Fix go mod tidy release problem (#422)

* Add go mod tidy check

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Run go mod tidy

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

.github/scripts/go-mod-tidy-check.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -u
+
+TMP_GOMOD=$(mktemp)
+TMP_GOSUM=$(mktemp)
+
+trap "rm -f ${TMP_GOSUM} ${TMP_GOMOD}" EXIT
+
+cp go.mod "${TMP_GOMOD}"
+cp go.sum "${TMP_GOSUM}"
+
+go mod tidy
+
+DIFF_MOD=$(diff -u "${TMP_GOMOD}" go.mod)
+DIFF_SUM=$(diff -u "${TMP_GOSUM}" go.sum)
+
+cp "${TMP_GOMOD}" go.mod
+cp "${TMP_GOSUM}" go.sum
+
+if [[ -n "${DIFF_MOD}" || -n "${DIFF_SUM}" ]]; then
+    echo "go.mod and/or go.sum are not tidy; please run go mod tidy"
+    echo "go.mod diff:"
+    echo "${DIFF_MOD}"
+    echo "go.sum diff:"
+    echo "${DIFF_SUM}"
+    exit 1
+fi

Makefile

@@ -115,7 +115,7 @@ bootstrap: $(RESULTSDIR) bootstrap-go bootstrap-tools ## Download and install al
 	$(call title,Bootstrapping dependencies)
 
 .PHONY: static-analysis
-static-analysis: lint check-licenses
+static-analysis: lint check-go-mod-tidy check-licenses
 
 .PHONY: lint
 lint: ## Run gofmt + golangci lint checks
@@ -136,11 +136,15 @@ lint-fix: ## Auto-format all source code + run golangci lint fixers
 	$(call title,Running lint fixers)
 	gofmt -w -s .
 	$(LINTCMD) --fix
+	go mod tidy
 
 .PHONY: check-licenses
 check-licenses:
 	$(TEMPDIR)/bouncer check
 
+check-go-mod-tidy:
+	@ .github/scripts/go-mod-tidy-check.sh && echo "go.mod and go.sum are tidy!"
+
 .PHONY: validate-cyclonedx-schema
 validate-cyclonedx-schema:
 	cd schema/cyclonedx && make
@@ -346,4 +350,4 @@ show-test-image-cache: ## Show all docker and image tar cache
 .PHONY: show-test-snapshots
 show-test-snapshots: ## Show all test snapshots
 	$(call title,Test snapshots)
-	@find . -type f -wholename "**/test-fixtures/snapshot/*" | sort
+	@find . -type f -wholename "**/test-fixtures/snapshot/*" | sort

cmd/packages.go

@@ -137,6 +137,11 @@ func setPackageFlags(flags *pflag.FlagSet) {
 		"overwrite-existing-image", false,
 		"overwrite an existing image during the upload to Anchore Enterprise",
 	)
+
+	flags.Uint(
+		"import-timeout", 30,
+		"set a timeout duration (in seconds) for the upload to Anchore Enterprise",
+	)
 }
 
 func bindPackagesConfigOptions(flags *pflag.FlagSet) error {
@@ -172,6 +177,10 @@ func bindPackagesConfigOptions(flags *pflag.FlagSet) error {
 		return err
 	}
 
+	if err := viper.BindPFlag("anchore.import-timeout", flags.Lookup("import-timeout")); err != nil {
+		return err
+	}
+
 	return nil
 }
 
@@ -262,6 +271,7 @@ func runPackageSbomUpload(src source.Source, s source.Metadata, catalog *pkg.Cat
 		Dockerfile:              dockerfileContents,
 		OverwriteExistingUpload: appConfig.Anchore.OverwriteExistingImage,
 		Scope:                   scope,
+		Timeout:                 appConfig.Anchore.ImportTimeout,
 	}
 
 	if err := c.Import(context.Background(), importCfg); err != nil {

go.mod

@@ -10,7 +10,7 @@ require (
 	github.com/anchore/go-rpmdb v0.0.0-20210415132930-2460011e83c6
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
-	github.com/anchore/stereoscope v0.0.0-20210413221244-d577f30b19e6
+	github.com/anchore/stereoscope v0.0.0-20210524175238-3b7662f3a66f
 	github.com/antihax/optional v1.0.0
 	github.com/bmatcuk/doublestar/v2 v2.0.4
 	github.com/docker/docker v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible

go.sum

@@ -115,8 +115,8 @@ github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04 h1:VzprUTpc0v
 github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04/go.mod h1:6dK64g27Qi1qGQZ67gFmBFvEHScy0/C8qhQhNe5B5pQ=
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZVsCYMrIZBpFxwV26CbsuoEh5muXD5I1Ods=
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
-github.com/anchore/stereoscope v0.0.0-20210413221244-d577f30b19e6 h1:g9ZS2V/T0wxseccI4t1hQTqWBek5DVOQZOzzdWBjwnU=
-github.com/anchore/stereoscope v0.0.0-20210413221244-d577f30b19e6/go.mod h1:vhh1M99rfWx5ejMvz1lkQiFZUrC5wu32V12R4JXH+ZI=
+github.com/anchore/stereoscope v0.0.0-20210524175238-3b7662f3a66f h1:bFadyOLOkzME3BrZFZ5m8cf/b2hsn3aMSS9s+SKubRk=
+github.com/anchore/stereoscope v0.0.0-20210524175238-3b7662f3a66f/go.mod h1:vhh1M99rfWx5ejMvz1lkQiFZUrC5wu32V12R4JXH+ZI=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/antihax/optional v1.0.0 h1:xK2lYat7ZLaVVcIuj82J8kIro4V6kDe0AUDFboUCwcg=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=

internal/anchore/import.go

@@ -27,6 +27,7 @@ type ImportConfig struct {
 	Dockerfile              []byte
 	OverwriteExistingUpload bool
 	Scope                   source.Scope
+	Timeout                 uint
 }
 
 func importProgress(source string) (*progress.Stage, *progress.Manual) {
@@ -54,7 +55,8 @@ func importProgress(source string) (*progress.Stage, *progress.Manual) {
 func (c *Client) Import(ctx context.Context, cfg ImportConfig) error {
 	stage, prog := importProgress(c.config.BaseURL)
 
-	ctxWithTimeout, cancel := context.WithTimeout(ctx, time.Second*30)
+	timeout := time.Duration(cfg.Timeout) * time.Second
+	ctxWithTimeout, cancel := context.WithTimeout(ctx, timeout)
 	defer cancel()
 
 	authedCtx := c.newRequestContext(ctxWithTimeout)

internal/config/anchore.go

@@ -12,6 +12,8 @@ type anchore struct {
 	Password               string `yaml:"-" json:"-" mapstructure:"password"`                                                               // -p , password to authenticate upload
 	Dockerfile             string `yaml:"dockerfile" json:"dockerfile" mapstructure:"dockerfile"`                                           // -d , dockerfile to attach for upload
 	OverwriteExistingImage bool   `yaml:"overwrite-existing-image" json:"overwrite-existing-image" mapstructure:"overwrite-existing-image"` // --overwrite-existing-image , if any of the SBOM components have already been uploaded this flag will ensure they are overwritten with the current upload
+	ImportTimeout          uint   `yaml:"import-timeout" json:"import-timeout" mapstructure:"import-timeout"`                               // --import-timeout
+	// , customize the number of seconds within which the SBOM import must be completed or canceled
 }
 
 func (cfg anchore) loadDefaultValues(v *viper.Viper) {

internal/config/registry.go

@@ -37,7 +37,7 @@ func (cfg *registry) parseConfigValues() error {
 		os.Getenv("SYFT_REGISTRY_AUTH_PASSWORD"),
 		os.Getenv("SYFT_REGISTRY_AUTH_TOKEN")
 
-	if hasNonEmptyCredentials(authority, username, password, token) {
+	if hasNonEmptyCredentials(username, password, token) {
 		// note: we prepend the credentials such that the environment variables take precedence over on-disk configuration.
 		cfg.Auth = append([]RegistryCredentials{
 			{
@@ -51,8 +51,8 @@ func (cfg *registry) parseConfigValues() error {
 	return nil
 }
 
-func hasNonEmptyCredentials(authority, username, password, token string) bool {
-	return authority != "" && password != "" && username != "" || authority != "" && token != ""
+func hasNonEmptyCredentials(username, password, token string) bool {
+	return password != "" && username != "" || token != ""
 }
 
 func (cfg *registry) ToOptions() *image.RegistryOptions {

internal/config/registry_test.go

@@ -9,51 +9,48 @@ import (
 
 func TestHasNonEmptyCredentials(t *testing.T) {
 	tests := []struct {
-		auth, username, password, token string
-		expected                        bool
+		username, password, token string
+		expected                  bool
 	}{
+
 		{
-			"", "", "", "",
+			"", "", "",
 			false,
 		},
 		{
-			"auth", "", "", "",
+			"user", "", "",
 			false,
 		},
 		{
-			"auth", "user", "", "",
+			"", "pass", "",
 			false,
 		},
 		{
-			"auth", "", "pass", "",
-			false,
-		},
-		{
-			"auth", "", "pass", "tok",
+			"", "pass", "tok",
 			true,
 		},
 		{
-			"auth", "user", "", "tok",
+			"user", "", "tok",
 			true,
 		},
 		{
-			"auth", "", "", "tok",
+			"", "", "tok",
 			true,
 		},
 		{
-			"auth", "user", "pass", "tok",
+			"user", "pass", "tok",
 			true,
 		},
 
 		{
-			"auth", "user", "pass", "",
+			"user", "pass", "",
 			true,
 		},
 	}
 
 	for _, test := range tests {
 		t.Run(fmt.Sprintf("%+v", test), func(t *testing.T) {
-			assert.Equal(t, test.expected, hasNonEmptyCredentials(test.auth, test.username, test.password, test.token))
+			assert.Equal(t, test.expected, hasNonEmptyCredentials(test.username, test.password, test.token))
 		})
 	}
 }

internal/presenter/poweruser/test-fixtures/snapshot/TestJSONPresenter.golden

@@ -174,7 +174,8 @@
     "host": "",
     "path": "",
     "dockerfile": "",
-    "overwrite-existing-image": false
+    "overwrite-existing-image": false,
+    "import-timeout": 0
    },
    "dev": {
     "profile-cpu": false,

syft/pkg/metadata.go

@@ -16,3 +16,15 @@ const (
 	RustCargoPackageMetadataType MetadataType = "RustCargoPackageMetadata"
 	KbPackageMetadataType        MetadataType = "KbPackageMetadata"
 )
+
+var AllMetadataTypes = []MetadataType{
+	ApkMetadataType,
+	DpkgMetadataType,
+	GemMetadataType,
+	JavaMetadataType,
+	NpmPackageJSONMetadataType,
+	RpmdbMetadataType,
+	PythonPackageMetadataType,
+	RustCargoPackageMetadataType,
+	KbPackageMetadataType,
+}

test/cli/packages_cmd_test.go

@@ -165,7 +165,7 @@ func TestRegistryAuth(t *testing.T) {
 			assertions: []traitAssertion{
 				assertInOutput("source=OciRegistry"),
 				assertInOutput("localhost:5000/something:latest"),
-				assertInOutput(`using registry credentials for "localhost:5000"`),
+				assertInOutput(`using basic auth for registry "localhost:5000"`),
 			},
 		},
 		{
@@ -178,7 +178,7 @@ func TestRegistryAuth(t *testing.T) {
 			assertions: []traitAssertion{
 				assertInOutput("source=OciRegistry"),
 				assertInOutput("localhost:5000/something:latest"),
-				assertInOutput(`using registry token for "localhost:5000"`),
+				assertInOutput(`using token for registry "localhost:5000"`),
 			},
 		},
 		{