Add lua/rockspec cataloger

[LaurentGoderre]

No description provided.

[LaurentGoderre]

Depends on anchore/packageurl-go#18

[kzantow]

Sorry for the delay here, @LaurentGoderre. I left some feedback inline. I'll also note that this can be rebased to get rid of some duplicate changes from the packageurl lib upgrade. That said, one thing I'd like to make sure about is in fact, the luarock string in the packageurl that doesn't seem to match the notes in the spec types of just lua. EDIT: I see the discussion here about it, so luarock seems to be fine.

[kzantow]

Is it typical to find lua rockspec files in images (and "installed")?

[LaurentGoderre]

I don't know about typical but the image that prompted this changed (Kong DOI) has them.

[wagoodman]

Indeed it does

root@9568d1a22c40:/# find / | grep rockspec | grep cjson
root@9568d1a22c40:/# luarocks install lua-cjson

Installing https://luarocks.org/lua-cjson-2.1.0.10-1.src.rock
lua-cjson 2.1.0.10-1 depends on lua >= 5.1 (5.4-1 provided by VM: success)
gcc -O2 -fPIC -I/usr/local/include -c lua_cjson.c -o lua_cjson.o
gcc -O2 -fPIC -I/usr/local/include -c strbuf.c -o strbuf.o
gcc -O2 -fPIC -I/usr/local/include -c fpconv.c -o fpconv.o
gcc  -shared -o /tmp/luarocks_build-lua-cjson-2.1.0.10-1-2704986/cjson.so lua_cjson.o strbuf.o fpconv.o
lua-cjson 2.1.0.10-1 is now installed in /usr/local (license: MIT)

root@9568d1a22c40:/# find / | grep rockspec | grep cjson
/usr/local/lib/luarocks/rocks-5.4/lua-cjson/2.1.0.10-1/lua-cjson-2.1.0.10-1.rockspec

I don't know if it's actively needed at runtime or if it is metadata that could be scrubbed and the lib still used. But the luarocks install command will leave rockspecs behind 👍 .

[kzantow]

Thanks @LaurentGoderre -- there are a few more spots I think we need guards to protect against malformed input causing panics, basically after every SkipWhitespace, it's possible that malformed input could result in a panic. I think I've noted each of the spots this could happen. Other than those small changes, this looks great! 👍

[kzantow]

it would be nice if these tests were asserting a specific return structure instead of just asserting that they don't result in errors. this could help when expanding the parser, but don't consider it blocking since I know there's a follow-on enhancement you have planned here, it could be done then.

[LaurentGoderre]

@kzantow done!

[kzantow]

LGTM thanks for the contribution @LaurentGoderre ! 🎉