feat: add initial dotnet-support

[ckotzbauer]

Signed-off-by: Christian Kotzbauer [email protected]

This PR adds initial support for .NET (Core). It focuses on the parsing of the *.deps.json files in the bin/ folders of a compiled project. This does not add support for parsing NuGet-related files which are usually only available at source-level.

I tested the changes against a compiled .NET project and against a ASP.NET Core image with the compiled project inside.

This changes are done alongside the PR adding dart-support. Please let me know, if anything is missing, wrong or should be changed.

Fixes #726
Ref #373

[ckotzbauer]

I will open a PR against the package-url/packageurl-go repo when the namings are approved here.

[luhring]

Thanks so much, @ckotzbauer! This would be excellent to add in!

@wagoodman PTAL this week when you're able. 😃

[wagoodman]

re: packageurl-go updates, we use a fork of package-url/packageurl-go for this reason -- so we can get the changes needed for syft in asap without waiting for upstream. We submit PRs to upstream as well, though the merge time can take a while.

Did you want to also create a PR in our fork of packageurl-go for the TypeDotnet update? (if not we can leave it as is too and get the cataloger in)

[wagoodman]

(not in scope for this PR, just capturing a comment for sometime in the future after this PR is merged)

We could capture *.runtimeconfig.json in the package metadata if it's available (would require significant cataloger changes).

[wagoodman]

I think the linter issues can be fixed with make lint-fix

[ckotzbauer]

I think the linter issues can be fixed with make lint-fix

fixed

Is the CLI-Test failure related to these changes?

Did you want to also create a PR in our fork of packageurl-go for the TypeDotnet update?

Yes, I will do a PR against the fork. anchore/packageurl-go#8

[wagoodman]

@ckotzbauer I merged the pURL PR, so you should be good to go there.

re: CLI tests, the failure seems related to:

    packages_cmd_test.go:236: expected package count of 20, but found 32
...

    packages_cmd_test.go:240: STDERR:
         [0000]  INFO could not identify distro
        [0000]  INFO cataloging image
        
    packages_cmd_test.go:241: COMMAND: /home/runner/work/syft/syft/snapshot/linux-build_linux_amd64/syft packages -o json -s squashed docker-archive:test-fixtures/cache/stereoscope-fixture-image-pkg-coverage-d5baa8a0e48b30716c65fda2fecff73c8a85bdc023917b7ccae9ae0903d6d94c.tar

Since the coverageImage now includes dotnet packages, the total number of packages expected has grown:

• https://github.com/ckotzbauer/syft/blob/feature/dotnet/test/cli/packages_cmd_test.go#L99.

The easiest way to iterate locally on the CLI tests is:

• make clean-snapshot snapshot to create a build
• make cli to run tests against the build

I went ahead an fixed the test in question in 009dd0a, so no action needed 🎉

[wagoodman]

Open question: though I've merged anchore/packageurl-go#8 I'm currently trying to make certain I understand the right usage of package URL for a .NET package relative to what a *.deps.json describes. As I understand it a .deps.json has nothing to do with nuget. However, in terms of pURL that might not matter. That is, the information contained within deps.json simply describe .NET packages, which canonically is nuget.

In short: should we be using the pURL type nuget instead of the proposed dotnet pURL type?

In thinking/reading through this more I think the answer is "yes" we should use "nuget", but wanted to raise this up for comment.

[ckotzbauer]

Great, thanks for fixing the CLI test.

I merged the pURL PR, so you should be good to go there.

I will update this PR.

should we be using the pURL type nuget instead of the proposed dotnet pURL type?

No, I don't think so. Nuget is the most popular package-manager for dotnet, but there are alternatives (e.g. https://fsprojects.github.io/Paket/index.html). I always used Nuget before, but I think the result in deps.json would be the same with another tool, as there's no reference to "nuget" in this file.

[wagoodman]

I think that all makes sense. I'll note that since the pURL type is non-standard that there is risk of needing to change this in the future, but I think for now we can operate under the assumption for now that a pURL that doesn't automatically couple .NET projects with nuget is the way to go in this instance.

[wagoodman]

Useful JSON schema diff for reviewers

# diff schema/json/schema-3.2.2.json  schema/json/schema-3.2.3.json
279a280,295
>     "DotnetDepsMetadata": {
>       "required": [
>         "name",
>         "version"
>       ],
>       "properties": {
>         "name": {
>           "type": "string"
>         },
>         "version": {
>           "type": "string"
>         }
>       },
>       "additionalProperties": true,
>       "type": "object"
>     },
520a537,542
>         },
>         "digest": {
>           "items": {
>             "$ref": "#/definitions/Digest"
>           },
>           "type": "array"
690a713,715
>               "$ref": "#/definitions/DotnetDepsMetadata"
>             },
>             {

[wagoodman]

cc: @anchore/tools
Looks like there are minor tweaks in grype testing needed -- I can confirm there is no apparent unexpected matching behavior with the stock matcher. We'll still need to add a .NET-specific matcher and DB namespace finder to link up GHSA matches in the future.

Overall, great work @ckotzbauer ! Thanks for taking the time on this ❤️

[ckotzbauer]

Oh, just because you posted the schema diff: I extended the Metadata as part of the review, but I think I forgot to regenerate the schema.

[wagoodman]

Latest diff:

# diff schema/json/schema-3.2.2.json  schema/json/schema-3.2.3.json
279a280,307
>     "DotnetDepsMetadata": {
>       "required": [
>         "name",
>         "version",
>         "path",
>         "sha512",
>         "hashPath"
>       ],
>       "properties": {
>         "name": {
>           "type": "string"
>         },
>         "version": {
>           "type": "string"
>         },
>         "path": {
>           "type": "string"
>         },
>         "sha512": {
>           "type": "string"
>         },
>         "hashPath": {
>           "type": "string"
>         }
>       },
>       "additionalProperties": true,
>       "type": "object"
>     },
520a549,554
>         },
>         "digest": {
>           "items": {
>             "$ref": "#/definitions/Digest"
>           },
>           "type": "array"
690a725,727
>               "$ref": "#/definitions/DotnetDepsMetadata"
>             },
>             {