From 2c589b2a510b41d18e412d3179617543f4c848a4 Mon Sep 17 00:00:00 2001
From: librelad <librelad@digitalangels.vip>
Date: Thu, 13 Aug 2026 00:55:04 +0100
Subject: [PATCH] fix(updater): treat docker.io/ as Docker Hub, not a
 third-party registry
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The registry helpers rejected any repo containing a dotted host segment,
which caught 'docker.io/authelia/authelia' — Docker Hub spelled out in
full. Those apps were silently skipped by tag enumeration and version
laddering. Strip the docker.io/ and index.docker.io/ prefixes before the
host check; genuinely third-party registries (ghcr.io, quay.io, lscr.io)
are still correctly skipped.

Found by auditing every app's anchor image.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 scripts/cli/commands/updater/cli_updater_ladder.sh          | 1 +
 scripts/webui/data/generators/updater/webui_updater_scan.sh | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/scripts/cli/commands/updater/cli_updater_ladder.sh b/scripts/cli/commands/updater/cli_updater_ladder.sh
index 1c71780..1227bd5 100644
--- a/scripts/cli/commands/updater/cli_updater_ladder.sh
+++ b/scripts/cli/commands/updater/cli_updater_ladder.sh
@@ -36,6 +36,7 @@ updaterTagSortKey() {
 # ladder is built by PROBING each candidate, never by enumerating.
 updaterTagExists() {
     local repo="${1%%:*}" tag="$2"
+    repo="${repo#docker.io/}"; repo="${repo#index.docker.io/}"   # docker.io/ IS Hub
     case "$repo" in *.*/*|localhost/*) return 1 ;; esac        # non-Hub: unknown
     case "$repo" in */*) : ;; *) repo="library/$repo" ;; esac
     command -v curl >/dev/null 2>&1 || return 1
diff --git a/scripts/webui/data/generators/updater/webui_updater_scan.sh b/scripts/webui/data/generators/updater/webui_updater_scan.sh
index 24c1054..04e424f 100644
--- a/scripts/webui/data/generators/updater/webui_updater_scan.sh
+++ b/scripts/webui/data/generators/updater/webui_updater_scan.sh
@@ -122,6 +122,11 @@ updaterRegistryDigest() {
 # they are returned newest-first and we only care about ones ABOVE the current.
 updaterRegistryTags() {
     local repo="${1%%:*}"                       # strip any :tag
+    # docker.io/ IS Docker Hub, just spelled out — several apps write it that
+    # way (docker.io/authelia/authelia). Stripping the prefix before the
+    # host check stops those being mistaken for a third-party registry and
+    # silently skipped.
+    repo="${repo#docker.io/}"; repo="${repo#index.docker.io/}"
     case "$repo" in
         *.*/*|localhost/*) return 0 ;;          # a real registry host — not Hub
     esac