feat: Add support for scanning GGUF models from OCI registries (#4335)

---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>

syft/format/internal/spdxutil/helpers/document_name.go

@@ -12,6 +12,8 @@ func DocumentName(src source.Description) string {
 	switch metadata := src.Metadata.(type) {
 	case source.ImageMetadata:
 		return metadata.UserInput
+	case source.OCIModelMetadata:
+		return metadata.UserInput
 	case source.DirectoryMetadata:
 		return metadata.Path
 	case source.FileMetadata:

syft/format/internal/spdxutil/helpers/document_name_test.go

@@ -54,6 +54,17 @@ func Test_DocumentName(t *testing.T) {
 			},
 			expected: "some/name",
 		},
+		{
+			name: "oci-model",
+			srcMetadata: source.Description{
+				Metadata: source.OCIModelMetadata{
+					UserInput:      "model-repo/name:tag",
+					ID:             "id",
+					ManifestDigest: "digest",
+				},
+			},
+			expected: "model-repo/name:tag",
+		},
 		{
 			name: "named",
 			srcMetadata: source.Description{

syft/format/internal/spdxutil/helpers/document_namespace.go

@@ -14,6 +14,7 @@ import (
 
 const (
 	InputImage     = "image"
+	InputOCIModel  = "oci-model"
 	InputDirectory = "dir"
 	InputFile      = "file"
 	InputSnap      = "snap"
@@ -30,6 +31,8 @@ func DocumentNamespace(name string, src source.Description, desc sbom.Descriptor
 	switch src.Metadata.(type) {
 	case source.ImageMetadata:
 		input = InputImage
+	case source.OCIModelMetadata:
+		input = InputOCIModel
 	case source.DirectoryMetadata:
 		input = InputDirectory
 	case source.FileMetadata:

syft/format/internal/spdxutil/helpers/document_namespace_test.go

@@ -61,6 +61,18 @@ func Test_DocumentNamespace(t *testing.T) {
 			},
 			expected: "https://anchore.com/syft/snap/my-name-",
 		},
+		{
+			name:      "oci-model",
+			inputName: "my-name",
+			src: source.Description{
+				Metadata: source.OCIModelMetadata{
+					UserInput:      "model-repo/name:tag",
+					ID:             "id",
+					ManifestDigest: "digest",
+				},
+			},
+			expected: "https://anchore.com/syft/oci-model/my-name-",
+		},
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {

syft/format/internal/spdxutil/helpers/source_info.go

@@ -83,7 +83,7 @@ func SourceInfo(p pkg.Package) string {
 	case pkg.TerraformPkg:
 		answer = "acquired package info from Terraform dependency lock file"
 	case pkg.ModelPkg:
-		answer = "acquired package info from AI artifact (e.g. GGUF File"
+		answer = "acquired package info from AI artifact (e.g. GGUF File)"
 	default:
 		answer = "acquired package info from the following paths"
 	}