Can analyse package_source to find add_sbom for vendored builds

go.mod

@@ -23,7 +23,6 @@ require (
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/package-url/packageurl-go v0.1.6 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect

internal/gardenlinux/repos/meta.go

@@ -30,6 +30,8 @@ type RepositoryMetadata struct {
 	UpstreamPatches bool `json:"upstream_patches"` // applys upstream_patches via import_upstream_patches
 	DebianPatches   bool `json:"debian_patches"`   // applys patches for debian, when apply_patches with directory "debian"
 	GlPatches       bool `json:"gl_patches"`       // applys custom patches, usually via apply_patches
+
+	VendoredPackage bool `json:"vendored_package"` // Is a vendored build and provides a package sbom
 }
 
 type FileContent struct {
@@ -266,6 +268,10 @@ func analyzePrepareSource(content string, queryData RepositoryMetadata) (*Reposi
 			}
 			continue
 		}
+
+		if strings.Contains(line, "add_sbom") {
+			metadata.VendoredPackage = true
+		}
 	}
 	return &metadata, nil
 }

internal/gardenlinux/repos/meta_test.go

@@ -219,6 +219,78 @@ rm -rf "$workdir"`
 	assert.False(t, metadata.UpstreamPatches)
 }
 
+func TestAddSbom(t *testing.T) {
+	t.Parallel()
+
+	//nolint:lll // source output
+	prepareSource := `version_orig=20260522.00
+plugin_manager_commit=c98709762f0de7e6b9fda26ec4dbd9dd3c43237a
+
+plugin_manager_workdir="$(mktemp -d)"
+
+git clone --depth=1 --revision="$plugin_manager_commit" https://github.com/GoogleCloudPlatform/google-guest-agent.git "$plugin_manager_workdir"
+rm -rf "$plugin_manager_workdir/.git"
+
+
+# Clone upstream repository
+workdir="$(mktemp -d)"
+
+git clone --depth 1 --recurse-submodules --branch "${version_orig}" https://github.com/GoogleCloudPlatform/guest-agent.git "$workdir"
+
+pushd "$workdir"
+
+# Fix upstream Debian package definition
+mv ./packaging/debian ./
+
+latest_commit_message="$(git log -1 --pretty="format:%s" ./google_guest_agent)"
+latest_commit_datetime="$(git log -1 --pretty="format:%aD" ./google_guest_agent)"
+
+tee ./debian/changelog << EOF
+google-guest-agent (1:${version_orig}) stable; urgency=medium
+
+  * $latest_commit_message
+  * Detailed changelog can be found at https://github.com/GoogleCloudPlatform/guest-agent/commits/${version_orig}
+
+ -- $maintainer <$email>  $latest_commit_datetime
+EOF
+
+echo "3.0 (native)" > ./debian/source/format
+
+cp -r -T "$plugin_manager_workdir" google-guest-agent
+
+# Cleanup
+rm -rf ./.git
+rm -rf ./packaging
+
+popd
+
+# Import modified upstream source distribution
+import_src "$workdir"
+
+add_sbom "$dir/src" "" "google-guest-agent" "$version_orig"
+
+rm -rf "$workdir"`
+
+	var metadata *repos.RepositoryMetadata
+	queryData := repos.RepositoryMetadata{
+		Repository: "package-google-guest-agent",
+		Branch:     "mybranch",
+		CommitId:   "12345d",
+	}
+	metadata, err := repos.AnalyzePrepareSource(prepareSource, queryData)
+	require.NoError(t, err)
+
+	assert.False(t, metadata.AptSrc)
+	assert.False(t, metadata.DebianSrc)
+	assert.False(t, metadata.SalsaSrc)
+	assert.True(t, metadata.UpstreamSrc)
+
+	assert.False(t, metadata.DebianPatches)
+	assert.False(t, metadata.GlPatches)
+	assert.False(t, metadata.UpstreamPatches)
+	assert.True(t, metadata.VendoredPackage)
+}
+
 func TestGetPackageNameFromBranch(t *testing.T) {
 	t.Parallel()
 

mise.toml

@@ -6,10 +6,10 @@ go = "1.26"
 "github:sqlc-dev/sqlc" = "latest"
 "aqua:golang-migrate/migrate" = "4.19.1"
 "aqua:golangci/golangci-lint" = "2.13.2"
-"aqua:gotestyourself/gotestsum" = "latest"
 syft = "latest"
 gofumpt = "latest"
 taplo = "latest"                           # TOML formatting
+gotestsum = "latest"
 
 [tasks."fmt:toml"]
 description = "Format all TOML files using taplo"