Introduce a single SBOM document (#606)

* [wip] single sbom doc

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix more tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update cli tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove scope in import path

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* swap SPDX tag-value formatter to single sbom document

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* bust CLI cache

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update fixture to byte diff

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* byte for byte

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* bust the cache

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* who needs cache

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* add jar for testing

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* no more bit flips

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* update apk with the delta for image and directory cases

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* restore cache workflow

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

Co-authored-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

test/cli/packages_cmd_test.go

@@ -3,8 +3,6 @@ package cli
 import (
 	"strings"
 	"testing"
-
-	"github.com/anchore/syft/syft/source"
 )
 
 func TestPackagesCmdFlags(t *testing.T) {
@@ -30,7 +28,6 @@ func TestPackagesCmdFlags(t *testing.T) {
 			args: []string{"packages", "-o", "json", request},
 			assertions: []traitAssertion{
 				assertJsonReport,
-				assertScope(source.SquashedScope),
 				assertSuccessfulReturnCode,
 			},
 		},
@@ -65,7 +62,7 @@ func TestPackagesCmdFlags(t *testing.T) {
 			name: "squashed-scope-flag",
 			args: []string{"packages", "-o", "json", "-s", "squashed", request},
 			assertions: []traitAssertion{
-				assertScope(source.SquashedScope),
+				assertPackageCount(17),
 				assertSuccessfulReturnCode,
 			},
 		},
@@ -73,18 +70,18 @@ func TestPackagesCmdFlags(t *testing.T) {
 			name: "all-layers-scope-flag",
 			args: []string{"packages", "-o", "json", "-s", "all-layers", request},
 			assertions: []traitAssertion{
-				assertScope(source.AllLayersScope),
+				assertPackageCount(19),
 				assertSuccessfulReturnCode,
 			},
 		},
 		{
-			name: "packages-scope-env-binding",
+			name: "all-layers-scope-flag-by-env",
+			args: []string{"packages", "-o", "json", request},
 			env: map[string]string{
 				"SYFT_PACKAGE_CATALOGER_SCOPE": "all-layers",
 			},
-			args: []string{"packages", "-o", "json", request},
 			assertions: []traitAssertion{
-				assertScope(source.AllLayersScope),
+				assertPackageCount(19),
 				assertSuccessfulReturnCode,
 			},
 		},

test/cli/trait_assertions_test.go

@@ -80,6 +80,24 @@ func assertStdoutLengthGreaterThan(length uint) traitAssertion {
 		tb.Helper()
 		if uint(len(stdout)) < length {
 			tb.Errorf("not enough output (expected at least %d, got %d)", length, len(stdout))
+		}
+	}
+}
+
+func assertPackageCount(length uint) traitAssertion {
+	return func(tb testing.TB, stdout, _ string, _ int) {
+		tb.Helper()
+		type partial struct {
+			Artifacts []interface{} `json:"artifacts"`
+		}
+		var data partial
+
+		if err := json.Unmarshal([]byte(stdout), &data); err != nil {
+			tb.Errorf("expected to find a JSON report, but was unmarshalable: %+v", err)
+		}
+
+		if uint(len(data.Artifacts)) != length {
+			tb.Errorf("expected package count of %d, but found %d", length, len(data.Artifacts))
 
 		}
 	}

test/integration/catalog_packages_cases_test.go

@@ -41,6 +41,15 @@ var imageOnlyTestCases = []testCase{
 			"someotherpkg": "3.19.0",
 		},
 	},
+	{
+		// When the image is build lib overwrites pkgs/lib causing there to only be two packages
+		name:    "find apkdb packages",
+		pkgType: pkg.ApkPkg,
+		pkgInfo: map[string]string{
+			"musl-utils": "1.1.24-r2",
+			"libc-utils": "0.7.2-r0",
+		},
+	},
 }
 
 var dirOnlyTestCases = []testCase{
@@ -149,6 +158,15 @@ var dirOnlyTestCases = []testCase{
 			"version_check": "0.1.5",
 		},
 	},
+	{
+		name:       "find apkdb packages",
+		pkgType:    pkg.ApkPkg,
+		duplicates: 2, // when the directory is cataloged we have duplicates between lib/ and pkgs/lib
+		pkgInfo: map[string]string{
+			"musl-utils": "1.1.24-r2",
+			"libc-utils": "0.7.2-r0",
+		},
+	},
 }
 
 var commonTestCases = []testCase{
@@ -186,13 +204,4 @@ var commonTestCases = []testCase{
 			"example-jenkins-plugin": "1.0-SNAPSHOT",
 		},
 	},
-	{
-
-		name:    "find apkdb packages",
-		pkgType: pkg.ApkPkg,
-		pkgInfo: map[string]string{
-			"musl-utils": "1.1.24-r2",
-			"libc-utils": "0.7.2-r0",
-		},
-	},
 }

test/integration/package_ownership_relationship_test.go

@@ -7,7 +7,7 @@ import (
 
 	"github.com/anchore/syft/internal/formats/syftjson"
 	syftjsonModel "github.com/anchore/syft/internal/formats/syftjson/model"
-	"github.com/anchore/syft/syft/source"
+	"github.com/anchore/syft/syft/sbom"
 )
 
 func TestPackageOwnershipRelationships(t *testing.T) {
@@ -25,7 +25,13 @@ func TestPackageOwnershipRelationships(t *testing.T) {
 		t.Run(test.fixture, func(t *testing.T) {
 			catalog, d, src := catalogFixtureImage(t, test.fixture)
 
-			p := syftjson.Format().Presenter(catalog, &src.Metadata, d, source.SquashedScope)
+			p := syftjson.Format().Presenter(sbom.SBOM{
+				Artifacts: sbom.Artifacts{
+					PackageCatalog: catalog,
+					Distro:         d,
+				},
+				Source: src.Metadata,
+			})
 			if p == nil {
 				t.Fatal("unable to get presenter")
 			}

test/integration/test-fixtures/.gitignore

@@ -3,5 +3,5 @@
 # twice in the repo seems redundant (even via symlink). Given that the fixture is a few kilobytes in size, the build process is already
 # captured, and integration tests should only be testing if jars can be discovered (not necessarily depth in java detection
 # functionality), committing it seems like an acceptable exception.
-!image-pkg-coverage/java/*.jar
-!image-pkg-coverage/java/*.hpi
+!image-pkg-coverage/pkgs/java/*.jar
+!image-pkg-coverage/pkgs/java/*.hpi

test/integration/test-fixtures/image-pkg-coverage/Dockerfile

@@ -1,2 +1,4 @@
 FROM scratch
-COPY . .
+COPY pkgs/ .
+# we duplicate to show a package count difference between all-layers and squashed scopes
+COPY lib lib

test/integration/test-fixtures/image-pkg-coverage/lib/apk/db/installed

@@ -46,4 +46,4 @@ a:0:0:755
 Z:Q1dAdYK8M/INibRQF5B3Rw7cmNDDA=
 R:getent
 a:0:0:755
-Z:Q1eR2Dz/WylabgbWMTkd2+hGmEya4=
+Z:Q1eR2Dz/WylabgbWMTkd2+hGmEya4=

test/integration/test-fixtures/image-pkg-coverage/pkgs/lib/apk/db/installed

@@ -0,0 +1,49 @@
+C:Q1p78yvTLG094tHE1+dToJGbmYzQE=
+P:libc-utils
+V:0.7.2-r0
+A:x86_64
+S:1175
+I:4096
+T:Meta package to pull in correct libc
+U:http://alpinelinux.org
+L:BSD
+o:libc-dev
+m:Natanael Copa <ncopa@alpinelinux.org>
+t:1575749004
+c:97b1c2842faa3bfa30f5811ffbf16d5ff9f1a479
+D:musl-utils
+
+C:Q1bTtF5526tETKfL+lnigzIDvm+2o=
+P:musl-utils
+V:1.1.24-r2
+A:x86_64
+S:37944
+I:151552
+T:the musl c library (libc) implementation
+U:https://musl.libc.org/
+L:MIT BSD GPL2+
+o:musl
+m:Timo Teräs <timo.teras@iki.fi>
+t:1584790550
+c:4024cc3b29ad4c65544ad068b8f59172b5494306
+D:scanelf so:libc.musl-x86_64.so.1
+p:cmd:getconf cmd:getent cmd:iconv cmd:ldconfig cmd:ldd
+r:libiconv
+F:sbin
+R:ldconfig
+a:0:0:755
+Z:Q1Kja2+POZKxEkUOZqwSjC6kmaED4=
+F:usr
+F:usr/bin
+R:iconv
+a:0:0:755
+Z:Q1CVmFbdY+Hv6/jAHl1gec2Kbx1EY=
+R:ldd
+a:0:0:755
+Z:Q1yFAhGggmL7ERgbIA7KQxyTzf3ks=
+R:getconf
+a:0:0:755
+Z:Q1dAdYK8M/INibRQF5B3Rw7cmNDDA=
+R:getent
+a:0:0:755
+Z:Q1eR2Dz/WylabgbWMTkd2+hGmEya4=