fix(ANE-2243): use correct Docker Hub registry API endpoint #1500
Conversation
When analyzing Docker images from Docker Hub, we now correctly use registry-1.docker.io instead of index.docker.io as the API endpoint. This fixes a 403 error that occurred when trying to analyze Docker images. The change distinguishes between: - index.docker.io: Used for parsing Docker image references - registry-1.docker.io: Used for making actual API requests Jira: ANE-2243
|
not sure why |
The link checker sometimes fails on hoogle.haskell.org due to rate limiting or other issues, but the link is known to be valid. Add it to the ignored patterns.
There was a problem hiding this comment.
This looks pretty safe to me!
Also, I'm not sure why that lint was failing either, or how your changes would have affected it at all. I'll tag @csasarak on this in case maybe he knows and/or has other thoughts on these changes.
|
Please don't remove links in order to fix the link check lint, can you revert that commit? Link checks aren't required to merge, but it is a good advisory for us if we notice a link consistently failing over a longer period of time. |
|
@csasarak done, sorry about that! Didn't realize it wasn't blocking. |
|
It's no problem. It's not obvious that it isn't required and the link check has value but it's definitely flake-y. Mainly when it fails we just have a look at which link it was and see if we can access it from somewhere other than GH like you did. Usually you can and in that case it's safe to bypass. If you can't access it, you can still merge but we'd want to keep that in mind and see if it comes back later. |
Overview
When analyzing Docker images from Docker Hub, we now correctly use registry-1.docker.io instead of index.docker.io as the API endpoint. This fixes a 403 error that occurred when trying to analyze Docker images.
The change distinguishes between:
Jira: ANE-2243
Acceptance criteria
This command should work rather than giving a 403 error:
fossa container analyze docker.io/grafana/loki:2.9.4Testing plan
I just tested the CI-built binary, and it satisfies the AC.
Risks
Highlight any areas that you're unsure of, want feedback on, or want reviewers to pay particular attention to.
Example: I'm not sure I did X correctly, can reviewers please double-check that for me?
Metrics
Is this change something that can or should be tracked? If so, can we do it today? And how? If its easy, do it
References
Jira: ANE-2243
Slack: https://teamfossa.slack.com/archives/C022TQ8EWD7/p1737577045680139
Checklist
docs/.docs/README.msand gave consideration to how discoverable or not my documentation is.Changelog.md. If this PR did not mark a release, I added my changes into an## Unreleasedsection at the top..fossa.ymlorfossa-deps.{json.yml}, I updateddocs/references/files/*.schema.jsonAND I have updated example files used byfossa initcommand. You may also need to update these if you have added/removed new dependency type (e.g.pip) or analysis target type (e.g.poetry).docs/references/subcommands/<subcommand>.md.