Mark package relations by file ownership (#329)

* add marking package relations by file ownership

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* correct json schema version; ensure fileOwners dont return dups; pin test pkg versions

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* extract package relationships into separate section

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* pull in client-go features for import of PackageRelationships

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* move unit test for ownership by files relationship further down

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* rename relationship to "ownership-by-file-overlap"

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

syft/presenter/json/document.go

@@ -12,11 +12,12 @@ import (
 
 // Document represents the syft cataloging findings as a JSON document
 type Document struct {
-	Artifacts  []Package    `json:"artifacts"`  // Artifacts is the list of packages discovered and placed into the catalog
-	Source     Source       `json:"source"`     // Source represents the original object that was cataloged
-	Distro     Distribution `json:"distro"`     // Distro represents the Linux distribution that was detected from the source
-	Descriptor Descriptor   `json:"descriptor"` // Descriptor is a block containing self-describing information about syft
-	Schema     Schema       `json:"schema"`     // Schema is a block reserved for defining the version for the shape of this JSON document and where to find the schema document to validate the shape
+	Artifacts             []Package      `json:"artifacts"`  // Artifacts is the list of packages discovered and placed into the catalog
+	Source                Source         `json:"source"`     // Source represents the original object that was cataloged
+	Distro                Distribution   `json:"distro"`     // Distro represents the Linux distribution that was detected from the source
+	Descriptor            Descriptor     `json:"descriptor"` // Descriptor is a block containing self-describing information about syft
+	Schema                Schema         `json:"schema"`     // Schema is a block reserved for defining the version for the shape of this JSON document and where to find the schema document to validate the shape
+	ArtifactRelationships []Relationship `json:"artifactRelationships"`
 }
 
 // NewDocument creates and populates a new JSON document struct from the given cataloging results.
@@ -38,6 +39,7 @@ func NewDocument(catalog *pkg.Catalog, srcMetadata source.Metadata, d *distro.Di
 			Version: internal.JSONSchemaVersion,
 			URL:     fmt.Sprintf("https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-%s.json", internal.JSONSchemaVersion),
 		},
+		ArtifactRelationships: newRelationships(pkg.NewRelationships(catalog)),
 	}
 
 	for _, p := range catalog.Sorted() {

syft/presenter/json/package.go

@@ -16,6 +16,7 @@ type Package struct {
 
 // packageBasicMetadata contains non-ambiguous values (type-wise) from pkg.Package.
 type packageBasicMetadata struct {
+	ID        string            `json:"id"`
 	Name      string            `json:"name"`
 	Version   string            `json:"version"`
 	Type      string            `json:"type"`
@@ -60,6 +61,7 @@ func NewPackage(p *pkg.Package) (Package, error) {
 
 	return Package{
 		packageBasicMetadata: packageBasicMetadata{
+			ID:        string(p.ID),
 			Name:      p.Name,
 			Version:   p.Version,
 			Type:      string(p.Type),
@@ -89,6 +91,7 @@ func (a Package) ToPackage() (pkg.Package, error) {
 	}
 	return pkg.Package{
 		// does not include found-by and locations
+		ID:           pkg.ID(a.ID),
 		Name:         a.Name,
 		Version:      a.Version,
 		FoundBy:      a.FoundBy,

syft/presenter/json/presenter_test.go

@@ -31,6 +31,7 @@ func TestJsonDirsPresenter(t *testing.T) {
 
 	// populate catalog with test data
 	catalog.Add(pkg.Package{
+		ID:      "package-1-id",
 		Name:    "package-1",
 		Version: "1.0.1",
 		Type:    pkg.PythonPkg,
@@ -51,6 +52,7 @@ func TestJsonDirsPresenter(t *testing.T) {
 		},
 	})
 	catalog.Add(pkg.Package{
+		ID:      "package-2-id",
 		Name:    "package-2",
 		Version: "2.0.1",
 		Type:    pkg.DebPkg,
@@ -113,6 +115,7 @@ func TestJsonImgsPresenter(t *testing.T) {
 
 	// populate catalog with test data
 	catalog.Add(pkg.Package{
+		ID:      "package-1-id",
 		Name:    "package-1",
 		Version: "1.0.1",
 		Locations: []source.Location{
@@ -133,6 +136,7 @@ func TestJsonImgsPresenter(t *testing.T) {
 		},
 	})
 	catalog.Add(pkg.Package{
+		ID:      "package-2-id",
 		Name:    "package-2",
 		Version: "2.0.1",
 		Locations: []source.Location{

syft/presenter/json/relationship.go

@@ -0,0 +1,23 @@
+package json
+
+import "github.com/anchore/syft/syft/pkg"
+
+type Relationship struct {
+	Parent   string      `json:"parent"`
+	Child    string      `json:"child"`
+	Type     string      `json:"type"`
+	Metadata interface{} `json:"metadata"`
+}
+
+func newRelationships(relationships []pkg.Relationship) []Relationship {
+	result := make([]Relationship, len(relationships))
+	for i, r := range relationships {
+		result[i] = Relationship{
+			Parent:   string(r.Parent),
+			Child:    string(r.Child),
+			Type:     string(r.Type),
+			Metadata: r.Metadata,
+		}
+	}
+	return result
+}

syft/presenter/json/test-fixtures/snapshot/TestJsonDirsPresenter.golden

@@ -1,6 +1,7 @@
 {
  "artifacts": [
   {
+   "id": "package-1-id",
    "name": "package-1",
    "version": "1.0.1",
    "type": "python",
@@ -30,6 +31,7 @@
    }
   },
   {
+   "id": "package-2-id",
    "name": "package-2",
    "version": "2.0.1",
    "type": "deb",
@@ -72,7 +74,8 @@
   "version": "[not provided]"
  },
  "schema": {
-  "version": "1.0.1",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-1.0.1.json"
- }
+  "version": "1.0.2",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-1.0.2.json"
+ },
+ "artifactRelationships": []
 }

syft/presenter/json/test-fixtures/snapshot/TestJsonImgsPresenter.golden

@@ -1,6 +1,7 @@
 {
  "artifacts": [
   {
+   "id": "package-1-id",
    "name": "package-1",
    "version": "1.0.1",
    "type": "python",
@@ -31,6 +32,7 @@
    }
   },
   {
+   "id": "package-2-id",
    "name": "package-2",
    "version": "2.0.1",
    "type": "deb",
@@ -103,7 +105,8 @@
   "version": "[not provided]"
  },
  "schema": {
-  "version": "1.0.1",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-1.0.1.json"
- }
+  "version": "1.0.2",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-1.0.2.json"
+ },
+ "artifactRelationships": []
 }