fix: add check during image discovery to make sure images are valid

src/pkg/packager/prepare.go

@@ -8,14 +8,15 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"github.com/zarf-dev/zarf/src/pkg/logger"
 	"os"
 	"path/filepath"
 	"regexp"
 	"sort"
 	"strings"
 	"time"
 
+	"github.com/zarf-dev/zarf/src/pkg/logger"
+
 	"github.com/defenseunicorns/pkg/helpers/v2"
 	"github.com/goccy/go-yaml"
 	"github.com/google/go-containerregistry/pkg/crane"
@@ -37,7 +38,8 @@ import (
 	"github.com/zarf-dev/zarf/src/types"
 )
 
-var imageCheck = regexp.MustCompile(`(?mi)"image":"([^"]+)"`)
+var imageCheck = regexp.MustCompile(`(?mi)"image":"((([a-z0-9._-]+)/)?([a-z0-9._-]+)(:([a-z0-9._-]+))?)"`)
+var imagePodCheck = regexp.MustCompile(`(?mi)^(([a-z0-9._-]+)/)?([a-z0-9._-]+)(:([a-z0-9._-]+))?$`)
 var imageFuzzyCheck = regexp.MustCompile(`(?mi)["|=]([a-z0-9\-.\/:]+:[\w.\-]*[a-z\.\-][\w.\-]*)"`)
 
 // FindImages iterates over a Zarf.yaml and attempts to parse any images.
@@ -454,13 +456,19 @@ func findWhyResources(resources []*unstructured.Unstructured, whyImage, componen
 
 func appendToImageMap(imgMap map[string]bool, pod corev1.PodSpec) map[string]bool {
 	for _, container := range pod.InitContainers {
-		imgMap[container.Image] = true
+		if imagePodCheck.MatchString(container.Image) {
+			imgMap[container.Image] = true
+		}
 	}
 	for _, container := range pod.Containers {
-		imgMap[container.Image] = true
+		if imagePodCheck.MatchString(container.Image) {
+			imgMap[container.Image] = true
+		}
 	}
 	for _, container := range pod.EphemeralContainers {
-		imgMap[container.Image] = true
+		if imagePodCheck.MatchString(container.Image) {
+			imgMap[container.Image] = true
+		}
 	}
 	return imgMap
 }

src/pkg/packager/prepare_test.go

@@ -69,6 +69,20 @@ func TestFindImages(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "valid-image-uri",
+			cfg: &types.PackagerConfig{
+				CreateOpts: types.ZarfCreateOptions{
+					BaseDir: "./testdata/find-images/valid-image-uri",
+				},
+			},
+			expectedImages: map[string][]string{
+				"baseline": {
+					"ghcr.io/zarf-dev/zarf/agent:v0.38.1",
+					"ghcr.io/zarf-dev/zarf/agent:sha256-f8b1c2f99349516ae1bd0711a19697abcc41555076b0ae90f1a70ca6b50dcbd8.sig",
+				},
+			},
+		},
 		{
 			name: "image not found",
 			cfg: &types.PackagerConfig{

src/pkg/packager/testdata/find-images/helm-chart/values-invalid-image.yaml

@@ -0,0 +1,2 @@
+image:
+  repository: docker.io*

src/pkg/packager/testdata/find-images/helm-chart/zarf.yaml

@@ -4,7 +4,7 @@ metadata:
   version: 1.0.0
 components:
   - name: baseline
-    required: true        
+    required: true
     charts:
       - name: with-values
         version: 0.1.0
@@ -16,3 +16,9 @@ components:
         version: 0.1.0
         namespace: without-values
         localPath: chart
+      - name: invalid-image
+        version: 0.1.0
+        namespace: invalid-image
+        localPath: chart
+        valuesFiles:
+          - values-invalid-image.yaml

src/pkg/packager/testdata/find-images/valid-image-uri/deployment.yaml

@@ -0,0 +1,18 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: agent
+spec:
+  selector:
+    matchLabels:
+      app: agent
+  template:
+    metadata:
+      labels:
+        app: agent
+    spec:
+      containers:
+        - name: agent
+          image: ghcr.io/zarf-dev/zarf/agent:v0.38.1
+        - name: bad-image
+          image: registry1.dso.mil*

src/pkg/packager/testdata/find-images/valid-image-uri/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- deployment.yaml
+- policy.yaml

src/pkg/packager/testdata/find-images/valid-image-uri/policy.yaml

@@ -0,0 +1,25 @@
+---
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: restrict-image-registries
+spec:
+  background: true
+  failurePolicy: Ignore
+  rules:
+  - exclude:
+      any:
+      - resources:
+          namespaces:
+          - kube-system
+    match:
+      all:
+      - resources:
+          kinds:
+          - Pod
+    name: validate-registries
+    validate:
+      foreach:
+      - list: request.object.spec.[ephemeralContainers, initContainers, containers][]
+        pattern:
+          image: docker.io*

src/pkg/packager/testdata/find-images/valid-image-uri/zarf.yaml

@@ -0,0 +1,12 @@
+kind: ZarfPackageConfig
+metadata:
+  name: valid-image-uri
+  version: 1.0.0
+components:
+  - name: baseline
+    required: true
+    manifests:
+      - name: valid-image-uri
+        namespace: default
+        kustomizations:
+          - ./.