+4

deploy/upcloud/provision.go

··· 328 328 if appviewCreated || holdCreated { 329 329 rootDir := projectRoot() 330 330 331 331 + if err := runGenerate(rootDir); err != nil { 332 332 + return fmt.Errorf("go generate: %w", err) 333 333 + } 334 334 + 331 335 fmt.Println("\nBuilding locally (GOOS=linux GOARCH=amd64)...") 332 336 if appviewCreated { 333 337 outputPath := filepath.Join(rootDir, "bin", "atcr-appview")

+16

deploy/upcloud/update.go

··· 114 114 return fmt.Errorf("unknown target: %s (use: all, appview, hold)", target) 115 115 } 116 116 117 117 + // Run go generate before building 118 118 + if err := runGenerate(rootDir); err != nil { 119 119 + return fmt.Errorf("go generate: %w", err) 120 120 + } 121 121 + 117 122 // Build all binaries locally before touching servers 118 123 fmt.Println("Building locally (GOOS=linux GOARCH=amd64)...") 119 124 for _, name := range toUpdate { ··· 297 302 BasePath: naming.BasePath(), 298 303 ScannerSecret: state.ScannerSecret, 299 304 } 305 305 + } 306 306 + 307 307 + // runGenerate runs go generate ./... in the given directory using host OS/arch 308 308 + // (no cross-compilation env vars — generate tools must run on the build machine). 309 309 + func runGenerate(dir string) error { 310 310 + fmt.Println("Running go generate ./...") 311 311 + cmd := exec.Command("go", "generate", "./...") 312 312 + cmd.Dir = dir 313 313 + cmd.Stdout = os.Stdout 314 314 + cmd.Stderr = os.Stderr 315 315 + return cmd.Run() 300 316 } 301 317 302 318 // buildLocal compiles a Go binary locally with cross-compilation flags for linux/amd64.

+7 -6

pkg/appview/handlers/attestation_details.go

··· 119 119 loggedIn := false 120 120 if user := middleware.GetUser(r); user != nil && h.Refresher != nil { 121 121 loggedIn = true 122 122 - holdDID := atproto.ResolveHoldDIDFromURL(details[0].HoldEndpoint) 123 123 - if holdDID == "" { 124 124 - holdDID = details[0].HoldEndpoint // might already be a DID 122 122 + holdDID, resolveErr := atproto.ResolveHoldDID(ctx, details[0].HoldEndpoint) 123 123 + if resolveErr != nil { 124 124 + slog.Debug("Could not resolve hold DID for service token", "holdEndpoint", details[0].HoldEndpoint, "error", resolveErr) 125 125 + holdDID = details[0].HoldEndpoint // fallback: use as-is 125 126 } 126 127 if token, err := auth.GetOrFetchServiceToken(ctx, h.Refresher, user.DID, holdDID, user.PDSEndpoint); err == nil { 127 128 serviceToken = token ··· 267 268 if err != nil { 268 269 return nil, fmt.Errorf("could not resolve hold endpoint %s: %w", holdEndpoint, err) 269 270 } 270 270 - holdDID := atproto.ResolveHoldDIDFromURL(holdEndpoint) 271 271 - if holdDID == "" { 272 272 - return nil, fmt.Errorf("could not resolve hold DID from: %s", holdEndpoint) 271 271 + holdDID, err := atproto.ResolveHoldDID(ctx, holdEndpoint) 272 272 + if err != nil { 273 273 + return nil, fmt.Errorf("could not resolve hold DID from %s: %w", holdEndpoint, err) 273 274 } 274 275 275 276 // Step 1: Request presigned URL from hold

+30 -9

pkg/appview/handlers/scan_result.go

··· 46 46 return 47 47 } 48 48 49 49 - // Derive hold DID from endpoint URL 50 50 - holdDID := atproto.ResolveHoldDIDFromURL(holdEndpoint) 51 51 - if holdDID == "" { 49 49 + // Resolve hold identity: holdEndpoint may be a DID or URL 50 50 + holdDID, err := atproto.ResolveHoldDID(r.Context(), holdEndpoint) 51 51 + if err != nil { 52 52 + slog.Debug("Failed to resolve hold DID", "holdEndpoint", holdEndpoint, "error", err) 53 53 + h.renderBadge(w, vulnBadgeData{Error: true}) 54 54 + return 55 55 + } 56 56 + 57 57 + // Resolve to HTTP endpoint URL (handles DID, URL, or hostname) 58 58 + holdURL, err := atproto.ResolveHoldURL(r.Context(), holdEndpoint) 59 59 + if err != nil { 60 60 + slog.Debug("Failed to resolve hold URL", "holdEndpoint", holdEndpoint, "error", err) 52 61 h.renderBadge(w, vulnBadgeData{Error: true}) 53 62 return 54 63 } ··· 61 70 defer cancel() 62 71 63 72 scanURL := fmt.Sprintf("%s/xrpc/com.atproto.repo.getRecord?repo=%s&collection=%s&rkey=%s", 64 64 - holdEndpoint, 73 73 + holdURL, 65 74 url.QueryEscape(holdDID), 66 75 url.QueryEscape(atproto.ScanCollection), 67 76 url.QueryEscape(rkey), ··· 116 125 ScannedAt: scanRecord.ScannedAt, 117 126 Found: true, 118 127 Digest: digest, 119 119 - HoldEndpoint: holdEndpoint, 128 128 + HoldEndpoint: holdDID, 120 129 }) 121 130 } 122 131 ··· 175 184 ScannedAt: scanRecord.ScannedAt, 176 185 Found: true, 177 186 Digest: fullDigest, 178 178 - HoldEndpoint: holdEndpoint, 187 187 + HoldEndpoint: holdDID, 179 188 } 180 189 } 181 190 ··· 199 208 digests = digests[:50] 200 209 } 201 210 202 202 - holdDID := atproto.ResolveHoldDIDFromURL(holdEndpoint) 203 203 - if holdDID == "" { 211 211 + holdDID, err := atproto.ResolveHoldDID(r.Context(), holdEndpoint) 212 212 + if err != nil { 204 213 // Can't resolve hold — render empty OOB spans 214 214 + slog.Debug("Failed to resolve hold DID for batch scan", "holdEndpoint", holdEndpoint, "error", err) 215 215 + w.Header().Set("Content-Type", "text/html") 216 216 + for _, d := range digests { 217 217 + fmt.Fprintf(w, `<span id="scan-badge-%s" hx-swap-oob="outerHTML"></span>`, template.HTMLEscapeString(d)) 218 218 + } 219 219 + return 220 220 + } 221 221 + 222 222 + // Resolve to HTTP endpoint URL (handles DID, URL, or hostname) 223 223 + holdURL, err := atproto.ResolveHoldURL(r.Context(), holdEndpoint) 224 224 + if err != nil { 225 225 + slog.Debug("Failed to resolve hold URL for batch scan", "holdEndpoint", holdEndpoint, "error", err) 205 226 w.Header().Set("Content-Type", "text/html") 206 227 for _, d := range digests { 207 228 fmt.Fprintf(w, `<span id="scan-badge-%s" hx-swap-oob="outerHTML"></span>`, template.HTMLEscapeString(d)) ··· 229 250 ctx, cancel := context.WithTimeout(r.Context(), 3*time.Second) 230 251 defer cancel() 231 252 232 232 - results[idx].data = fetchScanRecord(ctx, holdEndpoint, holdDID, hex) 253 253 + results[idx].data = fetchScanRecord(ctx, holdURL, holdDID, hex) 233 254 }(i, hexDigest) 234 255 } 235 256 wg.Wait()

+34

pkg/appview/handlers/scan_result_test.go

··· 11 11 "atcr.io/pkg/appview/handlers" 12 12 ) 13 13 14 14 + // mockHoldDID is the DID returned by test hold servers for /.well-known/atproto-did 15 15 + const mockHoldDID = "did:web:hold.example.com" 16 16 + 17 17 + // handleMockDID serves /.well-known/atproto-did for test hold servers. 18 18 + // Returns true if the request was handled, false if it should be passed to the next handler. 19 19 + func handleMockDID(w http.ResponseWriter, r *http.Request) bool { 20 20 + if r.URL.Path == "/.well-known/atproto-did" { 21 21 + w.Write([]byte(mockHoldDID)) 22 22 + return true 23 23 + } 24 24 + return false 25 25 + } 26 26 + 14 27 // mockScanRecord returns a getRecord JSON envelope wrapping a scan record 15 28 func mockScanRecord(critical, high, medium, low, total int64) string { 16 29 record := map[string]any{ ··· 51 64 func TestScanResult_WithVulnerabilities(t *testing.T) { 52 65 // Mock hold that returns a scan record with vulnerabilities 53 66 hold := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 67 67 + if handleMockDID(w, r) { 68 68 + return 69 69 + } 54 70 w.Header().Set("Content-Type", "application/json") 55 71 w.Write([]byte(mockScanRecord(2, 5, 10, 3, 20))) 56 72 })) ··· 96 112 func TestScanResult_Clean(t *testing.T) { 97 113 // Mock hold that returns a scan record with zero vulnerabilities 98 114 hold := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 115 115 + if handleMockDID(w, r) { 116 116 + return 117 117 + } 99 118 w.Header().Set("Content-Type", "application/json") 100 119 w.Write([]byte(mockScanRecord(0, 0, 0, 0, 0))) 101 120 })) ··· 124 143 func TestScanResult_NotFound(t *testing.T) { 125 144 // Mock hold that returns 404 (no scan record — scanning disabled or not yet scanned) 126 145 hold := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 146 146 + if handleMockDID(w, r) { 147 147 + return 148 148 + } 127 149 http.Error(w, "record not found", http.StatusNotFound) 128 150 })) 129 151 defer hold.Close() ··· 145 167 func TestScanResult_HoldError(t *testing.T) { 146 168 // Mock hold that returns 500 147 169 hold := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 170 170 + if handleMockDID(w, r) { 171 171 + return 172 172 + } 148 173 http.Error(w, "internal error", http.StatusInternalServerError) 149 174 })) 150 175 defer hold.Close() ··· 226 251 func TestScanResult_OnlyCriticalShown(t *testing.T) { 227 252 // Only critical vulns, no high/medium/low 228 253 hold := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 254 254 + if handleMockDID(w, r) { 255 255 + return 256 256 + } 229 257 w.Header().Set("Content-Type", "application/json") 230 258 w.Write([]byte(mockScanRecord(3, 0, 0, 0, 3))) 231 259 })) ··· 272 300 func TestBatchScanResult_MultipleDigests(t *testing.T) { 273 301 // Mock hold that returns different results based on rkey 274 302 hold := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 303 303 + if handleMockDID(w, r) { 304 304 + return 305 305 + } 275 306 rkey := r.URL.Query().Get("rkey") 276 307 w.Header().Set("Content-Type", "application/json") 277 308 switch rkey { ··· 379 410 380 411 func TestBatchScanResult_SingleDigest(t *testing.T) { 381 412 hold := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 413 413 + if handleMockDID(w, r) { 414 414 + return 415 415 + } 382 416 w.Header().Set("Content-Type", "application/json") 383 417 w.Write([]byte(mockScanRecord(1, 0, 0, 0, 1))) 384 418 }))

+32 -19

pkg/appview/handlers/vuln_details.go

··· 21 21 } 22 22 23 23 // grypeReport is the minimal Grype JSON structure we need. 24 24 + // Grype v0.107+ uses PascalCase JSON keys. 24 25 type grypeReport struct { 25 26 Matches []grypeMatch `json:"matches"` 26 27 } 27 28 28 29 type grypeMatch struct { 29 29 - Vulnerability grypeVuln `json:"vulnerability"` 30 30 - Artifact grypeArtifact `json:"artifact"` 30 30 + Vulnerability grypeVuln `json:"Vulnerability"` 31 31 + Package grypePackage `json:"Package"` 31 32 } 32 33 33 34 type grypeVuln struct { 34 34 - ID string `json:"id"` 35 35 - Severity string `json:"severity"` 36 36 - Fix grypeFix `json:"fix"` 35 35 + ID string `json:"ID"` 36 36 + Metadata grypeMetadata `json:"Metadata"` 37 37 + Fix grypeFix `json:"Fix"` 38 38 + } 39 39 + 40 40 + type grypeMetadata struct { 41 41 + Severity string `json:"Severity"` 37 42 } 38 43 39 44 type grypeFix struct { 40 40 - Versions []string `json:"versions"` 41 41 - State string `json:"state"` 45 45 + Versions []string `json:"Versions"` 46 46 + State string `json:"State"` 42 47 } 43 48 44 44 - type grypeArtifact struct { 45 45 - Name string `json:"name"` 46 46 - Version string `json:"version"` 47 47 - Type string `json:"type"` 49 49 + type grypePackage struct { 50 50 + Name string `json:"Name"` 51 51 + Version string `json:"Version"` 52 52 + Type string `json:"Type"` 48 53 } 49 54 50 55 // vulnDetailsData is the template data for the vuln-details partial. ··· 92 97 return 93 98 } 94 99 95 95 - holdDID := atproto.ResolveHoldDIDFromURL(holdEndpoint) 96 96 - if holdDID == "" { 100 100 + holdDID, err := atproto.ResolveHoldDID(r.Context(), holdEndpoint) 101 101 + if err != nil { 102 102 + slog.Debug("Failed to resolve hold DID", "holdEndpoint", holdEndpoint, "error", err) 97 103 h.renderDetails(w, vulnDetailsData{Error: "Could not resolve hold identity"}) 104 104 + return 105 105 + } 106 106 + 107 107 + // Resolve to HTTP endpoint URL (handles DID, URL, or hostname) 108 108 + holdURL, err := atproto.ResolveHoldURL(r.Context(), holdEndpoint) 109 109 + if err != nil { 110 110 + h.renderDetails(w, vulnDetailsData{Error: "Could not resolve hold endpoint"}) 98 111 return 99 112 } 100 113 ··· 105 118 106 119 // Step 1: Fetch the scan record to get the VulnReportBlob CID 107 120 scanURL := fmt.Sprintf("%s/xrpc/com.atproto.repo.getRecord?repo=%s&collection=%s&rkey=%s", 108 108 - holdEndpoint, 121 121 + holdURL, 109 122 url.QueryEscape(holdDID), 110 123 url.QueryEscape(atproto.ScanCollection), 111 124 url.QueryEscape(rkey), ··· 163 176 164 177 blobCID := scanRecord.VulnReportBlob.Ref.String() 165 178 blobURL := fmt.Sprintf("%s/xrpc/com.atproto.sync.getBlob?did=%s&cid=%s", 166 166 - holdEndpoint, 179 179 + holdURL, 167 180 url.QueryEscape(holdDID), 168 181 url.QueryEscape(blobCID), 169 182 ) ··· 211 224 matches = append(matches, vulnMatch{ 212 225 CVEID: m.Vulnerability.ID, 213 226 CVEURL: cveURL, 214 214 - Severity: m.Vulnerability.Severity, 215 215 - Package: m.Artifact.Name, 216 216 - Version: m.Artifact.Version, 227 227 + Severity: m.Vulnerability.Metadata.Severity, 228 228 + Package: m.Package.Name, 229 229 + Version: m.Package.Version, 217 230 FixedIn: fixedIn, 218 218 - Type: m.Artifact.Type, 231 231 + Type: m.Package.Type, 219 232 }) 220 233 } 221 234

+15 -1

pkg/appview/handlers/vuln_details_test.go

··· 159 159 func TestVulnDetails_FullReport(t *testing.T) { 160 160 grypeJSON := mockGrypeReport() 161 161 162 162 - // Mock hold that serves both getRecord and getBlob 162 162 + // Mock hold that serves DID resolution, getRecord, and getBlob 163 163 hold := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 164 164 path := r.URL.Path 165 165 + if path == "/.well-known/atproto-did" { 166 166 + w.Write([]byte("did:web:hold.example.com")) 167 167 + return 168 168 + } 165 169 if strings.Contains(path, "getRecord") { 166 170 w.Header().Set("Content-Type", "application/json") 167 171 w.Write([]byte(mockScanRecordWithBlob(1, 1, 0, 1, 3))) ··· 231 235 func TestVulnDetails_NoVulnReportBlob(t *testing.T) { 232 236 // Mock hold returns scan record WITHOUT VulnReportBlob 233 237 hold := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 238 238 + if handleMockDID(w, r) { 239 239 + return 240 240 + } 234 241 w.Header().Set("Content-Type", "application/json") 235 242 w.Write([]byte(mockScanRecordWithoutBlob(2, 5, 10, 3, 20))) 236 243 })) ··· 263 270 func TestVulnDetails_NotFound(t *testing.T) { 264 271 // Mock hold returns 404 265 272 hold := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 273 273 + if handleMockDID(w, r) { 274 274 + return 275 275 + } 266 276 http.Error(w, "not found", http.StatusNotFound) 267 277 })) 268 278 defer hold.Close() ··· 286 296 287 297 hold := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 288 298 path := r.URL.Path 299 299 + if path == "/.well-known/atproto-did" { 300 300 + w.Write([]byte("did:web:hold.example.com")) 301 301 + return 302 302 + } 289 303 if strings.Contains(path, "getRecord") { 290 304 w.Header().Set("Content-Type", "application/json") 291 305 w.Write([]byte(mockScanRecordWithBlob(1, 1, 0, 1, 3)))

-54

pkg/appview/holdhealth/checker_test.go

··· 6 6 "net/http/httptest" 7 7 "testing" 8 8 "time" 9 9 - 10 10 - "atcr.io/pkg/atproto" 11 9 ) 12 10 13 11 func TestNewChecker(t *testing.T) { ··· 270 268 } 271 269 } 272 270 273 273 - func TestNormalizeHoldEndpoint(t *testing.T) { 274 274 - tests := []struct { 275 275 - name string 276 276 - input string 277 277 - expected string 278 278 - }{ 279 279 - { 280 280 - name: "HTTP URL", 281 281 - input: "http://hold01.atcr.io", 282 282 - expected: "did:web:hold01.atcr.io", 283 283 - }, 284 284 - { 285 285 - name: "HTTPS URL", 286 286 - input: "https://hold01.atcr.io", 287 287 - expected: "did:web:hold01.atcr.io", 288 288 - }, 289 289 - { 290 290 - name: "HTTP URL with port", 291 291 - input: "http://172.28.0.3:8080", 292 292 - expected: "did:web:172.28.0.3:8080", 293 293 - }, 294 294 - { 295 295 - name: "HTTP URL with trailing slash", 296 296 - input: "http://hold01.atcr.io/", 297 297 - expected: "did:web:hold01.atcr.io", 298 298 - }, 299 299 - { 300 300 - name: "HTTP URL with path", 301 301 - input: "http://hold01.atcr.io/some/path", 302 302 - expected: "did:web:hold01.atcr.io", 303 303 - }, 304 304 - { 305 305 - name: "Already a DID", 306 306 - input: "did:web:hold01.atcr.io", 307 307 - expected: "did:web:hold01.atcr.io", 308 308 - }, 309 309 - { 310 310 - name: "DID with port", 311 311 - input: "did:web:172.28.0.3:8080", 312 312 - expected: "did:web:172.28.0.3:8080", 313 313 - }, 314 314 - } 315 315 - 316 316 - for _, tt := range tests { 317 317 - t.Run(tt.name, func(t *testing.T) { 318 318 - result := atproto.ResolveHoldDIDFromURL(tt.input) 319 319 - if result != tt.expected { 320 320 - t.Errorf("normalizeHoldEndpoint(%q) = %q, want %q", tt.input, result, tt.expected) 321 321 - } 322 322 - }) 323 323 - } 324 324 - }

+5 -1

pkg/appview/holdhealth/worker.go

··· 127 127 128 128 for _, endpoint := range endpoints { 129 129 // Normalize to canonical DID format 130 130 - normalizedDID := atproto.ResolveHoldDIDFromURL(endpoint) 130 130 + normalizedDID, err := atproto.ResolveHoldDID(ctx, endpoint) 131 131 + if err != nil { 132 132 + slog.Debug("Failed to resolve hold DID during health check", "endpoint", endpoint, "error", err) 133 133 + continue 134 134 + } 131 135 132 136 // Skip if we've already seen this normalized DID 133 137 if seen[normalizedDID] {

+9 -5

pkg/appview/jetstream/processor.go

··· 252 252 // Old manifests use holdEndpoint field (URL format) - convert to DID 253 253 holdDID := manifestRecord.HoldDID 254 254 if holdDID == "" && manifestRecord.HoldEndpoint != "" { 255 255 - // Legacy manifest - convert URL to DID 256 256 - holdDID = atproto.ResolveHoldDIDFromURL(manifestRecord.HoldEndpoint) 255 255 + // Legacy manifest - resolve URL to DID via /.well-known/atproto-did 256 256 + if resolved, err := atproto.ResolveHoldDID(ctx, manifestRecord.HoldEndpoint); err != nil { 257 257 + slog.Warn("Failed to resolve hold DID from legacy manifest endpoint", "holdEndpoint", manifestRecord.HoldEndpoint, "error", err) 258 258 + } else { 259 259 + holdDID = resolved 260 260 + } 257 261 } 258 262 259 263 // Detect artifact type from config media type ··· 445 449 } 446 450 447 451 // Convert hold URL/DID to canonical DID 448 448 - holdDID := atproto.ResolveHoldDIDFromURL(profileRecord.DefaultHold) 449 449 - if holdDID == "" { 450 450 - slog.Warn("Invalid hold reference in profile", "component", "processor", "did", did, "default_hold", profileRecord.DefaultHold) 452 452 + holdDID, err := atproto.ResolveHoldDID(ctx, profileRecord.DefaultHold) 453 453 + if err != nil { 454 454 + slog.Warn("Invalid hold reference in profile", "component", "processor", "did", did, "default_hold", profileRecord.DefaultHold, "error", err) 451 455 return nil 452 456 } 453 457

+9 -6

pkg/appview/server.go

··· 352 352 if strings.HasPrefix(profile.DefaultHold, "http://") || strings.HasPrefix(profile.DefaultHold, "https://") { 353 353 slog.Debug("Migrating hold URL to DID", "component", "appview/callback", "did", did, "hold_url", profile.DefaultHold) 354 354 355 355 - holdDID := atproto.ResolveHoldDIDFromURL(profile.DefaultHold) 356 356 - 357 357 - profile.DefaultHold = holdDID 358 358 - if err := storage.UpdateProfile(ctx, client, profile); err != nil { 359 359 - slog.Warn("Failed to update profile with hold DID", "component", "appview/callback", "did", did, "error", err) 355 355 + if resolvedDID, resolveErr := atproto.ResolveHoldDID(ctx, profile.DefaultHold); resolveErr != nil { 356 356 + slog.Warn("Failed to resolve hold DID from URL", "component", "appview/callback", "did", did, "hold_url", profile.DefaultHold, "error", resolveErr) 360 357 } else { 361 361 - slog.Debug("Updated profile with hold DID", "component", "appview/callback", "hold_did", holdDID) 358 358 + holdDID = resolvedDID 359 359 + profile.DefaultHold = holdDID 360 360 + if err := storage.UpdateProfile(ctx, client, profile); err != nil { 361 361 + slog.Warn("Failed to update profile with hold DID", "component", "appview/callback", "did", did, "error", err) 362 362 + } else { 363 363 + slog.Debug("Updated profile with hold DID", "component", "appview/callback", "hold_did", holdDID) 364 364 + } 362 365 } 363 366 } else { 364 367 holdDID = profile.DefaultHold

+30

pkg/appview/src/css/main.css

··· 368 368 .menu li > form > label { 369 369 @apply block w-full; 370 370 } 371 371 + 372 372 + /* ---------------------------------------- 373 373 + OFFLINE MANIFEST FILTERING 374 374 + Hide offline manifests by default; 375 375 + show when "Show offline images" is checked 376 376 + ---------------------------------------- */ 377 377 + .manifests-list > [data-reachable="false"] { 378 378 + display: none; 379 379 + } 380 380 + 381 381 + .manifests-list.show-offline > [data-reachable="false"] { 382 382 + display: block; 383 383 + } 384 384 + 385 385 + /* ---------------------------------------- 386 386 + VULNERABILITY SEVERITY BOX STRIP 387 387 + Docker Hub-style connected severity boxes 388 388 + ---------------------------------------- */ 389 389 + .vuln-strip { 390 390 + @apply inline-flex items-stretch text-xs font-semibold leading-none; 391 391 + } 392 392 + .vuln-strip > span { 393 393 + @apply px-2 py-1 min-w-[1.75rem] text-center cursor-pointer; 394 394 + } 395 395 + .vuln-strip > span:first-child { @apply rounded-l; } 396 396 + .vuln-strip > span:last-child { @apply rounded-r; } 397 397 + .vuln-box-critical { background-color: oklch(45% 0.16 20); color: oklch(97% 0.01 20); } 398 398 + .vuln-box-high { background-color: oklch(58% 0.18 35); color: oklch(97% 0.01 35); } 399 399 + .vuln-box-medium { background-color: oklch(72% 0.15 70); color: oklch(25% 0.05 70); } 400 400 + .vuln-box-low { background-color: oklch(80% 0.1 85); color: oklch(25% 0.05 85); } 371 401 }

+3 -3

pkg/appview/storage/crew.go

··· 23 23 } 24 24 25 25 // Normalize URL to DID if needed 26 26 - holdDID := atproto.ResolveHoldDIDFromURL(defaultHoldDID) 27 27 - if holdDID == "" { 28 28 - slog.Warn("failed to resolve hold DID", "defaultHold", defaultHoldDID) 26 26 + holdDID, err := atproto.ResolveHoldDID(ctx, defaultHoldDID) 27 27 + if err != nil { 28 28 + slog.Warn("failed to resolve hold DID", "defaultHold", defaultHoldDID, "error", err) 29 29 return 30 30 } 31 31

+4 -2

pkg/appview/storage/drain.go

··· 92 92 needsRewrite := false 93 93 if manifest.HoldDID == oldHold { 94 94 needsRewrite = true 95 95 - } else if manifest.HoldEndpoint != "" && atproto.ResolveHoldDIDFromURL(manifest.HoldEndpoint) == oldHold { 96 96 - needsRewrite = true 95 95 + } else if manifest.HoldEndpoint != "" { 96 96 + if resolvedDID, resolveErr := atproto.ResolveHoldDID(ctx, manifest.HoldEndpoint); resolveErr == nil && resolvedDID == oldHold { 97 97 + needsRewrite = true 98 98 + } 97 99 } 98 100 99 101 if !needsRewrite {

+41 -28

pkg/appview/storage/profile.go

··· 36 36 // This ensures we store DIDs consistently in new profiles 37 37 normalizedDID := "" 38 38 if defaultHoldDID != "" { 39 39 - normalizedDID = atproto.ResolveHoldDIDFromURL(defaultHoldDID) 39 39 + resolved, err := atproto.ResolveHoldDID(ctx, defaultHoldDID) 40 40 + if err != nil { 41 41 + slog.Warn("Failed to resolve hold DID for new profile", "component", "profile", "defaultHold", defaultHoldDID, "error", err) 42 42 + } else { 43 43 + normalizedDID = resolved 44 44 + } 40 45 } 41 46 42 47 // Profile doesn't exist - create it ··· 73 78 // Migrate old URL-based defaultHold to DID format 74 79 // This ensures backward compatibility with profiles created before DID migration 75 80 if profile.DefaultHold != "" && !atproto.IsDID(profile.DefaultHold) { 76 76 - // Convert URL to DID transparently 77 77 - migratedDID := atproto.ResolveHoldDIDFromURL(profile.DefaultHold) 78 78 - profile.DefaultHold = migratedDID 81 81 + // Convert URL to DID by querying /.well-known/atproto-did 82 82 + migratedDID, resolveErr := atproto.ResolveHoldDID(ctx, profile.DefaultHold) 83 83 + if resolveErr != nil { 84 84 + slog.Warn("Failed to resolve hold DID during profile migration", "component", "profile", "defaultHold", profile.DefaultHold, "error", resolveErr) 85 85 + } else { 86 86 + profile.DefaultHold = migratedDID 79 87 80 80 - // Persist the migration to PDS in a background goroutine 81 81 - // Use a lock to ensure only one goroutine migrates this DID 82 82 - did := client.DID() 83 83 - if _, loaded := migrationLocks.LoadOrStore(did, true); !loaded { 84 84 - // We got the lock - launch goroutine to persist the migration 85 85 - go func() { 86 86 - // Clean up lock when done (after a short delay to batch requests) 87 87 - defer func() { 88 88 - time.Sleep(1 * time.Second) 89 89 - migrationLocks.Delete(did) 90 90 - }() 88 88 + // Persist the migration to PDS in a background goroutine 89 89 + // Use a lock to ensure only one goroutine migrates this DID 90 90 + did := client.DID() 91 91 + if _, loaded := migrationLocks.LoadOrStore(did, true); !loaded { 92 92 + // We got the lock - launch goroutine to persist the migration 93 93 + go func() { 94 94 + // Clean up lock when done (after a short delay to batch requests) 95 95 + defer func() { 96 96 + time.Sleep(1 * time.Second) 97 97 + migrationLocks.Delete(did) 98 98 + }() 91 99 92 92 - // Create a new context with timeout for the background operation 93 93 - ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second) 94 94 - defer cancel() 100 100 + // Create a new context with timeout for the background operation 101 101 + bgCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second) 102 102 + defer cancel() 95 103 96 96 - // Update the profile on the PDS 97 97 - profile.UpdatedAt = time.Now() 98 98 - if err := UpdateProfile(ctx, client, &profile); err != nil { 99 99 - slog.Warn("Failed to persist URL-to-DID migration", "component", "profile", "did", did, "error", err) 100 100 - } else { 101 101 - slog.Debug("Persisted defaultHold migration to DID", "component", "profile", "migrated_did", migratedDID, "did", did) 102 102 - } 103 103 - }() 104 104 + // Update the profile on the PDS 105 105 + profile.UpdatedAt = time.Now() 106 106 + if err := UpdateProfile(bgCtx, client, &profile); err != nil { 107 107 + slog.Warn("Failed to persist URL-to-DID migration", "component", "profile", "did", did, "error", err) 108 108 + } else { 109 109 + slog.Debug("Persisted defaultHold migration to DID", "component", "profile", "migrated_did", migratedDID, "did", did) 110 110 + } 111 111 + }() 112 112 + } 104 113 } 105 114 } 106 115 ··· 113 122 // Normalize defaultHold to DID if it's a URL 114 123 // This ensures we always store DIDs, even if user provides a URL 115 124 if profile.DefaultHold != "" && !atproto.IsDID(profile.DefaultHold) { 116 116 - profile.DefaultHold = atproto.ResolveHoldDIDFromURL(profile.DefaultHold) 117 117 - slog.Debug("Normalized defaultHold to DID", "component", "profile", "default_hold", profile.DefaultHold) 125 125 + if resolved, err := atproto.ResolveHoldDID(ctx, profile.DefaultHold); err != nil { 126 126 + slog.Warn("Failed to resolve hold DID during profile update", "component", "profile", "defaultHold", profile.DefaultHold, "error", err) 127 127 + } else { 128 128 + profile.DefaultHold = resolved 129 129 + slog.Debug("Normalized defaultHold to DID", "component", "profile", "default_hold", profile.DefaultHold) 130 130 + } 118 131 } 119 132 120 133 _, err := client.PutRecord(ctx, atproto.SailorProfileCollection, ProfileRKey, profile)

+206 -39

pkg/appview/storage/profile_test.go

··· 3 3 import ( 4 4 "context" 5 5 "encoding/json" 6 6 + "fmt" 6 7 "net/http" 7 8 "net/http/httptest" 8 9 "strings" ··· 23 24 { 24 25 name: "with DID", 25 26 defaultHoldDID: "did:web:hold01.atcr.io", 26 26 - wantNormalized: "did:web:hold01.atcr.io", 27 27 - }, 28 28 - { 29 29 - name: "with URL - should normalize to DID", 30 30 - defaultHoldDID: "https://hold01.atcr.io", 31 27 wantNormalized: "did:web:hold01.atcr.io", 32 28 }, 33 29 { ··· 104 100 } 105 101 }) 106 102 } 103 103 + 104 104 + // URL normalization test uses a local test server for /.well-known/atproto-did 105 105 + t.Run("with URL - should normalize to DID", func(t *testing.T) { 106 106 + var createdProfile *atproto.SailorProfileRecord 107 107 + 108 108 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 109 109 + // Handle hold DID resolution 110 110 + if r.URL.Path == "/.well-known/atproto-did" { 111 111 + w.Write([]byte("did:web:hold01.atcr.io")) 112 112 + return 113 113 + } 114 114 + 115 115 + // GetRecord: profile doesn't exist 116 116 + if r.Method == "GET" { 117 117 + w.WriteHeader(http.StatusNotFound) 118 118 + return 119 119 + } 120 120 + 121 121 + // PutRecord: create profile 122 122 + if r.Method == "POST" && strings.Contains(r.URL.Path, "putRecord") { 123 123 + var body map[string]any 124 124 + json.NewDecoder(r.Body).Decode(&body) 125 125 + 126 126 + recordData := body["record"].(map[string]any) 127 127 + defaultHold := recordData["defaultHold"] 128 128 + defaultHoldStr := "" 129 129 + if defaultHold != nil { 130 130 + defaultHoldStr = defaultHold.(string) 131 131 + } 132 132 + if defaultHoldStr != "did:web:hold01.atcr.io" { 133 133 + t.Errorf("defaultHold = %v, want did:web:hold01.atcr.io", defaultHoldStr) 134 134 + } 135 135 + 136 136 + profileBytes, _ := json.Marshal(recordData) 137 137 + json.Unmarshal(profileBytes, &createdProfile) 138 138 + 139 139 + w.WriteHeader(http.StatusOK) 140 140 + w.Write([]byte(`{"uri":"at://did:plc:test123/io.atcr.sailor.profile/self","cid":"bafytest"}`)) 141 141 + return 142 142 + } 143 143 + 144 144 + w.WriteHeader(http.StatusBadRequest) 145 145 + })) 146 146 + defer server.Close() 147 147 + 148 148 + client := atproto.NewClient(server.URL, "did:plc:test123", "test-token") 149 149 + err := EnsureProfile(context.Background(), client, server.URL) 150 150 + if err != nil { 151 151 + t.Fatalf("EnsureProfile() error = %v", err) 152 152 + } 153 153 + 154 154 + if createdProfile == nil { 155 155 + t.Fatal("Profile was not created") 156 156 + } 157 157 + 158 158 + if createdProfile.DefaultHold != "did:web:hold01.atcr.io" { 159 159 + t.Errorf("DefaultHold = %v, want did:web:hold01.atcr.io", createdProfile.DefaultHold) 160 160 + } 161 161 + }) 107 162 } 108 163 109 164 // TestEnsureProfile_Exists tests that EnsureProfile doesn't recreate existing profiles ··· 176 231 wantNil: false, 177 232 wantErr: false, 178 233 expectMigration: false, 179 179 - expectedHoldDID: "did:web:hold01.atcr.io", 180 180 - }, 181 181 - { 182 182 - name: "profile with URL (migration needed)", 183 183 - serverResponse: `{ 184 184 - "uri": "at://did:plc:test123/io.atcr.sailor.profile/self", 185 185 - "value": { 186 186 - "$type": "io.atcr.sailor.profile", 187 187 - "defaultHold": "https://hold01.atcr.io", 188 188 - "createdAt": "2025-01-01T00:00:00Z", 189 189 - "updatedAt": "2025-01-01T00:00:00Z" 190 190 - } 191 191 - }`, 192 192 - serverStatus: http.StatusOK, 193 193 - wantNil: false, 194 194 - wantErr: false, 195 195 - expectMigration: true, 196 196 - originalHoldURL: "https://hold01.atcr.io", 197 234 expectedHoldDID: "did:web:hold01.atcr.io", 198 235 }, 199 236 { ··· 293 330 } 294 331 }) 295 332 } 333 333 + 334 334 + // URL migration test uses a local test server for /.well-known/atproto-did 335 335 + t.Run("profile with URL (migration needed)", func(t *testing.T) { 336 336 + migrationLocks = sync.Map{} 337 337 + 338 338 + var mu sync.Mutex 339 339 + putRecordCalled := false 340 340 + var migrationRequest map[string]any 341 341 + 342 342 + var server *httptest.Server 343 343 + server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 344 344 + // Handle hold DID resolution 345 345 + if r.URL.Path == "/.well-known/atproto-did" { 346 346 + w.Write([]byte("did:web:hold01.atcr.io")) 347 347 + return 348 348 + } 349 349 + 350 350 + // GetRecord - return profile with URL pointing to this server 351 351 + if r.Method == "GET" { 352 352 + response := fmt.Sprintf(`{ 353 353 + "uri": "at://did:plc:test123/io.atcr.sailor.profile/self", 354 354 + "value": { 355 355 + "$type": "io.atcr.sailor.profile", 356 356 + "defaultHold": %q, 357 357 + "createdAt": "2025-01-01T00:00:00Z", 358 358 + "updatedAt": "2025-01-01T00:00:00Z" 359 359 + } 360 360 + }`, server.URL) 361 361 + w.WriteHeader(http.StatusOK) 362 362 + w.Write([]byte(response)) 363 363 + return 364 364 + } 365 365 + 366 366 + // PutRecord (migration) 367 367 + if r.Method == "POST" && strings.Contains(r.URL.Path, "putRecord") { 368 368 + mu.Lock() 369 369 + putRecordCalled = true 370 370 + json.NewDecoder(r.Body).Decode(&migrationRequest) 371 371 + mu.Unlock() 372 372 + w.WriteHeader(http.StatusOK) 373 373 + w.Write([]byte(`{"uri":"at://did:plc:test123/io.atcr.sailor.profile/self","cid":"bafytest"}`)) 374 374 + return 375 375 + } 376 376 + })) 377 377 + defer server.Close() 378 378 + 379 379 + client := atproto.NewClient(server.URL, "did:plc:test123", "test-token") 380 380 + profile, err := GetProfile(context.Background(), client) 381 381 + 382 382 + if err != nil { 383 383 + t.Fatalf("GetProfile() error = %v", err) 384 384 + } 385 385 + 386 386 + if profile == nil { 387 387 + t.Fatal("GetProfile() returned nil, want profile") 388 388 + } 389 389 + 390 390 + if profile.DefaultHold != "did:web:hold01.atcr.io" { 391 391 + t.Errorf("DefaultHold = %v, want did:web:hold01.atcr.io", profile.DefaultHold) 392 392 + } 393 393 + 394 394 + // Give migration goroutine time to execute 395 395 + time.Sleep(50 * time.Millisecond) 396 396 + 397 397 + mu.Lock() 398 398 + called := putRecordCalled 399 399 + request := migrationRequest 400 400 + mu.Unlock() 401 401 + 402 402 + if !called { 403 403 + t.Error("Expected migration PutRecord to be called") 404 404 + } 405 405 + 406 406 + if request != nil { 407 407 + recordData := request["record"].(map[string]any) 408 408 + migratedHold := recordData["defaultHold"] 409 409 + if migratedHold != "did:web:hold01.atcr.io" { 410 410 + t.Errorf("Migrated defaultHold = %v, want did:web:hold01.atcr.io", migratedHold) 411 411 + } 412 412 + } 413 413 + }) 296 414 } 297 415 298 416 // TestGetProfile_MigrationLocking tests that concurrent migrations don't happen ··· 303 421 putRecordCount := 0 304 422 var mu sync.Mutex 305 423 306 306 - server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 307 307 - // GetRecord - return profile with URL 424 424 + var server *httptest.Server 425 425 + server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 426 426 + // Handle hold DID resolution 427 427 + if r.URL.Path == "/.well-known/atproto-did" { 428 428 + w.Write([]byte("did:web:hold01.atcr.io")) 429 429 + return 430 430 + } 431 431 + 432 432 + // GetRecord - return profile with URL pointing to this server 308 433 if r.Method == "GET" { 309 309 - response := `{ 434 434 + response := fmt.Sprintf(`{ 310 435 "uri": "at://did:plc:test123/io.atcr.sailor.profile/self", 311 436 "value": { 312 437 "$type": "io.atcr.sailor.profile", 313 313 - "defaultHold": "https://hold01.atcr.io", 438 438 + "defaultHold": %q, 314 439 "createdAt": "2025-01-01T00:00:00Z", 315 440 "updatedAt": "2025-01-01T00:00:00Z" 316 441 } 317 317 - }` 442 442 + }`, server.URL) 318 443 w.WriteHeader(http.StatusOK) 319 444 w.Write([]byte(response)) 320 445 return ··· 384 509 wantErr: false, 385 510 }, 386 511 { 387 387 - name: "update with URL - should normalize", 388 388 - profile: &atproto.SailorProfileRecord{ 389 389 - Type: atproto.SailorProfileCollection, 390 390 - DefaultHold: "https://hold02.atcr.io", 391 391 - CreatedAt: time.Now(), 392 392 - UpdatedAt: time.Now(), 393 393 - }, 394 394 - wantNormalized: "did:web:hold02.atcr.io", 395 395 - wantErr: false, 396 396 - }, 397 397 - { 398 512 name: "clear default hold", 399 513 profile: &atproto.SailorProfileRecord{ 400 514 Type: atproto.SailorProfileCollection, ··· 458 572 } 459 573 }) 460 574 } 575 575 + 576 576 + // URL normalization test uses a local test server for /.well-known/atproto-did 577 577 + t.Run("update with URL - should normalize", func(t *testing.T) { 578 578 + var sentProfile map[string]any 579 579 + 580 580 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 581 581 + // Handle hold DID resolution 582 582 + if r.URL.Path == "/.well-known/atproto-did" { 583 583 + w.Write([]byte("did:web:hold02.atcr.io")) 584 584 + return 585 585 + } 586 586 + 587 587 + if r.Method == "POST" && strings.Contains(r.URL.Path, "putRecord") { 588 588 + var body map[string]any 589 589 + json.NewDecoder(r.Body).Decode(&body) 590 590 + sentProfile = body 591 591 + 592 592 + if body["rkey"] != ProfileRKey { 593 593 + t.Errorf("rkey = %v, want %v", body["rkey"], ProfileRKey) 594 594 + } 595 595 + 596 596 + w.WriteHeader(http.StatusOK) 597 597 + w.Write([]byte(`{"uri":"at://did:plc:test123/io.atcr.sailor.profile/self","cid":"bafytest"}`)) 598 598 + return 599 599 + } 600 600 + w.WriteHeader(http.StatusBadRequest) 601 601 + })) 602 602 + defer server.Close() 603 603 + 604 604 + profile := &atproto.SailorProfileRecord{ 605 605 + Type: atproto.SailorProfileCollection, 606 606 + DefaultHold: server.URL, // URL pointing to test server with /.well-known/atproto-did 607 607 + CreatedAt: time.Now(), 608 608 + UpdatedAt: time.Now(), 609 609 + } 610 610 + 611 611 + client := atproto.NewClient(server.URL, "did:plc:test123", "test-token") 612 612 + err := UpdateProfile(context.Background(), client, profile) 613 613 + if err != nil { 614 614 + t.Errorf("UpdateProfile() error = %v", err) 615 615 + return 616 616 + } 617 617 + 618 618 + recordData := sentProfile["record"].(map[string]any) 619 619 + defaultHold := recordData["defaultHold"].(string) 620 620 + if defaultHold != "did:web:hold02.atcr.io" { 621 621 + t.Errorf("defaultHold = %v, want did:web:hold02.atcr.io", defaultHold) 622 622 + } 623 623 + 624 624 + if profile.DefaultHold != "did:web:hold02.atcr.io" { 625 625 + t.Errorf("profile.DefaultHold = %v, want did:web:hold02.atcr.io (should be updated in-place)", profile.DefaultHold) 626 626 + } 627 627 + }) 461 628 } 462 629 463 630 // TestProfileRKey tests that profile record key is always "self"

+6 -6

pkg/appview/templates/pages/repository.html

··· 188 188 </label> 189 189 </div> 190 190 {{ if .Manifests }} 191 191 - <div class="space-y-4"> 191 191 + <div class="space-y-4 manifests-list"> 192 192 {{ range .Manifests }} 193 193 <div class="bg-base-200 rounded-lg p-4 space-y-3" id="manifest-{{ sanitizeID .Manifest.Digest }}" data-reachable="{{ .Reachable }}"> 194 194 <div class="flex flex-wrap items-start justify-between gap-2"> ··· 220 220 {{ else if not .Reachable }} 221 221 <span class="badge badge-sm badge-warning">{{ icon "alert-triangle" "size-3" }} Offline</span> 222 222 {{ end }} 223 223 - {{/* Vulnerability scan badge placeholder (batch-loaded via OOB swap) */}} 224 224 - {{ if and (not .IsManifestList) .Manifest.HoldEndpoint }} 225 225 - <span id="scan-badge-{{ trimPrefix "sha256:" .Manifest.Digest }}"></span> 226 226 - {{ end }} 227 223 </div> 228 224 <div class="flex items-center gap-2"> 229 225 <code class="font-mono text-xs text-base-content/60 truncate max-w-40" title="{{ .Manifest.Digest }}">{{ .Manifest.Digest }}</code> 230 226 <button class="btn btn-ghost btn-xs" onclick="copyToClipboard('{{ .Manifest.Digest }}')" aria-label="Copy manifest digest to clipboard">{{ icon "copy" "size-3" }}</button> 231 227 </div> 228 228 + {{/* Vulnerability scan badge — own row below digest */}} 229 229 + {{ if and (not .IsManifestList) .Manifest.HoldEndpoint }} 230 230 + <div><span id="scan-badge-{{ trimPrefix "sha256:" .Manifest.Digest }}"></span></div> 231 231 + {{ end }} 232 232 </div> 233 233 <div class="flex items-center gap-2"> 234 234 <time class="text-sm text-base-content/60" datetime="{{ .Manifest.CreatedAt.Format "2006-01-02T15:04:05Z07:00" }}"> ··· 307 307 308 308 <!-- Vulnerability Details Modal --> 309 309 <dialog id="vuln-detail-modal" class="modal"> 310 310 - <div class="modal-box max-w-4xl"> 310 310 + <div class="modal-box max-w-6xl"> 311 311 <h3 class="text-lg font-bold">Vulnerability Scan Results</h3> 312 312 <div id="vuln-modal-body" class="py-4"> 313 313 <span class="loading loading-spinner loading-md"></span>

+5 -13

pkg/appview/templates/partials/vuln-badge.html

··· 4 4 {{ else if eq .Total 0 }} 5 5 <span class="badge badge-sm badge-success" title="No vulnerabilities found (scanned {{ .ScannedAt }})">{{ icon "shield-check" "size-3" }} Clean</span> 6 6 {{ else }} 7 7 - <button class="flex items-center gap-1 cursor-pointer hover:opacity-80 transition-opacity" 7 7 + <button class="vuln-strip cursor-pointer hover:opacity-80 transition-opacity" 8 8 onclick="openVulnDetails('{{ .Digest }}', '{{ .HoldEndpoint }}')" 9 9 title="Click for vulnerability details (scanned {{ .ScannedAt }})"> 10 10 - {{ if gt .Critical 0 }} 11 11 - <span class="badge badge-sm badge-error">C:{{ .Critical }}</span> 12 12 - {{ end }} 13 13 - {{ if gt .High 0 }} 14 14 - <span class="badge badge-sm badge-warning">H:{{ .High }}</span> 15 15 - {{ end }} 16 16 - {{ if gt .Medium 0 }} 17 17 - <span class="badge badge-sm badge-soft badge-warning">M:{{ .Medium }}</span> 18 18 - {{ end }} 19 19 - {{ if gt .Low 0 }} 20 20 - <span class="badge badge-sm badge-info">L:{{ .Low }}</span> 21 21 - {{ end }} 10 10 + <span class="tooltip vuln-box-critical" data-tip="Critical">{{ .Critical }}</span> 11 11 + <span class="tooltip vuln-box-high" data-tip="High">{{ .High }}</span> 12 12 + <span class="tooltip vuln-box-medium" data-tip="Medium">{{ .Medium }}</span> 13 13 + <span class="tooltip vuln-box-low" data-tip="Low">{{ .Low }}</span> 22 14 </button> 23 15 {{ end }} 24 16 {{ end }}

+15 -13

pkg/appview/templates/partials/vuln-details.html

··· 3 3 {{ if .Summary.Total }} 4 4 <!-- Summary available but no detailed report --> 5 5 <div class="space-y-4"> 6 6 - <div class="flex flex-wrap gap-2"> 7 7 - {{ if gt .Summary.Critical 0 }}<span class="badge badge-error">{{ .Summary.Critical }} Critical</span>{{ end }} 8 8 - {{ if gt .Summary.High 0 }}<span class="badge badge-warning">{{ .Summary.High }} High</span>{{ end }} 9 9 - {{ if gt .Summary.Medium 0 }}<span class="badge badge-soft badge-warning">{{ .Summary.Medium }} Medium</span>{{ end }} 10 10 - {{ if gt .Summary.Low 0 }}<span class="badge badge-info">{{ .Summary.Low }} Low</span>{{ end }} 11 11 - </div> 6 6 + <span class="vuln-strip"> 7 7 + <span class="tooltip vuln-box-critical" data-tip="Critical">{{ .Summary.Critical }}</span> 8 8 + <span class="tooltip vuln-box-high" data-tip="High">{{ .Summary.High }}</span> 9 9 + <span class="tooltip vuln-box-medium" data-tip="Medium">{{ .Summary.Medium }}</span> 10 10 + <span class="tooltip vuln-box-low" data-tip="Low">{{ .Summary.Low }}</span> 11 11 + </span> 12 12 <p class="text-base-content/60 text-sm">{{ .Error }}</p> 13 13 {{ if .ScannedAt }}<p class="text-base-content/40 text-xs">Scanned: {{ .ScannedAt }}</p>{{ end }} 14 14 </div> ··· 18 18 {{ else }} 19 19 <div class="space-y-4"> 20 20 <!-- Summary badges --> 21 21 - <div class="flex flex-wrap items-center gap-2"> 21 21 + <div class="flex flex-wrap items-center gap-3"> 22 22 <span class="font-semibold text-sm">{{ .Summary.Total }} vulnerabilities found</span> 23 23 - {{ if gt .Summary.Critical 0 }}<span class="badge badge-error">{{ .Summary.Critical }} Critical</span>{{ end }} 24 24 - {{ if gt .Summary.High 0 }}<span class="badge badge-warning">{{ .Summary.High }} High</span>{{ end }} 25 25 - {{ if gt .Summary.Medium 0 }}<span class="badge badge-soft badge-warning">{{ .Summary.Medium }} Medium</span>{{ end }} 26 26 - {{ if gt .Summary.Low 0 }}<span class="badge badge-info">{{ .Summary.Low }} Low</span>{{ end }} 23 23 + <span class="vuln-strip"> 24 24 + <span class="tooltip vuln-box-critical" data-tip="Critical">{{ .Summary.Critical }}</span> 25 25 + <span class="tooltip vuln-box-high" data-tip="High">{{ .Summary.High }}</span> 26 26 + <span class="tooltip vuln-box-medium" data-tip="Medium">{{ .Summary.Medium }}</span> 27 27 + <span class="tooltip vuln-box-low" data-tip="Low">{{ .Summary.Low }}</span> 28 28 + </span> 27 29 </div> 28 30 29 31 {{ if .ScannedAt }}<p class="text-base-content/40 text-xs">Scanned: {{ .ScannedAt }}</p>{{ end }} ··· 68 70 <span class="font-mono text-xs">{{ .Package }}</span> 69 71 {{ if .Type }}<span class="text-base-content/40 text-xs">({{ .Type }})</span>{{ end }} 70 72 </td> 71 71 - <td class="font-mono text-xs">{{ .Version }}</td> 72 72 - <td class="font-mono text-xs"> 73 73 + <td class="font-mono text-xs break-all">{{ .Version }}</td> 74 74 + <td class="font-mono text-xs break-all"> 73 75 {{ if .FixedIn }} 74 76 <span class="text-success">{{ .FixedIn }}</span> 75 77 {{ else }}

-31

pkg/atproto/lexicon.go

··· 558 558 return migrated, nil 559 559 } 560 560 561 561 - // ResolveHoldDIDFromURL converts a hold endpoint URL to a did:web DID 562 562 - // This ensures that different representations of the same hold are deduplicated: 563 563 - // - http://172.28.0.3:8080 → did:web:172.28.0.3:8080 564 564 - // - http://hold01.atcr.io → did:web:hold01.atcr.io 565 565 - // - https://hold01.atcr.io → did:web:hold01.atcr.io 566 566 - // - did:web:hold01.atcr.io → did:web:hold01.atcr.io (passthrough) 567 567 - func ResolveHoldDIDFromURL(holdURL string) string { 568 568 - // Handle empty URLs 569 569 - if holdURL == "" { 570 570 - return "" 571 571 - } 572 572 - 573 573 - // If already a DID, return as-is 574 574 - if IsDID(holdURL) { 575 575 - return holdURL 576 576 - } 577 577 - 578 578 - // Parse URL to get hostname 579 579 - holdURL = strings.TrimPrefix(holdURL, "http://") 580 580 - holdURL = strings.TrimPrefix(holdURL, "https://") 581 581 - holdURL = strings.TrimSuffix(holdURL, "/") 582 582 - 583 583 - // Extract hostname (remove path if present) 584 584 - parts := strings.Split(holdURL, "/") 585 585 - hostname := parts[0] 586 586 - 587 587 - // Convert to did:web 588 588 - // did:web uses hostname directly (port included if non-standard) 589 589 - return "did:web:" + hostname 590 590 - } 591 591 - 592 561 // IsDID checks if a string is a DID (starts with "did:") 593 562 func IsDID(s string) bool { 594 563 return len(s) > 4 && s[:4] == "did:"

-67

pkg/atproto/lexicon_test.go

··· 653 653 } 654 654 } 655 655 656 656 - func TestResolveHoldDIDFromURL(t *testing.T) { 657 657 - tests := []struct { 658 658 - name string 659 659 - holdURL string 660 660 - want string 661 661 - }{ 662 662 - { 663 663 - name: "https URL", 664 664 - holdURL: "https://hold01.atcr.io", 665 665 - want: "did:web:hold01.atcr.io", 666 666 - }, 667 667 - { 668 668 - name: "http URL", 669 669 - holdURL: "http://hold01.atcr.io", 670 670 - want: "did:web:hold01.atcr.io", 671 671 - }, 672 672 - { 673 673 - name: "URL with trailing slash", 674 674 - holdURL: "https://hold01.atcr.io/", 675 675 - want: "did:web:hold01.atcr.io", 676 676 - }, 677 677 - { 678 678 - name: "URL with path", 679 679 - holdURL: "https://hold01.atcr.io/some/path", 680 680 - want: "did:web:hold01.atcr.io", 681 681 - }, 682 682 - { 683 683 - name: "URL with port", 684 684 - holdURL: "https://hold01.atcr.io:8080", 685 685 - want: "did:web:hold01.atcr.io:8080", 686 686 - }, 687 687 - { 688 688 - name: "already a did:web", 689 689 - holdURL: "did:web:hold01.atcr.io", 690 690 - want: "did:web:hold01.atcr.io", 691 691 - }, 692 692 - { 693 693 - name: "already a did:plc", 694 694 - holdURL: "did:plc:abc123", 695 695 - want: "did:plc:abc123", 696 696 - }, 697 697 - { 698 698 - name: "empty string", 699 699 - holdURL: "", 700 700 - want: "", 701 701 - }, 702 702 - { 703 703 - name: "localhost", 704 704 - holdURL: "http://localhost:8080", 705 705 - want: "did:web:localhost:8080", 706 706 - }, 707 707 - { 708 708 - name: "IP address", 709 709 - holdURL: "http://192.168.1.1:8080", 710 710 - want: "did:web:192.168.1.1:8080", 711 711 - }, 712 712 - } 713 713 - 714 714 - for _, tt := range tests { 715 715 - t.Run(tt.name, func(t *testing.T) { 716 716 - got := ResolveHoldDIDFromURL(tt.holdURL) 717 717 - if got != tt.want { 718 718 - t.Errorf("ResolveHoldDIDFromURL() = %v, want %v", got, tt.want) 719 719 - } 720 720 - }) 721 721 - } 722 722 - } 723 656 724 657 func TestIsDID(t *testing.T) { 725 658 tests := []struct {

+52

pkg/atproto/resolver.go

··· 3 3 import ( 4 4 "context" 5 5 "fmt" 6 6 + "io" 7 7 + "net/http" 6 8 "strings" 7 9 8 10 "github.com/bluesky-social/indigo/atproto/syntax" ··· 30 32 31 33 // Fallback: assume it's a hostname and use HTTPS 32 34 return "https://" + holdIdentifier, nil 35 35 + } 36 36 + 37 37 + // ResolveHoldDID resolves a hold identifier (DID, URL, or hostname) to its actual DID. 38 38 + // If the input is already a DID, it is returned as-is. 39 39 + // If the input is a URL or hostname, the hold's /.well-known/atproto-did endpoint is 40 40 + // fetched to discover the real DID (which may be did:web or did:plc). 41 41 + func ResolveHoldDID(ctx context.Context, holdIdentifier string) (string, error) { 42 42 + if holdIdentifier == "" { 43 43 + return "", fmt.Errorf("empty hold identifier") 44 44 + } 45 45 + 46 46 + // If already a DID, return as-is 47 47 + if IsDID(holdIdentifier) { 48 48 + return holdIdentifier, nil 49 49 + } 50 50 + 51 51 + // Normalize to a full URL 52 52 + holdURL := holdIdentifier 53 53 + if !strings.HasPrefix(holdURL, "http://") && !strings.HasPrefix(holdURL, "https://") { 54 54 + holdURL = "https://" + holdURL 55 55 + } 56 56 + holdURL = strings.TrimSuffix(holdURL, "/") 57 57 + 58 58 + // Fetch /.well-known/atproto-did to discover the hold's actual DID 59 59 + req, err := http.NewRequestWithContext(ctx, "GET", holdURL+"/.well-known/atproto-did", nil) 60 60 + if err != nil { 61 61 + return "", fmt.Errorf("failed to create request for hold DID resolution: %w", err) 62 62 + } 63 63 + 64 64 + resp, err := http.DefaultClient.Do(req) 65 65 + if err != nil { 66 66 + return "", fmt.Errorf("failed to fetch hold DID from %s: %w", holdURL, err) 67 67 + } 68 68 + defer resp.Body.Close() 69 69 + 70 70 + if resp.StatusCode != http.StatusOK { 71 71 + return "", fmt.Errorf("hold at %s returned status %d for DID resolution", holdURL, resp.StatusCode) 72 72 + } 73 73 + 74 74 + body, err := io.ReadAll(io.LimitReader(resp.Body, 256)) 75 75 + if err != nil { 76 76 + return "", fmt.Errorf("failed to read hold DID response: %w", err) 77 77 + } 78 78 + 79 79 + did := strings.TrimSpace(string(body)) 80 80 + if !IsDID(did) { 81 81 + return "", fmt.Errorf("hold at %s returned invalid DID: %q", holdURL, did) 82 82 + } 83 83 + 84 84 + return did, nil 33 85 } 34 86 35 87 // ResolveHoldDIDToURL resolves a hold DID to its HTTP service endpoint.

+7 -3

pkg/hold/gc/gc.go

··· 621 621 continue 622 622 } 623 623 624 624 - if gc.manifestBelongsToHold(&manifest, holdDID) { 624 624 + if gc.manifestBelongsToHold(ctx, &manifest, holdDID) { 625 625 manifests = append(manifests, &manifestInfo{ 626 626 URI: rec.URI, 627 627 UserDID: userDID, ··· 640 640 } 641 641 642 642 // manifestBelongsToHold checks if a manifest references this hold via HoldDID or legacy HoldEndpoint. 643 643 - func (gc *GarbageCollector) manifestBelongsToHold(manifest *atproto.ManifestRecord, holdDID string) bool { 643 643 + func (gc *GarbageCollector) manifestBelongsToHold(ctx context.Context, manifest *atproto.ManifestRecord, holdDID string) bool { 644 644 if manifest.HoldDID == holdDID { 645 645 return true 646 646 } 647 647 // Legacy: check holdEndpoint converted to DID 648 648 if manifest.HoldEndpoint != "" { 649 649 - resolved := atproto.ResolveHoldDIDFromURL(manifest.HoldEndpoint) 649 649 + resolved, err := atproto.ResolveHoldDID(ctx, manifest.HoldEndpoint) 650 650 + if err != nil { 651 651 + gc.logger.Debug("Failed to resolve hold DID from legacy endpoint", "holdEndpoint", manifest.HoldEndpoint, "error", err) 652 652 + return false 653 653 + } 650 654 return resolved == holdDID 651 655 } 652 656 return false

+3 -2

pkg/hold/gc/gc_test.go

··· 1 1 package gc 2 2 3 3 import ( 4 4 + "context" 4 5 "encoding/json" 5 6 "fmt" 6 7 "log/slog" ··· 200 201 } 201 202 202 203 func TestManifestBelongsToHold(t *testing.T) { 203 203 - gc := &GarbageCollector{} 204 204 + gc := &GarbageCollector{logger: newTestLogger()} 204 205 holdDID := "did:web:hold01.atcr.io" 205 206 206 207 tests := []struct { ··· 253 254 254 255 for _, tt := range tests { 255 256 t.Run(tt.name, func(t *testing.T) { 256 256 - got := gc.manifestBelongsToHold(tt.manifest, holdDID) 257 257 + got := gc.manifestBelongsToHold(context.Background(), tt.manifest, holdDID) 257 258 if got != tt.want { 258 259 t.Errorf("manifestBelongsToHold() = %v, want %v", got, tt.want) 259 260 }

+3 -5

pkg/hold/pds/xrpc.go

··· 1493 1493 "operation", operation, 1494 1494 "digest", digest) 1495 1495 slog.Debug("Using XRPC proxy fallback") 1496 1496 - proxyURL := getProxyURL(h.pds.PublicURL, digest, did, operation) 1496 1496 + proxyURL := getProxyURL(h.pds.PublicURL, digest, h.pds.DID(), operation) 1497 1497 if proxyURL == "" { 1498 1498 return "", fmt.Errorf("presign failed and XRPC proxy not supported for PUT operations") 1499 1499 } ··· 1504 1504 } 1505 1505 1506 1506 // Fallback: return XRPC endpoint through this service 1507 1507 - proxyURL := getProxyURL(h.pds.PublicURL, digest, did, operation) 1507 1507 + proxyURL := getProxyURL(h.pds.PublicURL, digest, h.pds.DID(), operation) 1508 1508 if proxyURL == "" { 1509 1509 return "", fmt.Errorf("S3 client not available and XRPC proxy not supported for PUT operations") 1510 1510 } ··· 1523 1523 // getProxyURL returns XRPC endpoint for blob operations (fallback when presigned URLs unavailable) 1524 1524 // For GET/HEAD operations, returns the XRPC getBlob endpoint 1525 1525 // For PUT operations, this fallback is no longer supported - use multipart upload instead 1526 1526 - func getProxyURL(publicURL string, digest, did string, operation string) string { 1526 1526 + func getProxyURL(publicURL string, digest, holdDID string, operation string) string { 1527 1527 // For read operations, use XRPC getBlob endpoint 1528 1528 if operation == http.MethodGet || operation == http.MethodHead { 1529 1529 - // Generate hold DID from public URL using shared function 1530 1530 - holdDID := atproto.ResolveHoldDIDFromURL(publicURL) 1531 1529 return fmt.Sprintf("%s%s?did=%s&cid=%s", 1532 1530 publicURL, atproto.SyncGetBlob, holdDID, digest) 1533 1531 }

+1 -1

pkg/hold/server.go

··· 192 192 193 193 // Initialize scan broadcaster if scanner secret is configured 194 194 if cfg.Scanner.Secret != "" { 195 195 - holdDID := pds.GenerateDIDFromURL(cfg.Server.PublicURL) 195 195 + holdDID := s.PDS.DID() 196 196 var sb *pds.ScanBroadcaster 197 197 if s.holdDB != nil { 198 198 sb, err = pds.NewScanBroadcasterWithDB(holdDID, cfg.Server.PublicURL, cfg.Scanner.Secret, s.holdDB.DB, s3Service, s.PDS)

+3 -1

scanner/internal/scan/extractor.go

··· 142 142 143 143 switch header.Typeflag { 144 144 case tar.TypeDir: 145 145 - if err := os.MkdirAll(target, os.FileMode(header.Mode)); err != nil { 145 145 + // Always set owner write bit so we can create files inside (e.g. Go module 146 146 + // cache dirs are 0555 in images, which would block subsequent writes) 147 147 + if err := os.MkdirAll(target, os.FileMode(header.Mode)|0200); err != nil { 146 148 return fmt.Errorf("failed to create directory %s: %w", target, err) 147 149 } 148 150