Updating Syft and Grype formulas

[kzantow]

Output of brew config

HEAD: d4444b563e24ac7c05a93121c464c02dfa04d44f
Last commit: 5 days ago
Core tap JSON: 01 Sep 13:36 UTC
HOMEBREW_PREFIX: /usr/local
HOMEBREW_CASK_OPTS: []
HOMEBREW_MAKE_JOBS: 12
Homebrew Ruby: 2.6.10 => /System/Library/Frameworks/Ruby.framework/Versions/2.6/usr/bin/ruby
CPU: dodeca-core 64-bit kabylake
Clang: 14.0.0 build 1400
Git: 2.37.1 => /Applications/Xcode.app/Contents/Developer/usr/bin/git
Curl: 7.87.0 => /usr/bin/curl
macOS: 12.6.7-x86_64
CLT: 14.2.0.0.1.1668646533
Xcode: 14.2

Output of brew doctor

Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

Warning: Some installed formulae are deprecated or disabled.
You should find replacements for the following formulae:
  [email protected]

Warning: Unbrewed header files were found in /usr/local/include.
If you didn't put them there on purpose they could cause problems when
building Homebrew formulae, and may need to be deleted.

Unexpected header files:
  /usr/local/include/node/cppgc/common.h
  ... lots more header files, which I don't think are relevant to the question

Warning: Homebrew's "sbin" was not found in your PATH but you have installed
formulae that put executables in /usr/local/sbin.
Consider setting your PATH for example like so:
  echo 'export PATH="/usr/local/sbin:$PATH"' >> ~/.zshrc

Description of issue

First of all -- thank you for including Syft and Grype in the main Homebrew, it is very much appreciated!

I noticed that not all the build flags are being set (as opposed to what's in our build process) and a couple have different values than we use when creating our own binaries. For example, the syft version output from the latest brew release is:

Application:     syft
Version:         0.89.0
BuildDate:       2023-08-31T14:50:32Z
GitCommit:       Homebrew
GitDescription:  [not provided]
Platform:        darwin/amd64
GoVersion:       go1.21.0
Compiler:        gc

whereas the Syft binary we release has different build flags, which include more/different information:

Application:     syft
Version:         0.89.0
BuildDate:       2023-08-31T15:38:42Z
GitCommit:       b454160549bbd199e0a5693750856f30b41767f7
GitDescription:  v0.89.0
Platform:        darwin/amd64
GoVersion:       go1.20.7
Compiler:        gc

The main differences of consequence:

• GitCommit is set to Homebrew (in grype this is brew)
• GitDescription (git tag name) is unset

Is there a way to add/update this information?

I am unfamiliar with writing formulae, and couldn't find any documentation if some of these variables might happen to be available. I suspect there isn't a git checkout because it looks like the code is downloaded as a .tar.gz from the github release, so as it's written perhaps this information isn't available. If that's the case, would this be available if the code is checked out from git like this?

url "https://github.com/anchore/syft.git",
      tag:      "v0.89.0",
      revision: "b454160549bbd199e0a5693750856f30b41767f7"

I'm also a bit unclear how this formula gets updated, I suspect there's something automated that does it, but I couldn't find this with a cursory search. I suspect if there were changes, this automation would also need to get updated?

I would be happy to make pull requests for this if someone would be able to help me understand what changes to make!

[ZhongRuoyu]

I am unfamiliar with writing formulae, and couldn't find any documentation if some of these variables might happen to be available.

General guidance for writing formulae can be found at https://docs.brew.sh/Formula-Cookbook. Not every piece of information is available there, though.

If that's the case, would this be available if the code is checked out from git like this?

Yes, it would be accessible through Utils.git_head. See, for instance, docker-buildx.rb:

    ldflags = %W[
      -s -w
      -X github.com/docker/buildx/version.Version=v#{version}
      -X github.com/docker/buildx/version.Revision=#{Utils.git_head}
    ]

    system "go", "build", *std_go_args(ldflags: ldflags), "./cmd/buildx"

I suspect there isn't a git checkout because it looks like the code is downloaded as a .tar.gz from the github release

Usually, tarball downloads are preferred over git clones, because the former is more efficient. However, we're fine with git clones if the necessity is justified.

I'm also a bit unclear how this formula gets updated, I suspect there's something automated that does it, but I couldn't find this with a cursory search.

By "something automated" you may be referring to brew bump-formula-pr, which does simple version bumps. However, for general formula-related pull requests, please check out https://docs.brew.sh/How-To-Open-a-Homebrew-Pull-Request#formulae-related-pull-request.

I suspect if there were changes, this automation would also need to get updated?

Modifications like that would not affect brew bump-formula-pr.