oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-11 21:57:22 +02:00
Code Issues Packages Projects Releases Wiki Activity
1,967 Commits 63 Branches 272 Tags
06ff1a353aad107d76b6a9353b350cade5bcc3b4
Commit Graph
1967 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
William Murphy 7c67df397e fix: PURLs with "nuget" type are dotnet packages (#2466) 
Otherwise, Grype won't match on well-formed .NET purls from other SBOM
tools.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2024-01-03 16:50:42 -05:00
anchore-actions-token-generator[bot]andspiffcs 0e5fb8e01f chore(deps): update tools to latest versions (#2459) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>
 2024-01-02 09:39:17 -05:00
anchore-actions-token-generator[bot]andwagoodman 8ea2425c97 chore(deps): update CPE dictionary index (#2458) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
 2024-01-02 06:12:32 -05:00
Christopher Angelo Phillips 2a04e06cbc chore: update binary to -x (#2456) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-12-22 09:50:32 -05:00
Laurent Goderre 3a6b6562d1 Add more functionality to the ErLang parser (#2390) 
* ERLang parser support for empty lists
* ERLang add support for single quote strings
* ERLang parser support for comments
---------
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2023-12-22 09:45:20 -05:00
Laurent GoderreandChristopher Phillips 63e7a004cb Added OpenSSL binary matcher (#2416) 
* Added OpenSSL binary matcher

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>

* chore: strip binary to smaller detection

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

---------

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-12-22 09:37:09 -05:00
anchore-actions-token-generator[bot]andkzantow 04e8c96822 chore(deps): update stereoscope to 590920dabc5479216e755983d41367b6be3544f3 (#2452) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: kzantow <kzantow@users.noreply.github.com>
 2023-12-22 09:36:13 -05:00
anchore-actions-token-generator[bot]andspiffcs 1bc4179193 chore(deps): update tools to latest versions (#2451) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>
 2023-12-22 09:30:00 -05:00
dependabot[bot] 51a1bad159 chore(deps): bump github/codeql-action from 3.22.11 to 3.22.12 (#2455) 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.22.11 to 3.22.12.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/b374143c1149a9115d881581d29b8390bbcbb59c...012739e5082ff0c22ca6d6ab32e07c36df03c4a4)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-12-22 09:01:16 -05:00
Christopher Angelo Phillips 3cffa0b7fd chore: remove execute from test fixtures (#2450) 
* chore: remove execute from test fixtures

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* chore: add back ignored file

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
v0.99.0 		2023-12-20 22:34:29 +00:00
anchore-actions-token-generator[bot]andspiffcs da03e981c3 chore(deps): update tools to latest versions (#2447) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>
 2023-12-20 10:59:01 -05:00
William Murphyandhoudini91 4aa2d8c0af fix: don't panic when hackage missing in haskell stack yaml lock (#2448) 
Fixes a bug where previously the haskell cataloger would panic
when parsing a stack.yaml.lock file that had an entry with an empty
hackage string.

Signed-off-by: houdini91 <mdstrauss91@gmail.com>
Signed-off-by: Will Murphy <will.murphy@anchore.com>
Co-authored-by: houdini91 <mdstrauss91@gmail.com>
 2023-12-20 10:57:06 -05:00
Laurent Goderre a635d66657 Add binary classifier for the ERLang interpretter (#2417) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2023-12-18 15:00:49 -05:00
Laurent Goderre 51d3cd0066 Add binary classifier for Julia lang (#2427) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2023-12-18 15:00:21 -05:00
Laurent Goderre 4846639ee4 Add binary detection for PHP composer (#2432) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2023-12-18 14:59:45 -05:00
dependabot[bot] 6030a69b17 chore(deps): bump actions/upload-artifact from 3.1.3 to 4.0.0 (#2433) 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 3.1.3 to 4.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/a8a3f3ad30e3422c9c7b888a15615d19a852ae32...c7d193f32edcb7bfad88892161225aeda64e9392)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-12-18 11:17:07 -05:00
anchore-actions-token-generator[bot]andwagoodman 8b9194eb81 chore(deps): update CPE dictionary index (#2442) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
 2023-12-18 07:01:21 -05:00
anchore-actions-token-generator[bot]andkzantow 56a1ab54d2 chore(deps): update stereoscope to 4b999b76ca8901d15bb97aef445dc94c38d11d5c (#2440) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: kzantow <kzantow@users.noreply.github.com>
 2023-12-18 06:43:24 -05:00
Alex Goodman f4dd36ca9d fix syft-json test to use pretty json for snapshot testing (#2441) 
without this fix, capturing fixtures will result in hard-to-read
failures in testing.

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-12-15 17:23:21 -05:00
Alex Goodman 17c605822e refactor pkg.Collection (#2439) 
- remove "catalog" references
- add a separate add() function for readability

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-12-15 17:11:11 -05:00
Alex Goodman 4eace4b141 refactor javascript cataloger to use configuration options when creating packages (#2438) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-12-15 17:11:02 -05:00
Alex Goodman 05660da8d7 use single source of truth for archive options (#2437) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-12-15 17:07:55 -05:00
Alex Goodman 2f378d806e fix file digest cataloger when passed coordinates (#2436) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-12-15 14:43:09 -05:00
dependabot[bot] b83cc8485a chore(deps): bump github.com/CycloneDX/cyclonedx-go from 0.7.2 to 0.8.0 (#2413) 2023-12-14 17:18:37 -05:00
Colm O hEigeartaigh 38a12bd91a Look for a maven version in a pom from a parent dependency management section (#2423) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-12-14 13:15:14 -05:00
Colm O hEigeartaigh 649d152548 Parse Python licenses from LicenseExpression entry in the Wheel Metadata (#2431) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-12-14 12:41:41 -05:00
dependabot[bot] f5d5892434 chore(deps): bump github/codeql-action from 2.22.10 to 3.22.11 (#2430) 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.22.10 to 3.22.11.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/305f6546310b9203e892c28c1484e82977f4f63d...b374143c1149a9115d881581d29b8390bbcbb59c)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-12-14 12:40:39 -05:00
dependabot[bot] 51831d303c chore(deps): bump modernc.org/sqlite from 1.27.0 to 1.28.0 (#2429) 
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.27.0 to 1.28.0.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.27.0...v1.28.0)

---
updated-dependencies:
- dependency-name: modernc.org/sqlite
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-12-14 12:38:55 -05:00
anchore-actions-token-generator[bot]andspiffcs 09e62c3282 chore(deps): update tools to latest versions (#2428) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>
 2023-12-14 07:31:44 -05:00
Colm O hEigeartaigh d39ef44e40 Parse Python licenses from LicenseFile entry in the Wheel Metadata (#2331) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-12-13 17:46:56 -05:00
Wayne Starr 8bca0ac39e fix: use filepath instead of path for file source exclusions (#2411) 
Signed-off-by: Wayne Starr <me@racer159.com>
 2023-12-13 17:45:34 -05:00
dependabot[bot] 67dbd1fe4c chore(deps): bump github.com/charmbracelet/bubbletea (#2424) 
Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea) from 0.24.2 to 0.25.0.
- [Release notes](https://github.com/charmbracelet/bubbletea/releases)
- [Commits](https://github.com/charmbracelet/bubbletea/compare/v0.24.2...v0.25.0)

---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbletea
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-12-13 12:21:22 -05:00
dependabot[bot] 402227f0b3 chore(deps): bump github.com/google/uuid from 1.4.0 to 1.5.0 (#2425) 
Bumps [github.com/google/uuid](https://github.com/google/uuid) from 1.4.0 to 1.5.0.
- [Release notes](https://github.com/google/uuid/releases)
- [Changelog](https://github.com/google/uuid/blob/master/CHANGELOG.md)
- [Commits](https://github.com/google/uuid/compare/v1.4.0...v1.5.0)

---
updated-dependencies:
- dependency-name: github.com/google/uuid
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-12-13 11:45:04 -05:00
dependabot[bot] 2bcf825857 chore(deps): bump github/codeql-action from 2.22.9 to 2.22.10 (#2426) 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.22.9 to 2.22.10.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/c0d1daa7f7e14667747d73a7dbbe8c074bc8bfe2...305f6546310b9203e892c28c1484e82977f4f63d)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-12-13 11:44:41 -05:00
dependabot[bot] 9cb7c3d350 chore(deps): bump dawidd6/action-homebrew-bump-formula (#2420) 
Bumps [dawidd6/action-homebrew-bump-formula](https://github.com/dawidd6/action-homebrew-bump-formula) from 3.10.0 to 3.10.1.
- [Release notes](https://github.com/dawidd6/action-homebrew-bump-formula/releases)
- [Commits](https://github.com/dawidd6/action-homebrew-bump-formula/compare/d3667e5ae14df19579e4414897498e3e88f2f458...75ed025ff3ad1d617862838b342b06d613a0ddf3)

---
updated-dependencies:
- dependency-name: dawidd6/action-homebrew-bump-formula
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-12-12 14:43:43 -05:00
Colm O hEigeartaigh e789e0714d feat: add the option to retrieve remote licenses for projects defined in a maven pom (#2409) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-12-12 14:02:36 -05:00
dependabot[bot] 790ecc6f28 chore(deps): bump github/codeql-action from 2.22.8 to 2.22.9 (#2400) 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.22.8 to 2.22.9.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/407ffafae6a767df3e0230c3df91b6443ae8df75...c0d1daa7f7e14667747d73a7dbbe8c074bc8bfe2)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-12-12 13:59:39 -05:00
dependabot[bot] b9462db59e chore(deps): bump github.com/saferwall/pe from 1.4.7 to 1.4.8 (#2415) 
Bumps [github.com/saferwall/pe](https://github.com/saferwall/pe) from 1.4.7 to 1.4.8.
- [Release notes](https://github.com/saferwall/pe/releases)
- [Changelog](https://github.com/saferwall/pe/blob/main/CHANGELOG.md)
- [Commits](https://github.com/saferwall/pe/compare/v1.4.7...v1.4.8)

---
updated-dependencies:
- dependency-name: github.com/saferwall/pe
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-12-11 12:37:20 -05:00
dependabot[bot] bfad9659a8 chore(deps): bump github.com/go-git/go-git/v5 from 5.10.1 to 5.11.0 (#2414) 
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.10.1 to 5.11.0.
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](https://github.com/go-git/go-git/compare/v5.10.1...v5.11.0)

---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-12-11 08:58:26 -05:00
dependabot[bot] b345752f49 chore(deps): bump actions/setup-go from 4.1.0 to 5.0.0 (#2401) 
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 4.1.0 to 5.0.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/93397bea11091df50f3d7e59dc26a7711a8bcfbe...0c52d547c9bc32b1aa3301fd7a9cb496313a4491)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-12-11 06:38:05 -05:00
anchore-actions-token-generator[bot]andspiffcs ba9dd1d5fd chore(deps): update tools to latest versions (#2408) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>
 2023-12-11 06:36:51 -05:00
anchore-actions-token-generator[bot]andwagoodman 68f35815d6 chore(deps): update CPE dictionary index (#2412) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
 2023-12-11 06:35:58 -05:00
Weston Steimel 4d4b502174 fix(java): improve identification for org.codehaus.groovy artifacts (#2404) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-08 05:02:01 -05:00
Weston Steimel ea80f94c0e fix(java): improve identification for commons-jelly artifacts (#2399) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-07 12:28:21 -05:00
Weston Steimel 2c145f70b2 fix(java): improve identification for io.minio artifacts (#2398) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-06 16:58:07 -05:00
Weston Steimel bcc7e90fcc fix(java): improve identification for com.graphql-java artifacts (#2397) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-06 18:04:43 +00:00
anchore-actions-token-generator[bot] fa1baabc05 chore(deps): update tools to latest versions (#2395) 2023-12-06 10:49:07 -05:00
Weston Steimel b5906824cb chore: enhance java purl generation integration test (#2393) 
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2023-12-06 15:31:16 +00:00
Colm O hEigeartaighandChristopher Phillips 16dee41b4b feat: add ability to retrieve remote licenses for yarn.lock (#2338) 
---------

Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-12-05 13:38:28 -05:00
dependabot[bot] 23778de112 chore(deps): bump anchore/sbom-action from 0.15.0 to 0.15.1 (#2392) 
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.15.0 to 0.15.1.
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Commits](https://github.com/anchore/sbom-action/compare/fd74a6fb98a204a1ad35bbfae0122c1a302ff88b...5ecf649a417b8ae17dc8383dc32d46c03f2312df)

---
updated-dependencies:
- dependency-name: anchore/sbom-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-12-05 09:48:40 -05:00