Conda ecosystem support

[rigzba21]

Hi all!

What would you like to be added:
Conda ecosystem (language agnostic) support

Why is this needed:
The conda ecosystem provides an amazing way to work with dependencies in terms of environments and is used heavily in the Data Science and Scientific Computing communities.

Additional context:
I'm happy to submit a PR for this feature/capability and looking forward to diving into the syft src!

[rigzba21]

I'll be opening a Draft PR when I have more done in my syft fork for conda support

[spiffcs]

Thanks @rigzba21 for the attention here!

Admittedly I don't have a lot of experience with the Conda ecosystem, but I'm excited to see the PR and learn more about the different constructs a cataloger might have to interact with to provide support.

Feel free to tag the tools team on the PR and we can help with getting the builds kicked off for CI. I've also tentatively added this as a topic to our next community meeting on April 14th so we have a forum to talk more about it as the feature is developed.

Link to the community meeting where we discuss new ideas/features for syft/grype:
https://anchorecommunity.slack.com/archives/C4PJFNEEM/p1648734651797149

[westonsteimel]

Yep, thanks @rigzba21, I had thought a bit about trying this before but never got around to it. One thing that will be interesting here is syft already identifies packages installed by conda as pip packages because they end up with the same METADATA entries per https://github.com/anchore/syft/blob/main/syft/pkg/cataloger/python/parse_wheel_egg_metadata.go. There is extra json for conda installed stuff that isn't taken into account though. Anyways, ths one will definitely be interesting and a great addition I think!

[rigzba21]

@spiffcs, I've joined the Slack channel and added the community meeting to my calendar. @westonsteimel, thank you for pointing me to a good starting point!

[rigzba21]

Closing my old draft PR which attempted to add a separate conda cataloger, in favor of the smaller-scoped work of extending the python cataloger as discussed in the last community meeting notes

Conda Support

• extend the python cataloger to include conda-meta/*.json files

[ssthom]

Is Conda support still being looked at? In our images we have Syft only finding openssl that the base image had installed and not the one in the Conda custom environment

spark@1838268b8f44:/usr/src/app$ /customenv/bin/openssl version
OpenSSL 3.0.5 5 Jul 2022 (Library: OpenSSL 3.0.5 5 Jul 2022)
spark@1838268b8f44:/usr/src/app$ apt list openssl
Listing... Done
openssl/stable,stable-security,now 1.1.1n-0+deb11u3 amd64 [installed,automatic]
spark@1838268b8f44:/usr/src/app$

Syft only finds:

openssl                                                         1.1.1n-0+deb11u3                           deb

[rigzba21]

Is Conda support still being looked at?

While I'd love to keep working on this (admittedly, I have not looked at this in a while), I don't currently have the time to focus on this.