jfrog / jfrog/jfrog-cli-security
jf scan failed to index tar file as container image
Open
Nobody has claimed this yet.
bug
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Describe the bug
source: https://github.com/jfrog/jfrog-cli-security/issues/334
$ jf -v
jf version 2.63.2
Current behavior
$ jf s ./artifacts/images/registry_2.8.1.tar
18:09:33 [Info] JFrog Xray version is: 3.95.7
18:09:33 [Info] [Thread 2] Indexing file: ./artifacts/images/registry_2.8.1.tar
18:09:40 [Info] 2024/08/16 18:09:33 maxprocs: Leaving GOMAXPROCS=8: CPU quota undefined
2024-08-16T18:09:37.334Z [jfxia] [WARN ] [] [docker_tar:74 ] [UnnamedContext ] Failed to index tar file as container image, continue to generic tar indexer. Error: failed to analyze docker tar archive
--- at /go/src/jfrog.com/xray/xray/backend/backend/indexer/indexer_core/docker_tar.go:134 (DockerTarOpener.analyzeTarAsContainer) ---
Caused by: failed to read manifest.json found in tar
--- at /go/src/jfrog.com/xray/xray/backend/backend/indexer/indexer_core/docker_tar.go:192 (DockerTarOpener.handleDockerManifestFile) ---
Caused by: manifest has no repo tags
--- at /go/src/jfrog.com/xray/xray/backend/backend/indexer/indexer_core/docker_tar.go:218 (prepareDockerManifestOnDemandData) ---
2024-08-16T18:09:37.354Z [jfxia] [INFO ] [] [extractor:185 ] [UnnamedContext ] Encountered release info file 'etc/alpine-release'
2024-08-16T18:09:37.355Z [jfxia] [INFO ] [] [extractor:185 ] [UnnamedContext ] Encountered release info file 'etc/os-release'
2024-08-16T18:09:40.177Z [jfxia] [INFO ] [] [archive_helper:61 ] [BackgroundContext ] SPDX license IDs from licenses.json and exceptions.json were loaded successfully
2024-08-16T18:09:40.445Z [jfxia] [INFO ] [] [golang:113 ] [UnnamedContext ] Couldn't get Go module component info: couldn't get go module name
18:09:40 [Info] Waiting for scan to complete on JFrog Xray...
Reproduction steps
$ skopeo copy --format v2s2 docker://registry:2.8.2 docker-archive:registry_2.8.1.tar
$ jf s registry_2.8.1.tar
Expected behavior
No response
JFrog CLI-Security version
2.63.2
JFrog CLI version (if applicable)
2.63.2
Operating system type and version
ubuntu 24.04
JFrog Xray version
3.95.7
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue with the skopeo archive command and jf s registry_2.8.1.tar, then trace the CLI security scan entry point for Docker archive handling. Compare the output with the logged manifest.json and repo-tags failure; done means the tar archive is indexed as a container image without falling back to generic tar indexing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100