- Remove dead docker login/pull/logout code and exceptions
- Fix finding metadata: empty RelatedUrl, Categories per finding type
- Replace SystemExit(0) with _listing_only flag in registry listing
- Use dynamic prowler_version in User-Agent header
- Normalize image UID by stripping protocol prefix on save
- Skip compliance and attack surface tasks for Image and IaC providers
- Add tests for scan_per_image and IMAGE scan path
Cloudflare bot management on Docker Hub blocks the default
python-requests User-Agent from container IPs, returning HTTP 500.
Add a Prowler/1.0 User-Agent header to all registry requests and
include truncated response body in 5xx retry logs for diagnostics.
- Add server error retry with exponential backoff in _request_with_retry
- Include truncated response body in Docker Hub login errors
- Add debug logging for login attempts
Add early return in _resolve_basic_credentials when password is None
to prevent TypeError on base64.b64decode. Move DockerHubAdapter import
from local scope to top-level in image_provider.py per PEP 8. Add
one-time 401 retry with token refresh in _authed_request to handle
per-repository-scoped bearer tokens on strict OCI registries.
Remove unused detect_registry_type() function and _ECR_PATTERN constant
from factory.py, along with their corresponding tests. Move requests
import behind TYPE_CHECKING guard in oci_adapter.py and
dockerhub_adapter.py since it is only used for type annotations.
- Fix shared dict mutation in ImageBaseException (thread-safety)
- Handle unexpected status codes in OCI adapter auth flow
- Force TLS verification for Docker Hub endpoints
- Add credential-safe __repr__ to RegistryAdapter
- Rename _next_page_url override to _next_tag_page_url in DockerHubAdapter
- Distinguish rate-limit from connection errors in retry logic
- Add type hints to all public adapter methods
- Remove unused imports in test files (flake8)
Update test patches from adapter-level to base-level module paths since
requests and time are now imported in base.py. Consolidate separate
requests.post/requests.get patches into requests.request since all HTTP
calls now go through _request_with_retry.
- Add test_registry_list_without_registry_fails: validates that
--registry-list without --registry returns an error
- Add test_registry_list_with_registry_passes: validates the happy path
- Add clarifying comment in factory.py about ECR using OCI adapter
- Use public /v2/repositories/{ns}/ endpoint when unauthenticated
- Fall back to namespace API when JWT is available for private repos
- Add test for unauthenticated public namespace listing
Add --registry-list flag that enumerates registry repositories and tags,
then prints a structured listing and exits without scanning. This helps
users discover available images before building --image-filter or
--tag-filter regexes.
Add pluggable registry adapter pattern for enumerating and scanning all
container images in a private registry. Supports:
- Generic OCI registries (Harbor, GitLab, JFrog) via /v2/_catalog
- Docker Hub via Hub REST API with namespace-based enumeration
- AWS ECR via standard OCI endpoints with ECR auth token
New CLI flags: --registry, --image-filter, --tag-filter, --max-images,
--registry-insecure
The pre-commit hook stash/restore cycle during the first merge caused
some auto-merged changes to be excluded from the merge commits. This
commit includes the remaining changes: error code renumbering (9000→11000
range), input validation, image config scanners, and docs branch updates.
- Add CLI argument for image config scanners (misconfig, secret)
- Add validation and ImageInvalidConfigScannerError exception
- Append --image-config-scanners to Trivy command when set
- Add tests for defaults, validation, and command construction
- Add IMAGE to Provider enum for runtime routing
- Validate image names against shell metacharacters and OCI format
- Enforce max line count and name length on image list files
- Add tests for name validation and file size limits
Trivy's remote source cannot authenticate against Docker Hub (and some
other registries) even after docker login. This adds a docker login +
docker pull flow before scanning so Trivy can access private images
from the local Docker daemon.
- Add _docker_login, _docker_pull, _docker_logout, cleanup methods
- Add _extract_registry to determine registry from image reference
- Wrap run() in try/finally to ensure cleanup on success or error
- Wire registry credentials from CLI args to ImageProvider
- Add ImageDockerLoginError and ImageDockerNotFoundError exceptions
Add a new Image provider that uses Trivy for container image vulnerability
and secret scanning, integrated into the Prowler CLI.
- ImageProvider class with Trivy integration for vuln/secret/misconfig scanning
- CLI support via `prowler image -I <image>` with severity filters, timeout,
ignore-unfixed, and image-list-file options
- CheckReportImage model for image-specific findings
- Custom exceptions (9000-9005) with clear remediation messages
- Error handling for Trivy failures (non-zero exit, binary not found)
- Batch processing of findings with progress bar
- test_connection() for registry accessibility checks
- Comprehensive test coverage
Andoni A.