fix: harden registry parsing (digests, ports, tag pagination) - #88
Open
Abhinesh Jha (Abhineshhh) wants to merge 2 commits into
Open
fix: harden registry parsing (digests, ports, tag pagination)#88Abhinesh Jha (Abhineshhh) wants to merge 2 commits into
Abhinesh Jha (Abhineshhh) wants to merge 2 commits into
Conversation
ExtractRegistryAndRepo previously split on the first :, which mangled digest suffixes (@sha256:...) and registries with ports (localhost:5000). Strip digests first and use the last : after the last / as the tag separator, matching Docker reference parsing. Fixes microsoft#74
GetTags issued a single tags/list request and ignored the Link rel=next header, so large repositories could silently drop tags before filtering and --max-tags selection. Page with n=100 and follow next links until exhausted; add unit tests with a multi-page httptest server. Fixes microsoft#76
Abhinesh Jha (Abhineshhh)
requested review from
Dariusz Porowski (DariuszPorowski) and
Mani Bindra (maniSbindra)
as code owners
July 16, 2026 20:06
This was referenced Jul 16, 2026
Mani Bindra (maniSbindra)
left a comment
Mani Bindra (maniSbindra)
left a comment
Member
There was a problem hiding this comment.
Abhinesh Jha (@Abhineshhh) detailed comment on registry.go:76
| next := fmt.Sprintf("%s/v2/%s/tags/list?n=%d", s.registryURL, repo, tagsPageSize) | ||
| var all []string | ||
|
|
||
| for next != "" { |
There was a problem hiding this comment.
Optional resilience hardening: this pagination loop has no visited-URL check or page limit, so a buggy registry or proxy returning a self-referencing or cyclic rel=next link could keep it running indefinitely. The HTTP timeout would not prevent this because it applies separately to each request.
Current MCR endpoints appear to return all tags without a Link header, so this is not a demonstrated MCR issue and should not block the PR. Consider adding visited-URL detection or a reasonable maximum page count for compatibility with other registries and future pagination behavior.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Consolidated registry fixes that both touch
pkg/infrastructure/scanner/registry.go, stacked into one PR for a clean review/merge.Related Issues
Fixes #74
Fixes #76
Changes
ExtractRegistryAndRepo— strip@digestfirst; last:after last/is the tag; supporthost:port/ localhost ([Bug]: ExtractRegistryAndRepo mishandles digest-pinned refs and registries with ports #74)GetTagspagination — follow Registry APILink: rel=nextwithn=100; httptest multi-page tests ([Bug]: GetTags does not follow Registry API pagination (Link header) #76)Stack note
This replaces the overlapping single-file PRs #83 and #84 (closed in favor of this consolidated stack).
Checklist
go test ./...passes locally