feat: add ztsd layer support for cve scans (#4258)

* feat: add ztsd layer support for cve scans

Fixes issue #4255

Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com>

* test(cve): cover zstd-compressed layers in scannability check

Add a case exercising ispec.MediaTypeImageLayerZstd alongside the
existing gzip case in TestImageScannable, per Copilot review feedback
that the new accepted media type had no test coverage.

Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com>

* test(cve): clarify zstd scannability test description

Reword the Convey description to state that the test validates
acceptance of the zstd layer media type, not decompression of actual
zstd-compressed content, per Copilot review feedback that the test
data (an empty JSON blob) doesn't exercise decompression.

Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com>

* fix(cve): guard against empty Manifests in isManifestScanable

Real ingestion paths (OnUpdateManifest, ParseStorage) always populate
ImageMeta.Manifests with exactly one entry for an ImageManifest, via
convert.GetImageManifestMeta. But isManifestScanable reads independently
from metaDB and indexes Manifests[0] unconditionally, so a stale or
malformed metadb entry would panic the scan instead of surfacing as an
error, per Copilot review feedback.

Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com>

* fix(cve): correct typo in isManifestScannable and error message spacing

Addresses Copilot review nits on scanner.go: rename isManifestScanable
to isManifestScannable to match sibling helpers (IsImageFormatScannable,
isIndexScannable, isManifestDataScannable), and remove a double space
in the "0 manifests" error message.

Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com>

---------

Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com>

Author: rchincha

pkg/extensions/search/cve/trivy/scanner.go

@@ -446,7 +446,7 @@ func (scanner Scanner) IsImageMediaScannable(repo, digestStr, mediaType string)
 
 	if mediaType == ispec.MediaTypeImageManifest || //nolint:gocritic // not converting to switch-case
 		compat.IsCompatibleManifestMediaType(mediaType) {
-		ok, err := scanner.isManifestScanable(digestStr)
+		ok, err := scanner.isManifestScannable(digestStr)
 		if err != nil {
 			return ok, fmt.Errorf("image '%s' %w", image, err)
 		}
@@ -465,7 +465,26 @@ func (scanner Scanner) IsImageMediaScannable(repo, digestStr, mediaType string)
 	}
 }
 
-func (scanner Scanner) isManifestScanable(digestStr string) (bool, error) {
+// isManifestLayersScannable checks whether all layers of a manifest have
+// media types that Trivy is able to scan.
+func isManifestLayersScannable(layers []ispec.Descriptor) (bool, error) {
+	for _, imageLayer := range layers {
+		switch imageLayer.MediaType {
+		case ispec.MediaTypeImageLayerGzip,
+			ispec.MediaTypeImageLayerZstd,
+			ispec.MediaTypeImageLayer,
+			string(regTypes.DockerLayer):
+			continue
+		default:
+			return false, fmt.Errorf("%w: layer media type '%s'",
+				zerr.ErrScanNotSupported, imageLayer.MediaType)
+		}
+	}
+
+	return true, nil
+}
+
+func (scanner Scanner) isManifestScannable(digestStr string) (bool, error) {
 	if scanner.cache.Get(digestStr) != nil {
 		return true, nil
 	}
@@ -475,33 +494,19 @@ func (scanner Scanner) isManifestScanable(digestStr string) (bool, error) {
 		return false, err
 	}
 
-	for _, imageLayer := range manifestData.Manifests[0].Manifest.Layers {
-		switch imageLayer.MediaType {
-		case ispec.MediaTypeImageLayerGzip, ispec.MediaTypeImageLayer, string(regTypes.DockerLayer):
-			continue
-		default:
-			return false, fmt.Errorf("%w: layer media type '%s'", zerr.ErrScanNotSupported, imageLayer.MediaType)
-		}
+	if len(manifestData.Manifests) == 0 {
+		return false, fmt.Errorf("%w: manifest data has 0 manifests", zerr.ErrScanNotSupported)
 	}
 
-	return true, nil
+	return isManifestLayersScannable(manifestData.Manifests[0].Manifest.Layers)
 }
 
 func (scanner Scanner) isManifestDataScannable(manifestData mTypes.ManifestMeta) (bool, error) {
 	if scanner.cache.Get(manifestData.Digest.String()) != nil {
 		return true, nil
 	}
 
-	for _, imageLayer := range manifestData.Manifest.Layers {
-		switch imageLayer.MediaType {
-		case ispec.MediaTypeImageLayerGzip, ispec.MediaTypeImageLayer, string(regTypes.DockerLayer):
-			continue
-		default:
-			return false, fmt.Errorf("%w: layer media type '%s'", zerr.ErrScanNotSupported, imageLayer.MediaType)
-		}
-	}
-
-	return true, nil
+	return isManifestLayersScannable(manifestData.Manifest.Layers)
 }
 
 func (scanner Scanner) isIndexScannable(digestStr string) (bool, error) {
@@ -896,7 +901,7 @@ func (scanner Scanner) scanIndex(ctx context.Context, repo, digest string) (map[
 	indexCveIDMap := map[string]cvemodel.CVE{}
 
 	for _, manifest := range indexData.Index.Manifests {
-		if isScannable, err := scanner.isManifestScanable(manifest.Digest.String()); isScannable && err == nil {
+		if isScannable, err := scanner.isManifestScannable(manifest.Digest.String()); isScannable && err == nil {
 			manifestCveIDMap, err := scanner.scanManifest(ctx, repo, manifest.Digest.String())
 			if err != nil {
 				return nil, err

pkg/extensions/search/cve/trivy/scanner_internal_test.go

@@ -414,14 +414,14 @@ func TestImageScannable(t *testing.T) {
 
 	boltDriver, err := boltdb.GetBoltDriver(params)
 	if err != nil {
-		panic(err)
+		t.Fatal(err)
 	}
 
 	log := log.NewTestLogger()
 
 	metaDB, err := boltdb.New(boltDriver, log)
 	if err != nil {
-		panic(err)
+		t.Fatal(err)
 	}
 
 	// Create test data for the following cases
@@ -449,7 +449,19 @@ func TestImageScannable(t *testing.T) {
 
 	err = metaDB.SetRepoReference(context.Background(), "repo1", "valid", validImage.AsImageMeta())
 	if err != nil {
-		panic(err)
+		t.Fatal(err)
+	}
+
+	validZstdImage := CreateImageWith().
+		Layers([]Layer{{
+			MediaType: ispec.MediaTypeImageLayerZstd,
+			Digest:    ispec.DescriptorEmptyJSON.Digest,
+			Blob:      ispec.DescriptorEmptyJSON.Data,
+		}}).ImageConfig(validConfig).Build()
+
+	err = metaDB.SetRepoReference(context.Background(), "repo1", "valid-zstd", validZstdImage.AsImageMeta())
+	if err != nil {
+		t.Fatal(err)
 	}
 
 	// Create MetaDB data for manifest with unscannable layers
@@ -463,7 +475,7 @@ func TestImageScannable(t *testing.T) {
 	err = metaDB.SetRepoReference(context.Background(), "repo1",
 		"unscannable-layer", imageWithUnscannableLayer.AsImageMeta())
 	if err != nil {
-		panic(err)
+		t.Fatal(err)
 	}
 
 	// Continue with initializing the objects the scanner depends on
@@ -487,6 +499,12 @@ func TestImageScannable(t *testing.T) {
 		So(result, ShouldBeTrue)
 	})
 
+	Convey("Valid image with zstd layer media type should be scannable", t, func() {
+		result, err := scanner.IsImageFormatScannable("repo1", "valid-zstd")
+		So(err, ShouldBeNil)
+		So(result, ShouldBeTrue)
+	})
+
 	Convey("Image with layers of unsupported types should be unscannable", t, func() {
 		result, err := scanner.IsImageFormatScannable("repo1", "unscannable-layer")
 		So(err, ShouldNotBeNil)