@docker-doctor/cli 0.6.0 → 0.7.0

package/dist/{src-BpAv-H0Z.cjs → src-DiT93yVt.cjs}

@@ -31,9 +31,10 @@ node_fs_promises = __toESM(node_fs_promises, 1);
 let node_path = require("node:path");
 node_path = __toESM(node_path, 1);
 let yaml = require("yaml");
+let node_url = require("node:url");
 
 //#region package.json
-var version = "0.6.0";
+var version = "0.7.0";
 
 //#endregion
 //#region ../core/src/project-info/ignore.ts
@@ -73,6 +74,17 @@ const globToRegExp = (pattern) => {
 	}
 	return new RegExp(`${source}$`, "u");
 };
+const LEADING_DOT_SLASH_RE = /^(?:\.\/)+/u;
+/**
+* Accepts two spellings people bring from `.gitignore`. A leading `./` is
+* dropped because patterns are already root-relative, and a trailing `/`
+* means the whole directory. `vendor/` and `./vendor/**` both become
+* `vendor/**`.
+*/
+const normalizeIgnorePattern = (pattern) => {
+	const rootRelative = pattern.replace(LEADING_DOT_SLASH_RE, "");
+	return rootRelative.endsWith("/") ? `${rootRelative}**` : rootRelative;
+};
 /**
 * Builds a predicate over root-relative paths from `ignore.files`
 * patterns. Windows separators in the tested path are normalized to `/`
@@ -80,7 +92,7 @@ const globToRegExp = (pattern) => {
 */
 const createIgnoreMatcher = (patterns) => {
 	if (!patterns || patterns.length === 0) return () => false;
-	const regexps = patterns.map(globToRegExp);
+	const regexps = patterns.map(normalizeIgnorePattern).map(globToRegExp);
 	return (relativePath) => {
 		const normalized = relativePath.replaceAll("\\", "/");
 		return regexps.some((regexp) => regexp.test(normalized));
@@ -117,7 +129,7 @@ const PRUNED_DIRECTORIES = [
 const PRUNED = new Set(PRUNED_DIRECTORIES);
 const toPosixRelative = (rootDir, file) => node_path.default.relative(rootDir, file).split(node_path.default.sep).join("/");
 const SUBTREE_SUFFIX = "/**";
-const createPrunedDirectoryMatcher = (patterns = []) => createIgnoreMatcher(patterns.filter((pattern) => pattern.endsWith(SUBTREE_SUFFIX)).map((pattern) => pattern.slice(0, -3)));
+const createPrunedDirectoryMatcher = (patterns = []) => createIgnoreMatcher(patterns.map(normalizeIgnorePattern).filter((pattern) => pattern.endsWith(SUBTREE_SUFFIX)).map((pattern) => pattern.slice(0, -3)));
 const isPermissionError = (error) => error instanceof Error && "code" in error && (error.code === "EACCES" || error.code === "EPERM");
 const walk = async (dir, options, fileList = []) => {
 	let files;
@@ -265,7 +277,7 @@ const HEREDOC_INSTRUCTIONS = /* @__PURE__ */ new Set([
 	"RUN"
 ]);
 const INSTRUCTION_LINE_RE = /^(?<inst>[A-Za-z]+)\s+(?<args>.*)$/u;
-const HEREDOC_OPENER_RE = /(?<=^|\s)<<-?(?<quote>['"]?)(?<delim>\w+)\k<quote>/gu;
+const HEREDOC_OPENER_RE = /(?<=^|\s)<<-?(?<quote>['"]?)(?<delim>[^\s'"<>;&|()]+)\k<quote>/gu;
 const createParserState = () => ({
 	currentArgs: "",
 	currentInstruction: "",
@@ -412,7 +424,7 @@ const parseExecForm = (args) => {
 //#endregion
 //#region ../core/src/parsers/image-ref.ts
 const parseImageRef = (ref) => {
-	if (ref.includes("${") || ref.startsWith("$")) return {
+	if (ref.includes("$")) return {
 		isVariable: true,
 		name: ref
 	};
@@ -464,6 +476,15 @@ const isHardenedRuntimeImage = (imagePart) => {
 	const { tag } = parseImageRef(imagePart);
 	return !(tag === "dev" || tag?.endsWith("-dev"));
 };
+const DISTROLESS_NONROOT_TAG_RE = /(?:^|-)nonroot(?:-|$)/u;
+/**
+* Distroless images tagged `nonroot` (also `debug-nonroot` and the
+* per-architecture `nonroot-amd64` forms) run as uid 65532.
+*/
+const isDistrolessNonroot = (imagePart) => {
+	const { name, registry, tag } = parseImageRef(imagePart);
+	return registry === "gcr.io" && name.startsWith("distroless/") && tag !== void 0 && DISTROLESS_NONROOT_TAG_RE.test(tag);
+};
 /**
 * Why a reference would resolve differently over time: no tag at all, or
 * the mutable `latest` tag without a digest. `undefined` means the ref is
@@ -493,6 +514,11 @@ const collectStageAliases = (instructions) => {
 	return aliases;
 };
 
+//#endregion
+//#region ../core/src/parsers/run-flags.ts
+const LEADING_RUN_FLAGS_RE = /^(?:--[a-z][a-z-]*(?:=\S*)?\s+)+/u;
+const stripRunFlags = (args) => args.replace(LEADING_RUN_FLAGS_RE, "");
+
 //#endregion
 //#region ../core/src/rules/create-diagnostic.ts
 const createDiagnostic = (file, ruleKey, severity, message, help, line) => ({
@@ -636,12 +662,14 @@ const usePipefail = {
 	key: "docker-doctor/use-pipefail",
 	message: "Use pipefail to catch pipeline command failures"
 };
+const SURROUNDING_QUOTES_RE$1 = /^(?<quote>["'])(?<inner>.*)\k<quote>$/u;
 const absoluteWorkdir = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "WORKDIR") {
-			const path = inst.args.trim();
+			const trimmed = inst.args.trim();
+			const path = trimmed.match(SURROUNDING_QUOTES_RE$1)?.groups?.inner ?? trimmed;
 			if (!/^(?:\/|\\|\$|[a-zA-Z]:)/u.test(path)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `WORKDIR specifies a relative path '${path}'. For clarity and reliability, always use absolute paths.`, this.help, inst.line));
 		}
 		return diagnostics;
@@ -655,7 +683,7 @@ const avoidRunCd = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN" && CD_COMMAND_RE.test(maskQuotedText(inst.args))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
+		for (const inst of instructions) if (inst.instruction === "RUN" && CD_COMMAND_RE.test(maskQuotedText(stripRunFlags(inst.args)))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "info",
@@ -666,11 +694,13 @@ const avoidRunCd = {
 const PACKAGE_LIST_START_RE = /\b(?:apt-get(?:\s+-\S+)*\s+install|apk\s+add|yum\s+install|dnf\s+install)\b/u;
 const SHELL_SEPARATOR_RE$1 = /[;|]|&&/u;
 const WHITESPACE_RE$1 = /\s+/u;
+const UNCONTINUED_NEWLINE_RE = /(?<!\\[ \t]*)\r?\n/u;
 const collectPackageList = (raw) => {
 	const start = PACKAGE_LIST_START_RE.exec(raw);
 	if (!start) return [];
 	const packages = [];
-	const tokens = raw.slice(start.index + start[0].length).split(WHITESPACE_RE$1);
+	const [command] = raw.slice(start.index + start[0].length).split(UNCONTINUED_NEWLINE_RE);
+	const tokens = command.split(WHITESPACE_RE$1);
 	for (const token of tokens) {
 		if (SHELL_SEPARATOR_RE$1.test(token)) break;
 		if (token !== "" && token !== "\\" && !token.startsWith("-")) packages.push(token);
@@ -700,15 +730,18 @@ const sortMultilineArgs = {
 	key: "docker-doctor/sort-multiline-args",
 	message: "Sort multi-line arguments alphanumerically"
 };
+const USERADD_COMMAND_RE = /\buseradd\b/u;
+const NO_LOG_INIT_FLAG_RE = /(?:^|\s)(?:--no-log-init|-[A-Za-z]*l[A-Za-z]*)(?=\s|$)/u;
+const useraddWritesLoginLogs = (args) => args.split(SHELL_SEPARATOR_RE$1).some((command) => USERADD_COMMAND_RE.test(command) && !NO_LOG_INIT_FLAG_RE.test(command));
 const useraddNoLogInit = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN" && /\buseradd\b/u.test(inst.args) && !inst.args.includes("--no-log-init")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN instruction runs 'useradd' without '--no-log-init'. This can cause excessive disk space usage / exhaustion under Go's sparse tar archive bug when large UIDs are used.", this.help, inst.line));
+		for (const inst of instructions) if (inst.instruction === "RUN" && useraddWritesLoginLogs(inst.args)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN instruction runs 'useradd' without '--no-log-init'. This can cause excessive disk space usage / exhaustion under Go's sparse tar archive bug when large UIDs are used.", this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Pass `--no-log-init` flag to useradd (e.g., `RUN useradd --no-log-init -r -g mygroup myuser`).",
+	help: "Pass `--no-log-init` or its short form `-l` to useradd (e.g., `RUN useradd --no-log-init -r -g mygroup myuser`).",
 	key: "docker-doctor/useradd-no-log-init",
 	message: "Use --no-log-init with useradd"
 };
@@ -727,6 +760,13 @@ const bestPracticesRules = [
 
 //#endregion
 //#region ../core/src/rules/compose-services.ts
+const TRUE_SPELLINGS = /* @__PURE__ */ new Set([
+	"true",
+	"y",
+	"yes",
+	"on"
+]);
+const isComposeTrue = (value) => value === true || typeof value === "string" && TRUE_SPELLINGS.has(value.trim().toLowerCase());
 /**
 * Narrows an unknown compose document to its service entries. A service
 * with a null body (`web:` with nothing under it) is returned as an empty
@@ -993,7 +1033,7 @@ const volumeMount = (volume) => {
 	if (volume && typeof volume === "object") {
 		const { read_only: readOnly, source, target, type } = volume;
 		return {
-			readOnly: readOnly === true,
+			readOnly: isComposeTrue(readOnly),
 			source: typeof source === "string" ? source : void 0,
 			target: typeof target === "string" ? target : void 0,
 			type: typeof type === "string" ? type : void 0
@@ -1078,12 +1118,14 @@ const SECRET_KEY_PATTERNS = [
 	/(?:^|[_-])auth(?:[_-]|$)/iu,
 	/(?:^|[_-])pat(?:[_-]|$)/iu
 ];
-const isSecretKey = (key) => SECRET_KEY_PATTERNS.some((regex) => regex.test(key));
+const SECRET_LOCATION_SUFFIX = /[_-](?:file|path)$/iu;
+const isSecretKey = (key) => !SECRET_LOCATION_SUFFIX.test(key) && SECRET_KEY_PATTERNS.some((regex) => regex.test(key));
 const CREDENTIAL_FREE_URL = /^[a-z][a-z0-9+.-]*:\/\/[^@/\s]*(?:\/|$)/iu;
+const SWITCH_VALUE = /^(?:true|false|yes|no|on|off)$/iu;
 const SURROUNDING_QUOTES_RE = /^(?<quote>["'])(?<inner>.*)\k<quote>$/su;
 const isLiteralSecretValue = (value) => {
 	const unquoted = value.match(SURROUNDING_QUOTES_RE)?.groups?.inner ?? value;
-	return unquoted.length > 0 && !unquoted.startsWith("$") && !CREDENTIAL_FREE_URL.test(unquoted);
+	return unquoted.length > 0 && !unquoted.startsWith("$") && !SWITCH_VALUE.test(unquoted) && !CREDENTIAL_FREE_URL.test(unquoted);
 };
 
 //#endregion
@@ -1092,7 +1134,7 @@ const noPrivilegedService = {
 	category: "Compose",
 	check(composeContent, file, context) {
 		const diagnostics = [];
-		for (const [name, config] of composeServices(composeContent)) if (config.privileged === true) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' runs in privileged mode. A privileged container has full access to the host's devices and kernel, so compromising this service compromises the host.`, this.help, context?.locate?.([
+		for (const [name, config] of composeServices(composeContent)) if (isComposeTrue(config.privileged)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' runs in privileged mode. A privileged container has full access to the host's devices and kernel, so compromising this service compromises the host.`, this.help, context?.locate?.([
 			"services",
 			name,
 			"privileged"
@@ -1244,13 +1286,56 @@ const composeSecurityRules = [
 
 //#endregion
 //#region ../core/src/rules/image-size.ts
+const NODE_ENV_ASSIGNMENT_RE = /(?:^|\s)NODE_ENV(?:=|\s+)["']?(?<value>[^\s"']*)/u;
+const collectStages = (instructions) => {
+	const stages = [];
+	const productionEnv = [];
+	for (const inst of instructions) if (inst.instruction === "FROM") {
+		const { base, stage } = parseFromArgs(inst.args);
+		const baseKey = base?.toLowerCase() ?? "";
+		const parent = stages.findIndex((s) => s.name !== null && s.name === baseKey);
+		productionEnv.push(parent !== -1 && productionEnv[parent]);
+		stages.push({
+			base: baseKey,
+			from: inst,
+			name: stage?.toLowerCase() ?? null,
+			runs: []
+		});
+	} else if (inst.instruction === "ENV" && stages.length > 0) {
+		const value = NODE_ENV_ASSIGNMENT_RE.exec(inst.args)?.groups?.value;
+		if (value !== void 0) productionEnv[stages.length - 1] = value === "production";
+	} else if (inst.instruction === "RUN" && stages.length > 0 && !productionEnv[stages.length - 1]) stages.at(-1)?.runs.push(inst);
+	return stages;
+};
+const shippedStages = (stages) => {
+	const shipped = [];
+	let index = stages.length - 1;
+	while (index >= 0) {
+		shipped.unshift(stages[index]);
+		const { base } = stages[index];
+		index = stages.slice(0, index).findIndex((s) => s.name !== null && s.name === base);
+	}
+	return shipped;
+};
+const MINIMAL_BASE_MARKERS = [
+	"alpine",
+	"slim",
+	"distroless",
+	"busybox",
+	"chainguard",
+	"wolfi",
+	"chiseled",
+	"minideb",
+	"nanoserver"
+];
+const MINIMAL_BASE_SEGMENT_RE = /(?:^|[/_. -])(?:minimal|micro)(?:$|[/_. -])/u;
 const preferSlimBase = {
 	category: "Image Size",
 	check(instructions, file) {
 		const diagnostics = [];
 		const stageAliases = collectStageAliases(instructions);
-		for (const inst of instructions) if (inst.instruction === "FROM") {
-			const imagePart = parseFromArgs(inst.args).base;
+		for (const { from } of shippedStages(collectStages(instructions))) {
+			const imagePart = parseFromArgs(from.args).base;
 			if (!imagePart || isScratch(imagePart)) continue;
 			const ref = parseImageRef(imagePart);
 			if (ref.isVariable || stageAliases.has(imagePart.toLowerCase())) continue;
@@ -1258,7 +1343,7 @@ const preferSlimBase = {
 			if (ref.digest) continue;
 			if (!ref.tag) continue;
 			const haystack = `${ref.name} ${ref.tag}`.toLowerCase();
-			if (!(haystack.includes("alpine") || haystack.includes("slim") || haystack.includes("distroless") || haystack.includes("busybox"))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, inst.line));
+			if (!(MINIMAL_BASE_MARKERS.some((marker) => haystack.includes(marker)) || MINIMAL_BASE_SEGMENT_RE.test(haystack))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, from.line));
 		}
 		return diagnostics;
 	},
@@ -1270,6 +1355,8 @@ const preferSlimBase = {
 const BUILDKIT_MOUNT_FLAG_RE = /--mount=(?<spec>\S+)/gu;
 const CACHE_TARGET_KEY_RE = /^(?:target|dst|destination)=/u;
 const cacheMountTargets = (args) => [...args.matchAll(BUILDKIT_MOUNT_FLAG_RE)].map((match) => (match.groups?.spec ?? "").split(",")).filter((options) => options.includes("type=cache")).flatMap((options) => options.filter((option) => CACHE_TARGET_KEY_RE.test(option)).map((option) => option.slice(option.indexOf("=") + 1)));
+const RECURSIVE_RM_RE = /\brm\s+(?:-[A-Za-z]+\s+)*-[A-Za-z]*[rR][A-Za-z]*\s(?<operands>[^;&|]*)/gu;
+const removesRecursively = (args, dir) => [...args.matchAll(RECURSIVE_RM_RE)].some((match) => (match.groups?.operands ?? "").includes(dir));
 const APT_CACHE_DIRS = ["/var/lib/apt", "/var/cache/apt"];
 const APK_CACHE_DIRS = ["/var/cache/apk", "/etc/apk/cache"];
 const hasCacheMountFor = (args, cacheDirs) => cacheMountTargets(args).some((target) => cacheDirs.some((dir) => target === dir || target.startsWith(`${dir}/`)));
@@ -1279,8 +1366,8 @@ const cleanPackageCache = {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "RUN") {
 			const { args } = inst;
-			if (hasAptGetInstall(args) && !args.includes("rm -rf /var/lib/apt/lists") && !hasCacheMountFor(args, APT_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
-			if (args.includes("apk add") && !args.includes("--no-cache") && !args.includes("rm -rf /var/cache/apk") && !hasCacheMountFor(args, APK_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apk add' without '--no-cache' or cleaning the apk cache. This increases layer size.`, this.help, inst.line));
+			if (hasAptGetInstall(args) && !removesRecursively(args, "/var/lib/apt/lists") && !hasCacheMountFor(args, APT_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
+			if (args.includes("apk add") && !args.includes("--no-cache") && !removesRecursively(args, "/var/cache/apk") && !hasCacheMountFor(args, APK_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apk add' without '--no-cache' or cleaning the apk cache. This increases layer size.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -1307,6 +1394,7 @@ const NON_DEV_INSTALL_FLAGS = /* @__PURE__ */ new Set([
 	"-g",
 	"--global",
 	"--production",
+	"--production=true",
 	"--omit=dev",
 	"--only=prod",
 	"--only=production",
@@ -1322,36 +1410,17 @@ const segmentInstallsDevDependencies = (segment) => {
 	if (!(NODE_PACKAGE_MANAGERS.has(manager) && INSTALL_VERBS.has(verb))) return false;
 	return !tokens.slice(0, commandStart).includes("NODE_ENV=production") && options.every((option) => option.startsWith("-") && !NON_DEV_INSTALL_FLAGS.has(option));
 };
-const installsDevDependencies = (args) => !args.includes("prune") && maskQuotedText(args).split(SHELL_SEPARATOR_RE).some(segmentInstallsDevDependencies);
+const installsDevDependencies = (args) => !args.includes("prune") && maskQuotedText(stripRunFlags(args)).split(SHELL_SEPARATOR_RE).some(segmentInstallsDevDependencies);
 const avoidDevDependencies = {
 	category: "Image Size",
 	check(instructions, file) {
 		const diagnostics = [];
-		const stages = [];
-		for (const inst of instructions) if (inst.instruction === "FROM") {
-			const { base, stage } = parseFromArgs(inst.args);
-			stages.push({
-				base: base?.toLowerCase() ?? "",
-				name: stage?.toLowerCase() ?? null,
-				runs: []
-			});
-		} else if (inst.instruction === "RUN" && stages.length > 0) stages.at(-1)?.runs.push(inst);
-		if (stages.length === 0) return diagnostics;
-		const auditedIndices = [];
-		let index = stages.length - 1;
-		while (index >= 0) {
-			auditedIndices.push(index);
-			const { base } = stages[index];
-			index = stages.slice(0, index).findIndex((s) => s.name !== null && s.name === base);
-		}
-		const finalIndex = stages.length - 1;
-		for (const stageIndex of auditedIndices.toReversed()) {
-			const stage = stages[stageIndex];
-			for (const inst of stage.runs) {
-				if (!installsDevDependencies(inst.args)) continue;
-				const where = stageIndex === finalIndex ? "in the final stage" : `in stage '${stage.name}', whose layers the final stage inherits,`;
-				diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running package install '${inst.args}' ${where} without omitting devDependencies.`, this.help, inst.line));
-			}
+		const stages = collectStages(instructions);
+		const finalStage = stages.at(-1);
+		for (const stage of shippedStages(stages)) for (const inst of stage.runs) {
+			if (!installsDevDependencies(inst.args)) continue;
+			const where = stage === finalStage ? "in the final stage" : `in stage '${stage.name}', whose layers the final stage inherits,`;
+			diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running package install '${inst.args}' ${where} without omitting devDependencies.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -1373,7 +1442,7 @@ const useMultiStage = {
 	category: "Performance",
 	check(instructions, file) {
 		if (instructions.filter((inst) => inst.instruction === "FROM").length === 1) {
-			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || BUILD_TOOL_COMMAND_RE.test(maskQuotedText(inst.args))))) return [createDiagnostic(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
+			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || BUILD_TOOL_COMMAND_RE.test(maskQuotedText(stripRunFlags(inst.args)))))) return [createDiagnostic(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
 		}
 		return [];
 	},
@@ -1476,7 +1545,7 @@ const noRootUser = {
 		let lastUserLine = 1;
 		for (const inst of instructions) if (inst.instruction === "FROM") {
 			const { base, stage } = parseFromArgs(inst.args);
-			const baseDefaultUser = base && isHardenedRuntimeImage(base) ? "nonroot" : "root";
+			const baseDefaultUser = base && (isHardenedRuntimeImage(base) || isDistrolessNonroot(base)) ? "nonroot" : "root";
 			lastUser = stageUser.get(base?.toLowerCase() ?? "") ?? baseDefaultUser;
 			lastUserLine = inst.line;
 			currentStage = stage?.toLowerCase() ?? null;
@@ -1555,14 +1624,16 @@ const noAddRemote = {
 	check(instructions, file) {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "ADD") {
-			const src = inst.args.split(/\s+/u).find((p) => !p.startsWith("--"));
-			if (!src) continue;
+			const parts = inst.args.split(/\s+/u);
+			const src = parts.find((p) => !p.startsWith("--"));
+			const isVerified = parts.some((p) => p.startsWith("--checksum="));
+			if (!src || isVerified) continue;
 			if (src.startsWith("http://") || src.startsWith("https://")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `ADD instruction uses a remote URL '${src}'. Remote files added via ADD cannot be cleaned up in later layers, increasing image size.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Use `RUN curl` or `RUN wget` instead of ADD for remote URLs, and delete the downloaded archive in the same layer to minimize size.",
+	help: "Add `--checksum=sha256:<digest>` so BuildKit verifies the download, or use `RUN curl` or `RUN wget` and delete the downloaded archive in the same layer to minimize size.",
 	key: "docker-doctor/no-add-remote",
 	message: "Avoid using ADD with remote URLs"
 };
@@ -1746,7 +1817,7 @@ const importConfig = async (filePath) => {
 	if (filePath.endsWith(".json")) return parseConfigFile(filePath, "JSON", JSON.parse);
 	if (filePath.endsWith(".yaml") || filePath.endsWith(".yml")) return parseConfigFile(filePath, "YAML", yaml.parse);
 	try {
-		const configModule = await import(filePath);
+		const configModule = await import((0, node_url.pathToFileURL)(filePath).href);
 		return configModule.default || configModule;
 	} catch (error) {
 		const reason = typeStrippingFailure(filePath, error);
@@ -1830,11 +1901,15 @@ const getScoreBucket = (score) => {
 	for (const bucket of SCORE_BUCKETS) if (score >= bucket.min) return bucket;
 	return SCORE_BUCKETS.at(-1);
 };
-const calculateScore = (diagnostics) => {
-	let penalty = 0;
-	for (const diag of diagnostics) if (diag.severity === "error") penalty += 10;
-	else if (diag.severity === "warning") penalty += 4;
-	else if (diag.severity === "info") penalty += 1;
+const SEVERITY_PENALTY = {
+	error: 10,
+	info: 1,
+	warning: 4
+};
+const calculateScore = (diagnostics, analyzedFileCount = 1) => {
+	let totalPenalty = 0;
+	for (const diag of diagnostics) totalPenalty += SEVERITY_PENALTY[diag.severity];
+	const penalty = totalPenalty / Math.max(1, analyzedFileCount);
 	const score = Math.round(100 * Math.exp(-penalty / 70));
 	const bucket = getScoreBucket(score);
 	return {
@@ -1845,7 +1920,7 @@ const calculateScore = (diagnostics) => {
 
 //#endregion
 //#region ../core/src/report.ts
-const REPORT_SCHEMA_VERSION = 4;
+const REPORT_SCHEMA_VERSION = 5;
 const resolveCategory = (diagnostic) => {
 	const category = diagnostic.category ?? findRule(diagnostic.rule)?.category;
 	if (!category) throw new Error(`Diagnostic for unknown rule "${diagnostic.rule}" has no category`);
@@ -1868,7 +1943,7 @@ const toJsonReport = (diagnostics, score, label, project, failures = []) => ({
 	})),
 	label,
 	project,
-	schemaVersion: 4,
+	schemaVersion: 5,
 	score,
 	timestamp: (/* @__PURE__ */ new Date()).toISOString()
 });
@@ -1952,4 +2027,4 @@ Object.defineProperty(exports, 'version', {
     return version;
   }
 });
-//# sourceMappingURL=src-BpAv-H0Z.cjs.map
+//# sourceMappingURL=src-DiT93yVt.cjs.map