defenseunicorns / defenseunicorns/uds-cli

sbom inspect issue when package re-used in a bundle

Open
#1,038 0 comments 0 reactions 0 assignees View on GitHub
possible-bug
Dominant language
Go
Stars
54
Forks
21
Avg merge
2d 15h
Merged PRs (30d)
45

Description

### Environment

Device and OS: Linux, Mac, GitHub runner
App version:
Kubernetes distro being used: N/A
Other:

### Steps to reproduce

1. define bundle that re-uses a package
```console
cat < uds-bundle.yaml
kind: UDSBundle
metadata:
name: test-bundle
version: "0.0.1"
packages:
- name: nginx-one
repository: ghcr.io/defenseunicorns/packages/uds/nginx
ref: 1.27.3-upstream
- name: nginx-too
repository: ghcr.io/defenseunicorns/packages/uds/nginx
ref: 1.27.3-upstream
EOF
```
2. create bundle
```console
uds create --confirm
```
3. try and inspect with sbom
```console
uds inspect --sbom uds-bundle-*.tar.zst
```

### Expected result

should display the bundle yaml and output an sbom tar file

### Actual Result

```console
ERROR: failed to inspect bundle: failed to extract 644ec9bc7af653fff952fbb438bdc49a6eca5f7af50733b5288006409e79b170 from uds-bundle-test-bundle-arm64-0.0.1.tar.zst: walking 644ec9bc7af653fff952fbb438bdc49a6eca5f7af50733b5288006409e79b170: extracting file blobs/sha256/644ec9bc7af653fff952fbb438bdc49a6eca5f7af50733b5288006409e79b170: file already exists: /var/folders/x5/9sbp9j3n4cj6dq856xl9g08c0000gp/T/zarf-3102812649/blobs/sha256/644ec9bc7af653fff952fbb438bdc49a6eca5f7af50733b5288006409e79b170
```

### Visual Proof (screenshots, videos, text, etc)

### Severity/Priority

### Additional Context

https://defense-unicorns.slack.com/archives/C06QJAUHWFN/p1733671019536349?thread_ts=1726666577.394639&cid=C06QJAUHWFN

Contributor guide

Open the contributing guide

Research direction

Reproduce the failure with the provided uds-bundle.yaml, then run `uds create --confirm` and `uds inspect --sbom uds-bundle-*.tar.zst`. Trace bundle inspection and extraction handling for the reused package blob; done means the bundle YAML is displayed and an SBOM tar file is produced without the duplicate-file error.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.