Fix image_test.snap commit hash

[robramsaynz]

I was getting the following test failures:

$ ./scripts/run_tests.sh
skipped building internal/image/fixtures/test-alpine.tar (already exists)
skipped building internal/image/fixtures/test-node_modules-npm-empty.tar (already exists)
skipped building internal/image/fixtures/test-node_modules-npm-full.tar (already exists)
skipped building internal/image/fixtures/test-node_modules-pnpm-empty.tar (already exists)
skipped building internal/image/fixtures/test-node_modules-pnpm-full.tar (already exists)
skipped building internal/image/fixtures/test-node_modules-yarn-empty.tar (already exists)
skipped building internal/image/fixtures/test-node_modules-yarn-full.tar (already exists)
go: downloading github.com/google/go-containerregistry v0.19.1
...
...
ok      github.com/google/osv-scanner/internal/customgitignore  1.526s  coverage: 82.2% of statements in ./...
--- FAIL: TestScanImage (0.00s)
    --- FAIL: TestScanImage/Alpine_3.10_image_tar_with_3.18_version_file (0.17s)
        image_test.go:88:
            - Snapshot - 1
            + Received + 1

            @@ -35,7 +35,7 @@

                      {
                        "name": "ca-certificates-cacert",
                        "version": "20191127-r2",
            -           "commit": "9677580919b73ca6eff94d3d31b9a846b4e40612",
            +           "commit": "f24637bad53762e9a2f847dd2e67bb91b1a615c2",
                        "ecosystem": "Alpine:v3.18",
                        "compareAs": "Alpine"
                      },

            at ../__snapshots__/image_test.snap:1205

FAIL
coverage: 13.8% of statements in ./...
FAIL    github.com/google/osv-scanner/internal/image    4.042s
ok      github.com/google/osv-scanner/internal/local    1.858s  coverage: 4.0% of statements in ./...
...
ok      github.com/google/osv-scanner/pkg/spdx  1.355s  coverage: 100.0% of statements in ./...
FAIL

I've tried reseting the fixtures dir: with,

$ rm internal/image/fixtures/*
$ git checkout internal/image/fixtures/

... and then and restarting Docker Desktop (macos). But got the same result.

[robramsaynz]

@G-Rath I've assigned this to you as the easiest way to talk about what's going on.

Google has pushed changes today, so I'm guessing this isn't a "real" problem if it's not blocking CI.

Options I can see causing this (decreasing likelyhood):

1. I've got some kind of a stale cache and need to clear out something before re-running the tests
2. there's some kind of difference about my system that is causing, (eg docker not picking up new changes, something related to my recet switch to goenv, etc, etc)
3. this is actually a problem (despite not being picked up by CI when google pushed changes today)

I've tried reseting the fixtures dir: with, rm internal/image/fixtures/* ; git checkout internal/image/fixtures/, then and restarting Docker Desktop (macos). But got the same results.

[robramsaynz]

I've tried pinning, and this code passes locally and fails on CI. So I'm at a lost as to what's going on.

Here's my local test run after I'd deleted all my internal/image/fixtures/*.tar files:

$ ./scripts/run_tests.sh                                                                                                                            
[+] Building 2.4s (8/8) FINISHED                                                                                                                                                     docker:desktop-linux 
 => [internal] load build definition from test-alpine.Dockerfile                                                                                                                                     0.0s 
 => => transferring dockerfile: 290B                                                                                                                                                                 0.0s 
 => [internal] load metadata for docker.io/library/alpine:3.10@sha256:451eee8bedcb2f029756dc3e9d73bab0e7943c1ac55cff3a4861c52a0fdd3e98                                                               2.5s
 => [auth] library/alpine:pull token for registry-1.docker.io                                                                                                                                        0.0s 
 => [internal] load .dockerignore                                                                                                                                                                    0.0s
 => => transferring context: 2B                                                                                                                                                                      0.0s
 => [internal] load build context                                                                                                                                                                    0.0s
 => => transferring context: 60B                                                                                                                                                                     0.0s
 => [1/2] FROM docker.io/library/alpine:3.10@sha256:451eee8bedcb2f029756dc3e9d73bab0e7943c1ac55cff3a4861c52a0fdd3e98                                                                                 0.0s
 => CACHED [2/2] COPY alpine-3.19-alpine-release /etc/alpine-release                                                                                                                                 0.0s
 => exporting to image                                                                                                                                                                               0.0s
 => => exporting layers                                                                                                                                                                              0.0s
 => => writing image sha256:d0a040a70b60d027a17a725b042f36463b8031c850bc0b8235c5e1df88af8356                                                                                                         0.0s
 => => naming to docker.io/osv-scanner/test-alpine:latest                                                                                                                                            0.0s

What's Next?
  View a summary of image vulnerabilities and recommendations → docker scout quickview
finished building internal/image/fixtures/test-alpine.tar (did not exist)
[+] Building 1.9s (10/10) FINISHED                                                                                                                                                   docker:desktop-linux
 => [internal] load build definition from test-node_modules-npm-empty.Dockerfile                                                                                                                     0.0s
 => => transferring dockerfile: 404B                                                                                                                                                                 0.0s
 => [internal] load metadata for docker.io/library/node:20-alpine@sha256:c0a3badbd8a0a760de903e00cedbca94588e609299820557e72cba2a53dbaa2c                                                            1.8s
 => [auth] library/node:pull token for registry-1.docker.io                                                                                                                                          0.0s
 => [internal] load .dockerignore                                                                                                                                                                    0.0s
 => => transferring context: 2B                                                                                                                                                                      0.0s
 => [1/5] FROM docker.io/library/node:20-alpine@sha256:c0a3badbd8a0a760de903e00cedbca94588e609299820557e72cba2a53dbaa2c                                                                              0.0s
 => CACHED [2/5] WORKDIR /usr/app                                                                                                                                                                    0.0s
 => CACHED [3/5] RUN npm i -g "npm@$MANAGER_VERSION"                                                                                                                                                 0.0s
 => CACHED [4/5] RUN npm init -y                                                                                                                                                                     0.0s
 => CACHED [5/5] RUN npm install                                                                                                                                                                     0.0s
 => exporting to image                                                                                                                                                                               0.0s
 => => exporting layers                                                                                                                                                                              0.0s
 => => writing image sha256:229b4ed6b1b701b82797e4d35d97a7c61321b3fd4dd1281c643bc427683f6def                                                                                                         0.0s
 => => naming to docker.io/osv-scanner/test-node_modules-npm-empty:latest                                                                                                                            0.0s

What's Next?
  View a summary of image vulnerabilities and recommendations → docker scout quickview
finished building internal/image/fixtures/test-node_modules-npm-empty.tar (did not exist)
[+] Building 0.0s (11/11) FINISHED                                                                                                                                                   docker:desktop-linux
 => [internal] load build definition from test-node_modules-npm-full.Dockerfile                                                                                                                      0.0s
 => => transferring dockerfile: 501B                                                                                                                                                                 0.0s
 => [internal] load metadata for docker.io/library/node:20-alpine@sha256:c0a3badbd8a0a760de903e00cedbca94588e609299820557e72cba2a53dbaa2c                                                            0.0s
 => [internal] load .dockerignore                                                                                                                                                                    0.0s
 => => transferring context: 2B                                                                                                                                                                      0.0s
 => [1/7] FROM docker.io/library/node:20-alpine@sha256:c0a3badbd8a0a760de903e00cedbca94588e609299820557e72cba2a53dbaa2c                                                                              0.0s
 => CACHED [2/7] WORKDIR /usr/app                                                                                                                                                                    0.0s
 => CACHED [3/7] RUN npm i -g "npm@$MANAGER_VERSION"                                                                                                                                                 0.0s
 => CACHED [4/7] RUN npm init -y                                                                                                                                                                     0.0s
 => CACHED [5/7] RUN npm i mkdirp@0.5.0                                                                                                                                                              0.0s
 => CACHED [6/7] RUN npm i -d cryo@0.0.6                                                                                                                                                             0.0s
 => CACHED [7/7] RUN npm install                                                                                                                                                                     0.0s
 => exporting to image                                                                                                                                                                               0.0s
 => => exporting layers                                                                                                                                                                              0.0s
 => => writing image sha256:9c1f486f143b2df93dab7586014c3645522c7892dd781ee1bf432518159fb14f                                                                                                         0.0s
 => => naming to docker.io/osv-scanner/test-node_modules-npm-full:latest                                                                                                                             0.0s

...

[robramsaynz]

@another-rex this is the only-on-Rob's-machine error I wasn running into. I've created a draft PR to record what I'd found. I've recently switched from homebrew installed go, to goenv installed go locally, but given the nature of the error I'm guessing this lives in Docker-land, rather than go-land.

I agree with @G-Rath that this may well be a phantom error, and is only worth chasing if we have someone else that runs into it. It doesn't block me and I believe that google#869 will stop me triggering it.

[robramsaynz]

NOTE: the .Dockerfile pinning in this PR, has been applied in google#880