Improve scheme parsing to cover relative directory paths
- Dominant language
- Go
- Stars
- 9.6k
- Forks
- 954
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 42
Description
This is being broken out into a separate issue from #283 (from https://github.com/anchore/syft/issues/283#issuecomment-708425067 and https://github.com/anchore/syft/issues/283#issuecomment-712245066 ).
> When passing in a file path without the dir: prefix, grype needs to decide how it's going to interpret the input. With /var/lib, it's pretty clear that this is a local filesystem path. Grype is trying to pull a container image called /var/lib, which doesn't make sense. We should update grype accordingly. With something like foo/bar, the input is inherently ambiguous. Is this a local filesystem path that's relative to the current working directory, equivalent to dir:./foo/bar? Or is this a container image named foo/bar, equivalent to docker:foo/bar? Regardless, it's clear that our documentation needs to be corrected.
> For specifying a source to scan "implicitly" — meaning without an explicit scheme like grype dir:... or grype docker:... — we have more work to do to figure out how input that's ambiguous should be interpreted. For anyone curious, we have a test that attempts to map out expectations for various kinds of input: https://github.com/anchore/syft/blob/main/syft/scope/scope_test.go#L220. We need to spend more time making sure that we're handling user input correctly; for example, by not asking the Docker daemon to fetch something that doesn't appear to be a Docker image.
Contributor guide
Research direction
Start with syft/scope/scope_test.go around line 220, which maps expectations for implicit source inputs. Determine how relative directory paths and ambiguous inputs should be interpreted, including when Docker should not be queried. Done means the behavior is clarified and the corresponding scope tests and documentation expectations are updated.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go
- Domain
- cli
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100