Fix panic in apkdb parsing on empty "provides" values (#1494)

* Add failing test for strip version specifiers panic

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

* Fix test

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

* Prevent panic scenario in helper func

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

* Fix lint issue

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

* add tests for apk stripVersionSpecifier() and remove caller empty value check

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Co-authored-by: Alex Goodman <alex.goodman@anchore.com>

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: daily
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: daily

.github/workflows/codeql-analysis.yml

@@ -34,7 +34,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
+      uses: github/codeql-action/init@v2
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -45,7 +45,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
+      uses: github/codeql-action/autobuild@v2
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -59,4 +59,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      uses: github/codeql-action/analyze@v2

.github/workflows/update-bootstrap-tools.yml

@@ -16,7 +16,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
 
-      - uses: actions/setup-go@v2
+      - uses: actions/setup-go@v3
         with:
           go-version: ${{ env.GO_VERSION }}
           stable: ${{ env.GO_STABLE_VERSION }}

.github/workflows/update-stereoscope-release.yml

@@ -16,7 +16,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
 
-      - uses: actions/setup-go@v2
+      - uses: actions/setup-go@v3
         with:
           go-version: ${{ env.GO_VERSION }}
           stable: ${{ env.GO_STABLE_VERSION }}

go.mod

@@ -5,20 +5,20 @@ go 1.18
 require (
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
 	github.com/acobaugh/osrelease v0.1.0
-	github.com/adrg/xdg v0.3.3
+	github.com/adrg/xdg v0.4.0
 	github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.1.1-0.20230104203445-02e0a6721501
-	github.com/bmatcuk/doublestar/v4 v4.0.2
+	github.com/bmatcuk/doublestar/v4 v4.6.0
 	github.com/dustin/go-humanize v1.0.0
-	github.com/facebookincubator/nvdtools v0.1.4
-	github.com/go-test/deep v1.0.8
+	github.com/facebookincubator/nvdtools v0.1.5
+	github.com/go-test/deep v1.1.0
 	github.com/google/go-cmp v0.5.9
 	github.com/google/uuid v1.3.0
-	github.com/gookit/color v1.4.2
+	github.com/gookit/color v1.5.2
 	github.com/hashicorp/go-multierror v1.1.1
-	github.com/jinzhu/copier v0.3.2
+	github.com/jinzhu/copier v0.3.5
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
 	github.com/mholt/archiver/v3 v3.5.1
 	github.com/microsoft/go-rustaudit v0.0.0-20220730194248-4b17361d90a5
@@ -29,22 +29,22 @@ require (
 	github.com/pelletier/go-toml v1.9.5
 	// pinned to pull in 386 arch fix: https://github.com/scylladb/go-set/commit/cc7b2070d91ebf40d233207b633e28f5bd8f03a5
 	github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e
-	github.com/sergi/go-diff v1.2.0
+	github.com/sergi/go-diff v1.3.1
 	github.com/sirupsen/logrus v1.9.0
 	github.com/spdx/tools-golang v0.3.1-0.20221108182156-8a01147e6342
-	github.com/spf13/afero v1.8.2
-	github.com/spf13/cobra v1.6.0
+	github.com/spf13/afero v1.9.3
+	github.com/spf13/cobra v1.6.1
 	github.com/spf13/pflag v1.0.5
-	github.com/spf13/viper v1.13.0
+	github.com/spf13/viper v1.15.0
 	github.com/stretchr/testify v1.8.1
-	github.com/vifraa/gopom v0.1.0
+	github.com/vifraa/gopom v0.2.1
 	github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5
 	github.com/wagoodman/go-progress v0.0.0-20200731105512-1020f39e6240
 	github.com/wagoodman/jotframe v0.0.0-20211129225309-56b0d0a4aebb
 	github.com/xeipuuv/gojsonschema v1.2.0
-	golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4
-	golang.org/x/net v0.4.0
-	golang.org/x/term v0.3.0
+	golang.org/x/mod v0.6.0
+	golang.org/x/net v0.5.0
+	golang.org/x/term v0.4.0
 	gopkg.in/yaml.v2 v2.4.0
 )
 
@@ -53,13 +53,13 @@ require (
 	github.com/Masterminds/sprig/v3 v3.2.2
 	github.com/anchore/go-logger v0.0.0-20220728155337-03b66a5207d8
 	github.com/anchore/stereoscope v0.0.0-20221208011002-c5ff155d72f1
-	github.com/docker/docker v20.10.17+incompatible
-	github.com/google/go-containerregistry v0.11.0
+	github.com/docker/docker v20.10.20+incompatible
+	github.com/google/go-containerregistry v0.12.1
 	github.com/invopop/jsonschema v0.7.0
 	github.com/knqyf263/go-rpmdb v0.0.0-20221030135625-4082a22221ce
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/sassoftware/go-rpmutils v0.2.0
-	github.com/vbatts/go-mtree v0.5.0
+	github.com/vbatts/go-mtree v0.5.2
 	golang.org/x/exp v0.0.0-20220823124025-807a23277127
 	gopkg.in/yaml.v3 v3.0.1
 )
@@ -68,17 +68,17 @@ require (
 	github.com/DataDog/zstd v1.4.5 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.1.1 // indirect
-	github.com/Microsoft/go-winio v0.5.2 // indirect
+	github.com/Microsoft/go-winio v0.6.0 // indirect
 	github.com/containerd/containerd v1.6.12 // indirect
-	github.com/containerd/stargz-snapshotter/estargz v0.12.0 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.12.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/docker/cli v20.10.17+incompatible // indirect
+	github.com/docker/cli v20.10.20+incompatible // indirect
 	github.com/docker/distribution v2.8.1+incompatible // indirect
-	github.com/docker/docker-credential-helpers v0.6.4 // indirect
+	github.com/docker/docker-credential-helpers v0.7.0 // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
-	github.com/docker/go-units v0.4.0 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 // indirect
-	github.com/fsnotify/fsnotify v1.5.4 // indirect
+	github.com/fsnotify/fsnotify v1.6.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.0 // indirect
 	github.com/go-restruct/restruct v1.2.0-alpha // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
@@ -91,10 +91,10 @@ require (
 	github.com/imdario/mergo v0.3.12 // indirect
 	github.com/inconshreveable/mousetrap v1.0.1 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
-	github.com/klauspost/compress v1.15.9 // indirect
+	github.com/klauspost/compress v1.15.11 // indirect
 	github.com/klauspost/pgzip v1.2.5 // indirect
 	github.com/logrusorgru/aurora v0.0.0-20200102142835-e9ef32dff381 // indirect
-	github.com/magiconair/properties v1.8.6 // indirect
+	github.com/magiconair/properties v1.8.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.16 // indirect
 	github.com/mattn/go-runewidth v0.0.13 // indirect
@@ -102,8 +102,8 @@ require (
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 // indirect
 	github.com/nwaples/rardecode v1.1.0 // indirect
-	github.com/opencontainers/image-spec v1.0.3-0.20220114050600-8b9d41f48198 // indirect
-	github.com/pelletier/go-toml/v2 v2.0.5 // indirect
+	github.com/opencontainers/image-spec v1.1.0-rc2 // indirect
+	github.com/pelletier/go-toml/v2 v2.0.6 // indirect
 	github.com/pierrec/lz4/v4 v4.1.15 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0 // indirect
@@ -113,7 +113,7 @@ require (
 	github.com/spf13/cast v1.5.0 // indirect
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
 	github.com/stretchr/objx v0.5.0 // indirect
-	github.com/subosito/gotenv v1.4.1 // indirect
+	github.com/subosito/gotenv v1.4.2 // indirect
 	github.com/sylabs/sif/v2 v2.8.1 // indirect
 	github.com/sylabs/squashfs v0.6.1 // indirect
 	github.com/therootcompany/xz v1.0.1 // indirect
@@ -123,14 +123,13 @@ require (
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
 	github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778 // indirect
-	golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0 // indirect
-	golang.org/x/sys v0.3.0 // indirect
-	golang.org/x/text v0.5.0 // indirect
-	golang.org/x/time v0.0.0-20220922220347-f3bd1da661af // indirect
+	golang.org/x/sync v0.1.0 // indirect
+	golang.org/x/sys v0.4.0 // indirect
+	golang.org/x/text v0.6.0 // indirect
 	golang.org/x/tools v0.1.12 // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
-	google.golang.org/genproto v0.0.0-20221010155953-15ba04fc1c0e // indirect
-	google.golang.org/grpc v1.50.1 // indirect
+	google.golang.org/genproto v0.0.0-20221227171554-f9683d7f8bef // indirect
+	google.golang.org/grpc v1.52.0 // indirect
 	google.golang.org/protobuf v1.28.1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	lukechampine.com/uint128 v1.1.1 // indirect
@@ -150,7 +149,7 @@ require (
 	// go: warning: github.com/andybalholm/brotli@v1.0.1: retracted by module author: occasional panics and data corruption
 	github.com/andybalholm/brotli v1.0.4 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	golang.org/x/crypto v0.0.0-20220926161630-eccd6366d1be // indirect
+	golang.org/x/crypto v0.1.0 // indirect
 )
 
 retract (

syft/pkg/cataloger/apkdb/parse_apk_db.go

@@ -71,6 +71,14 @@ func parseApkDB(_ source.FileResolver, env *generic.Environment, reader source.L
 			log.Warnf("unable to parse field data from line %q", line)
 			continue
 		}
+		if len(field.name) == 0 {
+			log.Warnf("failed to parse field name from line %q", line)
+			continue
+		}
+		if len(field.value) == 0 {
+			log.Debugf("line %q: parsed field %q appears to have an empty value, skipping", line, field.name)
+			continue
+		}
 
 		entryParsingInProgress = true
 
@@ -353,5 +361,11 @@ func stripVersionSpecifier(s string) string {
 	// examples:
 	// musl>=1                 --> musl
 	// cmd:scanelf=1.3.4-r0    --> cmd:scanelf
-	return splitAny(s, "<>=")[0]
+
+	items := splitAny(s, "<>=")
+	if len(items) == 0 {
+		return s
+	}
+
+	return items[0]
 }

syft/pkg/cataloger/apkdb/parse_apk_db_test.go

@@ -160,6 +160,43 @@ func TestSinglePackageDetails(t *testing.T) {
 				},
 			},
 		},
+		{
+			fixture: "test-fixtures/empty-deps-and-provides",
+			expected: pkg.ApkMetadata{
+				Package:       "alpine-baselayout-data",
+				OriginPackage: "alpine-baselayout",
+				Version:       "3.4.0-r0",
+				Description:   "Alpine base dir structure and init scripts",
+				Maintainer:    "Natanael Copa <ncopa@alpinelinux.org>",
+				License:       "GPL-2.0-only",
+				Architecture:  "x86_64",
+				URL:           "https://git.alpinelinux.org/cgit/aports/tree/main/alpine-baselayout",
+				Size:          11664,
+				InstalledSize: 77824,
+				Dependencies:  []string{},
+				Provides:      []string{},
+				Checksum:      "Q15ffjKT28lB7iSXjzpI/eDdYRCwM=",
+				GitCommit:     "bd965a7ebf7fd8f07d7a0cc0d7375bf3e4eb9b24",
+				Files: []pkg.ApkFileRecord{
+					{Path: "/etc"},
+					{Path: "/etc/fstab"},
+					{Path: "/etc/group"},
+					{Path: "/etc/hostname"},
+					{Path: "/etc/hosts"},
+					{Path: "/etc/inittab"},
+					{Path: "/etc/modules"},
+					{Path: "/etc/mtab", OwnerUID: "0", OwnerGID: "0", Permissions: "0777"},
+					{Path: "/etc/nsswitch.conf"},
+					{Path: "/etc/passwd"},
+					{Path: "/etc/profile"},
+					{Path: "/etc/protocols"},
+					{Path: "/etc/services"},
+					{Path: "/etc/shadow", OwnerUID: "0", OwnerGID: "148", Permissions: "0640"},
+					{Path: "/etc/shells"},
+					{Path: "/etc/sysctl.conf"},
+				},
+			},
+		},
 		{
 			fixture: "test-fixtures/base",
 			expected: pkg.ApkMetadata{
@@ -874,6 +911,27 @@ func Test_discoverPackageDependencies(t *testing.T) {
 				}
 			},
 		},
+		{
+			name: "strip version specifiers with empty provides value",
+			genFn: func() ([]pkg.Package, []artifact.Relationship) {
+				a := pkg.Package{
+					Name: "package-a",
+					Metadata: pkg.ApkMetadata{
+						Dependencies: []string{"so:libc.musl-x86_64.so.1"},
+					},
+				}
+				a.SetID()
+				b := pkg.Package{
+					Name: "package-b",
+					Metadata: pkg.ApkMetadata{
+						Provides: []string{""},
+					},
+				}
+				b.SetID()
+
+				return []pkg.Package{a, b}, nil
+			},
+		},
 		{
 			name: "depends on package name",
 			genFn: func() ([]pkg.Package, []artifact.Relationship) {
@@ -1089,3 +1147,42 @@ func newLocationReadCloser(t *testing.T, path string) source.LocationReadCloser
 
 	return source.NewLocationReadCloser(source.NewLocation(path), f)
 }
+
+func Test_stripVersionSpecifier(t *testing.T) {
+	tests := []struct {
+		name    string
+		version string
+		want    string
+	}{
+		{
+			name:    "empty expression",
+			version: "",
+			want:    "",
+		},
+		{
+			name:    "no expression",
+			version: "cmd:foo",
+			want:    "cmd:foo",
+		},
+		{
+			name:    "=",
+			version: "cmd:scanelf=1.3.4-r0",
+			want:    "cmd:scanelf",
+		},
+		{
+			name:    ">=",
+			version: "cmd:scanelf>=1.3.4-r0",
+			want:    "cmd:scanelf",
+		},
+		{
+			name:    "<",
+			version: "cmd:scanelf<1.3.4-r0",
+			want:    "cmd:scanelf",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, stripVersionSpecifier(tt.version))
+		})
+	}
+}

syft/pkg/cataloger/apkdb/test-fixtures/empty-deps-and-provides

@@ -0,0 +1,35 @@
+P:alpine-baselayout-data
+V:3.4.0-r0
+A:x86_64
+L:GPL-2.0-only
+T:Alpine base dir structure and init scripts
+o:alpine-baselayout
+m:Natanael Copa <ncopa@alpinelinux.org>
+U:https://git.alpinelinux.org/cgit/aports/tree/main/alpine-baselayout
+D:
+p:
+c:bd965a7ebf7fd8f07d7a0cc0d7375bf3e4eb9b24
+i:[]
+t:1667573027
+S:11664
+I:77824
+k:0
+C:Q15ffjKT28lB7iSXjzpI/eDdYRCwM=
+F:etc
+R:fstab
+R:group
+R:hostname
+R:hosts
+R:inittab
+R:modules
+R:mtab
+a:0:0:0777
+R:nsswitch.conf
+R:passwd
+R:profile
+R:protocols
+R:services
+R:shadow
+a:0:148:0640
+R:shells
+R:sysctl.conf

syft/pkg/cataloger/binary/cataloger.go

@@ -1,6 +1,7 @@
 package binary
 
 import (
+	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
@@ -30,41 +31,52 @@ func (c Cataloger) Catalog(resolver source.FileResolver) ([]pkg.Package, []artif
 	var packages []pkg.Package
 	var relationships []artifact.Relationship
 
-	for _, classifier := range defaultClassifiers {
-		locations, err := resolver.FilesByGlob(classifier.FileGlob)
+	for _, cls := range defaultClassifiers {
+		pkgs, err := catalog(resolver, cls)
 		if err != nil {
-			return nil, nil, err
-		}
-		for _, location := range locations {
-			reader, err := resolver.FileContentsByLocation(location)
-			if err != nil {
-				return nil, nil, err
-			}
-			locationReader := source.NewLocationReadCloser(location, reader)
-			newPkgs, err := classifier.EvidenceMatcher(classifier, locationReader)
-			if err != nil {
-				return nil, nil, err
-			}
-		newPackages:
-			for i := range newPkgs {
-				newPkg := &newPkgs[i]
-				for j := range packages {
-					p := &packages[j]
-					// consolidate identical packages found in different locations,
-					// but continue to track each location
-					if packagesMatch(p, newPkg) {
-						p.Locations.Add(newPkg.Locations.ToSlice()...)
-						continue newPackages
-					}
-				}
-				packages = append(packages, *newPkg)
-			}
+			log.WithFields("error", err, "classifier", cls.Class).Warn("unable to catalog binary package: %w", err)
+			continue
 		}
+		packages = append(packages, pkgs...)
 	}
 
 	return packages, relationships, nil
 }
 
+func catalog(resolver source.FileResolver, cls classifier) ([]pkg.Package, error) {
+	var pkgs []pkg.Package
+	locations, err := resolver.FilesByGlob(cls.FileGlob)
+	if err != nil {
+		return nil, err
+	}
+	for _, location := range locations {
+		reader, err := resolver.FileContentsByLocation(location)
+		if err != nil {
+			return nil, err
+		}
+		locationReader := source.NewLocationReadCloser(location, reader)
+		newPkgs, err := cls.EvidenceMatcher(cls, locationReader)
+		if err != nil {
+			return nil, err
+		}
+	newPackages:
+		for i := range newPkgs {
+			newPkg := &newPkgs[i]
+			for j := range pkgs {
+				p := &pkgs[j]
+				// consolidate identical packages found in different locations,
+				// but continue to track each location
+				if packagesMatch(p, newPkg) {
+					p.Locations.Add(newPkg.Locations.ToSlice()...)
+					continue newPackages
+				}
+			}
+			pkgs = append(pkgs, *newPkg)
+		}
+	}
+	return pkgs, nil
+}
+
 // packagesMatch returns true if the binary packages "match" based on basic criteria
 func packagesMatch(p1 *pkg.Package, p2 *pkg.Package) bool {
 	if p1.Name != p2.Name ||

syft/pkg/cataloger/binary/cataloger_test.go

@@ -1,6 +1,8 @@
 package binary
 
 import (
+	"errors"
+	"io"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -17,6 +19,20 @@ func TestClassifierCataloger_DefaultClassifiers_PositiveCases(t *testing.T) {
 		fixtureDir string
 		expected   pkg.Package
 	}{
+		{
+			name:       "positive-memcached-1.6.18",
+			fixtureDir: "test-fixtures/classifiers/positive/memcached-1.6.18",
+			expected: pkg.Package{
+				Name:      "memcached",
+				Version:   "1.6.18",
+				Type:      "binary",
+				PURL:      "pkg:generic/memcached@1.6.18",
+				Locations: singleLocation("memcached"),
+				Metadata: pkg.BinaryMetadata{
+					Classifier: "memcached-binary",
+				},
+			},
+		},
 		{
 			name:       "positive-httpd-2.4.54",
 			fixtureDir: "test-fixtures/classifiers/positive/httpd-2.4.54",
@@ -30,7 +46,8 @@ func TestClassifierCataloger_DefaultClassifiers_PositiveCases(t *testing.T) {
 					Classifier: "httpd-binary",
 				},
 			},
-		}, {
+		},
+		{
 			name:       "positive-php-cli-8.2.1",
 			fixtureDir: "test-fixtures/classifiers/positive/php-cli-8.2.1",
 			expected: pkg.Package{
@@ -418,3 +435,49 @@ func assertPackagesAreEqual(t *testing.T, expected pkg.Package, p pkg.Package) {
 		assert.Failf(t, "packages not equal", "%v != %v", expected, p)
 	}
 }
+
+type panicyResolver struct {
+	globCalled bool
+}
+
+func (p panicyResolver) FileContentsByLocation(location source.Location) (io.ReadCloser, error) {
+	return nil, errors.New("not implemented")
+}
+
+func (p panicyResolver) HasPath(s string) bool {
+	return true
+}
+
+func (p panicyResolver) FilesByPath(paths ...string) ([]source.Location, error) {
+	return nil, errors.New("not implemented")
+}
+
+func (p *panicyResolver) FilesByGlob(patterns ...string) ([]source.Location, error) {
+	p.globCalled = true
+	return nil, errors.New("not implemented")
+}
+
+func (p panicyResolver) FilesByMIMEType(types ...string) ([]source.Location, error) {
+	return nil, errors.New("not implemented")
+}
+
+func (p panicyResolver) RelativeFileByPath(_ source.Location, path string) *source.Location {
+	return nil
+}
+
+func (p panicyResolver) AllLocations() <-chan source.Location {
+	return nil
+}
+
+func (p panicyResolver) FileMetadataByLocation(location source.Location) (source.FileMetadata, error) {
+	return source.FileMetadata{}, errors.New("not implemented")
+}
+
+func Test_Cataloger_ResilientToErrors(t *testing.T) {
+	c := NewCataloger()
+
+	resolver := &panicyResolver{}
+	_, _, err := c.Catalog(resolver)
+	assert.NoError(t, err)
+	assert.True(t, resolver.globCalled)
+}

syft/pkg/cataloger/binary/default_classifiers.go

@@ -141,4 +141,12 @@ var defaultClassifiers = []classifier{
 		PURL:    mustPURL("pkg:generic/httpd@version"),
 		CPEs:    singleCPE("cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*"),
 	},
+	{
+		Class:    "memcached-binary",
+		FileGlob: "**/memcached",
+		EvidenceMatcher: fileContentsVersionMatcher(
+			`(?m)memcached\s(?P<version>[0-9]+\.[0-9]+\.[0-9]+)`),
+		Package: "memcached",
+		PURL:    mustPURL("pkg:generic/memcached@version"),
+	},
 }

syft/pkg/cataloger/binary/test-fixtures/classifiers/positive/memcached-1.6.18/memcached

@@ -0,0 +1,13 @@
+secs_since_last_cmd
+listen
+memcached 1.6.18
+udp-port
+memcached 1.6.18
+Failed to allocate memory
+%s,%s
+--
+bget
+flush_all
+VERSION 1.6.18
+quit
+BADCLASS invalid class id

syft/pkg/cataloger/generic/cataloger.go

@@ -28,7 +28,8 @@ func (c *Cataloger) WithParserByGlobs(parser Parser, globs ...string) *Cataloger
 		func(resolver source.FileResolver, env Environment) []request {
 			var requests []request
 			for _, g := range globs {
-				// TODO: add more trace logging here
+				log.WithFields("glob", g).Trace("searching for paths matching glob")
+
 				matches, err := resolver.FilesByGlob(g)
 				if err != nil {
 					log.Warnf("unable to process glob=%q: %+v", g, err)
@@ -47,7 +48,8 @@ func (c *Cataloger) WithParserByMimeTypes(parser Parser, types ...string) *Catal
 		func(resolver source.FileResolver, env Environment) []request {
 			var requests []request
 			for _, t := range types {
-				// TODO: add more trace logging here
+				log.WithFields("mimetype", t).Trace("searching for paths matching mimetype")
+
 				matches, err := resolver.FilesByMIMEType(t)
 				if err != nil {
 					log.Warnf("unable to process mimetype=%q: %+v", t, err)
@@ -65,11 +67,12 @@ func (c *Cataloger) WithParserByPath(parser Parser, paths ...string) *Cataloger
 	c.processor = append(c.processor,
 		func(resolver source.FileResolver, env Environment) []request {
 			var requests []request
-			for _, g := range paths {
-				// TODO: add more trace logging here
-				matches, err := resolver.FilesByPath(g)
+			for _, p := range paths {
+				log.WithFields("path", p).Trace("searching for path")
+
+				matches, err := resolver.FilesByPath(p)
 				if err != nil {
-					log.Warnf("unable to process path=%q: %+v", g, err)
+					log.Warnf("unable to process path=%q: %+v", p, err)
 					continue
 				}
 				requests = append(requests, makeRequests(parser, matches)...)

syft/pkg/cataloger/golang/scan_binary.go

@@ -53,7 +53,8 @@ func getBuildInfo(r io.ReaderAt) (bi *debug.BuildInfo, err error) {
 	if err != nil {
 		if err.Error() == "not a Go executable" {
 			// since the cataloger can only select executables and not distinguish if they are a go-compiled
-			// binary, we should not show warnings/logs in this case.
+			// binary, we should not show warnings/logs in this case. For this reason we nil-out err here.
+			err = nil
 			return
 		}
 		// in this case we could not read the or parse the file, but not explicitly because it is not a

syft/pkg/cataloger/java/archive_parser.go

@@ -133,12 +133,14 @@ func (j *archiveParser) parse() ([]pkg.Package, []artifact.Relationship, error)
 	// add pURLs to all packages found
 	// note: since package information may change after initial creation when parsing multiple locations within the
 	// jar, we wait until the conclusion of the parsing process before synthesizing pURLs.
-	for i, p := range pkgs {
+	for i := range pkgs {
+		p := &pkgs[i]
 		if m, ok := p.Metadata.(pkg.JavaMetadata); ok {
-			pkgs[i].PURL = packageURL(p.Name, p.Version, m)
+			p.PURL = packageURL(p.Name, p.Version, m)
 		} else {
 			log.WithFields("package", p.String()).Warn("unable to extract java metadata to generate purl")
 		}
+		p.SetID()
 	}
 
 	return pkgs, relationships, nil

syft/pkg/cataloger/java/archive_parser_test.go

@@ -277,6 +277,10 @@ func TestParseJar(t *testing.T) {
 			}
 
 			for _, a := range actual {
+				if a.ID() == "" {
+					t.Fatalf("empty package ID: %+v", a)
+				}
+
 				e, ok := test.expected[a.Name]
 				if !ok {
 					t.Errorf("entry not found: %s", a.Name)

syft/pkg/cataloger/java/graalvm_native_image_cataloger.go

@@ -117,7 +117,7 @@ func getPackage(component nativeImageComponent) pkg.Package {
 	for _, property := range component.Properties {
 		c, err := cpe.New(property.Value)
 		if err != nil {
-			log.Debugf("native-image cataloger: could not parse CPE: %v.", err)
+			log.Debugf("unable to parse CPE: %v", err)
 			continue
 		}
 		cpes = append(cpes, c)
@@ -156,7 +156,7 @@ func decompressSbom(dataBuf []byte, sbomStart uint64, lengthStart uint64) ([]pkg
 		return nil, fmt.Errorf("could not read from binary file: %w", err)
 	}
 
-	log.WithFields("len", storedLength).Trace("native-image cataloger: found SBOM")
+	log.WithFields("len", storedLength).Trace("found java native-image SBOM")
 	sbomEnd := sbomStart + storedLength
 	if sbomEnd > uint64(bufLen) {
 		return nil, errors.New("the sbom symbol overflows the binary")
@@ -166,18 +166,18 @@ func decompressSbom(dataBuf []byte, sbomStart uint64, lengthStart uint64) ([]pkg
 	p = bytes.NewBuffer(sbomCompressed)
 	gzreader, err := gzip.NewReader(p)
 	if err != nil {
-		return nil, fmt.Errorf("could not decompress the native-image SBOM: %w", err)
+		return nil, fmt.Errorf("could not decompress the java native-image SBOM: %w", err)
 	}
 
 	output, err := io.ReadAll(gzreader)
 	if err != nil {
-		return nil, fmt.Errorf("could not read the native-image SBOM: %w", err)
+		return nil, fmt.Errorf("could not read the java native-image SBOM: %w", err)
 	}
 
 	var sbomContent nativeImageCycloneDX
 	err = json.Unmarshal(output, &sbomContent)
 	if err != nil {
-		return nil, fmt.Errorf("could not unmarshal the native-image SBOM: %w", err)
+		return nil, fmt.Errorf("could not unmarshal the java native-image SBOM: %w", err)
 	}
 
 	for _, component := range sbomContent.Components {
@@ -199,10 +199,18 @@ func newElf(filename string, r io.ReaderAt) (nativeImage, error) {
 	// First attempt to read an ELF file.
 	bi, err := elf.NewFile(r)
 
-	// The reader does not refer to an ELF file.
 	if err != nil {
+		var fmtErr *elf.FormatError
+		if errors.As(err, &fmtErr) {
+			// this is not an elf file
+			log.WithFields("filename", filename, "error", err).Trace("not an ELF binary")
+			return nil, nil
+		}
 		return fileError(filename, err)
 	}
+	if bi == nil {
+		return nil, nil
+	}
 	return nativeImageElf{
 		file: bi,
 	}, nil
@@ -213,9 +221,16 @@ func newMachO(filename string, r io.ReaderAt) (nativeImage, error) {
 	// First attempt to read an ELF file.
 	bi, err := macho.NewFile(r)
 
-	// The reader does not refer to an MachO file.
 	if err != nil {
-		return fileError(filename, err)
+		var fmtErr *macho.FormatError
+		if errors.As(err, &fmtErr) {
+			// this is not a MachO file
+			log.WithFields("filename", filename, "error", err).Trace("not a MachO binary")
+			return nil, nil
+		}
+	}
+	if bi == nil {
+		return nil, nil
 	}
 	return nativeImageMachO{
 		file: bi,
@@ -224,13 +239,19 @@ func newMachO(filename string, r io.ReaderAt) (nativeImage, error) {
 
 // newPE reads a Native Image from a Portable Executable file.
 func newPE(filename string, r io.ReaderAt) (nativeImage, error) {
-	// First attempt to read an ELF file.
+	// First attempt to read an PE file.
 	bi, err := pe.NewFile(r)
 
-	// The reader does not refer to an MachO file.
+	// The reader does not refer to a PE file.
 	if err != nil {
-		return fileError(filename, err)
+		// note: there isn't a good way to distinguish between a format error and other kinds of errors
+		log.WithFields("filename", filename, "error", err).Trace("not a PE binary")
+		return nil, nil
 	}
+	if bi == nil {
+		return nil, nil
+	}
+
 	var exportSymbolsDataDirectory pe.DataDirectory
 	switch h := bi.OptionalHeader.(type) {
 	case *pe.OptionalHeader32:
@@ -282,10 +303,6 @@ func (ni nativeImageElf) fetchPkgs() (pkgs []pkg.Package, retErr error) {
 	}()
 
 	bi := ni.file
-	if bi == nil {
-		log.Debugf("native-image cataloger: file is nil")
-		return nil, nil
-	}
 	var sbom elf.Symbol
 	var sbomLength elf.Symbol
 	var svmVersion elf.Symbol
@@ -340,10 +357,6 @@ func (ni nativeImageMachO) fetchPkgs() (pkgs []pkg.Package, retErr error) {
 	var svmVersion macho.Symbol
 
 	bi := ni.file
-	if bi == nil {
-		log.Debugf("native-image cataloger: file is nil")
-		return nil, nil
-	}
 	if bi.Symtab == nil {
 		return nil, errors.New(nativeImageMissingSymbolsError)
 	}
@@ -367,7 +380,7 @@ func (ni nativeImageMachO) fetchPkgs() (pkgs []pkg.Package, retErr error) {
 	}
 	dataBuf, err := dataSegment.Data()
 	if err != nil {
-		log.Debugf("native-image cataloger: cannot obtain buffer from data segment.")
+		log.Tracef("cannot obtain buffer from data segment")
 		return nil, nil
 	}
 	sbomLocation := sbom.Value - dataSegment.Addr
@@ -382,13 +395,13 @@ func (ni nativeImagePE) fetchExportAttribute(i int) (uint32, error) {
 	n := len(ni.exports)
 	j := int(unsafe.Sizeof(ni.header)) + i*int(unsafe.Sizeof(ni.t.headerAttribute))
 	if j+4 >= n {
-		log.Debugf("native-image cataloger: invalid index to export directory entry attribute: %v.", j)
+		log.Tracef("invalid index to export directory entry attribute: %v", j)
 		return uint32(0), errors.New(nativeImageInvalidIndexError)
 	}
 	p := bytes.NewBuffer(ni.exports[j : j+4])
 	err := binary.Read(p, binary.LittleEndian, &attribute)
 	if err != nil {
-		log.Debugf("native-image cataloger: error fetching export directory entry attribute: %v.", err)
+		log.Tracef("error fetching export directory entry attribute: %v", err)
 		return uint32(0), err
 	}
 	return attribute, nil
@@ -402,13 +415,13 @@ func (ni nativeImagePE) fetchExportFunctionPointer(functionsBase uint32, i uint3
 	sz := uint32(unsafe.Sizeof(ni.t.functionPointer))
 	j := functionsBase + i*sz
 	if j+sz >= n {
-		log.Debugf("native-image cataloger: invalid index to exported function: %v.", j)
+		log.Tracef("invalid index to exported function: %v", j)
 		return uint32(0), errors.New(nativeImageInvalidIndexError)
 	}
 	p := bytes.NewBuffer(ni.exports[j : j+sz])
 	err := binary.Read(p, binary.LittleEndian, &pointer)
 	if err != nil {
-		log.Debugf("native-image cataloger: error fetching exported function: %v.", err)
+		log.Tracef("error fetching exported function: %v", err)
 		return uint32(0), err
 	}
 	return pointer, nil
@@ -452,7 +465,7 @@ func (ni nativeImagePE) fetchSbomSymbols(content *exportContentPE) {
 		k := addressBase + j
 		sz := uint32(unsafe.Sizeof(ni.t.namePointer))
 		if k+sz >= n {
-			log.Debugf("native-image cataloger: invalid index to exported function: %v.", k)
+			log.Tracef("invalid index to exported function: %v", k)
 			// If we are at the end of exports, stop looking
 			return
 		}
@@ -460,12 +473,12 @@ func (ni nativeImagePE) fetchSbomSymbols(content *exportContentPE) {
 		p := bytes.NewBuffer(ni.exports[k : k+sz])
 		err := binary.Read(p, binary.LittleEndian, &symbolAddress)
 		if err != nil {
-			log.Debugf("native-image cataloger: error fetching address of symbol %v.", err)
+			log.Tracef("error fetching address of symbol %v", err)
 			return
 		}
 		symbolBase := symbolAddress - ni.exportSymbols.VirtualAddress
 		if symbolBase >= n {
-			log.Debugf("native-image cataloger: invalid index to exported symbol: %v.", symbolBase)
+			log.Tracef("invalid index to exported symbol: %v", symbolBase)
 			return
 		}
 		switch {
@@ -491,7 +504,7 @@ func (ni nativeImagePE) fetchPkgs() (pkgs []pkg.Package, retErr error) {
 
 	content, err := ni.fetchExportContent()
 	if err != nil {
-		log.Debugf("native-image cataloger: could not fetch the content of the export directory entry: %v.", err)
+		log.Debugf("could not fetch the content of the export directory entry: %v", err)
 		return nil, err
 	}
 	ni.fetchSbomSymbols(content)
@@ -516,7 +529,7 @@ func (ni nativeImagePE) fetchPkgs() (pkgs []pkg.Package, retErr error) {
 	}
 	dataBuf, err := dataSection.Data()
 	if err != nil {
-		log.Debugf("native-image cataloger: cannot obtain buffer from .data section.")
+		log.Tracef("cannot obtain buffer from the java native-image .data section")
 		return nil, nil
 	}
 	sbomLocation := sbomAddress - dataSection.VirtualAddress
@@ -528,27 +541,30 @@ func (ni nativeImagePE) fetchPkgs() (pkgs []pkg.Package, retErr error) {
 // fetchPkgs provides the packages available in a UnionReader.
 func fetchPkgs(reader unionreader.UnionReader, filename string) []pkg.Package {
 	var pkgs []pkg.Package
-	imageformats := []func(string, io.ReaderAt) (nativeImage, error){newElf, newMachO, newPE}
+	imageFormats := []func(string, io.ReaderAt) (nativeImage, error){newElf, newMachO, newPE}
 
 	// NOTE: multiple readers are returned to cover universal binaries, which are files
 	// with more than one binary
 	readers, err := unionreader.GetReaders(reader)
 	if err != nil {
-		log.Debugf("native-image cataloger: failed to open a binary: %v.", err)
+		log.Debugf("failed to open the java native-image binary: %v", err)
 		return nil
 	}
 	for _, r := range readers {
-		for _, makeNativeImage := range imageformats {
+		for _, makeNativeImage := range imageFormats {
 			ni, err := makeNativeImage(filename, r)
 			if err != nil {
 				continue
 			}
-			newpkgs, err := ni.fetchPkgs()
-			if err != nil {
-				log.Debugf("native-image cataloger: error extracting SBOM from %s: %v.", filename, err)
+			if ni == nil {
 				continue
 			}
-			pkgs = append(pkgs, newpkgs...)
+			newPkgs, err := ni.fetchPkgs()
+			if err != nil {
+				log.Tracef("unable to extract SBOM from possible java native-image %s: %v", filename, err)
+				continue
+			}
+			pkgs = append(pkgs, newPkgs...)
 		}
 	}
 	return pkgs
@@ -565,16 +581,16 @@ func (c *NativeImageCataloger) Catalog(resolver source.FileResolver) ([]pkg.Pack
 	for _, location := range fileMatches {
 		readerCloser, err := resolver.FileContentsByLocation(location)
 		if err != nil {
-			log.Debugf("native-image cataloger: error opening file: %v.", err)
+			log.Debugf("error opening file: %v", err)
 			continue
 		}
-		log.Tracef("native-image cataloger: found an executable file %v.", location)
+
 		reader, err := unionreader.GetUnionReader(readerCloser)
 		if err != nil {
 			return nil, nil, err
 		}
-		newpkgs := fetchPkgs(reader, location.RealPath)
-		pkgs = append(pkgs, newpkgs...)
+		newPkgs := fetchPkgs(reader, location.RealPath)
+		pkgs = append(pkgs, newPkgs...)
 		internal.CloseAndLogError(readerCloser, location.RealPath)
 	}
 

syft/pkg/cataloger/javascript/package.go

@@ -78,8 +78,8 @@ func newPackageLockV1Package(resolver source.FileResolver, location source.Locat
 func newPackageLockV2Package(resolver source.FileResolver, location source.Location, name string, u lockPackage) pkg.Package {
 	var licenses []string
 
-	if u.License != "" {
-		licenses = append(licenses, u.License)
+	if u.License != nil {
+		licenses = u.License
 	}
 
 	return finalizeLockPkg(

syft/pkg/cataloger/javascript/parse_package_lock.go

@@ -7,6 +7,7 @@ import (
 	"io"
 	"strings"
 
+	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/generic"
@@ -24,6 +25,39 @@ type packageLock struct {
 	Packages        map[string]lockPackage
 }
 
+// packageLockLicense
+type packageLockLicense []string
+
+func (licenses *packageLockLicense) UnmarshalJSON(data []byte) (err error) {
+	// The license field could be either a string or an array.
+
+	// 1. An array
+	var arr []string
+	if err := json.Unmarshal(data, &arr); err == nil {
+		*licenses = arr
+		return nil
+	}
+
+	// 2. A string
+	var str string
+	if err = json.Unmarshal(data, &str); err == nil {
+		*licenses = make([]string, 1)
+		(*licenses)[0] = str
+		return nil
+	}
+
+	// debug the content we did not expect
+	if len(data) > 0 {
+		log.WithFields("license", string(data)).Debug("Unable to parse the following `license` value in package-lock.json")
+	}
+
+	// 3. Unexpected
+	// In case we are unable to parse the license field,
+	// i.e if we have not covered the full specification,
+	// we do not want to throw an error, instead assign nil.
+	return nil
+}
+
 // lockDependency represents a single package dependency listed in the package.lock json file
 type lockDependency struct {
 	Version   string `json:"version"`
@@ -32,11 +66,11 @@ type lockDependency struct {
 }
 
 type lockPackage struct {
-	Name      string `json:"name"` // only present in the root package entry (named "")
-	Version   string `json:"version"`
-	Resolved  string `json:"resolved"`
-	Integrity string `json:"integrity"`
-	License   string `json:"license"`
+	Name      string             `json:"name"` // only present in the root package entry (named "")
+	Version   string             `json:"version"`
+	Resolved  string             `json:"resolved"`
+	Integrity string             `json:"integrity"`
+	License   packageLockLicense `json:"license"`
 }
 
 // parsePackageLock parses a package-lock.json and returns the discovered JavaScript packages.

syft/pkg/cataloger/javascript/parse_package_lock_test.go

@@ -297,3 +297,44 @@ func TestParsePackageLockAlias(t *testing.T) {
 		pkgtest.TestFileParser(t, packageLock, parsePackageLock, expected, expectedRelationships)
 	}
 }
+
+func TestParsePackageLockLicenseWithArray(t *testing.T) {
+	fixture := "test-fixtures/pkg-lock/array-license-package-lock.json"
+	var expectedRelationships []artifact.Relationship
+	expectedPkgs := []pkg.Package{
+		{
+			Name:         "tmp",
+			Version:      "1.0.0",
+			Licenses:     []string{"ISC"},
+			Language:     pkg.JavaScript,
+			Type:         pkg.NpmPkg,
+			PURL:         "pkg:npm/tmp@1.0.0",
+			MetadataType: "NpmPackageLockJsonMetadata",
+			Metadata:     pkg.NpmPackageLockJSONMetadata{},
+		},
+		{
+			Name:         "pause-stream",
+			Version:      "0.0.11",
+			Licenses:     []string{"MIT", "Apache2"},
+			Language:     pkg.JavaScript,
+			Type:         pkg.NpmPkg,
+			PURL:         "pkg:npm/pause-stream@0.0.11",
+			MetadataType: "NpmPackageLockJsonMetadata",
+			Metadata:     pkg.NpmPackageLockJSONMetadata{},
+		},
+		{
+			Name:         "through",
+			Version:      "2.3.8",
+			Licenses:     []string{"MIT"},
+			Language:     pkg.JavaScript,
+			Type:         pkg.NpmPkg,
+			PURL:         "pkg:npm/through@2.3.8",
+			MetadataType: "NpmPackageLockJsonMetadata",
+			Metadata:     pkg.NpmPackageLockJSONMetadata{},
+		},
+	}
+	for i := range expectedPkgs {
+		expectedPkgs[i].Locations.Add(source.NewLocation(fixture))
+	}
+	pkgtest.TestFileParser(t, fixture, parsePackageLock, expectedPkgs, expectedRelationships)
+}

syft/pkg/cataloger/javascript/test-fixtures/pkg-lock/array-license-package-lock.json

@@ -0,0 +1,41 @@
+{
+    "name": "tmp",
+    "version": "1.0.0",
+    "lockfileVersion": 2,
+    "requires": true,
+    "packages": {
+      "": {
+        "name": "tmp",
+        "version": "1.0.0",
+        "license": "ISC",
+        "dependencies": {
+          "pause-stream": "0.0.11"
+        }
+      },
+      "node_modules/pause-stream": {
+        "version": "0.0.11",
+        "license": [
+            "MIT",
+            "Apache2"
+        ],
+        "dependencies": {
+          "through": "~2.3"
+        }
+      },
+      "node_modules/through": {
+        "version": "2.3.8",
+        "license": "MIT"
+      }
+    },
+    "dependencies": {
+      "pause-stream": {
+        "version": "0.0.11",
+        "requires": {
+          "through": "~2.3"
+        }
+      },
+      "through": {
+        "version": "2.3.8"
+      }
+    }
+  }

syft/source/directory_resolver.go

@@ -338,7 +338,7 @@ func (r directoryResolver) FilesByPath(userPaths ...string) ([]Location, error)
 		// we should be resolving symlinks and preserving this information as a VirtualPath to the real file
 		evaluatedPath, err := filepath.EvalSymlinks(userStrPath)
 		if err != nil {
-			log.Debugf("directory resolver unable to evaluate symlink for path=%q : %+v", userPath, err)
+			log.Tracef("unable to evaluate symlink for path=%q : %+v", userPath, err)
 			continue
 		}
 

test/cli/spdx_tooling_validation_test.go

@@ -36,6 +36,8 @@ func TestSpdxValidationTooling(t *testing.T) {
 				fixturesPath := filepath.Join(cwd, "test-fixtures", "image-java-spdx-tools")
 				buildCmd := exec.Command("make", "build")
 				buildCmd.Dir = fixturesPath
+				buildCmd.Stdout = os.Stdout
+				buildCmd.Stderr = os.Stderr
 				err = buildCmd.Run()
 				require.NoError(t, err)
 			},

test/cli/test-fixtures/image-java-spdx-tools/Dockerfile

@@ -1,4 +1,4 @@
-FROM cgr.dev/chainguard/jdk
+FROM openjdk:11
 
 RUN wget https://github.com/spdx/tools-java/releases/download/v1.1.3/tools-java-1.1.3.zip && \
 	unzip tools-java-1.1.3.zip && \