Improve cataloging of Ruby Gems under development
- Dominant language
- Go
- Stars
- 9.6k
- Forks
- 954
- Avg merge
- 23h 27m
- Merged PRs (30d)
- 48
Description
**What would you like to be added**:
Running `syft` pointed at a directory that contains the source code of a Ruby gem should find that gem and its dependencies.
**Why is this needed**:
Syft's current Ruby catalogers, which focus on `Gemfile.lock` (directory cataloger) and `**/specifications/**/*.gemspec` in an image context. However, when running Syft on a directory that contains a checkout of the source of a gem, neither of these catalogers finds anything. (For example, running `git clone git@github.com:CanCanCommunity/cancancan.git && syft packages --catalogers all dir:cancancan` prints `No packages discovered`; it should instead print `cancancan` itself and its dependencies.)
**Additional context**:
https://yehudakatz.com/2010/12/16/clarifying-the-roles-of-the-gemspec-and-gemfile/ is a helpful post on understanding how working on a gem is different from having an installed gem and different from working on an application.
Thanks @mscottford for pointing out this issue!
Contributor guide
Research direction
Start by reading Syft's existing Ruby catalogers for Gemfile.lock and specifications/**/*.gemspec, then reproduce the issue with the cancancan checkout and the provided syft command. Trace how directory cataloging discovers Ruby metadata and dependencies. Done means a gem source checkout reports the gem itself and its dependencies instead of "No packages discovered."
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, ruby
- Domain
- cli, devtools
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100