jfrog / jfrog/jfrog-cli-security

jf scan failed to index tar file as container image

Open
#150 0 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
13
Forks
50
Avg merge
3d 48m
Merged PRs (30d)
26

Description

Describe the bug

source: https://github.com/jfrog/jfrog-cli-security/issues/334

$ jf -v
jf version 2.63.2
Current behavior
$ jf s ./artifacts/images/registry_2.8.1.tar
18:09:33 [Info] JFrog Xray version is: 3.95.7
18:09:33 [Info] [Thread 2] Indexing file: ./artifacts/images/registry_2.8.1.tar
18:09:40 [Info] 2024/08/16 18:09:33 maxprocs: Leaving GOMAXPROCS=8: CPU quota undefined
2024-08-16T18:09:37.334Z [jfxia] [WARN ] [] [docker_tar:74 ] [UnnamedContext ] Failed to index tar file as container image, continue to generic tar indexer. Error: failed to analyze docker tar archive
--- at /go/src/jfrog.com/xray/xray/backend/backend/indexer/indexer_core/docker_tar.go:134 (DockerTarOpener.analyzeTarAsContainer) ---
Caused by: failed to read manifest.json found in tar
--- at /go/src/jfrog.com/xray/xray/backend/backend/indexer/indexer_core/docker_tar.go:192 (DockerTarOpener.handleDockerManifestFile) ---
Caused by: manifest has no repo tags
--- at /go/src/jfrog.com/xray/xray/backend/backend/indexer/indexer_core/docker_tar.go:218 (prepareDockerManifestOnDemandData) ---
2024-08-16T18:09:37.354Z [jfxia] [INFO ] [] [extractor:185 ] [UnnamedContext ] Encountered release info file 'etc/alpine-release'
2024-08-16T18:09:37.355Z [jfxia] [INFO ] [] [extractor:185 ] [UnnamedContext ] Encountered release info file 'etc/os-release'
2024-08-16T18:09:40.177Z [jfxia] [INFO ] [] [archive_helper:61 ] [BackgroundContext ] SPDX license IDs from licenses.json and exceptions.json were loaded successfully
2024-08-16T18:09:40.445Z [jfxia] [INFO ] [] [golang:113 ] [UnnamedContext ] Couldn't get Go module component info: couldn't get go module name
18:09:40 [Info] Waiting for scan to complete on JFrog Xray...
Reproduction steps
$ skopeo copy --format v2s2 docker://registry:2.8.2 docker-archive:registry_2.8.1.tar
$ jf s registry_2.8.1.tar 
Expected behavior

No response

JFrog CLI-Security version

2.63.2

JFrog CLI version (if applicable)

2.63.2

Operating system type and version

ubuntu 24.04

JFrog Xray version

3.95.7

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue with the skopeo archive command and jf s registry_2.8.1.tar, then trace the CLI security scan entry point for Docker archive handling. Compare the output with the logged manifest.json and repo-tags failure; done means the tar archive is indexed as a container image without falling back to generic tar indexing.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, go
Domain
cli, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.