renovate 44.17.0 → 44.17.2

package/dist/modules/datasource/custom/formats/toml.js.map

@@ -1 +1 @@
-{"version":3,"file":"toml.js","names":["parseToml"],"sources":["../../../../../lib/modules/datasource/custom/formats/toml.ts"],"sourcesContent":["import { readLocalFile } from '../../../../util/fs/index.ts';\nimport type { Http } from '../../../../util/http/index.ts';\nimport { parse as parseToml } from '../../../../util/toml.ts';\nimport type { CustomDatasourceFetcher } from './types.ts';\n\nexport class TomlFetcher implements CustomDatasourceFetcher {\n  async fetch(http: Http, registryURL: string): Promise<unknown> {\n    const response = await http.getToml(registryURL);\n\n    return response.body;\n  }\n\n  async readFile(registryURL: string): Promise<unknown> {\n    const fileContent = await readLocalFile(registryURL, 'utf8');\n\n    return parseToml(fileContent!);\n  }\n}\n"],"mappings":";;;AAKA,IAAa,cAAb,MAA4D;CAC1D,MAAM,MAAM,MAAY,aAAuC;EAG7D,QAAO,MAFgB,KAAK,QAAQ,WAAW,EAAA,CAE/B;CAClB;CAEA,MAAM,SAAS,aAAuC;EAGpD,OAAOA,MAAU,MAFS,cAAc,aAAa,MAAM,CAE9B;CAC/B;AACF"}
+{"version":3,"file":"toml.js","names":["parseToml"],"sources":["../../../../../lib/modules/datasource/custom/formats/toml.ts"],"sourcesContent":["import { readLocalFile } from '../../../../util/fs/index.ts';\nimport type { Http } from '../../../../util/http/index.ts';\nimport { parse as parseToml } from '../../../../util/toml.ts';\nimport type { CustomDatasourceFetcher } from './types.ts';\n\nexport class TomlFetcher implements CustomDatasourceFetcher {\n  async fetch(http: Http, registryURL: string): Promise<unknown> {\n    const response = await http.getToml(registryURL);\n\n    return response.body;\n  }\n\n  async readFile(registryURL: string): Promise<unknown> {\n    const fileContent = await readLocalFile(registryURL, 'utf8');\n\n    return parseToml(fileContent!);\n  }\n}\n"],"mappings":";;;AAKA,IAAa,cAAb,MAA4D;CAC1D,MAAM,MAAM,MAAY,aAAuC;EAG7D,QAAO,MAFgB,KAAK,QAAQ,WAAW,EAAA,CAE/B;CAClB;CAEA,MAAM,SAAS,aAAuC;EACpD,MAAM,cAAc,MAAM,cAAc,aAAa,MAAM;EAE3D,OAAOA,MAAU,WAAY;CAC/B;AACF"}

package/dist/modules/datasource/custom/formats/yaml.js

@@ -3,10 +3,12 @@ import { readLocalFile } from "../../../../util/fs/index.js";
 //#region lib/modules/datasource/custom/formats/yaml.ts
 var YamlFetcher = class {
 	async fetch(http, registryURL) {
-		return parseSingleYaml((await http.getText(registryURL)).body);
+		const response = await http.getText(registryURL);
+		return parseSingleYaml(response.body);
 	}
 	async readFile(registryURL) {
-		return parseSingleYaml(await readLocalFile(registryURL, "utf8"));
+		const fileContent = await readLocalFile(registryURL, "utf8");
+		return parseSingleYaml(fileContent);
 	}
 };
 //#endregion

package/dist/modules/datasource/custom/formats/yaml.js.map

@@ -1 +1 @@
-{"version":3,"file":"yaml.js","names":[],"sources":["../../../../../lib/modules/datasource/custom/formats/yaml.ts"],"sourcesContent":["import { readLocalFile } from '../../../../util/fs/index.ts';\nimport type { Http } from '../../../../util/http/index.ts';\nimport { parseSingleYaml } from '../../../../util/yaml.ts';\nimport type { CustomDatasourceFetcher } from './types.ts';\n\nexport class YamlFetcher implements CustomDatasourceFetcher {\n  async fetch(http: Http, registryURL: string): Promise<unknown> {\n    const response = await http.getText(registryURL);\n\n    return parseSingleYaml(response.body);\n  }\n\n  async readFile(registryURL: string): Promise<unknown> {\n    const fileContent = await readLocalFile(registryURL, 'utf8');\n\n    return parseSingleYaml(fileContent!);\n  }\n}\n"],"mappings":";;;AAKA,IAAa,cAAb,MAA4D;CAC1D,MAAM,MAAM,MAAY,aAAuC;EAG7D,OAAO,iBAAgB,MAFA,KAAK,QAAQ,WAAW,EAAA,CAEf,IAAI;CACtC;CAEA,MAAM,SAAS,aAAuC;EAGpD,OAAO,gBAAgB,MAFG,cAAc,aAAa,MAAM,CAExB;CACrC;AACF"}
+{"version":3,"file":"yaml.js","names":[],"sources":["../../../../../lib/modules/datasource/custom/formats/yaml.ts"],"sourcesContent":["import { readLocalFile } from '../../../../util/fs/index.ts';\nimport type { Http } from '../../../../util/http/index.ts';\nimport { parseSingleYaml } from '../../../../util/yaml.ts';\nimport type { CustomDatasourceFetcher } from './types.ts';\n\nexport class YamlFetcher implements CustomDatasourceFetcher {\n  async fetch(http: Http, registryURL: string): Promise<unknown> {\n    const response = await http.getText(registryURL);\n\n    return parseSingleYaml(response.body);\n  }\n\n  async readFile(registryURL: string): Promise<unknown> {\n    const fileContent = await readLocalFile(registryURL, 'utf8');\n\n    return parseSingleYaml(fileContent!);\n  }\n}\n"],"mappings":";;;AAKA,IAAa,cAAb,MAA4D;CAC1D,MAAM,MAAM,MAAY,aAAuC;EAC7D,MAAM,WAAW,MAAM,KAAK,QAAQ,WAAW;EAE/C,OAAO,gBAAgB,SAAS,IAAI;CACtC;CAEA,MAAM,SAAS,aAAuC;EACpD,MAAM,cAAc,MAAM,cAAc,aAAa,MAAM;EAE3D,OAAO,gBAAgB,WAAY;CACrC;AACF"}

package/dist/modules/datasource/deb/checksum.js

@@ -25,7 +25,8 @@ function parseChecksumsFromInRelease(inReleaseContent, packagePath) {
 * @returns resolves to the SHA256 checksum
 */
 function computeFileChecksum(filePath) {
-	return hashStream(createCacheReadStream(filePath), "sha256");
+	const stream = createCacheReadStream(filePath);
+	return hashStream(stream, "sha256");
 }
 //#endregion
 export { computeFileChecksum, parseChecksumsFromInRelease };

package/dist/modules/datasource/deb/checksum.js.map

@@ -1 +1 @@
-{"version":3,"file":"checksum.js","names":[],"sources":["../../../../lib/modules/datasource/deb/checksum.ts"],"sourcesContent":["import { createCacheReadStream } from '../../../util/fs/index.ts';\nimport { hashStream } from '../../../util/hash.ts';\nimport { escapeRegExp, newlineRegex, regEx } from '../../../util/regex.ts';\n\n/**\n * Parses the SHA256 checksum for a specified package path from the InRelease content.\n *\n * @param inReleaseContent - content of the InRelease file\n * @param packagePath - path of the package file (e.g., 'contrib/binary-amd64/Packages.gz')\n * @returns The SHA256 checksum if found, otherwise undefined\n */\nexport function parseChecksumsFromInRelease(\n  inReleaseContent: string,\n  packagePath: string,\n): string | null {\n  const lines = inReleaseContent.split(newlineRegex);\n  const regex = regEx(\n    `([a-f0-9]{64})\\\\s+\\\\d+\\\\s+${escapeRegExp(packagePath)}$`,\n  );\n\n  for (const line of lines) {\n    const match = regex.exec(line);\n    if (match) {\n      return match[1];\n    }\n  }\n\n  return null;\n}\n\n/**\n * Computes the SHA256 checksum of a specified file.\n *\n * @param filePath - path of the file\n * @returns resolves to the SHA256 checksum\n */\nexport function computeFileChecksum(filePath: string): Promise<string> {\n  const stream = createCacheReadStream(filePath);\n  return hashStream(stream, 'sha256');\n}\n"],"mappings":";;;;;;;;;;;AAWA,SAAgB,4BACd,kBACA,aACe;CACf,MAAM,QAAQ,iBAAiB,MAAM,YAAY;CACjD,MAAM,QAAQ,MACZ,6BAA6B,aAAa,WAAW,EAAE,EACzD;CAEA,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,QAAQ,MAAM,KAAK,IAAI;EAC7B,IAAI,OACF,OAAO,MAAM;CAEjB;CAEA,OAAO;AACT;;;;;;;AAQA,SAAgB,oBAAoB,UAAmC;CAErE,OAAO,WADQ,sBAAsB,QACd,GAAG,QAAQ;AACpC"}
+{"version":3,"file":"checksum.js","names":[],"sources":["../../../../lib/modules/datasource/deb/checksum.ts"],"sourcesContent":["import { createCacheReadStream } from '../../../util/fs/index.ts';\nimport { hashStream } from '../../../util/hash.ts';\nimport { escapeRegExp, newlineRegex, regEx } from '../../../util/regex.ts';\n\n/**\n * Parses the SHA256 checksum for a specified package path from the InRelease content.\n *\n * @param inReleaseContent - content of the InRelease file\n * @param packagePath - path of the package file (e.g., 'contrib/binary-amd64/Packages.gz')\n * @returns The SHA256 checksum if found, otherwise undefined\n */\nexport function parseChecksumsFromInRelease(\n  inReleaseContent: string,\n  packagePath: string,\n): string | null {\n  const lines = inReleaseContent.split(newlineRegex);\n  const regex = regEx(\n    `([a-f0-9]{64})\\\\s+\\\\d+\\\\s+${escapeRegExp(packagePath)}$`,\n  );\n\n  for (const line of lines) {\n    const match = regex.exec(line);\n    if (match) {\n      return match[1];\n    }\n  }\n\n  return null;\n}\n\n/**\n * Computes the SHA256 checksum of a specified file.\n *\n * @param filePath - path of the file\n * @returns resolves to the SHA256 checksum\n */\nexport function computeFileChecksum(filePath: string): Promise<string> {\n  const stream = createCacheReadStream(filePath);\n  return hashStream(stream, 'sha256');\n}\n"],"mappings":";;;;;;;;;;;AAWA,SAAgB,4BACd,kBACA,aACe;CACf,MAAM,QAAQ,iBAAiB,MAAM,YAAY;CACjD,MAAM,QAAQ,MACZ,6BAA6B,aAAa,WAAW,EAAE,EACzD;CAEA,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,QAAQ,MAAM,KAAK,IAAI;EAC7B,IAAI,OACF,OAAO,MAAM;CAEjB;CAEA,OAAO;AACT;;;;;;;AAQA,SAAgB,oBAAoB,UAAmC;CACrE,MAAM,SAAS,sBAAsB,QAAQ;CAC7C,OAAO,WAAW,QAAQ,QAAQ;AACpC"}

package/dist/modules/datasource/deb/packages.js

@@ -60,7 +60,9 @@ async function downloadPackageFile(basePackageUrl, compression, compressedFile,
 		logger.debug(`No need to download ${packageUrl}, file is up to date.`);
 		return false;
 	}
-	await pipeline(http.stream(packageUrl), createCacheWriteStream(compressedFile));
+	const readStream = http.stream(packageUrl);
+	const writeStream = createCacheWriteStream(compressedFile);
+	await pipeline(readStream, writeStream);
 	logger.debug({
 		url: packageUrl,
 		targetFile: compressedFile

package/dist/modules/datasource/deb/packages.js.map

@@ -1 +1 @@
-{"version":3,"file":"packages.js","names":["fs.ensureCacheDir","fs.rmCache","fs.createCacheWriteStream","fs.pipeline"],"sources":["../../../../lib/modules/datasource/deb/packages.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\nimport upath from 'upath';\nimport { logger } from '../../../logger/index.ts';\nimport * as fs from '../../../util/fs/index.ts';\nimport { toSha256 } from '../../../util/hash.ts';\nimport type { Http } from '../../../util/http/index.ts';\nimport { joinUrlParts } from '../../../util/url.ts';\nimport {\n  computeFileChecksum,\n  parseChecksumsFromInRelease,\n} from './checksum.ts';\nimport { cacheSubDir } from './common.ts';\nimport { checkIfModified, getBaseSuiteUrl } from './url.ts';\nimport { extract, getFileCreationTime } from './utils.ts';\n\n/**\n * Downloads and extracts a package file from a component URL.\n *\n * @param componentUrl - The URL of the component.\n * @returns The path to the extracted file and the last modification timestamp.\n * @throws Will throw an error if no valid compression method is found.\n */\nexport async function downloadAndExtractPackage(\n  componentUrl: string,\n  http: Http,\n): Promise<{ extractedFile: string; lastTimestamp: Date }> {\n  const packageUrlHash = toSha256(componentUrl);\n  const fullCacheDir = await fs.ensureCacheDir(cacheSubDir);\n  const extractedFile = upath.join(fullCacheDir, `${packageUrlHash}.txt`);\n  let lastTimestamp = await getFileCreationTime(extractedFile);\n\n  const compression = 'gz';\n  const compressedFile = upath.join(\n    fullCacheDir,\n    `${randomUUID()}_${packageUrlHash}.${compression}`,\n  );\n\n  const wasUpdated = await downloadPackageFile(\n    componentUrl,\n    compression,\n    compressedFile,\n    http,\n    lastTimestamp,\n  );\n\n  if (wasUpdated || !lastTimestamp) {\n    try {\n      await extract(compressedFile, compression, extractedFile);\n      lastTimestamp = await getFileCreationTime(extractedFile);\n    } catch (error) {\n      logger.warn(\n        {\n          compressedFile,\n          componentUrl,\n          compression,\n          error: error.message,\n        },\n        'Failed to extract package file from compressed file',\n      );\n    } finally {\n      await fs.rmCache(compressedFile);\n    }\n  }\n\n  if (!lastTimestamp) {\n    //extracting went wrong\n    throw new Error('Missing metadata in extracted package index file!');\n  }\n\n  return { extractedFile, lastTimestamp };\n}\n\n/**\n * Downloads a package file if it has been modified since the last download timestamp.\n *\n * @param basePackageUrl - The base URL of the package.\n * @param compression - The compression method used (e.g., 'gz').\n * @param compressedFile - The path where the compressed file will be saved.\n * @param lastDownloadTimestamp - The timestamp of the last download.\n * @returns True if the file was downloaded, otherwise false.\n */\nexport async function downloadPackageFile(\n  basePackageUrl: string,\n  compression: string,\n  compressedFile: string,\n  http: Http,\n  lastDownloadTimestamp?: Date,\n): Promise<boolean> {\n  const baseSuiteUrl = getBaseSuiteUrl(basePackageUrl);\n  const packageUrl = joinUrlParts(basePackageUrl, `Packages.${compression}`);\n  let needsToDownload = true;\n\n  if (lastDownloadTimestamp) {\n    needsToDownload = await checkIfModified(\n      packageUrl,\n      lastDownloadTimestamp,\n      http,\n    );\n  }\n\n  if (!needsToDownload) {\n    logger.debug(`No need to download ${packageUrl}, file is up to date.`);\n    return false;\n  }\n  const readStream = http.stream(packageUrl);\n  const writeStream = fs.createCacheWriteStream(compressedFile);\n  await fs.pipeline(readStream, writeStream);\n  logger.debug(\n    { url: packageUrl, targetFile: compressedFile },\n    'Downloading Debian package file',\n  );\n\n  let inReleaseContent = '';\n\n  try {\n    inReleaseContent = await fetchInReleaseFile(baseSuiteUrl, http);\n  } catch (error) {\n    // This is expected to fail for Artifactory if GPG verification is not enabled\n    logger.debug(\n      { url: baseSuiteUrl, err: error },\n      'Could not fetch InRelease file',\n    );\n  }\n\n  if (inReleaseContent) {\n    const actualChecksum = await computeFileChecksum(compressedFile);\n    const expectedChecksum = parseChecksumsFromInRelease(\n      inReleaseContent,\n      // path to the Package.gz file\n      packageUrl.replace(`${baseSuiteUrl}/`, ''),\n    );\n    if (actualChecksum !== expectedChecksum) {\n      await fs.rmCache(compressedFile);\n      throw new Error('SHA256 checksum validation failed');\n    }\n  }\n\n  return needsToDownload;\n}\n\n/**\n * Fetches the content of the InRelease file from the given base suite URL.\n *\n * @param baseReleaseUrl - The base URL of the suite (e.g., 'https://deb.debian.org/debian/dists/bullseye').\n * @returns resolves to the content of the InRelease file.\n * @throws An error if the InRelease file could not be downloaded.\n */\nexport async function fetchInReleaseFile(\n  baseReleaseUrl: string,\n  http: Http,\n): Promise<string> {\n  const inReleaseUrl = joinUrlParts(baseReleaseUrl, 'InRelease');\n  const response = await http.getText(inReleaseUrl);\n  return response.body;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAsBA,eAAsB,0BACpB,cACA,MACyD;CACzD,MAAM,iBAAiB,SAAS,YAAY;CAC5C,MAAM,eAAe,MAAMA,eAAAA,KAA6B;CACxD,MAAM,gBAAgB,MAAM,KAAK,cAAc,GAAG,eAAe,KAAK;CACtE,IAAI,gBAAgB,MAAM,oBAAoB,aAAa;CAE3D,MAAM,cAAc;CACpB,MAAM,iBAAiB,MAAM,KAC3B,cACA,GAAG,WAAW,EAAE,GAAG,eAAe,GAAG,aACvC;CAUA,IAAI,MARqB,oBACvB,cACA,aACA,gBACA,MACA,aACF,KAEkB,CAAC,eACjB,IAAI;EACF,MAAM,QAAQ,gBAAgB,aAAa,aAAa;EACxD,gBAAgB,MAAM,oBAAoB,aAAa;CACzD,SAAS,OAAO;EACd,OAAO,KACL;GACE;GACA;GACA;GACA,OAAO,MAAM;EACf,GACA,qDACF;CACF,UAAU;EACR,MAAMC,QAAW,cAAc;CACjC;CAGF,IAAI,CAAC,eAEH,MAAM,IAAI,MAAM,mDAAmD;CAGrE,OAAO;EAAE;EAAe;CAAc;AACxC;;;;;;;;;;AAWA,eAAsB,oBACpB,gBACA,aACA,gBACA,MACA,uBACkB;CAClB,MAAM,eAAe,gBAAgB,cAAc;CACnD,MAAM,aAAa,aAAa,gBAAgB,YAAY,aAAa;CACzE,IAAI,kBAAkB;CAEtB,IAAI,uBACF,kBAAkB,MAAM,gBACtB,YACA,uBACA,IACF;CAGF,IAAI,CAAC,iBAAiB;EACpB,OAAO,MAAM,uBAAuB,WAAW,sBAAsB;EACrE,OAAO;CACT;CAGA,MAAME,SAFa,KAAK,OAAO,UAEb,GADED,uBAA0B,cAChB,CAAW;CACzC,OAAO,MACL;EAAE,KAAK;EAAY,YAAY;CAAe,GAC9C,iCACF;CAEA,IAAI,mBAAmB;CAEvB,IAAI;EACF,mBAAmB,MAAM,mBAAmB,cAAc,IAAI;CAChE,SAAS,OAAO;EAEd,OAAO,MACL;GAAE,KAAK;GAAc,KAAK;EAAM,GAChC,gCACF;CACF;CAEA,IAAI,kBAOE;MAAA,MANyB,oBAAoB,cAAc,MACtC,4BACvB,kBAEA,WAAW,QAAQ,GAAG,aAAa,IAAI,EAAE,CAEL,GAAG;GACvC,MAAMD,QAAW,cAAc;GAC/B,MAAM,IAAI,MAAM,mCAAmC;EACrD;;CAGF,OAAO;AACT;;;;;;;;AASA,eAAsB,mBACpB,gBACA,MACiB;CACjB,MAAM,eAAe,aAAa,gBAAgB,WAAW;CAE7D,QAAO,MADgB,KAAK,QAAQ,YAAY,EAAA,CAChC;AAClB"}
+{"version":3,"file":"packages.js","names":["fs.ensureCacheDir","fs.rmCache","fs.createCacheWriteStream","fs.pipeline"],"sources":["../../../../lib/modules/datasource/deb/packages.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\nimport upath from 'upath';\nimport { logger } from '../../../logger/index.ts';\nimport * as fs from '../../../util/fs/index.ts';\nimport { toSha256 } from '../../../util/hash.ts';\nimport type { Http } from '../../../util/http/index.ts';\nimport { joinUrlParts } from '../../../util/url.ts';\nimport {\n  computeFileChecksum,\n  parseChecksumsFromInRelease,\n} from './checksum.ts';\nimport { cacheSubDir } from './common.ts';\nimport { checkIfModified, getBaseSuiteUrl } from './url.ts';\nimport { extract, getFileCreationTime } from './utils.ts';\n\n/**\n * Downloads and extracts a package file from a component URL.\n *\n * @param componentUrl - The URL of the component.\n * @returns The path to the extracted file and the last modification timestamp.\n * @throws Will throw an error if no valid compression method is found.\n */\nexport async function downloadAndExtractPackage(\n  componentUrl: string,\n  http: Http,\n): Promise<{ extractedFile: string; lastTimestamp: Date }> {\n  const packageUrlHash = toSha256(componentUrl);\n  const fullCacheDir = await fs.ensureCacheDir(cacheSubDir);\n  const extractedFile = upath.join(fullCacheDir, `${packageUrlHash}.txt`);\n  let lastTimestamp = await getFileCreationTime(extractedFile);\n\n  const compression = 'gz';\n  const compressedFile = upath.join(\n    fullCacheDir,\n    `${randomUUID()}_${packageUrlHash}.${compression}`,\n  );\n\n  const wasUpdated = await downloadPackageFile(\n    componentUrl,\n    compression,\n    compressedFile,\n    http,\n    lastTimestamp,\n  );\n\n  if (wasUpdated || !lastTimestamp) {\n    try {\n      await extract(compressedFile, compression, extractedFile);\n      lastTimestamp = await getFileCreationTime(extractedFile);\n    } catch (error) {\n      logger.warn(\n        {\n          compressedFile,\n          componentUrl,\n          compression,\n          error: error.message,\n        },\n        'Failed to extract package file from compressed file',\n      );\n    } finally {\n      await fs.rmCache(compressedFile);\n    }\n  }\n\n  if (!lastTimestamp) {\n    //extracting went wrong\n    throw new Error('Missing metadata in extracted package index file!');\n  }\n\n  return { extractedFile, lastTimestamp };\n}\n\n/**\n * Downloads a package file if it has been modified since the last download timestamp.\n *\n * @param basePackageUrl - The base URL of the package.\n * @param compression - The compression method used (e.g., 'gz').\n * @param compressedFile - The path where the compressed file will be saved.\n * @param lastDownloadTimestamp - The timestamp of the last download.\n * @returns True if the file was downloaded, otherwise false.\n */\nexport async function downloadPackageFile(\n  basePackageUrl: string,\n  compression: string,\n  compressedFile: string,\n  http: Http,\n  lastDownloadTimestamp?: Date,\n): Promise<boolean> {\n  const baseSuiteUrl = getBaseSuiteUrl(basePackageUrl);\n  const packageUrl = joinUrlParts(basePackageUrl, `Packages.${compression}`);\n  let needsToDownload = true;\n\n  if (lastDownloadTimestamp) {\n    needsToDownload = await checkIfModified(\n      packageUrl,\n      lastDownloadTimestamp,\n      http,\n    );\n  }\n\n  if (!needsToDownload) {\n    logger.debug(`No need to download ${packageUrl}, file is up to date.`);\n    return false;\n  }\n  const readStream = http.stream(packageUrl);\n  const writeStream = fs.createCacheWriteStream(compressedFile);\n  await fs.pipeline(readStream, writeStream);\n  logger.debug(\n    { url: packageUrl, targetFile: compressedFile },\n    'Downloading Debian package file',\n  );\n\n  let inReleaseContent = '';\n\n  try {\n    inReleaseContent = await fetchInReleaseFile(baseSuiteUrl, http);\n  } catch (error) {\n    // This is expected to fail for Artifactory if GPG verification is not enabled\n    logger.debug(\n      { url: baseSuiteUrl, err: error },\n      'Could not fetch InRelease file',\n    );\n  }\n\n  if (inReleaseContent) {\n    const actualChecksum = await computeFileChecksum(compressedFile);\n    const expectedChecksum = parseChecksumsFromInRelease(\n      inReleaseContent,\n      // path to the Package.gz file\n      packageUrl.replace(`${baseSuiteUrl}/`, ''),\n    );\n    if (actualChecksum !== expectedChecksum) {\n      await fs.rmCache(compressedFile);\n      throw new Error('SHA256 checksum validation failed');\n    }\n  }\n\n  return needsToDownload;\n}\n\n/**\n * Fetches the content of the InRelease file from the given base suite URL.\n *\n * @param baseReleaseUrl - The base URL of the suite (e.g., 'https://deb.debian.org/debian/dists/bullseye').\n * @returns resolves to the content of the InRelease file.\n * @throws An error if the InRelease file could not be downloaded.\n */\nexport async function fetchInReleaseFile(\n  baseReleaseUrl: string,\n  http: Http,\n): Promise<string> {\n  const inReleaseUrl = joinUrlParts(baseReleaseUrl, 'InRelease');\n  const response = await http.getText(inReleaseUrl);\n  return response.body;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAsBA,eAAsB,0BACpB,cACA,MACyD;CACzD,MAAM,iBAAiB,SAAS,YAAY;CAC5C,MAAM,eAAe,MAAMA,eAAAA,KAA6B;CACxD,MAAM,gBAAgB,MAAM,KAAK,cAAc,GAAG,eAAe,KAAK;CACtE,IAAI,gBAAgB,MAAM,oBAAoB,aAAa;CAE3D,MAAM,cAAc;CACpB,MAAM,iBAAiB,MAAM,KAC3B,cACA,GAAG,WAAW,EAAE,GAAG,eAAe,GAAG,aACvC;CAUA,IAAI,MARqB,oBACvB,cACA,aACA,gBACA,MACA,aACF,KAEkB,CAAC,eACjB,IAAI;EACF,MAAM,QAAQ,gBAAgB,aAAa,aAAa;EACxD,gBAAgB,MAAM,oBAAoB,aAAa;CACzD,SAAS,OAAO;EACd,OAAO,KACL;GACE;GACA;GACA;GACA,OAAO,MAAM;EACf,GACA,qDACF;CACF,UAAU;EACR,MAAMC,QAAW,cAAc;CACjC;CAGF,IAAI,CAAC,eAEH,MAAM,IAAI,MAAM,mDAAmD;CAGrE,OAAO;EAAE;EAAe;CAAc;AACxC;;;;;;;;;;AAWA,eAAsB,oBACpB,gBACA,aACA,gBACA,MACA,uBACkB;CAClB,MAAM,eAAe,gBAAgB,cAAc;CACnD,MAAM,aAAa,aAAa,gBAAgB,YAAY,aAAa;CACzE,IAAI,kBAAkB;CAEtB,IAAI,uBACF,kBAAkB,MAAM,gBACtB,YACA,uBACA,IACF;CAGF,IAAI,CAAC,iBAAiB;EACpB,OAAO,MAAM,uBAAuB,WAAW,sBAAsB;EACrE,OAAO;CACT;CACA,MAAM,aAAa,KAAK,OAAO,UAAU;CACzC,MAAM,cAAcC,uBAA0B,cAAc;CAC5D,MAAMC,SAAY,YAAY,WAAW;CACzC,OAAO,MACL;EAAE,KAAK;EAAY,YAAY;CAAe,GAC9C,iCACF;CAEA,IAAI,mBAAmB;CAEvB,IAAI;EACF,mBAAmB,MAAM,mBAAmB,cAAc,IAAI;CAChE,SAAS,OAAO;EAEd,OAAO,MACL;GAAE,KAAK;GAAc,KAAK;EAAM,GAChC,gCACF;CACF;CAEA,IAAI,kBAOE;MAAA,MANyB,oBAAoB,cAAc,MACtC,4BACvB,kBAEA,WAAW,QAAQ,GAAG,aAAa,IAAI,EAAE,CAEL,GAAG;GACvC,MAAMF,QAAW,cAAc;GAC/B,MAAM,IAAI,MAAM,mCAAmC;EACrD;;CAGF,OAAO;AACT;;;;;;;;AASA,eAAsB,mBACpB,gBACA,MACiB;CACjB,MAAM,eAAe,aAAa,gBAAgB,WAAW;CAE7D,QAAO,MADgB,KAAK,QAAQ,YAAY,EAAA,CAChC;AAClB"}

package/dist/modules/datasource/deno/index.js

@@ -29,7 +29,8 @@ var DenoDatasource = class DenoDatasource extends Datasource {
 			logger.debug(`Could not extract rawPackageName from packageName: "${packageName}"`);
 			return null;
 		}
-		const moduleAPIURL = joinUrlParts(massagedRegistryUrl, "v2/modules", rawPackageName.replace("x/", ""));
+		const massagedPackageName = rawPackageName.replace("x/", "");
+		const moduleAPIURL = joinUrlParts(massagedRegistryUrl, "v2/modules", massagedPackageName);
 		return await this.getReleaseResult(moduleAPIURL);
 	}
 	getReleases(config) {

package/dist/modules/datasource/deno/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["semanticVersioning.id","packageCache.get","packageCache.set"],"sources":["../../../../lib/modules/datasource/deno/index.ts"],"sourcesContent":["import { isNullOrUndefined } from '@sindresorhus/is';\nimport pMap from 'p-map';\nimport { logger } from '../../../logger/index.ts';\nimport * as packageCache from '../../../util/cache/package/index.ts';\nimport { withCache } from '../../../util/cache/package/with-cache.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { joinUrlParts } from '../../../util/url.ts';\nimport * as semanticVersioning from '../../versioning/semver/index.ts';\nimport { Datasource } from '../datasource.ts';\nimport type { Release } from '../index.ts';\nimport type { GetReleasesConfig, ReleaseResult } from '../types.ts';\nimport {\n  DenoAPIModuleResponse,\n  DenoAPIModuleVersionResponse,\n} from './schema.ts';\n\nexport class DenoDatasource extends Datasource {\n  static readonly id = 'deno';\n\n  override readonly customRegistrySupport = true;\n\n  override readonly registryStrategy = 'first';\n\n  override readonly defaultVersioning = semanticVersioning.id;\n\n  override readonly defaultRegistryUrls = ['https://apiland.deno.dev'];\n\n  override readonly releaseTimestampSupport = true;\n  override readonly releaseTimestampNote =\n    'The release timestamp is determined from the `uploaded_at` field in the results.';\n  override readonly sourceUrlSupport = 'release';\n  override readonly sourceUrlNote =\n    'The source URL is determined from the `repository` field in the results.';\n\n  constructor() {\n    super(DenoDatasource.id);\n  }\n\n  private async _getReleases({\n    packageName,\n    registryUrl,\n  }: GetReleasesConfig): Promise<ReleaseResult | null> {\n    const massagedRegistryUrl = registryUrl!;\n\n    const extractResult = regEx(\n      /^(https:\\/\\/deno.land\\/)(?<rawPackageName>[^@\\s]+)/,\n    ).exec(packageName);\n    const rawPackageName = extractResult?.groups?.rawPackageName;\n    if (isNullOrUndefined(rawPackageName)) {\n      logger.debug(\n        `Could not extract rawPackageName from packageName: \"${packageName}\"`,\n      );\n      return null;\n    }\n\n    // remove third-party prefix if defined. The only internal library is `std` and is available under the same API\n    const massagedPackageName = rawPackageName.replace('x/', '');\n\n    // https://apiland.deno.dev/v2/modules/postgres\n    const moduleAPIURL = joinUrlParts(\n      massagedRegistryUrl,\n      'v2/modules',\n      massagedPackageName,\n    );\n\n    return await this.getReleaseResult(moduleAPIURL);\n  }\n\n  getReleases(config: GetReleasesConfig): Promise<ReleaseResult | null> {\n    return withCache(\n      {\n        namespace: `datasource-${DenoDatasource.id}`,\n        // TODO: types (#22198)\n        key: `getReleases:${config.registryUrl}:${config.packageName}`,\n        fallback: true,\n      },\n      () => this._getReleases(config),\n    );\n  }\n\n  private async _getReleaseResult(\n    moduleAPIURL: string,\n  ): Promise<ReleaseResult> {\n    const detailsCacheKey = `details:${moduleAPIURL}`;\n    const releasesCache: Record<string, Release> =\n      (await packageCache.get(\n        `datasource-${DenoDatasource.id}`,\n        detailsCacheKey,\n      )) ?? {};\n    let cacheModified = false;\n\n    const {\n      body: { versions, tags },\n    } = await this.http.getJson(moduleAPIURL, DenoAPIModuleResponse);\n\n    // get details for the versions\n    const releases = await pMap(\n      versions,\n      async (version) => {\n        const cacheRelease = releasesCache[version];\n        /* v8 ignore next 3: hard to test */\n        if (cacheRelease) {\n          return cacheRelease;\n        }\n\n        // https://apiland.deno.dev/v2/modules/postgres/v0.17.0\n        const url = joinUrlParts(moduleAPIURL, version);\n        const { body: release } = await this.http.getJson(\n          url,\n          DenoAPIModuleVersionResponse.catch(({ error: err }) => {\n            logger.warn(\n              { err, version },\n              'Deno: failed to get version details',\n            );\n            return { version };\n          }),\n        );\n\n        releasesCache[release.version] = release;\n        cacheModified = true;\n\n        return release;\n      },\n      { concurrency: 5 },\n    );\n\n    if (cacheModified) {\n      // 1 week. Releases at Deno are immutable, therefore we can use a long term cache here.\n      await packageCache.set(\n        `datasource-${DenoDatasource.id}`,\n        detailsCacheKey,\n        releasesCache,\n        10080,\n      );\n    }\n\n    return { releases, tags };\n  }\n\n  getReleaseResult(moduleAPIURL: string): Promise<ReleaseResult> {\n    return withCache(\n      {\n        namespace: `datasource-${DenoDatasource.id}`,\n        key: `getReleaseResult:${moduleAPIURL}`,\n      },\n      () => this._getReleaseResult(moduleAPIURL),\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;AAgBA,IAAa,iBAAb,MAAa,uBAAuB,WAAW;CAC7C,OAAgB,KAAK;CAErB,wBAA0C;CAE1C,mBAAqC;CAErC,oBAAsCA;CAEtC,sBAAwC,CAAC,0BAA0B;CAEnE,0BAA4C;CAC5C,uBACE;CACF,mBAAqC;CACrC,gBACE;CAEF,cAAc;EACZ,MAAM,eAAe,EAAE;CACzB;CAEA,MAAc,aAAa,EACzB,aACA,eACmD;EACnD,MAAM,sBAAsB;EAK5B,MAAM,iBAHgB,MACpB,oDACF,CAAC,CAAC,KAAK,WAC4B,CAAC,EAAE,QAAQ;EAC9C,IAAI,kBAAkB,cAAc,GAAG;GACrC,OAAO,MACL,uDAAuD,YAAY,EACrE;GACA,OAAO;EACT;EAMA,MAAM,eAAe,aACnB,qBACA,cAL0B,eAAe,QAAQ,MAAM,EAMrC,CACpB;EAEA,OAAO,MAAM,KAAK,iBAAiB,YAAY;CACjD;CAEA,YAAY,QAA0D;EACpE,OAAO,UACL;GACE,WAAW,cAAc,eAAe;GAExC,KAAK,eAAe,OAAO,YAAY,GAAG,OAAO;GACjD,UAAU;EACZ,SACM,KAAK,aAAa,MAAM,CAChC;CACF;CAEA,MAAc,kBACZ,cACwB;EACxB,MAAM,kBAAkB,WAAW;EACnC,MAAM,gBACH,MAAMC,IACL,cAAc,eAAe,MAC7B,eACF,KAAM,CAAC;EACT,IAAI,gBAAgB;EAEpB,MAAM,EACJ,MAAM,EAAE,UAAU,WAChB,MAAM,KAAK,KAAK,QAAQ,cAAc,qBAAqB;EAG/D,MAAM,WAAW,MAAM,KACrB,UACA,OAAO,YAAY;GACjB,MAAM,eAAe,cAAc;;GAEnC,IAAI,cACF,OAAO;GAIT,MAAM,MAAM,aAAa,cAAc,OAAO;GAC9C,MAAM,EAAE,MAAM,YAAY,MAAM,KAAK,KAAK,QACxC,KACA,6BAA6B,OAAO,EAAE,OAAO,UAAU;IACrD,OAAO,KACL;KAAE;KAAK;IAAQ,GACf,qCACF;IACA,OAAO,EAAE,QAAQ;GACnB,CAAC,CACH;GAEA,cAAc,QAAQ,WAAW;GACjC,gBAAgB;GAEhB,OAAO;EACT,GACA,EAAE,aAAa,EAAE,CACnB;EAEA,IAAI,eAEF,MAAMC,IACJ,cAAc,eAAe,MAC7B,iBACA,eACA,KACF;EAGF,OAAO;GAAE;GAAU;EAAK;CAC1B;CAEA,iBAAiB,cAA8C;EAC7D,OAAO,UACL;GACE,WAAW,cAAc,eAAe;GACxC,KAAK,oBAAoB;EAC3B,SACM,KAAK,kBAAkB,YAAY,CAC3C;CACF;AACF"}
+{"version":3,"file":"index.js","names":["semanticVersioning.id","packageCache.get","packageCache.set"],"sources":["../../../../lib/modules/datasource/deno/index.ts"],"sourcesContent":["import { isNullOrUndefined } from '@sindresorhus/is';\nimport pMap from 'p-map';\nimport { logger } from '../../../logger/index.ts';\nimport * as packageCache from '../../../util/cache/package/index.ts';\nimport { withCache } from '../../../util/cache/package/with-cache.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { joinUrlParts } from '../../../util/url.ts';\nimport * as semanticVersioning from '../../versioning/semver/index.ts';\nimport { Datasource } from '../datasource.ts';\nimport type { Release } from '../index.ts';\nimport type { GetReleasesConfig, ReleaseResult } from '../types.ts';\nimport {\n  DenoAPIModuleResponse,\n  DenoAPIModuleVersionResponse,\n} from './schema.ts';\n\nexport class DenoDatasource extends Datasource {\n  static readonly id = 'deno';\n\n  override readonly customRegistrySupport = true;\n\n  override readonly registryStrategy = 'first';\n\n  override readonly defaultVersioning = semanticVersioning.id;\n\n  override readonly defaultRegistryUrls = ['https://apiland.deno.dev'];\n\n  override readonly releaseTimestampSupport = true;\n  override readonly releaseTimestampNote =\n    'The release timestamp is determined from the `uploaded_at` field in the results.';\n  override readonly sourceUrlSupport = 'release';\n  override readonly sourceUrlNote =\n    'The source URL is determined from the `repository` field in the results.';\n\n  constructor() {\n    super(DenoDatasource.id);\n  }\n\n  private async _getReleases({\n    packageName,\n    registryUrl,\n  }: GetReleasesConfig): Promise<ReleaseResult | null> {\n    const massagedRegistryUrl = registryUrl!;\n\n    const extractResult = regEx(\n      /^(https:\\/\\/deno.land\\/)(?<rawPackageName>[^@\\s]+)/,\n    ).exec(packageName);\n    const rawPackageName = extractResult?.groups?.rawPackageName;\n    if (isNullOrUndefined(rawPackageName)) {\n      logger.debug(\n        `Could not extract rawPackageName from packageName: \"${packageName}\"`,\n      );\n      return null;\n    }\n\n    // remove third-party prefix if defined. The only internal library is `std` and is available under the same API\n    const massagedPackageName = rawPackageName.replace('x/', '');\n\n    // https://apiland.deno.dev/v2/modules/postgres\n    const moduleAPIURL = joinUrlParts(\n      massagedRegistryUrl,\n      'v2/modules',\n      massagedPackageName,\n    );\n\n    return await this.getReleaseResult(moduleAPIURL);\n  }\n\n  getReleases(config: GetReleasesConfig): Promise<ReleaseResult | null> {\n    return withCache(\n      {\n        namespace: `datasource-${DenoDatasource.id}`,\n        // TODO: types (#22198)\n        key: `getReleases:${config.registryUrl}:${config.packageName}`,\n        fallback: true,\n      },\n      () => this._getReleases(config),\n    );\n  }\n\n  private async _getReleaseResult(\n    moduleAPIURL: string,\n  ): Promise<ReleaseResult> {\n    const detailsCacheKey = `details:${moduleAPIURL}`;\n    const releasesCache: Record<string, Release> =\n      (await packageCache.get(\n        `datasource-${DenoDatasource.id}`,\n        detailsCacheKey,\n      )) ?? {};\n    let cacheModified = false;\n\n    const {\n      body: { versions, tags },\n    } = await this.http.getJson(moduleAPIURL, DenoAPIModuleResponse);\n\n    // get details for the versions\n    const releases = await pMap(\n      versions,\n      async (version) => {\n        const cacheRelease = releasesCache[version];\n        /* v8 ignore next 3: hard to test */\n        if (cacheRelease) {\n          return cacheRelease;\n        }\n\n        // https://apiland.deno.dev/v2/modules/postgres/v0.17.0\n        const url = joinUrlParts(moduleAPIURL, version);\n        const { body: release } = await this.http.getJson(\n          url,\n          DenoAPIModuleVersionResponse.catch(({ error: err }) => {\n            logger.warn(\n              { err, version },\n              'Deno: failed to get version details',\n            );\n            return { version };\n          }),\n        );\n\n        releasesCache[release.version] = release;\n        cacheModified = true;\n\n        return release;\n      },\n      { concurrency: 5 },\n    );\n\n    if (cacheModified) {\n      // 1 week. Releases at Deno are immutable, therefore we can use a long term cache here.\n      await packageCache.set(\n        `datasource-${DenoDatasource.id}`,\n        detailsCacheKey,\n        releasesCache,\n        10080,\n      );\n    }\n\n    return { releases, tags };\n  }\n\n  getReleaseResult(moduleAPIURL: string): Promise<ReleaseResult> {\n    return withCache(\n      {\n        namespace: `datasource-${DenoDatasource.id}`,\n        key: `getReleaseResult:${moduleAPIURL}`,\n      },\n      () => this._getReleaseResult(moduleAPIURL),\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;AAgBA,IAAa,iBAAb,MAAa,uBAAuB,WAAW;CAC7C,OAAgB,KAAK;CAErB,wBAA0C;CAE1C,mBAAqC;CAErC,oBAAsCA;CAEtC,sBAAwC,CAAC,0BAA0B;CAEnE,0BAA4C;CAC5C,uBACE;CACF,mBAAqC;CACrC,gBACE;CAEF,cAAc;EACZ,MAAM,eAAe,EAAE;CACzB;CAEA,MAAc,aAAa,EACzB,aACA,eACmD;EACnD,MAAM,sBAAsB;EAK5B,MAAM,iBAHgB,MACpB,oDACF,CAAC,CAAC,KAAK,WAC4B,CAAC,EAAE,QAAQ;EAC9C,IAAI,kBAAkB,cAAc,GAAG;GACrC,OAAO,MACL,uDAAuD,YAAY,EACrE;GACA,OAAO;EACT;EAGA,MAAM,sBAAsB,eAAe,QAAQ,MAAM,EAAE;EAG3D,MAAM,eAAe,aACnB,qBACA,cACA,mBACF;EAEA,OAAO,MAAM,KAAK,iBAAiB,YAAY;CACjD;CAEA,YAAY,QAA0D;EACpE,OAAO,UACL;GACE,WAAW,cAAc,eAAe;GAExC,KAAK,eAAe,OAAO,YAAY,GAAG,OAAO;GACjD,UAAU;EACZ,SACM,KAAK,aAAa,MAAM,CAChC;CACF;CAEA,MAAc,kBACZ,cACwB;EACxB,MAAM,kBAAkB,WAAW;EACnC,MAAM,gBACH,MAAMC,IACL,cAAc,eAAe,MAC7B,eACF,KAAM,CAAC;EACT,IAAI,gBAAgB;EAEpB,MAAM,EACJ,MAAM,EAAE,UAAU,WAChB,MAAM,KAAK,KAAK,QAAQ,cAAc,qBAAqB;EAG/D,MAAM,WAAW,MAAM,KACrB,UACA,OAAO,YAAY;GACjB,MAAM,eAAe,cAAc;;GAEnC,IAAI,cACF,OAAO;GAIT,MAAM,MAAM,aAAa,cAAc,OAAO;GAC9C,MAAM,EAAE,MAAM,YAAY,MAAM,KAAK,KAAK,QACxC,KACA,6BAA6B,OAAO,EAAE,OAAO,UAAU;IACrD,OAAO,KACL;KAAE;KAAK;IAAQ,GACf,qCACF;IACA,OAAO,EAAE,QAAQ;GACnB,CAAC,CACH;GAEA,cAAc,QAAQ,WAAW;GACjC,gBAAgB;GAEhB,OAAO;EACT,GACA,EAAE,aAAa,EAAE,CACnB;EAEA,IAAI,eAEF,MAAMC,IACJ,cAAc,eAAe,MAC7B,iBACA,eACA,KACF;EAGF,OAAO;GAAE;GAAU;EAAK;CAC1B;CAEA,iBAAiB,cAA8C;EAC7D,OAAO,UACL;GACE,WAAW,cAAc,eAAe;GACxC,KAAK,oBAAoB;EAC3B,SACM,KAAK,kBAAkB,YAAY,CAC3C;CACF;AACF"}

package/dist/modules/datasource/docker/common.js

@@ -126,7 +126,7 @@ async function getAuthHeaders(http, registryHost, dockerRepository, apiCheckUrl
 		}
 		addSecretForSanitizing(token);
 		return { authorization: `Bearer ${token}` };
-	} catch (err) 	/* istanbul ignore next */ {
+	} catch (err) /* istanbul ignore next */ {
 		/* v8 ignore if -- quay.io errors are swallowed pending #9604, not reproduced in specs */
 		if (err.host === "quay.io") return null;
 		/* v8 ignore if -- registry auth rejection is logged and swallowed, not mocked in specs */
@@ -177,7 +177,8 @@ function getRegistryRepository(packageName, registryUrl) {
 			let registryHost = trimTrailingSlash(registryUrl);
 			if (!regEx(/^https?:\/\//).test(registryHost)) registryHost = `https://${registryHost}`;
 			let dockerRepository = packageName.replace(registryEndingWithSlash, "");
-			const parsedFullUrl = parseUrl(`${registryHost}/${dockerRepository}`);
+			const fullUrl = `${registryHost}/${dockerRepository}`;
+			const parsedFullUrl = parseUrl(fullUrl);
 			if (!parsedFullUrl) return {
 				registryHost,
 				dockerRepository

package/dist/modules/datasource/docker/common.js.map

@@ -1 +1 @@
-{"version":3,"file":"common.js","names":["hostRules.find","dockerVersioning"],"sources":["../../../../lib/modules/datasource/docker/common.ts"],"sourcesContent":["import { isNonEmptyString, isString } from '@sindresorhus/is';\nimport {\n  HOST_DISABLED,\n  PAGE_NOT_FOUND_ERROR,\n} from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { ExternalHostError } from '../../../types/errors/external-host-error.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport { detectPlatform } from '../../../util/common.ts';\nimport { parseGitUrl } from '../../../util/git/url.ts';\nimport { toSha256 } from '../../../util/hash.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { memCacheProvider } from '../../../util/http/cache/memory-http-cache-provider.ts';\nimport type { Http } from '../../../util/http/index.ts';\nimport type {\n  HttpOptions,\n  HttpResponse,\n  OutgoingHttpHeaders,\n} from '../../../util/http/types.ts';\nimport type { ParamsChallenge } from '../../../util/http/www-authenticate.ts';\nimport { BearerScheme, parse } from '../../../util/http/www-authenticate.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { addSecretForSanitizing } from '../../../util/sanitize.ts';\nimport {\n  ensureTrailingSlash,\n  parseUrl,\n  trimTrailingSlash,\n} from '../../../util/url.ts';\nimport { api as dockerVersioning } from '../../versioning/docker/index.ts';\nimport { getGoogleAuthToken } from '../util.ts';\nimport { ecrRegex, getECRAuthToken, isECRMaxResultsResponse } from './ecr.ts';\nimport { googleRegex } from './google.ts';\nimport type { OciHelmConfig } from './schema.ts';\nimport { RegistryAuthToken } from './schema.ts';\nimport type { RegistryRepository } from './types.ts';\n\nexport const dockerDatasourceId = 'docker';\n\nexport const imageUrlLabel = 'org.opencontainers.image.url';\n\nexport const sourceLabel = 'org.opencontainers.image.source';\nexport const sourceLabels = [sourceLabel, 'org.label-schema.vcs-url'] as const;\n\nexport const gitRefLabel = 'org.opencontainers.image.revision';\n\nexport const DOCKER_HUB = 'https://index.docker.io';\n\nexport function isDockerHost(host: string): boolean {\n  const regex = regEx(/(?:^|\\.)docker\\.io$/);\n  return regex.test(host);\n}\n\nexport async function getAuthHeaders(\n  http: Http,\n  registryHost: string,\n  dockerRepository: string,\n  apiCheckUrl = `${registryHost}/v2/`,\n): Promise<OutgoingHttpHeaders | null> {\n  try {\n    const options = {\n      throwHttpErrors: false,\n      noAuth: true,\n      cacheProvider: memCacheProvider,\n    };\n    const apiCheckResponse = apiCheckUrl.endsWith('/v2/')\n      ? await http.get(apiCheckUrl, options)\n      : // use json request, as this will be cached for tags, so it returns json\n        // TODO: add cache test\n        await http.getJsonUnchecked(apiCheckUrl, options);\n\n    if (apiCheckResponse.statusCode === 200) {\n      logger.debug(`No registry auth required for ${apiCheckUrl}`);\n      return {};\n    }\n    if (apiCheckResponse.statusCode === 404) {\n      logger.debug(`Page Not Found ${apiCheckUrl}`);\n      // throw error up to be caught and potentially retried with library/ prefix\n      throw new Error(PAGE_NOT_FOUND_ERROR);\n    }\n    // Some ECR-compatible private registries (e.g. corporate Docker proxies) reject\n    // n>1000 with 405 even on the auth-probe request.  Fall back to probing the base\n    // /v2/ endpoint so getAuthHeaders can still obtain a valid token; the main fetch\n    // loop already retries with n=1000 when it encounters this same error.\n    if (isECRMaxResultsResponse(apiCheckResponse)) {\n      logger.debug(\n        { apiCheckUrl },\n        'Registry rejected n>1000 on auth probe; retrying auth check via base /v2/ endpoint',\n      );\n      return getAuthHeaders(http, registryHost, dockerRepository);\n    }\n    if (\n      apiCheckResponse.statusCode !== 401 ||\n      !isNonEmptyString(apiCheckResponse.headers['www-authenticate'])\n    ) {\n      logger.warn(\n        { apiCheckUrl, res: apiCheckResponse },\n        'Invalid registry response',\n      );\n      return null;\n    }\n\n    const rule = hostRules.find({\n      hostType: dockerDatasourceId,\n      url: apiCheckUrl,\n    });\n    const opts: HttpOptions = {};\n\n    if (ecrRegex.test(registryHost)) {\n      logger.once.debug(`hostRules: ecr auth for ${registryHost}`);\n      logger.trace(\n        { registryHost, dockerRepository },\n        `Using ecr auth for Docker registry`,\n      );\n      const [, region] = coerceArray(ecrRegex.exec(registryHost));\n      const auth = await getECRAuthToken(region, rule);\n      if (auth) {\n        opts.headers = { authorization: `Basic ${auth}` };\n      }\n    } else if (\n      googleRegex.test(registryHost) &&\n      typeof rule.username === 'undefined' &&\n      typeof rule.password === 'undefined' &&\n      typeof rule.token === 'undefined'\n    ) {\n      logger.once.debug(`hostRules: google auth for ${registryHost}`);\n      logger.trace(\n        { registryHost, dockerRepository },\n        `Using google auth for Docker registry`,\n      );\n      const auth = await getGoogleAuthToken();\n      if (auth) {\n        opts.headers = { authorization: `Basic ${auth}` };\n      } else {\n        logger.once.debug(\n          { registryHost, dockerRepository },\n          'Could not get Google access token, using no auth',\n        );\n      }\n    } else if (rule.username && rule.password) {\n      logger.once.debug(`hostRules: basic auth for ${registryHost}`);\n      logger.trace(\n        { registryHost, dockerRepository },\n        `Using basic auth for Docker registry`,\n      );\n      const auth = Buffer.from(`${rule.username}:${rule.password}`).toString(\n        'base64',\n      );\n      opts.headers = { authorization: `Basic ${auth}` };\n    } else if (rule.token) {\n      const authType = rule.authType ?? 'Bearer';\n      logger.once.debug(\n        `hostRules: ${authType} token auth for ${registryHost}`,\n      );\n      logger.trace(\n        { registryHost, dockerRepository },\n        `Using ${authType} token for Docker registry`,\n      );\n      opts.headers = { authorization: `${authType} ${rule.token}` };\n    }\n\n    const challenges = parse(apiCheckResponse.headers['www-authenticate']);\n    const authenticateHeader = challenges.find(\n      (c): c is ParamsChallenge => c.scheme === BearerScheme,\n    );\n\n    // If realm isn't an url, we should directly use auth header\n    // Can happen when we get a Basic auth or some other auth type\n    // * WWW-Authenticate: Basic realm=\"Artifactory Realm\"\n    // * Www-Authenticate: Basic realm=\"https://123456789.dkr.ecr.eu-central-1.amazonaws.com/\",service=\"ecr.amazonaws.com\"\n    // * www-authenticate: Bearer realm=\"https://ghcr.io/token\",service=\"ghcr.io\",scope=\"repository:user/image:pull\"\n    // * www-authenticate: Bearer realm=\"https://auth.docker.io/token\",service=\"registry.docker.io\"\n    // * www-authenticate: Bearer realm=\"https://codeberg.org/v2/token\",service=\"container_registry\",scope=\"*\",Basic realm=\"https://codeberg.org/v2\",service=\"container_registry\",scope=\"*\"\n    if (\n      !authenticateHeader ||\n      !isString(authenticateHeader.params?.realm) ||\n      parseUrl(authenticateHeader.params.realm) === null\n    ) {\n      logger.once.debug(`hostRules: testing direct auth for ${registryHost}`);\n      logger.trace(\n        { registryHost, dockerRepository, authenticateHeader },\n        `Invalid realm, testing direct auth`,\n      );\n      return opts.headers ?? null;\n    }\n\n    // already guarded by above clause\n    const authUrl = parseUrl(`${authenticateHeader.params.realm}`)!;\n\n    // repo isn't known to server yet, so causing wrong scope `repository:user/image:pull`\n    if (\n      isString(authenticateHeader.params.scope) &&\n      !apiCheckUrl.endsWith('/v2/')\n    ) {\n      authUrl.searchParams.append('scope', authenticateHeader.params.scope);\n    } else {\n      authUrl.searchParams.append(\n        'scope',\n        `repository:${dockerRepository}:pull`,\n      );\n    }\n\n    if (isString(authenticateHeader.params.service)) {\n      authUrl.searchParams.append('service', authenticateHeader.params.service);\n    }\n\n    logger.trace(\n      { registryHost, dockerRepository, authUrl: authUrl.href },\n      `Obtaining docker registry token`,\n    );\n    opts.noAuth = true;\n    opts.cacheProvider = memCacheProvider;\n    const authResponse = (\n      await http.getJson(authUrl.href, opts, RegistryAuthToken)\n    ).body;\n\n    const token = authResponse.token ?? authResponse.access_token;\n    /* v8 ignore next 4 -- TODO: add test */\n    if (!token) {\n      logger.warn('Failed to obtain docker registry token');\n      return null;\n    }\n    // sanitize token\n    addSecretForSanitizing(token);\n    return {\n      authorization: `Bearer ${token}`,\n    };\n  } catch (err) /* istanbul ignore next */ {\n    /* v8 ignore if -- quay.io errors are swallowed pending #9604, not reproduced in specs */\n    if (err.host === 'quay.io') {\n      // TODO: debug why quay throws errors (#9604)\n      return null;\n    }\n    /* v8 ignore if -- registry auth rejection is logged and swallowed, not mocked in specs */\n    if (err.statusCode === 401) {\n      logger.debug(\n        { registryHost, dockerRepository },\n        'Unauthorized docker lookup',\n      );\n      logger.debug({ err });\n      return null;\n    }\n    /* v8 ignore if -- registry permission rejection is logged and swallowed, not mocked in specs */\n    if (err.statusCode === 403) {\n      logger.debug(\n        { registryHost, dockerRepository },\n        'Not allowed to access docker registry',\n      );\n      logger.debug({ err });\n      return null;\n    }\n    if (err.name === 'RequestError' && isDockerHost(registryHost)) {\n      throw new ExternalHostError(err);\n    }\n    /* v8 ignore if -- Docker Hub rate limiting maps to ExternalHostError, not mocked in specs */\n    if (err.statusCode === 429 && isDockerHost(registryHost)) {\n      throw new ExternalHostError(err);\n    }\n    /* v8 ignore if -- registry server errors map to ExternalHostError, not mocked in specs */\n    if (err.statusCode >= 500 && err.statusCode < 600) {\n      throw new ExternalHostError(err);\n    }\n    if (err.message === PAGE_NOT_FOUND_ERROR) {\n      throw err;\n    }\n    /* v8 ignore if -- hostRules-disabled host is swallowed silently, not mocked in specs */\n    if (err.message === HOST_DISABLED) {\n      logger.trace({ registryHost, dockerRepository, err }, 'Host disabled');\n      return null;\n    }\n    logger.warn(\n      { registryHost, dockerRepository, err },\n      'Error obtaining docker token',\n    );\n    return null;\n  }\n}\n\nexport function getRegistryRepository(\n  packageName: string,\n  registryUrl: string,\n): RegistryRepository {\n  if (registryUrl !== DOCKER_HUB) {\n    const registryEndingWithSlash = ensureTrailingSlash(\n      registryUrl.replace(regEx(/^https?:\\/\\//), ''),\n    );\n    if (packageName.startsWith(registryEndingWithSlash)) {\n      let registryHost = trimTrailingSlash(registryUrl);\n      if (!regEx(/^https?:\\/\\//).test(registryHost)) {\n        registryHost = `https://${registryHost}`;\n      }\n      let dockerRepository = packageName.replace(registryEndingWithSlash, '');\n      const fullUrl = `${registryHost}/${dockerRepository}`;\n      const parsedFullUrl = parseUrl(fullUrl);\n      if (!parsedFullUrl) {\n        return { registryHost, dockerRepository };\n      }\n      registryHost = parsedFullUrl.origin;\n      dockerRepository = parsedFullUrl.pathname.substring(1);\n      return {\n        registryHost,\n        dockerRepository,\n      };\n    }\n  }\n  let registryHost = registryUrl;\n  const split = packageName.split('/');\n  if (split.length > 1 && (split[0].includes('.') || split[0].includes(':'))) {\n    [registryHost] = split;\n    split.shift();\n  }\n  let dockerRepository = split.join('/');\n\n  if (!regEx(/^https?:\\/\\//).test(registryHost)) {\n    registryHost = `https://${registryHost}`;\n  }\n\n  const { path, base } =\n    regEx(/^(?<base>https:\\/\\/[^/]+)\\/(?<path>.+)$/).exec(registryHost)\n      ?.groups ?? {};\n  if (base && path) {\n    registryHost = base;\n    dockerRepository = `${trimTrailingSlash(path)}/${dockerRepository}`;\n  }\n\n  registryHost = registryHost\n    .replace('https://docker.io', 'https://index.docker.io')\n    .replace('https://registry-1.docker.io', 'https://index.docker.io');\n\n  const opts = hostRules.find({\n    hostType: dockerDatasourceId,\n    url: registryHost,\n  });\n  if (opts?.insecureRegistry) {\n    registryHost = registryHost.replace('https', 'http');\n  }\n  if (registryHost.endsWith('.docker.io') && !dockerRepository.includes('/')) {\n    dockerRepository = `library/${dockerRepository}`;\n  }\n  return {\n    registryHost,\n    dockerRepository,\n  };\n}\n\nexport function extractDigestFromResponseBody(\n  manifestResponse: HttpResponse,\n): string {\n  return `sha256:${toSha256(manifestResponse.body)}`;\n}\n\nexport function findLatestStable(tags: string[]): string | null {\n  let stable: string | null = null;\n\n  for (const tag of tags) {\n    if (!dockerVersioning.isValid(tag) || !dockerVersioning.isStable(tag)) {\n      continue;\n    }\n\n    if (!stable || dockerVersioning.isGreaterThan(tag, stable)) {\n      stable = tag;\n    }\n  }\n\n  return stable;\n}\n\nconst chartRepo = regEx(/charts?|helm|helm-charts?/i);\n\nfunction isPossibleChartRepo(url: string): boolean {\n  if (detectPlatform(url) === null) {\n    return false;\n  }\n\n  const parsed = parseGitUrl(url);\n  return chartRepo.test(parsed.name);\n}\n\nexport function findHelmSourceUrl(release: OciHelmConfig): string | null {\n  if (release.home && isPossibleChartRepo(release.home)) {\n    return release.home;\n  }\n\n  if (!release.sources?.length) {\n    return null;\n  }\n\n  for (const url of release.sources) {\n    if (isPossibleChartRepo(url)) {\n      return url;\n    }\n  }\n\n  // fallback\n  return release.sources[0];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAoCA,MAAa,qBAAqB;AAElC,MAAa,gBAAgB;AAE7B,MAAa,cAAc;AAC3B,MAAa,eAAe,CAAC,aAAa,0BAA0B;AAEpE,MAAa,cAAc;AAE3B,MAAa,aAAa;AAE1B,SAAgB,aAAa,MAAuB;CAElD,OADc,MAAM,qBACT,CAAC,CAAC,KAAK,IAAI;AACxB;AAEA,eAAsB,eACpB,MACA,cACA,kBACA,cAAc,GAAG,aAAa,OACO;CACrC,IAAI;EACF,MAAM,UAAU;GACd,iBAAiB;GACjB,QAAQ;GACR,eAAe;EACjB;EACA,MAAM,mBAAmB,YAAY,SAAS,MAAM,IAChD,MAAM,KAAK,IAAI,aAAa,OAAO,IAGnC,MAAM,KAAK,iBAAiB,aAAa,OAAO;EAEpD,IAAI,iBAAiB,eAAe,KAAK;GACvC,OAAO,MAAM,iCAAiC,aAAa;GAC3D,OAAO,CAAC;EACV;EACA,IAAI,iBAAiB,eAAe,KAAK;GACvC,OAAO,MAAM,kBAAkB,aAAa;GAE5C,MAAM,IAAI,MAAM,oBAAoB;EACtC;EAKA,IAAI,wBAAwB,gBAAgB,GAAG;GAC7C,OAAO,MACL,EAAE,YAAY,GACd,oFACF;GACA,OAAO,eAAe,MAAM,cAAc,gBAAgB;EAC5D;EACA,IACE,iBAAiB,eAAe,OAChC,CAAC,iBAAiB,iBAAiB,QAAQ,mBAAmB,GAC9D;GACA,OAAO,KACL;IAAE;IAAa,KAAK;GAAiB,GACrC,2BACF;GACA,OAAO;EACT;EAEA,MAAM,OAAOA,KAAe;GAC1B,UAAU;GACV,KAAK;EACP,CAAC;EACD,MAAM,OAAoB,CAAC;EAE3B,IAAI,SAAS,KAAK,YAAY,GAAG;GAC/B,OAAO,KAAK,MAAM,2BAA2B,cAAc;GAC3D,OAAO,MACL;IAAE;IAAc;GAAiB,GACjC,oCACF;GACA,MAAM,GAAG,UAAU,YAAY,SAAS,KAAK,YAAY,CAAC;GAC1D,MAAM,OAAO,MAAM,gBAAgB,QAAQ,IAAI;GAC/C,IAAI,MACF,KAAK,UAAU,EAAE,eAAe,SAAS,OAAO;EAEpD,OAAO,IACL,YAAY,KAAK,YAAY,KAC7B,OAAO,KAAK,aAAa,eACzB,OAAO,KAAK,aAAa,eACzB,OAAO,KAAK,UAAU,aACtB;GACA,OAAO,KAAK,MAAM,8BAA8B,cAAc;GAC9D,OAAO,MACL;IAAE;IAAc;GAAiB,GACjC,uCACF;GACA,MAAM,OAAO,MAAM,mBAAmB;GACtC,IAAI,MACF,KAAK,UAAU,EAAE,eAAe,SAAS,OAAO;QAEhD,OAAO,KAAK,MACV;IAAE;IAAc;GAAiB,GACjC,kDACF;EAEJ,OAAO,IAAI,KAAK,YAAY,KAAK,UAAU;GACzC,OAAO,KAAK,MAAM,6BAA6B,cAAc;GAC7D,OAAO,MACL;IAAE;IAAc;GAAiB,GACjC,sCACF;GAIA,KAAK,UAAU,EAAE,eAAe,SAHnB,OAAO,KAAK,GAAG,KAAK,SAAS,GAAG,KAAK,UAAU,CAAC,CAAC,SAC5D,QAE0C,IAAI;EAClD,OAAO,IAAI,KAAK,OAAO;GACrB,MAAM,WAAW,KAAK,YAAY;GAClC,OAAO,KAAK,MACV,cAAc,SAAS,kBAAkB,cAC3C;GACA,OAAO,MACL;IAAE;IAAc;GAAiB,GACjC,SAAS,SAAS,2BACpB;GACA,KAAK,UAAU,EAAE,eAAe,GAAG,SAAS,GAAG,KAAK,QAAQ;EAC9D;EAGA,MAAM,qBADa,MAAM,iBAAiB,QAAQ,mBACd,CAAC,CAAC,MACnC,MAA4B,EAAE,WAAW,YAC5C;EASA,IACE,CAAC,sBACD,CAAC,SAAS,mBAAmB,QAAQ,KAAK,KAC1C,SAAS,mBAAmB,OAAO,KAAK,MAAM,MAC9C;GACA,OAAO,KAAK,MAAM,sCAAsC,cAAc;GACtE,OAAO,MACL;IAAE;IAAc;IAAkB;GAAmB,GACrD,oCACF;GACA,OAAO,KAAK,WAAW;EACzB;EAGA,MAAM,UAAU,SAAS,GAAG,mBAAmB,OAAO,OAAO;EAG7D,IACE,SAAS,mBAAmB,OAAO,KAAK,KACxC,CAAC,YAAY,SAAS,MAAM,GAE5B,QAAQ,aAAa,OAAO,SAAS,mBAAmB,OAAO,KAAK;OAEpE,QAAQ,aAAa,OACnB,SACA,cAAc,iBAAiB,MACjC;EAGF,IAAI,SAAS,mBAAmB,OAAO,OAAO,GAC5C,QAAQ,aAAa,OAAO,WAAW,mBAAmB,OAAO,OAAO;EAG1E,OAAO,MACL;GAAE;GAAc;GAAkB,SAAS,QAAQ;EAAK,GACxD,iCACF;EACA,KAAK,SAAS;EACd,KAAK,gBAAgB;EACrB,MAAM,gBACJ,MAAM,KAAK,QAAQ,QAAQ,MAAM,MAAM,iBAAiB,EAAA,CACxD;EAEF,MAAM,QAAQ,aAAa,SAAS,aAAa;;EAEjD,IAAI,CAAC,OAAO;GACV,OAAO,KAAK,wCAAwC;GACpD,OAAO;EACT;EAEA,uBAAuB,KAAK;EAC5B,OAAO,EACL,eAAe,UAAU,QAC3B;CACF,SAAS,iCAAgC;;EAEvC,IAAI,IAAI,SAAS,WAEf,OAAO;;EAGT,IAAI,IAAI,eAAe,KAAK;GAC1B,OAAO,MACL;IAAE;IAAc;GAAiB,GACjC,4BACF;GACA,OAAO,MAAM,EAAE,IAAI,CAAC;GACpB,OAAO;EACT;;EAEA,IAAI,IAAI,eAAe,KAAK;GAC1B,OAAO,MACL;IAAE;IAAc;GAAiB,GACjC,uCACF;GACA,OAAO,MAAM,EAAE,IAAI,CAAC;GACpB,OAAO;EACT;EACA,IAAI,IAAI,SAAS,kBAAkB,aAAa,YAAY,GAC1D,MAAM,IAAI,kBAAkB,GAAG;;EAGjC,IAAI,IAAI,eAAe,OAAO,aAAa,YAAY,GACrD,MAAM,IAAI,kBAAkB,GAAG;;EAGjC,IAAI,IAAI,cAAc,OAAO,IAAI,aAAa,KAC5C,MAAM,IAAI,kBAAkB,GAAG;EAEjC,IAAI,IAAI,YAAA,kBACN,MAAM;;EAGR,IAAI,IAAI,YAAA,iBAA2B;GACjC,OAAO,MAAM;IAAE;IAAc;IAAkB;GAAI,GAAG,eAAe;GACrE,OAAO;EACT;EACA,OAAO,KACL;GAAE;GAAc;GAAkB;EAAI,GACtC,8BACF;EACA,OAAO;CACT;AACF;AAEA,SAAgB,sBACd,aACA,aACoB;CACpB,IAAI,gBAAA,2BAA4B;EAC9B,MAAM,0BAA0B,oBAC9B,YAAY,QAAQ,MAAM,cAAc,GAAG,EAAE,CAC/C;EACA,IAAI,YAAY,WAAW,uBAAuB,GAAG;GACnD,IAAI,eAAe,kBAAkB,WAAW;GAChD,IAAI,CAAC,MAAM,cAAc,CAAC,CAAC,KAAK,YAAY,GAC1C,eAAe,WAAW;GAE5B,IAAI,mBAAmB,YAAY,QAAQ,yBAAyB,EAAE;GAEtE,MAAM,gBAAgB,SAAS,GADZ,aAAa,GAAG,kBACG;GACtC,IAAI,CAAC,eACH,OAAO;IAAE;IAAc;GAAiB;GAE1C,eAAe,cAAc;GAC7B,mBAAmB,cAAc,SAAS,UAAU,CAAC;GACrD,OAAO;IACL;IACA;GACF;EACF;CACF;CACA,IAAI,eAAe;CACnB,MAAM,QAAQ,YAAY,MAAM,GAAG;CACnC,IAAI,MAAM,SAAS,MAAM,MAAM,EAAE,CAAC,SAAS,GAAG,KAAK,MAAM,EAAE,CAAC,SAAS,GAAG,IAAI;EAC1E,CAAC,gBAAgB;EACjB,MAAM,MAAM;CACd;CACA,IAAI,mBAAmB,MAAM,KAAK,GAAG;CAErC,IAAI,CAAC,MAAM,cAAc,CAAC,CAAC,KAAK,YAAY,GAC1C,eAAe,WAAW;CAG5B,MAAM,EAAE,MAAM,SACZ,MAAM,yCAAyC,CAAC,CAAC,KAAK,YAAY,CAAC,EAC/D,UAAU,CAAC;CACjB,IAAI,QAAQ,MAAM;EAChB,eAAe;EACf,mBAAmB,GAAG,kBAAkB,IAAI,EAAE,GAAG;CACnD;CAEA,eAAe,aACZ,QAAQ,qBAAqB,yBAAyB,CAAC,CACvD,QAAQ,gCAAgC,yBAAyB;CAMpE,IAJaA,KAAe;EAC1B,UAAA;EACA,KAAK;CACP,CACO,CAAC,EAAE,kBACR,eAAe,aAAa,QAAQ,SAAS,MAAM;CAErD,IAAI,aAAa,SAAS,YAAY,KAAK,CAAC,iBAAiB,SAAS,GAAG,GACvE,mBAAmB,WAAW;CAEhC,OAAO;EACL;EACA;CACF;AACF;AAEA,SAAgB,8BACd,kBACQ;CACR,OAAO,UAAU,SAAS,iBAAiB,IAAI;AACjD;AAEA,SAAgB,iBAAiB,MAA+B;CAC9D,IAAI,SAAwB;CAE5B,KAAK,MAAM,OAAO,MAAM;EACtB,IAAI,CAACC,IAAiB,QAAQ,GAAG,KAAK,CAACA,IAAiB,SAAS,GAAG,GAClE;EAGF,IAAI,CAAC,UAAUA,IAAiB,cAAc,KAAK,MAAM,GACvD,SAAS;CAEb;CAEA,OAAO;AACT;AAEA,MAAM,YAAY,MAAM,4BAA4B;AAEpD,SAAS,oBAAoB,KAAsB;CACjD,IAAI,eAAe,GAAG,MAAM,MAC1B,OAAO;CAGT,MAAM,SAAS,YAAY,GAAG;CAC9B,OAAO,UAAU,KAAK,OAAO,IAAI;AACnC;AAEA,SAAgB,kBAAkB,SAAuC;CACvE,IAAI,QAAQ,QAAQ,oBAAoB,QAAQ,IAAI,GAClD,OAAO,QAAQ;CAGjB,IAAI,CAAC,QAAQ,SAAS,QACpB,OAAO;CAGT,KAAK,MAAM,OAAO,QAAQ,SACxB,IAAI,oBAAoB,GAAG,GACzB,OAAO;CAKX,OAAO,QAAQ,QAAQ;AACzB"}
+{"version":3,"file":"common.js","names":["hostRules.find","dockerVersioning"],"sources":["../../../../lib/modules/datasource/docker/common.ts"],"sourcesContent":["import { isNonEmptyString, isString } from '@sindresorhus/is';\nimport {\n  HOST_DISABLED,\n  PAGE_NOT_FOUND_ERROR,\n} from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { ExternalHostError } from '../../../types/errors/external-host-error.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport { detectPlatform } from '../../../util/common.ts';\nimport { parseGitUrl } from '../../../util/git/url.ts';\nimport { toSha256 } from '../../../util/hash.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { memCacheProvider } from '../../../util/http/cache/memory-http-cache-provider.ts';\nimport type { Http } from '../../../util/http/index.ts';\nimport type {\n  HttpOptions,\n  HttpResponse,\n  OutgoingHttpHeaders,\n} from '../../../util/http/types.ts';\nimport type { ParamsChallenge } from '../../../util/http/www-authenticate.ts';\nimport { BearerScheme, parse } from '../../../util/http/www-authenticate.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { addSecretForSanitizing } from '../../../util/sanitize.ts';\nimport {\n  ensureTrailingSlash,\n  parseUrl,\n  trimTrailingSlash,\n} from '../../../util/url.ts';\nimport { api as dockerVersioning } from '../../versioning/docker/index.ts';\nimport { getGoogleAuthToken } from '../util.ts';\nimport { ecrRegex, getECRAuthToken, isECRMaxResultsResponse } from './ecr.ts';\nimport { googleRegex } from './google.ts';\nimport type { OciHelmConfig } from './schema.ts';\nimport { RegistryAuthToken } from './schema.ts';\nimport type { RegistryRepository } from './types.ts';\n\nexport const dockerDatasourceId = 'docker';\n\nexport const imageUrlLabel = 'org.opencontainers.image.url';\n\nexport const sourceLabel = 'org.opencontainers.image.source';\nexport const sourceLabels = [sourceLabel, 'org.label-schema.vcs-url'] as const;\n\nexport const gitRefLabel = 'org.opencontainers.image.revision';\n\nexport const DOCKER_HUB = 'https://index.docker.io';\n\nexport function isDockerHost(host: string): boolean {\n  const regex = regEx(/(?:^|\\.)docker\\.io$/);\n  return regex.test(host);\n}\n\nexport async function getAuthHeaders(\n  http: Http,\n  registryHost: string,\n  dockerRepository: string,\n  apiCheckUrl = `${registryHost}/v2/`,\n): Promise<OutgoingHttpHeaders | null> {\n  try {\n    const options = {\n      throwHttpErrors: false,\n      noAuth: true,\n      cacheProvider: memCacheProvider,\n    };\n    const apiCheckResponse = apiCheckUrl.endsWith('/v2/')\n      ? await http.get(apiCheckUrl, options)\n      : // use json request, as this will be cached for tags, so it returns json\n        // TODO: add cache test\n        await http.getJsonUnchecked(apiCheckUrl, options);\n\n    if (apiCheckResponse.statusCode === 200) {\n      logger.debug(`No registry auth required for ${apiCheckUrl}`);\n      return {};\n    }\n    if (apiCheckResponse.statusCode === 404) {\n      logger.debug(`Page Not Found ${apiCheckUrl}`);\n      // throw error up to be caught and potentially retried with library/ prefix\n      throw new Error(PAGE_NOT_FOUND_ERROR);\n    }\n    // Some ECR-compatible private registries (e.g. corporate Docker proxies) reject\n    // n>1000 with 405 even on the auth-probe request.  Fall back to probing the base\n    // /v2/ endpoint so getAuthHeaders can still obtain a valid token; the main fetch\n    // loop already retries with n=1000 when it encounters this same error.\n    if (isECRMaxResultsResponse(apiCheckResponse)) {\n      logger.debug(\n        { apiCheckUrl },\n        'Registry rejected n>1000 on auth probe; retrying auth check via base /v2/ endpoint',\n      );\n      return getAuthHeaders(http, registryHost, dockerRepository);\n    }\n    if (\n      apiCheckResponse.statusCode !== 401 ||\n      !isNonEmptyString(apiCheckResponse.headers['www-authenticate'])\n    ) {\n      logger.warn(\n        { apiCheckUrl, res: apiCheckResponse },\n        'Invalid registry response',\n      );\n      return null;\n    }\n\n    const rule = hostRules.find({\n      hostType: dockerDatasourceId,\n      url: apiCheckUrl,\n    });\n    const opts: HttpOptions = {};\n\n    if (ecrRegex.test(registryHost)) {\n      logger.once.debug(`hostRules: ecr auth for ${registryHost}`);\n      logger.trace(\n        { registryHost, dockerRepository },\n        `Using ecr auth for Docker registry`,\n      );\n      const [, region] = coerceArray(ecrRegex.exec(registryHost));\n      const auth = await getECRAuthToken(region, rule);\n      if (auth) {\n        opts.headers = { authorization: `Basic ${auth}` };\n      }\n    } else if (\n      googleRegex.test(registryHost) &&\n      typeof rule.username === 'undefined' &&\n      typeof rule.password === 'undefined' &&\n      typeof rule.token === 'undefined'\n    ) {\n      logger.once.debug(`hostRules: google auth for ${registryHost}`);\n      logger.trace(\n        { registryHost, dockerRepository },\n        `Using google auth for Docker registry`,\n      );\n      const auth = await getGoogleAuthToken();\n      if (auth) {\n        opts.headers = { authorization: `Basic ${auth}` };\n      } else {\n        logger.once.debug(\n          { registryHost, dockerRepository },\n          'Could not get Google access token, using no auth',\n        );\n      }\n    } else if (rule.username && rule.password) {\n      logger.once.debug(`hostRules: basic auth for ${registryHost}`);\n      logger.trace(\n        { registryHost, dockerRepository },\n        `Using basic auth for Docker registry`,\n      );\n      const auth = Buffer.from(`${rule.username}:${rule.password}`).toString(\n        'base64',\n      );\n      opts.headers = { authorization: `Basic ${auth}` };\n    } else if (rule.token) {\n      const authType = rule.authType ?? 'Bearer';\n      logger.once.debug(\n        `hostRules: ${authType} token auth for ${registryHost}`,\n      );\n      logger.trace(\n        { registryHost, dockerRepository },\n        `Using ${authType} token for Docker registry`,\n      );\n      opts.headers = { authorization: `${authType} ${rule.token}` };\n    }\n\n    const challenges = parse(apiCheckResponse.headers['www-authenticate']);\n    const authenticateHeader = challenges.find(\n      (c): c is ParamsChallenge => c.scheme === BearerScheme,\n    );\n\n    // If realm isn't an url, we should directly use auth header\n    // Can happen when we get a Basic auth or some other auth type\n    // * WWW-Authenticate: Basic realm=\"Artifactory Realm\"\n    // * Www-Authenticate: Basic realm=\"https://123456789.dkr.ecr.eu-central-1.amazonaws.com/\",service=\"ecr.amazonaws.com\"\n    // * www-authenticate: Bearer realm=\"https://ghcr.io/token\",service=\"ghcr.io\",scope=\"repository:user/image:pull\"\n    // * www-authenticate: Bearer realm=\"https://auth.docker.io/token\",service=\"registry.docker.io\"\n    // * www-authenticate: Bearer realm=\"https://codeberg.org/v2/token\",service=\"container_registry\",scope=\"*\",Basic realm=\"https://codeberg.org/v2\",service=\"container_registry\",scope=\"*\"\n    if (\n      !authenticateHeader ||\n      !isString(authenticateHeader.params?.realm) ||\n      parseUrl(authenticateHeader.params.realm) === null\n    ) {\n      logger.once.debug(`hostRules: testing direct auth for ${registryHost}`);\n      logger.trace(\n        { registryHost, dockerRepository, authenticateHeader },\n        `Invalid realm, testing direct auth`,\n      );\n      return opts.headers ?? null;\n    }\n\n    // already guarded by above clause\n    const authUrl = parseUrl(`${authenticateHeader.params.realm}`)!;\n\n    // repo isn't known to server yet, so causing wrong scope `repository:user/image:pull`\n    if (\n      isString(authenticateHeader.params.scope) &&\n      !apiCheckUrl.endsWith('/v2/')\n    ) {\n      authUrl.searchParams.append('scope', authenticateHeader.params.scope);\n    } else {\n      authUrl.searchParams.append(\n        'scope',\n        `repository:${dockerRepository}:pull`,\n      );\n    }\n\n    if (isString(authenticateHeader.params.service)) {\n      authUrl.searchParams.append('service', authenticateHeader.params.service);\n    }\n\n    logger.trace(\n      { registryHost, dockerRepository, authUrl: authUrl.href },\n      `Obtaining docker registry token`,\n    );\n    opts.noAuth = true;\n    opts.cacheProvider = memCacheProvider;\n    const authResponse = (\n      await http.getJson(authUrl.href, opts, RegistryAuthToken)\n    ).body;\n\n    const token = authResponse.token ?? authResponse.access_token;\n    /* v8 ignore next 4 -- TODO: add test */\n    if (!token) {\n      logger.warn('Failed to obtain docker registry token');\n      return null;\n    }\n    // sanitize token\n    addSecretForSanitizing(token);\n    return {\n      authorization: `Bearer ${token}`,\n    };\n  } catch (err) /* istanbul ignore next */ {\n    /* v8 ignore if -- quay.io errors are swallowed pending #9604, not reproduced in specs */\n    if (err.host === 'quay.io') {\n      // TODO: debug why quay throws errors (#9604)\n      return null;\n    }\n    /* v8 ignore if -- registry auth rejection is logged and swallowed, not mocked in specs */\n    if (err.statusCode === 401) {\n      logger.debug(\n        { registryHost, dockerRepository },\n        'Unauthorized docker lookup',\n      );\n      logger.debug({ err });\n      return null;\n    }\n    /* v8 ignore if -- registry permission rejection is logged and swallowed, not mocked in specs */\n    if (err.statusCode === 403) {\n      logger.debug(\n        { registryHost, dockerRepository },\n        'Not allowed to access docker registry',\n      );\n      logger.debug({ err });\n      return null;\n    }\n    if (err.name === 'RequestError' && isDockerHost(registryHost)) {\n      throw new ExternalHostError(err);\n    }\n    /* v8 ignore if -- Docker Hub rate limiting maps to ExternalHostError, not mocked in specs */\n    if (err.statusCode === 429 && isDockerHost(registryHost)) {\n      throw new ExternalHostError(err);\n    }\n    /* v8 ignore if -- registry server errors map to ExternalHostError, not mocked in specs */\n    if (err.statusCode >= 500 && err.statusCode < 600) {\n      throw new ExternalHostError(err);\n    }\n    if (err.message === PAGE_NOT_FOUND_ERROR) {\n      throw err;\n    }\n    /* v8 ignore if -- hostRules-disabled host is swallowed silently, not mocked in specs */\n    if (err.message === HOST_DISABLED) {\n      logger.trace({ registryHost, dockerRepository, err }, 'Host disabled');\n      return null;\n    }\n    logger.warn(\n      { registryHost, dockerRepository, err },\n      'Error obtaining docker token',\n    );\n    return null;\n  }\n}\n\nexport function getRegistryRepository(\n  packageName: string,\n  registryUrl: string,\n): RegistryRepository {\n  if (registryUrl !== DOCKER_HUB) {\n    const registryEndingWithSlash = ensureTrailingSlash(\n      registryUrl.replace(regEx(/^https?:\\/\\//), ''),\n    );\n    if (packageName.startsWith(registryEndingWithSlash)) {\n      let registryHost = trimTrailingSlash(registryUrl);\n      if (!regEx(/^https?:\\/\\//).test(registryHost)) {\n        registryHost = `https://${registryHost}`;\n      }\n      let dockerRepository = packageName.replace(registryEndingWithSlash, '');\n      const fullUrl = `${registryHost}/${dockerRepository}`;\n      const parsedFullUrl = parseUrl(fullUrl);\n      if (!parsedFullUrl) {\n        return { registryHost, dockerRepository };\n      }\n      registryHost = parsedFullUrl.origin;\n      dockerRepository = parsedFullUrl.pathname.substring(1);\n      return {\n        registryHost,\n        dockerRepository,\n      };\n    }\n  }\n  let registryHost = registryUrl;\n  const split = packageName.split('/');\n  if (split.length > 1 && (split[0].includes('.') || split[0].includes(':'))) {\n    [registryHost] = split;\n    split.shift();\n  }\n  let dockerRepository = split.join('/');\n\n  if (!regEx(/^https?:\\/\\//).test(registryHost)) {\n    registryHost = `https://${registryHost}`;\n  }\n\n  const { path, base } =\n    regEx(/^(?<base>https:\\/\\/[^/]+)\\/(?<path>.+)$/).exec(registryHost)\n      ?.groups ?? {};\n  if (base && path) {\n    registryHost = base;\n    dockerRepository = `${trimTrailingSlash(path)}/${dockerRepository}`;\n  }\n\n  registryHost = registryHost\n    .replace('https://docker.io', 'https://index.docker.io')\n    .replace('https://registry-1.docker.io', 'https://index.docker.io');\n\n  const opts = hostRules.find({\n    hostType: dockerDatasourceId,\n    url: registryHost,\n  });\n  if (opts?.insecureRegistry) {\n    registryHost = registryHost.replace('https', 'http');\n  }\n  if (registryHost.endsWith('.docker.io') && !dockerRepository.includes('/')) {\n    dockerRepository = `library/${dockerRepository}`;\n  }\n  return {\n    registryHost,\n    dockerRepository,\n  };\n}\n\nexport function extractDigestFromResponseBody(\n  manifestResponse: HttpResponse,\n): string {\n  return `sha256:${toSha256(manifestResponse.body)}`;\n}\n\nexport function findLatestStable(tags: string[]): string | null {\n  let stable: string | null = null;\n\n  for (const tag of tags) {\n    if (!dockerVersioning.isValid(tag) || !dockerVersioning.isStable(tag)) {\n      continue;\n    }\n\n    if (!stable || dockerVersioning.isGreaterThan(tag, stable)) {\n      stable = tag;\n    }\n  }\n\n  return stable;\n}\n\nconst chartRepo = regEx(/charts?|helm|helm-charts?/i);\n\nfunction isPossibleChartRepo(url: string): boolean {\n  if (detectPlatform(url) === null) {\n    return false;\n  }\n\n  const parsed = parseGitUrl(url);\n  return chartRepo.test(parsed.name);\n}\n\nexport function findHelmSourceUrl(release: OciHelmConfig): string | null {\n  if (release.home && isPossibleChartRepo(release.home)) {\n    return release.home;\n  }\n\n  if (!release.sources?.length) {\n    return null;\n  }\n\n  for (const url of release.sources) {\n    if (isPossibleChartRepo(url)) {\n      return url;\n    }\n  }\n\n  // fallback\n  return release.sources[0];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAoCA,MAAa,qBAAqB;AAElC,MAAa,gBAAgB;AAE7B,MAAa,cAAc;AAC3B,MAAa,eAAe,CAAC,aAAa,0BAA0B;AAEpE,MAAa,cAAc;AAE3B,MAAa,aAAa;AAE1B,SAAgB,aAAa,MAAuB;CAElD,OADc,MAAM,qBACT,CAAC,CAAC,KAAK,IAAI;AACxB;AAEA,eAAsB,eACpB,MACA,cACA,kBACA,cAAc,GAAG,aAAa,OACO;CACrC,IAAI;EACF,MAAM,UAAU;GACd,iBAAiB;GACjB,QAAQ;GACR,eAAe;EACjB;EACA,MAAM,mBAAmB,YAAY,SAAS,MAAM,IAChD,MAAM,KAAK,IAAI,aAAa,OAAO,IAGnC,MAAM,KAAK,iBAAiB,aAAa,OAAO;EAEpD,IAAI,iBAAiB,eAAe,KAAK;GACvC,OAAO,MAAM,iCAAiC,aAAa;GAC3D,OAAO,CAAC;EACV;EACA,IAAI,iBAAiB,eAAe,KAAK;GACvC,OAAO,MAAM,kBAAkB,aAAa;GAE5C,MAAM,IAAI,MAAM,oBAAoB;EACtC;EAKA,IAAI,wBAAwB,gBAAgB,GAAG;GAC7C,OAAO,MACL,EAAE,YAAY,GACd,oFACF;GACA,OAAO,eAAe,MAAM,cAAc,gBAAgB;EAC5D;EACA,IACE,iBAAiB,eAAe,OAChC,CAAC,iBAAiB,iBAAiB,QAAQ,mBAAmB,GAC9D;GACA,OAAO,KACL;IAAE;IAAa,KAAK;GAAiB,GACrC,2BACF;GACA,OAAO;EACT;EAEA,MAAM,OAAOA,KAAe;GAC1B,UAAU;GACV,KAAK;EACP,CAAC;EACD,MAAM,OAAoB,CAAC;EAE3B,IAAI,SAAS,KAAK,YAAY,GAAG;GAC/B,OAAO,KAAK,MAAM,2BAA2B,cAAc;GAC3D,OAAO,MACL;IAAE;IAAc;GAAiB,GACjC,oCACF;GACA,MAAM,GAAG,UAAU,YAAY,SAAS,KAAK,YAAY,CAAC;GAC1D,MAAM,OAAO,MAAM,gBAAgB,QAAQ,IAAI;GAC/C,IAAI,MACF,KAAK,UAAU,EAAE,eAAe,SAAS,OAAO;EAEpD,OAAO,IACL,YAAY,KAAK,YAAY,KAC7B,OAAO,KAAK,aAAa,eACzB,OAAO,KAAK,aAAa,eACzB,OAAO,KAAK,UAAU,aACtB;GACA,OAAO,KAAK,MAAM,8BAA8B,cAAc;GAC9D,OAAO,MACL;IAAE;IAAc;GAAiB,GACjC,uCACF;GACA,MAAM,OAAO,MAAM,mBAAmB;GACtC,IAAI,MACF,KAAK,UAAU,EAAE,eAAe,SAAS,OAAO;QAEhD,OAAO,KAAK,MACV;IAAE;IAAc;GAAiB,GACjC,kDACF;EAEJ,OAAO,IAAI,KAAK,YAAY,KAAK,UAAU;GACzC,OAAO,KAAK,MAAM,6BAA6B,cAAc;GAC7D,OAAO,MACL;IAAE;IAAc;GAAiB,GACjC,sCACF;GAIA,KAAK,UAAU,EAAE,eAAe,SAHnB,OAAO,KAAK,GAAG,KAAK,SAAS,GAAG,KAAK,UAAU,CAAC,CAAC,SAC5D,QAE0C,IAAI;EAClD,OAAO,IAAI,KAAK,OAAO;GACrB,MAAM,WAAW,KAAK,YAAY;GAClC,OAAO,KAAK,MACV,cAAc,SAAS,kBAAkB,cAC3C;GACA,OAAO,MACL;IAAE;IAAc;GAAiB,GACjC,SAAS,SAAS,2BACpB;GACA,KAAK,UAAU,EAAE,eAAe,GAAG,SAAS,GAAG,KAAK,QAAQ;EAC9D;EAGA,MAAM,qBADa,MAAM,iBAAiB,QAAQ,mBACd,CAAC,CAAC,MACnC,MAA4B,EAAE,WAAW,YAC5C;EASA,IACE,CAAC,sBACD,CAAC,SAAS,mBAAmB,QAAQ,KAAK,KAC1C,SAAS,mBAAmB,OAAO,KAAK,MAAM,MAC9C;GACA,OAAO,KAAK,MAAM,sCAAsC,cAAc;GACtE,OAAO,MACL;IAAE;IAAc;IAAkB;GAAmB,GACrD,oCACF;GACA,OAAO,KAAK,WAAW;EACzB;EAGA,MAAM,UAAU,SAAS,GAAG,mBAAmB,OAAO,OAAO;EAG7D,IACE,SAAS,mBAAmB,OAAO,KAAK,KACxC,CAAC,YAAY,SAAS,MAAM,GAE5B,QAAQ,aAAa,OAAO,SAAS,mBAAmB,OAAO,KAAK;OAEpE,QAAQ,aAAa,OACnB,SACA,cAAc,iBAAiB,MACjC;EAGF,IAAI,SAAS,mBAAmB,OAAO,OAAO,GAC5C,QAAQ,aAAa,OAAO,WAAW,mBAAmB,OAAO,OAAO;EAG1E,OAAO,MACL;GAAE;GAAc;GAAkB,SAAS,QAAQ;EAAK,GACxD,iCACF;EACA,KAAK,SAAS;EACd,KAAK,gBAAgB;EACrB,MAAM,gBACJ,MAAM,KAAK,QAAQ,QAAQ,MAAM,MAAM,iBAAiB,EAAA,CACxD;EAEF,MAAM,QAAQ,aAAa,SAAS,aAAa;;EAEjD,IAAI,CAAC,OAAO;GACV,OAAO,KAAK,wCAAwC;GACpD,OAAO;EACT;EAEA,uBAAuB,KAAK;EAC5B,OAAO,EACL,eAAe,UAAU,QAC3B;CACF,SAAS,gCAAgC;;EAEvC,IAAI,IAAI,SAAS,WAEf,OAAO;;EAGT,IAAI,IAAI,eAAe,KAAK;GAC1B,OAAO,MACL;IAAE;IAAc;GAAiB,GACjC,4BACF;GACA,OAAO,MAAM,EAAE,IAAI,CAAC;GACpB,OAAO;EACT;;EAEA,IAAI,IAAI,eAAe,KAAK;GAC1B,OAAO,MACL;IAAE;IAAc;GAAiB,GACjC,uCACF;GACA,OAAO,MAAM,EAAE,IAAI,CAAC;GACpB,OAAO;EACT;EACA,IAAI,IAAI,SAAS,kBAAkB,aAAa,YAAY,GAC1D,MAAM,IAAI,kBAAkB,GAAG;;EAGjC,IAAI,IAAI,eAAe,OAAO,aAAa,YAAY,GACrD,MAAM,IAAI,kBAAkB,GAAG;;EAGjC,IAAI,IAAI,cAAc,OAAO,IAAI,aAAa,KAC5C,MAAM,IAAI,kBAAkB,GAAG;EAEjC,IAAI,IAAI,YAAA,kBACN,MAAM;;EAGR,IAAI,IAAI,YAAA,iBAA2B;GACjC,OAAO,MAAM;IAAE;IAAc;IAAkB;GAAI,GAAG,eAAe;GACrE,OAAO;EACT;EACA,OAAO,KACL;GAAE;GAAc;GAAkB;EAAI,GACtC,8BACF;EACA,OAAO;CACT;AACF;AAEA,SAAgB,sBACd,aACA,aACoB;CACpB,IAAI,gBAAA,2BAA4B;EAC9B,MAAM,0BAA0B,oBAC9B,YAAY,QAAQ,MAAM,cAAc,GAAG,EAAE,CAC/C;EACA,IAAI,YAAY,WAAW,uBAAuB,GAAG;GACnD,IAAI,eAAe,kBAAkB,WAAW;GAChD,IAAI,CAAC,MAAM,cAAc,CAAC,CAAC,KAAK,YAAY,GAC1C,eAAe,WAAW;GAE5B,IAAI,mBAAmB,YAAY,QAAQ,yBAAyB,EAAE;GACtE,MAAM,UAAU,GAAG,aAAa,GAAG;GACnC,MAAM,gBAAgB,SAAS,OAAO;GACtC,IAAI,CAAC,eACH,OAAO;IAAE;IAAc;GAAiB;GAE1C,eAAe,cAAc;GAC7B,mBAAmB,cAAc,SAAS,UAAU,CAAC;GACrD,OAAO;IACL;IACA;GACF;EACF;CACF;CACA,IAAI,eAAe;CACnB,MAAM,QAAQ,YAAY,MAAM,GAAG;CACnC,IAAI,MAAM,SAAS,MAAM,MAAM,EAAE,CAAC,SAAS,GAAG,KAAK,MAAM,EAAE,CAAC,SAAS,GAAG,IAAI;EAC1E,CAAC,gBAAgB;EACjB,MAAM,MAAM;CACd;CACA,IAAI,mBAAmB,MAAM,KAAK,GAAG;CAErC,IAAI,CAAC,MAAM,cAAc,CAAC,CAAC,KAAK,YAAY,GAC1C,eAAe,WAAW;CAG5B,MAAM,EAAE,MAAM,SACZ,MAAM,yCAAyC,CAAC,CAAC,KAAK,YAAY,CAAC,EAC/D,UAAU,CAAC;CACjB,IAAI,QAAQ,MAAM;EAChB,eAAe;EACf,mBAAmB,GAAG,kBAAkB,IAAI,EAAE,GAAG;CACnD;CAEA,eAAe,aACZ,QAAQ,qBAAqB,yBAAyB,CAAC,CACvD,QAAQ,gCAAgC,yBAAyB;CAMpE,IAJaA,KAAe;EAC1B,UAAA;EACA,KAAK;CACP,CACO,CAAC,EAAE,kBACR,eAAe,aAAa,QAAQ,SAAS,MAAM;CAErD,IAAI,aAAa,SAAS,YAAY,KAAK,CAAC,iBAAiB,SAAS,GAAG,GACvE,mBAAmB,WAAW;CAEhC,OAAO;EACL;EACA;CACF;AACF;AAEA,SAAgB,8BACd,kBACQ;CACR,OAAO,UAAU,SAAS,iBAAiB,IAAI;AACjD;AAEA,SAAgB,iBAAiB,MAA+B;CAC9D,IAAI,SAAwB;CAE5B,KAAK,MAAM,OAAO,MAAM;EACtB,IAAI,CAACC,IAAiB,QAAQ,GAAG,KAAK,CAACA,IAAiB,SAAS,GAAG,GAClE;EAGF,IAAI,CAAC,UAAUA,IAAiB,cAAc,KAAK,MAAM,GACvD,SAAS;CAEb;CAEA,OAAO;AACT;AAEA,MAAM,YAAY,MAAM,4BAA4B;AAEpD,SAAS,oBAAoB,KAAsB;CACjD,IAAI,eAAe,GAAG,MAAM,MAC1B,OAAO;CAGT,MAAM,SAAS,YAAY,GAAG;CAC9B,OAAO,UAAU,KAAK,OAAO,IAAI;AACnC;AAEA,SAAgB,kBAAkB,SAAuC;CACvE,IAAI,QAAQ,QAAQ,oBAAoB,QAAQ,IAAI,GAClD,OAAO,QAAQ;CAGjB,IAAI,CAAC,QAAQ,SAAS,QACpB,OAAO;CAGT,KAAK,MAAM,OAAO,QAAQ,SACxB,IAAI,oBAAoB,GAAG,GACzB,OAAO;CAKX,OAAO,QAAQ,QAAQ;AACzB"}

package/dist/modules/datasource/docker/dockerhub-cache.js

@@ -56,7 +56,7 @@ var DockerHubCache = class DockerHubCache {
 		return needNextPage;
 	}
 	async save() {
-		if (this.isChanged) await set(cacheNamespace, this.dockerRepository, this.cache, 4320 * 30);
+		if (this.isChanged) await set(cacheNamespace, this.dockerRepository, this.cache, 129600);
 	}
 	getItems() {
 		return Object.values(this.cache.items);

package/dist/modules/datasource/docker/dockerhub-cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"dockerhub-cache.js","names":["packageCache.get","packageCache.set"],"sources":["../../../../lib/modules/datasource/docker/dockerhub-cache.ts"],"sourcesContent":["import { dequal } from 'dequal';\nimport { DateTime } from 'luxon';\nimport * as packageCache from '../../../util/cache/package/index.ts';\nimport type { DockerHubTag } from './schema.ts';\n\nexport interface DockerHubCacheData {\n  items: Record<number, DockerHubTag>;\n  updatedAt: string | null;\n}\n\nconst cacheNamespace = 'datasource-docker-hub-cache';\n\nexport class DockerHubCache {\n  private isChanged = false;\n  private reconciledIds = new Set<number>();\n  private dockerRepository: string;\n  private cache: DockerHubCacheData;\n\n  private constructor(dockerRepository: string, cache: DockerHubCacheData) {\n    this.dockerRepository = dockerRepository;\n    this.cache = cache;\n  }\n\n  static async init(dockerRepository: string): Promise<DockerHubCache> {\n    let repoCache = await packageCache.get<DockerHubCacheData>(\n      cacheNamespace,\n      dockerRepository,\n    );\n\n    repoCache ??= {\n      items: {},\n      updatedAt: null,\n    };\n\n    return new DockerHubCache(dockerRepository, repoCache);\n  }\n\n  reconcile(items: DockerHubTag[], expectedCount: number): boolean {\n    let needNextPage = true;\n\n    let earliestDate = null;\n\n    let { updatedAt } = this.cache;\n    let latestDate = updatedAt ? DateTime.fromISO(updatedAt) : null;\n\n    for (const newItem of items) {\n      const id = newItem.id;\n      this.reconciledIds.add(id);\n\n      const oldItem = this.cache.items[id];\n\n      const itemDate = DateTime.fromISO(newItem.last_updated);\n\n      if (!earliestDate || earliestDate > itemDate) {\n        earliestDate = itemDate;\n      }\n\n      if (!latestDate || latestDate < itemDate) {\n        latestDate = itemDate;\n        updatedAt = newItem.last_updated;\n      }\n\n      if (dequal(oldItem, newItem)) {\n        needNextPage = false;\n        continue;\n      }\n\n      this.cache.items[newItem.id] = newItem;\n      this.isChanged = true;\n    }\n\n    this.cache.updatedAt = updatedAt;\n\n    if (earliestDate && latestDate) {\n      for (const [key, item] of Object.entries(this.cache.items)) {\n        const id = parseInt(key, 10);\n\n        const itemDate = DateTime.fromISO(item.last_updated);\n\n        if (\n          itemDate < earliestDate ||\n          itemDate > latestDate ||\n          this.reconciledIds.has(id)\n        ) {\n          continue;\n        }\n\n        delete this.cache.items[id];\n        this.isChanged = true;\n      }\n\n      if (Object.keys(this.cache.items).length > expectedCount) {\n        return true;\n      }\n    }\n\n    return needNextPage;\n  }\n\n  async save(): Promise<void> {\n    if (this.isChanged) {\n      await packageCache.set(\n        cacheNamespace,\n        this.dockerRepository,\n        this.cache,\n        3 * 60 * 24 * 30,\n      );\n    }\n  }\n\n  getItems(): DockerHubTag[] {\n    return Object.values(this.cache.items);\n  }\n\n  getDigestForTag(tagName: string): string | null {\n    return (\n      this.getItems().find((item) => item.name === tagName)?.digest ?? null\n    );\n  }\n\n  getArchDigestForTag(tagName: string, architecture: string): string | null {\n    const tag = this.getItems().find((item) => item.name === tagName);\n    return (\n      tag?.images.find((img) => img.architecture === architecture)?.digest ??\n      null\n    );\n  }\n}\n"],"mappings":";;;;AAUA,MAAM,iBAAiB;AAEvB,IAAa,iBAAb,MAAa,eAAe;CAC1B,YAAoB;CACpB,gCAAwB,IAAI,IAAY;CACxC;CACA;CAEA,YAAoB,kBAA0B,OAA2B;EACvE,KAAK,mBAAmB;EACxB,KAAK,QAAQ;CACf;CAEA,aAAa,KAAK,kBAAmD;EACnE,IAAI,YAAY,MAAMA,IACpB,gBACA,gBACF;EAEA,cAAc;GACZ,OAAO,CAAC;GACR,WAAW;EACb;EAEA,OAAO,IAAI,eAAe,kBAAkB,SAAS;CACvD;CAEA,UAAU,OAAuB,eAAgC;EAC/D,IAAI,eAAe;EAEnB,IAAI,eAAe;EAEnB,IAAI,EAAE,cAAc,KAAK;EACzB,IAAI,aAAa,YAAY,SAAS,QAAQ,SAAS,IAAI;EAE3D,KAAK,MAAM,WAAW,OAAO;GAC3B,MAAM,KAAK,QAAQ;GACnB,KAAK,cAAc,IAAI,EAAE;GAEzB,MAAM,UAAU,KAAK,MAAM,MAAM;GAEjC,MAAM,WAAW,SAAS,QAAQ,QAAQ,YAAY;GAEtD,IAAI,CAAC,gBAAgB,eAAe,UAClC,eAAe;GAGjB,IAAI,CAAC,cAAc,aAAa,UAAU;IACxC,aAAa;IACb,YAAY,QAAQ;GACtB;GAEA,IAAI,OAAO,SAAS,OAAO,GAAG;IAC5B,eAAe;IACf;GACF;GAEA,KAAK,MAAM,MAAM,QAAQ,MAAM;GAC/B,KAAK,YAAY;EACnB;EAEA,KAAK,MAAM,YAAY;EAEvB,IAAI,gBAAgB,YAAY;GAC9B,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,KAAK,MAAM,KAAK,GAAG;IAC1D,MAAM,KAAK,SAAS,KAAK,EAAE;IAE3B,MAAM,WAAW,SAAS,QAAQ,KAAK,YAAY;IAEnD,IACE,WAAW,gBACX,WAAW,cACX,KAAK,cAAc,IAAI,EAAE,GAEzB;IAGF,OAAO,KAAK,MAAM,MAAM;IACxB,KAAK,YAAY;GACnB;GAEA,IAAI,OAAO,KAAK,KAAK,MAAM,KAAK,CAAC,CAAC,SAAS,eACzC,OAAO;EAEX;EAEA,OAAO;CACT;CAEA,MAAM,OAAsB;EAC1B,IAAI,KAAK,WACP,MAAMC,IACJ,gBACA,KAAK,kBACL,KAAK,OACL,OAAc,EAChB;CAEJ;CAEA,WAA2B;EACzB,OAAO,OAAO,OAAO,KAAK,MAAM,KAAK;CACvC;CAEA,gBAAgB,SAAgC;EAC9C,OACE,KAAK,SAAS,CAAC,CAAC,MAAM,SAAS,KAAK,SAAS,OAAO,CAAC,EAAE,UAAU;CAErE;CAEA,oBAAoB,SAAiB,cAAqC;EAExE,OADY,KAAK,SAAS,CAAC,CAAC,MAAM,SAAS,KAAK,SAAS,OAErD,CAAC,EAAE,OAAO,MAAM,QAAQ,IAAI,iBAAiB,YAAY,CAAC,EAAE,UAC9D;CAEJ;AACF"}
+{"version":3,"file":"dockerhub-cache.js","names":["packageCache.get","packageCache.set"],"sources":["../../../../lib/modules/datasource/docker/dockerhub-cache.ts"],"sourcesContent":["import { dequal } from 'dequal';\nimport { DateTime } from 'luxon';\nimport * as packageCache from '../../../util/cache/package/index.ts';\nimport type { DockerHubTag } from './schema.ts';\n\nexport interface DockerHubCacheData {\n  items: Record<number, DockerHubTag>;\n  updatedAt: string | null;\n}\n\nconst cacheNamespace = 'datasource-docker-hub-cache';\n\nexport class DockerHubCache {\n  private isChanged = false;\n  private reconciledIds = new Set<number>();\n  private dockerRepository: string;\n  private cache: DockerHubCacheData;\n\n  private constructor(dockerRepository: string, cache: DockerHubCacheData) {\n    this.dockerRepository = dockerRepository;\n    this.cache = cache;\n  }\n\n  static async init(dockerRepository: string): Promise<DockerHubCache> {\n    let repoCache = await packageCache.get<DockerHubCacheData>(\n      cacheNamespace,\n      dockerRepository,\n    );\n\n    repoCache ??= {\n      items: {},\n      updatedAt: null,\n    };\n\n    return new DockerHubCache(dockerRepository, repoCache);\n  }\n\n  reconcile(items: DockerHubTag[], expectedCount: number): boolean {\n    let needNextPage = true;\n\n    let earliestDate = null;\n\n    let { updatedAt } = this.cache;\n    let latestDate = updatedAt ? DateTime.fromISO(updatedAt) : null;\n\n    for (const newItem of items) {\n      const id = newItem.id;\n      this.reconciledIds.add(id);\n\n      const oldItem = this.cache.items[id];\n\n      const itemDate = DateTime.fromISO(newItem.last_updated);\n\n      if (!earliestDate || earliestDate > itemDate) {\n        earliestDate = itemDate;\n      }\n\n      if (!latestDate || latestDate < itemDate) {\n        latestDate = itemDate;\n        updatedAt = newItem.last_updated;\n      }\n\n      if (dequal(oldItem, newItem)) {\n        needNextPage = false;\n        continue;\n      }\n\n      this.cache.items[newItem.id] = newItem;\n      this.isChanged = true;\n    }\n\n    this.cache.updatedAt = updatedAt;\n\n    if (earliestDate && latestDate) {\n      for (const [key, item] of Object.entries(this.cache.items)) {\n        const id = parseInt(key, 10);\n\n        const itemDate = DateTime.fromISO(item.last_updated);\n\n        if (\n          itemDate < earliestDate ||\n          itemDate > latestDate ||\n          this.reconciledIds.has(id)\n        ) {\n          continue;\n        }\n\n        delete this.cache.items[id];\n        this.isChanged = true;\n      }\n\n      if (Object.keys(this.cache.items).length > expectedCount) {\n        return true;\n      }\n    }\n\n    return needNextPage;\n  }\n\n  async save(): Promise<void> {\n    if (this.isChanged) {\n      await packageCache.set(\n        cacheNamespace,\n        this.dockerRepository,\n        this.cache,\n        3 * 60 * 24 * 30,\n      );\n    }\n  }\n\n  getItems(): DockerHubTag[] {\n    return Object.values(this.cache.items);\n  }\n\n  getDigestForTag(tagName: string): string | null {\n    return (\n      this.getItems().find((item) => item.name === tagName)?.digest ?? null\n    );\n  }\n\n  getArchDigestForTag(tagName: string, architecture: string): string | null {\n    const tag = this.getItems().find((item) => item.name === tagName);\n    return (\n      tag?.images.find((img) => img.architecture === architecture)?.digest ??\n      null\n    );\n  }\n}\n"],"mappings":";;;;AAUA,MAAM,iBAAiB;AAEvB,IAAa,iBAAb,MAAa,eAAe;CAC1B,YAAoB;CACpB,gCAAwB,IAAI,IAAY;CACxC;CACA;CAEA,YAAoB,kBAA0B,OAA2B;EACvE,KAAK,mBAAmB;EACxB,KAAK,QAAQ;CACf;CAEA,aAAa,KAAK,kBAAmD;EACnE,IAAI,YAAY,MAAMA,IACpB,gBACA,gBACF;EAEA,cAAc;GACZ,OAAO,CAAC;GACR,WAAW;EACb;EAEA,OAAO,IAAI,eAAe,kBAAkB,SAAS;CACvD;CAEA,UAAU,OAAuB,eAAgC;EAC/D,IAAI,eAAe;EAEnB,IAAI,eAAe;EAEnB,IAAI,EAAE,cAAc,KAAK;EACzB,IAAI,aAAa,YAAY,SAAS,QAAQ,SAAS,IAAI;EAE3D,KAAK,MAAM,WAAW,OAAO;GAC3B,MAAM,KAAK,QAAQ;GACnB,KAAK,cAAc,IAAI,EAAE;GAEzB,MAAM,UAAU,KAAK,MAAM,MAAM;GAEjC,MAAM,WAAW,SAAS,QAAQ,QAAQ,YAAY;GAEtD,IAAI,CAAC,gBAAgB,eAAe,UAClC,eAAe;GAGjB,IAAI,CAAC,cAAc,aAAa,UAAU;IACxC,aAAa;IACb,YAAY,QAAQ;GACtB;GAEA,IAAI,OAAO,SAAS,OAAO,GAAG;IAC5B,eAAe;IACf;GACF;GAEA,KAAK,MAAM,MAAM,QAAQ,MAAM;GAC/B,KAAK,YAAY;EACnB;EAEA,KAAK,MAAM,YAAY;EAEvB,IAAI,gBAAgB,YAAY;GAC9B,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,KAAK,MAAM,KAAK,GAAG;IAC1D,MAAM,KAAK,SAAS,KAAK,EAAE;IAE3B,MAAM,WAAW,SAAS,QAAQ,KAAK,YAAY;IAEnD,IACE,WAAW,gBACX,WAAW,cACX,KAAK,cAAc,IAAI,EAAE,GAEzB;IAGF,OAAO,KAAK,MAAM,MAAM;IACxB,KAAK,YAAY;GACnB;GAEA,IAAI,OAAO,KAAK,KAAK,MAAM,KAAK,CAAC,CAAC,SAAS,eACzC,OAAO;EAEX;EAEA,OAAO;CACT;CAEA,MAAM,OAAsB;EAC1B,IAAI,KAAK,WACP,MAAMC,IACJ,gBACA,KAAK,kBACL,KAAK,OACL,MACF;CAEJ;CAEA,WAA2B;EACzB,OAAO,OAAO,OAAO,KAAK,MAAM,KAAK;CACvC;CAEA,gBAAgB,SAAgC;EAC9C,OACE,KAAK,SAAS,CAAC,CAAC,MAAM,SAAS,KAAK,SAAS,OAAO,CAAC,EAAE,UAAU;CAErE;CAEA,oBAAoB,SAAiB,cAAqC;EAExE,OADY,KAAK,SAAS,CAAC,CAAC,MAAM,SAAS,KAAK,SAAS,OAErD,CAAC,EAAE,OAAO,MAAM,QAAQ,IAAI,iBAAiB,YAAY,CAAC,EAAE,UAC9D;CAEJ;AACF"}

package/dist/modules/datasource/docker/index.js

@@ -74,7 +74,7 @@ var DockerDatasource = class DockerDatasource extends Datasource {
 				noAuth: true,
 				cacheProvider: memCacheProvider
 			});
-		} catch (err) 		/* istanbul ignore next */ {
+		} catch (err) /* istanbul ignore next */ {
 			if (err instanceof ExternalHostError) throw err;
 			if (err.statusCode === 401) {
 				logger.debug({
@@ -127,7 +127,7 @@ var DockerDatasource = class DockerDatasource extends Datasource {
 		return withCache({
 			namespace: "datasource-docker-imageconfig",
 			key: `${registryHost}:${dockerRepository}@${configDigest}`,
-			ttlMinutes: 1440 * 28
+			ttlMinutes: 40320
 		}, () => this._getImageConfig(registryHost, dockerRepository, configDigest));
 	}
 	async _getHelmConfig(registryHost, dockerRepository, configDigest) {
@@ -148,7 +148,7 @@ var DockerDatasource = class DockerDatasource extends Datasource {
 		return withCache({
 			namespace: "datasource-docker-imageconfig",
 			key: `${registryHost}:${dockerRepository}@${configDigest}`,
-			ttlMinutes: 1440 * 28
+			ttlMinutes: 40320
 		}, () => this._getHelmConfig(registryHost, dockerRepository, configDigest));
 	}
 	async getConfigDigest(registry, dockerRepository, tag) {
@@ -203,7 +203,7 @@ var DockerDatasource = class DockerDatasource extends Datasource {
 			try {
 				manifestResponse = await this.getManifestResponse(registryHost, dockerRepository, currentDigest, "head");
 			} catch (_err) {
-				const err = _err instanceof ExternalHostError ? _err.err : 				/* istanbul ignore next: can never happen */ _err;
+				const err = _err instanceof ExternalHostError ? _err.err : /* istanbul ignore next: can never happen */ _err;
 				if (typeof err.statusCode === "number" && err.statusCode >= 500 && err.statusCode < 600) return null;
 				/* istanbul ignore next */
 				throw _err;
@@ -217,7 +217,7 @@ var DockerDatasource = class DockerDatasource extends Datasource {
 				logger.debug(`Current digest ${currentDigest} relates to architecture ${architecture ?? "null"}`);
 				return architecture;
 			}
-		} catch (err) 		/* istanbul ignore next */ {
+		} catch (err) /* istanbul ignore next */ {
 			if (err.statusCode !== 404 || err.message === "page-not-found") throw err;
 			logger.debug({
 				registryHost,
@@ -231,7 +231,7 @@ var DockerDatasource = class DockerDatasource extends Datasource {
 		return withCache({
 			namespace: "datasource-docker-architecture",
 			key: `${registryHost}:${dockerRepository}@${currentDigest}`,
-			ttlMinutes: 1440 * 28,
+			ttlMinutes: 40320,
 			shouldCacheResult: isNonEmptyString
 		}, () => this._getImageArchitecture(registryHost, dockerRepository, currentDigest));
 	}
@@ -297,7 +297,7 @@ var DockerDatasource = class DockerDatasource extends Datasource {
 			}
 			if (labels) logger.debug({ labels }, "found labels in manifest");
 			return labels;
-		} catch (err) 		/* istanbul ignore next: should be tested in future */ {
+		} catch (err) /* istanbul ignore next: should be tested in future */ {
 			if (err instanceof ExternalHostError) throw err;
 			if (err.statusCode === 400 || err.statusCode === 401) logger.debug({
 				registryHost,
@@ -437,7 +437,7 @@ var DockerDatasource = class DockerDatasource extends Datasource {
 			}
 			else tags = await this.getDockerApiTags(registryHost, dockerRepository);
 			return tags;
-		} catch (_err) 		/* istanbul ignore next */ {
+		} catch (_err) /* istanbul ignore next */ {
 			const err = _err instanceof ExternalHostError ? _err.err : _err;
 			if ((err.statusCode === 404 || err.message === "page-not-found") && !dockerRepository.includes("/")) {
 				logger.debug(`Retrying Tags for ${registryHost}/${dockerRepository} using library/ prefix`);
@@ -563,7 +563,7 @@ var DockerDatasource = class DockerDatasource extends Datasource {
 				}, newValue);
 			}
 			if (manifestResponse) logger.debug(`Got docker digest ${digest}`);
-		} catch (err) 		/* istanbul ignore next */ {
+		} catch (err) /* istanbul ignore next */ {
 			if (err instanceof ExternalHostError) throw err;
 			logger.debug({
 				err,
@@ -576,9 +576,10 @@ var DockerDatasource = class DockerDatasource extends Datasource {
 	getDigest(config, newValue) {
 		const newTag = newValue ?? "latest";
 		const { registryHost, dockerRepository } = getRegistryRepository(config.packageName, config.registryUrl);
+		const digest = config.currentDigest ? `@${config.currentDigest}` : "";
 		return withCache({
 			namespace: "datasource-docker-digest",
-			key: `${registryHost}:${dockerRepository}:${newTag}${config.currentDigest ? `@${config.currentDigest}` : ""}`,
+			key: `${registryHost}:${dockerRepository}:${newTag}${digest}`,
 			fallback: true,
 			shouldCacheResult: isNonEmptyString
 		}, () => this._getDigest(config, newValue));