dependabot-docker 0.396.0 → 0.397.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d4dfb9902bcedec29154319ac165b61f4919234b9e14a5bb52b43c942f51a1e5
-  data.tar.gz: 6c7e1b398f047fdf203ca9a21d8802eb999e573273e72c76576f8f028e89544a
+  metadata.gz: b43ff0be6b23394fc47285dce19edb7b8e90bcc6a859243315758559dbd5fac4
+  data.tar.gz: 0b12ca42143a2d08547b575d4b4373ce4cf0490f22fc41f8c2fb2ff4a944ef4f
 SHA512:
-  metadata.gz: af5fe84bcc77eab88b77e70e2f659159698f1bcec99cb6d114dccc3a5a3f325859a8b1bb8d9573eb20c46c3994d731805ef8f88083408ac882bb30fa2935f5db
-  data.tar.gz: 9f3ab430f720059323379a4900c9d27a782ee4c6d9ba1381a4eb801dc4c417a5858a820d427a955686e4d10d391f4f2e6901e4b1db9dbdf40ac36a06a515d026
+  metadata.gz: 338d342f4d99ee355295af0581139e6a121c580bcc636d54cd8bde653b4169b569e80b5371ab1b0bd321e421df07fb13f4275eea8e4aebe2384a55afc014e18d
+  data.tar.gz: a7feda400c5b1fc35e0ac60b36d37c7bfa57295416ff1e230fe656311700573b4fae9d0ac0097702e8325d94a2f245ba56f668ddca145c2df3f63c8f49ef8bee

data/lib/dependabot/docker/file_parser.rb

@@ -145,7 +145,11 @@ module Dependabot
         repo = img_hash.fetch("repository", nil)
         return [] unless repo.is_a?(String)
 
-        match = tag_value.to_s.match(TAG_WITH_DIGEST)
+        tag = tag_value.to_s
+        # Helm template expressions cannot be resolved without rendering the chart.
+        return [] if tag.include?("{{")
+
+        match = tag.match(TAG_WITH_DIGEST)
         return [] unless match
 
         tag_details = match.named_captures

data/lib/dependabot/docker/update_checker.rb

@@ -2,7 +2,10 @@
 # frozen_string_literal: true
 
 require "docker_registry2"
+require "excon"
+require "json"
 require "sorbet-runtime"
+require "uri"
 
 begin
   require "rest-client"
@@ -36,6 +39,7 @@ end
 require "dependabot/update_checkers"
 require "dependabot/update_checkers/base"
 require "dependabot/update_checkers/cooldown_calculation"
+require "dependabot/registry_client"
 require "dependabot/errors"
 require "dependabot/docker/tag"
 require "dependabot/docker/file_parser"
@@ -471,25 +475,8 @@ module Dependabot
 
       sig { params(tag: Dependabot::Docker::Tag).returns(T.nilable(Dependabot::Package::PackageRelease)) }
       def get_tag_publication_details(tag)
-        digest_info = with_retries(max_attempts: 3, errors: transient_docker_errors) do
-          client = docker_registry_client
-          client.digest(docker_repo_name, tag.name)
-        end
-
-        first_digest = extract_digest_from_response(digest_info, tag)
-        return nil unless first_digest
-
-        # When digest_info is an Array the registry returned a manifest list
-        # (OCI image index) and the extracted digest points at a platform-
-        # specific *manifest*, not a blob.  Use the correct endpoint so the
-        # HEAD request succeeds on registries like ghcr.io.
-        endpoint = digest_info.is_a?(Array) ? "manifests" : "blobs"
-        head_response = with_retries(max_attempts: 3, errors: transient_docker_errors) do
-          client = docker_registry_client
-          client.dohead "v2/#{docker_repo_name}/#{endpoint}/#{first_digest}"
-        end
-
-        published_date = published_date_from_response_headers(head_response.headers, tag.name)
+        published_date = registry_tag_release_date(tag)
+        return nil unless published_date
 
         Dependabot::Package::PackageRelease.new(
           version: release_version_for(tag),
@@ -499,58 +486,75 @@ module Dependabot
           url: nil,
           package_type: "docker"
         )
-      rescue *transient_docker_errors,
+      end
+
+      sig { params(tag: Dependabot::Docker::Tag).returns(T.nilable(Time)) }
+      def registry_tag_release_date(tag)
+        return docker_hub_tag_release_date(tag) if using_dockerhub?
+
+        Dependabot.logger.info(
+          "No verified registry publication date source for #{registry_hostname}; " \
+          "skipping cooldown for #{docker_repo_name}:#{tag.name}"
+        )
+        nil
+      rescue JSON::ParserError, ArgumentError, TypeError, Excon::Error::Socket, Excon::Error::Timeout,
+             RegistryError, PrivateSourceBadResponse, PrivateSourceAuthenticationFailure,
+             *transient_docker_errors,
              DockerRegistry2::RegistryAuthenticationException,
              DockerRegistry2::RegistryAuthorizationException,
              RestClient::Forbidden,
              RestClient::TooManyRequests => e
-        Dependabot.logger.warn(
-          "Failed to fetch publication details for #{docker_repo_name}:#{tag.name}, " \
-          "skipping cooldown: #{e.class} - #{e.message}"
+        Dependabot.logger.info(
+          "Failed to fetch registry tag metadata for #{docker_repo_name}:#{tag.name}: #{e.message}"
         )
         nil
       end
 
-      sig { params(headers: T::Hash[Symbol, String], tag_name: String).returns(T.nilable(Time)) }
-      def published_date_from_response_headers(headers, tag_name)
-        last_modified = headers[:last_modified]
-        return nil unless last_modified
+      sig { params(tag: Dependabot::Docker::Tag).returns(T.nilable(Time)) }
+      def docker_hub_tag_release_date(tag)
+        namespace, repository = docker_repo_name.split("/", 2)
+        return unless namespace && repository
 
-        Time.parse(last_modified)
-      rescue ArgumentError, TypeError => e
-        Dependabot.logger.info(
-          "Invalid Last-Modified header for #{docker_repo_name}:#{tag_name}: #{e.message}"
+        digest = digest_of(tag.name)
+        return unless digest
+
+        response = Dependabot::RegistryClient.get(
+          url: docker_hub_tag_url(namespace, repository, tag.name),
+          headers: { "Accept" => "application/json" },
+          options: {
+            connect_timeout: docker_open_timeout_in_seconds,
+            read_timeout: docker_read_timeout_in_seconds,
+            write_timeout: docker_read_timeout_in_seconds
+          }
         )
-        nil
+        return unless response.status == 200
+
+        metadata = JSON.parse(response.body)
+        return unless metadata.is_a?(Hash)
+        return unless docker_hub_digest_matches_update?(metadata["digest"], digest)
+
+        timestamp = metadata["tag_last_pushed"]
+        Time.iso8601(timestamp) if timestamp.is_a?(String)
       end
 
-      sig do
-        params(
-          digest_info: Object,
-          tag: Dependabot::Docker::Tag
-        ).returns(T.nilable(String))
+      sig { params(metadata_digest: Object, digest: String).returns(T::Boolean) }
+      def docker_hub_digest_matches_update?(metadata_digest, digest)
+        return digest_requirements.empty? && !pin_digests? if metadata_digest.nil?
+
+        matching_digest?(metadata_digest, digest)
       end
-      def extract_digest_from_response(digest_info, tag)
-        # digest_info can be either a String or an Array depending on the registry response
-        case digest_info
-        when Array
-          if digest_info.empty?
-            Dependabot.logger.warn(
-              "Empty digest_info array for #{docker_repo_name}:#{tag.name}"
-            )
-            return nil
-          end
-          digest = digest_info.first&.fetch("digest")
-          digest if digest.is_a?(String)
-        when String
-          digest_info
-        else
-          Dependabot.logger.warn(
-            "Unexpected digest_info type for #{docker_repo_name}:#{tag.name}: " \
-            "#{digest_info.class} (expected String or Array)"
-          )
-          nil
-        end
+
+      sig { params(namespace: String, repository: String, tag: String).returns(String) }
+      def docker_hub_tag_url(namespace, repository, tag)
+        escaped = [namespace, repository, tag].map { |value| URI.encode_www_form_component(value) }
+        "https://hub.docker.com/v2/namespaces/#{escaped[0]}/repositories/#{escaped[1]}/tags/#{escaped[2]}"
+      end
+
+      sig { params(first: Object, second: Object).returns(T::Boolean) }
+      def matching_digest?(first, second)
+        return false unless first.is_a?(String) && second.is_a?(String)
+
+        first.delete_prefix("sha256:").casecmp?(second.delete_prefix("sha256:")) || false
       end
 
       sig do
@@ -1088,8 +1092,7 @@ module Dependabot
       # don't change the version string, so the default cooldown window applies
       # (semver-specific windows require a version delta, and the tag may be
       # non-comparable like "alpine"). Fails open (returns false) when the
-      # publication date can't be determined, so a missing Last-Modified header
-      # never permanently blocks an update.
+      # publication date can't be determined and records an unavailable-date warning.
       sig { params(tag_name: String).returns(T::Boolean) }
       def digest_within_cooldown?(tag_name)
         return false if should_skip_cooldown?

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.396.0
+  version: 0.397.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.396.0
+        version: 0.397.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.396.0
+        version: 0.397.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -266,7 +266,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.396.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.397.0
 rdoc_options: []
 require_paths:
 - lib