Scan images with clairctl leads to manifest unknown: manifest unknown return.

[flomickl]

With clair 4.7.4 and clairctl from here [1] I am trying to scan an image for example quay.io/projectquay/clair:4.7.4 image

I am using the correct image with successfully pulling the image:

podman pull quay.io/projectquay/clair:4.7.4

The manifest is accessible, like proven here:

curl -s -H "Accept: application/vnd.docker.distribution.manifest.v2+json" https://quay.io/v2/projectquay/clair/manifests/4.7.4

but if I scan clairctl with the following command

clairctl --config /data/quay/clairctl.yml --log-level debug analyze quay.io/projectquay/clair:4.7.4

2024-07-12 11:56:00.659542 D | config: Using config file: /data/quay/clairctl.yml
2024-07-12 11:56:00.659694 D | dockerdist: Downloading manifest for quay.io/projectquay/clair:4.7.4
2024-07-12 11:56:00.659787 D | dockerdist: Retrieving repository client
2024-07-12 11:56:00.695953 D | dockerdist: endpoint.TLSConfig.InsecureSkipVerify: true
client quit unexpectedly
2024-07-12 11:56:02.732825 C | cmd: retrieving manifest for "quay.io/projectquay/clair:4.7.4": manifest unknown: manifest unknown

clairctl --config /data/quay/clairctl.yml --log-level debug report quay.io/projectquay/clair:4.7.4
2024-07-12 11:54:59.256799 D | config: Using config file: /data/quay/clairctl.yml
2024-07-12 11:54:59.256979 D | dockerdist: Downloading manifest for quay.io/projectquay/clair:4.7.4
2024-07-12 11:54:59.257125 D | dockerdist: Retrieving repository client
2024-07-12 11:54:59.313029 D | dockerdist: endpoint.TLSConfig.InsecureSkipVerify: true
client quit unexpectedly
2024-07-12 11:55:01.305783 C | cmd: retrieving manifest for "quay.io/projectquay/clair:4.7.4": manifest unknown: manifest unknown

I am using the following clairctl config,

clair:
  port: 6060
  healthPort: 8000
  uri: http://localhost
  report:
    path: /data/quay/reports
  auth:
    insecureSkipVerify: false  # Auf true setzen, falls selbstsigniertes Zertifikat verwendet wird
    psk:
      key: XXXXXXXXXXXX
      iss: quay

If I push this image into my quay registry, the image is scanned without any hesitation and reported the results to quay!

Any ideas why I got this message?
Many thanks in advance!

[1] https://github.com/quay/clair/releases/download/v4.7.4/clairctl-linux-amd64

[hdonnay]

I don't think you're actually using that binary, because the configuration is in the wrong format, the log output isn't correct, and that command line wouldn't work.

[flomickl]

What a bummer!
You were right. Thanks for this quick hint.

Somehow, the clairctl from a previous installation try was still active on my system.
I just followed the installation process mentioned here [1] but it is far outdated of course.
But it was the only source I found at that time and was also my second google search hit.

So instead "install" clairctl from here [1] with clairctl version 1.2.8
use it from HERE -> https://github.com/quay/clair/releases
using clairctl v4.7.4 (claircore v1.5.27) :)

With the latest version and the command

clairctl  --iss my-issuer report  -host https://example.com quay.io/projectquay/clair:4.7.4

it was working

In the first time I forgot the tag from the container
with the following result

2024-07-13T23:17:52+02:00 ERR error="GET https://quay.io/v2/projectquay/clair/manifests/latest: MANIFEST_UNKNOWN: manifest unknown; map[]"

In this case, "manifest unknown" means the "latest" tag image does not exist and because of this the manifest is unknown

I also started a new discussion because for an improved documentation here using the the latest commands correctly [2].

[1] https://github.com/jgsqware/clairctl
[2] #2094