Add support for encrypted Singularity images
- Dominant language
- Go
- Stars
- 9.6k
- Forks
- 954
- Avg merge
- 23h 27m
- Merged PRs (30d)
- 48
Description
**What would you like to be added**:
Support for cataloging encrypted SIF images with Syft.
**Why is this needed**:
Singularity supports encryption of the root filesystem within a SIF image ([ref](https://docs.sylabs.io/guides/latest/user-guide/encryption.html)). Attempting to scan an encrypted Singularity image isn't currently possible:
```sh
$ sudo singularity build --passphrase encrypted.sif docker://alpine
...
$ syft packages singularity:encrypted.sif
2022/09/02 12:55:16 error during command execution: 1 error occurred:
* failed to construct source from user input "singularity:encrypted.sif": could not fetch image "encrypted.sif": could not read image: media type 'Encrypted squashfs' not supported
```
**Additional context**:
The implementation here may be challenging. [Singularity](https://github.com/sylabs/singularity) implements this using `dm-crypt` and `cryptsetup`, which I believe would limit support to the Linux platform. And I'm not sure if there's a Go-native way to do this without shelling out.
Contributor guide
Research direction
Reproduce the failure with `syft packages singularity:encrypted.sif` after building the image with `singularity build --passphrase`, then read the linked Singularity encryption documentation and trace Syft's image-source handling for the unsupported `Encrypted squashfs` media type. Done means Syft can catalog packages from an encrypted SIF image, with the Linux and `dm-crypt`/`cryptsetup` constraints understood.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, linux
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100