Improve CycloneDX format output (#710)

* Improve CycloneDX format output

## Additions to CycloneDX output

* CPEs
* Authors
* Publishers
* External References (Website, Distribution, VCS)
* Description

Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net>

syft/linux/release.go

@@ -2,14 +2,14 @@ package linux
 
 // Release represents Linux Distribution release information as specified from https://www.freedesktop.org/software/systemd/man/os-release.html
 type Release struct {
-	PrettyName       string   // A pretty operating system name in a format suitable for presentation to the user.
+	PrettyName       string   `cyclonedx:"prettyName"` // A pretty operating system name in a format suitable for presentation to the user.
 	Name             string   // identifies the operating system, without a version component, and suitable for presentation to the user.
-	ID               string   // identifies the operating system, excluding any version information and suitable for processing by scripts or usage in generated filenames.
-	IDLike           []string // list of operating system identifiers in the same syntax as the ID= setting. It should list identifiers of operating systems that are closely related to the local operating system in regards to packaging and programming interfaces.
+	ID               string   `cyclonedx:"id"`     // identifies the operating system, excluding any version information and suitable for processing by scripts or usage in generated filenames.
+	IDLike           []string `cyclonedx:"idLike"` // list of operating system identifiers in the same syntax as the ID= setting. It should list identifiers of operating systems that are closely related to the local operating system in regards to packaging and programming interfaces.
 	Version          string   // identifies the operating system version, excluding any OS name information, possibly including a release code name, and suitable for presentation to the user.
-	VersionID        string   // identifies the operating system version, excluding any OS name information or release code name, and suitable for processing by scripts or usage in generated filenames.
-	Variant          string   // identifies a specific variant or edition of the operating system suitable for presentation to the user.
-	VariantID        string   // identifies a specific variant or edition of the operating system. This may be interpreted by other packages in order to determine a divergent default configuration.
+	VersionID        string   `cyclonedx:"versionID"` // identifies the operating system version, excluding any OS name information or release code name, and suitable for processing by scripts or usage in generated filenames.
+	Variant          string   `cyclonedx:"variant"`   // identifies a specific variant or edition of the operating system suitable for presentation to the user.
+	VariantID        string   `cyclonedx:"variantID"` // identifies a specific variant or edition of the operating system. This may be interpreted by other packages in order to determine a divergent default configuration.
 	HomeURL          string
 	SupportURL       string
 	BugReportURL     string

syft/pkg/apk_metadata.go

@@ -20,18 +20,18 @@ var _ FileOwner = (*ApkMetadata)(nil)
 // - https://git.alpinelinux.org/apk-tools/tree/src/database.c
 type ApkMetadata struct {
 	Package          string          `mapstructure:"P" json:"package"`
-	OriginPackage    string          `mapstructure:"o" json:"originPackage"`
+	OriginPackage    string          `mapstructure:"o" json:"originPackage" cyclonedx:"originPackage"`
 	Maintainer       string          `mapstructure:"m" json:"maintainer"`
 	Version          string          `mapstructure:"V" json:"version"`
 	License          string          `mapstructure:"L" json:"license"`
 	Architecture     string          `mapstructure:"A" json:"architecture"`
 	URL              string          `mapstructure:"U" json:"url"`
 	Description      string          `mapstructure:"T" json:"description"`
-	Size             int             `mapstructure:"S" json:"size"`
-	InstalledSize    int             `mapstructure:"I" json:"installedSize"`
-	PullDependencies string          `mapstructure:"D" json:"pullDependencies"`
-	PullChecksum     string          `mapstructure:"C" json:"pullChecksum"`
-	GitCommitOfAport string          `mapstructure:"c" json:"gitCommitOfApkPort"`
+	Size             int             `mapstructure:"S" json:"size" cyclonedx:"size"`
+	InstalledSize    int             `mapstructure:"I" json:"installedSize" cyclonedx:"installedSize"`
+	PullDependencies string          `mapstructure:"D" json:"pullDependencies" cyclonedx:"pullDependencies"`
+	PullChecksum     string          `mapstructure:"C" json:"pullChecksum" cyclonedx:"pullChecksum"`
+	GitCommitOfAport string          `mapstructure:"c" json:"gitCommitOfApkPort" cyclonedx:"gitCommitOfApkPort"`
 	Files            []ApkFileRecord `json:"files"`
 }
 

syft/pkg/dpkg_metadata.go

@@ -18,12 +18,12 @@ var _ FileOwner = (*DpkgMetadata)(nil)
 // at http://manpages.ubuntu.com/manpages/xenial/man1/dpkg-query.1.html in the --showformat section.
 type DpkgMetadata struct {
 	Package       string           `mapstructure:"Package" json:"package"`
-	Source        string           `mapstructure:"Source" json:"source"`
+	Source        string           `mapstructure:"Source" json:"source" cyclonedx:"source"`
 	Version       string           `mapstructure:"Version" json:"version"`
-	SourceVersion string           `mapstructure:"SourceVersion" json:"sourceVersion"`
+	SourceVersion string           `mapstructure:"SourceVersion" json:"sourceVersion" cyclonedx:"sourceVersion"`
 	Architecture  string           `mapstructure:"Architecture" json:"architecture"`
 	Maintainer    string           `mapstructure:"Maintainer" json:"maintainer"`
-	InstalledSize int              `mapstructure:"InstalledSize" json:"installedSize"`
+	InstalledSize int              `mapstructure:"InstalledSize" json:"installedSize" cyclonedx:"installedSize"`
 	Files         []DpkgFileRecord `json:"files"`
 }
 

syft/pkg/golang_bin_metadata.go

@@ -2,7 +2,7 @@ package pkg
 
 // GolangBinMetadata represents all captured data for a Golang Binary
 type GolangBinMetadata struct {
-	GoCompiledVersion string `json:"goCompiledVersion"`
-	Architecture      string `json:"architecture"`
-	H1Digest          string `json:"h1Digest"`
+	GoCompiledVersion string `json:"goCompiledVersion" cyclonedx:"goCompiledVersion"`
+	Architecture      string `json:"architecture" cyclonedx:"architecture"`
+	H1Digest          string `json:"h1Digest" cyclonedx:"h1Digest"`
 }

syft/pkg/package.go

@@ -17,14 +17,14 @@ type Package struct {
 	id           artifact.ID       `hash:"ignore"`
 	Name         string            // the package name
 	Version      string            // the version of the package
-	FoundBy      string            // the specific cataloger that discovered this package
+	FoundBy      string            `cyclonedx:"foundBy"` // the specific cataloger that discovered this package
 	Locations    []source.Location // the locations that lead to the discovery of this package (note: this is not necessarily the locations that make up this package)
 	Licenses     []string          // licenses discovered with the package metadata
-	Language     Language          // the language ecosystem this package belongs to (e.g. JavaScript, Python, etc)
-	Type         Type              // the package type (e.g. Npm, Yarn, Python, Rpm, Deb, etc)
-	CPEs         []CPE             `hash:"ignore"` // all possible Common Platform Enumerators (note: this is NOT included in the definition of the ID since all fields on a CPE are derived from other fields)
-	PURL         string            `hash:"ignore"` // the Package URL (see https://github.com/package-url/purl-spec) (note: this is NOT included in the definition of the ID since all fields on a pURL are derived from other fields)
-	MetadataType MetadataType      // the shape of the additional data in the "metadata" field
+	Language     Language          `cyclonedx:"language"`     // the language ecosystem this package belongs to (e.g. JavaScript, Python, etc)
+	Type         Type              `cyclonedx:"type"`         // the package type (e.g. Npm, Yarn, Python, Rpm, Deb, etc)
+	CPEs         []CPE             `hash:"ignore"`            // all possible Common Platform Enumerators (note: this is NOT included in the definition of the ID since all fields on a CPE are derived from other fields)
+	PURL         string            `hash:"ignore"`            // the Package URL (see https://github.com/package-url/purl-spec) (note: this is NOT included in the definition of the ID since all fields on a pURL are derived from other fields)
+	MetadataType MetadataType      `cyclonedx:"metadataType"` // the shape of the additional data in the "metadata" field
 	Metadata     interface{}       // additional data found while parsing the package source
 }
 

syft/pkg/rpmdb_metadata.go

@@ -21,11 +21,11 @@ var _ FileOwner = (*RpmdbMetadata)(nil)
 type RpmdbMetadata struct {
 	Name      string            `json:"name"`
 	Version   string            `json:"version"`
-	Epoch     *int              `json:"epoch"`
+	Epoch     *int              `json:"epoch"  cyclonedx:"epoch"`
 	Arch      string            `json:"architecture"`
-	Release   string            `json:"release"`
-	SourceRpm string            `json:"sourceRpm"`
-	Size      int               `json:"size"`
+	Release   string            `json:"release" cyclonedx:"release"`
+	SourceRpm string            `json:"sourceRpm" cyclonedx:"sourceRpm"`
+	Size      int               `json:"size" cyclonedx:"size"`
 	License   string            `json:"license"`
 	Vendor    string            `json:"vendor"`
 	Files     []RpmdbFileRecord `json:"files"`

syft/source/coordinates.go

@@ -10,8 +10,8 @@ import (
 
 // Coordinates contains the minimal information needed to describe how to find a file within any possible source object (e.g. image and directory sources)
 type Coordinates struct {
-	RealPath     string `json:"path"`              // The path where all path ancestors have no hardlinks / symlinks
-	FileSystemID string `json:"layerID,omitempty"` // An ID representing the filesystem. For container images, this is a layer digest. For directories or a root filesystem, this is blank.
+	RealPath     string `json:"path" cyclonedx:"path"`                 // The path where all path ancestors have no hardlinks / symlinks
+	FileSystemID string `json:"layerID,omitempty" cyclonedx:"layerID"` // An ID representing the filesystem. For container images, this is a layer digest. For directories or a root filesystem, this is blank.
 }
 
 // CoordinateSet represents a set of string types.