oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-11 21:57:22 +02:00
Code Issues Packages Projects Releases Wiki Activity
3,149 Commits 63 Branches 272 Tags
add-go-symbol-extract
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Alex Goodman 3549b04e18 Merge remote-tracking branch 'origin/main' into add-go-symbol-extract 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-12-19 10:02:13 -05:00
Alex Goodman 7ed733c3fb signpost to docs site (#4483) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-12-17 18:00:38 +00:00
Alex Goodman 89824f0ae7 Merge remote-tracking branch 'origin/main' into add-go-symbol-extract 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-12-16 13:53:31 -05:00
Alex Goodman b361427043 add test coverage for cgo 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-12-16 13:47:55 -05:00
Alex Goodman beb70891e5 unapply base path for resolver inbound requests (#4478) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-12-16 08:28:12 -05:00
Alex Goodman 6be0a9abc4 Improve PR template (#4472) 
* improve pr template

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* incorporate feedback

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-12-12 15:45:29 +00:00
Alex Goodman 281a9b87de keep both local and global symbols 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-12-11 14:20:44 -05:00
Alex Goodman bf1f0ceea3 add support for PE binaries 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-12-10 13:53:00 -05:00
Alex Goodman 703edff876 call file config validate in cli post load 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-12-10 13:24:34 -05:00
Alex Goodman a05608a4c8 wire up cli config 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-12-10 12:53:41 -05:00
Alex Goodman 41aa6f6753 fix test fixture 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-12-10 09:08:31 -05:00
Alex Goodman 1a70ffe2fa bump json schema 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-12-10 09:08:17 -05:00
Alex Goodman 33c5e40431 remove dead code 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-12-09 17:46:30 -05:00
Alex Goodman 32946ec41f add gcc and clang toolchains 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-12-09 17:43:38 -05:00
Alex Goodman 9bf4c5bdf9 initial prototype 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-12-09 11:31:48 -05:00
Alex Goodman 153f2321ce Fix test-fixture publish (#4369) 
* pin python dependencies

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* pin rust dependencies

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* pin php deps

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update and pin http and curl fixtures

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-11-14 15:41:23 -05:00
Alex Goodman 7bf7bcc461 Support extras statements in Python PDM cataloger (#4352) 
* fix pdm

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update json schema

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add test for metadata construction

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add missing test fixture

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* conserve markers

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update json schema

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add additional tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-11-14 15:13:10 -05:00
Alex Goodman 66c78d44af Document additional json schema fields (#4356) 
* add documentation to key fields

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* regenerate json schema

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-11-10 16:29:06 -05:00
Alex Goodman 199394934d preserve --from order (#4350) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-11-07 10:17:10 -05:00
Alex Goodman e5711e9b42 Update CPE processing to use NVD API (#4332) 
* update NVD CPE dictionary processor to use API

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* pass linting with exceptions

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-11-06 16:02:26 -05:00
Alex Goodman 7c154e7c37 use official action for token generation (#4331) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-11-03 13:08:42 -05:00
Alex Goodman 538430d65d describe cataloger capabilities via test observations (#4318) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-10-30 13:19:42 -04:00
Alex Goodman 5db3a9bf55 add workflow to create PR for spdx license list updates (#4319) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-10-30 12:14:13 -04:00
Alex Goodman d22914baf5 add docs to configs (#4281) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-10-14 13:58:31 -04:00
Alex Goodman 4ae8f73583 migrate json schema generation (#4270) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-10-10 14:16:28 +00:00
Alex Goodman a77d24e379 Improve struct and field comments and incorporate into json schema (#4252) 
* improve struct and field comments and incorporate into json schema

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address review feedback

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-10-03 17:01:56 +00:00
Alex Goodman 8a7302c5cf migrate to get.anchore.io (#4095) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-07-30 10:54:22 -04:00
Alex Goodman f0a990b85f chore: add source completion tester (#4077) 
* add source completion tester

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add missing t.Helper calls

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-07-23 13:49:47 +00:00
Alex Goodman 2bda086423 Add ability to scan snaps (as a source) (#3929) 2025-06-25 16:53:35 -04:00
Alex Goodman 96c34ffc43 account for non-import shapes (#3997) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-06-11 13:11:40 -04:00
Alex Goodman 79b6d5daa4 Allow decoding of anchorectl json files (#3973) 
* allow decoding of import sbom file shape

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address formatting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add file mode and type processing

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* use type to interpret the raw value

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* safe mode convert should use uint32

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* simpler decoder type

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-06-10 15:03:50 -04:00
Alex Goodman 18f9b5ab58 remove benchmark utils (#3982) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-06-09 18:24:49 +00:00
Alex Goodman ac883f52ed add cdx group as purl namespace (#3922) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-20 15:56:08 -04:00
Alex Goodman e23ca43a83 add PE binary cataloger (#3911) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-19 14:17:09 -04:00
Alex Goodman db77b54c01 finalize go mod ref (#3908) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-16 17:36:26 +00:00
Alex Goodman 2d4fe513ec remove benchmark workflow (#3906) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-16 11:08:43 -04:00
Alex Goodman 0480b516f6 chore: fix publishing test fixture images (#3896) 
* update pkg counts

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* bump max cache size

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-15 14:35:11 -04:00
Alex Goodman 0521ccaf5e chore: update fixtures based on CI builds (#3894) 
* update fixtures based on ci builds

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix typo

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-14 21:30:20 +00:00
Alex Goodman 59b880f26a order locations by container layer order (#3858) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-13 00:02:07 -04:00
Alex Goodman e3e69596bd Translate Portage license strings to SPDX expressions (#1763) 
* fix portage license handling

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* cover license_group file

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add licenses to portage metadata in json schema

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-12 21:03:51 -04:00
Alex Goodman f9d0fa81ab do not search binary contents for version for go package (#3874) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-09 17:49:17 +00:00
Alex Goodman abe5e27b4b fix: remove race when writing errors in generic cataloger (#3875) 
* fix generic cataloger race

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update race test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-09 17:46:47 +00:00
Alex Goodman a7816dc9e7 clear devel version for go packages (#3873) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-09 13:36:52 -04:00
Alex Goodman 1574fb20ae merge multiple targets for the same dotnet package (#3869) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-08 15:28:08 +00:00
Alex Goodman 7b25ea5eda annotate hidden paths in all-layers scope (#3855) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-06 09:50:04 -04:00
Alex Goodman d47a6c3a6d Improve support for cataloging nix package relationships (#3837) 
* add nix DB cataloger

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add derivation path to nix store pkg metadata

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* go mod tidy

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* allow for derivation path to be optional

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* repin build image and disable syscall filtering

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* bump storage capacity

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* track nix derivation details on packages

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* image fixture should have derivation examples

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-05 15:35:13 +00:00
Alex Goodman 03fa142de9 Resolve owned file paths when searching for overlaps (#3828) 
* resolve owned file paths when searching for overlaps

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* dont remove empty paths

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-04-24 21:59:45 +00:00
Alex Goodman 5c6c6aa123 Add support for detecting javascript assets in .NET projects using libman (#3825) 
* add support for .NET libman files

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix when no libman detected

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add libman.json docs

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-04-24 17:11:01 +00:00
Alex Goodman df18edf905 Consider DLL claims for dependencies of .NET packages from deps.json (#3822) 
* consider child dll claims for .NET packages from deps.json

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* make dll claim propagation configurable

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-04-24 11:59:16 -04:00
Alex Goodman 2dd9d583af PE cataloger should consider compile target paths from deps.json (#3821) 
* fix PE compile path processing

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* adjust fixture comment

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-04-24 14:01:53 +01:00
Alex Goodman 24df095a5e empty source during decoding should not be fatal (#3791) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-04-11 10:12:29 -04:00
Alex Goodman 12f36420dd Parse GitHub actions comments (#3776) 
* add version comment parsing support to github actions

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update json schema with github actions metadata

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add originator processing for github actions type

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-04-03 14:46:27 +00:00
Alex Goodman f851085668 Expand python license scanning to cover unclaimed files (#3779) 
* expand python license scanning to cover unclaimed files

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* speed up tests using the license scanner

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-04-03 10:31:02 -04:00
Alex Goodman d033ad7de6 unpin go version in ci (#3773) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-04-01 13:27:15 +00:00
Alex Goodman c53f2fbad3 Better represent .NET runtime packages (#3768) 
* clean up .NET runtime packages

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add runtime relationships

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove runtime references from binary package name

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-03-28 13:36:27 -04:00
Alex Goodman 40dd5d0bbd better .NET cpe generation (#3764) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-03-28 10:58:59 -04:00
Alex Goodman ad9928cb2a Merge the .NET deps.json and PE binary catalogers (#3563) 
* add combined deps.json + pe binary cataloger

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* deprecate pe and deps standalone catalogers

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* parse resource names + add tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix integration and CLI tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add some helpful code comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* allow for dropping Dep packages that are missing DLLs

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* migrate json schema changes to 24

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* keep application configuration

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* correct config help

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* [wip] detect claims of dlls within deps.json

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* [wip] fix tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add assembly repack detection

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* .net package count is lower due to dll claim requirement

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-03-27 14:38:16 -04:00
Alex Goodman e9b24a29d7 Remove mitchellh dependencies (#3748) 
* remove mitchellh dependencies

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix failing unit tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-03-20 10:19:19 -04:00
Alex Goodman 2738291a96 swap centos images for rocky (#3741) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-03-18 14:25:03 +00:00
Alex Goodman 34e5ff753f Location order on packages should consider evidence annotations when sorting (#3720) 
* fix: sorting locations should consider pkg evidence

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* simplify location test options for comparison

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-03-11 10:34:37 -04:00
Alex Goodman f6605a3817 suppress file already closed errors (#3695) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-02-27 21:52:50 +00:00
Alex Goodman 5e2723187d Fix /etc/redhat-release file parsing when resolving distro details (#3688) 2025-02-26 12:42:29 +00:00
Alex Goodman 684b6e3f98 Add file catalogers to selection configuration (#3505) 
* add file catalogers to selection configuration

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix typos

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* warn when there is conflicting file cataloging configuration

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* allow for explicit removal of all package and file tasks

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address PR feedback

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-02-03 19:10:17 +00:00
Alex Goodman cbce129bb9 Use reader when scanning for package versions over reading entire binary into memory (#3558) 
* use streaming readers

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* replace redis search patterns

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address PR feedback

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-01-02 22:12:37 +00:00
Alex Goodman d77e78ea9d Make pre-release integration PRs (#3370) 
* use reusable dep update action

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* use workflow that takes multiple repo

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix mispelling

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove taskfile update

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* bump action to main branch

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* rename action

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove gh make var

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-12-10 17:14:11 +00:00
Alex Goodman d38efb0b7f chore(deps): update anchore dependencies (#3510) 
* integrate anchore deps

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* upgrade to released versions

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-12-09 15:51:16 -05:00
Alex Goodman 340b5e17f0 Add relationships for rust audit binary packages (#3500) 
* add rust audit binary pkg relationships

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix linting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-12-06 09:23:18 -05:00
Alex Goodman b0bffef1a2 restore log on ui teardown (#3427) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-11-08 12:31:38 -05:00
Alex Goodman e4e985b9b0 Create single license scanner for all catalogers (#3348) 
* add single license scanner instance

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* rename testing license scanner

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-10-21 16:17:12 +00:00
Alex Goodman 56dbb342ef update to latest packageurl-go (#3347) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-10-18 14:47:02 -04:00
Alex Goodman fbff87fc6d shorten release docs (#3318) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-10-11 05:17:01 -04:00
Alex Goodman 13c6876906 Track supporting DPKG evidence (#3228) 
* add dpkg evidence support

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* use path over filepath

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-10-04 11:07:29 -04:00
Alex Goodman d7005d7d8c add awaiting response management (#3272) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-09-25 08:56:21 -04:00
Alex Goodman 01de99b253 Add JVM cataloger (#3217) 
* add jvm cataloger

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* simplify version selection

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* CPEs from JVM cataloger should be declared

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* ensure package overlap is enabled for sensitive use cases

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* more permissive glob

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-09-23 17:21:38 -04:00
Alex Goodman 963ea594c8 Add compliance policy for empty name and version (#3257) 
* add policy for empty name and version

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* default stub version

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* modifying ids requires augmenting relationships

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-09-20 12:50:47 -04:00
Alex Goodman ba7bf6b85e dont cleanup cache in forks (#3214) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-09-09 20:27:21 +00:00
Alex Goodman b153b1d594 less verbose java logging when non-fatal issues arise (#3208) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-09-09 15:27:59 +00:00
Alex Goodman 0a3f513f92 Slim down docker cache size (#3190) 
* slim down docker cache size

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove old centos images

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* troubleshoot test failure

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix wget version ref

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* refactor caching mechanisms

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add cache cleanup steps

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* simplify deleting cache

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix first clone issue

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add tool dep

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-09-09 11:15:13 -04:00
Alex Goodman e9a8c27be1 respond to authoratative CPEs from catalogers (#3166) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-08-27 10:26:35 -04:00
Alex Goodman 4ee6c179f8 set cataloger names within package cataloger task (#3165) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-08-27 09:23:43 -04:00
Alex Goodman b6b5c8e308 fix ELF package correlations (#3151) 2024-08-26 08:44:39 -04:00
Alex Goodman 9573f557d1 better go mod detection from partial package builds (#3060) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-07-24 09:34:40 -04:00
Alex Goodman 573440b7cf Infer the package type from ELF package notes (#3008) 
* fix ELF package types to be honored

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* prefer OS packages over binary packages when there are duplicates

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-07-02 16:07:08 -04:00
Alex Goodman 0956753409 Consider Author field for wordpress plugins when generating CPEs (#2946) 
* enhance wordpress vendor candidates for CPEs

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* encode wordpress plugin target software

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-10 14:12:20 -04:00
Alex Goodman f966bcfd03 trim whitespace from wordpress values (#2945) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-10 13:35:01 -04:00
Alex Goodman c43f4fb416 add signature verification to install.sh (#2941) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-10 11:29:53 -04:00
Alex Goodman db0c33481e pin golang image (#2944) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-10 09:59:33 -04:00
Alex Goodman 254a562b4e Add support for reading ELF package notes with section header (#2939) 
* add support for reading ELF package notes with section header

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add systemd elf package fields to json schema

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-07 14:38:54 -04:00
Alex Goodman 6e16396d18 remove dco workflow (#2936) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-06 14:29:55 +00:00
Alex Goodman 3472b48177 Add relationships for python poetry packages (#2906) 
* [wip] add initial poetry.lock relationship support

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* provide generic set for basic types

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* dependency resolver should allow for conditional deps

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add tests for poetry lock relationship additions

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update schema with python poetry dependency refs

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* dep specification data structure should not be recursive in nature

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-04 20:00:05 +00:00
Alex Goodman 4bdbd1aa2a remove unused test fixtures and empty dirs (#2924) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-04 15:22:49 -04:00
Alex Goodman cb09dd9e19 match existing DCO GH check name 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-04 13:34:29 -04:00
Alex Goodman 2f39322f81 use dco tool during gh app outage (#2926) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-04 17:31:29 +00:00
Alex Goodman f4a69e6d35 add relationships for go binary packages (#2912) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-05-30 11:37:17 -04:00
Alex Goodman 05e8ba948d Add python wheel egg relationships (#2903) 
* add python package relationships

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* nil for empty relationships collections

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* new json schema for optional python requiremenets

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update format snapshots for python packages

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* decompose python parsers more + add tests around plural fields

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update JSON schema with python dep refs

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-05-25 20:11:38 +00:00
Alex Goodman 048df17e3d Use values in relationship To/From fields (#2871) 
* use pkg values in relationship fields

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add linter rule for using values in relationships

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* use new cmptest package for comparing relationships

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* create cmptest for common cmp.Diff options in test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* condense matches for relationship ruleguard

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove relationship type from rules

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* restore build tag

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* suggest using values

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* nil check pkgs

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-05-14 13:48:33 -04:00
Alex Goodman 7ad7627d5d add support for RPM DB package relationships (#2872) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-05-14 13:48:19 -04:00
Alex Goodman 4a18895545 Add abstraction for adding relationships from package cataloger results (#2853) 
* add internal dependency resolver

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* refactor dependency relationship resolution to common object

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* replace cataloger decorator with generic processor

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* refactor resolver to be a single function

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* use common dependency specifier for debian

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* use common dependency specifier for arch

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* use common dependency specifier for alpine

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* allow for generic pkg and rel assertions in testpkg helper

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* do not allow for empty results

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* move stable deduplicate comment

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove relationship resolver type

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-05-14 13:27:36 +00:00
Alex Goodman c200896a96 fix pruning binary packages when considering ELF packages (#2862) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-05-09 19:35:22 +00:00
Alex Goodman ada8f009d2 Add relationships for ALPM packages (arch linux) (#2851) 
* add alpm relationships

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* tweak reader linter rule to check for reader impl

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update JSON schema with alpm dependency information

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-05-07 13:29:46 -04:00