fix(ANE-2243): use correct Docker Hub registry API endpoint

Changelog.md

@@ -1,5 +1,8 @@
 # FOSSA CLI Changelog
 
+## Unreleased
+- Container scanning: Fix a bug where Docker URLs were being constructed incorrectly, resulting in a 403 error
+
 ## 3.9.45
 - Preflight: Fix a bug where the preflight checks fail for SBOM team analysis ([#1499](https://github.com/fossas/fossa-cli/pull/1499))
 

src/Container/Docker/SourceParser.hs

@@ -47,6 +47,7 @@ module Container.Docker.SourceParser (
   suggestDockerExport,
   showReferenceWithSep,
   toRepoNameWithRegistry,
+  toRegistryApiHost,
 ) where
 
 import Control.Monad (unless, void)
@@ -158,6 +159,14 @@ showReferenceWithSep :: RepoReference -> Text
 showReferenceWithSep (RepoReferenceTag (RepoTag tag)) = ":" <> tag
 showReferenceWithSep (RepoReferenceDigest (RepoDigest digest)) = "@" <> digest
 
+-- | Convert a registry host to its API endpoint.
+-- For Docker Hub, we need to use registry-1.docker.io instead of index.docker.io
+-- See: https://docs.docker.com/registry/spec/api/
+toRegistryApiHost :: Text -> Text
+toRegistryApiHost host
+  | host == defaultRegistry = "registry-1.docker.io"
+  | otherwise = host
+
 -- | Parses to RegistryImageSource.
 --
 -- >> parse parseImageUrl "fossa/db" = https://index.docker.io/fossa/db:latest

src/Control/Carrier/ContainerRegistryApi.hs

@@ -38,6 +38,7 @@ import Container.Docker.SourceParser (
   ),
   RepoDigest,
   RepoReference (RepoReferenceDigest),
+  toRegistryApiHost,
  )
 import Control.Algebra (Has)
 import Control.Carrier.AtomicCounter (runAtomicCounter)
@@ -147,13 +148,13 @@ reqManager = sendIO $ newManager tlsManagerSettings
 -- Refer to: https://github.com/opencontainers/distribution-spec/blob/main/spec.md#pulling-manifests
 manifestEndpoint :: Has (Lift IO) sig m => RegistryImageSource -> m Request
 manifestEndpoint (RegistryImageSource url scheme _ repo ref _) =
-  sendIO $ parseRequest (toString $ (toText . show $ scheme) <> url <> "/v2/" <> repo <> "/manifests/" <> (toText . show $ ref))
+  sendIO $ parseRequest (toString $ (toText . show $ scheme) <> toRegistryApiHost url <> "/v2/" <> repo <> "/manifests/" <> (toText . show $ ref))
 
 -- | Blob Endpoint.
 -- Refer to: https://github.com/opencontainers/distribution-spec/blob/main/spec.md#pulling-blobs
 blobEndpoint :: Has (Lift IO) sig m => RegistryImageSource -> m Request
 blobEndpoint (RegistryImageSource url scheme _ repo ref _) =
-  sendIO $ parseRequest (toString $ (toText . show $ scheme) <> url <> "/v2/" <> repo <> "/blobs/" <> (toText . show $ ref))
+  sendIO $ parseRequest (toString $ (toText . show $ scheme) <> toRegistryApiHost url <> "/v2/" <> repo <> "/blobs/" <> (toText . show $ ref))
 
 -- | Retrieve Manifest.
 getImageManifest ::

test/Container/Docker/SourceParserSpec.hs

@@ -10,10 +10,11 @@ import Container.Docker.SourceParser (
   defaultRegistry,
   defaultTag,
   parseImageUrl,
+  toRegistryApiHost,
  )
 import Data.Text (Text)
 import Data.Void (Void)
-import Test.Hspec (Expectation, Spec, describe, it)
+import Test.Hspec (Expectation, Spec, describe, it, shouldBe)
 import Test.Hspec.Megaparsec (shouldParse)
 import Text.Megaparsec (
   Parsec,
@@ -127,6 +128,14 @@ spec = do
                               fixtureArch
                           )
 
+  describe "toRegistryApiHost" $ do
+    it "should convert Docker Hub registry to API endpoint" $
+      toRegistryApiHost defaultRegistry `shouldBe` "registry-1.docker.io"
+
+    it "should not modify other registry hosts" $ do
+      toRegistryApiHost "ghcr.io" `shouldBe` "ghcr.io"
+      toRegistryApiHost "quay.io" `shouldBe` "quay.io"
+
 fixtureArch :: Text
 fixtureArch = "amd64"