test: add e2e os/chisel test

Author: zhijie-yang

cmd/osv-scanner/scan/image/command_test.go

@@ -363,6 +363,14 @@ func TestCommand_OCIImage(t *testing.T) {
 			},
 			Exit: 1,
 		},
+		{
+			Name: "scanning_insecure_chiseled_ubuntu_image",
+			Args: []string{
+				"", "image",
+				"--archive", "./testdata/test-chisel.tar",
+			},
+			Exit: 1,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.Name, func(t *testing.T) {
@@ -499,6 +507,20 @@ func TestCommand_OCIImage_JSONFormat(t *testing.T) {
 				testutility.AnyDiffID,
 			},
 		},
+		{
+			Name: "scanning_insecure_chiseled_ubuntu_image",
+			Args: []string{
+				"", "image", "--format=json",
+				"--archive", "./testdata/test-chisel.tar",
+			},
+			Exit: 1,
+			ReplaceRules: []testutility.JSONReplaceRule{
+				testutility.GroupsAsArrayLen,
+				testutility.OnlyIDVulnsRule,
+				testutility.OnlyFirstBaseImage,
+				testutility.AnyDiffID,
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.Name, func(t *testing.T) {

cmd/osv-scanner/scan/image/testdata/test-chisel.Dockerfile

@@ -0,0 +1,23 @@
+FROM ubuntu:26.04@sha256:f3d28607ddd78734bb7f71f117f3c6706c666b8b76cbff7c9ff6e5718d46ff64 AS builder
+
+RUN apt install --update -y curl wget
+
+# Deb arch to GOARCH
+RUN arch="$(dpkg --print-architecture | sed -e 's/armhf/arm/g' -e 's/ppc64el/ppc64le/g')" && \
+    curl -s https://api.github.com/repos/canonical/chisel/releases/latest \
+        | awk "/browser_download_url/ && /chisel_v/ && /_$arch\./" \
+        | cut -d : -f 2,3 \
+        | tr -d \" \
+        | xargs wget
+
+RUN sha384sum -c chisel_v*sha384
+RUN tar -xf chisel_v*tar.gz -C /usr/local/bin
+RUN mkdir /rootfs && \
+    chisel cut --root /rootfs \
+        base-files_base \
+        base-files_chisel \
+        base-files_release-info \
+        golang_core
+
+FROM scratch
+COPY --from=builder /rootfs/ /