Vcpkg Cataloger (#4081)

* Vcpkg cataloger for vcpkg "Manifest Mode"

Find and parse vcpkg-lock.json to get HEAD commit hash

Signed-off-by: Gabriel Rau <gabetrau@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* just use local vcpkg git repo if it exists, clone it if it doesn't

Signed-off-by: Gabriel Rau <gabetrau@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* Config opt for git remote clones for vcpkg and README update

Signed-off-by: Gabriel Rau <gabetrau@gmail.com>

* Look in vcpkg cache git repo for custom git repos

Signed-off-by: Gabriel Rau <gabetrau@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add triplet to metadata and support overlay-ports from config file

Signed-off-by: Gabriel Rau <gabetrau@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* Add PURL to packages (not sure if this is correct)

Signed-off-by: Gabriel Rau <gabetrau@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* flatten structs in pkg module and move vcpkg structs to resolver

Signed-off-by: Gabriel Rau <gabetrau@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* account for overriden versions in toplevel manifest

Signed-off-by: Gabriel Rau <gabetrau@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* generate json schema for vcpkg metadata

Signed-off-by: Gabriel Rau <gabetrau@gmail.com>

* test for basic vcpkg project

dependencies for vcpkg registry to be pulled in

add tree hashes and use correct git hash in builtin-baseline for helloworld test

vcpkg-registry for testing that uses object hashes from syft repo

fix broken tests

Signed-off-by: Gabriel Rau <gabetrau@gmail.com>

* formatting

Signed-off-by: Gabriel Rau <gabetrau@gmail.com>

* fix static-analysis violations

Signed-off-by: Gabriel Rau <gabetrau@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix integration test failure

Signed-off-by: Gabriel Rau <gabetrau@gmail.com>

* remove uneeded files from vcpkg test fixture and use custom registry

Signed-off-by: Gabriel Rau <gabetrau@gmail.com>

* change vcpkg registry to anchore one

Signed-off-by: Gabriel Rau <gabetrau@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* purl spec based on open PR

Signed-off-by: Gabriel Rau <gabetrau@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* generate-json-schema

Signed-off-by: Gabriel Rau <gabetrau@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* rebased and generate json schema 16.0.40

Signed-off-by: Gabriel Rau <gabetrau@gmail.com>

* address low hanging fruit

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* handle additional comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* migrate to testdata

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* improve docs and testing

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix static analysis

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove license from pkg metadata

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix capabilities claim

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Gabriel Rau <gabetrau@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
This commit is contained in:
gab
2026-07-01 09:11:33 -04:00
committed by GitHub
co-authored by Alex Goodman
parent 148fe572bc
commit 656a4d46d7
34 changed files with 6042 additions and 11 deletions
File diff suppressed because it is too large Load Diff
+84 -1
View File
@@ -1,6 +1,6 @@
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "anchore.io/schema/syft/json/16.1.7/document",
"$id": "anchore.io/schema/syft/json/16.1.8/document",
"$ref": "#/$defs/Document",
"$defs": {
"AlpmDbEntry": {
@@ -2927,6 +2927,9 @@
{
"$ref": "#/$defs/TerraformLockProviderEntry"
},
{
"$ref": "#/$defs/VcpkgManifest"
},
{
"$ref": "#/$defs/WordpressPluginEntry"
}
@@ -4385,6 +4388,86 @@
],
"description": "TerraformLockProviderEntry represents a single provider entry in a Terraform dependency lock file (.terraform.lock.hcl)."
},
"VcpkgManifest": {
"properties": {
"description": {
"items": {
"type": "string"
},
"type": "array"
},
"documentation": {
"type": "string"
},
"full-version": {
"type": "string"
},
"version": {
"type": "string"
},
"port-version": {
"type": "integer"
},
"maintainers": {
"items": {
"type": "string"
},
"type": "array"
},
"name": {
"type": "string"
},
"supports": {
"type": "string"
},
"registry": {
"$ref": "#/$defs/VcpkgRegistryEntry",
"description": "to show where it came from"
},
"triplet": {
"type": "string",
"description": "found by looking at build folder to find target. ex. \"x64-linux\""
}
},
"type": "object",
"required": [
"full-version",
"version",
"port-version",
"name"
],
"description": "used for metadata."
},
"VcpkgRegistryEntry": {
"properties": {
"baseline": {
"type": "string"
},
"kind": {
"type": "string"
},
"packages": {
"items": {
"type": "string"
},
"type": "array"
},
"path": {
"type": "string"
},
"reference": {
"type": "string"
},
"repository": {
"type": "string"
}
},
"type": "object",
"required": [
"kind"
],
"description": "Matches definition of Vcpkg \"Registry\"."
},
"WordpressPluginEntry": {
"properties": {
"pluginInstallDirectory": {