Merge remote-tracking branch 'upstream/main' into add-nested-archive-cataloging

cmd/syft/internal/commands/convert.go

@@ -114,6 +114,10 @@ func RunConvert(ctx context.Context, opts *ConvertOptions, userInput string) err
 		if err != nil {
 			return err
 		}
+		// output files are opened up front; release them if we bail out before writing
+		if c, ok := writer.(io.Closer); ok {
+			defer func() { _ = c.Close() }()
+		}
 	}
 
 	for _, output := range unchanged {

cmd/syft/internal/commands/scan.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"io"
 	"os"
 	"reflect"
 	"strings"
@@ -181,6 +182,10 @@ func runScan(ctx context.Context, id clio.Identification, opts *scanOptions, use
 	if err != nil {
 		return err
 	}
+	// output files are opened up front; release them if we bail out before writing
+	if c, ok := writer.(io.Closer); ok {
+		defer func() { _ = c.Close() }()
+	}
 
 	sources := opts.From
 	if len(sources) == 0 {

cmd/syft/internal/options/cache_test.go

@@ -4,6 +4,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"runtime"
 	"strings"
 	"testing"
 	"time"
@@ -22,9 +23,10 @@ func Test_defaultDir(t *testing.T) {
 	homeDir := filepath.Join(tmpDir, "fake-home")
 
 	tests := []struct {
-		name     string
-		env      map[string]string
-		expected string
+		name          string
+		env           map[string]string
+		expected      string
+		skipOnWindows bool
 	}{
 		{
 			name: "no-xdg",
@@ -32,6 +34,8 @@ func Test_defaultDir(t *testing.T) {
 				"HOME": homeDir,
 			},
 			expected: homeDir,
+			// xdg falls back to LOCALAPPDATA on windows, not HOME
+			skipOnWindows: true,
 		},
 		{
 			name: "xdg-cache",
@@ -59,6 +63,9 @@ func Test_defaultDir(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
+			if test.skipOnWindows && runtime.GOOS == "windows" {
+				t.Skip("posix-only cache dir fallback")
+			}
 			restoreCache(t)
 
 			for k, v := range test.env {

cmd/syft/internal/options/source.go

@@ -36,7 +36,7 @@ var _ clio.PostLoader = (*imageSource)(nil)
 func (o *sourceConfig) DescribeFields(descriptions clio.FieldDescriptionSet) {
 	descriptions.Add(&o.File.Digests, `the file digest algorithms to use on the scanned file (options: "md5", "sha1", "sha224", "sha256", "sha384", "sha512")`)
 	descriptions.Add(&o.Image.DefaultPullSource, `allows users to specify which image source should be used to generate the sbom
-valid values are: registry, docker, podman`)
+valid values are: registry, docker, podman, containers-storage`)
 }
 
 type imageSource struct {
@@ -74,7 +74,7 @@ func (c *imageSource) PostLoad() error {
 	return checkDefaultSourceValues(c.DefaultPullSource)
 }
 
-var validDefaultSourceValues = []string{"registry", "docker", "podman", ""}
+var validDefaultSourceValues = []string{"registry", "docker", "podman", "containers-storage", ""}
 
 func checkDefaultSourceValues(source string) error {
 	validValues := strset.New(validDefaultSourceValues...)

cmd/syft/internal/options/writer.go

@@ -2,10 +2,11 @@ package options
 
 import (
 	"bytes"
+	"errors"
 	"fmt"
 	"io"
 	"os"
-	"path"
+	"path/filepath"
 	"sort"
 	"strings"
 
@@ -20,7 +21,10 @@ import (
 	"github.com/anchore/syft/syft/sbom"
 )
 
-var _ sbom.Writer = (*sbomMultiWriter)(nil)
+var _ interface {
+	io.Closer
+	sbom.Writer
+} = (*sbomMultiWriter)(nil)
 
 var _ interface {
 	io.Closer
@@ -164,6 +168,12 @@ func newSBOMMultiWriter(options ...sbomWriterDescription) (_ *sbomMultiWriter, e
 	}
 
 	out := &sbomMultiWriter{}
+	defer func() {
+		// don't leak the files already opened when a later output fails
+		if err != nil {
+			_ = out.Close()
+		}
+	}()
 
 	for _, option := range options {
 		switch len(option.Path) {
@@ -172,8 +182,8 @@ func newSBOMMultiWriter(options ...sbomWriterDescription) (_ *sbomMultiWriter, e
 				format: option.Format,
 			})
 		default:
-			// create any missing subdirectories
-			dir := path.Dir(option.Path)
+			// create any missing subdirectories (option.Path is a host path, so this must be filepath)
+			dir := filepath.Dir(option.Path)
 			if dir != "" {
 				s, err := os.Stat(dir)
 				if err != nil {
@@ -210,6 +220,20 @@ func (m *sbomMultiWriter) Write(s sbom.SBOM) (errs error) {
 	return errs
 }
 
+// Close releases any files held by the writers. Write already closes each file it writes to, so this matters
+// when the SBOM is never written (e.g. an error after the writer was created).
+func (m *sbomMultiWriter) Close() error {
+	var errs error
+	for _, w := range m.writers {
+		if c, ok := w.(io.Closer); ok {
+			if err := c.Close(); err != nil && !errors.Is(err, os.ErrClosed) {
+				errs = multierror.Append(errs, err)
+			}
+		}
+	}
+	return errs
+}
+
 // sbomStreamWriter implements sbom.Writer for a given format and io.Writer, also providing a close function for cleanup
 type sbomStreamWriter struct {
 	format sbom.FormatEncoder

cmd/syft/internal/options/writer_test.go

@@ -202,9 +202,9 @@ func Test_newSBOMMultiWriter(t *testing.T) {
 			if test.err {
 				assert.Error(t, err)
 				return
-			} else {
-				assert.NoError(t, err)
 			}
+			require.NoError(t, err)
+			t.Cleanup(func() { _ = mw.Close() })
 
 			assert.Len(t, mw.writers, len(test.expected))