feat: add support for Bitnami cataloguer (#3341)

* prototype: start bitnami cataloger Bitnami images have spdx SBOMs at predictable paths, and Syft could more accurately identify the software in these images by scanning those SBOMs. Start work on this by forking the sbom-cataloger as a new bitnami-cataloger. Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * wire up bitnami cataloger to run on images by default Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * feat: add support for Bitnami cataloguer Signed-off-by: juan131 <jariza@vmware.com> * feat: use a better SPDX sample for unit tests Signed-off-by: juan131 <jariza@vmware.com> * bugfix: only report bitnami pkgs Signed-off-by: juan131 <jariza@vmware.com> * feat: adapt JSON schema, spdxutil and packagemetadata Signed-off-by: juan131 <jariza@vmware.com> * bugfix: integration tests Signed-off-by: juan131 <jariza@vmware.com> * feat: implement FileOwner interface Signed-off-by: juan131 <jariza@vmware.com> * bugfix: update json schema Signed-off-by: juan131 <jariza@vmware.com> * [wip] add bitnami owned files and fix binary package ownership filtering Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * feat: obtain bitnami pkg files based on SPDX relationships tree Signed-off-by: juan131 <jariza@vmware.com> * preserve type switches Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename bitnami entry metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * restrict find main pkg logic Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add missing graalvm source info Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bugfix: integration tests Signed-off-by: juan131 <jariza@vmware.com> * bugfix: mod tidy Signed-off-by: juan131 <jariza@vmware.com> --------- Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> Signed-off-by: juan131 <jariza@vmware.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
2026-10-30 14:02:26 +01:00 · 2025-02-18 09:07:47 -05:00
parent 869908ece1
commit bffe26bcc5
32 changed files with 4674 additions and 60 deletions
@@ -3,5 +3,5 @@ package internal
 const (
 	// JSONSchemaVersion is the current schema version output by the JSON encoder
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "16.0.21"
+	JSONSchemaVersion = "16.0.22"
 )
@@ -58,11 +58,10 @@ func generateRelationships(resolver file.Resolver, accessor sbomsync.Accessor, i

 // PackagesToRemove returns a list of binary packages (resolved by the ELF cataloger) that should be removed from the SBOM
 // These packages are removed because they are already represented by a higher order packages in the SBOM.
-func PackagesToRemove(resolver file.Resolver, accessor sbomsync.Accessor) []artifact.ID {
+func PackagesToRemove(accessor sbomsync.Accessor) []artifact.ID {
 	pkgsToDelete := make([]artifact.ID, 0)
 	accessor.ReadFromSBOM(func(s *sbom.SBOM) {
-		// OTHER package type > ELF package type > Binary package type
-		pkgsToDelete = append(pkgsToDelete, getBinaryPackagesToDelete(resolver, s)...)
+		// ELF package type > Binary package type
 		pkgsToDelete = append(pkgsToDelete, compareElfBinaryPackages(s)...)
 	})
 	return pkgsToDelete
@@ -114,33 +113,6 @@ func isElfPackage(p pkg.Package) bool {
 	return ok
 }

-func getBinaryPackagesToDelete(resolver file.Resolver, s *sbom.SBOM) []artifact.ID {
-	pkgsToDelete := make([]artifact.ID, 0)
-	for p := range s.Artifacts.Packages.Enumerate() {
-		if p.Type == pkg.BinaryPkg {
-			continue
-		}
-		fileOwner, ok := p.Metadata.(pkg.FileOwner)
-		if !ok {
-			continue
-		}
-		ownedFiles := fileOwner.OwnedFiles()
-		locations, err := resolver.FilesByPath(ownedFiles...)
-		if err != nil {
-			log.WithFields("error", err).Trace("unable to find path for owned file")
-			continue
-		}
-		for _, loc := range locations {
-			for _, pathPkg := range s.Artifacts.Packages.PackagesByPath(loc.RealPath) {
-				if pathPkg.Type == pkg.BinaryPkg {
-					pkgsToDelete = append(pkgsToDelete, pathPkg.ID())
-				}
-			}
-		}
-	}
-	return pkgsToDelete
-}
-
 func populateRelationships(exec file.Executable, parentPkg pkg.Package, resolver file.Resolver, addRelationship func(artifact.Relationship), index *sharedLibraryIndex) {
 	for _, libReference := range exec.ImportedLibraries {
 		// for each library reference, check s.Artifacts.Packages.Sorted(pkg.BinaryPkg) for a binary package that represents that library
@@ -21,7 +21,7 @@ func TestPackagesToRemove(t *testing.T) {
 		Name:    "glibc",
 		Version: "2.28-236.el8_9.12",
 		Locations: file.NewLocationSet(
-			file.NewLocation(glibcCoordinate.RealPath),
+			file.NewLocation("path/to/rpmdb"),
 		),
 		Type: pkg.RpmPkg,
 		Metadata: pkg.RpmDBEntry{
@@ -88,50 +88,45 @@ func TestPackagesToRemove(t *testing.T) {

 	tests := []struct {
 		name     string
-		resolver file.Resolver
 		accessor sbomsync.Accessor
 		want     []artifact.ID
 	}{
 		{
 			name:     "remove packages that are overlapping rpm --> binary",
-			resolver: file.NewMockResolverForPaths(glibcCoordinate.RealPath),
 			accessor: newAccessor([]pkg.Package{glibCPackage, glibCBinaryELFPackage}, map[file.Coordinates]file.Executable{}, nil),
-			want:     []artifact.ID{glibCBinaryELFPackage.ID()},
+			// this is surprising, right? the calling function reasons about if any generic binary package (regardless of it being an ELF package or not)
+			// should be deleted or kept based on the user configuration to do so.
+			want: []artifact.ID{},
 		},
 		{
 			name:     "keep packages that are overlapping rpm --> binary when the binary self identifies as an RPM",
-			resolver: file.NewMockResolverForPaths(glibcCoordinate.RealPath),
 			accessor: newAccessor([]pkg.Package{glibCPackage, glibCBinaryELFPackageAsRPM}, map[file.Coordinates]file.Executable{}, nil),
 			want:     []artifact.ID{},
 		},
 		{
 			name:     "remove no packages when there is a single binary package (or self identifying RPM)",
-			resolver: file.NewMockResolverForPaths(glibcCoordinate.RealPath),
 			accessor: newAccessor([]pkg.Package{glibCBinaryELFPackage, glibCBinaryELFPackageAsRPM}, map[file.Coordinates]file.Executable{}, nil),
 			want:     []artifact.ID{},
 		},
 		{
 			name:     "remove packages when there is a single binary package and a classifier package",
-			resolver: file.NewMockResolverForPaths(glibcCoordinate.RealPath),
 			accessor: newAccessor([]pkg.Package{glibCBinaryELFPackage, glibCBinaryClassifierPackage}, map[file.Coordinates]file.Executable{}, nil),
 			want:     []artifact.ID{glibCBinaryClassifierPackage.ID()},
 		},
 		{
 			name:     "ensure we're considering ELF packages, not just binary packages (supporting evidence)",
-			resolver: file.NewMockResolverForPaths(glibcCoordinate.RealPath),
 			accessor: newAccessor([]pkg.Package{glibCBinaryClassifierPackage}, map[file.Coordinates]file.Executable{}, nil),
 			want:     []artifact.ID{},
 		},
 		{
 			name:     "ensure we're considering ELF packages, not just binary packages (primary evidence)",
-			resolver: file.NewMockResolverForPaths(glibcCoordinate.RealPath),
 			accessor: newAccessor([]pkg.Package{libCBinaryClassifierPackage}, map[file.Coordinates]file.Executable{}, nil),
 			want:     []artifact.ID{},
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			pkgsToDelete := PackagesToRemove(tt.resolver, tt.accessor)
+			pkgsToDelete := PackagesToRemove(tt.accessor)
 			if diff := cmp.Diff(tt.want, pkgsToDelete); diff != "" {
 				t.Errorf("unexpected packages to delete (-want, +got): %s", diff)
 			}
@@ -22,6 +22,9 @@ var (
 	binaryCatalogerTypes = []pkg.Type{
 		pkg.BinaryPkg,
 	}
+	bitnamiCatalogerTypes = []pkg.Type{
+		pkg.BitnamiPkg,
+	}
 	binaryMetadataTypes = []string{
 		reflect.TypeOf(pkg.ELFBinaryPackageNoteJSONPayload{}).Name(),
 		reflect.TypeOf(pkg.BinarySignature{}).Name(),
@@ -65,6 +68,10 @@ func excludeByFileOwnershipOverlap(r artifact.Relationship, c *pkg.Collection) a
 		return idToRemove
 	}

+	if idToRemove := identifyOverlappingBitnamiRelationship(parent, child); idToRemove != "" {
+		return idToRemove
+	}
+
 	return ""
 }

@@ -124,3 +131,24 @@ func identifyOverlappingOSRelationship(parent *pkg.Package, child *pkg.Package)

 	return child.ID()
 }
+
+// identifyOverlappingBitnamiRelationship indicates the package ID to remove if this is a Bitnami pkg -> bin pkg relationship.
+func identifyOverlappingBitnamiRelationship(parent *pkg.Package, child *pkg.Package) artifact.ID {
+	if !slices.Contains(bitnamiCatalogerTypes, parent.Type) {
+		return ""
+	}
+
+	if slices.Contains(binaryCatalogerTypes, child.Type) {
+		return child.ID()
+	}
+
+	if child.Metadata == nil {
+		return ""
+	}
+
+	if !slices.Contains(binaryMetadataTypes, reflect.TypeOf(child.Metadata).Name()) {
+		return ""
+	}
+
+	return child.ID()
+}
@@ -13,7 +13,8 @@ func TestExcludeByFileOwnershipOverlap(t *testing.T) {
 	packageA := pkg.Package{Name: "package-a", Type: pkg.ApkPkg}
 	packageB := pkg.Package{Name: "package-b", Type: pkg.BinaryPkg, Metadata: pkg.JavaVMInstallation{}}
 	packageC := pkg.Package{Name: "package-c", Type: pkg.BinaryPkg, Metadata: pkg.ELFBinaryPackageNoteJSONPayload{Type: "rpm"}}
-	for _, p := range []*pkg.Package{&packageA, &packageB, &packageC} {
+	packageD := pkg.Package{Name: "package-d", Type: pkg.BitnamiPkg}
+	for _, p := range []*pkg.Package{&packageA, &packageB, &packageC, &packageD} {
 		p := p
 		p.SetID()
 	}
@@ -46,6 +47,17 @@ func TestExcludeByFileOwnershipOverlap(t *testing.T) {
 			packages:      pkg.NewCollection(packageC, packageB),
 			shouldExclude: true,
 		},
+		{
+			// prove that Bitnami -> bin exclusions are wired
+			name: "exclusions from bitnami -> binary",
+			relationship: artifact.Relationship{
+				Type: artifact.OwnershipByFileOverlapRelationship,
+				From: packageD, // Bitnami
+				To:   packageC, // ELF binary
+			},
+			packages:      pkg.NewCollection(packageD, packageC),
+			shouldExclude: true,
+		},
 	}

 	for _, test := range tests {
@@ -117,6 +129,63 @@ func TestIdentifyOverlappingOSRelationship(t *testing.T) {
 	}
 }

+func TestIdentifyOverlappingBitnamiRelationship(t *testing.T) {
+	packageA := pkg.Package{Name: "package-a", Type: pkg.BitnamiPkg} // Bitnami package
+	packageB := pkg.Package{Name: "package-b", Type: pkg.BinaryPkg}
+	packageC := pkg.Package{Name: "package-c", Type: pkg.BinaryPkg, Metadata: pkg.BinarySignature{}}
+	packageD := pkg.Package{Name: "package-d", Type: pkg.PythonPkg} // Language package
+	packageE := pkg.Package{Name: "package-e", Type: pkg.BinaryPkg, Metadata: pkg.ELFBinaryPackageNoteJSONPayload{}}
+
+	for _, p := range []*pkg.Package{&packageA, &packageB, &packageC, &packageD, &packageE} {
+		p.SetID()
+	}
+
+	tests := []struct {
+		name       string
+		parent     *pkg.Package
+		child      *pkg.Package
+		expectedID artifact.ID
+	}{
+		{
+			name:       "Bitnami -> binary without metadata",
+			parent:     &packageA,
+			child:      &packageB,
+			expectedID: packageB.ID(), // Bitnami package to binary package, should return child ID
+		},
+		{
+			name:       "Bitnami -> binary with binary metadata",
+			parent:     &packageA,
+			child:      &packageC,
+			expectedID: packageC.ID(), // Bitnami package to binary package with binary metadata, should return child ID
+		},
+		{
+			name:       "Bitnami -> non-binary package",
+			parent:     &packageA,
+			child:      &packageD,
+			expectedID: "", // Bitnami package to non-binary package, no exclusion
+		},
+		{
+			name:       "Bitnami -> binary with ELF metadata",
+			parent:     &packageA,
+			child:      &packageE,
+			expectedID: packageE.ID(), // Bitnami package to binary package with ELF metadata, should return child ID
+		},
+		{
+			name:       "non-Bitnami parent",
+			parent:     &packageD, // non-Bitnami package
+			child:      &packageC,
+			expectedID: "", // non-Bitnami parent, no exclusion
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			resultID := identifyOverlappingBitnamiRelationship(tt.parent, tt.child)
+			assert.Equal(t, tt.expectedID, resultID)
+		})
+	}
+}
+
 func TestIdentifyOverlappingJVMRelationship(t *testing.T) {

 	packageA := pkg.Package{Name: "package-a", Type: pkg.BinaryPkg}
@@ -6,6 +6,7 @@ import (
 	"github.com/anchore/syft/syft/pkg/cataloger/alpine"
 	"github.com/anchore/syft/syft/pkg/cataloger/arch"
 	"github.com/anchore/syft/syft/pkg/cataloger/binary"
+	bitnamiSbomCataloger "github.com/anchore/syft/syft/pkg/cataloger/bitnami"
 	"github.com/anchore/syft/syft/pkg/cataloger/cpp"
 	"github.com/anchore/syft/syft/pkg/cataloger/dart"
 	"github.com/anchore/syft/syft/pkg/cataloger/debian"
@@ -152,6 +153,7 @@ func DefaultPackageTaskFactories() Factories {
 			pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "linux", "kernel",
 		),
 		newSimplePackageTaskFactory(sbomCataloger.NewCataloger, "sbom"), // note: not evidence of installed packages
+		newSimplePackageTaskFactory(bitnamiSbomCataloger.NewCataloger, "bitnami", pkgcataloging.InstalledTag, pkgcataloging.ImageTag),
 		newSimplePackageTaskFactory(wordpress.NewWordpressPluginCataloger, pkgcataloging.DirectoryTag, pkgcataloging.ImageTag, "wordpress"),
 		newSimplePackageTaskFactory(terraform.NewLockCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, "terraform"),
 	}
@@ -42,7 +42,7 @@ func finalizeRelationships(resolver file.Resolver, builder sbomsync.Builder, cfg

 	// remove ELF packages and Binary packages that are already
 	// represented by a source package (e.g. a package that is evident by some package manager)
-	builder.DeletePackages(binary.PackagesToRemove(resolver, accessor)...)
+	builder.DeletePackages(binary.PackagesToRemove(accessor)...)

 	// add relationships showing packages that are evident by a file which is owned by another package (package-to-package)
 	if cfg.PackageFileOwnershipOverlap {