feat(sbom): resolve conversations

Signed-off-by: Radmir Khurum <radmir.khurum@flant.com>

Author: reyreavman

docs/_data/werf_yaml.yml

@@ -593,13 +593,13 @@ sections:
           - name: workdir
             value: "string"
             description:
-              en: "Directory inside the image that contains the manifest files (required for go-mod and python-*)"
-              ru: "Директория внутри образа, содержащая файлы манифеста (обязательно для go-mod и python-*)"
+              en: "Directory inside the image that contains the spec files (required for go-mod and python-*)"
+              ru: "Директория внутри образа, содержащая файлы спецификации (обязательно для go-mod и python-*)"
           - name: spec
             value: "string"
             description:
-              en: "Manifest file name (defaults: go.mod for go-mod, pyproject.toml for python-uv/python-poetry, requirements.txt for python-pip)"
-              ru: "Имя файла манифеста (по умолчанию: go.mod для go-mod, pyproject.toml для python-uv/python-poetry, requirements.txt для python-pip)"
+              en: "Spec file name (defaults: go.mod for go-mod, pyproject.toml for python-uv/python-poetry, requirements.txt for python-pip)"
+              ru: "Имя файла спецификации (по умолчанию: go.mod для go-mod, pyproject.toml для python-uv/python-poetry, requirements.txt для python-pip)"
           - name: lock
             value: "string"
             description:

pkg/config/packages_directive.go

@@ -27,29 +27,32 @@ type FileBasedSpec struct {
 }
 
 type PackageEcosystem struct {
-	Type          PackagesDirectiveType
-	Aliases       []string
-	DefaultSpec   string
-	DefaultLock   string
-	InstallCmd    func(workdir, spec string) string
-	CatalogerName string
+	Type             PackagesDirectiveType
+	Aliases          []string
+	DefaultSpec      string
+	DefaultLock      string
+	InstallCmd       func(workdir, spec string) string
+	CatalogerName    string
+	UseWorkdirFilter bool
 }
 
 var ecosystems = map[PackagesDirectiveType]PackageEcosystem{
 	PackagesDirectiveTypeGoMod: {
-		Type:          PackagesDirectiveTypeGoMod,
-		DefaultSpec:   "go.mod",
-		DefaultLock:   "go.sum",
-		InstallCmd:    func(workdir, _ string) string { return fmt.Sprintf("cd %q && go mod download", workdir) },
-		CatalogerName: "go-module-file-cataloger",
+		Type:             PackagesDirectiveTypeGoMod,
+		DefaultSpec:      "go.mod",
+		DefaultLock:      "go.sum",
+		InstallCmd:       func(workdir, _ string) string { return fmt.Sprintf("cd %q && go mod download", workdir) },
+		CatalogerName:    "go-module-file-cataloger",
+		UseWorkdirFilter: false,
 	},
 	PackagesDirectiveTypePythonUV: {
-		Type:          PackagesDirectiveTypePythonUV,
-		Aliases:       []string{"uv"},
-		DefaultSpec:   "pyproject.toml",
-		DefaultLock:   "uv.lock",
-		InstallCmd:    func(workdir, _ string) string { return fmt.Sprintf("cd %q && uv sync --frozen", workdir) },
-		CatalogerName: "python-package-cataloger",
+		Type:             PackagesDirectiveTypePythonUV,
+		Aliases:          []string{"uv"},
+		DefaultSpec:      "pyproject.toml",
+		DefaultLock:      "uv.lock",
+		InstallCmd:       func(workdir, _ string) string { return fmt.Sprintf("cd %q && uv sync --frozen", workdir) },
+		CatalogerName:    "python-package-cataloger",
+		UseWorkdirFilter: true,
 	},
 	PackagesDirectiveTypePythonPip: {
 		Type:        PackagesDirectiveTypePythonPip,
@@ -59,15 +62,17 @@ var ecosystems = map[PackagesDirectiveType]PackageEcosystem{
 		InstallCmd: func(workdir, spec string) string {
 			return fmt.Sprintf("cd %q && pip install --no-cache-dir -r %q", workdir, spec)
 		},
-		CatalogerName: "python-package-cataloger",
+		CatalogerName:    "python-package-cataloger",
+		UseWorkdirFilter: true,
 	},
 	PackagesDirectiveTypePythonPoetry: {
-		Type:          PackagesDirectiveTypePythonPoetry,
-		Aliases:       []string{"poetry"},
-		DefaultSpec:   "pyproject.toml",
-		DefaultLock:   "poetry.lock",
-		InstallCmd:    func(workdir, _ string) string { return fmt.Sprintf("cd %q && poetry install --no-root", workdir) },
-		CatalogerName: "python-package-cataloger",
+		Type:             PackagesDirectiveTypePythonPoetry,
+		Aliases:          []string{"poetry"},
+		DefaultSpec:      "pyproject.toml",
+		DefaultLock:      "poetry.lock",
+		InstallCmd:       func(workdir, _ string) string { return fmt.Sprintf("cd %q && poetry install --no-root", workdir) },
+		CatalogerName:    "python-package-cataloger",
+		UseWorkdirFilter: true,
 	},
 }
 

pkg/sbom/managedinput/managedinput.go

@@ -15,7 +15,9 @@ import (
 type inputResolver struct {
 	inputType     config.PackagesDirectiveType
 	catalogerName string
+	filterMode    scanner.CatalogerFilterMode
 	sourcePaths   func(directive *config.PackagesDirective) []string
+	workdir       func(directive *config.PackagesDirective) string
 }
 
 var resolvers = buildResolvers()
@@ -31,16 +33,24 @@ func buildResolvers() []inputResolver {
 	built := make([]inputResolver, 0, len(types))
 	for _, t := range types {
 		eco := ecosystems[t]
+		filterMode := scanner.CatalogerFilterExactPath
+		if eco.UseWorkdirFilter {
+			filterMode = scanner.CatalogerFilterWorkdirPrefix
+		}
 		built = append(built, inputResolver{
 			inputType:     eco.Type,
 			catalogerName: eco.CatalogerName,
+			filterMode:    filterMode,
 			sourcePaths: func(d *config.PackagesDirective) []string {
 				paths := []string{path.Join(d.FileBased.Workdir, d.FileBased.Spec)}
 				if d.FileBased.Lock != "" {
 					paths = append(paths, path.Join(d.FileBased.Workdir, d.FileBased.Lock))
 				}
 				return paths
 			},
+			workdir: func(d *config.PackagesDirective) string {
+				return d.FileBased.Workdir
+			},
 		})
 	}
 	return built
@@ -59,7 +69,9 @@ func ToCatalogers(packages []*config.PackagesDirective) []scanner.Cataloger {
 
 		catalogers = append(catalogers, scanner.Cataloger{
 			Name:        res.catalogerName,
+			FilterMode:  res.filterMode,
 			SourcePaths: res.sourcePaths(directive),
+			Workdir:     res.workdir(directive),
 		})
 	}
 
@@ -71,33 +83,55 @@ func FilterBOMBySourcePaths(bom *cdx.BOM, catalogers []scanner.Cataloger) {
 		return
 	}
 
-	catalogerNames := make(map[string]struct{})
-	allowedPaths := make(map[string]struct{})
+	type catalogerFilter struct {
+		name       string
+		filterMode scanner.CatalogerFilterMode
+		paths      map[string]struct{}
+		workdir    string
+	}
+
+	filters := make([]catalogerFilter, 0, len(catalogers))
 	for _, cat := range catalogers {
-		catalogerNames[cat.Name] = struct{}{}
+		paths := make(map[string]struct{}, len(cat.SourcePaths))
 		for _, p := range cat.SourcePaths {
-			allowedPaths[p] = struct{}{}
+			paths[p] = struct{}{}
 		}
+		filters = append(filters, catalogerFilter{
+			name:       cat.Name,
+			filterMode: cat.FilterMode,
+			paths:      paths,
+			workdir:    cat.Workdir,
+		})
 	}
 
 	filtered := lo.Filter(*bom.Components, func(comp cdx.Component, _ int) bool {
-		if !componentFoundByCatalogers(comp, catalogerNames) {
-			return false
+		for _, f := range filters {
+			if !componentFoundByCataloger(comp, f.name) {
+				continue
+			}
+			if f.filterMode == scanner.CatalogerFilterWorkdirPrefix {
+				if componentMatchesWorkdirPrefix(comp, f.workdir) {
+					return true
+				}
+			} else {
+				if componentMatchesAllowedPaths(comp, f.paths) {
+					return true
+				}
+			}
 		}
-		return componentMatchesAllowedPaths(comp, allowedPaths)
+		return false
 	})
 
 	*bom.Components = filtered
 }
 
-func componentFoundByCatalogers(comp cdx.Component, catalogerNames map[string]struct{}) bool {
+func componentFoundByCataloger(comp cdx.Component, catalogerName string) bool {
 	if comp.Properties == nil {
 		return false
 	}
 	for _, prop := range *comp.Properties {
 		if prop.Name == "syft:package:foundBy" {
-			_, ok := catalogerNames[prop.Value]
-			return ok
+			return prop.Value == catalogerName
 		}
 	}
 	return false
@@ -117,3 +151,19 @@ func componentMatchesAllowedPaths(comp cdx.Component, allowedPaths map[string]st
 	}
 	return false
 }
+
+func componentMatchesWorkdirPrefix(comp cdx.Component, workdir string) bool {
+	if comp.Properties == nil {
+		return false
+	}
+	prefix := workdir + "/"
+	for _, prop := range *comp.Properties {
+		if !strings.HasPrefix(prop.Name, "syft:location:") || !strings.HasSuffix(prop.Name, ":path") {
+			continue
+		}
+		if strings.HasPrefix(prop.Value, prefix) {
+			return true
+		}
+	}
+	return false
+}

pkg/sbom/managedinput/managedinput_test.go

@@ -61,8 +61,8 @@ var _ = Describe("ToCatalogers", func() {
 				},
 			},
 			[]scanner.Cataloger{
-				{Name: "go-module-file-cataloger", SourcePaths: []string{"/app/api/go.mod", "/app/api/go.sum"}},
-				{Name: "go-module-file-cataloger", SourcePaths: []string{"/app/cli/go.mod", "/app/cli/go.sum"}},
+				{Name: "go-module-file-cataloger", FilterMode: scanner.CatalogerFilterExactPath, SourcePaths: []string{"/app/api/go.mod", "/app/api/go.sum"}, Workdir: "/app/api"},
+				{Name: "go-module-file-cataloger", FilterMode: scanner.CatalogerFilterExactPath, SourcePaths: []string{"/app/cli/go.mod", "/app/cli/go.sum"}, Workdir: "/app/cli"},
 			},
 		),
 
@@ -120,7 +120,7 @@ var _ = Describe("FilterBOMBySourcePaths", func() {
 				},
 			},
 			[]scanner.Cataloger{
-				{Name: "go-module-file-cataloger", SourcePaths: []string{"/app/api/go.mod", "/app/api/go.sum"}},
+				{Name: "go-module-file-cataloger", FilterMode: scanner.CatalogerFilterExactPath, SourcePaths: []string{"/app/api/go.mod", "/app/api/go.sum"}, Workdir: "/app/api"},
 			},
 			[]string{"github.com/foo/bar"},
 		),
@@ -137,7 +137,7 @@ var _ = Describe("FilterBOMBySourcePaths", func() {
 
 		Entry("does nothing when BOM is nil",
 			(*cdx.BOM)(nil),
-			[]scanner.Cataloger{{Name: "x", SourcePaths: []string{"/app/go.mod"}}},
+			[]scanner.Cataloger{{Name: "x", FilterMode: scanner.CatalogerFilterExactPath, SourcePaths: []string{"/app/go.mod"}, Workdir: "/app"}},
 			[]string(nil),
 		),
 	)
@@ -157,7 +157,7 @@ var _ = Describe("ToCatalogers python", func() {
 				},
 			},
 			[]scanner.Cataloger{
-				{Name: "python-package-cataloger", SourcePaths: []string{"/app/requirements.txt"}},
+				{Name: "python-package-cataloger", FilterMode: scanner.CatalogerFilterWorkdirPrefix, SourcePaths: []string{"/app/requirements.txt"}, Workdir: "/app"},
 			},
 		),
 
@@ -169,7 +169,7 @@ var _ = Describe("ToCatalogers python", func() {
 				},
 			},
 			[]scanner.Cataloger{
-				{Name: "python-package-cataloger", SourcePaths: []string{"/app/pyproject.toml", "/app/uv.lock"}},
+				{Name: "python-package-cataloger", FilterMode: scanner.CatalogerFilterWorkdirPrefix, SourcePaths: []string{"/app/pyproject.toml", "/app/uv.lock"}, Workdir: "/app"},
 			},
 		),
 
@@ -181,20 +181,21 @@ var _ = Describe("ToCatalogers python", func() {
 				},
 			},
 			[]scanner.Cataloger{
-				{Name: "python-package-cataloger", SourcePaths: []string{"/svc/pyproject.toml", "/svc/poetry.lock"}},
+				{Name: "python-package-cataloger", FilterMode: scanner.CatalogerFilterWorkdirPrefix, SourcePaths: []string{"/svc/pyproject.toml", "/svc/poetry.lock"}, Workdir: "/svc"},
 			},
 		),
 	)
 })
 
 var _ = Describe("FilterBOMBySourcePaths python declared", func() {
-	pythonProps := func(paths ...string) *[]cdx.Property {
+	distInfoProps := func(workdir, pkgName string, extraPaths ...string) *[]cdx.Property {
 		props := []cdx.Property{
 			{Name: "syft:package:foundBy", Value: "python-package-cataloger"},
+			{Name: "syft:location:0:path", Value: workdir + "/.venv/lib/python3.12/site-packages/" + pkgName + ".dist-info/METADATA"},
 		}
-		for i, p := range paths {
+		for i, p := range extraPaths {
 			props = append(props, cdx.Property{
-				Name:  fmt.Sprintf("syft:location:%d:path", i),
+				Name:  fmt.Sprintf("syft:location:%d:path", i+1),
 				Value: p,
 			})
 		}
@@ -208,7 +209,7 @@ var _ = Describe("FilterBOMBySourcePaths python declared", func() {
 		}
 	}
 
-	DescribeTable("exact-match path filtering for python and go-mod",
+	DescribeTable("workdir-prefix filtering for python, exact-match for go-mod",
 		func(bom *cdx.BOM, catalogers []scanner.Cataloger, expectedNames []string) {
 			FilterBOMBySourcePaths(bom, catalogers)
 			Expect(*bom.Components).To(HaveLen(len(expectedNames)))
@@ -217,31 +218,56 @@ var _ = Describe("FilterBOMBySourcePaths python declared", func() {
 			}
 		},
 
-		Entry("python pip component with matching requirements.txt path is kept",
+		Entry("python-uv: keeps dist-info components under workdir, drops components from other workdirs",
 			&cdx.BOM{
 				Components: &[]cdx.Component{
-					{Name: "requests", Properties: pythonProps("/app/requirements.txt")},
-					{Name: "flask", Properties: pythonProps("/other/requirements.txt")},
+					{Name: "requests", Properties: distInfoProps("/app", "requests-2.32.3")},
+					{Name: "flask", Properties: distInfoProps("/other", "flask-3.0.0")},
 				},
 			},
 			[]scanner.Cataloger{
-				{Name: "python-package-cataloger", SourcePaths: []string{"/app/requirements.txt"}},
+				{Name: "python-package-cataloger", FilterMode: scanner.CatalogerFilterWorkdirPrefix, SourcePaths: []string{"/app/pyproject.toml", "/app/uv.lock"}, Workdir: "/app"},
 			},
 			[]string{"requests"},
 		),
 
-		Entry("python uv component is kept when both spec and lock paths match",
+		Entry("python-pip: keeps dist-info components under workdir",
 			&cdx.BOM{
 				Components: &[]cdx.Component{
-					{Name: "requests", Properties: pythonProps("/svc/pyproject.toml")},
-					{Name: "requests", Properties: pythonProps("/svc/uv.lock")},
-					{Name: "flask", Properties: pythonProps("/other/pyproject.toml")},
+					{Name: "requests", Properties: distInfoProps("/app", "requests-2.32.3")},
+					{Name: "flask", Properties: distInfoProps("/other", "flask-3.0.0")},
 				},
 			},
 			[]scanner.Cataloger{
-				{Name: "python-package-cataloger", SourcePaths: []string{"/svc/pyproject.toml", "/svc/uv.lock"}},
+				{Name: "python-package-cataloger", FilterMode: scanner.CatalogerFilterWorkdirPrefix, SourcePaths: []string{"/app/requirements.txt"}, Workdir: "/app"},
 			},
-			[]string{"requests", "requests"},
+			[]string{"requests"},
+		),
+
+		Entry("python-poetry: keeps dist-info components under workdir",
+			&cdx.BOM{
+				Components: &[]cdx.Component{
+					{Name: "requests", Properties: distInfoProps("/svc", "requests-2.32.3")},
+					{Name: "flask", Properties: distInfoProps("/app", "flask-3.0.0")},
+				},
+			},
+			[]scanner.Cataloger{
+				{Name: "python-package-cataloger", FilterMode: scanner.CatalogerFilterWorkdirPrefix, SourcePaths: []string{"/svc/pyproject.toml", "/svc/poetry.lock"}, Workdir: "/svc"},
+			},
+			[]string{"requests"},
+		),
+
+		Entry("workdir prefix does not match exact workdir path (no trailing slash confusion)",
+			&cdx.BOM{
+				Components: &[]cdx.Component{
+					{Name: "requests", Properties: distInfoProps("/app", "requests-2.32.3")},
+					{Name: "flask", Properties: distInfoProps("/appother", "flask-3.0.0")},
+				},
+			},
+			[]scanner.Cataloger{
+				{Name: "python-package-cataloger", FilterMode: scanner.CatalogerFilterWorkdirPrefix, SourcePaths: []string{"/app/pyproject.toml"}, Workdir: "/app"},
+			},
+			[]string{"requests"},
 		),
 
 		Entry("regression: go-mod exact-match still works alongside python cataloger",
@@ -252,7 +278,7 @@ var _ = Describe("FilterBOMBySourcePaths python declared", func() {
 				},
 			},
 			[]scanner.Cataloger{
-				{Name: "go-module-file-cataloger", SourcePaths: []string{"/app/go.mod", "/app/go.sum"}},
+				{Name: "go-module-file-cataloger", FilterMode: scanner.CatalogerFilterExactPath, SourcePaths: []string{"/app/go.mod", "/app/go.sum"}, Workdir: "/app"},
 			},
 			[]string{"github.com/foo/bar"},
 		),