296 Commits

Include renames

Author	SHA1	Message	Date
Keith Zantow	108a5dae9b	chore: update busybox image for acceptance tests (#2663) ... Signed-off-by: Keith Zantow <kzantow@gmail.com>	2024-02-22 15:32:17 -05:00
Alexandr HacicheantandAlex Goodman	96ee2db875	feat: Add Wordpress cataloger (#2218) ... * Closes #1911 Wordpress cataloger Signed-off-by: disc <a.hacicheant@gmail.com> * Fixed a few unit tests and static analizer notices Signed-off-by: disc <a.hacicheant@gmail.com> * Updated `README.md` Signed-off-by: disc <a.hacicheant@gmail.com> * Fixed `golangci-lint` notices Added integration test for `wordpress-plugin` Signed-off-by: disc <a.hacicheant@gmail.com> * Fixed `gosimports` notices Signed-off-by: disc <a.hacicheant@gmail.com> * Updated `json schema` version Signed-off-by: disc <a.hacicheant@gmail.com> * Fixed CLI tests, increased expected package count Signed-off-by: disc <a.hacicheant@gmail.com> * Read first 4Kb of a plugins file's content Signed-off-by: disc <a.hacicheant@gmail.com> * replace JSON schema version Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * change wording on source info for wordpress packages Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * Minor changes after a huge refactoring Signed-off-by: disc <a.hacicheant@gmail.com> * Removed unused files Signed-off-by: disc <a.hacicheant@gmail.com> * Updated schema Signed-off-by: disc <a.hacicheant@gmail.com> * Fixed integration tests Signed-off-by: disc <a.hacicheant@gmail.com> * fix integration tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * Renamed `metadata.Name` to `metadata.PluginInstallDirectory` Signed-off-by: disc <a.hacicheant@gmail.com> * rename fields to be compliant with json conventions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: disc <a.hacicheant@gmail.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-02-14 16:03:25 +00:00
Keith Zantow	d26a5c4d30	fix: ensure version output to stdout (#2621)	2024-02-09 20:59:25 +00:00
William MurphyandAlex Goodman	bbddac1f9d	Fix attest with --key (#2551) ... Fix passing "--key" to the attest command. Additionally, pull in an update to the clio CLI library to permit unit testing that flags and env vars are parsed to the correct field on command options structs. This testing strategy was needed here because testing attestation in an end to end test requires a prohibitive amount of setup. --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: Will Murphy <will.murphy@anchore.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-01-31 16:39:17 -05:00
Alex Goodman	aa702a72b4	Sign checksums file and add SBOMs on release (#2548) ... * with release signature of checksums file * attach SBOMs to the release * update acceptance tests --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-01-30 13:16:40 -05:00
Alex Goodman	414fb2f8ad	fix migration of integration test (#2546) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-01-25 15:18:36 +00:00
Alex Goodman	a32b8d7fc6	Use the json schema as input for templating (#2542) ... * use the json schema as input for templating Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-01-25 14:00:35 +00:00
Alex Goodman	11c0b1c234	Unexport types and functions cataloger packages (#2530) ... * unexport as many types and functions from cataloger packages as possible Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * capture type and signature information in convention test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * check that we return pkg.Cataloger from constructors Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-01-24 16:12:46 -05:00
Alex Goodman	e0e1c4ba0a	Internalize majority of cmd package (#2533) ... * internalize majority of cmd package and migrate integration tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add internal api encoder Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * create internal representation of all formats Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * export capability to get default encoders Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * restore test fixtures Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-01-24 13:29:51 -05:00
Alex Goodman	03b7938fbf	Turn off the SBOM cataloger by default (#2527) ... * turn off the SBOM cataloger by default Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix integration tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-01-22 12:32:45 -05:00
Alex Goodman	4c77783461	Re-introduce linux kernel cataloger (#2526) ... * re-add linux kernel cataloger Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * ensure there is at least a directory or image tag on each task Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix CLI tests to account for kernel finding (+2) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-01-22 16:31:41 +00:00
Christopher Angelo Phillips	22f3a29fd7	fix: remove second call to finalize as the task handles it (#2516) ... * fix: remove second call to finalize as the task handles it Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * test: add test to protect against dupe relationships in final SBOM Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> --------- Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>	2024-01-19 14:12:29 -05:00
Alex Goodman	b0ab75fd89	Replace core SBOM-creation API with builder pattern (#1383) ... * remove existing cataloging API Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add file cataloging config Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add package cataloging config Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add configs for cross-cutting concerns Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename CLI option configs to not require import aliases later Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update all nested structs for the Catalog struct Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update Catalog cli options - add new cataloger selection options (selection and default) - remove the excludeBinaryOverlapByOwnership - deprecate "catalogers" flag - add new javascript configuration Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * migrate relationship capabilities to separate internal package Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * refactor golang cataloger to use configuration options when creating packages Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * create internal object to facilitate reading from and writing to an SBOM Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * create a command-like object (task) to facilitate partial SBOM creation Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add cataloger selection capability - be able to parse string expressions into a set of resolved actions against sets - be able to use expressions to select/add/remove tasks to/from the final set of tasks to run Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add package, file, and environment related tasks Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update existing file catalogers to use nested UI elements Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add CreateSBOMConfig that drives the SBOM creation process Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * capture SBOM creation info as a struct Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add CreateSBOM() function Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update docs with SBOM selection help + breaking changes Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix multiple override default inputs Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix deprecation flag printing to stdout Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * refactor cataloger selection description to separate object Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * address review comments Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * keep expression errors and show specific suggestions only Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * address additional review feedback Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * address more review comments Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * addressed additional PR review feedback Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix file selection references Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove guess language data generation option Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for coordinatesForSelection Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename relationship attributes Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add descriptions to relationships config fields Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * improve documentation around configuration options Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add explicit errors around legacy config entries Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-01-12 17:39:13 -05:00
Alex Goodman	4c20a74d2f	Replace packages command with scan (#2446) ... * replace packages command with scan Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for packages alias Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update comments with referenes to the packages command Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename valiadte args function Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-01-04 16:56:57 +00:00
Weston Steimel	4d4b502174	fix(java): improve identification for org.codehaus.groovy artifacts (#2404) ... Signed-off-by: Weston Steimel <weston.steimel@proton.me>	2023-12-08 05:02:01 -05:00
Weston Steimel	ea80f94c0e	fix(java): improve identification for commons-jelly artifacts (#2399) ... Signed-off-by: Weston Steimel <weston.steimel@proton.me>	2023-12-07 12:28:21 -05:00
Weston Steimel	2c145f70b2	fix(java): improve identification for io.minio artifacts (#2398) ... Signed-off-by: Weston Steimel <weston.steimel@proton.me>	2023-12-06 16:58:07 -05:00
Weston Steimel	bcc7e90fcc	fix(java): improve identification for com.graphql-java artifacts (#2397) ... Signed-off-by: Weston Steimel <weston.steimel@proton.me>	2023-12-06 18:04:43 +00:00
Weston Steimel	b5906824cb	chore: enhance java purl generation integration test (#2393) ... Signed-off-by: Weston Steimel <weston.steimel@anchore.com>	2023-12-06 15:31:16 +00:00
Keith Zantow	a50a0f77d2	fix: capture root command stdout (#2364) ... Signed-off-by: Keith Zantow <kzantow@gmail.com>	2023-11-28 15:04:28 -05:00
William Murphy	ce4b31757a	fix: index file itself when file scan path has symlink (#2359) ... Previously, building the index of the filesystem when source was file would fail if part of the path syft was passed to the file included a symlinked directory, resulting in cataloging misses. --------- Signed-off-by: Will Murphy <will.murphy@anchore.com>	2023-11-28 09:41:28 -05:00
Alex Goodman	4712246897	Fix the attest command (#2337) ... * fix attest command Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add notification on how to access the attestation Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix integration test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-11-21 18:29:58 +00:00
Weston Steimel	ebeb768f59	fix: add manual namespace mapping for org.springframework jars (#2345) ... Signed-off-by: Weston Steimel <weston.steimel@proton.me>	2023-11-21 18:28:10 +00:00
Alex Goodman	5565bdef0c	Remove the power-user command and related catalogers (#2306) ... * remove the power-user command Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove secrets + classifier catalogers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * regenerate json schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-11-20 15:44:28 +00:00
Alex Goodman	1676934c63	Add "pretty" json configuration and change default behavior to be space-efficient (#2275) ... * expose underlying format options Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove escape html options and address PR feedback Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * incorporate PR feedback Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-11-20 15:29:34 +00:00
Christopher Angelo PhillipsandAlex Goodman	ba80e490c2	feat: allow for stdout to be buffered on each command (#2335) ... * feat: add preRun func to version to restore stdout Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * test: add test to capture version in output Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * change stdout buffering to log to be opt-in per command Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-11-17 14:14:13 -05:00
Alex Goodman	b2f4d7eda2	Follow convention for naming catalogers (#2277) ... * follow convention for naming catalogers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cataloger name example Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-11-02 12:39:42 +00:00
Christopher Angelo Phillips	ee4e69285a	test: remove dll files and updates tests to use versionResources (#2276) ... * test: remove dll files and updates tests to use versionResources Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * test: update integration tests with dot net coverage Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * chore: move test cases to appropriate blocks Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * fix: chmod only the dll Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * fix: add primary annotation key to packages Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * chore: bump number of packages with new dotnet package Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> --------- Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>	2023-10-31 15:33:52 -04:00
Alex Goodman	1aaa644007	Remove MetadataType from core package object and normalize JSON metadataType values (#1983) ... * [wip] Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * distinct the package metadata functions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove metadata type from package core model Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * incorporate review feedback for names Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add RPM archive metadata and split parser helpers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * clarify the python package metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename the KB metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * break hackage and composer types by use case Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * linting fix Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix encoding and decoding for syft-json and cyclonedx Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema to 11 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx-xml snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update spdx-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update spdx-tv snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update syft-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * correct metadata type in stack yaml parser test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix bom-ref redactor for cyclonedx-xml Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for legacy package metadata names Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * regenerate json schema v11 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix legacy HackageMetadataType reflect type value check Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * packagemetadata discovery should account for type shadowing Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema version to v12 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update json schema to incorporate changes from main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add syft-json legacy config option Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests around v11-v12 json decoding Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add docs for SYFT_JSON_LEGACY Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename structs to be compliant with new naming scheme Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-30 12:12:04 -04:00
Alex Goodman	7392d607b6	Split the sbom.Format interface by encode and decode use cases (#2186) ... * split up sbom.Format into encode and decode ops Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cmd pkg to inject format configs Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump cyclonedx schema to 1.5 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * redact image metadata from github encoder tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add more testing around format decoder identify Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add test case for format version options Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix CLI test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * [wip] - review comments Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * keep encoder creation out of post load function Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * keep decider and identify functions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add a few more doc comments Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove format encoder default function helpers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * address PR feedback Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * move back to streaming based decode functions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * with common convention for encoder constructors Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix tests and allow for encoders to be created from cli options Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * buffer reads from stdin to support seeking Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-25 13:43:06 +00:00
Chao LiandWill Murphy	671ff39933	Add ruby.NewGemSpecCataloger to DirectoryCatalogers. (#1971) ... * Add ruby.NewGemSpecCataloger to DirectoryCatalogers. Signed-off-by: Evan <chaol@vmware.com> * fixed tests Signed-off-by: Evan <chaol@vmware.com> * Addressed review comment Signed-off-by: Evan <chaol@vmware.com> * Remove NewInstalledGemSpecCataloger from default dir catalogers Because the files that the installed gemspec cataloger work off of are a subset of the files that the more general gemspec cataloger will work off of, we shouldn't have both of them on by default, since this could result in finding the same package twice. Signed-off-by: Will Murphy <will.murphy@anchore.com> --------- Signed-off-by: Evan <chaol@vmware.com> Signed-off-by: Will Murphy <will.murphy@anchore.com> Co-authored-by: Will Murphy <will.murphy@anchore.com>	2023-10-23 08:49:57 -04:00
Alex Goodman	7018573bf7	Remove internal string set (#2219) ... * remove internal string set Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * incorporate changes from #2227 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * beef up the pkg.License.Merg() doc string Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-17 12:52:11 -04:00
Benji VisserandAlex Goodman	fe7a417fb2	Parse donet dependency trees (#2143) ... * add dependency information for .NET pkgs Signed-off-by: Benji Visser <benji@093b.org> * update pkg coverage directory test Signed-off-by: Benji Visser <benji@093b.org> * reverse dependsOn relationship Signed-off-by: Benji Visser <benji@093b.org> * update root pkg parsing Signed-off-by: Benji Visser <benji@093b.org> * add comments about the test relationships represented Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add docs around relationship sorting functions + update test helpers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Benji Visser <benji@093b.org> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-11 18:01:24 +00:00
Christopher Angelo Phillips	f6c8057977	feat: add package for go compiler given binary detection (#2195) ... adds a unique synthetic package to the SBOM output that represents the go compiler when it is detected as a part of a package discovered by the go binary cataloger. When using an SBOM generated by syft - downstream vulnerability scanners now have the opportunity to detect/report on the PURL/CPEs attached to the new stdlib package. --------- Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>	2023-10-06 13:15:50 -04:00
William Murphy	e34adea749	fix: deterministic java purls (#2170) ... Previously, which PURL was generated depended on the order of key iteration in maps. Also update an integ test that was apparently only passing because of the previous issue. Signed-off-by: Will Murphy <will.murphy@anchore.com>	2023-09-25 09:28:18 -04:00
Alex Goodman	5d48882a78	Add GitHub actions and shared workflow usage catalogers (#2140) ... * add github actions usage cataloger Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update integration and cli tests with github actions sample Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add support for shared workflows Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * split github actions usage cataloger Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add source explanation for github action types Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * a github purl does not always mean the package is a github action Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * keep github action catalogers as dir only catalogers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-09-15 18:51:21 +00:00
Christopher Angelo Phillips	094b41b301	chore: pin and update all workflow dependencies; add permission scopes (#2138) ... --------- Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>	2023-09-15 14:18:42 -04:00
William Murphy	2eb2d55551	chore: pin all cli test FROM lines to linux/amd64 (#2137) ... Many of these images have a slightly different sets of packages when the arm64 variant is pulled, so that leaving this digest unpinned causes the tests to fail on arm64 hosts. Pin the FROM lines to force stable platform values regardless of host architecture. Signed-off-by: Will Murphy <will.murphy@anchore.com>	2023-09-15 12:49:02 -04:00
William Murphy	007b034ee3	fix: correct group IDs for commons-codec, okhttp, okio, and add integration tests for Java PURL generation (#2075) ... Add overall integration test for java PURL detection. Signed-off-by: Will Murphy <will.murphy@anchore.com>	2023-08-31 16:57:55 -04:00
Alex Goodman	36d794febe	fix quiet flag (#2081) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-08-31 10:40:11 -04:00
William Murphy	51d38f8e59	fix: in some cases, try to use pom info to guess name and version to top level jar (#2080) ... Otherwise, small renames like 'hudson-war-2.2.1.war' to 'hudson.war', would cause syft to incorrectly catolog the archive. Signed-off-by: Will Murphy <will.murphy@anchore.com>	2023-08-31 10:19:55 -04:00
Keith ZantowandAlex Goodman	2b7a9d0be3	chore: update CLI to CLIO (#2001) ... Signed-off-by: Keith Zantow <kzantow@gmail.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-08-29 15:52:26 -04:00
3 people	b03e9c6868	Add registry certificate verification support (#1734) ... * add registry certificate verification support * replace stereoscope version * modify go.mod * pull in stereoscope update Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename registry cert options, add docs, and add test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update to account for changes in anchore/stereoscope#195 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: lishituo <24578666@qq.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-08-29 11:45:20 -04:00
3 people	9467bd66c2	fix: CycloneDX relationships not output or decoded properly (#1974) ... Signed-off-by: Mark Galpin <mark@tidelift.com> Signed-off-by: Keith Zantow <kzantow@gmail.com> Co-authored-by: Mark Galpin <mark@tidelift.com> Co-authored-by: Keith Zantow <kzantow@gmail.com>	2023-08-17 11:02:12 -04:00
Keith Zantow	59107324ce	chore: restore cataloger.DefaultConfig (#2028) ... Signed-off-by: Keith Zantow <kzantow@gmail.com>	2023-08-14 20:28:07 +00:00
Keith Zantow	c7272fd6a5	fix: SPDX license values and download location (#2007) ... Signed-off-by: Keith Zantow <kzantow@gmail.com>	2023-08-08 15:55:50 -04:00
Christopher Angelo Phillips	466da7cbda	931: binary cataloger exclusion defaults for ownership by overlap (#1948) ... Fixes #931 PR #1948 introduces a new implicit exclusion for binary packages that overlap by file ownership and have certain characteristics: 1) the relationship between packages is OwnershipByFileOverlap 2) the parent package is an "os" package - see changelog for included catalogers 3) the child is a synthetic package generated by the binary cataloger - see changelog for included catalogers 4) the package names are identical --------- Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>	2023-08-08 13:00:52 -04:00
Christopher Angelo Phillips	78660022bf	test: add coverage for new rpmdb paths (#1999) ... Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>	2023-08-04 13:04:36 -04:00
Tristan Farkas	e1c1832f84	Add cataloger for Swift Package Manager. (#1919) ... Signed-off-by: Tristan Farkas <Tristan.Farkas@axis.com>	2023-07-25 14:35:21 -04:00
Dan LuhringandAlex Goodman	8478e0bef7	Add support for parsing .NET assemblies (#1943) ... * Add support for parsing .NET assemblies Signed-off-by: Dan Luhring <dluhring@chainguard.dev> Former-commit-id: 69c33fe4d77357d843c11590f3b07825bc6249ac * Add dll and exe files Signed-off-by: Dan Luhring <dluhring@chainguard.dev> Former-commit-id: b9d204efa6d2ef385b5fbb7a59a3474ecabea641 * Add PE cataloger to directory catalogers Signed-off-by: Dan Luhring <dluhring@chainguard.dev> Former-commit-id: 9711c00d9da92e2887e0c1f92edd740ea5345849 * Don't set language to dotnet for PEs Signed-off-by: Dan Luhring <dluhring@chainguard.dev> Former-commit-id: 368313fddac9160d8a06a01ebe8c5ac7990232f5 * Fix spelling of cataloger in constructor Signed-off-by: Dan Luhring <dluhring@chainguard.dev> Former-commit-id: e42fd77b2f8b6d42e076a84f6cce386861260941 * Adjust which cases in PE parsing return errors Signed-off-by: Dan Luhring <dluhring@chainguard.dev> Former-commit-id: 95b25f8fc3a7d4e18fe30e489b09851f316795ff * remove build binary from branch Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Former-commit-id: fa54c0d0aef0998d5520e9f44cae51f5f9cd38a2 * Fix failing CLI tests Signed-off-by: Dan Luhring <dluhring@chainguard.dev> --------- Signed-off-by: Dan Luhring <dluhring@chainguard.dev> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-07-19 15:34:07 -04:00