From 7bccdadb9adebf1805e0df9b49f54e9797661b14 Mon Sep 17 00:00:00 2001
From: kitsdk <kitsdk@163.com>
Date: Wed, 23 Sep 2026 14:48:15 +0800
Subject: [PATCH] fix: qualify local image IDs for export

---
 cvetools/image.go      | 14 +++++++++++++-
 cvetools/image_test.go | 43 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 56 insertions(+), 1 deletion(-)
 create mode 100644 cvetools/image_test.go

diff --git a/cvetools/image.go b/cvetools/image.go
index 82b62569f..4cea1b524 100644
--- a/cvetools/image.go
+++ b/cvetools/image.go
@@ -61,6 +61,18 @@ func parseSocketFromRepo(repo string) (string, string) {
 	return "", repo
 }
 
+func dockerImageSaveRef(id string) string {
+	if len(id) != goDigest.SHA256.Size()*2 {
+		return id
+	}
+
+	digest := goDigest.Digest(goDigest.SHA256.String() + ":" + id)
+	if err := digest.Validate(); err != nil {
+		return id
+	}
+	return digest.String()
+}
+
 func (s *ScanTools) GetLocalImageMeta(ctx context.Context, repository, tag string) (*container.ImageMeta, share.ScanErrorCode) {
 	sock, repo := parseSocketFromRepo(repository)
 	if sock == "" {
@@ -119,7 +131,7 @@ func (s *ScanTools) LoadLocalImage(ctx context.Context, repository, tag, imgPath
 		return nil, nil, nil, share.ScanErrorCode_ScanErrContainerAPI
 	}
 
-	file, err := rt.GetImageFile(meta.ID)
+	file, err := rt.GetImageFile(dockerImageSaveRef(meta.ID))
 	if err != nil {
 		log.WithFields(log.Fields{"error": err}).Error("Failed to get image")
 		if errdefs.IsNotFound(err) {
diff --git a/cvetools/image_test.go b/cvetools/image_test.go
new file mode 100644
index 000000000..bbc076963
--- /dev/null
+++ b/cvetools/image_test.go
@@ -0,0 +1,43 @@
+package cvetools
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestDockerImageSaveRef(t *testing.T) {
+	tests := []struct {
+		name string
+		id   string
+		want string
+	}{
+		{
+			name: "bare sha256 digest",
+			id:   strings.Repeat("a", 64),
+			want: "sha256:" + strings.Repeat("a", 64),
+		},
+		{
+			name: "prefixed sha256 digest",
+			id:   "sha256:" + strings.Repeat("b", 64),
+			want: "sha256:" + strings.Repeat("b", 64),
+		},
+		{
+			name: "image name",
+			id:   "nginx:latest",
+			want: "nginx:latest",
+		},
+		{
+			name: "invalid bare digest",
+			id:   strings.Repeat("z", 64),
+			want: strings.Repeat("z", 64),
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			require.Equal(t, tt.want, dockerImageSaveRef(tt.id))
+		})
+	}
+}