feat: report unknowns in sbom (#2998)

Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>

syft/pkg/cataloger/rust/cataloger_test.go

@@ -97,3 +97,10 @@ func Test_AuditBinaryCataloger_Globs(t *testing.T) {
 		})
 	}
 }
+
+func Test_corruptAuditBinary(t *testing.T) {
+	pkgtest.NewCatalogTester().
+		FromFile(t, "test-fixtures/glob-paths/partial-binary").
+		WithError().
+		TestParser(t, parseAuditBinary)
+}

syft/pkg/cataloger/rust/parse_audit_binary.go

@@ -3,6 +3,7 @@ package rust
 import (
 	"context"
 	"errors"
+	"fmt"
 
 	rustaudit "github.com/microsoft/go-rustaudit"
 
@@ -23,21 +24,22 @@ func parseAuditBinary(_ context.Context, _ file.Resolver, _ *generic.Environment
 		return nil, nil, err
 	}
 
-	for _, versionInfo := range parseAuditBinaryEntry(unionReader, reader.RealPath) {
+	infos, err := parseAuditBinaryEntry(unionReader, reader.RealPath)
+	for _, versionInfo := range infos {
 		pkgs = append(pkgs, newPackagesFromAudit(reader.Location, versionInfo)...)
 	}
 
-	return pkgs, nil, nil
+	return pkgs, nil, err
 }
 
 // scanFile scans file to try to report the Rust crate dependencies
-func parseAuditBinaryEntry(reader unionreader.UnionReader, filename string) []rustaudit.VersionInfo {
+func parseAuditBinaryEntry(reader unionreader.UnionReader, filename string) ([]rustaudit.VersionInfo, error) {
 	// NOTE: multiple readers are returned to cover universal binaries, which are files
 	// with more than one binary
 	readers, err := unionreader.GetReaders(reader)
 	if err != nil {
 		log.Warnf("rust cataloger: failed to open a binary: %v", err)
-		return nil
+		return nil, fmt.Errorf("rust cataloger: failed to open a binary: %w", err)
 	}
 
 	var versionInfos []rustaudit.VersionInfo
@@ -48,14 +50,14 @@ func parseAuditBinaryEntry(reader unionreader.UnionReader, filename string) []ru
 			if errors.Is(err, rustaudit.ErrNoRustDepInfo) {
 				// since the cataloger can only select executables and not distinguish if they are a Rust-compiled
 				// binary, we should not show warnings/logs in this case.
-				return nil
+				return nil, nil
 			}
 			log.Tracef("rust cataloger: unable to read dependency information (file=%q): %v", filename, err)
-			return nil
+			return nil, fmt.Errorf("rust cataloger: unable to read dependency information: %w", err)
 		}
 
 		versionInfos = append(versionInfos, versionInfo)
 	}
 
-	return versionInfos
+	return versionInfos, nil
 }

syft/pkg/cataloger/rust/parse_cargo_lock.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/pelletier/go-toml"
 
+	"github.com/anchore/syft/internal/unknown"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
@@ -46,5 +47,5 @@ func parseCargoLock(_ context.Context, _ file.Resolver, _ *generic.Environment,
 		)
 	}
 
-	return pkgs, nil, nil
+	return pkgs, nil, unknown.IfEmptyf(pkgs, "unable to determine packages")
 }

syft/pkg/cataloger/rust/parse_cargo_lock_test.go

@@ -191,3 +191,10 @@ func TestParseCargoLock(t *testing.T) {
 	pkgtest.TestFileParser(t, fixture, parseCargoLock, expectedPkgs, expectedRelationships)
 
 }
+
+func Test_corruptCargoLock(t *testing.T) {
+	pkgtest.NewCatalogTester().
+		FromFile(t, "test-fixtures/glob-paths/src/Cargo.lock").
+		WithError().
+		TestParser(t, parseCargoLock)
+}