Add release process (#89)

* add check for app update; fix ETUI error handling * validate user args * add goreleaser support * replace cgo dependencies (go-rpm) with go equivalents * add acceptance tests against build snapshot * add brew tap + acceptance test pipeline * add mac acceptance tests * fix compare makefile * fix mac acceptance tests * add release pipeline with wait checks * add token to release step * rm dir presenters int test * enforce dpkg to be non interactive Co-authored-by: Alfredo Deza <adeza@anchore.com> * pin brew formulae * pin skopeo to formulae url * only run acceptance tests Co-authored-by: Alfredo Deza <adeza@anchore.com>
2026-11-01 15:06:36 +01:00 · 2020-07-23 10:52:44 -04:00
parent 3cb7c43dbc
commit ba4f63099d
49 changed files with 952 additions and 57 deletions
@@ -0,0 +1,109 @@
+#!/usr/bin/env python3
+import sys
+import json
+import collections
+
+Metadata = collections.namedtuple("Metadata", "metadata sources")
+Package = collections.namedtuple("Package", "name type version")
+Vulnerability = collections.namedtuple("Vulnerability", "cve package")
+
+
+class ImgBom:
+    def __init__(self, report_path):
+        self.report_path = report_path
+
+    def _enumerate_section(self, section):
+        with open(self.report_path) as json_file:
+            data = json.load(json_file)
+            for entry in data[section]:
+                yield entry
+
+    def packages(self):
+        packages = set()
+        metadata = collections.defaultdict(dict)
+        for entry in self._enumerate_section(section="artifacts"):
+            package = Package(
+                name=entry["name"], type=entry["type"], version=entry["version"]
+            )
+
+            packages.add(package)
+            metadata[package.type][package] = Metadata(
+                metadata=repr(entry["metadata"]), sources=repr(entry["sources"])
+            )
+        return packages, metadata
+
+
+def main(baseline_report, new_report):
+    report1_obj = ImgBom(report_path=baseline_report)
+    report1_packages, report1_metadata = report1_obj.packages()
+
+    report2_obj = ImgBom(report_path=new_report)
+    report2_packages, report2_metadata = report2_obj.packages()
+
+    if len(report2_packages) == 0 and len(report1_packages) == 0:
+        print("nobody found any packages")
+        return 0
+
+    same_packages = report2_packages & report1_packages
+    percent_overlap_packages = (
+        float(len(same_packages)) / float(len(report1_packages))
+    ) * 100.0
+
+    extra_packages = report2_packages - report1_packages
+    missing_pacakges = report1_packages - report2_packages
+
+    report1_metadata_set = set()
+    for package in report1_packages:
+        metadata = report1_metadata[package.type][package]
+        report1_metadata_set.add((package, metadata))
+
+    report2_metadata_set = set()
+    for package in report2_packages:
+        metadata = report2_metadata[package.type][package]
+        report2_metadata_set.add((package, metadata))
+
+    same_metadata = report2_metadata_set & report1_metadata_set
+    percent_overlap_metadata = 0
+    if len(report1_metadata_set) > 0:
+        percent_overlap_metadata = (
+            float(len(same_metadata)) / float(len(report1_metadata_set))
+        ) * 100.0
+
+    if len(extra_packages) > 0:
+        print("Extra packages:")
+        for package in sorted(list(extra_packages)):
+            print("    " + repr(package))
+        print()
+
+    if len(missing_pacakges) > 0:
+        print("Missing packages:")
+        for package in sorted(list(missing_pacakges)):
+            print("    " + repr(package))
+        print()
+
+    print("Baseline Packages: %d" % len(report1_packages))
+    print("New Packages:      %d" % len(report2_packages))
+    print()
+    print(
+        "Baseline Packages Matched: %.2f %% (%d/%d packages)"
+        % (percent_overlap_packages, len(same_packages), len(report1_packages))
+    )
+    print(
+        "Baseline Metadata Matched: %.2f %% (%d/%d metadata)"
+        % (percent_overlap_metadata, len(same_metadata), len(report1_metadata_set))
+    )
+
+    if len(report1_packages) != len(report2_packages):
+        print("failed quality gate: requires exact name & version match")
+        return 1
+
+    return 0
+
+
+if __name__ == "__main__":
+    print("\nComparing two imgbom reports...\n")
+    if len(sys.argv) != 3:
+        sys.exit("please provide two imgbom json files")
+
+    rc = main(sys.argv[1], sys.argv[2])
+    sys.exit(rc)
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -eu
+
+BOLD="$(tput -T linux bold)"
+RED="$(tput -T linux setaf 1)"
+RESET="$(tput -T linux sgr0)"
+FAIL="${BOLD}${RED}"
+SUCCESS="${BOLD}"
+JQ_ARGS="-S .artifacts"
+
+if ! command -v jq &> /dev/null ;then
+    JQ_IMAGE="imega/jq:latest"
+    JQ_CMD="docker run --rm -i ${JQ_IMAGE} ${JQ_ARGS}"
+    docker pull "${JQ_IMAGE}"
+else
+    JQ_CMD="jq ${JQ_ARGS}"
+fi
+
+if [[ $(cat $1 | ${JQ_CMD}) ]]; then
+    set -x
+    # compare the output of both results
+    diff <(cat $1 | ${JQ_CMD}) <(cat $2 | ${JQ_CMD})
+    set +x
+    echo "${SUCCESS}Comparison passed!${RESET}"
+else
+    exit "${FAIL}Failing since one of the test files is empty ($1)${RESET}"
+fi
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+set -eux
+
+DISTDIR=$1
+ACC_DIR=$2
+TEST_IMAGE=$3
+
+TEST_TYPE=deb
+WORK_DIR=`mktemp -d -t "imgbom-acceptance-test-${TEST_TYPE}-XXXXXX"`
+REPORT=${WORK_DIR}/acceptance-${TEST_TYPE}-${TEST_IMAGE}.json
+GOLDEN_REPORT=${ACC_DIR}/test-fixtures/acceptance-${TEST_IMAGE}.json
+
+# check if tmp dir was created
+if [[ ! "${WORK_DIR}" || ! -d "${WORK_DIR}" ]]; then
+  echo "Could not create temp dir"
+  exit 1
+fi
+
+function cleanup {
+  rm -rf "${WORK_DIR}"
+}
+
+trap cleanup EXIT
+
+# fetch test image
+docker pull ${TEST_IMAGE}
+
+# install and run imgbom
+docker run --rm \
+    -v /var/run/docker.sock://var/run/docker.sock \
+    -v /${PWD}:/src \
+    -v ${WORK_DIR}:${WORK_DIR} \
+    -w /src \
+    ubuntu:latest \
+        /bin/bash -x -c "\
+            DEBIAN_FRONTEND=noninteractive apt install ${DISTDIR}/imgbom_*_linux_amd64.deb -y && \
+            imgbom version -v && \
+            imgbom ${TEST_IMAGE} -vv -o json > ${REPORT} && \
+            cat ${REPORT} \
+        "
+
+# compare the results to a known good output
+${ACC_DIR}/compare.py \
+    ${GOLDEN_REPORT} \
+    ${REPORT}
@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+set -eux
+
+DISTDIR=$1
+ACC_DIR=$2
+TEST_IMAGE=$3
+
+TEST_IMAGE_TAR=/tmp/image.tar
+TEST_TYPE=mac
+WORK_DIR=`mktemp -d -t "imgbom-acceptance-test-${TEST_TYPE}-XXXXXX"`
+REPORT=${WORK_DIR}/acceptance-${TEST_TYPE}-${TEST_IMAGE}.json
+GOLDEN_REPORT=${ACC_DIR}/test-fixtures/acceptance-${TEST_IMAGE}.json
+
+# check if tmp dir was created
+if [[ ! "${WORK_DIR}" || ! -d "${WORK_DIR}" ]]; then
+  echo "Could not create temp dir"
+  exit 1
+fi
+
+function cleanup {
+  rm -rf "${WORK_DIR}"
+}
+
+trap cleanup EXIT
+
+# install skopeo (pinned to 1.1.0)
+skopeo --version || brew install https://raw.githubusercontent.com/Homebrew/homebrew-core/75e8d7a40af77b48cc91f4bdb7d669f891a6de60/Formula/skopeo.rb
+
+# fetch test image
+skopeo --override-os linux copy docker://docker.io/${TEST_IMAGE} docker-archive:${TEST_IMAGE_TAR}
+ls -alh ${TEST_IMAGE_TAR}
+
+# run imgbom
+chmod 755 ${DISTDIR}/imgbom_darwin_amd64/imgbom
+${DISTDIR}/imgbom_darwin_amd64/imgbom version -v
+${DISTDIR}/imgbom_darwin_amd64/imgbom docker-archive://${TEST_IMAGE_TAR} -vv -o json > ${REPORT}
+cat ${REPORT}
+
+# compare the results to a known good output
+${ACC_DIR}/compare.py \
+    ${GOLDEN_REPORT} \
+    ${REPORT}
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+set -eux
+
+DISTDIR=$1
+ACC_DIR=$2
+TEST_IMAGE=$3
+
+TEST_TYPE=rpm
+WORK_DIR=`mktemp -d -t "imgbom-acceptance-test-${TEST_TYPE}-XXXXXX"`
+REPORT=${WORK_DIR}/acceptance-${TEST_TYPE}-${TEST_IMAGE}.json
+GOLDEN_REPORT=${ACC_DIR}/test-fixtures/acceptance-${TEST_IMAGE}.json
+
+# check if tmp dir was created
+if [[ ! "${WORK_DIR}" || ! -d "${WORK_DIR}" ]]; then
+  echo "Could not create temp dir"
+  exit 1
+fi
+
+function cleanup {
+  rm -rf "${WORK_DIR}"
+}
+
+trap cleanup EXIT
+
+# fetch test image
+docker pull ${TEST_IMAGE}
+
+# install and run imgbom
+docker run --rm \
+    -v /var/run/docker.sock://var/run/docker.sock \
+    -v /${PWD}:/src \
+    -v ${WORK_DIR}:${WORK_DIR} \
+    -w /src \
+    centos:latest \
+        /bin/bash -x -c "\
+            rpm -ivh ${DISTDIR}/imgbom_*_linux_amd64.rpm && \
+            imgbom version -v && \
+            imgbom ${TEST_IMAGE} -vv -o json > ${REPORT} && \
+            cat ${REPORT} \
+        "
+
+# compare the results to a known good output
+${ACC_DIR}/compare.py \
+    ${GOLDEN_REPORT} \
+    ${REPORT}
@@ -0,0 +1,2 @@
+*.json
+inline-reports
@@ -0,0 +1,7 @@
+FROM python:3
+
+WORKDIR /
+COPY imgbom-reports /imgbom-reports
+COPY inline-reports /inline-reports
+COPY compare.py .
+ENTRYPOINT ["/compare.py"]
@@ -0,0 +1,39 @@
+IMAGE = "centos:8"
+IMAGE_CLEAN = $(shell echo $(IMAGE) | tr ":" "_")
+IMGBOM_DIR = imgbom-reports
+IMGBOM_REPORT = $(IMGBOM_DIR)/$(IMAGE_CLEAN).json
+INLINE_DIR = inline-reports
+INLINE_REPORT = $(INLINE_DIR)/$(IMAGE_CLEAN)-content-os.json
+
+ifndef IMGBOM_DIR
+	$(error IMGBOM_DIR is not set)
+endif
+
+ifndef INLINE_DIR
+	$(error INLINE_DIR is not set)
+endif
+
+.PHONY: all
+all: compare
+
+.PHONY: compare
+compare: $(INLINE_REPORT) $(IMGBOM_REPORT)
+	docker build -t compare-imgbom:latest .
+	docker run compare-imgbom:latest $(IMAGE)
+
+$(INLINE_REPORT):
+	echo "Creating $(INLINE_REPORT)..."
+	mkdir -p $(INLINE_DIR)
+	curl -s https://ci-tools.anchore.io/inline_scan-v0.7.0 | bash -s -- -p -r $(IMAGE)
+	mv anchore-reports/* $(INLINE_DIR)/
+	rmdir anchore-reports
+
+$(IMGBOM_REPORT):
+	echo "Creating $(IMGBOM_REPORT)..."
+	mkdir -p $(IMGBOM_DIR)
+	docker pull $(IMAGE)
+	go run ../../main.go $(IMAGE) -o json > $(IMGBOM_REPORT)
+
+.PHONY: clean
+clean:
+	rm -f $(INLINE_DIR)/*  $(IMGBOM_DIR)/*
@@ -0,0 +1,173 @@
+#!/usr/bin/env python3
+import os
+import sys
+import json
+import functools
+import collections
+
+QUALITY_GATE_THRESHOLD = 0.9
+
+Metadata = collections.namedtuple("Metadata", "version")
+Package = collections.namedtuple("Package", "name type")
+Vulnerability = collections.namedtuple("Vulnerability", "cve package")
+
+
+class InlineScan:
+
+    report_tmpl = "{image}-{report}.json"
+
+    def __init__(self, image, report_dir="./"):
+        self.report_dir = report_dir
+        self.image = image
+
+    def packages(self):
+        python_packages, python_metadata = self._python_packages()
+        os_pacakges, os_metadata = self._os_packages()
+        return python_packages | os_pacakges, {**python_metadata, **os_metadata}
+
+    def _report_path(self, report):
+        return os.path.join(
+            self.report_dir,
+            self.report_tmpl.format(image=self.image.replace(":", "_"), report=report),
+        )
+
+    def _enumerate_section(self, report, section):
+        report_path = self._report_path(report=report)
+        with open(report_path) as json_file:
+            data = json.load(json_file)
+            for entry in data[section]:
+                yield entry
+
+    @functools.lru_cache
+    def _python_packages(self):
+        packages = set()
+        metadata = collections.defaultdict(dict)
+        for entry in self._enumerate_section(
+            report="content-python", section="content"
+        ):
+            package = Package(name=entry["package"], type=entry["type"].lower(),)
+            packages.add(package)
+            metadata[package.type][package] = Metadata(version=entry["version"])
+
+        return packages, metadata
+
+    @functools.lru_cache
+    def _os_packages(self):
+        packages = set()
+        metadata = collections.defaultdict(dict)
+        for entry in self._enumerate_section(report="content-os", section="content"):
+            package = Package(name=entry["package"], type=entry["type"].lower())
+            packages.add(package)
+            metadata[package.type][package] = Metadata(version=entry["version"])
+
+        return packages, metadata
+
+
+class ImgBom:
+
+    report_tmpl = "{image}.json"
+
+    def __init__(self, image, report_dir="./"):
+        self.report_path = os.path.join(
+            report_dir, self.report_tmpl.format(image=image.replace(":", "_"))
+        )
+
+    def _enumerate_section(self, section):
+        with open(self.report_path) as json_file:
+            data = json.load(json_file)
+            for entry in data[section]:
+                yield entry
+
+    @functools.lru_cache
+    def packages(self):
+        packages = set()
+        metadata = collections.defaultdict(dict)
+        for entry in self._enumerate_section(section="artifacts"):
+
+            # normalize to inline
+            pType = entry["type"].lower()
+            if pType in ("wheel", "egg"):
+                pType = "python"
+
+            package = Package(name=entry["name"], type=pType,)
+
+            packages.add(package)
+            metadata[package.type][package] = Metadata(version=entry["version"])
+        return packages, metadata
+
+
+def main(image):
+    inline = InlineScan(image=image, report_dir="inline-reports")
+    inline_packages, inline_metadata = inline.packages()
+
+    imgbom = ImgBom(image=image, report_dir="imgbom-reports")
+    imgbom_packages, imgbom_metadata = imgbom.packages()
+
+    if len(imgbom_packages) == 0 and len(inline_packages) == 0:
+        print("nobody found any packages")
+        return 0
+
+    same_packages = imgbom_packages & inline_packages
+    percent_overlap_packages = (
+        float(len(same_packages)) / float(len(inline_packages))
+    ) * 100.0
+
+    bonus_packages = imgbom_packages - inline_packages
+    missing_pacakges = inline_packages - imgbom_packages
+
+    inline_metadata_set = set()
+    for package in inline_packages:
+        metadata = inline_metadata[package.type][package]
+        inline_metadata_set.add((package, metadata))
+
+    imgbom_metadata_set = set()
+    for package in imgbom_packages:
+        metadata = imgbom_metadata[package.type][package]
+        imgbom_metadata_set.add((package, metadata))
+
+    same_metadata = imgbom_metadata_set & inline_metadata_set
+    percent_overlap_metadata = (
+        float(len(same_metadata)) / float(len(inline_metadata_set))
+    ) * 100.0
+
+    if len(bonus_packages) > 0:
+        print("Imgbom Bonus packages:")
+        for package in sorted(list(bonus_packages)):
+            print("    " + repr(package))
+        print()
+
+    if len(missing_pacakges) > 0:
+        print("Imgbom Missing packages:")
+        for package in sorted(list(missing_pacakges)):
+            print("    " + repr(package))
+        print()
+
+    print("Inline Packages: %d" % len(inline_packages))
+    print("Imgbom Packages: %d" % len(imgbom_packages))
+    print()
+    print(
+        "Baseline Packages Matched: %2.3f %% (%d/%d packages)"
+        % (percent_overlap_packages, len(same_packages), len(inline_packages))
+    )
+    print(
+        "Baseline Metadata Matched: %2.3f %% (%d/%d metadata)"
+        % (percent_overlap_metadata, len(same_metadata), len(inline_metadata_set))
+    )
+
+    overall_score = (percent_overlap_packages + percent_overlap_metadata) / 2.0
+
+    print("Overall Score: %2.3f %%" % overall_score)
+
+    if overall_score < (QUALITY_GATE_THRESHOLD * 100):
+        print("failed quality gate (>= %d %%)" % (QUALITY_GATE_THRESHOLD * 100))
+        return 1
+
+    return 0
+
+
+if __name__ == "__main__":
+    if len(sys.argv) != 2:
+        sys.exit("provide an image")
+
+    rc = main(sys.argv[1])
+    sys.exit(rc)
@@ -0,0 +1,42 @@
+// +build integration
+
+package integration
+
+import (
+	"testing"
+
+	"github.com/anchore/imgbom/imgbom"
+
+	"github.com/anchore/go-testutils"
+	"github.com/anchore/imgbom/imgbom/distro"
+	"github.com/anchore/imgbom/imgbom/scope"
+	"github.com/go-test/deep"
+)
+
+func TestDistroImage(t *testing.T) {
+	fixtureImageName := "image-distro-id"
+	_, cleanup := testutils.GetFixtureImage(t, "docker-archive", fixtureImageName)
+	tarPath := testutils.GetFixtureImageTarPath(t, fixtureImageName)
+	defer cleanup()
+
+	_, _, actualDistro, err := imgbom.Catalog("docker-archive://"+tarPath, scope.AllLayersScope)
+	if err != nil {
+		t.Fatalf("failed to catalog image: %+v", err)
+	}
+	if actualDistro == nil {
+		t.Fatalf("could not find distro")
+	}
+
+	expected, err := distro.NewDistro(distro.Busybox, "1.31.1")
+	if err != nil {
+		t.Fatalf("could not create distro: %+v", err)
+	}
+
+	diffs := deep.Equal(*actualDistro, expected)
+	if len(diffs) != 0 {
+		for _, d := range diffs {
+			t.Errorf("found distro difference: %+v", d)
+		}
+	}
+
+}
@@ -0,0 +1,300 @@
+// +build integration
+
+package integration
+
+import (
+	"testing"
+
+	"github.com/anchore/imgbom/imgbom"
+
+	"github.com/anchore/imgbom/internal"
+
+	"github.com/anchore/go-testutils"
+	"github.com/anchore/imgbom/imgbom/pkg"
+	"github.com/anchore/imgbom/imgbom/scope"
+)
+
+var cases = []struct {
+	name        string
+	pkgType     pkg.Type
+	pkgLanguage pkg.Language
+	pkgInfo     map[string]string
+}{
+	{
+		name:    "find rpmdb packages",
+		pkgType: pkg.RpmPkg,
+		pkgInfo: map[string]string{
+			"dive": "0.9.2",
+		},
+	},
+	{
+		name:    "find dpkg packages",
+		pkgType: pkg.DebPkg,
+		pkgInfo: map[string]string{
+			"apt": "1.8.2",
+		},
+	},
+	{
+		name:        "find java packages",
+		pkgType:     pkg.JavaPkg,
+		pkgLanguage: pkg.Java,
+		pkgInfo: map[string]string{
+			"example-java-app-maven": "0.1.0",
+			"example-jenkins-plugin": "1.0-SNAPSHOT", // the jenkins HPI file has a nested JAR of the same name
+		},
+	},
+	{
+		name:        "find jenkins plugins",
+		pkgType:     pkg.JenkinsPluginPkg,
+		pkgLanguage: pkg.Java,
+		pkgInfo: map[string]string{
+			"example-jenkins-plugin": "1.0-SNAPSHOT",
+		},
+	},
+	{
+		name:        "find python wheel packages",
+		pkgType:     pkg.WheelPkg,
+		pkgLanguage: pkg.Python,
+		pkgInfo: map[string]string{
+			"Pygments": "2.6.1",
+		},
+	},
+	{
+		name:        "find javascript npm packages",
+		pkgType:     pkg.NpmPkg,
+		pkgLanguage: pkg.JavaScript,
+		pkgInfo: map[string]string{
+			"get-stdin": "8.0.0",
+		},
+	},
+	{
+		name:        "find python egg packages",
+		pkgType:     pkg.EggPkg,
+		pkgLanguage: pkg.Python,
+		pkgInfo: map[string]string{
+			"requests": "2.22.0",
+		},
+	},
+	{
+		name:        "find python packages",
+		pkgType:     pkg.PythonRequirementsPkg,
+		pkgLanguage: pkg.Python,
+		pkgInfo: map[string]string{
+			"flask": "4.0.0",
+		},
+	},
+	{
+		name:        "find bundler packages",
+		pkgType:     pkg.BundlerPkg,
+		pkgLanguage: pkg.Ruby,
+		pkgInfo: map[string]string{
+			"actionmailer":         "4.1.1",
+			"actionpack":           "4.1.1",
+			"actionview":           "4.1.1",
+			"activemodel":          "4.1.1",
+			"activerecord":         "4.1.1",
+			"activesupport":        "4.1.1",
+			"arel":                 "5.0.1.20140414130214",
+			"bootstrap-sass":       "3.1.1.1",
+			"builder":              "3.2.2",
+			"coffee-rails":         "4.0.1",
+			"coffee-script":        "2.2.0",
+			"coffee-script-source": "1.7.0",
+			"erubis":               "2.7.0",
+			"execjs":               "2.0.2",
+			"hike":                 "1.2.3",
+			"i18n":                 "0.6.9",
+			"jbuilder":             "2.0.7",
+			"jquery-rails":         "3.1.0",
+			"json":                 "1.8.1",
+			"kgio":                 "2.9.2",
+			"libv8":                "3.16.14.3",
+			"mail":                 "2.5.4",
+			"mime-types":           "1.25.1",
+			"minitest":             "5.3.4",
+			"multi_json":           "1.10.1",
+			"mysql2":               "0.3.16",
+			"polyglot":             "0.3.4",
+			"rack":                 "1.5.2",
+			"rack-test":            "0.6.2",
+			"rails":                "4.1.1",
+			"railties":             "4.1.1",
+			"raindrops":            "0.13.0",
+			"rake":                 "10.3.2",
+			"rdoc":                 "4.1.1",
+			"ref":                  "1.0.5",
+			"sass":                 "3.2.19",
+			"sass-rails":           "4.0.3",
+			"sdoc":                 "0.4.0",
+			"spring":               "1.1.3",
+			"sprockets":            "2.11.0",
+			"sprockets-rails":      "2.1.3",
+			"sqlite3":              "1.3.9",
+			"therubyracer":         "0.12.1",
+			"thor":                 "0.19.1",
+			"thread_safe":          "0.3.3",
+			"tilt":                 "1.4.1",
+			"treetop":              "1.4.15",
+			"turbolinks":           "2.2.2",
+			"tzinfo":               "1.2.0",
+			"uglifier":             "2.5.0",
+			"unicorn":              "4.8.3",
+		},
+	},
+	{
+		name:        "find golang modules",
+		pkgType:     pkg.GoModulePkg,
+		pkgLanguage: pkg.Go,
+		pkgInfo: map[string]string{
+			"github.com/bmatcuk/doublestar": "v1.3.1",
+		},
+	},
+}
+
+func TestPkgCoverageImage(t *testing.T) {
+	fixtureImageName := "image-pkg-coverage"
+	_, cleanup := testutils.GetFixtureImage(t, "docker-archive", fixtureImageName)
+	tarPath := testutils.GetFixtureImageTarPath(t, fixtureImageName)
+	defer cleanup()
+
+	catalog, _, _, err := imgbom.Catalog("docker-archive://"+tarPath, scope.AllLayersScope)
+	if err != nil {
+		t.Fatalf("failed to catalog image: %+v", err)
+	}
+
+	observedLanguages := internal.NewStringSet()
+	definedLanguages := internal.NewStringSet()
+	for _, l := range pkg.AllLanguages {
+		definedLanguages.Add(l.String())
+	}
+
+	observedPkgs := internal.NewStringSet()
+	definedPkgs := internal.NewStringSet()
+	for _, p := range pkg.AllPkgs {
+		definedPkgs.Add(p.String())
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			pkgCount := 0
+
+			for a := range catalog.Enumerate(c.pkgType) {
+
+				observedLanguages.Add(a.Language.String())
+				observedPkgs.Add(a.Type.String())
+
+				expectedVersion, ok := c.pkgInfo[a.Name]
+				if !ok {
+					t.Errorf("unexpected package found: %s", a.Name)
+				}
+
+				if expectedVersion != a.Version {
+					t.Errorf("unexpected package version (pkg=%s): %s, expected: %s", a.Name, a.Version, expectedVersion)
+				}
+
+				if a.Language != c.pkgLanguage {
+					t.Errorf("bad language (pkg=%+v): %+v", a.Name, a.Language)
+				}
+
+				if a.Type != c.pkgType {
+					t.Errorf("bad package type (pkg=%+v): %+v", a.Name, a.Type)
+				}
+				pkgCount++
+			}
+
+			if pkgCount != len(c.pkgInfo) {
+				for a := range catalog.Enumerate(c.pkgType) {
+					t.Log("   ", a)
+				}
+				t.Fatalf("unexpected package count: %d!=%d", pkgCount, len(c.pkgInfo))
+			}
+
+		})
+	}
+
+	observedLanguages.Remove(pkg.UnknownLanguage.String())
+	definedLanguages.Remove(pkg.UnknownLanguage.String())
+	observedPkgs.Remove(pkg.UnknownPkg.String())
+	definedPkgs.Remove(pkg.UnknownPkg.String())
+
+	// ensure that integration test cases stay in sync with the available catalogers
+	if len(observedLanguages) < len(definedLanguages) {
+		t.Errorf("language coverage incomplete (languages=%d, coverage=%d)", len(definedLanguages), len(observedLanguages))
+	}
+
+	if len(observedPkgs) < len(definedPkgs) {
+		t.Errorf("package coverage incomplete (packages=%d, coverage=%d)", len(definedPkgs), len(observedPkgs))
+	}
+}
+
+func TestPkgCoverageDirectory(t *testing.T) {
+	catalog, _, _, err := imgbom.Catalog("dir://test-fixtures/image-pkg-coverage", scope.AllLayersScope)
+
+	if err != nil {
+		t.Errorf("unable to create scope from dir: %+v", err)
+	}
+
+	observedLanguages := internal.NewStringSet()
+	definedLanguages := internal.NewStringSet()
+	for _, l := range pkg.AllLanguages {
+		definedLanguages.Add(l.String())
+	}
+
+	observedPkgs := internal.NewStringSet()
+	definedPkgs := internal.NewStringSet()
+	for _, p := range pkg.AllPkgs {
+		definedPkgs.Add(p.String())
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			pkgCount := 0
+
+			for a := range catalog.Enumerate(c.pkgType) {
+
+				observedLanguages.Add(a.Language.String())
+				observedPkgs.Add(a.Type.String())
+
+				expectedVersion, ok := c.pkgInfo[a.Name]
+				if !ok {
+					t.Errorf("unexpected package found: %s", a.Name)
+				}
+
+				if expectedVersion != a.Version {
+					t.Errorf("unexpected package version (pkg=%s): %s", a.Name, a.Version)
+				}
+
+				if a.Language != c.pkgLanguage {
+					t.Errorf("bad language (pkg=%+v): %+v", a.Name, a.Language)
+				}
+
+				if a.Type != c.pkgType {
+					t.Errorf("bad package type (pkg=%+v): %+v", a.Name, a.Type)
+				}
+				pkgCount++
+			}
+
+			if pkgCount != len(c.pkgInfo) {
+				for a := range catalog.Enumerate(c.pkgType) {
+					t.Log("   ", a)
+				}
+				t.Fatalf("unexpected package count: %d!=%d", pkgCount, len(c.pkgInfo))
+			}
+
+		})
+	}
+
+	observedLanguages.Remove(pkg.UnknownLanguage.String())
+	definedLanguages.Remove(pkg.UnknownLanguage.String())
+	observedPkgs.Remove(pkg.UnknownPkg.String())
+	definedPkgs.Remove(pkg.UnknownPkg.String())
+
+	// ensure that integration test cases stay in sync with the available catalogers
+	if len(observedLanguages) < len(definedLanguages) {
+		t.Errorf("language coverage incomplete (languages=%d, coverage=%d)", len(definedLanguages), len(observedLanguages))
+	}
+
+	if len(observedPkgs) < len(definedPkgs) {
+		t.Errorf("package coverage incomplete (packages=%d, coverage=%d)", len(definedPkgs), len(observedPkgs))
+	}
+}
@@ -0,0 +1,7 @@
+# we should strive to not commit blobs to the repo and strive to keep the build process of how blobs are acquired in-repo.
+# this blob is generated from imgbom/imgbom/catalogers/java/test-fixtures/java-builds , however, preserving the build process
+# twice in the repo seems redundant (even via symlink). Given that the fixture is a few kilobytes in size, the build process is already
+# captured, and integration tests should only be testing if jars can be discovered (not necessarily depth in java detection
+# functionality), committing it seems like an acceptable exception.
+!image-pkg-coverage/java/*.jar
+!image-pkg-coverage/java/*.hpi
@@ -0,0 +1,3 @@
+FROM busybox:1.31.1
+
+
@@ -0,0 +1,2 @@
+FROM scratch
+COPY . .
@@ -0,0 +1,7 @@
+module github.com/anchore/imgbom
+
+go 1.14
+
+require (
+	github.com/bmatcuk/doublestar v1.3.1
+)
@@ -0,0 +1 @@
+See the imgbom/cataloger/java/test-fixtures/java-builds dir to generate test fixtures and copy to here manually.
@@ -0,0 +1,11 @@
+{
+  "requires": true,
+  "lockfileVersion": 1,
+  "dependencies": {
+    "get-stdin": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/get-stdin/-/get-stdin-8.0.0.tgz",
+      "integrity": "sha512-sY22aA6xchAzprjyqmSEQv4UbAAzRN0L2dQB0NlN5acTTK9Don6nhoc3eAbUnpZiCANAMfd/+40kVdKfFygohg=="
+    }
+  }
+}
@@ -0,0 +1,47 @@
+Metadata-Version: 2.1
+Name: Pygments
+Version: 2.6.1
+Summary: Pygments is a syntax highlighting package written in Python.
+Home-page: https://pygments.org/
+Author: Georg Brandl
+Author-email: georg@python.org
+License: BSD License
+Keywords: syntax highlighting
+Platform: any
+Classifier: License :: OSI Approved :: BSD License
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: End Users/Desktop
+Classifier: Intended Audience :: System Administrators
+Classifier: Development Status :: 6 - Mature
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.5
+Classifier: Programming Language :: Python :: 3.6
+Classifier: Programming Language :: Python :: 3.7
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: Implementation :: CPython
+Classifier: Programming Language :: Python :: Implementation :: PyPy
+Classifier: Operating System :: OS Independent
+Classifier: Topic :: Text Processing :: Filters
+Classifier: Topic :: Utilities
+Requires-Python: >=3.5
+
+
+Pygments
+~~~~~~~~
+
+Pygments is a syntax highlighting package written in Python.
+
+It is a generic syntax highlighter suitable for use in code hosting, forums,
+wikis or other applications that need to prettify source code.  Highlights
+are:
+
+* a wide range of over 500 languages and other text formats is supported
+* special attention is paid to details, increasing quality by a fair amount
+* support for new languages and formats are added easily
+* a number of output formats, presently HTML, LaTeX, RTF, SVG, all image     formats that PIL supports and ANSI sequences
+* it is usable as a command-line tool and as a library
+
+:copyright: Copyright 2006-2019 by the Pygments team, see AUTHORS.
+:license: BSD, see LICENSE for details.
+
@@ -0,0 +1,134 @@
+Metadata-Version: 2.1
+Name: requests
+Version: 2.22.0
+Summary: Python HTTP for Humans.
+Home-page: http://python-requests.org
+Author: Kenneth Reitz
+Author-email: me@kennethreitz.org
+License: Apache 2.0
+Description: Requests: HTTP for Humans™
+        ==========================
+        
+        [![image](https://img.shields.io/pypi/v/requests.svg)](https://pypi.org/project/requests/)
+        [![image](https://img.shields.io/pypi/l/requests.svg)](https://pypi.org/project/requests/)
+        [![image](https://img.shields.io/pypi/pyversions/requests.svg)](https://pypi.org/project/requests/)
+        [![codecov.io](https://codecov.io/github/requests/requests/coverage.svg?branch=master)](https://codecov.io/github/requests/requests)
+        [![image](https://img.shields.io/github/contributors/requests/requests.svg)](https://github.com/requests/requests/graphs/contributors)
+        [![image](https://img.shields.io/badge/Say%20Thanks-!-1EAEDB.svg)](https://saythanks.io/to/kennethreitz)
+        
+        Requests is the only *Non-GMO* HTTP library for Python, safe for human
+        consumption.
+        
+        ![image](https://farm5.staticflickr.com/4317/35198386374_1939af3de6_k_d.jpg)
+        
+        Behold, the power of Requests:
+        
+        ``` {.sourceCode .python}
+        >>> import requests
+        >>> r = requests.get('https://api.github.com/user', auth=('user', 'pass'))
+        >>> r.status_code
+        200
+        >>> r.headers['content-type']
+        'application/json; charset=utf8'
+        >>> r.encoding
+        'utf-8'
+        >>> r.text
+        u'{"type":"User"...'
+        >>> r.json()
+        {u'disk_usage': 368627, u'private_gists': 484, ...}
+        ```
+        
+        See [the similar code, sans Requests](https://gist.github.com/973705).
+        
+        [![image](https://raw.githubusercontent.com/requests/requests/master/docs/_static/requests-logo-small.png)](http://docs.python-requests.org/)
+        
+        Requests allows you to send *organic, grass-fed* HTTP/1.1 requests,
+        without the need for manual labor. There's no need to manually add query
+        strings to your URLs, or to form-encode your POST data. Keep-alive and
+        HTTP connection pooling are 100% automatic, thanks to
+        [urllib3](https://github.com/shazow/urllib3).
+        
+        Besides, all the cool kids are doing it. Requests is one of the most
+        downloaded Python packages of all time, pulling in over 11,000,000
+        downloads every month. You don't want to be left out!
+        
+        Feature Support
+        ---------------
+        
+        Requests is ready for today's web.
+        
+        -   International Domains and URLs
+        -   Keep-Alive & Connection Pooling
+        -   Sessions with Cookie Persistence
+        -   Browser-style SSL Verification
+        -   Basic/Digest Authentication
+        -   Elegant Key/Value Cookies
+        -   Automatic Decompression
+        -   Automatic Content Decoding
+        -   Unicode Response Bodies
+        -   Multipart File Uploads
+        -   HTTP(S) Proxy Support
+        -   Connection Timeouts
+        -   Streaming Downloads
+        -   `.netrc` Support
+        -   Chunked Requests
+        
+        Requests officially supports Python 2.7 & 3.4–3.7, and runs great on
+        PyPy.
+        
+        Installation
+        ------------
+        
+        To install Requests, simply use [pipenv](http://pipenv.org/) (or pip, of
+        course):
+        
+        ``` {.sourceCode .bash}
+        $ pipenv install requests
+        ✨🍰✨
+        ```
+        
+        Satisfaction guaranteed.
+        
+        Documentation
+        -------------
+        
+        Fantastic documentation is available at
+        <http://docs.python-requests.org/>, for a limited time only.
+        
+        How to Contribute
+        -----------------
+        
+        1.  Become more familiar with the project by reading our [Contributor's Guide](http://docs.python-requests.org/en/latest/dev/contributing/) and our [development philosophy](http://docs.python-requests.org/en/latest/dev/philosophy/).
+        2.  Check for open issues or open a fresh issue to start a discussion
+            around a feature idea or a bug. There is a [Contributor
+            Friendly](https://github.com/requests/requests/issues?direction=desc&labels=Contributor+Friendly&page=1&sort=updated&state=open)
+            tag for issues that should be ideal for people who are not very
+            familiar with the codebase yet.
+        3.  Fork [the repository](https://github.com/requests/requests) on
+            GitHub to start making your changes to the **master** branch (or
+            branch off of it).
+        4.  Write a test which shows that the bug was fixed or that the feature
+            works as expected.
+        5.  Send a pull request and bug the maintainer until it gets merged and
+            published. :) Make sure to add yourself to
+            [AUTHORS](https://github.com/requests/requests/blob/master/AUTHORS.rst).
+        
+        
+Platform: UNKNOWN
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Classifier: Natural Language :: English
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 2
+Classifier: Programming Language :: Python :: 2.7
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.5
+Classifier: Programming Language :: Python :: 3.6
+Classifier: Programming Language :: Python :: 3.7
+Classifier: Programming Language :: Python :: Implementation :: CPython
+Classifier: Programming Language :: Python :: Implementation :: PyPy
+Requires-Python: >=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*
+Description-Content-Type: text/markdown
+Provides-Extra: security
+Provides-Extra: socks
@@ -0,0 +1,3 @@
+flask==4.0.0
+# this is an ignored line
+
@@ -0,0 +1,149 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    actionmailer (4.1.1)
+      actionpack (= 4.1.1)
+      actionview (= 4.1.1)
+      mail (~> 2.5.4)
+    actionpack (4.1.1)
+      actionview (= 4.1.1)
+      activesupport (= 4.1.1)
+      rack (~> 1.5.2)
+      rack-test (~> 0.6.2)
+    actionview (4.1.1)
+      activesupport (= 4.1.1)
+      builder (~> 3.1)
+      erubis (~> 2.7.0)
+    activemodel (4.1.1)
+      activesupport (= 4.1.1)
+      builder (~> 3.1)
+    activerecord (4.1.1)
+      activemodel (= 4.1.1)
+      activesupport (= 4.1.1)
+      arel (~> 5.0.0)
+    activesupport (4.1.1)
+      i18n (~> 0.6, >= 0.6.9)
+      json (~> 1.7, >= 1.7.7)
+      minitest (~> 5.1)
+      thread_safe (~> 0.1)
+      tzinfo (~> 1.1)
+    arel (5.0.1.20140414130214)
+    bootstrap-sass (3.1.1.1)
+      sass (~> 3.2)
+    builder (3.2.2)
+    coffee-rails (4.0.1)
+      coffee-script (>= 2.2.0)
+      railties (>= 4.0.0, < 5.0)
+    coffee-script (2.2.0)
+      coffee-script-source
+      execjs
+    coffee-script-source (1.7.0)
+    erubis (2.7.0)
+    execjs (2.0.2)
+    hike (1.2.3)
+    i18n (0.6.9)
+    jbuilder (2.0.7)
+      activesupport (>= 3.0.0, < 5)
+      multi_json (~> 1.2)
+    jquery-rails (3.1.0)
+      railties (>= 3.0, < 5.0)
+      thor (>= 0.14, < 2.0)
+    json (1.8.1)
+    kgio (2.9.2)
+    libv8 (3.16.14.3)
+    mail (2.5.4)
+      mime-types (~> 1.16)
+      treetop (~> 1.4.8)
+    mime-types (1.25.1)
+    minitest (5.3.4)
+    multi_json (1.10.1)
+    mysql2 (0.3.16)
+    polyglot (0.3.4)
+    rack (1.5.2)
+    rack-test (0.6.2)
+      rack (>= 1.0)
+    rails (4.1.1)
+      actionmailer (= 4.1.1)
+      actionpack (= 4.1.1)
+      actionview (= 4.1.1)
+      activemodel (= 4.1.1)
+      activerecord (= 4.1.1)
+      activesupport (= 4.1.1)
+      bundler (>= 1.3.0, < 2.0)
+      railties (= 4.1.1)
+      sprockets-rails (~> 2.0)
+    railties (4.1.1)
+      actionpack (= 4.1.1)
+      activesupport (= 4.1.1)
+      rake (>= 0.8.7)
+      thor (>= 0.18.1, < 2.0)
+    raindrops (0.13.0)
+    rake (10.3.2)
+    rdoc (4.1.1)
+      json (~> 1.4)
+    ref (1.0.5)
+    sass (3.2.19)
+    sass-rails (4.0.3)
+      railties (>= 4.0.0, < 5.0)
+      sass (~> 3.2.0)
+      sprockets (~> 2.8, <= 2.11.0)
+      sprockets-rails (~> 2.0)
+    sdoc (0.4.0)
+      json (~> 1.8)
+      rdoc (~> 4.0, < 5.0)
+    spring (1.1.3)
+    sprockets (2.11.0)
+      hike (~> 1.2)
+      multi_json (~> 1.0)
+      rack (~> 1.0)
+      tilt (~> 1.1, != 1.3.0)
+    sprockets-rails (2.1.3)
+      actionpack (>= 3.0)
+      activesupport (>= 3.0)
+      sprockets (~> 2.8)
+    sqlite3 (1.3.9)
+    therubyracer (0.12.1)
+      libv8 (~> 3.16.14.0)
+      ref
+    thor (0.19.1)
+    thread_safe (0.3.3)
+    tilt (1.4.1)
+    treetop (1.4.15)
+      polyglot
+      polyglot (>= 0.3.1)
+    turbolinks (2.2.2)
+      coffee-rails
+    tzinfo (1.2.0)
+      thread_safe (~> 0.1)
+    uglifier (2.5.0)
+      execjs (>= 0.3.0)
+      json (>= 1.8.0)
+    unicorn (4.8.3)
+      kgio (~> 2.6)
+      rack
+      raindrops (~> 0.7)
+
+BAD-SECTION
+    bad-entry (5.5.5)
+      bad-kgio (~> 2.6)
+      bad-rack
+      bad-raindrops (~> 0.7)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  bootstrap-sass
+  coffee-rails (~> 4.0.0)
+  jbuilder (~> 2.0)
+  jquery-rails
+  mysql2 (~> 0.3.16)
+  rails (= 4.1.1)
+  sass-rails (~> 4.0.3)
+  sdoc (~> 0.4.0)
+  spring
+  sqlite3
+  therubyracer
+  turbolinks
+  uglifier (>= 1.3.0)
+  unicorn
@@ -0,0 +1,35 @@
+Package: apt
+Status: install ok installed
+Priority: required
+Section: admin
+Installed-Size: 4064
+Maintainer: APT Development Team <deity@lists.debian.org>
+Architecture: amd64
+Version: 1.8.2
+Source: apt-dev
+Replaces: apt-transport-https (<< 1.5~alpha4~), apt-utils (<< 1.3~exp2~)
+Provides: apt-transport-https (= 1.8.2)
+Depends: adduser, gpgv | gpgv2 | gpgv1, debian-archive-keyring, libapt-pkg5.0 (>= 1.7.0~alpha3~), libc6 (>= 2.15), libgcc1 (>= 1:3.0), libgnutls30 (>= 3.6.6), libseccomp2 (>= 1.0.1), libstdc++6 (>= 5.2)
+Recommends: ca-certificates
+Suggests: apt-doc, aptitude | synaptic | wajig, dpkg-dev (>= 1.17.2), gnupg | gnupg2 | gnupg1, powermgmt-base
+Breaks: apt-transport-https (<< 1.5~alpha4~), apt-utils (<< 1.3~exp2~), aptitude (<< 0.8.10)
+Conffiles:
+ /etc/apt/apt.conf.d/01autoremove 76120d358bc9037bb6358e737b3050b5
+ /etc/cron.daily/apt-compat 49e9b2cfa17849700d4db735d04244f3
+ /etc/kernel/postinst.d/apt-auto-removal 4ad976a68f045517cf4696cec7b8aa3a
+ /etc/logrotate.d/apt 179f2ed4f85cbaca12fa3d69c2a4a1c3
+Description: commandline package manager
+ This package provides commandline tools for searching and
+ managing as well as querying information about packages
+ as a low-level access to all features of the libapt-pkg library.
+ .
+ These include:
+  * apt-get for retrieval of packages and information about them
+    from authenticated sources and for installation, upgrade and
+    removal of packages together with their dependencies
+  * apt-cache for querying available information about installed
+    as well as installable packages
+  * apt-cdrom to use removable media as a source for packages
+  * apt-config as an interface to the configuration settings
+  * apt-key as an interface to manage authentication keys
+
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -eux
+
+docker create --name generate-rpmdb-fixture centos:latest sh -c 'tail -f /dev/null'
+
+function cleanup {
+  docker kill generate-rpmdb-fixture
+  docker rm generate-rpmdb-fixture
+}
+trap cleanup EXIT
+
+docker start generate-rpmdb-fixture
+docker exec -i --tty=false generate-rpmdb-fixture bash <<-EOF
+  mkdir -p /scratch
+  cd /scratch
+  rpm --initdb --dbpath /scratch
+  curl -sSLO https://github.com/wagoodman/dive/releases/download/v0.9.2/dive_0.9.2_linux_amd64.rpm
+  rpm --dbpath /scratch -ivh dive_0.9.2_linux_amd64.rpm
+  rm dive_0.9.2_linux_amd64.rpm
+  rpm --dbpath /scratch -qa
+EOF
+
+docker cp generate-rpmdb-fixture:/scratch/Packages .
@@ -0,0 +1,256 @@
+[Path: test-fixtures]
+[actionmailer]
+ Version:	 4.1.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[actionpack]
+ Version:	 4.1.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[actionview]
+ Version:	 4.1.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[activemodel]
+ Version:	 4.1.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[activerecord]
+ Version:	 4.1.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[activesupport]
+ Version:	 4.1.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[arel]
+ Version:	 5.0.1.20140414130214
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[bootstrap-sass]
+ Version:	 3.1.1.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[builder]
+ Version:	 3.2.2
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[coffee-rails]
+ Version:	 4.0.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[coffee-script]
+ Version:	 2.2.0
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[coffee-script-source]
+ Version:	 1.7.0
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[erubis]
+ Version:	 2.7.0
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[execjs]
+ Version:	 2.0.2
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[hike]
+ Version:	 1.2.3
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[i18n]
+ Version:	 0.6.9
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[jbuilder]
+ Version:	 2.0.7
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[jquery-rails]
+ Version:	 3.1.0
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[json]
+ Version:	 1.8.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[kgio]
+ Version:	 2.9.2
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[libv8]
+ Version:	 3.16.14.3
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[mail]
+ Version:	 2.5.4
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[mime-types]
+ Version:	 1.25.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[minitest]
+ Version:	 5.3.4
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[multi_json]
+ Version:	 1.10.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[mysql2]
+ Version:	 0.3.16
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[polyglot]
+ Version:	 0.3.4
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[rack]
+ Version:	 1.5.2
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[rack-test]
+ Version:	 0.6.2
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[rails]
+ Version:	 4.1.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[railties]
+ Version:	 4.1.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[raindrops]
+ Version:	 0.13.0
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[rake]
+ Version:	 10.3.2
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[rdoc]
+ Version:	 4.1.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[ref]
+ Version:	 1.0.5
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[sass]
+ Version:	 3.2.19
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[sass-rails]
+ Version:	 4.0.3
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[sdoc]
+ Version:	 0.4.0
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[spring]
+ Version:	 1.1.3
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[sprockets]
+ Version:	 2.11.0
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[sprockets-rails]
+ Version:	 2.1.3
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[sqlite3]
+ Version:	 1.3.9
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[therubyracer]
+ Version:	 0.12.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[thor]
+ Version:	 0.19.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[thread_safe]
+ Version:	 0.3.3
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[tilt]
+ Version:	 1.4.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[treetop]
+ Version:	 1.4.15
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[turbolinks]
+ Version:	 2.2.2
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[tzinfo]
+ Version:	 1.2.0
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[uglifier]
+ Version:	 2.5.0
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[unicorn]
+ Version:	 4.8.3
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
				`@@ -0,0 +1 @@`
				`See the imgbom/cataloger/java/test-fixtures/java-builds dir to generate test fixtures and copy to here manually.`