feat: added support for anchore/syft, an SBOM utility

syft/README.md

@@ -0,0 +1,37 @@
+---
+title: Syft
+homepage: https://github.com/anchore/syft/
+tagline: |
+  Syft is a CLI tool and library for generating a Software Bill of Materials
+  from container images and filesystems.
+---
+
+To update or switch versions, run `webi syft@stable` (or `@v0.101.1`, `@beta`,
+etc)
+
+### Files
+
+```
+~/.config/envman/PATH.env
+~/.syft.yaml
+~/.local/bin/syft
+```
+
+## Cheat Sheet
+
+> Generates SBOMs for container images, filesystems, archives, and more to
+> discover packages and libraries. Supports OCI, Docker and Singularity image
+> formats. Convert between SBOM formats, such as CycloneDX, SPDX, and Syft's own
+> format.
+
+### To generate an SBOM for a container image:
+
+```sh
+syft <image>
+```
+
+### To take into account the contents of all image layers:
+
+```sh
+syft <image> --scope all-layers
+```

syft/install.ps1

@@ -0,0 +1,57 @@
+#!/usr/bin/env pwsh
+
+################
+# Install Syft #
+################
+
+# Every package should define these variables
+$pkg_cmd_name = "syft"
+
+$pkg_dst_cmd = "$Env:USERPROFILE\.local\bin\syft.exe"
+$pkg_dst_bin = "$Env:USERPROFILE\.local\bin"
+$pkg_dst = "$pkg_dst_cmd"
+
+$pkg_src_cmd = "$Env:USERPROFILE\.local\opt\syft-v$Env:WEBI_VERSION\bin\syft.exe"
+$pkg_src_bin = "$Env:USERPROFILE\.local\opt\syft-v$Env:WEBI_VERSION\bin"
+$pkg_src_dir = "$Env:USERPROFILE\.local\opt\syft-v$Env:WEBI_VERSION"
+$pkg_src = "$pkg_src_cmd"
+
+New-Item "$Env:USERPROFILE\Downloads\webi" -ItemType Directory -Force | Out-Null
+$pkg_download = "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE"
+
+# Fetch archive
+IF (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
+    Write-Output "Downloading syft from $Env:WEBI_PKG_URL to $pkg_download"
+    & curl.exe -A "$Env:WEBI_UA" -fsSL "$Env:WEBI_PKG_URL" -o "$pkg_download.part"
+    & Move-Item "$pkg_download.part" "$pkg_download"
+}
+
+IF (!(Test-Path -Path "$pkg_src_cmd")) {
+    Write-Output "Installing syft"
+
+    # TODO: create package-specific temp directory
+    # Enter tmp
+    Push-Location .local\tmp
+
+    # Remove any leftover tmp cruft
+    Remove-Item -Path ".\syft-v*" -Recurse -ErrorAction Ignore
+    Remove-Item -Path ".\syft.exe" -Recurse -ErrorAction Ignore
+
+    # Unpack archive file into this temporary directory
+    # Windows BSD-tar handles zip. Imagine that.
+    Write-Output "Unpacking $pkg_download"
+    & tar xf "$pkg_download"
+
+    # Settle unpacked archive into place
+    Write-Output "Install Location: $pkg_src_cmd"
+    New-Item "$pkg_src_bin" -ItemType Directory -Force | Out-Null
+    Move-Item -Path ".\syft.exe" -Destination "$pkg_src_bin"
+
+    # Exit tmp
+    Pop-Location
+}
+
+Write-Output "Copying into '$pkg_dst_cmd' from '$pkg_src_cmd'"
+Remove-Item -Path "$pkg_dst_cmd" -Recurse -ErrorAction Ignore | Out-Null
+New-Item "$pkg_dst_bin" -ItemType Directory -Force | Out-Null
+Copy-Item -Path "$pkg_src" -Destination "$pkg_dst" -Recurse

syft/install.sh

@@ -0,0 +1,43 @@
+#!/bin/sh
+set -e
+set -u
+
+__init_syft() {
+
+    ################
+    # Install Syft #
+    ################
+
+    # Every package should define these 6 variables
+    pkg_cmd_name="syft"
+
+    pkg_dst_cmd="$HOME/.local/bin/syft"
+    pkg_dst="$pkg_dst_cmd"
+
+    pkg_src_cmd="$HOME/.local/opt/syft-v$WEBI_VERSION/bin/syft"
+    pkg_src_dir="$HOME/.local/opt/syft-v$WEBI_VERSION"
+    pkg_src="$pkg_src_cmd"
+
+    # pkg_install must be defined by every package
+    pkg_install() {
+        # ~/.local/opt/syft-v0.101.1/bin
+        mkdir -p "$(dirname "${pkg_src_cmd}")"
+
+        # mv ./syft ~/.local/opt/syft-v0.101.1/bin/syft
+        mv ./"$pkg_cmd_name"* "$pkg_src"
+    }
+
+    # pkg_get_current_version is recommended, but not required
+    pkg_get_current_version() {
+        # 'syft --version' has output in this format:
+        #       syft 0.101.1
+        # This trims it down to just the version number:
+        #       0.101.1
+        syft --version 2> /dev/null |
+            head -n 1 |
+            cut -d ' ' -f 2
+    }
+
+}
+
+__init_syft

syft/releases.js

@@ -0,0 +1,20 @@
+'use strict';
+
+var github = require('../_common/github.js');
+var owner = 'anchore';
+var repo = 'syft';
+
+module.exports = function (request) {
+  return github(request, owner, repo).then(function (all) {
+    return all;
+  });
+};
+
+if (module === require.main) {
+  module.exports(require('@root/request')).then(function (all) {
+    all = require('../_webi/normalize.js')(all);
+    // just select the first 5 for demonstration
+    all.releases = all.releases.slice(0, 5);
+    console.info(JSON.stringify(all, null, 2));
+  });
+}