Fix directory scanning

cmd/syft-scanner/main.go

@@ -15,6 +15,7 @@
 package main
 
 import (
+	"errors"
 	"fmt"
 	"os"
 
@@ -32,6 +33,11 @@ func main() {
 		panic(fmt.Sprintf("unable to initialize logger: %+v", err))
 	}
 
+	// HACK: ensure that /tmp exists, as syft will fail if it does not
+	if err := os.Mkdir("/tmp", 0o777); err != nil && !errors.Is(err, os.ErrExist) {
+		panic("could not create /tmp directory")
+	}
+
 	logrus.Infof("starting syft scanner for buildkit %s", version.Version)
 
 	scanner, err := internal.NewScannerFromEnvironment()

examples/centos.Dockerfile

@@ -14,7 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM centos:7
+FROM centos:7 AS base
 ARG BUILDKIT_SBOM_SCAN_STAGE=true
 RUN yum install -y findutils
 COPY <<EOF /empty

go.mod

@@ -5,7 +5,7 @@ go 1.19
 require (
 	github.com/anchore/go-logger v0.0.0-20220728155337-03b66a5207d8
 	github.com/anchore/stereoscope v0.0.0-20221208011002-c5ff155d72f1
-	github.com/anchore/syft v0.68.1
+	github.com/anchore/syft v0.69.0
 	github.com/in-toto/in-toto-golang v0.4.1-0.20221018183522-731d0640b65f
 	github.com/pkg/errors v0.9.1
 	github.com/sirupsen/logrus v1.9.0

go.sum

@@ -140,8 +140,8 @@ github.com/anchore/packageurl-go v0.1.1-0.20230104203445-02e0a6721501 h1:AV7qjwM
 github.com/anchore/packageurl-go v0.1.1-0.20230104203445-02e0a6721501/go.mod h1:Blo6OgJNiYF41ufcgHKkbCKF2MDOMlrqhXv/ij6ocR4=
 github.com/anchore/stereoscope v0.0.0-20221208011002-c5ff155d72f1 h1:DXUAm/H9chRTEzMfkFyduBIcCiJyFXhCmv3zH3C0HGs=
 github.com/anchore/stereoscope v0.0.0-20221208011002-c5ff155d72f1/go.mod h1:/zjVnu2Jdl7xQCUtASegzeEg+IHKrM7SyMqdao3e+Nc=
-github.com/anchore/syft v0.68.1 h1:lXRSy51cCwOhlXyFYJppiHuOx+Aj59l9vIr9QwRXwXQ=
-github.com/anchore/syft v0.68.1/go.mod h1:8V+ty9yieYYjEL3wQkcQC1EfEy+yM+VXLnkqpXie1FQ=
+github.com/anchore/syft v0.69.0 h1:6Zbg9iUdNDv/tL2jUehqIm9xvGwCUS24RjWKZGQ/m48=
+github.com/anchore/syft v0.69.0/go.mod h1:8V+ty9yieYYjEL3wQkcQC1EfEy+yM+VXLnkqpXie1FQ=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
 github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY3JY=

internal/target.go

@@ -34,49 +34,27 @@ func (t Target) Name() string {
 }
 
 func (t Target) Scan() (sbom.SBOM, error) {
-	// HACK: execute the scan inside a chroot, to ensure that symlinks are
-	// correctly resolved internally to the mounted image (instead of
-	// redirecting to the host).
-	//
-	// To avoid this, syft needs to support a mode of execution that scans
-	// unpacked container filesystems, see https://github.com/anchore/syft/issues/1359.
-
-	var result sbom.SBOM
-	err := withChroot(t.Path, func() error {
-		inputSrc := "dir:/"
-		input, err := source.ParseInput(inputSrc, "", false)
-		if err != nil {
-			return fmt.Errorf("failed to parse user input %q: %w", inputSrc, err)
-		}
-
-		src, cleanup, err := source.New(*input, nil, nil)
-		if err != nil {
-			return fmt.Errorf("failed to construct source from user input %q: %w", inputSrc, err)
-		}
-		src.Metadata.Name = t.Name()
-		if cleanup != nil {
-			defer cleanup()
-		}
-
-		result = sbom.SBOM{
-			Source: src.Metadata,
-			Descriptor: sbom.Descriptor{
-				Name:    "syft",
-				Version: version.SyftVersion,
-			},
-		}
+	src, err := source.NewFromDirectoryRootWithName(t.Path, t.Name())
+	if err != nil {
+		return sbom.SBOM{}, fmt.Errorf("failed to create source from %q: %w", t.Path, err)
+	}
+	result := sbom.SBOM{
+		Source: src.Metadata,
+		Descriptor: sbom.Descriptor{
+			Name:    "syft",
+			Version: version.SyftVersion,
+		},
+	}
 
-		packageCatalog, relationships, theDistro, err := syft.CatalogPackages(src, cataloger.DefaultConfig())
-		if err != nil {
-			return err
-		}
+	packageCatalog, relationships, theDistro, err := syft.CatalogPackages(&src, cataloger.DefaultConfig())
+	if err != nil {
+		return sbom.SBOM{}, err
+	}
 
-		result.Artifacts.PackageCatalog = packageCatalog
-		result.Artifacts.LinuxDistribution = theDistro
-		result.Relationships = relationships
+	result.Artifacts.PackageCatalog = packageCatalog
+	result.Artifacts.LinuxDistribution = theDistro
+	result.Relationships = relationships
 
-		return nil
-	})
 	if err != nil {
 		return sbom.SBOM{}, err
 	}