Remove MetadataType from core package object and normalize JSON metadataType values (#1983)

* [wip] Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * distinct the package metadata functions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove metadata type from package core model Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * incorporate review feedback for names Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add RPM archive metadata and split parser helpers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * clarify the python package metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename the KB metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * break hackage and composer types by use case Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * linting fix Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix encoding and decoding for syft-json and cyclonedx Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema to 11 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx-xml snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update spdx-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update spdx-tv snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update syft-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * correct metadata type in stack yaml parser test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix bom-ref redactor for cyclonedx-xml Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for legacy package metadata names Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * regenerate json schema v11 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix legacy HackageMetadataType reflect type value check Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * packagemetadata discovery should account for type shadowing Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema version to v12 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update json schema to incorporate changes from main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add syft-json legacy config option Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests around v11-v12 json decoding Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add docs for SYFT_JSON_LEGACY Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename structs to be compliant with new naming scheme Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2026-11-05 00:46:38 +01:00 · 2023-10-30 12:12:04 -04:00
parent f442586ec9
commit 1aaa644007
261 changed files with 7010 additions and 4040 deletions
@@ -8,44 +8,59 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 )

-func newComposerLockPackage(m parsedData, indexLocation file.Location) pkg.Package {
+func newComposerLockPackage(pd parsedLockData, indexLocation file.Location) pkg.Package {
 	p := pkg.Package{
-		Name:         m.Name,
-		Version:      m.Version,
-		Locations:    file.NewLocationSet(indexLocation),
-		Licenses:     pkg.NewLicenseSet(pkg.NewLicensesFromLocation(indexLocation, m.License...)...),
-		PURL:         packageURL(m),
-		Language:     pkg.PHP,
-		Type:         pkg.PhpComposerPkg,
-		MetadataType: pkg.PhpComposerJSONMetadataType,
-		Metadata:     m.PhpComposerJSONMetadata,
+		Name:      pd.Name,
+		Version:   pd.Version,
+		Locations: file.NewLocationSet(indexLocation.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation)),
+		Licenses:  pkg.NewLicenseSet(pkg.NewLicensesFromLocation(indexLocation, pd.License...)...),
+		PURL:      packageURL(pd.Name, pd.Version),
+		Language:  pkg.PHP,
+		Type:      pkg.PhpComposerPkg,
+		Metadata:  pd.PhpComposerLockEntry,
 	}

 	p.SetID()
 	return p
 }

-func packageURL(m parsedData) string {
-	var name, vendor string
-	fields := strings.Split(m.Name, "/")
+func newComposerInstalledPackage(pd parsedInstalledData, indexLocation file.Location) pkg.Package {
+	p := pkg.Package{
+		Name:      pd.Name,
+		Version:   pd.Version,
+		Locations: file.NewLocationSet(indexLocation.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation)),
+		Licenses:  pkg.NewLicenseSet(pkg.NewLicensesFromLocation(indexLocation, pd.License...)...),
+		PURL:      packageURL(pd.Name, pd.Version),
+		Language:  pkg.PHP,
+		Type:      pkg.PhpComposerPkg,
+		Metadata:  pd.PhpComposerInstalledEntry,
+	}
+
+	p.SetID()
+	return p
+}
+
+func packageURL(name, version string) string {
+	var pkgName, vendor string
+	fields := strings.Split(name, "/")
 	switch len(fields) {
 	case 0:
 		return ""
 	case 1:
-		name = m.Name
+		pkgName = name
 	case 2:
 		vendor = fields[0]
-		name = fields[1]
+		pkgName = fields[1]
 	default:
 		vendor = fields[0]
-		name = strings.Join(fields[1:], "-")
+		pkgName = strings.Join(fields[1:], "-")
 	}

 	pURL := packageurl.NewPackageURL(
 		packageurl.TypeComposer,
 		vendor,
-		name,
-		m.Version,
+		pkgName,
+		version,
 		nil,
 		"")
 	return pURL.ToString()