Convert between SBOM formats (#964)

* add convert command Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * mvp Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * fix hanging bug Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * validate SBOM formats for conversion Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * move convert cmd to new structure Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * remove bin Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * drop event loop from convert cmd extract SBOM type from document namespace Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * validate SPDX in tests Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * documenting convert cmd Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * support output format=file.json notation Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * test convertible formats Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * fix typo Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * clean up Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * more clean up and docs Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * feedback changes Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * nit Signed-off-by: Jonas Xavier <jonasx@anchore.com> * feedback changes Signed-off-by: Jonas Xavier <jonasx@anchore.com> * re-use more code Signed-off-by: Jonas Xavier <jonasx@anchore.com> * undo encode-decode cycle test Signed-off-by: Jonas Xavier <jonasx@anchore.com> * remove unnecessary test constraint Signed-off-by: Jonas Xavier <jonasx@anchore.com> * fix readme Signed-off-by: Jonas Xavier <jonasx@anchore.com> * try verbose Signed-off-by: Jonas Xavier <jonasx@anchore.com> * cleaner README and no table conversion Signed-off-by: Jonas Xavier <jonasx@anchore.com> * simpler conversion Signed-off-by: Jonas Xavier <jonasx@anchore.com> * feedback changes and cleanup Signed-off-by: Jonas Xavier <jonasx@anchore.com> * nit space fix Signed-off-by: Jonas Xavier <jonasx@anchore.com> * use defer Signed-off-by: Jonas Xavier <jonasx@anchore.com> * feedback changes Signed-off-by: Jonas Xavier <jonasx@anchore.com> Co-authored-by: Keith Zantow <kzantow@gmail.com>
2026-11-01 15:06:36 +01:00 · 2022-05-09 17:28:33 -07:00
parent a83506628c
commit 24f08e7738
18 changed files with 377 additions and 92 deletions
@@ -22,7 +22,7 @@ func GetValidator(format cyclonedx.BOMFileFormat) sbom.Validator {
 			return err
 		}
 		// random JSON does not necessarily cause an error (e.g. SPDX)
-		if (cyclonedx.BOM{} == *bom) {
+		if (cyclonedx.BOM{} == *bom || bom.Components == nil) {
 			return fmt.Errorf("not a valid CycloneDX document")
 		}
 		return nil
@@ -1,22 +1,21 @@
 package spdxhelpers

 import (
-	"fmt"
 	"path"
 	"strings"

 	"github.com/anchore/syft/syft/source"
 )

-func DocumentName(srcMetadata source.Metadata) (string, error) {
+func DocumentName(srcMetadata source.Metadata) string {
 	switch srcMetadata.Scheme {
 	case source.ImageScheme:
-		return cleanName(srcMetadata.ImageMetadata.UserInput), nil
+		return cleanName(srcMetadata.ImageMetadata.UserInput)
 	case source.DirectoryScheme, source.FileScheme:
-		return cleanName(srcMetadata.Path), nil
+		return cleanName(srcMetadata.Path)
+	default:
+		return "unknown"
 	}
-
-	return "", fmt.Errorf("unable to determine document name from scheme=%q", srcMetadata.Scheme)
 }

 func cleanName(name string) string {
@@ -5,8 +5,6 @@ import (
 	"strings"
 	"testing"

-	"github.com/stretchr/testify/require"
-
 	"github.com/anchore/syft/syft/source"
 	"github.com/scylladb/go-set/strset"
 	"github.com/stretchr/testify/assert"
@@ -59,8 +57,7 @@ func Test_DocumentName(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			actual, err := DocumentName(test.srcMetadata)
-			require.NoError(t, err)
+			actual := DocumentName(test.srcMetadata)
 			assert.True(t, strings.HasPrefix(actual, test.expected), fmt.Sprintf("actual name %q", actual))

 			// track each scheme tested (passed or not)
@@ -10,12 +10,9 @@ import (
 	"github.com/google/uuid"
 )

-func DocumentNameAndNamespace(srcMetadata source.Metadata) (string, string, error) {
-	name, err := DocumentName(srcMetadata)
-	if err != nil {
-		return "", "", err
-	}
-	return name, DocumentNamespace(name, srcMetadata), nil
+func DocumentNameAndNamespace(srcMetadata source.Metadata) (string, string) {
+	name := DocumentName(srcMetadata)
+	return name, DocumentNamespace(name, srcMetadata)
 }

 func DocumentNamespace(name string, srcMetadata source.Metadata) string {
@@ -2,6 +2,7 @@ package spdxhelpers

 import (
 	"errors"
+	"net/url"
 	"strconv"
 	"strings"

@@ -24,7 +25,13 @@ func ToSyftModel(doc *spdx.Document2_2) (*sbom.SBOM, error) {

 	spdxIDMap := make(map[string]interface{})

+	src := source.Metadata{Scheme: source.UnknownScheme}
+	if doc.CreationInfo != nil {
+		src.Scheme = extractSchemeFromNamespace(doc.CreationInfo.DocumentNamespace)
+	}
+
 	s := &sbom.SBOM{
+		Source: src,
 		Artifacts: sbom.Artifacts{
 			PackageCatalog:    pkg.NewCatalog(),
 			FileMetadata:      map[source.Coordinates]source.FileMetadata{},
@@ -42,6 +49,30 @@ func ToSyftModel(doc *spdx.Document2_2) (*sbom.SBOM, error) {
 	return s, nil
 }

+// NOTE(jonas): SPDX doesn't inform what an SBOM is about,
+// image, directory, for example. This is our best effort to determine
+// the scheme. Syft-generated SBOMs have in the namespace
+// field a type encoded, which we try to identify here.
+func extractSchemeFromNamespace(ns string) source.Scheme {
+	u, err := url.Parse(ns)
+	if err != nil {
+		return source.UnknownScheme
+	}
+
+	parts := strings.Split(u.Path, "/")
+	for _, p := range parts {
+		switch p {
+		case "file":
+			return source.FileScheme
+		case "image":
+			return source.ImageScheme
+		case "dir":
+			return source.DirectoryScheme
+		}
+	}
+	return source.UnknownScheme
+}
+
 func findLinuxReleaseByPURL(doc *spdx.Document2_2) *linux.Release {
 	for _, p := range doc.Packages {
 		purlValue := findPURLValue(p)
@@ -4,8 +4,10 @@ import (
 	"testing"

 	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
 	"github.com/spdx/tools-golang/spdx"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )

 func TestToSyftModel(t *testing.T) {
@@ -195,3 +197,39 @@ func Test_extractMetadata(t *testing.T) {
 		})
 	}
 }
+
+func TestExtractSourceFromNamespaces(t *testing.T) {
+	tests := []struct {
+		namespace string
+		expected  source.Scheme
+	}{
+		{
+			namespace: "https://anchore.com/syft/file/d42b01d0-7325-409b-b03f-74082935c4d3",
+			expected:  source.FileScheme,
+		},
+		{
+			namespace: "https://anchore.com/syft/image/d42b01d0-7325-409b-b03f-74082935c4d3",
+			expected:  source.ImageScheme,
+		},
+		{
+			namespace: "https://anchore.com/syft/dir/d42b01d0-7325-409b-b03f-74082935c4d3",
+			expected:  source.DirectoryScheme,
+		},
+		{
+			namespace: "https://another-host/blob/123",
+			expected:  source.UnknownScheme,
+		},
+		{
+			namespace: "bla bla",
+			expected:  source.UnknownScheme,
+		},
+		{
+			namespace: "",
+			expected:  source.UnknownScheme,
+		},
+	}
+
+	for _, tt := range tests {
+		require.Equal(t, tt.expected, extractSchemeFromNamespace(tt.namespace))
+	}
+}