Merge pull request #65 from DataDog/jmachado/backport-remote-artifact-type

fix(image): don't reject remote images whose ArtifactType is just a config media type

Author: Bit-Doctor

pkg/fanal/image/remote.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/google/go-containerregistry/pkg/name"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
+	v1types "github.com/google/go-containerregistry/pkg/v1/types"
 	"golang.org/x/xerrors"
 
 	"github.com/aquasecurity/trivy/pkg/fanal/types"
@@ -21,9 +22,11 @@ func tryRemote(ctx context.Context, imageName string, ref name.Reference, option
 	if err != nil {
 		return nil, cleanup, err
 	}
-	// ArtifactType being non-empty indicates this is not a regular container image
-	// (e.g., Helm charts, WASM modules, or other OCI artifacts)
-	if desc.ArtifactType != "" {
+
+	// An empty ArtifactType or an ArtifactType with a config media type indicates a
+	// regular container image. Any other ArtifactType is treated as a non-image
+	// artifact (e.g., Helm charts, WASM modules, or other OCI artifacts).
+	if desc.ArtifactType != "" && !v1types.MediaType(desc.ArtifactType).IsConfig() {
 		return nil, cleanup, xerrors.Errorf("unsupported artifact type %q for image %q", desc.ArtifactType, imageName)
 	}
 	img, err := desc.Image()

pkg/fanal/image/remote_test.go

@@ -144,6 +144,29 @@ func Test_tryRemote(t *testing.T) {
 			},
 			wantErr: "unsupported artifact type",
 		},
+		{
+			// Regression test: a single-arch image manifest (as opposed to a
+			// multi-arch manifest list/index) has a Config field, and when the
+			// manifest itself doesn't set an explicit `artifactType`,
+			// go-containerregistry falls back to using the config's media type
+			// as the descriptor's ArtifactType. A regular container image config
+			// media type must NOT be treated as an unsupported artifact type.
+			name:      "regular image with explicit docker config media type",
+			imageName: "test/dockerconfig:latest",
+			setupImage: func(t *testing.T, ref name.Reference) {
+				configFile, err := img.ConfigFile()
+				require.NoError(t, err)
+
+				imageToWrite, err := mutate.Config(img, configFile.Config)
+				require.NoError(t, err)
+
+				imageToWrite = mutate.ConfigMediaType(imageToWrite, "application/vnd.docker.container.image.v1+json")
+
+				err = remote.Write(ref, imageToWrite)
+				require.NoError(t, err)
+			},
+			wantName: "/test/dockerconfig:latest",
+		},
 		{
 			name:       "image not found",
 			imageName:  "test/notfound:latest",