fix: use central parsing to create oci metadata

Author: d3vco

lib/analyzer/image-inspector.ts

@@ -268,14 +268,11 @@ async function getImageArchive(
 
 function extractImageDetails(targetImage: string): ImageDetails {
   const parsed = parseImageReference(targetImage);
-  const hostname = parsed.registryForPull;
-  const isDockerHub = hostname === "registry-1.docker.io";
-  const imageName =
-    isDockerHub && !parsed.repository.includes("/")
-      ? "library/" + parsed.repository
-      : parsed.repository;
-  const tag = parsed.tailReferenceForPull;
-  return { hostname, imageName, tag };
+  return {
+    hostname: parsed.registryForPull,
+    imageName: parsed.normalizedRepository,
+    tag: parsed.tailReferenceForPull,
+  };
 }
 
 function isLocalImageSameArchitecture(

lib/extractor/oci-distribution-metadata.ts

@@ -1,4 +1,4 @@
-import { parseAll } from "@swimlane/docker-reference";
+import { parseImageReference } from "../image-reference";
 
 export interface OCIDistributionMetadata {
   // Must be a valid host, including port if one was used to pull the image.
@@ -32,17 +32,15 @@ export function constructOCIDisributionMetadata({
   | OCIDistributionMetadata
   | undefined {
   try {
-    const ref = parseAll(imageName);
-    if (!ref.domain || !ref.repository) {
-      return;
-    }
-
+    const parsed = parseImageReference(imageName);
+    // Normalize the hostname. Note this function uses slightly different logic from the one in the image-reference.ts file.
+    const hostname = parsed.registry ? parsed.registry : "docker.io";
     const metadata: OCIDistributionMetadata = {
-      registryHost: ref.domain,
-      repository: ref.repository,
+      registryHost: hostname,
+      repository: parsed.normalizedRepository,
       manifestDigest,
       indexDigest,
-      imageTag: ref.tag,
+      imageTag: parsed.tag,
     };
 
     if (!ociDistributionMetadataIsValid(metadata)) {

lib/image-reference.ts

@@ -54,12 +54,20 @@ export class ParsedImageReference {
     return ref;
   }
 
+  /**
+   * Whether the image is from Docker Hub.
+   * This is true if the registry is "registry-1.docker.io" or "docker.io" or undefined.
+   */
+  get isDockerHub(): boolean {
+    return this.registry === "registry-1.docker.io" || this.registry === "docker.io" || this.registry === undefined;
+  }
+
   /**
    * The registry to use for pulling the image.
    * If the registry is not set, use Docker Hub.
    */
   get registryForPull(): string {
-    if (this.registry === "docker.io" || this.registry === undefined) {
+    if (this.isDockerHub || this.registry === undefined) {
       return "registry-1.docker.io";
     }
     return this.registry;
@@ -74,6 +82,17 @@ export class ParsedImageReference {
   get tailReferenceForPull(): string {
     return this.digest ?? this.tag ?? "latest";
   }
+
+  /**
+   * The normalized repository name.
+   * If the image is from Docker Hub and the repository does not have a namespace, add the default namespace "library".
+   */
+  get normalizedRepository(): string {
+    if (this.isDockerHub && !this.repository.includes("/")) {
+      return "library/" + this.repository;
+    }
+    return this.repository;
+  }
 }
 
 /**

package-lock.json

@@ -33,7 +33,6 @@
     "@snyk/docker-registry-v2-client": "^2.24.0",
     "@snyk/rpm-parser": "^3.4.1",
     "@snyk/snyk-docker-pull": "^3.15.0",
-    "@swimlane/docker-reference": "^2.0.1",
     "adm-zip": "^0.5.16",
     "chalk": "^2.4.2",
     "debug": "^4.4.3",
@@ -62,7 +61,6 @@
     "@commitlint/config-conventional": "^17.0.2",
     "@mongodb-js/zstd": "^2.0.1",
     "@semantic-release/exec": "^6.0.3",
-    "semantic-release": "^19.0.5",
     "@types/adm-zip": "^0.4.34",
     "@types/debug": "^4.1.5",
     "@types/jest": "^29.5.5",
@@ -73,6 +71,7 @@
     "jest": "^29.7.0",
     "npm-run-all": "^4.1.5",
     "prettier": "^2.7.1",
+    "semantic-release": "^19.0.5",
     "ts-jest": "^29.1.1",
     "ts-node": "^10.2.1",
     "tsc-watch": "^4.2.8",