Implement limitation of layer size in image in syft

Syft
1

I want to implement this task - support configuration of layer size in Syft · Issue #3428 · anchore/syft · GitHub
however I am wondering where is the best place to use the function SetPerFileReadLimit
in syft scan flow. Do you have any suggestions?

2

@TimBrown1611 – configuration loading is where this should be set.

Each configuration object can optionally implement a PostLoader interface, where a PostLoad() hook is called to perform some behavior after the configuration has loaded.

This setting is only pertinent to the image source extraction, though, so perhaps it’s something that belongs on the imageSource, although the source-only platform configuration is part of the catalog options, so I don’t have a very strong opinion where this option lives – we may have some other checks for tar extraction code that fall outside just the source, I don’t recall if there are other spots this might need to be set.

Thinking about specifying this in yaml, if we put it on the imageSource config, I think it would be something like:

image:
  max-layer-size: 10G

… which also be automatically mapped to environment variable: SYFT_IMAGE_MAX_LAYER_SIZE and would correspond to this change:

type imageSource struct {
	DefaultPullSource string `json:"default-pull-source" yaml:"default-pull-source" mapstructure:"default-pull-source"`
	MaxLayerSize string `json:"max-layer-size" yaml:"max-layer-size" mapstructure:"max-layer-size"` // add this
}

func (c imageSource) PostLoad() error {
	// add something like this:
	if c.MaxLayerSize != "" {
		perFileReadLimit, err := humanize.ParseBytes(c.MaxLayerSize)
		if err != nil { return err }
		stereoscopeFile.SetPerFileReadLimit(perFileReadLimit)
	}

	// existing code:
	return checkDefaultSourceValues(c.DefaultPullSource)
}

This is using github.com/dustin/go-humanize for parsing.

3

hi!
tried to follow the implementation, while debugging I saw it never goes to this function.

I added the configuration and running <path_to_tar_file >-c <path_to_config>