oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-30 14:02:26 +01:00
Code Issues Packages Projects Releases Wiki Activity

Convert between SBOM formats (#964)

Browse Source 
* add convert command

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* mvp

Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>

* fix hanging bug

Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>

* validate SBOM formats for conversion

Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>

* move convert cmd to new structure

Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>

* remove bin

Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>

* drop event loop from convert cmd

extract SBOM type from document namespace

Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>

* validate SPDX in tests

Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>

* documenting convert cmd

Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>

* support output format=file.json notation

Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>

* test convertible formats

Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>

* fix typo

Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>

* clean up

Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>

* more clean up and docs

Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>

* feedback changes

Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>

* nit

Signed-off-by: Jonas Xavier <jonasx@anchore.com>

* feedback changes

Signed-off-by: Jonas Xavier <jonasx@anchore.com>

* re-use more code

Signed-off-by: Jonas Xavier <jonasx@anchore.com>

* undo encode-decode cycle test

Signed-off-by: Jonas Xavier <jonasx@anchore.com>

* remove unnecessary test constraint

Signed-off-by: Jonas Xavier <jonasx@anchore.com>

* fix readme

Signed-off-by: Jonas Xavier <jonasx@anchore.com>

* try verbose

Signed-off-by: Jonas Xavier <jonasx@anchore.com>

* cleaner README and no table conversion

Signed-off-by: Jonas Xavier <jonasx@anchore.com>

* simpler conversion

Signed-off-by: Jonas Xavier <jonasx@anchore.com>

* feedback changes and cleanup

Signed-off-by: Jonas Xavier <jonasx@anchore.com>

* nit space fix

Signed-off-by: Jonas Xavier <jonasx@anchore.com>

* use defer

Signed-off-by: Jonas Xavier <jonasx@anchore.com>

* feedback changes

Signed-off-by: Jonas Xavier <jonasx@anchore.com>

Co-authored-by: Keith Zantow <kzantow@gmail.com>
This commit is contained in:
Jonas Xavier
2022-05-09 17:28:33 -07:00
committed by GitHub
co-authored by Keith Zantow
parent a83506628c
commit 24f08e7738
18 changed files with 377 additions and 92 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/syft/cli/commands.go
+2
View File
@@ -46,6 +46,7 @@ func New() (*cobra.Command, error) {
// root options are also passed to the attestCmd so that a user provided config location can be discovered
attestCmd := Attest(v, app, ro)
poweruserCmd := PowerUser(v, app, ro)
convertCmd := Convert(v, app, ro)
// rootCmd is currently an alias for the packages command
rootCmd := &cobra.Command{
@@ -84,6 +85,7 @@ func New() (*cobra.Command, error) {
// Add sub-commands.
rootCmd.AddCommand(packagesCmd)
rootCmd.AddCommand(attestCmd)
rootCmd.AddCommand(convertCmd)
rootCmd.AddCommand(poweruserCmd)
rootCmd.AddCommand(Completion())
rootCmd.AddCommand(Version(v, app))
cmd/syft/cli/convert.go
+47
View File
@@ -0,0 +1,47 @@
package cli
import (
"fmt"
"github.com/anchore/syft/cmd/syft/cli/convert"
"github.com/anchore/syft/cmd/syft/cli/options"
"github.com/anchore/syft/internal"
"github.com/anchore/syft/internal/config"
"github.com/spf13/cobra"
"github.com/spf13/viper"
)
const (
convertExample = ` {{.appName}} {{.command}} img.syft.json -o spdx-json convert a syft SBOM to spdx-json, output goes to stdout in table format, by default
{{.appName}} {{.command}} img.syft.json -o cyclonedx-json=img.cdx.json convert a syft SBOM to CycloneDX, output goes to a file named img.cdx.json
`
)
func Convert(v *viper.Viper, app *config.Application, ro *options.RootOptions) *cobra.Command {
cmd := &cobra.Command{
Use: "convert [SOURCE-SBOM] -o [FORMAT]",
Short: "Convert between SBOM formats",
Long: "[Experimental] Convert SBOM files to, and from, SPDX, CycloneDX and Syft's format. For more info about data loss between formats see https://github.com/anchore/syft#format-conversion-experimental",
Example: internal.Tprintf(convertExample, map[string]interface{}{
"appName": internal.ApplicationName,
"command": "convert",
}),
Args: func(cmd *cobra.Command, args []string) error {
if err := app.LoadAllValues(v, ro.Config); err != nil {
return fmt.Errorf("invalid application config: %w", err)
}
newLogWrapper(app)
logApplicationConfig(app)
return validateArgs(cmd, args)
},
SilenceUsage: true,
SilenceErrors: true,
RunE: func(cmd *cobra.Command, args []string) error {
if app.CheckForAppUpdate {
checkForApplicationUpdate()
}
return convert.Run(cmd.Context(), app, args)
},
}
return cmd
}
cmd/syft/cli/convert/convert.go
+41
View File
@@ -0,0 +1,41 @@
package convert
import (
"context"
"fmt"
"os"
"github.com/anchore/syft/cmd/syft/cli/options"
"github.com/anchore/syft/internal/config"
"github.com/anchore/syft/internal/log"
"github.com/anchore/syft/syft"
)
func Run(ctx context.Context, app *config.Application, args []string) error {
log.Warn("convert is an experimental feature, run `syft convert -h` for help")
writer, err := options.MakeWriter(app.Outputs, app.File)
if err != nil {
return err
}
defer func() {
if err := writer.Close(); err != nil {
log.Warnf("unable to write to report destination: %w", err)
}
}()
// this can only be a SBOM file
userInput := args[0]
f, err := os.Open(userInput)
if err != nil {
return fmt.Errorf("failed to open SBOM file: %w", err)
}
defer f.Close()
sbom, _, err := syft.Decode(f)
if err != nil {
return fmt.Errorf("failed to decode SBOM: %w", err)
}
return writer.Write(*sbom)
}
cmd/syft/cli/options/writer.go
+62
View File
@@ -0,0 +1,62 @@
package options
import (
"fmt"
"strings"
"github.com/anchore/syft/internal/formats/table"
"github.com/anchore/syft/syft"
"github.com/anchore/syft/syft/sbom"
"github.com/hashicorp/go-multierror"
)
// makeWriter creates a sbom.Writer for output or returns an error. this will either return a valid writer
// or an error but neither both and if there is no error, sbom.Writer.Close() should be called
func MakeWriter(outputs []string, defaultFile string) (sbom.Writer, error) {
outputOptions, err := parseOutputs(outputs, defaultFile)
if err != nil {
return nil, err
}
writer, err := sbom.NewWriter(outputOptions...)
if err != nil {
return nil, err
}
return writer, nil
}
// parseOptions utility to parse command-line option strings and retain the existing behavior of default format and file
func parseOutputs(outputs []string, defaultFile string) (out []sbom.WriterOption, errs error) {
// always should have one option -- we generally get the default of "table", but just make sure
if len(outputs) == 0 {
outputs = append(outputs, string(table.ID))
}
for _, name := range outputs {
name = strings.TrimSpace(name)
// split to at most two parts for <format>=<file>
parts := strings.SplitN(name, "=", 2)
// the format name is the first part
name = parts[0]
// default to the --file or empty string if not specified
file := defaultFile
// If a file is specified as part of the output formatName, use that
if len(parts) > 1 {
file = parts[1]
}
format := syft.FormatByName(name)
if format == nil {
errs = multierror.Append(errs, fmt.Errorf("bad output format: '%s'", name))
continue
}
out = append(out, sbom.NewWriterOption(format, file))
}
return out, errs
}
cmd/syft/cli/options/writer_test.go
+34
View File
@@ -0,0 +1,34 @@
package options
import (
"testing"
"github.com/stretchr/testify/assert"
)
func TestIsSupportedFormat(t *testing.T) {
tests := []struct {
outputs []string
wantErr assert.ErrorAssertionFunc
}{
{
outputs: []string{"json"},
wantErr: assert.NoError,
},
{
outputs: []string{"table", "json"},
wantErr: assert.NoError,
},
{
outputs: []string{"unknown"},
wantErr: func(t assert.TestingT, err error, bla ...interface{}) bool {
return assert.ErrorContains(t, err, "bad output format: 'unknown'")
},
},
}
for _, tt := range tests {
_, err := MakeWriter(tt.outputs, "")
tt.wantErr(t, err)
}
}
cmd/syft/cli/packages/packages.go
+1 -55
View File
@@ -5,7 +5,6 @@ import (
"fmt"
"io/ioutil"
"os"
"strings"
"github.com/anchore/stereoscope"
"github.com/anchore/syft/cmd/syft/cli/eventloop"
@@ -14,7 +13,6 @@ import (
"github.com/anchore/syft/internal/anchore"
"github.com/anchore/syft/internal/bus"
"github.com/anchore/syft/internal/config"
"github.com/anchore/syft/internal/formats/table"
"github.com/anchore/syft/internal/log"
"github.com/anchore/syft/internal/ui"
"github.com/anchore/syft/internal/version"
@@ -23,12 +21,11 @@ import (
"github.com/anchore/syft/syft/event"
"github.com/anchore/syft/syft/sbom"
"github.com/anchore/syft/syft/source"
"github.com/hashicorp/go-multierror"
"github.com/wagoodman/go-partybus"
)
func Run(ctx context.Context, app *config.Application, args []string) error {
writer, err := makeWriter(app.Outputs, app.File)
writer, err := options.MakeWriter(app.Outputs, app.File)
if err != nil {
return err
}
@@ -187,54 +184,3 @@ func runPackageSbomUpload(src *source.Source, s sbom.SBOM, app *config.Applicati
return nil
}
// makeWriter creates a sbom.Writer for output or returns an error. this will either return a valid writer
// or an error but neither both and if there is no error, sbom.Writer.Close() should be called
func makeWriter(outputs []string, defaultFile string) (sbom.Writer, error) {
outputOptions, err := parseOptions(outputs, defaultFile)
if err != nil {
return nil, err
}
writer, err := sbom.NewWriter(outputOptions...)
if err != nil {
return nil, err
}
return writer, nil
}
// parseOptions utility to parse command-line option strings and retain the existing behavior of default format and file
func parseOptions(outputs []string, defaultFile string) (out []sbom.WriterOption, errs error) {
// always should have one option -- we generally get the default of "table", but just make sure
if len(outputs) == 0 {
outputs = append(outputs, string(table.ID))
}
for _, name := range outputs {
name = strings.TrimSpace(name)
// split to at most two parts for <format>=<file>
parts := strings.SplitN(name, "=", 2)
// the format name is the first part
name = parts[0]
// default to the --file or empty string if not specified
file := defaultFile
// If a file is specified as part of the output formatName, use that
if len(parts) > 1 {
file = parts[1]
}
format := syft.FormatByName(name)
if format == nil {
errs = multierror.Append(errs, fmt.Errorf("bad output format: '%s'", name))
continue
}
out = append(out, sbom.NewWriterOption(format, file))
}
return out, errs
}