anchore-engine icon indicating copy to clipboard operation
anchore-engine copied to clipboard

package list API should use syft packages (golang)

Open luhring opened this issue 3 years ago • 0 comments

As an engine user, I expect the product to leverage the Anchore OSS toolbox so to extend the software for Golang packages.

AC In order to support the existing interface, the client implements a translation layer on syft for the following:

  1. Match the existing packages results
  2. Produce the same metadata from packages found

Steps to Test

  1. Use the Anchore CLI for known image and compare results to a known image matches.
  2. Look at the anchore_engine/analyzers/modules dir within the Anchore container image and ensure the Go analyzer is not present.

Developer Notes The current Go analyzer relies exclusively on the Hints file. There is no native Go support in Anchore Engine to detect packages as it is the case with syft. This means that tests for Go packages wouldn't pass in Anchore Engine unless there is hints file support in syft.

luhring avatar Oct 21 '20 20:10 luhring