oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-11 21:57:22 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: SPDX 3 (#4269)

Browse Source 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
This commit is contained in:
Keith Zantow
2026-06-22 10:59:34 -04:00
committed by GitHub
parent 0e8d6deabe
commit 9c321691d4
23 changed files with 2063 additions and 100 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/cli/all_formats_convertible_test.go
+1
View File
@@ -29,6 +29,7 @@ func TestAllFormatsConvertable(t *testing.T) {
{to: "spdx-json", from: "cyclonedx-json"},
{to: "cyclonedx-json", from: "syft-json"},
{to: "cyclonedx-json", from: "spdx-json"},
{to: "spdx-json@3", from: "spdx-tag-value@2.1"},
}
for _, test := range tests {
test/cli/all_formats_expressible_test.go
+4
View File
@@ -65,6 +65,10 @@ func Test_formatVersionsExpressible(t *testing.T) {
format: "spdx-json@2.3",
assertion: assertInOutput(`"spdxVersion":"SPDX-2.3"`),
},
{
format: "spdx-json@3.0",
assertion: assertInOutput(`https://spdx.org/rdf/3.0`),
},
}
for _, test := range tests {
test/cli/convert_cmd_test.go
+1
View File
@@ -28,6 +28,7 @@ func TestConvertCmd(t *testing.T) {
}{
{from: "syft-json", to: "spdx-tag-value", expect: mustEncoder(spdxtagvalue.NewFormatEncoderWithConfig(spdxtagvalue.DefaultEncoderConfig()))},
{from: "syft-json", to: "spdx-json", expect: mustEncoder(spdxjson.NewFormatEncoderWithConfig(spdxjson.DefaultEncoderConfig()))},
{from: "syft-json", to: "spdx-json@3.0", expect: mustEncoder(spdxjson.NewFormatEncoderWithConfig(spdxjson.DefaultEncoderConfig()))},
{from: "syft-json", to: "cyclonedx-json", expect: mustEncoder(cyclonedxjson.NewFormatEncoderWithConfig(cyclonedxjson.DefaultEncoderConfig()))},
{from: "syft-json", to: "cyclonedx-xml", expect: mustEncoder(cyclonedxxml.NewFormatEncoderWithConfig(cyclonedxxml.DefaultEncoderConfig()))},
}
test/cli/spdx_json_schema_test.go
+1 -1
View File
@@ -31,7 +31,7 @@ func TestSPDXJSONSchema(t *testing.T) {
{
name: "scan:image:docker-archive:pkg-coverage",
subcommand: "scan",
args: []string{"-o", "spdx-json"},
args: []string{"-o", "spdx-json@2.3"},
fixture: imageFixture,
},
{
test/cli/spdx_tooling_validation_test.go
+40 -45
View File
@@ -2,23 +2,20 @@ package cli
import (
"fmt"
"os"
"os/exec"
"path"
"path/filepath"
"strings"
"testing"
"github.com/stretchr/testify/require"
)
"github.com/anchore/stereoscope/pkg/imagetest"
const (
validatorV2 = "ghcr.io/spdx/tools-java/tools-java:v1.1.8@sha256:c3b9e848083132e03b30302576b9b51adffd454f43c786f1708cc37c0861a2aa"
validatorV3 = "ghcr.io/spdx/tools-java/tools-java:v2.0.4@sha256:15062f85b4be9688c7bf42df34ad6b84e084ed46e262e1f2dc1603795de9f7b4"
)
func TestSpdxValidationTooling(t *testing.T) {
// note: the external tooling requires that the daemon explicitly has the image loaded, not just that
// we can get the image from a cache tar.
imgTag := imagetest.LoadFixtureImageIntoDocker(t, "image-java-spdx-tools")
images := []string{
"alpine:3.17.3@sha256:b6ca290b6b4cdcca5b3db3ffa338ee0285c11744b4a6abaa9627746ee3291d8d",
"photon:3.0@sha256:888675e193418d924feea262cf639c46532b63c2027a39fd3ac75383b3c1130e",
@@ -32,43 +29,44 @@ func TestSpdxValidationTooling(t *testing.T) {
}
tests := []struct {
name string
syftArgs []string
images []string
setup func(t *testing.T)
env map[string]string
name string
format string
validator string
}{
{
name: "spdx validation tooling tag value",
syftArgs: []string{"scan", "-o", "spdx"},
images: images,
env: env,
name: "spdx 2.3 validation tooling tag value",
format: "spdx",
},
{
name: "spdx validation tooling json",
syftArgs: []string{"scan", "-o", "spdx-json"},
images: images,
env: env,
name: "spdx 2.3 validation tooling json",
format: "spdx-json",
},
{
name: "spdx validation tooling tag value",
syftArgs: []string{"scan", "-o", "spdx@2.2"},
images: images,
env: env,
name: "spdx 3.0 validation tooling json",
format: "spdx-json@3.0",
validator: validatorV3,
},
{
name: "spdx validation tooling json",
syftArgs: []string{"scan", "-o", "spdx-json@2.2"},
images: images,
env: env,
name: "spdx 2.2 validation tooling tag value",
format: "spdx@2.2",
},
{
name: "spdx 2.2 validation tooling json",
format: "spdx-json@2.2",
},
}
for _, test := range tests {
for _, image := range test.images {
t.Run(test.name+"_"+image, func(t *testing.T) {
for _, image := range images {
syftJsonFile := filepath.Join(t.TempDir(), "sbom.syft.json")
args := append(test.syftArgs, image)
cmd, _, stderr := runSyft(t, env, "-o", "syft-json", "--file", syftJsonFile, image)
if cmd.ProcessState.ExitCode() != 0 {
t.Fatalf("failed to run syft: %s", stderr)
}
for _, test := range tests {
t.Run(test.name+"_"+image, func(t *testing.T) {
t.Parallel()
var suffix string
if strings.Contains(test.name, "json") {
@@ -78,30 +76,27 @@ func TestSpdxValidationTooling(t *testing.T) {
}
dir := t.TempDir()
sbomPath := filepath.Join(dir, fmt.Sprintf("sbom%s", suffix))
sbomFile := fmt.Sprintf("sbom%s", suffix)
sbomPath := filepath.Join(dir, sbomFile)
args = append(args, "--file", sbomPath)
cmd, _, stderr := runSyft(t, test.env, args...)
cmd, _, stderr = runSyft(t, nil, "convert", syftJsonFile, "-o", test.format, "--file", sbomPath)
if cmd.ProcessState.ExitCode() != 0 {
t.Fatalf("failed to run syft: %s", stderr)
t.Fatalf("failed to run syft convert: %s", stderr)
}
cwd, err := os.Getwd()
require.NoError(t, err)
if test.validator == "" {
test.validator = validatorV2
}
// validate against spdx java tooling
fileArg := fmt.Sprintf("DIR=%s", dir)
mountArg := fmt.Sprintf("BASE=%s", path.Base(sbomPath))
imageArg := fmt.Sprintf("IMAGE=%s", imgTag)
validateCmd := exec.Command("make", "validate", fileArg, mountArg, imageArg)
validateCmd.Dir = filepath.Join(cwd, "testdata", "image-java-spdx-tools")
validateCmd := exec.Command("docker", "run", "--rm", "-i", "--platform", "linux/amd64",
"-v", dir+":/data", test.validator, "Verify", "/data/"+sbomFile)
stdout, stderr, err := runCommand(validateCmd, map[string]string{})
if err != nil {
t.Fatalf("invalid SPDX document:%v\nSTDOUT:\n%s\nSTDERR:\n%s", err, stdout, stderr)
}
require.Contains(t, stdout, "SPDX Document is valid")
})
}
}
test/cli/testdata/image-java-spdx-tools/Dockerfile
Vendored
-7
View File
@@ -1,7 +0,0 @@
FROM openjdk:11@sha256:e81b7f317654b0f26d3993e014b04bcb29250339b11b9de41e130feecd4cd43c
RUN wget --no-verbose https://github.com/spdx/tools-java/releases/download/v1.1.3/tools-java-1.1.3.zip && \
unzip tools-java-1.1.3.zip && \
rm tools-java-1.1.3.zip
ENTRYPOINT ["java", "-jar", "tools-java-1.1.3-jar-with-dependencies.jar"]
test/cli/testdata/image-java-spdx-tools/Makefile
Vendored
-10
View File
@@ -1,10 +0,0 @@
all: build validate
IMAGE := "spdx-java-tools:latest"
.PHONY: build
build:
docker build -t spdx-java-tools:latest .
validate:
docker run --rm -v $(DIR):/home/build/ $(IMAGE) Verify /home/build/$(BASE)