anchore / anchore/syft

Improve cataloging of Ruby Gems under development

Open
#2,128 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
23h 27m
Merged PRs (30d)
48

Description

**What would you like to be added**:

Running `syft` pointed at a directory that contains the source code of a Ruby gem should find that gem and its dependencies.

**Why is this needed**:

Syft's current Ruby catalogers, which focus on `Gemfile.lock` (directory cataloger) and `**/specifications/**/*.gemspec` in an image context. However, when running Syft on a directory that contains a checkout of the source of a gem, neither of these catalogers finds anything. (For example, running `git clone git@github.com:CanCanCommunity/cancancan.git && syft packages --catalogers all dir:cancancan` prints `No packages discovered`; it should instead print `cancancan` itself and its dependencies.)

**Additional context**:
https://yehudakatz.com/2010/12/16/clarifying-the-roles-of-the-gemspec-and-gemfile/ is a helpful post on understanding how working on a gem is different from having an installed gem and different from working on an application.

Thanks @mscottford for pointing out this issue!

Contributor guide

Open the contributing guide

Research direction

Start by reading Syft's existing Ruby catalogers for Gemfile.lock and specifications/**/*.gemspec, then reproduce the issue with the cancancan checkout and the provided syft command. Trace how directory cataloging discovers Ruby metadata and dependencies. Done means a gem source checkout reports the gem itself and its dependencies instead of "No packages discovered."

Written by the indexing model from the issue text.

Assessment

Tech stack
go, ruby
Domain
cli, devtools
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.