feat: detect unpackaged Firefox in software inventories (#5068)

Signed-off-by: ychampion <ychampion@users.noreply.github.com>

syft/pkg/cataloger/binary/capabilities.yaml

@@ -666,6 +666,16 @@ catalogers:
             cpes:
               - cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
             type: BinaryPkg
+      - method: glob
+        criteria:
+          - '**/{firefox,firefox.exe}'
+        packages:
+          - class: firefox-binary
+            name: firefox
+            purl: pkg:generic/firefox
+            cpes:
+              - cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
+            type: BinaryPkg
       - method: glob
         criteria:
           - '**/ffmpeg'

syft/pkg/cataloger/binary/classifier_cataloger_test.go

@@ -1951,6 +1951,17 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 				Metadata:  metadata("chrome-binary"),
 			},
 		},
+		{
+			logicalFixture: "firefox/151.0/linux-amd64",
+			expected: pkg.Package{
+				Name:      "firefox",
+				Version:   "151.0",
+				Type:      "binary",
+				PURL:      "pkg:generic/firefox@151.0",
+				Locations: locations("firefox", "application.ini"),
+				Metadata:  metadata("firefox-binary"),
+			},
+		},
 		{
 			logicalFixture: "ffmpeg/7.1.1/darwin-arm64",
 			expected: pkg.Package{

syft/pkg/cataloger/binary/classifiers.go

@@ -913,6 +913,19 @@ func DefaultClassifiers() []binutils.Classifier {
 			PURL:    mustPURL("pkg:generic/chrome@version"),
 			CPEs:    singleCPE("cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*"),
 		},
+		{
+			Class:    "firefox-binary",
+			FileGlob: "**/{firefox,firefox.exe}",
+			EvidenceMatcher: binutils.SupportingEvidenceMatcher(
+				"application.ini",
+				m.FileContentsVersionMatcher(
+					`(?ms)^Name=Firefox\r?$.*?^Version=(?P<version>[0-9]+(?:\.[0-9]+)+(?:[A-Za-z][0-9A-Za-z.-]*)?)\r?$`,
+				),
+			),
+			Package: "firefox",
+			PURL:    mustPURL("pkg:generic/firefox@version"),
+			CPEs:    singleCPE("cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*"),
+		},
 		{
 			Class:    "ffmpeg-binary",
 			FileGlob: "**/ffmpeg",

syft/pkg/cataloger/binary/testdata/classifiers/negative/firefox/application.ini

@@ -0,0 +1,3 @@
+[App]
+Name=Thunderbird
+Version=151.0

syft/pkg/cataloger/binary/testdata/classifiers/negative/firefox/firefox

@@ -0,0 +1 @@
+not a Firefox executable

syft/pkg/cataloger/binary/testdata/classifiers/snippets/firefox/151.0/linux-amd64/application.ini

@@ -0,0 +1,29 @@
+name: application.ini
+offset: 0
+length: 641
+snippetSha256: 286d4471ecf20596e8abde1ec5cb11456db06a6f73593c7b983f502b0b9b3011
+fileSha256: 286d4471ecf20596e8abde1ec5cb11456db06a6f73593c7b983f502b0b9b3011
+
+### byte snippet to follow ###
+; This file is not used. If you modify it and want the application to use
+; your modifications, move it under the browser/ subdirectory and start with
+; the "-app /path/to/browser/application.ini" argument.
+[App]
+Vendor=Mozilla
+Name=Firefox
+RemotingName=firefox-default
+CodeName=Nightly
+Version=151.0
+BuildID=20260611122700
+ID={ec8030f7-c20a-464f-9b0e-13a3a9e97384}
+
+[Gecko]
+MinVersion=151.0
+MaxVersion=151.0
+
+[XRE]
+EnableProfileMigrator=1
+
+
+[AppUpdate]
+URL=https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%SYSTEM_CAPABILITIES%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/update.xml

syft/pkg/cataloger/binary/testdata/config.yaml

@@ -17,6 +17,15 @@ from-images:
     paths:
       - /bin/[
 
+  - name: firefox
+    version: "151.0"
+    images:
+      - ref: mcr.microsoft.com/playwright:v1.61.1-noble@sha256:cf0daee9b994042e011bc29f20cdff1a9f682a039b43fcd738f7d8a9d3bcd9d6
+        platform: linux/amd64
+    paths:
+      - /ms-playwright/firefox-1532/firefox/firefox
+      - /ms-playwright/firefox-1532/firefox/application.ini
+
   - name: util-linux
     version: 2.37.4
     images: