Documentation
¶
Overview ¶
Package dockerhub provides a verifier for Docker Hub Personal Access Tokens. It uses the Docker Hub API GET /v2/user/ endpoint to check token validity.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Verifier ¶
type Verifier struct {
// contains filtered or unexported fields
}
Verifier checks whether a Docker Hub PAT is active by calling the Docker Hub API. It NEVER logs or persists raw token values.
func (*Verifier) Verify ¶
func (v *Verifier) Verify(ctx context.Context, raw detector.RawFinding) finding.VerificationResult
Verify checks if the detected Docker Hub PAT is valid/active. Raw contains the token value.
Docker Hub Personal Access Tokens are sent directly as an Authorization: Bearer header on the v2 API, without a preceding login/JWT-exchange step: Docker's own access-token documentation confirms PATs authenticate the Hub API directly (https://docs.docker.com/security/access-tokens/), and the legacy POST /v2/users/login/ JWT-exchange flow is documented to reject tokens minted from a PAT ("token issued from personal access token") on many endpoints, so it is not a viable alternative here. That flow would also require the token's Docker Hub username, which this package's detector does not capture (only the PAT itself is matched) — a second, independent reason the login-exchange is not implementable for this verifier.
Source Files