Andoni A.
d9e451489d
fix(image): harden registry adapter layer
...
- Fix shared dict mutation in ImageBaseException (thread-safety)
- Handle unexpected status codes in OCI adapter auth flow
- Force TLS verification for Docker Hub endpoints
- Add credential-safe __repr__ to RegistryAdapter
- Rename _next_page_url override to _next_tag_page_url in DockerHubAdapter
- Distinguish rate-limit from connection errors in retry logic
- Add type hints to all public adapter methods
- Remove unused imports in test files (flake8)
2026-02-17 10:01:35 +01:00
Andoni A.
b00c76acf2
test(image): update mock patch targets after base class refactor
...
Update test patches from adapter-level to base-level module paths since
requests and time are now imported in base.py. Consolidate separate
requests.post/requests.get patches into requests.request since all HTTP
calls now go through _request_with_retry.
2026-02-17 09:41:57 +01:00
Andoni A.
46e55a3351
test(image): add --registry-list validation tests and factory comment
...
- Add test_registry_list_without_registry_fails: validates that
--registry-list without --registry returns an error
- Add test_registry_list_with_registry_passes: validates the happy path
- Add clarifying comment in factory.py about ECR using OCI adapter
2026-02-17 09:39:52 +01:00
Andoni A.
103f71c215
fix(image): use correct singular/plural in registry listing output
...
Handle "1 repository" vs "2 repositories" and "1 image" vs "2 images"
in _print_registry_listing output.
2026-02-17 09:39:29 +01:00
Andoni A.
310a32e391
refactor(image): deduplicate retry logic into registry adapter base class
...
- Move _request_with_retry, _next_page_url, _MAX_RETRIES, _BACKOFF_BASE
from OciRegistryAdapter and DockerHubAdapter into RegistryAdapter base
- Add context_label parameter to _request_with_retry for contextual
error/warning messages (defaults to self.registry_url)
- Route _hub_login and _get_registry_token through retry logic
- Change 404 exception in _check_hub_response from ImageRegistryAuthError
to ImageRegistryCatalogError (missing namespace is not an auth failure)
- Remove redundant time, requests imports from leaf adapters
2026-02-17 09:39:15 +01:00
Andoni Alonso
402b33516b
Merge branch 'master' into feat/PROWLER-939-stage-2-registry-auth
2026-02-17 09:17:03 +01:00
Andoni A.
5e2ed6a37c
docs(image): remove redundant version badges from subsections
...
All features ship in 5.19.0 with the provider; subsection badges are
unnecessary since the top-level Prowler CLI badge already covers it.
2026-02-17 09:10:06 +01:00
Andoni A.
8ef231faae
docs(image): update docs and changelog for public Docker Hub support
...
- Add note about public namespace scanning without credentials to docs
- Update changelog entry to mention public Docker Hub support
2026-02-17 09:06:38 +01:00
Andoni A.
304fa25f25
feat(image): support public Docker Hub registry scan without credentials
...
- Use public /v2/repositories/{ns}/ endpoint when unauthenticated
- Fall back to namespace API when JWT is available for private repos
- Add test for unauthenticated public namespace listing
2026-02-17 08:43:01 +01:00
Andoni A.
ffeaeb760e
docs(image): document registry scan mode and --registry-list flag
...
Add Registry Scan Mode section covering --registry, --image-filter,
--tag-filter, --max-images, --registry-insecure, and the new
--registry-list flag for image discovery.
2026-02-17 08:02:41 +01:00
Andoni A.
876702fd22
feat(image): add --registry-list flag for image discovery
...
Add --registry-list flag that enumerates registry repositories and tags,
then prints a structured listing and exits without scanning. This helps
users discover available images before building --image-filter or
--tag-filter regexes.
2026-02-17 07:44:41 +01:00
Andoni A.
326def4a17
fix(image): handle Basic auth challenge and pre-encoded ECR credentials
...
- Detect Basic auth challenges (non-Bearer) in _ensure_auth()
- Decode base64-wrapped credentials from aws ecr get-authorization-token
- Add unit tests for credential resolution and Basic auth flow
2026-02-16 17:50:05 +01:00
Andoni A.
aa284b8b24
test(image): add comprehensive registry scan mode unit tests
...
69 tests covering:
- Factory auto-detection (OCI, Docker Hub, ECR URL patterns)
- OCI adapter (auth flows, pagination, retry, error handling)
- Docker Hub adapter (namespace extraction, Hub API, token exchange)
- Argument validation (registry flags, Docker Hub namespace)
- Provider integration (enumeration, filtering, max-images, dedup)
2026-02-16 15:42:02 +01:00
Andoni A.
ace36fe76e
feat(image): add registry scan mode with OCI, Docker Hub, and ECR support
...
Add pluggable registry adapter pattern for enumerating and scanning all
container images in a private registry. Supports:
- Generic OCI registries (Harbor, GitLab, JFrog) via /v2/_catalog
- Docker Hub via Hub REST API with namespace-based enumeration
- AWS ECR via standard OCI endpoints with ECR auth token
New CLI flags: --registry, --image-filter, --tag-filter, --max-images,
--registry-insecure
2026-02-16 15:35:55 +01:00
Prowler Bot and prowler-bot
df8a7220ff
feat(oraclecloud): Update commercial regions ( #10082 )
...
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com >
2026-02-16 14:23:28 +01:00
Daniel Barranquero
a106cdf4c9
fix: oci regions actions labels ( #10083 )
2026-02-16 14:23:17 +01:00
Daniel Barranquero
a86f0b95bc
fix(oci): update regions script to handle raw credentials ( #10081 )
2026-02-16 14:03:27 +01:00
Josema Camacho
bb34f6cc3d
refactor(api): remove graph_database and is_graph_database_deleted from AttackPathsScan ( #10077 )
2026-02-16 12:46:49 +01:00
Daniel Barranquero
be516f1dfc
feat(openstack): Add 7 New Compute Security Checks ( #9944 )
2026-02-16 11:46:48 +01:00
90e317d39f
fix(kms): detect public access for any KMS action, not just kms:* ( #10071 )
...
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com >
Co-authored-by: jfagoagas <16007882+jfagoagas@users.noreply.github.com >
Co-authored-by: Pepe Fagoaga <pepe@prowler.com >
2026-02-16 10:12:29 +01:00
Pedro Martín and Hugo Pereira Brito
21bdbacdfb
chore(readme): update and add skill ( #10067 )
...
Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com >
2026-02-16 09:31:21 +01:00
75ee07c6e1
chore(gcp): enhance metadata for logging service ( #9648 )
...
Co-authored-by: HugoPBrito <hugopbrit@gmail.com >
Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com >
2026-02-13 16:37:07 +01:00
ddc5d879e0
chore(gcp): enhance metadata for kms service ( #9647 )
...
Co-authored-by: HugoPBrito <hugopbrit@gmail.com >
Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com >
2026-02-13 16:32:26 +01:00
006c2dc754
chore(gcp): enhance metadata for iam service ( #9646 )
...
Co-authored-by: HugoPBrito <hugopbrit@gmail.com >
Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com >
2026-02-13 16:24:52 +01:00
Rubén De la Torre Vico and HugoPBrito
4981d3fc38
chore(gcp): enhance metadata for gke service ( #9645 )
...
Co-authored-by: HugoPBrito <hugopbrit@gmail.com >
2026-02-13 16:14:14 +01:00
cceaf1ea54
chore(gcp): enhance metadata for gcr service ( #9644 )
...
Co-authored-by: HugoPBrito <hugopbrit@gmail.com >
Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com >
2026-02-13 15:55:00 +01:00
Rubén De la Torre Vico and HugoPBrito
b436da27c8
chore(gcp): enhance metadata for dns service ( #9643 )
...
Co-authored-by: HugoPBrito <hugopbrit@gmail.com >
2026-02-13 15:47:30 +01:00
Rubén De la Torre Vico and HugoPBrito
82be83c668
chore(gcp): enhance metadata for dataproc service ( #9642 )
...
Co-authored-by: HugoPBrito <hugopbrit@gmail.com >
2026-02-13 14:57:33 +01:00
Andoni Alonso
4f18bfc33c
feat(iam): add ECS Exec privilege escalation detection (ECS-006) ( #10066 )
2026-02-13 14:45:33 +01:00
Rubén De la Torre Vico and HugoPBrito
941f9b7e0b
chore(gcp): enhance metadata for compute service ( #9641 )
...
Co-authored-by: HugoPBrito <hugopbrit@gmail.com >
2026-02-13 14:29:38 +01:00
9da0b0c0b1
feat(github): add organization domain verification check ( #10033 )
...
Co-authored-by: Kush321 <kushp2018@gmail.com >
Co-authored-by: Andoni A. <14891798+andoniaf@users.noreply.github.com >
2026-02-13 13:41:17 +01:00
Rubén De la Torre Vico and HugoPBrito
8c1da0732d
chore(gcp): enhance metadata for cloudsql service ( #9639 )
...
Co-authored-by: HugoPBrito <hugopbrit@gmail.com >
2026-02-13 13:35:34 +01:00
Andoni A.
3a2960fd09
Merge remote-tracking branch 'origin/master' into feat/PROWLER-939-stage-2-registry-auth
2026-02-13 13:31:17 +01:00
Josema Camacho
02b58d8a31
fix(api): mark attack paths scan as failed when celery task fails ( #10065 )
2026-02-13 13:20:38 +01:00
Rubén De la Torre Vico and HugoPBrito
3defbcd386
chore(gcp): enhance metadata for cloudstorage service ( #9640 )
...
Co-authored-by: HugoPBrito <hugopbrit@gmail.com >
2026-02-13 13:17:58 +01:00
Andoni A.
6b0a139361
Merge remote-tracking branch 'origin/master' into feat/PROWLER-939-stage-2-registry-auth
...
# Conflicts:
# prowler/CHANGELOG.md
# prowler/lib/check/models.py
# prowler/providers/common/provider.py
# prowler/providers/image/exceptions/exceptions.py
# prowler/providers/image/image_provider.py
# tests/providers/image/image_provider_test.py
2026-02-13 13:09:51 +01:00
Josema Camacho
ceb4691c36
build(deps): bump cryptography to 44.0.3 and py-ocsf-models to 0.8.1 ( #10059 )
2026-02-13 12:36:38 +01:00
Pepe Fagoaga
4be8831ee1
docs: add proxy/load balancer UI rebuild requirements ( #10064 )
2026-02-13 11:11:05 +01:00
Andoni Alonso
da23d62e6a
docs(image): add Image provider CLI documentation ( #9986 )
2026-02-13 11:00:03 +01:00
Andoni A.
429f807f8c
docs(image): document registry authentication methods
...
- Cover basic auth, token-based auth, and manual docker login
- Document auth method priority and automatic cleanup behavior
- Update troubleshooting section with environment variable references
2026-02-13 10:59:17 +01:00
Rubén De la Torre Vico and HugoPBrito
222db94a48
chore(gcp): enhance metadata for bigquery service ( #9638 )
...
Co-authored-by: HugoPBrito <hugopbrit@gmail.com >
2026-02-13 10:57:31 +01:00
Hugo Pereira Brito
c33565a127
fix(sdk): update openstacksdk to fix pip install on systems without C compiler ( #10055 )
2026-02-13 10:49:01 +01:00
Andoni A.
56535e5b24
fix(image): correct type annotation and remove dead exception handler
...
- Fix CheckReportImage metadata parameter type from dict to str
- Remove redundant re-raise of already-handled exceptions
2026-02-13 10:40:28 +01:00
Pedro Martín
961b247d36
feat(compliance): add csa ccm for the alibabacloud provider ( #10061 )
2026-02-13 10:36:29 +01:00
Rubén De la Torre Vico and HugoPBrito
6abd5186aa
chore(gcp): enhance metadata for apikeys service ( #9637 )
...
Co-authored-by: HugoPBrito <hugopbrit@gmail.com >
2026-02-13 10:35:05 +01:00
Andoni A.
4af9bc99bf
fix(image): use getattr for registry credentials to avoid AttributeError
...
- Use getattr with None defaults for registry auth arguments
- Credentials fall back to TRIVY_USERNAME/TRIVY_PASSWORD env vars in ImageProvider
2026-02-13 08:56:38 +01:00
Andoni A.
0589721505
fix(image): include missing merge changes from stage-1 and docs branches
...
The pre-commit hook stash/restore cycle during the first merge caused
some auto-merged changes to be excluded from the merge commits. This
commit includes the remaining changes: error code renumbering (9000→11000
range), input validation, image config scanners, and docs branch updates.
2026-02-12 22:38:11 +01:00
Pedro Martín
627088e214
feat(compliance): add csa ccm for the oraclecloud provider ( #10057 )
2026-02-12 18:06:51 +01:00
Josema Camacho
93ac38ca90
feat(attack-pahts--aws-queries): The rest of Path Finding paths queries ( #10008 )
2026-02-12 17:09:08 +01:00
Andoni Alonso
aa7490aab4
feat(image): add container image provider for CLI scanning ( #9984 )
2026-02-12 16:36:48 +01:00
Andoni A.