anchore / anchore/syft

Improve scheme parsing to cover relative directory paths

Open
#441 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
1d 5h
Merged PRs (30d)
42

Description

This is being broken out into a separate issue from #283 (from https://github.com/anchore/syft/issues/283#issuecomment-708425067 and https://github.com/anchore/syft/issues/283#issuecomment-712245066 ).

> When passing in a file path without the dir: prefix, grype needs to decide how it's going to interpret the input. With /var/lib, it's pretty clear that this is a local filesystem path. Grype is trying to pull a container image called /var/lib, which doesn't make sense. We should update grype accordingly. With something like foo/bar, the input is inherently ambiguous. Is this a local filesystem path that's relative to the current working directory, equivalent to dir:./foo/bar? Or is this a container image named foo/bar, equivalent to docker:foo/bar? Regardless, it's clear that our documentation needs to be corrected.

> For specifying a source to scan "implicitly" — meaning without an explicit scheme like grype dir:... or grype docker:... — we have more work to do to figure out how input that's ambiguous should be interpreted. For anyone curious, we have a test that attempts to map out expectations for various kinds of input: https://github.com/anchore/syft/blob/main/syft/scope/scope_test.go#L220. We need to spend more time making sure that we're handling user input correctly; for example, by not asking the Docker daemon to fetch something that doesn't appear to be a Docker image.

Contributor guide

Open the contributing guide

Research direction

Start with syft/scope/scope_test.go around line 220, which maps expectations for implicit source inputs. Determine how relative directory paths and ambiguous inputs should be interpreted, including when Docker should not be queried. Done means the behavior is clarified and the corresponding scope tests and documentation expectations are updated.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, go
Domain
cli
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.