mirror of
https://github.com/anchore/syft.git
synced 2026-10-30 14:02:26 +01:00
29b92a58c1
* feat: add containers-storage support for Podman and Buildah, update tests and documentation Signed-off-by: Bruce Clark <bruce.clark@mandg.com> * test: update containers-storage tests to validate package.json and handle missing images Signed-off-by: Bruce Clark <bruce.clark@mandg.com> * test: fix rootless containers-storage test setup Install uidmap for Podman and Buildah CI jobs. Align temporary rootful and rootless storage paths. Clean up rootless stores within the builder's user namespace. Signed-off-by: Bruce Clark <bruce.clark@mandg.com> * fix: only use containers-storage when explicitly requested - containers-storage is no longer part of automatic image resolution; it's used only for `--from containers-storage`, the `containers-storage:` scheme, or `default-pull-source: containers-storage` (now an accepted value). Opening a store runs full graph driver init (mounts, locks, store writes), which is too invasive as a probe on every plain image reference. - rootless stores must be read from inside the builder's user namespace (`podman unshare syft ...`), documented in the README. - the `containers_image_openpgp` tag is now applied to unit/integration tests and lint, so dev tooling compiles the same provider that ships. - containers-storage CI runs through `make containers-storage-test` and covers both vfs and overlay stores. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix: exclude cgo btrfs driver and unmount overlay store in cleanup - cgo-enabled linux builds (`-race` tests, lint) compile go.podman.io's btrfs graph driver, which needs libbtrfs headers. Add `exclude_graphdriver_btrfs` alongside `containers_image_openpgp` everywhere the tag is set; release builds are `CGO_ENABLED=0` and never included it. - the overlay driver bind-mounts its graphroot inside the rootless user namespace, so the containers-storage test unmounts it before removing the store, and cleanup no longer fails the run. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Bruce Clark <bruce.clark@mandg.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Bruce Clark <bruce.clark@mandg.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
88 lines
2.8 KiB
Go
88 lines
2.8 KiB
Go
package options
|
|
|
|
import (
|
|
"fmt"
|
|
"sort"
|
|
"strings"
|
|
|
|
"github.com/dustin/go-humanize"
|
|
"github.com/scylladb/go-set/strset"
|
|
|
|
"github.com/anchore/clio"
|
|
stereoscopeFile "github.com/anchore/stereoscope/pkg/file"
|
|
"github.com/anchore/syft/syft/source/sourceproviders"
|
|
)
|
|
|
|
type sourceConfig struct {
|
|
Name string `json:"name" yaml:"name" mapstructure:"name"`
|
|
Version string `json:"version" yaml:"version" mapstructure:"version"`
|
|
Supplier string `json:"supplier" yaml:"supplier" mapstructure:"supplier"`
|
|
Source string `json:"source" yaml:"source" mapstructure:"source"`
|
|
BasePath string `yaml:"base-path" json:"base-path" mapstructure:"base-path"` // specify base path for all file paths
|
|
File fileSource `json:"file" yaml:"file" mapstructure:"file"`
|
|
Image imageSource `json:"image" yaml:"image" mapstructure:"image"`
|
|
}
|
|
|
|
type fileSource struct {
|
|
Digests []string `json:"digests" yaml:"digests" mapstructure:"digests"`
|
|
}
|
|
|
|
var _ interface {
|
|
clio.FieldDescriber
|
|
} = (*sourceConfig)(nil)
|
|
|
|
var _ clio.PostLoader = (*imageSource)(nil)
|
|
|
|
func (o *sourceConfig) DescribeFields(descriptions clio.FieldDescriptionSet) {
|
|
descriptions.Add(&o.File.Digests, `the file digest algorithms to use on the scanned file (options: "md5", "sha1", "sha224", "sha256", "sha384", "sha512")`)
|
|
descriptions.Add(&o.Image.DefaultPullSource, `allows users to specify which image source should be used to generate the sbom
|
|
valid values are: registry, docker, podman, containers-storage`)
|
|
}
|
|
|
|
type imageSource struct {
|
|
DefaultPullSource string `json:"default-pull-source" yaml:"default-pull-source" mapstructure:"default-pull-source"`
|
|
MaxLayerSize string `json:"max-layer-size" yaml:"max-layer-size" mapstructure:"max-layer-size"`
|
|
}
|
|
|
|
func defaultSourceConfig() sourceConfig {
|
|
var digests []string
|
|
for _, alg := range sourceproviders.DefaultConfig().DigestAlgorithms {
|
|
digests = append(digests, alg.String())
|
|
}
|
|
return sourceConfig{
|
|
File: fileSource{
|
|
Digests: digests,
|
|
},
|
|
}
|
|
}
|
|
|
|
func (c *fileSource) PostLoad() error {
|
|
digests := strset.New(c.Digests...).List()
|
|
sort.Strings(digests)
|
|
c.Digests = digests
|
|
return nil
|
|
}
|
|
|
|
func (c *imageSource) PostLoad() error {
|
|
if c.MaxLayerSize != "" {
|
|
perFileReadLimit, err := humanize.ParseBytes(c.MaxLayerSize)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
stereoscopeFile.SetPerFileReadLimit(int64(perFileReadLimit))
|
|
}
|
|
return checkDefaultSourceValues(c.DefaultPullSource)
|
|
}
|
|
|
|
var validDefaultSourceValues = []string{"registry", "docker", "podman", "containers-storage", ""}
|
|
|
|
func checkDefaultSourceValues(source string) error {
|
|
validValues := strset.New(validDefaultSourceValues...)
|
|
if !validValues.Has(source) {
|
|
validValuesString := strings.Join(validDefaultSourceValues, ", ")
|
|
return fmt.Errorf("%s is not a valid default source; please use one of the following: %s''", source, validValuesString)
|
|
}
|
|
|
|
return nil
|
|
}
|