feat: add package supplier flag (#4131)

---------

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

cmd/syft/internal/commands/scan.go

@@ -218,8 +218,9 @@ func getSource(ctx context.Context, opts *options.Catalog, userInput string, sou
 	cfg := syft.DefaultGetSourceConfig().
 		WithRegistryOptions(opts.Registry.ToOptions()).
 		WithAlias(source.Alias{
-			Name:    opts.Source.Name,
-			Version: opts.Source.Version,
+			Name:     opts.Source.Name,
+			Version:  opts.Source.Version,
+			Supplier: opts.Source.Supplier,
 		}).
 		WithExcludeConfig(source.ExcludeConfig{
 			Paths: opts.Exclusions,

cmd/syft/internal/options/catalog.go

@@ -259,6 +259,9 @@ func (cfg *Catalog) AddFlags(flags clio.FlagSet) {
 
 	flags.StringVarP(&cfg.Source.BasePath, "base-path", "",
 		"base directory for scanning, no links will be followed above this directory, and all paths will be reported relative to this directory")
+
+	flags.StringVarP(&cfg.Source.Supplier, "source-supplier", "",
+		"the organization that supplied the component, which often may be the manufacturer, distributor, or repackager")
 }
 
 func (cfg *Catalog) DescribeFields(descriptions fangs.FieldDescriptionSet) {

cmd/syft/internal/options/format.go

@@ -43,9 +43,9 @@ over to the final syft 1.0 json output this option can be used to ease the trans
 
 Note: long term support for this option is not guaranteed (it may change or break at any time)`)
 
-	descriptions.Add(&o.Template.Path, `path to the template file to use when rendering the output with the template output format. 
+	descriptions.Add(&o.Template.Path, `path to the template file to use when rendering the output with the template output format.
 Note that all template paths are based on the current syft-json schema`)
-	descriptions.Add(&o.Template.Legacy, `if true, uses the go structs for the syft-json format for templating. 
+	descriptions.Add(&o.Template.Legacy, `if true, uses the go structs for the syft-json format for templating.
 if false, uses the syft-json output for templating (which follows the syft JSON schema exactly).
 
 Note: long term support for this option is not guaranteed (it may change or break at any time)`)

cmd/syft/internal/options/source.go

@@ -16,6 +16,8 @@ import (
 type sourceConfig struct {
 	Name     string      `json:"name" yaml:"name" mapstructure:"name"`
 	Version  string      `json:"version" yaml:"version" mapstructure:"version"`
+	Supplier string      `json:"supplier" yaml:"supplier" mapstructure:"supplier"`
+	Source   string      `json:"source" yaml:"source" mapstructure:"source"`
 	BasePath string      `yaml:"base-path" json:"base-path" mapstructure:"base-path"` // specify base path for all file paths
 	File     fileSource  `json:"file" yaml:"file" mapstructure:"file"`
 	Image    imageSource `json:"image" yaml:"image" mapstructure:"image"`

cmd/syft/internal/test/integration/encode_decode_cycle_test.go

@@ -78,7 +78,10 @@ func TestEncodeDecodeEncodeCycleComparison(t *testing.T) {
 		t.Run(test.name, func(t *testing.T) {
 			for _, image := range images {
 				originalSBOM, _ := catalogFixtureImage(t, image, source.SquashedScope)
-
+				// we need a way to inject supplier into this test
+				// supplier is not available as part of the SBOM Config API since the flag
+				// is used in conjunction with the SourceConfig which is injected into generateSBOM during scan
+				originalSBOM.Source.Supplier = "anchore"
 				f := encoders.GetByString(test.name)
 				require.NotNil(t, f)