Gemspec file generating empty SBOMs

[diptanshumittal]

What happened:
Empty SBOMs are generated using the *.gemspec file. Syft is not able to detect any package using the gemspec file even tough gemspec is a valid cataloger.

What you expected to happen:
Expected the SBOMs to atleast have a single package with gem details in it. Similar to other languages like Javascript.

Steps to reproduce the issue:
Run syft packages -o spdx-json for the file
Anything else we need to know?:

Environment:

• Output of syft version: 0.85.0
• OS (e.g: cat /etc/os-release or similar): macOS 13.4.1

[tgerla]

Hi @diptanshumittal, thank you for the report and the information necessary to reproduce this issue. We'll take a look when we are able.

[spiffcs]

👋 hey @diptanshumittal!

It looks like it's enabled only for the image cataloger by default

syft/syft/pkg/cataloger/cataloger.go

Lines 42 to 62 in a90cff1

	func ImageCatalogers(cfg Config) []pkg.Cataloger {
	return filterCatalogers([]pkg.Cataloger{
	alpm.NewAlpmdbCataloger(),
	apkdb.NewApkdbCataloger(),
	binary.NewCataloger(),
	deb.NewDpkgdbCataloger(),
	dotnet.NewDotnetPortableExecutableCataloger(),
	golang.NewGoModuleBinaryCataloger(cfg.Golang),
	java.NewJavaCataloger(cfg.Java()),
	java.NewNativeImageCataloger(),
	javascript.NewPackageCataloger(),
	nix.NewStoreCataloger(),
	php.NewComposerInstalledCataloger(),
	portage.NewPortageCataloger(),
	python.NewPythonPackageCataloger(),
	r.NewPackageCataloger(),
	rpm.NewRpmDBCataloger(),
	ruby.NewGemSpecCataloger(),
	sbom.NewSBOMCataloger(),
	}, cfg.Catalogers)
	}

Can you try updating your configuration code to enable that cataloger. See the configuration here:
https://github.com/anchore/syft#configuration

[willmurphyscode]

Depending on where the *.gemspec file is, it looks like enabling the cataloger still might not find it:

syft/syft/pkg/cataloger/ruby/catalogers.go

Line 19 in 5d48882

WithParserByGlobs(parseGemSpecEntries, "**/specifications/**/*.gemspec")

shows the glob to be **/specifications/**/*.gemspec, but if the gem is defined in the directory being scanned, for example, I'm not sure that the gemspec would be under the specifications directory.

See also #2128

[wagoodman]

I think this might solve the confusion with this pr/comment, but it's not clear if it is being currently updated or is stale

[tgerla]

I believe this is fixed thanks to #1971 so I'll close this issue, but feel free to re-open if you are still having problems. Thanks!