Pub/q1 dev

[priti-parate]

Issues Resolved by this Pull Request

Please be sure to associate your pull request with one or more open issues. Use the word Fixes as well as a hashtag (#) prior to the issue number in order to automatically resolve associated issues (e.g., Fixes #100).

Fixes #

Description of the Solution

Please describe the solution provided and how it resolves the associated issues.

Suggested Reviewers

If you wish to suggest specific reviewers for this solution, please include them in this section. Be sure to include the @ before the GitHub username.

In general, the correct way to distinguish Docker Hub images (or any particular registry) is to parse the image reference to separate the registry host from the rest of the path, and then compare the host (or a normalized form of it) to the expected value(s). Relying on raw string prefix checks on the entire image string is fragile and is what CodeQL is warning about.

The best fix here, without changing existing functionality, is:

1. Reuse get_repo_url_and_content(package) to derive a normalized base URL for the registry associated with package['package'].
2. From that base URL, extract the hostname using urllib.parse.urlparse.
3. Decide whether to use Docker Hub auth by comparing that hostname to the known Docker Hub host (registry-1.docker.io is what get_repo_url_and_content already maps docker.io to).
4. Keep the existing behavior: only if the registry is Docker Hub and docker_username/docker_password are provided do we call create_container_remote_with_auth; otherwise we call create_container_remote.

Concretely:

• Add an import for urlparse from urllib.parse at the top of common/library/module_utils/local_repo/download_image.py.
• In the elif "tag" in package: block, replace the condition if package['package'].startswith('docker.io/') and docker_username and docker_password: with logic that:
  • Calls get_repo_url_and_content(package['package']) to retrieve base_url.
  • Uses urlparse(base_url).hostname to get the registry host.
  • Checks if registry_host in ("docker.io", "registry-1.docker.io") and docker_username and docker_password: (or simply == "registry-1.docker.io" given the current mapping) before choosing the auth path.

We must be careful not to change other variables such as base_url and package_content that are already computed earlier in the function; the new logic should use package['package'] solely to determine the registry host for the auth decision and leave the rest of the flow unchanged.

---

In general, the fix is to configure the SSLContext so that TLS versions below 1.2 are disabled, regardless of environment defaults. In modern Python (3.7+), the preferred approach is to set context.minimum_version = ssl.TLSVersion.TLSv1_2. For older Python versions where minimum_version or TLSVersion may not exist, the conventional approach is to set context.options flags OP_NO_TLSv1 and OP_NO_TLSv1_1 (and, if relevant, also disable SSLv2/v3 if not already disabled by create_default_context).

The single best fix here, without altering existing functionality, is:

• Keep using ssl.create_default_context() as before.
• Immediately after creating the context, explicitly restrict protocol versions:
  • Prefer context.minimum_version = ssl.TLSVersion.TLSv1_2 when available.
  • Fall back to OR‑ing ssl.OP_NO_TLSv1 and ssl.OP_NO_TLSv1_1 into context.options if the newer API isn’t available.
• Keep the existing check_hostname = False and verify_mode = CERT_NONE lines intact, since they are part of this “probe” function’s current behavior.

This change is local to is_https in common/library/module_utils/local_repo/registry_utils.py, at and just after line 26. We do not need extra imports because everything required comes from the existing ssl import. No other functions in the file need to change to address this specific alert.