Improve package URL support (#754)

* rename npm metadata struct

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* improve os package URLs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* improve language package URLs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* wire up composer pURL method

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

syft/pkg/cataloger/catalog.go

@@ -68,7 +68,7 @@ func Catalog(resolver source.FileResolver, release *linux.Release, catalogers ..
 			p.CPEs = cpe.Generate(p)
 
 			// generate PURL (note: this is excluded from package ID, so is safe to mutate)
-			p.PURL = generatePackageURL(p, release)
+			p.PURL = pkg.URL(p, release)
 
 			// create file-to-package relationships for files owned by the package
 			owningRelationships, err := packageFileOwnershipRelationships(p, resolver)

syft/pkg/cataloger/package_url.go

@@ -1,49 +0,0 @@
-package cataloger
-
-import (
-	"regexp"
-	"strings"
-
-	"github.com/anchore/packageurl-go"
-	"github.com/anchore/syft/syft/linux"
-	"github.com/anchore/syft/syft/pkg"
-)
-
-// generatePackageURL returns a package-URL representation of the given package (see https://github.com/package-url/purl-spec)
-func generatePackageURL(p pkg.Package, release *linux.Release) string {
-	// default to pURLs on the metadata
-	if p.Metadata != nil {
-		if i, ok := p.Metadata.(interface{ PackageURL() string }); ok {
-			return i.PackageURL()
-		} else if i, ok := p.Metadata.(interface{ PackageURL(*linux.Release) string }); ok {
-			return i.PackageURL(release)
-		}
-	}
-
-	var purlType = p.Type.PackageURLType()
-	var name = p.Name
-	var namespace = ""
-
-	switch {
-	case purlType == "":
-		// there is no purl type, don't attempt to craft a purl
-		// TODO: should this be a "generic" purl type instead?
-		return ""
-	case p.Type == pkg.GoModulePkg:
-		re := regexp.MustCompile(`(/)[^/]*$`)
-		fields := re.Split(p.Name, -1)
-		namespace = fields[0]
-		name = strings.TrimPrefix(p.Name, namespace+"/")
-	}
-
-	// generate a purl from the package data
-	pURL := packageurl.NewPackageURL(
-		purlType,
-		namespace,
-		name,
-		p.Version,
-		nil,
-		"")
-
-	return pURL.ToString()
-}

syft/pkg/cataloger/package_url_test.go

@@ -1,166 +0,0 @@
-package cataloger
-
-import (
-	"testing"
-
-	"github.com/anchore/syft/syft/linux"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/sergi/go-diff/diffmatchpatch"
-)
-
-func TestPackageURL(t *testing.T) {
-	tests := []struct {
-		name     string
-		pkg      pkg.Package
-		distro   *linux.Release
-		expected string
-	}{
-		{
-			name: "golang",
-			pkg: pkg.Package{
-				Name:    "github.com/anchore/syft",
-				Version: "v0.1.0",
-				Type:    pkg.GoModulePkg,
-			},
-			expected: "pkg:golang/github.com/anchore/syft@v0.1.0",
-		},
-		{
-			name: "pip with vcs url",
-			pkg: pkg.Package{
-				Name:    "bad-name",
-				Version: "bad-v0.1.0",
-				Type:    pkg.PythonPkg,
-				Metadata: pkg.PythonPackageMetadata{
-					Name:    "name",
-					Version: "v0.1.0",
-					DirectURLOrigin: &pkg.PythonDirectURLOriginInfo{
-						VCS:      "git",
-						URL:      "https://github.com/test/test.git",
-						CommitID: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-					},
-				},
-			},
-			expected: "pkg:pypi/name@v0.1.0?vcs_url=git+https:%2F%2Fgithub.com%2Ftest%2Ftest.git@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-		},
-		{
-			name: "pip without vcs url",
-			pkg: pkg.Package{
-				Name:    "bad-name",
-				Version: "bad-v0.1.0",
-				Type:    pkg.PythonPkg,
-				Metadata: pkg.PythonPackageMetadata{
-					Name:    "name",
-					Version: "v0.1.0",
-				},
-			},
-			expected: "pkg:pypi/name@v0.1.0",
-		},
-		{
-			name: "gem",
-			pkg: pkg.Package{
-				Name:    "name",
-				Version: "v0.1.0",
-				Type:    pkg.GemPkg,
-			},
-			expected: "pkg:gem/name@v0.1.0",
-		},
-		{
-			name: "npm",
-			pkg: pkg.Package{
-				Name:    "name",
-				Version: "v0.1.0",
-				Type:    pkg.NpmPkg,
-			},
-			expected: "pkg:npm/name@v0.1.0",
-		},
-		{
-			name: "deb with arch",
-			distro: &linux.Release{
-				ID: "ubuntu",
-			},
-			pkg: pkg.Package{
-				Name:    "bad-name",
-				Version: "bad-v0.1.0",
-				Type:    pkg.DebPkg,
-				Metadata: pkg.DpkgMetadata{
-					Package:      "name",
-					Version:      "v0.1.0",
-					Architecture: "amd64",
-				},
-			},
-			expected: "pkg:deb/ubuntu/name@v0.1.0?arch=amd64",
-		},
-		{
-			name: "deb with epoch",
-			distro: &linux.Release{
-				ID: "centos",
-			},
-			pkg: pkg.Package{
-				Name:    "bad-name",
-				Version: "bad-v0.1.0",
-				Type:    pkg.RpmPkg,
-				Metadata: pkg.RpmdbMetadata{
-					Name:    "name",
-					Version: "0.1.0",
-					Epoch:   intRef(2),
-					Arch:    "amd64",
-					Release: "3",
-				},
-			},
-			expected: "pkg:rpm/centos/name@0.1.0-3?arch=amd64&epoch=2",
-		},
-		{
-			name: "deb with nil epoch",
-			distro: &linux.Release{
-				ID: "centos",
-			},
-			pkg: pkg.Package{
-				Name:    "bad-name",
-				Version: "bad-v0.1.0",
-				Type:    pkg.RpmPkg,
-				Metadata: pkg.RpmdbMetadata{
-					Name:    "name",
-					Version: "0.1.0",
-					Epoch:   nil,
-					Arch:    "amd64",
-					Release: "3",
-				},
-			},
-			expected: "pkg:rpm/centos/name@0.1.0-3?arch=amd64",
-		},
-		{
-			name:   "deb with unknown distro",
-			distro: nil,
-			pkg: pkg.Package{
-				Name:    "name",
-				Version: "v0.1.0",
-				Type:    pkg.DebPkg,
-			},
-			expected: "pkg:deb/name@v0.1.0",
-		},
-		{
-			name: "cargo",
-			pkg: pkg.Package{
-				Name:    "name",
-				Version: "v0.1.0",
-				Type:    pkg.RustPkg,
-			},
-			expected: "pkg:cargo/name@v0.1.0",
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			actual := generatePackageURL(test.pkg, test.distro)
-			if actual != test.expected {
-				dmp := diffmatchpatch.New()
-				diffs := dmp.DiffMain(test.expected, actual, true)
-				t.Errorf("diff: %s", dmp.DiffPrettyText(diffs))
-			}
-		})
-	}
-}
-
-func intRef(i int) *int {
-	return &i
-}