Mark package relations by file ownership (#329)

* add marking package relations by file ownership

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* correct json schema version; ensure fileOwners dont return dups; pin test pkg versions

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* extract package relationships into separate section

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* pull in client-go features for import of PackageRelationships

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* move unit test for ownership by files relationship further down

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* rename relationship to "ownership-by-file-overlap"

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

test/integration/document_import_test.go

@@ -2,6 +2,7 @@ package integration
 
 import (
 	"bytes"
+	"strings"
 	"testing"
 
 	"github.com/anchore/stereoscope/pkg/imagetest"
@@ -57,8 +58,6 @@ func TestCatalogFromJSON(t *testing.T) {
 
 			var actualPackages, expectedPackages []*pkg.Package
 
-			// TODO: take out pkg.RpmdbMetadataType filter
-
 			for _, p := range expectedCatalog.Sorted() {
 				expectedPackages = append(expectedPackages, p)
 			}
@@ -89,8 +88,7 @@ func TestCatalogFromJSON(t *testing.T) {
 
 				for _, d := range deep.Equal(a, e) {
 					// ignore errors for empty collections vs nil for select fields
-					// TODO: this is brittle, but not dangerously so. We should still find a better way to do this.
-					if d == "Licenses: [] != <nil slice>" {
+					if strings.Contains(d, "[] != <nil slice>") {
 						continue
 					}
 					t.Errorf("   package %d (name=%s) diff: %+v", i, e.Name, d)

test/integration/package_ownership_relationship_test.go

@@ -0,0 +1,61 @@
+package integration
+
+import (
+	"bytes"
+	"encoding/json"
+	"testing"
+
+	"github.com/anchore/stereoscope/pkg/imagetest"
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/presenter"
+	jsonPresenter "github.com/anchore/syft/syft/presenter/json"
+	"github.com/anchore/syft/syft/source"
+)
+
+func TestPackageOwnershipRelationships(t *testing.T) {
+
+	// ensure that the json presenter is applying artifact ownership with an image that has expected ownership relationships
+	tests := []struct {
+		fixture string
+	}{
+		{
+			fixture: "image-owning-package",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.fixture, func(t *testing.T) {
+			_, cleanup := imagetest.GetFixtureImage(t, "docker-archive", test.fixture)
+			tarPath := imagetest.GetFixtureImageTarPath(t, test.fixture)
+			defer cleanup()
+
+			src, catalog, d, err := syft.Catalog("docker-archive:"+tarPath, source.SquashedScope)
+			if err != nil {
+				t.Fatalf("failed to catalog image: %+v", err)
+			}
+
+			p := presenter.GetPresenter(presenter.JSONPresenter, src.Metadata, catalog, d)
+			if p == nil {
+				t.Fatal("unable to get presenter")
+			}
+
+			output := bytes.NewBufferString("")
+			err = p.Present(output)
+			if err != nil {
+				t.Fatalf("unable to present: %+v", err)
+			}
+
+			var doc jsonPresenter.Document
+			decoder := json.NewDecoder(output)
+			if err := decoder.Decode(&doc); err != nil {
+				t.Fatalf("unable to decode json doc: %+v", err)
+			}
+
+			if len(doc.ArtifactRelationships) == 0 {
+				t.Errorf("expected to find relationships between packages but found none")
+			}
+
+		})
+	}
+
+}

test/integration/test-fixtures/image-owning-package/Dockerfile

@@ -0,0 +1,3 @@
+FROM ubuntu:20.04
+# this covers rpm-python
+RUN apt-get update && apt-get install -y python-pil=6.2.1-3