gitea-mirror/trivy
1
0
Fork 0
mirror of https://github.com/aquasecurity/trivy.git synced 2025-12-12 15:50:15 -08:00
Code Issues Packages Projects Releases Wiki Activity

fix(image): parsePlatform is failing with UNAUTHORIZED error (#3326)

Browse Source 
Co-authored-by: knqyf263 <knqyf263@gmail.com>
This commit is contained in:
Kalyana Krishna Varanasi
2023-01-10 16:56:57 +05:30
committed by GitHub
parent 76c883dc43
commit 0f545cfa96
1 changed files with 30 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
pkg/fanal/image/remote.go
View File

@@ -11,6 +11,7 @@ import (
"github.com/google/go-containerregistry/pkg/name"
v1 "github.com/google/go-containerregistry/pkg/v1"
"github.com/google/go-containerregistry/pkg/v1/remote"
v1types "github.com/google/go-containerregistry/pkg/v1/types"
"golang.org/x/xerrors"
"github.com/aquasecurity/trivy/pkg/fanal/image/token"
@@ -27,14 +28,6 @@ func tryRemote(ctx context.Context, imageName string, ref name.Reference, option
remoteOpts = append(remoteOpts, remote.WithTransport(t))
}
if option.Platform != "" {
s, err := parsePlatform(ref, option.Platform)
if err != nil {
return nil, err
}
remoteOpts = append(remoteOpts, remote.WithPlatform(*s))
}
domain := ref.Context().RegistryStr()
auth := token.GetToken(ctx, domain, option)
@@ -47,6 +40,17 @@ func tryRemote(ctx context.Context, imageName string, ref name.Reference, option
remoteOpts = append(remoteOpts, remote.WithAuthFromKeychain(authn.DefaultKeychain))
}
if option.Platform != "" {
s, err := parsePlatform(ref, option.Platform, remoteOpts)
if err != nil {
return nil, xerrors.Errorf("platform error: %w", err)
}
// Don't pass platform when the specified image is single-arch.
if s != nil {
remoteOpts = append(remoteOpts, remote.WithPlatform(*s))
}
}
desc, err := remote.Get(ref, remoteOpts...)
if err != nil {
return nil, err
@@ -67,25 +71,34 @@ func tryRemote(ctx context.Context, imageName string, ref name.Reference, option
}
func parsePlatform(ref name.Reference, p string) (*v1.Platform, error) {
func parsePlatform(ref name.Reference, p string, options []remote.Option) (*v1.Platform, error) {
// OS wildcard, implicitly pick up the first os found in the image list.
// e.g. */amd64
if strings.HasPrefix(p, "*/") {
index, err := remote.Index(ref)
d, err := remote.Get(ref, options...)
if err != nil {
// Not a multi-arch image
if _, ok := err.(*remote.ErrSchema1); ok {
log.Logger.Debug("Ignored --platform as the image is not multi-arch")
return nil, nil
}
return nil, xerrors.Errorf("remote index error: %w", err)
return nil, xerrors.Errorf("image get error: %w", err)
}
switch d.MediaType {
case v1types.OCIManifestSchema1, v1types.DockerManifestSchema2:
// We want an index but the registry has an image, not multi-arch. We just ignore "--platform".
log.Logger.Debug("Ignore --platform as the image is not multi-arch")
return nil, nil
case v1types.OCIImageIndex, v1types.DockerManifestList:
// These are expected.
}
index, err := d.ImageIndex()
if err != nil {
return nil, xerrors.Errorf("image index error: %w", err)
}
m, err := index.IndexManifest()
if err != nil {
return nil, xerrors.Errorf("remote index manifest error: %w", err)
}
if len(m.Manifests) == 0 {
log.Logger.Debug("Ignored --platform as the image is not multi-arch")
log.Logger.Debug("Ignore --platform as the image is not multi-arch")
return nil, nil
}
if m.Manifests[0].Platform != nil {