Add annotations for evidence on package locations (#1723)

* add location annotations + deb evidence annotations Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * rename LocationData struct and Annotation helper function Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add failing integration test for evidence coverage Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add evidence to aplm cataloger locations Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * change location annotation helper to return a location copy Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add evidence to binary cataloger locations Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * updated remaining catalogers with location annotations Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * fix unit tests Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * fix linting Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * bump json schema Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * partial addressing of review comments Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * rename location.WithAnnotation Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
2026-11-01 23:16:30 +01:00 · 2023-04-13 17:02:29 -04:00
parent 05715489c4
commit 5d156b8241
67 changed files with 2511 additions and 849 deletions
@@ -829,12 +829,12 @@ func match(classifier string, paths ...string) pkg.ClassifierMatch {
 	}
 	return pkg.ClassifierMatch{
 		Classifier: classifier,
-		Location: source.Location{
-			Coordinates: source.Coordinates{
+		Location: source.NewVirtualLocationFromCoordinates(
+			source.Coordinates{
 				RealPath: realPath,
 			},
-			VirtualPath: virtualPath,
-		},
+			virtualPath,
+		),
 	}
 }

@@ -7,7 +7,6 @@ import (
 	"debug/pe"
 	"fmt"
 	"io"
-	"reflect"
 	"regexp"
 	"strings"
 	"text/template"
@@ -107,7 +106,13 @@ func fileNameTemplateVersionMatcher(fileNamePattern string, contentTemplate stri
 		}

 		matchMetadata := internal.MatchNamedCaptureGroups(tmplPattern, string(contents))
-		return singlePackage(classifier, location, matchMetadata), nil
+
+		p := newPackage(classifier, location, matchMetadata)
+		if p == nil {
+			return nil, nil
+		}
+
+		return []pkg.Package{*p}, nil
 	}
 }

@@ -120,7 +125,13 @@ func fileContentsVersionMatcher(pattern string) evidenceMatcher {
 		}

 		matchMetadata := internal.MatchNamedCaptureGroups(pat, string(contents))
-		return singlePackage(classifier, location, matchMetadata), nil
+
+		p := newPackage(classifier, location, matchMetadata)
+		if p == nil {
+			return nil, nil
+		}
+
+		return []pkg.Package{*p}, nil
 	}
 }

@@ -141,8 +152,8 @@ func sharedLibraryLookup(sharedLibraryPattern string, sharedLibraryMatcher evide
 			if err != nil {
 				return nil, err
 			}
-			for _, libraryLication := range locations {
-				pkgs, err := sharedLibraryMatcher(resolver, classifier, libraryLication)
+			for _, libraryLocation := range locations {
+				pkgs, err := sharedLibraryMatcher(resolver, classifier, libraryLocation)
 				if err != nil {
 					return nil, err
 				}
@@ -176,58 +187,6 @@ func mustPURL(purl string) packageurl.PackageURL {
 	return p
 }

-func singlePackage(classifier classifier, location source.Location, matchMetadata map[string]string) []pkg.Package {
-	version, ok := matchMetadata["version"]
-	if !ok {
-		return nil
-	}
-
-	update := matchMetadata["update"]
-
-	var cpes []cpe.CPE
-	for _, c := range classifier.CPEs {
-		c.Version = version
-		c.Update = update
-		cpes = append(cpes, c)
-	}
-
-	p := pkg.Package{
-		Name:         classifier.Package,
-		Version:      version,
-		Locations:    source.NewLocationSet(location),
-		Type:         pkg.BinaryPkg,
-		CPEs:         cpes,
-		FoundBy:      catalogerName,
-		MetadataType: pkg.BinaryMetadataType,
-		Metadata: pkg.BinaryMetadata{
-			Matches: []pkg.ClassifierMatch{
-				{
-					Classifier: classifier.Class,
-					Location:   location,
-				},
-			},
-		},
-	}
-
-	if classifier.Type != "" {
-		p.Type = classifier.Type
-	}
-
-	if !reflect.DeepEqual(classifier.PURL, emptyPURL) {
-		purl := classifier.PURL
-		purl.Version = version
-		p.PURL = purl.ToString()
-	}
-
-	if classifier.Language != "" {
-		p.Language = classifier.Language
-	}
-
-	p.SetID()
-
-	return []pkg.Package{p}
-}
-
 func getContents(resolver source.FileResolver, location source.Location) ([]byte, error) {
 	reader, err := resolver.FileContentsByLocation(location)
 	if err != nil {
@@ -0,0 +1,63 @@
+package binary
+
+import (
+	"reflect"
+
+	"github.com/anchore/syft/syft/cpe"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+func newPackage(classifier classifier, location source.Location, matchMetadata map[string]string) *pkg.Package {
+	version, ok := matchMetadata["version"]
+	if !ok {
+		return nil
+	}
+
+	update := matchMetadata["update"]
+
+	var cpes []cpe.CPE
+	for _, c := range classifier.CPEs {
+		c.Version = version
+		c.Update = update
+		cpes = append(cpes, c)
+	}
+
+	p := pkg.Package{
+		Name:    classifier.Package,
+		Version: version,
+		Locations: source.NewLocationSet(
+			location.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
+		),
+		Type:         pkg.BinaryPkg,
+		CPEs:         cpes,
+		FoundBy:      catalogerName,
+		MetadataType: pkg.BinaryMetadataType,
+		Metadata: pkg.BinaryMetadata{
+			Matches: []pkg.ClassifierMatch{
+				{
+					Classifier: classifier.Class,
+					Location:   location,
+				},
+			},
+		},
+	}
+
+	if classifier.Type != "" {
+		p.Type = classifier.Type
+	}
+
+	if !reflect.DeepEqual(classifier.PURL, emptyPURL) {
+		purl := classifier.PURL
+		purl.Version = version
+		p.PURL = purl.ToString()
+	}
+
+	if classifier.Language != "" {
+		p.Language = classifier.Language
+	}
+
+	p.SetID()
+
+	return &p
+}