dependabot-docker 0.388.0 → 0.389.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3aa2fc6d14725482321a9c09dd3304b393aec6271208da0437803b15806f5821
-  data.tar.gz: '0785c238b7814483f797a6d31642deb80748a718b386be4f188dc32886d7b6c5'
+  metadata.gz: acc9b9fe679bfe9320ba49b341428d06c1e8c8ee3a32fe8ee9b2c58e3255088d
+  data.tar.gz: 750a5ecbaf42000e3aee5b91cf0e6563918c1e97f5bfd67c000a73cad2266d59
 SHA512:
-  metadata.gz: 92c9e9149fc669a82485b6186646811e0c46820481f9c0160a1386a7e912def7f6b6873e376ec4176d930f2e1f483f9e3e52930cea2bf6d27927f0048e81743c
-  data.tar.gz: a451bc5070ef987e560032f7761cb8a29d349947cb4dc9e4988a9954fd3e554538f56cde67347ab23a5feb6fb2a6da6e7633eba9a4072a8d063689dcd95b03e9
+  metadata.gz: 42c3c509647b68dd51fb9854e8d799d1d7c698fa2d6e2b7534e4d71d958572e0d4e44616d2d201032ad746a862e3471f5cd7e293713a1b94f3afb1922e0e27ba
+  data.tar.gz: e23963530ca9eedab7de6ffcfa2ecff538a502784d308c8b305645eb60e23ce4b2ce2328ce4c747daadd8a4730879f1e9c62b5aa46e028aebecb35b6439899cc

data/lib/dependabot/docker/update_checker.rb

@@ -80,6 +80,14 @@ module Dependabot
       # so we cap the attempts to avoid rate limiting or excessive latency.
       MAX_PLATFORM_VALIDATION_ATTEMPTS = T.let(5, Integer)
 
+      # Page size used when listing tags from a registry. Without an explicit page
+      # size, registries such as Docker Hub try to return every tag in a single
+      # response, which times out (HTTP 504) for images with very large tag counts
+      # (e.g. hexpm/elixir has ~1M tags). Requesting a bounded page keeps each
+      # request fast; the client then follows the registry's pagination links to
+      # collect the remaining tags.
+      TAGS_PAGE_SIZE = T.let(100, Integer)
+
       DockerSource = T.type_alias do
         T::Hash[Symbol, T.nilable(String)]
       end
@@ -491,6 +499,7 @@ module Dependabot
         )
       rescue *transient_docker_errors,
              DockerRegistry2::RegistryAuthenticationException,
+             DockerRegistry2::RegistryAuthorizationException,
              RestClient::Forbidden,
              RestClient::TooManyRequests => e
         Dependabot.logger.warn(
@@ -700,30 +709,28 @@ module Dependabot
       sig { returns(T::Array[Dependabot::Docker::Tag]) }
       def tags_from_registry
         @tags_from_registry ||= T.let(
-          begin
-            client = docker_registry_client
-
-            client.tags(docker_repo_name, auto_paginate: true).fetch("tags").map { |name| Tag.new(name) }
-          rescue *transient_docker_errors
-            attempt ||= 1
-            attempt += 1
-            raise if attempt > 3
-
-            retry
-          end,
+          fetch_tags_from_registry,
           T.nilable(T::Array[Dependabot::Docker::Tag])
         )
       rescue DockerRegistry2::RegistryAuthenticationException,
+             DockerRegistry2::RegistryAuthorizationException,
              RestClient::Forbidden
         raise PrivateSourceAuthenticationFailure, registry_hostname
       rescue RestClient::Exceptions::OpenTimeout,
-             RestClient::Exceptions::ReadTimeout
+             RestClient::Exceptions::ReadTimeout,
+             DockerRegistry2::RegistryUnknownException
         raise if using_dockerhub?
 
         raise PrivateSourceTimedOut, T.must(registry_hostname)
       rescue RestClient::ServerBrokeConnection,
              RestClient::TooManyRequests
         raise PrivateSourceBadResponse, registry_hostname
+      rescue DockerRegistry2::RegistryHTTPException => e
+        # The registry returned an HTTP error status (e.g. a 504 when Docker Hub
+        # can't enumerate an image's tags). Surface a generic RegistryError with
+        # the status rather than a private-source error, since the registry may
+        # well be public (e.g. Docker Hub).
+        raise_registry_error(e)
       rescue JSON::ParserError => e
         if e.message.include?("unexpected token")
           raise DependencyFileNotResolvable, "Error while accessing docker image at #{registry_hostname}"
@@ -732,6 +739,52 @@ module Dependabot
         raise
       end
 
+      # Registries such as Docker Hub time out (HTTP 504) when asked to return the
+      # full tag list for images with very large tag counts (e.g. hexpm/elixir has
+      # ~1M tags). Request the list without a page size first — a single efficient
+      # call for the common case — and fall back to a paginated request when the
+      # registry can't return everything at once.
+      sig { params(page_size: T.nilable(Integer)).returns(T::Array[Dependabot::Docker::Tag]) }
+      def fetch_tags_from_registry(page_size: nil)
+        client = docker_registry_client
+        response =
+          if page_size
+            client.tags(docker_repo_name, page_size, "", false, auto_paginate: true)
+          else
+            client.tags(docker_repo_name, auto_paginate: true)
+          end
+        response.fetch("tags").map { |name| Tag.new(name) }
+      rescue *transient_docker_errors
+        attempt ||= 1
+        attempt += 1
+        raise if attempt > 3
+
+        retry
+      rescue DockerRegistry2::RegistryHTTPException => e
+        raise if page_size || registry_http_status(e) == 429
+
+        fetch_tags_from_registry(page_size: TAGS_PAGE_SIZE)
+      end
+
+      # docker_registry2 1.19.0 only exposes the status in the exception message.
+      sig { params(error: DockerRegistry2::RegistryHTTPException).returns(Integer) }
+      def registry_http_status(error)
+        if error.respond_to?(:status)
+          status = error.method(:status).call
+          return status if status.is_a?(Integer)
+        end
+
+        status = error.message[/status (\d+)/, 1]
+        return status.to_i if status
+
+        raise error
+      end
+
+      sig { params(error: DockerRegistry2::RegistryHTTPException).returns(T.noreturn) }
+      def raise_registry_error(error)
+        raise RegistryError.new(registry_http_status(error), error.message)
+      end
+
       sig { returns(T.nilable(String)) }
       def latest_digest
         return unless tags_from_registry.map(&:name).include?("latest")
@@ -757,7 +810,10 @@ module Dependabot
         raise PrivateSourceBadResponse, registry_hostname if attempt > 3
 
         retry
+      rescue DockerRegistry2::RegistryHTTPException => e
+        raise_registry_error(e)
       rescue DockerRegistry2::RegistryAuthenticationException,
+             DockerRegistry2::RegistryAuthorizationException,
              RestClient::Forbidden
         raise PrivateSourceAuthenticationFailure, registry_hostname
       rescue RestClient::ServerBrokeConnection,
@@ -777,6 +833,7 @@ module Dependabot
           RestClient::ServiceUnavailable,
           RestClient::InternalServerError,
           RestClient::BadGateway,
+          DockerRegistry2::RegistryUnknownException,
           DockerRegistry2::NotFound
         ]
       end
@@ -1120,6 +1177,7 @@ module Dependabot
         config_created_timestamps[tag_name] = created
         created
       rescue *transient_docker_errors, DockerRegistry2::RegistryAuthenticationException,
+             DockerRegistry2::RegistryAuthorizationException,
              RestClient::Forbidden, JSON::ParserError => e
         Dependabot.logger.info(
           "Failed to fetch config created timestamp for #{docker_repo_name}:#{tag_name}: #{e.message}"
@@ -1417,6 +1475,7 @@ module Dependabot
         platform_digests_cache[tag_name] = digests
         digests
       rescue *transient_docker_errors, DockerRegistry2::RegistryAuthenticationException,
+             DockerRegistry2::RegistryAuthorizationException,
              RestClient::Forbidden, RestClient::TooManyRequests, JSON::ParserError => e
         Dependabot.logger.info(
           "Failed to fetch platform digests for #{docker_repo_name}:#{tag_name}: #{e.message}"
@@ -1460,6 +1519,7 @@ module Dependabot
         manifest_platforms_cache[tag_name] = platforms
         platforms
       rescue *transient_docker_errors, DockerRegistry2::RegistryAuthenticationException,
+             DockerRegistry2::RegistryAuthorizationException,
              RestClient::Forbidden, JSON::ParserError => e
         Dependabot.logger.info(
           "Failed to fetch manifest platforms for #{docker_repo_name}:#{tag_name}: #{e.message}"
@@ -1524,6 +1584,7 @@ module Dependabot
         platform_timestamps_cache[tag_name] = timestamps
         timestamps
       rescue *transient_docker_errors, DockerRegistry2::RegistryAuthenticationException,
+             DockerRegistry2::RegistryAuthorizationException,
              RestClient::Forbidden, JSON::ParserError => e
         Dependabot.logger.info(
           "Failed to fetch platform timestamps for #{docker_repo_name}:#{tag_name}: #{e.message}"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.388.0
+  version: 0.389.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.388.0
+        version: 0.389.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.388.0
+        version: 0.389.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -266,7 +266,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.388.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.389.0
 rdoc_options: []
 require_paths:
 - lib