478 identify go binaries and extract mod information (#534)

* add query by MIME type to source.FileResolver

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* import stereoscope lib changes to find mime type

- add bin cataloger
- add bin parser
- add mime type go utils
- import new resolver

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* add go std library code to unpack bin

- keep them in their own (original) files
- add note for "this code was copied from"
- comment the lines the required changing

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
Co-authored-by: Alex Goodman <alex.goodman@anchore.com>

test/integration/regression_go_bin_scanner_arch_test.go

@@ -0,0 +1,48 @@
+package integration
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func TestRegressionGoArchDiscovery(t *testing.T) {
+	const (
+		expectedELFPkg   = 3
+		expectedWINPkg   = 3
+		expectedMACOSPkg = 3
+	)
+	// This is a regression test to make sure the way we detect go binary packages
+	// stays consistent and reproducible as the tool chain evolves
+	catalog, _, _ := catalogFixtureImage(t, "image-go-bin-arch-coverage")
+
+	var actualELF, actualWIN, actualMACOS int
+
+	for p := range catalog.Enumerate(pkg.GoModulePkg) {
+		for _, l := range p.Locations {
+			switch {
+			case strings.Contains(l.RealPath, "elf"):
+				actualELF++
+			case strings.Contains(l.RealPath, "win"):
+				actualWIN++
+			case strings.Contains(l.RealPath, "macos"):
+				actualMACOS++
+			default:
+
+			}
+		}
+	}
+
+	if actualELF != expectedELFPkg {
+		t.Errorf("unexpected number of elf packages: %d != %d", expectedELFPkg, actualELF)
+	}
+
+	if actualWIN != expectedWINPkg {
+		t.Errorf("unexpected number of win packages: %d != %d", expectedWINPkg, actualWIN)
+	}
+
+	if actualMACOS != expectedMACOSPkg {
+		t.Errorf("unexpected number of macos packages: %d != %d", expectedMACOSPkg, actualMACOS)
+	}
+}

test/integration/test-fixtures/image-go-bin-arch-coverage/Dockerfile

@@ -0,0 +1,16 @@
+FROM golang:latest as builder
+WORKDIR /app
+COPY go.sum go.mod app.go ./
+
+RUN GOOS=linux go build -o elf .
+RUN GOOS=windows go build -o win .
+RUN GOOS=darwin go build -o macos .
+
+FROM scratch
+
+WORKDIR /tmp
+COPY --from=builder /app/elf /
+COPY --from=builder /app/win /
+COPY --from=builder /app/macos /
+
+ENTRYPOINT ["/elf"]

test/integration/test-fixtures/image-go-bin-arch-coverage/app.go

@@ -0,0 +1,18 @@
+//build:ignore
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"golang.org/x/net/html"
+	"golang.org/x/term"
+)
+
+var test = html.ErrBufferExceeded
+
+func main() {
+	t := term.NewTerminal(os.Stdout, "foo")
+	t.Write([]byte("hello anchore"))
+	t.Write([]byte(fmt.Sprintf("%v", test)))
+}

test/integration/test-fixtures/image-go-bin-arch-coverage/go.mod

@@ -0,0 +1,14 @@
+module github.com/anchore/test
+
+go 1.17
+
+require (
+	golang.org/x/net v0.0.0-20211006190231-62292e806868
+	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211
+)
+
+require golang.org/x/sys v0.0.0-20211006194710-c8a6f5223071 // indirect
+
+exclude golang.org/x/net v0.0.0-20211005215030-d2e5035098b3
+
+replace golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 => golang.org/x/term v0.0.0-20210916214954-140adaaadfaf

test/integration/test-fixtures/image-go-bin-arch-coverage/go.sum

@@ -0,0 +1,12 @@
+golang.org/x/net v0.0.0-20211006190231-62292e806868 h1:KlOXYy8wQWTUJYFgkUI40Lzr06ofg5IRXUK5C7qZt1k=
+golang.org/x/net v0.0.0-20211006190231-62292e806868/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211006194710-c8a6f5223071 h1:PjhxBct4MZii8FFR8+oeS7QOvxKOTZXgk63EU2XpfJE=
+golang.org/x/sys v0.0.0-20211006194710-c8a6f5223071/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210916214954-140adaaadfaf h1:Ihq/mm/suC88gF8WFcVwk+OV6Tq+wyA1O0E5UEvDglI=
+golang.org/x/term v0.0.0-20210916214954-140adaaadfaf/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

test/integration/test-fixtures/image-large-apk-data/Dockerfile

@@ -1,5 +1,8 @@
 FROM alpine@sha256:d9a7354e3845ea8466bb00b22224d9116b183e594527fb5b6c3d30bc01a20378
+
+# we keep these unpinned so that if alpine
+# changes our integration tests can adapt
 RUN apk add --no-cache \
-            tzdata=2021a-r0 \
-            vim=8.2.2320-r0 \
-            alpine-sdk=1.0-r0
+            tzdata \
+            vim \
+            alpine-sdk