Skip storing image for downloading attestations
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
Research direction
Start at the docker scout attestation get command and trace how it handles the manifest, --predicate, and --predicate-type options; compare that flow with the manifest and SBOM retrieval behavior described for ORAS. Done means attestations can be retrieved without downloading or indexing the full image, while the existing predicate filtering still works.
Written by the indexing model from the issue text.
Description
Right now, when I execute docker scout attestation get --platform linux/amd64 --predicate --predicate-type https://cyclonedx.org/bom/v1.6 <image> it's downloading the whole image with a couple GB, showing Storing image for indexing for some time. When doing docker pull <image> first, that works a lot more reliable, but has the same downside.
Getting the attestation should be quick and easy just using the manifest. No need to do any indexing, right? Using oras I can quickly grab the manifests and the SBOM within seconds, but would need to extract the in-toto statement myself (or at least I didn't find a nicer way like --predicate --predicate-type https://cyclonedx.org/bom/v1.6 on docker-scout).
- Dominant language
- Shell
- Stars
- 454
- Forks
- 134
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from docker/scout-cli
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
-
allstar
Difficulty 2/5 1-3 hours Newbie friendliness 45/100
-
panic: nil deref in createVCS() scanning multi-arch image by tag when no attestation sidecar exists Open
Difficulty 4/5 3-5 days Newbie friendliness 64/100
-
Difficulty 4/5 3-5 days Newbie friendliness 38/100
All issues in docker/scout-cli
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
danielmiessler/LifeOS#2218 ·
-
docs(agents): strengthen the no-backslash-escaped-backticks rule with an issue-creation example Open
Difficulty 1/5 Under an hour Newbie friendliness 92/100
-
package-update
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
oSoWoSo/vOid_Community_repOsitory#148 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
chore
Difficulty 1/5 Under an hour Newbie friendliness 91/100
alunduil/alunduil-chezmoi#792 ·