Introduce a single SBOM document (#606)

* [wip] single sbom doc

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix more tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update cli tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove scope in import path

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* swap SPDX tag-value formatter to single sbom document

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* bust CLI cache

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update fixture to byte diff

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* byte for byte

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* bust the cache

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* who needs cache

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* add jar for testing

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* no more bit flips

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* update apk with the delta for image and directory cases

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* restore cache workflow

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

Co-authored-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

test/integration/catalog_packages_cases_test.go

@@ -41,6 +41,15 @@ var imageOnlyTestCases = []testCase{
 			"someotherpkg": "3.19.0",
 		},
 	},
+	{
+		// When the image is build lib overwrites pkgs/lib causing there to only be two packages
+		name:    "find apkdb packages",
+		pkgType: pkg.ApkPkg,
+		pkgInfo: map[string]string{
+			"musl-utils": "1.1.24-r2",
+			"libc-utils": "0.7.2-r0",
+		},
+	},
 }
 
 var dirOnlyTestCases = []testCase{
@@ -149,6 +158,15 @@ var dirOnlyTestCases = []testCase{
 			"version_check": "0.1.5",
 		},
 	},
+	{
+		name:       "find apkdb packages",
+		pkgType:    pkg.ApkPkg,
+		duplicates: 2, // when the directory is cataloged we have duplicates between lib/ and pkgs/lib
+		pkgInfo: map[string]string{
+			"musl-utils": "1.1.24-r2",
+			"libc-utils": "0.7.2-r0",
+		},
+	},
 }
 
 var commonTestCases = []testCase{
@@ -186,13 +204,4 @@ var commonTestCases = []testCase{
 			"example-jenkins-plugin": "1.0-SNAPSHOT",
 		},
 	},
-	{
-
-		name:    "find apkdb packages",
-		pkgType: pkg.ApkPkg,
-		pkgInfo: map[string]string{
-			"musl-utils": "1.1.24-r2",
-			"libc-utils": "0.7.2-r0",
-		},
-	},
 }

test/integration/package_ownership_relationship_test.go

@@ -7,7 +7,7 @@ import (
 
 	"github.com/anchore/syft/internal/formats/syftjson"
 	syftjsonModel "github.com/anchore/syft/internal/formats/syftjson/model"
-	"github.com/anchore/syft/syft/source"
+	"github.com/anchore/syft/syft/sbom"
 )
 
 func TestPackageOwnershipRelationships(t *testing.T) {
@@ -25,7 +25,13 @@ func TestPackageOwnershipRelationships(t *testing.T) {
 		t.Run(test.fixture, func(t *testing.T) {
 			catalog, d, src := catalogFixtureImage(t, test.fixture)
 
-			p := syftjson.Format().Presenter(catalog, &src.Metadata, d, source.SquashedScope)
+			p := syftjson.Format().Presenter(sbom.SBOM{
+				Artifacts: sbom.Artifacts{
+					PackageCatalog: catalog,
+					Distro:         d,
+				},
+				Source: src.Metadata,
+			})
 			if p == nil {
 				t.Fatal("unable to get presenter")
 			}

test/integration/test-fixtures/.gitignore

@@ -3,5 +3,5 @@
 # twice in the repo seems redundant (even via symlink). Given that the fixture is a few kilobytes in size, the build process is already
 # captured, and integration tests should only be testing if jars can be discovered (not necessarily depth in java detection
 # functionality), committing it seems like an acceptable exception.
-!image-pkg-coverage/java/*.jar
-!image-pkg-coverage/java/*.hpi
+!image-pkg-coverage/pkgs/java/*.jar
+!image-pkg-coverage/pkgs/java/*.hpi

test/integration/test-fixtures/image-pkg-coverage/Dockerfile

@@ -1,2 +1,4 @@
 FROM scratch
-COPY . .
+COPY pkgs/ .
+# we duplicate to show a package count difference between all-layers and squashed scopes
+COPY lib lib

test/integration/test-fixtures/image-pkg-coverage/lib/apk/db/installed

@@ -46,4 +46,4 @@ a:0:0:755
 Z:Q1dAdYK8M/INibRQF5B3Rw7cmNDDA=
 R:getent
 a:0:0:755
-Z:Q1eR2Dz/WylabgbWMTkd2+hGmEya4=
+Z:Q1eR2Dz/WylabgbWMTkd2+hGmEya4=

test/integration/test-fixtures/image-pkg-coverage/pkgs/lib/apk/db/installed

@@ -0,0 +1,49 @@
+C:Q1p78yvTLG094tHE1+dToJGbmYzQE=
+P:libc-utils
+V:0.7.2-r0
+A:x86_64
+S:1175
+I:4096
+T:Meta package to pull in correct libc
+U:http://alpinelinux.org
+L:BSD
+o:libc-dev
+m:Natanael Copa <ncopa@alpinelinux.org>
+t:1575749004
+c:97b1c2842faa3bfa30f5811ffbf16d5ff9f1a479
+D:musl-utils
+
+C:Q1bTtF5526tETKfL+lnigzIDvm+2o=
+P:musl-utils
+V:1.1.24-r2
+A:x86_64
+S:37944
+I:151552
+T:the musl c library (libc) implementation
+U:https://musl.libc.org/
+L:MIT BSD GPL2+
+o:musl
+m:Timo Teräs <timo.teras@iki.fi>
+t:1584790550
+c:4024cc3b29ad4c65544ad068b8f59172b5494306
+D:scanelf so:libc.musl-x86_64.so.1
+p:cmd:getconf cmd:getent cmd:iconv cmd:ldconfig cmd:ldd
+r:libiconv
+F:sbin
+R:ldconfig
+a:0:0:755
+Z:Q1Kja2+POZKxEkUOZqwSjC6kmaED4=
+F:usr
+F:usr/bin
+R:iconv
+a:0:0:755
+Z:Q1CVmFbdY+Hv6/jAHl1gec2Kbx1EY=
+R:ldd
+a:0:0:755
+Z:Q1yFAhGggmL7ERgbIA7KQxyTzf3ks=
+R:getconf
+a:0:0:755
+Z:Q1dAdYK8M/INibRQF5B3Rw7cmNDDA=
+R:getent
+a:0:0:755
+Z:Q1eR2Dz/WylabgbWMTkd2+hGmEya4=