feat: optionally capture golang binary symbols (#4988)

---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>

cmd/syft/internal/options/catalog.go

@@ -198,7 +198,8 @@ func (cfg Catalog) ToPackagesConfig() pkgcataloging.Config {
 					WithFromBuildSettings(cfg.Golang.MainModuleVersion.FromBuildSettings).
 					WithFromLDFlags(cfg.Golang.MainModuleVersion.FromLDFlags),
 			).
-			WithUsePackagesLib(*multiLevelOption(true, enrichmentEnabled(cfg.Enrich, task.Go, task.Golang), cfg.Golang.UsePackagesLib)),
+			WithUsePackagesLib(*multiLevelOption(true, enrichmentEnabled(cfg.Enrich, task.Go, task.Golang), cfg.Golang.UsePackagesLib)).
+			WithCaptureSymbols(cfg.Golang.CaptureSymbols),
 		JavaScript: javascript.DefaultCatalogerConfig().
 			WithIncludeDevDependencies(*multiLevelOption(false, cfg.JavaScript.IncludeDevDependencies)).
 			WithSearchRemoteLicenses(*multiLevelOption(false, enrichmentEnabled(cfg.Enrich, task.JavaScript, task.Node, task.NPM), cfg.JavaScript.SearchRemoteLicenses)).

cmd/syft/internal/options/golang.go

@@ -4,6 +4,7 @@ import (
 	"strings"
 
 	"github.com/anchore/clio"
+	"github.com/anchore/syft/syft/cataloging"
 	"github.com/anchore/syft/syft/pkg/cataloger/golang"
 )
 
@@ -17,10 +18,12 @@ type golangConfig struct {
 	NoProxy                     string                        `json:"no-proxy" yaml:"no-proxy" mapstructure:"no-proxy"`
 	MainModuleVersion           golangMainModuleVersionConfig `json:"main-module-version" yaml:"main-module-version" mapstructure:"main-module-version"`
 	UsePackagesLib              *bool                         `json:"use-packages-lib" yaml:"use-packages-lib" mapstructure:"use-packages-lib"`
+	CaptureSymbols              cataloging.SymbolScope        `json:"capture-symbols" yaml:"capture-symbols" mapstructure:"capture-symbols"`
 }
 
 var _ interface {
 	clio.FieldDescriber
+	clio.PostLoader
 } = (*golangConfig)(nil)
 
 func (o *golangConfig) DescribeFields(descriptions clio.FieldDescriptionSet) {
@@ -39,12 +42,19 @@ if unset this defaults to $GONOPROXY`)
 always show (devel) as the version. Use these options to control heuristics to guess
 a more accurate version from the binary.`)
 	descriptions.Add(&o.UsePackagesLib, `use the golang.org/x/tools/go/packages library, which executes golang tooling found on the path in addition to potential network access to get the most accurate results`)
+	descriptions.Add(&o.CaptureSymbols, `capture function symbols from the binary symbol table (pclntab). valid values are:
+"none" (disabled), "stdlib" (only the synthetic stdlib package), and "all" (all module packages plus stdlib)`)
 	descriptions.Add(&o.MainModuleVersion.FromLDFlags, `look for LD flags that appear to be setting a version (e.g. -X main.version=1.0.0)`)
-	descriptions.Add(&o.MainModuleVersion.FromBuildSettings, `use the build settings (e.g. vcs.version & vcs.time) to craft a v0 pseudo version 
+	descriptions.Add(&o.MainModuleVersion.FromBuildSettings, `use the build settings (e.g. vcs.version & vcs.time) to craft a v0 pseudo version
 (e.g. v0.0.0-20220308212642-53e6d0aaf6fb) when a more accurate version cannot be found otherwise`)
 	descriptions.Add(&o.MainModuleVersion.FromContents, `search for semver-like strings in the binary contents`)
 }
 
+func (o *golangConfig) PostLoad() error {
+	o.CaptureSymbols = o.CaptureSymbols.Parse()
+	return nil
+}
+
 type golangMainModuleVersionConfig struct {
 	FromLDFlags       bool `json:"from-ld-flags" yaml:"from-ld-flags" mapstructure:"from-ld-flags"`
 	FromContents      bool `json:"from-contents" yaml:"from-contents" mapstructure:"from-contents"`
@@ -67,5 +77,6 @@ func defaultGolangConfig() golangConfig {
 			FromBuildSettings: def.MainModuleVersion.FromBuildSettings,
 		},
 		UsePackagesLib: nil, // this defaults to true, which is the API default
+		CaptureSymbols: def.CaptureSymbols,
 	}
 }

cmd/syft/internal/options/golang_test.go

@@ -0,0 +1,57 @@
+package options
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/syft/syft/cataloging"
+)
+
+func Test_golangConfig_PostLoad(t *testing.T) {
+	tests := []struct {
+		name     string
+		cfg      golangConfig
+		expected cataloging.SymbolScope
+		wantErr  assert.ErrorAssertionFunc
+	}{
+		{
+			name:     "normalize all",
+			cfg:      golangConfig{CaptureSymbols: "all"},
+			expected: cataloging.SymbolScopeAll,
+		},
+		{
+			name:     "normalize stdlib",
+			cfg:      golangConfig{CaptureSymbols: "stdlib"},
+			expected: cataloging.SymbolScopeStdlib,
+		},
+		{
+			name:     "empty defaults to none",
+			cfg:      golangConfig{CaptureSymbols: ""},
+			expected: cataloging.SymbolScopeNone,
+		},
+		{
+			name:     "invalid value defaults to none",
+			cfg:      golangConfig{CaptureSymbols: "bogus"},
+			expected: cataloging.SymbolScopeNone,
+		},
+		{
+			name:     "boolean spellings default to none",
+			cfg:      golangConfig{CaptureSymbols: "true"},
+			expected: cataloging.SymbolScopeNone,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.wantErr == nil {
+				tt.wantErr = assert.NoError
+			}
+			err := tt.cfg.PostLoad()
+			tt.wantErr(t, err)
+			if err != nil {
+				return
+			}
+			assert.Equal(t, tt.expected, tt.cfg.CaptureSymbols)
+		})
+	}
+}