feat: report unknowns in sbom (#2998)

Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>

syft/pkg/cataloger/redhat/parse_rpm_archive_test.go

@@ -94,3 +94,10 @@ func TestParseRpmFiles(t *testing.T) {
 		})
 	}
 }
+
+func Test_corruptRpmArchive(t *testing.T) {
+	pkgtest.NewCatalogTester().
+		FromFile(t, "test-fixtures/bad/bad.rpm").
+		WithError().
+		TestParser(t, parseRpmArchive)
+}

syft/pkg/cataloger/redhat/parse_rpm_db.go

@@ -9,6 +9,7 @@ import (
 	rpmdb "github.com/knqyf263/go-rpmdb/pkg"
 
 	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/unknown"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/linux"
@@ -59,11 +60,15 @@ func parseRpmDB(_ context.Context, resolver file.Resolver, env *generic.Environm
 		distro = env.LinuxRelease
 	}
 
+	var errs error
 	for _, entry := range pkgList {
 		if entry == nil {
 			continue
 		}
 
+		files, err := extractRpmFileRecords(resolver, *entry)
+		errs = unknown.Join(errs, err)
+
 		metadata := pkg.RpmDBEntry{
 			Name:            entry.Name,
 			Version:         entry.Version,
@@ -74,7 +79,7 @@ func parseRpmDB(_ context.Context, resolver file.Resolver, env *generic.Environm
 			Vendor:          entry.Vendor,
 			Size:            entry.Size,
 			ModularityLabel: &entry.Modularitylabel,
-			Files:           extractRpmFileRecords(resolver, *entry),
+			Files:           files,
 			Provides:        entry.Provides,
 			Requires:        entry.Requires,
 		}
@@ -89,6 +94,7 @@ func parseRpmDB(_ context.Context, resolver file.Resolver, env *generic.Environm
 		if !pkg.IsValid(&p) {
 			log.WithFields("location", reader.RealPath, "pkg", fmt.Sprintf("%s@%s", entry.Name, entry.Version)).
 				Warn("ignoring invalid package found in RPM DB")
+			errs = unknown.Appendf(errs, reader, "invalild package found; name: %s, version: %s", entry.Name, entry.Version)
 			continue
 		}
 
@@ -96,7 +102,11 @@ func parseRpmDB(_ context.Context, resolver file.Resolver, env *generic.Environm
 		allPkgs = append(allPkgs, p)
 	}
 
-	return allPkgs, nil, nil
+	if errs == nil && len(allPkgs) == 0 {
+		errs = fmt.Errorf("unable to determine packages")
+	}
+
+	return allPkgs, nil, errs
 }
 
 // The RPM naming scheme is [name]-[version]-[release]-[arch], where version is implicitly expands to [epoch]:[version].
@@ -112,13 +122,13 @@ func toELVersion(epoch *int, version, release string) string {
 	return fmt.Sprintf("%s-%s", version, release)
 }
 
-func extractRpmFileRecords(resolver file.PathResolver, entry rpmdb.PackageInfo) []pkg.RpmFileRecord {
+func extractRpmFileRecords(resolver file.PathResolver, entry rpmdb.PackageInfo) ([]pkg.RpmFileRecord, error) {
 	var records = make([]pkg.RpmFileRecord, 0)
 
 	files, err := entry.InstalledFiles()
 	if err != nil {
 		log.Warnf("unable to parse listing of installed files for RPM DB entry: %s", err.Error())
-		return records
+		return records, fmt.Errorf("unable to parse listing of installed files for RPM DB entry: %w", err)
 	}
 
 	for _, record := range files {
@@ -138,5 +148,5 @@ func extractRpmFileRecords(resolver file.PathResolver, entry rpmdb.PackageInfo)
 			})
 		}
 	}
-	return records
+	return records, nil
 }

syft/pkg/cataloger/redhat/parse_rpm_db_test.go

@@ -214,6 +214,13 @@ func TestToElVersion(t *testing.T) {
 	}
 }
 
+func Test_corruptRpmDbEntry(t *testing.T) {
+	pkgtest.NewCatalogTester().
+		FromFile(t, "test-fixtures/glob-paths/usr/lib/sysimage/rpm/Packages.db").
+		WithError().
+		TestParser(t, parseRpmDB)
+}
+
 func intRef(i int) *int {
 	return &i
 }

syft/pkg/cataloger/redhat/parse_rpm_manifest.go

@@ -8,6 +8,7 @@ import (
 	"strings"
 
 	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/unknown"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
@@ -53,5 +54,5 @@ func parseRpmManifest(_ context.Context, _ file.Resolver, _ *generic.Environment
 		allPkgs = append(allPkgs, p)
 	}
 
-	return allPkgs, nil, nil
+	return allPkgs, nil, unknown.IfEmptyf(allPkgs, "unable to determine packages")
 }