mirror of
https://github.com/anchore/syft.git
synced 2026-11-01 15:06:36 +01:00
feat: initial recursive archive cataloging impl
Signed-off-by: Keith Zantow <keith.zantow@anchore.com>
This commit is contained in:
Keith Zantow
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
||||
"$id": "anchore.io/schema/syft/json/16.1.4/document",
|
||||
"$id": "anchore.io/schema/syft/json/16.1.11/document",
|
||||
"$ref": "#/$defs/Document",
|
||||
"$defs": {
|
||||
"AlpmDbEntry": {
|
||||
@@ -249,6 +249,67 @@
|
||||
],
|
||||
"description": "ApkFileRecord represents a single file listing and metadata from a APK DB entry (which may have many of these file records)."
|
||||
},
|
||||
"AppleAppBundleEntry": {
|
||||
"properties": {
|
||||
"bundleIdentifier": {
|
||||
"type": "string",
|
||||
"description": "BundleIdentifier is the unique identifier for the bundle (e.g. \"com.apple.Safari\")"
|
||||
},
|
||||
"name": {
|
||||
"type": "string",
|
||||
"description": "Name is the short name of the bundle"
|
||||
},
|
||||
"displayName": {
|
||||
"type": "string",
|
||||
"description": "DisplayName is the user-facing name of the bundle"
|
||||
},
|
||||
"executable": {
|
||||
"type": "string",
|
||||
"description": "Executable is the name of the executable within the bundle"
|
||||
},
|
||||
"shortVersion": {
|
||||
"type": "string",
|
||||
"description": "ShortVersion is the release (marketing) version of the bundle"
|
||||
},
|
||||
"version": {
|
||||
"type": "string",
|
||||
"description": "Version is the build version of the bundle, which often differs from the short version"
|
||||
},
|
||||
"packageType": {
|
||||
"type": "string",
|
||||
"description": "PackageType is the four-letter type code (e.g. \"APPL\" for apps, \"FMWK\" for frameworks, \"BNDL\" for bundles)"
|
||||
},
|
||||
"supportedPlatforms": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"description": "SupportedPlatforms lists the platforms the bundle targets (e.g. \"MacOSX\", \"iPhoneOS\")"
|
||||
},
|
||||
"minimumSystemVersion": {
|
||||
"type": "string",
|
||||
"description": "MinimumSystemVersion is the minimum macOS version required to run the bundle"
|
||||
},
|
||||
"minimumOSVersion": {
|
||||
"type": "string",
|
||||
"description": "MinimumOSVersion is the minimum OS version required for non-macOS platforms (e.g. iOS)"
|
||||
},
|
||||
"copyright": {
|
||||
"type": "string",
|
||||
"description": "Copyright is the human-readable copyright notice for the bundle"
|
||||
},
|
||||
"platformName": {
|
||||
"type": "string",
|
||||
"description": "PlatformName is the platform name of the SDK used to build the bundle (e.g. \"macosx\")"
|
||||
},
|
||||
"sdkName": {
|
||||
"type": "string",
|
||||
"description": "SDKName is the name of the SDK used to build the bundle (e.g. \"macosx14.0\")"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"description": "AppleAppBundleEntry represents metadata about an Apple application bundle (CFBundle) extracted from Info.plist files."
|
||||
},
|
||||
"BinarySignature": {
|
||||
"properties": {
|
||||
"matches": {
|
||||
@@ -659,7 +720,11 @@
|
||||
},
|
||||
"layerID": {
|
||||
"type": "string",
|
||||
"description": "FileSystemID is an ID representing and entire filesystem. For container images, this is a layer digest. For directories or a root filesystem, this is blank."
|
||||
"description": "FileSystemID is an ID representing an entire filesystem. For container images, this is a layer digest. For directories or a root filesystem, this is blank. A file found inside an archive carries the FileSystemID of the filesystem the archive itself was found in (a layer digest, or blank), inherited unchanged down the nesting chain; the nesting chain is carried by ArchivePath instead."
|
||||
},
|
||||
"archivePath": {
|
||||
"type": "string",
|
||||
"description": "ArchivePath is the colon-delimited chain of archive paths, from the scan root, of every archive traversed to reach this file (e.g. \"app.war:WEB-INF/lib/dep.jar\"). It is blank for files not found within an archive. It disambiguates identically-named files residing in different archives on the same filesystem."
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
@@ -748,6 +813,45 @@
|
||||
],
|
||||
"description": "DartPubspecLockEntry is a struct that represents a single entry found in the \"packages\" section in a Dart pubspec.lock file."
|
||||
},
|
||||
"DenoLockEntry": {
|
||||
"properties": {
|
||||
"integrity": {
|
||||
"type": "string",
|
||||
"description": "Integrity is the crpto hash of the package content for verification"
|
||||
},
|
||||
"dependencies": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"description": "Dependencies is the list of package specifiers that this package depends on"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"required": [
|
||||
"integrity",
|
||||
"dependencies"
|
||||
],
|
||||
"description": "DenoLockEntry is a struct that rep a single entry found in the \"packages\" section of a Deno deno.lock file"
|
||||
},
|
||||
"DenoRemoteLockEntry": {
|
||||
"properties": {
|
||||
"url": {
|
||||
"type": "string",
|
||||
"description": "URL is the remote URL from which the module fetcef"
|
||||
},
|
||||
"integrity": {
|
||||
"type": "string",
|
||||
"description": "Integrity is the crpto hash of the package content for verification"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"required": [
|
||||
"url",
|
||||
"integrity"
|
||||
],
|
||||
"description": "DenoRemoteLockEntry is a struct that rep a single entry found in the \"remote\" section of a Deno deno.lock file"
|
||||
},
|
||||
"Descriptor": {
|
||||
"properties": {
|
||||
"name": {
|
||||
@@ -1228,6 +1332,13 @@
|
||||
"pkgHashExt": {
|
||||
"type": "string",
|
||||
"description": "PkgHashExt is the extended package hash format (inner checksum is deprecated - SHA-256 of concatenated file contents excluding CHECKSUM file, now replaced by outer checksum)"
|
||||
},
|
||||
"dependencies": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"description": "Dependencies are the names of the packages this entry depends on, as\ndeclared in the entry's dependency list within mix.lock. Used to derive\ndependency-of relationships between locked packages."
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
@@ -1546,6 +1657,16 @@
|
||||
},
|
||||
"type": "array",
|
||||
"description": "GoExperiments lists experimental Go features enabled during compilation (e.g., \"arenas\", \"cgocheck2\")."
|
||||
},
|
||||
"symbols": {
|
||||
"additionalProperties": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"type": "object",
|
||||
"description": "Symbols are the function symbols from this module that are compiled into the binary, extracted from\nthe binary symbol table (pclntab) and grouped by the import path of the package that owns them. Each\nvalue is the sorted, deduplicated list of symbol names local to that package, i.e. with the import\npath prefix stripped (e.g. import path \"github.com/foo/bar\" -\u003e \"(*Type).Method\"). The fully qualified\nname is the import path, a \".\", and the local name. One exception: the binary's main package appears\nunder the key \"main\" (the name the linker assigns), not its original source import path, which is not\nrecoverable from the binary. Populated only when the golang cataloger's capture-symbols scope covers\nthis package: the \"all\" scope populates every module package plus the synthetic stdlib package, the\n\"extended-stdlib\" scope populates the stdlib package plus every module under golang.org/x/, and the\n\"stdlib\" scope populates only the stdlib package. The capture-symbols-modules glob patterns populate\nany additional modules they match."
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
@@ -2365,7 +2486,11 @@
|
||||
},
|
||||
"layerID": {
|
||||
"type": "string",
|
||||
"description": "FileSystemID is an ID representing and entire filesystem. For container images, this is a layer digest. For directories or a root filesystem, this is blank."
|
||||
"description": "FileSystemID is an ID representing an entire filesystem. For container images, this is a layer digest. For directories or a root filesystem, this is blank. A file found inside an archive carries the FileSystemID of the filesystem the archive itself was found in (a layer digest, or blank), inherited unchanged down the nesting chain; the nesting chain is carried by ArchivePath instead."
|
||||
},
|
||||
"archivePath": {
|
||||
"type": "string",
|
||||
"description": "ArchivePath is the colon-delimited chain of archive paths, from the scan root, of every archive traversed to reach this file (e.g. \"app.war:WEB-INF/lib/dep.jar\"). It is blank for files not found within an archive. It disambiguates identically-named files residing in different archives on the same filesystem."
|
||||
},
|
||||
"accessPath": {
|
||||
"type": "string",
|
||||
@@ -2628,6 +2753,9 @@
|
||||
{
|
||||
"$ref": "#/$defs/ApkDbEntry"
|
||||
},
|
||||
{
|
||||
"$ref": "#/$defs/AppleAppBundleEntry"
|
||||
},
|
||||
{
|
||||
"$ref": "#/$defs/BinarySignature"
|
||||
},
|
||||
@@ -2658,6 +2786,12 @@
|
||||
{
|
||||
"$ref": "#/$defs/DartPubspecLockEntry"
|
||||
},
|
||||
{
|
||||
"$ref": "#/$defs/DenoLockEntry"
|
||||
},
|
||||
{
|
||||
"$ref": "#/$defs/DenoRemoteLockEntry"
|
||||
},
|
||||
{
|
||||
"$ref": "#/$defs/DotnetDepsEntry"
|
||||
},
|
||||
@@ -2799,6 +2933,9 @@
|
||||
{
|
||||
"$ref": "#/$defs/RustCargoLockEntry"
|
||||
},
|
||||
{
|
||||
"$ref": "#/$defs/SafetensorsModelInfo"
|
||||
},
|
||||
{
|
||||
"$ref": "#/$defs/SnapEntry"
|
||||
},
|
||||
@@ -2811,6 +2948,9 @@
|
||||
{
|
||||
"$ref": "#/$defs/TerraformLockProviderEntry"
|
||||
},
|
||||
{
|
||||
"$ref": "#/$defs/VcpkgManifest"
|
||||
},
|
||||
{
|
||||
"$ref": "#/$defs/WordpressPluginEntry"
|
||||
}
|
||||
@@ -4087,6 +4227,55 @@
|
||||
],
|
||||
"description": "RustCargoLockEntry represents a locked dependency from a Cargo.lock file with precise version and checksum information."
|
||||
},
|
||||
"SafetensorsModelInfo": {
|
||||
"properties": {
|
||||
"format": {
|
||||
"type": "string",
|
||||
"description": "Format is the source format label (always \"safetensors\" for this metadata type).\nPresent because the Docker AI model config blob carries an explicit format field"
|
||||
},
|
||||
"architecture": {
|
||||
"type": "string",
|
||||
"description": "Architecture is the model architecture (e.g., \"LlamaForCausalLM\",\n\"Qwen3MoeForConditionalGeneration\"). It is not present in the SafeTensors\nheader itself; it is enriched from the companion config.json\n\"architectures\" array when one is found alongside the model."
|
||||
},
|
||||
"quantization": {
|
||||
"type": "string",
|
||||
"description": "Quantization describes tensor precision (e.g., \"BF16\", \"F16\", \"F32\", \"INT8\")."
|
||||
},
|
||||
"parameters": {
|
||||
"type": "integer",
|
||||
"description": "Parameters is the total number of model parameters, computed from the tensor\nshapes in the SafeTensors header(s). For a sharded model it is the sum across\nevery shard."
|
||||
},
|
||||
"tensorCount": {
|
||||
"type": "integer",
|
||||
"description": "TensorCount is the number of tensor entries in the file header."
|
||||
},
|
||||
"totalSize": {
|
||||
"type": "string",
|
||||
"description": "TotalSize is the total byte size of tensor data across all shards when known\n(from the Docker AI model config \"size\" field)."
|
||||
},
|
||||
"shardCount": {
|
||||
"type": "integer",
|
||||
"description": "ShardCount is the number of .safetensors shards for a sharded model (1 for a\nsingle-file model)."
|
||||
},
|
||||
"userMetadata": {
|
||||
"$ref": "#/$defs/KeyValues",
|
||||
"description": "UserMetadata is the optional \"__metadata__\" map from a .safetensors file header\n(string-to-string key/values set by the producer)."
|
||||
},
|
||||
"metadataHash": {
|
||||
"type": "string",
|
||||
"description": "MetadataHash is an xxhash over the on-disk SafeTensors header (sorted tensor\nentries + __metadata__). It is derived ONLY from the safetensors file bytes."
|
||||
},
|
||||
"parts": {
|
||||
"items": {
|
||||
"$ref": "#/$defs/SafetensorsModelInfo"
|
||||
},
|
||||
"type": "array",
|
||||
"description": "Parts contains metadata from additional SafeTensors shards or OCI layers that\nwere merged into this package during post-processing."
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"description": "SafeTensorsModelInfo holds the model details extracted from SafeTensors content."
|
||||
},
|
||||
"Schema": {
|
||||
"properties": {
|
||||
"version": {
|
||||
@@ -4269,6 +4458,94 @@
|
||||
],
|
||||
"description": "TerraformLockProviderEntry represents a single provider entry in a Terraform dependency lock file (.terraform.lock.hcl)."
|
||||
},
|
||||
"VcpkgManifest": {
|
||||
"properties": {
|
||||
"description": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"description": "Description is the human-readable description of the package (may be a single string or a list of paragraphs in the manifest)."
|
||||
},
|
||||
"documentation": {
|
||||
"type": "string",
|
||||
"description": "Documentation is the URL to the package's documentation."
|
||||
},
|
||||
"full-version": {
|
||||
"type": "string",
|
||||
"description": "FullVersion is the complete version string including the port-version suffix (e.g. \"1.2.3#2\")."
|
||||
},
|
||||
"version": {
|
||||
"type": "string",
|
||||
"description": "Version is the upstream package version without the port-version suffix (e.g. \"1.2.3\")."
|
||||
},
|
||||
"port-version": {
|
||||
"type": "integer",
|
||||
"description": "PortVersion is the vcpkg-specific packaging revision for a given upstream version."
|
||||
},
|
||||
"maintainers": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"description": "Maintainers are the people responsible for maintaining the vcpkg port."
|
||||
},
|
||||
"name": {
|
||||
"type": "string",
|
||||
"description": "Name is the package name as declared in the manifest."
|
||||
},
|
||||
"supports": {
|
||||
"type": "string",
|
||||
"description": "Supports is the platform expression describing which triplets the package can be built for (e.g. \"!windows\")."
|
||||
},
|
||||
"registry": {
|
||||
"$ref": "#/$defs/VcpkgRegistryEntry",
|
||||
"description": "Registry indicates where the package definition came from."
|
||||
},
|
||||
"triplet": {
|
||||
"type": "string",
|
||||
"description": "Triplet is the build target discovered from the build folder (e.g. \"x64-linux\")."
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"required": [
|
||||
"full-version",
|
||||
"version",
|
||||
"port-version",
|
||||
"name"
|
||||
],
|
||||
"description": "VcpkgManifest summarizes the data found in a vcpkg manifest (vcpkg.json) relevant to a single vcpkg package."
|
||||
},
|
||||
"VcpkgRegistryEntry": {
|
||||
"properties": {
|
||||
"baseline": {
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"type": "string"
|
||||
},
|
||||
"packages": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"path": {
|
||||
"type": "string"
|
||||
},
|
||||
"reference": {
|
||||
"type": "string"
|
||||
},
|
||||
"repository": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"required": [
|
||||
"kind"
|
||||
],
|
||||
"description": "Matches definition of Vcpkg \"Registry\"."
|
||||
},
|
||||
"WordpressPluginEntry": {
|
||||
"properties": {
|
||||
"pluginInstallDirectory": {
|
||||
|
||||
Reference in New Issue
Block a user