Migrate SPDX-JSON relationships to SBOM model (#634)

* remove power-user document shape

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add power-user specific fields to syft-json format

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* port remaining spdx-json relationships to sbom model

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add coordinate set

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add SBOM file path helper

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* use internal mimetype helper in go binary cataloger

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add new package-of relationship

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update json schema to v2

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* replace power-user presenter with syft-json format

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix tests and linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove "package-of" relationship (in favor of "contains")

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add tests for spdx22json format encoding enhancements

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update TODO and log entries

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* introduce sbom.Descriptor

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

syft/source/coordinates.go

@@ -2,6 +2,7 @@ package source
 
 import (
 	"fmt"
+	"sort"
 
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
@@ -13,6 +14,18 @@ type Coordinates struct {
 	FileSystemID string `json:"layerID,omitempty"` // An ID representing the filesystem. For container images, this is a layer digest. For directories or a root filesystem, this is blank.
 }
 
+// CoordinateSet represents a set of string types.
+type CoordinateSet map[Coordinates]struct{}
+
+// NewCoordinateSet creates a CoordinateSet populated with values from the given slice.
+func NewCoordinateSet(start ...Coordinates) CoordinateSet {
+	ret := make(CoordinateSet)
+	for _, s := range start {
+		ret.Add(s)
+	}
+	return ret
+}
+
 func (c Coordinates) ID() artifact.ID {
 	f, err := artifact.IDFromHash(c)
 	if err != nil {
@@ -32,3 +45,37 @@ func (c Coordinates) String() string {
 	}
 	return fmt.Sprintf("Location<%s>", str)
 }
+
+// Add a string to the set.
+func (s CoordinateSet) Add(i Coordinates) {
+	s[i] = struct{}{}
+}
+
+// Remove a string from the set.
+func (s CoordinateSet) Remove(i Coordinates) {
+	delete(s, i)
+}
+
+// Contains indicates if the given string is contained within the set.
+func (s CoordinateSet) Contains(i Coordinates) bool {
+	_, ok := s[i]
+	return ok
+}
+
+// ToSlice returns a sorted slice of Locations that are contained within the set.
+func (s CoordinateSet) ToSlice() []Coordinates {
+	ret := make([]Coordinates, len(s))
+	idx := 0
+	for v := range s {
+		ret[idx] = v
+		idx++
+	}
+
+	sort.SliceStable(ret, func(i, j int) bool {
+		if ret[i].RealPath == ret[j].RealPath {
+			return ret[i].FileSystemID < ret[j].FileSystemID
+		}
+		return ret[i].RealPath < ret[j].RealPath
+	})
+	return ret
+}

syft/source/coordinates_test.go

@@ -0,0 +1,51 @@
+package source
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestCoordinateSet(t *testing.T) {
+
+	binA := Coordinates{
+		RealPath:     "/bin",
+		FileSystemID: "a",
+	}
+
+	binB := Coordinates{
+		RealPath:     "/bin",
+		FileSystemID: "b",
+	}
+
+	tests := []struct {
+		name     string
+		input    []Coordinates
+		expected []Coordinates
+	}{
+		{
+			name: "de-dup same location",
+			input: []Coordinates{
+				binA, binA, binA,
+			},
+			expected: []Coordinates{
+				binA,
+			},
+		},
+		{
+			name: "dont de-dup different filesystem",
+			input: []Coordinates{
+				binB, binA,
+			},
+			expected: []Coordinates{
+				binA, binB,
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, NewCoordinateSet(test.input...).ToSlice())
+		})
+	}
+}