question/feature: determining if image has already been scanned

[samcornwell]

question/feature: determining if image has already been scanned

[samcornwell]

Update: ok maybe I don't understand the logic. After running for a while with --ignore-annotations, it seems to have populated my repo, and now it's showing Skip image for everything

[ckotzbauer]

Hi @samcornwell,
to populate a new repo you have to run the operator with --ignore-annotation until all your sboms are created again, then you can remove the flag again. The purpose of the flag is just to force a one-time re-scan of all images. When they are scanned (and the operator did not restart) they are skipped again, when the image did not change, it uses an in-memory cache with the sha256's.

Of course it would be possible to instead always check the repo and check if the expected file is already there, but this would be much slower, this is the reason why I implemented it this way.

Does this solve your question?

[samcornwell]

Edit: Disregard, I did not read the message closely enough.

Thank you. That's exactly what I tried doing, and it seemed like it was working. It seemed to scan everything. Then later I looked at my logs and saw that the most recent scans are skipping again, even though I still haven't removed the --ignore-annotations flag yet. I expected that it would just scan over and over until I removed the flag, because that's what it appeared to be doing at first. Is there some other check that can cause skipping?

[samcornwell]

Edit: Disregard, I did not read the message closely enough.

Update: I think I see what's going on. It appears there is a map in memory that tracks whether a particular image has been scanned before in the lifespan of the sbom-operator process, and it's being skipped based on that map.

If that's right, consider it resolved. Thank you

[samcornwell]

Doh, I did not read your message close enough, apologies. Thank you.