oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-30 22:12:28 +01:00
Code Issues Packages Projects Releases Wiki Activity

rename to syft

Browse Source
This commit is contained in:
Alex Goodman
2020-07-23 20:54:04 -04:00
parent 2132700198
commit a4016d35ce
192 changed files with 241 additions and 239 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/acceptance/compare.py
+5 -5
View File
@@ -8,7 +8,7 @@ Package = collections.namedtuple("Package", "name type version")
Vulnerability = collections.namedtuple("Vulnerability", "cve package")
class ImgBom:
class syft:
def __init__(self, report_path):
self.report_path = report_path
@@ -34,10 +34,10 @@ class ImgBom:
def main(baseline_report, new_report):
report1_obj = ImgBom(report_path=baseline_report)
report1_obj = syft(report_path=baseline_report)
report1_packages, report1_metadata = report1_obj.packages()
report2_obj = ImgBom(report_path=new_report)
report2_obj = syft(report_path=new_report)
report2_packages, report2_metadata = report2_obj.packages()
if len(report2_packages) == 0 and len(report1_packages) == 0:
@@ -101,9 +101,9 @@ def main(baseline_report, new_report):
if __name__ == "__main__":
print("\nComparing two imgbom reports...\n")
print("\nComparing two syft reports...\n")
if len(sys.argv) != 3:
sys.exit("please provide two imgbom json files")
sys.exit("please provide two syft json files")
rc = main(sys.argv[1], sys.argv[2])
sys.exit(rc)
test/acceptance/deb.sh
+5 -5
View File
@@ -6,7 +6,7 @@ ACC_DIR=$2
TEST_IMAGE=$3
TEST_TYPE=deb
WORK_DIR=`mktemp -d -t "imgbom-acceptance-test-${TEST_TYPE}-XXXXXX"`
WORK_DIR=`mktemp -d -t "syft-acceptance-test-${TEST_TYPE}-XXXXXX"`
NORMAL_TEST_IMAGE=$(echo ${TEST_IMAGE} | tr ':' '-' )
REPORT=${WORK_DIR}/acceptance-${TEST_TYPE}-${NORMAL_TEST_IMAGE}.json
GOLDEN_REPORT=${ACC_DIR}/test-fixtures/acceptance-${NORMAL_TEST_IMAGE}.json
@@ -26,7 +26,7 @@ trap cleanup EXIT
# fetch test image
docker pull ${TEST_IMAGE}
# install and run imgbom
# install and run syft
docker run --rm \
-v /var/run/docker.sock://var/run/docker.sock \
-v /${PWD}:/src \
@@ -34,9 +34,9 @@ docker run --rm \
-w /src \
ubuntu:latest \
/bin/bash -x -c "\
DEBIAN_FRONTEND=noninteractive apt install ${DISTDIR}/imgbom_*_linux_amd64.deb -y && \
imgbom version -v && \
imgbom ${TEST_IMAGE} -vv -o json > ${REPORT} && \
DEBIAN_FRONTEND=noninteractive apt install ${DISTDIR}/syft_*_linux_amd64.deb -y && \
syft version -v && \
syft ${TEST_IMAGE} -vv -o json > ${REPORT} && \
cat ${REPORT} \
"
test/acceptance/mac.sh
+5 -5
View File
@@ -7,7 +7,7 @@ TEST_IMAGE=$3
TEST_IMAGE_TAR=/tmp/image.tar
TEST_TYPE=mac
WORK_DIR=`mktemp -d -t "imgbom-acceptance-test-${TEST_TYPE}-XXXXXX"`
WORK_DIR=`mktemp -d -t "syft-acceptance-test-${TEST_TYPE}-XXXXXX"`
NORMAL_TEST_IMAGE=$(echo ${TEST_IMAGE} | tr ':' '-' )
REPORT=${WORK_DIR}/acceptance-${TEST_TYPE}-${NORMAL_TEST_IMAGE}.json
GOLDEN_REPORT=${ACC_DIR}/test-fixtures/acceptance-${NORMAL_TEST_IMAGE}.json
@@ -31,10 +31,10 @@ skopeo --version || brew install https://raw.githubusercontent.com/Homebrew/home
skopeo --override-os linux copy docker://docker.io/${TEST_IMAGE} docker-archive:${TEST_IMAGE_TAR}
ls -alh ${TEST_IMAGE_TAR}
# run imgbom
chmod 755 ${DISTDIR}/imgbom_darwin_amd64/imgbom
${DISTDIR}/imgbom_darwin_amd64/imgbom version -v
${DISTDIR}/imgbom_darwin_amd64/imgbom docker-archive://${TEST_IMAGE_TAR} -vv -o json > ${REPORT}
# run syft
chmod 755 ${DISTDIR}/syft_darwin_amd64/syft
${DISTDIR}/syft_darwin_amd64/syft version -v
${DISTDIR}/syft_darwin_amd64/syft docker-archive://${TEST_IMAGE_TAR} -vv -o json > ${REPORT}
cat ${REPORT}
# compare the results to a known good output
test/acceptance/rpm.sh
+5 -5
View File
@@ -6,7 +6,7 @@ ACC_DIR=$2
TEST_IMAGE=$3
TEST_TYPE=rpm
WORK_DIR=`mktemp -d -t "imgbom-acceptance-test-${TEST_TYPE}-XXXXXX"`
WORK_DIR=`mktemp -d -t "syft-acceptance-test-${TEST_TYPE}-XXXXXX"`
NORMAL_TEST_IMAGE=$(echo ${TEST_IMAGE} | tr ':' '-' )
REPORT=${WORK_DIR}/acceptance-${TEST_TYPE}-${NORMAL_TEST_IMAGE}.json
GOLDEN_REPORT=${ACC_DIR}/test-fixtures/acceptance-${NORMAL_TEST_IMAGE}.json
@@ -26,7 +26,7 @@ trap cleanup EXIT
# fetch test image
docker pull ${TEST_IMAGE}
# install and run imgbom
# install and run syft
docker run --rm \
-v /var/run/docker.sock://var/run/docker.sock \
-v /${PWD}:/src \
@@ -34,9 +34,9 @@ docker run --rm \
-w /src \
centos:latest \
/bin/bash -x -c "\
rpm -ivh ${DISTDIR}/imgbom_*_linux_amd64.rpm && \
imgbom version -v && \
imgbom ${TEST_IMAGE} -vv -o json > ${REPORT} && \
rpm -ivh ${DISTDIR}/syft_*_linux_amd64.rpm && \
syft version -v && \
syft ${TEST_IMAGE} -vv -o json > ${REPORT} && \
cat ${REPORT} \
"
test/inline-compare/Dockerfile
+1 -1
View File
@@ -1,7 +1,7 @@
FROM python:3
WORKDIR /
COPY imgbom-reports /imgbom-reports
COPY syft-reports /syft-reports
COPY inline-reports /inline-reports
COPY compare.py .
ENTRYPOINT ["/compare.py"]
test/inline-compare/Makefile
+12 -12
View File
@@ -1,12 +1,12 @@
IMAGE = "centos:8"
IMAGE_CLEAN = $(shell echo $(IMAGE) | tr ":" "_")
IMGBOM_DIR = imgbom-reports
IMGBOM_REPORT = $(IMGBOM_DIR)/$(IMAGE_CLEAN).json
syft_DIR = syft-reports
syft_REPORT = $(syft_DIR)/$(IMAGE_CLEAN).json
INLINE_DIR = inline-reports
INLINE_REPORT = $(INLINE_DIR)/$(IMAGE_CLEAN)-content-os.json
ifndef IMGBOM_DIR
$(error IMGBOM_DIR is not set)
ifndef syft_DIR
$(error syft_DIR is not set)
endif
ifndef INLINE_DIR
@@ -17,9 +17,9 @@ endif
all: compare
.PHONY: compare
compare: $(INLINE_REPORT) $(IMGBOM_REPORT)
docker build -t compare-imgbom:latest .
docker run compare-imgbom:latest $(IMAGE)
compare: $(INLINE_REPORT) $(syft_REPORT)
docker build -t compare-syft:latest .
docker run compare-syft:latest $(IMAGE)
$(INLINE_REPORT):
echo "Creating $(INLINE_REPORT)..."
@@ -28,12 +28,12 @@ $(INLINE_REPORT):
mv anchore-reports/* $(INLINE_DIR)/
rmdir anchore-reports
$(IMGBOM_REPORT):
echo "Creating $(IMGBOM_REPORT)..."
mkdir -p $(IMGBOM_DIR)
$(syft_REPORT):
echo "Creating $(syft_REPORT)..."
mkdir -p $(syft_DIR)
docker pull $(IMAGE)
go run ../../main.go $(IMAGE) -o json > $(IMGBOM_REPORT)
go run ../../main.go $(IMAGE) -o json > $(syft_REPORT)
.PHONY: clean
clean:
rm -f $(INLINE_DIR)/* $(IMGBOM_DIR)/*
rm -f $(INLINE_DIR)/* $(syft_DIR)/*
test/inline-compare/compare.py
+15 -15
View File
@@ -63,7 +63,7 @@ class InlineScan:
return packages, metadata
class ImgBom:
class syft:
report_tmpl = "{image}.json"
@@ -100,50 +100,50 @@ def main(image):
inline = InlineScan(image=image, report_dir="inline-reports")
inline_packages, inline_metadata = inline.packages()
imgbom = ImgBom(image=image, report_dir="imgbom-reports")
imgbom_packages, imgbom_metadata = imgbom.packages()
syft = syft(image=image, report_dir="syft-reports")
syft_packages, syft_metadata = syft.packages()
if len(imgbom_packages) == 0 and len(inline_packages) == 0:
if len(syft_packages) == 0 and len(inline_packages) == 0:
print("nobody found any packages")
return 0
same_packages = imgbom_packages & inline_packages
same_packages = syft_packages & inline_packages
percent_overlap_packages = (
float(len(same_packages)) / float(len(inline_packages))
) * 100.0
bonus_packages = imgbom_packages - inline_packages
missing_pacakges = inline_packages - imgbom_packages
bonus_packages = syft_packages - inline_packages
missing_pacakges = inline_packages - syft_packages
inline_metadata_set = set()
for package in inline_packages:
metadata = inline_metadata[package.type][package]
inline_metadata_set.add((package, metadata))
imgbom_metadata_set = set()
for package in imgbom_packages:
metadata = imgbom_metadata[package.type][package]
imgbom_metadata_set.add((package, metadata))
syft_metadata_set = set()
for package in syft_packages:
metadata = syft_metadata[package.type][package]
syft_metadata_set.add((package, metadata))
same_metadata = imgbom_metadata_set & inline_metadata_set
same_metadata = syft_metadata_set & inline_metadata_set
percent_overlap_metadata = (
float(len(same_metadata)) / float(len(inline_metadata_set))
) * 100.0
if len(bonus_packages) > 0:
print("Imgbom Bonus packages:")
print("syft Bonus packages:")
for package in sorted(list(bonus_packages)):
print(" " + repr(package))
print()
if len(missing_pacakges) > 0:
print("Imgbom Missing packages:")
print("syft Missing packages:")
for package in sorted(list(missing_pacakges)):
print(" " + repr(package))
print()
print("Inline Packages: %d" % len(inline_packages))
print("Imgbom Packages: %d" % len(imgbom_packages))
print("syft Packages: %d" % len(syft_packages))
print()
print(
"Baseline Packages Matched: %2.3f %% (%d/%d packages)"
test/integration/fixture_image_distro_test.go
+4 -4
View File
@@ -5,11 +5,11 @@ package integration
import (
"testing"
"github.com/anchore/imgbom/imgbom"
"github.com/anchore/syft/syft"
"github.com/anchore/go-testutils"
"github.com/anchore/imgbom/imgbom/distro"
"github.com/anchore/imgbom/imgbom/scope"
"github.com/anchore/syft/syft/distro"
"github.com/anchore/syft/syft/scope"
"github.com/go-test/deep"
)
@@ -19,7 +19,7 @@ func TestDistroImage(t *testing.T) {
tarPath := testutils.GetFixtureImageTarPath(t, fixtureImageName)
defer cleanup()
_, _, actualDistro, err := imgbom.Catalog("docker-archive://"+tarPath, scope.AllLayersScope)
_, _, actualDistro, err := syft.Catalog("docker-archive://"+tarPath, scope.AllLayersScope)
if err != nil {
t.Fatalf("failed to catalog image: %+v", err)
}
test/integration/fixture_pkg_coverage_test.go
+6 -6
View File
@@ -5,13 +5,13 @@ package integration
import (
"testing"
"github.com/anchore/imgbom/imgbom"
"github.com/anchore/syft/syft"
"github.com/anchore/imgbom/internal"
"github.com/anchore/syft/internal"
"github.com/anchore/go-testutils"
"github.com/anchore/imgbom/imgbom/pkg"
"github.com/anchore/imgbom/imgbom/scope"
"github.com/anchore/syft/syft/pkg"
"github.com/anchore/syft/syft/scope"
)
var cases = []struct {
@@ -166,7 +166,7 @@ func TestPkgCoverageImage(t *testing.T) {
tarPath := testutils.GetFixtureImageTarPath(t, fixtureImageName)
defer cleanup()
catalog, _, _, err := imgbom.Catalog("docker-archive://"+tarPath, scope.AllLayersScope)
catalog, _, _, err := syft.Catalog("docker-archive://"+tarPath, scope.AllLayersScope)
if err != nil {
t.Fatalf("failed to catalog image: %+v", err)
}
@@ -237,7 +237,7 @@ func TestPkgCoverageImage(t *testing.T) {
}
func TestPkgCoverageDirectory(t *testing.T) {
catalog, _, _, err := imgbom.Catalog("dir://test-fixtures/image-pkg-coverage", scope.AllLayersScope)
catalog, _, _, err := syft.Catalog("dir://test-fixtures/image-pkg-coverage", scope.AllLayersScope)
if err != nil {
t.Errorf("unable to create scope from dir: %+v", err)
test/integration/test-fixtures/.gitignore
+1 -1
View File
@@ -1,5 +1,5 @@
# we should strive to not commit blobs to the repo and strive to keep the build process of how blobs are acquired in-repo.
# this blob is generated from imgbom/imgbom/catalogers/java/test-fixtures/java-builds , however, preserving the build process
# this blob is generated from syft/syft/catalogers/java/test-fixtures/java-builds , however, preserving the build process
# twice in the repo seems redundant (even via symlink). Given that the fixture is a few kilobytes in size, the build process is already
# captured, and integration tests should only be testing if jars can be discovered (not necessarily depth in java detection
# functionality), committing it seems like an acceptable exception.
test/integration/test-fixtures/image-pkg-coverage/go/go.mod
+1 -1
View File
@@ -1,4 +1,4 @@
module github.com/anchore/imgbom
module github.com/anchore/syft
go 1.14
test/integration/test-fixtures/image-pkg-coverage/java/generate-fixtures.md
+1 -1
View File
@@ -1 +1 @@
See the imgbom/cataloger/java/test-fixtures/java-builds dir to generate test fixtures and copy to here manually.
See the syft/cataloger/java/test-fixtures/java-builds dir to generate test fixtures and copy to here manually.