buildkit: check ADD statements (#137)

* check about ADD statement even if built by buildkit
* add manifest test
* use alpine:3.14

Dockerfile

@@ -6,7 +6,7 @@ RUN apk --no-cache add git
 COPY . .
 RUN CGO_ENABLED=0 go build -a -o /dockle ${PWD}/cmd/dockle
 
-FROM alpine:3.13
+FROM alpine:3.14
 COPY --from=builder /dockle /usr/local/bin/dockle
 RUN chmod +x /usr/local/bin/dockle
 RUN apk --no-cache add ca-certificates shadow

Dockerfile.releaser

@@ -1,3 +1,3 @@
-FROM alpine:3.13
+FROM alpine:3.14
 COPY dockle /usr/bin/dockle
 ENTRYPOINT ["/usr/bin/dockle"]

pkg/assessor/manifest/manifest.go

@@ -197,7 +197,7 @@ func useDistUpgrade(cmdSlices map[int][]string) bool {
 
 func useADDstatement(cmdSlices map[int][]string) bool {
 	for _, cmdSlice := range cmdSlices {
-		if containsAll(cmdSlice, []string{"ADD", "in"}) {
+		if containsThreshold(cmdSlice, []string{"ADD", "in", "buildkit"}, 2) {
 			return true
 		}
 	}

pkg/assessor/manifest/manifest_test.go

@@ -380,6 +380,58 @@ func TestUseDistUpgrade(t *testing.T) {
 	}
 }
 
+func TestContainsThreshold(t *testing.T) {
+	var tests = map[string]struct {
+		heystack  []string
+		needles   []string
+		threshold int
+		expected  bool
+	}{
+		"SimpleSuccess2": {
+			heystack:  []string{"a", "b", "c", "d"},
+			needles:   []string{"a", "b", "x", "z"},
+			threshold: 2,
+			expected:  true,
+		},
+		"SimpleFail2": {
+			heystack:  []string{"a", "b", "c", "d"},
+			needles:   []string{"a", "x", "y", "z"},
+			threshold: 3,
+			expected:  false,
+		},
+		"SimpleSuccess3": {
+			heystack:  []string{"a", "b", "c", "d"},
+			needles:   []string{"a", "b", "c", "z"},
+			threshold: 3,
+			expected:  true,
+		},
+		"SimpleFail3": {
+			heystack:  []string{"a", "b", "d", "f"},
+			needles:   []string{"a", "b", "c", "z"},
+			threshold: 3,
+			expected:  false,
+		},
+		"DuplicateHeystackSuccess": {
+			heystack:  []string{"a", "a", "b", "c"},
+			needles:   []string{"a", "a", "y", "z"},
+			threshold: 2,
+			expected:  false,
+		},
+		"DuplicateHeystackFail": {
+			heystack:  []string{"a", "a", "b", "c"},
+			needles:   []string{"a", "x", "y", "z"},
+			threshold: 2,
+			expected:  false,
+		},
+	}
+	for testname, v := range tests {
+		actual := containsThreshold(v.heystack, v.needles, v.threshold)
+		if actual != v.expected {
+			t.Errorf("%s want: %t, got %t", testname, v.expected, actual)
+		}
+	}
+}
+
 func loadImageFromFile(path string) (config types.Image, err error) {
 	read, err := os.Open(path)
 	if err != nil {