Add support for recursively export all of the compressed files
- Dominant language
- Go
- Stars
- 9.6k
- Forks
- 954
- Avg merge
- 23h 27m
- Merged PRs (30d)
- 48
Description
**What would you like to be added**:
If given file is compressed or ISO, try to export all of the compressed files recursively to scan.
**Why is this needed**:
My use case was to scan Lima image as you can find here:
```
$ curl -sLO https://github.com/abiosoft/alpine-lima/releases/download/colima-v0.5.5/alpine-lima-clm-3.18.0-aarch64.iso
$ mkdir test
$ tar xvf alpine-lima-clm-3.18.0-aarch64.iso -C test
$ grype dir:test
```
But Grype returns `No vulnerabilities found` error. But ISO contains lots of `tar` files, if we recursively export all of _compressed_ files, Grype can able to find the vulnerabilities as expected:
```
$ cd test
$ tar xvf alpine.apkovl.tar.gz
$ cd usr/
$ grype dir:.
```
Now Grype can able to find the packages and vulnerabilities.
Since `ISO` files are not actually _compressed data_, Grype could force try to uncompress of the given file regardless of its _type_.
```
$ file alpine-lima-clm-3.18.0-aarch64.iso
alpine-lima-clm-3.18.0-aarch64.iso: ISO 9660 CD-ROM filesystem data (DOS/MBR boot sector) 'alpine-lima clm-3.18.0 aarch64' (bootable)
```
What would be the most effective way to handle this kind of cases?
**Additional context**:
As the context of Grype clearly mentioned already: `vulnerability scanner FOR container images and filesystems`, the goal here is not to add support for ISO files, since it could be out-of-context of what this tool is designed for.
Contributor guide
Research direction
No files, tests, or entry points are named. Start by reproducing the ISO example and tracing how Syft handles filesystem inputs and nested archives; done means the described ISO containing compressed tar files can be scanned recursively, with coverage for the nested case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100