quay / clair

Vulnerability Static Analysis for Containers

Home Page:https://quay.github.io/clair/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

clairctl import-updaters error when vulnerabilities gz file is about 200MB

lees07 opened this issue · comments

Description of Problem / Feature Request

There is an issue on "clairctl import-updaters" function at airgap environment when the vulnerabilities gz file about 200MB.
I tried to add -g for gz file and -z for zst file, the issue still occur.

e.g. command line:
podman run -it --rm --privileged=true -v /opt/clair4/config:/clair:Z -v /opt/clair4/updates:/updates:Z --entrypoint /bin/clairctl registry.redhat.io/quay/clair-rhel8:v3.7 --config /clair/config.yaml import-updaters -g /updates/updates.json.gz

Expected Outcome

import completely

Actual Outcome

Always display the error of "gzip: invalid header", either gz file or zst file.

2022-11-18T06:05:25Z ERR error="gzip: invalid header"

Environment

  • Clair version/image: v4.4.4 / registry.redhat.io/quay/clair-rhel8:v3.7.10-2
  • Clair client name/version: clairctl / 0.2.0
  • Host OS: RHEL8.6
  • Kernel (e.g. uname -a): "Linux registry.ocp4.example.com 4.18.0-372.9.1.el8.x86_64 #1 SMP Fri Apr 15 22:12:19 EDT 2022 x86_64 x86_64 x86_64 GNU/Linux"
  • Kubernetes version (use kubectl version): N/A
  • Network/Firewall setup:

the gz file is tested by gzip.
gzip -v -t /opt/clair4/updates/updates.json.gz
/opt/clair4/updates/updates.json.gz: OK

Does this happen on the latest release? Does this happen when there's no gz or zst file ending?

The clair image is the latest release at that time, and vulnerabilities are the newest. The updates.json.gz had been exported by clairctl export-updaters command, the uncompress json file is about 14GB.

Clair version/image: v4.4.4

This is not the latest, see the releases page and the release containers.

If you want to use a 4.4 release, does this happen when there's no gz file ending when the contents are still gzipped?

tried clair:4.5.1 image from quay.io, the issue has been fixed. thank you!

Good to hear!