Add JVM cataloger (#3217)

* add jvm cataloger Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * simplify version selection Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * CPEs from JVM cataloger should be declared Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * ensure package overlap is enabled for sensitive use cases Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * more permissive glob Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2026-11-04 16:36:40 +01:00 · 2024-09-23 17:21:38 -04:00
parent 7815d8e4d9
commit 01de99b253
25 changed files with 4271 additions and 81 deletions
@@ -3,18 +3,17 @@ package relationship
 import (
 	"testing"

+	"github.com/stretchr/testify/assert"
+
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/pkg"
 )

-func TestExclude(t *testing.T) {
+func TestExcludeByFileOwnershipOverlap(t *testing.T) {
 	packageA := pkg.Package{Name: "package-a", Type: pkg.ApkPkg}
-	packageB := pkg.Package{Name: "package-a", Type: pkg.PythonPkg}
-	packageC := pkg.Package{Name: "package-a", Type: pkg.BinaryPkg}
-	packageD := pkg.Package{Name: "package-d", Type: pkg.BinaryPkg}
-	packageE := pkg.Package{Name: "package-e", Type: pkg.RpmPkg, Metadata: pkg.ELFBinaryPackageNoteJSONPayload{Type: "rpm"}}
-	packageF := pkg.Package{Name: "package-f", Type: pkg.RpmPkg, Metadata: pkg.BinarySignature{}}
-	for _, p := range []*pkg.Package{&packageA, &packageB, &packageC, &packageD, &packageE, &packageF} {
+	packageB := pkg.Package{Name: "package-b", Type: pkg.BinaryPkg, Metadata: pkg.JavaVMInstallation{}}
+	packageC := pkg.Package{Name: "package-c", Type: pkg.BinaryPkg, Metadata: pkg.ELFBinaryPackageNoteJSONPayload{Type: "rpm"}}
+	for _, p := range []*pkg.Package{&packageA, &packageB, &packageC} {
 		p := p
 		p.SetID()
 	}
@@ -26,73 +25,152 @@ func TestExclude(t *testing.T) {
 		shouldExclude bool
 	}{
 		{
-			name: "no exclusions from os -> python",
+			// prove that OS -> bin exclusions are wired
+			name: "exclusions from os -> elf binary (as RPM)",
 			relationship: artifact.Relationship{
 				Type: artifact.OwnershipByFileOverlapRelationship,
-				From: packageA,
-				To:   packageB,
-			},
-			packages:      pkg.NewCollection(packageA, packageB),
-			shouldExclude: false,
-		},
-		{
-			name: "exclusions from os -> binary",
-			relationship: artifact.Relationship{
-				Type: artifact.OwnershipByFileOverlapRelationship,
-				From: packageA,
-				To:   packageC,
+				From: packageA, // OS
+				To:   packageC, // ELF binary
 			},
 			packages:      pkg.NewCollection(packageA, packageC),
 			shouldExclude: true,
 		},
 		{
-			name: "exclusions from os -> elf binary (as RPM)",
+			// prove that bin -> JVM exclusions are wired
+			name: "exclusions from binary -> binary with JVM metadata",
 			relationship: artifact.Relationship{
 				Type: artifact.OwnershipByFileOverlapRelationship,
-				From: packageA,
-				To:   packageE,
+				From: packageB, // binary with JVM metadata
+				To:   packageC, // binary
 			},
-			packages:      pkg.NewCollection(packageA, packageE),
+			packages:      pkg.NewCollection(packageC, packageB),
 			shouldExclude: true,
 		},
-		{
-			name: "exclusions from os -> binary (masquerading as RPM)",
-			relationship: artifact.Relationship{
-				Type: artifact.OwnershipByFileOverlapRelationship,
-				From: packageA,
-				To:   packageF,
-			},
-			packages:      pkg.NewCollection(packageA, packageF),
-			shouldExclude: true,
-		},
-		{
-			name: "no exclusions from python -> binary",
-			relationship: artifact.Relationship{
-				Type: artifact.OwnershipByFileOverlapRelationship,
-				From: packageB,
-				To:   packageC,
-			},
-			packages:      pkg.NewCollection(packageB, packageC),
-			shouldExclude: false,
-		},
-		{
-			name: "no exclusions for different package names",
-			relationship: artifact.Relationship{
-				Type: artifact.OwnershipByFileOverlapRelationship,
-				From: packageA,
-				To:   packageD,
-			},
-			packages:      pkg.NewCollection(packageA, packageD),
-			shouldExclude: false,
-		},
 	}

 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			if !excludeBinaryByFileOwnershipOverlap(test.relationship, test.packages) && test.shouldExclude {
+			actualExclude := excludeByFileOwnershipOverlap(test.relationship, test.packages)
+			didExclude := actualExclude != ""
+			if !didExclude && test.shouldExclude {
 				t.Errorf("expected to exclude relationship %+v", test.relationship)
 			}
 		})

 	}
 }
+
+func TestIdentifyOverlappingOSRelationship(t *testing.T) {
+	packageA := pkg.Package{Name: "package-a", Type: pkg.ApkPkg} // OS package
+	packageB := pkg.Package{Name: "package-b", Type: pkg.BinaryPkg}
+	packageC := pkg.Package{Name: "package-c", Type: pkg.BinaryPkg, Metadata: pkg.BinarySignature{}}
+	packageD := pkg.Package{Name: "package-d", Type: pkg.PythonPkg} // Language package
+	packageE := pkg.Package{Name: "package-e", Type: pkg.BinaryPkg, Metadata: pkg.ELFBinaryPackageNoteJSONPayload{}}
+
+	for _, p := range []*pkg.Package{&packageA, &packageB, &packageC, &packageD, &packageE} {
+		p.SetID()
+	}
+
+	tests := []struct {
+		name       string
+		parent     *pkg.Package
+		child      *pkg.Package
+		expectedID artifact.ID
+	}{
+		{
+			name:       "OS -> binary without metadata",
+			parent:     &packageA,
+			child:      &packageB,
+			expectedID: packageB.ID(), // OS package to binary package, should return child ID
+		},
+		{
+			name:       "OS -> binary with binary metadata",
+			parent:     &packageA,
+			child:      &packageC,
+			expectedID: packageC.ID(), // OS package to binary package with binary metadata, should return child ID
+		},
+		{
+			name:       "OS -> non-binary package",
+			parent:     &packageA,
+			child:      &packageD,
+			expectedID: "", // OS package to non-binary package, no exclusion
+		},
+		{
+			name:       "OS -> binary with ELF metadata",
+			parent:     &packageA,
+			child:      &packageE,
+			expectedID: packageE.ID(), // OS package to binary package with ELF metadata, should return child ID
+		},
+		{
+			name:       "non-OS parent",
+			parent:     &packageD, // non-OS package
+			child:      &packageC,
+			expectedID: "", // non-OS parent, no exclusion
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			resultID := identifyOverlappingOSRelationship(tt.parent, tt.child)
+			assert.Equal(t, tt.expectedID, resultID)
+		})
+	}
+}
+
+func TestIdentifyOverlappingJVMRelationship(t *testing.T) {
+
+	packageA := pkg.Package{Name: "package-a", Type: pkg.BinaryPkg}
+	packageB := pkg.Package{Name: "package-b", Type: pkg.BinaryPkg, Metadata: pkg.BinarySignature{}}
+	packageC := pkg.Package{Name: "package-c", Type: pkg.BinaryPkg, Metadata: pkg.JavaVMInstallation{}}
+	packageD := pkg.Package{Name: "package-d", Type: pkg.PythonPkg}
+	packageE := pkg.Package{Name: "package-e", Type: pkg.BinaryPkg}
+
+	for _, p := range []*pkg.Package{&packageA, &packageB, &packageC, &packageD, &packageE} {
+		p.SetID()
+	}
+
+	tests := []struct {
+		name       string
+		parent     *pkg.Package
+		child      *pkg.Package
+		expectedID artifact.ID
+	}{
+		{
+			name:       "binary -> binary with JVM installation",
+			parent:     &packageA,
+			child:      &packageC,
+			expectedID: packageA.ID(), // JVM found, return BinaryPkg ID
+		},
+		{
+			name:       "binary -> binary with binary signature",
+			parent:     &packageA,
+			child:      &packageB,
+			expectedID: "", // binary signatures only found, no exclusion
+		},
+		{
+			name:       "binary -> python (non-binary child)",
+			parent:     &packageA,
+			child:      &packageD,
+			expectedID: "", // non-binary child, no exclusion
+		},
+		{
+			name:       "no JVM or signature in binary -> binary",
+			parent:     &packageA,
+			child:      &packageE,
+			expectedID: "", // no JVM or binary signature, no exclusion
+		},
+		{
+			name:       "non-binary parent",
+			parent:     &packageD,
+			child:      &packageC,
+			expectedID: "", // non-binary parent, no exclusion
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			resultID := identifyOverlappingJVMRelationship(tt.parent, tt.child)
+			assert.Equal(t, tt.expectedID, resultID)
+		})
+	}
+}