oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-02-12 02:26:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

update formatter and json schema

Browse Source 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
This commit is contained in:
Alex Goodman 2024-10-31 11:44:32 -04:00
parent 5b7ec60f8d
commit ad2abfabd1
13 changed files with 2800 additions and 48 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
internal/constants.go
View File

@ -3,5 +3,5 @@ package internal
const (
// JSONSchemaVersion is the current schema version output by the JSON encoder
// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
JSONSchemaVersion = "16.0.18"
JSONSchemaVersion = "16.0.19"
)

2731
schema/json/schema-16.0.19.json Normal file
View File

File diff suppressed because it is too large Load Diff

8
schema/json/schema-latest.json
View File

@ -1,6 +1,6 @@
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "anchore.io/schema/syft/json/16.0.18/document",
"$id": "anchore.io/schema/syft/json/16.0.19/document",
"$ref": "#/$defs/Document",
"$defs": {
"AlpmDbEntry": {
@ -1610,6 +1610,9 @@
"purl": {
"type": "string"
},
"dependencies": {
"type": "string"
},
"metadataType": {
"type": "string"
},
@ -1773,7 +1776,8 @@
"licenses",
"language",
"cpes",
"purl"
"purl",
"dependencies"
]
},
"PhpComposerAuthors": {

10
syft/format/internal/testutil/directory_input.go
View File

@ -121,7 +121,8 @@ func newDirectoryCatalog() *pkg.Collection {
},
},
},
PURL: "a-purl-2", // intentionally a bad pURL for test fixtures
PURL: "a-purl-2", // intentionally a bad pURL for test fixtures
Dependencies: pkg.CompleteDependencies,
CPEs: []cpe.CPE{
cpe.Must("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*", cpe.Source("")),
},
@ -138,7 +139,8 @@ func newDirectoryCatalog() *pkg.Collection {
Package: "package-2",
Version: "2.0.1",
},
PURL: "pkg:deb/debian/package-2@2.0.1",
PURL: "pkg:deb/debian/package-2@2.0.1",
Dependencies: pkg.CompleteDependencies,
CPEs: []cpe.CPE{
cpe.Must("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*", cpe.Source("")),
},
@ -163,6 +165,7 @@ func newDirectoryCatalogWithAuthorField() *pkg.Collection {
Licenses: pkg.NewLicenseSet(
pkg.NewLicense("MIT"),
),
Dependencies: pkg.CompleteDependencies,
Metadata: pkg.PythonPackage{
Name: "package-1",
Version: "1.0.1",
@ -190,7 +193,8 @@ func newDirectoryCatalogWithAuthorField() *pkg.Collection {
Package: "package-2",
Version: "2.0.1",
},
PURL: "pkg:deb/debian/package-2@2.0.1",
Dependencies: pkg.CompleteDependencies,
PURL: "pkg:deb/debian/package-2@2.0.1",
CPEs: []cpe.CPE{
cpe.Must("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*", "another-test-source"),
},

6
syft/format/internal/testutil/image_input.go
View File

@ -117,7 +117,8 @@ func populateImageCatalog(catalog *pkg.Collection, img *image.Image) {
Name: "package-1",
Version: "1.0.1",
},
PURL: "a-purl-1", // intentionally a bad pURL for test fixtures
PURL: "a-purl-1", // intentionally a bad pURL for test fixtures
Dependencies: pkg.CompleteDependencies,
CPEs: []cpe.CPE{
cpe.Must("cpe:2.3:*:some:package:1:*:*:*:*:*:*:*", cpe.GeneratedSource),
},
@ -137,7 +138,8 @@ func populateImageCatalog(catalog *pkg.Collection, img *image.Image) {
Package: "package-2",
Version: "2.0.1",
},
PURL: "pkg:deb/debian/package-2@2.0.1",
PURL: "pkg:deb/debian/package-2@2.0.1",
Dependencies: pkg.CompleteDependencies,
CPEs: []cpe.CPE{
cpe.Must("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*", cpe.NVDDictionaryLookupSource),
},

14
syft/format/syftjson/encoder_test.go
View File

@ -141,10 +141,11 @@ func TestEncodeFullJSONDocument(t *testing.T) {
RealPath: "/a/place/a",
}),
),
Type: pkg.PythonPkg,
FoundBy: "the-cataloger-1",
Language: pkg.Python,
Licenses: pkg.NewLicenseSet(pkg.NewLicense("MIT")),
Type: pkg.PythonPkg,
FoundBy: "the-cataloger-1",
Language: pkg.Python,
Licenses: pkg.NewLicenseSet(pkg.NewLicense("MIT")),
Dependencies: pkg.CompleteDependencies,
Metadata: pkg.PythonPackage{
Name: "package-1",
Version: "1.0.1",
@ -164,8 +165,9 @@ func TestEncodeFullJSONDocument(t *testing.T) {
RealPath: "/b/place/b",
}),
),
Type: pkg.DebPkg,
FoundBy: "the-cataloger-2",
Type: pkg.DebPkg,
FoundBy: "the-cataloger-2",
Dependencies: pkg.CompleteDependencies,
Metadata: pkg.DpkgDBEntry{
Package: "package-2",
Version: "2.0.1",

21
syft/format/syftjson/model/package.go
View File

@ -24,16 +24,17 @@ type Package struct {
// PackageBasicData contains non-ambiguous values (type-wise) from pkg.Package.
type PackageBasicData struct {
ID string `json:"id"`
Name string `json:"name"`
Version string `json:"version"`
Type pkg.Type `json:"type"`
FoundBy string `json:"foundBy"`
Locations []file.Location `json:"locations"`
Licenses licenses `json:"licenses"`
Language pkg.Language `json:"language"`
CPEs cpes `json:"cpes"`
PURL string `json:"purl"`
ID string `json:"id"`
Name string `json:"name"`
Version string `json:"version"`
Type pkg.Type `json:"type"`
FoundBy string `json:"foundBy"`
Locations []file.Location `json:"locations"`
Licenses licenses `json:"licenses"`
Language pkg.Language `json:"language"`
CPEs cpes `json:"cpes"`
PURL string `json:"purl"`
Dependencies pkg.DependencyCompleteness `json:"dependencies"`
}
type cpes []CPE

2
syft/format/syftjson/test-fixtures/snapshot/TestDirectoryEncoder.golden
View File

@ -28,6 +28,7 @@
}
],
"purl": "a-purl-2",
"dependencies": "complete",
"metadataType": "python-package",
"metadata": {
"name": "package-1",
@ -63,6 +64,7 @@
}
],
"purl": "pkg:deb/debian/package-2@2.0.1",
"dependencies": "complete",
"metadataType": "dpkg-db-entry",
"metadata": {
"package": "package-2",

2
syft/format/syftjson/test-fixtures/snapshot/TestEncodeFullJSONDocument.golden
View File

@ -29,6 +29,7 @@
}
],
"purl": "a-purl-1",
"dependencies": "complete",
"metadataType": "python-package",
"metadata": {
"name": "package-1",
@ -60,6 +61,7 @@
}
],
"purl": "a-purl-2",
"dependencies": "complete",
"metadataType": "dpkg-db-entry",
"metadata": {
"package": "package-2",

2
syft/format/syftjson/test-fixtures/snapshot/TestImageEncoder.golden
View File

@ -30,6 +30,7 @@
}
],
"purl": "a-purl-1",
"dependencies": "complete",
"metadataType": "python-package",
"metadata": {
"name": "package-1",
@ -62,6 +63,7 @@
}
],
"purl": "pkg:deb/debian/package-2@2.0.1",
"dependencies": "complete",
"metadataType": "dpkg-db-entry",
"metadata": {
"package": "package-2",

21
syft/format/syftjson/to_format_model.go
View File

@ -259,16 +259,17 @@ func toPackageModel(p pkg.Package, cfg EncoderConfig) model.Package {
return model.Package{
PackageBasicData: model.PackageBasicData{
ID: string(p.ID()),
Name: p.Name,
Version: p.Version,
Type: p.Type,
FoundBy: p.FoundBy,
Locations: p.Locations.ToSlice(),
Licenses: licenses,
Language: p.Language,
CPEs: cpes,
PURL: p.PURL,
ID: string(p.ID()),
Name: p.Name,
Version: p.Version,
Type: p.Type,
FoundBy: p.FoundBy,
Locations: p.Locations.ToSlice(),
Licenses: licenses,
Language: p.Language,
CPEs: cpes,
PURL: p.PURL,
Dependencies: p.Dependencies,
},
PackageCustomData: model.PackageCustomData{
MetadataType: metadataType(p.Metadata, cfg.Legacy),

21
syft/format/syftjson/to_syft_model.go
View File

@ -338,16 +338,17 @@ func toSyftPackage(p model.Package, idAliases map[string]string) pkg.Package {
}
out := pkg.Package{
Name: p.Name,
Version: p.Version,
FoundBy: p.FoundBy,
Locations: file.NewLocationSet(p.Locations...),
Licenses: pkg.NewLicenseSet(toSyftLicenses(p.Licenses)...),
Language: p.Language,
Type: p.Type,
CPEs: cpes,
PURL: p.PURL,
Metadata: p.Metadata,
Name: p.Name,
Version: p.Version,
FoundBy: p.FoundBy,
Locations: file.NewLocationSet(p.Locations...),
Licenses: pkg.NewLicenseSet(toSyftLicenses(p.Licenses)...),
Language: p.Language,
Type: p.Type,
CPEs: cpes,
PURL: p.PURL,
Dependencies: p.Dependencies,
Metadata: p.Metadata,
}
// we don't know if this package ID is truly unique, however, we need to trust the user input in case there are

8
syft/pkg/dependencies.go
View File

@ -22,14 +22,14 @@ const (
CompleteDependencies DependencyCompleteness = "complete"
// MixedDependencies is a superset of complete. It indicates that the package has all of its direct dependencies
// resolved as well as one or all of indirect dependencies. What is notable about this is that direct and
// resolved as well as some or all of indirect dependencies. What is notable about this is that direct and
// indirect dependencies are linked directly to this package and are not separable (you cannot distinguish between
// a direct and indirect dependency from the perspective of this package).
MixedDependencies DependencyCompleteness = "mixed"
// IncompleteDependencies indicates that the package does not have all of its dependencies resolved. This is useful
// in times when there is more than one mechanism at play for resolving dependencies and the cataloger only
// implements a subset of them, or in cases where the mechanism for resolving dependencies is limited.
// IncompleteDependencies indicates that the package does not have all of its direct dependencies resolved.
// This is useful in times when there is more than one mechanism at play for resolving dependencies and the
// cataloger only implements a subset of them, or in cases where the mechanism for resolving dependencies is limited.
IncompleteDependencies DependencyCompleteness = "incomplete"
)