[zhanglt]

Summary

• qualify bare 64-character SHA256 image IDs before passing them to the Docker ImageSave API
• preserve already-qualified digests, image names, and invalid digest-like values
• add table-driven regression coverage for image save reference normalization

Problem

The Docker driver strips the sha256: prefix from local image metadata. LoadLocalImage then passes that bare ID to ImageSave. Docker 29.1.3 rejects a bare 64-character hexadecimal value with:

invalid repository name (...), cannot specify 64-byte hexadecimal strings

Restoring the sha256: prefix for valid bare SHA256 IDs allows the local image export to succeed while leaving other references unchanged.

Verification

• go test ./cvetools -run TestDockerImageSaveRef -count=1
• go test ./common ./cvetools ./detectors ./cmd/scanner
• make test
• reproduced with Docker 29.1.3: saving the bare ID failed, while saving the same ID with the sha256: prefix completed with exit code 0

[pohanhuang]

duplicate #587

[pohanhuang]

Thanks for the contribution.

[pohanhuang]

Suggested change

	func dockerImageSaveRef(id string) string {
	if len(id) != goDigest.SHA256.Size()*2 {
	return id
	}
	digest := goDigest.Digest(goDigest.SHA256.String() + ":" + id)
	if err := digest.Validate(); err != nil {
	return id
	}
	return digest.String()
	}
	const sha256Prefix = "sha256:"
	func dockerImageSaveID(id string) string {
	if d, err := goDigest.Parse(id); err == nil {
	return d.String()
	}
	if d, err := goDigest.Parse(sha256Prefix + id); err == nil {
	return d.String()
	}
	return id
	}

[pohanhuang]

@zhanglt are you still working on this issue?

[pohanhuang]

Closing this for the issue has been resolve in #597