Report package DB verification metadata

[wagoodman]

Report on RPM, DPKG, and APK file manifest data for each file owned by each package found in the respective database:

• digest
• digest algorithm
• mode
• user
• group
• size
• conffile listing (if available)

[wagoodman]

Update for DPKG

anchore-engine today only captures: digest, digest algorithm, and indication if this is a conf file
See: https://github.com/anchore/anchore-engine/blob/v0.8.2/anchore_engine/analyzers/utils.py#L1863

This means that the following fields will be left out of the syft implementation: mode, user, group, file size

Actions:

• pull out the conffile listing, combining information from both the status file and the info/conffile
• today we have a md5 field. We could make this agnostic by providing a digest field with value and algorithm fields. DPKG only uses md5, but it could help consumers by being consistent.

[wagoodman]

Update for APK

anchore-engine today only captures: digest, digest algorithm, mode, group, and user
See: https://github.com/anchore/anchore-engine/blob/v0.8.2/anchore_engine/analyzers/utils.py#L1975

This means that the following fields will be left out of the syft implementation: conffile, size

Actions:

• today we have a Checksum field. We could make this agnostic by providing a digest field with value and algorithm fields. APK only uses sha1, but it could help consumers by being consistent.

[wagoodman]

Update for RPM

anchore-engine today captures: digest, digest algorithm, mode, group, user, size, and indication if this is a conffile
See: https://github.com/anchore/anchore-engine/blob/v0.8.2/anchore_engine/analyzers/utils.py#L1756

Actions:

• add user
• add group
• add conffile indication
• add digest algorithm
• today we have aSHA256 field. We could make this agnostic by providing a digest field with value and algorithm fields. This way we could help consumers by being consistent.