[wip] git-root config search concept

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

README.md

@@ -11,6 +11,16 @@
 
 A CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Exceptional for vulnerability detection when used with a scanner tool like [Grype](https://github.com/anchore/grype).
 
+### Join us at the virtual OSS meetup!
+
+When: December 1, 2021 @ 11am-noon PT (2-3pm ET)
+
+We’ve got security experts from VMware and Anchore who will share their tips, tricks, and lessons learned on securing containers using [Syft](https://github.com/anchore/syft), [Grype](https://github.com/anchore/grype), and [Cartographer](https://github.com/vmware-tanzu/cartographer).
+
+Register now: https://get.anchore.com/anchore-oss-meetup-dec-1-2021/
+
+---
+
 ![syft-demo](https://user-images.githubusercontent.com/590471/90277200-2a253000-de33-11ea-893f-32c219eea11a.gif)
 
 ## Features
@@ -191,6 +201,8 @@ Configuration search paths:
 
 - `.syft.yaml`
 - `.syft/config.yaml`
+- `<git repo root>/.syft.yaml`
+- `<git repo root>/.syft/config.yaml`
 - `~/.syft.yaml`
 - `<XDG_CONFIG_HOME>/syft/config.yaml`
 

go.mod

@@ -12,13 +12,13 @@ require (
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29
-	github.com/anchore/stereoscope v0.0.0-20211203160213-5a5e323a5c89
+	github.com/anchore/stereoscope v0.0.0-20211116152349-7e4e1b56a15d
 	// we are hinting brotli to latest due to warning when installing archiver v3:
 	// go: warning: github.com/andybalholm/brotli@v1.0.1: retracted by module author: occasional panics and data corruption
 	github.com/andybalholm/brotli v1.0.4 // indirect
 	github.com/antihax/optional v1.0.0
 	github.com/bmatcuk/doublestar/v2 v2.0.4
-	github.com/docker/docker v20.10.11+incompatible
+	github.com/docker/docker v20.10.10+incompatible
 	github.com/dustin/go-humanize v1.0.0
 	github.com/facebookincubator/nvdtools v0.1.4
 	github.com/go-test/deep v1.0.7

go.sum

@@ -78,7 +78,6 @@ github.com/Microsoft/hcsshim v0.8.14/go.mod h1:NtVKoYxQuTLx6gEq0L96c9Ju4JbRJ4nY2
 github.com/Microsoft/hcsshim v0.8.15/go.mod h1:x38A4YbHbdxJtc0sF6oIz+RG0npwSCAvn69iY6URG00=
 github.com/Microsoft/hcsshim v0.8.16/go.mod h1:o5/SZqmR7x9JNKsW3pu+nqHm0MF8vbA+VxGOoXdC600=
 github.com/Microsoft/hcsshim v0.8.21/go.mod h1:+w2gRZ5ReXQhFOrvSQeNfhrYB/dg3oDwTOcER2fw4I4=
-github.com/Microsoft/hcsshim v0.8.23/go.mod h1:4zegtUJth7lAvFyc6cH2gGQ5B3OFQim01nnU2M8jKDg=
 github.com/Microsoft/hcsshim/test v0.0.0-20201218223536-d3e5debf77da/go.mod h1:5hlzMzRKMLyo42nCZ9oml8AdTlq/0cvIaBv6tK1RehU=
 github.com/Microsoft/hcsshim/test v0.0.0-20210227013316-43a75bb4edd3/go.mod h1:mw7qgWloBUl75W/gVH3cQszUg1+gUITj7D6NY7ywVnY=
 github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
@@ -109,8 +108,8 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZV
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29 h1:K9LfnxwhqvihqU0+MF325FNy7fsKV9EGaUxdfR4gnWk=
 github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29/go.mod h1:Oc1UkGaJwY6ND6vtAqPSlYrptKRJngHwkwB6W7l1uP0=
-github.com/anchore/stereoscope v0.0.0-20211203160213-5a5e323a5c89 h1:pcMFN7wjIQIxdZm8NA0R3JiRRFn5Eyx9mhagHOVS4Bw=
-github.com/anchore/stereoscope v0.0.0-20211203160213-5a5e323a5c89/go.mod h1:FNm1rtauEjkC3elA3jr3bJkU+/4QiovApwJdPnHQ9x0=
+github.com/anchore/stereoscope v0.0.0-20211116152349-7e4e1b56a15d h1:ieKMmJk1IcmdviUv/KGO1DAk0yFxoGwDpwGq8ckVeVU=
+github.com/anchore/stereoscope v0.0.0-20211116152349-7e4e1b56a15d/go.mod h1:Zzs5pLx2ZtUctlER7bNDAucDmsc8RO2g/oL3for1tVA=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
 github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY3JY=
@@ -143,7 +142,6 @@ github.com/buger/jsonparser v0.0.0-20180808090653-f4dd9f5a6b44/go.mod h1:bbYlZJ7
 github.com/bugsnag/bugsnag-go v0.0.0-20141110184014-b1d153021fcd/go.mod h1:2oa8nejYd4cQ/b0hMIopN0lCRxU0bueqREvZLWFrtK8=
 github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b/go.mod h1:obH5gd0BsqsP2LwDJ9aOkm/6J86V6lyAXCoQWGw3K50=
 github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0/go.mod h1:D/8v3kj0zr8ZAKg1AQ6crr+5VwKN5eIywRkfhyM/+dE=
-github.com/cenkalti/backoff/v4 v4.1.1/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
@@ -194,15 +192,13 @@ github.com/containerd/containerd v1.3.2/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMX
 github.com/containerd/containerd v1.4.0-beta.2.0.20200729163537-40b22ef07410/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
 github.com/containerd/containerd v1.4.1/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
 github.com/containerd/containerd v1.4.3/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.4.9/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
 github.com/containerd/containerd v1.5.0-beta.1/go.mod h1:5HfvG1V2FsKesEGQ17k5/T7V960Tmcumvqn8Mc+pCYQ=
 github.com/containerd/containerd v1.5.0-beta.3/go.mod h1:/wr9AVtEM7x9c+n0+stptlo/uBBoBORwEx6ardVcmKU=
 github.com/containerd/containerd v1.5.0-beta.4/go.mod h1:GmdgZd2zA2GYIBZ0w09ZvgqEq8EfBp/m3lcVZIvPHhI=
 github.com/containerd/containerd v1.5.0-rc.0/go.mod h1:V/IXoMqNGgBlabz3tHD2TWDoTJseu1FGOKuoA4nNb2s=
 github.com/containerd/containerd v1.5.1/go.mod h1:0DOxVqwDy2iZvrZp2JUx/E+hS0UNTVn7dJnIOwtYR4g=
+github.com/containerd/containerd v1.5.7 h1:rQyoYtj4KddB3bxG6SAqd4+08gePNyJjRqvOIfV3rkM=
 github.com/containerd/containerd v1.5.7/go.mod h1:gyvv6+ugqY25TiXxcZC3L5yOeYgEw0QMhscqVp1AR9c=
-github.com/containerd/containerd v1.5.8 h1:NmkCC1/QxyZFBny8JogwLpOy2f+VEbO/f6bV2Mqtwuw=
-github.com/containerd/containerd v1.5.8/go.mod h1:YdFSv5bTFLpG2HIYmfqDpSYYTDX+mc5qtSuYx1YUb/s=
 github.com/containerd/continuity v0.0.0-20190426062206-aaeac12a7ffc/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
 github.com/containerd/continuity v0.0.0-20190815185530-f2a389ac0a02/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
 github.com/containerd/continuity v0.0.0-20191127005431-f65d91d395eb/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
@@ -237,7 +233,6 @@ github.com/containerd/ttrpc v0.0.0-20190828172938-92c8520ef9f8/go.mod h1:PvCDdDG
 github.com/containerd/ttrpc v0.0.0-20191028202541-4f1b8fe65a5c/go.mod h1:LPm1u0xBw8r8NOKoOdNMeVHSawSsltak+Ihv+etqsE8=
 github.com/containerd/ttrpc v1.0.1/go.mod h1:UAxOpgT9ziI0gJrmKvgcZivgxOp8iFPSk8httJEt98Y=
 github.com/containerd/ttrpc v1.0.2/go.mod h1:UAxOpgT9ziI0gJrmKvgcZivgxOp8iFPSk8httJEt98Y=
-github.com/containerd/ttrpc v1.1.0/go.mod h1:XX4ZTnoOId4HklF4edwc4DcqskFZuvXB1Evzy5KFQpQ=
 github.com/containerd/typeurl v0.0.0-20180627222232-a93fcdb778cd/go.mod h1:Cm3kwCdlkCfMSHURc+r6fwoGH6/F1hH3S4sg0rLFWPc=
 github.com/containerd/typeurl v0.0.0-20190911142611-5eb25027c9fd/go.mod h1:GeKYzf2pQcqv7tJ0AoCuuhtnqhva5LNU3U+OyKxxJpk=
 github.com/containerd/typeurl v1.0.1/go.mod h1:TB1hUtrpaiO88KEK56ijojHS1+NeF0izUACaJW2mdXg=
@@ -295,9 +290,8 @@ github.com/docker/distribution v0.0.0-20190905152932-14b96e55d84c/go.mod h1:0+TT
 github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.7.1+incompatible h1:a5mlkVzth6W5A4fOsS3D2EO5BUmsJpcB+cRlLU7cSug=
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/docker v20.10.10+incompatible h1:GKkP0T7U4ks6X3lmmHKC2QDprnpRJor2Z5a8m62R9ZM=
 github.com/docker/docker v20.10.10+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v20.10.11+incompatible h1:OqzI/g/W54LczvhnccGqniFoQghHx3pklbLuhfXpqGo=
-github.com/docker/docker v20.10.11+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.6.4 h1:axCks+yV+2MR3/kZhAmy07yC56WZ2Pwu/fKWtKuZB0o=
 github.com/docker/docker-credential-helpers v0.6.4/go.mod h1:ofX3UI0Gz1TteYBjtgs07O36Pyasyp66D2uKT7H8W1c=
 github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
@@ -657,9 +651,8 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.0.0/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
 github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
+github.com/opencontainers/image-spec v1.0.2-0.20210730191737-8e42a01fb1b7 h1:axgApq2XShTLwQii2zAnIkMPlhGVHbAXHUcHezu5G/k=
 github.com/opencontainers/image-spec v1.0.2-0.20210730191737-8e42a01fb1b7/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
-github.com/opencontainers/image-spec v1.0.2 h1:9yCKha/T5XdGtO0q9Q9a6T5NUCsTn/DrBg0D7ufOcFM=
-github.com/opencontainers/image-spec v1.0.2/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
 github.com/opencontainers/runc v0.0.0-20190115041553-12f6a991201f/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runc v0.1.1/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runc v1.0.0-rc8.0.20190926000215-3e425f80a8c9/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=

internal/config/application.go

@@ -3,7 +3,10 @@ package config
 import (
 	"errors"
 	"fmt"
+	"os"
+	"os/exec"
 	"path"
+	"path/filepath"
 	"reflect"
 	"strings"
 
@@ -206,44 +209,80 @@ func readConfig(v *viper.Viper, configPath string) error {
 	// 1. look for .<appname>.yaml (in the current directory)
 	v.AddConfigPath(".")
 	v.SetConfigName("." + internal.ApplicationName)
-	if err = v.ReadInConfig(); err == nil {
-		return nil
-	} else if !errors.As(err, &viper.ConfigFileNotFoundError{}) {
-		return fmt.Errorf("unable to parse config=%q: %w", v.ConfigFileUsed(), err)
+	if exists, err := readViperConfig(v); exists || err != nil {
+		return err
 	}
 
 	// 2. look for .<appname>/config.yaml (in the current directory)
 	v.AddConfigPath("." + internal.ApplicationName)
 	v.SetConfigName("config")
-	if err = v.ReadInConfig(); err == nil {
-		return nil
-	} else if !errors.As(err, &viper.ConfigFileNotFoundError{}) {
-		return fmt.Errorf("unable to parse config=%q: %w", v.ConfigFileUsed(), err)
+	if exists, err := readViperConfig(v); exists || err != nil {
+		return err
 	}
 
-	// 3. look for ~/.<appname>.yaml
+	if root := gitRepoRoot(); root != "" {
+		// 3. look for <git repo root>/.<appname>.yaml, where the repo root is defined by "git rev-parse --show-toplevel"
+		v.AddConfigPath(root)
+		v.SetConfigName("." + internal.ApplicationName)
+		if exists, err := readViperConfig(v); exists {
+			if err != nil {
+				return err
+			}
+			return os.Chdir(root)
+		}
+
+		// 4. look for <git repo root>/.<appname>/config.yaml, where the repo root is defined by "git rev-parse --show-toplevel"
+		v.AddConfigPath(filepath.Join(root, "."+internal.ApplicationName))
+		v.SetConfigName("config")
+		if exists, err := readViperConfig(v); exists {
+			if err != nil {
+				return err
+			}
+			return os.Chdir(root)
+		}
+	}
+
+	// 5. look for ~/.<appname>.yaml
 	home, err := homedir.Dir()
 	if err == nil {
 		v.AddConfigPath(home)
 		v.SetConfigName("." + internal.ApplicationName)
-		if err = v.ReadInConfig(); err == nil {
-			return nil
-		} else if !errors.As(err, &viper.ConfigFileNotFoundError{}) {
-			return fmt.Errorf("unable to parse config=%q: %w", v.ConfigFileUsed(), err)
+		if exists, err := readViperConfig(v); exists || err != nil {
+			return err
 		}
 	}
 
-	// 4. look for <appname>/config.yaml in xdg locations (starting with xdg home config dir, then moving upwards)
+	// 6. look for <appname>/config.yaml in xdg locations (starting with xdg home config dir, then moving upwards)
 	v.AddConfigPath(path.Join(xdg.ConfigHome, internal.ApplicationName))
 	for _, dir := range xdg.ConfigDirs {
 		v.AddConfigPath(path.Join(dir, internal.ApplicationName))
 	}
 	v.SetConfigName("config")
-	if err = v.ReadInConfig(); err == nil {
-		return nil
-	} else if !errors.As(err, &viper.ConfigFileNotFoundError{}) {
-		return fmt.Errorf("unable to parse config=%q: %w", v.ConfigFileUsed(), err)
+	if exists, err := readViperConfig(v); exists || err != nil {
+		return err
 	}
 
 	return ErrApplicationConfigNotFound
 }
+
+func readViperConfig(v *viper.Viper) (bool, error) {
+	err := v.ReadInConfig()
+	if err == nil {
+		return true, nil
+	} else if errors.As(err, &viper.ConfigFileNotFoundError{}) {
+		return false, nil
+	}
+	return true, fmt.Errorf("unable to parse config=%q: %w", v.ConfigFileUsed(), err)
+}
+
+func gitRepoRoot() string {
+	root, err := exec.Command("git", "rev-parse", "--show-toplevel").Output()
+	if err != nil {
+		return ""
+	}
+	absRepoRoot, err := filepath.Abs(strings.TrimSpace(string(root)))
+	if err != nil {
+		return ""
+	}
+	return absRepoRoot
+}

internal/formats/common/spdxhelpers/document_name.go

@@ -1,31 +0,0 @@
-package spdxhelpers
-
-import (
-	"fmt"
-	"path"
-	"strings"
-
-	"github.com/anchore/syft/syft/source"
-)
-
-func DocumentName(srcMetadata source.Metadata) (string, error) {
-	switch srcMetadata.Scheme {
-	case source.ImageScheme:
-		return cleanName(srcMetadata.ImageMetadata.UserInput), nil
-	case source.DirectoryScheme, source.FileScheme:
-		return cleanName(srcMetadata.Path), nil
-	}
-
-	return "", fmt.Errorf("unable to determine document name from scheme=%q", srcMetadata.Scheme)
-}
-
-func cleanName(name string) string {
-	// remove # according to specification
-	name = strings.ReplaceAll(name, "#", "-")
-
-	// remove : for url construction
-	name = strings.ReplaceAll(name, ":", "-")
-
-	// clean relative pathing
-	return path.Clean(name)
-}

internal/formats/common/spdxhelpers/document_name_test.go

@@ -1,73 +0,0 @@
-package spdxhelpers
-
-import (
-	"fmt"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/anchore/syft/syft/source"
-	"github.com/scylladb/go-set/strset"
-	"github.com/stretchr/testify/assert"
-)
-
-func Test_DocumentName(t *testing.T) {
-	allSchemes := strset.New()
-	for _, s := range source.AllSchemes {
-		allSchemes.Add(string(s))
-	}
-	testedSchemes := strset.New()
-
-	tests := []struct {
-		name        string
-		inputName   string
-		srcMetadata source.Metadata
-		expected    string
-	}{
-		{
-			name:      "image",
-			inputName: "my-name",
-			srcMetadata: source.Metadata{
-				Scheme: source.ImageScheme,
-				ImageMetadata: source.ImageMetadata{
-					UserInput:      "image-repo/name:tag",
-					ID:             "id",
-					ManifestDigest: "digest",
-				},
-			},
-			expected: "image-repo/name-tag",
-		},
-		{
-			name:      "directory",
-			inputName: "my-name",
-			srcMetadata: source.Metadata{
-				Scheme: source.DirectoryScheme,
-				Path:   "some/path/to/place",
-			},
-			expected: "some/path/to/place",
-		},
-		{
-			name:      "file",
-			inputName: "my-name",
-			srcMetadata: source.Metadata{
-				Scheme: source.FileScheme,
-				Path:   "some/path/to/place",
-			},
-			expected: "some/path/to/place",
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			actual, err := DocumentName(test.srcMetadata)
-			require.NoError(t, err)
-			assert.True(t, strings.HasPrefix(actual, test.expected), fmt.Sprintf("actual name %q", actual))
-
-			// track each scheme tested (passed or not)
-			testedSchemes.Add(string(test.srcMetadata.Scheme))
-		})
-	}
-
-	// assert all possible schemes were under test
-	assert.ElementsMatch(t, allSchemes.List(), testedSchemes.List(), "not all source.Schemes are under test")
-}

internal/formats/common/spdxhelpers/document_namespace.go

@@ -1,45 +0,0 @@
-package spdxhelpers
-
-import (
-	"fmt"
-	"net/url"
-	"path"
-
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/syft/source"
-	"github.com/google/uuid"
-)
-
-func DocumentNameAndNamespace(srcMetadata source.Metadata) (string, string, error) {
-	name, err := DocumentName(srcMetadata)
-	if err != nil {
-		return "", "", err
-	}
-	return name, DocumentNamespace(name, srcMetadata), nil
-}
-
-func DocumentNamespace(name string, srcMetadata source.Metadata) string {
-	input := "unknown-source-type"
-	switch srcMetadata.Scheme {
-	case source.ImageScheme:
-		input = "image"
-	case source.DirectoryScheme:
-		input = "dir"
-	case source.FileScheme:
-		input = "file"
-	}
-
-	uniqueID := uuid.Must(uuid.NewRandom())
-	identifier := path.Join(input, uniqueID.String())
-	if name != "." {
-		identifier = path.Join(input, fmt.Sprintf("%s-%s", name, uniqueID.String()))
-	}
-
-	u := url.URL{
-		Scheme: "https",
-		Host:   "anchore.com",
-		Path:   path.Join(internal.ApplicationName, identifier),
-	}
-
-	return u.String()
-}

internal/formats/common/spdxhelpers/document_namespace_test.go

@@ -1,71 +0,0 @@
-package spdxhelpers
-
-import (
-	"fmt"
-	"strings"
-	"testing"
-
-	"github.com/anchore/syft/syft/source"
-	"github.com/scylladb/go-set/strset"
-	"github.com/stretchr/testify/assert"
-)
-
-func Test_documentNamespace(t *testing.T) {
-	allSchemes := strset.New()
-	for _, s := range source.AllSchemes {
-		allSchemes.Add(string(s))
-	}
-	testedSchemes := strset.New()
-
-	tests := []struct {
-		name        string
-		inputName   string
-		srcMetadata source.Metadata
-		expected    string
-	}{
-		{
-			name:      "image",
-			inputName: "my-name",
-			srcMetadata: source.Metadata{
-				Scheme: source.ImageScheme,
-				ImageMetadata: source.ImageMetadata{
-					UserInput:      "image-repo/name:tag",
-					ID:             "id",
-					ManifestDigest: "digest",
-				},
-			},
-			expected: "https://anchore.com/syft/image/my-name-",
-		},
-		{
-			name:      "directory",
-			inputName: "my-name",
-			srcMetadata: source.Metadata{
-				Scheme: source.DirectoryScheme,
-				Path:   "some/path/to/place",
-			},
-			expected: "https://anchore.com/syft/dir/my-name-",
-		},
-		{
-			name:      "file",
-			inputName: "my-name",
-			srcMetadata: source.Metadata{
-				Scheme: source.FileScheme,
-				Path:   "some/path/to/place",
-			},
-			expected: "https://anchore.com/syft/file/my-name-",
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			actual := DocumentNamespace(test.inputName, test.srcMetadata)
-			// note: since the namespace ends with a UUID we check the prefix
-			assert.True(t, strings.HasPrefix(actual, test.expected), fmt.Sprintf("actual namespace %q", actual))
-
-			// track each scheme tested (passed or not)
-			testedSchemes.Add(string(test.srcMetadata.Scheme))
-		})
-	}
-
-	// assert all possible schemes were under test
-	assert.ElementsMatch(t, allSchemes.List(), testedSchemes.List(), "not all source.Schemes are under test")
-}

internal/formats/cyclonedx12xml/to_format_model.go

@@ -69,7 +69,7 @@ func toBomDescriptorComponent(srcMetadata source.Metadata) *model.BomDescriptorC
 				Version: srcMetadata.ImageMetadata.ManifestDigest,
 			},
 		}
-	case source.DirectoryScheme, source.FileScheme:
+	case source.DirectoryScheme:
 		return &model.BomDescriptorComponent{
 			Component: model.Component{
 				Type: "file",

internal/formats/spdx22json/encoder.go

@@ -7,16 +7,15 @@ import (
 	"github.com/anchore/syft/syft/sbom"
 )
 
+const anchoreNamespace = "https://anchore.com/syft"
+
 func encoder(output io.Writer, s sbom.SBOM) error {
-	doc, err := toFormatModel(s)
-	if err != nil {
-		return err
-	}
+	doc := toFormatModel(s)
 
 	enc := json.NewEncoder(output)
 	// prevent > and < from being escaped in the payload
 	enc.SetEscapeHTML(false)
 	enc.SetIndent("", " ")
 
-	return enc.Encode(doc)
+	return enc.Encode(&doc)
 }

internal/formats/spdx22json/test-fixtures/snapshot/TestSPDXJSONDirectoryPresenter.golden

@@ -3,7 +3,7 @@
  "name": "/some/path",
  "spdxVersion": "SPDX-2.2",
  "creationInfo": {
-  "created": "2021-12-01T15:08:29.469369Z",
+  "created": "2021-11-17T19:35:54.834877Z",
   "creators": [
    "Organization: Anchore, Inc",
    "Tool: syft-[not provided]"
@@ -11,7 +11,7 @@
   "licenseListVersion": "3.15"
  },
  "dataLicense": "CC0-1.0",
- "documentNamespace": "https://anchore.com/syft/dir/some/path-f4586501-2da6-4541-a8e9-232b32f25e9a",
+ "documentNamespace": "https:/anchore.com/syft/dir/some/path-65e2226e-a61e-4ed1-81bb-56022e1ff1eb",
  "packages": [
   {
    "SPDXID": "SPDXRef-2a115ac97d018a0e",

internal/formats/spdx22json/test-fixtures/snapshot/TestSPDXJSONImagePresenter.golden

@@ -3,7 +3,7 @@
  "name": "user-image-input",
  "spdxVersion": "SPDX-2.2",
  "creationInfo": {
-  "created": "2021-12-01T15:08:29.476498Z",
+  "created": "2021-11-17T19:35:57.761372Z",
   "creators": [
    "Organization: Anchore, Inc",
    "Tool: syft-[not provided]"
@@ -11,7 +11,7 @@
   "licenseListVersion": "3.15"
  },
  "dataLicense": "CC0-1.0",
- "documentNamespace": "https://anchore.com/syft/image/user-image-input-e3b7637c-9b2f-4005-a683-58e60f979082",
+ "documentNamespace": "https:/anchore.com/syft/image/user-image-input-5383918f-ec96-4aa9-b756-ad16e1ada31e",
  "packages": [
   {
    "SPDXID": "SPDXRef-888661d4f0362f02",

internal/formats/spdx22json/to_format_model.go

@@ -2,6 +2,7 @@ package spdx22json
 
 import (
 	"fmt"
+	"path"
 	"path/filepath"
 	"sort"
 	"strings"
@@ -18,16 +19,14 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
+	"github.com/google/uuid"
 )
 
 // toFormatModel creates and populates a new JSON document struct that follows the SPDX 2.2 spec from the given cataloging results.
-func toFormatModel(s sbom.SBOM) (*model.Document, error) {
-	name, namespace, err := spdxhelpers.DocumentNameAndNamespace(s.Source)
-	if err != nil {
-		return nil, err
-	}
+func toFormatModel(s sbom.SBOM) model.Document {
+	name := documentName(s.Source)
 
-	return &model.Document{
+	return model.Document{
 		Element: model.Element{
 			SPDXID: model.ElementID("DOCUMENT").String(),
 			Name:   name,
@@ -43,11 +42,52 @@ func toFormatModel(s sbom.SBOM) (*model.Document, error) {
 			LicenseListVersion: spdxlicense.Version,
 		},
 		DataLicense:       "CC0-1.0",
-		DocumentNamespace: namespace,
+		DocumentNamespace: documentNamespace(name, s.Source),
 		Packages:          toPackages(s.Artifacts.PackageCatalog, s.Relationships),
 		Files:             toFiles(s),
 		Relationships:     toRelationships(s.Relationships),
-	}, nil
+	}
+}
+
+func documentName(srcMetadata source.Metadata) string {
+	switch srcMetadata.Scheme {
+	case source.ImageScheme:
+		return cleanSPDXName(srcMetadata.ImageMetadata.UserInput)
+	case source.DirectoryScheme:
+		return cleanSPDXName(srcMetadata.Path)
+	}
+
+	// TODO: is this alright?
+	return uuid.Must(uuid.NewRandom()).String()
+}
+
+func cleanSPDXName(name string) string {
+	// remove # according to specification
+	name = strings.ReplaceAll(name, "#", "-")
+
+	// remove : for url construction
+	name = strings.ReplaceAll(name, ":", "-")
+
+	// clean relative pathing
+	return path.Clean(name)
+}
+
+func documentNamespace(name string, srcMetadata source.Metadata) string {
+	input := "unknown-source-type"
+	switch srcMetadata.Scheme {
+	case source.ImageScheme:
+		input = "image"
+	case source.DirectoryScheme:
+		input = "dir"
+	}
+
+	uniqueID := uuid.Must(uuid.NewRandom())
+	identifier := path.Join(input, uniqueID.String())
+	if name != "." {
+		identifier = path.Join(input, fmt.Sprintf("%s-%s", name, uniqueID.String()))
+	}
+
+	return path.Join(anchoreNamespace, identifier)
 }
 
 func toPackages(catalog *pkg.Catalog, relationships []artifact.Relationship) []model.Package {

internal/formats/spdx22tagvalue/encoder.go

@@ -8,9 +8,6 @@ import (
 )
 
 func encoder(output io.Writer, s sbom.SBOM) error {
-	model, err := toFormatModel(s)
-	if err != nil {
-		return err
-	}
-	return tvsaver.Save2_2(model, output)
+	model := toFormatModel(s)
+	return tvsaver.Save2_2(&model, output)
 }

internal/formats/spdx22tagvalue/encoder_test.go

@@ -32,10 +32,6 @@ func TestSPDXTagValueImagePresenter(t *testing.T) {
 func spdxTagValueRedactor(s []byte) []byte {
 	// each SBOM reports the time it was generated, which is not useful during snapshot testing
 	s = regexp.MustCompile(`Created: .*`).ReplaceAll(s, []byte("redacted"))
-
-	// each SBOM reports a unique documentNamespace when generated, this is not useful for snapshot testing
-	s = regexp.MustCompile(`DocumentNamespace: https://anchore.com/syft/.*`).ReplaceAll(s, []byte("redacted"))
-
 	// the license list will be updated periodically, the value here should not be directly tested in snapshot tests
 	return regexp.MustCompile(`LicenseListVersion: .*`).ReplaceAll(s, []byte("redacted"))
 }

internal/formats/spdx22tagvalue/test-fixtures/snapshot/TestSPDXTagValueDirectoryPresenter.golden

@@ -1,12 +1,11 @@
 SPDXVersion: SPDX-2.2
 DataLicense: CC0-1.0
 SPDXID: SPDXRef-DOCUMENT
-DocumentName: /some/path
-DocumentNamespace: https://anchore.com/syft/dir/some/path-22f5732a-cab0-4376-9b79-15e413049500
-LicenseListVersion: 3.15
+DocumentNamespace: https://anchore.com/syft/image/
+LicenseListVersion: 3.13
 Creator: Organization: Anchore, Inc
 Creator: Tool: syft-[not provided]
-Created: 2021-12-01T15:08:43Z
+Created: 2021-06-23T17:49:25Z
 
 ##### Package: package-2
 

internal/formats/spdx22tagvalue/test-fixtures/snapshot/TestSPDXTagValueImagePresenter.golden

@@ -2,11 +2,11 @@ SPDXVersion: SPDX-2.2
 DataLicense: CC0-1.0
 SPDXID: SPDXRef-DOCUMENT
 DocumentName: user-image-input
-DocumentNamespace: https://anchore.com/syft/image/user-image-input-ce4d4ae5-9d79-4f84-a410-361e394c2908
-LicenseListVersion: 3.15
+DocumentNamespace: https://anchore.com/syft/image/user-image-input
+LicenseListVersion: 3.13
 Creator: Organization: Anchore, Inc
 Creator: Tool: syft-[not provided]
-Created: 2021-12-01T15:08:44Z
+Created: 2021-06-23T17:49:25Z
 
 ##### Package: package-2
 

internal/formats/spdx22tagvalue/to_format_model.go

@@ -16,12 +16,8 @@ import (
 
 // toFormatModel creates and populates a new JSON document struct that follows the SPDX 2.2 spec from the given cataloging results.
 // nolint:funlen
-func toFormatModel(s sbom.SBOM) (*spdx.Document2_2, error) {
-	name, namespace, err := spdxhelpers.DocumentNameAndNamespace(s.Source)
-	if err != nil {
-		return nil, err
-	}
-	return &spdx.Document2_2{
+func toFormatModel(s sbom.SBOM) spdx.Document2_2 {
+	return spdx.Document2_2{
 		CreationInfo: &spdx.CreationInfo2_2{
 			// 2.1: SPDX Version; should be in the format "SPDX-2.2"
 			// Cardinality: mandatory, one
@@ -37,7 +33,7 @@ func toFormatModel(s sbom.SBOM) (*spdx.Document2_2, error) {
 
 			// 2.4: Document Name
 			// Cardinality: mandatory, one
-			DocumentName: name,
+			DocumentName: s.Source.ImageMetadata.UserInput,
 
 			// 2.5: Document Namespace
 			// Cardinality: mandatory, one
@@ -56,7 +52,7 @@ func toFormatModel(s sbom.SBOM) (*spdx.Document2_2, error) {
 			// In many cases, the URI will point to a web accessible document, but this should not be assumed
 			// to be the case.
 
-			DocumentNamespace: namespace,
+			DocumentNamespace: fmt.Sprintf("https://anchore.com/syft/image/%s", s.Source.ImageMetadata.UserInput),
 
 			// 2.6: External Document References
 			// Cardinality: optional, one or many
@@ -86,7 +82,7 @@ func toFormatModel(s sbom.SBOM) (*spdx.Document2_2, error) {
 			DocumentComment: "",
 		},
 		Packages: toFormatPackages(s.Artifacts.PackageCatalog),
-	}, nil
+	}
 }
 
 // packages populates all Package Information from the package Catalog (see https://spdx.github.io/spdx-spec/3-package-information/)

internal/formats/syftjson/to_format_model.go

@@ -202,11 +202,6 @@ func toSourceModel(src source.Metadata) (model.Source, error) {
 			Type:   "directory",
 			Target: src.Path,
 		}, nil
-	case source.FileScheme:
-		return model.Source{
-			Type:   "file",
-			Target: src.Path,
-		}, nil
 	default:
 		return model.Source{}, fmt.Errorf("unsupported source: %q", src.Scheme)
 	}

internal/formats/syftjson/to_format_model_test.go

@@ -1,84 +0,0 @@
-package syftjson
-
-import (
-	"testing"
-
-	"github.com/scylladb/go-set/strset"
-
-	"github.com/anchore/syft/internal/formats/syftjson/model"
-	"github.com/anchore/syft/syft/source"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func Test_toSourceModel(t *testing.T) {
-	allSchemes := strset.New()
-	for _, s := range source.AllSchemes {
-		allSchemes.Add(string(s))
-	}
-	testedSchemes := strset.New()
-
-	tests := []struct {
-		name     string
-		src      source.Metadata
-		expected model.Source
-	}{
-		{
-			name: "directory",
-			src: source.Metadata{
-				Scheme: source.DirectoryScheme,
-				Path:   "some/path",
-			},
-			expected: model.Source{
-				Type:   "directory",
-				Target: "some/path",
-			},
-		},
-		{
-			name: "file",
-			src: source.Metadata{
-				Scheme: source.FileScheme,
-				Path:   "some/path",
-			},
-			expected: model.Source{
-				Type:   "file",
-				Target: "some/path",
-			},
-		},
-		{
-			name: "image",
-			src: source.Metadata{
-				Scheme: source.ImageScheme,
-				ImageMetadata: source.ImageMetadata{
-					UserInput:      "user-input",
-					ID:             "id...",
-					ManifestDigest: "digest...",
-					MediaType:      "type...",
-				},
-			},
-			expected: model.Source{
-				Type: "image",
-				Target: source.ImageMetadata{
-					UserInput:      "user-input",
-					ID:             "id...",
-					ManifestDigest: "digest...",
-					MediaType:      "type...",
-				},
-			},
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			// track each scheme tested (passed or not)
-			testedSchemes.Add(string(test.src.Scheme))
-
-			// assert the model transformation is correct
-			actual, err := toSourceModel(test.src)
-			require.NoError(t, err)
-			assert.Equal(t, test.expected, actual)
-		})
-	}
-
-	// assert all possible schemes were under test
-	assert.ElementsMatch(t, allSchemes.List(), testedSchemes.List(), "not all source.Schemes are under test")
-}

internal/formats/syftjson/to_syft_model.go

@@ -40,11 +40,6 @@ func toSyftSourceData(s model.Source) *source.Metadata {
 			Scheme: source.DirectoryScheme,
 			Path:   s.Target.(string),
 		}
-	case "file":
-		return &source.Metadata{
-			Scheme: source.FileScheme,
-			Path:   s.Target.(string),
-		}
 	case "image":
 		return &source.Metadata{
 			Scheme:        source.ImageScheme,

internal/formats/syftjson/to_syft_model_test.go

@@ -1,81 +0,0 @@
-package syftjson
-
-import (
-	"testing"
-
-	"github.com/anchore/syft/internal/formats/syftjson/model"
-	"github.com/anchore/syft/syft/source"
-	"github.com/scylladb/go-set/strset"
-	"github.com/stretchr/testify/assert"
-)
-
-func Test_toSyftSourceData(t *testing.T) {
-	allSchemes := strset.New()
-	for _, s := range source.AllSchemes {
-		allSchemes.Add(string(s))
-	}
-	testedSchemes := strset.New()
-
-	tests := []struct {
-		name     string
-		src      model.Source
-		expected source.Metadata
-	}{
-		{
-			name: "directory",
-			expected: source.Metadata{
-				Scheme: source.DirectoryScheme,
-				Path:   "some/path",
-			},
-			src: model.Source{
-				Type:   "directory",
-				Target: "some/path",
-			},
-		},
-		{
-			name: "file",
-			expected: source.Metadata{
-				Scheme: source.FileScheme,
-				Path:   "some/path",
-			},
-			src: model.Source{
-				Type:   "file",
-				Target: "some/path",
-			},
-		},
-		{
-			name: "image",
-			expected: source.Metadata{
-				Scheme: source.ImageScheme,
-				ImageMetadata: source.ImageMetadata{
-					UserInput:      "user-input",
-					ID:             "id...",
-					ManifestDigest: "digest...",
-					MediaType:      "type...",
-				},
-			},
-			src: model.Source{
-				Type: "image",
-				Target: source.ImageMetadata{
-					UserInput:      "user-input",
-					ID:             "id...",
-					ManifestDigest: "digest...",
-					MediaType:      "type...",
-				},
-			},
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			// assert the model transformation is correct
-			actual := toSyftSourceData(test.src)
-			assert.Equal(t, test.expected, *actual)
-
-			// track each scheme tested (passed or not)
-			testedSchemes.Add(string(test.expected.Scheme))
-		})
-	}
-
-	// assert all possible schemes were under test
-	assert.ElementsMatch(t, allSchemes.List(), testedSchemes.List(), "not all source.Schemes are under test")
-}

internal/formats/text/encoder.go

@@ -16,7 +16,7 @@ func encoder(output io.Writer, s sbom.SBOM) error {
 	w.Init(output, 0, 8, 0, '\t', tabwriter.AlignRight)
 
 	switch s.Source.Scheme {
-	case source.DirectoryScheme, source.FileScheme:
+	case source.DirectoryScheme:
 		fmt.Fprintf(w, "[Path: %s]\n", s.Source.Path)
 	case source.ImageScheme:
 		fmt.Fprintln(w, "[Image]")

syft/pkg/cataloger/catalog.go

@@ -111,9 +111,8 @@ func packageFileOwnershipRelationships(p pkg.Package, resolver source.FilePathRe
 		}
 
 		if len(locations) == 0 {
-			// ideally we want to warn users about missing files from a package, however, it is very common for
-			// container image authors to delete files that are not needed in order to keep image sizes small. Adding
-			// a warning here would be needlessly noisy (even for popular base images).
+			// TODO: this is a known-unknown that could later be persisted in the SBOM (or as a validation failure)
+			log.Warnf("unable to find location which a package claims ownership of: %s", path)
 			continue
 		}
 

syft/source/directory_resolver.go

@@ -326,10 +326,7 @@ func (r *directoryResolver) RelativeFileByPath(_ Location, path string) *Locatio
 // FileContentsByLocation fetches file contents for a single file reference relative to a directory.
 // If the path does not exist an error is returned.
 func (r directoryResolver) FileContentsByLocation(location Location) (io.ReadCloser, error) {
-	if location.ref.RealPath == "" {
-		return nil, errors.New("empty path given")
-	}
-	return file.NewLazyReadCloser(string(location.ref.RealPath)), nil
+	return file.NewLazyReadCloser(location.RealPath), nil
 }
 
 func (r *directoryResolver) AllLocations() <-chan Location {

syft/source/directory_resolver_test.go

@@ -536,45 +536,3 @@ func Test_ignoreIrregularFiles(t *testing.T) {
 	rp := resolver.fileTree.AllFiles()[0].RealPath
 	assert.True(t, strings.Contains(string(rp), filepath.Join(dir, "readme")))
 }
-
-func Test_directoryResolver_FileContentsByLocation(t *testing.T) {
-	tests := []struct {
-		name     string
-		location Location
-		expects  string
-		err      bool
-	}{
-		{
-			name: "use file reference for content requests",
-			location: NewLocationFromDirectory("some/place", file.Reference{
-				RealPath: "test-fixtures/image-simple/file-1.txt",
-			}),
-			expects: "this file has contents",
-		},
-		{
-			name:     "error on empty file reference",
-			location: NewLocationFromDirectory("doesn't matter", file.Reference{}),
-			err:      true,
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			r, err := newDirectoryResolver(".")
-			require.NoError(t, err)
-
-			actual, err := r.FileContentsByLocation(test.location)
-			if test.err {
-				require.Error(t, err)
-				return
-			} else {
-				require.NoError(t, err)
-			}
-
-			if test.expects != "" {
-				b, err := ioutil.ReadAll(actual)
-				require.NoError(t, err)
-				assert.Equal(t, test.expects, string(b))
-			}
-		})
-	}
-}

syft/source/scheme.go

@@ -23,12 +23,6 @@ const (
 	FileScheme Scheme = "FileScheme"
 )
 
-var AllSchemes = []Scheme{
-	DirectoryScheme,
-	ImageScheme,
-	FileScheme,
-}
-
 func detectScheme(fs afero.Fs, imageDetector sourceDetector, userInput string) (Scheme, image.Source, string, error) {
 	switch {
 	case strings.HasPrefix(userInput, "dir:"):