imjasonh

container-report

This is an experimental tool that emits a JSON report of the contents of an image.

It's current intended use is to be passed two images and to have their reports diffed using diff.

Example:

imjasonh

function gauth() {
  gcloud auth login && gcloud auth application-default login
}

# Diff two image filesystems
function cdiff-fs() {
  diff \
    <(crane export $1 - --platform ${3:-linux/amd64} | tar -tvf - | sort) \
    <(crane export $2 - --platform ${3:-linux/amd64} | tar -tvf - | sort)
}

imjasonh

# Diff two image filesystems
function cdiff-fs() {
  diff \
    <(crane export $1 - --platform ${3:-linux/amd64} | tar -tvf - | sort) \
    <(crane export $2 - --platform ${3:-linux/amd64} | tar -tvf - | sort)
}
# Diff two image configs
function cdiff-cfg() {
  diff \
    <(crane config $1 --platform ${3:-linux/amd64} | jq) \

imjasonh

$ crane export alpine - | tar -Oxf - etc/os-release
NAME="Alpine Linux"
ID=alpine
VERSION_ID=3.16.1
PRETTY_NAME="Alpine Linux v3.16"
HOME_URL="https://alpinelinux.org/"
BUG_REPORT_URL="https://gitlab.alpinelinux.org/alpine/aports/-/issues"

$ crane export ghcr.io/distroless/alpine-base - | tar -Oxf - etc/os-release
ID=alpine

imjasonh

package main

import (
	"fmt"
	"log"

	"github.com/google/go-containerregistry/pkg/authn"
	"github.com/google/go-containerregistry/pkg/crane"
	"github.com/google/go-containerregistry/pkg/v1/google"
)

imjasonh

diff ../cosign/cmd/cosign/cli/fulcio/fulcioroots/fulcioroots.go pkg/fulcioroots/fulcioroots.go
2c2
< // Copyright 2021 The Sigstore Authors.
---
> // Copyright 2022 The Sigstore Authors.
24d23
< 	"os"
27d25
< 	"github.com/sigstore/cosign/pkg/cosign/tuf"
28a27

imjasonh

package glob_test

import (
	"fmt"
	"regexp"
	"strings"
	"testing"

	"github.com/google/go-containerregistry/pkg/name"
)

imjasonh

tknviz
.vscode/

imjasonh

build:
	GOOS=linux go build ./

imjasonh

sget-test