feat: warn if parsing newer SBOM (#1810)

If syft is asked to parse an SBOM that was written by a newer version of
syft, emit a warning, since the current version of syft doesn't know about 
fields that may be added in the future.

Signed-off-by: Will Murphy <will.murphy@anchore.com>

syft/formats/syftjson/decoder.go

@@ -5,6 +5,10 @@ import (
 	"fmt"
 	"io"
 
+	"github.com/Masterminds/semver"
+
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/formats/syftjson/model"
 	"github.com/anchore/syft/syft/sbom"
 )
@@ -18,5 +22,27 @@ func decoder(reader io.Reader) (*sbom.SBOM, error) {
 		return nil, fmt.Errorf("unable to decode syft-json: %w", err)
 	}
 
+	if err := checkSupportedSchema(doc.Schema.Version, internal.JSONSchemaVersion); err != nil {
+		log.Warn(err)
+	}
+
 	return toSyftModel(doc)
 }
+
+func checkSupportedSchema(documentVerion string, parserVersion string) error {
+	documentV, err := semver.NewVersion(documentVerion)
+	if err != nil {
+		return fmt.Errorf("error comparing document schema version with parser schema version: %w", err)
+	}
+
+	parserV, err := semver.NewVersion(parserVersion)
+	if err != nil {
+		return fmt.Errorf("error comparing document schema version with parser schema version: %w", err)
+	}
+
+	if documentV.GreaterThan(parserV) {
+		return fmt.Errorf("document has schema version %s, but parser has older schema version (%s)", documentVerion, parserVersion)
+	}
+
+	return nil
+}

syft/formats/syftjson/decoder_test.go

@@ -2,6 +2,8 @@ package syftjson
 
 import (
 	"bytes"
+	"errors"
+	"fmt"
 	"strings"
 	"testing"
 
@@ -49,3 +51,38 @@ func TestEncodeDecodeCycle(t *testing.T) {
 		}
 	}
 }
+
+func TestOutOfDateParser(t *testing.T) {
+	tests := []struct {
+		name            string
+		documentVersion string
+		parserVersion   string
+		want            error
+	}{{
+		name:            "no warning when doc version is older",
+		documentVersion: "1.0.9",
+		parserVersion:   "3.1.0",
+	}, {
+		name:            "warning when parser is older",
+		documentVersion: "4.3.2",
+		parserVersion:   "3.1.0",
+		want:            fmt.Errorf("document has schema version %s, but parser has older schema version (%s)", "4.3.2", "3.1.0"),
+	}, {
+		name:            "warning when document version is unparseable",
+		documentVersion: "some-nonsense",
+		parserVersion:   "3.1.0",
+		want:            fmt.Errorf("error comparing document schema version with parser schema version: %w", errors.New("Invalid Semantic Version")),
+	}, {
+		name:            "warning when parser version is unparseable",
+		documentVersion: "7.1.0",
+		parserVersion:   "some-nonsense",
+		want:            fmt.Errorf("error comparing document schema version with parser schema version: %w", errors.New("Invalid Semantic Version")),
+	}}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := checkSupportedSchema(tt.documentVersion, tt.parserVersion)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}