Justin Chadwell
10f43d75e0
feat: Add --name option to override name in output ( #1269 )
2022-11-10 14:03:23 -05:00
949cff158d
Add support for dependency relationships for alpine (apk) ( #1063 )
...
* Fix type of pull deps and add support for provides
Signed-off-by: Dan Luhring <dan+github@luhrings.com >
* [wip] apk dependency lookup
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update whitespace for linter
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
* adjust test conditions
Signed-off-by: Timothy Gerla <tim@gerla.net >
* fix TODOs and improve Provides parser
* run simports after main merge
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
* add tests to cover apk relationship parsing cases
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* generate JSON schema for breaking changes to apk metadata
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update tests to account for additional dependencies
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* [wip] fix relationship encoding for cyclonedx
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* simplify package relationships that can be expressed
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Dan Luhring <dan+github@luhrings.com >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
Signed-off-by: Timothy Gerla <tim@gerla.net >
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
Co-authored-by: Timothy Gerla <tim@gerla.net >
2022-11-09 15:43:37 +00:00
Alex Goodman
d7a51a69dd
Update java generic cataloger ( #1329 )
...
* remove centralize pURL generation
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* port java cataloger to new generic cataloger pattern
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* remove common.GenericCataloger
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update format test fixtures to reflect ID updates
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix package sort instability for encode-decode-encode cycles
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2022-11-09 14:55:54 +00:00
Alex Goodman
5ed002e1a9
Update swift cataloger to generic cataloger ( #1324 )
...
* port swift cataloger to new generic cataloger pattern
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* add cocopods metadata to json schema defs
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update json test fixture with latest schema version
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2022-11-04 13:51:59 -04:00
Alex Goodman
2deb96a801
Update portage cataloger to new generic cataloger ( #1316 )
...
* port portage (ha) cataloger to new generic cataloger pattern
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update JSON schema to account for removing portage fields
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2022-11-03 14:49:18 -04:00
Christopher Angelo Phillips
edeba9c01c
feat: add nodejs-binary package classifier ( #1296 )
2022-10-31 16:45:11 +00:00
Marc-Etienne Vargenau
dd89461ba3
Fix #1245 Update SPDX license list to 3.18 ( #1259 )
...
* Fix #1245 Update SPDX license list to 3.18
Signed-off-by: Marc-Etienne Vargenau <marc-etienne.vargenau@nokia.com >
2022-10-27 23:46:54 -04:00
Alex Goodman
52cb7269bf
port deb/dpkg cataloger to new generic cataloger pattern ( #1288 )
...
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2022-10-25 15:47:32 +00:00
Alex Goodman
d8c659b65b
replace logger interface with anchore/go-logger ( #1279 )
...
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2022-10-21 15:12:14 +00:00
Marc-Etienne Vargenau
e2d06cecb7
chore: handle deprecated SPDX license: StandardML-NJ ( #1266 )
2022-10-17 13:45:36 -04:00
Marc-Etienne Vargenau
41bc6bb410
Fixes #1179 Deprecated SPDX license ( #1263 )
2022-10-14 15:54:57 -04:00
Christopher Angelo Phillips
89575199b8
feat: add RelationshipsBySourceOwnership to syft json output ( #1248 )
2022-10-11 15:11:03 -04:00
Keith Zantow
780e1c310c
refactor: Remove experimental Anchore Enterprise upload functionality ( #1257 )
2022-10-10 16:16:47 -04:00
Hiroaki KAWAI and Christopher Phillips
b9b13d5525
Add Conan (C/C++) conan.lock file support ( #1230 )
...
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2022-09-29 18:45:59 +00:00
Keith Zantow
b20310eaf8
Add gosimports ( #1205 )
2022-09-14 13:38:18 -04:00
Chapman Pendery
9097614f3b
refactor: move formats from internal into syft module ( #1172 )
2022-09-13 11:20:52 -04:00
Keith Zantow
70db13d49e
Add RPM file scanning support ( #1188 )
2022-09-07 14:16:30 -04:00
Scott Andrews
1c7b7c5f8a
Normalize syft-json output ( #1194 )
2022-09-07 10:56:49 -04:00
Christopher Angelo Phillips
586d3fe77f
Revert "External sources configuration ( #1158 )" ( #1191 )
...
reverted as functionality is to be merged with dev branch of kubecon draft
2022-09-01 15:45:35 -04:00
Keith Zantow
a17ff7b555
Fix RPM DB license handling ( #1184 )
2022-08-30 14:38:12 -04:00
Christopher Angelo Phillips and Alex Goodman
615f933d98
Bug fix for 1095 - syft conversion option error ( #1177 )
...
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2022-08-25 17:36:15 -04:00
anchore-actions-token-generator[bot] and Weston Steimel
b0fc955e0c
Update syft bootstrap tools to latest versions. ( #1171 )
...
* Update syft bootstrap tools to latest versions.
Signed-off-by: GitHub <noreply@github.com >
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
Co-authored-by: Weston Steimel <weston.steimel@anchore.com >
2022-08-23 20:36:59 +01:00
Marco Deicas
13296880cd
External sources configuration ( #1158 )
2022-08-22 11:22:18 -04:00
Keith Zantow
21eb772060
Associate node package licenses from node_modules ( #1152 )
2022-08-16 14:14:02 -04:00
Justin Chadwell
3db6911865
fix: extract file ids correctly for spdx-json ( #1156 )
...
Previously, extracting relationships between packages and files was not
completing correctly, as SPDXRef- ElementIDs were being compared to raw
IDs, and so never matched. This patch ensures that we always compare
ElementIDs, to ensure that the hasFiles field is correctly populated.
Signed-off-by: Justin Chadwell <me@jedevc.com >
2022-08-11 14:06:36 -04:00
Alex Goodman
2693a8c19a
metadata decoding should be optional ( #1154 )
...
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2022-08-10 16:20:53 +00:00
04387301ce
Add modularitylabel metadata to RPM type records generated by syft ( #1148 )
...
* bump cosign to v1.10.1 (#1144 )
Signed-off-by: Daniel Nurmi <nurmi@anchore.com >
* Add modularitylabel metadata to RPM type records generated by syft. Fixes #1145 .
Signed-off-by: Daniel Nurmi <nurmi@anchore.com >
* update to address lint failures
Signed-off-by: Daniel Nurmi <nurmi@anchore.com >
* Update syft/pkg/rpmdb_metadata.go
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Daniel Nurmi <nurmi@anchore.com >
* update json schema to match camel case
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Co-authored-by: Weston Steimel <weston.steimel@anchore.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
2022-08-08 11:52:32 +00:00
Jonas Xavier and Alex Goodman
69fb0a6f3b
Overwrite deprecated SPDX licenses automatically ( #1009 )
...
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
2022-08-02 15:25:33 -04:00
cpendery
9b1adce19a
feat: implement haskell support ( #1096 )
2022-07-18 15:33:54 -04:00
cpendery
470b13045b
feat: add support for cocoapods (Swift/Objective-C) ( #1081 )
2022-07-11 10:09:08 -04:00
Zac Medico and Christopher Phillips
4c55c62834
Add portage support for Gentoo Linux ( #1076 )
...
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2022-07-06 16:18:54 -04:00
Batuhan Apaydın and Christopher Phillips
69134ed3b5
feat: add new login cmd ( #1068 )
...
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2022-07-05 11:57:28 -04:00
cpendery
57323a1666
feat: add support for conan packages (C/C++) ( #1083 )
2022-07-05 10:49:24 -04:00
Alex Goodman and ramanan-ravi
ea611dab5f
Add catalogers configuration ( #1038 )
...
* Option to enable specific language or ecosystem cataloger
Signed-off-by: ramanan-ravi <ramanan@deepfence.io >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* Disable dotnet cataloger
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* Option to enable specific language or ecosystem cataloger
Signed-off-by: Ramanan Ravikumar <ramanan@deepfence.io >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* rename "enable-cataloger" option to "catalogers"
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* add cli test for --catalogers option
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update readme with latest cataloger names
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* enable dotnet cataloger
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix linting
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix cataloger imports
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update readme with alpmdb cataloger config example
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Co-authored-by: ramanan-ravi <ramanan@deepfence.io >
2022-06-21 13:06:25 +00:00
Jonas Xavier
aed1599c4d
add template output ( #1051 )
...
* add template output
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* remove dead code
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* fix template cli flag
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* implement template's own format type
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* simpler code
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* fix readme link to Go template
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* feedback changes
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* simpler func signature patter
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* nit
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* fix linter error
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
2022-06-17 14:04:31 -04:00
Christopher Angelo Phillips
9e72771b85
update zip_read_closer to incorporate zip64 support ( #1041 )
2022-06-16 10:43:18 -04:00
Morten Linderud and Christopher Phillips
e72d68b0c6
Add pacman (alpm) parser support ( #943 )
...
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2022-06-13 18:51:37 +00:00
Jonas Xavier
0aea55f880
add main module field to go bin metadata ( #1026 )
...
* add main module field to go bin metadata
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* udpate json ouput schema to 3.2.4
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* clean up fixture
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
2022-06-03 23:12:09 +00:00
cpendery
6ccd460e59
fix: add component list to prevent cyclone-dx panic ( #1015 )
2022-05-26 13:44:12 -04:00
Jonas Xavier
7cb8e1fc14
Use SBOM descriptor version ( #1011 )
...
* Use SBOM descriptor version
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* Update tests
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* CycloneDX extract tools metadata in decoding stage
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* add descriptor to spdx tag-value test
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* remove comment
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
2022-05-25 14:40:08 -07:00
Christopher Angelo Phillips
03ee4fdf5e
add integration tests for validating CycloneDX output using cyclonedx-cli ( #1000 )
2022-05-12 12:56:04 -04:00
Jonas Xavier and Keith Zantow
24f08e7738
Convert between SBOM formats ( #964 )
...
* add convert command
Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com >
* mvp
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* fix hanging bug
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* validate SBOM formats for conversion
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* move convert cmd to new structure
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* remove bin
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* drop event loop from convert cmd
extract SBOM type from document namespace
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* validate SPDX in tests
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* documenting convert cmd
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* support output format=file.json notation
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* test convertible formats
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* fix typo
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* clean up
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* more clean up and docs
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* feedback changes
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* nit
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* feedback changes
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* re-use more code
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* undo encode-decode cycle test
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* remove unnecessary test constraint
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* fix readme
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* try verbose
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* cleaner README and no table conversion
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* simpler conversion
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* feedback changes and cleanup
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* nit space fix
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* use defer
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* feedback changes
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
2022-05-09 17:28:33 -07:00
Christopher Angelo Phillips
a83506628c
Add README updates for Keyless features ( #988 )
2022-05-09 16:07:28 +00:00
Jonas Xavier
42f8601919
Fix tests: add timeout to long-running failures, update SPDX license list ( #989 )
2022-05-09 11:48:44 -04:00
Christopher Angelo Phillips and Alex Goodman
d2d532f4a8
835 - Keyless Support for SBOM Attestations ( #910 )
...
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
2022-05-06 18:06:32 -04:00
Christian Kotzbauer and Alex Goodman
1cea0ecd5c
feat: add initial dotnet-support ( #951 )
...
* feat: add initial dotnet-support
Signed-off-by: Christian Kotzbauer <git@ckotzbauer.de >
* fix: add path, sha512 and hashpath
Signed-off-by: Christian Kotzbauer <git@ckotzbauer.de >
* fix: add missing dot
Signed-off-by: Christian Kotzbauer <git@ckotzbauer.de >
* fix: lint warnings
Signed-off-by: Christian Kotzbauer <git@ckotzbauer.de >
* fix CLI test package counts to account for dotnet
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix: updated packagurl-go
Signed-off-by: Christian Kotzbauer <git@ckotzbauer.de >
* tidy go.sum
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update json schema
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
2022-05-05 15:32:02 -04:00
Dan Luhring
0bd3558fb2
reduce noise of log output ( #976 )
2022-05-02 14:54:30 +00:00
Sambhav Kothari and Christopher Phillips
36973021fa
Rename syft-id to package-id ( #970 )
...
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2022-04-29 11:18:45 -04:00
Christopher Angelo Phillips
6029dd7c2e
refactor command package to remove globals and add dependency injection
2022-04-26 18:23:03 +00:00
Jon McEwen
7304bbf8ee
fix : #953 Derive language from pURL - https://github.com/anchore/syft … ( #957 )
...
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2022-04-26 11:51:24 -04:00
Justin Chadwell
Alex Goodman
Christopher Angelo Phillips
Marc-Etienne Vargenau
Keith Zantow
Hiroaki KAWAIandChristopher Phillips
Chapman Pendery
Scott Andrews
anchore-actions-token-generator[bot]andWeston Steimel
Marco Deicas
Justin Chadwell
Jonas XavierandAlex Goodman
Zac MedicoandChristopher Phillips
Batuhan ApaydınandChristopher Phillips
Morten LinderudandChristopher Phillips
Christian KotzbauerandAlex Goodman
Sambhav KothariandChristopher Phillips
Jon McEwen