feat(conda): add licenses support for environment.yml files

[DmitriyLewen]

Description

Add licenses support for environment.yml files.
Licenses are taken from conda-meta directory.
Path to conda-meta is determined from prefix field of environment.yml

Related issues

• Close Conda environment.yml support #5949
• Close feat(conda): detect licenses for environment.yml #6566

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[DmitriyLewen]

I use prefix as FilePath in dependency parser.
This is a workaround.
Perhaps we need to add a prefix or a new field to Package.

[knqyf263]

It's inefficient, but what if parsing environment.yaml again in pkg/fanal/analyzer/language/conda/environment/environment.go to just extract a prefix? Using FilePath is a bit hacky.

[DmitriyLewen]

yeah. I doubted this decision.

I didn't think about it right away, but what if we will use logic as for package.json file.
I mean don't implement Parser interface:

trivy/pkg/dependency/parser/nodejs/packagejson/parse.go

Lines 27 to 41 in e9fc3e3

	type Package struct {
	ftypes.Package
	Dependencies map[string]string
	OptionalDependencies map[string]string
	DevDependencies map[string]string
	Workspaces []string
	}
	type Parser struct{}
	func NewParser() *Parser {
	return &Parser{}
	}
	func (p *Parser) Parse(r io.Reader) (Package, error) {

wdyt?

[knqyf263]

It's also okay for me.

[knqyf263]

@DmitriyLewen Do you think you'll update it shortly?

[DmitriyLewen]

I want to do this today.

[DmitriyLewen]

@knqyf263 i updated PR (67daea7 + 9200c44)
take a look, please.

[knqyf263]

nit: I prefer an early return.

Suggested change

	if res != nil && len(res.Applications) > 0 {
	if res == nil || len(res.Applications) == 0 {
	return nil, nil
	}

[DmitriyLewen]

updated in d75bce2

[knqyf263]

You can use this function for a versioned document link.

trivy/pkg/version/doc/doc.go

Lines 25 to 31 in 3d4ae8b

	// URL returns the URL for the versioned documentation with the given path
	func URL(rawPath, fragment string) string {
	base := BaseURL(app.Version())
	base.Path = path.Join(base.Path, rawPath)
	base.Fragment = fragment
	return base.String()
	}

Suggested change

	log.WithPrefix("conda").Debug("License not found. See https://aquasecurity.github.io/trivy/latest/docs/coverage/os/conda/#license_1 for details",
	log.WithPrefix("conda").Debugf("License not found. See %s for details", doc.URL("docs/coverage/os/conda/", "license_1"))

[knqyf263]

Oh, sorry, I missed some arguments, and my suggestion was broken.

log.String("pkg", pkg.Name), log.Err(err))

[DmitriyLewen]

i am fixing that

[DmitriyLewen]

Fixed in b68efe7

 DEBUG   [conda] License not found. See https://aquasecurity.github.io/trivy/dev/docs/coverage/os/conda#license_1 for details.   pkg="_openmp_mutex" err="unable to read conda-meta dir: open /opt/conda/envs/test-env/conda-meta: no such file or directory"