refactor: move formats from internal into syft module (#1172)

syft/formats/common/spdxhelpers/description.go

@@ -0,0 +1,19 @@
+package spdxhelpers
+
+import "github.com/anchore/syft/syft/pkg"
+
+func Description(p pkg.Package) string {
+	if hasMetadata(p) {
+		switch metadata := p.Metadata.(type) {
+		case pkg.ApkMetadata:
+			return metadata.Description
+		case pkg.NpmPackageJSONMetadata:
+			return metadata.Description
+		}
+	}
+	return ""
+}
+
+func hasMetadata(p pkg.Package) bool {
+	return p.Metadata != nil
+}

syft/formats/common/spdxhelpers/description_test.go

@@ -0,0 +1,56 @@
+package spdxhelpers
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_Description(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected string
+	}{
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name:     "no metadata",
+			input:    pkg.Package{},
+			expected: "",
+		},
+		{
+			name: "from apk",
+			input: pkg.Package{
+				Metadata: pkg.ApkMetadata{
+					Description: "a description!",
+				},
+			},
+			expected: "a description!",
+		},
+		{
+			name: "from npm",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					Description: "a description!",
+				},
+			},
+			expected: "a description!",
+		},
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name: "empty",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					Homepage: "",
+				},
+			},
+			expected: "",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, Description(test.input))
+		})
+	}
+}

syft/formats/common/spdxhelpers/document_name.go

@@ -0,0 +1,30 @@
+package spdxhelpers
+
+import (
+	"path"
+	"strings"
+
+	"github.com/anchore/syft/syft/source"
+)
+
+func DocumentName(srcMetadata source.Metadata) string {
+	switch srcMetadata.Scheme {
+	case source.ImageScheme:
+		return cleanName(srcMetadata.ImageMetadata.UserInput)
+	case source.DirectoryScheme, source.FileScheme:
+		return cleanName(srcMetadata.Path)
+	default:
+		return "unknown"
+	}
+}
+
+func cleanName(name string) string {
+	// remove # according to specification
+	name = strings.ReplaceAll(name, "#", "-")
+
+	// remove : for url construction
+	name = strings.ReplaceAll(name, ":", "-")
+
+	// clean relative pathing
+	return path.Clean(name)
+}

syft/formats/common/spdxhelpers/document_name_test.go

@@ -0,0 +1,70 @@
+package spdxhelpers
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/anchore/syft/syft/source"
+	"github.com/scylladb/go-set/strset"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_DocumentName(t *testing.T) {
+	allSchemes := strset.New()
+	for _, s := range source.AllSchemes {
+		allSchemes.Add(string(s))
+	}
+	testedSchemes := strset.New()
+
+	tests := []struct {
+		name        string
+		inputName   string
+		srcMetadata source.Metadata
+		expected    string
+	}{
+		{
+			name:      "image",
+			inputName: "my-name",
+			srcMetadata: source.Metadata{
+				Scheme: source.ImageScheme,
+				ImageMetadata: source.ImageMetadata{
+					UserInput:      "image-repo/name:tag",
+					ID:             "id",
+					ManifestDigest: "digest",
+				},
+			},
+			expected: "image-repo/name-tag",
+		},
+		{
+			name:      "directory",
+			inputName: "my-name",
+			srcMetadata: source.Metadata{
+				Scheme: source.DirectoryScheme,
+				Path:   "some/path/to/place",
+			},
+			expected: "some/path/to/place",
+		},
+		{
+			name:      "file",
+			inputName: "my-name",
+			srcMetadata: source.Metadata{
+				Scheme: source.FileScheme,
+				Path:   "some/path/to/place",
+			},
+			expected: "some/path/to/place",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actual := DocumentName(test.srcMetadata)
+			assert.True(t, strings.HasPrefix(actual, test.expected), fmt.Sprintf("actual name %q", actual))
+
+			// track each scheme tested (passed or not)
+			testedSchemes.Add(string(test.srcMetadata.Scheme))
+		})
+	}
+
+	// assert all possible schemes were under test
+	assert.ElementsMatch(t, allSchemes.List(), testedSchemes.List(), "not all source.Schemes are under test")
+}

syft/formats/common/spdxhelpers/document_namespace.go

@@ -0,0 +1,42 @@
+package spdxhelpers
+
+import (
+	"fmt"
+	"net/url"
+	"path"
+
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/syft/source"
+	"github.com/google/uuid"
+)
+
+func DocumentNameAndNamespace(srcMetadata source.Metadata) (string, string) {
+	name := DocumentName(srcMetadata)
+	return name, DocumentNamespace(name, srcMetadata)
+}
+
+func DocumentNamespace(name string, srcMetadata source.Metadata) string {
+	input := "unknown-source-type"
+	switch srcMetadata.Scheme {
+	case source.ImageScheme:
+		input = "image"
+	case source.DirectoryScheme:
+		input = "dir"
+	case source.FileScheme:
+		input = "file"
+	}
+
+	uniqueID := uuid.Must(uuid.NewRandom())
+	identifier := path.Join(input, uniqueID.String())
+	if name != "." {
+		identifier = path.Join(input, fmt.Sprintf("%s-%s", name, uniqueID.String()))
+	}
+
+	u := url.URL{
+		Scheme: "https",
+		Host:   "anchore.com",
+		Path:   path.Join(internal.ApplicationName, identifier),
+	}
+
+	return u.String()
+}

syft/formats/common/spdxhelpers/document_namespace_test.go

@@ -0,0 +1,71 @@
+package spdxhelpers
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/anchore/syft/syft/source"
+	"github.com/scylladb/go-set/strset"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_documentNamespace(t *testing.T) {
+	allSchemes := strset.New()
+	for _, s := range source.AllSchemes {
+		allSchemes.Add(string(s))
+	}
+	testedSchemes := strset.New()
+
+	tests := []struct {
+		name        string
+		inputName   string
+		srcMetadata source.Metadata
+		expected    string
+	}{
+		{
+			name:      "image",
+			inputName: "my-name",
+			srcMetadata: source.Metadata{
+				Scheme: source.ImageScheme,
+				ImageMetadata: source.ImageMetadata{
+					UserInput:      "image-repo/name:tag",
+					ID:             "id",
+					ManifestDigest: "digest",
+				},
+			},
+			expected: "https://anchore.com/syft/image/my-name-",
+		},
+		{
+			name:      "directory",
+			inputName: "my-name",
+			srcMetadata: source.Metadata{
+				Scheme: source.DirectoryScheme,
+				Path:   "some/path/to/place",
+			},
+			expected: "https://anchore.com/syft/dir/my-name-",
+		},
+		{
+			name:      "file",
+			inputName: "my-name",
+			srcMetadata: source.Metadata{
+				Scheme: source.FileScheme,
+				Path:   "some/path/to/place",
+			},
+			expected: "https://anchore.com/syft/file/my-name-",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actual := DocumentNamespace(test.inputName, test.srcMetadata)
+			// note: since the namespace ends with a UUID we check the prefix
+			assert.True(t, strings.HasPrefix(actual, test.expected), fmt.Sprintf("actual namespace %q", actual))
+
+			// track each scheme tested (passed or not)
+			testedSchemes.Add(string(test.srcMetadata.Scheme))
+		})
+	}
+
+	// assert all possible schemes were under test
+	assert.ElementsMatch(t, allSchemes.List(), testedSchemes.List(), "not all source.Schemes are under test")
+}

syft/formats/common/spdxhelpers/download_location.go

@@ -0,0 +1,26 @@
+package spdxhelpers
+
+import "github.com/anchore/syft/syft/pkg"
+
+const NONE = "NONE"
+const NOASSERTION = "NOASSERTION"
+
+func DownloadLocation(p pkg.Package) string {
+	// 3.7: Package Download Location
+	// Cardinality: mandatory, one
+	// NONE if there is no download location whatsoever.
+	// NOASSERTION if:
+	//   (i) the SPDX file creator has attempted to but cannot reach a reasonable objective determination;
+	//   (ii) the SPDX file creator has made no attempt to determine this field; or
+	//   (iii) the SPDX file creator has intentionally provided no information (no meaning should be implied by doing so).
+
+	if hasMetadata(p) {
+		switch metadata := p.Metadata.(type) {
+		case pkg.ApkMetadata:
+			return NoneIfEmpty(metadata.URL)
+		case pkg.NpmPackageJSONMetadata:
+			return NoneIfEmpty(metadata.URL)
+		}
+	}
+	return NOASSERTION
+}

syft/formats/common/spdxhelpers/download_location_test.go

@@ -0,0 +1,54 @@
+package spdxhelpers
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_DownloadLocation(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected string
+	}{
+		{
+			name:     "no metadata",
+			input:    pkg.Package{},
+			expected: NOASSERTION,
+		},
+		{
+			name: "from apk",
+			input: pkg.Package{
+				Metadata: pkg.ApkMetadata{
+					URL: "http://a-place.gov",
+				},
+			},
+			expected: "http://a-place.gov",
+		},
+		{
+			name: "from npm",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					URL: "http://a-place.gov",
+				},
+			},
+			expected: "http://a-place.gov",
+		},
+		{
+			name: "empty",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					URL: "",
+				},
+			},
+			expected: NONE,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, DownloadLocation(test.input))
+		})
+	}
+}

syft/formats/common/spdxhelpers/external_ref.go

@@ -0,0 +1,43 @@
+package spdxhelpers
+
+type ReferenceCategory string
+
+const (
+	SecurityReferenceCategory       ReferenceCategory = "SECURITY"
+	PackageManagerReferenceCategory ReferenceCategory = "PACKAGE_MANAGER"
+	OtherReferenceCategory          ReferenceCategory = "OTHER"
+)
+
+// source: https://spdx.github.io/spdx-spec/appendix-VI-external-repository-identifiers/
+
+type ExternalRefType string
+
+const (
+	// see https://nvd.nist.gov/cpe
+	Cpe22ExternalRefType ExternalRefType = "cpe22Type"
+	// see https://nvd.nist.gov/cpe
+	Cpe23ExternalRefType ExternalRefType = "cpe23Type"
+	// see http://repo1.maven.org/maven2/
+	MavenCentralExternalRefType ExternalRefType = "maven-central"
+	// see https://www.npmjs.com/
+	NpmExternalRefType ExternalRefType = "npm"
+	// see https://www.nuget.org/
+	NugetExternalRefType ExternalRefType = "nuget"
+	// see http://bower.io/
+	BowerExternalRefType ExternalRefType = "bower"
+	// see https://github.com/package-url/purl-spec
+	PurlExternalRefType ExternalRefType = "purl"
+	// These point to objects present in the Software Heritage archive by the means of SoftWare Heritage persistent Identifiers (SWHID)
+	SwhExternalRefType ExternalRefType = "swh"
+)
+
+type ExternalRef struct {
+	Comment string `json:"comment,omitempty"`
+	// Category for the external reference.
+	ReferenceCategory ReferenceCategory `json:"referenceCategory"`
+	// The unique string with no spaces necessary to access the package-specific information, metadata, or content
+	// within the target location. The format of the locator is subject to constraints defined by the <type>.
+	ReferenceLocator string `json:"referenceLocator"`
+	// Type of the external reference. These are defined in an appendix in the SPDX specification.
+	ReferenceType ExternalRefType `json:"referenceType"`
+}

syft/formats/common/spdxhelpers/external_refs.go

@@ -0,0 +1,27 @@
+package spdxhelpers
+
+import (
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func ExternalRefs(p pkg.Package) (externalRefs []ExternalRef) {
+	externalRefs = make([]ExternalRef, 0)
+
+	for _, c := range p.CPEs {
+		externalRefs = append(externalRefs, ExternalRef{
+			ReferenceCategory: SecurityReferenceCategory,
+			ReferenceLocator:  pkg.CPEString(c),
+			ReferenceType:     Cpe23ExternalRefType,
+		})
+	}
+
+	if p.PURL != "" {
+		externalRefs = append(externalRefs, ExternalRef{
+			ReferenceCategory: PackageManagerReferenceCategory,
+			ReferenceLocator:  p.PURL,
+			ReferenceType:     PurlExternalRefType,
+		})
+	}
+
+	return externalRefs
+}

syft/formats/common/spdxhelpers/external_refs_test.go

@@ -0,0 +1,44 @@
+package spdxhelpers
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_ExternalRefs(t *testing.T) {
+	testCPE := pkg.MustCPE("cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*")
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected []ExternalRef
+	}{
+		{
+			name: "cpe + purl",
+			input: pkg.Package{
+				CPEs: []pkg.CPE{
+					testCPE,
+				},
+				PURL: "a-purl",
+			},
+			expected: []ExternalRef{
+				{
+					ReferenceCategory: SecurityReferenceCategory,
+					ReferenceLocator:  pkg.CPEString(testCPE),
+					ReferenceType:     Cpe23ExternalRefType,
+				},
+				{
+					ReferenceCategory: PackageManagerReferenceCategory,
+					ReferenceLocator:  "a-purl",
+					ReferenceType:     PurlExternalRefType,
+				},
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.ElementsMatch(t, test.expected, ExternalRefs(test.input))
+		})
+	}
+}

syft/formats/common/spdxhelpers/file_type.go

@@ -0,0 +1,17 @@
+package spdxhelpers
+
+type FileType string
+
+const (
+	DocumentationFileType FileType = "DOCUMENTATION" // if the file serves as documentation
+	ImageFileType         FileType = "IMAGE"         // if the file is associated with a picture image file (MIME type of image/*, e.g., .jpg, .gif)
+	VideoFileType         FileType = "VIDEO"         // if the file is associated with a video file type (MIME type of video/*)
+	ArchiveFileType       FileType = "ARCHIVE"       // if the file represents an archive (.tar, .jar, etc.)
+	SpdxFileType          FileType = "SPDX"          // if the file is an SPDX document
+	ApplicationFileType   FileType = "APPLICATION"   // if the file is associated with a specific application type (MIME type of application/*)
+	SourceFileType        FileType = "SOURCE"        // if the file is human readable source code (.c, .html, etc.)
+	BinaryFileType        FileType = "BINARY"        // if the file is a compiled object, target image or binary executable (.o, .a, etc.)
+	TextFileType          FileType = "TEXT"          // if the file is human readable text file (MIME type of text/*)
+	AudioFileType         FileType = "AUDIO"         // if the file is associated with an audio file (MIME type of audio/* , e.g. .mp3)
+	OtherFileType         FileType = "OTHER"         // if the file doesn't fit into the above categories (generated artifacts, data files, etc.)
+)

syft/formats/common/spdxhelpers/homepage.go

@@ -0,0 +1,15 @@
+package spdxhelpers
+
+import "github.com/anchore/syft/syft/pkg"
+
+func Homepage(p pkg.Package) string {
+	if hasMetadata(p) {
+		switch metadata := p.Metadata.(type) {
+		case pkg.GemMetadata:
+			return metadata.Homepage
+		case pkg.NpmPackageJSONMetadata:
+			return metadata.Homepage
+		}
+	}
+	return ""
+}

syft/formats/common/spdxhelpers/homepage_test.go

@@ -0,0 +1,56 @@
+package spdxhelpers
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_Homepage(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected string
+	}{
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name:     "no metadata",
+			input:    pkg.Package{},
+			expected: "",
+		},
+		{
+			name: "from gem",
+			input: pkg.Package{
+				Metadata: pkg.GemMetadata{
+					Homepage: "http://a-place.gov",
+				},
+			},
+			expected: "http://a-place.gov",
+		},
+		{
+			name: "from npm",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					Homepage: "http://a-place.gov",
+				},
+			},
+			expected: "http://a-place.gov",
+		},
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name: "empty",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					Homepage: "",
+				},
+			},
+			expected: "",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, Homepage(test.input))
+		})
+	}
+}

syft/formats/common/spdxhelpers/license.go

@@ -0,0 +1,37 @@
+package spdxhelpers
+
+import (
+	"strings"
+
+	"github.com/anchore/syft/internal/spdxlicense"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func License(p pkg.Package) string {
+	// source: https://spdx.github.io/spdx-spec/3-package-information/#313-concluded-license
+	// The options to populate this field are limited to:
+	// A valid SPDX License Expression as defined in Appendix IV;
+	// NONE, if the SPDX file creator concludes there is no license available for this package; or
+	// NOASSERTION if:
+	//   (i) the SPDX file creator has attempted to but cannot reach a reasonable objective determination;
+	//   (ii) the SPDX file creator has made no attempt to determine this field; or
+	//   (iii) the SPDX file creator has intentionally provided no information (no meaning should be implied by doing so).
+
+	if len(p.Licenses) == 0 {
+		return NONE
+	}
+
+	// take all licenses and assume an AND expression; for information about license expressions see https://spdx.github.io/spdx-spec/appendix-IV-SPDX-license-expressions/
+	var parsedLicenses []string
+	for _, l := range p.Licenses {
+		if value, exists := spdxlicense.ID(l); exists {
+			parsedLicenses = append(parsedLicenses, value)
+		}
+	}
+
+	if len(parsedLicenses) == 0 {
+		return NOASSERTION
+	}
+
+	return strings.Join(parsedLicenses, " AND ")
+}

syft/formats/common/spdxhelpers/license_test.go

@@ -0,0 +1,73 @@
+package spdxhelpers
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_License(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected string
+	}{
+		{
+			name:     "no licenses",
+			input:    pkg.Package{},
+			expected: NONE,
+		},
+		{
+			name: "no SPDX licenses",
+			input: pkg.Package{
+				Licenses: []string{
+					"made-up",
+				},
+			},
+			expected: NOASSERTION,
+		},
+		{
+			name: "with SPDX license",
+			input: pkg.Package{
+				Licenses: []string{
+					"MIT",
+				},
+			},
+			expected: "MIT",
+		},
+		{
+			name: "with SPDX license expression",
+			input: pkg.Package{
+				Licenses: []string{
+					"MIT",
+					"GPL-3.0",
+				},
+			},
+			expected: "MIT AND GPL-3.0-only",
+		},
+		{
+			name: "cap insensitive",
+			input: pkg.Package{
+				Licenses: []string{
+					"gpl-3.0",
+				},
+			},
+			expected: "GPL-3.0-only",
+		},
+		{
+			name: "debian to spdx conversion",
+			input: pkg.Package{
+				Licenses: []string{
+					"GPL-2",
+				},
+			},
+			expected: "GPL-2.0-only",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, License(test.input))
+		})
+	}
+}

syft/formats/common/spdxhelpers/none_if_empty.go

@@ -0,0 +1,12 @@
+package spdxhelpers
+
+import (
+	"strings"
+)
+
+func NoneIfEmpty(value string) string {
+	if strings.TrimSpace(value) == "" {
+		return NONE
+	}
+	return value
+}

syft/formats/common/spdxhelpers/none_if_empty_test.go

@@ -0,0 +1,41 @@
+package spdxhelpers
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_noneIfEmpty(t *testing.T) {
+	tests := []struct {
+		name     string
+		value    string
+		expected string
+	}{
+		{
+			name:     "non-zero value",
+			value:    "something",
+			expected: "something",
+		},
+		{
+			name:     "empty",
+			value:    "",
+			expected: NONE,
+		},
+		{
+			name:     "space",
+			value:    " ",
+			expected: NONE,
+		},
+		{
+			name:     "tab",
+			value:    "\t",
+			expected: NONE,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, NoneIfEmpty(test.value))
+		})
+	}
+}

syft/formats/common/spdxhelpers/originator_test.go

@@ -0,0 +1,114 @@
+package spdxhelpers
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_Originator(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected string
+	}{
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name:     "no metadata",
+			input:    pkg.Package{},
+			expected: "",
+		},
+		{
+			name: "from gem",
+			input: pkg.Package{
+				Metadata: pkg.GemMetadata{
+					Authors: []string{
+						"auth1",
+						"auth2",
+					},
+				},
+			},
+			expected: "Person: auth1",
+		},
+		{
+			name: "from npm",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					Author: "auth",
+				},
+			},
+			expected: "Person: auth",
+		},
+		{
+			name: "from apk",
+			input: pkg.Package{
+				Metadata: pkg.ApkMetadata{
+					Maintainer: "auth",
+				},
+			},
+			expected: "Person: auth",
+		},
+		{
+			name: "from python - just name",
+			input: pkg.Package{
+				Metadata: pkg.PythonPackageMetadata{
+					Author: "auth",
+				},
+			},
+			expected: "Person: auth",
+		},
+		{
+			name: "from python - just email",
+			input: pkg.Package{
+				Metadata: pkg.PythonPackageMetadata{
+					AuthorEmail: "auth@auth.gov",
+				},
+			},
+			expected: "Person: auth@auth.gov",
+		},
+		{
+			name: "from python - both name and email",
+			input: pkg.Package{
+				Metadata: pkg.PythonPackageMetadata{
+					Author:      "auth",
+					AuthorEmail: "auth@auth.gov",
+				},
+			},
+			expected: "Person: auth (auth@auth.gov)",
+		},
+		{
+			name: "from rpm",
+			input: pkg.Package{
+				Metadata: pkg.RpmMetadata{
+					Vendor: "auth",
+				},
+			},
+			expected: "Organization: auth",
+		},
+		{
+			name: "from dpkg",
+			input: pkg.Package{
+				Metadata: pkg.DpkgMetadata{
+					Maintainer: "auth",
+				},
+			},
+			expected: "Person: auth",
+		},
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name: "empty",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					Author: "",
+				},
+			},
+			expected: "",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, Originator(test.input))
+		})
+	}
+}

syft/formats/common/spdxhelpers/origintor.go

@@ -0,0 +1,41 @@
+package spdxhelpers
+
+import (
+	"fmt"
+
+	"github.com/anchore/syft/syft/pkg"
+)
+
+// Originator needs to conform to the SPDX spec here:
+// https://spdx.github.io/spdx-spec/package-information/#76-package-originator-field
+// Available options are: <omit>, NOASSERTION, Person: <person>, Organization: <org>
+func Originator(p pkg.Package) string {
+	if hasMetadata(p) {
+		author := ""
+		switch metadata := p.Metadata.(type) {
+		case pkg.ApkMetadata:
+			author = metadata.Maintainer
+		case pkg.NpmPackageJSONMetadata:
+			author = metadata.Author
+		case pkg.PythonPackageMetadata:
+			author = metadata.Author
+			if author == "" {
+				author = metadata.AuthorEmail
+			} else if metadata.AuthorEmail != "" {
+				author = fmt.Sprintf("%s (%s)", author, metadata.AuthorEmail)
+			}
+		case pkg.GemMetadata:
+			if len(metadata.Authors) > 0 {
+				author = metadata.Authors[0]
+			}
+		case pkg.RpmMetadata:
+			return "Organization: " + metadata.Vendor
+		case pkg.DpkgMetadata:
+			author = metadata.Maintainer
+		}
+		if author != "" {
+			return "Person: " + author
+		}
+	}
+	return ""
+}

syft/formats/common/spdxhelpers/relationship_type.go

@@ -0,0 +1,173 @@
+package spdxhelpers
+
+// source: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/
+type RelationshipType string
+
+const (
+	// DescribedByRelationship is to be used when SPDXRef-A is described by SPDXREF-Document.
+	// Example: The package 'WildFly' is described by SPDX document WildFly.spdx.
+	DescribedByRelationship RelationshipType = "DESCRIBED_BY"
+
+	// ContainsRelationship is to be used when SPDXRef-A contains SPDXRef-B.
+	// Example: An ARCHIVE file bar.tgz contains a SOURCE file foo.c.
+	ContainsRelationship RelationshipType = "CONTAINS"
+
+	// ContainedByRelationship is to be used when SPDXRef-A is contained by SPDXRef-B.
+	// Example: A SOURCE file foo.c is contained by ARCHIVE file bar.tgz
+	ContainedByRelationship RelationshipType = "CONTAINED_BY"
+
+	// DependsOnRelationship is to be used when SPDXRef-A depends on SPDXRef-B.
+	// Example: Package A depends on the presence of package B in order to build and run
+	DependsOnRelationship RelationshipType = "DEPENDS_ON"
+
+	// DependencyOfRelationship is to be used when SPDXRef-A is dependency of SPDXRef-B.
+	// Example: A is explicitly stated as a dependency of B in a machine-readable file. Use when a package manager does not define scopes.
+	DependencyOfRelationship RelationshipType = "DEPENDENCY_OF"
+
+	// DependencyManifestOfRelationship is to be used when SPDXRef-A is a manifest file that lists a set of dependencies for SPDXRef-B.
+	// Example: A file package.json is the dependency manifest of a package foo. Note that only one manifest should be used to define the same dependency graph.
+	DependencyManifestOfRelationship RelationshipType = "DEPENDENCY_MANIFEST_OF"
+
+	// BuildDependencyOfRelationship is to be used when SPDXRef-A is a build dependency of SPDXRef-B.
+	// Example: A is in the compile scope of B in a Maven project.
+	BuildDependencyOfRelationship RelationshipType = "BUILD_DEPENDENCY_OF"
+
+	// DevDependencyOfRelationship is to be used when SPDXRef-A is a development dependency of SPDXRef-B.
+	// Example: A is in the devDependencies scope of B in a Maven project.
+	DevDependencyOfRelationship RelationshipType = "DEV_DEPENDENCY_OF"
+
+	// OptionalDependencyOfRelationship is to be used when SPDXRef-A is an optional dependency of SPDXRef-B.
+	// Example: Use when building the code will proceed even if a dependency cannot be found, fails to install, or is only installed on a specific platform. For example, A is in the optionalDependencies scope of npm project B.
+	OptionalDependencyOfRelationship RelationshipType = "OPTIONAL_DEPENDENCY_OF"
+
+	// ProvidedDependencyOfRelationship is to be used when SPDXRef-A is a to be provided dependency of SPDXRef-B.
+	// Example: A is in the provided scope of B in a Maven project, indicating that the project expects it to be provided, for instance, by the container or JDK.
+	ProvidedDependencyOfRelationship RelationshipType = "PROVIDED_DEPENDENCY_OF"
+
+	// TestDependencyOfRelationship is to be used when SPDXRef-A is a test dependency of SPDXRef-B.
+	// Example: A is in the test scope of B in a Maven project.
+	TestDependencyOfRelationship RelationshipType = "TEST_DEPENDENCY_OF"
+
+	// RuntimeDependencyOfRelationship is to be used when SPDXRef-A is a dependency required for the execution of SPDXRef-B.
+	// Example: A is in the runtime scope of B in a Maven project.
+	RuntimeDependencyOfRelationship RelationshipType = "RUNTIME_DEPENDENCY_OF"
+
+	// ExampleOfRelationship is to be used when SPDXRef-A is an example of SPDXRef-B.
+	// Example: The file or snippet that illustrates how to use an application or library.
+	ExampleOfRelationship RelationshipType = "EXAMPLE_OF"
+
+	// GeneratesRelationship is to be used when SPDXRef-A generates SPDXRef-B.
+	// Example: A SOURCE file makefile.mk generates a BINARY file a.out
+	GeneratesRelationship RelationshipType = "GENERATES"
+
+	// GeneratedFromRelationship is to be used when SPDXRef-A was generated from SPDXRef-B.
+	// Example: A BINARY file a.out has been generated from a SOURCE file makefile.mk. A BINARY file foolib.a is generated from a SOURCE file bar.c.
+	GeneratedFromRelationship RelationshipType = "GENERATED_FROM"
+
+	// AncestorOfRelationship is to be used when SPDXRef-A is an ancestor (same lineage but pre-dates) SPDXRef-B.
+	// Example: A SOURCE file makefile.mk is a version of the original ancestor SOURCE file 'makefile2.mk'
+	AncestorOfRelationship RelationshipType = "ANCESTOR_OF"
+
+	// DescendantOfRelationship is to be used when SPDXRef-A is a descendant of (same lineage but postdates) SPDXRef-B.
+	// Example: A SOURCE file makefile2.mk is a descendant of the original SOURCE file 'makefile.mk'
+	DescendantOfRelationship RelationshipType = "DESCENDANT_OF"
+
+	// VariantOfRelationship is to be used when SPDXRef-A is a variant of (same lineage but not clear which came first) SPDXRef-B.
+	// Example: A SOURCE file makefile2.mk is a variant of SOURCE file makefile.mk if they differ by some edit, but there is no way to tell which came first (no reliable date information).
+	VariantOfRelationship RelationshipType = "VARIANT_OF"
+
+	// DistributionArtifactRelationship is to be used when distributing SPDXRef-A requires that SPDXRef-B also be distributed.
+	// Example: A BINARY file foo.o requires that the ARCHIVE file bar-sources.tgz be made available on distribution.
+	DistributionArtifactRelationship RelationshipType = "DISTRIBUTION_ARTIFACT"
+
+	// PatchForRelationship is to be used when SPDXRef-A is a patch file for (to be applied to) SPDXRef-B.
+	// Example: A SOURCE file foo.diff is a patch file for SOURCE file foo.c.
+	PatchForRelationship RelationshipType = "PATCH_FOR"
+
+	// PatchAppliedRelationship is to be used when SPDXRef-A is a patch file that has been applied to SPDXRef-B.
+	// Example: A SOURCE file foo.diff is a patch file that has been applied to SOURCE file 'foo-patched.c'.
+	PatchAppliedRelationship RelationshipType = "PATCH_APPLIED"
+
+	// CopyOfRelationship is to be used when SPDXRef-A is an exact copy of SPDXRef-B.
+	// Example: A BINARY file alib.a is an exact copy of BINARY file a2lib.a.
+	CopyOfRelationship RelationshipType = "COPY_OF"
+
+	// FileAddedRelationship is to be used when SPDXRef-A is a file that was added to SPDXRef-B.
+	// Example: A SOURCE file foo.c has been added to package ARCHIVE bar.tgz.
+	FileAddedRelationship RelationshipType = "FILE_ADDED"
+
+	// FileDeletedRelationship is to be used when SPDXRef-A is a file that was deleted from SPDXRef-B.
+	// Example: A SOURCE file foo.diff has been deleted from package ARCHIVE bar.tgz.
+	FileDeletedRelationship RelationshipType = "FILE_DELETED"
+
+	// FileModifiedRelationship is to be used when SPDXRef-A is a file that was modified from SPDXRef-B.
+	// Example: A SOURCE file foo.c has been modified from SOURCE file foo.orig.c.
+	FileModifiedRelationship RelationshipType = "FILE_MODIFIED"
+
+	// ExpandedFromArchiveRelationship is to be used when SPDXRef-A is expanded from the archive SPDXRef-B.
+	// Example: A SOURCE file foo.c, has been expanded from the archive ARCHIVE file xyz.tgz.
+	ExpandedFromArchiveRelationship RelationshipType = "EXPANDED_FROM_ARCHIVE"
+
+	// DynamicLinkRelationship is to be used when SPDXRef-A dynamically links to SPDXRef-B.
+	// Example: An APPLICATION file 'myapp' dynamically links to BINARY file zlib.so.
+	DynamicLinkRelationship RelationshipType = "DYNAMIC_LINK"
+
+	// StaticLinkRelationship is to be used when SPDXRef-A statically links to SPDXRef-B.
+	// Example: An APPLICATION file 'myapp' statically links to BINARY zlib.a.
+	StaticLinkRelationship RelationshipType = "STATIC_LINK"
+
+	// DataFileOfRelationship is to be used when SPDXRef-A is a data file used in SPDXRef-B.
+	// Example: An IMAGE file 'kitty.jpg' is a data file of an APPLICATION 'hellokitty'.
+	DataFileOfRelationship RelationshipType = "DATA_FILE_OF"
+
+	// TestCaseOfRelationship is to be used when SPDXRef-A is a test case used in testing SPDXRef-B.
+	// Example: A SOURCE file testMyCode.java is a unit test file used to test an APPLICATION MyPackage.
+	TestCaseOfRelationship RelationshipType = "TEST_CASE_OF"
+
+	// BuildToolOfRelationship is to be used when SPDXRef-A is used to build SPDXRef-B.
+	// Example: A SOURCE file makefile.mk is used to build an APPLICATION 'zlib'.
+	BuildToolOfRelationship RelationshipType = "BUILD_TOOL_OF"
+
+	// DevToolOfRelationship is to be used when SPDXRef-A is used as a development tool for SPDXRef-B.
+	// Example: Any tool used for development such as a code debugger.
+	DevToolOfRelationship RelationshipType = "DEV_TOOL_OF"
+
+	// TestOfRelationship is to be used when SPDXRef-A is used for testing SPDXRef-B.
+	// Example: Generic relationship for cases where it's clear that something is used for testing but unclear whether it's TEST_CASE_OF or TEST_TOOL_OF.
+	TestOfRelationship RelationshipType = "TEST_OF"
+
+	// TestToolOfRelationship is to be used when SPDXRef-A is used as a test tool for SPDXRef-B.
+	// Example: Any tool used to test the code such as ESlint.
+	TestToolOfRelationship RelationshipType = "TEST_TOOL_OF"
+
+	// DocumentationOfRelationship is to be used when SPDXRef-A provides documentation of SPDXRef-B.
+	// Example: A DOCUMENTATION file readme.txt documents the APPLICATION 'zlib'.
+	DocumentationOfRelationship RelationshipType = "DOCUMENTATION_OF"
+
+	// OptionalComponentOfRelationship is to be used when SPDXRef-A is an optional component of SPDXRef-B.
+	// Example: A SOURCE file fool.c (which is in the contributors directory) may or may not be included in the build of APPLICATION 'atthebar'.
+	OptionalComponentOfRelationship RelationshipType = "OPTIONAL_COMPONENT_OF"
+
+	// MetafileOfRelationship is to be used when SPDXRef-A is a metafile of SPDXRef-B.
+	// Example: A SOURCE file pom.xml is a metafile of the APPLICATION 'Apache Xerces'.
+	MetafileOfRelationship RelationshipType = "METAFILE_OF"
+
+	// PackageOfRelationship is to be used when SPDXRef-A is used as a package as part of SPDXRef-B.
+	// Example: A Linux distribution contains an APPLICATION package gawk as part of the distribution MyLinuxDistro.
+	PackageOfRelationship RelationshipType = "PACKAGE_OF"
+
+	// AmendsRelationship is to be used when (current) SPDXRef-DOCUMENT amends the SPDX information in SPDXRef-B.
+	// Example: (Current) SPDX document A version 2 contains a correction to a previous version of the SPDX document A version 1. Note the reserved identifier SPDXRef-DOCUMENT for the current document is required.
+	AmendsRelationship RelationshipType = "AMENDS"
+
+	// PrerequisiteForRelationship is to be used when SPDXRef-A is a prerequisite for SPDXRef-B.
+	// Example: A library bar.dll is a prerequisite or dependency for APPLICATION foo.exe
+	PrerequisiteForRelationship RelationshipType = "PREREQUISITE_FOR"
+
+	// HasPrerequisiteRelationship is to be used when SPDXRef-A has as a prerequisite SPDXRef-B.
+	// Example: An APPLICATION foo.exe has prerequisite or dependency on bar.dll
+	HasPrerequisiteRelationship RelationshipType = "HAS_PREREQUISITE"
+
+	// OtherRelationship is to be used for a relationship which has not been defined in the formal SPDX specification. A description of the relationship should be included in the Relationship comments field.
+	OtherRelationship RelationshipType = "OTHER"
+)

syft/formats/common/spdxhelpers/source_info.go

@@ -0,0 +1,56 @@
+package spdxhelpers
+
+import (
+	"strings"
+
+	"github.com/anchore/syft/syft/pkg"
+)
+
+//nolint:funlen
+func SourceInfo(p pkg.Package) string {
+	answer := ""
+	switch p.Type {
+	case pkg.AlpmPkg:
+		answer = "acquired package info from ALPM DB"
+	case pkg.RpmPkg:
+		answer = "acquired package info from RPM DB"
+	case pkg.ApkPkg:
+		answer = "acquired package info from APK DB"
+	case pkg.DartPubPkg:
+		answer = "acquired package info from pubspec manifest"
+	case pkg.DebPkg:
+		answer = "acquired package info from DPKG DB"
+	case pkg.DotnetPkg:
+		answer = "acquired package info from dotnet project assets file"
+	case pkg.NpmPkg:
+		answer = "acquired package info from installed node module manifest file"
+	case pkg.PythonPkg:
+		answer = "acquired package info from installed python package manifest file"
+	case pkg.JavaPkg, pkg.JenkinsPluginPkg:
+		answer = "acquired package info from installed java archive"
+	case pkg.GemPkg:
+		answer = "acquired package info from installed gem metadata file"
+	case pkg.GoModulePkg:
+		answer = "acquired package info from go module information"
+	case pkg.RustPkg:
+		answer = "acquired package info from rust cargo manifest"
+	case pkg.PhpComposerPkg:
+		answer = "acquired package info from PHP composer manifest"
+	case pkg.CocoapodsPkg:
+		answer = "acquired package info from installed cocoapods manifest file"
+	case pkg.ConanPkg:
+		answer = "acquired package info from conan manifest"
+	case pkg.PortagePkg:
+		answer = "acquired package info from portage DB"
+	case pkg.HackagePkg:
+		answer = "acquired package info from cabal or stack manifest files"
+	default:
+		answer = "acquired package info from the following paths"
+	}
+	var paths []string
+	for _, l := range p.Locations.ToSlice() {
+		paths = append(paths, l.RealPath)
+	}
+
+	return answer + ": " + strings.Join(paths, ", ")
+}

syft/formats/common/spdxhelpers/source_info_test.go

@@ -0,0 +1,199 @@
+package spdxhelpers
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_SourceInfo(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected []string
+	}{
+		{
+			name: "locations are captured",
+			input: pkg.Package{
+				// note: no type given
+				Locations: source.NewLocationSet(
+					source.NewVirtualLocation("/a-place", "/b-place"),
+					source.NewVirtualLocation("/c-place", "/d-place"),
+				),
+			},
+			expected: []string{
+				"from the following paths",
+				"/a-place",
+				"/c-place",
+			},
+		},
+		{
+			// note: no specific support for this
+			input: pkg.Package{
+				Type: pkg.KbPkg,
+			},
+			expected: []string{
+				"from the following paths",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.RpmPkg,
+			},
+			expected: []string{
+				"from RPM DB",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.ApkPkg,
+			},
+			expected: []string{
+				"from APK DB",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.DebPkg,
+			},
+			expected: []string{
+				"from DPKG DB",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.NpmPkg,
+			},
+			expected: []string{
+				"from installed node module manifest file",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.PythonPkg,
+			},
+			expected: []string{
+				"from installed python package manifest file",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.JavaPkg,
+			},
+			expected: []string{
+				"from installed java archive",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.JenkinsPluginPkg,
+			},
+			expected: []string{
+				"from installed java archive",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.GemPkg,
+			},
+			expected: []string{
+				"from installed gem metadata file",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.GoModulePkg,
+			},
+			expected: []string{
+				"from go module information",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.RustPkg,
+			},
+			expected: []string{
+				"from rust cargo manifest",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.PhpComposerPkg,
+			},
+			expected: []string{
+				"from PHP composer manifest",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.DartPubPkg,
+			},
+			expected: []string{
+				"from pubspec manifest",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.DotnetPkg,
+			},
+			expected: []string{
+				"from dotnet project assets file",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.AlpmPkg,
+			},
+			expected: []string{
+				"from ALPM DB",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.CocoapodsPkg,
+			},
+			expected: []string{
+				"installed cocoapods manifest file",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.ConanPkg,
+			},
+			expected: []string{
+				"from conan manifest",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.PortagePkg,
+			},
+			expected: []string{
+				"from portage DB",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.HackagePkg,
+			},
+			expected: []string{
+				"from cabal or stack manifest files",
+			},
+		},
+	}
+	var pkgTypes []pkg.Type
+	for _, test := range tests {
+		t.Run(test.name+" "+string(test.input.Type), func(t *testing.T) {
+			if test.input.Type != "" {
+				pkgTypes = append(pkgTypes, test.input.Type)
+			}
+			actual := SourceInfo(test.input)
+			for _, expected := range test.expected {
+				assert.Contains(t, actual, expected)
+			}
+		})
+	}
+	assert.ElementsMatch(t, pkg.AllPkgs, pkgTypes, "missing one or more package types to test against (maybe a package type was added?)")
+}

syft/formats/common/spdxhelpers/spdxid.go

@@ -0,0 +1,13 @@
+package spdxhelpers
+
+import (
+	"regexp"
+)
+
+var expr = regexp.MustCompile("[^a-zA-Z0-9.-]")
+
+// SPDX spec says SPDXID must be:
+// "SPDXRef-"[idstring] where [idstring] is a unique string containing letters, numbers, ., and/or -
+func SanitizeElementID(id string) string {
+	return expr.ReplaceAllString(id, "-")
+}

syft/formats/common/spdxhelpers/spdxid_test.go

@@ -0,0 +1,39 @@
+package spdxhelpers
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_SanitizeElementID(t *testing.T) {
+	tests := []struct {
+		input    string
+		expected string
+	}{
+		{
+			input:    "letters",
+			expected: "letters",
+		},
+		{
+			input:    "ssl-client",
+			expected: "ssl-client",
+		},
+		{
+			input:    "ssl_client",
+			expected: "ssl-client",
+		},
+		{
+			input:    "go-module-sigs.k8s.io/structured-merge-diff/v3",
+			expected: "go-module-sigs.k8s.io-structured-merge-diff-v3",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.input, func(t *testing.T) {
+			actual := SanitizeElementID(test.input)
+
+			assert.Equal(t, test.expected, actual)
+		})
+	}
+}

syft/formats/common/spdxhelpers/to_syft_model.go

@@ -0,0 +1,387 @@
+package spdxhelpers
+
+import (
+	"errors"
+	"net/url"
+	"strconv"
+	"strings"
+
+	"github.com/spdx/tools-golang/spdx"
+
+	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/linux"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/anchore/syft/syft/source"
+)
+
+func ToSyftModel(doc *spdx.Document2_2) (*sbom.SBOM, error) {
+	if doc == nil {
+		return nil, errors.New("cannot convert SPDX document to Syft model because document is nil")
+	}
+
+	spdxIDMap := make(map[string]interface{})
+
+	src := source.Metadata{Scheme: source.UnknownScheme}
+	if doc.CreationInfo != nil {
+		src.Scheme = extractSchemeFromNamespace(doc.CreationInfo.DocumentNamespace)
+	}
+
+	s := &sbom.SBOM{
+		Source: src,
+		Artifacts: sbom.Artifacts{
+			PackageCatalog:    pkg.NewCatalog(),
+			FileMetadata:      map[source.Coordinates]source.FileMetadata{},
+			FileDigests:       map[source.Coordinates][]file.Digest{},
+			LinuxDistribution: findLinuxReleaseByPURL(doc),
+		},
+	}
+
+	collectSyftPackages(s, spdxIDMap, doc)
+
+	collectSyftFiles(s, spdxIDMap, doc)
+
+	s.Relationships = toSyftRelationships(spdxIDMap, doc)
+
+	return s, nil
+}
+
+// NOTE(jonas): SPDX doesn't inform what an SBOM is about,
+// image, directory, for example. This is our best effort to determine
+// the scheme. Syft-generated SBOMs have in the namespace
+// field a type encoded, which we try to identify here.
+func extractSchemeFromNamespace(ns string) source.Scheme {
+	u, err := url.Parse(ns)
+	if err != nil {
+		return source.UnknownScheme
+	}
+
+	parts := strings.Split(u.Path, "/")
+	for _, p := range parts {
+		switch p {
+		case "file":
+			return source.FileScheme
+		case "image":
+			return source.ImageScheme
+		case "dir":
+			return source.DirectoryScheme
+		}
+	}
+	return source.UnknownScheme
+}
+
+func findLinuxReleaseByPURL(doc *spdx.Document2_2) *linux.Release {
+	for _, p := range doc.Packages {
+		purlValue := findPURLValue(p)
+		if purlValue == "" {
+			continue
+		}
+		purl, err := packageurl.FromString(purlValue)
+		if err != nil {
+			log.Warnf("unable to parse purl: %s", purlValue)
+			continue
+		}
+		distro := findQualifierValue(purl, pkg.PURLQualifierDistro)
+		if distro != "" {
+			parts := strings.Split(distro, "-")
+			name := parts[0]
+			version := ""
+			if len(parts) > 1 {
+				version = parts[1]
+			}
+			return &linux.Release{
+				PrettyName: name,
+				Name:       name,
+				ID:         name,
+				IDLike:     []string{name},
+				Version:    version,
+				VersionID:  version,
+			}
+		}
+	}
+
+	return nil
+}
+
+func collectSyftPackages(s *sbom.SBOM, spdxIDMap map[string]interface{}, doc *spdx.Document2_2) {
+	for _, p := range doc.Packages {
+		syftPkg := toSyftPackage(p)
+		spdxIDMap[string(p.PackageSPDXIdentifier)] = syftPkg
+		s.Artifacts.PackageCatalog.Add(*syftPkg)
+	}
+}
+
+func collectSyftFiles(s *sbom.SBOM, spdxIDMap map[string]interface{}, doc *spdx.Document2_2) {
+	for _, f := range doc.UnpackagedFiles {
+		l := toSyftLocation(f)
+		spdxIDMap[string(f.FileSPDXIdentifier)] = l
+
+		s.Artifacts.FileMetadata[l.Coordinates] = toFileMetadata(f)
+		s.Artifacts.FileDigests[l.Coordinates] = toFileDigests(f)
+	}
+}
+
+func toFileDigests(f *spdx.File2_2) (digests []file.Digest) {
+	for _, digest := range f.FileChecksums {
+		digests = append(digests, file.Digest{
+			Algorithm: string(digest.Algorithm),
+			Value:     digest.Value,
+		})
+	}
+	return digests
+}
+
+func toFileMetadata(f *spdx.File2_2) (meta source.FileMetadata) {
+	// FIXME Syft is currently lossy due to the SPDX 2.2.1 spec not supporting arbitrary mimetypes
+	for _, typ := range f.FileType {
+		switch FileType(typ) {
+		case ImageFileType:
+			meta.MIMEType = "image/"
+		case VideoFileType:
+			meta.MIMEType = "video/"
+		case ApplicationFileType:
+			meta.MIMEType = "application/"
+		case TextFileType:
+			meta.MIMEType = "text/"
+		case AudioFileType:
+			meta.MIMEType = "audio/"
+		case BinaryFileType:
+		case ArchiveFileType:
+		case OtherFileType:
+		}
+	}
+	return meta
+}
+
+func toSyftRelationships(spdxIDMap map[string]interface{}, doc *spdx.Document2_2) []artifact.Relationship {
+	var out []artifact.Relationship
+	for _, r := range doc.Relationships {
+		// FIXME what to do with r.RefA.DocumentRefID and  r.RefA.SpecialID
+		if r.RefA.DocumentRefID != "" && requireAndTrimPrefix(r.RefA.DocumentRefID, "DocumentRef-") != string(doc.CreationInfo.SPDXIdentifier) {
+			log.Debugf("ignoring relationship to external document: %+v", r)
+			continue
+		}
+		a := spdxIDMap[string(r.RefA.ElementRefID)]
+		b := spdxIDMap[string(r.RefB.ElementRefID)]
+		from, fromOk := a.(*pkg.Package)
+		toPackage, toPackageOk := b.(*pkg.Package)
+		toLocation, toLocationOk := b.(*source.Location)
+		if !fromOk || !(toPackageOk || toLocationOk) {
+			log.Debugf("unable to find valid relationship mapping from SPDX 2.2 JSON, ignoring: (from: %+v) (to: %+v)", a, b)
+			continue
+		}
+		var to artifact.Identifiable
+		var typ artifact.RelationshipType
+		if toLocationOk {
+			if r.Relationship == string(ContainsRelationship) {
+				typ = artifact.ContainsRelationship
+				to = toLocation
+			}
+		} else {
+			switch RelationshipType(r.Relationship) {
+			case ContainsRelationship:
+				typ = artifact.ContainsRelationship
+				to = toPackage
+			case BuildDependencyOfRelationship:
+				typ = artifact.BuildDependencyOfRelationship
+				to = toPackage
+			case RuntimeDependencyOfRelationship:
+				typ = artifact.RuntimeDependencyOfRelationship
+				to = toPackage
+			case OtherRelationship:
+				// Encoding uses a specifically formatted comment...
+				if strings.Index(r.RelationshipComment, string(artifact.OwnershipByFileOverlapRelationship)) == 0 {
+					typ = artifact.RuntimeDependencyOfRelationship
+					to = toPackage
+				}
+			}
+		}
+		if typ != "" && to != nil {
+			out = append(out, artifact.Relationship{
+				From: from,
+				To:   to,
+				Type: typ,
+			})
+		}
+	}
+	return out
+}
+
+func toSyftCoordinates(f *spdx.File2_2) source.Coordinates {
+	const layerIDPrefix = "layerID: "
+	var fileSystemID string
+	if strings.Index(f.FileComment, layerIDPrefix) == 0 {
+		fileSystemID = strings.TrimPrefix(f.FileComment, layerIDPrefix)
+	}
+	if strings.Index(string(f.FileSPDXIdentifier), layerIDPrefix) == 0 {
+		fileSystemID = strings.TrimPrefix(string(f.FileSPDXIdentifier), layerIDPrefix)
+	}
+	return source.Coordinates{
+		RealPath:     f.FileName,
+		FileSystemID: fileSystemID,
+	}
+}
+
+func toSyftLocation(f *spdx.File2_2) *source.Location {
+	return &source.Location{
+		Coordinates: toSyftCoordinates(f),
+		VirtualPath: f.FileName,
+	}
+}
+
+func requireAndTrimPrefix(val interface{}, prefix string) string {
+	if v, ok := val.(string); ok {
+		if i := strings.Index(v, prefix); i == 0 {
+			return strings.Replace(v, prefix, "", 1)
+		}
+	}
+	return ""
+}
+
+type pkgInfo struct {
+	purl packageurl.PackageURL
+	typ  pkg.Type
+	lang pkg.Language
+}
+
+func (p *pkgInfo) qualifierValue(name string) string {
+	return findQualifierValue(p.purl, name)
+}
+
+func findQualifierValue(purl packageurl.PackageURL, qualifier string) string {
+	for _, q := range purl.Qualifiers {
+		if q.Key == qualifier {
+			return q.Value
+		}
+	}
+	return ""
+}
+
+func extractPkgInfo(p *spdx.Package2_2) pkgInfo {
+	pu := findPURLValue(p)
+	purl, err := packageurl.FromString(pu)
+	if err != nil {
+		return pkgInfo{}
+	}
+	return pkgInfo{
+		purl,
+		pkg.TypeByName(purl.Type),
+		pkg.LanguageByName(purl.Type),
+	}
+}
+
+func toSyftPackage(p *spdx.Package2_2) *pkg.Package {
+	info := extractPkgInfo(p)
+	metadataType, metadata := extractMetadata(p, info)
+	sP := pkg.Package{
+		Type:         info.typ,
+		Name:         p.PackageName,
+		Version:      p.PackageVersion,
+		Licenses:     parseLicense(p.PackageLicenseDeclared),
+		CPEs:         extractCPEs(p),
+		PURL:         info.purl.String(),
+		Language:     info.lang,
+		MetadataType: metadataType,
+		Metadata:     metadata,
+	}
+
+	sP.SetID()
+
+	return &sP
+}
+
+func extractMetadata(p *spdx.Package2_2, info pkgInfo) (pkg.MetadataType, interface{}) {
+	arch := info.qualifierValue(pkg.PURLQualifierArch)
+	upstreamValue := info.qualifierValue(pkg.PURLQualifierUpstream)
+	upstream := strings.SplitN(upstreamValue, "@", 2)
+	upstreamName := upstream[0]
+	upstreamVersion := ""
+	if len(upstream) > 1 {
+		upstreamVersion = upstream[1]
+	}
+	switch info.typ {
+	case pkg.ApkPkg:
+		return pkg.ApkMetadataType, pkg.ApkMetadata{
+			Package:       p.PackageName,
+			OriginPackage: upstreamName,
+			Maintainer:    p.PackageSupplierPerson,
+			Version:       p.PackageVersion,
+			License:       p.PackageLicenseDeclared,
+			Architecture:  arch,
+			URL:           p.PackageHomePage,
+			Description:   p.PackageDescription,
+		}
+	case pkg.RpmPkg:
+		converted, err := strconv.Atoi(info.qualifierValue(pkg.PURLQualifierEpoch))
+		var epoch *int
+		if err != nil {
+			epoch = nil
+		} else {
+			epoch = &converted
+		}
+		license := p.PackageLicenseDeclared
+		if license == "" {
+			license = p.PackageLicenseConcluded
+		}
+		return pkg.RpmMetadataType, pkg.RpmMetadata{
+			Name:      p.PackageName,
+			Version:   p.PackageVersion,
+			Epoch:     epoch,
+			Arch:      arch,
+			SourceRpm: upstreamValue,
+			License:   license,
+			Vendor:    p.PackageOriginatorOrganization,
+		}
+	case pkg.DebPkg:
+		return pkg.DpkgMetadataType, pkg.DpkgMetadata{
+			Package:       p.PackageName,
+			Source:        upstreamName,
+			Version:       p.PackageVersion,
+			SourceVersion: upstreamVersion,
+			Architecture:  arch,
+			Maintainer:    p.PackageOriginatorPerson,
+		}
+	case pkg.JavaPkg:
+		var digests []file.Digest
+		for algorithm, value := range p.PackageChecksums {
+			digests = append(digests, file.Digest{Algorithm: string(algorithm), Value: value.Value})
+		}
+		return pkg.JavaMetadataType, pkg.JavaMetadata{
+			ArchiveDigests: digests,
+		}
+	}
+	return pkg.UnknownMetadataType, nil
+}
+
+func findPURLValue(p *spdx.Package2_2) string {
+	for _, r := range p.PackageExternalReferences {
+		if r.RefType == string(PurlExternalRefType) {
+			return r.Locator
+		}
+	}
+	return ""
+}
+
+func extractCPEs(p *spdx.Package2_2) (cpes []pkg.CPE) {
+	for _, r := range p.PackageExternalReferences {
+		if r.RefType == string(Cpe23ExternalRefType) {
+			cpe, err := pkg.NewCPE(r.Locator)
+			if err != nil {
+				log.Warnf("unable to extract SPDX CPE=%q: %+v", r.Locator, err)
+				continue
+			}
+			cpes = append(cpes, cpe)
+		}
+	}
+	return cpes
+}
+
+func parseLicense(l string) []string {
+	if l == NOASSERTION || l == NONE {
+		return nil
+	}
+	return strings.Split(l, " AND ")
+}

syft/formats/common/spdxhelpers/to_syft_model_test.go

@@ -0,0 +1,235 @@
+package spdxhelpers
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+	"github.com/spdx/tools-golang/spdx"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestToSyftModel(t *testing.T) {
+	sbom, err := ToSyftModel(&spdx.Document2_2{
+		CreationInfo: &spdx.CreationInfo2_2{
+			SPDXVersion:                "1",
+			DataLicense:                "GPL",
+			SPDXIdentifier:             "id-doc-1",
+			DocumentName:               "docName",
+			DocumentNamespace:          "docNamespace",
+			ExternalDocumentReferences: nil,
+			LicenseListVersion:         "",
+			CreatorPersons:             nil,
+			CreatorOrganizations:       nil,
+			CreatorTools:               nil,
+			Created:                    "",
+			CreatorComment:             "",
+			DocumentComment:            "",
+		},
+		Packages: map[spdx.ElementID]*spdx.Package2_2{
+			"id-pkg-1": {
+				PackageName:                 "pkg-1",
+				PackageSPDXIdentifier:       "id-pkg-1",
+				PackageVersion:              "5.4.3",
+				PackageSupplierPerson:       "",
+				PackageSupplierOrganization: "",
+				PackageLicenseDeclared:      "",
+				PackageDescription:          "",
+				PackageExternalReferences: []*spdx.PackageExternalReference2_2{
+					{
+						Category: "SECURITY",
+						Locator:  "cpe:2.3:a:pkg-1:pkg-1:5.4.3:*:*:*:*:*:*:*",
+						RefType:  "cpe23Type",
+					},
+					{
+						Category: "SECURITY",
+						Locator:  "cpe:2.3:a:pkg_1:pkg_1:5.4.3:*:*:*:*:*:*:*",
+						RefType:  "cpe23Type",
+					},
+					{
+						Category: "PACKAGE_MANAGER",
+						Locator:  "pkg:alpine/pkg-1@5.4.3?arch=x86_64&upstream=p1-origin&distro=alpine-3.10.9",
+						RefType:  "purl",
+					},
+				},
+				Files: nil,
+			},
+			"id-pkg-2": {
+				PackageName:                 "pkg-2",
+				PackageSPDXIdentifier:       "id-pkg-2",
+				PackageVersion:              "7.3.1",
+				PackageSupplierPerson:       "",
+				PackageSupplierOrganization: "",
+				PackageLicenseDeclared:      "",
+				PackageDescription:          "",
+				PackageExternalReferences: []*spdx.PackageExternalReference2_2{
+					{
+						Category: "SECURITY",
+						Locator:  "cpe:2.3:a:pkg-2:pkg-2:7.3.1:*:*:*:*:*:*:*",
+						RefType:  "cpe23Type",
+					},
+					{
+						Category: "SECURITY",
+						Locator:  "cpe:2.3:a:pkg_2:pkg_2:7.3.1:*:*:*:*:*:*:*",
+						RefType:  "cpe23Type",
+					},
+					{
+						Category: "SECURITY",
+						Locator:  "cpe:2.3:a:pkg-2:pkg_2:7.3.1:*:*:*:*:*:*:*",
+						RefType:  "cpe23Type",
+					},
+					{
+						Category: "PACKAGE_MANAGER",
+						Locator:  "pkg:deb/pkg-2@7.3.1?arch=x86_64&upstream=p2-origin@9.1.3&distro=debian-3.10.9",
+						RefType:  "purl",
+					},
+				},
+				Files: nil,
+			},
+		},
+		UnpackagedFiles: map[spdx.ElementID]*spdx.File2_2{},
+		Relationships:   []*spdx.Relationship2_2{},
+	})
+
+	assert.NoError(t, err)
+
+	assert.NotNil(t, sbom)
+
+	pkgs := sbom.Artifacts.PackageCatalog.Sorted()
+
+	assert.Len(t, pkgs, 2)
+
+	p1 := pkgs[0]
+	assert.Equal(t, p1.Name, "pkg-1")
+	assert.Equal(t, p1.MetadataType, pkg.ApkMetadataType)
+	p1meta := p1.Metadata.(pkg.ApkMetadata)
+	assert.Equal(t, p1meta.OriginPackage, "p1-origin")
+	assert.Len(t, p1.CPEs, 2)
+
+	p2 := pkgs[1]
+	assert.Equal(t, p2.Name, "pkg-2")
+	assert.Equal(t, p2.MetadataType, pkg.DpkgMetadataType)
+	p2meta := p2.Metadata.(pkg.DpkgMetadata)
+	assert.Equal(t, p2meta.Source, "p2-origin")
+	assert.Equal(t, p2meta.SourceVersion, "9.1.3")
+	assert.Len(t, p2.CPEs, 3)
+}
+
+func Test_extractMetadata(t *testing.T) {
+	oneTwoThreeFour := 1234
+	tests := []struct {
+		pkg      spdx.Package2_2
+		metaType pkg.MetadataType
+		meta     interface{}
+	}{
+		{
+			pkg: spdx.Package2_2{
+				PackageName:    "SomeDebPkg",
+				PackageVersion: "43.1.235",
+				PackageExternalReferences: []*spdx.PackageExternalReference2_2{
+					{
+						Category: "PACKAGE_MANAGER",
+						Locator:  "pkg:deb/pkg-2@7.3.1?arch=x86_64&upstream=somedebpkg-origin@9.1.3&distro=debian-3.10.9",
+						RefType:  "purl",
+					},
+				},
+			},
+			metaType: pkg.DpkgMetadataType,
+			meta: pkg.DpkgMetadata{
+				Package:       "SomeDebPkg",
+				Source:        "somedebpkg-origin",
+				Version:       "43.1.235",
+				SourceVersion: "9.1.3",
+				Architecture:  "x86_64",
+			},
+		},
+		{
+			pkg: spdx.Package2_2{
+				PackageName:    "SomeApkPkg",
+				PackageVersion: "3.2.9",
+				PackageExternalReferences: []*spdx.PackageExternalReference2_2{
+					{
+						Category: "PACKAGE_MANAGER",
+						Locator:  "pkg:alpine/pkg-2@7.3.1?arch=x86_64&upstream=apk-origin@9.1.3&distro=alpine-3.10.9",
+						RefType:  "purl",
+					},
+				},
+			},
+			metaType: pkg.ApkMetadataType,
+			meta: pkg.ApkMetadata{
+				Package:       "SomeApkPkg",
+				OriginPackage: "apk-origin",
+				Version:       "3.2.9",
+				Architecture:  "x86_64",
+			},
+		},
+		{
+			pkg: spdx.Package2_2{
+				PackageName:    "SomeRpmPkg",
+				PackageVersion: "13.2.79",
+				PackageExternalReferences: []*spdx.PackageExternalReference2_2{
+					{
+						Category: "PACKAGE_MANAGER",
+						Locator:  "pkg:rpm/pkg-2@7.3.1?arch=x86_64&epoch=1234&upstream=some-rpm-origin-1.16.3&distro=alpine-3.10.9",
+						RefType:  "purl",
+					},
+				},
+			},
+			metaType: pkg.RpmMetadataType,
+			meta: pkg.RpmMetadata{
+				Name:      "SomeRpmPkg",
+				Version:   "13.2.79",
+				Epoch:     &oneTwoThreeFour,
+				Arch:      "x86_64",
+				Release:   "",
+				SourceRpm: "some-rpm-origin-1.16.3",
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.pkg.PackageName, func(t *testing.T) {
+			info := extractPkgInfo(&test.pkg)
+			metaType, meta := extractMetadata(&test.pkg, info)
+			assert.Equal(t, test.metaType, metaType)
+			assert.EqualValues(t, test.meta, meta)
+		})
+	}
+}
+
+func TestExtractSourceFromNamespaces(t *testing.T) {
+	tests := []struct {
+		namespace string
+		expected  source.Scheme
+	}{
+		{
+			namespace: "https://anchore.com/syft/file/d42b01d0-7325-409b-b03f-74082935c4d3",
+			expected:  source.FileScheme,
+		},
+		{
+			namespace: "https://anchore.com/syft/image/d42b01d0-7325-409b-b03f-74082935c4d3",
+			expected:  source.ImageScheme,
+		},
+		{
+			namespace: "https://anchore.com/syft/dir/d42b01d0-7325-409b-b03f-74082935c4d3",
+			expected:  source.DirectoryScheme,
+		},
+		{
+			namespace: "https://another-host/blob/123",
+			expected:  source.UnknownScheme,
+		},
+		{
+			namespace: "bla bla",
+			expected:  source.UnknownScheme,
+		},
+		{
+			namespace: "",
+			expected:  source.UnknownScheme,
+		},
+	}
+
+	for _, tt := range tests {
+		require.Equal(t, tt.expected, extractSchemeFromNamespace(tt.namespace))
+	}
+}