
   name: vcr
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 6.1.0
+        version: '6.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 6.1.0
+        version: '6.1'
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.4'
+        version: '3.18'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.4'
-description: Automated dependency management for Ruby, JavaScript, Python, PHP, Elixir,
-  Rust, Java, .NET, Elm and Go
-email: support@dependabot.com
+        version: '3.18'
+description: Dependabot-Docker provides support for bumping Docker image tags via
+  Dependabot. If you want support for multiple package managers, you probably want
+  the meta-gem dependabot-omnibus.
+email: opensource@github.com
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -219,6 +220,7 @@ files:
 - lib/dependabot/docker/file_updater.rb
 - lib/dependabot/docker/metadata_finder.rb
 - lib/dependabot/docker/requirement.rb
+- lib/dependabot/docker/tag.rb
 - lib/dependabot/docker/update_checker.rb
 - lib/dependabot/docker/utils/credentials_finder.rb
 - lib/dependabot/docker/utils/helpers.rb
@@ -226,7 +228,9 @@ files:
 homepage: https://github.com/dependabot/dependabot-core
 licenses:
 - Nonstandard
-metadata: {}
+metadata:
+  issue_tracker_uri: https://github.com/dependabot/dependabot-core/issues
+  changelog_uri: https://github.com/dependabot/dependabot-core/blob/main/CHANGELOG.md
 post_install_message: 
 rdoc_options: []
 require_paths:
@@ -242,8 +246,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 3.1.0
 requirements: []
-rubygems_version: 3.3.7
+rubygems_version: 3.3.26
 signing_key: 
 specification_version: 4
-summary: Docker support for dependabot-common
+summary: Provides Dependabot support for Docker
 test_files: []