feat: add support for Bitnami cataloguer (#3341)

* prototype: start bitnami cataloger Bitnami images have spdx SBOMs at predictable paths, and Syft could more accurately identify the software in these images by scanning those SBOMs. Start work on this by forking the sbom-cataloger as a new bitnami-cataloger. Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * wire up bitnami cataloger to run on images by default Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * feat: add support for Bitnami cataloguer Signed-off-by: juan131 <jariza@vmware.com> * feat: use a better SPDX sample for unit tests Signed-off-by: juan131 <jariza@vmware.com> * bugfix: only report bitnami pkgs Signed-off-by: juan131 <jariza@vmware.com> * feat: adapt JSON schema, spdxutil and packagemetadata Signed-off-by: juan131 <jariza@vmware.com> * bugfix: integration tests Signed-off-by: juan131 <jariza@vmware.com> * feat: implement FileOwner interface Signed-off-by: juan131 <jariza@vmware.com> * bugfix: update json schema Signed-off-by: juan131 <jariza@vmware.com> * [wip] add bitnami owned files and fix binary package ownership filtering Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * feat: obtain bitnami pkg files based on SPDX relationships tree Signed-off-by: juan131 <jariza@vmware.com> * preserve type switches Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename bitnami entry metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * restrict find main pkg logic Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add missing graalvm source info Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bugfix: integration tests Signed-off-by: juan131 <jariza@vmware.com> * bugfix: mod tidy Signed-off-by: juan131 <jariza@vmware.com> --------- Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> Signed-off-by: juan131 <jariza@vmware.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
2026-11-01 23:16:30 +01:00 · 2025-02-18 09:07:47 -05:00
parent 869908ece1
commit bffe26bcc5
32 changed files with 4674 additions and 60 deletions
@@ -0,0 +1,173 @@
+/*
+Package bitnami provides a concrete Cataloger implementation for capturing packages embedded within Bitnami SBOM files.
+*/
+package bitnami
+
+import (
+	"context"
+	"path/filepath"
+	"strings"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/format"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/generic"
+)
+
+const catalogerName = "bitnami-cataloger"
+
+// NewCataloger returns a new SBOM cataloger object loaded from saved SBOM JSON.
+func NewCataloger() pkg.Cataloger {
+	return generic.NewCataloger(catalogerName).
+		WithParserByGlobs(parseSBOM,
+			"/opt/bitnami/**/.spdx-*.spdx",
+		)
+}
+
+func parseSBOM(_ context.Context, resolver file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
+	s, sFormat, _, err := format.Decode(reader)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	if s == nil {
+		log.WithFields("path", reader.Location.RealPath).Trace("file is not an SBOM")
+		return nil, nil, nil
+	}
+
+	// Bitnami exclusively uses SPDX JSON SBOMs
+	if sFormat != "spdx-json" {
+		log.WithFields("path", reader.Location.RealPath).Trace("file is not an SPDX JSON SBOM")
+		return nil, nil, nil
+	}
+
+	var pkgs []pkg.Package
+	var secondaryPkgsFiles []string
+	mainPkgID := findMainPkgID(s.Relationships)
+	for _, p := range s.Artifacts.Packages.Sorted() {
+		// We only want to report Bitnami packages
+		if !strings.HasPrefix(p.PURL, "pkg:bitnami") {
+			continue
+		}
+
+		p.FoundBy = catalogerName
+		p.Type = pkg.BitnamiPkg
+		// replace all locations on the package with the location of the SBOM file.
+		// Why not keep the original list of locations? Since the "locations" field is meant to capture
+		// where there is evidence of this file, and the catalogers have not run against any file other than,
+		// the SBOM, this is the only location that is relevant for this cataloger.
+		p.Locations = file.NewLocationSet(
+			reader.Location.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
+		)
+
+		// Parse the Bitnami-specific metadata
+		metadata, err := parseBitnamiPURL(p.PURL)
+		if err != nil {
+			return nil, nil, err
+		}
+
+		// Bitnami packages reported in a SPDX file are shipped under the same directory
+		// as the SPDX file itself.
+		metadata.Path = filepath.Dir(reader.Location.RealPath)
+		if p.ID() != mainPkgID {
+			metadata.Files = packageFiles(s.Relationships, p, metadata.Path)
+			secondaryPkgsFiles = append(secondaryPkgsFiles, metadata.Files...)
+		}
+
+		p.Metadata = metadata
+
+		pkgs = append(pkgs, p)
+	}
+
+	// Resolve all files owned by the main package in the SBOM and update the metadata
+	if mainPkgFiles, err := mainPkgFiles(resolver, reader.Location.RealPath, secondaryPkgsFiles); err == nil {
+		for i, p := range pkgs {
+			if p.ID() == mainPkgID {
+				metadata, ok := p.Metadata.(*pkg.BitnamiSBOMEntry)
+				if !ok {
+					log.WithFields("spdx-filepath", reader.Location.RealPath).Trace("main package in SBOM does not have Bitnami metadata")
+					continue
+				}
+
+				metadata.Files = mainPkgFiles
+				pkgs[i].Metadata = metadata
+			}
+		}
+	} else {
+		log.WithFields("spdx-filepath", reader.Location.RealPath, "error", err).Trace("unable to resolve owned files for main package in SBOM")
+	}
+
+	return pkgs, filterRelationships(s.Relationships, pkgs), nil
+}
+
+// filterRelationships filters out relationships that are not related to Bitnami packages
+// and replaces the package information with the one with completed info
+func filterRelationships(relationships []artifact.Relationship, pkgs []pkg.Package) []artifact.Relationship {
+	var result []artifact.Relationship
+	for _, r := range relationships {
+		if value, ok := r.From.(pkg.Package); ok {
+			found := false
+			for _, p := range pkgs {
+				if value.PURL == p.PURL {
+					r.From = p
+					found = true
+					break
+				}
+			}
+			if !found {
+				continue
+			}
+		}
+		if value, ok := r.To.(pkg.Package); ok {
+			found := false
+			for _, p := range pkgs {
+				if value.PURL == p.PURL {
+					r.To = p
+					found = true
+					break
+				}
+			}
+			if !found {
+				continue
+			}
+		}
+		result = append(result, r)
+	}
+
+	return result
+}
+
+// findMainPkgID goes through the list of relationships and finds the main package ID
+// which is the one that contains other packages but is not contained by any other package
+func findMainPkgID(relationships []artifact.Relationship) artifact.ID {
+	containedByAnother := func(candidateID artifact.ID) bool {
+		for _, r := range relationships {
+			if r.Type != artifact.ContainsRelationship {
+				continue
+			}
+
+			if to, ok := r.To.(pkg.Package); ok {
+				if to.ID() == candidateID {
+					return true
+				}
+			}
+		}
+
+		return false
+	}
+
+	for _, r := range relationships {
+		if from, ok := r.From.(pkg.Package); ok {
+			if !strings.HasPrefix(from.PURL, "pkg:bitnami") {
+				continue
+			}
+			if !containedByAnother(from.ID()) {
+				return from.ID()
+			}
+		}
+	}
+
+	return ""
+}
@@ -0,0 +1,470 @@
+package bitnami
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/cpe"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/license"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/internal/pkgtest"
+)
+
+func mustCPEs(s ...string) (c []cpe.CPE) {
+	for _, i := range s {
+		newCPE := cpe.Must(i, "")
+		newCPE.Source = cpe.DeclaredSource
+		c = append(c, newCPE)
+	}
+	return
+}
+
+func TestBitnamiCataloger(t *testing.T) {
+	postgresqlMainPkg := pkg.Package{
+		Name:      "postgresql",
+		Version:   "17.2.0-8",
+		Type:      pkg.BitnamiPkg,
+		Locations: file.NewLocationSet(file.NewLocation("opt/bitnami/postgresql/.spdx-postgresql.spdx")),
+		Licenses: pkg.NewLicenseSet(
+			pkg.NewLicenseFromType("PostgreSQL", license.Concluded),
+			pkg.NewLicenseFromType("PostgreSQL", license.Declared),
+		),
+		FoundBy: catalogerName,
+		PURL:    "pkg:bitnami/postgresql@17.2.0-8?arch=arm64&distro=debian-12",
+		CPEs: mustCPEs(
+			"cpe:2.3:*:postgresql:postgresql:17.2.0:*:*:*:*:*:*:*",
+		),
+		Metadata: &pkg.BitnamiSBOMEntry{
+			Name:         "postgresql",
+			Version:      "17.2.0",
+			Revision:     "8",
+			Architecture: "arm64",
+			Distro:       "debian-12",
+			Path:         "opt/bitnami/postgresql",
+			Files: []string{
+				"opt/bitnami/postgresql/readme.txt",
+			},
+		},
+	}
+	postgresqlSecondaryPkgs := []pkg.Package{
+		{
+			Name:      "geos",
+			Version:   "3.13.0",
+			Type:      pkg.BitnamiPkg,
+			Locations: file.NewLocationSet(file.NewLocation("opt/bitnami/postgresql/.spdx-postgresql.spdx")),
+			Licenses: pkg.NewLicenseSet(
+				pkg.NewLicenseFromType("LGPL-2.1-only", license.Concluded),
+				pkg.NewLicenseFromType("LGPL-2.1-only", license.Declared),
+			),
+			FoundBy: catalogerName,
+			PURL:    "pkg:bitnami/geos@3.13.0?arch=arm64&distro=debian-12",
+			CPEs: mustCPEs(
+				"cpe:2.3:*:libgeos:geos:3.13.0:*:*:*:*:*:*:*",
+			),
+			Metadata: &pkg.BitnamiSBOMEntry{
+				Name:         "geos",
+				Version:      "3.13.0",
+				Architecture: "arm64",
+				Distro:       "debian-12",
+				Path:         "opt/bitnami/postgresql",
+			},
+		},
+		{
+			Name:      "proj",
+			Version:   "6.3.2",
+			Type:      pkg.BitnamiPkg,
+			Locations: file.NewLocationSet(file.NewLocation("opt/bitnami/postgresql/.spdx-postgresql.spdx")),
+			Licenses: pkg.NewLicenseSet(
+				pkg.NewLicenseFromType("MIT", license.Concluded),
+				pkg.NewLicenseFromType("MIT", license.Declared),
+			),
+			FoundBy: catalogerName,
+			PURL:    "pkg:bitnami/proj@6.3.2?arch=arm64&distro=debian-12",
+			CPEs: mustCPEs(
+				"cpe:2.3:*:proj:proj:6.3.2:*:*:*:*:*:*:*",
+			),
+			Metadata: &pkg.BitnamiSBOMEntry{
+				Name:         "proj",
+				Version:      "6.3.2",
+				Architecture: "arm64",
+				Distro:       "debian-12",
+				Path:         "opt/bitnami/postgresql",
+			},
+		},
+		{
+			Name:      "gdal",
+			Version:   "3.10.1",
+			Type:      pkg.BitnamiPkg,
+			Locations: file.NewLocationSet(file.NewLocation("opt/bitnami/postgresql/.spdx-postgresql.spdx")),
+			Licenses: pkg.NewLicenseSet(
+				pkg.NewLicenseFromType("MIT", license.Concluded),
+				pkg.NewLicenseFromType("MIT", license.Declared),
+			),
+			FoundBy: catalogerName,
+			PURL:    "pkg:bitnami/gdal@3.10.1?arch=arm64&distro=debian-12",
+			CPEs: mustCPEs(
+				"cpe:2.3:*:osgeo:gdal:3.10.1:*:*:*:*:*:*:*",
+			),
+			Metadata: &pkg.BitnamiSBOMEntry{
+				Name:         "gdal",
+				Version:      "3.10.1",
+				Architecture: "arm64",
+				Distro:       "debian-12",
+				Path:         "opt/bitnami/postgresql",
+			},
+		},
+		{
+			Name:      "json-c",
+			Version:   "0.16.20220414",
+			Type:      pkg.BitnamiPkg,
+			Locations: file.NewLocationSet(file.NewLocation("opt/bitnami/postgresql/.spdx-postgresql.spdx")),
+			Licenses: pkg.NewLicenseSet(
+				pkg.NewLicenseFromType("MIT", license.Concluded),
+				pkg.NewLicenseFromType("MIT", license.Declared),
+			),
+			FoundBy: catalogerName,
+			PURL:    "pkg:bitnami/json-c@0.16.20220414?arch=arm64&distro=debian-12",
+			CPEs: mustCPEs(
+				"cpe:2.3:*:json-c_project:json-c:0.16.20220414:*:*:*:*:*:*:*",
+			),
+			Metadata: &pkg.BitnamiSBOMEntry{
+				Name:         "json-c",
+				Version:      "0.16.20220414",
+				Architecture: "arm64",
+				Distro:       "debian-12",
+				Path:         "opt/bitnami/postgresql",
+			},
+		},
+		{
+			Name:      "orafce",
+			Version:   "4.14.1",
+			Type:      pkg.BitnamiPkg,
+			Locations: file.NewLocationSet(file.NewLocation("opt/bitnami/postgresql/.spdx-postgresql.spdx")),
+			Licenses: pkg.NewLicenseSet(
+				pkg.NewLicenseFromType("0BSD", license.Concluded),
+				pkg.NewLicenseFromType("0BSD", license.Declared),
+			),
+			FoundBy: catalogerName,
+			PURL:    "pkg:bitnami/orafce@4.14.1?arch=arm64&distro=debian-12",
+			CPEs: mustCPEs(
+				"cpe:2.3:*:orafce:orafce:4.14.1:*:*:*:*:*:*:*",
+			),
+			Metadata: &pkg.BitnamiSBOMEntry{
+				Name:         "orafce",
+				Version:      "4.14.1",
+				Architecture: "arm64",
+				Distro:       "debian-12",
+				Path:         "opt/bitnami/postgresql",
+			},
+		},
+		{
+			Name:      "pljava",
+			Version:   "1.6.8",
+			Type:      pkg.BitnamiPkg,
+			Locations: file.NewLocationSet(file.NewLocation("opt/bitnami/postgresql/.spdx-postgresql.spdx")),
+			Licenses: pkg.NewLicenseSet(
+				pkg.NewLicenseFromType("BSD-3-Clause", license.Concluded),
+				pkg.NewLicenseFromType("BSD-3-Clause", license.Declared),
+			),
+			FoundBy: catalogerName,
+			PURL:    "pkg:bitnami/pljava@1.6.8?arch=arm64&distro=debian-12",
+			CPEs: mustCPEs(
+				"cpe:2.3:*:pl/java_project:pl/java:1.6.8:*:*:*:*:*:*:*",
+			),
+			Metadata: &pkg.BitnamiSBOMEntry{
+				Name:         "pljava",
+				Version:      "1.6.8",
+				Architecture: "arm64",
+				Distro:       "debian-12",
+				Path:         "opt/bitnami/postgresql",
+				Files: []string{
+					"opt/bitnami/postgresql/share/pljava/pljava-api-1.6.8.jar",
+					"opt/bitnami/postgresql/share/pljava/pljava-1.6.8.jar",
+					"opt/bitnami/postgresql/share/pljava/pljava-examples-1.6.8.jar",
+				},
+			},
+		},
+		{
+			Name:      "unixodbc",
+			Version:   "2.3.12",
+			Type:      pkg.BitnamiPkg,
+			Locations: file.NewLocationSet(file.NewLocation("opt/bitnami/postgresql/.spdx-postgresql.spdx")),
+			Licenses: pkg.NewLicenseSet(
+				pkg.NewLicenseFromType("LGPL-2.1-only", license.Concluded),
+				pkg.NewLicenseFromType("LGPL-2.1-only", license.Declared),
+			),
+			FoundBy: catalogerName,
+			PURL:    "pkg:bitnami/unixodbc@2.3.12?arch=arm64&distro=debian-12",
+			CPEs: mustCPEs(
+				"cpe:2.3:*:unixodbc:unixodbc:2.3.12:*:*:*:*:*:*:*",
+			),
+			Metadata: &pkg.BitnamiSBOMEntry{
+				Name:         "unixodbc",
+				Version:      "2.3.12",
+				Architecture: "arm64",
+				Distro:       "debian-12",
+				Path:         "opt/bitnami/postgresql",
+			},
+		},
+		{
+			Name:      "psqlodbc",
+			Version:   "16.0.0",
+			Type:      pkg.BitnamiPkg,
+			Locations: file.NewLocationSet(file.NewLocation("opt/bitnami/postgresql/.spdx-postgresql.spdx")),
+			Licenses: pkg.NewLicenseSet(
+				pkg.NewLicenseFromType("LGPL-3.0-only", license.Concluded),
+				pkg.NewLicenseFromType("LGPL-3.0-only", license.Declared),
+			),
+			FoundBy: catalogerName,
+			PURL:    "pkg:bitnami/psqlodbc@16.0.0?arch=arm64&distro=debian-12",
+			CPEs: mustCPEs(
+				"cpe:2.3:*:postgresql:psqlodbc:16.0.0:*:*:*:*:*:*:*",
+			),
+			Metadata: &pkg.BitnamiSBOMEntry{
+				Name:         "psqlodbc",
+				Version:      "16.0.0",
+				Architecture: "arm64",
+				Distro:       "debian-12",
+				Path:         "opt/bitnami/postgresql",
+			},
+		},
+		{
+			Name:      "protobuf",
+			Version:   "3.21.12",
+			Type:      pkg.BitnamiPkg,
+			Locations: file.NewLocationSet(file.NewLocation("opt/bitnami/postgresql/.spdx-postgresql.spdx")),
+			Licenses: pkg.NewLicenseSet(
+				pkg.NewLicenseFromType("BSD-3-Clause", license.Concluded),
+				pkg.NewLicenseFromType("BSD-3-Clause", license.Declared),
+			),
+			FoundBy: catalogerName,
+			PURL:    "pkg:bitnami/protobuf@3.21.12?arch=arm64&distro=debian-12",
+			CPEs: mustCPEs(
+				"cpe:2.3:*:golang:protobuf:3.21.12:*:*:*:*:*:*:*",
+			),
+			Metadata: &pkg.BitnamiSBOMEntry{
+				Name:         "protobuf",
+				Version:      "3.21.12",
+				Architecture: "arm64",
+				Distro:       "debian-12",
+				Path:         "opt/bitnami/postgresql",
+			},
+		},
+		{
+			Name:      "protobuf-c",
+			Version:   "1.5.1",
+			Type:      pkg.BitnamiPkg,
+			Locations: file.NewLocationSet(file.NewLocation("opt/bitnami/postgresql/.spdx-postgresql.spdx")),
+			Licenses: pkg.NewLicenseSet(
+				pkg.NewLicenseFromType("BSD-2-Clause", license.Concluded),
+				pkg.NewLicenseFromType("BSD-2-Clause", license.Declared),
+			),
+			FoundBy: catalogerName,
+			PURL:    "pkg:bitnami/protobuf-c@1.5.1?arch=arm64&distro=debian-12",
+			CPEs: mustCPEs(
+				"cpe:2.3:*:protobuf-c:protobuf-c:1.5.1:*:*:*:*:*:*:*",
+			),
+			Metadata: &pkg.BitnamiSBOMEntry{
+				Name:         "protobuf-c",
+				Version:      "1.5.1",
+				Architecture: "arm64",
+				Distro:       "debian-12",
+				Path:         "opt/bitnami/postgresql",
+			},
+		},
+		{
+			Name:      "postgis",
+			Version:   "3.4.4",
+			Type:      pkg.BitnamiPkg,
+			Locations: file.NewLocationSet(file.NewLocation("opt/bitnami/postgresql/.spdx-postgresql.spdx")),
+			Licenses: pkg.NewLicenseSet(
+				pkg.NewLicenseFromType("GPL-2.0-or-later", license.Concluded),
+				pkg.NewLicenseFromType("GPL-2.0-or-later", license.Declared),
+			),
+			FoundBy: catalogerName,
+			PURL:    "pkg:bitnami/postgis@3.4.4?arch=arm64&distro=debian-12",
+			CPEs: mustCPEs(
+				"cpe:2.3:*:postgis:postgis:3.4.4:*:*:*:*:*:*:*",
+			),
+			Metadata: &pkg.BitnamiSBOMEntry{
+				Name:         "postgis",
+				Version:      "3.4.4",
+				Architecture: "arm64",
+				Distro:       "debian-12",
+				Path:         "opt/bitnami/postgresql",
+			},
+		},
+		{
+			Name:      "pgaudit",
+			Version:   "17.0.0",
+			Type:      pkg.BitnamiPkg,
+			Locations: file.NewLocationSet(file.NewLocation("opt/bitnami/postgresql/.spdx-postgresql.spdx")),
+			Licenses: pkg.NewLicenseSet(
+				pkg.NewLicenseFromType("PostgreSQL", license.Concluded),
+				pkg.NewLicenseFromType("PostgreSQL", license.Declared),
+			),
+			FoundBy: catalogerName,
+			PURL:    "pkg:bitnami/pgaudit@17.0.0?arch=arm64&distro=debian-12",
+			Metadata: &pkg.BitnamiSBOMEntry{
+				Name:         "pgaudit",
+				Version:      "17.0.0",
+				Architecture: "arm64",
+				Distro:       "debian-12",
+				Path:         "opt/bitnami/postgresql",
+			},
+		},
+		{
+			Name:      "pgbackrest",
+			Version:   "2.54.2",
+			Type:      pkg.BitnamiPkg,
+			Locations: file.NewLocationSet(file.NewLocation("opt/bitnami/postgresql/.spdx-postgresql.spdx")),
+			Licenses: pkg.NewLicenseSet(
+				pkg.NewLicenseFromType("MIT", license.Concluded),
+				pkg.NewLicenseFromType("MIT", license.Declared),
+			),
+			FoundBy: catalogerName,
+			PURL:    "pkg:bitnami/pgbackrest@2.54.2?arch=arm64&distro=debian-12",
+			CPEs: mustCPEs(
+				"cpe:2.3:*:pgbackrest:pgbackrest:2.54.2:*:*:*:*:*:*:*",
+			),
+			Metadata: &pkg.BitnamiSBOMEntry{
+				Name:         "pgbackrest",
+				Version:      "2.54.2",
+				Architecture: "arm64",
+				Distro:       "debian-12",
+				Path:         "opt/bitnami/postgresql",
+			},
+		},
+		{
+			Name:      "wal2json",
+			Version:   "2.6.0",
+			Type:      pkg.BitnamiPkg,
+			Locations: file.NewLocationSet(file.NewLocation("opt/bitnami/postgresql/.spdx-postgresql.spdx")),
+			Licenses: pkg.NewLicenseSet(
+				pkg.NewLicenseFromType("BSD-3-Clause", license.Concluded),
+				pkg.NewLicenseFromType("BSD-3-Clause", license.Declared),
+			),
+			FoundBy: catalogerName,
+			PURL:    "pkg:bitnami/wal2json@2.6.0?arch=arm64&distro=debian-12",
+			CPEs: mustCPEs(
+				"cpe:2.3:*:wal2json:wal2json:2.6.0:*:*:*:*:*:*:*",
+			),
+			Metadata: &pkg.BitnamiSBOMEntry{
+				Name:         "wal2json",
+				Version:      "2.6.0",
+				Architecture: "arm64",
+				Distro:       "debian-12",
+				Path:         "opt/bitnami/postgresql",
+			},
+		},
+		{
+			Name:      "nss-wrapper",
+			Version:   "1.1.16",
+			Type:      pkg.BitnamiPkg,
+			Locations: file.NewLocationSet(file.NewLocation("opt/bitnami/postgresql/.spdx-postgresql.spdx")),
+			Licenses: pkg.NewLicenseSet(
+				pkg.NewLicenseFromType("BSD-3-Clause", license.Concluded),
+				pkg.NewLicenseFromType("BSD-3-Clause", license.Declared),
+			),
+			FoundBy: catalogerName,
+			PURL:    "pkg:bitnami/nss_wrapper@1.1.16?arch=arm64&distro=debian-12",
+			CPEs: mustCPEs(
+				"cpe:2.3:*:nss_wrapper:nss_wrapper:1.1.16:*:*:*:*:*:*:*",
+			),
+			Metadata: &pkg.BitnamiSBOMEntry{
+				Name:         "nss_wrapper",
+				Version:      "1.1.16",
+				Architecture: "arm64",
+				Distro:       "debian-12",
+				Path:         "opt/bitnami/postgresql",
+			},
+		},
+	}
+
+	postgresqlExpectedPkgs := []pkg.Package{postgresqlMainPkg}
+	postgresqlExpectedPkgs = append(postgresqlExpectedPkgs, postgresqlSecondaryPkgs...)
+	pkg.Sort(postgresqlExpectedPkgs)
+	var postgresqlExpectedRelationships []artifact.Relationship
+	for _, p := range postgresqlSecondaryPkgs {
+		postgresqlExpectedRelationships = append(postgresqlExpectedRelationships, artifact.Relationship{
+			From: postgresqlMainPkg,
+			To:   p,
+			Type: artifact.ContainsRelationship,
+		})
+	}
+
+	renderTemplateMainPkg := pkg.Package{
+		Name:      "render-template",
+		Version:   "1.0.7-4",
+		Type:      pkg.BitnamiPkg,
+		Locations: file.NewLocationSet(file.NewLocation("opt/bitnami/render-template/.spdx-render-template.spdx")),
+		Licenses: pkg.NewLicenseSet(
+			pkg.NewLicenseFromType("Apache-2.0", license.Concluded),
+			pkg.NewLicenseFromType("Apache-2.0", license.Declared),
+		),
+		FoundBy: catalogerName,
+		PURL:    "pkg:bitnami/render-template@1.0.7-4?arch=arm64&distro=debian-12",
+		CPEs: mustCPEs(
+			"cpe:2.3:*:render-template:render-template:1.0.7:*:*:*:*:*:*:*",
+		),
+		Metadata: &pkg.BitnamiSBOMEntry{
+			Name:         "render-template",
+			Version:      "1.0.7",
+			Revision:     "4",
+			Architecture: "arm64",
+			Distro:       "debian-12",
+			Path:         "opt/bitnami/render-template",
+			Files:        []string{},
+		},
+	}
+
+	tests := []struct {
+		name              string
+		fixture           string
+		wantPkgs          []pkg.Package
+		wantRelationships []artifact.Relationship
+		wantErr           require.ErrorAssertionFunc
+	}{
+		{
+			name:              "parse valid PostgreSQL SBOM",
+			fixture:           "test-fixtures/json",
+			wantPkgs:          postgresqlExpectedPkgs,
+			wantRelationships: postgresqlExpectedRelationships,
+			wantErr:           require.NoError,
+		},
+		{
+			name:              "parse valid SBOM that includes both Bitnami and non-Bitnami packages",
+			fixture:           "test-fixtures/mix",
+			wantPkgs:          []pkg.Package{renderTemplateMainPkg},
+			wantRelationships: nil,
+			wantErr:           require.NoError,
+		},
+		{
+			name:              "Redis SBOM with not allowed tag-value format",
+			fixture:           "test-fixtures/tag-value",
+			wantPkgs:          nil,
+			wantRelationships: nil,
+			wantErr:           require.NoError,
+		},
+		{
+			name:              "Invalid SBOM",
+			fixture:           "test-fixtures/invalid",
+			wantPkgs:          nil,
+			wantRelationships: nil,
+			wantErr:           require.Error,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			pkgtest.NewCatalogTester().
+				FromDirectory(t, tt.fixture).
+				Expects(tt.wantPkgs, tt.wantRelationships).
+				WithErrorAssertion(tt.wantErr).
+				TestCataloger(t, NewCataloger())
+		})
+	}
+}
@@ -0,0 +1,92 @@
+package bitnami
+
+import (
+	"fmt"
+	"path"
+	"path/filepath"
+	"slices"
+	"strings"
+
+	version "github.com/bitnami/go-version/pkg/version"
+
+	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func parseBitnamiPURL(p string) (*pkg.BitnamiSBOMEntry, error) {
+	purl, err := packageurl.FromString(p)
+	if err != nil {
+		return nil, err
+	}
+
+	v, err := version.Parse(purl.Version)
+	if err != nil {
+		return nil, err
+	}
+
+	entry := pkg.BitnamiSBOMEntry{
+		Name:     purl.Name,
+		Version:  strings.TrimSuffix(v.String(), fmt.Sprintf("-%s", v.Revision().String())),
+		Revision: v.Revision().String(),
+	}
+
+	for _, q := range purl.Qualifiers {
+		switch q.Key {
+		case "arch":
+			entry.Architecture = q.Value
+		case "distro":
+			entry.Distro = q.Value
+		}
+	}
+
+	return &entry, nil
+}
+
+// packageFiles goes through the list of relationships and finds the files that
+// are owned by the given package
+func packageFiles(relationships []artifact.Relationship, p pkg.Package, baseDirectory string) []string {
+	var result []string
+	for _, r := range relationships {
+		if r.Type != artifact.ContainsRelationship {
+			continue
+		}
+
+		if from, ok := r.From.(pkg.Package); ok {
+			if from.PURL == p.PURL {
+				if to, ok := r.To.(pkg.Package); ok {
+					result = append(result, packageFiles(relationships, to, baseDirectory)...)
+				}
+				if value, ok := r.To.(file.Location); ok {
+					// note: the file.Location is from the SBOM, and all files within the Bitnami SBOM by convention
+					// are relative to the /opt/bitnami/PRODUCT directory, so we need to prepend the base directory
+					// so that it's relative to the path found within the container image.
+					result = append(result, path.Join(baseDirectory, value.RealPath))
+				}
+			}
+		}
+	}
+
+	return result
+}
+
+// mainPkgFiles returns the files owned by the main package in the SPDX file.
+func mainPkgFiles(resolver file.Resolver, spdxFilePath string, secondaryPkgsFiles []string) ([]string, error) {
+	ownedPathGlob := fmt.Sprintf("%s/**", filepath.Dir(spdxFilePath))
+	ownedLocations, err := resolver.FilesByGlob(ownedPathGlob)
+	if err != nil {
+		return nil, err
+	}
+
+	ownedLocationSet := file.NewLocationSet(ownedLocations...)
+	ownedFiles := ownedLocationSet.CoordinateSet().Paths()
+
+	// Remove the SPDX file and the files already assigned to other packages
+	// from the list of owned files
+	files := slices.DeleteFunc(ownedFiles, func(f string) bool {
+		return f == spdxFilePath || slices.Contains(secondaryPkgsFiles, f)
+	})
+
+	return files, nil
+}
@@ -0,0 +1,57 @@
+package bitnami
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func Test_parseBitnamiPURL(t *testing.T) {
+	tests := []struct {
+		name    string
+		purl    string
+		want    *pkg.BitnamiSBOMEntry
+		wantErr bool
+	}{
+		{
+			name: "Valid Bitnami pURL",
+			purl: "pkg:bitnami/redis@7.4.1-0?arch=arm64&distro=debian-12",
+			want: &pkg.BitnamiSBOMEntry{
+				Name:         "redis",
+				Version:      "7.4.1",
+				Revision:     "0",
+				Architecture: "arm64",
+				Distro:       "debian-12",
+			},
+			wantErr: false,
+		},
+		{
+			name:    "Invalid pURL",
+			purl:    "this/is/not/a/purl",
+			want:    nil,
+			wantErr: true,
+		},
+		{
+			name:    "Invalid version",
+			purl:    "pkg:bitnami/redis@7.4.1.0?arch=arm64&distro=debian-12",
+			want:    nil,
+			wantErr: true,
+		},
+	}
+	t.Parallel()
+	for _, testToRun := range tests {
+		test := testToRun
+		t.Run(test.name, func(tt *testing.T) {
+			tt.Parallel()
+			got, err := parseBitnamiPURL(test.purl)
+			if (err != nil) != test.wantErr {
+				tt.Errorf("parseBitnamiPURL() error = %v, wantErr %v", err, test.wantErr)
+				return
+			}
+			if !reflect.DeepEqual(got, test.want) {
+				tt.Errorf("parseBitnamiPURL() = %v, want %v", got, test.want)
+			}
+		})
+	}
+}
@@ -0,0 +1,5 @@
+{
+    "id": "invalid-id",
+    "name": "invalid-name",
+    "description: "This is not a SPDX file"
+}
@@ -0,0 +1,573 @@
+{
+    "SPDXID": "SPDXRef-postgresql",
+    "spdxVersion": "SPDX-2.3",
+    "creationInfo": {
+        "created": "2025-02-02T05:18:41.934Z",
+        "creators": [
+            "Organization: Broadcom Inc. and/or its subsidiaries."
+        ]
+    },
+    "name": "SPDX document for PostgreSQL 17.2.0",
+    "dataLicense": "CC0-1.0",
+    "documentDescribes": [
+        "SPDXRef-postgresql"
+    ],
+    "documentNamespace": "postgresql-17.2.0",
+    "packages": [
+        {
+            "SPDXID": "SPDXRef-postgresql",
+            "name": "postgresql",
+            "versionInfo": "17.2.0-8",
+            "downloadLocation": "https://ftp.postgresql.org/pub/source/v17.2/postgresql-17.2.tar.gz",
+            "licenseConcluded": "PostgreSQL",
+            "licenseDeclared": "PostgreSQL",
+            "filesAnalyzed": false,
+            "externalRefs": [
+                {
+                    "referenceCategory": "SECURITY",
+                    "referenceType": "cpe23Type",
+                    "referenceLocator": "cpe:2.3:*:postgresql:postgresql:17.2.0:*:*:*:*:*:*:*"
+                },
+                {
+                    "referenceCategory": "PACKAGE-MANAGER",
+                    "referenceType": "purl",
+                    "referenceLocator": "pkg:bitnami/postgresql@17.2.0-8?arch=arm64&distro=debian-12"
+                }
+            ],
+            "copyrightText": "NOASSERTION"
+        },
+        {
+            "SPDXID": "SPDXRef-geos",
+            "name": "geos",
+            "versionInfo": "3.13.0",
+            "downloadLocation": "https://github.com/libgeos/geos/archive/3.13.0.tar.gz",
+            "licenseConcluded": "LGPL-2.1-only",
+            "licenseDeclared": "LGPL-2.1-only",
+            "filesAnalyzed": false,
+            "externalRefs": [
+                {
+                    "referenceCategory": "SECURITY",
+                    "referenceType": "cpe23Type",
+                    "referenceLocator": "cpe:2.3:*:libgeos:geos:3.13.0:*:*:*:*:*:*:*"
+                },
+                {
+                    "referenceCategory": "PACKAGE-MANAGER",
+                    "referenceType": "purl",
+                    "referenceLocator": "pkg:bitnami/geos@3.13.0?arch=arm64&distro=debian-12"
+                }
+            ],
+            "copyrightText": "NOASSERTION"
+        },
+        {
+            "SPDXID": "SPDXRef-proj",
+            "name": "proj",
+            "versionInfo": "6.3.2",
+            "downloadLocation": "https://github.com/OSGeo/PROJ/archive/6.3.2.tar.gz",
+            "licenseConcluded": "MIT",
+            "licenseDeclared": "MIT",
+            "filesAnalyzed": false,
+            "externalRefs": [
+                {
+                    "referenceCategory": "SECURITY",
+                    "referenceType": "cpe23Type",
+                    "referenceLocator": "cpe:2.3:*:proj:proj:6.3.2:*:*:*:*:*:*:*"
+                },
+                {
+                    "referenceCategory": "PACKAGE-MANAGER",
+                    "referenceType": "purl",
+                    "referenceLocator": "pkg:bitnami/proj@6.3.2?arch=arm64&distro=debian-12"
+                }
+            ],
+            "copyrightText": "NOASSERTION"
+        },
+        {
+            "SPDXID": "SPDXRef-gdal",
+            "name": "gdal",
+            "versionInfo": "3.10.1",
+            "downloadLocation": "https://github.com/OSGeo/gdal/releases/download/v3.10.1/gdal-3.10.1.tar.gz",
+            "licenseConcluded": "MIT",
+            "licenseDeclared": "MIT",
+            "filesAnalyzed": false,
+            "externalRefs": [
+                {
+                    "referenceCategory": "SECURITY",
+                    "referenceType": "cpe23Type",
+                    "referenceLocator": "cpe:2.3:*:osgeo:gdal:3.10.1:*:*:*:*:*:*:*"
+                },
+                {
+                    "referenceCategory": "PACKAGE-MANAGER",
+                    "referenceType": "purl",
+                    "referenceLocator": "pkg:bitnami/gdal@3.10.1?arch=arm64&distro=debian-12"
+                }
+            ],
+            "copyrightText": "NOASSERTION"
+        },
+        {
+            "SPDXID": "SPDXRef-json-c",
+            "name": "json-c",
+            "versionInfo": "0.16.20220414",
+            "downloadLocation": "https://github.com/json-c/json-c/archive/refs/tags/json-c-0.16-20220414.tar.gz",
+            "licenseConcluded": "MIT",
+            "licenseDeclared": "MIT",
+            "filesAnalyzed": false,
+            "externalRefs": [
+                {
+                    "referenceCategory": "SECURITY",
+                    "referenceType": "cpe23Type",
+                    "referenceLocator": "cpe:2.3:*:json-c_project:json-c:0.16.20220414:*:*:*:*:*:*:*"
+                },
+                {
+                    "referenceCategory": "PACKAGE-MANAGER",
+                    "referenceType": "purl",
+                    "referenceLocator": "pkg:bitnami/json-c@0.16.20220414?arch=arm64&distro=debian-12"
+                }
+            ],
+            "copyrightText": "NOASSERTION"
+        },
+        {
+            "SPDXID": "SPDXRef-orafce",
+            "name": "orafce",
+            "versionInfo": "4.14.1",
+            "downloadLocation": "https://github.com/orafce/orafce/archive/refs/tags/VERSION_4_14_1.tar.gz",
+            "licenseConcluded": "0BSD",
+            "licenseDeclared": "0BSD",
+            "filesAnalyzed": false,
+            "externalRefs": [
+                {
+                    "referenceCategory": "SECURITY",
+                    "referenceType": "cpe23Type",
+                    "referenceLocator": "cpe:2.3:*:orafce:orafce:4.14.1:*:*:*:*:*:*:*"
+                },
+                {
+                    "referenceCategory": "PACKAGE-MANAGER",
+                    "referenceType": "purl",
+                    "referenceLocator": "pkg:bitnami/orafce@4.14.1?arch=arm64&distro=debian-12"
+                }
+            ],
+            "copyrightText": "NOASSERTION"
+        },
+        {
+            "SPDXID": "SPDXRef-pljava",
+            "name": "pljava",
+            "versionInfo": "1.6.8",
+            "downloadLocation": "https://github.com/tada/pljava/archive/V1_6_8.tar.gz",
+            "licenseConcluded": "BSD-3-Clause",
+            "licenseDeclared": "BSD-3-Clause",
+            "filesAnalyzed": false,
+            "externalRefs": [
+                {
+                    "referenceCategory": "SECURITY",
+                    "referenceType": "cpe23Type",
+                    "referenceLocator": "cpe:2.3:*:pl/java_project:pl/java:1.6.8:*:*:*:*:*:*:*"
+                },
+                {
+                    "referenceCategory": "PACKAGE-MANAGER",
+                    "referenceType": "purl",
+                    "referenceLocator": "pkg:bitnami/pljava@1.6.8?arch=arm64&distro=debian-12"
+                }
+            ],
+            "copyrightText": "NOASSERTION"
+        },
+        {
+            "name": "org.postgresql:pljava",
+            "SPDXID": "SPDXRef-Package-551f76fc50fc5735",
+            "versionInfo": "1.6.8",
+            "supplier": "NOASSERTION",
+            "downloadLocation": "NONE",
+            "filesAnalyzed": true,
+            "packageVerificationCode": {
+                "packageVerificationCodeValue": "8b35292054790088fc1f41fb696a993d584d17cd"
+            },
+            "licenseConcluded": "NONE",
+            "licenseDeclared": "NONE",
+            "externalRefs": [
+                {
+                    "referenceCategory": "PACKAGE-MANAGER",
+                    "referenceType": "purl",
+                    "referenceLocator": "pkg:maven/org.postgresql/pljava@1.6.8"
+                }
+            ],
+            "primaryPackagePurpose": "LIBRARY",
+            "copyrightText": "NOASSERTION"
+        },
+        {
+            "name": "org.postgresql:pljava-api",
+            "SPDXID": "SPDXRef-Package-2dde48fd49927020",
+            "versionInfo": "1.6.8",
+            "supplier": "NOASSERTION",
+            "downloadLocation": "NONE",
+            "filesAnalyzed": true,
+            "packageVerificationCode": {
+                "packageVerificationCodeValue": "3aaf93e288e125481a250d50ab629d890f72e7b8"
+            },
+            "licenseConcluded": "NONE",
+            "licenseDeclared": "NONE",
+            "externalRefs": [
+                {
+                    "referenceCategory": "PACKAGE-MANAGER",
+                    "referenceType": "purl",
+                    "referenceLocator": "pkg:maven/org.postgresql/pljava-api@1.6.8"
+                }
+            ],
+            "primaryPackagePurpose": "LIBRARY",
+            "copyrightText": "NOASSERTION"
+        },
+        {
+            "name": "org.postgresql:pljava-examples",
+            "SPDXID": "SPDXRef-Package-f13571c8a05828cc",
+            "versionInfo": "1.6.8",
+            "supplier": "NOASSERTION",
+            "downloadLocation": "NONE",
+            "filesAnalyzed": true,
+            "packageVerificationCode": {
+                "packageVerificationCodeValue": "6f126f1237ddd2be6196726130c014770864bcc9"
+            },
+            "licenseConcluded": "NONE",
+            "licenseDeclared": "NONE",
+            "externalRefs": [
+                {
+                    "referenceCategory": "PACKAGE-MANAGER",
+                    "referenceType": "purl",
+                    "referenceLocator": "pkg:maven/org.postgresql/pljava-examples@1.6.8"
+                }
+            ],
+            "primaryPackagePurpose": "LIBRARY",
+            "copyrightText": "NOASSERTION"
+        },
+        {
+            "SPDXID": "SPDXRef-unixodbc",
+            "name": "unixodbc",
+            "versionInfo": "2.3.12",
+            "downloadLocation": "http://www.unixodbc.org/unixODBC-2.3.12.tar.gz",
+            "licenseConcluded": "LGPL-2.1-only",
+            "licenseDeclared": "LGPL-2.1-only",
+            "filesAnalyzed": false,
+            "externalRefs": [
+                {
+                    "referenceCategory": "SECURITY",
+                    "referenceType": "cpe23Type",
+                    "referenceLocator": "cpe:2.3:*:unixodbc:unixodbc:2.3.12:*:*:*:*:*:*:*"
+                },
+                {
+                    "referenceCategory": "PACKAGE-MANAGER",
+                    "referenceType": "purl",
+                    "referenceLocator": "pkg:bitnami/unixodbc@2.3.12?arch=arm64&distro=debian-12"
+                }
+            ],
+            "copyrightText": "NOASSERTION"
+        },
+        {
+            "SPDXID": "SPDXRef-psqlodbc",
+            "name": "psqlodbc",
+            "versionInfo": "16.0.0",
+            "downloadLocation": "https://ftp.postgresql.org/pub/odbc/versions/src/psqlodbc-16.00.0000.tar.gz",
+            "licenseConcluded": "LGPL-3.0-only",
+            "licenseDeclared": "LGPL-3.0-only",
+            "filesAnalyzed": false,
+            "externalRefs": [
+                {
+                    "referenceCategory": "SECURITY",
+                    "referenceType": "cpe23Type",
+                    "referenceLocator": "cpe:2.3:*:postgresql:psqlodbc:16.0.0:*:*:*:*:*:*:*"
+                },
+                {
+                    "referenceCategory": "PACKAGE-MANAGER",
+                    "referenceType": "purl",
+                    "referenceLocator": "pkg:bitnami/psqlodbc@16.0.0?arch=arm64&distro=debian-12"
+                }
+            ],
+            "copyrightText": "NOASSERTION"
+        },
+        {
+            "SPDXID": "SPDXRef-protobuf",
+            "name": "protobuf",
+            "versionInfo": "3.21.12",
+            "downloadLocation": "https://github.com/protocolbuffers/protobuf/archive/refs/tags/v3.21.12.tar.gz",
+            "licenseConcluded": "BSD-3-Clause",
+            "licenseDeclared": "BSD-3-Clause",
+            "filesAnalyzed": false,
+            "externalRefs": [
+                {
+                    "referenceCategory": "SECURITY",
+                    "referenceType": "cpe23Type",
+                    "referenceLocator": "cpe:2.3:*:golang:protobuf:3.21.12:*:*:*:*:*:*:*"
+                },
+                {
+                    "referenceCategory": "PACKAGE-MANAGER",
+                    "referenceType": "purl",
+                    "referenceLocator": "pkg:bitnami/protobuf@3.21.12?arch=arm64&distro=debian-12"
+                }
+            ],
+            "copyrightText": "NOASSERTION"
+        },
+        {
+            "SPDXID": "SPDXRef-protobuf-c",
+            "name": "protobuf-c",
+            "versionInfo": "1.5.1",
+            "downloadLocation": "https://github.com/protobuf-c/protobuf-c/releases/download/v1.5.1/protobuf-c-1.5.1.tar.gz",
+            "licenseConcluded": "BSD-2-Clause",
+            "licenseDeclared": "BSD-2-Clause",
+            "filesAnalyzed": false,
+            "externalRefs": [
+                {
+                    "referenceCategory": "SECURITY",
+                    "referenceType": "cpe23Type",
+                    "referenceLocator": "cpe:2.3:*:protobuf-c:protobuf-c:1.5.1:*:*:*:*:*:*:*"
+                },
+                {
+                    "referenceCategory": "PACKAGE-MANAGER",
+                    "referenceType": "purl",
+                    "referenceLocator": "pkg:bitnami/protobuf-c@1.5.1?arch=arm64&distro=debian-12"
+                }
+            ],
+            "copyrightText": "NOASSERTION"
+        },
+        {
+            "SPDXID": "SPDXRef-postgis",
+            "name": "postgis",
+            "versionInfo": "3.4.4",
+            "downloadLocation": "http://download.osgeo.org/postgis/source/postgis-3.4.4.tar.gz",
+            "licenseConcluded": "GPL-2.0-or-later",
+            "licenseDeclared": "GPL-2.0-or-later",
+            "filesAnalyzed": false,
+            "externalRefs": [
+                {
+                    "referenceCategory": "SECURITY",
+                    "referenceType": "cpe23Type",
+                    "referenceLocator": "cpe:2.3:*:postgis:postgis:3.4.4:*:*:*:*:*:*:*"
+                },
+                {
+                    "referenceCategory": "PACKAGE-MANAGER",
+                    "referenceType": "purl",
+                    "referenceLocator": "pkg:bitnami/postgis@3.4.4?arch=arm64&distro=debian-12"
+                }
+            ],
+            "copyrightText": "NOASSERTION"
+        },
+        {
+            "SPDXID": "SPDXRef-pgaudit",
+            "name": "pgaudit",
+            "versionInfo": "17.0.0",
+            "downloadLocation": "https://github.com/pgaudit/pgaudit/archive/17.0.tar.gz",
+            "licenseConcluded": "PostgreSQL",
+            "licenseDeclared": "PostgreSQL",
+            "filesAnalyzed": false,
+            "externalRefs": [
+                {
+                    "referenceCategory": "PACKAGE-MANAGER",
+                    "referenceType": "purl",
+                    "referenceLocator": "pkg:bitnami/pgaudit@17.0.0?arch=arm64&distro=debian-12"
+                }
+            ],
+            "copyrightText": "NOASSERTION"
+        },
+        {
+            "SPDXID": "SPDXRef-pgbackrest",
+            "name": "pgbackrest",
+            "versionInfo": "2.54.2",
+            "downloadLocation": "https://github.com/pgbackrest/pgbackrest/archive/release/2.54.2.tar.gz",
+            "licenseConcluded": "MIT",
+            "licenseDeclared": "MIT",
+            "filesAnalyzed": false,
+            "externalRefs": [
+                {
+                    "referenceCategory": "SECURITY",
+                    "referenceType": "cpe23Type",
+                    "referenceLocator": "cpe:2.3:*:pgbackrest:pgbackrest:2.54.2:*:*:*:*:*:*:*"
+                },
+                {
+                    "referenceCategory": "PACKAGE-MANAGER",
+                    "referenceType": "purl",
+                    "referenceLocator": "pkg:bitnami/pgbackrest@2.54.2?arch=arm64&distro=debian-12"
+                }
+            ],
+            "copyrightText": "NOASSERTION"
+        },
+        {
+            "SPDXID": "SPDXRef-wal2json",
+            "name": "wal2json",
+            "versionInfo": "2.6.0",
+            "downloadLocation": "https://github.com/eulerto/wal2json/archive/refs/tags/wal2json_2_6.tar.gz",
+            "licenseConcluded": "BSD-3-Clause",
+            "licenseDeclared": "BSD-3-Clause",
+            "filesAnalyzed": false,
+            "externalRefs": [
+                {
+                    "referenceCategory": "SECURITY",
+                    "referenceType": "cpe23Type",
+                    "referenceLocator": "cpe:2.3:*:wal2json:wal2json:2.6.0:*:*:*:*:*:*:*"
+                },
+                {
+                    "referenceCategory": "PACKAGE-MANAGER",
+                    "referenceType": "purl",
+                    "referenceLocator": "pkg:bitnami/wal2json@2.6.0?arch=arm64&distro=debian-12"
+                }
+            ],
+            "copyrightText": "NOASSERTION"
+        },
+        {
+            "SPDXID": "SPDXRef-nss-wrapper",
+            "name": "nss-wrapper",
+            "versionInfo": "1.1.16",
+            "downloadLocation": "https://ftp.samba.org/pub/cwrap/nss_wrapper-1.1.16.tar.gz",
+            "licenseConcluded": "BSD-3-Clause",
+            "licenseDeclared": "BSD-3-Clause",
+            "filesAnalyzed": false,
+            "externalRefs": [
+                {
+                    "referenceCategory": "SECURITY",
+                    "referenceType": "cpe23Type",
+                    "referenceLocator": "cpe:2.3:*:nss_wrapper:nss_wrapper:1.1.16:*:*:*:*:*:*:*"
+                },
+                {
+                    "referenceCategory": "PACKAGE-MANAGER",
+                    "referenceType": "purl",
+                    "referenceLocator": "pkg:bitnami/nss_wrapper@1.1.16?arch=arm64&distro=debian-12"
+                }
+            ],
+            "copyrightText": "NOASSERTION"
+        }
+    ],
+    "files": [
+        {
+            "fileName": "share/pljava/pljava-1.6.8.jar",
+            "SPDXID": "SPDXRef-File-28d7473df5d8af04-pljava",
+            "checksums": [
+                {
+                    "algorithm": "SHA1",
+                    "checksumValue": "b0b8f544ddefbc9ba47ed72ddce13627df919cc9"
+                }
+            ],
+            "copyrightText": ""
+        },
+        {
+            "fileName": "share/pljava/pljava-api-1.6.8.jar",
+            "SPDXID": "SPDXRef-File-3531f2e94fdf52e3-pljava",
+            "checksums": [
+                {
+                    "algorithm": "SHA1",
+                    "checksumValue": "a2013f3202afc8dc15a21ef7a796730df08d1a00"
+                }
+            ],
+            "copyrightText": ""
+        },
+        {
+            "fileName": "share/pljava/pljava-examples-1.6.8.jar",
+            "SPDXID": "SPDXRef-File-8f3dee04908d7a5a-pljava",
+            "checksums": [
+                {
+                    "algorithm": "SHA1",
+                    "checksumValue": "1c61bddc63ce4aaaa803d9c39f0740a15c19d300"
+                }
+            ],
+            "copyrightText": ""
+        }
+    ],
+    "relationships": [
+        {
+            "spdxElementId": "SPDXRef-postgresql",
+            "relationshipType": "CONTAINS",
+            "relatedSpdxElement": "SPDXRef-geos"
+        },
+        {
+            "spdxElementId": "SPDXRef-postgresql",
+            "relationshipType": "CONTAINS",
+            "relatedSpdxElement": "SPDXRef-proj"
+        },
+        {
+            "spdxElementId": "SPDXRef-postgresql",
+            "relationshipType": "CONTAINS",
+            "relatedSpdxElement": "SPDXRef-gdal"
+        },
+        {
+            "spdxElementId": "SPDXRef-postgresql",
+            "relationshipType": "CONTAINS",
+            "relatedSpdxElement": "SPDXRef-json-c"
+        },
+        {
+            "spdxElementId": "SPDXRef-postgresql",
+            "relationshipType": "CONTAINS",
+            "relatedSpdxElement": "SPDXRef-orafce"
+        },
+        {
+            "spdxElementId": "SPDXRef-postgresql",
+            "relationshipType": "CONTAINS",
+            "relatedSpdxElement": "SPDXRef-pljava"
+        },
+        {
+            "spdxElementId": "SPDXRef-pljava",
+            "relatedSpdxElement": "SPDXRef-Package-2dde48fd49927020",
+            "relationshipType": "CONTAINS"
+        },
+        {
+            "spdxElementId": "SPDXRef-pljava",
+            "relatedSpdxElement": "SPDXRef-Package-551f76fc50fc5735",
+            "relationshipType": "CONTAINS"
+        },
+        {
+            "spdxElementId": "SPDXRef-pljava",
+            "relatedSpdxElement": "SPDXRef-Package-f13571c8a05828cc",
+            "relationshipType": "CONTAINS"
+        },
+        {
+            "spdxElementId": "SPDXRef-Package-2dde48fd49927020",
+            "relatedSpdxElement": "SPDXRef-File-3531f2e94fdf52e3-pljava",
+            "relationshipType": "CONTAINS"
+        },
+        {
+            "spdxElementId": "SPDXRef-Package-551f76fc50fc5735",
+            "relatedSpdxElement": "SPDXRef-File-28d7473df5d8af04-pljava",
+            "relationshipType": "CONTAINS"
+        },
+        {
+            "spdxElementId": "SPDXRef-Package-f13571c8a05828cc",
+            "relatedSpdxElement": "SPDXRef-File-8f3dee04908d7a5a-pljava",
+            "relationshipType": "CONTAINS"
+        },
+        {
+            "spdxElementId": "SPDXRef-postgresql",
+            "relationshipType": "CONTAINS",
+            "relatedSpdxElement": "SPDXRef-unixodbc"
+        },
+        {
+            "spdxElementId": "SPDXRef-postgresql",
+            "relationshipType": "CONTAINS",
+            "relatedSpdxElement": "SPDXRef-psqlodbc"
+        },
+        {
+            "spdxElementId": "SPDXRef-postgresql",
+            "relationshipType": "CONTAINS",
+            "relatedSpdxElement": "SPDXRef-protobuf"
+        },
+        {
+            "spdxElementId": "SPDXRef-postgresql",
+            "relationshipType": "CONTAINS",
+            "relatedSpdxElement": "SPDXRef-protobuf-c"
+        },
+        {
+            "spdxElementId": "SPDXRef-postgresql",
+            "relationshipType": "CONTAINS",
+            "relatedSpdxElement": "SPDXRef-postgis"
+        },
+        {
+            "spdxElementId": "SPDXRef-postgresql",
+            "relationshipType": "CONTAINS",
+            "relatedSpdxElement": "SPDXRef-pgaudit"
+        },
+        {
+            "spdxElementId": "SPDXRef-postgresql",
+            "relationshipType": "CONTAINS",
+            "relatedSpdxElement": "SPDXRef-pgbackrest"
+        },
+        {
+            "spdxElementId": "SPDXRef-postgresql",
+            "relationshipType": "CONTAINS",
+            "relatedSpdxElement": "SPDXRef-wal2json"
+        },
+        {
+            "spdxElementId": "SPDXRef-postgresql",
+            "relationshipType": "CONTAINS",
+            "relatedSpdxElement": "SPDXRef-nss-wrapper"
+        }
+    ]
+}
@@ -0,0 +1 @@
+This file should be reported as part of the Bitnami PostgreSQL package.
@@ -0,0 +1,212 @@
+{
+    "SPDXID": "SPDXRef-render-template",
+    "spdxVersion": "SPDX-2.3",
+    "creationInfo": {
+        "created": "2024-09-05T18:51:42.225Z",
+        "creators": [
+            "Organization: VMware, Inc."
+        ]
+    },
+    "name": "SPDX document for render-template 1.0.7",
+    "dataLicense": "CC0-1.0",
+    "documentDescribes": [
+        "SPDXRef-render-template"
+    ],
+    "documentNamespace": "render-template-1.0.7",
+    "packages": [
+        {
+            "SPDXID": "SPDXRef-render-template",
+            "name": "render-template",
+            "versionInfo": "1.0.7-4",
+            "downloadLocation": "https://github.com/bitnami/render-template/archive/refs/tags/v1.0.7.tar.gz",
+            "licenseConcluded": "Apache-2.0",
+            "licenseDeclared": "Apache-2.0",
+            "filesAnalyzed": false,
+            "externalRefs": [
+                {
+                    "referenceCategory": "SECURITY",
+                    "referenceType": "cpe23Type",
+                    "referenceLocator": "cpe:2.3:*:render-template:render-template:1.0.7:*:*:*:*:*:*:*"
+                },
+                {
+                    "referenceCategory": "PACKAGE-MANAGER",
+                    "referenceType": "purl",
+                    "referenceLocator": "pkg:bitnami/render-template@1.0.7-4?arch=arm64&distro=debian-12"
+                }
+            ],
+            "copyrightText": "NOASSERTION"
+        },
+        {
+            "name": "opt/bitnami/common/bin/render-template",
+            "SPDXID": "SPDXRef-Application-4b412cf3f25d2574-render-template",
+            "downloadLocation": "NONE",
+            "filesAnalyzed": false,
+            "primaryPackagePurpose": "APPLICATION",
+            "copyrightText": "NOASSERTION",
+            "licenseConcluded": "NOASSERTION",
+            "licenseDeclared": "NOASSERTION"
+        },
+        {
+            "name": "github.com/aymerick/raymond",
+            "SPDXID": "SPDXRef-Package-c77f44f540ae92a0",
+            "versionInfo": "v2.0.2+incompatible",
+            "supplier": "NOASSERTION",
+            "downloadLocation": "NONE",
+            "filesAnalyzed": false,
+            "sourceInfo": "opt/bitnami/common/package found in: opt/bitnami/common/bin/render-template",
+            "licenseConcluded": "NONE",
+            "licenseDeclared": "NONE",
+            "externalRefs": [
+                {
+                    "referenceCategory": "PACKAGE-MANAGER",
+                    "referenceType": "purl",
+                    "referenceLocator": "pkg:golang/github.com/aymerick/raymond@v2.0.2%2Bincompatible"
+                }
+            ],
+            "primaryPackagePurpose": "LIBRARY",
+            "copyrightText": "NOASSERTION"
+        },
+        {
+            "name": "github.com/bitnami/render-template",
+            "SPDXID": "SPDXRef-Package-8213648cad51225d",
+            "supplier": "NOASSERTION",
+            "downloadLocation": "NONE",
+            "filesAnalyzed": false,
+            "sourceInfo": "opt/bitnami/common/package found in: opt/bitnami/common/bin/render-template",
+            "licenseConcluded": "NONE",
+            "licenseDeclared": "NONE",
+            "externalRefs": [
+                {
+                    "referenceCategory": "PACKAGE-MANAGER",
+                    "referenceType": "purl",
+                    "referenceLocator": "pkg:golang/github.com/bitnami/render-template"
+                }
+            ],
+            "primaryPackagePurpose": "LIBRARY",
+            "copyrightText": "NOASSERTION"
+        },
+        {
+            "name": "github.com/jessevdk/go-flags",
+            "SPDXID": "SPDXRef-Package-be6fde8a3edd7caf",
+            "versionInfo": "v1.6.1",
+            "supplier": "NOASSERTION",
+            "downloadLocation": "NONE",
+            "filesAnalyzed": false,
+            "sourceInfo": "opt/bitnami/common/package found in: opt/bitnami/common/bin/render-template",
+            "licenseConcluded": "NONE",
+            "licenseDeclared": "NONE",
+            "externalRefs": [
+                {
+                    "referenceCategory": "PACKAGE-MANAGER",
+                    "referenceType": "purl",
+                    "referenceLocator": "pkg:golang/github.com/jessevdk/go-flags@v1.6.1"
+                }
+            ],
+            "primaryPackagePurpose": "LIBRARY",
+            "copyrightText": "NOASSERTION"
+        },
+        {
+            "name": "github.com/mmikulicic/multierror",
+            "SPDXID": "SPDXRef-Package-b08d834237b92fed",
+            "versionInfo": "v0.0.0-20170428094957-c1ad6b5ecd26",
+            "supplier": "NOASSERTION",
+            "downloadLocation": "NONE",
+            "filesAnalyzed": false,
+            "sourceInfo": "opt/bitnami/common/package found in: opt/bitnami/common/bin/render-template",
+            "licenseConcluded": "NONE",
+            "licenseDeclared": "NONE",
+            "externalRefs": [
+                {
+                    "referenceCategory": "PACKAGE-MANAGER",
+                    "referenceType": "purl",
+                    "referenceLocator": "pkg:golang/github.com/mmikulicic/multierror@v0.0.0-20170428094957-c1ad6b5ecd26"
+                }
+            ],
+            "primaryPackagePurpose": "LIBRARY",
+            "copyrightText": "NOASSERTION"
+        },
+        {
+            "name": "golang.org/x/sys",
+            "SPDXID": "SPDXRef-Package-644a66965f04af7f",
+            "versionInfo": "v0.21.0",
+            "supplier": "NOASSERTION",
+            "downloadLocation": "NONE",
+            "filesAnalyzed": false,
+            "sourceInfo": "opt/bitnami/common/package found in: opt/bitnami/common/bin/render-template",
+            "licenseConcluded": "NONE",
+            "licenseDeclared": "NONE",
+            "externalRefs": [
+                {
+                    "referenceCategory": "PACKAGE-MANAGER",
+                    "referenceType": "purl",
+                    "referenceLocator": "pkg:golang/golang.org/x/sys@v0.21.0"
+                }
+            ],
+            "primaryPackagePurpose": "LIBRARY",
+            "copyrightText": "NOASSERTION"
+        },
+        {
+            "name": "stdlib",
+            "SPDXID": "SPDXRef-Package-7d9b78ebb84f1578",
+            "versionInfo": "1.22.7",
+            "supplier": "NOASSERTION",
+            "downloadLocation": "NONE",
+            "filesAnalyzed": false,
+            "sourceInfo": "opt/bitnami/common/package found in: opt/bitnami/common/bin/render-template",
+            "licenseConcluded": "NONE",
+            "licenseDeclared": "NONE",
+            "externalRefs": [
+                {
+                    "referenceCategory": "PACKAGE-MANAGER",
+                    "referenceType": "purl",
+                    "referenceLocator": "pkg:golang/stdlib@1.22.7"
+                }
+            ],
+            "primaryPackagePurpose": "LIBRARY",
+            "copyrightText": "NOASSERTION"
+        }
+    ],
+    "files": [],
+    "relationships": [
+        {
+            "spdxElementId": "SPDXRef-render-template",
+            "relationshipType": "CONTAINS",
+            "relatedSpdxElement": "SPDXRef-Application-4b412cf3f25d2574-render-template"
+        },
+        {
+            "spdxElementId": "SPDXRef-Application-4b412cf3f25d2574-render-template",
+            "relatedSpdxElement": "SPDXRef-Package-8213648cad51225d",
+            "relationshipType": "CONTAINS"
+        },
+        {
+            "spdxElementId": "SPDXRef-render-template",
+            "relatedSpdxElement": "SPDXRef-Application-4b412cf3f25d2574-render-template",
+            "relationshipType": "CONTAINS"
+        },
+        {
+            "spdxElementId": "SPDXRef-Package-8213648cad51225d",
+            "relatedSpdxElement": "SPDXRef-Package-644a66965f04af7f",
+            "relationshipType": "DEPENDS_ON"
+        },
+        {
+            "spdxElementId": "SPDXRef-Package-8213648cad51225d",
+            "relatedSpdxElement": "SPDXRef-Package-7d9b78ebb84f1578",
+            "relationshipType": "DEPENDS_ON"
+        },
+        {
+            "spdxElementId": "SPDXRef-Package-8213648cad51225d",
+            "relatedSpdxElement": "SPDXRef-Package-b08d834237b92fed",
+            "relationshipType": "DEPENDS_ON"
+        },
+        {
+            "spdxElementId": "SPDXRef-Package-8213648cad51225d",
+            "relatedSpdxElement": "SPDXRef-Package-be6fde8a3edd7caf",
+            "relationshipType": "DEPENDS_ON"
+        },
+        {
+            "spdxElementId": "SPDXRef-Package-8213648cad51225d",
+            "relatedSpdxElement": "SPDXRef-Package-c77f44f540ae92a0",
+            "relationshipType": "DEPENDS_ON"
+        }
+    ]
+}
@@ -0,0 +1,23 @@
+SPDXVersion: SPDX-2.3
+DataLicense: CC0-1.0
+DocumentNamespace: redis-7.4.1
+DocumentName: SPDX document for Redis(R) 7.4.1
+SPDXID: SPDXRef-DOCUMENT
+
+## Creation Information
+Creator: Organization: VMware, Inc.
+Created: 2024-10-02T20:17:11.692Z
+## Relationships
+Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-redis
+
+## Package Information
+PackageName: redis
+SPDXID: SPDXRef-redis
+PackageVersion: 7.4.1-0
+PackageDownloadLocation: http://download.redis.io/releases/redis-7.4.1.tar.gz
+PackageLicenseConcluded: RSALv2
+PackageLicenseDeclared: RSALv2
+PackageCopyrightText: NOASSERTION
+ExternalRef: SECURITY cpe23Type cpe:2.3:*:redis:redis:7.4.1:*:*:*:*:*:*:*
+ExternalRef: PACKAGE-MANAGER purl pkg:bitnami/redis@7.4.1-0?arch=arm64&distro=debian-12
+FilesAnalyzed: false
				`@@ -0,0 +1 @@`
				`This file should be reported as part of the Bitnami PostgreSQL package.`