defenseunicorns / defenseunicorns/uds-cli
sbom inspect issue when package re-used in a bundle
- Dominant language
- Go
- Stars
- 54
- Forks
- 21
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 45
Description
### Environment
Device and OS: Linux, Mac, GitHub runner
App version:
Kubernetes distro being used: N/A
Other:
### Steps to reproduce
1. define bundle that re-uses a package
```console
cat < uds-bundle.yaml
kind: UDSBundle
metadata:
name: test-bundle
version: "0.0.1"
packages:
- name: nginx-one
repository: ghcr.io/defenseunicorns/packages/uds/nginx
ref: 1.27.3-upstream
- name: nginx-too
repository: ghcr.io/defenseunicorns/packages/uds/nginx
ref: 1.27.3-upstream
EOF
```
2. create bundle
```console
uds create --confirm
```
3. try and inspect with sbom
```console
uds inspect --sbom uds-bundle-*.tar.zst
```
### Expected result
should display the bundle yaml and output an sbom tar file
### Actual Result
```console
ERROR: failed to inspect bundle: failed to extract 644ec9bc7af653fff952fbb438bdc49a6eca5f7af50733b5288006409e79b170 from uds-bundle-test-bundle-arm64-0.0.1.tar.zst: walking 644ec9bc7af653fff952fbb438bdc49a6eca5f7af50733b5288006409e79b170: extracting file blobs/sha256/644ec9bc7af653fff952fbb438bdc49a6eca5f7af50733b5288006409e79b170: file already exists: /var/folders/x5/9sbp9j3n4cj6dq856xl9g08c0000gp/T/zarf-3102812649/blobs/sha256/644ec9bc7af653fff952fbb438bdc49a6eca5f7af50733b5288006409e79b170
```
### Visual Proof (screenshots, videos, text, etc)
### Severity/Priority
### Additional Context
https://defense-unicorns.slack.com/archives/C06QJAUHWFN/p1733671019536349?thread_ts=1726666577.394639&cid=C06QJAUHWFN
Contributor guide
Research direction
Reproduce the failure with the provided uds-bundle.yaml, then run `uds create --confirm` and `uds inspect --sbom uds-bundle-*.tar.zst`. Trace bundle inspection and extraction handling for the reused package blob; done means the bundle YAML is displayed and an SBOM tar file is produced without the duplicate-file error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100