mirror of
https://github.com/anchore/syft.git
synced 2026-11-01 06:56:40 +01:00
Merge remote-tracking branch 'upstream/main' into add-nested-archive-cataloging
This commit is contained in:
Keith Zantow
+1385
-359
File diff suppressed because it is too large
Load Diff
+1848
-387
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
+166
-1
@@ -2,7 +2,7 @@
|
||||
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
|
||||
elementFormDefault="qualified"
|
||||
targetNamespace="http://cyclonedx.org/schema/spdx"
|
||||
version="1.0-3.27.0">
|
||||
version="1.0-3.28.0">
|
||||
|
||||
<xs:simpleType name="licenseId">
|
||||
<xs:restriction base="xs:string">
|
||||
@@ -57,6 +57,11 @@
|
||||
<xs:documentation>Amazon Digital Services License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Advanced-Cryptics-Dictionary">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Advanced Cryptics Dictionary License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="AFL-1.1">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Academic Free License v1.1</xs:documentation>
|
||||
@@ -122,6 +127,11 @@
|
||||
<xs:documentation>Aladdin Free Public License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="ALGLIB-Documentation">
|
||||
<xs:annotation>
|
||||
<xs:documentation>ALGLIB Documentation License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="AMD-newlib">
|
||||
<xs:annotation>
|
||||
<xs:documentation>AMD newlib License</xs:documentation>
|
||||
@@ -327,6 +337,11 @@
|
||||
<xs:documentation>Boehm-Demers-Weiser GC License (without fee)</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="BOLA-1.1">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Buena Onda License Agreement v1.1</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Borceux">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Borceux license</xs:documentation>
|
||||
@@ -457,6 +472,11 @@
|
||||
<xs:documentation>BSD 3-Clause Sun Microsystems</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="BSD-3-Clause-Tso">
|
||||
<xs:annotation>
|
||||
<xs:documentation>BSD 3-Clause Tso variant</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="BSD-4-Clause">
|
||||
<xs:annotation>
|
||||
<xs:documentation>BSD 4-Clause "Original" or "Old" License</xs:documentation>
|
||||
@@ -497,6 +517,11 @@
|
||||
<xs:documentation>BSD-Inferno-Nettverk</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="BSD-Mark-Modifications">
|
||||
<xs:annotation>
|
||||
<xs:documentation>BSD Mark Modifications License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="BSD-Protection">
|
||||
<xs:annotation>
|
||||
<xs:documentation>BSD Protection License</xs:documentation>
|
||||
@@ -527,6 +552,11 @@
|
||||
<xs:documentation>Boost Software License 1.0</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Buddy">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Buddy License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="BUSL-1.1">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Business Source License 1.1</xs:documentation>
|
||||
@@ -567,6 +597,11 @@
|
||||
<xs:documentation>Caldera License (without preamble)</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="CAPEC-tou">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Common Attack Pattern Enumeration and Classification License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Catharon">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Catharon License</xs:documentation>
|
||||
@@ -1212,6 +1247,21 @@
|
||||
<xs:documentation>Erlang Public License v1.1</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="ESA-PL-permissive-2.4">
|
||||
<xs:annotation>
|
||||
<xs:documentation>European Space Agency Public License – v2.4 – Permissive (Type 3)</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="ESA-PL-strong-copyleft-2.4">
|
||||
<xs:annotation>
|
||||
<xs:documentation>European Space Agency Public License (ESA-PL) - V2.4 - Strong Copyleft (Type 1)</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="ESA-PL-weak-copyleft-2.4">
|
||||
<xs:annotation>
|
||||
<xs:documentation>European Space Agency Public License – v2.4 – Weak Copyleft (Type 2)</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="etalab-2.0">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Etalab Open License 2.0</xs:documentation>
|
||||
@@ -1737,6 +1787,11 @@
|
||||
<xs:documentation>Historical Permission Notice and Disclaimer - sell variant</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="HPND-sell-variant-critical-systems">
|
||||
<xs:annotation>
|
||||
<xs:documentation>HPND - sell variant with safety critical systems clause</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="HPND-sell-variant-MIT-disclaimer">
|
||||
<xs:annotation>
|
||||
<xs:documentation>HPND sell variant with MIT disclaimer</xs:documentation>
|
||||
@@ -1747,6 +1802,11 @@
|
||||
<xs:documentation>HPND sell variant with MIT disclaimer - reverse</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="HPND-SMC">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Historical Permission Notice and Disclaimer - SMC variant</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="HPND-UC">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Historical Permission Notice and Disclaimer - University of California variant</xs:documentation>
|
||||
@@ -1762,6 +1822,11 @@
|
||||
<xs:documentation>HTML Tidy License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="hyphen-bulgarian">
|
||||
<xs:annotation>
|
||||
<xs:documentation>hyphen-bulgarian License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="IBM-pibs">
|
||||
<xs:annotation>
|
||||
<xs:documentation>IBM PowerPC Initialization and Boot Software</xs:documentation>
|
||||
@@ -1852,6 +1917,11 @@
|
||||
<xs:documentation>ISC Veillard variant</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="ISO-permission">
|
||||
<xs:annotation>
|
||||
<xs:documentation>ISO permission notice</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Jam">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Jam License</xs:documentation>
|
||||
@@ -2237,6 +2307,11 @@
|
||||
<xs:documentation>MIT Open Group variant</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="MIT-STK">
|
||||
<xs:annotation>
|
||||
<xs:documentation>MIT-STK License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="MIT-testregex">
|
||||
<xs:annotation>
|
||||
<xs:documentation>MIT testregex Variant</xs:documentation>
|
||||
@@ -2257,6 +2332,11 @@
|
||||
<xs:documentation>MMIXware License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="MMPL-1.0.1">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Minecraft Mod Public License v1.0.1</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Motosoto">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Motosoto License</xs:documentation>
|
||||
@@ -2422,6 +2502,11 @@
|
||||
<xs:documentation>NIST Public Domain Notice with license fallback</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="NIST-PD-TNT">
|
||||
<xs:annotation>
|
||||
<xs:documentation>NIST Public Domain Notice TNT variant</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="NIST-Software">
|
||||
<xs:annotation>
|
||||
<xs:documentation>NIST Software License</xs:documentation>
|
||||
@@ -2687,6 +2772,11 @@
|
||||
<xs:documentation>Open Market License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="OpenMDW-1.0">
|
||||
<xs:annotation>
|
||||
<xs:documentation>OpenMDW License Agreement v1.0</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="OpenPBS-2.3">
|
||||
<xs:annotation>
|
||||
<xs:documentation>OpenPBS v2.3 Software License</xs:documentation>
|
||||
@@ -2722,6 +2812,11 @@
|
||||
<xs:documentation>Open Publication License v1.0</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="OSC-1.0">
|
||||
<xs:annotation>
|
||||
<xs:documentation>OSC License 1.0</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="OSET-PL-2.1">
|
||||
<xs:annotation>
|
||||
<xs:documentation>OSET Public License version 2.1</xs:documentation>
|
||||
@@ -2752,11 +2847,21 @@
|
||||
<xs:documentation>Open Software License 3.0</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="OSSP">
|
||||
<xs:annotation>
|
||||
<xs:documentation>OSSP License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="PADL">
|
||||
<xs:annotation>
|
||||
<xs:documentation>PADL License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="ParaType-Free-Font-1.3">
|
||||
<xs:annotation>
|
||||
<xs:documentation>ParaType Free Font Licensing Agreement v1.3</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Parity-6.0.0">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The Parity Public License 6.0.0</xs:documentation>
|
||||
@@ -2977,6 +3082,11 @@
|
||||
<xs:documentation>SGI OpenGL License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="SGMLUG-PM">
|
||||
<xs:annotation>
|
||||
<xs:documentation>SGMLUG Parser Materials License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="SGP4">
|
||||
<xs:annotation>
|
||||
<xs:documentation>SGP4 Permission Notice</xs:documentation>
|
||||
@@ -3162,6 +3272,11 @@
|
||||
<xs:documentation>TCP Wrappers License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="TekHVC">
|
||||
<xs:annotation>
|
||||
<xs:documentation>TekHVC License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="TermReadKey">
|
||||
<xs:annotation>
|
||||
<xs:documentation>TermReadKey License</xs:documentation>
|
||||
@@ -3297,6 +3412,11 @@
|
||||
<xs:documentation>Unlicense - libwhirlpool variant</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="UnRAR">
|
||||
<xs:annotation>
|
||||
<xs:documentation>UnRAR License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="UPL-1.0">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Universal Permissive License v1.0</xs:documentation>
|
||||
@@ -3312,6 +3432,11 @@
|
||||
<xs:documentation>Vim License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Vixie-Cron">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Vixie Cron License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="VOSTROM">
|
||||
<xs:annotation>
|
||||
<xs:documentation>VOSTROM Public License for Open Source</xs:documentation>
|
||||
@@ -3352,11 +3477,21 @@
|
||||
<xs:documentation>Widget Workshop License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="WordNet">
|
||||
<xs:annotation>
|
||||
<xs:documentation>WordNet License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Wsuipa">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Wsuipa License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="WTFNMFPL">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Do What The F*ck You Want To But It's Not My Fault Public License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="WTFPL">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Do What The F*ck You Want To Public License</xs:documentation>
|
||||
@@ -3382,6 +3517,11 @@
|
||||
<xs:documentation>X11 License Distribution Modification Variant</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="X11-no-permit-persons">
|
||||
<xs:annotation>
|
||||
<xs:documentation>X11 no permit persons clause</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="X11-swapped">
|
||||
<xs:annotation>
|
||||
<xs:documentation>X11 swapped final paragraphs</xs:documentation>
|
||||
@@ -3568,6 +3708,11 @@
|
||||
<xs:documentation>Classpath exception 2.0</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Classpath-exception-2.0-short">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Classpath exception 2.0 - short</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="CLISP-exception-2.0">
|
||||
<xs:annotation>
|
||||
<xs:documentation>CLISP exception 2.0</xs:documentation>
|
||||
@@ -3718,6 +3863,11 @@
|
||||
<xs:documentation>KiCad Libraries Exception</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="kvirc-openssl-exception">
|
||||
<xs:annotation>
|
||||
<xs:documentation>kvirc OpenSSL Exception</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="LGPL-3.0-linking-exception">
|
||||
<xs:annotation>
|
||||
<xs:documentation>LGPL-3.0 Linking Exception</xs:documentation>
|
||||
@@ -3833,6 +3983,11 @@
|
||||
<xs:documentation>RRDtool FLOSS exception 2.0</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="rsync-linking-exception">
|
||||
<xs:annotation>
|
||||
<xs:documentation>rsync Linking Exception</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="SANE-exception">
|
||||
<xs:annotation>
|
||||
<xs:documentation>SANE Exception</xs:documentation>
|
||||
@@ -3848,6 +4003,16 @@
|
||||
<xs:documentation>Solderpad Hardware License v2.1</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Simple-Library-Usage-exception">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Simple Library Usage Exception</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="sqlitestudio-OpenSSL-exception">
|
||||
<xs:annotation>
|
||||
<xs:documentation>sqlitestudio OpenSSL exception</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="stunnel-exception">
|
||||
<xs:annotation>
|
||||
<xs:documentation>stunnel Exception</xs:documentation>
|
||||
|
||||
@@ -35,3 +35,24 @@ Create the new schema by running `make generate-json-schema` from the root of th
|
||||
- If there is an existing schema for the given version and the new schema **does not** match the existing schema, an error is shown indicating to increment the version appropriately (see the "Versioning" section)
|
||||
|
||||
***Note: never delete a JSON schema and never change an existing JSON schema once it has been published in a release!*** Only add new schemas with a newly incremented version. All previous schema files must be stored in the `schema/json/` directory.
|
||||
|
||||
### Exception: `description`-only corrections
|
||||
|
||||
A published schema may be amended in place for one narrow case: the change touches only `description` text and leaves the data shape identical. Descriptions are documentation carried alongside the schema rather than constraints a validator evaluates, so correcting one cannot invalidate a document that already validated against that version. Minting a new version instead would leave the old one permanently describing the tool incorrectly, and spend a version number on no semantic change.
|
||||
|
||||
This applies when **every** one of the following holds:
|
||||
|
||||
- the only differences are `description` values
|
||||
- no field, type, enum, `required` entry, or `$ref` is added, removed, or altered
|
||||
- the `$id` version is unchanged
|
||||
|
||||
Anything else, including adding a field that happens to be optional, is a schema change and needs a version bump per the "Versioning" section above.
|
||||
|
||||
The generator blocks an in-place edit by design, since it refuses to overwrite a file that differs from what it would produce. To amend one, delete the schema file and regenerate so it is rewritten from the current Go doc comments:
|
||||
|
||||
```bash
|
||||
rm schema/json/schema-$VERSION.json
|
||||
make generate-json-schema
|
||||
```
|
||||
|
||||
The result is byte-identical to what the generator produces, so do not hand-edit the JSON. Re-running `make generate-json-schema` afterwards should report `No change to the existing schema!`, and `make check-json-schema-drift` should pass. Confirm with `git diff` that the only changes are the intended description lines.
|
||||
|
||||
@@ -720,7 +720,7 @@
|
||||
},
|
||||
"layerID": {
|
||||
"type": "string",
|
||||
"description": "FileSystemID is an ID representing an entire filesystem. For container images, this is a layer digest. For directories or a root filesystem, this is blank. When nested archive cataloging is enabled, a file found inside an archive carries the chain naming that archive's filesystem instead: the ID of the filesystem the archive itself was found in (a layer digest, or blank) joined with the path of each containing archive, e.g. \"sha256:1a2b.../app.war/WEB-INF/lib/dep.jar\". It is a path there rather than a digest, and it is what keeps identically-named files in different archives apart."
|
||||
"description": "FileSystemID is an ID representing and entire filesystem. For container images, this is a layer digest. For directories or a root filesystem, this is blank."
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
@@ -2482,7 +2482,7 @@
|
||||
},
|
||||
"layerID": {
|
||||
"type": "string",
|
||||
"description": "FileSystemID is an ID representing an entire filesystem. For container images, this is a layer digest. For directories or a root filesystem, this is blank. When nested archive cataloging is enabled, a file found inside an archive carries the chain naming that archive's filesystem instead: the ID of the filesystem the archive itself was found in (a layer digest, or blank) joined with the path of each containing archive, e.g. \"sha256:1a2b.../app.war/WEB-INF/lib/dep.jar\". It is a path there rather than a digest, and it is what keeps identically-named files in different archives apart."
|
||||
"description": "FileSystemID is an ID representing and entire filesystem. For container images, this is a layer digest. For directories or a root filesystem, this is blank."
|
||||
},
|
||||
"accessPath": {
|
||||
"type": "string",
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user