Signed-off-by: Christian Dupuis <cd@atomist.com>
This commit is contained in:
Christian Dupuis 2022-10-29 11:22:04 +02:00
Родитель 1304a6694c
Коммит 942f25eb6d
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: E32B019A8B65E57A
7 изменённых файлов: 65 добавлений и 37 удалений

Просмотреть файл

@ -4,6 +4,10 @@ vars:
IMAGE_NAME: docker/index-cli-plugin:local
tasks:
go:test:
cmds:
- go test ./...
go:build:
cmds:
- go build -o docker-index -ldflags="-w -s -X 'github.com/docker/index-cli-plugin/internal.version={{.GIT_COMMIT}}'"

38
sbom/detect/detect.go Normal file
Просмотреть файл

@ -0,0 +1,38 @@
/*
* Copyright © 2022 Docker, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package detect
import (
"github.com/anchore/syft/syft/source"
"github.com/docker/index-cli-plugin/types"
)
type PackageDetector = func(packages []types.Package, image source.Source, lm types.LayerMapping) []types.Package
var detectors []PackageDetector
func init() {
detectors = []PackageDetector{nodePackageDetector}
}
func AdditionalPackages(packages []types.Package, image source.Source, lm types.LayerMapping) []types.Package {
additionalPackages := make([]types.Package, 0)
for _, d := range detectors {
additionalPackages = append(additionalPackages, d(packages, image, lm)...)
}
return additionalPackages
}

Просмотреть файл

@ -14,7 +14,7 @@
* limitations under the License.
*/
package sbom
package detect
import (
"testing"
@ -28,8 +28,10 @@ import (
func TestNodeDetector(t *testing.T) {
cmd, _ := command.NewDockerCli()
img, ociPath, _ := registry.SaveImage("node@sha256:2b00d259f3b07d8aa694b298a7dcf4655571aea2ab91375b5adb8e5a905d3ee2", cmd.Client())
lm := createLayerMapping(img)
_, ociPath, _ := registry.SaveImage("node@sha256:2b00d259f3b07d8aa694b298a7dcf4655571aea2ab91375b5adb8e5a905d3ee2", cmd.Client())
lm := types.LayerMapping{
ByDiffId: make(map[string]string),
}
i := source.Input{
Scheme: source.ImageScheme,
ImageSource: stereoscopeimage.OciDirectorySource,

Просмотреть файл

@ -14,7 +14,7 @@
* limitations under the License.
*/
package sbom
package detect
import (
"fmt"
@ -24,22 +24,6 @@ import (
"github.com/docker/index-cli-plugin/types"
)
type PackageDetector = func(packages []types.Package, image source.Source, lm types.LayerMapping) []types.Package
var detectors []PackageDetector
func init() {
detectors = []PackageDetector{nodePackageDetector}
}
func detectAdditionalPackages(packages []types.Package, image source.Source, lm types.LayerMapping) []types.Package {
additionalPackages := make([]types.Package, 0)
for _, d := range detectors {
additionalPackages = append(additionalPackages, d(packages, image, lm)...)
}
return additionalPackages
}
func nodePackageDetector(_ []types.Package, image source.Source, lm types.LayerMapping) []types.Package {
var path []string
var nodeVersion string

Просмотреть файл

@ -30,6 +30,8 @@ import (
"github.com/anchore/syft/syft/pkg/cataloger/deb"
"github.com/anchore/syft/syft/pkg/cataloger/rpm"
"github.com/anchore/syft/syft/source"
"github.com/docker/index-cli-plugin/sbom/detect"
"github.com/docker/index-cli-plugin/sbom/util"
"github.com/docker/index-cli-plugin/types"
"github.com/pkg/errors"
)
@ -69,7 +71,7 @@ func syftSbom(ociPath string, lm types.LayerMapping, resultChan chan<- types.Ind
pm := make(packageMapping, 0)
for _, layer := range src.Image.Layers {
layerPkgs := make([]pkg2.Package, 0)
res := newSingleLayerResolver(layer)
res := util.NewSingleLayerResolver(layer)
apkPkgs, _, err := apkdb.NewApkdbCataloger().Catalog(res)
if err != nil {
if err != nil {
@ -108,7 +110,7 @@ func syftSbom(ociPath string, lm types.LayerMapping, resultChan chan<- types.Ind
result.Packages = append(result.Packages, pkg...)
}
result.Packages = append(result.Packages, detectAdditionalPackages(result.Packages, *src, lm)...)
result.Packages = append(result.Packages, detect.AdditionalPackages(result.Packages, *src, lm)...)
resultChan <- result
}

Просмотреть файл

@ -14,7 +14,7 @@
* limitations under the License.
*/
package sbom
package util
import (
"io"
@ -30,7 +30,7 @@ type singleLayerResolver struct {
layer *image.Layer
}
func newSingleLayerResolver(layer *image.Layer) *singleLayerResolver {
func NewSingleLayerResolver(layer *image.Layer) *singleLayerResolver {
return &singleLayerResolver{layer: layer}
}

Просмотреть файл

@ -14,26 +14,24 @@
* limitations under the License.
*/
package sbom
package types
import (
"testing"
"github.com/docker/index-cli-plugin/types"
)
func TestMergePackages(t *testing.T) {
pkga := types.Package{
pkga := Package{
Purl: "pkg:maven/foo@1.0.0",
Files: []types.Location{{
Files: []Location{{
Path: "/bar",
Digest: "sha256:1234",
DiffId: "sha256:1234",
}},
}
pkgb := types.Package{
pkgb := Package{
Purl: "pkg:maven/foo@1.0.0",
Files: []types.Location{{
Files: []Location{{
Path: "/bar",
Digest: "sha256:1234",
DiffId: "sha256:1234",
@ -43,12 +41,12 @@ func TestMergePackages(t *testing.T) {
DiffId: "sha256:5678",
}},
}
packages := types.MergePackages(types.IndexResult{
Status: types.Success,
Packages: []types.Package{pkga},
}, types.IndexResult{
Status: types.Success,
Packages: []types.Package{pkgb},
packages := MergePackages(IndexResult{
Status: Success,
Packages: []Package{pkga},
}, IndexResult{
Status: Success,
Packages: []Package{pkgb},
})
if len(packages) != 1 {
t.Error("expected 1 package")