Cdxgen tool not working in docker

[Varsha-lalwani]

I have a go plugin where I already have syft to generate sbom, and I am adding cdxgen as well.
I have installed cdxgen using this RUN npm install -g @cyclonedx/cdxgen@9.11.1

While the tool works perfectly fine in my local, when I am creating docker image and running it, I am getting this output and it is not creating the sbom file.

INF sbom generation started format=cyclonedx-json source=autosscauser/varsha-test:cdxgen
2024-01-19 12:03:57 INF cmd output (stdout): Check if the post-installation steps were performed correctly as per this documentation https://docs.docker.com/engine/install/linux-postinstall/
2024-01-19 12:03:57 Check if the post-installation steps were performed correctly as per this documentation https://docs.docker.com/engine/install/linux-postinstall/
2024-01-19 12:03:57 Unable to pull autosscauser/varsha-test:cdxgen. Check if the name is valid. Perform any authentication prior to invoking cdxgen.
2024-01-19 12:03:57 Try manually pulling this image using docker pull autosscauser/varsha-test:cdxgen
2024-01-19 12:03:57 BOM generation has failed due to problems with exporting the image
2024-01-19 12:03:57 
2024-01-19 12:03:57 ERR cmd error output (stderr): Ensure docker/podman service or Docker for Desktop is running. {
2024-01-19 12:03:57   enableUnixSockets: true,
2024-01-19 12:03:57   throwHttpErrors: true,
2024-01-19 12:03:57   method: 'GET',
2024-01-19 12:03:57   prefixUrl: undefined,
2024-01-19 12:03:57   headers: { 'X-Registry-Auth': 'auth' }
2024-01-19 12:03:57 }
2024-01-19 12:03:57 Ensure docker/podman service or Docker for Desktop is running. {
2024-01-19 12:03:57   enableUnixSockets: true,
2024-01-19 12:03:57   throwHttpErrors: true,
2024-01-19 12:03:57   method: 'GET',
2024-01-19 12:03:57   prefixUrl: undefined,
2024-01-19 12:03:57   headers: { 'X-Registry-Auth': 'auth' }
2024-01-19 12:03:57 }

It says it's not able to pull the image while syft is able to pull fine. ANy suggesstions?

Also the other thing I noticed is that cdxgen is not able to create the directory if the path is absent

[prabhu]

@Varsha-lalwani, I think the error message is clear. The image needs to be pulled manually before invoking cdxgen.

[Varsha-lalwani]

@prabhu Is there any plans that cdxgen will pull image itself?

[prabhu]

@Varsha-lalwani, no plans. Let's not complicate this project by making this also a docker cli. Try exploring docker rootless, podman, and even nerdctl which offer ways to pull the image that can be used subsequently for sbom generation

[Varsha-lalwani]

@prabhu I used go-containerregistry library to save the tar file of the image. I am getting this error with cdxgen when I use that tar file.
Error while extracting image /tmp/docker-images-D7v9bA/99862ea1e6fda77f6d7973cec883f2ae5dc92ec72fb4501f4743903fde9c1042.tar.gz to /tmp/docker-images-D7v9bA/all-layers. Please file this bug to the cdxgen repo. https://github.com/CycloneDX/cdxgen/issues
2024-01-23 13:29:45 ------------
2024-01-23 13:29:45 Error: TAR_ENTRY_INFO: stripping / from absolute path
2024-01-23 13:29:45 at UnpackSync.warn (/usr/local/lib/node_modules/@cyclonedx/cdxgen/node_modules/tar/lib/warn-mixin.js:21:40)
2024-01-23 13:29:45 at UnpackSync.warn (/usr/local/lib/node_modules/@cyclonedx/cdxgen/node_modules/tar/lib/unpack.js:229:18)
2024-01-23 13:29:45 at [checkPath] (/usr/local/lib/node_modules/@cyclonedx/cdxgen/node_modules/tar/lib/unpack.js:273:14)
2024-01-23 13:29:45 at [onEntry] (/usr/local/lib/node_modules/@cyclonedx/cdxgen/node_modules/tar/lib/unpack.js:322:25)
2024-01-23 13:29:45 at UnpackSync. (/usr/local/lib/node_modules/@cyclonedx/cdxgen/node_modules/tar/lib/unpack.js:219:44)
2024-01-23 13:29:45 at UnpackSync.emit (node:events:517:28)
2024-01-23 13:29:45 at [processEntry] (/usr/local/lib/node_modules/@cyclonedx/cdxgen/node_modules/tar/lib/parse.js:248:12)
2024-01-23 13:29:45 at [nextEntry] (/usr/local/lib/node_modules/@cyclonedx/cdxgen/node_modules/tar/lib/parse.js:259:36)
2024-01-23 13:29:45 at [consumeHeader] (/usr/local/lib/node_modules/@cyclonedx/cdxgen/node_modules/tar/lib/parse.js:223:32)
2024-01-23 13:29:45 at [consumeChunkSub] (/usr/local/lib/node_modules/@cyclonedx/cdxgen/node_modules/tar/lib/parse.js:513:30) {
2024-01-23 13:29:45 entry: ReadEntry {
2024-01-23 13:29:45 _events: [Object: null prototype] {},
2024-01-23 13:29:45 _eventsCount: 0,
2024-01-23 13:29:45 _maxListeners: undefined,
2024-01-23 13:29:45 writable: false,
2024-01-23 13:29:45 readable: false,
2024-01-23 13:29:45 extended: Pax {
2024-01-23 13:29:45 atime: 2024-01-22T06:17:43.756Z,
2024-01-23 13:29:45 charset: null,
2024-01-23 13:29:45 comment: null,
2024-01-23 13:29:45 ctime: 2024-01-22T06:17:49.848Z,
2024-01-23 13:29:45 gid: null,
2024-01-23 13:29:45 gname: null,
2024-01-23 13:29:45 linkpath: null,
2024-01-23 13:29:45 mtime: 2024-01-22T06:17:49.848Z,
2024-01-23 13:29:45 path: null,
2024-01-23 13:29:45 size: null,
2024-01-23 13:29:45 uid: null,
2024-01-23 13:29:45 uname: null,
2024-01-23 13:29:45 dev: null,
2024-01-23 13:29:45 ino: null,
2024-01-23 13:29:45 nlink: null,
2024-01-23 13:29:45 global: false
2024-01-23 13:29:45 },
2024-01-23 13:29:45 globalExtended: null,
2024-01-23 13:29:45 header: Header {
2024-01-23 13:29:45 cksumValid: true,
2024-01-23 13:29:45 needPax: false,
2024-01-23 13:29:45 nullBlock: false,
2024-01-23 13:29:45 block: null,
2024-01-23 13:29:45 path: '/',
2024-01-23 13:29:45 mode: 493,
2024-01-23 13:29:45 uid: 0,
2024-01-23 13:29:45 gid: 0,
2024-01-23 13:29:45 size: 0,
2024-01-23 13:29:45 mtime: 2024-01-22T06:17:49.848Z,
2024-01-23 13:29:45 cksum: 3798,
2024-01-23 13:29:45 linkpath: '',
2024-01-23 13:29:45 uname: '',
2024-01-23 13:29:45 gname: '',
2024-01-23 13:29:45 devmaj: 0,
2024-01-23 13:29:45 devmin: 0,
2024-01-23 13:29:45 atime: null,
2024-01-23 13:29:45 ctime: null,
2024-01-23 13:29:45 global: false,
2024-01-23 13:29:45 [Symbol(type)]: '5'
2024-01-23 13:29:45 },
2024-01-23 13:29:45 startBlockSize: 0,
2024-01-23 13:29:45 blockRemain: 0,
2024-01-23 13:29:45 remain: 0,
2024-01-23 13:29:45 type: 'Directory',
2024-01-23 13:29:45 meta: false,
2024-01-23 13:29:45 ignore: false,
2024-01-23 13:29:45 path: '',
2024-01-23 13:29:45 mode: 493,
2024-01-23 13:29:45 uid: 0,
2024-01-23 13:29:45 gid: 0,
2024-01-23 13:29:45 uname: '',
2024-01-23 13:29:45 gname: '',
2024-01-23 13:29:45 size: 0,
2024-01-23 13:29:45 mtime: 2024-01-22T06:17:49.848Z,
2024-01-23 13:29:45 atime: 2024-01-22T06:17:43.756Z,
2024-01-23 13:29:45 ctime: 2024-01-22T06:17:49.848Z,
2024-01-23 13:29:45 linkpath: '',
2024-01-23 13:29:45 global: false,
2024-01-23 13:29:45 absolute: '/tmp/docker-images-D7v9bA/all-layers',
2024-01-23 13:29:45 [Symbol(kCapture)]: false,
2024-01-23 13:29:45 [Symbol(flowing)]: true,
2024-01-23 13:29:45 [Symbol(paused)]: false,
2024-01-23 13:29:45 [Symbol(pipes)]: [],
2024-01-23 13:29:45 [Symbol(buffer)]: [],
2024-01-23 13:29:45 [Symbol(objectMode)]: false,
2024-01-23 13:29:45 [Symbol(encoding)]: null,
2024-01-23 13:29:45 [Symbol(async)]: false,
2024-01-23 13:29:45 [Symbol(decoder)]: null,
2024-01-23 13:29:45 [Symbol(EOF)]: true,
2024-01-23 13:29:45 [Symbol(emittedEnd)]: true,
2024-01-23 13:29:45 [Symbol(emittingEnd)]: false,
2024-01-23 13:29:45 [Symbol(closed)]: false,
2024-01-23 13:29:45 [Symbol(emittedError)]: null,
2024-01-23 13:29:45 [Symbol(bufferLength)]: 0,
2024-01-23 13:29:45 [Symbol(destroyed)]: false,
2024-01-23 13:29:45 [Symbol(signal)]: undefined,
2024-01-23 13:29:45 [Symbol(aborted)]: false
2024-01-23 13:29:45 },
2024-01-23 13:29:45 path: '/',
2024-01-23 13:29:45 cwd: '/tmp/docker-images-D7v9bA/all-layers',
2024-01-23 13:29:45 code: 'TAR_ENTRY_INFO',
2024-01-23 13:29:45 tarCode: 'TAR_ENTRY_INFO'
2024-01-23 13:29:45 }

[prabhu]

@Varsha-lalwani, any issues with the sbom since these errors can usually be ignored. The below link has some info on absolute paths and why node-tar (used by cdxgen) flags these as errors.

https://www.baeldung.com/linux/tar-absolute-paths-and-removing-leading-slashes