Remove MetadataType from core package object and normalize JSON metadataType values (#1983)

* [wip] Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * distinct the package metadata functions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove metadata type from package core model Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * incorporate review feedback for names Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add RPM archive metadata and split parser helpers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * clarify the python package metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename the KB metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * break hackage and composer types by use case Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * linting fix Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix encoding and decoding for syft-json and cyclonedx Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema to 11 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx-xml snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update spdx-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update spdx-tv snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update syft-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * correct metadata type in stack yaml parser test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix bom-ref redactor for cyclonedx-xml Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for legacy package metadata names Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * regenerate json schema v11 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix legacy HackageMetadataType reflect type value check Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * packagemetadata discovery should account for type shadowing Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema version to v12 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update json schema to incorporate changes from main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add syft-json legacy config option Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests around v11-v12 json decoding Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add docs for SYFT_JSON_LEGACY Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename structs to be compliant with new naming scheme Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2026-11-03 16:06:36 +01:00 · 2023-10-30 12:12:04 -04:00
parent f442586ec9
commit 1aaa644007
261 changed files with 7010 additions and 4040 deletions
@@ -12,30 +12,28 @@ func TestNewAuditBinaryCataloger(t *testing.T) {

 	expectedPkgs := []pkg.Package{
 		{
-			Name:         "auditable",
-			Version:      "0.1.0",
-			PURL:         "pkg:cargo/auditable@0.1.0",
-			FoundBy:      "cargo-auditable-binary-cataloger",
-			Locations:    file.NewLocationSet(file.NewVirtualLocation("/hello-auditable", "/hello-auditable")),
-			Language:     pkg.Rust,
-			Type:         pkg.RustPkg,
-			MetadataType: pkg.RustCargoPackageMetadataType,
-			Metadata: pkg.CargoPackageMetadata{
+			Name:      "auditable",
+			Version:   "0.1.0",
+			PURL:      "pkg:cargo/auditable@0.1.0",
+			FoundBy:   "cargo-auditable-binary-cataloger",
+			Locations: file.NewLocationSet(file.NewVirtualLocation("/hello-auditable", "/hello-auditable")),
+			Language:  pkg.Rust,
+			Type:      pkg.RustPkg,
+			Metadata: pkg.RustBinaryAuditEntry{
 				Name:    "auditable",
 				Version: "0.1.0",
 				Source:  "local",
 			},
 		},
 		{
-			Name:         "hello-auditable",
-			Version:      "0.1.0",
-			PURL:         "pkg:cargo/hello-auditable@0.1.0",
-			FoundBy:      "cargo-auditable-binary-cataloger",
-			Locations:    file.NewLocationSet(file.NewVirtualLocation("/hello-auditable", "/hello-auditable")),
-			Language:     pkg.Rust,
-			Type:         pkg.RustPkg,
-			MetadataType: pkg.RustCargoPackageMetadataType,
-			Metadata: pkg.CargoPackageMetadata{
+			Name:      "hello-auditable",
+			Version:   "0.1.0",
+			PURL:      "pkg:cargo/hello-auditable@0.1.0",
+			FoundBy:   "cargo-auditable-binary-cataloger",
+			Locations: file.NewLocationSet(file.NewVirtualLocation("/hello-auditable", "/hello-auditable")),
+			Language:  pkg.Rust,
+			Type:      pkg.RustPkg,
+			Metadata: pkg.RustBinaryAuditEntry{
 				Name:    "hello-auditable",
 				Version: "0.1.0",
 				Source:  "local",
@@ -9,16 +9,15 @@ import (
 )

 // Pkg returns the standard `pkg.Package` representation of the package referenced within the Cargo.lock metadata.
-func newPackageFromCargoMetadata(m pkg.CargoPackageMetadata, locations ...file.Location) pkg.Package {
+func newPackageFromCargoMetadata(m pkg.RustCargoLockEntry, locations ...file.Location) pkg.Package {
 	p := pkg.Package{
-		Name:         m.Name,
-		Version:      m.Version,
-		Locations:    file.NewLocationSet(locations...),
-		PURL:         packageURL(m.Name, m.Version),
-		Language:     pkg.Rust,
-		Type:         pkg.RustPkg,
-		MetadataType: pkg.RustCargoPackageMetadataType,
-		Metadata:     m,
+		Name:      m.Name,
+		Version:   m.Version,
+		Locations: file.NewLocationSet(locations...),
+		PURL:      packageURL(m.Name, m.Version),
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Metadata:  m,
 	}

 	p.SetID()
@@ -42,14 +41,13 @@ func newPackagesFromAudit(location file.Location, versionInfo rustaudit.VersionI

 func newPackageFromAudit(dep *rustaudit.Package, locations ...file.Location) pkg.Package {
 	p := pkg.Package{
-		Name:         dep.Name,
-		Version:      dep.Version,
-		PURL:         packageURL(dep.Name, dep.Version),
-		Language:     pkg.Rust,
-		Type:         pkg.RustPkg,
-		Locations:    file.NewLocationSet(locations...),
-		MetadataType: pkg.RustCargoPackageMetadataType,
-		Metadata: pkg.CargoPackageMetadata{
+		Name:      dep.Name,
+		Version:   dep.Version,
+		PURL:      packageURL(dep.Name, dep.Version),
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Locations: file.NewLocationSet(locations...),
+		Metadata: pkg.RustBinaryAuditEntry{
 			Name:    dep.Name,
 			Version: dep.Version,
 			Source:  dep.Source,
@@ -14,7 +14,7 @@ import (
 var _ generic.Parser = parseCargoLock

 type cargoLockFile struct {
-	Packages []pkg.CargoPackageMetadata `toml:"package"`
+	Packages []pkg.RustCargoLockEntry `toml:"package"`
 }

 // parseCargoLock is a parser function for Cargo.lock contents, returning all rust cargo crates discovered.
@@ -14,15 +14,14 @@ func TestParseCargoLock(t *testing.T) {
 	locations := file.NewLocationSet(file.NewLocation(fixture))
 	expectedPkgs := []pkg.Package{
 		{
-			Name:         "ansi_term",
-			Version:      "0.12.1",
-			PURL:         "pkg:cargo/ansi_term@0.12.1",
-			Locations:    locations,
-			Language:     pkg.Rust,
-			Type:         pkg.RustPkg,
-			MetadataType: pkg.RustCargoPackageMetadataType,
-			Licenses:     pkg.NewLicenseSet(),
-			Metadata: pkg.CargoPackageMetadata{
+			Name:      "ansi_term",
+			Version:   "0.12.1",
+			PURL:      "pkg:cargo/ansi_term@0.12.1",
+			Locations: locations,
+			Language:  pkg.Rust,
+			Type:      pkg.RustPkg,
+			Licenses:  pkg.NewLicenseSet(),
+			Metadata: pkg.RustCargoLockEntry{
 				Name:     "ansi_term",
 				Version:  "0.12.1",
 				Source:   "registry+https://github.com/rust-lang/crates.io-index",
@@ -33,15 +32,14 @@ func TestParseCargoLock(t *testing.T) {
 			},
 		},
 		{
-			Name:         "matches",
-			Version:      "0.1.8",
-			PURL:         "pkg:cargo/matches@0.1.8",
-			Locations:    locations,
-			Language:     pkg.Rust,
-			Type:         pkg.RustPkg,
-			MetadataType: pkg.RustCargoPackageMetadataType,
-			Licenses:     pkg.NewLicenseSet(),
-			Metadata: pkg.CargoPackageMetadata{
+			Name:      "matches",
+			Version:   "0.1.8",
+			PURL:      "pkg:cargo/matches@0.1.8",
+			Locations: locations,
+			Language:  pkg.Rust,
+			Type:      pkg.RustPkg,
+			Licenses:  pkg.NewLicenseSet(),
+			Metadata: pkg.RustCargoLockEntry{
 				Name:         "matches",
 				Version:      "0.1.8",
 				Source:       "registry+https://github.com/rust-lang/crates.io-index",
@@ -50,15 +48,14 @@ func TestParseCargoLock(t *testing.T) {
 			},
 		},
 		{
-			Name:         "memchr",
-			Version:      "2.3.3",
-			PURL:         "pkg:cargo/memchr@2.3.3",
-			Locations:    locations,
-			Language:     pkg.Rust,
-			Type:         pkg.RustPkg,
-			MetadataType: pkg.RustCargoPackageMetadataType,
-			Licenses:     pkg.NewLicenseSet(),
-			Metadata: pkg.CargoPackageMetadata{
+			Name:      "memchr",
+			Version:   "2.3.3",
+			PURL:      "pkg:cargo/memchr@2.3.3",
+			Locations: locations,
+			Language:  pkg.Rust,
+			Type:      pkg.RustPkg,
+			Licenses:  pkg.NewLicenseSet(),
+			Metadata: pkg.RustCargoLockEntry{
 				Name:         "memchr",
 				Version:      "2.3.3",
 				Source:       "registry+https://github.com/rust-lang/crates.io-index",
@@ -67,15 +64,14 @@ func TestParseCargoLock(t *testing.T) {
 			},
 		},
 		{
-			Name:         "natord",
-			Version:      "1.0.9",
-			PURL:         "pkg:cargo/natord@1.0.9",
-			Locations:    locations,
-			Language:     pkg.Rust,
-			Type:         pkg.RustPkg,
-			MetadataType: pkg.RustCargoPackageMetadataType,
-			Licenses:     pkg.NewLicenseSet(),
-			Metadata: pkg.CargoPackageMetadata{
+			Name:      "natord",
+			Version:   "1.0.9",
+			PURL:      "pkg:cargo/natord@1.0.9",
+			Locations: locations,
+			Language:  pkg.Rust,
+			Type:      pkg.RustPkg,
+			Licenses:  pkg.NewLicenseSet(),
+			Metadata: pkg.RustCargoLockEntry{
 				Name:         "natord",
 				Version:      "1.0.9",
 				Source:       "registry+https://github.com/rust-lang/crates.io-index",
@@ -84,15 +80,14 @@ func TestParseCargoLock(t *testing.T) {
 			},
 		},
 		{
-			Name:         "nom",
-			Version:      "4.2.3",
-			PURL:         "pkg:cargo/nom@4.2.3",
-			Locations:    locations,
-			Language:     pkg.Rust,
-			Type:         pkg.RustPkg,
-			MetadataType: pkg.RustCargoPackageMetadataType,
-			Licenses:     pkg.NewLicenseSet(),
-			Metadata: pkg.CargoPackageMetadata{
+			Name:      "nom",
+			Version:   "4.2.3",
+			PURL:      "pkg:cargo/nom@4.2.3",
+			Locations: locations,
+			Language:  pkg.Rust,
+			Type:      pkg.RustPkg,
+			Licenses:  pkg.NewLicenseSet(),
+			Metadata: pkg.RustCargoLockEntry{
 				Name:     "nom",
 				Version:  "4.2.3",
 				Source:   "registry+https://github.com/rust-lang/crates.io-index",
@@ -104,15 +99,14 @@ func TestParseCargoLock(t *testing.T) {
 			},
 		},
 		{
-			Name:         "unicode-bidi",
-			Version:      "0.3.4",
-			PURL:         "pkg:cargo/unicode-bidi@0.3.4",
-			Locations:    locations,
-			Language:     pkg.Rust,
-			Type:         pkg.RustPkg,
-			MetadataType: pkg.RustCargoPackageMetadataType,
-			Licenses:     pkg.NewLicenseSet(),
-			Metadata: pkg.CargoPackageMetadata{
+			Name:      "unicode-bidi",
+			Version:   "0.3.4",
+			PURL:      "pkg:cargo/unicode-bidi@0.3.4",
+			Locations: locations,
+			Language:  pkg.Rust,
+			Type:      pkg.RustPkg,
+			Licenses:  pkg.NewLicenseSet(),
+			Metadata: pkg.RustCargoLockEntry{
 				Name:     "unicode-bidi",
 				Version:  "0.3.4",
 				Source:   "registry+https://github.com/rust-lang/crates.io-index",
@@ -123,15 +117,14 @@ func TestParseCargoLock(t *testing.T) {
 			},
 		},
 		{
-			Name:         "version_check",
-			Version:      "0.1.5",
-			PURL:         "pkg:cargo/version_check@0.1.5",
-			Locations:    locations,
-			Language:     pkg.Rust,
-			Type:         pkg.RustPkg,
-			MetadataType: pkg.RustCargoPackageMetadataType,
-			Licenses:     pkg.NewLicenseSet(),
-			Metadata: pkg.CargoPackageMetadata{
+			Name:      "version_check",
+			Version:   "0.1.5",
+			PURL:      "pkg:cargo/version_check@0.1.5",
+			Locations: locations,
+			Language:  pkg.Rust,
+			Type:      pkg.RustPkg,
+			Licenses:  pkg.NewLicenseSet(),
+			Metadata: pkg.RustCargoLockEntry{
 				Name:         "version_check",
 				Version:      "0.1.5",
 				Source:       "registry+https://github.com/rust-lang/crates.io-index",
@@ -140,15 +133,14 @@ func TestParseCargoLock(t *testing.T) {
 			},
 		},
 		{
-			Name:         "winapi",
-			Version:      "0.3.9",
-			PURL:         "pkg:cargo/winapi@0.3.9",
-			Locations:    locations,
-			Language:     pkg.Rust,
-			Type:         pkg.RustPkg,
-			MetadataType: pkg.RustCargoPackageMetadataType,
-			Licenses:     pkg.NewLicenseSet(),
-			Metadata: pkg.CargoPackageMetadata{
+			Name:      "winapi",
+			Version:   "0.3.9",
+			PURL:      "pkg:cargo/winapi@0.3.9",
+			Locations: locations,
+			Language:  pkg.Rust,
+			Type:      pkg.RustPkg,
+			Licenses:  pkg.NewLicenseSet(),
+			Metadata: pkg.RustCargoLockEntry{
 				Name:     "winapi",
 				Version:  "0.3.9",
 				Source:   "registry+https://github.com/rust-lang/crates.io-index",
@@ -160,15 +152,14 @@ func TestParseCargoLock(t *testing.T) {
 			},
 		},
 		{
-			Name:         "winapi-i686-pc-windows-gnu",
-			Version:      "0.4.0",
-			PURL:         "pkg:cargo/winapi-i686-pc-windows-gnu@0.4.0",
-			Locations:    locations,
-			Language:     pkg.Rust,
-			Type:         pkg.RustPkg,
-			MetadataType: pkg.RustCargoPackageMetadataType,
-			Licenses:     pkg.NewLicenseSet(),
-			Metadata: pkg.CargoPackageMetadata{
+			Name:      "winapi-i686-pc-windows-gnu",
+			Version:   "0.4.0",
+			PURL:      "pkg:cargo/winapi-i686-pc-windows-gnu@0.4.0",
+			Locations: locations,
+			Language:  pkg.Rust,
+			Type:      pkg.RustPkg,
+			Licenses:  pkg.NewLicenseSet(),
+			Metadata: pkg.RustCargoLockEntry{
 				Name:         "winapi-i686-pc-windows-gnu",
 				Version:      "0.4.0",
 				Source:       "registry+https://github.com/rust-lang/crates.io-index",
@@ -177,15 +168,14 @@ func TestParseCargoLock(t *testing.T) {
 			},
 		},
 		{
-			Name:         "winapi-x86_64-pc-windows-gnu",
-			Version:      "0.4.0",
-			PURL:         "pkg:cargo/winapi-x86_64-pc-windows-gnu@0.4.0",
-			Locations:    locations,
-			Language:     pkg.Rust,
-			Type:         pkg.RustPkg,
-			MetadataType: pkg.RustCargoPackageMetadataType,
-			Licenses:     pkg.NewLicenseSet(),
-			Metadata: pkg.CargoPackageMetadata{
+			Name:      "winapi-x86_64-pc-windows-gnu",
+			Version:   "0.4.0",
+			PURL:      "pkg:cargo/winapi-x86_64-pc-windows-gnu@0.4.0",
+			Locations: locations,
+			Language:  pkg.Rust,
+			Type:      pkg.RustPkg,
+			Licenses:  pkg.NewLicenseSet(),
+			Metadata: pkg.RustCargoLockEntry{
 				Name:         "winapi-x86_64-pc-windows-gnu",
 				Version:      "0.4.0",
 				Source:       "registry+https://github.com/rust-lang/crates.io-index",