Add crates.io enichment option for rust audit binary, json schema and spdx license updates.

cmd/syft/internal/options/catalog.go

@@ -24,6 +24,7 @@ import (
 	"github.com/anchore/syft/syft/pkg/cataloger/javascript"
 	"github.com/anchore/syft/syft/pkg/cataloger/kernel"
 	"github.com/anchore/syft/syft/pkg/cataloger/python"
+	"github.com/anchore/syft/syft/pkg/cataloger/rust"
 	"github.com/anchore/syft/syft/source"
 )
 
@@ -46,6 +47,7 @@ type Catalog struct {
 	JavaScript  javaScriptConfig  `yaml:"javascript" json:"javascript" mapstructure:"javascript"`
 	LinuxKernel linuxKernelConfig `yaml:"linux-kernel" json:"linux-kernel" mapstructure:"linux-kernel"`
 	Python      pythonConfig      `yaml:"python" json:"python" mapstructure:"python"`
+	Rust        rustConfig        `yaml:"rust" json:"rust" mapstructure:"rust"`
 
 	// configuration for the source (the subject being analyzed)
 	Registry   registryConfig `yaml:"registry" json:"registry" mapstructure:"registry"`
@@ -74,6 +76,7 @@ func DefaultCatalog() Catalog {
 		Java:          defaultJavaConfig(),
 		File:          defaultFileConfig(),
 		Relationships: defaultRelationshipsConfig(),
+		Rust:          defaultRustConfig(),
 		Unknowns:      defaultUnknowns(),
 		Source:        defaultSourceConfig(),
 		Parallelism:   1,
@@ -182,6 +185,12 @@ func (cfg Catalog) ToPackagesConfig() pkgcataloging.Config {
 			WithMavenBaseURL(cfg.Java.MavenURL).
 			WithArchiveTraversal(archiveSearch, cfg.Java.MaxParentRecursiveDepth).
 			WithResolveTransitiveDependencies(cfg.Java.ResolveTransitiveDependencies),
+		Rust: rust.DefaultCatalogerConfig().
+			WithProxy(cfg.Rust.Proxy).
+			WithCratesBaseURL(cfg.Rust.CratesBaseURL).
+			WithCratesTimeout(cfg.Rust.CratesTimeout).
+			WithUseCratesEnrichment(*cfg.Rust.UseCratesEnrichment).
+			WithInsecureSkipTLSVerify(*cfg.Rust.InsecureSkipTLSVerify),
 	}
 }
 

cmd/syft/internal/options/rust.go

@@ -0,0 +1,39 @@
+package options
+
+import (
+	"time"
+
+	"github.com/anchore/clio"
+	"github.com/anchore/syft/syft/pkg/cataloger/rust"
+)
+
+type rustConfig struct {
+	InsecureSkipTLSVerify *bool         `yaml:"insecure-skip-tls-verify" json:"insecure-skip-tls-verify" mapstructure:"insecure-skip-tls-verify"`
+	UseCratesEnrichment   *bool         `json:"use-crates-enrichment" yaml:"use-crates-enrichment" mapstructure:"use-crates-enrichment"`
+	Proxy                 string        `yaml:"proxy,omitempty" json:"proxy,omitempty" mapstructure:"proxy"`
+	CratesBaseURL         string        `yaml:"crates-base-url" json:"crates-base-url" mapstructure:"crates-base-url"`
+	CratesTimeout         time.Duration `yaml:"crates-timeout" json:"crates-timeout" mapstructure:"crates-timeout"`
+}
+
+var _ interface {
+	clio.FieldDescriber
+} = (*rustConfig)(nil)
+
+func defaultRustConfig() rustConfig {
+	def := rust.DefaultCatalogerConfig()
+	return rustConfig{
+		InsecureSkipTLSVerify: &def.InsecureSkipTLSVerify,
+		UseCratesEnrichment:   &def.UseCratesEnrichment,
+		Proxy:                 def.Proxy,
+		CratesBaseURL:         def.CratesBaseURL,
+		CratesTimeout:         def.CratesTimeout,
+	}
+}
+
+func (o *rustConfig) DescribeFields(descriptions clio.FieldDescriptionSet) {
+	descriptions.Add(&o.UseCratesEnrichment, `enables Syft to use the network to fill in more detailed package information using crates.io`)
+	descriptions.Add(&o.InsecureSkipTLSVerify, `skip TLS certificate verification`)
+	descriptions.Add(&o.CratesBaseURL, `base URL to use if not using crates.io`)
+	descriptions.Add(&o.CratesTimeout, `timeout for requests to crates.io`)
+	descriptions.Add(&o.Proxy, `proxy to use when connecting to remote services`)
+}

internal/constants.go

@@ -3,5 +3,5 @@ package internal
 const (
 	// JSONSchemaVersion is the current schema version output by the JSON encoder
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "16.0.18"
+	JSONSchemaVersion = "16.0.19"
 )

internal/task/package_tasks.go

@@ -68,7 +68,6 @@ func DefaultPackageTaskFactories() PackageTaskFactories {
 		newSimplePackageTaskFactory(php.NewComposerInstalledCataloger, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, pkgcataloging.LanguageTag, "php", "composer"),
 		newSimplePackageTaskFactory(r.NewPackageCataloger, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, pkgcataloging.LanguageTag, "r"),
 		newSimplePackageTaskFactory(ruby.NewInstalledGemSpecCataloger, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, pkgcataloging.LanguageTag, "ruby", "gem", "gemspec"),
-		newSimplePackageTaskFactory(rust.NewAuditBinaryCataloger, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, pkgcataloging.LanguageTag, "rust", "binary"),
 
 		// language-specific package declared catalogers ///////////////////////////////////////////////////////////////////////////
 		newSimplePackageTaskFactory(cpp.NewConanCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "cpp", "conan"),
@@ -107,7 +106,18 @@ func DefaultPackageTaskFactories() PackageTaskFactories {
 		),
 		newSimplePackageTaskFactory(ruby.NewGemFileLockCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "ruby", "gem"),
 		newSimplePackageTaskFactory(ruby.NewGemSpecCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "ruby", "gem", "gemspec"),
-		newSimplePackageTaskFactory(rust.NewCargoLockCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "rust", "cargo"),
+		newPackageTaskFactory(
+			func(cfg CatalogingFactoryConfig) pkg.Cataloger {
+				return rust.NewCargoLockCataloger(cfg.PackagesConfig.Rust)
+			},
+			pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "rust", "cargo",
+		),
+		newPackageTaskFactory(
+			func(cfg CatalogingFactoryConfig) pkg.Cataloger {
+				return rust.NewAuditBinaryCataloger(cfg.PackagesConfig.Rust)
+			},
+			pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, pkgcataloging.LanguageTag, "rust", "binary",
+		),
 		newSimplePackageTaskFactory(swift.NewCocoapodsCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "swift", "cocoapods"),
 		newSimplePackageTaskFactory(swift.NewSwiftPackageManagerCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "swift", "spm"),
 		newSimplePackageTaskFactory(swipl.NewSwiplPackCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "swipl", "pack"),