Suport SPDX SBOM decoding (#738)

internal/formats/syftjson/to_syft_model.go

@@ -3,6 +3,7 @@ package syftjson
 import (
 	"github.com/anchore/syft/internal/formats/syftjson/model"
 	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
@@ -11,13 +12,16 @@ import (
 )
 
 func toSyftModel(doc model.Document) (*sbom.SBOM, error) {
+	catalog := toSyftCatalog(doc.Artifacts)
+
 	return &sbom.SBOM{
 		Artifacts: sbom.Artifacts{
-			PackageCatalog:    toSyftCatalog(doc.Artifacts),
+			PackageCatalog:    catalog,
 			LinuxDistribution: toSyftLinuxRelease(doc.Distro),
 		},
-		Source:     *toSyftSourceData(doc.Source),
-		Descriptor: toSyftDescriptor(doc.Descriptor),
+		Source:        *toSyftSourceData(doc.Source),
+		Descriptor:    toSyftDescriptor(doc.Descriptor),
+		Relationships: toSyftRelationships(&doc, catalog, doc.ArtifactRelationships),
 	}, nil
 }
 
@@ -42,6 +46,59 @@ func toSyftLinuxRelease(d model.LinuxRelease) *linux.Release {
 	}
 }
 
+func toSyftRelationships(doc *model.Document, catalog *pkg.Catalog, relationships []model.Relationship) []artifact.Relationship {
+	idMap := make(map[string]interface{})
+
+	for _, p := range catalog.Sorted() {
+		idMap[string(p.ID())] = p
+		for _, l := range p.Locations {
+			idMap[string(l.Coordinates.ID())] = l.Coordinates
+		}
+	}
+
+	for _, f := range doc.Files {
+		idMap[f.ID] = f.Location
+	}
+
+	var out []artifact.Relationship
+	for _, r := range relationships {
+		syftRelationship := toSyftRelationship(idMap, r)
+		if syftRelationship != nil {
+			out = append(out, *syftRelationship)
+		}
+	}
+	return out
+}
+
+func toSyftRelationship(idMap map[string]interface{}, relationship model.Relationship) *artifact.Relationship {
+	from, ok := idMap[relationship.Parent].(artifact.Identifiable)
+	if !ok {
+		log.Warnf("relationship mapping from key %s is not a valid artifact.Identifiable type: %+v", relationship.Parent, idMap[relationship.Parent])
+		return nil
+	}
+	to, ok := idMap[relationship.Child].(artifact.Identifiable)
+	if !ok {
+		log.Warnf("relationship mapping to key %s is not a valid artifact.Identifiable type: %+v", relationship.Child, idMap[relationship.Child])
+		return nil
+	}
+	typ := artifact.RelationshipType(relationship.Type)
+
+	switch typ {
+	case artifact.OwnershipByFileOverlapRelationship:
+		fallthrough
+	case artifact.ContainsRelationship:
+	default:
+		log.Warnf("unknown relationship type: %s", typ)
+		return nil
+	}
+	return &artifact.Relationship{
+		From: from,
+		To:   to,
+		Type: typ,
+		Data: relationship.Metadata,
+	}
+}
+
 func toSyftDescriptor(d model.Descriptor) sbom.Descriptor {
 	return sbom.Descriptor{
 		Name:          d.Name,