syft/internal/formats/github/encoder_test.go

package github

import (
	"encoding/json"
	"testing"

	"github.com/stretchr/testify/assert"

	"github.com/anchore/packageurl-go"
	"github.com/anchore/syft/syft/linux"
	"github.com/anchore/syft/syft/pkg"
	"github.com/anchore/syft/syft/sbom"
	"github.com/anchore/syft/syft/source"
)

func Test_toGithubModel(t *testing.T) {
	s := sbom.SBOM{
		Source: source.Metadata{
			Scheme: source.ImageScheme,
			ImageMetadata: source.ImageMetadata{
				UserInput:    "ubuntu:18.04",
				Architecture: "amd64",
			},
		},
		Artifacts: sbom.Artifacts{
			LinuxDistribution: &linux.Release{
				ID:        "ubuntu",
				VersionID: "18.04",
				IDLike:    []string{"debian"},
			},
			PackageCatalog: pkg.NewCatalog(),
		},
	}
	for _, p := range []pkg.Package{
		{
			Name:    "pkg-1",
			Version: "1.0.1",
			Locations: []source.Location{{
				Coordinates: source.Coordinates{
					RealPath:     "/usr/lib",
					FileSystemID: "fsid-1",
				},
			}},
		},
		{
			Name:    "pkg-2",
			Version: "2.0.2",
			Locations: []source.Location{{
				Coordinates: source.Coordinates{
					RealPath:     "/usr/lib",
					FileSystemID: "fsid-1",
				},
			}},
		},
		{
			Name:    "pkg-3",
			Version: "3.0.3",
			Locations: []source.Location{{
				Coordinates: source.Coordinates{
					RealPath:     "/etc",
					FileSystemID: "fsid-1",
				},
			}},
		},
	} {
		p.PURL = packageurl.NewPackageURL(
			"generic",
			"",
			p.Name,
			p.Version,
			nil,
			"",
		).ToString()
		s.Artifacts.PackageCatalog.Add(p)
	}

	actual := toGithubModel(&s)

	expected := DependencySnapshot{
		Version: 0,
		Detector: DetectorMetadata{
			Name:    "syft",
			Version: "0.0.0-dev",
			URL:     "https://github.com/anchore/syft",
		},
		Metadata: Metadata{
			"syft:distro": "pkg:generic/ubuntu@18.04?like=debian",
		},
		Scanned: actual.Scanned,
		Manifests: Manifests{
			"ubuntu:18.04:/usr/lib": Manifest{
				Name: "ubuntu:18.04:/usr/lib",
				File: FileInfo{
					SourceLocation: "ubuntu:18.04:/usr/lib",
				},
				Metadata: Metadata{
					"syft:filesystem": "fsid-1",
				},
				Resolved: DependencyGraph{
					"pkg:generic/pkg-1@1.0.1": DependencyNode{
						Purl:         "pkg:generic/pkg-1@1.0.1",
						Scope:        DependencyScopeRuntime,
						Relationship: DependencyRelationshipDirect,
					},
					"pkg:generic/pkg-2@2.0.2": DependencyNode{
						Purl:         "pkg:generic/pkg-2@2.0.2",
						Scope:        DependencyScopeRuntime,
						Relationship: DependencyRelationshipDirect,
					},
				},
			},
			"ubuntu:18.04:/etc": Manifest{
				Name: "ubuntu:18.04:/etc",
				File: FileInfo{
					SourceLocation: "ubuntu:18.04:/etc",
				},
				Metadata: Metadata{
					"syft:filesystem": "fsid-1",
				},
				Resolved: DependencyGraph{
					"pkg:generic/pkg-3@3.0.3": DependencyNode{
						Purl:         "pkg:generic/pkg-3@3.0.3",
						Scope:        DependencyScopeRuntime,
						Relationship: DependencyRelationshipDirect,
					},
				},
			},
		},
	}

	// just using JSONEq because it gives a comprehensible diff
	s1, _ := json.Marshal(expected)
	s2, _ := json.Marshal(actual)
	assert.JSONEq(t, string(s1), string(s2))

	// Just test the other schemes:
	s.Source.Path = "."
	s.Source.Scheme = source.DirectoryScheme
	actual = toGithubModel(&s)
	assert.Equal(t, "etc", actual.Manifests["etc"].Name)

	s.Source.Path = "./artifacts"
	s.Source.Scheme = source.DirectoryScheme
	actual = toGithubModel(&s)
	assert.Equal(t, "artifacts/etc", actual.Manifests["artifacts/etc"].Name)

	s.Source.Path = "/artifacts"
	s.Source.Scheme = source.DirectoryScheme
	actual = toGithubModel(&s)
	assert.Equal(t, "/artifacts/etc", actual.Manifests["/artifacts/etc"].Name)

	s.Source.Path = "./executable"
	s.Source.Scheme = source.FileScheme
	actual = toGithubModel(&s)
	assert.Equal(t, "executable", actual.Manifests["executable"].Name)

	s.Source.Path = "./archive.tar.gz"
	s.Source.Scheme = source.FileScheme
	actual = toGithubModel(&s)
	assert.Equal(t, "archive.tar.gz:/etc", actual.Manifests["archive.tar.gz:/etc"].Name)
}