bug: spdx checksum empty array; allow syft to generate SHA1 for spdx-tag-value documents (#1404)

test/cli/cosign_test.go

@@ -1,8 +1,6 @@
 package cli
 
 import (
-	"bufio"
-	"io"
 	"net/http"
 	"os"
 	"os/exec"
@@ -15,30 +13,6 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func runAndShow(t *testing.T, cmd *exec.Cmd) {
-	t.Helper()
-
-	stderr, err := cmd.StderrPipe()
-	require.NoErrorf(t, err, "could not get stderr: +v", err)
-
-	stdout, err := cmd.StdoutPipe()
-	require.NoErrorf(t, err, "could not get stdout: +v", err)
-
-	err = cmd.Start()
-	require.NoErrorf(t, err, "failed to start cmd: %+v", err)
-
-	show := func(label string, reader io.ReadCloser) {
-		scanner := bufio.NewScanner(reader)
-		scanner.Split(bufio.ScanLines)
-		for scanner.Scan() {
-			t.Logf("%s: %s", label, scanner.Text())
-		}
-	}
-
-	show("out", stdout)
-	show("err", stderr)
-}
-
 func TestCosignWorkflow(t *testing.T) {
 	// found under test-fixtures/registry/Makefile
 	img := "localhost:5000/attest:latest"
@@ -113,7 +87,6 @@ func TestCosignWorkflow(t *testing.T) {
 				cmd = exec.Command("make", "push")
 				cmd.Dir = fixturesPath
 				runAndShow(t, cmd)
-
 			},
 			cleanup: func() {
 				cwd, err := os.Getwd()

test/cli/spdx_json_schema_test.go

@@ -15,7 +15,6 @@ import (
 const spdxJsonSchemaPath = "schema/spdx-json"
 
 func TestSPDXJSONSchema(t *testing.T) {
-
 	imageFixture := func(t *testing.T) string {
 		fixtureImageName := "image-pkg-coverage"
 		imagetest.GetFixtureImage(t, "docker-archive", fixtureImageName)
@@ -35,11 +34,6 @@ func TestSPDXJSONSchema(t *testing.T) {
 			args:       []string{"-o", "spdx-json"},
 			fixture:    imageFixture,
 		},
-		{
-			name:       "power-user:image:docker-archive:pkg-coverage",
-			subcommand: "power-user",
-			fixture:    imageFixture,
-		},
 		{
 			name:       "packages:dir:pkg-coverage",
 			subcommand: "packages",

test/cli/spdx_tooling_validation_test.go

@@ -0,0 +1,83 @@
+package cli
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestSpdxValidationTooling(t *testing.T) {
+	tests := []struct {
+		name       string
+		syftArgs   []string
+		images     []string
+		setup      func(t *testing.T)
+		env        map[string]string
+		assertions []traitAssertion
+	}{
+		{
+			name:     "spdx validation tooling tag value",
+			syftArgs: []string{"packages", "-o", "spdx"},
+			images:   []string{"alpine:latest", "photon:3.0", "debian:latest"},
+			env: map[string]string{
+				"SYFT_FILE_METADATA_CATALOGER_ENABLED": "true",
+				"SYFT_FILE_METADATA_DIGESTS":           "sha1",
+			},
+			setup: func(t *testing.T) {
+				cwd, err := os.Getwd()
+				require.NoError(t, err)
+				fixturesPath := filepath.Join(cwd, "test-fixtures", "image-java-spdx-tools")
+				buildCmd := exec.Command("make", "build")
+				buildCmd.Dir = fixturesPath
+				err = buildCmd.Run()
+				require.NoError(t, err)
+			},
+			assertions: []traitAssertion{
+				assertSuccessfulReturnCode,
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			// build the validation image
+			test.setup(t)
+
+			for _, image := range test.images {
+				args := append(test.syftArgs, image)
+				cmd, stdout, stderr := runSyft(t, test.env, args...)
+				for _, traitFn := range test.assertions {
+					traitFn(t, stdout, stderr, cmd.ProcessState.ExitCode())
+				}
+
+				cwd, err := os.Getwd()
+				require.NoError(t, err)
+
+				f, err := os.CreateTemp(t.TempDir(), "temp")
+				require.NoError(t, err)
+
+				// spdx tooling only takes a file with suffix spdx
+				rename := path.Join(path.Dir(f.Name()), fmt.Sprintf("%s.spdx", path.Base(f.Name())))
+				err = os.Rename(f.Name(), rename)
+				require.NoError(t, err)
+
+				// write file for validation
+				_, err = f.Write([]byte(stdout))
+				require.NoError(t, err)
+
+				// validate against spdx java tooling
+				fileArg := fmt.Sprintf("FILE=%s", rename)
+				mountArg := fmt.Sprintf("BASE=%s", path.Base(rename))
+
+				validateCmd := exec.Command("make", "validate", fileArg, mountArg)
+				validateCmd.Dir = filepath.Join(cwd, "test-fixtures", "image-java-spdx-tools")
+				runAndShow(t, validateCmd)
+			}
+		})
+	}
+}

test/cli/test-fixtures/image-java-spdx-tools/Dockerfile

@@ -0,0 +1,7 @@
+FROM cgr.dev/chainguard/jdk
+
+RUN wget https://github.com/spdx/tools-java/releases/download/v1.1.3/tools-java-1.1.3.zip && \
+	unzip tools-java-1.1.3.zip && \
+	rm tools-java-1.1.3.zip
+
+ENTRYPOINT ["java", "-jar", "tools-java-1.1.3-jar-with-dependencies.jar"]

test/cli/test-fixtures/image-java-spdx-tools/Makefile

@@ -0,0 +1,8 @@
+all: build validate
+
+.PHONY: build
+build:
+	docker build -t spdx-java-tools:latest .
+
+validate:
+	docker run --rm -v ${FILE}:/home/build/${BASE} spdx-java-tools:latest Verify ${BASE}

test/cli/utils_test.go

@@ -1,8 +1,10 @@
 package cli
 
 import (
+	"bufio"
 	"bytes"
 	"fmt"
+	"io"
 	"math"
 	"os"
 	"os/exec"
@@ -14,9 +16,35 @@ import (
 	"testing"
 	"time"
 
+	"github.com/stretchr/testify/require"
+
 	"github.com/anchore/stereoscope/pkg/imagetest"
 )
 
+func runAndShow(t *testing.T, cmd *exec.Cmd) {
+	t.Helper()
+
+	stderr, err := cmd.StderrPipe()
+	require.NoErrorf(t, err, "could not get stderr: +v", err)
+
+	stdout, err := cmd.StdoutPipe()
+	require.NoErrorf(t, err, "could not get stdout: +v", err)
+
+	err = cmd.Start()
+	require.NoErrorf(t, err, "failed to start cmd: %+v", err)
+
+	show := func(label string, reader io.ReadCloser) {
+		scanner := bufio.NewScanner(reader)
+		scanner.Split(bufio.ScanLines)
+		for scanner.Scan() {
+			t.Logf("%s: %s", label, scanner.Text())
+		}
+	}
+
+	show("out", stdout)
+	show("err", stderr)
+}
+
 func setupPKI(t *testing.T, pw string) func() {
 	err := os.Setenv("COSIGN_PASSWORD", pw)
 	if err != nil {