Add release process (#89)

* add check for app update; fix ETUI error handling * validate user args * add goreleaser support * replace cgo dependencies (go-rpm) with go equivalents * add acceptance tests against build snapshot * add brew tap + acceptance test pipeline * add mac acceptance tests * fix compare makefile * fix mac acceptance tests * add release pipeline with wait checks * add token to release step * rm dir presenters int test * enforce dpkg to be non interactive Co-authored-by: Alfredo Deza <adeza@anchore.com> * pin brew formulae * pin skopeo to formulae url * only run acceptance tests Co-authored-by: Alfredo Deza <adeza@anchore.com>
2026-10-31 06:26:30 +01:00 · 2020-07-23 10:52:44 -04:00
parent 3cb7c43dbc
commit ba4f63099d
49 changed files with 952 additions and 57 deletions
@@ -0,0 +1,42 @@
+// +build integration
+
+package integration
+
+import (
+	"testing"
+
+	"github.com/anchore/imgbom/imgbom"
+
+	"github.com/anchore/go-testutils"
+	"github.com/anchore/imgbom/imgbom/distro"
+	"github.com/anchore/imgbom/imgbom/scope"
+	"github.com/go-test/deep"
+)
+
+func TestDistroImage(t *testing.T) {
+	fixtureImageName := "image-distro-id"
+	_, cleanup := testutils.GetFixtureImage(t, "docker-archive", fixtureImageName)
+	tarPath := testutils.GetFixtureImageTarPath(t, fixtureImageName)
+	defer cleanup()
+
+	_, _, actualDistro, err := imgbom.Catalog("docker-archive://"+tarPath, scope.AllLayersScope)
+	if err != nil {
+		t.Fatalf("failed to catalog image: %+v", err)
+	}
+	if actualDistro == nil {
+		t.Fatalf("could not find distro")
+	}
+
+	expected, err := distro.NewDistro(distro.Busybox, "1.31.1")
+	if err != nil {
+		t.Fatalf("could not create distro: %+v", err)
+	}
+
+	diffs := deep.Equal(*actualDistro, expected)
+	if len(diffs) != 0 {
+		for _, d := range diffs {
+			t.Errorf("found distro difference: %+v", d)
+		}
+	}
+
+}
@@ -0,0 +1,300 @@
+// +build integration
+
+package integration
+
+import (
+	"testing"
+
+	"github.com/anchore/imgbom/imgbom"
+
+	"github.com/anchore/imgbom/internal"
+
+	"github.com/anchore/go-testutils"
+	"github.com/anchore/imgbom/imgbom/pkg"
+	"github.com/anchore/imgbom/imgbom/scope"
+)
+
+var cases = []struct {
+	name        string
+	pkgType     pkg.Type
+	pkgLanguage pkg.Language
+	pkgInfo     map[string]string
+}{
+	{
+		name:    "find rpmdb packages",
+		pkgType: pkg.RpmPkg,
+		pkgInfo: map[string]string{
+			"dive": "0.9.2",
+		},
+	},
+	{
+		name:    "find dpkg packages",
+		pkgType: pkg.DebPkg,
+		pkgInfo: map[string]string{
+			"apt": "1.8.2",
+		},
+	},
+	{
+		name:        "find java packages",
+		pkgType:     pkg.JavaPkg,
+		pkgLanguage: pkg.Java,
+		pkgInfo: map[string]string{
+			"example-java-app-maven": "0.1.0",
+			"example-jenkins-plugin": "1.0-SNAPSHOT", // the jenkins HPI file has a nested JAR of the same name
+		},
+	},
+	{
+		name:        "find jenkins plugins",
+		pkgType:     pkg.JenkinsPluginPkg,
+		pkgLanguage: pkg.Java,
+		pkgInfo: map[string]string{
+			"example-jenkins-plugin": "1.0-SNAPSHOT",
+		},
+	},
+	{
+		name:        "find python wheel packages",
+		pkgType:     pkg.WheelPkg,
+		pkgLanguage: pkg.Python,
+		pkgInfo: map[string]string{
+			"Pygments": "2.6.1",
+		},
+	},
+	{
+		name:        "find javascript npm packages",
+		pkgType:     pkg.NpmPkg,
+		pkgLanguage: pkg.JavaScript,
+		pkgInfo: map[string]string{
+			"get-stdin": "8.0.0",
+		},
+	},
+	{
+		name:        "find python egg packages",
+		pkgType:     pkg.EggPkg,
+		pkgLanguage: pkg.Python,
+		pkgInfo: map[string]string{
+			"requests": "2.22.0",
+		},
+	},
+	{
+		name:        "find python packages",
+		pkgType:     pkg.PythonRequirementsPkg,
+		pkgLanguage: pkg.Python,
+		pkgInfo: map[string]string{
+			"flask": "4.0.0",
+		},
+	},
+	{
+		name:        "find bundler packages",
+		pkgType:     pkg.BundlerPkg,
+		pkgLanguage: pkg.Ruby,
+		pkgInfo: map[string]string{
+			"actionmailer":         "4.1.1",
+			"actionpack":           "4.1.1",
+			"actionview":           "4.1.1",
+			"activemodel":          "4.1.1",
+			"activerecord":         "4.1.1",
+			"activesupport":        "4.1.1",
+			"arel":                 "5.0.1.20140414130214",
+			"bootstrap-sass":       "3.1.1.1",
+			"builder":              "3.2.2",
+			"coffee-rails":         "4.0.1",
+			"coffee-script":        "2.2.0",
+			"coffee-script-source": "1.7.0",
+			"erubis":               "2.7.0",
+			"execjs":               "2.0.2",
+			"hike":                 "1.2.3",
+			"i18n":                 "0.6.9",
+			"jbuilder":             "2.0.7",
+			"jquery-rails":         "3.1.0",
+			"json":                 "1.8.1",
+			"kgio":                 "2.9.2",
+			"libv8":                "3.16.14.3",
+			"mail":                 "2.5.4",
+			"mime-types":           "1.25.1",
+			"minitest":             "5.3.4",
+			"multi_json":           "1.10.1",
+			"mysql2":               "0.3.16",
+			"polyglot":             "0.3.4",
+			"rack":                 "1.5.2",
+			"rack-test":            "0.6.2",
+			"rails":                "4.1.1",
+			"railties":             "4.1.1",
+			"raindrops":            "0.13.0",
+			"rake":                 "10.3.2",
+			"rdoc":                 "4.1.1",
+			"ref":                  "1.0.5",
+			"sass":                 "3.2.19",
+			"sass-rails":           "4.0.3",
+			"sdoc":                 "0.4.0",
+			"spring":               "1.1.3",
+			"sprockets":            "2.11.0",
+			"sprockets-rails":      "2.1.3",
+			"sqlite3":              "1.3.9",
+			"therubyracer":         "0.12.1",
+			"thor":                 "0.19.1",
+			"thread_safe":          "0.3.3",
+			"tilt":                 "1.4.1",
+			"treetop":              "1.4.15",
+			"turbolinks":           "2.2.2",
+			"tzinfo":               "1.2.0",
+			"uglifier":             "2.5.0",
+			"unicorn":              "4.8.3",
+		},
+	},
+	{
+		name:        "find golang modules",
+		pkgType:     pkg.GoModulePkg,
+		pkgLanguage: pkg.Go,
+		pkgInfo: map[string]string{
+			"github.com/bmatcuk/doublestar": "v1.3.1",
+		},
+	},
+}
+
+func TestPkgCoverageImage(t *testing.T) {
+	fixtureImageName := "image-pkg-coverage"
+	_, cleanup := testutils.GetFixtureImage(t, "docker-archive", fixtureImageName)
+	tarPath := testutils.GetFixtureImageTarPath(t, fixtureImageName)
+	defer cleanup()
+
+	catalog, _, _, err := imgbom.Catalog("docker-archive://"+tarPath, scope.AllLayersScope)
+	if err != nil {
+		t.Fatalf("failed to catalog image: %+v", err)
+	}
+
+	observedLanguages := internal.NewStringSet()
+	definedLanguages := internal.NewStringSet()
+	for _, l := range pkg.AllLanguages {
+		definedLanguages.Add(l.String())
+	}
+
+	observedPkgs := internal.NewStringSet()
+	definedPkgs := internal.NewStringSet()
+	for _, p := range pkg.AllPkgs {
+		definedPkgs.Add(p.String())
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			pkgCount := 0
+
+			for a := range catalog.Enumerate(c.pkgType) {
+
+				observedLanguages.Add(a.Language.String())
+				observedPkgs.Add(a.Type.String())
+
+				expectedVersion, ok := c.pkgInfo[a.Name]
+				if !ok {
+					t.Errorf("unexpected package found: %s", a.Name)
+				}
+
+				if expectedVersion != a.Version {
+					t.Errorf("unexpected package version (pkg=%s): %s, expected: %s", a.Name, a.Version, expectedVersion)
+				}
+
+				if a.Language != c.pkgLanguage {
+					t.Errorf("bad language (pkg=%+v): %+v", a.Name, a.Language)
+				}
+
+				if a.Type != c.pkgType {
+					t.Errorf("bad package type (pkg=%+v): %+v", a.Name, a.Type)
+				}
+				pkgCount++
+			}
+
+			if pkgCount != len(c.pkgInfo) {
+				for a := range catalog.Enumerate(c.pkgType) {
+					t.Log("   ", a)
+				}
+				t.Fatalf("unexpected package count: %d!=%d", pkgCount, len(c.pkgInfo))
+			}
+
+		})
+	}
+
+	observedLanguages.Remove(pkg.UnknownLanguage.String())
+	definedLanguages.Remove(pkg.UnknownLanguage.String())
+	observedPkgs.Remove(pkg.UnknownPkg.String())
+	definedPkgs.Remove(pkg.UnknownPkg.String())
+
+	// ensure that integration test cases stay in sync with the available catalogers
+	if len(observedLanguages) < len(definedLanguages) {
+		t.Errorf("language coverage incomplete (languages=%d, coverage=%d)", len(definedLanguages), len(observedLanguages))
+	}
+
+	if len(observedPkgs) < len(definedPkgs) {
+		t.Errorf("package coverage incomplete (packages=%d, coverage=%d)", len(definedPkgs), len(observedPkgs))
+	}
+}
+
+func TestPkgCoverageDirectory(t *testing.T) {
+	catalog, _, _, err := imgbom.Catalog("dir://test-fixtures/image-pkg-coverage", scope.AllLayersScope)
+
+	if err != nil {
+		t.Errorf("unable to create scope from dir: %+v", err)
+	}
+
+	observedLanguages := internal.NewStringSet()
+	definedLanguages := internal.NewStringSet()
+	for _, l := range pkg.AllLanguages {
+		definedLanguages.Add(l.String())
+	}
+
+	observedPkgs := internal.NewStringSet()
+	definedPkgs := internal.NewStringSet()
+	for _, p := range pkg.AllPkgs {
+		definedPkgs.Add(p.String())
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			pkgCount := 0
+
+			for a := range catalog.Enumerate(c.pkgType) {
+
+				observedLanguages.Add(a.Language.String())
+				observedPkgs.Add(a.Type.String())
+
+				expectedVersion, ok := c.pkgInfo[a.Name]
+				if !ok {
+					t.Errorf("unexpected package found: %s", a.Name)
+				}
+
+				if expectedVersion != a.Version {
+					t.Errorf("unexpected package version (pkg=%s): %s", a.Name, a.Version)
+				}
+
+				if a.Language != c.pkgLanguage {
+					t.Errorf("bad language (pkg=%+v): %+v", a.Name, a.Language)
+				}
+
+				if a.Type != c.pkgType {
+					t.Errorf("bad package type (pkg=%+v): %+v", a.Name, a.Type)
+				}
+				pkgCount++
+			}
+
+			if pkgCount != len(c.pkgInfo) {
+				for a := range catalog.Enumerate(c.pkgType) {
+					t.Log("   ", a)
+				}
+				t.Fatalf("unexpected package count: %d!=%d", pkgCount, len(c.pkgInfo))
+			}
+
+		})
+	}
+
+	observedLanguages.Remove(pkg.UnknownLanguage.String())
+	definedLanguages.Remove(pkg.UnknownLanguage.String())
+	observedPkgs.Remove(pkg.UnknownPkg.String())
+	definedPkgs.Remove(pkg.UnknownPkg.String())
+
+	// ensure that integration test cases stay in sync with the available catalogers
+	if len(observedLanguages) < len(definedLanguages) {
+		t.Errorf("language coverage incomplete (languages=%d, coverage=%d)", len(definedLanguages), len(observedLanguages))
+	}
+
+	if len(observedPkgs) < len(definedPkgs) {
+		t.Errorf("package coverage incomplete (packages=%d, coverage=%d)", len(definedPkgs), len(observedPkgs))
+	}
+}
@@ -0,0 +1,7 @@
+# we should strive to not commit blobs to the repo and strive to keep the build process of how blobs are acquired in-repo.
+# this blob is generated from imgbom/imgbom/catalogers/java/test-fixtures/java-builds , however, preserving the build process
+# twice in the repo seems redundant (even via symlink). Given that the fixture is a few kilobytes in size, the build process is already
+# captured, and integration tests should only be testing if jars can be discovered (not necessarily depth in java detection
+# functionality), committing it seems like an acceptable exception.
+!image-pkg-coverage/java/*.jar
+!image-pkg-coverage/java/*.hpi
@@ -0,0 +1,3 @@
+FROM busybox:1.31.1
+
+
@@ -0,0 +1,2 @@
+FROM scratch
+COPY . .
@@ -0,0 +1,7 @@
+module github.com/anchore/imgbom
+
+go 1.14
+
+require (
+	github.com/bmatcuk/doublestar v1.3.1
+)
@@ -0,0 +1 @@
+See the imgbom/cataloger/java/test-fixtures/java-builds dir to generate test fixtures and copy to here manually.
@@ -0,0 +1,11 @@
+{
+  "requires": true,
+  "lockfileVersion": 1,
+  "dependencies": {
+    "get-stdin": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/get-stdin/-/get-stdin-8.0.0.tgz",
+      "integrity": "sha512-sY22aA6xchAzprjyqmSEQv4UbAAzRN0L2dQB0NlN5acTTK9Don6nhoc3eAbUnpZiCANAMfd/+40kVdKfFygohg=="
+    }
+  }
+}
@@ -0,0 +1,47 @@
+Metadata-Version: 2.1
+Name: Pygments
+Version: 2.6.1
+Summary: Pygments is a syntax highlighting package written in Python.
+Home-page: https://pygments.org/
+Author: Georg Brandl
+Author-email: georg@python.org
+License: BSD License
+Keywords: syntax highlighting
+Platform: any
+Classifier: License :: OSI Approved :: BSD License
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: End Users/Desktop
+Classifier: Intended Audience :: System Administrators
+Classifier: Development Status :: 6 - Mature
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.5
+Classifier: Programming Language :: Python :: 3.6
+Classifier: Programming Language :: Python :: 3.7
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: Implementation :: CPython
+Classifier: Programming Language :: Python :: Implementation :: PyPy
+Classifier: Operating System :: OS Independent
+Classifier: Topic :: Text Processing :: Filters
+Classifier: Topic :: Utilities
+Requires-Python: >=3.5
+
+
+Pygments
+~~~~~~~~
+
+Pygments is a syntax highlighting package written in Python.
+
+It is a generic syntax highlighter suitable for use in code hosting, forums,
+wikis or other applications that need to prettify source code.  Highlights
+are:
+
+* a wide range of over 500 languages and other text formats is supported
+* special attention is paid to details, increasing quality by a fair amount
+* support for new languages and formats are added easily
+* a number of output formats, presently HTML, LaTeX, RTF, SVG, all image     formats that PIL supports and ANSI sequences
+* it is usable as a command-line tool and as a library
+
+:copyright: Copyright 2006-2019 by the Pygments team, see AUTHORS.
+:license: BSD, see LICENSE for details.
+
@@ -0,0 +1,134 @@
+Metadata-Version: 2.1
+Name: requests
+Version: 2.22.0
+Summary: Python HTTP for Humans.
+Home-page: http://python-requests.org
+Author: Kenneth Reitz
+Author-email: me@kennethreitz.org
+License: Apache 2.0
+Description: Requests: HTTP for Humans™
+        ==========================
+        
+        [![image](https://img.shields.io/pypi/v/requests.svg)](https://pypi.org/project/requests/)
+        [![image](https://img.shields.io/pypi/l/requests.svg)](https://pypi.org/project/requests/)
+        [![image](https://img.shields.io/pypi/pyversions/requests.svg)](https://pypi.org/project/requests/)
+        [![codecov.io](https://codecov.io/github/requests/requests/coverage.svg?branch=master)](https://codecov.io/github/requests/requests)
+        [![image](https://img.shields.io/github/contributors/requests/requests.svg)](https://github.com/requests/requests/graphs/contributors)
+        [![image](https://img.shields.io/badge/Say%20Thanks-!-1EAEDB.svg)](https://saythanks.io/to/kennethreitz)
+        
+        Requests is the only *Non-GMO* HTTP library for Python, safe for human
+        consumption.
+        
+        ![image](https://farm5.staticflickr.com/4317/35198386374_1939af3de6_k_d.jpg)
+        
+        Behold, the power of Requests:
+        
+        ``` {.sourceCode .python}
+        >>> import requests
+        >>> r = requests.get('https://api.github.com/user', auth=('user', 'pass'))
+        >>> r.status_code
+        200
+        >>> r.headers['content-type']
+        'application/json; charset=utf8'
+        >>> r.encoding
+        'utf-8'
+        >>> r.text
+        u'{"type":"User"...'
+        >>> r.json()
+        {u'disk_usage': 368627, u'private_gists': 484, ...}
+        ```
+        
+        See [the similar code, sans Requests](https://gist.github.com/973705).
+        
+        [![image](https://raw.githubusercontent.com/requests/requests/master/docs/_static/requests-logo-small.png)](http://docs.python-requests.org/)
+        
+        Requests allows you to send *organic, grass-fed* HTTP/1.1 requests,
+        without the need for manual labor. There's no need to manually add query
+        strings to your URLs, or to form-encode your POST data. Keep-alive and
+        HTTP connection pooling are 100% automatic, thanks to
+        [urllib3](https://github.com/shazow/urllib3).
+        
+        Besides, all the cool kids are doing it. Requests is one of the most
+        downloaded Python packages of all time, pulling in over 11,000,000
+        downloads every month. You don't want to be left out!
+        
+        Feature Support
+        ---------------
+        
+        Requests is ready for today's web.
+        
+        -   International Domains and URLs
+        -   Keep-Alive & Connection Pooling
+        -   Sessions with Cookie Persistence
+        -   Browser-style SSL Verification
+        -   Basic/Digest Authentication
+        -   Elegant Key/Value Cookies
+        -   Automatic Decompression
+        -   Automatic Content Decoding
+        -   Unicode Response Bodies
+        -   Multipart File Uploads
+        -   HTTP(S) Proxy Support
+        -   Connection Timeouts
+        -   Streaming Downloads
+        -   `.netrc` Support
+        -   Chunked Requests
+        
+        Requests officially supports Python 2.7 & 3.4–3.7, and runs great on
+        PyPy.
+        
+        Installation
+        ------------
+        
+        To install Requests, simply use [pipenv](http://pipenv.org/) (or pip, of
+        course):
+        
+        ``` {.sourceCode .bash}
+        $ pipenv install requests
+        ✨🍰✨
+        ```
+        
+        Satisfaction guaranteed.
+        
+        Documentation
+        -------------
+        
+        Fantastic documentation is available at
+        <http://docs.python-requests.org/>, for a limited time only.
+        
+        How to Contribute
+        -----------------
+        
+        1.  Become more familiar with the project by reading our [Contributor's Guide](http://docs.python-requests.org/en/latest/dev/contributing/) and our [development philosophy](http://docs.python-requests.org/en/latest/dev/philosophy/).
+        2.  Check for open issues or open a fresh issue to start a discussion
+            around a feature idea or a bug. There is a [Contributor
+            Friendly](https://github.com/requests/requests/issues?direction=desc&labels=Contributor+Friendly&page=1&sort=updated&state=open)
+            tag for issues that should be ideal for people who are not very
+            familiar with the codebase yet.
+        3.  Fork [the repository](https://github.com/requests/requests) on
+            GitHub to start making your changes to the **master** branch (or
+            branch off of it).
+        4.  Write a test which shows that the bug was fixed or that the feature
+            works as expected.
+        5.  Send a pull request and bug the maintainer until it gets merged and
+            published. :) Make sure to add yourself to
+            [AUTHORS](https://github.com/requests/requests/blob/master/AUTHORS.rst).
+        
+        
+Platform: UNKNOWN
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Classifier: Natural Language :: English
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 2
+Classifier: Programming Language :: Python :: 2.7
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.5
+Classifier: Programming Language :: Python :: 3.6
+Classifier: Programming Language :: Python :: 3.7
+Classifier: Programming Language :: Python :: Implementation :: CPython
+Classifier: Programming Language :: Python :: Implementation :: PyPy
+Requires-Python: >=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*
+Description-Content-Type: text/markdown
+Provides-Extra: security
+Provides-Extra: socks
@@ -0,0 +1,3 @@
+flask==4.0.0
+# this is an ignored line
+
@@ -0,0 +1,149 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    actionmailer (4.1.1)
+      actionpack (= 4.1.1)
+      actionview (= 4.1.1)
+      mail (~> 2.5.4)
+    actionpack (4.1.1)
+      actionview (= 4.1.1)
+      activesupport (= 4.1.1)
+      rack (~> 1.5.2)
+      rack-test (~> 0.6.2)
+    actionview (4.1.1)
+      activesupport (= 4.1.1)
+      builder (~> 3.1)
+      erubis (~> 2.7.0)
+    activemodel (4.1.1)
+      activesupport (= 4.1.1)
+      builder (~> 3.1)
+    activerecord (4.1.1)
+      activemodel (= 4.1.1)
+      activesupport (= 4.1.1)
+      arel (~> 5.0.0)
+    activesupport (4.1.1)
+      i18n (~> 0.6, >= 0.6.9)
+      json (~> 1.7, >= 1.7.7)
+      minitest (~> 5.1)
+      thread_safe (~> 0.1)
+      tzinfo (~> 1.1)
+    arel (5.0.1.20140414130214)
+    bootstrap-sass (3.1.1.1)
+      sass (~> 3.2)
+    builder (3.2.2)
+    coffee-rails (4.0.1)
+      coffee-script (>= 2.2.0)
+      railties (>= 4.0.0, < 5.0)
+    coffee-script (2.2.0)
+      coffee-script-source
+      execjs
+    coffee-script-source (1.7.0)
+    erubis (2.7.0)
+    execjs (2.0.2)
+    hike (1.2.3)
+    i18n (0.6.9)
+    jbuilder (2.0.7)
+      activesupport (>= 3.0.0, < 5)
+      multi_json (~> 1.2)
+    jquery-rails (3.1.0)
+      railties (>= 3.0, < 5.0)
+      thor (>= 0.14, < 2.0)
+    json (1.8.1)
+    kgio (2.9.2)
+    libv8 (3.16.14.3)
+    mail (2.5.4)
+      mime-types (~> 1.16)
+      treetop (~> 1.4.8)
+    mime-types (1.25.1)
+    minitest (5.3.4)
+    multi_json (1.10.1)
+    mysql2 (0.3.16)
+    polyglot (0.3.4)
+    rack (1.5.2)
+    rack-test (0.6.2)
+      rack (>= 1.0)
+    rails (4.1.1)
+      actionmailer (= 4.1.1)
+      actionpack (= 4.1.1)
+      actionview (= 4.1.1)
+      activemodel (= 4.1.1)
+      activerecord (= 4.1.1)
+      activesupport (= 4.1.1)
+      bundler (>= 1.3.0, < 2.0)
+      railties (= 4.1.1)
+      sprockets-rails (~> 2.0)
+    railties (4.1.1)
+      actionpack (= 4.1.1)
+      activesupport (= 4.1.1)
+      rake (>= 0.8.7)
+      thor (>= 0.18.1, < 2.0)
+    raindrops (0.13.0)
+    rake (10.3.2)
+    rdoc (4.1.1)
+      json (~> 1.4)
+    ref (1.0.5)
+    sass (3.2.19)
+    sass-rails (4.0.3)
+      railties (>= 4.0.0, < 5.0)
+      sass (~> 3.2.0)
+      sprockets (~> 2.8, <= 2.11.0)
+      sprockets-rails (~> 2.0)
+    sdoc (0.4.0)
+      json (~> 1.8)
+      rdoc (~> 4.0, < 5.0)
+    spring (1.1.3)
+    sprockets (2.11.0)
+      hike (~> 1.2)
+      multi_json (~> 1.0)
+      rack (~> 1.0)
+      tilt (~> 1.1, != 1.3.0)
+    sprockets-rails (2.1.3)
+      actionpack (>= 3.0)
+      activesupport (>= 3.0)
+      sprockets (~> 2.8)
+    sqlite3 (1.3.9)
+    therubyracer (0.12.1)
+      libv8 (~> 3.16.14.0)
+      ref
+    thor (0.19.1)
+    thread_safe (0.3.3)
+    tilt (1.4.1)
+    treetop (1.4.15)
+      polyglot
+      polyglot (>= 0.3.1)
+    turbolinks (2.2.2)
+      coffee-rails
+    tzinfo (1.2.0)
+      thread_safe (~> 0.1)
+    uglifier (2.5.0)
+      execjs (>= 0.3.0)
+      json (>= 1.8.0)
+    unicorn (4.8.3)
+      kgio (~> 2.6)
+      rack
+      raindrops (~> 0.7)
+
+BAD-SECTION
+    bad-entry (5.5.5)
+      bad-kgio (~> 2.6)
+      bad-rack
+      bad-raindrops (~> 0.7)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  bootstrap-sass
+  coffee-rails (~> 4.0.0)
+  jbuilder (~> 2.0)
+  jquery-rails
+  mysql2 (~> 0.3.16)
+  rails (= 4.1.1)
+  sass-rails (~> 4.0.3)
+  sdoc (~> 0.4.0)
+  spring
+  sqlite3
+  therubyracer
+  turbolinks
+  uglifier (>= 1.3.0)
+  unicorn
@@ -0,0 +1,35 @@
+Package: apt
+Status: install ok installed
+Priority: required
+Section: admin
+Installed-Size: 4064
+Maintainer: APT Development Team <deity@lists.debian.org>
+Architecture: amd64
+Version: 1.8.2
+Source: apt-dev
+Replaces: apt-transport-https (<< 1.5~alpha4~), apt-utils (<< 1.3~exp2~)
+Provides: apt-transport-https (= 1.8.2)
+Depends: adduser, gpgv | gpgv2 | gpgv1, debian-archive-keyring, libapt-pkg5.0 (>= 1.7.0~alpha3~), libc6 (>= 2.15), libgcc1 (>= 1:3.0), libgnutls30 (>= 3.6.6), libseccomp2 (>= 1.0.1), libstdc++6 (>= 5.2)
+Recommends: ca-certificates
+Suggests: apt-doc, aptitude | synaptic | wajig, dpkg-dev (>= 1.17.2), gnupg | gnupg2 | gnupg1, powermgmt-base
+Breaks: apt-transport-https (<< 1.5~alpha4~), apt-utils (<< 1.3~exp2~), aptitude (<< 0.8.10)
+Conffiles:
+ /etc/apt/apt.conf.d/01autoremove 76120d358bc9037bb6358e737b3050b5
+ /etc/cron.daily/apt-compat 49e9b2cfa17849700d4db735d04244f3
+ /etc/kernel/postinst.d/apt-auto-removal 4ad976a68f045517cf4696cec7b8aa3a
+ /etc/logrotate.d/apt 179f2ed4f85cbaca12fa3d69c2a4a1c3
+Description: commandline package manager
+ This package provides commandline tools for searching and
+ managing as well as querying information about packages
+ as a low-level access to all features of the libapt-pkg library.
+ .
+ These include:
+  * apt-get for retrieval of packages and information about them
+    from authenticated sources and for installation, upgrade and
+    removal of packages together with their dependencies
+  * apt-cache for querying available information about installed
+    as well as installable packages
+  * apt-cdrom to use removable media as a source for packages
+  * apt-config as an interface to the configuration settings
+  * apt-key as an interface to manage authentication keys
+
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -eux
+
+docker create --name generate-rpmdb-fixture centos:latest sh -c 'tail -f /dev/null'
+
+function cleanup {
+  docker kill generate-rpmdb-fixture
+  docker rm generate-rpmdb-fixture
+}
+trap cleanup EXIT
+
+docker start generate-rpmdb-fixture
+docker exec -i --tty=false generate-rpmdb-fixture bash <<-EOF
+  mkdir -p /scratch
+  cd /scratch
+  rpm --initdb --dbpath /scratch
+  curl -sSLO https://github.com/wagoodman/dive/releases/download/v0.9.2/dive_0.9.2_linux_amd64.rpm
+  rpm --dbpath /scratch -ivh dive_0.9.2_linux_amd64.rpm
+  rm dive_0.9.2_linux_amd64.rpm
+  rpm --dbpath /scratch -qa
+EOF
+
+docker cp generate-rpmdb-fixture:/scratch/Packages .
@@ -0,0 +1,256 @@
+[Path: test-fixtures]
+[actionmailer]
+ Version:	 4.1.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[actionpack]
+ Version:	 4.1.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[actionview]
+ Version:	 4.1.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[activemodel]
+ Version:	 4.1.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[activerecord]
+ Version:	 4.1.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[activesupport]
+ Version:	 4.1.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[arel]
+ Version:	 5.0.1.20140414130214
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[bootstrap-sass]
+ Version:	 3.1.1.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[builder]
+ Version:	 3.2.2
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[coffee-rails]
+ Version:	 4.0.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[coffee-script]
+ Version:	 2.2.0
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[coffee-script-source]
+ Version:	 1.7.0
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[erubis]
+ Version:	 2.7.0
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[execjs]
+ Version:	 2.0.2
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[hike]
+ Version:	 1.2.3
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[i18n]
+ Version:	 0.6.9
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[jbuilder]
+ Version:	 2.0.7
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[jquery-rails]
+ Version:	 3.1.0
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[json]
+ Version:	 1.8.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[kgio]
+ Version:	 2.9.2
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[libv8]
+ Version:	 3.16.14.3
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[mail]
+ Version:	 2.5.4
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[mime-types]
+ Version:	 1.25.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[minitest]
+ Version:	 5.3.4
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[multi_json]
+ Version:	 1.10.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[mysql2]
+ Version:	 0.3.16
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[polyglot]
+ Version:	 0.3.4
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[rack]
+ Version:	 1.5.2
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[rack-test]
+ Version:	 0.6.2
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[rails]
+ Version:	 4.1.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[railties]
+ Version:	 4.1.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[raindrops]
+ Version:	 0.13.0
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[rake]
+ Version:	 10.3.2
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[rdoc]
+ Version:	 4.1.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[ref]
+ Version:	 1.0.5
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[sass]
+ Version:	 3.2.19
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[sass-rails]
+ Version:	 4.0.3
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[sdoc]
+ Version:	 0.4.0
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[spring]
+ Version:	 1.1.3
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[sprockets]
+ Version:	 2.11.0
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[sprockets-rails]
+ Version:	 2.1.3
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[sqlite3]
+ Version:	 1.3.9
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[therubyracer]
+ Version:	 0.12.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[thor]
+ Version:	 0.19.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[thread_safe]
+ Version:	 0.3.3
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[tilt]
+ Version:	 1.4.1
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[treetop]
+ Version:	 1.4.15
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[turbolinks]
+ Version:	 2.2.2
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[tzinfo]
+ Version:	 1.2.0
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[uglifier]
+ Version:	 2.5.0
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
+[unicorn]
+ Version:	 4.8.3
+ Type:		 bundle
+ Found by:	 bundler-cataloger
+
				`@@ -0,0 +1 @@`
				`See the imgbom/cataloger/java/test-fixtures/java-builds dir to generate test fixtures and copy to here manually.`