oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-30 14:02:26 +01:00
Code Issues Packages Projects Releases Wiki Activity

855 attest registry source only (#856)

Browse Source 
Add source.NewFromRegistry function so that the syft attest command can always explicitly ask for an OCIRegistry provider rather than rely on local daemon detection for image sources.

Attestation can not be used where local images loaded in a daemon are the source. Digest values for the layer identification step in attestation can sometimes vary across workstations.

This fix makes it so that attest is generating an SBOM for, and attesting to, a source that exists in an OCI registry. It should never load a source from a local user docker/podman daemon.

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
This commit is contained in:
Christopher Angelo Phillips
2022-03-01 23:16:42 -05:00
committed by GitHub
co-authored by Alex Goodman
parent edac8c7bf7
commit afc0c1acd9
17 changed files with 459 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/integration/catalog_packages_test.go
+5 -1
View File
@@ -1,6 +1,7 @@
package integration
import (
"github.com/stretchr/testify/require"
"testing"
"github.com/anchore/syft/syft/linux"
@@ -22,7 +23,10 @@ func BenchmarkImagePackageCatalogers(b *testing.B) {
var pc *pkg.Catalog
for _, c := range cataloger.ImageCatalogers(cataloger.DefaultConfig()) {
// in case of future alteration where state is persisted, assume no dependency is safe to reuse
theSource, cleanupSource, err := source.New("docker-archive:"+tarPath, nil, nil)
userInput := "docker-archive:" + tarPath
sourceInput, err := source.ParseInput(userInput, false)
require.NoError(b, err)
theSource, cleanupSource, err := source.New(*sourceInput, nil, nil)
b.Cleanup(cleanupSource)
if err != nil {
b.Fatalf("unable to get source: %+v", err)
test/integration/utils_test.go
+11 -9
View File
@@ -1,6 +1,7 @@
package integration
import (
"github.com/stretchr/testify/require"
"testing"
"github.com/anchore/syft/syft/pkg/cataloger"
@@ -15,12 +16,12 @@ import (
func catalogFixtureImage(t *testing.T, fixtureImageName string) (sbom.SBOM, *source.Source) {
imagetest.GetFixtureImage(t, "docker-archive", fixtureImageName)
tarPath := imagetest.GetFixtureImageTarPath(t, fixtureImageName)
theSource, cleanupSource, err := source.New("docker-archive:"+tarPath, nil, nil)
userInput := "docker-archive:" + tarPath
sourceInput, err := source.ParseInput(userInput, false)
require.NoError(t, err)
theSource, cleanupSource, err := source.New(*sourceInput, nil, nil)
t.Cleanup(cleanupSource)
if err != nil {
t.Fatalf("unable to get source: %+v", err)
}
require.NoError(t, err)
// TODO: this would be better with functional options (after/during API refactor)
c := cataloger.DefaultConfig()
@@ -50,11 +51,12 @@ func catalogFixtureImage(t *testing.T, fixtureImageName string) (sbom.SBOM, *sou
}
func catalogDirectory(t *testing.T, dir string) (sbom.SBOM, *source.Source) {
theSource, cleanupSource, err := source.New("dir:"+dir, nil, nil)
userInput := "dir:" + dir
sourceInput, err := source.ParseInput(userInput, false)
require.NoError(t, err)
theSource, cleanupSource, err := source.New(*sourceInput, nil, nil)
t.Cleanup(cleanupSource)
if err != nil {
t.Fatalf("unable to get source: %+v", err)
}
require.NoError(t, err)
// TODO: this would be better with functional options (after/during API refactor)
c := cataloger.DefaultConfig()