SBOM cataloger (#1029)

* SBOM cataloger Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk> * sbom-cataloger: turn off by default and add integration test Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk> * SBOM cataloger Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk> * SBOM cataloger (optimize) Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk> * SBOM cataloger (fix) Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk> * SBOM cataloger (fix imports #1172) Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk> * SBOM cataloger (fix: support group attribute in CDX SBOMs) Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk> * port to generic cataloger and add relationship to original file Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * generalize parser for all format globs Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Tom Fay <tomfay@microsoft.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2026-11-01 15:06:36 +01:00 · 2022-11-16 14:11:45 -05:00
parent 0774ad15e2
commit 0c4b99c1c2
17 changed files with 3855 additions and 109 deletions
@@ -0,0 +1,34 @@
+package integration
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+func TestSbomCataloger(t *testing.T) {
+	// The image contains a go.mod file with 2 dependencies and an spdx json sbom.
+	// The go.mod file contains 2 dependencies, and the sbom includes a go dependency
+	// that overlaps with the go.mod
+	sbom, _ := catalogFixtureImage(t, "image-sbom-cataloger", source.SquashedScope, []string{"all"})
+
+	expectedSbomCatalogerPkgs := 1
+	expectedGoModCatalogerPkgs := 2
+	actualSbomPkgs := 0
+	actualGoModPkgs := 0
+	for pkg := range sbom.Artifacts.PackageCatalog.Enumerate(pkg.GoModulePkg) {
+		if pkg.FoundBy == "go-mod-file-cataloger" {
+			actualGoModPkgs += 1
+		} else if pkg.FoundBy == "sbom-cataloger" {
+			actualSbomPkgs += 1
+		}
+	}
+
+	if actualGoModPkgs != expectedGoModCatalogerPkgs {
+		t.Errorf("unexpected number of packages from go mod cataloger: %d != %d", expectedGoModCatalogerPkgs, actualGoModPkgs)
+	}
+	if actualSbomPkgs != expectedSbomCatalogerPkgs {
+		t.Errorf("unexpected number of packages from sbom cataloger: %d != %d", expectedSbomCatalogerPkgs, actualSbomPkgs)
+	}
+}
@@ -0,0 +1,3 @@
+FROM scratch
+COPY go.mod /
+COPY test.spdx.json /
@@ -0,0 +1,8 @@
+module github.com/anchore/syft
+
+go 1.14
+
+require (
+	github.com/anchore/packageurl-go v0.1.1-0.20220428202044-a072fa3cb6d7
+	github.com/bmatcuk/doublestar v1.3.1
+)
@@ -0,0 +1,39 @@
+{
+ "SPDXID": "SPDXRef-DOCUMENT",
+ "name": "test/integration/test-fixtures/image-sbom-cataloger",
+ "spdxVersion": "SPDX-2.2",
+ "creationInfo": {
+  "created": "2022-08-18T05:23:38.066146511Z",
+  "creators": [
+   "Organization: Anchore, Inc",
+   "Tool: syft-0.53.0"
+  ],
+  "licenseListVersion": "3.17"
+ },
+ "dataLicense": "CC0-1.0",
+ "documentNamespace": "https://anchore.com/syft/dir/test/integration/test-fixtures/image-sbom-cataloger-057e7aa2-332c-4b50-bbd1-a17dd62ddce4",
+ "packages": [
+  {
+   "SPDXID": "SPDXRef-45209ca0cdcbafa",
+   "name": "github.com/bmatcuk/doublestar",
+   "licenseConcluded": "NONE",
+   "downloadLocation": "NOASSERTION",
+   "externalRefs": [
+    {
+     "referenceCategory": "SECURITY",
+     "referenceLocator": "cpe:2.3:a:bmatcuk:doublestar:v1.3.1:*:*:*:*:*:*:*",
+     "referenceType": "cpe23Type"
+    },
+    {
+     "referenceCategory": "PACKAGE_MANAGER",
+     "referenceLocator": "pkg:golang/github.com/bmatcuk/doublestar@v1.3.1",
+     "referenceType": "purl"
+    }
+   ],
+   "filesAnalyzed": false,
+   "licenseDeclared": "NONE",
+   "sourceInfo": "acquired package info from go module information: go.mod",
+   "versionInfo": "v1.3.1"
+  }
+ ]
+}