use Syft for decoding CPEs

cmd/grype/cli/commands/root.go

@@ -67,6 +67,7 @@ You can also explicitly specify the scheme to use:
     {{.appName}} registry:yourrepo/yourimage:tag        pull image directly from a registry (no container runtime required)
     {{.appName}} purl:path/to/purl/file                 read a newline separated file of package URLs from a path on disk
     {{.appName}} PURL                                   read a single package PURL directly (e.g. pkg:apk/[email protected]?distro=alpine-3.20.3)
+    {{.appName}} cpes:path/to/cpes/file                 read a newline separated file of package CPEs from a path on disk
     {{.appName}} CPE                                    read a single CPE directly (e.g. cpe:2.3:a:openssl:openssl:3.0.14:*:*:*:*:*)
 
 You can also pipe in Syft JSON directly:

grype/pkg/cpe_provider.go

@@ -1,31 +1,34 @@
 package pkg
 
 import (
-	"bufio"
 	"fmt"
 	"io"
 	"strings"
 
-	"github.com/anchore/grype/grype/internal"
-	"github.com/anchore/syft/syft/cpe"
-	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/format"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 )
 
 const cpeInputPrefix = "cpe:"
+const cpeListPrefix = "cpes:"
 
 type CPELiteralMetadata struct {
 	CPE string
 }
 
-func cpeProvider(userInput string) ([]Package, Context, *sbom.SBOM, error) {
+func cpeProvider(userInput string, config ProviderConfig) ([]Package, Context, *sbom.SBOM, error) {
 	reader, ctx, err := getCPEReader(userInput)
 	if err != nil {
 		return nil, Context{}, nil, err
 	}
 
-	return decodeCPEsFromReader(reader, ctx)
+	s, _, _, err := format.Decode(reader)
+	if s == nil {
+		return nil, Context{}, nil, fmt.Errorf("unable to decode cpe: %w", err)
+	}
+
+	return FromCollection(s.Artifacts.Packages, config.SynthesisConfig), ctx, s, nil
 }
 
 func getCPEReader(userInput string) (r io.Reader, ctx Context, err error) {
@@ -39,61 +42,3 @@ func getCPEReader(userInput string) (r io.Reader, ctx Context, err error) {
 	}
 	return nil, ctx, errDoesNotProvide
 }
-
-func decodeCPEsFromReader(reader io.Reader, ctx Context) ([]Package, Context, *sbom.SBOM, error) {
-	scanner := bufio.NewScanner(reader)
-	var packages []Package
-	var syftPkgs []pkg.Package
-
-	for scanner.Scan() {
-		rawLine := scanner.Text()
-		p, syftPkg, err := cpeToPackage(rawLine)
-		if err != nil {
-			return nil, Context{}, nil, err
-		}
-
-		if p != nil {
-			packages = append(packages, *p)
-		}
-		if syftPkg != nil {
-			syftPkgs = append(syftPkgs, *syftPkg)
-		}
-	}
-
-	if err := scanner.Err(); err != nil {
-		return nil, Context{}, nil, err
-	}
-
-	s := &sbom.SBOM{
-		Artifacts: sbom.Artifacts{
-			Packages: pkg.NewCollection(syftPkgs...),
-		},
-	}
-
-	return packages, ctx, s, nil
-}
-
-func cpeToPackage(rawLine string) (*Package, *pkg.Package, error) {
-	c, err := cpe.New(rawLine, "")
-	if err != nil {
-		return nil, nil, fmt.Errorf("unable to decode cpe %q: %w", rawLine, err)
-	}
-
-	syftPkg := pkg.Package{
-		Name:    c.Attributes.Product,
-		Version: c.Attributes.Version,
-		CPEs:    []cpe.CPE{c},
-		Type:    internal.CPETargetSoftwareToPackageType(c.Attributes.TargetSW),
-	}
-
-	syftPkg.SetID()
-
-	return &Package{
-		ID:       ID(c.Attributes.BindToFmtString()),
-		CPEs:     syftPkg.CPEs,
-		Name:     syftPkg.Name,
-		Version:  syftPkg.Version,
-		Type:     syftPkg.Type,
-		Language: syftPkg.Language,
-	}, &syftPkg, nil
-}

grype/pkg/provider.go

@@ -141,9 +141,9 @@ func provide(userInput string, config ProviderConfig, applyChannel func(d *distr
 		return packages, ctx, s, err
 	}
 
-	packages, ctx, s, err = cpeProvider(userInput)
+	packages, ctx, s, err = cpeProvider(userInput, config)
 	if !errors.Is(err, errDoesNotProvide) {
-		log.WithFields("input", userInput).Trace("interpreting input as a CPE")
+		log.WithFields("input", userInput).Trace("interpreting input as a one or more CPEs")
 		return packages, ctx, s, err
 	}
 

grype/pkg/syft_sbom_provider.go

@@ -90,6 +90,10 @@ func getSBOMReader(userInput string) (io.ReadSeeker, string, error) {
 		filepath := strings.TrimPrefix(userInput, purlInputPrefix)
 		return openFile(filepath)
 
+	case explicitlySpecifyingCPEList(userInput):
+		filepath := strings.TrimPrefix(userInput, cpeListPrefix)
+		return openFile(filepath)
+
 	case explicitlySpecifyingSBOM(userInput):
 		filepath := strings.TrimPrefix(userInput, "sbom:")
 		return openFile(filepath)
@@ -177,3 +181,7 @@ func explicitlySpecifyingSBOM(userInput string) bool {
 func explicitlySpecifyingPurlList(userInput string) bool {
 	return strings.HasPrefix(userInput, purlInputPrefix)
 }
+
+func explicitlySpecifyingCPEList(userInput string) bool {
+	return strings.HasPrefix(userInput, cpeListPrefix)
+}