@@ -2062,10 +2062,9 @@ func runContainerResolver(cmd *cobra.Command, directoryPath, containerImageFlag
20622062
20632063 logger .PrintIfVerbose (fmt .Sprintf ("User input container images identified: %v" , strings .Join (containerImagesList , ", " )))
20642064
2065- // Process container images for syft compatibility (strip prefixes as syft does)
2066- processedImages := processContainerImagesForSyft (containerImagesList )
2067- logger .PrintIfVerbose (fmt .Sprintf ("Processed container images for syft: %v" , strings .Join (processedImages , ", " )))
2068- containerImagesList = processedImages
2065+ // Pass images as-is to syft - it needs the prefixes to determine the image source
2066+ // Examples: "oci-dir:my-alpine-image", "docker:nginx:latest", "file:alpine.tar"
2067+ logger .PrintIfVerbose (fmt .Sprintf ("Container images will be passed to syft: %v" , strings .Join (containerImagesList , ", " )))
20692068 }
20702069 if containerResolveLocally || len (containerImagesList ) > 0 {
20712070 containerResolverErr := containerResolver .Resolve (directoryPath , directoryPath , containerImagesList , debug )
@@ -2076,64 +2075,6 @@ func runContainerResolver(cmd *cobra.Command, directoryPath, containerImageFlag
20762075 return nil
20772076}
20782077
2079- // processContainerImagesForSyft processes container image references using syft's scheme extraction logic.
2080- // Container-security scan-type related function.
2081- // This function strips known prefixes (docker:, podman:, file:, etc.) from image references
2082- // to match syft/stereoscope's expected input format.
2083- func processContainerImagesForSyft (images []string ) []string {
2084- var processedImages []string
2085-
2086- // Define known source provider tags (based on syft/stereoscope providers)
2087- knownSources := []string {
2088- "file" , "dir" , "docker" , "podman" , "containerd" , "registry" ,
2089- "docker-archive" , "oci-archive" , "oci-dir" , "singularity" ,
2090- }
2091-
2092- for _ , image := range images {
2093- // Use the same scheme extraction logic as syft/stereoscope
2094- source , strippedInput := extractSchemeSource (image , knownSources )
2095-
2096- var processedImage string
2097- if source != "" {
2098- // Valid scheme found - use the stripped input (like syft does)
2099- processedImage = strippedInput
2100- } else {
2101- // No valid scheme - pass the original input unchanged
2102- processedImage = image
2103- }
2104-
2105- processedImages = append (processedImages , processedImage )
2106- }
2107-
2108- return processedImages
2109- }
2110-
2111- // extractSchemeSource mimics stereoscope.ExtractSchemeSource behavior.
2112- // Container-security scan-type related function.
2113- // This function extracts and validates source prefixes from container image references.
2114- func extractSchemeSource (userInput string , sources []string ) (source , newInput string ) {
2115- const SchemeSeparator = ":"
2116- const minPartsForScheme = 2
2117- const schemePartIndex = 0
2118- const inputPartIndex = 1
2119-
2120- parts := strings .SplitN (userInput , SchemeSeparator , minPartsForScheme )
2121- if len (parts ) < minPartsForScheme {
2122- return "" , userInput
2123- }
2124-
2125- // Check if the first part is a valid source hint
2126- sourceHint := strings .TrimSpace (strings .ToLower (parts [schemePartIndex ]))
2127- for _ , validSource := range sources {
2128- if sourceHint == validSource {
2129- return sourceHint , parts [inputPartIndex ]
2130- }
2131- }
2132-
2133- // No valid scheme found
2134- return "" , userInput
2135- }
2136-
21372078func uploadZip (uploadsWrapper wrappers.UploadsWrapper , zipFilePath string , unzip , userProvidedZip bool , featureFlagsWrapper wrappers.FeatureFlagsWrapper ) (
21382079 url , zipPath string ,
21392080 err error ,
@@ -2315,10 +2256,10 @@ func enforceLocalResolutionForTarFiles(cmd *cobra.Command) error {
23152256func isTarFileReference (imageRef string ) bool {
23162257 // Known prefixes that might precede the actual file path
23172258 knownPrefixes := []string {
2318- "docker-archive:" ,
2319- "oci-archive:" ,
2320- "file:" ,
2321- "oci-dir:" ,
2259+ dockerArchivePrefix ,
2260+ ociArchivePrefix ,
2261+ filePrefix ,
2262+ ociDirPrefix ,
23222263 }
23232264
23242265 // First, trim quotes from the entire input
@@ -3528,6 +3469,19 @@ func validateCreateScanFlags(cmd *cobra.Command) error {
35283469 return nil
35293470}
35303471
3472+ // Container image prefix constants for validation
3473+ const (
3474+ dockerPrefix = "docker:"
3475+ podmanPrefix = "podman:"
3476+ containerdPrefix = "containerd:"
3477+ registryPrefix = "registry:"
3478+ dockerArchivePrefix = "docker-archive:"
3479+ ociArchivePrefix = "oci-archive:"
3480+ ociDirPrefix = "oci-dir:"
3481+ filePrefix = "file:"
3482+ dirPrefix = "dir:"
3483+ )
3484+
35313485// validateContainerImageFormat validates container image references for the --container-images flag.
35323486// Container-security scan-type related function.
35333487// This function implements comprehensive validation logic for all supported container image formats:
@@ -3538,18 +3492,18 @@ func validateCreateScanFlags(cmd *cobra.Command) error {
35383492func validateContainerImageFormat (containerImage string ) error {
35393493 // Define known sources (prefixes) for container image references
35403494 knownSources := []string {
3541- "docker:" ,
3542- "podman:" ,
3543- "containerd:" ,
3544- "registry:" ,
3545- "docker-archive:" ,
3546- "oci-archive:" ,
3547- "oci-dir:" ,
3548- "file:" ,
3495+ dockerPrefix ,
3496+ podmanPrefix ,
3497+ containerdPrefix ,
3498+ registryPrefix ,
3499+ dockerArchivePrefix ,
3500+ ociArchivePrefix ,
3501+ ociDirPrefix ,
3502+ filePrefix ,
35493503 }
35503504
35513505 // Check for explicitly forbidden prefixes first
3552- if strings .HasPrefix (containerImage , "dir:" ) {
3506+ if strings .HasPrefix (containerImage , dirPrefix ) {
35533507 return errors .Errorf ("Invalid value for --container-images flag. The 'dir:' prefix is not supported as it would scan entire directories rather than a single image" )
35543508 }
35553509
@@ -3622,11 +3576,11 @@ func validateContainerImageFormat(containerImage string) error {
36223576 if hasKnownSource {
36233577 prefix := getPrefixFromInput (containerImage , knownSources )
36243578 // oci-dir can reference directories without tags, validate it
3625- if prefix == "oci-dir:" {
3579+ if prefix == ociDirPrefix {
36263580 return validatePrefixedContainerImage (containerImage , prefix )
36273581 }
36283582 // Archive prefixes (file:, docker-archive:, oci-archive:) can reference files without tags
3629- if prefix == "file:" || prefix == "docker-archive:" || prefix == "oci-archive:" {
3583+ if prefix == filePrefix || prefix == dockerArchivePrefix || prefix == ociArchivePrefix {
36303584 return validatePrefixedContainerImage (containerImage , prefix )
36313585 }
36323586 }
@@ -3664,13 +3618,13 @@ func validatePrefixedContainerImage(containerImage, prefix string) error {
36643618
36653619 // Delegate to specific validators based on prefix type
36663620 switch prefix {
3667- case "docker-archive:" , "oci-archive:" , "file:" :
3621+ case dockerArchivePrefix , ociArchivePrefix , filePrefix :
36683622 return validateArchivePrefix (imageRef )
3669- case "oci-dir:" :
3623+ case ociDirPrefix :
36703624 return validateOCIDirPrefix (imageRef )
3671- case "registry:" :
3625+ case registryPrefix :
36723626 return validateRegistryPrefix (imageRef )
3673- case "docker:" , "podman:" , "containerd:" :
3627+ case dockerPrefix , podmanPrefix , containerdPrefix :
36743628 return validateDaemonPrefix (imageRef , prefix )
36753629 default :
36763630 return nil
0 commit comments