Mark package relations by file ownership (#329)

* add marking package relations by file ownership

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* correct json schema version; ensure fileOwners dont return dups; pin test pkg versions

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* extract package relationships into separate section

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* pull in client-go features for import of PackageRelationships

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* move unit test for ownership by files relationship further down

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* rename relationship to "ownership-by-file-overlap"

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

internal/anchore/import_package_sbom_test.go

@@ -107,6 +107,10 @@ func TestPackageSbomToModel(t *testing.T) {
 	}
 
 	for _, d := range deep.Equal(actualDoc, expectedDoc) {
+		if strings.HasSuffix(d, "<nil slice> != []") {
+			// do not consider nil vs empty collection semantics as a "difference"
+			continue
+		}
 		t.Errorf("diff: %+v", d)
 	}
 }

internal/constants.go

@@ -6,5 +6,5 @@ const (
 
 	// JSONSchemaVersion is the current schema version output by the JSON presenter
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "1.0.1"
+	JSONSchemaVersion = "1.0.2"
 )