feat(image): add logic to guess base layer for docker-cis scan

[DmitriyLewen]

Description

Add logic to guess base layer for docker-cis scan.
See more in #3834.

Related issues

• Close Add base image layer detection to compliance scanning #3834

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

Can we move it under fanal/image/? The existing file image.go or a new file, history.go

[DmitriyLewen]

I don't think that we need to create new file for 1 function.
I moved function to fanal/image/image.go in b2cce5f

[knqyf263]

I think this comment should be moved to this function as the main logic exists here.

trivy/pkg/fanal/artifact/image/image.go

Lines 473 to 501 in 87844ca

	// Guess layers in base image (call base layers).
	//
	// e.g. In the following example, we should detect layers in debian:8.
	//
	// FROM debian:8
	// RUN apt-get update
	// COPY mysecret /
	// ENTRYPOINT ["entrypoint.sh"]
	// CMD ["somecmd"]
	//
	// debian:8 may be like
	//
	// ADD file:5d673d25da3a14ce1f6cf66e4c7fd4f4b85a3759a9d93efb3fd9ff852b5b56e4 in /
	// CMD ["/bin/sh"]
	//
	// In total, it would be like:
	//
	// ADD file:5d673d25da3a14ce1f6cf66e4c7fd4f4b85a3759a9d93efb3fd9ff852b5b56e4 in /
	// CMD ["/bin/sh"] # empty layer (detected)
	// RUN apt-get update
	// COPY mysecret /
	// ENTRYPOINT ["entrypoint.sh"] # empty layer (skipped)
	// CMD ["somecmd"] # empty layer (skipped)
	//
	// This method tries to detect CMD in the second line and assume the first line is a base layer.
	// 1. Iterate histories from the bottom.
	// 2. Skip all the empty layers at the bottom. In the above example, "entrypoint.sh" and "somecmd" will be skipped
	// 3. If it finds CMD, it assumes that it is the end of base layers.
	// 4. It gets all the layers as base layers above the CMD found in #3.

[knqyf263]

Maybe keep the first line only in Artifact.guessBaseLayers().

[DmitriyLewen]

You are right. Made this in d8c4002