search

tern-tools / tern

Tern is a software composition analysis tool and Python library that generates a Software Bill of Materials for container images and Dockerfiles. The SBOM that Tern generates will give you a layer-by-layer view of what's inside your container in a variety of formats including human-readable, JSON, HTML, SPDX and more.
BSD 2-Clause "Simplified" License
960 stars 188 forks source link

Error while trying to inspect local image #1190

Closed Ruivalim closed 1 year ago

Ruivalim commented 1 year ago

I'm trying to use Tern to inspect a local image but I'm getting an authentication error. Lets say the image tag is project:v1 and when I run tern report -i project:v1 I get this error:

2022-11-08 12:50:33,081 - ERROR - skopeo - Error when downloading image: "b'time="2022-11-08T12:50:33Z" level=fatal msg="initializing source docker://project:v1: reading manifest v1 in docker.io/library/project: errors:\\ndenied: requested access to the resource is denied\\nunauthorized: authentication required\\n"\n'"

But the image is present in my local registry and I can run it use any problems.

Tern version 2.10.1 python version = 3.8.10 (default, Jun 22 2022, 20:18:18)

Ruivalim commented 1 year ago

Skopeo has support for local images. The command skopeo copy --src-tls-verify=false docker-daemon:project:v1 dir:/root/.tern/temp works. But if I try to use the docker-daemon: on the image name in tern, it breaks because it generates this: 2022-11-08 12:55:17,224 - DEBUG - rootfs - Running command: skopeo copy --src-tls-verify=false docker://docker-daemon:project:v1 dir:/root/.tern/temp 2022-11-08 12:55:17,242 - ERROR - skopeo - Error when downloading image: "b'time="2022-11-08T12:55:17Z" level=fatal msg="Invalid source name docker://docker-daemon:project:v1: invalid reference format"\n'"

Ruivalim commented 1 year ago

I made a fix for the issue, here's the pull request: https://github.com/tern-tools/tern/pull/1191

Feel free to ask me to change anything, I tried to make the change concise as possible.

Now the command tern report -i docker-daemon:project:v1 will work and tern will use the image present in the local registry.

Ruivalim commented 1 year ago

Fixed on https://github.com/tern-tools/tern/pull/1198