fix: Trivy fails with "invalid tar header" when scanning Copa-patched images

[robert-cronin]

Changes:

• Add compression=uncompressed for non-push exports
• Add force-compression=true to ensure attribute is applied

Closes #1358

[Copilot]

Pull Request Overview

This PR fixes a Trivy scanning issue (#1358) where Copa-patched images fail with "invalid tar header" errors. The fix ensures that locally exported images use uncompressed layers, which resolves hash mismatches that occur when diff_id and blob digest differ due to compression.

Key changes:

• Added compression=uncompressed attribute to BuildKit export configuration for non-push (local) exports
• Added force-compression=true to ensure the compression attribute is applied

[Copilot]

The comment explains the purpose of uncompressed layers but doesn't clarify why force-compression=true is needed alongside compression=uncompressed. Consider expanding the comment to explain that force-compression ensures the compression setting is applied even when BuildKit might otherwise use defaults.

Suggested change

	// Use uncompressed layers for local export to ensure diff_id == blob digest
	// This fixes Trivy scanning issues where compressed layers have mismatched hashes
	// Use uncompressed layers for local export to ensure diff_id == blob digest.
	// This fixes Trivy scanning issues where compressed layers have mismatched hashes.
	// Note: BuildKit may ignore the 'compression' setting and use its default unless 'force-compression' is set to 'true'.
	// Setting both ensures that the compression setting is always applied as intended.

[codecov]

Codecov Report

❌ Patch coverage is 75.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 39.51%. Comparing base (4bee93a) to head (1ed73a4).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/patch/build.go	75.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1359      +/-   ##
==========================================
+ Coverage   39.49%   39.51%   +0.02%     
==========================================
  Files          42       42              
  Lines        5879     5881       +2     
==========================================
+ Hits         2322     2324       +2     
  Misses       3361     3361              
  Partials      196      196              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ashnamehrotra]

LGTM