oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-11 21:57:22 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,134 Commits 63 Branches 272 Tags
feat/directory-alias-identifiers
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Keith Zantow 674558adbd feat: detect name/version from directory scans 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-05-29 21:14:41 -04:00
Keith Zantow ac34808b9c feat: detect fluent-bit binaries (#2905) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-05-28 10:13:06 -04:00
Keith Zantow 1c37bab2b2 feat: add config command (#2892) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-05-23 15:18:09 -04:00
Keith Zantow b0c88ddea9 fix(spdx): include required fields (#2168) 
* fix(spdx): include required fields

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: missed update due to refactoring

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: update tools-golang

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: add test with packageVerificationCode included and excluded

Signed-off-by: Keith Zantow <kzantow@gmail.com>

---------

Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-04-30 13:28:42 -04:00
Keith Zantow 047e31a969 fix: add correct vendor for dnsmasq CPE (#2659) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-04-30 13:24:01 -04:00
Keith Zantow f7d3d552ce fix: exclude known instrumentation jars from being erroneously identified (#2796) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-04-22 15:03:17 -04:00
Keith ZantowandWill Murphy dde5d349b1 fix: more robust go main version extraction (#2767) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Will Murphy <will.murphy@anchore.com>
Co-authored-by: Will Murphy <will.murphy@anchore.com>
 2024-04-11 11:58:51 -04:00
Keith Zantow 01340b2a5c fix: conan poco project cpe (#2740) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-03-28 16:56:24 -04:00
Keith Zantow 410867ca0c fix: panic scanning binaries without symtab (#2739) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-03-27 13:51:45 -04:00
Keith Zantow f9e09aef19 docs: add simplest example from regsitry (#2691) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-03-06 14:25:37 -05:00
Keith Zantow 326ec57d4a docs: fix incorrect flag name in readme (#2677) 2024-02-28 15:39:43 -05:00
Keith Zantow a978966cad feat: add --from flag, refactor source providers (#2610) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-02-27 16:44:37 -05:00
Keith Zantow 2995c3c4fd fix: SPDX tag value version selector (#2665) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-02-23 08:22:10 -05:00
Keith Zantow 108a5dae9b chore: update busybox image for acceptance tests (#2663) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-02-22 15:32:17 -05:00
Keith Zantow 6288530835 fix: add BOMRef to CycloneDX OS Component (#2634) 2024-02-14 08:18:16 -05:00
Keith Zantow d26a5c4d30 fix: ensure version output to stdout (#2621) 2024-02-09 20:59:25 +00:00
Keith Zantow ef5c1651ef fix: improve dotnet portable executable identification (#2133) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-11-29 12:51:24 -05:00
Keith Zantow f5a6b5a02f fix: logging level for parsing potential PE files (#2367) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-11-29 03:42:22 +00:00
Keith Zantow a50a0f77d2 fix: capture root command stdout (#2364) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-11-28 15:04:28 -05:00
Keith Zantow 1c787f436f fix: prevent writing non-report output to stdout (#2324) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-11-16 17:45:25 -05:00
Keith Zantow d91c2dd842 fix: identify cyclone-json without $schema (#2303) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-11-08 11:54:22 -05:00
Keith Zantow 7d0d3e1977 fix: prevent errors from clobbering terminal (#2161) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-09-20 14:35:41 -04:00
Keith Zantow a46d12270f fix: encode and decode FileLicenses and FileContents in Syft JSON (#2083) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-09-13 16:14:20 -04:00
Keith ZantowandAlex Goodman 2b7a9d0be3 chore: update CLI to CLIO (#2001) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-08-29 15:52:26 -04:00
Keith Zantow dd09e0362e chore: update quill to the latest version (#2065) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-25 20:45:04 +00:00
Keith Zantow 4ae94c37eb fix: duplicate entries in cyclonedx dependency list (#2063) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-25 12:19:01 -04:00
Keith Zantow 4762ba0943 feat: use java package names to determine known groupids (#2032) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-17 12:55:25 -04:00
Keith Zantow d1635971a1 fix: inconsistent removal of binaries by overlap (#2036) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-17 15:27:31 +00:00
Keith Zantow 59107324ce chore: restore cataloger.DefaultConfig (#2028) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-14 20:28:07 +00:00
Keith Zantow b3d7ba569b fix: read direct package files when decoding SPDX tag-value (#2014) 
* fix: read direct package files when decoding SPDX tag-value

---------

Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-14 11:37:24 -04:00
Keith Zantow c7272fd6a5 fix: SPDX license values and download location (#2007) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-08 15:55:50 -04:00
Keith Zantow aaf767f8d3 chore: improve spdx purl decoding (#1996) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-04 11:43:21 -04:00
Keith Zantow 79014ed8c8 fix: gradle lockfile parser groupId handling (#1995) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-04 11:42:26 -04:00
Keith Zantow 3f0475efb7 chore: update bubbly to fix hanging (#1990) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-02 10:28:35 -04:00
Keith Zantow e2f7befbfb fix: default image source name to user input (#1979) 
* fix: default image source name to user input

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: add test

Signed-off-by: Keith Zantow <kzantow@gmail.com>

---------

Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-07-31 17:29:18 +00:00
Keith Zantow 9480f10ccd feat: support top-level SPDX package and graph (#1934) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-07-26 13:54:32 -04:00
Keith Zantow f79cb9587f fix: only output valid cyclonedx license choices (#1879) 
* fix: only output valid cyclonedx license choices

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: update tests

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: return nil for emtpty cdx license list

Signed-off-by: Keith Zantow <kzantow@gmail.com>

---------

Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-06-22 12:05:38 -04:00
Keith Zantow 631d50d038 chore: update SPDX license list to 3.21 (#1885) 2023-06-20 15:47:02 +00:00
Keith Zantow 79a955b1a9 feat: source-version flag (#1859) 2023-06-05 10:36:34 -04:00
Keith Zantow a3c5550217 fix: duplicate packages, support pnpm lockfile v6 (#1778) 2023-05-23 10:24:25 -04:00
Keith Zantow ddb338d834 chore: do not HTML escape PackageURLs (#1782) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-05-05 10:08:04 -04:00
Keith Zantow 354c72bbf4 chore: do not include kernel module cataloger by default (#1784) 2023-05-05 09:54:24 -04:00
Keith Zantow 645206735e chore: add more detail on SPDX file IDs (#1769) 2023-05-02 16:52:18 -04:00
Keith Zantow 451cb9d5ca chore: update test redactor ordering (#1765) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-04-26 20:42:43 +00:00
Keith Zantow 7845381331 chore: update tools-golang to v0.5.0 (#1717) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-04-05 13:59:52 -04:00
Keith Zantow 2022ffa0e5 chore: update deprecated set-output calls (#1705) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-04-03 09:36:11 -04:00
Keith Zantow 11e926ab2f chore: fix flaky license sorting (#1690) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-03-22 14:41:49 -04:00
Keith Zantow 34ace36a9e chore: tweak some workflow text (#1685) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-03-21 11:08:49 -04:00
Keith Zantow d05000ff21 fix: reduce logging for bad dpkg lines (#1675) 
* fix: reduce logging for bad dpkg lines to Trace level
---------

Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-03-17 13:08:51 -04:00
Keith Zantow 302735097e fix: remove author contributing to javascript CPEs (#1669) 2023-03-14 14:10:24 +00:00
Keith Zantow cc0a376aba fix: more python matching support (#1667) 2023-03-13 13:26:43 -04:00
Keith Zantow 7714bc0521 fix: improved Python binary detection (#1648) 2023-03-07 10:52:29 -05:00
Keith Zantow 7cfdffab5f fix: sanitize SPDX LicenseRefs (#1657) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-03-06 10:55:23 -05:00
Keith Zantow 304be4a5a1 fix: dotnet PURL types are invalid (#1649) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-03-03 16:45:20 -05:00
Keith Zantow 5f90d03718 fix: possible race condition (#1639) 2023-03-01 15:35:01 -05:00
Keith Zantow 2e6e3b0c74 fix: rebar lock file decoding panic (#1628) 2023-03-01 10:08:29 -05:00
Keith Zantow 24584a4d27 fix: handle individual cataloger panics (#1636) 2023-03-01 10:03:34 -05:00
Keith Zantow 5e8aa4da5e fix: decoding null apk metadata pullDependencies (#1614) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-02-23 19:55:49 +00:00
Keith Zantow 4bf677d555 chore: fix cataloger_test (#1603) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-02-22 17:30:41 +00:00
Keith Zantow f5e20521e0 fix: merging of binary packages (#1583) 2023-02-22 12:03:15 -05:00
Keith Zantow 8f6a317fef fix: issue when matching format versions (#1585) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-02-22 10:32:05 -05:00
Keith Zantow 2ef2eed382 chore: update SPDX license list (#1599) 2023-02-21 17:31:24 +00:00
Keith Zantow a3ebb31e3c chore: update bug issue template (#1571) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-02-14 12:58:44 -05:00
Keith Zantow 890fb3f0e8 fix: missing APK node vulnerabilities (#1565) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-02-10 15:52:13 -05:00
Keith Zantow 9650473298 feat: Allow specific versions of formats to be specified (#1543) 2023-02-07 10:40:43 -05:00
Keith Zantow 1530ef354f chore: update spdx/tools-golang to v0.5.0-rc1 (#1503) 2023-01-31 11:53:16 -05:00
Keith Zantow ba55963104 fix: allow template for syft convert (#1521) 2023-01-26 12:07:36 -05:00
Keith Zantow 674a54512c chore: correct bootstrap tool script (#1514) 2023-01-25 10:22:28 -05:00
Keith ZantowandAlex Goodman 6cf668f749 fix: nil panic in graalvm cataloger (#1468) 
* normalize error handling and recover from panics while parsing binaries
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2023-01-17 19:06:24 +00:00
Keith Zantow 934644232a chore: revert GolangBinMetadata name and make analogous GolangModMetadata (#1458) 2023-01-13 16:46:12 -05:00
Keith Zantow ac94bf530c fix: update graalvm cataloger to fix panic (#1454) 
Fixes https://github.com/anchore/syft/issues/1453
 2023-01-12 17:42:13 -05:00
Keith Zantow 85bddaa43d chore: update schema (#1449) 2023-01-12 14:25:47 -05:00
Keith Zantow 725529f43f fix: duplicate file in tar archive causes read to fail (#1445) 2023-01-10 14:55:02 -05:00
Keith Zantow 64be0a1072 chore: refactor basic CPE functionality to its own package (#1436) 2023-01-04 11:26:28 -05:00
Keith Zantow e1e489a284 fix: unicode output in cyclonedx-json format (#1420) 2022-12-23 08:37:47 -05:00
Keith Zantow b125ea83ba fix: excessive go binary warnings (#1424) 2022-12-23 08:36:49 -05:00
Keith Zantow 7b08608adb feat: add h1digest when scanning go.mod (#1405) 
Fixes https://github.com/anchore/syft/issues/1277
 2022-12-20 02:18:35 +00:00
Keith Zantow 4ffbeeeea5 fix: cyclonedx component type for binaries (#1406) 2022-12-19 19:49:27 -05:00
Keith Zantow b1d6dae203 fix: openjdk detection pattern (#1415) 2022-12-19 19:49:04 -05:00
Keith Zantow 17aa8287e6 docs: remove file classifier (#1397) 2022-12-08 16:50:29 +00:00
Keith Zantow 997fbdfcf3 feat: Add Java binary catalogers (#1392) 2022-12-08 10:50:28 -05:00
Keith Zantow 5dbb3fc41d chore: fix test busybox image sha (#1393) 2022-12-07 20:15:39 -05:00
Keith Zantow 614ea00905 fix: go version not properly identified in binary (#1384) 2022-12-02 13:24:36 -05:00
Keith Zantow 9e43725951 fix: Update node binary package name (#1375) 2022-11-30 10:30:57 -05:00
Keith Zantow 4f39287216 feat: Generic Binary Cataloger (#1336) 2022-11-29 18:28:10 -05:00
Keith Zantow 098e61dcc8 fix: sort relationships in SPDX output (#1350) 2022-11-21 09:26:24 -05:00
Keith Zantow 0dddf51fd5 chore: add debug logging for decode errors (#1352) 2022-11-21 09:26:11 -05:00
Keith Zantow 42cb0a47a4 feat: SPDX 2.3 support (#1311) 2022-11-18 08:54:39 -05:00
Keith Zantow f8be64d312 fix: Unmarshal Syft JSON with missing metadata (#1338) 2022-11-15 13:00:10 -05:00
Keith Zantow c1fdfce5f1 fix: Output only valid CPEs for CycloneDX OS components (#1339) 2022-11-14 15:24:19 -05:00
Keith Zantow f3528132a7 Support encoding map types to CycloneDX properties (#1332) 2022-11-08 18:59:37 -05:00
Keith Zantow 3e99c4d7d8 Fix: Include version information in binary cataloger CPEs (#1310) 2022-11-03 10:17:15 -04:00
Keith Zantow 35f0f2931e chore: update goreleaser brew token (#1306) 2022-11-02 10:05:20 -04:00
Keith Zantow 95c7378109 fix: Decode binary and unknown metadata (#1307) 2022-11-01 21:26:00 +00:00
Keith Zantow ba57f3db51 chore: update github token permissions for goreleaser (#1305) 2022-11-01 16:28:37 +00:00
Keith Zantow c489c37e35 fix: Continue parsing Python RECORD files when bad lines encountered (#1295) 2022-10-29 15:45:59 -04:00
Keith Zantow 78a0af2e2d Add go binary h1 digest to SPDX (#1265) 2022-10-19 16:33:10 -04:00
Keith Zantow 780e1c310c refactor: Remove experimental Anchore Enterprise upload functionality (#1257) 2022-10-10 16:16:47 -04:00
Keith Zantow 4d2f18218c fix: Follow symlinks when searching for globs in all-layers scope (#1221) 2022-09-30 13:01:08 -04:00
Keith Zantow 6a40dbf765 Do not fail if unable to parse .rpm file (#1232) 2022-09-28 11:26:06 -04:00