Support for syfting CPIO archives

[Harvie]

What would you like to be added:

Support to recurse into (compressed) CPIO archives.

Why is this needed:

Linux kernel allows userspace to be imported in CPIO format, possibly even compressed eg. 'initrd.cpio.zst'
We often work with systems packaged in such format... It would be handy if we could just syft them in place...

Additional context:

[wagoodman]

I take it you're interested in doing something like syft initrd.cpio.zst and getting an SBOM?

If so, we could use either https://github.com/cavaliergopher/cpio (looks to not be maintained, but unclear) or https://github.com/u-root/u-root/tree/main/pkg/cpio . This would need to hook up into the file source where we identify archive types. We wrap mholt/archives for much of this internally, but we'd probably need to start registering cpio or cpio.zst (and other) formats in the archives lib (requiring a new implementation that wraps the earlier lib reference to meet either the Extractor or Archiver interfaces).

A quick look at this shows this would be the implementation path.

[Harvie]

I take it you're interested in doing something like syft initrd.cpio.zst and getting an SBOM?

yes.

[Harvie]

There is CPIO implementation everyone uses... I beleive it's quite common for most linux distribution to have it available or even preinstalled:

https://cgit.git.savannah.gnu.org/cgit/cpio.git/tree/

[Harvie]

It's unindexed, but very linear format. Basically just all files concatenated (each individualy prepended with simple header containing filename and similar metadata). If syft needs to go through every file exactly once and order does not matter, that is very easy to do itterating through CPIO archive. If you need to seek and/or jump to random files by name, it's bit harder task.