Drop whiteout/opaque files and warn when pkg lacks Name/Version

internal/formats/github/encoder.go

@@ -9,7 +9,6 @@ import (
 
 	"github.com/anchore/packageurl-go"
 	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
@@ -148,7 +147,6 @@ func toGithubManifests(s *sbom.SBOM) Manifests {
 func dependencyName(p pkg.Package) string {
 	purl, err := packageurl.FromString(p.PURL)
 	if err != nil {
-		log.Warnf("Invalid PURL for package: '%s' PURL: '%s' (%w)", p.Name, p.PURL, err)
 		return ""
 	}
 	// don't use qualifiers for this

syft/pkg/cataloger/python/package_cataloger.go

@@ -8,7 +8,6 @@ import (
 	"path/filepath"
 
 	"github.com/anchore/syft/internal"
-
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/pkg"
 

syft/pkg/package.go

@@ -33,6 +33,14 @@ func (p *Package) OverrideID(id artifact.ID) {
 }
 
 func (p *Package) SetID() {
+	if p.Name == "" {
+		log.Warnf("%s: missing package name, that is necessary for further metadata extraction, such as CPEs and pURLs", p.FoundBy)
+	}
+
+	if p.Version == "" {
+		log.Warnf("%s: missing package version, that is necessary for further metadata extraction, such as CPEs and pURLs", p.FoundBy)
+	}
+
 	id, err := artifact.IDByHash(p)
 	if err != nil {
 		// TODO: what to do in this case?

syft/pkg/python_package_metadata_test.go

@@ -1,11 +1,12 @@
 package pkg
 
 import (
-	"github.com/anchore/syft/syft/linux"
-	"github.com/sergi/go-diff/diffmatchpatch"
 	"strings"
 	"testing"
 
+	"github.com/anchore/syft/syft/linux"
+	"github.com/sergi/go-diff/diffmatchpatch"
+
 	"github.com/go-test/deep"
 )
 
@@ -16,6 +17,13 @@ func TestPythonPackageMetadata_pURL(t *testing.T) {
 		metadata PythonPackageMetadata
 		expected string
 	}{
+		// NOTE: making this case explicit since it happens for users
+		// with empty egg/wheel files
+		{
+			name:     "without-name-and-version",
+			metadata: PythonPackageMetadata{},
+			expected: "pkg:pypi/",
+		},
 		{
 			name: "with vcs info",
 			metadata: PythonPackageMetadata{

test/cli/package_missing_data_test.go

@@ -0,0 +1,37 @@
+package cli
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/anchore/syft/syft"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestPackageMissingNameAndVersion(t *testing.T) {
+	formats := syft.FormatIDs()
+	commonAssertions := []traitAssertion{
+		func(tb testing.TB, _, stderr string, _ int) {
+			tb.Helper()
+			assert.Contains(tb, stderr, "python-package-cataloger: missing package name, that is necessary for further metadata extraction, such as CPEs and pURLs")
+			assert.Contains(tb, stderr, "python-package-cataloger: missing package version, that is necessary for further metadata extraction, such as CPEs and pURLs")
+		},
+		assertSuccessfulReturnCode,
+	}
+
+	for _, o := range formats {
+		t.Run(fmt.Sprintf("format:%s", o), func(t *testing.T) {
+			// TODO: does it make sense to add empty metadata for all catalogers?
+			cmd, stdout, stderr := runSyft(t, nil, "dir:./test-fixtures/image-pkg-coverage/pkgs/", "-o", string(o))
+			for _, traitFn := range commonAssertions {
+				traitFn(t, stdout, stderr, cmd.ProcessState.ExitCode())
+			}
+			if t.Failed() {
+				t.Log("STDOUT:\n", stdout)
+				t.Log("STDERR:\n", stderr)
+				t.Log("COMMAND:", strings.Join(cmd.Args, " "))
+			}
+		})
+	}
+}

test/cli/packages_cmd_test.go

@@ -96,7 +96,7 @@ func TestPackagesCmdFlags(t *testing.T) {
 			name: "squashed-scope-flag",
 			args: []string{"packages", "-o", "json", "-s", "squashed", coverageImage},
 			assertions: []traitAssertion{
-				assertPackageCount(32),
+				assertPackageCount(34),
 				assertSuccessfulReturnCode,
 			},
 		},

test/integration/catalog_packages_cases_test.go

@@ -39,6 +39,8 @@ var imageOnlyTestCases = []testCase{
 			"requests":     "2.22.0",
 			"somerequests": "3.22.0",
 			"someotherpkg": "3.19.0",
+			"brokenpkg":    "",
+			"":             "",
 		},
 	},
 	{
@@ -148,6 +150,8 @@ var dirOnlyTestCases = []testCase{
 			"requests":     "2.22.0",
 			"somerequests": "3.22.0",
 			"someotherpkg": "3.19.0",
+			"brokenpkg":    "",
+			"":             "",
 		},
 	},
 	{

test/integration/test-fixtures/image-pkg-coverage/pkgs/python/broken-1.0.0-py3.8.egg-info

@@ -0,0 +1 @@
+Name: brokenpkg