Squashed all layers

internal/task/scope_tasks.go

@@ -0,0 +1,71 @@
+package task
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/anchore/syft/internal/sbomsync"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/sbom"
+)
+
+func NewScopesTask() Task {
+	fn := func(_ context.Context, _ file.Resolver, builder sbomsync.Builder) error {
+		finalizeScope(builder)
+		return nil
+	}
+
+	return NewTask("scope-cataloger", fn)
+}
+
+func finalizeScope(builder sbomsync.Builder) {
+	accessor := builder.(sbomsync.Accessor)
+
+	// remove all packages that doesn't exist in the final state of the image
+	builder.DeletePackages(packagesToRemove(accessor)...)
+}
+
+func packagesToRemove(accessor sbomsync.Accessor) []artifact.ID {
+	pkgsToDelete := make([]artifact.ID, 0)
+	accessor.ReadFromSBOM(func(s *sbom.SBOM) {
+		// remove packages which doesn't exist in the final state of the image
+		pkgsToDelete = append(pkgsToDelete, getPackagesToDelete(s)...)
+	})
+	return pkgsToDelete
+}
+
+func getPackagesToDelete(s *sbom.SBOM) []artifact.ID {
+	pkgsToDelete := make([]artifact.ID, 0)
+	filterDuplicates := make(map[string]bool)
+	for p := range s.Artifacts.Packages.Enumerate() {
+		noSquashed := true
+		noPrimary := true
+		for _, l := range p.Locations.ToSlice() {
+			scope := l.LocationMetadata.Annotations[file.ScopeAnnotationKey]
+			evidence := l.LocationMetadata.Annotations[pkg.EvidenceAnnotationKey]
+			if scope == file.SquashedScopeAnnotation && evidence == pkg.PrimaryEvidenceAnnotation || scope == file.SquashedScopeAnnotation && p.Type == pkg.BinaryPkg {
+				noSquashed = false
+				break
+			}
+			if scope == "" && evidence == pkg.PrimaryEvidenceAnnotation {
+				if exists := filterDuplicates[getKey(p, l)]; exists {
+					break
+				}
+				filterDuplicates[getKey(p, l)] = true
+				noPrimary = false
+				break
+			}
+		}
+
+		if noSquashed && noPrimary {
+			pkgsToDelete = append(pkgsToDelete, p.ID())
+		}
+	}
+	return pkgsToDelete
+}
+
+func getKey(pkg pkg.Package, loc file.Location) string {
+	return fmt.Sprintf("%s-%s-%s-%s", pkg.Name, pkg.Version, loc.RealPath, loc.AccessPath)
+}

syft/create_sbom_config.go

@@ -179,6 +179,7 @@ func (c *CreateSBOMConfig) makeTaskGroups(src source.Description) ([][]task.Task
 
 	// generate package and file tasks based on the configuration
 	environmentTasks := c.environmentTasks()
+	scopeTasks := c.scopeTasks()
 	relationshipsTasks := c.relationshipTasks(src)
 	unknownTasks := c.unknownsTasks()
 	fileTasks := c.fileTasks()
@@ -195,6 +196,11 @@ func (c *CreateSBOMConfig) makeTaskGroups(src source.Description) ([][]task.Task
 		taskGroups = append(taskGroups, append(pkgTasks, fileTasks...))
 	}
 
+	// all scope work must be done after all nodes (files and packages) have been cataloged and before the relationship
+	if len(scopeTasks) > 0 {
+		taskGroups = append(taskGroups, scopeTasks)
+	}
+
 	// all relationship work must be done after all nodes (files and packages) have been cataloged
 	if len(relationshipsTasks) > 0 {
 		taskGroups = append(taskGroups, relationshipsTasks)
@@ -328,6 +334,17 @@ func (c *CreateSBOMConfig) userPackageTasks(cfg task.CatalogingFactoryConfig) ([
 	return persistentPackageTasks, selectablePackageTasks, nil
 }
 
+// scopeTasks returns the set of tasks that should be run to generate additional scope information
+func (c *CreateSBOMConfig) scopeTasks() []task.Task {
+	var tsks []task.Task
+	if c.Search.Scope == source.SquashWithAllLayersScope {
+		if t := task.NewScopesTask(); t != nil {
+			tsks = append(tsks, t)
+		}
+	}
+	return tsks
+}
+
 // relationshipTasks returns the set of tasks that should be run to generate additional relationships as well as
 // prune existing relationships.
 func (c *CreateSBOMConfig) relationshipTasks(src source.Description) []task.Task {

syft/file/scope.go

@@ -0,0 +1,7 @@
+package file
+
+const (
+	ScopeAnnotationKey       = "scope"
+	SquashedScopeAnnotation  = "squashed"
+	AllLayersScopeAnnotation = "all-layers"
+)

syft/format/syftjson/to_format_model.go

@@ -211,6 +211,7 @@ func toPackageModels(catalog *pkg.Collection, cfg EncoderConfig) []model.Package
 	for _, p := range catalog.Sorted() {
 		artifacts = append(artifacts, toPackageModel(p, cfg))
 	}
+
 	return artifacts
 }