jfrog / jfrog/jfrog-cli-security
jf scan failed to index tar file as container image and exits with an unexpected exit code
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Describe the bug
jf scan failed to index tar file downloaded with skopeo as container image. I've tried that with oci and v2 format (see logs below). Also the command exits with Scan completed successfully. and exit code 0 wich is unexpected.
Background: I would like to scan container images without running docker cli and docker socket on my agent.
This may be related to jfrog/jfrog-cli-security#350 and jfrog/jfrog-cli-security#340.
Current behavior
# print jf version
$ jf --version
jf version 2.51.1
# download image in oci format
$ skopeo copy --format oci docker://ubuntu:22.04 oci-archive:scan_target_oci.tar
Getting image source signatures
Copying blob aece8493d397 done
Copying config e4c5895818 done
Writing manifest to image destination
Storing signatures
# download image in v2s2 format
$ skopeo copy --format v2s2 docker://ubuntu:22.04 docker-archive:scan_target_v2s2.tar
Getting image source signatures
Copying blob aece8493d397 done
Copying config e4c5895818 done
Writing manifest to image destination
Storing signatures
# scan oci image
$ JFROG_CLI_LOG_LEVEL=DEBUG jf scan scan_target_oci.tar > scan_target_oci_out.txt 2>&1
$ echo $?
0
# scan v2s2 image
$ JFROG_CLI_LOG_LEVEL=DEBUG jf scan scan_target_v2s2.tar > scan_target_v2s2_out.txt 2>&1
$ echo $?
0
I censored our private domain with <**censored**>. Here is the log output:
scan_target_oci_out.txt
scan_target_v2s2_out.txt
Reproduction steps
See Current behavior
Expected behavior
First of all I expected the scan to work because the tar archieves are recognized as container images.
Then I expected the Failed to index tar file as container image to be an ERROR instead of an WARN.
Furthermore I expected the command to fail if such error occurs and exit with a non-zero exit code.
JFrog CLI version
jf version 2.51.1
Operating system type and version
Ubuntu 22.04.3 LTS
JFrog Artifactory version
{"version":"7.68.14","revision":"76814900"}
JFrog Xray version
{"xray_version":"3.85.5","xray_revision":"8ef6b2d"}
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the jf scan command's tar-file indexing and exit-status handling, using the attached OCI and v2s2 logs as reproduction evidence. Verify behavior with the skopeo-generated archives and ensure indexing succeeds or reports an ERROR, with a non-zero exit code when scanning fails.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100