fix: update steroscope to include OCI platform metadata (#5128)

* Update steroscope to include OCI platform metadata

Signed-off-by: Jason Paulos <jasonpaulos@users.noreply.github.com>

* chore(deps): point stereoscope at anchore/main

drops the fork `replace` directive and moves to a pseudo-version off stereoscope
main (`a22e5ae`, anchore/stereoscope#657). no tag carries it yet, so this should
move to a real version once one is cut.

`readImageMetadata` now fills os/architecture/variant for every provider, not
just oci. the docker tarball provider set neither before, so image metadata and
the image purl change for docker-archive input too:

- `"architecture": ""` -> `"amd64"`
- `"os": ""` -> `"linux"`
- `?arch=` -> `?arch=amd64`

the empty `arch=` qualifier was never right, but it is user-visible output.

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* test: cover single-platform oci layouts

the pr only added assertions to the multiplatform fixture, which already
reported the right platform. the behavior that actually changed is single-image
layouts: they used to report empty os/arch and silently ignore `--platform`, and
now report what the image config says and fail with a platform mismatch.

also drops the non-linux skip on the default-platform test. the oci providers
default to `linux/<GOARCH>` regardless of host os, so it holds on macos too.

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Jason Paulos <jasonpaulos@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>

cmd/syft/internal/test/integration/multiplatform_oci_test.go

@@ -60,6 +60,8 @@ func TestMultiPlatformOCIImageSelection(t *testing.T) {
 
 					// The raw config of the selected image must match the requested platform...
 					assertConfigPlatform(t, meta.RawConfig, "linux", arch)
+					assert.Equal(t, "linux", meta.OS)
+					assert.Equal(t, arch, meta.Architecture)
 					// ...and it must be the exact per-platform image from the multi-platform index.
 					assert.Equal(t, expectedDigest[arch], meta.ID)
 				})
@@ -125,6 +127,8 @@ func TestMultiPlatformOCIImageSelection_DefaultPlatform(t *testing.T) {
 
 			// The raw config of the selected image must match the current platform
 			assertConfigPlatform(t, meta.RawConfig, "linux", runtime.GOARCH)
+			assert.Equal(t, "linux", meta.OS)
+			assert.Equal(t, runtime.GOARCH, meta.Architecture)
 		})
 	}
 }

cmd/syft/internal/test/integration/single_platform_oci_test.go

@@ -0,0 +1,64 @@
+package integration
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/stereoscope/pkg/image"
+	"github.com/anchore/stereoscope/pkg/imagetest"
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/source"
+)
+
+// TestSinglePlatformOCIImage covers the single-image (non-index) OCI layouts, where syft used to report
+// empty os/architecture metadata and silently accept any --platform. Both now come from the image config.
+func TestSinglePlatformOCIImage(t *testing.T) {
+	// a platform this fixture is never built for, so the mismatch is not host dependent
+	unavailablePlatform, err := image.NewPlatform("linux/ppc64le")
+	require.NoError(t, err)
+
+	sources := map[string]image.Source{
+		"oci-dir":     image.OciDirectorySource,
+		"oci-archive": image.OciTarballSource,
+	}
+
+	for from, imageSource := range sources {
+		t.Run(from, func(t *testing.T) {
+			localPath := strings.TrimPrefix(imagetest.PrepareFixtureImage(t, imageSource, "image-distro-id"), string(imageSource)+":")
+
+			t.Run("reports the platform from the image config", func(t *testing.T) {
+				src, err := syft.GetSource(
+					context.Background(),
+					localPath,
+					syft.DefaultGetSourceConfig().WithSources(from),
+				)
+				require.NoError(t, err)
+				t.Cleanup(func() {
+					require.NoError(t, src.Close())
+				})
+
+				meta, ok := src.Describe().Metadata.(source.ImageMetadata)
+				require.True(t, ok, "expected image metadata, got %T", src.Describe().Metadata)
+
+				// the fixture is built for whatever the local docker daemon runs, so assert against the
+				// config rather than a fixed platform
+				assert.NotEmpty(t, meta.OS)
+				assert.NotEmpty(t, meta.Architecture)
+				assertConfigPlatform(t, meta.RawConfig, meta.OS, meta.Architecture)
+			})
+
+			t.Run("rejects a platform the image does not match", func(t *testing.T) {
+				_, err := syft.GetSource(
+					context.Background(),
+					localPath,
+					syft.DefaultGetSourceConfig().WithSources(from).WithPlatform(unavailablePlatform),
+				)
+				require.ErrorContains(t, err, "linux/ppc64le")
+			})
+		})
+	}
+}