feat: make python requirements.txt parser more inclusive

go.mod

@@ -50,6 +50,7 @@ require (
 
 require (
 	github.com/CycloneDX/cyclonedx-go v0.7.1-0.20221222100750-41a1ac565cce
+	github.com/Masterminds/semver/v3 v3.2.0
 	github.com/Masterminds/sprig/v3 v3.2.3
 	github.com/anchore/go-logger v0.0.0-20220728155337-03b66a5207d8
 	github.com/anchore/stereoscope v0.0.0-20230216143338-4b5ebf8c7f4b
@@ -67,7 +68,6 @@ require (
 require (
 	github.com/DataDog/zstd v1.4.5 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.2.0 // indirect
 	github.com/Microsoft/go-winio v0.6.0 // indirect
 	github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092 // indirect
 	github.com/becheran/wildmatch-go v1.0.0 // indirect

syft/pkg/cataloger/python/parse_requirements.go

@@ -6,6 +6,7 @@ import (
 	"strings"
 	"unicode"
 
+	"github.com/Masterminds/semver/v3"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/pkg"
@@ -35,14 +36,20 @@ func parseRequirementsTxt(_ source.FileResolver, _ *generic.Environment, reader
 			continue
 		}
 
-		if !strings.Contains(line, "==") {
-			// a package without a version, or a range (unpinned) which does not tell us
-			// exactly what will be installed.
-			continue
+		var parts []string
+		if strings.Contains(line, "==") {
+			parts = strings.Split(line, "==")
+		}
+		// Using min/max version is better than ignoring the package, however, it does not provide the same level of
+		// confidence as a pinned version.
+		index := strings.IndexFunc(line, func(r rune) bool {
+			return r == '>' || r == '<' || r == '~'
+		})
+
+		if index > 0 {
+			parts = append(parts, line[:index], line[index:])
 		}
 
-		// parse a new requirement
-		parts := strings.Split(line, "==")
 		if len(parts) < 2 {
 			// this should never happen, but just in case
 			log.WithFields("path", reader.RealPath).Warnf("unable to parse requirements.txt line: %q", line)
@@ -51,7 +58,7 @@ func parseRequirementsTxt(_ source.FileResolver, _ *generic.Environment, reader
 
 		// check if the version contains hash declarations on the same line
 		version, _ := parseVersionAndHashes(parts[1])
-
+		version = parseVersion(version)
 		name := strings.TrimSpace(parts[0])
 		version = strings.TrimFunc(version, func(r rune) bool {
 			return !unicode.IsLetter(r) && !unicode.IsNumber(r)
@@ -71,6 +78,45 @@ func parseRequirementsTxt(_ source.FileResolver, _ *generic.Environment, reader
 	return packages, nil, nil
 }
 
+func parseVersion(version string) string {
+	parts := strings.Split(version, ",")
+	if len(parts) < 2 {
+		return version
+	}
+
+	filteredVersions := map[string]struct{}{}
+	for _, part := range parts {
+		if strings.Contains(part, "!=") {
+			parts := strings.Split(part, "!=")
+			filteredVersions[strings.TrimSpace(parts[1])] = struct{}{}
+		}
+	}
+
+	closestVersion := semver.MustParse("0.0.0")
+	for _, part := range parts {
+		// ignore any parts that do not have '=' in them, >,<,~ are not valid semver
+		parts := strings.SplitAfter(part, "=")
+		if len(parts) < 2 {
+			continue
+		}
+		version := semver.MustParse(strings.TrimSpace(parts[1]))
+		if _, ok := filteredVersions[version.String()]; ok {
+			continue
+		}
+
+		if strings.Contains(part, "==") {
+			parts := strings.Split(part, "==")
+			return parts[1]
+		}
+
+		if version.GreaterThan(closestVersion) {
+			closestVersion = version
+		}
+	}
+
+	return closestVersion.String()
+}
+
 func parseVersionAndHashes(version string) (string, []string) {
 	parts := strings.Split(version, "--hash=")
 	if len(parts) < 2 {

syft/pkg/cataloger/python/parse_requirements_test.go

@@ -21,6 +21,30 @@ func TestParseRequirementsTxt(t *testing.T) {
 			Language:  pkg.Python,
 			Type:      pkg.PythonPkg,
 		},
+		{
+			Name:      "Mopidy-Dirble",
+			Version:   "1.1",
+			PURL:      "pkg:pypi/Mopidy-Dirble@1.1",
+			Locations: locations,
+			Language:  pkg.Python,
+			Type:      pkg.PythonPkg,
+		},
+		{
+			Name:      "sqlalchemy",
+			Version:   "2.0.0",
+			PURL:      "pkg:pypi/sqlalchemy@2.0.0",
+			Locations: locations,
+			Language:  pkg.Python,
+			Type:      pkg.PythonPkg,
+		},
+		{
+			Name:      "numpy",
+			Version:   "3.4.1",
+			PURL:      "pkg:pypi/numpy@3.4.1",
+			Locations: locations,
+			Language:  pkg.Python,
+			Type:      pkg.PythonPkg,
+		},
 		{
 			Name:      "foo",
 			Version:   "1.0.0",

syft/pkg/cataloger/python/test-fixtures/requires/requirements.txt

@@ -1,6 +1,6 @@
  flask == 4.0.0
 # a line that is ignored
-sqlalchemy >= 1.0.0
+sqlalchemy >= 1.0.0, <= 2.0.0, != 3.0.0, <= 3.0.0
  foo == 1.0.0 # a comment that needs to be ignored
 -e https://github.com/pecan/pecan.git
 -r other-requirements.txt