Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Image layer code should inspect bytes instead of relying on file extension #36

Closed
puerco opened this issue Jan 28, 2022 · 0 comments · Fixed by #37
Closed

Image layer code should inspect bytes instead of relying on file extension #36

puerco opened this issue Jan 28, 2022 · 0 comments · Fixed by #37
Labels
kind/bug Categorizes issue or PR as related to a bug. sig/release Categorizes an issue or PR as relevant to SIG Release.

Comments

@puerco
Copy link
Member

puerco commented Jan 28, 2022

What happened:

When extracting image layers, the layer analyzer will treat the blobs as a tar file or as compressed data depending on the file extension. This causes an error when the blobs are extracted and opened for inspection

What you expected to happen:

Layer blobs should be opened and inspected

How to reproduce it (as minimally and precisely as possible):

Trying to generate an SBOM with bom v0.2.0 of this Istio image fails:

wget https://storage.googleapis.com/istio-prerelease/prerelease/1.13.0-beta.0/docker/app-debug.tar.gz
bom generate --image-archive app-debug.tar.gz

INFO Generating SPDX Bill of Materials            
INFO Processing tarball app-debug.tar.gz          
INFO Generating SPDX package from image tarball app-debug.tar.gz 
INFO Successfully extracted 12 files from image tarball app-debug.tar.gz 
INFO Package describes istio/app:1.13.0-beta.0-debug image 
INFO Image manifest lists 7 layers                
FATA generating doc: creating SPDX document: generating tarball package: getting os data from container: reading os type from layer: reading os release: extracting os-release from tar: reading tarfile: archive/tar: invalid tar header 

Anything else we need to know?:

@puerco puerco added kind/bug Categorizes issue or PR as related to a bug. sig/release Categorizes an issue or PR as relevant to SIG Release. labels Jan 28, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/bug Categorizes issue or PR as related to a bug. sig/release Categorizes an issue or PR as relevant to SIG Release.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant