anchore / anchore/syft

Syft fails when /tmp is missing, but continues without exit code 0

Open
#3,074 3 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
9.6k
Forks
962
Avg merge
23h 27m
Merged PRs (30d)
48

Description

**What happened**:
I ran syft in an environment where no /tmp folder existed (a really small scratch container). In this container I tried to scan a container image tar file.

Command: `syft scan container.tar -o cyclonedx-json=sbom.json`

Syft logs the error:
```
[0000] WARN file could not be unarchived: unable to create tempdir for archive processing: stat /tmp: no such file or directory
```
but then continues and returns with exit code 0.
The generated SBOM does not contain any dependency but the structure is valid.

**What you expected to happen**:
I expect that syft either crashes with exit code != 0 and does not generate a sbom in this case or that it creates the tmp folder when it does not exist.

**Steps to reproduce the issue**:
Run syft in a docker container and scan a container image tar there. Delete the `/tmp/` folder before, then you should be able to reproduce the issue.

**Anything else we need to know?**:
We ran this in GitLab and the error message `[0000] WARN file could not be unarchived: unable to create tempdir for archive processing: stat /tmp: no such file or directory` was not visible in the pipeline, it only appeared when running manually, maybe because a tty was missing?

**Environment**:
- Output of `syft version`:
`syft 1.9.0`

- OS (e.g: `cat /etc/os-release` or similar):
In my case it was a distroless docker container.

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue with `syft scan container.tar -o cyclonedx-json=sbom.json` after removing `/tmp`, and start by tracing the container archive processing and temp-directory error handling. Done means the missing `/tmp` condition has an intentional nonzero exit outcome or supported directory creation, with no misleading empty SBOM; verify the command's exit code and output.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.