fix: update config struct to not decode password/key (#1538)

* fix: update config struct to not decode password/key
* test: update tests to confirm no secrets in output

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

Makefile

@@ -8,11 +8,11 @@ RELEASE_CMD := $(TEMP_DIR)/goreleaser release --rm-dist
 SNAPSHOT_CMD := $(RELEASE_CMD) --skip-publish --skip-sign --snapshot
 
 # Tool versions #################################
-GOLANGCILINT_VERSION := v1.50.1
+GOLANGCILINT_VERSION := v1.51.0
 GOSIMPORTS_VERSION := v0.3.5
 BOUNCER_VERSION := v0.4.0
 CHRONICLE_VERSION := v0.5.1
-GORELEASER_VERSION := v1.15.0
+GORELEASER_VERSION := v1.15.1
 YAJSV_VERSION := v1.4.1
 COSIGN_VERSION := v1.13.1
 QUILL_VERSION := v0.2.0

cmd/syft/cli/attest/attest.go

@@ -131,7 +131,7 @@ func execWorker(app *config.Application, si source.Input, writer sbom.Writer) <-
 				return
 			}
 
-			args := []string{"attest", si.UserInput, "--type", "custom", "--predicate", f.Name()}
+			args := []string{"attest", si.UserInput, "--predicate", f.Name()}
 			if app.Attest.Key != "" {
 				args = append(args, "--key", app.Attest.Key)
 			}

go.mod

@@ -53,7 +53,7 @@ require (
 	github.com/Masterminds/sprig/v3 v3.2.3
 	github.com/anchore/go-logger v0.0.0-20220728155337-03b66a5207d8
 	github.com/anchore/stereoscope v0.0.0-20221208011002-c5ff155d72f1
-	github.com/docker/docker v20.10.23+incompatible
+	github.com/docker/docker v23.0.0+incompatible
 	github.com/google/go-containerregistry v0.13.0
 	github.com/invopop/jsonschema v0.7.0
 	github.com/knqyf263/go-rpmdb v0.0.0-20221030135625-4082a22221ce

go.sum

@@ -397,8 +397,8 @@ github.com/docker/distribution v2.8.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4Kfc
 github.com/docker/docker v1.4.2-0.20190924003213-a8608b5b67c7/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker v20.10.10+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker v20.10.12+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v20.10.23+incompatible h1:1ZQUUYAdh+oylOT85aA2ZcfRp22jmLhoaEcVEfK8dyA=
-github.com/docker/docker v20.10.23+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v23.0.0+incompatible h1:L6c28tNyqZ4/ub9AZC9d5QUuunoHHfEH4/Ue+h/E5nE=
+github.com/docker/docker v23.0.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.6.3/go.mod h1:WRaJzqw3CTB9bk10avuGsjVBZsD05qeibJ1/TYlvc0Y=
 github.com/docker/docker-credential-helpers v0.6.4/go.mod h1:ofX3UI0Gz1TteYBjtgs07O36Pyasyp66D2uKT7H8W1c=
 github.com/docker/docker-credential-helpers v0.7.0 h1:xtCHsjxogADNZcdv1pKUHXryefjlVRqWqIhk/uXJp0A=

internal/config/attest.go

@@ -3,8 +3,9 @@ package config
 import "github.com/spf13/viper"
 
 type attest struct {
-	Key      string `yaml:"key" json:"key" mapstructure:"key"`
-	Password string `yaml:"password" json:"password" mapstructure:"password"`
+	// IMPORTANT: do not show the attestation key/password in any YAML/JSON output (sensitive information)
+	Key      string `yaml:"-" json:"-" mapstructure:"key"`
+	Password string `yaml:"-" json:"-" mapstructure:"password"`
 }
 
 func (cfg attest) loadDefaultValues(v *viper.Viper) {

syft/pkg/cataloger/binary/cataloger_test.go

@@ -19,6 +19,34 @@ func TestClassifierCataloger_DefaultClassifiers_PositiveCases(t *testing.T) {
 		fixtureDir string
 		expected   pkg.Package
 	}{
+		{
+			name:       "positive-traefik-2.9.6",
+			fixtureDir: "test-fixtures/classifiers/positive/traefik-2.9.6",
+			expected: pkg.Package{
+				Name:      "traefik",
+				Version:   "2.9.6",
+				Type:      "binary",
+				PURL:      "pkg:generic/traefik@2.9.6",
+				Locations: singleLocation("traefik"),
+				Metadata: pkg.BinaryMetadata{
+					Classifier: "traefik-binary",
+				},
+			},
+		},
+		{
+			name:       "positive-traefik-1.7.34",
+			fixtureDir: "test-fixtures/classifiers/positive/traefik-1.7.34",
+			expected: pkg.Package{
+				Name:      "traefik",
+				Version:   "1.7.34",
+				Type:      "binary",
+				PURL:      "pkg:generic/traefik@1.7.34",
+				Locations: singleLocation("traefik"),
+				Metadata: pkg.BinaryMetadata{
+					Classifier: "traefik-binary",
+				},
+			},
+		},
 		{
 			name:       "positive-memcached-1.6.18",
 			fixtureDir: "test-fixtures/classifiers/positive/memcached-1.6.18",

syft/pkg/cataloger/binary/default_classifiers.go

@@ -165,4 +165,14 @@ var defaultClassifiers = []classifier{
 		Package: "memcached",
 		PURL:    mustPURL("pkg:generic/memcached@version"),
 	},
+	{
+		Class:    "traefik-binary",
+		FileGlob: "**/traefik",
+		EvidenceMatcher: fileContentsVersionMatcher(
+			// [NUL]v1.7.34[NUL]
+			// [NUL]2.9.6[NUL]
+			`(?m)\x00v?(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha[0-9]|-beta[0-9]|-rc[0-9])?)\x00`),
+		Package: "traefik",
+		PURL:    mustPURL("pkg:generic/traefik@version"),
+	},
 }

test/cli/packages_cmd_test.go

@@ -229,6 +229,20 @@ func TestPackagesCmdFlags(t *testing.T) {
 				assertSuccessfulReturnCode,
 			},
 		},
+		{
+			name: "password and key not in config output",
+			args: []string{"packages", "-vvv", "-o", "json", coverageImage},
+			env: map[string]string{
+				"SYFT_ATTEST_PASSWORD": "secret_password",
+				"SYFT_ATTEST_KEY":      "secret_key_path",
+			},
+			assertions: []traitAssertion{
+				assertNotInOutput("secret_password"),
+				assertNotInOutput("secret_key_path"),
+				assertPackageCount(34),
+				assertSuccessfulReturnCode,
+			},
+		},
 	}
 
 	for _, test := range tests {