From 8415adde363f1c46d01f5d82a3a152a4f959bb3f Mon Sep 17 00:00:00 2001
From: Christopher Biggs <christopher.l.biggs@gmail.com>
Date: Mon, 14 Sep 2026 09:51:09 -0400
Subject: [PATCH] fix: normalize Docker image IDs before export

---
 cvetools/image.go      | 10 +++++++++-
 cvetools/image_test.go | 36 ++++++++++++++++++++++++++++++++++++
 2 files changed, 45 insertions(+), 1 deletion(-)
 create mode 100644 cvetools/image_test.go

diff --git a/cvetools/image.go b/cvetools/image.go
index 501ebac8a..212d1854a 100644
--- a/cvetools/image.go
+++ b/cvetools/image.go
@@ -61,6 +61,13 @@ func parseSocketFromRepo(repo string) (string, string) {
 	return "", repo
 }
 
+func dockerImageSaveID(id string) string {
+	if len(id) == 64 {
+		return "sha256:" + id
+	}
+	return id
+}
+
 func (s *ScanTools) GetLocalImageMeta(ctx context.Context, repository, tag string) (*container.ImageMeta, share.ScanErrorCode) {
 	sock, repo := parseSocketFromRepo(repository)
 	if sock == "" {
@@ -119,7 +126,7 @@ func (s *ScanTools) LoadLocalImage(ctx context.Context, repository, tag, imgPath
 		return nil, nil, nil, share.ScanErrorCode_ScanErrContainerAPI
 	}
 
-	file, err := rt.GetImageFile(meta.ID)
+	file, err := rt.GetImageFile(dockerImageSaveID(meta.ID))
 	if err != nil {
 		log.WithFields(log.Fields{"error": err}).Error("Failed to get image")
 		if errdefs.IsNotFound(err) {
@@ -861,3 +868,4 @@ func getSignatureDataForImage(ctx context.Context, rc *scan.RegClient, repo, dig
 	s.Manifest = string(info.RawManifest)
 	return s, share.ScanErrorCode_ScanErrNone
 }
+
diff --git a/cvetools/image_test.go b/cvetools/image_test.go
new file mode 100644
index 000000000..b2c1b57d1
--- /dev/null
+++ b/cvetools/image_test.go
@@ -0,0 +1,36 @@
+package cvetools
+
+import "testing"
+
+func TestDockerImageSaveID(t *testing.T) {
+	tests := []struct {
+		name string
+		id   string
+		want string
+	}{
+		{
+			name: "bare sha256",
+			id:   "fd791d74b68913cbb027c6546007b3f0d3bc45125f797758156952bc2d6daf40",
+			want: "sha256:fd791d74b68913cbb027c6546007b3f0d3bc45125f797758156952bc2d6daf40",
+		},
+		{
+			name: "canonical sha256",
+			id:   "sha256:fd791d74b68913cbb027c6546007b3f0d3bc45125f797758156952bc2d6daf40",
+			want: "sha256:fd791d74b68913cbb027c6546007b3f0d3bc45125f797758156952bc2d6daf40",
+		},
+		{
+			name: "short image ID",
+			id:   "fd791d74b689",
+			want: "fd791d74b689",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := dockerImageSaveID(tt.id); got != tt.want {
+				t.Fatalf("dockerImageSaveID(%q) = %q, want %q", tt.id, got, tt.want)
+			}
+		})
+	}
+}
+