"docker scout compare" crashes with a Go panic irrespective of version

Docker Desktop Docker Scout
1

docker scout compare nil pointer dereference panic in attestations.createVCS (provenance.go:128)

`docker scout compare` crashes instead of producing a report. It gets as far as reading the second image’s attestations, then dies with a Go panic (nil pointer dereference) and dumps a stack trace. No report file is created, and no error message explains what went wrong.

It appears to choke on the provenance attestation of the `–to` image: that attestation has no version-control (git) metadata, and Scout tries to read the missing field instead of skipping it. See `createVCS` at internal/attestations/provenance.go:128 in the trace below.

The crash is completely reproducible — 4 out of 4 attempts — and the output format makes no difference. Default text, `–format json`, and `–format markdown` all fail the same way, whether writing with `-o FILE` or redirecting the output in the shell.

Other Scout commands read the exact same image without any trouble:

- `docker scout cves cleanstart/go@sha256:38cebe9d5955…` — works, indexes 56 packages

  • `docker scout sbom cleanstart/go@sha256:38cebe9d5955…` — works
2

Can you share more about the environment? Operating system, Docker Desktop version and Docker CE version?

The output of the following commands contain all:

docker info
docker version

Please, use a code block for sharing the outputs so we can read it better and you can remove any private info from the output before sharing if you see any.

I’m asking only so we can help you where and how it should be reported. If you have recent Docker scout version, you will likely need to check issues here or create a new one if you have not found any related:

OR since you asked the question in the Docker Desktop category, if you have Docker Desktop, you can probably report it in the desktop feedback repo

If you have an older version of scout or Docker Desktop, I would recommend updating first if possible and test if the issue is still reproducable.