Christopher Angelo Phillips and Alex Goodman
13ffeeb3d0
feat: combine go module file and go source discovery into single cataloger ( #4127 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-08-26 19:35:44 +00:00
Simeon Stoykov and Christopher Phillips
a433045d51
feat: basic Conda ecosystem support ( #4002 )
...
----------------------------------------------------------------
Signed-off-by: Simeon Stoykov <simeon.stoykov@quantco.com >
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-08-19 22:37:27 -04:00
Christopher Angelo Phillips
6b48bd4b5e
feat: add package supplier flag ( #4131 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-08-12 14:49:41 -04:00
Christopher Angelo Phillips
89470ecdd3
feat: update syft license construction to be able to look up by URL ( #4132 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-08-12 14:30:32 -04:00
c491dab35b
feat: add parsing for uv.lock ( #3763 )
...
* feat: add parsing for uv.lock (#3268 )
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* Still no tests, but much more complete
Next up: start writing tests! :)
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore: finish out functionality and write tests
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* Merge the .NET deps.json and PE binary catalogers (#3563 )
* add combined deps.json + pe binary cataloger
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* deprecate pe and deps standalone catalogers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* parse resource names + add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix integration and CLI tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add some helpful code comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* allow for dropping Dep packages that are missing DLLs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* migrate json schema changes to 24
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* keep application configuration
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* correct config help
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] detect claims of dlls within deps.json
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add assembly repack detection
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* .net package count is lower due to dll claim requirement
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* better .NET cpe generation (#3764 )
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* Better represent .NET runtime packages (#3768 )
* clean up .NET runtime packages
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add runtime relationships
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove runtime references from binary package name
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore(deps): update CPE dictionary index (#3769 )
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore(deps): bump modernc.org/sqlite from 1.36.1 to 1.37.0 (#3771 )
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.36.1 to 1.37.0.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.36.1...v1.37.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore(deps): bump 8398a7/action-slack from 3.16.2 to 3.18.0 (#3767 )
Bumps [8398a7/action-slack](https://github.com/8398a7/action-slack ) from 3.16.2 to 3.18.0.
- [Release notes](https://github.com/8398a7/action-slack/releases )
- [Commits](https://github.com/8398a7/action-slack/compare/28ba43ae48961b90635b50953d216767a6bea486...1750b5085f3ec60384090fb7c52965ef822e869e )
---
updated-dependencies:
- dependency-name: 8398a7/action-slack
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 (#3766 )
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.37.0 to 0.38.0.
- [Commits](https://github.com/golang/net/compare/v0.37.0...v0.38.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore: move/modify code for lint issues
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore: make sure private structs are not exported
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* generate json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* chore: update readme to include uv
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore: use uv as the package manager name
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
---------
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: anchore-actions-token-generator[bot] <102182147+anchore-actions-token-generator[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-17 18:26:56 +00:00
Keith Zantow and Alex Goodman
02703d5c80
feat: RHEL EUS detection ( #4023 )
...
* feat: rhel eus detection
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* chore: update tests
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* chore: update more tests
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* rename feature detection functions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-07-07 14:11:20 +00:00
Alex Goodman
e23ca43a83
add PE binary cataloger ( #3911 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-19 14:17:09 -04:00
Ralph Bean and Alex Goodman
b369b02f4f
Expose RPM signature information (for RPM DB and RPM archives) ( #3179 )
...
* feat: expose rpm signature information
This helps with more confident identification of an rpm.
In theory, two rpms can be built that have the same purl string, and
otherwise look identical in syft's output, but the PGP information
would distinguish them as signed either by different keys, or signed at
different times.
In practice, this usually makes no difference since rpms tend to have
unique name/version/release strings. This just gives increased
confidence about the identity of the rpm found in the db.
Signed-off-by: Ralph Bean <rbean@redhat.com >
* chore: generate json schema
Signed-off-by: Ralph Bean <rbean@redhat.com >
* re-generate json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename to a more generic signature field
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename rpm.pgp to rpm.signatures
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* split out signature fields
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* include RPM archives
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* dont fail on unknown signature type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Ralph Bean <rbean@redhat.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-15 16:01:00 +00:00
Christopher Angelo Phillips
3c7018a853
feat: remove full-text before release ( #3889 )
...
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-05-14 13:12:05 +00:00
Laurent Goderre and Alex Goodman
175a6719a9
Add cataloger for Dart pubspec ( #3292 )
...
* Add cataloger for Dart pubspec
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
* capture pubspec specific fields
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-13 21:51:49 +00:00
Keith Zantow
b4d717fb30
chore: update mimetype contact info ( #3887 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-05-13 17:47:05 +00:00
Rez Moss and Alex Goodman
12d91f47dc
Add a homebrew cataloger ( #3724 )
...
* Cataloger homebrew (#4 )
* homebrew cataloger
* uptd
* fixed test
* fixed test
* fixed tests
* fixed lint
* inc schema ver
* upt schema
* fixed integration test
* fixed integration tst
* fixed test
Signed-off-by: Rez Moss <hi@rezmoss.com >
* Update parse_homebrew_test.go
Signed-off-by: Rez Moss <hi@rezmoss.com >
* Update parse_homebrew_test.go
fixed DCO
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Rez Moss <hi@rezmoss.com >
* Update parse_homebrew_test.go
add evd anno to test
Signed-off-by: Rez Moss <hi@rezmoss.com >
* lint
Signed-off-by: Rez Moss <hi@rezmoss.com >
* fixed test
Signed-off-by: Rez Moss <hi@rezmoss.com >
* with PR refactors
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate jsonschema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* refactor homebrew parser + add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* more resiliant variable extraction
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-13 13:01:41 -04:00
Alex Goodman
e3e69596bd
Translate Portage license strings to SPDX expressions ( #1763 )
...
* fix portage license handling
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* cover license_group file
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add licenses to portage metadata in json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-12 21:03:51 -04:00
Alex Goodman
d47a6c3a6d
Improve support for cataloging nix package relationships ( #3837 )
...
* add nix DB cataloger
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add derivation path to nix store pkg metadata
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* go mod tidy
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* allow for derivation path to be optional
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* repin build image and disable syscall filtering
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump storage capacity
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* track nix derivation details on packages
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* image fixture should have derivation examples
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-05 15:35:13 +00:00
Christopher Angelo Phillips
94e63eb367
feat: detect when full license text has been provided and preserve as separate field ( #3450 )
...
* feat: add full text field to syft license struct
---------
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com >
2025-05-01 15:00:46 -04:00
Laurent Goderre and Alex Goodman
529840bfc0
Add support for PHP Pear ( #2775 )
...
* Add support for PHP Pear and unify PECL with it
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove log statements
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix struct comment
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-04-30 20:16:58 +00:00
Alex Goodman
12f36420dd
Parse GitHub actions comments ( #3776 )
...
* add version comment parsing support to github actions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update json schema with github actions metadata
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add originator processing for github actions type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-04-03 14:46:27 +00:00
Alex Goodman
ad9928cb2a
Merge the .NET deps.json and PE binary catalogers ( #3563 )
...
* add combined deps.json + pe binary cataloger
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* deprecate pe and deps standalone catalogers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* parse resource names + add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix integration and CLI tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add some helpful code comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* allow for dropping Dep packages that are missing DLLs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* migrate json schema changes to 24
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* keep application configuration
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* correct config help
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] detect claims of dlls within deps.json
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add assembly repack detection
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* .net package count is lower due to dll claim requirement
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-03-27 14:38:16 -04:00
Alan Pope and Alex Goodman
5fa8e9c6e9
feat: add Debian archive (.deb) file cataloger ( #3704 )
...
* feat: add Debian archive (.deb) file cataloger
Add a cataloger that parses Debian package (.deb) archive files directly,
allowing Syft to discover packages from .deb files without requiring
them to be installed on the system. This implements issue #3315 .
Key features:
- Parse .deb AR archives to extract package metadata
- Support for gzip, xz, and zstd compressed control files
- Extract package metadata from control files
- Process file information from md5sums files
- Mark configuration files from conffiles entries
- Handle trailing slashes in archive member names
Signed-off-by: Alan Pope <alan.pope@anchore.com >
* chore: run go mod tidy to fix failing workflow
Signed-off-by: Alan Pope <alan.pope@anchore.com >
* add license processing to dpkg archive cataloger + add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update json schema with dpkg archive type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alan Pope <alan.pope@anchore.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-03-19 20:03:21 +00:00
bffe26bcc5
feat: add support for Bitnami cataloguer ( #3341 )
...
* prototype: start bitnami cataloger
Bitnami images have spdx SBOMs at predictable paths, and Syft could more
accurately identify the software in these images by scanning those
SBOMs. Start work on this by forking the sbom-cataloger as a new
bitnami-cataloger.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* wire up bitnami cataloger to run on images by default
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* feat: add support for Bitnami cataloguer
Signed-off-by: juan131 <jariza@vmware.com >
* feat: use a better SPDX sample for unit tests
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: only report bitnami pkgs
Signed-off-by: juan131 <jariza@vmware.com >
* feat: adapt JSON schema, spdxutil and packagemetadata
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: integration tests
Signed-off-by: juan131 <jariza@vmware.com >
* feat: implement FileOwner interface
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: update json schema
Signed-off-by: juan131 <jariza@vmware.com >
* [wip] add bitnami owned files and fix binary package ownership filtering
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* feat: obtain bitnami pkg files based on SPDX relationships tree
Signed-off-by: juan131 <jariza@vmware.com >
* preserve type switches
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename bitnami entry metadata type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* restrict find main pkg logic
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add missing graalvm source info
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bugfix: integration tests
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: mod tidy
Signed-off-by: juan131 <jariza@vmware.com >
---------
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Signed-off-by: juan131 <jariza@vmware.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-02-18 09:07:47 -05:00
HeyeOpenSource and Christopher Phillips
f7e767fc25
feat: update licenses to including license content when SPDX expressions are unable to be determined ( #3366 )
...
---------
Signed-off-by: HeyeOpenSource <opensource@heye-international.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-01-28 18:05:27 +00:00
c10e904c28
feat(cataloger): add a terraform provider cataloger ( #3378 )
...
* feat(cataloger): add a terraform provider cataloger
* chore: bump schema from 16.0.19 -> 16.0.20
------
Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-01-21 14:44:54 -05:00
Bert Coppens and Alex Goodman
512319337f
feat: add cataloger for NuGet packages ( #3484 )
...
* add cataloger for dotnet packages.lock.json files
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* add entry for dotnet packages.lock files
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* add unit test for dotnet packages.lock cataloger
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* add test for faulty packages.lock.json file
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* add missing name metadata
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* ensure package appears with version
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* add example of conflicting dependencies
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump json schema and fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* move section
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-01-16 14:57:17 -05:00
Keith Zantow and Alex Goodman
ccbee94b87
feat: report unknowns in sbom ( #2998 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-10-07 16:11:37 -04:00
Alex Goodman
01de99b253
Add JVM cataloger ( #3217 )
...
* add jvm cataloger
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* simplify version selection
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* CPEs from JVM cataloger should be declared
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* ensure package overlap is enabled for sensitive use cases
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* more permissive glob
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-09-23 17:21:38 -04:00
Laurent Goderre
9c2799e379
Add the Ocaml ecosystem ( #3112 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-09-10 10:35:18 -04:00
Laurent Goderre
92d63df6f5
Added the SWI Prolog (swipl) ecosystem ( #3076 )
...
* Add binary classifier for swipl
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
* Added cataloger for SWI Prolog Pack packages
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
---------
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-07-31 16:13:26 -04:00
Rajan Agaskar
ae0683074e
feat: update syft to generate cyclone-dx 1.6 by default ( #2978 )
...
- Resolves #2974
- add detailed instructions re: updating schemas (a necessary task
when a new CycloneDX spec version becomes available).
- The DefaultVersion constant has been updated to "1.6" -- it's not
clear to me how this is used at this time (it may be redundant given
other code), but effectively unless a specific spec version is
configured, `syft` will emit the "most recent" spec version available
for cyclonedx. Users who wish to pin back to a "older" specVersion
(e.g. to preserve compatibilty with utilities that have not yet bumped
to latest) can either set this in a syft config file or pass a
name@spec_version pair to the output flag (e.g. `-o
cyclonedx-json@1.5=some-1.5-spec-bom.cdx.json`)
- Regenerate relevant .golden files (there seems to be a way to do this
via flags, but I couldn't quite figure out the right set to pass
correctly, esp. since (as a relative go novice) I found it difficult
to run just a single test file. I ended up "brute-forcing it" by
changing the *updateSnapshot val to "true" and running it in Goland.
A brief comment giving an example of regenerating fixtures usage would
be helpful.
Signed-off-by: Rajan Agaskar <ragaskar@gmail.com >
2024-06-21 08:51:27 -07:00
Alex Goodman
254a562b4e
Add support for reading ELF package notes with section header ( #2939 )
...
* add support for reading ELF package notes with section header
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add systemd elf package fields to json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-06-07 14:38:54 -04:00
Alex Goodman
3472b48177
Add relationships for python poetry packages ( #2906 )
...
* [wip] add initial poetry.lock relationship support
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* provide generic set for basic types
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* dependency resolver should allow for conditional deps
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add tests for poetry lock relationship additions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update schema with python poetry dependency refs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* dep specification data structure should not be recursive in nature
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-06-04 20:00:05 +00:00
Jon Johnson and Will Murphy
c314e05aae
Handle GOEXPERIMENTs in go version ( #2893 )
...
* Handle GOEXPERIMENTs in go version
Signed-off-by: Jon Johnson <jon.johnson@chainguard.dev >
* bump JSON schema
Signed-off-by: Will Murphy <will.murphy@anchore.com >
---------
Signed-off-by: Jon Johnson <jon.johnson@chainguard.dev >
Signed-off-by: Will Murphy <will.murphy@anchore.com >
Co-authored-by: Will Murphy <will.murphy@anchore.com >
2024-05-25 20:23:30 +00:00
Alex Goodman
05e8ba948d
Add python wheel egg relationships ( #2903 )
...
* add python package relationships
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* nil for empty relationships collections
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* new json schema for optional python requiremenets
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update format snapshots for python packages
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* decompose python parsers more + add tests around plural fields
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update JSON schema with python dep refs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-05-25 20:11:38 +00:00
Laurent Goderre
b51252dbdb
feat: Add Lua cataloger ( #2613 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-05-24 16:56:34 -04:00
Alex Goodman
7ad7627d5d
add support for RPM DB package relationships ( #2872 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-05-14 13:48:19 -04:00
Alex Goodman
ada8f009d2
Add relationships for ALPM packages (arch linux) ( #2851 )
...
* add alpm relationships
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* tweak reader linter rule to check for reader impl
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update JSON schema with alpm dependency information
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-05-07 13:29:46 -04:00
Alex Goodman
87cd6c8c48
update spdx license list to 3.23 ( #2818 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-04-26 14:50:55 +00:00
Laurent Goderre
e0233625cb
feat: cataloger for PHP Pecl and PEAR packages ( #2604 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-04-02 11:55:56 -04:00
6a2517b5d2
Add ELF binary package cataloger ( #2396 )
...
* feat Adds Elf package catalogger
Signed-off-by: Brian Ebarb <ebarb.brian@gmail.com >
* Add test fixtures for elf package
Signed-off-by: Colleen Divers <colleen.divers@gmail.com >
* bump JSON schema to v16.0.6 + expand test fixtures
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* less verbose logging
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove dead test code
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove unreleated swift change
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Brian Ebarb <ebarb.brian@gmail.com >
Signed-off-by: Colleen Divers <colleen.divers@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Colleen Divers <colleen.divers@gmail.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-03-14 11:16:03 -04:00
Alex Goodman
47fc909700
Show binary exports, entrypoint, and imports ( #2626 )
...
show binary exports, entrypoint, and imports for macho, elf, and pe formats
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-03-12 22:04:02 +00:00
Alexandr Hacicheant and Alex Goodman
96ee2db875
feat: Add Wordpress cataloger ( #2218 )
...
* Closes #1911 Wordpress cataloger
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed a few unit tests and static analizer notices
Signed-off-by: disc <a.hacicheant@gmail.com >
* Updated `README.md`
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed `golangci-lint` notices
Added integration test for `wordpress-plugin`
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed `gosimports` notices
Signed-off-by: disc <a.hacicheant@gmail.com >
* Updated `json schema` version
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed CLI tests, increased expected package count
Signed-off-by: disc <a.hacicheant@gmail.com >
* Read first 4Kb of a plugins file's content
Signed-off-by: disc <a.hacicheant@gmail.com >
* replace JSON schema version
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* change wording on source info for wordpress packages
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* Minor changes after a huge refactoring
Signed-off-by: disc <a.hacicheant@gmail.com >
* Removed unused files
Signed-off-by: disc <a.hacicheant@gmail.com >
* Updated schema
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed integration tests
Signed-off-by: disc <a.hacicheant@gmail.com >
* fix integration tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* Renamed `metadata.Name` to `metadata.PluginInstallDirectory`
Signed-off-by: disc <a.hacicheant@gmail.com >
* rename fields to be compliant with json conventions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: disc <a.hacicheant@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-14 16:03:25 +00:00
Alex Goodman and mikey strauss
c61f59e7b7
Finalize Conan v2 support ( #2587 )
...
* Add support for conan lock v2 (#2461 )
* conan lock 2.x requires field support
Signed-off-by: houdini91 <mdstrauss91@gmail.com >
* PR review, struct renaming
Signed-off-by: houdini91 <mdstrauss91@gmail.com >
---------
Signed-off-by: houdini91 <mdstrauss91@gmail.com >
* decompose conanlock parser + add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: houdini91 <mdstrauss91@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: mikey strauss <mdstrauss91@gmail.com >
2024-02-07 08:24:02 -05:00
William Murphy
b735106848
chore: copy latest schema to stable path for easier diff ( #2586 )
...
Because we generate a new JSON schema file every time the schema version
changes, the git diff always shows that the file is completely new.
Therefore, every time the file is re-generated, also write the schema to
a stable path, so that the actual changes to the schema are easily
visible in the git diff of the latest schema file.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2024-02-02 17:09:28 -05:00
Asi Greenholts and Alex Goodman
98de2e2f62
Adding metadata fields when parsing yarn.lock and poetry.lock ( #2350 )
...
* Adding the resolved and integrity fields of yarn.lock to the parsed metadata. This addition is similar to the metadata added when parsing package-lock.json.
Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com >
* fix comment
Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com >
* Adding the Index field to metadeta when parsing poetry.lock similarly to the existing Pipfile metadata
Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com >
* fixing struct accoding to tests
Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com >
* remove old schema change
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove empty constants
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* re-generate JSON schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update document ref
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-02 19:53:42 +00:00
Alex Goodman
3023a5a7bc
Detect ELF security features ( #2443 )
...
* add detection of ELF security features
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update json schema with file executable data
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update expected fixure when no tty present
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* more detailed differ
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use json differ
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove json schema addition
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix mimtype set ref
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-02 16:51:18 +00:00
William Murphy
b7a6d5e946
feat: Record where CPEs come from ( #2552 )
...
Syft can get CPEs from several source, including generating them based on
package data, finding them in the NVD CPE dictionary, or finding them declared
in a manifest or existing SBOM. Record where Syft got CPEs so that consumers of
SBOMs can reason about how trustworthy they are.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2024-02-02 16:17:52 +00:00
Alex Goodman
6107e5e2ad
translate maps to sequences in pkg metadata ( #2553 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-01 11:58:10 -05:00
Alex Goodman
bf3cd9ed3b
allow for RPM modularity to be optional ( #2540 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-24 13:21:59 -05:00
Alex Goodman
5565bdef0c
Remove the power-user command and related catalogers ( #2306 )
...
* remove the power-user command
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove secrets + classifier catalogers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-11-20 15:44:28 +00:00
Alex Goodman
502971a1b2
Add accessPath on Location objects to syft-json output ( #2287 )
...
* add accessPath on Location objects to syft-json output
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* generate json schema v12.0.1
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-11-08 17:05:30 -06:00
Alex Goodman
1aaa644007
Remove MetadataType from core package object and normalize JSON metadataType values ( #1983 )
...
* [wip]
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* distinct the package metadata functions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove metadata type from package core model
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* incorporate review feedback for names
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add RPM archive metadata and split parser helpers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* clarify the python package metadata type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename the KB metadata type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* break hackage and composer types by use case
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* linting fix
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix encoding and decoding for syft-json and cyclonedx
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump json schema to 11
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update cyclonedx-json snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update cyclonedx-xml snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update spdx-json snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update spdx-tv snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update syft-json snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* correct metadata type in stack yaml parser test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix bom-ref redactor for cyclonedx-xml
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add tests for legacy package metadata names
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate json schema v11
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix legacy HackageMetadataType reflect type value check
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* packagemetadata discovery should account for type shadowing
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix cli tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump json schema version to v12
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update json schema to incorporate changes from main
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add syft-json legacy config option
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add tests around v11-v12 json decoding
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add docs for SYFT_JSON_LEGACY
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename structs to be compliant with new naming scheme
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-10-30 12:12:04 -04:00
Christopher Angelo PhillipsandAlex Goodman
Simeon StoykovandChristopher Phillips
Keith ZantowandAlex Goodman
Ralph BeanandAlex Goodman
Laurent GoderreandAlex Goodman
Rez MossandAlex Goodman
Alan PopeandAlex Goodman
HeyeOpenSourceandChristopher Phillips
Bert CoppensandAlex Goodman
Rajan Agaskar
Jon JohnsonandWill Murphy
Alexandr HacicheantandAlex Goodman
Asi GreenholtsandAlex Goodman