Remove MetadataType from core package object and normalize JSON metadataType values (#1983)

* [wip] Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * distinct the package metadata functions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove metadata type from package core model Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * incorporate review feedback for names Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add RPM archive metadata and split parser helpers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * clarify the python package metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename the KB metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * break hackage and composer types by use case Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * linting fix Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix encoding and decoding for syft-json and cyclonedx Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema to 11 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx-xml snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update spdx-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update spdx-tv snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update syft-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * correct metadata type in stack yaml parser test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix bom-ref redactor for cyclonedx-xml Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for legacy package metadata names Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * regenerate json schema v11 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix legacy HackageMetadataType reflect type value check Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * packagemetadata discovery should account for type shadowing Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema version to v12 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update json schema to incorporate changes from main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add syft-json legacy config option Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests around v11-v12 json decoding Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add docs for SYFT_JSON_LEGACY Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename structs to be compliant with new naming scheme Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2026-11-05 00:46:38 +01:00 · 2023-10-30 12:12:04 -04:00
parent f442586ec9
commit 1aaa644007
261 changed files with 7010 additions and 4040 deletions
@@ -9,7 +9,7 @@ import (

 const catalogerName = "elixir-mix-lock-cataloger"

-// NewMixLockCataloger returns parses mix.lock files and returns packages
+// NewMixLockCataloger returns a cataloger object for Elixir mix.lock files.
 func NewMixLockCataloger() *generic.Cataloger {
 	return generic.NewCataloger(catalogerName).
 		WithParserByGlobs(parseMixLock, "**/mix.lock")
@@ -6,16 +6,15 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 )

-func newPackage(d pkg.MixLockMetadata, locations ...file.Location) pkg.Package {
+func newPackage(d pkg.ElixirMixLockEntry, locations ...file.Location) pkg.Package {
 	p := pkg.Package{
-		Name:         d.Name,
-		Version:      d.Version,
-		Language:     pkg.Elixir,
-		Locations:    file.NewLocationSet(locations...),
-		PURL:         packageURL(d),
-		Type:         pkg.HexPkg,
-		MetadataType: pkg.MixLockMetadataType,
-		Metadata:     d,
+		Name:      d.Name,
+		Version:   d.Version,
+		Language:  pkg.Elixir,
+		Locations: file.NewLocationSet(locations...),
+		PURL:      packageURL(d),
+		Type:      pkg.HexPkg,
+		Metadata:  d,
 	}

 	p.SetID()
@@ -23,7 +22,7 @@ func newPackage(d pkg.MixLockMetadata, locations ...file.Location) pkg.Package {
 	return p
 }

-func packageURL(m pkg.MixLockMetadata) string {
+func packageURL(m pkg.ElixirMixLockEntry) string {
 	var qualifiers packageurl.Qualifiers

 	return packageurl.NewPackageURL(
@@ -45,7 +45,7 @@ func parseMixLock(_ file.Resolver, _ *generic.Environment, reader file.LocationR

 		packages = append(packages,
 			newPackage(
-				pkg.MixLockMetadata{
+				pkg.ElixirMixLockEntry{
 					Name:       name,
 					Version:    version,
 					PkgHash:    hash,
@@ -13,14 +13,13 @@ func TestParseMixLock(t *testing.T) {
 	locations := file.NewLocationSet(file.NewLocation("test-fixtures/mix.lock"))
 	expected := []pkg.Package{
 		{
-			Name:         "castore",
-			Version:      "0.1.17",
-			Language:     pkg.Elixir,
-			Type:         pkg.HexPkg,
-			Locations:    locations,
-			PURL:         "pkg:hex/castore@0.1.17",
-			MetadataType: pkg.MixLockMetadataType,
-			Metadata: pkg.MixLockMetadata{
+			Name:      "castore",
+			Version:   "0.1.17",
+			Language:  pkg.Elixir,
+			Type:      pkg.HexPkg,
+			Locations: locations,
+			PURL:      "pkg:hex/castore@0.1.17",
+			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "castore",
 				Version:    "0.1.17",
 				PkgHash:    "ba672681de4e51ed8ec1f74ed624d104c0db72742ea1a5e74edbc770c815182f",
@@ -28,14 +27,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:         "connection",
-			Version:      "1.1.0",
-			Language:     pkg.Elixir,
-			Type:         pkg.HexPkg,
-			Locations:    locations,
-			PURL:         "pkg:hex/connection@1.1.0",
-			MetadataType: pkg.MixLockMetadataType,
-			Metadata: pkg.MixLockMetadata{
+			Name:      "connection",
+			Version:   "1.1.0",
+			Language:  pkg.Elixir,
+			Type:      pkg.HexPkg,
+			Locations: locations,
+			PURL:      "pkg:hex/connection@1.1.0",
+			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "connection",
 				Version:    "1.1.0",
 				PkgHash:    "ff2a49c4b75b6fb3e674bfc5536451607270aac754ffd1bdfe175abe4a6d7a68",
@@ -43,14 +41,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:         "cowboy",
-			Version:      "2.9.0",
-			Language:     pkg.Elixir,
-			Type:         pkg.HexPkg,
-			Locations:    locations,
-			PURL:         "pkg:hex/cowboy@2.9.0",
-			MetadataType: pkg.MixLockMetadataType,
-			Metadata: pkg.MixLockMetadata{
+			Name:      "cowboy",
+			Version:   "2.9.0",
+			Language:  pkg.Elixir,
+			Type:      pkg.HexPkg,
+			Locations: locations,
+			PURL:      "pkg:hex/cowboy@2.9.0",
+			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "cowboy",
 				Version:    "2.9.0",
 				PkgHash:    "865dd8b6607e14cf03282e10e934023a1bd8be6f6bacf921a7e2a96d800cd452",
@@ -58,14 +55,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:         "cowboy_telemetry",
-			Version:      "0.4.0",
-			Language:     pkg.Elixir,
-			Type:         pkg.HexPkg,
-			Locations:    locations,
-			PURL:         "pkg:hex/cowboy_telemetry@0.4.0",
-			MetadataType: pkg.MixLockMetadataType,
-			Metadata: pkg.MixLockMetadata{
+			Name:      "cowboy_telemetry",
+			Version:   "0.4.0",
+			Language:  pkg.Elixir,
+			Type:      pkg.HexPkg,
+			Locations: locations,
+			PURL:      "pkg:hex/cowboy_telemetry@0.4.0",
+			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "cowboy_telemetry",
 				Version:    "0.4.0",
 				PkgHash:    "f239f68b588efa7707abce16a84d0d2acf3a0f50571f8bb7f56a15865aae820c",
@@ -73,14 +69,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:         "cowlib",
-			Version:      "2.11.0",
-			Language:     pkg.Elixir,
-			Type:         pkg.HexPkg,
-			Locations:    locations,
-			PURL:         "pkg:hex/cowlib@2.11.0",
-			MetadataType: pkg.MixLockMetadataType,
-			Metadata: pkg.MixLockMetadata{
+			Name:      "cowlib",
+			Version:   "2.11.0",
+			Language:  pkg.Elixir,
+			Type:      pkg.HexPkg,
+			Locations: locations,
+			PURL:      "pkg:hex/cowlib@2.11.0",
+			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "cowlib",
 				Version:    "2.11.0",
 				PkgHash:    "0b9ff9c346629256c42ebe1eeb769a83c6cb771a6ee5960bd110ab0b9b872063",
@@ -88,14 +83,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:         "db_connection",
-			Version:      "2.4.2",
-			Language:     pkg.Elixir,
-			Type:         pkg.HexPkg,
-			Locations:    locations,
-			PURL:         "pkg:hex/db_connection@2.4.2",
-			MetadataType: pkg.MixLockMetadataType,
-			Metadata: pkg.MixLockMetadata{
+			Name:      "db_connection",
+			Version:   "2.4.2",
+			Language:  pkg.Elixir,
+			Type:      pkg.HexPkg,
+			Locations: locations,
+			PURL:      "pkg:hex/db_connection@2.4.2",
+			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "db_connection",
 				Version:    "2.4.2",
 				PkgHash:    "f92e79aff2375299a16bcb069a14ee8615c3414863a6fef93156aee8e86c2ff3",
@@ -103,14 +97,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:         "decimal",
-			Version:      "2.0.0",
-			Language:     pkg.Elixir,
-			Type:         pkg.HexPkg,
-			Locations:    locations,
-			PURL:         "pkg:hex/decimal@2.0.0",
-			MetadataType: pkg.MixLockMetadataType,
-			Metadata: pkg.MixLockMetadata{
+			Name:      "decimal",
+			Version:   "2.0.0",
+			Language:  pkg.Elixir,
+			Type:      pkg.HexPkg,
+			Locations: locations,
+			PURL:      "pkg:hex/decimal@2.0.0",
+			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "decimal",
 				Version:    "2.0.0",
 				PkgHash:    "a78296e617b0f5dd4c6caf57c714431347912ffb1d0842e998e9792b5642d697",
@@ -118,14 +111,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:         "earmark_parser",
-			Version:      "1.4.25",
-			Language:     pkg.Elixir,
-			Type:         pkg.HexPkg,
-			Locations:    locations,
-			PURL:         "pkg:hex/earmark_parser@1.4.25",
-			MetadataType: pkg.MixLockMetadataType,
-			Metadata: pkg.MixLockMetadata{
+			Name:      "earmark_parser",
+			Version:   "1.4.25",
+			Language:  pkg.Elixir,
+			Type:      pkg.HexPkg,
+			Locations: locations,
+			PURL:      "pkg:hex/earmark_parser@1.4.25",
+			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "earmark_parser",
 				Version:    "1.4.25",
 				PkgHash:    "2024618731c55ebfcc5439d756852ec4e85978a39d0d58593763924d9a15916f",
@@ -133,14 +125,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:         "ecto",
-			Version:      "3.8.1",
-			Language:     pkg.Elixir,
-			Type:         pkg.HexPkg,
-			Locations:    locations,
-			PURL:         "pkg:hex/ecto@3.8.1",
-			MetadataType: pkg.MixLockMetadataType,
-			Metadata: pkg.MixLockMetadata{
+			Name:      "ecto",
+			Version:   "3.8.1",
+			Language:  pkg.Elixir,
+			Type:      pkg.HexPkg,
+			Locations: locations,
+			PURL:      "pkg:hex/ecto@3.8.1",
+			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "ecto",
 				Version:    "3.8.1",
 				PkgHash:    "35e0bd8c8eb772e14a5191a538cd079706ecb45164ea08a7523b4fc69ab70f56",
@@ -148,14 +139,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:         "ecto_sql",
-			Version:      "3.8.1",
-			Language:     pkg.Elixir,
-			Type:         pkg.HexPkg,
-			Locations:    locations,
-			PURL:         "pkg:hex/ecto_sql@3.8.1",
-			MetadataType: pkg.MixLockMetadataType,
-			Metadata: pkg.MixLockMetadata{
+			Name:      "ecto_sql",
+			Version:   "3.8.1",
+			Language:  pkg.Elixir,
+			Type:      pkg.HexPkg,
+			Locations: locations,
+			PURL:      "pkg:hex/ecto_sql@3.8.1",
+			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "ecto_sql",
 				Version:    "3.8.1",
 				PkgHash:    "1acaaba32ca0551fd19e492fc7c80414e72fc1a7140fc9395aaa53c2e8629798",
@@ -163,14 +153,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:         "esbuild",
-			Version:      "0.5.0",
-			Language:     pkg.Elixir,
-			Type:         pkg.HexPkg,
-			Locations:    locations,
-			PURL:         "pkg:hex/esbuild@0.5.0",
-			MetadataType: pkg.MixLockMetadataType,
-			Metadata: pkg.MixLockMetadata{
+			Name:      "esbuild",
+			Version:   "0.5.0",
+			Language:  pkg.Elixir,
+			Type:      pkg.HexPkg,
+			Locations: locations,
+			PURL:      "pkg:hex/esbuild@0.5.0",
+			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "esbuild",
 				Version:    "0.5.0",
 				PkgHash:    "d5bb08ff049d7880ee3609ed5c4b864bd2f46445ea40b16b4acead724fb4c4a3",
@@ -178,14 +167,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:         "ex_doc",
-			Version:      "0.28.4",
-			Language:     pkg.Elixir,
-			Type:         pkg.HexPkg,
-			Locations:    locations,
-			PURL:         "pkg:hex/ex_doc@0.28.4",
-			MetadataType: pkg.MixLockMetadataType,
-			Metadata: pkg.MixLockMetadata{
+			Name:      "ex_doc",
+			Version:   "0.28.4",
+			Language:  pkg.Elixir,
+			Type:      pkg.HexPkg,
+			Locations: locations,
+			PURL:      "pkg:hex/ex_doc@0.28.4",
+			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "ex_doc",
 				Version:    "0.28.4",
 				PkgHash:    "001a0ea6beac2f810f1abc3dbf4b123e9593eaa5f00dd13ded024eae7c523298",
@@ -193,14 +181,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:         "gettext",
-			Version:      "0.19.1",
-			Language:     pkg.Elixir,
-			Type:         pkg.HexPkg,
-			Locations:    locations,
-			PURL:         "pkg:hex/gettext@0.19.1",
-			MetadataType: pkg.MixLockMetadataType,
-			Metadata: pkg.MixLockMetadata{
+			Name:      "gettext",
+			Version:   "0.19.1",
+			Language:  pkg.Elixir,
+			Type:      pkg.HexPkg,
+			Locations: locations,
+			PURL:      "pkg:hex/gettext@0.19.1",
+			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "gettext",
 				Version:    "0.19.1",
 				PkgHash:    "564953fd21f29358e68b91634799d9d26989f8d039d7512622efb3c3b1c97892",
@@ -208,14 +195,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:         "hpax",
-			Version:      "0.1.1",
-			Language:     pkg.Elixir,
-			Type:         pkg.HexPkg,
-			Locations:    locations,
-			PURL:         "pkg:hex/hpax@0.1.1",
-			MetadataType: pkg.MixLockMetadataType,
-			Metadata: pkg.MixLockMetadata{
+			Name:      "hpax",
+			Version:   "0.1.1",
+			Language:  pkg.Elixir,
+			Type:      pkg.HexPkg,
+			Locations: locations,
+			PURL:      "pkg:hex/hpax@0.1.1",
+			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "hpax",
 				Version:    "0.1.1",
 				PkgHash:    "2396c313683ada39e98c20a75a82911592b47e5c24391363343bde74f82396ca",
@@ -223,14 +209,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:         "jason",
-			Version:      "1.3.0",
-			Language:     pkg.Elixir,
-			Type:         pkg.HexPkg,
-			Locations:    locations,
-			PURL:         "pkg:hex/jason@1.3.0",
-			MetadataType: pkg.MixLockMetadataType,
-			Metadata: pkg.MixLockMetadata{
+			Name:      "jason",
+			Version:   "1.3.0",
+			Language:  pkg.Elixir,
+			Type:      pkg.HexPkg,
+			Locations: locations,
+			PURL:      "pkg:hex/jason@1.3.0",
+			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "jason",
 				Version:    "1.3.0",
 				PkgHash:    "fa6b82a934feb176263ad2df0dbd91bf633d4a46ebfdffea0c8ae82953714946",