Add CycloneDX decoder (#811)

internal/formats/cyclonedx13json/decoder_test.go

@@ -0,0 +1,70 @@
+package cyclonedx13json
+
+import (
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_decodeJSON(t *testing.T) {
+	tests := []struct {
+		file     string
+		err      bool
+		distro   string
+		packages []string
+	}{
+		{
+			file:     "snapshot/TestCycloneDxDirectoryEncoder.golden",
+			distro:   "debian:1.2.3",
+			packages: []string{"package-1:1.0.1", "package-2:2.0.1"},
+		},
+		{
+			file:     "snapshot/TestCycloneDxImageEncoder.golden",
+			distro:   "debian:1.2.3",
+			packages: []string{"package-1:1.0.1", "package-2:2.0.1"},
+		},
+		{
+			file: "image-simple/Dockerfile",
+			err:  true,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.file, func(t *testing.T) {
+			reader, err := os.Open("test-fixtures/" + test.file)
+			assert.NoError(t, err)
+
+			if test.err {
+				err = Format().Validate(reader)
+				assert.Error(t, err)
+				return
+			}
+
+			bom, err := Format().Decode(reader)
+
+			assert.NoError(t, err)
+
+			split := strings.SplitN(test.distro, ":", 2)
+			name := split[0]
+			version := split[1]
+			assert.Equal(t, bom.Artifacts.LinuxDistribution.ID, name)
+			assert.Equal(t, bom.Artifacts.LinuxDistribution.Version, version)
+
+		pkgs:
+			for _, pkg := range test.packages {
+				split = strings.SplitN(pkg, ":", 2)
+				name = split[0]
+				version = split[1]
+				for p := range bom.Artifacts.PackageCatalog.Enumerate() {
+					if p.Name == name {
+						assert.Equal(t, version, p.Version)
+						continue pkgs
+					}
+				}
+				assert.Fail(t, fmt.Sprintf("package should be present: %s", pkg))
+			}
+		})
+	}
+}

internal/formats/cyclonedx13json/format.go

@@ -1,12 +1,16 @@
 package cyclonedx13json
 
-import "github.com/anchore/syft/syft/format"
+import (
+	"github.com/CycloneDX/cyclonedx-go"
+	"github.com/anchore/syft/internal/formats/common/cyclonedxhelpers"
+	"github.com/anchore/syft/syft/format"
+)
 
 func Format() format.Format {
 	return format.NewFormat(
 		format.CycloneDxJSONOption,
 		encoder,
-		nil,
-		nil,
+		cyclonedxhelpers.GetDecoder(cyclonedx.BOMFileFormatJSON),
+		cyclonedxhelpers.GetValidator(cyclonedx.BOMFileFormatJSON),
 	)
 }

internal/formats/cyclonedx13json/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden

@@ -1,10 +1,10 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.3",
-  "serialNumber": "urn:uuid:258d2616-5b1f-48cd-82a3-d6c95e262950",
+  "serialNumber": "urn:uuid:326afa86-5620-4a80-8f2b-7f283b954b9b",
   "version": 1,
   "metadata": {
-    "timestamp": "2022-01-14T22:47:00Z",
+    "timestamp": "2022-02-10T17:19:38-05:00",
     "tools": [
       {
         "vendor": "anchore",
@@ -13,6 +13,7 @@
       }
     ],
     "component": {
+      "bom-ref": "163686ac6e30c752",
       "type": "file",
       "name": "/some/path",
       "version": ""
@@ -84,6 +85,12 @@
       "type": "operating-system",
       "name": "debian",
       "version": "1.2.3",
+      "description": "debian",
+      "swid": {
+        "tagId": "debian",
+        "name": "debian",
+        "version": "1.2.3"
+      },
       "properties": [
         {
           "name": "prettyName",

internal/formats/cyclonedx13json/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden

@@ -1,10 +1,10 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.3",
-  "serialNumber": "urn:uuid:8a84b1cf-e918-4842-a6a8-c7fdafc55bc0",
+  "serialNumber": "urn:uuid:761a2036-0f25-4787-bf28-f5e9a7d9a0bf",
   "version": 1,
   "metadata": {
-    "timestamp": "2022-01-14T22:47:00Z",
+    "timestamp": "2022-02-10T17:19:38-05:00",
     "tools": [
       {
         "vendor": "anchore",
@@ -13,6 +13,7 @@
       }
     ],
     "component": {
+      "bom-ref": "4f9453fd20e0cf80",
       "type": "container",
       "name": "user-image-input",
       "version": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368"
@@ -55,7 +56,7 @@
         },
         {
           "name": "layerID",
-          "value": "sha256:16e64541f2ddf59a90391ce7bb8af90313f7d373f2105d88f3d3267b72e0ebab"
+          "value": "sha256:41e7295da66c405eb3a4df29188dcf80f622f9304d487033a86d4a22e3f01abe"
         }
       ]
     },
@@ -84,7 +85,7 @@
         },
         {
           "name": "layerID",
-          "value": "sha256:de6c235f76ea24c8503ec08891445b5d6a8bdf8249117ed8d8b0b6fb3ebe4f67"
+          "value": "sha256:68a2c166dcb3acf6b7303e995ca1fe7d794bd3b5852a0b4048f9c96b796086aa"
         }
       ]
     },
@@ -92,6 +93,12 @@
       "type": "operating-system",
       "name": "debian",
       "version": "1.2.3",
+      "description": "debian",
+      "swid": {
+        "tagId": "debian",
+        "name": "debian",
+        "version": "1.2.3"
+      },
       "properties": [
         {
           "name": "prettyName",