129 Commits

Include renames

Author	SHA1	Message	Date
3 people	bffe26bcc5	feat: add support for Bitnami cataloguer (#3341) ... * prototype: start bitnami cataloger Bitnami images have spdx SBOMs at predictable paths, and Syft could more accurately identify the software in these images by scanning those SBOMs. Start work on this by forking the sbom-cataloger as a new bitnami-cataloger. Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * wire up bitnami cataloger to run on images by default Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * feat: add support for Bitnami cataloguer Signed-off-by: juan131 <jariza@vmware.com> * feat: use a better SPDX sample for unit tests Signed-off-by: juan131 <jariza@vmware.com> * bugfix: only report bitnami pkgs Signed-off-by: juan131 <jariza@vmware.com> * feat: adapt JSON schema, spdxutil and packagemetadata Signed-off-by: juan131 <jariza@vmware.com> * bugfix: integration tests Signed-off-by: juan131 <jariza@vmware.com> * feat: implement FileOwner interface Signed-off-by: juan131 <jariza@vmware.com> * bugfix: update json schema Signed-off-by: juan131 <jariza@vmware.com> * [wip] add bitnami owned files and fix binary package ownership filtering Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * feat: obtain bitnami pkg files based on SPDX relationships tree Signed-off-by: juan131 <jariza@vmware.com> * preserve type switches Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename bitnami entry metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * restrict find main pkg logic Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add missing graalvm source info Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bugfix: integration tests Signed-off-by: juan131 <jariza@vmware.com> * bugfix: mod tidy Signed-off-by: juan131 <jariza@vmware.com> --------- Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> Signed-off-by: juan131 <jariza@vmware.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-02-18 09:07:47 -05:00
HeyeOpenSourceandChristopher Phillips	f7e767fc25	feat: update licenses to including license content when SPDX expressions are unable to be determined (#3366) ... --------- Signed-off-by: HeyeOpenSource <opensource@heye-international.com> Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2025-01-28 18:05:27 +00:00
3 people	c10e904c28	feat(cataloger): add a terraform provider cataloger (#3378) ... * feat(cataloger): add a terraform provider cataloger * chore: bump schema from 16.0.19 -> 16.0.20 ------ Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2025-01-21 14:44:54 -05:00
Bert CoppensandAlex Goodman	512319337f	feat: add cataloger for NuGet packages (#3484) ... * add cataloger for dotnet packages.lock.json files Signed-off-by: Kemosabert <bert.coppens14@gmail.com> * add entry for dotnet packages.lock files Signed-off-by: Kemosabert <bert.coppens14@gmail.com> * add unit test for dotnet packages.lock cataloger Signed-off-by: Kemosabert <bert.coppens14@gmail.com> * add test for faulty packages.lock.json file Signed-off-by: Kemosabert <bert.coppens14@gmail.com> * add missing name metadata Signed-off-by: Kemosabert <bert.coppens14@gmail.com> * ensure package appears with version Signed-off-by: Kemosabert <bert.coppens14@gmail.com> * add example of conflicting dependencies Signed-off-by: Kemosabert <bert.coppens14@gmail.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema and fix tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * move section Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Kemosabert <bert.coppens14@gmail.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-01-16 14:57:17 -05:00
Keith ZantowandAlex Goodman	ccbee94b87	feat: report unknowns in sbom (#2998) ... Signed-off-by: Keith Zantow <kzantow@gmail.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-10-07 16:11:37 -04:00
Alex Goodman	01de99b253	Add JVM cataloger (#3217) ... * add jvm cataloger Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * simplify version selection Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * CPEs from JVM cataloger should be declared Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * ensure package overlap is enabled for sensitive use cases Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * more permissive glob Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-09-23 17:21:38 -04:00
Laurent Goderre	9c2799e379	Add the Ocaml ecosystem (#3112) ... Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-09-10 10:35:18 -04:00
Laurent Goderre	92d63df6f5	Added the SWI Prolog (swipl) ecosystem (#3076) ... * Add binary classifier for swipl Signed-off-by: Laurent Goderre <laurent.goderre@docker.com> * Added cataloger for SWI Prolog Pack packages Signed-off-by: Laurent Goderre <laurent.goderre@docker.com> --------- Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-07-31 16:13:26 -04:00
Rajan Agaskar	ae0683074e	feat: update syft to generate cyclone-dx 1.6 by default (#2978) ... - Resolves #2974 - add detailed instructions re: updating schemas (a necessary task when a new CycloneDX spec version becomes available). - The DefaultVersion constant has been updated to "1.6" -- it's not clear to me how this is used at this time (it may be redundant given other code), but effectively unless a specific spec version is configured, `syft` will emit the "most recent" spec version available for cyclonedx. Users who wish to pin back to a "older" specVersion (e.g. to preserve compatibilty with utilities that have not yet bumped to latest) can either set this in a syft config file or pass a name@spec_version pair to the output flag (e.g. `-o cyclonedx-json@1.5=some-1.5-spec-bom.cdx.json`) - Regenerate relevant .golden files (there seems to be a way to do this via flags, but I couldn't quite figure out the right set to pass correctly, esp. since (as a relative go novice) I found it difficult to run just a single test file. I ended up "brute-forcing it" by changing the *updateSnapshot val to "true" and running it in Goland. A brief comment giving an example of regenerating fixtures usage would be helpful. Signed-off-by: Rajan Agaskar <ragaskar@gmail.com>	2024-06-21 08:51:27 -07:00
Alex Goodman	254a562b4e	Add support for reading ELF package notes with section header (#2939) ... * add support for reading ELF package notes with section header Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add systemd elf package fields to json schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-06-07 14:38:54 -04:00
Alex Goodman	3472b48177	Add relationships for python poetry packages (#2906) ... * [wip] add initial poetry.lock relationship support Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * provide generic set for basic types Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * dependency resolver should allow for conditional deps Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for poetry lock relationship additions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update schema with python poetry dependency refs Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * dep specification data structure should not be recursive in nature Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-06-04 20:00:05 +00:00
Jon JohnsonandWill Murphy	c314e05aae	Handle GOEXPERIMENTs in go version (#2893) ... * Handle GOEXPERIMENTs in go version Signed-off-by: Jon Johnson <jon.johnson@chainguard.dev> * bump JSON schema Signed-off-by: Will Murphy <will.murphy@anchore.com> --------- Signed-off-by: Jon Johnson <jon.johnson@chainguard.dev> Signed-off-by: Will Murphy <will.murphy@anchore.com> Co-authored-by: Will Murphy <will.murphy@anchore.com>	2024-05-25 20:23:30 +00:00
Alex Goodman	05e8ba948d	Add python wheel egg relationships (#2903) ... * add python package relationships Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * nil for empty relationships collections Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * new json schema for optional python requiremenets Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update format snapshots for python packages Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * decompose python parsers more + add tests around plural fields Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update JSON schema with python dep refs Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-05-25 20:11:38 +00:00
Laurent Goderre	b51252dbdb	feat: Add Lua cataloger (#2613) ... Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-05-24 16:56:34 -04:00
Alex Goodman	7ad7627d5d	add support for RPM DB package relationships (#2872) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-05-14 13:48:19 -04:00
Alex Goodman	ada8f009d2	Add relationships for ALPM packages (arch linux) (#2851) ... * add alpm relationships Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * tweak reader linter rule to check for reader impl Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update JSON schema with alpm dependency information Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-05-07 13:29:46 -04:00
Alex Goodman	87cd6c8c48	update spdx license list to 3.23 (#2818) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-04-26 14:50:55 +00:00
Laurent Goderre	e0233625cb	feat: cataloger for PHP Pecl and PEAR packages (#2604) ... Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-04-02 11:55:56 -04:00
3 people	6a2517b5d2	Add ELF binary package cataloger (#2396) ... * feat Adds Elf package catalogger Signed-off-by: Brian Ebarb <ebarb.brian@gmail.com> * Add test fixtures for elf package Signed-off-by: Colleen Divers <colleen.divers@gmail.com> * bump JSON schema to v16.0.6 + expand test fixtures Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * less verbose logging Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove dead test code Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove unreleated swift change Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Brian Ebarb <ebarb.brian@gmail.com> Signed-off-by: Colleen Divers <colleen.divers@gmail.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Colleen Divers <colleen.divers@gmail.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-03-14 11:16:03 -04:00
Alex Goodman	47fc909700	Show binary exports, entrypoint, and imports (#2626) ... show binary exports, entrypoint, and imports for macho, elf, and pe formats Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-03-12 22:04:02 +00:00
Alexandr HacicheantandAlex Goodman	96ee2db875	feat: Add Wordpress cataloger (#2218) ... * Closes #1911 Wordpress cataloger Signed-off-by: disc <a.hacicheant@gmail.com> * Fixed a few unit tests and static analizer notices Signed-off-by: disc <a.hacicheant@gmail.com> * Updated `README.md` Signed-off-by: disc <a.hacicheant@gmail.com> * Fixed `golangci-lint` notices Added integration test for `wordpress-plugin` Signed-off-by: disc <a.hacicheant@gmail.com> * Fixed `gosimports` notices Signed-off-by: disc <a.hacicheant@gmail.com> * Updated `json schema` version Signed-off-by: disc <a.hacicheant@gmail.com> * Fixed CLI tests, increased expected package count Signed-off-by: disc <a.hacicheant@gmail.com> * Read first 4Kb of a plugins file's content Signed-off-by: disc <a.hacicheant@gmail.com> * replace JSON schema version Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * change wording on source info for wordpress packages Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * Minor changes after a huge refactoring Signed-off-by: disc <a.hacicheant@gmail.com> * Removed unused files Signed-off-by: disc <a.hacicheant@gmail.com> * Updated schema Signed-off-by: disc <a.hacicheant@gmail.com> * Fixed integration tests Signed-off-by: disc <a.hacicheant@gmail.com> * fix integration tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * Renamed `metadata.Name` to `metadata.PluginInstallDirectory` Signed-off-by: disc <a.hacicheant@gmail.com> * rename fields to be compliant with json conventions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: disc <a.hacicheant@gmail.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-02-14 16:03:25 +00:00
Alex Goodmanandmikey strauss	c61f59e7b7	Finalize Conan v2 support (#2587) ... * Add support for conan lock v2 (#2461) * conan lock 2.x requires field support Signed-off-by: houdini91 <mdstrauss91@gmail.com> * PR review, struct renaming Signed-off-by: houdini91 <mdstrauss91@gmail.com> --------- Signed-off-by: houdini91 <mdstrauss91@gmail.com> * decompose conanlock parser + add tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: houdini91 <mdstrauss91@gmail.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: mikey strauss <mdstrauss91@gmail.com>	2024-02-07 08:24:02 -05:00
William Murphy	b735106848	chore: copy latest schema to stable path for easier diff (#2586) ... Because we generate a new JSON schema file every time the schema version changes, the git diff always shows that the file is completely new. Therefore, every time the file is re-generated, also write the schema to a stable path, so that the actual changes to the schema are easily visible in the git diff of the latest schema file. Signed-off-by: Will Murphy <will.murphy@anchore.com>	2024-02-02 17:09:28 -05:00
Asi GreenholtsandAlex Goodman	98de2e2f62	Adding metadata fields when parsing yarn.lock and poetry.lock (#2350) ... * Adding the resolved and integrity fields of yarn.lock to the parsed metadata. This addition is similar to the metadata added when parsing package-lock.json. Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com> * fix comment Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com> * Adding the Index field to metadeta when parsing poetry.lock similarly to the existing Pipfile metadata Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com> * fixing struct accoding to tests Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com> * remove old schema change Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove empty constants Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * re-generate JSON schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update document ref Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-02-02 19:53:42 +00:00
Alex Goodman	3023a5a7bc	Detect ELF security features (#2443) ... * add detection of ELF security features Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update json schema with file executable data Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update expected fixure when no tty present Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * more detailed differ Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * use json differ Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove json schema addition Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * regenerate json schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix mimtype set ref Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-02-02 16:51:18 +00:00
William Murphy	b7a6d5e946	feat: Record where CPEs come from (#2552) ... Syft can get CPEs from several source, including generating them based on package data, finding them in the NVD CPE dictionary, or finding them declared in a manifest or existing SBOM. Record where Syft got CPEs so that consumers of SBOMs can reason about how trustworthy they are. Signed-off-by: Will Murphy <will.murphy@anchore.com>	2024-02-02 16:17:52 +00:00
Alex Goodman	6107e5e2ad	translate maps to sequences in pkg metadata (#2553) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-02-01 11:58:10 -05:00
Alex Goodman	bf3cd9ed3b	allow for RPM modularity to be optional (#2540) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-01-24 13:21:59 -05:00
Alex Goodman	5565bdef0c	Remove the power-user command and related catalogers (#2306) ... * remove the power-user command Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove secrets + classifier catalogers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * regenerate json schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-11-20 15:44:28 +00:00
Alex Goodman	502971a1b2	Add accessPath on Location objects to syft-json output (#2287) ... * add accessPath on Location objects to syft-json output Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * generate json schema v12.0.1 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-11-08 17:05:30 -06:00
Alex Goodman	1aaa644007	Remove MetadataType from core package object and normalize JSON metadataType values (#1983) ... * [wip] Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * distinct the package metadata functions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove metadata type from package core model Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * incorporate review feedback for names Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add RPM archive metadata and split parser helpers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * clarify the python package metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename the KB metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * break hackage and composer types by use case Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * linting fix Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix encoding and decoding for syft-json and cyclonedx Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema to 11 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx-xml snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update spdx-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update spdx-tv snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update syft-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * correct metadata type in stack yaml parser test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix bom-ref redactor for cyclonedx-xml Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for legacy package metadata names Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * regenerate json schema v11 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix legacy HackageMetadataType reflect type value check Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * packagemetadata discovery should account for type shadowing Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema version to v12 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update json schema to incorporate changes from main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add syft-json legacy config option Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests around v11-v12 json decoding Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add docs for SYFT_JSON_LEGACY Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename structs to be compliant with new naming scheme Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-30 12:12:04 -04:00
Alex Goodman	7392d607b6	Split the sbom.Format interface by encode and decode use cases (#2186) ... * split up sbom.Format into encode and decode ops Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cmd pkg to inject format configs Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump cyclonedx schema to 1.5 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * redact image metadata from github encoder tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add more testing around format decoder identify Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add test case for format version options Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix CLI test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * [wip] - review comments Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * keep encoder creation out of post load function Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * keep decider and identify functions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add a few more doc comments Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove format encoder default function helpers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * address PR feedback Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * move back to streaming based decode functions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * with common convention for encoder constructors Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix tests and allow for encoders to be created from cli options Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * buffer reads from stdin to support seeking Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-25 13:43:06 +00:00
Alex Goodman	7315f83f9d	Upgrade tool management (#2188) ... * migrate to binny and taskfile Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update binny to not require github token Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * added support for automatically building snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * detect source changes for snapshot builds Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fail workflow explicitly when snapshot cache restoral fails Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * match snapshot restoral paths Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-25 09:08:43 -04:00
Alex Goodman	ef759038f5	Add relationships for dpkg packages (#2212) ... * add relationships for deb packages Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * small refactor to remove duplicate code Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-11 08:56:26 -04:00
Stefan Profanter	ec4d595920	feat: add dependency information to conan lockfile parser (#2131) ... Signed-off-by: Stefan Profanter <stefan.profanter@agile-robots.com>	2023-09-15 14:31:08 -04:00
Keith Zantow	a46d12270f	fix: encode and decode FileLicenses and FileContents in Syft JSON (#2083) ... Signed-off-by: Keith Zantow <kzantow@gmail.com>	2023-09-13 16:14:20 -04:00
Christopher Angelo Phillips	3e16c6813f	feat: add cyclonedx schema version selection (#2123) ... --------- Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>	2023-09-13 14:50:22 -04:00
Sirish Bathina	62f689824c	Detect golang boring crypto and fipsonly modules (#2021) ... * Extending build info to include crypto settings Signed-off-by: Sirish Bathina <sirish@kasten.io> * Use kasten fork for goversion module Signed-off-by: Sirish Bathina <sirish@kasten.io> * go mod tidy Signed-off-by: Sirish Bathina <sirish@kasten.io> * change key to GoCryptoSettings and lint fix Signed-off-by: Sirish Bathina <sirish@kasten.io> * Addressing feedback Signed-off-by: Sirish Bathina <sirish@kasten.io> --------- Signed-off-by: Sirish Bathina <sirish@kasten.io>	2023-08-24 09:49:59 -04:00
Alex Goodmanandmanifestori	063e9da65d	Guess unpinned versions in python requirements.txt (#1966) ... * feat: python requirements.txt parsing inclusive Signed-off-by: manifestori <ori@manifestcyber.com> * refactor: parseVersion Signed-off-by: manifestori <ori@manifestcyber.com> * add python config for optional requirements version constraint resolution Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * fix tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * allow for python requirements metadata to be optional Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * restore cyclonedx dependency Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: manifestori <ori@manifestcyber.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: manifestori <ori@manifestcyber.com>	2023-07-27 14:26:59 -04:00
Alex Goodman	d84120f499	bump JSON schema to account for simplified python env markers (#1967) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-07-27 14:13:17 +00:00
Tristan Farkas	e1c1832f84	Add cataloger for Swift Package Manager. (#1919) ... Signed-off-by: Tristan Farkas <Tristan.Farkas@axis.com>	2023-07-25 14:35:21 -04:00
Dan LuhringandAlex Goodman	8478e0bef7	Add support for parsing .NET assemblies (#1943) ... * Add support for parsing .NET assemblies Signed-off-by: Dan Luhring <dluhring@chainguard.dev> Former-commit-id: 69c33fe4d77357d843c11590f3b07825bc6249ac * Add dll and exe files Signed-off-by: Dan Luhring <dluhring@chainguard.dev> Former-commit-id: b9d204efa6d2ef385b5fbb7a59a3474ecabea641 * Add PE cataloger to directory catalogers Signed-off-by: Dan Luhring <dluhring@chainguard.dev> Former-commit-id: 9711c00d9da92e2887e0c1f92edd740ea5345849 * Don't set language to dotnet for PEs Signed-off-by: Dan Luhring <dluhring@chainguard.dev> Former-commit-id: 368313fddac9160d8a06a01ebe8c5ac7990232f5 * Fix spelling of cataloger in constructor Signed-off-by: Dan Luhring <dluhring@chainguard.dev> Former-commit-id: e42fd77b2f8b6d42e076a84f6cce386861260941 * Adjust which cases in PE parsing return errors Signed-off-by: Dan Luhring <dluhring@chainguard.dev> Former-commit-id: 95b25f8fc3a7d4e18fe30e489b09851f316795ff * remove build binary from branch Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Former-commit-id: fa54c0d0aef0998d5520e9f44cae51f5f9cd38a2 * Fix failing CLI tests Signed-off-by: Dan Luhring <dluhring@chainguard.dev> --------- Signed-off-by: Dan Luhring <dluhring@chainguard.dev> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-07-19 15:34:07 -04:00
Alex Goodman	4da3be864f	Refactor source API (#1846) ... * refactor source API and syft json source block Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update source detection and format test utils Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * generate list of all source metadata types Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * extract base and root normalization into helper functions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * preserve syftjson model package name import ref Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * alias should not be a pointer Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-06-30 14:19:16 +00:00
James Neate	c69cdd9f4a	feat: add scope to pom properties (#1779) ... * feat: add scope to pom properties Signed-off-by: James Neate <jamesmneate@gmail.com> * fix: fixed conflict with schema bump Signed-off-by: James Neate <jamesmneate@gmail.com> --------- Signed-off-by: James Neate <jamesmneate@gmail.com>	2023-06-01 12:22:29 +00:00
Alex Goodman	74013d7da7	Add test to ensure package metadata is represented in the JSON schema (#1841) ... * [wip] try to reflect metadata types... probably wont work Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * refactor to add unit test to ensure there is coverage in the schema Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * [wip] generate metadata container Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add generation of metadata container struct for JSON schema generation Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * fix linting Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update linter script to account for code generation Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2023-05-25 13:26:56 -04:00
Christopher Angelo Phillips	4601ca3735	fix: update field plurality of 8.0.0 schema before release (#1820) ... to keep things consistent across the schema we want Locations and URLs to be plural fields now that they are fields on the License struct --------- Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>	2023-05-16 13:05:48 -04:00
Christopher Angelo Phillips	42fa9e4965	feat: update syft license concept to complex struct (#1743) ... this PR makes the following changes to update the underlying license model to have more expressive capabilities it also provides some guarantee's surrounding the license values themselves - Licenses are updated from string -> pkg.LicenseSet which contain pkg.License with the following fields: - original `Value` read by syft - If it's possible to construct licenses will always have a valid SPDX expression for downstream consumption - the above is run against a generated list of SPDX license ID to try and find the correct ID - SPDX concluded vs declared is added to the new struct - URL source for license is added to the new struct - Location source is added to the new struct to show where the expression was pulled from	2023-05-15 16:23:39 -04:00
William Murphy	da3624644a	feat: Add R cataloger (#1790) ... Add a cataloger that detects installed R packages by looking for DESCRIPTION files. The base R package is now picked up in coverageImage tests in test/cli/packages_cmd_test.go, so increment expected package counts for the tests that use that image. Signed-off-by: Will Murphy <will.murphy@anchore.com>	2023-05-10 12:30:11 -04:00
Shane Dell	a07bfe7dfa	Create python requirements metadata (#1759) ... - Create new metadata struct and type for python requirements. - Update parsing of python requirements to use python requirements metadata. - Remove extras and url from line. Add them to metadata instead. - Add unit test to test that extras are removed from package name. - Update test to look at requirements metadata. - Will need updated in future to support more than just == for the version constraint. - Update JSON schema data Closes anchore/grype#1246 Closes anchore/grype#1251 Signed-off-by: Shane Dell <shanedell100@gmail.com>	2023-04-27 09:04:30 -04:00
Alex Goodman	44422853be	Add package-to-file location evidence relationships (#1698) ... * add evident-by relationship Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * wire up evident-by relationship geneation Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * handle evident-by relationship in spdx formats Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * fix decoding file info for syft json format Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * bump json schema to incorporate file size attribute Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * refactor to create relationships for primary evidence only Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * fix linting Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * remove unused 7.0.2 json schema Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2023-04-14 15:08:46 -04:00