anchore / anchore/syft

Add support for encrypted Singularity images

Open
#1,192 0 comments 0 reactions 0 assignees View on GitHub
enhancement good-first-issue
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
23h 27m
Merged PRs (30d)
48

Description

**What would you like to be added**:

Support for cataloging encrypted SIF images with Syft.

**Why is this needed**:

Singularity supports encryption of the root filesystem within a SIF image ([ref](https://docs.sylabs.io/guides/latest/user-guide/encryption.html)). Attempting to scan an encrypted Singularity image isn't currently possible:

```sh
$ sudo singularity build --passphrase encrypted.sif docker://alpine
...
$ syft packages singularity:encrypted.sif

2022/09/02 12:55:16 error during command execution: 1 error occurred:
* failed to construct source from user input "singularity:encrypted.sif": could not fetch image "encrypted.sif": could not read image: media type 'Encrypted squashfs' not supported
```

**Additional context**:

The implementation here may be challenging. [Singularity](https://github.com/sylabs/singularity) implements this using `dm-crypt` and `cryptsetup`, which I believe would limit support to the Linux platform. And I'm not sure if there's a Go-native way to do this without shelling out.

Contributor guide

Open the contributing guide

Research direction

Reproduce the failure with `syft packages singularity:encrypted.sif` after building the image with `singularity build --passphrase`, then read the linked Singularity encryption documentation and trace Syft's image-source handling for the unsupported `Encrypted squashfs` media type. Done means Syft can catalog packages from an encrypted SIF image, with the Linux and `dm-crypt`/`cryptsetup` constraints understood.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
cli, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.