镜像扫描Layer分析对比

解压镜像tar文件 -> 解析manifest.json文件 -> 依次对每一个layer进行处理

f := make(map[string]*bytes.Buffer)// Walk the fs. ReadFile will handle symlink resolution.if err := fs.WalkDir(sys, ".", func(p string, d fs.DirEntry, err error) error {  switch {  case err != nil:    return err  case d.IsDir():    return nil  }  if _, ok := want[p]; !ok {    return nil  }  delete(want, p)  b, err := fs.ReadFile(sys, p)  if err != nil {    return err  }  f[p] = bytes.NewBuffer(b)  return nil}); err != nil {  return nil, err}
// If there's nothing in the "f" map, we didn't find anything.if len(f) == 0 {  return nil, ErrNotFound}return f, nil

// reduce determines which layers should be fetched/scanned and returns these layersfunc reduce(ctx context.Context, store indexer.Store, scnrs indexer.VersionedScanners, layers []*claircore.Layer) ([]*claircore.Layer, error) {  do := []*claircore.Layer{}  for _, l := range layers {    for _, scnr := range scnrs {      ok, err := store.LayerScanned(ctx, l.Hash, scnr)      if err != nil {        zlog.Debug(ctx).          Stringer("layer", l.Hash).          Err(err).          Msg("unable to lookup layer")        return nil, err      }      if !ok {        do = append(do, l)        break      }    }  }  return do, nil}

func (a Applier) ApplyLayers(imageID string, layerKeys []string) (types.ArtifactDetail, error) {  var mergedKey string  // Try to restore the merged layer if the feature is enabled    if a.cacheMergedLayer {    var err error    mergedKey, err = calcMergedKey(layerKeys)    if err != nil {      return types.ArtifactDetail{}, xerrors.Errorf("failed to calculate a merged key: %w", err)    }    if b, err := a.cache.GetBlob(mergedKey); err == nil {      return b.ToArtifactDetail(), nil    }  }  var layers []types.BlobInfo  for _, key := range layerKeys {        // 查看每一个layer是否含有缓存    blob, _ := a.cache.GetBlob(key) // nolint    if blob.SchemaVersion == 0 {      return types.ArtifactDetail{}, xerrors.Errorf("layer cache missing: %s", key)    }    layers = append(layers, blob)  }
  mergedLayer := ApplyLayers(layers)  if mergedLayer.OS == nil {    return mergedLayer, analyzer.ErrUnknownOS // send back package and apps info regardless  } else if mergedLayer.Packages == nil {    return mergedLayer, analyzer.ErrNoPkgsDetected // send back package and apps info regardless  }    // 查看镜像是否被缓存  imageInfo, _ := a.cache.GetArtifact(imageID) // nolint  mergedLayer.HistoryPackages = imageInfo.HistoryPackages
  // Store the merged layer if the feature is enabled  if a.cacheMergedLayer {    if err := a.cache.PutBlob(mergedKey, mergedLayer.ToBlobInfo()); err != nil {      log.Logger.Error("Unable to cache the merged layer: %s", err)    }  }
  return mergedLayer, nil

通过Docker cli拿到存储镜像的文件句柄 -> 将文件句柄解压到临时文件夹中 -> 将每一层的layer统一解压到制定的文件夹中 -> 分析供应链组建信息 -> 删除文件夹

// Walk ignore the file which is vert largefunc Walk(tarReader *tar.Reader, path string) error {  for hdr, err := tarReader.Next(); err != io.EOF; hdr, err = tarReader.Next() {    if err != nil {      return err    }
    extractFile := filepath.Join(path, hdr.Name)
    // ignore the file larger than 1GB    if hdr.Size > 1073741824 {      continue    }
    switch hdr.Typeflag {    case tar.TypeDir:      if !exists(extractFile) {        if err := os.MkdirAll(extractFile, 0775); err != nil {          return err        }      }    case tar.TypeReg:      file, err := os.OpenFile(extractFile, os.O_CREATE|os.O_RDWR, os.FileMode(hdr.Mode))      if err != nil {        continue      }      _, err = io.Copy(file, tarReader)      if err != nil {        log.Printf("file %s can not extract: %v", hdr.Name, err)      }    default:      // ignore    }  }  return nil}

项目地址: https://github.com/kvesta/vesta