⚠️ Reviewers, please take a look at the performance degradation observations at the bottom of the PR description.

Description

This PR updates node indexing to work with newer ClairCore filesystem URI handling and improves resilience/correctness for the ROX-32459 scenario.

• Bump github.com/quay/claircore from v1.5.44 to v1.5.50.
• Convert node indexer filesystem layer input to normalized absolute file:// URIs before claircore.Layer.Init.
• Add/adjust node indexer tests to validate URI behavior and updated error handling for empty host paths.
• Update JSONFormat to FormatJSON to make the code compile (introduced here)

Why:

• Newer ClairCore versions require file:// URI semantics for filesystem layers.
• Versions after v1.5.44 include improvements relevant to ROX-32459 context (including filtering problematic filesystem access and package-scanner error propagation behavior).

Acknowledgments:

• The issue documentation and discussion in ROX-32459 provided clear problem framing and validation targets.
• This implementation was inspired by prior work and rationale in stackrox/stackrox#18341.

User-facing documentation

• CHANGELOG.md is updated OR update is not needed
• documentation PR is created and is linked above OR is not needed

Testing and quality

• the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
• CI results are inspected

Automated testing

• added unit tests
• added e2e tests
• added regression tests
• added compatibility tests
• modified existing tests

How I validated my change

• CI
• By running the reproduction steps from the Jira ticket on a VM

Confirming the bug is fixed

# Building smaller root to save some time
sudo mkdir -p /tmp/roxroot/{etc,var,usr,root,proc}
sudo mount --bind /etc /tmp/roxroot/etc
sudo mount --bind /var /tmp/roxroot/var
sudo mount --bind /usr /tmp/roxroot/usr
sudo mount --bind /root /tmp/roxroot/root
sudo mount --bind /proc /tmp/roxroot/proc  # mounting on purpose to reproduce the issue

# starting zombie
$ (sleep 1 & exec /bin/sleep 180) &

$ time sudo /home/cloud-user/vm-agent-amd64 --port 818 --host-path /tmp/roxroot
2026/03/13 18:52:20 WARN rpm source packages always record 0 epoch; this may cause incorrect matching see-also="https://github.com/rpm-software-management/rpm/issues/2796 https://github.com/rpm-software-management/rpm/discussions/3703 https://github.com/rpm-software-management/rpm/pull/3755"
virtualmachines/roxagent/vsock: 2026/03/13 18:52:24.781263 client.go:79: Info: Sent message with index report containing 517 packages to host

real    1m22.010s
user    0m22.752s
sys     0m54.774s

# some time later the zombie finishes
[1]+  Done                    ( sleep 1 & exec /bin/sleep 180 )

✅ The fix is a solution to the issue. However, it makes the indexing pretty slow...

Observing performance

The change seem to significantly increase indexing times. Here few observations (still need more data for a conclusion).

1. Scanning limited root, so that /proc is not being searched

sudo mkdir -p /tmp/roxroot/{etc,var,usr,root}
sudo mount --bind /etc /tmp/roxroot/etc
sudo mount --bind /var /tmp/roxroot/var
sudo mount --bind /usr /tmp/roxroot/usr
sudo mount --bind /root /tmp/roxroot/root


time sudo /home/cloud-user/vm-agent-amd64 --port 818 --host-path /tmp/roxroot

2026/03/13 18:32:17 WARN rpm source packages always record 0 epoch; this may cause incorrect matching see-also="https://github.com/rpm-software-management/rpm/issues/2796 https://github.com/rpm-software-management/rpm/discussions/3703 https://github.com/rpm-software-management/rpm/pull/3755"
virtualmachines/roxagent/vsock: 2026/03/13 18:32:21.564264 client.go:79: Info: Sent message with index report containing 517 packages to host

real    0m22.315s
user    0m9.513s
sys     0m11.275s

2. Scanning full root (including /proc):

[cloud-user@rhel9-1 ~]$ time sudo /home/cloud-user/vm-agent-amd64 --port 818 --host-path /
2026/03/13 18:49:31 WARN rpm source packages always record 0 epoch; this may cause incorrect matching see-also="https://github.com/rpm-software-management/rpm/issues/2796 https://github.com/rpm-software-management/rpm/discussions/3703 https://github.com/rpm-software-management/rpm/pull/3755"
virtualmachines/roxagent/vsock: 2026/03/13 18:49:35.245293 client.go:79: Info: Sent message with index report containing 517 packages to host

real    1m45.496s
user    0m31.055s
sys     1m7.528s

3. Additional obesrvation

In case multiple agents run in parallel (e.g., one daemon, other one-shot), then the runtimes are very long - I killed one run after 10 minutes of waiting for any result. CPU load spikes.

Suggestion: add lock file to prevent more than one agent running in parallel.