Skip to content

BUG: Dockerfile named build stages with incomplete remediation report #2906

@gabibguti

Description

@gabibguti

Describe the bug

Pinned-Dependencies check does not correctly report the remediation for snippets such as FROM alpine as build in Dockerfiles.

Using named build stages as in FROM alpine as build results in a incomplete remediation report:

Warn: containerImage not pinned by hash: Dockerfile:{line}

While using FROM alpine results in a complete remediation report:

Warn: containerImage not pinned by hash: Dockerfile:{line}: pin your Docker image by updating alpine to alpine@sha256:124c7d2707904eea7431fffe91522a01e5a861a624ee31d03372cc1d138a3126

Reproduction steps
Steps to reproduce the behavior:

  1. Create a Dockerfile with 2 lines, one FROM alpine as build and another FROM alpine.
  2. Run [email protected] detailed report
  3. Check Pinned-Dependencies check details
  4. Verify in report the FROM alpine as build line does NOT report the remediation suggesting the sha256
  5. Verify in report the FROM alpine line does report the remediation suggesting the sha256

Expected behavior
I expect FROM alpine as build example and other named build stages to report the remediation suggesting the sha256.

Additional context
None.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    Status

    Backlog - Bugs

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions