System independent build not possible

[wurstbrot]

What happened:
As a developer not knowing Go I want to build an image (in my case I want to try out https://github.com/patrikbeno/syft/tree/sbom-cataloger).
I just want to run docker build -t test . and have a running image.
Instead, the image needs a step beforehand, the build of the application. I get the following error:

$ docker run test
docker: Error response from daemon: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: exec: "/syft": stat /syft: no such file or directory: unknown.
ERRO[0001] error waiting for container: context canceled 

What you expected to happen:
I expect that the build of an image includes all steps (also application build). This is often achieved with a multistage build.
In case you provide me with:

• A go image to use for the build
• The steps in bash to build the application with that go Image

I can create a PR with the build of an image via multistage build. To adjust of the github workflow (in case you want to remove the build step for example) would be your task.

How to reproduce it (as minimally and precisely as possible):

$ docker build -t test .
$ docker run test

Anything else we need to know?:
I see it as a bug and not a feature request, because it should work in an easy way. I can not build the application on my system, because I get multiple errors:

$ make build
Building snapshot artifacts
# create a config with the dist dir overridden
echo "dist: ./snapshot" > ./.tmp/goreleaser.yaml
/bin/sh: 1: cannot create ./.tmp/goreleaser.yaml: Directory nonexistent
make: *** [Makefile:243: snapshot] Error 2

$ mkdir .tmp
$ make build
Building snapshot artifacts
# create a config with the dist dir overridden
echo "dist: ./snapshot" > ./.tmp/goreleaser.yaml
cat .goreleaser.yaml >> ./.tmp/goreleaser.yaml
# build release snapshots
bash -c "SKIP_SIGNING=true ./.tmp/goreleaser release --rm-dist --skip-publish --snapshot --skip-sign --config ./.tmp/goreleaser.yaml"
bash: line 1: ./.tmp/goreleaser: No such file or directory
make: *** [Makefile:246: snapshot] Error 127

Environment:

• Output of syft version: latest main
• OS (e.g: cat /etc/os-release or similar): Linux/Ubuntu

[cpendery]

Hi @wurstbrot, did you run make bootstrap? That should install all the necessary dependencies like goreleaser. After that, make build should be able to run just fine. As for the Docker image, I'll let someone else touch on that

[wurstbrot]

Hi @cpendery , that works.
In case you need help with the docker image, let me know.
Thank you.

[spiffcs]

👋 Thanks for the issue @wurstbrot!

I'm sorry you had trouble with getting the image built as you outlined above.
We also have a document for local development in https://github.com/anchore/syft/blob/main/DEVELOPING.md.

We've tried iterations where we included the make bootstrap as part of a multi-stage build, but it added a lot to build times when it was being run every single time we wanted to do a rebuild. It's been much smoother having to run that setup command once and then have our image build go on top of that one-time initialization.

I'm happy to update the documentation to make it easier to discover the development docs. Also happy to make other changes that you think would make the first-time setup on the project easier.

Sorry again for the pain here!

[wurstbrot]

Hi @spiffcs,
thank you for your reply.
From my point of view, that means there should be two Dockerfiles, one for the development/CI and one to get it working directly.

I'm happy to update the documentation to make it easier to discover the development docs. Also happy to make other changes that you think would make the first-time setup on the project easier.

A link to https://github.com/anchore/syft/blob/main/DEVELOPING.md (maybe with mentioning local build) in the README.md might help.

[joshbressers]

I found a goreleaser bug that should cover this case
goreleaser/goreleaser#3219

A workaround I use when developing on Debian is to comment out all the arm64 bits in the goreleaser yaml file (which is not an acceptable long term solution)

[kzantow]

We believe this issue is resolved, if we're not understanding this please reopen! But we are going to investigate improvements to the documentation.