anchore / anchore/syft

Syft cli.Command() panics when invoked multiple times

Open
#2,285 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
23h 27m
Merged PRs (30d)
48

Description

**What happened**:
See https://stackoverflow.com/questions/77387892/unable-to-call-anchore-syft-library-command-multiple-times-when-embedded-in-go-a

```golang
func generateCycloneDX(ociArchiveName string, jsonOutputName string) {
syftId := clio.Identification{Name: "syft"}
syftCommand := cli.Command(syftId)
syftCommand.SetArgs([]string{ociArchiveName, "-o", jsonOutputName})
err := syftCommand.Execute()
if err != nil {
panic(err)
}
}
```

Which results in:
```
panic: replace existing redaction store (probably unintentional)

goroutine 1 [running]:
github.com/anchore/syft/internal/redact.Set(...)
go/pkg/mod/github.com/anchore/syft@v0.93.0/internal/redact/redact.go:11
github.com/anchore/syft/cmd/syft/cli.create.func2(0xc000490a90?)
go/pkg/mod/github.com/anchore/syft@v0.93.0/cmd/syft/cli/cli.go:64 +0x1a5
github.com/anchore/clio.(*application).runInitializers(0xc0013bc1a0)
go/pkg/mod/github.com/anchore/clio@v0.0.0-20231016125707-b60d41410795/application.go:110 +0x66
github.com/anchore/clio.(*application).PostLoad(0xc0013bc1a0)
go/pkg/mod/github.com/anchore/clio@v0.0.0-20231016125707-b60d41410795/application.go:105 +0xbb
github.com/anchore/fangs.postLoad({0x1f81f40?, 0xc0013bc1a0?, 0xc0013bc1a0?})
go/pkg/mod/github.com/anchore/fangs@v0.0.0-20230818131516-2186b10924fe/load.go:201 +0x1e5
github.com/anchore/fangs.loadConfig({{0x26109f8, 0x349e4e0}, {0x1ff3df6, 0x4}, {0x2004cda, 0xc}, {0x0, 0x0}, {0xc002b25e30, 0x5, ...}}, ...)
go/pkg/mod/github.com/anchore/fangs@v0.0.0-20230818131516-2186b10924fe/load.go:80 +0x7d1
github.com/anchore/fangs.Load({{0x26109f8, 0x349e4e0}, {0x1ff3df6, 0x4}, {0x2004cda, 0xc}, {0x0, 0x0}, {0xc002b25e30, 0x5, ...}}, ...)
go/pkg/mod/github.com/anchore/fangs@v0.0.0-20230818131516-2186b10924fe/load.go:16 +0x74
github.com/anchore/clio.(*application).loadConfigs(0xc0013bc1a0, 0xc000033870?, {0xc0004909f0, 0x1, 0xc0013b2700?})
go/pkg/mod/github.com/anchore/clio@v0.0.0-20231016125707-b60d41410795/application.go:95 +0x1a5
github.com/anchore/clio.(*application).setupCommand.func1.(*application).Setup.func1(0x4?, {0xd631f2?, 0xc0013b2700?, 0xc000033af0?})
go/pkg/mod/github.com/anchore/clio@v0.0.0-20231016125707-b60d41410795/application.go:74 +0x45
github.com/anchore/clio.(*application).setupCommand.func1(0xc0013b2700?, {0xc002e20870, 0x1, 0x3})
go/pkg/mod/github.com/anchore/clio@v0.0.0-20231016125707-b60d41410795/application.go:316 +0x82
github.com/spf13/cobra.(*Command).execute(0xc000845200, {0xc002e20660, 0x3, 0x3})
go/pkg/mod/github.com/spf13/cobra@v1.7.0/command.go:925 +0x7f6
github.com/spf13/cobra.(*Command).ExecuteC(0xc000845200)
go/pkg/mod/github.com/spf13/cobra@v1.7.0/command.go:1068 +0x3a5
github.com/spf13/cobra.(*Command).Execute(...)
go/pkg/mod/github.com/spf13/cobra@v1.7.0/command.go:992
```

**What you expected to happen**:
The panic is well intentioned, however, it is unintentional that it this panics on the second invocation.

Contributor guide

Open the contributing guide

Research direction

Start with cmd/syft/cli/cli.go and internal/redact/redact.go, then run a minimal reproduction based on the issue that invokes cli.Command and Execute twice. Trace the first and second initialization paths; done means repeated command invocation no longer panics with “replace existing redaction store.”

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.