Merge pull request #590 from chainguard-dev/feature/sca-pkgconf

build: package: add pkgconf-based SCA to catalog SDKs which use it

go.mod

@@ -6,6 +6,7 @@ require (
 	chainguard.dev/apko v0.9.1-0.20230711074042-37b82f3a5bd8
 	cloud.google.com/go/storage v1.31.0
 	github.com/chainguard-dev/go-apk v0.0.0-20230710230135-7fc46e8b3c4d
+	github.com/chainguard-dev/go-pkgconfig v0.0.0-20230805235849-9bda3971e4cb
 	github.com/chainguard-dev/kontext v0.1.0
 	github.com/chainguard-dev/yam v0.0.0-20230411155911-ba3a3357c32e
 	github.com/docker/docker v24.0.5+incompatible

go.sum

@@ -80,6 +80,8 @@ github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL
 github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
 github.com/chainguard-dev/go-apk v0.0.0-20230710230135-7fc46e8b3c4d h1:FiATZeiXcC0fq/604scYNZteOnEteWQhvqFZsOhSr6Y=
 github.com/chainguard-dev/go-apk v0.0.0-20230710230135-7fc46e8b3c4d/go.mod h1:woT/bFOpXAUI8PgmogdS4IPPwdNdfhg8XnNQeA+R7j8=
+github.com/chainguard-dev/go-pkgconfig v0.0.0-20230805235849-9bda3971e4cb h1:lKz/2jUE8VOXjg3Z+CctAMtpDcvIHALNR9Jv+9eSgUU=
+github.com/chainguard-dev/go-pkgconfig v0.0.0-20230805235849-9bda3971e4cb/go.mod h1:obzGv2cx3tkRgkLQADSPaRl3OEsYmyfSv7t2Wu60tZw=
 github.com/chainguard-dev/kontext v0.1.0 h1:GFnDRZiqa+anUi7tzZMECXr0nwt4Eo/zMzTQPLRXUIs=
 github.com/chainguard-dev/kontext v0.1.0/go.mod h1:hdyG5Sia0niCW8HN8MDXcDh/nL0sgcWQYSjPRFZOX/w=
 github.com/chainguard-dev/yam v0.0.0-20230411155911-ba3a3357c32e h1:TlpfdSUjQkrq2yh+bySzoOmPKspeaxmOr1fmsNCfNXM=

pkg/build/package.go

@@ -28,10 +28,12 @@ import (
 	"io/fs"
 	"os"
 	"path/filepath"
+	"regexp"
 	"sort"
 	"strings"
 	"text/template"
 
+	"github.com/chainguard-dev/go-pkgconfig"
 	"github.com/klauspost/compress/gzip"
 	"github.com/klauspost/pgzip"
 
@@ -563,6 +565,63 @@ func generateSharedObjectNameDeps(pc *PackageBuild, generated *config.Dependenci
 	return nil
 }
 
+var pkgConfigVersionRegexp = regexp.MustCompile("-(alpha|beta|rc|pre)")
+
+// TODO(kaniini): Turn this feature on once enough of Wolfi is built with provider data.
+var generateRuntimePkgConfigDeps = false
+
+// generatePkgConfigDeps generates a list of provided pkg-config package names and versions,
+// as well as dependency relationships.
+func generatePkgConfigDeps(pc *PackageBuild, generated *config.Dependencies) error {
+	pc.Logger.Printf("scanning for pkg-config data...")
+
+	fsys := readlinkFS(pc.WorkspaceSubdir())
+	if err := fs.WalkDir(fsys, ".", func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+
+		if !strings.Contains(path, ".pc") {
+			return nil
+		}
+
+		pkg, err := pkgconfig.Load(filepath.Join(pc.WorkspaceSubdir(), path))
+		if err != nil {
+			return err
+		}
+
+		pcName := filepath.Base(path)
+		pcName, _ = strings.CutSuffix(pcName, ".pc")
+
+		apkVersion := pkgConfigVersionRegexp.ReplaceAllString(pkg.Version, "_$1")
+		if !pc.Options.NoProvides {
+			generated.Provides = append(generated.Provides, fmt.Sprintf("pc:%s=%s", pcName, apkVersion))
+		}
+
+		if generateRuntimePkgConfigDeps {
+			// TODO(kaniini): Capture version relationships here too.  In practice, this does not matter
+			// so much though for us.
+			for _, dep := range pkg.Requires {
+				generated.Runtime = append(generated.Runtime, fmt.Sprintf("pc:%s", dep.Identifier))
+			}
+
+			for _, dep := range pkg.RequiresPrivate {
+				generated.Runtime = append(generated.Runtime, fmt.Sprintf("pc:%s", dep.Identifier))
+			}
+
+			for _, dep := range pkg.RequiresInternal {
+				generated.Runtime = append(generated.Runtime, fmt.Sprintf("pc:%s", dep.Identifier))
+			}
+		}
+
+		return nil
+	}); err != nil {
+		return err
+	}
+
+	return nil
+}
+
 // removeSelfProvidedDeps removes dependencies which are provided by the package itself.
 func removeSelfProvidedDeps(runtimeDeps, providedDeps []string) []string {
 	providedDepsMap := map[string]bool{}
@@ -590,6 +649,7 @@ func (pc *PackageBuild) GenerateDependencies() error {
 	generators := []DependencyGenerator{
 		generateSharedObjectNameDeps,
 		generateCmdProviders,
+		generatePkgConfigDeps,
 	}
 
 	for _, gen := range generators {