oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-11 21:57:22 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,755 Commits 63 Branches 272 Tags
preserve-format-object
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Keith Zantow b13ffdd304 fix: comma separated selectors in cataloger list command (#3804) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-04-16 10:41:48 -04:00
Keith Zantow 4a9437808e feat: parallelize catalogers per-file and hash contents in parallel (#3636) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-03-26 11:10:08 -04:00
Keith Zantow 7ac4d91f43 chore: reformat (#3754) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-03-21 06:13:35 -04:00
Keith Zantow 9a2c2ad401 chore: upload individual binaries as artifacts (#3714) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-03-13 12:15:13 -04:00
Keith Zantow 7571f8dfba chore: updates for go 1.24.1 (#3712) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-03-06 15:35:26 +00:00
Keith Zantow 2792013eb2 chore: disable line wrapping glow output (#3679) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-02-24 10:04:14 -05:00
Keith Zantow 46522bcc5d chore: update packageurl-go (#3678) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-02-21 15:31:16 -05:00
Keith Zantow a17fe480a0 chore: update runners to ubuntu-24.04 (#3657) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-02-11 21:34:12 +00:00
Keith Zantow 2328b20082 fix: reduce warn levels to debug for non-actionable errors (#3645) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-02-07 13:22:55 -05:00
Keith Zantow a2a56dd3e9 fix: golang remote license search not executing when error reading local mod dir (#3549) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-01-06 11:47:55 -05:00
Keith Zantow 16eedd81ec chore: build release sbom from go.mod (#3417) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-11-05 09:51:23 -05:00
Keith Zantow 798c18a698 fix: stack overflow in spyingIoReadCloser (#3392) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-10-29 08:23:57 -04:00
Keith Zantow 1118ac4ace fix: bad pom files may cause infinite loop (#3391) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-10-28 18:09:04 -04:00
Keith Zantow 759b898df5 feat: multi-level configuration and profiles (#3337) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-10-23 12:15:59 -04:00
Keith Zantow a00533c836 feat: Java dependency graph information (#3363) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-10-23 11:17:34 -04:00
Keith ZantowandAlex Goodman ccbee94b87 feat: report unknowns in sbom (#2998) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-10-07 16:11:37 -04:00
Keith Zantow 1b863268df feat: --enrich flag for data enrichment feature enablement (#3182) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-09-12 10:45:18 -04:00
Keith Zantow c33a51d3d8 chore: restore ci-check.sh script (#3218) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-09-10 15:19:05 -04:00
Keith Zantow 11d77b4a94 fix: cycles resolving relative path parent poms with parent-defined variables (#3170) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-08-28 15:12:13 -04:00
Keith Zantow 73b9d5aa42 fix: mysql 8.0.3x binary detection (#3142) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-08-21 09:48:28 -04:00
Keith Zantow 95b4a88256 fix: logging for remote network calls (#3140) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-08-20 11:45:33 -04:00
Keith Zantow cf85450e08 chore: fix failing python relationship test (#3117) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-08-12 12:07:47 -04:00
Keith Zantow 05a10e8bed chore: update release script to use gh from binny (#3084) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-07-31 20:10:17 -04:00
Keith Zantow a4b5dcd0df fix: improve determinism in java archive identification (#3085) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-07-30 12:02:52 -04:00
Keith Zantow 741c8fb9bd fix: SPDX output performance with many relationships (#3053) 2024-07-24 10:14:20 -04:00
Keith Zantow 125c787e40 chore: add debug logging for errors reading RPM files (#3051) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-07-22 13:05:04 -04:00
Keith Zantow ba31c2f1ae fix: include CPEs with Maven groupId as vendor (#3045) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-07-17 11:23:58 -07:00
Keith Zantow 278b72d39b chore: pin fedora image for elf binary test (#3041) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-07-15 16:37:09 +00:00
Keith Zantow bd1c1d260c fix: handle errors reading go licenses (#2985) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-06-24 10:27:03 -04:00
Keith Zantow af3aaa0397 fix: make caching options more explicit (#2966) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-06-14 18:45:48 +00:00
Keith Zantow ca0cc52d47 fix: separate golang license caches from mod dir (#2852) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-06-12 19:12:35 -04:00
Keith Zantow ac34808b9c feat: detect fluent-bit binaries (#2905) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-05-28 10:13:06 -04:00
Keith Zantow 1c37bab2b2 feat: add config command (#2892) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-05-23 15:18:09 -04:00
Keith Zantow b0c88ddea9 fix(spdx): include required fields (#2168) 
* fix(spdx): include required fields

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: missed update due to refactoring

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: update tools-golang

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: add test with packageVerificationCode included and excluded

Signed-off-by: Keith Zantow <kzantow@gmail.com>

---------

Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-04-30 13:28:42 -04:00
Keith Zantow 047e31a969 fix: add correct vendor for dnsmasq CPE (#2659) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-04-30 13:24:01 -04:00
Keith Zantow f7d3d552ce fix: exclude known instrumentation jars from being erroneously identified (#2796) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-04-22 15:03:17 -04:00
Keith ZantowandWill Murphy dde5d349b1 fix: more robust go main version extraction (#2767) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Will Murphy <will.murphy@anchore.com>
Co-authored-by: Will Murphy <will.murphy@anchore.com>
 2024-04-11 11:58:51 -04:00
Keith Zantow 01340b2a5c fix: conan poco project cpe (#2740) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-03-28 16:56:24 -04:00
Keith Zantow 410867ca0c fix: panic scanning binaries without symtab (#2739) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-03-27 13:51:45 -04:00
Keith Zantow f9e09aef19 docs: add simplest example from regsitry (#2691) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-03-06 14:25:37 -05:00
Keith Zantow 326ec57d4a docs: fix incorrect flag name in readme (#2677) 2024-02-28 15:39:43 -05:00
Keith Zantow a978966cad feat: add --from flag, refactor source providers (#2610) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-02-27 16:44:37 -05:00
Keith Zantow 2995c3c4fd fix: SPDX tag value version selector (#2665) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-02-23 08:22:10 -05:00
Keith Zantow 108a5dae9b chore: update busybox image for acceptance tests (#2663) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-02-22 15:32:17 -05:00
Keith Zantow 6288530835 fix: add BOMRef to CycloneDX OS Component (#2634) 2024-02-14 08:18:16 -05:00
Keith Zantow d26a5c4d30 fix: ensure version output to stdout (#2621) 2024-02-09 20:59:25 +00:00
Keith Zantow ef5c1651ef fix: improve dotnet portable executable identification (#2133) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-11-29 12:51:24 -05:00
Keith Zantow f5a6b5a02f fix: logging level for parsing potential PE files (#2367) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-11-29 03:42:22 +00:00
Keith Zantow a50a0f77d2 fix: capture root command stdout (#2364) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-11-28 15:04:28 -05:00
Keith Zantow 1c787f436f fix: prevent writing non-report output to stdout (#2324) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-11-16 17:45:25 -05:00
Keith Zantow d91c2dd842 fix: identify cyclone-json without $schema (#2303) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-11-08 11:54:22 -05:00
Keith Zantow 7d0d3e1977 fix: prevent errors from clobbering terminal (#2161) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-09-20 14:35:41 -04:00
Keith Zantow a46d12270f fix: encode and decode FileLicenses and FileContents in Syft JSON (#2083) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-09-13 16:14:20 -04:00
Keith ZantowandAlex Goodman 2b7a9d0be3 chore: update CLI to CLIO (#2001) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-08-29 15:52:26 -04:00
Keith Zantow dd09e0362e chore: update quill to the latest version (#2065) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-25 20:45:04 +00:00
Keith Zantow 4ae94c37eb fix: duplicate entries in cyclonedx dependency list (#2063) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-25 12:19:01 -04:00
Keith Zantow 4762ba0943 feat: use java package names to determine known groupids (#2032) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-17 12:55:25 -04:00
Keith Zantow d1635971a1 fix: inconsistent removal of binaries by overlap (#2036) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-17 15:27:31 +00:00
Keith Zantow 59107324ce chore: restore cataloger.DefaultConfig (#2028) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-14 20:28:07 +00:00
Keith Zantow b3d7ba569b fix: read direct package files when decoding SPDX tag-value (#2014) 
* fix: read direct package files when decoding SPDX tag-value

---------

Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-14 11:37:24 -04:00
Keith Zantow c7272fd6a5 fix: SPDX license values and download location (#2007) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-08 15:55:50 -04:00
Keith Zantow aaf767f8d3 chore: improve spdx purl decoding (#1996) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-04 11:43:21 -04:00
Keith Zantow 79014ed8c8 fix: gradle lockfile parser groupId handling (#1995) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-04 11:42:26 -04:00
Keith Zantow 3f0475efb7 chore: update bubbly to fix hanging (#1990) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-02 10:28:35 -04:00
Keith Zantow e2f7befbfb fix: default image source name to user input (#1979) 
* fix: default image source name to user input

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: add test

Signed-off-by: Keith Zantow <kzantow@gmail.com>

---------

Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-07-31 17:29:18 +00:00
Keith Zantow 9480f10ccd feat: support top-level SPDX package and graph (#1934) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-07-26 13:54:32 -04:00
Keith Zantow f79cb9587f fix: only output valid cyclonedx license choices (#1879) 
* fix: only output valid cyclonedx license choices

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: update tests

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: return nil for emtpty cdx license list

Signed-off-by: Keith Zantow <kzantow@gmail.com>

---------

Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-06-22 12:05:38 -04:00
Keith Zantow 631d50d038 chore: update SPDX license list to 3.21 (#1885) 2023-06-20 15:47:02 +00:00
Keith Zantow 79a955b1a9 feat: source-version flag (#1859) 2023-06-05 10:36:34 -04:00
Keith Zantow a3c5550217 fix: duplicate packages, support pnpm lockfile v6 (#1778) 2023-05-23 10:24:25 -04:00
Keith Zantow ddb338d834 chore: do not HTML escape PackageURLs (#1782) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-05-05 10:08:04 -04:00
Keith Zantow 354c72bbf4 chore: do not include kernel module cataloger by default (#1784) 2023-05-05 09:54:24 -04:00
Keith Zantow 645206735e chore: add more detail on SPDX file IDs (#1769) 2023-05-02 16:52:18 -04:00
Keith Zantow 451cb9d5ca chore: update test redactor ordering (#1765) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-04-26 20:42:43 +00:00
Keith Zantow 7845381331 chore: update tools-golang to v0.5.0 (#1717) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-04-05 13:59:52 -04:00
Keith Zantow 2022ffa0e5 chore: update deprecated set-output calls (#1705) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-04-03 09:36:11 -04:00
Keith Zantow 11e926ab2f chore: fix flaky license sorting (#1690) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-03-22 14:41:49 -04:00
Keith Zantow 34ace36a9e chore: tweak some workflow text (#1685) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-03-21 11:08:49 -04:00
Keith Zantow d05000ff21 fix: reduce logging for bad dpkg lines (#1675) 
* fix: reduce logging for bad dpkg lines to Trace level
---------

Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-03-17 13:08:51 -04:00
Keith Zantow 302735097e fix: remove author contributing to javascript CPEs (#1669) 2023-03-14 14:10:24 +00:00
Keith Zantow cc0a376aba fix: more python matching support (#1667) 2023-03-13 13:26:43 -04:00
Keith Zantow 7714bc0521 fix: improved Python binary detection (#1648) 2023-03-07 10:52:29 -05:00
Keith Zantow 7cfdffab5f fix: sanitize SPDX LicenseRefs (#1657) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-03-06 10:55:23 -05:00
Keith Zantow 304be4a5a1 fix: dotnet PURL types are invalid (#1649) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-03-03 16:45:20 -05:00
Keith Zantow 5f90d03718 fix: possible race condition (#1639) 2023-03-01 15:35:01 -05:00
Keith Zantow 2e6e3b0c74 fix: rebar lock file decoding panic (#1628) 2023-03-01 10:08:29 -05:00
Keith Zantow 24584a4d27 fix: handle individual cataloger panics (#1636) 2023-03-01 10:03:34 -05:00
Keith Zantow 5e8aa4da5e fix: decoding null apk metadata pullDependencies (#1614) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-02-23 19:55:49 +00:00
Keith Zantow 4bf677d555 chore: fix cataloger_test (#1603) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-02-22 17:30:41 +00:00
Keith Zantow f5e20521e0 fix: merging of binary packages (#1583) 2023-02-22 12:03:15 -05:00
Keith Zantow 8f6a317fef fix: issue when matching format versions (#1585) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-02-22 10:32:05 -05:00
Keith Zantow 2ef2eed382 chore: update SPDX license list (#1599) 2023-02-21 17:31:24 +00:00
Keith Zantow a3ebb31e3c chore: update bug issue template (#1571) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-02-14 12:58:44 -05:00
Keith Zantow 890fb3f0e8 fix: missing APK node vulnerabilities (#1565) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-02-10 15:52:13 -05:00
Keith Zantow 9650473298 feat: Allow specific versions of formats to be specified (#1543) 2023-02-07 10:40:43 -05:00
Keith Zantow 1530ef354f chore: update spdx/tools-golang to v0.5.0-rc1 (#1503) 2023-01-31 11:53:16 -05:00
Keith Zantow ba55963104 fix: allow template for syft convert (#1521) 2023-01-26 12:07:36 -05:00
Keith Zantow 674a54512c chore: correct bootstrap tool script (#1514) 2023-01-25 10:22:28 -05:00
Keith ZantowandAlex Goodman 6cf668f749 fix: nil panic in graalvm cataloger (#1468) 
* normalize error handling and recover from panics while parsing binaries
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2023-01-17 19:06:24 +00:00
Keith Zantow 934644232a chore: revert GolangBinMetadata name and make analogous GolangModMetadata (#1458) 2023-01-13 16:46:12 -05:00