composer.json isn't parsed for packages

[cpendery]

What happened:
Syft isn't detecting any packages when given file:composer.json

What you expected to happen:
It should be able to index those packages since it's listed in the Syft supported languages

How to reproduce it (as minimally and precisely as possible):
Clone this repo and run Syft on it

Anything else we need to know?:
Found by @josecoimbra in anchore/grype#797

Environment:

• Output of syft version: 48.1
• OS (e.g: cat /etc/os-release or similar):

System Version: macOS 11.6 (20G165)
Kernel Version: Darwin 20.6.0
Model Name: MacBook Pro
Model Identifier: MacBookPro16,1
Processor Name: 6-Core Intel Core i7

[cpendery]

Happy to add a cataloger for composer.json files to https://github.com/anchore/syft/blob/main/syft/pkg/cataloger/cataloger.go#L80

[spiffcs]

Thanks @cpendery! If you want to add this support go ahead. Really appreciate you filling out syft's support for more things.

[josecoimbra]

Happy to add a cataloger for composer.json files to https://github.com/anchore/syft/blob/main/syft/pkg/cataloger/cataloger.go#L80

@cpendery Perhaps it could be better to use composer.lock, since composer.json has only direct dependencies, leaving dependencies of dependencies out.

[cpendery]

Happy to add a cataloger for composer.json files to https://github.com/anchore/syft/blob/main/syft/pkg/cataloger/cataloger.go#L80

@cpendery Perhaps it could be better to use composer.lock, since composer.json has only direct dependencies, leaving dependencies of dependencies out.

Sounds great! I'll tag you on PR and test it on the repo you linked to make sure it meets what you're looking for

[cpendery]

@josecoimbra it looks like I should have dug a little deeper into Syft's code. Syft already index's composer's composer.lock and installed.json files to detect resolved files in the project. I'll update Grype's documentation to reflect this, and I'm making a PR to add support for using file:composer.lock since that isn't supported right now. This matches with how all other ecosystems work where a lock file gives version resolutions, like Javascript, in Syft.