fix: return proper image digest #2310
Conversation
Trivy Operator incorrectly reported imageID as image digest. Fixes aquasecurity#2259
| // - image ID (this is what is visible in 'docker image ls command') | ||
| // Execute docker image ls --digests --no-trunc <image> to see both digest and ID. | ||
| // See https://stackoverflow.com/questions/56364643/whats-the-difference-between-a-docker-images-image-id-and-its-digest | ||
| var imageDigest = strings.Split(reports.Metadata.RepoDigests[0], "@")[1] |
There was a problem hiding this comment.
@d-mankowski-synerise any reason to strip the sha256@ prefix?
There was a problem hiding this comment.
copying from the issue you raised:
"RepoDigests": [
"<registry>/<image repo>@sha256:cf3e3b3a98edde46eac58d4745a2467b9da2bc49a11191565a893ffac38034a3"
],
so it is not stripping sha256 prefix, but <registry>/<repo>@ part
There was a problem hiding this comment.
ohh, right! mixed up the delimiters 👍🏼
| @@ -5,7 +5,10 @@ | |||
| "Family": "alpine", | |||
| "Name": "3.10.2", | |||
| "EOSL": true | |||
| } | |||
| }, | |||
| "RepoDigests": [ | |||
There was a problem hiding this comment.
not really sure why RepoDigests and other parameters are not included in this report (which, I assume, is the output of trivy i --format json alpine:3.10.2)
There was a problem hiding this comment.
yeah, looks like the fixture is incomplete, might have been generated with an older version of Trivy?
|
looks like a bunch of tests need to be updated to account for the image digest: https://github.com/aquasecurity/trivy-operator/actions/runs/11804608055/job/32885192536?pr=2310 should be fairly simple to fix |
Trivy Operator incorrectly reported imageID as image digest.
Fixes #2259
Description
Related issues
Remove this section if you don't have related PRs.
Checklist