feat: add ability to ignore packages on pom properties

[jneate]

This resolves #985

I was 50/50 about adding GroupID and ArtifactID, happy to remove artifact ID as you could use package-name in the package ignore rules but opened the PR anyway just in case it added value.

The artifact ID ignore rules are dependant on anchore/syft#1870 as currently it's blank

Group ID filter

Scope filter

Pom used for testing:

<dependency>
        <groupId>log4j</groupId>
        <artifactId>log4j</artifactId>
        <version>1.2.17</version>
</dependency>		
<dependency>
	<groupId>org.springframework.boot</groupId>
	<artifactId>spring-boot-starter-webflux</artifactId>
	<scope>test</scope>
</dependency>

[kzantow]

Thanks @jneate -- my main question is if the pom should be a top-level field on the IgnoreRule (I don't know, just posing the question)

[kzantow]

Has the change to this vulnerability test removed the ruby case? Unclear why it should be removed, should this be added back in as another test case?

[kzantow]

I wonder if this should be nested under a Java ignore rule container? E.g. the configuration would be:

  # ...or just by a single pom field:
  - java:
      pom:
        scope: test

[kzantow]

@jneate the team talked about this PR a bit and had a few comments:

The first thing to note is

The simplest change to get this to the finish line: since this is for a package rather than something else we believe this should be nested under the IgnoreRulePackage, probably for now as java (since the metadata is pkg.JavaMetadata rather than Maven POM specific), so the configuration would look something like:

- package:
    java:
      scope: 'test'
      artifact-id: 'log4j'
      group-id: 'org.apache.logging.log4j'

... I think this would basically just involve moving the

Pom           IgnoreRulePom     `yaml:"pom" json:"pom" mapstructure:"pom"`

under the IgnoreRulePackage, as something more like:

Java           IgnoreRuleJava     `yaml:"java" json:"java" mapstructure:"java"`

--

But... I'd also mention there was another thought that we might like to make this more generic, where we could potentially specify any metadata information, something like:

- package:
    metadata:
      - field : .PomScope
        value: test
      - field :  .PomArtifactID
        value: log4j
      - field :  .PomGroupID
        value: 'org.apache.logging.log4j'

Do you think either of these options would be something you'd like to do? If not, we could probably help at least get the first change done to get this to the finish line.

[wagoodman]

This to me feels more like a matcher configuration and not additional fields on an ignore rule. The reason being is that matchers are already ecosystem specific and can handle cases where we're adding new attributes to consider for that entire ecosystem.

[spiffcs]

@jneate thanks for the contribution and apologies that this got stale. I've rebased the changes here and will work on getting the comments from @wagoodman and @kzantow addressed!

[spiffcs]

We're back to passing on this PR - I'm now taking it in the direction suggested by @wagoodman where we update the matcher configuration rather than the ignore rules