Remove MetadataType from core package object and normalize JSON metadataType values (#1983)

* [wip] Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * distinct the package metadata functions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove metadata type from package core model Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * incorporate review feedback for names Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add RPM archive metadata and split parser helpers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * clarify the python package metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename the KB metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * break hackage and composer types by use case Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * linting fix Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix encoding and decoding for syft-json and cyclonedx Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema to 11 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx-xml snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update spdx-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update spdx-tv snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update syft-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * correct metadata type in stack yaml parser test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix bom-ref redactor for cyclonedx-xml Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for legacy package metadata names Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * regenerate json schema v11 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix legacy HackageMetadataType reflect type value check Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * packagemetadata discovery should account for type shadowing Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema version to v12 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update json schema to incorporate changes from main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add syft-json legacy config option Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests around v11-v12 json decoding Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add docs for SYFT_JSON_LEGACY Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename structs to be compliant with new naming scheme Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2026-11-04 00:16:38 +01:00 · 2023-10-30 12:12:04 -04:00
parent f442586ec9
commit 1aaa644007
261 changed files with 7010 additions and 4040 deletions
@@ -490,17 +490,15 @@ func extractPkgInfo(p *spdx.Package) pkgInfo {

 func toSyftPackage(p *spdx.Package) pkg.Package {
 	info := extractPkgInfo(p)
-	metadataType, metadata := extractMetadata(p, info)
 	sP := &pkg.Package{
-		Type:         info.typ,
-		Name:         p.PackageName,
-		Version:      p.PackageVersion,
-		Licenses:     pkg.NewLicenseSet(parseSPDXLicenses(p)...),
-		CPEs:         extractCPEs(p),
-		PURL:         purlValue(info.purl),
-		Language:     info.lang,
-		MetadataType: metadataType,
-		Metadata:     metadata,
+		Type:     info.typ,
+		Name:     p.PackageName,
+		Version:  p.PackageVersion,
+		Licenses: pkg.NewLicenseSet(parseSPDXLicenses(p)...),
+		CPEs:     extractCPEs(p),
+		PURL:     purlValue(info.purl),
+		Language: info.lang,
+		Metadata: extractMetadata(p, info),
 	}

 	sP.SetID()
@@ -541,7 +539,7 @@ func cleanSPDXID(id string) string {
 }

 //nolint:funlen
-func extractMetadata(p *spdx.Package, info pkgInfo) (pkg.MetadataType, interface{}) {
+func extractMetadata(p *spdx.Package, info pkgInfo) any {
 	arch := info.qualifierValue(pkg.PURLQualifierArch)
 	upstreamValue := info.qualifierValue(pkg.PURLQualifierUpstream)
 	upstream := strings.SplitN(upstreamValue, "@", 2)
@@ -560,7 +558,7 @@ func extractMetadata(p *spdx.Package, info pkgInfo) (pkg.MetadataType, interface
 	}
 	switch info.typ {
 	case pkg.ApkPkg:
-		return pkg.ApkMetadataType, pkg.ApkMetadata{
+		return pkg.ApkDBEntry{
 			Package:       p.PackageName,
 			OriginPackage: upstreamName,
 			Maintainer:    supplier,
@@ -577,7 +575,7 @@ func extractMetadata(p *spdx.Package, info pkgInfo) (pkg.MetadataType, interface
 		} else {
 			epoch = &converted
 		}
-		return pkg.RpmMetadataType, pkg.RpmMetadata{
+		return pkg.RpmDBEntry{
 			Name:      p.PackageName,
 			Version:   p.PackageVersion,
 			Epoch:     epoch,
@@ -586,7 +584,7 @@ func extractMetadata(p *spdx.Package, info pkgInfo) (pkg.MetadataType, interface
 			Vendor:    originator,
 		}
 	case pkg.DebPkg:
-		return pkg.DpkgMetadataType, pkg.DpkgMetadata{
+		return pkg.DpkgDBEntry{
 			Package:       p.PackageName,
 			Source:        upstreamName,
 			Version:       p.PackageVersion,
@@ -599,7 +597,7 @@ func extractMetadata(p *spdx.Package, info pkgInfo) (pkg.MetadataType, interface
 		for _, value := range p.PackageChecksums {
 			digests = append(digests, file.Digest{Algorithm: fromChecksumAlgorithm(value.Algorithm), Value: value.Value})
 		}
-		return pkg.JavaMetadataType, pkg.JavaMetadata{
+		return pkg.JavaArchive{
 			ArchiveDigests: digests,
 		}
 	case pkg.GoModulePkg:
@@ -613,11 +611,11 @@ func extractMetadata(p *spdx.Package, info pkgInfo) (pkg.MetadataType, interface
 			h1Digest = digest
 			break
 		}
-		return pkg.GolangBinMetadataType, pkg.GolangBinMetadata{
+		return pkg.GolangBinaryBuildinfoEntry{
 			H1Digest: h1Digest,
 		}
 	}
-	return pkg.UnknownMetadataType, nil
+	return nil
 }

 func findPURLValue(p *spdx.Package) string {