fix(image): don't reject remote images whose ArtifactType is just a config media type

go-containerregistry sets Descriptor.ArtifactType to the manifest's config
media type whenever the manifest itself has no explicit `artifactType` field.
This is the case for essentially all plain, single-architecture image
manifests fetched directly (as opposed to a multi-arch manifest list/index,
which has no config field and so leaves ArtifactType empty).

The check added to reject non-image OCI artifacts (Helm charts, WASM
modules, etc.) in the remote image source didn't account for this, causing
single-arch images pulled via the remote fallback to fail with:

    remote error: unsupported artifact type "application/vnd.docker.container.image.v1+json" for image "..."

Backported from upstream aquasecurity/trivy (fixed as of v0.72.0, alongside
a go-containerregistry bump that isn't needed here since IsConfig() is
already available in the go-containerregistry version this fork depends on).

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: Bit-Doctor

pkg/fanal/image/remote.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/google/go-containerregistry/pkg/name"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
+	v1types "github.com/google/go-containerregistry/pkg/v1/types"
 	"golang.org/x/xerrors"
 
 	"github.com/aquasecurity/trivy/pkg/fanal/types"
@@ -21,9 +22,11 @@ func tryRemote(ctx context.Context, imageName string, ref name.Reference, option
 	if err != nil {
 		return nil, cleanup, err
 	}
-	// ArtifactType being non-empty indicates this is not a regular container image
-	// (e.g., Helm charts, WASM modules, or other OCI artifacts)
-	if desc.ArtifactType != "" {
+
+	// An empty ArtifactType or an ArtifactType with a config media type indicates a
+	// regular container image. Any other ArtifactType is treated as a non-image
+	// artifact (e.g., Helm charts, WASM modules, or other OCI artifacts).
+	if desc.ArtifactType != "" && !v1types.MediaType(desc.ArtifactType).IsConfig() {
 		return nil, cleanup, xerrors.Errorf("unsupported artifact type %q for image %q", desc.ArtifactType, imageName)
 	}
 	img, err := desc.Image()

pkg/fanal/image/remote_test.go

@@ -144,6 +144,29 @@ func Test_tryRemote(t *testing.T) {
 			},
 			wantErr: "unsupported artifact type",
 		},
+		{
+			// Regression test: a single-arch image manifest (as opposed to a
+			// multi-arch manifest list/index) has a Config field, and when the
+			// manifest itself doesn't set an explicit `artifactType`,
+			// go-containerregistry falls back to using the config's media type
+			// as the descriptor's ArtifactType. A regular container image config
+			// media type must NOT be treated as an unsupported artifact type.
+			name:      "regular image with explicit docker config media type",
+			imageName: "test/dockerconfig:latest",
+			setupImage: func(t *testing.T, ref name.Reference) {
+				configFile, err := img.ConfigFile()
+				require.NoError(t, err)
+
+				imageToWrite, err := mutate.Config(img, configFile.Config)
+				require.NoError(t, err)
+
+				imageToWrite = mutate.ConfigMediaType(imageToWrite, "application/vnd.docker.container.image.v1+json")
+
+				err = remote.Write(ref, imageToWrite)
+				require.NoError(t, err)
+			},
+			wantName: "/test/dockerconfig:latest",
+		},
 		{
 			name:       "image not found",
 			imageName:  "test/notfound:latest",