dockerfile verify command fails when stage names are used in FROM #3880
Description
Description
When a Dockerfile contains a FROM statement using a stage name instead of image, dockerfile verify fails because cosign tries to pull the stage name as if it was an image.
For example, using this Dockerfile:
FROM cgr.dev/chainguard/static:latest AS base_image
# some customization here
FROM base_image
ENTRYPOINT "/executable"running cosign dockerfile verify Dockerfile --certificate-oidc-issuer=https://token.actions.githubusercontent.com --certificate-identity=https://github.com/chainguard-images/images/.github/workflows/release.yaml@refs/heads/main ends with an error:
Extracted image(s): cgr.dev/chainguard/static:latest, base_image
(...)
Error: GET https://index.docker.io/v2/library/base_image/manifests/latest: UNAUTHORIZED: authentication required; [map[Action:pull Class: Name:library/base_image Type:repository]]
main.go:69: error during command execution: GET https://index.docker.io/v2/library/base_image/manifests/latest: UNAUTHORIZED: authentication required; [map[Action:pull Class: Name:library/base_image Type:repository]]
Commenting out FROM base_image in Dockerfile makes it work.
Version
GitVersion: v2.4.0
GitCommit: b5e7dc123a272080f4af4554054797296271e902
GitTreeState: clean
BuildDate: 2024-08-06T21:39:53Z
GoVersion: go1.22.5
Compiler: gc
Platform: linux/amd64