Remove MetadataType from core package object and normalize JSON metadataType values (#1983)

* [wip] Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * distinct the package metadata functions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove metadata type from package core model Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * incorporate review feedback for names Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add RPM archive metadata and split parser helpers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * clarify the python package metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename the KB metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * break hackage and composer types by use case Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * linting fix Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix encoding and decoding for syft-json and cyclonedx Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema to 11 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx-xml snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update spdx-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update spdx-tv snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update syft-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * correct metadata type in stack yaml parser test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix bom-ref redactor for cyclonedx-xml Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for legacy package metadata names Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * regenerate json schema v11 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix legacy HackageMetadataType reflect type value check Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * packagemetadata discovery should account for type shadowing Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema version to v12 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update json schema to incorporate changes from main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add syft-json legacy config option Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests around v11-v12 json decoding Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add docs for SYFT_JSON_LEGACY Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename structs to be compliant with new naming scheme Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2026-11-01 23:16:30 +01:00 · 2023-10-30 12:12:04 -04:00
parent f442586ec9
commit 1aaa644007
261 changed files with 7010 additions and 4040 deletions
@@ -108,12 +108,11 @@ func newDirectoryCatalog() *pkg.Collection {
 		Locations: file.NewLocationSet(
 			file.NewLocation("/some/path/pkg1"),
 		),
-		Language:     pkg.Python,
-		MetadataType: pkg.PythonPackageMetadataType,
+		Language: pkg.Python,
 		Licenses: pkg.NewLicenseSet(
 			pkg.NewLicense("MIT"),
 		),
-		Metadata: pkg.PythonPackageMetadata{
+		Metadata: pkg.PythonPackage{
 			Name:    "package-1",
 			Version: "1.0.1",
 			Files: []pkg.PythonFileRecord{
@@ -135,8 +134,7 @@ func newDirectoryCatalog() *pkg.Collection {
 		Locations: file.NewLocationSet(
 			file.NewLocation("/some/path/pkg1"),
 		),
-		MetadataType: pkg.DpkgMetadataType,
-		Metadata: pkg.DpkgMetadata{
+		Metadata: pkg.DpkgDBEntry{
 			Package: "package-2",
 			Version: "2.0.1",
 		},
@@ -161,12 +159,11 @@ func newDirectoryCatalogWithAuthorField() *pkg.Collection {
 		Locations: file.NewLocationSet(
 			file.NewLocation("/some/path/pkg1"),
 		),
-		Language:     pkg.Python,
-		MetadataType: pkg.PythonPackageMetadataType,
+		Language: pkg.Python,
 		Licenses: pkg.NewLicenseSet(
 			pkg.NewLicense("MIT"),
 		),
-		Metadata: pkg.PythonPackageMetadata{
+		Metadata: pkg.PythonPackage{
 			Name:    "package-1",
 			Version: "1.0.1",
 			Author:  "test-author",
@@ -189,8 +186,7 @@ func newDirectoryCatalogWithAuthorField() *pkg.Collection {
 		Locations: file.NewLocationSet(
 			file.NewLocation("/some/path/pkg1"),
 		),
-		MetadataType: pkg.DpkgMetadataType,
-		Metadata: pkg.DpkgMetadata{
+		Metadata: pkg.DpkgDBEntry{
 			Package: "package-2",
 			Version: "2.0.1",
 		},
@@ -95,48 +95,52 @@ func changeToDirectoryWithGoldenFixture(t testing.TB, testImage string) func() {
 }

 func populateImageCatalog(catalog *pkg.Collection, img *image.Image) {
+	// TODO: this helper function is coupled to the image-simple fixture, which seems like a bad idea
 	_, ref1, _ := img.SquashedTree().File("/somefile-1.txt", filetree.FollowBasenameLinks)
 	_, ref2, _ := img.SquashedTree().File("/somefile-2.txt", filetree.FollowBasenameLinks)

 	// populate catalog with test data
-	catalog.Add(pkg.Package{
-		Name:    "package-1",
-		Version: "1.0.1",
-		Locations: file.NewLocationSet(
-			file.NewLocationFromImage(string(ref1.RealPath), *ref1.Reference, img),
-		),
-		Type:         pkg.PythonPkg,
-		FoundBy:      "the-cataloger-1",
-		Language:     pkg.Python,
-		MetadataType: pkg.PythonPackageMetadataType,
-		Licenses: pkg.NewLicenseSet(
-			pkg.NewLicense("MIT"),
-		),
-		Metadata: pkg.PythonPackageMetadata{
+	if ref1 != nil {
+		catalog.Add(pkg.Package{
 			Name:    "package-1",
 			Version: "1.0.1",
-		},
-		PURL: "a-purl-1", // intentionally a bad pURL for test fixtures
-		CPEs: []cpe.CPE{
-			cpe.Must("cpe:2.3:*:some:package:1:*:*:*:*:*:*:*"),
-		},
-	})
-	catalog.Add(pkg.Package{
-		Name:    "package-2",
-		Version: "2.0.1",
-		Locations: file.NewLocationSet(
-			file.NewLocationFromImage(string(ref2.RealPath), *ref2.Reference, img),
-		),
-		Type:         pkg.DebPkg,
-		FoundBy:      "the-cataloger-2",
-		MetadataType: pkg.DpkgMetadataType,
-		Metadata: pkg.DpkgMetadata{
-			Package: "package-2",
+			Locations: file.NewLocationSet(
+				file.NewLocationFromImage(string(ref1.RealPath), *ref1.Reference, img),
+			),
+			Type:     pkg.PythonPkg,
+			FoundBy:  "the-cataloger-1",
+			Language: pkg.Python,
+			Licenses: pkg.NewLicenseSet(
+				pkg.NewLicense("MIT"),
+			),
+			Metadata: pkg.PythonPackage{
+				Name:    "package-1",
+				Version: "1.0.1",
+			},
+			PURL: "a-purl-1", // intentionally a bad pURL for test fixtures
+			CPEs: []cpe.CPE{
+				cpe.Must("cpe:2.3:*:some:package:1:*:*:*:*:*:*:*"),
+			},
+		})
+	}
+
+	if ref2 != nil {
+		catalog.Add(pkg.Package{
+			Name:    "package-2",
 			Version: "2.0.1",
-		},
-		PURL: "pkg:deb/debian/package-2@2.0.1",
-		CPEs: []cpe.CPE{
-			cpe.Must("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"),
-		},
-	})
+			Locations: file.NewLocationSet(
+				file.NewLocationFromImage(string(ref2.RealPath), *ref2.Reference, img),
+			),
+			Type:    pkg.DebPkg,
+			FoundBy: "the-cataloger-2",
+			Metadata: pkg.DpkgDBEntry{
+				Package: "package-2",
+				Version: "2.0.1",
+			},
+			PURL: "pkg:deb/debian/package-2@2.0.1",
+			CPEs: []cpe.CPE{
+				cpe.Must("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"),
+			},
+		})
+	}
 }