Add Cataloger for Homebrew on macOS

[rezmoss]

What would you like to be added:

I would like to request the addition of a cataloger for Homebrew on macOS within Syft. This feature should enable Syft to scan and catalog installed Homebrew packages, allowing users to generate SBOMs that include Homebrew-installed software.

Why is this needed:

Homebrew is a widely used package manager for macOS, and many security vulnerabilities arise within installed Homebrew packages. Adding a Homebrew cataloger would help users surface vulnerabilities associated with their installed Homebrew applications, ensuring more comprehensive security scanning and compliance checks

Additional context:

• Homebrew maintains a package database at /usr/local/Cellar/ (for Intel Macs) and /opt/homebrew/Cellar/ (for Apple Silicon Macs).
• Each installed package has a subdirectory with versioned installations (e.g., /opt/homebrew/Cellar/git/2.42.0/).
• Homebrew maintains a list of installed packages in /usr/local/Homebrew/Library/Taps/ or /opt/homebrew/Library/Taps/.
• Running brew list --versions provides a structured list of installed packages and their versions.

By leveraging this data, Syft can catalog installed Homebrew applications and map them against vulnerability databases to enhance security insights for macOS users

I am interested to work on this new cataloger.

[popey]

Thanks for the issue @rezmoss and welcome to the community!

We briefly discussed this towards the end of today's live stream.

The team agreed that this would be an interesting and valuable cataloger to add, and I don't think any of us had considered it previously. So, good call!

We also pondered the possibility of scanning brew packages on linux, and I guess on WSL2 also?

In short, thanks for the issue and for stepping up to work on it. Feel free to let us know if you need help.

[rezmoss]

Thank you @popey for the warm welcome and great suggestions! I’ll plan to address macOS first and also consider Linux/WSL2 support. I’m planning to start soon—will let you know if I need any help!