Merge pull request #2 from paketo-buildpacks/main

Merge from upstream

.github/labels.yml

@@ -0,0 +1,18 @@
+- name: status/possible-priority
+  description: This issue is ready to work and should be considered as a potential priority
+  color: F9D0C4
+- name: status/prioritized
+  description: This issue has been triaged and resolving it is a priority
+  color: BFD4F2
+- name: status/blocked
+  description: This issue has been triaged and resolving it is blocked on some other issue
+  color: 848978
+- name: bug
+  description: Something isn't working
+  color: d73a4a
+- name: enhancement
+  description: A new feature or request
+  color: a2eeef
+- name: documentation
+  description: This issue relates to writing documentation
+  color: D4C5F9

.github/workflows/synchronize-labels.yml

@@ -0,0 +1,17 @@
+name: Synchronize Labels
+"on":
+    push:
+        branches:
+            - main
+        paths:
+            - .github/labels.yml
+jobs:
+    synchronize:
+        name: Synchronize Labels
+        runs-on:
+            - ubuntu-latest
+        steps:
+            - uses: actions/checkout@v2
+            - uses: micnncim/action-label-syncer@v1
+              env:
+                GITHUB_TOKEN: ${{ github.token }}

cargo/jam/internal/image.go

@@ -45,6 +45,9 @@ func FindLatestImage(uri string) (Image, error) {
 		if err != nil {
 			continue
 		}
+		if version.Prerelease() != "" {
+			continue
+		}
 
 		versions = append(versions, version)
 	}

cargo/jam/internal/image_test.go

@@ -44,7 +44,8 @@ func testImage(t *testing.T, context spec.G, it spec.S) {
 								"0.20.1",
 								"0.20.12",
 								"999999",
-								"latest"
+								"latest",
+								"0.20.13-rc1"
 							]
 					}`)
 
@@ -80,7 +81,7 @@ func testImage(t *testing.T, context spec.G, it spec.S) {
 			Expect(os.RemoveAll(dockerConfig)).To(Succeed())
 		})
 
-		it("returns the latest semver tag for the given image uri", func() {
+		it("returns the latest non-prerelease semver tag for the given image uri", func() {
 			image, err := internal.FindLatestImage(fmt.Sprintf("%s/some-org/some-repo:latest", strings.TrimPrefix(server.URL, "http://")))
 			Expect(err).NotTo(HaveOccurred())
 			Expect(image).To(Equal(internal.Image{

go.mod

@@ -1,6 +1,6 @@
 module github.com/paketo-buildpacks/packit
 
-go 1.13
+go 1.16
 
 require (
 	github.com/BurntSushi/toml v0.3.1
@@ -12,7 +12,7 @@ require (
 	github.com/google/go-containerregistry v0.4.1
 	github.com/mattn/go-runewidth v0.0.8 // indirect
 	github.com/onsi/gomega v1.11.0
-	github.com/pelletier/go-toml v1.8.1
+	github.com/pelletier/go-toml v1.9.0
 	github.com/sclevine/spec v1.4.0
 	github.com/spf13/cobra v1.1.3
 	github.com/ulikunitz/xz v0.5.10

go.sum

@@ -69,7 +69,6 @@ github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfc
 github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
@@ -142,7 +141,6 @@ github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrU
 github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
 github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
 github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.3 h1:JjCZWpVbqXDqFVmTfYWEVTMIYrL/NPdPSCHPJ0T/raM=
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
@@ -277,8 +275,8 @@ github.com/opencontainers/image-spec v1.0.1 h1:JMemWkRwHx4Zj+fVxWoMCFm/8sYGGrUVo
 github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
-github.com/pelletier/go-toml v1.8.1 h1:1Nf83orprkJyknT6h7zbuEGUEjcyVlCxSUGTENmNCRM=
-github.com/pelletier/go-toml v1.8.1/go.mod h1:T2/BmBdy8dvIRq1a/8aqjN41wvWlN4lrapLU/GW4pbc=
+github.com/pelletier/go-toml v1.9.0 h1:NOd0BRdOKpPf0SxkL3HxSQOG7rNh+4kl6PHcBPFs7Q0=
+github.com/pelletier/go-toml v1.9.0/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -576,7 +574,6 @@ google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzi
 google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.24.0 h1:UhZDfRO8JRQru4/+LlLE0BRKGF8L+PICnvYZmx/fEGA=
 google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

postal/buildpack.go

@@ -16,15 +16,9 @@ type Dependency struct {
 	// ID is the identifier used to specify the dependency.
 	ID string `toml:"id"`
 
-	// Version is the specific version of the dependency.
-	Version string `toml:"version"`
-
 	// Name is the human-readable name of the dependency.
 	Name string `toml:"name"`
 
-	// URI is the uri location of the built dependency.
-	URI string `toml:"uri"`
-
 	// SHA256 is the hex-encoded SHA256 checksum of the built dependency.
 	SHA256 string `toml:"sha256"`
 
@@ -36,6 +30,12 @@ type Dependency struct {
 
 	// Stacks is a list of stacks for which the dependency is built.
 	Stacks []string `toml:"stacks"`
+
+	// URI is the uri location of the built dependency.
+	URI string `toml:"uri"`
+
+	// Version is the specific version of the dependency.
+	Version string `toml:"version"`
 }
 
 func parseBuildpack(path, name string) ([]Dependency, string, error) {

postal/service.go

@@ -7,8 +7,10 @@ import (
 	"regexp"
 	"sort"
 	"strings"
+	"time"
 
 	"github.com/Masterminds/semver/v3"
+	"github.com/paketo-buildpacks/packit"
 	"github.com/paketo-buildpacks/packit/cargo"
 	"github.com/paketo-buildpacks/packit/postal/internal"
 	"github.com/paketo-buildpacks/packit/vacation"
@@ -177,3 +179,28 @@ func (s Service) Deliver(dependency Dependency, cnbPath, layerPath, platformPath
 func (s Service) Install(dependency Dependency, cnbPath, layerPath string) error {
 	return s.Deliver(dependency, cnbPath, layerPath, "/platform")
 }
+
+// GenerateBillOfMaterials will generate a list of BOMEntry values given a
+// collection of Dependency values.
+func (s Service) GenerateBillOfMaterials(dependencies ...Dependency) []packit.BOMEntry {
+	var entries []packit.BOMEntry
+	for _, dependency := range dependencies {
+		entry := packit.BOMEntry{
+			Name: dependency.Name,
+			Metadata: map[string]interface{}{
+				"sha256":  dependency.SHA256,
+				"stacks":  dependency.Stacks,
+				"uri":     dependency.URI,
+				"version": dependency.Version,
+			},
+		}
+
+		if (dependency.DeprecationDate != time.Time{}) {
+			entry.Metadata["deprecation-date"] = dependency.DeprecationDate
+		}
+
+		entries = append(entries, entry)
+	}
+
+	return entries
+}

postal/service_test.go

@@ -14,6 +14,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/paketo-buildpacks/packit"
 	"github.com/paketo-buildpacks/packit/postal"
 	"github.com/paketo-buildpacks/packit/postal/fakes"
 	"github.com/sclevine/spec"
@@ -38,7 +39,6 @@ func testService(t *testing.T, context spec.G, it spec.S) {
 		Expect(err).NotTo(HaveOccurred())
 
 		path = file.Name()
-
 		_, err = file.WriteString(`
 [[metadata.dependencies]]
 deprecation_date = 2022-04-01T00:00:00Z
@@ -450,7 +450,8 @@ version = "this is super not semver"
 
 			context("when the file contents are empty", func() {
 				it.Before(func() {
-					buffer := bytes.NewBuffer(nil)
+					// This is a FLAC header
+					buffer := bytes.NewBuffer([]byte("\x66\x4C\x61\x43\x00\x00\x00\x22"))
 					transport.DropCall.Returns.ReadCloser = io.NopCloser(buffer)
 
 					sum := sha256.Sum256(buffer.Bytes())
@@ -703,7 +704,8 @@ version = "this is super not semver"
 
 			context("when the file contents are empty", func() {
 				it.Before(func() {
-					buffer := bytes.NewBuffer(nil)
+					// This is a FLAC header
+					buffer := bytes.NewBuffer([]byte("\x66\x4C\x61\x43\x00\x00\x00\x22"))
 					transport.DropCall.Returns.ReadCloser = io.NopCloser(buffer)
 
 					sum := sha256.Sum256(buffer.Bytes())
@@ -821,4 +823,59 @@ version = "this is super not semver"
 			})
 		})
 	})
+
+	context("GenerateBillOfMaterials", func() {
+		var deprecationDate time.Time
+
+		it.Before(func() {
+			var err error
+			deprecationDate, err = time.Parse(time.RFC3339, "2022-04-01T00:00:00Z")
+			Expect(err).NotTo(HaveOccurred())
+		})
+
+		it("returns a list of BOMEntry values", func() {
+			entries := service.GenerateBillOfMaterials(
+				postal.Dependency{
+					DeprecationDate: deprecationDate,
+					ID:              "some-entry",
+					Name:            "Some Entry",
+					SHA256:          "some-sha",
+					Source:          "some-source",
+					Stacks:          []string{"some-stack"},
+					URI:             "some-uri",
+					Version:         "1.2.3",
+				},
+				postal.Dependency{
+					ID:      "other-entry",
+					Name:    "Other Entry",
+					SHA256:  "other-sha",
+					Source:  "other-source",
+					Stacks:  []string{"other-stack"},
+					URI:     "other-uri",
+					Version: "4.5.6",
+				},
+			)
+			Expect(entries).To(Equal([]packit.BOMEntry{
+				{
+					Name: "Some Entry",
+					Metadata: map[string]interface{}{
+						"deprecation-date": deprecationDate,
+						"sha256":           "some-sha",
+						"stacks":           []string{"some-stack"},
+						"uri":              "some-uri",
+						"version":          "1.2.3",
+					},
+				},
+				{
+					Name: "Other Entry",
+					Metadata: map[string]interface{}{
+						"sha256":  "other-sha",
+						"stacks":  []string{"other-stack"},
+						"uri":     "other-uri",
+						"version": "4.5.6",
+					},
+				},
+			}))
+		})
+	})
 }

vacation/init_test.go

@@ -13,6 +13,7 @@ func TestVacation(t *testing.T) {
 	suite("VacationTar", testVacationTar)
 	suite("VacationTarGzip", testVacationTarGzip)
 	suite("VacationTarXZ", testVacationTarXZ)
+	suite("VacationText", testVacationText)
 	suite("VacationZip", testVacationZip)
 	suite.Run(t)
 }

vacation/vacation.go

@@ -141,7 +141,6 @@ func (ta TarArchive) Decompress(destination string) error {
 			if err != nil {
 				return fmt.Errorf("failed to extract symlink: %s", err)
 			}
-
 		}
 	}
 
@@ -150,6 +149,10 @@ func (ta TarArchive) Decompress(destination string) error {
 
 // Decompress reads from Archive, determines the archive type of the input
 // stream, and writes files into the destination specified.
+//
+// Archive decompression will also handle files that are types "text/plain;
+// charset=utf-8" and write the contents of the input stream to a file name
+// "artifact" in the destination directory.
 func (a Archive) Decompress(destination string) error {
 	// Convert reader into a buffered read so that the header can be peeked to
 	// determine the type.
@@ -176,6 +179,10 @@ func (a Archive) Decompress(destination string) error {
 		return NewTarXZArchive(bufferedReader).StripComponents(a.components).Decompress(destination)
 	case "application/zip":
 		return NewZipArchive(bufferedReader).Decompress(destination)
+	case "text/plain; charset=utf-8":
+		// This function will write the contents of the reader to file called
+		// "artifact" in the destination directory
+		return writeTextFile(bufferedReader, destination)
 	default:
 		return fmt.Errorf("unsupported archive type: %s", mime.String())
 	}
@@ -203,6 +210,20 @@ func (txz TarXZArchive) Decompress(destination string) error {
 	return NewTarArchive(xzr).StripComponents(txz.components).Decompress(destination)
 }
 
+func writeTextFile(reader io.Reader, destination string) error {
+	file, err := os.Create(filepath.Join(destination, "artifact"))
+	if err != nil {
+		panic(err)
+	}
+
+	_, err = io.Copy(file, reader)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
 // StripComponents behaves like the --strip-components flag on tar command
 // removing the first n levels from the final decompression destination.
 // Setting this is a no-op for archive types that do not use --strip-components

vacation/vacation_archive_test.go

@@ -264,7 +264,8 @@ func testVacationArchive(t *testing.T, context spec.G, it spec.S) {
 					tempDir, err = os.MkdirTemp("", "vacation")
 					Expect(err).NotTo(HaveOccurred())
 
-					buffer := bytes.NewBuffer([]byte(`some contents`))
+					// This is a FLAC header
+					buffer := bytes.NewBuffer([]byte("\x66\x4C\x61\x43\x00\x00\x00\x22"))
 
 					archive = vacation.NewArchive(buffer)
 				})