fix(scanner): handle digest-only MainAssetName without panic (supersedes #42)

go.mod

@@ -4,7 +4,6 @@ go 1.25.0
 
 require (
 	github.com/golang/mock v1.6.0
-	github.com/gorilla/handlers v1.5.2
 	github.com/gorilla/mux v1.8.1
 	github.com/onsi/ginkgo/v2 v2.28.1
 	github.com/onsi/gomega v1.39.1
@@ -19,7 +18,6 @@ require (
 	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
-	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
@@ -55,15 +53,15 @@ require (
 	github.com/x448/float16 v0.8.4 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/mod v0.33.0 // indirect
-	golang.org/x/net v0.51.0 // indirect
+	golang.org/x/mod v0.37.0 // indirect
+	golang.org/x/net v0.57.0 // indirect
 	golang.org/x/oauth2 v0.35.0 // indirect
-	golang.org/x/sync v0.19.0 // indirect
-	golang.org/x/sys v0.41.0 // indirect
-	golang.org/x/term v0.40.0 // indirect
-	golang.org/x/text v0.34.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/term v0.45.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
-	golang.org/x/tools v0.42.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect

go.sum

@@ -6,8 +6,6 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=
 github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
-github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
-github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
@@ -73,8 +71,6 @@ github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc h1:VBbFa1lDYWEeV5FZKU
 github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gorilla/handlers v1.5.2 h1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=
-github.com/gorilla/handlers v1.5.2/go.mod h1:dX+xVpaxdSw+q0Qek8SSsl3dfMk3jNddUkMzo0GtH0w=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
 github.com/joshdk/go-junit v1.0.0 h1:S86cUKIdwBHWwA6xCmFlf3RTLfVXYQfvanM5Uh+K6GE=
@@ -143,40 +139,40 @@ go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
-golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
-golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
-golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
 golang.org/x/oauth2 v0.35.0 h1:Mv2mzuHuZuY2+bkyWXIHMfhNdJAdwW3FuWeCPYN5GVQ=
 golang.org/x/oauth2 v0.35.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
-golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
-golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
-golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
-golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

package.nix

@@ -2,7 +2,7 @@
 buildGoModule {
   pname = "harbor-scanner-sysdig-secure";
   version = "0.8.4";
-  vendorHash = "sha256-zTLTbNYohQkYpvO8BDnFXczlcWABCvhwk/dRFmZuUqk=";
+  vendorHash = "sha256-hFRo/V7Hz5pcUYwDHDWdoXOPO41sW6ndJkzftrvHzYo=";
   src = ./.;
   subPackages = [
     "cmd/harbor-scanner-sysdig-secure"

pkg/scanner/backend_adapter_test.go

@@ -111,7 +111,12 @@ func vulnerabilityReport() harbor.VulnerabilityReport {
 			Vendor:  "Sysdig",
 			Version: secure.BackendVersion,
 		},
-		Artifact: nil,
+		Artifact: &harbor.Artifact{
+			Repository: "sysdig/agent",
+			Digest:     imageDigest,
+			Tag:        "9.7",
+			MimeType:   harbor.DockerDistributionManifestMimeType,
+		},
 		Vulnerabilities: []harbor.VulnerabilityItem{
 			{
 				ID:          "CVE-2019-9948",

pkg/scanner/base_adapter.go

@@ -95,18 +95,16 @@ func (b *BaseAdapter) ToHarborVulnerabilityReport(repository string, shaDigest s
 	scanResponse, _ := b.secureClient.GetImage(shaDigest)
 
 	for _, imageDetail := range scanResponse.Data {
-		parts := strings.Split(imageDetail.MainAssetName, "@")
-		repoWithTag := parts[0]
-		hash := parts[1]
-		firstSlash := strings.Index(repoWithTag, "/")
-		lastColon := strings.LastIndex(repoWithTag, ":")
-		repo := repoWithTag[firstSlash+1 : lastColon]
-		tag := repoWithTag[lastColon+1:]
+		repo, tag, digest, ok := parseMainAssetName(imageDetail.MainAssetName)
+		if !ok {
+			slog.Warn("invalid main asset name format", "main_asset_name", imageDetail.MainAssetName)
+			continue
+		}
 		if repo == repository {
 			result.GeneratedAt = imageDetail.CreatedAt
 			result.Artifact = &harbor.Artifact{
 				Repository: repo,
-				Digest:     hash,
+				Digest:     digest,
 				Tag:        tag,
 				MimeType:   harbor.DockerDistributionManifestMimeType,
 			}
@@ -117,6 +115,56 @@ func (b *BaseAdapter) ToHarborVulnerabilityReport(repository string, shaDigest s
 	return result, nil
 }
 
+// parseMainAssetName splits a Sysdig MainAssetName into its repository, tag and
+// digest components. It accepts the reference forms produced by Sysdig Secure:
+//
+//	repo@sha256:...                        (digest-only, no tag)
+//	repo:tag@sha256:...                    (tagged)
+//	registry/repo[:tag]@sha256:...         (registry-prefixed)
+//	registry:port/repo[:tag]@sha256:...    (registry with port)
+//
+// The leading path segment is treated as a registry host and stripped only when
+// it looks like one (contains "." or ":", or equals "localhost"), following the
+// canonical Docker reference convention. Malformed values (missing digest,
+// missing name, or an empty tag such as "repo:@sha256:...") return ok=false so
+// the caller can log and skip them instead of panicking.
+func parseMainAssetName(mainAssetName string) (repo string, tag string, digest string, ok bool) {
+	parts := strings.SplitN(mainAssetName, "@", 2)
+	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
+		return "", "", "", false
+	}
+
+	namePart := parts[0]
+	digest = parts[1]
+
+	lastSlash := strings.LastIndex(namePart, "/")
+	lastColon := strings.LastIndex(namePart, ":")
+	if lastColon > lastSlash {
+		tag = namePart[lastColon+1:]
+		namePart = namePart[:lastColon]
+		// A tag separator with an empty tag (e.g. "repo:@sha256:...") is not a
+		// valid reference; treat it as malformed so the caller logs and skips it.
+		if tag == "" {
+			return "", "", "", false
+		}
+	}
+
+	repo = namePart
+	firstSlash := strings.Index(namePart, "/")
+	if firstSlash != -1 {
+		firstPart := namePart[:firstSlash]
+		if strings.Contains(firstPart, ".") || strings.Contains(firstPart, ":") || firstPart == "localhost" {
+			repo = namePart[firstSlash+1:]
+		}
+	}
+
+	if repo == "" {
+		return "", "", "", false
+	}
+
+	return repo, tag, digest, true
+}
+
 func (b *BaseAdapter) getVulnerabilitiesDescriptionFrom(vulnerabilities []*secure.Vulnerability) (map[string]string, error) {
 	result := make(map[string]string)
 

pkg/scanner/base_adapter_test.go

@@ -0,0 +1,108 @@
+package scanner
+
+import (
+	"fmt"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+)
+
+var _ = Describe("parseMainAssetName", func() {
+	It("parses tagged repository without registry", func() {
+		repo, tag, hash, ok := parseMainAssetName("sysdig/agent:9.7.0@sha256:abc")
+
+		Expect(ok).To(BeTrue())
+		Expect(repo).To(Equal("sysdig/agent"))
+		Expect(tag).To(Equal("9.7.0"))
+		Expect(hash).To(Equal("sha256:abc"))
+	})
+
+	It("parses digest-only repository without registry", func() {
+		repo, tag, hash, ok := parseMainAssetName("sysdig/agent@sha256:abc")
+
+		Expect(ok).To(BeTrue())
+		Expect(repo).To(Equal("sysdig/agent"))
+		Expect(tag).To(BeEmpty())
+		Expect(hash).To(Equal("sha256:abc"))
+	})
+
+	It("parses tagged repository with registry and strips registry host", func() {
+		repo, tag, hash, ok := parseMainAssetName("registry.example.com/sysdig/agent:latest@sha256:abc")
+
+		Expect(ok).To(BeTrue())
+		Expect(repo).To(Equal("sysdig/agent"))
+		Expect(tag).To(Equal("latest"))
+		Expect(hash).To(Equal("sha256:abc"))
+	})
+
+	It("parses digest-only repository with registry and strips registry host", func() {
+		repo, tag, hash, ok := parseMainAssetName("registry.example.com/sysdig/agent@sha256:abc")
+
+		Expect(ok).To(BeTrue())
+		Expect(repo).To(Equal("sysdig/agent"))
+		Expect(tag).To(BeEmpty())
+		Expect(hash).To(Equal("sha256:abc"))
+	})
+
+	It("keeps repository untouched when first path segment is not a registry host", func() {
+		repo, tag, hash, ok := parseMainAssetName("library/debian@sha256:abc")
+
+		Expect(ok).To(BeTrue())
+		Expect(repo).To(Equal("library/debian"))
+		Expect(tag).To(BeEmpty())
+		Expect(hash).To(Equal("sha256:abc"))
+	})
+
+	It("strips registry host with port and does not mistake the port for a tag", func() {
+		repo, tag, hash, ok := parseMainAssetName("localhost:5000/sysdig/agent@sha256:abc")
+
+		Expect(ok).To(BeTrue())
+		Expect(repo).To(Equal("sysdig/agent"))
+		Expect(tag).To(BeEmpty())
+		Expect(hash).To(Equal("sha256:abc"))
+	})
+
+	It("strips registry host with port while keeping the tag", func() {
+		repo, tag, hash, ok := parseMainAssetName("localhost:5000/sysdig/agent:9.7@sha256:abc")
+
+		Expect(ok).To(BeTrue())
+		Expect(repo).To(Equal("sysdig/agent"))
+		Expect(tag).To(Equal("9.7"))
+		Expect(hash).To(Equal("sha256:abc"))
+	})
+
+	It("parses a single-name official image without tag", func() {
+		repo, tag, hash, ok := parseMainAssetName("nginx@sha256:abc")
+
+		Expect(ok).To(BeTrue())
+		Expect(repo).To(Equal("nginx"))
+		Expect(tag).To(BeEmpty())
+		Expect(hash).To(Equal("sha256:abc"))
+	})
+
+	It("parses a single-name official image with tag", func() {
+		repo, tag, hash, ok := parseMainAssetName("nginx:latest@sha256:abc")
+
+		Expect(ok).To(BeTrue())
+		Expect(repo).To(Equal("nginx"))
+		Expect(tag).To(Equal("latest"))
+		Expect(hash).To(Equal("sha256:abc"))
+	})
+
+	It("returns not ok for malformed values", func() {
+		for _, tc := range []string{
+			"",
+			"@sha256:abc",
+			"sysdig/agent@",
+			"sysdig/agent",
+			"sysdig/agent:1.0",
+			"sysdig/agent:@sha256:abc",
+		} {
+			repo, tag, hash, ok := parseMainAssetName(tc)
+			Expect(ok).To(BeFalse(), fmt.Sprintf("mainAssetName=%q", tc))
+			Expect(repo).To(BeEmpty())
+			Expect(tag).To(BeEmpty())
+			Expect(hash).To(BeEmpty())
+		}
+	})
+})