feat: report unknowns in sbom (#2998)

Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>

test/cli/test-fixtures/image-unknowns/Dockerfile

@@ -0,0 +1,3 @@
+FROM alpine@sha256:c5c5fda71656f28e49ac9c5416b3643eaa6a108a8093151d6d1afc9463be8e33
+RUN rm -rf /lib/apk/db/installed
+COPY . /home/files

test/cli/test-fixtures/image-unknowns/executable-script

@@ -0,0 +1,2 @@
+#!/bin/sh
+echo "hello"

test/cli/test-fixtures/image-unknowns/package-lock.json

@@ -0,0 +1,3 @@
+invalid [{
+
+}]

test/cli/unknowns_test.go

@@ -0,0 +1,39 @@
+package cli
+
+import (
+	"testing"
+)
+
+func Test_Unknowns(t *testing.T) {
+	unknownsImage := getFixtureImage(t, "image-unknowns")
+
+	tests := []struct {
+		name       string
+		args       []string
+		env        map[string]string
+		assertions []traitAssertion
+	}{
+		{
+			name: "unknown executables",
+			args: []string{"scan", "-o", "json", unknownsImage, "--from", "docker-archive"},
+			env:  map[string]string{"SYFT_FORMAT_PRETTY": "true"},
+			assertions: []traitAssertion{
+				assertJsonReport,
+				assertInOutput(`no package identified in executable file`),
+				assertInOutput(`unable to read files from java archive`),
+				assertInOutput(`no package identified in archive`),
+				assertSuccessfulReturnCode,
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			cmd, stdout, stderr := runSyft(t, test.env, test.args...)
+			for _, traitFn := range test.assertions {
+				traitFn(t, stdout, stderr, cmd.ProcessState.ExitCode())
+			}
+			logOutputOnFailure(t, cmd, stdout, stderr)
+		})
+	}
+}

test/cli/utils_test.go

@@ -15,6 +15,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/stretchr/testify/require"
+
 	"github.com/anchore/stereoscope/pkg/imagetest"
 )
 
@@ -267,11 +269,15 @@ func getSyftCommand(t testing.TB, args ...string) *exec.Cmd {
 }
 
 func getSyftBinaryLocation(t testing.TB) string {
-	if os.Getenv("SYFT_BINARY_LOCATION") != "" {
+	const envKey = "SYFT_BINARY_LOCATION"
+	if os.Getenv(envKey) != "" {
 		// SYFT_BINARY_LOCATION is the absolute path to the snapshot binary
-		return os.Getenv("SYFT_BINARY_LOCATION")
+		return os.Getenv(envKey)
 	}
-	return getSyftBinaryLocationByOS(t, runtime.GOOS)
+	loc := getSyftBinaryLocationByOS(t, runtime.GOOS)
+	buildBinary(t, loc)
+	_ = os.Setenv(envKey, loc)
+	return loc
 }
 
 func getSyftBinaryLocationByOS(t testing.TB, goOS string) string {
@@ -291,6 +297,21 @@ func getSyftBinaryLocationByOS(t testing.TB, goOS string) string {
 	return ""
 }
 
+func buildBinary(t testing.TB, loc string) {
+	wd, err := os.Getwd()
+	require.NoError(t, err)
+	require.NoError(t, os.Chdir(repoRoot(t)))
+	defer func() {
+		require.NoError(t, os.Chdir(wd))
+	}()
+	t.Log("Building syft...")
+	c := exec.Command("go", "build", "-o", loc, "./cmd/syft")
+	c.Stdout = os.Stdout
+	c.Stderr = os.Stderr
+	c.Stdin = os.Stdin
+	require.NoError(t, c.Run())
+}
+
 func repoRoot(t testing.TB) string {
 	t.Helper()
 	root, err := exec.Command("git", "rev-parse", "--show-toplevel").Output()