[clbiggs]

Description

Fix local image scanning when Docker uses the containerd image store.

With the containerd image store, Docker may return an image ID as a bare 64-character SHA-256 value. Newer Docker versions reject that value when it is passed to the image-save API without the sha256: prefix:

invalid repository name (...), cannot specify 64-byte hexadecimal strings

Fix neuvector/neuvector#2508

Test

go test ./cvetools
Result:
ok github.com/neuvector/scanner/cvetools

Additional Information

• Prefix bare 64-character image IDs with sha256: before calling GetImageFile.
• Preserve image IDs that already include the digest algorithm.
• Preserve short image IDs.
• Add unit tests for each form.
  This keeps the existing behavior for the overlay2 image store while allowing locally cached images to be scanned when Docker uses the containerd image store.

[pohanhuang]

Thanks for contribution, this is a good fouding!

[pohanhuang]

Suggested change

	func dockerImageSaveID(id string) string {
	if len(id) == 64 {
	return "sha256:" + id
	}
	return id
	}
	const sha256Prefix = "sha256:"
	func dockerImageSaveID(id string) string {
	if d, err := goDigest.Parse(id); err == nil {
	return d.String()
	}
	if d, err := goDigest.Parse(sha256Prefix + id); err == nil {
	return d.String()
	}
	return id
	}

[pohanhuang]

@clbiggs are you still working on this issue?

[pohanhuang]

Closing this for the issue has been resolve in #597