feat: Support scanning license files in golang packages over the network (#1630)

Signed-off-by: Avi Deitcher <avi@deitcher.net>
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
Co-authored-by: Alex Goodman <alex.goodman@anchore.com>

syft/pkg/cataloger/golang/licenses_test.go

@@ -1,8 +1,14 @@
 package golang
 
 import (
+	"archive/zip"
+	"bytes"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
 	"os"
 	"path"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -10,7 +16,7 @@ import (
 	"github.com/anchore/syft/syft/source"
 )
 
-func Test_LicenseSearch(t *testing.T) {
+func Test_LocalLicenseSearch(t *testing.T) {
 	tests := []struct {
 		name     string
 		version  string
@@ -34,10 +40,85 @@ func Test_LicenseSearch(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			l := newGoLicenses(GoCatalogerOpts{
-				SearchLocalModCacheLicenses: true,
-				LocalModCacheDir:            path.Join(wd, "test-fixtures", "licenses"),
+				searchLocalModCacheLicenses: true,
+				localModCacheDir:            path.Join(wd, "test-fixtures", "licenses", "pkg", "mod"),
 			})
-			licenses, err := l.getLicenses(source.MockResolver{}, test.name, test.version)
+			licenses, err := l.getLicenses(source.EmptyResolver{}, test.name, test.version)
+			require.NoError(t, err)
+
+			require.Len(t, licenses, 1)
+
+			require.Equal(t, test.expected, licenses[0])
+		})
+	}
+}
+
+func Test_RemoteProxyLicenseSearch(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		buf := &bytes.Buffer{}
+		uri := strings.TrimPrefix(strings.TrimSuffix(r.RequestURI, ".zip"), "/")
+
+		parts := strings.Split(uri, "/@v/")
+		modPath := parts[0]
+		modVersion := parts[1]
+
+		wd, err := os.Getwd()
+		require.NoError(t, err)
+		testDir := path.Join(wd, "test-fixtures", "licenses", "pkg", "mod", processCaps(modPath)+"@"+modVersion)
+
+		archive := zip.NewWriter(buf)
+
+		entries, err := os.ReadDir(testDir)
+		require.NoError(t, err)
+		for _, f := range entries {
+			// the zip files downloaded contain a path to the repo that somewhat matches where it ends up on disk,
+			// so prefix entries with something similar
+			writer, err := archive.Create(path.Join("github.com/something/some@version", f.Name()))
+			require.NoError(t, err)
+			contents, err := os.ReadFile(path.Join(testDir, f.Name()))
+			require.NoError(t, err)
+			_, err = writer.Write(contents)
+			require.NoError(t, err)
+		}
+
+		err = archive.Close()
+		require.NoError(t, err)
+
+		w.Header().Add("Content-Length", fmt.Sprintf("%d", buf.Len()))
+
+		_, err = w.Write(buf.Bytes())
+		require.NoError(t, err)
+	}))
+	defer server.Close()
+
+	tests := []struct {
+		name     string
+		version  string
+		expected string
+	}{
+		{
+			name:     "github.com/someorg/somename",
+			version:  "v0.3.2",
+			expected: "Apache-2.0",
+		},
+		{
+			name:     "github.com/CapORG/CapProject",
+			version:  "v4.111.5",
+			expected: "MIT",
+		},
+	}
+
+	modDir := path.Join(t.TempDir())
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			l := newGoLicenses(GoCatalogerOpts{
+				searchRemoteLicenses: true,
+				proxies:              []string{server.URL},
+				localModCacheDir:     modDir,
+			})
+
+			licenses, err := l.getLicenses(source.EmptyResolver{}, test.name, test.version)
 			require.NoError(t, err)
 
 			require.Len(t, licenses, 1)
@@ -74,3 +155,42 @@ func Test_processCaps(t *testing.T) {
 		})
 	}
 }
+
+func Test_remotesForModule(t *testing.T) {
+	allProxies := []string{"https://somewhere.org", "direct"}
+	directProxy := []string{"direct"}
+
+	tests := []struct {
+		module   string
+		noProxy  string
+		expected []string
+	}{
+		{
+			module:   "github.com/anchore/syft",
+			expected: allProxies,
+		},
+		{
+			module:   "github.com/anchore/sbom-action",
+			noProxy:  "*/anchore/*",
+			expected: directProxy,
+		},
+		{
+			module:   "github.com/anchore/sbom-action",
+			noProxy:  "*/user/mod,*/anchore/sbom-action",
+			expected: directProxy,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.module, func(t *testing.T) {
+			got := remotesForModule(allProxies, strings.Split(test.noProxy, ","), test.module)
+			require.Equal(t, test.expected, got)
+		})
+	}
+}
+
+func Test_findVersionPath(t *testing.T) {
+	f := os.DirFS("test-fixtures/zip-fs")
+	vp := findVersionPath(f, ".")
+	require.Equal(t, "github.com/someorg/somepkg@version", vp)
+}