jenkinsci / jenkinsci/crowdstrike-security-plugin
Jenkins plugin changes image digest on upload
- Dominant language
- Java
- Stars
- 4
- Forks
- 5
- PR merge metrics
- No merged PRs in 30d
Description
### Jenkins and plugins versions report
Environment
```text
Paste the output here
```
### What Operating System are you using (both controller, and any agents involved in the problem)?
generic linux
### Reproduction steps
use jenkins plugin to scan container image, during which a container image is uploaded to crowdstrike for assessment with a new image digest.
that leads to discrepancy between deployed container image vs assessment of said image (image digests differ) which makes vulnerability cross checking with running containers impossible.
### Expected Results
image digest is preserved so that container image vulnerability reporting correctly matches it to running containers
### Actual Results
image digest of the image used for deployment differs from the one that had been scanned
### Anything else?
crowdstrike documentation suggests using skopeo for image upload that can preserve digest;
### Are you interested in contributing a fix?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.