Add support for scanning IPK packages using the deb-archive-cataloger

[skyhisi]

Description

IPK packages are used by the opkg package manager, they have the same format as DEB packages, so the existing scanner can be used.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (please discuss with the team first; Syft is 1.0 software and we won't accept breaking changes without going to 2.0)
• Documentation (updates the documentation)
• Chore (improve the developer experience, fix a test flake, etc, without changing the visible behavior of Syft)
• Performance (make Syft run faster or use less memory, without changing visible behavior much)

Checklist

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections

Issue references

[spiffcs]

👋 Thanks for the PR @skyhisi. I think I have some questions before we move foward.

Does this update do what is actually suggests in the PR?

Can you add some tests or show some steps that demonstrate syft working correctly with files that match the*.ipk glob?

Can the .ipk come as a gzipped tar like in this example and does syft handle this correctly with this change?

$ curl -sLO https://downloads.openwrt.org/releases/23.05.5/packages/mips_24kc/base/6in4_28_all.ipk
$ file 6in4_28_all.ipk   → gzip compressed data

I don't think our current AR implementation would play nice with a match that comes as gzipped and might produce no package results as well as superfluous unknown entries.

I think we might need more complex handling of the compression for the different cases utilizing mholt/archives: see the original PR for context #3704

For this PR to move forward:

• I think we need to do a bit more inquiry into the different compression formats *.ipk could come in, handling of those, and tests added showing that handling
• Glob tests added
• We probably want the team to chime in here as well to see if there are any other considerations for syft's surface area on if the opkg package manager should be lumped under the deb archive cataloger like this, or if it deserves a spot carved out on it's own or mentioned in some way.

[skyhisi]

@spiffcs Thanks for taking an initial look at this PR, I didn't realise the OpenWrt version of IPK used a gzip outer container, I'm using it with packages built by Yocto which follows the Debian format of having an outer AR file containing compressed tar files, which it works fine with.

I can look into adding some tests for the globbing, but from using it, it works fine.

I haven't tried it with OpenWrt packages and given that the OpenWrt project has moved to using APK (Alpine format) packages, I'm not sure if it's worth the syft project supporting the deprecated IPK format? Maybe it'd be enough if it skipped them?

[skyhisi]

I've updated the PR with some unit tests now.