354 Commits

Include renames

Author	SHA1	Message	Date
RogueAIandKeith Zantow	aeea170b19	fix: disable cert validation in dotnet-portable-executable-cataloger by default (#3677) ... Signed-off-by: rogueai <rogueai@users.noreply.github.com> Signed-off-by: Keith Zantow <kzantow@gmail.com> Co-authored-by: Keith Zantow <kzantow@gmail.com>	2025-02-21 15:08:06 -05:00
3 people	bffe26bcc5	feat: add support for Bitnami cataloguer (#3341) ... * prototype: start bitnami cataloger Bitnami images have spdx SBOMs at predictable paths, and Syft could more accurately identify the software in these images by scanning those SBOMs. Start work on this by forking the sbom-cataloger as a new bitnami-cataloger. Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * wire up bitnami cataloger to run on images by default Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * feat: add support for Bitnami cataloguer Signed-off-by: juan131 <jariza@vmware.com> * feat: use a better SPDX sample for unit tests Signed-off-by: juan131 <jariza@vmware.com> * bugfix: only report bitnami pkgs Signed-off-by: juan131 <jariza@vmware.com> * feat: adapt JSON schema, spdxutil and packagemetadata Signed-off-by: juan131 <jariza@vmware.com> * bugfix: integration tests Signed-off-by: juan131 <jariza@vmware.com> * feat: implement FileOwner interface Signed-off-by: juan131 <jariza@vmware.com> * bugfix: update json schema Signed-off-by: juan131 <jariza@vmware.com> * [wip] add bitnami owned files and fix binary package ownership filtering Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * feat: obtain bitnami pkg files based on SPDX relationships tree Signed-off-by: juan131 <jariza@vmware.com> * preserve type switches Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename bitnami entry metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * restrict find main pkg logic Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add missing graalvm source info Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bugfix: integration tests Signed-off-by: juan131 <jariza@vmware.com> * bugfix: mod tidy Signed-off-by: juan131 <jariza@vmware.com> --------- Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> Signed-off-by: juan131 <jariza@vmware.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-02-18 09:07:47 -05:00
Keith Zantow	2328b20082	fix: reduce warn levels to debug for non-actionable errors (#3645) ... Signed-off-by: Keith Zantow <kzantow@gmail.com>	2025-02-07 13:22:55 -05:00
Christopher Angelo Phillips	e584c9f416	feat: 3626 add option enable license content; disable by default (#3631) ... --------- Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2025-02-05 20:41:03 +00:00
Alex Goodman	684b6e3f98	Add file catalogers to selection configuration (#3505) ... * add file catalogers to selection configuration Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix typos Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * warn when there is conflicting file cataloging configuration Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * allow for explicit removal of all package and file tasks Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * address PR feedback Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-02-03 19:10:17 +00:00
HeyeOpenSourceandChristopher Phillips	f7e767fc25	feat: update licenses to including license content when SPDX expressions are unable to be determined (#3366) ... --------- Signed-off-by: HeyeOpenSource <opensource@heye-international.com> Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2025-01-28 18:05:27 +00:00
3 people	c10e904c28	feat(cataloger): add a terraform provider cataloger (#3378) ... * feat(cataloger): add a terraform provider cataloger * chore: bump schema from 16.0.19 -> 16.0.20 ------ Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2025-01-21 14:44:54 -05:00
Bert CoppensandAlex Goodman	512319337f	feat: add cataloger for NuGet packages (#3484) ... * add cataloger for dotnet packages.lock.json files Signed-off-by: Kemosabert <bert.coppens14@gmail.com> * add entry for dotnet packages.lock files Signed-off-by: Kemosabert <bert.coppens14@gmail.com> * add unit test for dotnet packages.lock cataloger Signed-off-by: Kemosabert <bert.coppens14@gmail.com> * add test for faulty packages.lock.json file Signed-off-by: Kemosabert <bert.coppens14@gmail.com> * add missing name metadata Signed-off-by: Kemosabert <bert.coppens14@gmail.com> * ensure package appears with version Signed-off-by: Kemosabert <bert.coppens14@gmail.com> * add example of conflicting dependencies Signed-off-by: Kemosabert <bert.coppens14@gmail.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema and fix tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * move section Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Kemosabert <bert.coppens14@gmail.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-01-16 14:57:17 -05:00
Alex Goodman	cbce129bb9	Use reader when scanning for package versions over reading entire binary into memory (#3558) ... * use streaming readers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * replace redis search patterns Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * address PR feedback Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-01-02 22:12:37 +00:00
Christopher Angelo Phillips	561ed50c2d	chore: migrate syft to use the anchore fork of archiver without replace (#3516) ... --------- Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2024-12-10 13:33:24 -05:00
Christopher Angelo PhillipsandKeith Zantow	8a41d77250	chore: prevent file resolver from bubbling errors in binary cataloger (#3410) ... Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> Signed-off-by: Keith Zantow <kzantow@gmail.com> Co-authored-by: Keith Zantow <kzantow@gmail.com>	2024-11-04 20:23:27 +00:00
Ariel Miculas-Trif	06d300e662	Enable cargo-auditable-binary-cataloger for files/directories (#3376) ... Especially when scanning a single binary file, the cargo-auditable-binary-cataloger should run and report the rust binary's dependencies: ``` scan --select-catalogers rust <binary_file> ``` This is in line with other binary catalogers, such as the go-module-binary-cataloger. Signed-off-by: Ariel Miculas-Trif <amiculas@cisco.com>	2024-10-23 14:55:04 +00:00
Alex Goodman	e4e985b9b0	Create single license scanner for all catalogers (#3348) ... * add single license scanner instance Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename testing license scanner Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-10-21 16:17:12 +00:00
Keith ZantowandAlex Goodman	ccbee94b87	feat: report unknowns in sbom (#2998) ... Signed-off-by: Keith Zantow <kzantow@gmail.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-10-07 16:11:37 -04:00
Alex Goodman	13c6876906	Track supporting DPKG evidence (#3228) ... * add dpkg evidence support Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * use path over filepath Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-10-04 11:07:29 -04:00
Niv Govrin	dbad17de9e	fix: don't use builtin scanner in licensecheck (#3290) ... Signed-off-by: Niv Govrin <nivgo@oligosecurity.io>	2024-10-01 13:53:54 -04:00
Alex Goodman	01de99b253	Add JVM cataloger (#3217) ... * add jvm cataloger Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * simplify version selection Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * CPEs from JVM cataloger should be declared Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * ensure package overlap is enabled for sensitive use cases Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * more permissive glob Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-09-23 17:21:38 -04:00
Alex Goodman	963ea594c8	Add compliance policy for empty name and version (#3257) ... * add policy for empty name and version Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * default stub version Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * modifying ids requires augmenting relationships Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-09-20 12:50:47 -04:00
anchore-actions-token-generator[bot]andspiffcs	58100fec9f	chore(deps): update tools to latest versions (#3205) ... * chore(deps): update tools to latest versions Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore: disable gosec(G115) A change to the rule gosec(G115) made a large amount of FP for gosec appear when updating to the latest golang-ci linter. https://github.com/securego/gosec/issues/1185 https://github.com/securego/gosec/pull/1149 We're going to ignore this rule for the time being while waiting for gosec to get updates so that bound checking and example snippets of `valid` code is added for this rule Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> --------- Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>	2024-09-13 15:05:50 -04:00
Keith Zantow	1b863268df	feat: --enrich flag for data enrichment feature enablement (#3182) ... Signed-off-by: Keith Zantow <kzantow@gmail.com>	2024-09-12 10:45:18 -04:00
Laurent Goderre	9c2799e379	Add the Ocaml ecosystem (#3112) ... Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-09-10 10:35:18 -04:00
Alex Goodman	0a3f513f92	Slim down docker cache size (#3190) ... * slim down docker cache size Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove old centos images Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * troubleshoot test failure Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix wget version ref Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * refactor caching mechanisms Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add cache cleanup steps Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * simplify deleting cache Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix first clone issue Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tool dep Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-09-09 11:15:13 -04:00
GGMU	04e3371cce	fix: add log time of task (#3105) ... Signed-off-by: tomersein <tomersein@gmail.com>	2024-08-28 11:04:26 -04:00
Alex Goodman	e9a8c27be1	respond to authoratative CPEs from catalogers (#3166) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-08-27 10:26:35 -04:00
Alex Goodman	4ee6c179f8	set cataloger names within package cataloger task (#3165) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-08-27 09:23:43 -04:00
Alex Goodman	b6b5c8e308	fix ELF package correlations (#3151)	2024-08-26 08:44:39 -04:00
anchore-actions-token-generator[bot]	dad253785e	chore(deps): update tools to latest versions (#3144)	2024-08-23 14:42:12 -04:00
Keith Zantow	95b4a88256	fix: logging for remote network calls (#3140) ... Signed-off-by: Keith Zantow <kzantow@gmail.com>	2024-08-20 11:45:33 -04:00
anchore-actions-token-generator[bot]andspiffcs	4b7ae0ed3b	chore(deps): update tools to latest versions (#3121) ... * chore(deps): update tools to latest versions Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore: update code to reflect new linter settings for error messages Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> --------- Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>	2024-08-16 17:56:36 +00:00
luozexuan	c19cf626ab	chore: fix some comments (#3114) ... Signed-off-by: luozexuan <fetchcode@139.com>	2024-08-12 12:08:04 -04:00
Laurent Goderre	92d63df6f5	Added the SWI Prolog (swipl) ecosystem (#3076) ... * Add binary classifier for swipl Signed-off-by: Laurent Goderre <laurent.goderre@docker.com> * Added cataloger for SWI Prolog Pack packages Signed-off-by: Laurent Goderre <laurent.goderre@docker.com> --------- Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-07-31 16:13:26 -04:00
Keith Zantow	741c8fb9bd	fix: SPDX output performance with many relationships (#3053)	2024-07-24 10:14:20 -04:00
Alex Goodman	573440b7cf	Infer the package type from ELF package notes (#3008) ... * fix ELF package types to be honored Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * prefer OS packages over binary packages when there are duplicates Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-07-02 16:07:08 -04:00
Keith Zantow	bd1c1d260c	fix: handle errors reading go licenses (#2985) ... Signed-off-by: Keith Zantow <kzantow@gmail.com>	2024-06-24 10:27:03 -04:00
Keith Zantow	af3aaa0397	fix: make caching options more explicit (#2966) ... Signed-off-by: Keith Zantow <kzantow@gmail.com>	2024-06-14 18:45:48 +00:00
Keith Zantow	ca0cc52d47	fix: separate golang license caches from mod dir (#2852) ... Signed-off-by: Keith Zantow <kzantow@gmail.com>	2024-06-12 19:12:35 -04:00
Alex Goodman	254a562b4e	Add support for reading ELF package notes with section header (#2939) ... * add support for reading ELF package notes with section header Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add systemd elf package fields to json schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-06-07 14:38:54 -04:00
Alex Goodman	3472b48177	Add relationships for python poetry packages (#2906) ... * [wip] add initial poetry.lock relationship support Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * provide generic set for basic types Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * dependency resolver should allow for conditional deps Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for poetry lock relationship additions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update schema with python poetry dependency refs Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * dep specification data structure should not be recursive in nature Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-06-04 20:00:05 +00:00
Jon JohnsonandWill Murphy	c314e05aae	Handle GOEXPERIMENTs in go version (#2893) ... * Handle GOEXPERIMENTs in go version Signed-off-by: Jon Johnson <jon.johnson@chainguard.dev> * bump JSON schema Signed-off-by: Will Murphy <will.murphy@anchore.com> --------- Signed-off-by: Jon Johnson <jon.johnson@chainguard.dev> Signed-off-by: Will Murphy <will.murphy@anchore.com> Co-authored-by: Will Murphy <will.murphy@anchore.com>	2024-05-25 20:23:30 +00:00
Alex Goodman	05e8ba948d	Add python wheel egg relationships (#2903) ... * add python package relationships Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * nil for empty relationships collections Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * new json schema for optional python requiremenets Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update format snapshots for python packages Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * decompose python parsers more + add tests around plural fields Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update JSON schema with python dep refs Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-05-25 20:11:38 +00:00
Laurent Goderre	b51252dbdb	feat: Add Lua cataloger (#2613) ... Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-05-24 16:56:34 -04:00
Christopher Angelo Phillips	b41d5cced5	chore: update spdx license list to 3.24.0 (#2895) ... --------- Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>	2024-05-23 13:10:36 +00:00
Alex Goodman	048df17e3d	Use values in relationship To/From fields (#2871) ... * use pkg values in relationship fields Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add linter rule for using values in relationships Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * use new cmptest package for comparing relationships Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * create cmptest for common cmp.Diff options in test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * condense matches for relationship ruleguard Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove relationship type from rules Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * restore build tag Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * suggest using values Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * nil check pkgs Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-05-14 13:48:33 -04:00
Alex Goodman	7ad7627d5d	add support for RPM DB package relationships (#2872) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-05-14 13:48:19 -04:00
Alex Goodman	4a18895545	Add abstraction for adding relationships from package cataloger results (#2853) ... * add internal dependency resolver Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * refactor dependency relationship resolution to common object Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * replace cataloger decorator with generic processor Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * refactor resolver to be a single function Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * use common dependency specifier for debian Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * use common dependency specifier for arch Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * use common dependency specifier for alpine Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * allow for generic pkg and rel assertions in testpkg helper Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * do not allow for empty results Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * move stable deduplicate comment Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove relationship resolver type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-05-14 13:27:36 +00:00
Alex Goodman	c200896a96	fix pruning binary packages when considering ELF packages (#2862) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-05-09 19:35:22 +00:00
Brian EbarbandAlex Goodman	4194a2cd34	feat: add relationships to ELF package discovery (#2715) ... This PR adds DependencyOf relationships when ELF packages have been discovered by the binary cataloger. The discovered file.Executable type has a []ImportedLibraries that's read from the file when discovered by syft. By mapping these imported libraries back to the package collection, syft is able to create relationships showing which packages are dependencies of other packages by just reading metadata from the ELF executable. --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: Brian Ebarb <ebarb.brian@sers.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-05-09 13:53:59 -04:00
Alex Goodman	ada8f009d2	Add relationships for ALPM packages (arch linux) (#2851) ... * add alpm relationships Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * tweak reader linter rule to check for reader impl Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update JSON schema with alpm dependency information Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-05-07 13:29:46 -04:00
Alex Goodman	a56eff90d6	fix ui race for package count (#2839) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-05-06 11:45:52 -04:00
Weston Steimel	9604e3dc9c	feat: support multiple known CPEs in index (#2813) ... It is possible that a given package has multiple known "official" CPEs active in the dictionary at once, so the index should support a slice of CPE strings per package Signed-off-by: Weston Steimel <commits@weston.slmail.me>	2024-04-25 15:22:26 +01:00