William Murphy
630c18e0d3
Print package list when extra packages found ( #1791 )
...
The tests in test/cli/packages_cmd_test.go are hard to debug when different
packages are found in different environments. For example, CI runs and M1 macs
have been observed to have different package counts. Therefore, if the test is
about to fail, log a sorted list of the packages that were found, so that it is
easy to compare failures of these tests.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2023-05-05 15:57:13 -04:00
Keith Zantow
354c72bbf4
chore: do not include kernel module cataloger by default ( #1784 )
2023-05-05 09:54:24 -04:00
Avi Deitcher and Alex Goodman
cc731c7b19
Add Linux Kernel cataloger ( #1694 )
...
* add kernel handler
Signed-off-by: Avi Deitcher <avi@deitcher.net >
* [wip] combine kernel and kernel module cataloging
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* [wip] combine kernel and kernel module cataloging
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Avi Deitcher <avi@deitcher.net >
* rename Kernel package to LinuxKernel package
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* split kernel and module packages within cataloger
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* wire up application configuration with kernel cataloger options
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* dont use references for packages on relationships
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix linting and tests
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* kernel cataloger should be resistent to partial failure
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* log upon kernel module metadata missing
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* add tests for linux kernel cataloger
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update integration tests
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update cli package test counts
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* add evidence annotations for kernel packages
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* reduce noise in cli test output
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* missed cli test to reduce noise for
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix package counts
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update docs with linux kernel cataloging refs
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* bump json schema with new metadata fields
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
---------
Signed-off-by: Avi Deitcher <avi@deitcher.net >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: <>
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
2023-04-14 14:33:36 -04:00
7464079a09
Add Nix cataloger ( #1696 )
...
* Add Basic Nix Cataloger
Signed-off-by: Julio Tain Sueiras <juliosueiras@gmail.com >
* Update nix def for the latest syft definition
Signed-off-by: Julio Tain Sueiras <juliosueiras@gmail.com >
* capture nix package files on pkg.NixStoreMetadata
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix unit tests and linting
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update JSON schema
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* address review comments
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* Update syft/pkg/cataloger/nix/parse_nix_store_path_test.go
Co-authored-by: Florian Klink <flokli@flokli.de >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* support unstable version conventions
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update json schema relative to main branch
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update syft json with v7.1.1 schema
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix CLI tests
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* remove extra continue statement
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* add Nix to list of supported ecosystems
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
---------
Signed-off-by: Julio Tain Sueiras <juliosueiras@gmail.com >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Co-authored-by: Julio Tain Sueiras <juliosueiras@gmail.com >
Co-authored-by: Florian Klink <flokli@flokli.de >
2023-04-04 10:53:56 -04:00
Alex Goodman
8a574c9ed9
refactor spdx tooling test to reduce intermittent failures ( #1707 )
...
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2023-04-03 18:43:28 +00:00
Christopher Angelo Phillips
928c4a55ff
feat: add shared dir for easier cleanup ( #1676 )
...
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2023-03-16 16:05:34 -04:00
Alex Goodman
9b9a7d6c98
allow convert to take stdin ( #1570 )
...
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2023-02-14 10:03:47 -05:00
Keith Zantow
9650473298
feat: Allow specific versions of formats to be specified ( #1543 )
2023-02-07 10:40:43 -05:00
Christopher Angelo Phillips
9995950c70
fix: update config struct to not decode password/key ( #1538 )
...
* fix: update config struct to not decode password/key
* test: update tests to confirm no secrets in output
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2023-02-03 18:06:14 +00:00
Keith Zantow
ba55963104
fix: allow template for syft convert ( #1521 )
2023-01-26 12:07:36 -05:00
Alex Goodman and Christopher Phillips
0f75f975c8
Relax error conditions for catalogers ( #1492 )
...
* binary cataloger should continue on errors
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* test: add redirect for cmd stderr stdout
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
* test: image update for test failure
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2023-01-19 19:28:42 -05:00
Alex Goodman
05611c283d
bootstrap within composite action ( #1461 )
...
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2023-01-17 10:04:22 -05:00
Christopher Angelo Phillips and Alex Goodman
44e8ae2577
fix: update attestation code to remove library dependencies and shellout for keyless flow ( #1442 )
...
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
2023-01-12 17:22:05 +00:00
mikcl and Alex Goodman
4bfb849310
Parallel package catalog processing ( #1355 )
...
* catalog: run cataloggers concurrently
Signed-off-by: mikcl <mikesmikes400@gmail.com >
* frontend: expose workers as a configurable option
Signed-off-by: mikcl <mikesmikes400@gmail.com >
* fixup! frontend: expose workers as a configurable option
Signed-off-by: mikcl <mikesmikes400@gmail.com >
* update logging statements
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* test: assert for debug logging
Signed-off-by: mikcl <mikesmikes400@gmail.com >
Signed-off-by: mikcl <mikesmikes400@gmail.com >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
2023-01-11 15:18:02 -05:00
Christopher Angelo Phillips
3690f979b3
feat: update spdx format model to produce valid spdx json documents ( #1418 )
2022-12-21 15:56:03 -05:00
Christopher Angelo Phillips
c8b8b1ca11
docs: update schema name to 2.3 ( #1416 )
2022-12-20 02:57:19 +00:00
Christopher Angelo Phillips
0f1e8fca14
bug: spdx checksum empty array; allow syft to generate SHA1 for spdx-tag-value documents ( #1404 )
2022-12-20 00:10:35 +00:00
Keith Zantow
4f39287216
feat: Generic Binary Cataloger ( #1336 )
2022-11-29 18:28:10 -05:00
Alex Goodman
d7a51a69dd
Update java generic cataloger ( #1329 )
...
* remove centralize pURL generation
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* port java cataloger to new generic cataloger pattern
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* remove common.GenericCataloger
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update format test fixtures to reflect ID updates
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix package sort instability for encode-decode-encode cycles
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2022-11-09 14:55:54 +00:00
Christopher Angelo Phillips
edeba9c01c
feat: add nodejs-binary package classifier ( #1296 )
2022-10-31 16:45:11 +00:00
Keith Zantow
780e1c310c
refactor: Remove experimental Anchore Enterprise upload functionality ( #1257 )
2022-10-10 16:16:47 -04:00
Christopher Angelo Phillips
0f99215b2c
bug: remove chance for panic; provide default attestation path ( #1214 )
2022-09-19 15:50:33 +00:00
Keith Zantow
b20310eaf8
Add gosimports ( #1205 )
2022-09-14 13:38:18 -04:00
Chapman Pendery
9097614f3b
refactor: move formats from internal into syft module ( #1172 )
2022-09-13 11:20:52 -04:00
Christopher Angelo Phillips and Alex Goodman
615f933d98
Bug fix for 1095 - syft conversion option error ( #1177 )
...
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2022-08-25 17:36:15 -04:00
Tom Fay
621f0fe082
cataloger configuration is respected regardless of source ( #1142 )
2022-08-04 21:14:23 +00:00
Weston Steimel and Christopher Phillips
62897fbc89
bump goreleaser to v1.10.3 ( #1123 )
...
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2022-07-28 17:10:32 +00:00
Zac Medico and Christopher Phillips
4c55c62834
Add portage support for Gentoo Linux ( #1076 )
...
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2022-07-06 16:18:54 -04:00
Alex Goodman and ramanan-ravi
ea611dab5f
Add catalogers configuration ( #1038 )
...
* Option to enable specific language or ecosystem cataloger
Signed-off-by: ramanan-ravi <ramanan@deepfence.io >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* Disable dotnet cataloger
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* Option to enable specific language or ecosystem cataloger
Signed-off-by: Ramanan Ravikumar <ramanan@deepfence.io >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* rename "enable-cataloger" option to "catalogers"
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* add cli test for --catalogers option
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update readme with latest cataloger names
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* enable dotnet cataloger
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix linting
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix cataloger imports
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update readme with alpmdb cataloger config example
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Co-authored-by: ramanan-ravi <ramanan@deepfence.io >
2022-06-21 13:06:25 +00:00
Jonas Xavier
aed1599c4d
add template output ( #1051 )
...
* add template output
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* remove dead code
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* fix template cli flag
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* implement template's own format type
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* simpler code
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* fix readme link to Go template
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* feedback changes
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* simpler func signature patter
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* nit
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* fix linter error
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
2022-06-17 14:04:31 -04:00
Morten Linderud and Christopher Phillips
e72d68b0c6
Add pacman (alpm) parser support ( #943 )
...
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2022-06-13 18:51:37 +00:00
Christopher Angelo Phillips
03ee4fdf5e
add integration tests for validating CycloneDX output using cyclonedx-cli ( #1000 )
2022-05-12 12:56:04 -04:00
Keith Zantow
91e2fd8532
Fix potential race condition during event subscription ( #993 )
2022-05-11 18:35:55 -04:00
Jonas Xavier
42f8601919
Fix tests: add timeout to long-running failures, update SPDX license list ( #989 )
2022-05-09 11:48:44 -04:00
Christopher Angelo Phillips and Alex Goodman
d2d532f4a8
835 - Keyless Support for SBOM Attestations ( #910 )
...
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
2022-05-06 18:06:32 -04:00
Christian Kotzbauer and Alex Goodman
1cea0ecd5c
feat: add initial dotnet-support ( #951 )
...
* feat: add initial dotnet-support
Signed-off-by: Christian Kotzbauer <git@ckotzbauer.de >
* fix: add path, sha512 and hashpath
Signed-off-by: Christian Kotzbauer <git@ckotzbauer.de >
* fix: add missing dot
Signed-off-by: Christian Kotzbauer <git@ckotzbauer.de >
* fix: lint warnings
Signed-off-by: Christian Kotzbauer <git@ckotzbauer.de >
* fix CLI test package counts to account for dotnet
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix: updated packagurl-go
Signed-off-by: Christian Kotzbauer <git@ckotzbauer.de >
* tidy go.sum
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update json schema
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
2022-05-05 15:32:02 -04:00
Alex Goodman
d2f053bc71
unblock timeout for power-user select CLI tests ( #985 )
...
* update to use shared secretsFixture to prevent race
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2022-05-05 15:12:11 +00:00
Christopher Angelo Phillips
6029dd7c2e
refactor command package to remove globals and add dependency injection
2022-04-26 18:23:03 +00:00
Alex Goodman
f24bbc1838
Deduplicate packages across multiple container image layers ( #930 )
2022-03-31 15:45:51 -04:00
Alex Goodman
07d3c9af52
Fix file creation for output options ( #875 )
2022-03-08 15:37:28 +00:00
Alex Goodman
a86dd3704e
Add platform selection ( #866 )
2022-03-04 22:41:38 +00:00
Alex Goodman
4af32c5bee
Migrate format definitions to sbom package ( #864 )
2022-03-04 17:22:40 -05:00
Christopher Angelo Phillips and Alex Goodman
afc0c1acd9
855 attest registry source only ( #856 )
...
Add source.NewFromRegistry function so that the syft attest command can always explicitly ask for an OCIRegistry provider rather than rely on local daemon detection for image sources.
Attestation can not be used where local images loaded in a daemon are the source. Digest values for the layer identification step in attestation can sometimes vary across workstations.
This fix makes it so that attest is generating an SBOM for, and attesting to, a source that exists in an OCI registry. It should never load a source from a local user docker/podman daemon.
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
2022-03-01 23:16:42 -05:00
Alex Goodman
99bb93d0fe
Resolve symlinks when fetching file contents ( #782 )
2022-02-24 10:01:59 -05:00
Christopher Angelo Phillips
256e85bc12
510 - SBOM attestation stdout ( #785 )
...
add syft attest command to produce an attestation as application/vnd.in-toto+json to standard out using on disk PKI
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2022-02-22 21:45:12 -05:00
Jonas Xavier
ca081ae5e0
use SYFT_LOG_FILE env var ( #805 )
...
* use SYFT_LOG_FILE
Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com >
* enable debug logs when SYFT_LOG_FILE is set
Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com >
* set log.file and add tests
Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com >
* test log file in temp directory
Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com >
* add note on binding refactor
Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com >
* remove unused function
Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com >
2022-02-09 10:04:08 -08:00
Alex Goodman
37251f6179
Fix intermittent slow CLI tests ( #797 )
...
* use a port that is porbably not in use
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* template cli test args
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2022-02-06 15:53:55 +00:00
Alex Goodman
341288ba29
Normalize snapshot and release artifacts ( #789 )
...
* refactor signing steps in release/snapshot workflows
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* show signing logs on snapshot or release failure
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update install.sh + tests to account for new goreleaser changes
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update cli tests to account for new goreleaser build names
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix acceptance test to use new snapshot bin path
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* add notarization
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* address review comments
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2022-02-04 12:41:37 -05:00
Keith Zantow
5e5312c72d
Add support for multiple output files in different formats ( #732 )
2022-01-06 17:52:20 -05:00
Alex Goodman
38c4b17847
Add support for searching for jars within archives ( #734 )
...
* add support for searching jars within archives
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* add package cataloger config options
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* address review comments + factor out safeCopy helper
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update config docs regarding package archive search options
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* show that unindexed archive cataloging defaults to false
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* remove lies about -s
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* address review comments
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update search archive note about java
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2022-01-06 21:40:51 +00:00
William Murphy
Keith Zantow
Avi DeitcherandAlex Goodman
Christopher Angelo Phillips
mikclandAlex Goodman
Chapman Pendery
Tom Fay
Weston SteimelandChristopher Phillips
Zac MedicoandChristopher Phillips
Jonas Xavier
Morten LinderudandChristopher Phillips
Christian KotzbauerandAlex Goodman
Jonas Xavier