Add experimental cataloger capabilities command (#4317)

* add info command from generated capabilities Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * correct gentoo and arch ecosystems Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename os pkg types Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * better binary cataloger description Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * expose metadata and pacakge types in json Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * expose json schema types Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add completeness tests for metadata types Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * latest generation Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * improve testing a docs Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix tests and linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * restore goreleaser config Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * tweak diagram Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix pdm Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * chore: java binary data Signed-off-by: Keith Zantow <kzantow@gmail.com> * new capability descriptions for gguf and python Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * correct poetry lock integrity hash claim Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix compile error Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix: remove purl version from overrides Signed-off-by: Keith Zantow <kzantow@gmail.com> * fix lua deps ref Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * keep gguf as ai ecosystem Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * split packages.yaml to multiple files by go package Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * ensure tests do not use go test cache Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * sort json output for info command Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * docs: fix ocaml, php, and portage capabilities yaml Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * chore: update erlang capabilities Signed-off-by: Keith Zantow <kzantow@gmail.com> * chore: update java capabilities Signed-off-by: Keith Zantow <kzantow@gmail.com> * chore: update javascript capabilities Signed-off-by: Keith Zantow <kzantow@gmail.com> * chore: update linux kernel capabilities Signed-off-by: Keith Zantow <kzantow@gmail.com> * remove missing tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix package.yaml references Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * revert license list change Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * check for drift in capability descriptions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * regenerate capabilities Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * test cleanup Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * use fixture cache in static analysis Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * claim fixtures pre-req for cap generation Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update documentation with correct regeneration procedure Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * chore: ruby-gemspec-cataloger finds no dependencies Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * chore: fix python docs and config comment Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * chore: commit re-generated java yaml Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * add cataloger selection to caps command Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * re-generate cap yamls Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix tests for cataloger selection Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add missing tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename cmd to `cataloger info` Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * [wip] change capability description locations Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * [wip] continued Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * [wip] adjust for import cycles Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * correct docs Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: Keith Zantow <kzantow@gmail.com> Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> Co-authored-by: Keith Zantow <kzantow@gmail.com> Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com>
2026-11-01 15:06:36 +01:00 · 2025-12-22 19:34:10 +00:00
parent ae1a247f3d
commit b3c70da3ea
116 changed files with 17277 additions and 139 deletions
@@ -0,0 +1,25 @@
+package python
+
+import (
+	"context"
+
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/generic"
+)
+
+const catalogerName = "python-package-cataloger"
+
+type CatalogerConfig struct {
+	Setting string
+}
+
+func NewPythonCataloger(_ CatalogerConfig) pkg.Cataloger {
+	return generic.NewCataloger(catalogerName).
+		WithParserByGlobs(parse, "**/*.py")
+}
+
+func parse(_ context.Context, _ file.Resolver, _ *generic.Environment, _ file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
+	return nil, nil, nil
+}
@@ -0,0 +1,23 @@
+package duplicate1
+
+import (
+	"context"
+
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/generic"
+)
+
+type Config struct {
+	Option1 bool
+}
+
+func NewDuplicateCataloger(_ Config) pkg.Cataloger {
+	return generic.NewCataloger("duplicate-cataloger").
+		WithParserByGlobs(parse, "**/*.txt")
+}
+
+func parse(_ context.Context, _ file.Resolver, _ *generic.Environment, _ file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
+	return nil, nil, nil
+}
@@ -0,0 +1,23 @@
+package duplicate2
+
+import (
+	"context"
+
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/generic"
+)
+
+type Config struct {
+	Option2 string
+}
+
+func NewDuplicateCataloger(_ Config) pkg.Cataloger {
+	return generic.NewCataloger("duplicate-cataloger").
+		WithParserByGlobs(parse, "**/*.json")
+}
+
+func parse(_ context.Context, _ file.Resolver, _ *generic.Environment, _ file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
+	return nil, nil, nil
+}
@@ -0,0 +1,9 @@
+package dotnet
+
+import (
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func NewDotnetCataloger(cfg CatalogerConfig) pkg.Cataloger {
+	return dotnetCataloger{cfg: cfg}
+}
@@ -0,0 +1,27 @@
+package dotnet
+
+import (
+	"context"
+
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+const catalogerName = "dotnet-cataloger"
+
+type CatalogerConfig struct {
+	Option bool
+}
+
+type dotnetCataloger struct {
+	cfg CatalogerConfig
+}
+
+func (d dotnetCataloger) Name() string {
+	return catalogerName
+}
+
+func (d dotnetCataloger) Catalog(_ context.Context, _ file.Resolver) ([]pkg.Package, []artifact.Relationship, error) {
+	return nil, nil, nil
+}
@@ -0,0 +1,31 @@
+package java
+
+import (
+	"context"
+
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+const pomCatalogerName = "java-pom-cataloger"
+
+type ArchiveCatalogerConfig struct {
+	IncludeArchives bool
+}
+
+type pomXMLCataloger struct {
+	cfg ArchiveCatalogerConfig
+}
+
+func (p pomXMLCataloger) Name() string {
+	return pomCatalogerName
+}
+
+func (p pomXMLCataloger) Catalog(_ context.Context, _ file.Resolver) ([]pkg.Package, []artifact.Relationship, error) {
+	return nil, nil, nil
+}
+
+func NewPomCataloger(cfg ArchiveCatalogerConfig) pkg.Cataloger {
+	return pomXMLCataloger{cfg: cfg}
+}
@@ -0,0 +1,19 @@
+package kernel
+
+import (
+	"context"
+
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/generic"
+)
+
+func NewLinuxKernelCataloger(_ LinuxKernelCatalogerConfig) pkg.Cataloger {
+	return generic.NewCataloger("linux-kernel-cataloger").
+		WithParserByGlobs(parse, "**/vmlinuz")
+}
+
+func parse(_ context.Context, _ file.Resolver, _ *generic.Environment, _ file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
+	return nil, nil, nil
+}
@@ -0,0 +1,5 @@
+package kernel
+
+type LinuxKernelCatalogerConfig struct {
+	KernelVersion string
+}
@@ -0,0 +1,23 @@
+package ruby
+
+import (
+	"context"
+
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/generic"
+)
+
+type Config struct {
+	Setting bool
+}
+
+func NewRubyCataloger(_ Config) pkg.Cataloger {
+	return generic.NewCataloger("ruby-cataloger").
+		WithParserByGlobs(parse, "**/Gemfile")
+}
+
+func parse(_ context.Context, _ file.Resolver, _ *generic.Environment, _ file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
+	return nil, nil, nil
+}
@@ -0,0 +1,19 @@
+package javascript
+
+import (
+	"context"
+
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/generic"
+)
+
+func NewJavaScriptCataloger() pkg.Cataloger {
+	return generic.NewCataloger("javascript-cataloger").
+		WithParserByGlobs(parse, "**/*.js")
+}
+
+func parse(_ context.Context, _ file.Resolver, _ *generic.Environment, _ file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
+	return nil, nil, nil
+}
@@ -0,0 +1,21 @@
+package binary
+
+import (
+	"context"
+
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/generic"
+)
+
+type Parser struct{}
+
+func NewBinaryCataloger(_ Parser) pkg.Cataloger {
+	return generic.NewCataloger("binary-cataloger").
+		WithParserByGlobs(parse, "**/*")
+}
+
+func parse(_ context.Context, _ file.Resolver, _ *generic.Environment, _ file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
+	return nil, nil, nil
+}
@@ -0,0 +1,24 @@
+package rust
+
+import (
+	"context"
+
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/generic"
+)
+
+// CatalogerConfig is imported from a selector expression in the real code
+type CatalogerConfig struct {
+	SomeOption bool
+}
+
+func NewRustCataloger(_ CatalogerConfig) pkg.Cataloger {
+	return generic.NewCataloger("rust-cataloger").
+		WithParserByGlobs(parse, "**/Cargo.toml")
+}
+
+func parse(_ context.Context, _ file.Resolver, _ *generic.Environment, _ file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
+	return nil, nil, nil
+}
@@ -0,0 +1,23 @@
+package golang
+
+import (
+	"context"
+
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/generic"
+)
+
+type CatalogerConfig struct {
+	SomeOption bool
+}
+
+func NewGoModuleCataloger(_ CatalogerConfig) pkg.Cataloger {
+	return generic.NewCataloger("go-module-cataloger").
+		WithParserByGlobs(parseGoMod, "**/go.mod")
+}
+
+func parseGoMod(_ context.Context, _ file.Resolver, _ *generic.Environment, _ file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
+	return nil, nil, nil
+}
@@ -0,0 +1,8 @@
+package java
+
+// ArchiveCatalogerConfig contains configuration for the java archive cataloger
+type ArchiveCatalogerConfig struct {
+	// include archive contents in catalog
+	// app-config: java.use-network
+	UseNetwork bool
+}
@@ -0,0 +1,8 @@
+package python
+
+// CatalogerConfig contains configuration for the python cataloger
+type CatalogerConfig struct {
+	// guess unpinned python package requirements
+	// app-config: python.guess-unpinned-requirements
+	GuessUnpinnedRequirements bool
+}
@@ -0,0 +1,22 @@
+package golang
+
+// MainModuleVersionConfig contains nested configuration for main module version detection
+type MainModuleVersionConfig struct {
+	// extract version from LD flags
+	// app-config: golang.main-module-version.from-ld-flags
+	FromLDFlags bool
+
+	// extract version from build info
+	// app-config: golang.main-module-version.from-build-info
+	FromBuildInfo bool
+}
+
+// CatalogerConfig contains configuration for the golang cataloger
+type CatalogerConfig struct {
+	// enable searching for go package licenses in the local mod cache
+	// app-config: golang.search-local-mod-cache-licenses
+	SearchLocalModCacheLicenses bool
+
+	// main module version configuration
+	MainModuleVersion MainModuleVersionConfig
+}
@@ -0,0 +1,10 @@
+package javascript
+
+// CatalogerConfig contains configuration for the javascript cataloger (no annotations)
+type CatalogerConfig struct {
+	// this field has no app-config annotation
+	SearchRemoteLicenses bool
+
+	// this field also has no annotation
+	IncludeDevDependencies bool
+}
@@ -0,0 +1,16 @@
+package golang
+
+// CatalogerConfig contains configuration for the golang cataloger
+type CatalogerConfig struct {
+	// enable searching for go package licenses in the local mod cache
+	// app-config: golang.search-local-mod-cache-licenses
+	SearchLocalModCacheLicenses bool
+
+	// base URL for npm registry
+	// app-config: golang.npm-base-url
+	NpmBaseURL string
+
+	// list of globs to search for go.mod files
+	// app-config: golang.search-patterns
+	SearchPatterns []string
+}