anchore / anchore/syft

Add support for recursively export all of the compressed files

Open
#2,407 1 comment 0 reactions 0 assignees View on GitHub
enhancement good-first-issue
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
23h 27m
Merged PRs (30d)
48

Description

**What would you like to be added**:

If given file is compressed or ISO, try to export all of the compressed files recursively to scan.

**Why is this needed**:

My use case was to scan Lima image as you can find here:

```
$ curl -sLO https://github.com/abiosoft/alpine-lima/releases/download/colima-v0.5.5/alpine-lima-clm-3.18.0-aarch64.iso
$ mkdir test
$ tar xvf alpine-lima-clm-3.18.0-aarch64.iso -C test
$ grype dir:test
```

But Grype returns `No vulnerabilities found` error. But ISO contains lots of `tar` files, if we recursively export all of _compressed_ files, Grype can able to find the vulnerabilities as expected:

```
$ cd test
$ tar xvf alpine.apkovl.tar.gz
$ cd usr/
$ grype dir:.
```

Now Grype can able to find the packages and vulnerabilities.

Since `ISO` files are not actually _compressed data_, Grype could force try to uncompress of the given file regardless of its _type_.

```
$ file alpine-lima-clm-3.18.0-aarch64.iso
alpine-lima-clm-3.18.0-aarch64.iso: ISO 9660 CD-ROM filesystem data (DOS/MBR boot sector) 'alpine-lima clm-3.18.0 aarch64' (bootable)
```

What would be the most effective way to handle this kind of cases?

**Additional context**:
As the context of Grype clearly mentioned already: `vulnerability scanner FOR container images and filesystems`, the goal here is not to add support for ISO files, since it could be out-of-context of what this tool is designed for.

Contributor guide

Open the contributing guide

Research direction

No files, tests, or entry points are named. Start by reproducing the ISO example and tracing how Syft handles filesystem inputs and nested archives; done means the described ISO containing compressed tar files can be scanned recursively, with coverage for the nested case.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.