oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-11 21:57:22 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,932 Commits 63 Branches 272 Tags
add-llms-txt
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Alex Goodman 8a7302c5cf migrate to get.anchore.io (#4095) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-07-30 10:54:22 -04:00
Alex Goodman f0a990b85f chore: add source completion tester (#4077) 
* add source completion tester

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add missing t.Helper calls

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-07-23 13:49:47 +00:00
Alex Goodman 2bda086423 Add ability to scan snaps (as a source) (#3929) 2025-06-25 16:53:35 -04:00
Alex Goodman 96c34ffc43 account for non-import shapes (#3997) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-06-11 13:11:40 -04:00
Alex Goodman 79b6d5daa4 Allow decoding of anchorectl json files (#3973) 
* allow decoding of import sbom file shape

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address formatting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add file mode and type processing

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* use type to interpret the raw value

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* safe mode convert should use uint32

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* simpler decoder type

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-06-10 15:03:50 -04:00
Alex Goodman 18f9b5ab58 remove benchmark utils (#3982) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-06-09 18:24:49 +00:00
Alex Goodman ac883f52ed add cdx group as purl namespace (#3922) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-20 15:56:08 -04:00
Alex Goodman e23ca43a83 add PE binary cataloger (#3911) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-19 14:17:09 -04:00
Alex Goodman db77b54c01 finalize go mod ref (#3908) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-16 17:36:26 +00:00
Alex Goodman 2d4fe513ec remove benchmark workflow (#3906) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-16 11:08:43 -04:00
Alex Goodman 0480b516f6 chore: fix publishing test fixture images (#3896) 
* update pkg counts

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* bump max cache size

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-15 14:35:11 -04:00
Alex Goodman 0521ccaf5e chore: update fixtures based on CI builds (#3894) 
* update fixtures based on ci builds

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix typo

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-14 21:30:20 +00:00
Alex Goodman 59b880f26a order locations by container layer order (#3858) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-13 00:02:07 -04:00
Alex Goodman e3e69596bd Translate Portage license strings to SPDX expressions (#1763) 
* fix portage license handling

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* cover license_group file

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add licenses to portage metadata in json schema

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-12 21:03:51 -04:00
Alex Goodman f9d0fa81ab do not search binary contents for version for go package (#3874) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-09 17:49:17 +00:00
Alex Goodman abe5e27b4b fix: remove race when writing errors in generic cataloger (#3875) 
* fix generic cataloger race

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update race test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-09 17:46:47 +00:00
Alex Goodman a7816dc9e7 clear devel version for go packages (#3873) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-09 13:36:52 -04:00
Alex Goodman 1574fb20ae merge multiple targets for the same dotnet package (#3869) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-08 15:28:08 +00:00
Alex Goodman 7b25ea5eda annotate hidden paths in all-layers scope (#3855) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-06 09:50:04 -04:00
Alex Goodman d47a6c3a6d Improve support for cataloging nix package relationships (#3837) 
* add nix DB cataloger

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add derivation path to nix store pkg metadata

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* go mod tidy

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* allow for derivation path to be optional

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* repin build image and disable syscall filtering

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* bump storage capacity

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* track nix derivation details on packages

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* image fixture should have derivation examples

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-05 15:35:13 +00:00
Alex Goodman 03fa142de9 Resolve owned file paths when searching for overlaps (#3828) 
* resolve owned file paths when searching for overlaps

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* dont remove empty paths

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-04-24 21:59:45 +00:00
Alex Goodman 5c6c6aa123 Add support for detecting javascript assets in .NET projects using libman (#3825) 
* add support for .NET libman files

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix when no libman detected

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add libman.json docs

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-04-24 17:11:01 +00:00
Alex Goodman df18edf905 Consider DLL claims for dependencies of .NET packages from deps.json (#3822) 
* consider child dll claims for .NET packages from deps.json

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* make dll claim propagation configurable

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-04-24 11:59:16 -04:00
Alex Goodman 2dd9d583af PE cataloger should consider compile target paths from deps.json (#3821) 
* fix PE compile path processing

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* adjust fixture comment

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-04-24 14:01:53 +01:00
Alex Goodman 24df095a5e empty source during decoding should not be fatal (#3791) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-04-11 10:12:29 -04:00
Alex Goodman 12f36420dd Parse GitHub actions comments (#3776) 
* add version comment parsing support to github actions

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update json schema with github actions metadata

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add originator processing for github actions type

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-04-03 14:46:27 +00:00
Alex Goodman f851085668 Expand python license scanning to cover unclaimed files (#3779) 
* expand python license scanning to cover unclaimed files

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* speed up tests using the license scanner

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-04-03 10:31:02 -04:00
Alex Goodman d033ad7de6 unpin go version in ci (#3773) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-04-01 13:27:15 +00:00
Alex Goodman c53f2fbad3 Better represent .NET runtime packages (#3768) 
* clean up .NET runtime packages

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add runtime relationships

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove runtime references from binary package name

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-03-28 13:36:27 -04:00
Alex Goodman 40dd5d0bbd better .NET cpe generation (#3764) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-03-28 10:58:59 -04:00
Alex Goodman ad9928cb2a Merge the .NET deps.json and PE binary catalogers (#3563) 
* add combined deps.json + pe binary cataloger

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* deprecate pe and deps standalone catalogers

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* parse resource names + add tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix integration and CLI tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add some helpful code comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* allow for dropping Dep packages that are missing DLLs

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* migrate json schema changes to 24

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* keep application configuration

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* correct config help

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* [wip] detect claims of dlls within deps.json

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* [wip] fix tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add assembly repack detection

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* .net package count is lower due to dll claim requirement

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-03-27 14:38:16 -04:00
Alex Goodman e9b24a29d7 Remove mitchellh dependencies (#3748) 
* remove mitchellh dependencies

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix failing unit tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-03-20 10:19:19 -04:00
Alex Goodman 2738291a96 swap centos images for rocky (#3741) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-03-18 14:25:03 +00:00
Alex Goodman 34e5ff753f Location order on packages should consider evidence annotations when sorting (#3720) 
* fix: sorting locations should consider pkg evidence

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* simplify location test options for comparison

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-03-11 10:34:37 -04:00
Alex Goodman f6605a3817 suppress file already closed errors (#3695) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-02-27 21:52:50 +00:00
Alex Goodman 5e2723187d Fix /etc/redhat-release file parsing when resolving distro details (#3688) 2025-02-26 12:42:29 +00:00
Alex Goodman 684b6e3f98 Add file catalogers to selection configuration (#3505) 
* add file catalogers to selection configuration

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix typos

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* warn when there is conflicting file cataloging configuration

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* allow for explicit removal of all package and file tasks

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address PR feedback

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-02-03 19:10:17 +00:00
Alex Goodman cbce129bb9 Use reader when scanning for package versions over reading entire binary into memory (#3558) 
* use streaming readers

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* replace redis search patterns

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address PR feedback

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-01-02 22:12:37 +00:00
Alex Goodman d77e78ea9d Make pre-release integration PRs (#3370) 
* use reusable dep update action

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* use workflow that takes multiple repo

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix mispelling

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove taskfile update

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* bump action to main branch

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* rename action

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove gh make var

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-12-10 17:14:11 +00:00
Alex Goodman d38efb0b7f chore(deps): update anchore dependencies (#3510) 
* integrate anchore deps

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* upgrade to released versions

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-12-09 15:51:16 -05:00
Alex Goodman 340b5e17f0 Add relationships for rust audit binary packages (#3500) 
* add rust audit binary pkg relationships

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix linting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-12-06 09:23:18 -05:00
Alex Goodman b0bffef1a2 restore log on ui teardown (#3427) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-11-08 12:31:38 -05:00
Alex Goodman e4e985b9b0 Create single license scanner for all catalogers (#3348) 
* add single license scanner instance

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* rename testing license scanner

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-10-21 16:17:12 +00:00
Alex Goodman 56dbb342ef update to latest packageurl-go (#3347) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-10-18 14:47:02 -04:00
Alex Goodman fbff87fc6d shorten release docs (#3318) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-10-11 05:17:01 -04:00
Alex Goodman 13c6876906 Track supporting DPKG evidence (#3228) 
* add dpkg evidence support

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* use path over filepath

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-10-04 11:07:29 -04:00
Alex Goodman d7005d7d8c add awaiting response management (#3272) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-09-25 08:56:21 -04:00
Alex Goodman 01de99b253 Add JVM cataloger (#3217) 
* add jvm cataloger

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* simplify version selection

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* CPEs from JVM cataloger should be declared

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* ensure package overlap is enabled for sensitive use cases

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* more permissive glob

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-09-23 17:21:38 -04:00
Alex Goodman 963ea594c8 Add compliance policy for empty name and version (#3257) 
* add policy for empty name and version

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* default stub version

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* modifying ids requires augmenting relationships

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-09-20 12:50:47 -04:00
Alex Goodman ba7bf6b85e dont cleanup cache in forks (#3214) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-09-09 20:27:21 +00:00
Alex Goodman b153b1d594 less verbose java logging when non-fatal issues arise (#3208) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-09-09 15:27:59 +00:00
Alex Goodman 0a3f513f92 Slim down docker cache size (#3190) 
* slim down docker cache size

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove old centos images

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* troubleshoot test failure

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix wget version ref

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* refactor caching mechanisms

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add cache cleanup steps

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* simplify deleting cache

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix first clone issue

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add tool dep

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-09-09 11:15:13 -04:00
Alex Goodman e9a8c27be1 respond to authoratative CPEs from catalogers (#3166) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-08-27 10:26:35 -04:00
Alex Goodman 4ee6c179f8 set cataloger names within package cataloger task (#3165) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-08-27 09:23:43 -04:00
Alex Goodman b6b5c8e308 fix ELF package correlations (#3151) 2024-08-26 08:44:39 -04:00
Alex Goodman 9573f557d1 better go mod detection from partial package builds (#3060) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-07-24 09:34:40 -04:00
Alex Goodman 573440b7cf Infer the package type from ELF package notes (#3008) 
* fix ELF package types to be honored

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* prefer OS packages over binary packages when there are duplicates

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-07-02 16:07:08 -04:00
Alex Goodman 0956753409 Consider Author field for wordpress plugins when generating CPEs (#2946) 
* enhance wordpress vendor candidates for CPEs

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* encode wordpress plugin target software

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-10 14:12:20 -04:00
Alex Goodman f966bcfd03 trim whitespace from wordpress values (#2945) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-10 13:35:01 -04:00
Alex Goodman c43f4fb416 add signature verification to install.sh (#2941) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-10 11:29:53 -04:00
Alex Goodman db0c33481e pin golang image (#2944) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-10 09:59:33 -04:00
Alex Goodman 254a562b4e Add support for reading ELF package notes with section header (#2939) 
* add support for reading ELF package notes with section header

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add systemd elf package fields to json schema

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-07 14:38:54 -04:00
Alex Goodman 6e16396d18 remove dco workflow (#2936) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-06 14:29:55 +00:00
Alex Goodman 3472b48177 Add relationships for python poetry packages (#2906) 
* [wip] add initial poetry.lock relationship support

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* provide generic set for basic types

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* dependency resolver should allow for conditional deps

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add tests for poetry lock relationship additions

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update schema with python poetry dependency refs

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* dep specification data structure should not be recursive in nature

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-04 20:00:05 +00:00
Alex Goodman 4bdbd1aa2a remove unused test fixtures and empty dirs (#2924) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-04 15:22:49 -04:00
Alex Goodman cb09dd9e19 match existing DCO GH check name 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-04 13:34:29 -04:00
Alex Goodman 2f39322f81 use dco tool during gh app outage (#2926) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-04 17:31:29 +00:00
Alex Goodman f4a69e6d35 add relationships for go binary packages (#2912) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-05-30 11:37:17 -04:00
Alex Goodman 05e8ba948d Add python wheel egg relationships (#2903) 
* add python package relationships

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* nil for empty relationships collections

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* new json schema for optional python requiremenets

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update format snapshots for python packages

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* decompose python parsers more + add tests around plural fields

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update JSON schema with python dep refs

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-05-25 20:11:38 +00:00
Alex Goodman 048df17e3d Use values in relationship To/From fields (#2871) 
* use pkg values in relationship fields

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add linter rule for using values in relationships

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* use new cmptest package for comparing relationships

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* create cmptest for common cmp.Diff options in test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* condense matches for relationship ruleguard

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove relationship type from rules

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* restore build tag

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* suggest using values

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* nil check pkgs

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-05-14 13:48:33 -04:00
Alex Goodman 7ad7627d5d add support for RPM DB package relationships (#2872) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-05-14 13:48:19 -04:00
Alex Goodman 4a18895545 Add abstraction for adding relationships from package cataloger results (#2853) 
* add internal dependency resolver

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* refactor dependency relationship resolution to common object

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* replace cataloger decorator with generic processor

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* refactor resolver to be a single function

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* use common dependency specifier for debian

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* use common dependency specifier for arch

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* use common dependency specifier for alpine

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* allow for generic pkg and rel assertions in testpkg helper

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* do not allow for empty results

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* move stable deduplicate comment

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove relationship resolver type

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-05-14 13:27:36 +00:00
Alex Goodman c200896a96 fix pruning binary packages when considering ELF packages (#2862) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-05-09 19:35:22 +00:00
Alex Goodman ada8f009d2 Add relationships for ALPM packages (arch linux) (#2851) 
* add alpm relationships

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* tweak reader linter rule to check for reader impl

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update JSON schema with alpm dependency information

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-05-07 13:29:46 -04:00
Alex Goodman 430c55a5b0 remove homebrew update workflow (#2846) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-05-06 15:38:12 -04:00
Alex Goodman 49e93646eb Restore version file update on release (#2844) 
* restore version file update on release

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* allow for shallower fetch depth

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-05-06 15:14:43 -04:00
Alex Goodman a56eff90d6 fix ui race for package count (#2839) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-05-06 11:45:52 -04:00
Alex Goodman 34ca9a8412 add security policy (#2835) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-05-02 14:45:17 +00:00
Alex Goodman 5b03788300 Fill in SPDX originator for all supported package types (#2822) 
* add failing test + beef up doc comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* cover more metadata types in spdx originator processing

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-04-29 16:33:00 -04:00
Alex Goodman 87cd6c8c48 update spdx license list to 3.23 (#2818) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-04-26 14:50:55 +00:00
Alex Goodman 0d5ebed74a dont include labels for dependabot ecosystems (#2720) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-03-21 12:16:01 -04:00
Alex Goodman 47fc909700 Show binary exports, entrypoint, and imports (#2626) 
show binary exports, entrypoint, and imports for macho, elf, and pe formats

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-03-12 22:04:02 +00:00
Alex Goodman 6377465440 Mark duplicated rows in table output (#2679) 
* mark duplicated rows in table output

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix unit test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-29 09:33:00 -05:00
Alex Goodman 06ff1a353a enforce breaking change bump major version (#2635) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-28 15:48:20 -05:00
Alex Goodman 48e5672a87 Consider filesystem types for mount points when ignoring system paths (#2675) 
* consider fs types for mount points when ignoring system paths

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address feedback

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-28 15:37:17 -05:00
Alex Goodman 0c3b8ca4ed rename binary classifier cataloger name (#2643) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-20 13:52:11 -05:00
Alex Goodman 434b6ad506 add cataloger selection example (#2646) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-20 11:44:42 -05:00
Alex Goodman a1b23bd57d add syft version used to SBOM tool info by default (#2647) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-14 16:57:31 -05:00
Alex Goodman 65cadda486 Survive indexing dead symlinks (#2645) 
* survive indexing branches that start with a bad symlink

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add log statement

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-14 21:06:22 +00:00
Alex Goodman a909e3cec9 fix considering base path when ignoring known bad unix paths (#2644) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-14 15:57:38 -05:00
Alex Goodman 8e62ff9831 test for field conventions in json schema (#2642) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-14 11:11:53 -05:00
Alex Goodman 98b700e83c rename binary cataloger to be more unique (#2633) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-14 11:01:55 -05:00
Alex Goodman 25ae7bf55f fix getting union reader for sif images (#2631) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-13 15:12:31 +00:00
Alex Goodman 84576b93e1 Guess go main module version based on binary contents (#2608) 
* guess go main module version based on binary contents

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add configuration options for golang main module version heuristics

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix test setup for go bin cataloger

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix unit test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix incorrect test assert ordering

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* handle error from seek

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-09 19:52:42 +00:00
Alex Goodman 7444a9f976 fix readme around templating options (#2612) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-09 13:44:41 -05:00
Alex Goodman 8683cba081 suppress executable parsing issues (#2614) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-09 17:13:58 +00:00
Alex Goodmanandmikey strauss c61f59e7b7 Finalize Conan v2 support (#2587) 
* Add support for conan lock v2 (#2461)

* conan lock 2.x requires field support

Signed-off-by: houdini91 <mdstrauss91@gmail.com>

* PR review, struct renaming

Signed-off-by: houdini91 <mdstrauss91@gmail.com>

---------

Signed-off-by: houdini91 <mdstrauss91@gmail.com>

* decompose conanlock parser + add tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: houdini91 <mdstrauss91@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: mikey strauss <mdstrauss91@gmail.com>
 2024-02-07 08:24:02 -05:00
Alex Goodman fd3844853a labeler should ignore latest version (#2588) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-02 18:08:15 -05:00
Alex Goodman 3023a5a7bc Detect ELF security features (#2443) 
* add detection of ELF security features

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix linting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update json schema with file executable data

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update expected fixure when no tty present

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* more detailed differ

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* use json differ

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove json schema addition

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* regenerate json schema

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix mimtype set ref

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-02 16:51:18 +00:00
Alex Goodman 3da679066e Add API examples (#2517) 
* [wip] initial syft api examples

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* smooth over some rough edges in the API

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* embed example file

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address review comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* change name of builder function

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-02 16:26:44 +00:00