feat: report unknowns in sbom (#2998)

Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>

syft/format/syftjson/decoder_test.go

@@ -221,6 +221,7 @@ func Test_encodeDecodeFileMetadata(t *testing.T) {
 					},
 				},
 			},
+			Unknowns: map[file.Coordinates][]string{},
 			Executables: map[file.Coordinates]file.Executable{
 				c: {
 					Format: file.ELF,

syft/format/syftjson/model/file.go

@@ -13,6 +13,7 @@ type File struct {
 	Digests    []file.Digest      `json:"digests,omitempty"`
 	Licenses   []FileLicense      `json:"licenses,omitempty"`
 	Executable *file.Executable   `json:"executable,omitempty"`
+	Unknowns   []string           `json:"unknowns,omitempty"`
 }
 
 type FileMetadataEntry struct {

syft/format/syftjson/to_format_model.go

@@ -101,6 +101,11 @@ func toFile(s sbom.SBOM) []model.File {
 			contents = contentsForLocation
 		}
 
+		var unknowns []string
+		if unknownsForLocation, exists := artifacts.Unknowns[coordinates]; exists {
+			unknowns = unknownsForLocation
+		}
+
 		var licenses []model.FileLicense
 		for _, l := range artifacts.FileLicenses[coordinates] {
 			var evidence *model.FileLicenseEvidence
@@ -132,6 +137,7 @@ func toFile(s sbom.SBOM) []model.File {
 			Contents:   contents,
 			Licenses:   licenses,
 			Executable: executable,
+			Unknowns:   unknowns,
 		})
 	}
 

syft/format/syftjson/to_syft_model.go

@@ -38,6 +38,7 @@ func toSyftModel(doc model.Document) *sbom.SBOM {
 			FileContents:      fileArtifacts.FileContents,
 			FileLicenses:      fileArtifacts.FileLicenses,
 			Executables:       fileArtifacts.Executables,
+			Unknowns:          fileArtifacts.Unknowns,
 			LinuxDistribution: toSyftLinuxRelease(doc.Distro),
 		},
 		Source:        *toSyftSourceData(doc.Source),
@@ -66,6 +67,7 @@ func deduplicateErrors(errors []error) []string {
 	return errorMessages
 }
 
+//nolint:funlen
 func toSyftFiles(files []model.File) sbom.Artifacts {
 	ret := sbom.Artifacts{
 		FileMetadata: make(map[file.Coordinates]file.Metadata),
@@ -73,6 +75,7 @@ func toSyftFiles(files []model.File) sbom.Artifacts {
 		FileContents: make(map[file.Coordinates]string),
 		FileLicenses: make(map[file.Coordinates][]file.License),
 		Executables:  make(map[file.Coordinates]file.Executable),
+		Unknowns:     make(map[file.Coordinates][]string),
 	}
 
 	for _, f := range files {
@@ -130,6 +133,10 @@ func toSyftFiles(files []model.File) sbom.Artifacts {
 		if f.Executable != nil {
 			ret.Executables[coord] = *f.Executable
 		}
+
+		if len(f.Unknowns) > 0 {
+			ret.Unknowns[coord] = f.Unknowns
+		}
 	}
 
 	return ret

syft/format/syftjson/to_syft_model_test.go

@@ -234,6 +234,7 @@ func Test_toSyftFiles(t *testing.T) {
 				FileMetadata: map[file.Coordinates]file.Metadata{},
 				FileDigests:  map[file.Coordinates][]file.Digest{},
 				Executables:  map[file.Coordinates]file.Executable{},
+				Unknowns:     make(map[file.Coordinates][]string),
 			},
 		},
 		{
@@ -349,6 +350,7 @@ func Test_toSyftFiles(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			tt.want.FileContents = make(map[file.Coordinates]string)
 			tt.want.FileLicenses = make(map[file.Coordinates][]file.License)
+			tt.want.Unknowns = make(map[file.Coordinates][]string)
 			assert.Equal(t, tt.want, toSyftFiles(tt.files))
 		})
 	}