Failure to fetch a helm chart with a docker://URL and analyze_docker_image

[pombredanne]

See the failure trace:
input: docker://ghcr.io/mercedes-benz/sechub/helm-charts/pds-xray:1.4.0
pipeline: analyze_docker_image

analyze_docker_image
Analyze Docker images.
Run Failure
Exit code 1
Execution time 1 seconds
ScanCode.io version 34.11.0
Task ID b8ce4e61-e7a7-4e5a-b674-7aec8a9bb0b7
Created date 2025-05-22 09:10
Start date 2025-05-22 09:10
End date 2025-05-22 09:10
Run log

2025-05-22 07:10:27.645 Pipeline [analyze_docker_image] starting
2025-05-22 07:10:27.648 Step [download_missing_inputs] starting
2025-05-22 07:10:27.650 Fetching input from docker://ghcr.io/mercedes-benz/sechub/helm-charts/pds-xray:1.4.0
2025-05-22 07:10:29.553 docker://ghcr.io/mercedes-benz/sechub/helm-charts/pds-xray:1.4.0 could not be fetched.
2025-05-22 07:10:29.555 Pipeline failed

Task output

InputFilesError encountered with the following issues:

Error 1: Error while executing cmd="('/opt/scancodeio/.venv/lib/python3.12/site-packages/fetchcode_container/bin/skopeo', 'copy', '--insecure-policy', 'docker://ghcr.io/mercedes-benz/sechub/helm-charts/pds-xray:1.4.0', 'docker-archive:/tmp/tmpjioznenn/ghcr_io_mercedes_benz_sechub_helm_charts_pds_xray_1_4_0.tar')": "time="2025-05-22T07:10:29Z" level=fatal msg="Error creating an updated image manifest: Unknown media type during manifest conversion: \"application/vnd.cncf.helm.chart.content.v1.tar+gzip\"""

Traceback (most recent call last):
  File "/opt/scancodeio/scanpipe/pipelines/__init__.py", line 146, in download_missing_inputs
    input_source.fetch()
  File "/opt/scancodeio/scanpipe/models.py", line 1890, in fetch
    downloaded = fetch_url(url=self.download_url)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/scancodeio/scanpipe/pipes/fetch.py", line 390, in fetch_url
    downloaded = fetcher(url)
                 ^^^^^^^^^^^^
  File "/opt/scancodeio/scanpipe/pipes/fetch.py", line 321, in fetch_docker_image
    output = run_command_safely(cmd_args)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/scancodeio/scanpipe/pipes/fetch.py", line 93, in run_command_safely
    raise subprocess.SubprocessError(error_msg)
subprocess.SubprocessError: Error while executing cmd="('/opt/scancodeio/.venv/lib/python3.12/site-packages/fetchcode_container/bin/skopeo', 'copy', '--insecure-policy', 'docker://ghcr.io/mercedes-benz/sechub/helm-charts/pds-xray:1.4.0', 'docker-archive:/tmp/tmpjioznenn/ghcr_io_mercedes_benz_sechub_helm_charts_pds_xray_1_4_0.tar')": "time="2025-05-22T07:10:29Z" level=fatal msg="Error creating an updated image manifest: Unknown media type during manifest conversion: \"application/vnd.cncf.helm.chart.content.v1.tar+gzip\"""


Traceback:
  File "/opt/scancodeio/aboutcode/pipeline/__init__.py", line 199, in execute
    step(self)
  File "/opt/scancodeio/scanpipe/pipelines/__init__.py", line 154, in download_missing_inputs
    raise InputFilesError(error_tracebacks)

[tdruez]

This is a Skopeo-related issue:

Error while executing cmd:

$ skopeo copy \
  docker://ghcr.io/mercedes-benz/sechub/helm-charts/pds-xray:1.4.0 \
  docker-archive:/ghcr_io_mercedes_benz_sechub_helm_charts_pds_xray_1_4_0.tar

-> Error creating an updated image manifest: Unknown media type during manifest conversion: 
"application/vnd.cncf.helm.chart.content.v1.tar+gzip"

After some research, it seems that Skopeo cannot fetch Helm charts directly, it's designed to work with container images, not Helm chart repositories.

Extract from podman-container-tools/skopeo#2272 (comment)

the docker-archive format can represent images (notably all blobs must be in the usual overlay tar format, and decompressed); and an artifact is not an image.
If you need to transfer the artifact as files, oci:/oci-archive:/dir: should work.

Using dir: in place of docker-archive: provide some results with the following Skopeo command:

$ skopeo --debug copy --insecure-policy docker://ghcr.io/mercedes-benz/sechub/helm-charts/pds-xray:1.4.0 dir:ghcr_io_mercedes_benz_sechub_helm_charts_pds_xray_1_4_0

Getting image source signatures
DEBU[0000] Reading /opt/scancodeio/.local/share/containers/sigstore/mercedes-benz/sechub/helm-charts/pds-xray@sha256=e1dabc6e9e1a234715e01cf4ec21859fc8b237ed50cd3fffac99794598ba1f06/signature-1
DEBU[0000] Downloading /v2/mercedes-benz/sechub/helm-charts/pds-xray/blobs/sha256:d24acbcedbfbc32016d2b4537fb30d417def5babc38135aaeaba0efffa236c79
DEBU[0000] GET https://ghcr.io/v2/mercedes-benz/sechub/helm-charts/pds-xray/blobs/sha256:d24acbcedbfbc32016d2b4537fb30d417def5babc38135aaeaba0efffa236c79
DEBU[0000] Detected compression format gzip
DEBU[0000] Using original blob without modification
Copying blob d24acbcedbfb done
DEBU[0000] Downloading /v2/mercedes-benz/sechub/helm-charts/pds-xray/blobs/sha256:b01a8925590d69210e3c9cf1c69a7b16333b0d3a5bde499936120e1d0165a338
DEBU[0000] GET https://ghcr.io/v2/mercedes-benz/sechub/helm-charts/pds-xray/blobs/sha256:b01a8925590d69210e3c9cf1c69a7b16333b0d3a5bde499936120e1d0165a338
DEBU[0001] No compression detected
DEBU[0001] Using original blob without modification
Copying config b01a892559 done
Writing manifest to image destination
Storing signatures

$ ls ghcr_io_mercedes_benz_sechub_helm_charts_pds_xray_1_4_0
b01a8925590d69210e3c9cf1c69a7b16333b0d3a5bde499936120e1d0165a338
d24acbcedbfbc32016d2b4537fb30d417def5babc38135aaeaba0efffa236c79
manifest.json
version

An alternative may be to look into using the helm command to fetch helm chart in place of Skopeo:

$ docker run -it --rm alpine/helm pull oci://ghcr.io/mercedes-benz/sechub/helm-charts/pds-xray:1.4.0
Pulled: ghcr.io/mercedes-benz/sechub/helm-charts/pds-xray:1.4.0
Digest: sha256:e1dabc6e9e1a234715e01cf4ec21859fc8b237ed50cd3fffac99794598ba1f06