diff --git a/cmd/cosign/cli/verify_dockerfile.go b/cmd/cosign/cli/verify_dockerfile.go index ade3e914d6d..882d4df10fc 100644 --- a/cmd/cosign/cli/verify_dockerfile.go +++ b/cmd/cosign/cli/verify_dockerfile.go @@ -130,7 +130,13 @@ func getImagesFromDockerfile(dockerfile io.Reader) ([]string, error) { func getImageFromLine(line string) string { line = strings.TrimPrefix(line, "FROM") // Remove "FROM" prefix line = os.ExpandEnv(line) // Substitute templated vars - line = strings.Split(line, " AS ")[0] // Remove the "AS" portion of line fields := strings.Fields(line) + for i := len(fields) - 1; i > 0; i-- { + // Remove the "AS" portion of line + if strings.EqualFold(fields[i], "AS") { + fields = fields[:i] + break + } + } return fields[len(fields)-1] // The image should be the last portion of the line that remains } diff --git a/cmd/cosign/cli/verify_dockerfile_test.go b/cmd/cosign/cli/verify_dockerfile_test.go index 0a1fed013a9..92af6892712 100644 --- a/cmd/cosign/cli/verify_dockerfile_test.go +++ b/cmd/cosign/cli/verify_dockerfile_test.go @@ -37,6 +37,11 @@ func TestGetImagesFromDockerfile(t *testing.T) { fileContents: `FROM gcr.io/test/image:latest`, expected: []string{"gcr.io/test/image:latest"}, }, + { + name: "tag with as", + fileContents: `FROM gcr.io/test/image:1.16.5 as build`, + expected: []string{"gcr.io/test/image:1.16.5"}, + }, { name: "digest", fileContents: `FROM gcr.io/test/image@sha256:d131624e6f5d8695e9aea7a0439f7bac0fcc50051282e0c3d4d627cab8845ba5`,