From 7263fcf35fa249989a016396000cf04fa3d9fd7d Mon Sep 17 00:00:00 2001 From: Siteshwar Vashisht Date: Tue, 13 Oct 2026 10:59:13 +0200 Subject: [PATCH] oci-util: don't mistake a registry port for an OCI tag The tag separator can only appear as the last path component, hence start the search there. Fixes an issue reproducible through: ``` > /usr/lib/systemd/systemd-pull oci quay.io:443/fedora/fedora fedora-without-tag OCI ref 'quay.io:443/fedora/fedora' is invalid. ``` (cherry picked from commit fe9fe613d92f2acffdf3f8b96d3af027f19d6b7e) --- src/import/oci-util.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/src/import/oci-util.c b/src/import/oci-util.c index d727bade97..87105bc2b8 100644 --- a/src/import/oci-util.c +++ b/src/import/oci-util.c @@ -77,7 +77,7 @@ int oci_registry_is_valid(const char *n) { } bool oci_tag_is_valid(const char *n) { - if (!n) + if (!n || isempty(n)) return false; /* As per https://github.com/opencontainers/distribution-spec/blob/main/spec.md, accept the following regex: @@ -89,7 +89,7 @@ bool oci_tag_is_valid(const char *n) { return false; size_t l = strspn(n + 1, ALPHANUMERICAL "._-"); - if (l > 126) + if (l > 127) return false; if (n[1+l] != 0) return false; @@ -108,7 +108,11 @@ int oci_ref_parse( assert(ref); _cleanup_free_ char *without_tag = NULL, *tag = NULL; - const char *t = strrchr(ref, ':'); + + /* Look for the tag separator only after the last "/", so that we don't mistake the port number of a + * registry for a tag, e.g. so that "quay.io:443/fedora/fedora" is parsed correctly. */ + const char *slash = strrchr(ref, '/'); + const char *t = strrchr(slash ?: ref, ':'); if (t) { tag = strdup(t + 1); if (!tag)