Version
sbi version: main @ d9404ec
Go: 1.26.5
What happened?
RegistryScanner.GetTags performs a single GET /v2/{repo}/tags/list and decodes one JSON body. The Docker Registry HTTP API paginates via the Link response header (rel=next). Repositories with many tags can silently return only the first page, under-reporting tags before FilterTags / LimitTags.
Expected: Follow Link: <url>; rel=next until exhausted (with a sane page size), concatenating all tags.
Steps to reproduce
- Inspect
GetTags in pkg/infrastructure/scanner/registry.go — no Link handling.
- Against a registry that paginates tags, compare the full tag list vs SBI output.
Version
sbi version: main @ d9404ec
Go: 1.26.5
What happened?
RegistryScanner.GetTagsperforms a singleGET /v2/{repo}/tags/listand decodes one JSON body. The Docker Registry HTTP API paginates via theLinkresponse header (rel=next). Repositories with many tags can silently return only the first page, under-reporting tags beforeFilterTags/LimitTags.Expected: Follow
Link: <url>; rel=nextuntil exhausted (with a sane page size), concatenating all tags.Steps to reproduce
GetTagsinpkg/infrastructure/scanner/registry.go— noLinkhandling.