Support for multiple image refs of same sha in OCI layout

[saisatishkarra]

What would you like to be added:

1. Syft should be able to scan and detect multiple image refs of mediaType application/vnd.oci.image.index.v1+json for the same sha in single oci-layout

Why is this needed:
Needed to avoid scanning twice for images with the same sha and different tag

Additional context:

[tgerla]

Hi @saisatishkarra, thanks for filing the issue. We have a couple of questions over here. Usually these OCI manifests are used, for instance, to list different architectures of the same image (which would have different SHAs), so we are a little bit confused as to why you would have a manifest with two instances of the same exact image (same SHA). Can you provide a few more details about where this manifest came from, what build tool created it, or how to create it, and we can take a closer look? Thanks!

[saisatishkarra]

@tgerla This index manifest is produced when using a build-push-action with multiple tags (list/csv) for a single architecture of the same image. Each tag is considered to produce a separate manifest within the index.json with differing io.containerd.image.name pointing to tag variants in the annotations section for the same image as attached in the description screenshot!!

[spiffcs]

There is a potential enhancement we can make in https://github.com/anchore/stereoscope where we check the manifest list, and if all of the digest are equal, we can proceed with the scan. @wagoodman if we find that this is only one single image we can just pick one and go right?

I've added this to the backlog as a stereoscope enhancement while we wait for a 2nd from @wagoodman

[saisatishkarra]

@spiffcs Is there an update on this?

[spiffcs]

@saisatishkarra just filed a PR in stereoscope to address this.

• feat: treat manifests with equal digest as single image stereoscope#202 -

Apologies for the long response time here!

[spiffcs]

This PR has been merged so I'll look to get this brought into syft for the next release