mirror of
https://github.com/anchore/syft.git
synced 2025-11-17 08:23:15 +01:00
f9407d0ce4
* Adds java and npm package comparison * Adds probable matching of extra packages syft found and missing packages that syft did not find (but inline did). This way there is a section of output that fuzzy-matches the package names to get a better sense of "real" problems (actual missing packages) vs slightly mismatched metadata during troubleshooting. * Adds a set or probable missing packages to the report based on the probable matches (again, to aid in troubleshooting) * Fixes image reference clean function to support references with registries * Only shows metadata differences when the package was found by both inline and syft * Splits the inline-compare code into more manageable pieces Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
55 lines
1.6 KiB
Python
55 lines
1.6 KiB
Python
import os
|
|
import json
|
|
import collections
|
|
|
|
import utils.package
|
|
import utils.image
|
|
|
|
|
|
class Syft:
|
|
"""
|
|
Class for parsing syft output into a set of packages and package metadata.
|
|
"""
|
|
report_tmpl = "{image}.json"
|
|
|
|
def __init__(self, image, report_dir):
|
|
self.report_path = os.path.join(
|
|
report_dir, self.report_tmpl.format(image=utils.image.clean(image))
|
|
)
|
|
|
|
def _enumerate_section(self, section):
|
|
with open(self.report_path) as json_file:
|
|
data = json.load(json_file)
|
|
for entry in data[section]:
|
|
yield entry
|
|
|
|
def packages(self):
|
|
packages = set()
|
|
metadata = collections.defaultdict(dict)
|
|
for entry in self._enumerate_section(section="artifacts"):
|
|
|
|
# normalize to inline
|
|
pkg_type = entry["type"].lower()
|
|
if pkg_type in ("wheel", "egg", "python"):
|
|
pkg_type = "python"
|
|
elif pkg_type in ("deb",):
|
|
pkg_type = "dpkg"
|
|
elif pkg_type in ("java-archive",):
|
|
# normalize to pseudo-inline
|
|
pkg_type = "java-?ar"
|
|
elif pkg_type in ("jenkins-plugin",):
|
|
# normalize to pseudo-inline
|
|
pkg_type = "java-?pi"
|
|
elif pkg_type in ("apk",):
|
|
pkg_type = "apkg"
|
|
|
|
pkg = utils.package.Package(
|
|
name=entry["name"],
|
|
type=pkg_type,
|
|
)
|
|
|
|
packages.add(pkg)
|
|
metadata[pkg.type][pkg] = utils.package.Metadata(version=entry["version"])
|
|
|
|
return utils.package.Info(packages=frozenset(packages), metadata=metadata)
|