Scalibr - new metadata and languages support

[ganochenkodg]

Add support for new extended inventory metadata keys on linux
Add support for several language package managers: Java, NPM, Gem, Python pip/uv, Go, Rust cargo, Php composer, Swift pm, Dart pubspec

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ganochenkodg
Once this PR has been reviewed and has the lgtm label, please assign paulinakania for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[google-oss-prow]

Hi @ganochenkodg. Thanks for your PR.

I'm waiting for a GoogleCloudPlatform member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[ganochenkodg]

And here is a full list of possible language extractors:

Python:

• python/wheelegg
• python/requirements
• python/pipfilelock
• python/poetrylock
• python/setup
• python/pylock
• python/uvlock
• python/pdmlock
• python/condameta

JavaScript:

• javascript/packagejson
• javascript/packagelockjson
• javascript/yarnlock
• javascript/pnpmlock
• javascript/bunlock
• javascript/denojson
• javascript/denotssource

Java:

• java/archive
• java/pomxml
• java/gradlelockfile
• java/gradleverificationmetadataxml

Ruby:

• ruby/gemspec
• ruby/gemfilelock

Go:

• go/binary
• go/gomod

Rust:

• rust/cargolock
• rust/cargotoml
• rust/cargoauditable

PHP:

• php/composerlock

.NET / C#:

• dotnet/depsjson
• dotnet/packagesconfig
• dotnet/packageslockjson
• dotnet/csproj
• dotnet/nugetcpm

Swift / Objective-C:

• swift/podfilelock
• swift/packageresolved

Dart / Flutter:

• dart/pubspec

Elixir / Erlang:

• elixir/mixlock
• erlang/mixlock

C++:

• cpp/conanlock

Haskell:

• haskell/stacklock
• haskell/cabal

OCaml:

• ocaml/opam

Perl:

• perl/cpan

Lua:

• lua/luarocks

Julia:

• julia/projecttoml
• julia/manifesttoml

Nim:

• nim/nimble

R:

• r/renvlock

[ganochenkodg]

Recommended list of extractors for beginning:
"python/wheelegg"
"python/uvlock"
"ruby/gemspec"
"javascript/packagejson"
"java/archive"
"java/gradlelockfile"
"java/pomxml"
"go/binary"
"go/gomod"
"rust/cargolock"
"rust/cargoauditable"
"php/composerlock"
"swift/packageresolved"
"dart/pubspec"

[petercieslak]

Has the performance of the agent been tested with this set of extractors? What about other language extractors that can run on Linux but are not included (for example Java and Lua packages)? Moreover, I would focus on OS packages as mentioned before.

[petercieslak]

Has the performance of the agent been tested with this set of extractors? What about other language extractors that can run on Linux but are not included (for example Java and Lua packages)?

If yes - can you share the results and testing framework? If no, ideally we should test the agent performance before deciding which extractors we should introduce.

[burov]

/gcbrun