normalizeImageID

Signed-off-by: David Wertenteil <dwertent@armosec.io> update regex Signed-off-by: David Wertenteil <dwertent@armosec.io>
kubescape · Jun 3, 2024 · d1c2ac4 · d1c2ac4
1 parent 29d3345
commit d1c2ac4
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 9 deletions.
diff --git a/adapters/v1/syft.go b/adapters/v1/syft.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"regexp"
 	"runtime"
 	"strings"
 	"time"
@@ -35,6 +36,10 @@ type SyftAdapter struct {
 	scanTimeout  time.Duration
 }
 
+const digestDelim = "@"
+
+var hashPattern = regexp.MustCompile(`^(.*@)?sha256:[a-f0-9]{64}$`)
+
 var _ ports.SBOMCreator = (*SyftAdapter)(nil)
 
 // NewSyftAdapter initializes the SyftAdapter struct
@@ -46,22 +51,25 @@ func NewSyftAdapter(scanTimeout time.Duration, maxImageSize int64, maxSBOMSize i
 	}
 }
 
-const digestDelim = "@"
-
 func normalizeImageID(imageID, imageTag string) string {
 	// registry scanning doesn't provide imageID, so we use imageTag as a reference
 	if imageID == "" {
 		return imageTag
 	}
+
+	if !hashPattern.MatchString(imageID) {
+		return imageTag
+	}
 	// try to parse imageID as a full digest
-	if newDigest, err := name.NewDigest(imageID); err == nil {
+	if newDigest, err := name.NewDigest(imageTag); err == nil {
 		return newDigest.String()
 	}
 	// if it's not a full digest, we need to use imageTag as a reference
 	tag, err := name.ParseReference(imageTag)
 	if err != nil {
-		return ""
+		return imageTag
 	}
+
 	// and append imageID as a digest
 	parts := strings.Split(imageID, digestDelim)
 	// filter garbage
@@ -84,6 +92,9 @@ func (s *SyftAdapter) CreateSBOM(ctx context.Context, name, imageID, imageTag st
 	ctx, span := otel.Tracer("").Start(ctx, "SyftAdapter.CreateSBOM")
 	defer span.End()
 
+	if imageTag != "" {
+		imageID = normalizeImageID(imageID, imageTag)
+	}
 	// prepare an SBOM and fill it progressively
 	domainSBOM := domain.SBOM{
 		Name:               name,
@@ -94,10 +105,8 @@ func (s *SyftAdapter) CreateSBOM(ctx context.Context, name, imageID, imageTag st
 		},
 		Labels: tools.LabelsFromImageID(imageID),
 	}
-	if imageTag != "" {
-		imageID = normalizeImageID(imageID, imageTag)
-		domainSBOM.Annotations[helpersv1.ImageTagMetadataKey] = imageTag
-	}
+	domainSBOM.Annotations[helpersv1.ImageTagMetadataKey] = imageTag
+
 	// translate business models into Syft models
 	if options.Platform == "" {
 		options.Platform = runtime.GOARCH

diff --git a/adapters/v1/syft_test.go b/adapters/v1/syft_test.go
@@ -208,7 +208,7 @@ func TestNormalizeImageID(t *testing.T) {
 			name:     "quay.io-kubescape-kubescape-v3.0.3-88a469",
 			imageID:  "86413975e2d0330176894e4f3f5987505ed27b1191f2537797fbbf345b88a469",
 			imageTag: "quay.io/kubescape/kubescape:v3.0.3",
-			want:     "quay.io/kubescape/kubescape@sha256:86413975e2d0330176894e4f3f5987505ed27b1191f2537797fbbf345b88a469",
+			want:     "quay.io/kubescape/kubescape:v3.0.3",
 		},
 		{
 			name:     "registry.k8s.io-kube-scheduler-v1.28.4-3d2c54",