feat: Add the origin field to the output format of syftjson

[TupleType]

This PR adds the origin field to the output format of syftjson when parsing “package-lock.json” or “Pipfile.lock”. The origin field can be useful in tracking the origin of downloaded packages in case of a security incident. The origin field contains the URL used to download an artifact according to the appropriate lock file. For example, package-lock.json has the resolved field to indicate the url used to download the package.

I wasn’t able to find a way to update the golden files of the integration tests similarly to the argument in the unit test’s golden files. Could you please guide me on how to update them?

Changes to the golden files were done using the appropriate parameters of the test files.

[kzantow]

Thanks for the contribution @asi-cider! It looks like this Origin field is specific to NPM packages and as such should not be added to the main pkg.Package but rather the appropriate metadata type. In this case we probably need a new metadata type, something like PackageLockPackageMetadata, which is set when creating the package, which contains the Origin field. An example metadata type is here.

I think this change would also reduce some of the conflicts, as it stands there are a number of conflicts to resolve if you are able to.

[TupleType]

Thanks for the contribution @asi-cider! It looks like this Origin field is specific to NPM packages and as such should not be added to the main pkg.Package but rather the appropriate metadata type. In this case we probably need a new metadata type, something like PackageLockPackageMetadata, which is set when creating the package, which contains the Origin field. An example metadata type is here.

I think this change would also reduce some of the conflicts, as it stands there are a number of conflicts to resolve if you are able to.

Hey @kzantow, thanks for the response. This field exists in some form or another in all kinds of lock files. Currently I've add this for npm and pipfile but I intend to add this for more ecosystems. Do you still think it should be added as metadata field?

[wagoodman]

@asi-cider I agree with @kzantow on this one. Though there are some similarities between different package managers on this field, at this time I think keeping this kind of field in the pkg.Metadata makes the most sense.

[TupleType]

@asi-cider I agree with @kzantow on this one. Though there are some similarities between different package managers on this field, at this time I think keeping this kind of field in the pkg.Metadata makes the most sense.

Sure i'll add that in pkg.Metadata

[TupleType]

Hey @kzantow and @wagoodman,
I've made the changes I would appreciate your approval.

[TupleType]

Hey @kzantow,

Could you guide me on how to fix the unit tests?
Regarding the CLI test, to what version should I bump the schema?

[TupleType]

Hey @kzantow @wagoodman, could you please help?

[kzantow]

@asi-cider I'll have a look today, but there's a conflict that needs to be dealt with -- are you able to merge the latest main changes and take care of this?

[wagoodman]

I can help out with the git conflicts and other updates

[wagoodman]

I rebased on main and made the following changes:

• make the metadata struct names as specific as possible relative to the parsed data sources they represent
• move the metadata structs to the syft.pkg package
• regenerated the JSON schema to account for the new fields. (since 6.1.0 hasn't been released yet, it can safely be regenerated)

[wagoodman]

Thanks for the improvements @asi-cider !

Stale