Add CycloneDX decoder (#811)

internal/formats/cyclonedx13xml/decoder_test.go

@@ -0,0 +1,70 @@
+package cyclonedx13xml
+
+import (
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_decodeXML(t *testing.T) {
+	tests := []struct {
+		file     string
+		err      bool
+		distro   string
+		packages []string
+	}{
+		{
+			file:     "snapshot/TestCycloneDxDirectoryEncoder.golden",
+			distro:   "debian:1.2.3",
+			packages: []string{"package-1:1.0.1", "package-2:2.0.1"},
+		},
+		{
+			file:     "snapshot/TestCycloneDxImageEncoder.golden",
+			distro:   "debian:1.2.3",
+			packages: []string{"package-1:1.0.1", "package-2:2.0.1"},
+		},
+		{
+			file: "image-simple/Dockerfile",
+			err:  true,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.file, func(t *testing.T) {
+			reader, err := os.Open("test-fixtures/" + test.file)
+			assert.NoError(t, err)
+
+			if test.err {
+				err = Format().Validate(reader)
+				assert.Error(t, err)
+				return
+			}
+
+			bom, err := Format().Decode(reader)
+
+			assert.NoError(t, err)
+
+			split := strings.SplitN(test.distro, ":", 2)
+			name := split[0]
+			version := split[1]
+			assert.Equal(t, bom.Artifacts.LinuxDistribution.ID, name)
+			assert.Equal(t, bom.Artifacts.LinuxDistribution.Version, version)
+
+		pkgs:
+			for _, pkg := range test.packages {
+				split = strings.SplitN(pkg, ":", 2)
+				name = split[0]
+				version = split[1]
+				for p := range bom.Artifacts.PackageCatalog.Enumerate() {
+					if p.Name == name {
+						assert.Equal(t, version, p.Version)
+						continue pkgs
+					}
+				}
+				assert.Fail(t, fmt.Sprintf("package should be present: %s", pkg))
+			}
+		})
+	}
+}

internal/formats/cyclonedx13xml/format.go

@@ -1,12 +1,16 @@
 package cyclonedx13xml
 
-import "github.com/anchore/syft/syft/format"
+import (
+	"github.com/CycloneDX/cyclonedx-go"
+	"github.com/anchore/syft/internal/formats/common/cyclonedxhelpers"
+	"github.com/anchore/syft/syft/format"
+)
 
 func Format() format.Format {
 	return format.NewFormat(
 		format.CycloneDxXMLOption,
 		encoder,
-		nil,
-		nil,
+		cyclonedxhelpers.GetDecoder(cyclonedx.BOMFileFormatXML),
+		cyclonedxhelpers.GetValidator(cyclonedx.BOMFileFormatXML),
 	)
 }

internal/formats/cyclonedx13xml/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.3" serialNumber="urn:uuid:16a426e7-fcc7-4b94-abd2-66c67569cc44" version="1">
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" serialNumber="urn:uuid:25133adc-01af-46ad-a198-002034e54097" version="1">
   <metadata>
-    <timestamp>2022-01-14T22:46:49Z</timestamp>
+    <timestamp>2022-02-10T17:18:31-05:00</timestamp>
     <tools>
       <tool>
         <vendor>anchore</vendor>
@@ -9,7 +9,7 @@
         <version>[not provided]</version>
       </tool>
     </tools>
-    <component type="file">
+    <component bom-ref="163686ac6e30c752" type="file">
       <name>/some/path</name>
       <version></version>
     </component>
@@ -48,6 +48,8 @@
     <component type="operating-system">
       <name>debian</name>
       <version>1.2.3</version>
+      <description>debian</description>
+      <swid tagId="debian" name="debian" version="1.2.3"></swid>
       <properties>
         <property name="prettyName">debian</property>
         <property name="id">debian</property>

internal/formats/cyclonedx13xml/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.3" serialNumber="urn:uuid:a3d776c6-a2ca-4116-8b99-b3538dd1a460" version="1">
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" serialNumber="urn:uuid:e702d78f-9372-4458-ac38-be8e80fc3005" version="1">
   <metadata>
-    <timestamp>2022-01-14T22:46:49Z</timestamp>
+    <timestamp>2022-02-10T17:18:31-05:00</timestamp>
     <tools>
       <tool>
         <vendor>anchore</vendor>
@@ -9,7 +9,7 @@
         <version>[not provided]</version>
       </tool>
     </tools>
-    <component type="container">
+    <component bom-ref="4f9453fd20e0cf80" type="container">
       <name>user-image-input</name>
       <version>sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368</version>
     </component>
@@ -31,7 +31,7 @@
         <property name="type">python</property>
         <property name="metadataType">PythonPackageMetadata</property>
         <property name="path">/somefile-1.txt</property>
-        <property name="layerID">sha256:16e64541f2ddf59a90391ce7bb8af90313f7d373f2105d88f3d3267b72e0ebab</property>
+        <property name="layerID">sha256:41e7295da66c405eb3a4df29188dcf80f622f9304d487033a86d4a22e3f01abe</property>
       </properties>
     </component>
     <component type="library">
@@ -44,12 +44,14 @@
         <property name="type">deb</property>
         <property name="metadataType">DpkgMetadata</property>
         <property name="path">/somefile-2.txt</property>
-        <property name="layerID">sha256:de6c235f76ea24c8503ec08891445b5d6a8bdf8249117ed8d8b0b6fb3ebe4f67</property>
+        <property name="layerID">sha256:68a2c166dcb3acf6b7303e995ca1fe7d794bd3b5852a0b4048f9c96b796086aa</property>
       </properties>
     </component>
     <component type="operating-system">
       <name>debian</name>
       <version>1.2.3</version>
+      <description>debian</description>
+      <swid tagId="debian" name="debian" version="1.2.3"></swid>
       <properties>
         <property name="prettyName">debian</property>
         <property name="id">debian</property>