/
parse_poetry_lock.go
53 lines (44 loc) · 1.37 KB
/
parse_poetry_lock.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
package python
import (
"fmt"
"github.com/pelletier/go-toml"
"github.com/nextlinux/sbom/sbom/artifact"
"github.com/nextlinux/sbom/sbom/pkg"
"github.com/nextlinux/sbom/sbom/pkg/cataloger/generic"
"github.com/nextlinux/sbom/sbom/source"
)
// integrity check
var _ generic.Parser = parsePoetryLock
type poetryMetadata struct {
Packages []struct {
Name string `toml:"name"`
Version string `toml:"version"`
Category string `toml:"category"`
Description string `toml:"description"`
Optional bool `toml:"optional"`
} `toml:"package"`
}
// parsePoetryLock is a parser function for poetry.lock contents, returning all python packages discovered.
func parsePoetryLock(_ source.FileResolver, _ *generic.Environment, reader source.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
tree, err := toml.LoadReader(reader)
if err != nil {
return nil, nil, fmt.Errorf("unable to load poetry.lock for parsing: %w", err)
}
metadata := poetryMetadata{}
err = tree.Unmarshal(&metadata)
if err != nil {
return nil, nil, fmt.Errorf("unable to parse poetry.lock: %w", err)
}
var pkgs []pkg.Package
for _, p := range metadata.Packages {
pkgs = append(
pkgs,
newPackageForIndex(
p.Name,
p.Version,
reader.Location.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
),
)
}
return pkgs, nil, nil
}