Correct SPDX-JSON checksum algorithm (#863)

* bump error language and remove panic

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

.github/workflows/codeql-analysis.yml

@@ -7,10 +7,10 @@ name: "CodeQL Security Scan"
 
 on:
   push:
-    branches: [main]
-  pull_request:
-    # The branches below must be a subset of the branches above
-    branches: [main]
+    branches:
+      # only run when there are pushes to the main branch (not on PRs)
+      - main
+
   schedule:
     - cron: '0 0 * * 3'
 

.github/workflows/validations.yaml

@@ -2,6 +2,8 @@ name: "Validations"
 on:
   workflow_dispatch:
   push:
+    branches:
+      - main
   pull_request:
 
 env:

README.md

@@ -114,6 +114,7 @@ Sources can be explicitly provided with a scheme:
 
 ```
 docker:yourrepo/yourimage:tag          use images from the Docker daemon
+podman:yourrepo/yourimage:tag          use images from the Podman daemon
 docker-archive:path/to/yourimage.tar   use a tarball from disk for archives created from "docker save"
 oci-archive:path/to/yourimage.tar      use a tarball from disk for OCI archives (from Skopeo or otherwise)
 oci-dir:path/to/yourimage              read directly from a path on disk for OCI layout directories (from Skopeo or otherwise)

cmd/attest.go

@@ -125,7 +125,7 @@ func attestExec(ctx context.Context, _ *cobra.Command, args []string) error {
 	userInput := args[0]
 	si, err := source.ParseInput(userInput, false)
 	if err != nil {
-		return fmt.Errorf("could not generate source input for attest command: %q", err)
+		return fmt.Errorf("could not generate source input for attest command: %w", err)
 	}
 
 	switch si.Scheme {

cmd/packages.go

@@ -42,6 +42,7 @@ const (
 
 	schemeHelpHeader = "You can also explicitly specify the scheme to use:"
 	imageSchemeHelp  = `    {{.appName}} {{.command}} docker:yourrepo/yourimage:tag          explicitly use the Docker daemon
+    {{.appName}} {{.command}} podman:yourrepo/yourimage:tag        	 explicitly use the Podman daemon
     {{.appName}} {{.command}} registry:yourrepo/yourimage:tag        pull image directly from a registry (no container runtime required)
     {{.appName}} {{.command}} docker-archive:path/to/yourimage.tar   use a tarball from disk for archives created from "docker save"
     {{.appName}} {{.command}} oci-archive:path/to/yourimage.tar      use a tarball from disk for OCI archives (from Skopeo or otherwise)
@@ -230,7 +231,7 @@ func packagesExec(_ *cobra.Command, args []string) error {
 	userInput := args[0]
 	si, err := source.ParseInput(userInput, true)
 	if err != nil {
-		return fmt.Errorf("could not generate source input for attest command: %q", err)
+		return fmt.Errorf("could not generate source input for packages command: %w", err)
 	}
 
 	return eventLoop(
@@ -305,7 +306,7 @@ func packagesExecWorker(si source.Input, writer sbom.Writer) <-chan error {
 		}
 
 		if s == nil {
-			panic("nil sbomb returned with no error")
+			errs <- fmt.Errorf("no SBOM produced for %q", si.UserInput)
 		}
 
 		if appConfig.Anchore.Host != "" {

cmd/power_user.go

@@ -26,7 +26,7 @@ const powerUserExample = `  {{.appName}} {{.command}} <image>
 
   DEPRECATED - THIS COMMAND WILL BE REMOVED in v1.0.0
 
-  Only image sources are supported (e.g. docker: , docker-archive: , oci: , etc.), the directory source (dir:) is not supported.
+  Only image sources are supported (e.g. docker: , podman: , docker-archive: , oci: , etc.), the directory source (dir:) is not supported.
 
   All behavior is controlled via application configuration and environment variables (see https://github.com/anchore/syft#configuration)
 `

internal/formats/spdx22json/to_format_model.go

@@ -152,13 +152,19 @@ func toFiles(s sbom.SBOM) []model.File {
 func toFileChecksums(digests []file.Digest) (checksums []model.Checksum) {
 	for _, digest := range digests {
 		checksums = append(checksums, model.Checksum{
-			Algorithm:     digest.Algorithm,
+			Algorithm:     toChecksumAlgorithm(digest.Algorithm),
 			ChecksumValue: digest.Value,
 		})
 	}
 	return checksums
 }
 
+func toChecksumAlgorithm(algorithm string) string {
+	// basically, we need an uppercase version of our algorithm:
+	// https://github.com/spdx/spdx-spec/blob/development/v2.2.2/schemas/spdx-schema.json#L165
+	return strings.ToUpper(algorithm)
+}
+
 func toFileTypes(metadata *source.FileMetadata) (ty []string) {
 	if metadata == nil {
 		return nil

internal/formats/spdx22json/to_format_model_test.go

@@ -142,7 +142,7 @@ func Test_toFileChecksums(t *testing.T) {
 			name: "has digests",
 			digests: []file.Digest{
 				{
-					Algorithm: "sha256",
+					Algorithm: "SHA256",
 					Value:     "deadbeefcafe",
 				},
 				{
@@ -152,11 +152,11 @@ func Test_toFileChecksums(t *testing.T) {
 			},
 			expected: []model.Checksum{
 				{
-					Algorithm:     "sha256",
+					Algorithm:     "SHA256",
 					ChecksumValue: "deadbeefcafe",
 				},
 				{
-					Algorithm:     "md5",
+					Algorithm:     "MD5",
 					ChecksumValue: "meh",
 				},
 			},

test/install/test_harness.sh

@@ -5,6 +5,15 @@ TEST_INSTALL_SH=true
 . ../../install.sh
 set -u
 
+echoerr() {
+  echo "$@" 1>&2
+}
+
+printferr() {
+  printf "%s" "$*" >&2
+}
+
+
 assertTrue() {
   if eval "$1"; then
     echo "assertTrue failed: $2"
@@ -93,16 +102,34 @@ setup_snapshot_server() {
   python3 -m http.server --directory "$(snapshot_dir)" $serve_port &> /dev/null &
   worker_pid=$!
 
-  # it takes some time for the server to be ready...
-  sleep 3
+  echoerr "serving up $(snapshot_dir) on port $serve_port"
+
+  echoerr "$(ls -1 $(snapshot_dir) | sed 's/^/  ▕―― /')"
+
+  check_snapshots_server_ready
+
+  echoerr "snapshot server ready! (worker=${worker_pid})"
 
   echo "$worker_pid"
 }
 
+check_snapshots_server_ready() {
+  i=0
+  until $(curl -m 3 --output /dev/null --silent --head --fail localhost:$serve_port/); do
+    sleep 1
+    ((i=i+1))
+    if [ "$i" -gt "30" ]; then
+      echoerr "could not connect to local snapshot server! bailing..."
+      exit 1
+    fi
+    printferr '.'
+  done
+}
+
 teardown_snapshot_server() {
   worker_pid="$1"
-
-  kill $worker_pid
+  echoerr "stopping worker=${worker_pid}"
+  kill "$worker_pid"
 }
 
 snapshot_version() {