Christopher Angelo Phillips
466da7cbda
931: binary cataloger exclusion defaults for ownership by overlap ( #1948 )
...
Fixes #931
PR #1948 introduces a new implicit exclusion for binary packages that overlap by file ownership and have certain characteristics:
1) the relationship between packages is OwnershipByFileOverlap
2) the parent package is an "os" package - see changelog for included catalogers
3) the child is a synthetic package generated by the binary cataloger - see changelog for included catalogers
4) the package names are identical
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2023-08-08 13:00:52 -04:00
Christopher Angelo Phillips
78660022bf
test: add coverage for new rpmdb paths ( #1999 )
...
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2023-08-04 13:04:36 -04:00
Tristan Farkas
e1c1832f84
Add cataloger for Swift Package Manager. ( #1919 )
...
Signed-off-by: Tristan Farkas <Tristan.Farkas@axis.com >
2023-07-25 14:35:21 -04:00
William Murphy
da3624644a
feat: Add R cataloger ( #1790 )
...
Add a cataloger that detects installed R packages by looking for DESCRIPTION
files. The base R package is now picked up in coverageImage tests in
test/cli/packages_cmd_test.go, so increment expected package counts for the
tests that use that image.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2023-05-10 12:30:11 -04:00
Shane Dell
98a6c6efbe
Add sections of interest for Gemfile.lock cataloger ( #1749 )
...
- Updated tests to reflect the new sections being added to show they function properly.
Closes #1660
Signed-off-by: Shane Dell <shanedell100@gmail.com >
2023-04-19 12:18:17 -04:00
Alex Goodman
5a7bab972c
Fix kernel cataloger test fixtures ( #1742 )
...
* pin kernel and modules version for kernel fixtures
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* cache kernel fixtures in CI
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update CLI test image with pinned kernel deps
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update the kernel version found in integration tests
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
---------
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2023-04-17 11:44:46 -04:00
Avi Deitcher and Alex Goodman
cc731c7b19
Add Linux Kernel cataloger ( #1694 )
...
* add kernel handler
Signed-off-by: Avi Deitcher <avi@deitcher.net >
* [wip] combine kernel and kernel module cataloging
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* [wip] combine kernel and kernel module cataloging
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Avi Deitcher <avi@deitcher.net >
* rename Kernel package to LinuxKernel package
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* split kernel and module packages within cataloger
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* wire up application configuration with kernel cataloger options
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* dont use references for packages on relationships
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix linting and tests
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* kernel cataloger should be resistent to partial failure
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* log upon kernel module metadata missing
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* add tests for linux kernel cataloger
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update integration tests
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update cli package test counts
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* add evidence annotations for kernel packages
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* reduce noise in cli test output
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* missed cli test to reduce noise for
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix package counts
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update docs with linux kernel cataloging refs
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* bump json schema with new metadata fields
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
---------
Signed-off-by: Avi Deitcher <avi@deitcher.net >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: <>
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
2023-04-14 14:33:36 -04:00
7464079a09
Add Nix cataloger ( #1696 )
...
* Add Basic Nix Cataloger
Signed-off-by: Julio Tain Sueiras <juliosueiras@gmail.com >
* Update nix def for the latest syft definition
Signed-off-by: Julio Tain Sueiras <juliosueiras@gmail.com >
* capture nix package files on pkg.NixStoreMetadata
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix unit tests and linting
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update JSON schema
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* address review comments
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* Update syft/pkg/cataloger/nix/parse_nix_store_path_test.go
Co-authored-by: Florian Klink <flokli@flokli.de >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* support unstable version conventions
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update json schema relative to main branch
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update syft json with v7.1.1 schema
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix CLI tests
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* remove extra continue statement
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* add Nix to list of supported ecosystems
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
---------
Signed-off-by: Julio Tain Sueiras <juliosueiras@gmail.com >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Co-authored-by: Julio Tain Sueiras <juliosueiras@gmail.com >
Co-authored-by: Florian Klink <flokli@flokli.de >
2023-04-04 10:53:56 -04:00
witchcraze
43b53ac173
Fix installed versions ( #1556 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2023-02-09 09:03:40 -05:00
Alex Goodman
05611c283d
bootstrap within composite action ( #1461 )
...
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2023-01-17 10:04:22 -05:00
Chapman Pendery and Alex Goodman
ac8f72fdd1
feat: add BeamVM Hex support ( #1073 )
...
* feat: initial commit providing mix support
Signed-off-by: cpendery <cpendery@vt.edu >
* feat: add rebar parser
Signed-off-by: cpendery <cpendery@vt.edu >
* fix: add beam/hex everywhere else required for Syft runtime
Signed-off-by: cpendery <cpendery@vt.edu >
* style: fix lints
Signed-off-by: cpendery <cpendery@vt.edu >
* ci: fix failing tests
Signed-off-by: cpendery <cpendery@vt.edu >
* docs: update with new supported languages
Signed-off-by: cpendery <cpendery@vt.edu >
* chore: update elixir/erlang catalogers to generic cataloger
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: cpendery <cpendery@vt.edu >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
2023-01-12 12:10:46 -05:00
0c4b99c1c2
SBOM cataloger ( #1029 )
...
* SBOM cataloger
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* sbom-cataloger: turn off by default
and add integration test
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* SBOM cataloger
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* SBOM cataloger (optimize)
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* SBOM cataloger (fix)
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* SBOM cataloger (fix imports #1172 )
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* SBOM cataloger (fix: support group attribute in CDX SBOMs)
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* port to generic cataloger and add relationship to original file
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* generalize parser for all format globs
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Co-authored-by: Tom Fay <tomfay@microsoft.com >
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
2022-11-16 14:11:45 -05:00
Keith Zantow
4d2f18218c
fix: Follow symlinks when searching for globs in all-layers scope ( #1221 )
2022-09-30 13:01:08 -04:00
Keith Zantow
7d4f333ec4
enhance development support on macOS ARM ( #1163 )
2022-08-24 13:48:14 -04:00
Tom Fay
9896ff1b1f
add a cataloger for binaries built with rust-audit ( #1116 )
...
* add a cataloger for binaries built with rust-audit
Signed-off-by: Tom Fay <tomfay@microsoft.com >
2022-07-28 18:17:38 +00:00
cpendery
9b1adce19a
feat: implement haskell support ( #1096 )
2022-07-18 15:33:54 -04:00
cpendery
470b13045b
feat: add support for cocoapods (Swift/Objective-C) ( #1081 )
2022-07-11 10:09:08 -04:00
Zac Medico and Christopher Phillips
4c55c62834
Add portage support for Gentoo Linux ( #1076 )
...
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2022-07-06 16:18:54 -04:00
cpendery
57323a1666
feat: add support for conan packages (C/C++) ( #1083 )
2022-07-05 10:49:24 -04:00
Miki and Christopher Phillips
d5e12ff89c
Updates parsing of yarn.lock to use resolved URLs that are pulled from yarn and npm registries ( #926 )
...
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2022-06-24 11:05:25 -04:00
Jonas Xavier and Christopher Phillips
1d14f22e45
add pom.xml cataloger ( #1055 )
...
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2022-06-22 14:19:10 -04:00
Tom Fay
3f6afd572a
Add support for CBL-Mariner distroless images ( #1045 )
2022-06-21 13:27:03 -04:00
Morten Linderud and Christopher Phillips
e72d68b0c6
Add pacman (alpm) parser support ( #943 )
...
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2022-06-13 18:51:37 +00:00
Tom Fay and Alex Goodman
3db3efacdc
Support RPM distros with newer RPM db formats ( #1018 )
...
* Support RPM distros with newer db formats
Recent RPM distros (Fedora 33+, CBL-Mariner 2.0+, amazonlinux 2022+)
use an sqlite package database in /var/lib/rpm/rpmdb.sqlite, or
"ndb" format (SUSE).
Remove anchore's fork in favour of the upstream,
https://github.com/knqyf263/go-rpmdb , to gain support for
these formats.
Signed-off-by: Tom Fay <tomfay@microsoft.com >
* add exception for modernc.org repos
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* shorten rpmdb helper function
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
2022-05-31 17:25:22 -04:00
Christian Kotzbauer and Alex Goodman
1cea0ecd5c
feat: add initial dotnet-support ( #951 )
...
* feat: add initial dotnet-support
Signed-off-by: Christian Kotzbauer <git@ckotzbauer.de >
* fix: add path, sha512 and hashpath
Signed-off-by: Christian Kotzbauer <git@ckotzbauer.de >
* fix: add missing dot
Signed-off-by: Christian Kotzbauer <git@ckotzbauer.de >
* fix: lint warnings
Signed-off-by: Christian Kotzbauer <git@ckotzbauer.de >
* fix CLI test package counts to account for dotnet
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix: updated packagurl-go
Signed-off-by: Christian Kotzbauer <git@ckotzbauer.de >
* tidy go.sum
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update json schema
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
2022-05-05 15:32:02 -04:00
Alex Goodman
f24bbc1838
Deduplicate packages across multiple container image layers ( #930 )
2022-03-31 15:45:51 -04:00
Eric Larssen and Alex Goodman
cb3e73e308
Add dart support ( #919 )
...
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
2022-03-31 15:44:55 -04:00
Alex Goodman
706f291679
Replace distro type ( #742 )
...
* remove strong distro type
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* bump json schema to v3 (breaking distro shape)
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix linting
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* allow for v2 decoding of distro idLikes field in v3 json decoder
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix casing in simple linux release name
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* use discovered name as pretty name in simple linux release
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2022-01-12 12:13:42 -05:00
Blaize Kaye and Alex Goodman
6af132e088
Adds composer installed.json parser ( #643 )
...
* Adds installed.json functionality and tests
Signed-off-by: Blaize Kaye <blaize.kaye@amazee.com >
* Adds php-installed-cataloger
Signed-off-by: Blaize Kaye <blaize.kaye@amazee.com >
* Changes fallback logic
Signed-off-by: Blaize Kaye <blaize.kaye@amazee.com >
* Adds image tests for installed.json composer packages
Signed-off-by: Blaize Kaye <blaize.kaye@amazee.com >
* tweak PHP cataloger names
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* unexport PHP types and fix CLI tests
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* rename PHP cataloger file
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
2021-11-30 11:36:08 -05:00
Nikita and Alex Goodman
25835ef589
PHP parser composer.lock ( #609 )
...
* PHP parse composer.lock
Signed-off-by: Nikita <33390074+Zilborg@users.noreply.github.com >
* rename PHP package type
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* add PHP composer package support to source info SPDX helper
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update directory cataloger integration tests (make exception for images)
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
2021-11-10 14:08:41 -05:00
Alex Goodman and Christopher Angelo Phillips
bb0f35bac4
Introduce a single SBOM document ( #606 )
...
* [wip] single sbom doc
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix tests
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix more tests
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix linting
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update cli tests
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* remove scope in import path
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* swap SPDX tag-value formatter to single sbom document
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* bust CLI cache
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update fixture to byte diff
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com >
* byte for byte
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com >
* bust the cache
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com >
* who needs cache
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com >
* add jar for testing
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com >
* no more bit flips
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com >
* update apk with the delta for image and directory cases
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com >
* restore cache workflow
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com >
Co-authored-by: Christopher Angelo Phillips <christopher.phillips@anchore.com >
2021-11-05 10:05:49 -04:00
Christopher Angelo Phillips and Alex Goodman
3462e18af3
478 identify go binaries and extract mod information ( #534 )
...
* add query by MIME type to source.FileResolver
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* import stereoscope lib changes to find mime type
- add bin cataloger
- add bin parser
- add mime type go utils
- import new resolver
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com >
* add go std library code to unpack bin
- keep them in their own (original) files
- add note for "this code was copied from"
- comment the lines the required changing
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com >
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
2021-10-07 12:16:38 -04:00
Keith Zantow
ff828fbac2
Skip package-lock.json and yarn.lock in node_modules #431 ( #485 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2021-08-20 13:50:28 -04:00
Weston Steimel
ba81bfe529
add cataloger for rust crates from Cargo.lock files
...
Signed-off-by: Weston Steimel <weston.steimel@gmail.com >
2021-03-18 03:12:51 +00:00
Weston Steimel
6c80f9910f
add to dpkg integration test cases to detect packages from /var/lib/dpkg/status.d/
...
Signed-off-by: Weston Steimel <weston.steimel@gmail.com >
2021-02-27 01:58:59 +00:00
Alex Goodman
6d5ff0fd8e
Mark package relations by file ownership ( #329 )
...
* add marking package relations by file ownership
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* correct json schema version; ensure fileOwners dont return dups; pin test pkg versions
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* extract package relationships into separate section
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* pull in client-go features for import of PackageRelationships
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* move unit test for ownership by files relationship further down
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* rename relationship to "ownership-by-file-overlap"
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2021-02-25 13:47:13 -05:00
Dan Luhring
0ccfee03f1
Fix dependency resolution issue in test image
...
Signed-off-by: Dan Luhring <dan.luhring@anchore.com >
2021-01-27 10:30:49 -05:00
Dan Luhring
ae7cd6bbb7
Add test for Java cataloging with no main package
...
Signed-off-by: Dan Luhring <dan.luhring@anchore.com >
2021-01-27 10:12:41 -05:00
Dan Luhring
9ec3ad58c8
Update regression test expected value and pin deps
...
Signed-off-by: Dan Luhring <dan.luhring@anchore.com >
2021-01-22 14:03:50 -05:00
Alex Goodman
133d180eec
update gemspec glob to include named spec dirs
...
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2021-01-04 19:33:52 -05:00
Alex Goodman
2e5ff4a995
add top_level.txt processing to python package cataloger
...
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2020-10-22 12:39:03 -04:00
Alex Goodman
1414d1fbc3
add test coverage for python pacakge cataloger and update catalog interface
...
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2020-10-22 09:51:29 -04:00
Alex Goodman
0ce8701e73
split python package catalogers by image vs directory
...
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2020-10-21 11:48:26 -04:00
Toure Dunnon
27c62e34f2
Add support for package.json #200
...
Signed-off-by: Toure Dunnon <toure.dunnon@anchore.com >
2020-10-16 11:28:54 -04:00
Alex Goodman
5d0909f31e
add regression test to cover issue #212
...
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2020-10-14 07:22:19 -04:00
Alex Goodman
335a6b022f
add acceptance test to cover gem cataloger + fix gem cataloger parent dir ( #207 )
...
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2020-10-08 13:13:31 -04:00
Alex Goodman
10b44f5311
split catalogers into two sets, one for images another for directory scans
...
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2020-10-08 10:23:24 -04:00
Sam Dacanay
11334b632e
Expand matching of requirements.txt file to include any prefixes or suffixes ( #168 )
...
* Expand matching of requirements.txt file to include any prefixes or suffixes
Signed-off-by: Samuel Dacanay <sam.dacanay@anchore.com >
* Add some test cases to integration test (ensure syft can pick up multiple requirements files)
Signed-off-by: Samuel Dacanay <sam.dacanay@anchore.com >
* Run lint-fix
Signed-off-by: Samuel Dacanay <sam.dacanay@anchore.com >
2020-09-08 10:23:37 -07:00
Alfredo Deza
861806f1dd
test: add setup.py integration cases
...
Signed-off-by: Alfredo Deza <adeza@anchore.com >
2020-08-17 16:00:49 -04:00
Alex Goodman
e2a874a277
finalize json output & add schema ( #118 )
2020-08-04 16:05:53 -04:00
Christopher Angelo Phillips
Tristan Farkas
William Murphy
Shane Dell
Alex Goodman
Avi DeitcherandAlex Goodman
witchcraze
Chapman PenderyandAlex Goodman
Keith Zantow
Zac MedicoandChristopher Phillips
MikiandChristopher Phillips
Jonas XavierandChristopher Phillips
Morten LinderudandChristopher Phillips
Tom FayandAlex Goodman
Christian KotzbauerandAlex Goodman
Eric LarssenandAlex Goodman
Blaize KayeandAlex Goodman
NikitaandAlex Goodman
Weston Steimel
Dan Luhring
Toure Dunnon
Sam Dacanay
Alfredo Deza