81 Commits

Include renames

Author	SHA1	Message	Date
Eljees	1286689419	Fix missing nested packages in package-lock.json v1 (#5108) ... * fix(javascript): catalog nested package-lock v1 dependencies Signed-off-by: Eljees <57435526+Eljees@users.noreply.github.com> * test(javascript): cover nested package-lock v1 dependencies Signed-off-by: Eljees <57435526+Eljees@users.noreply.github.com> --------- Signed-off-by: Eljees <57435526+Eljees@users.noreply.github.com>	2026-07-27 15:18:48 -04:00
SynvoyaandSynvoya	bd0917fe93	fix(javascript): strip peer-dep suffix from deno.lock npm keys (#5055) ... deno.lock npm keys append resolved peer dependencies after the version, separated by "_" (e.g. "typedoc@0.28.19_typescript@6.0.3" or the scoped "@scope/name@1.2.3_@scope+peer@4.5.6"). parseDenoNpmNameVersion split on the last "@", capturing a peer's "@" and producing a garbage package name plus the peer's version (and a corrupt PURL that breaks vulnerability matching). Strip the peer suffix (the first "_" after the version "@") before splitting name@version; a semver version never contains "_". Signed-off-by: Synvoya <16019863+Synvoya@users.noreply.github.com> Co-authored-by: Synvoya <16019863+Synvoya@users.noreply.github.com>	2026-07-13 14:38:32 +00:00
Rez MossandChristopher Phillips	fea4a50124	feat: deno cataloger #4417 (#4523) ... Signed-off-by: Rez Moss <hi@rezmoss.com> Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2026-06-23 10:58:22 -04:00
Alex Goodman	951fbd454a	add purl types to cataloger info cmd (#4984) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2026-06-16 12:13:34 -04:00
Yoonho HannandChristopher Phillips	b08d3c2970	feat: add support for Bun lockfile (#4625) ... --------- Signed-off-by: Yoonho Hann <hnnynh125@gmail.com> Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2026-06-09 13:22:43 -04:00
3 people	36969bdeff	fix: Allow duplicates in Yarn "Berry" files (#4691) (#4838) ... * fix: Allow duplicates in Yarn "Berry" files (#4691) Yarn lockfiles can have multiple versions resolved for the same package name. We correctly allow this in Yarn v1 lockfiles but the "Berry" YAML-format lockfiles were doing deduplication by package name. This change removes that deduplication. Signed-off-by: Calum Leslie <cleslie@atlassian.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Calum Leslie <cleslie@atlassian.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Calum Leslie <cleslie@atlassian.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2026-05-11 21:10:17 +00:00
Rayan Salhab	8cb78ce40c	fix: resolve yarn lock aliases to source package (#4836) ... Signed-off-by: cyphercodes <cyphercodes@users.noreply.github.com>	2026-04-29 09:50:09 -04:00
anchore-oss-update-botandanchore-oss-update-bot	33bc4b8397	chore(deps): update Go version (#4798) ... Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com> Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>	2026-04-20 10:03:15 -04:00
Yoav Alon	30fe53e629	fix(javascript): accept scalar people fields in package.json (#4779) ... Signed-off-by: Yoav Alon <yoav@orca.security>	2026-04-15 14:21:49 -04:00
3 people	4321ecc66f	fix(javascript): ensure deterministic pnpm lockfile parsing (#4765) ... * fix(javascript): ensure deterministic pnpm lockfile parsing Replace nondeterministic Go map iteration with sorted key iteration in both v6 and v9 pnpm lockfile parsers. When multiple lockfile keys collapse to the same package key after peer dependency stripping, the unsorted map iteration caused different entries to win on each run, producing unstable artifact IDs and non-reproducible SBOM output. Fixes #4648 Signed-off-by: lawrence3699 <lawrence3699@users.noreply.github.com> * add regression test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: lawrence3699 <lawrence3699@users.noreply.github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: lawrence3699 <lawrence3699@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2026-04-15 14:39:57 +00:00
anchore-oss-update-botandanchore-oss-update-bot	5b58ec96b7	chore(deps): update Go version (#4773) ... Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com> Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>	2026-04-15 10:01:39 -04:00
Will Murphy	e38851143e	chore: centralize temp files and prefer streaming IO (#4668) ... * chore: centralize temp files and prefer streaming IO Catalogers that create temp files ad-hoc can easily forget cleanup, leaking files on disk. Similarly, io.ReadAll is convenient but risks OOM on large or malicious inputs. Introduce internal/tmpdir to manage all cataloger temp storage under a single root directory with automatic cleanup. Prefer streaming parsers (bufio.Scanner, json/yaml.NewDecoder, io.LimitReader) over buffering entire inputs into memory. Add ruleguard rules to enforce both practices going forward. Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * chore: go back to old release parsing Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * simplify to limit reader in version check Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * chore: regex change postponed Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * simplify supplement release to limitreader Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> --------- Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>	2026-03-18 10:53:51 -04:00
Alex Goodman	b5e85c3ea5	chore: migrate fixtures to testdata (#4651) ... * migrate fixtures to testdata Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix: correct broken symlinks after testdata migration The migration from test-fixtures to testdata broke several symlinks: - elf-test-fixtures symlinks pointed to old test-fixtures paths - elf-test-fixtures needed to be renamed to elf-testdata - image-pkg-coverage symlink pointed to test-fixtures instead of testdata Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix: handle missing classifiers/bin directory in Makefile The clean-fingerprint target was failing when classifiers/bin doesn't exist (e.g., on fresh clone without downloaded binaries). Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix: add gitignore negation for jar/zip fixtures in test/cli The jar and zip files in test/cli/testdata/image-unknowns were being gitignored by the root .gitignore patterns. This caused them to be untracked and not included when building docker images in CI, resulting in Test_Unknowns failures since the test expects errors from corrupt archive files that weren't present. Add a .gitignore in test/cli/testdata to negate the exclusions for these specific test fixture files. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * switch fixture cache to v2 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * test: update expected versions for rebuilt fixtures Update test expectations for packages that have been updated in upstream repositories when docker images are rebuilt: - glibc: 2.42-r4 → 2.43-r1 (wolfi) - php: 8.2.29 → 8.2.30 (ubuntu/apache) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgrade go Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix: add go-shlex dependency for testdata manager tool The manager tool in syft/pkg/cataloger/binary/testdata/ imports go-shlex, but since it's in a testdata directory, Go doesn't track its dependencies. This caused CI failures when go.mod didn't explicitly list the dependency. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * refactor: move binary classifier manager to internal/ Move the manager tool from testdata/manager to internal/manager so that Go properly tracks its dependencies. Code in testdata directories is ignored by Go for dependency tracking, which caused CI failures when go.mod didn't explicitly list transitive dependencies. This is a cleaner solution than manually adding dependencies to go.mod for code that happens to live in testdata. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix: add gitignore negations for test fixtures blocked by root patterns Multiple test fixtures were being blocked by root-level gitignore patterns like bin/, *.jar, *.tar, and *.exe. This adds targeted .gitignore files with negation patterns to allow these specific test fixtures to be tracked: - syft/linux/testdata/os/busybox/bin/busybox (blocked by bin/) - syft/pkg/cataloger/java/testdata/corrupt/example.{jar,tar} (blocked by *.jar, *.tar) - syft/pkg/cataloger/binary/testdata/classifiers/snippets/go-version-hint/**/bin/go (blocked by bin/) - syft/pkg/cataloger/bitnami/testdata/no-rel/.../bin/redis-server (blocked by bin/) Also updates the bitnami test expectation to include the newly required .gitignore files in the test fixture. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * test: update glibc version expectation (2.43-r1 -> 2.43-r2) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add capability drift check as unit step Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * dont clear test observations before drift detection Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump stereoscope commit to main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2026-03-06 19:42:04 +00:00
Rez MossandChristopher Phillips	c185657d71	feat: add yarn lock dev dep detection; fixed #4548 ... --------- Signed-off-by: Rez Moss <hi@rezmoss.com> Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2026-02-05 22:27:17 +00:00
Rez MossandAlex Goodman	3a3a86eb01	fixed #4430 exclude dev pnpm pkg (#4487) ... * fixed #4430 exclude dev pnpm pkg Signed-off-by: Rez Moss <hi@rezmoss.com> * use existing dev deps option Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fixed #4430 exclude dev pnpm pkg, add test Signed-off-by: Rez Moss <hi@rezmoss.com> * fixed #4430 exclude dev pnpm pkg, add test Signed-off-by: Rez Moss <hi@rezmoss.com> --------- Signed-off-by: Rez Moss <hi@rezmoss.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2026-01-07 10:39:16 -05:00
3 people	b3c70da3ea	Add experimental cataloger capabilities command (#4317) ... * add info command from generated capabilities Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * correct gentoo and arch ecosystems Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename os pkg types Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * better binary cataloger description Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * expose metadata and pacakge types in json Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * expose json schema types Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add completeness tests for metadata types Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * latest generation Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * improve testing a docs Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix tests and linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * restore goreleaser config Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * tweak diagram Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix pdm Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * chore: java binary data Signed-off-by: Keith Zantow <kzantow@gmail.com> * new capability descriptions for gguf and python Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * correct poetry lock integrity hash claim Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix compile error Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix: remove purl version from overrides Signed-off-by: Keith Zantow <kzantow@gmail.com> * fix lua deps ref Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * keep gguf as ai ecosystem Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * split packages.yaml to multiple files by go package Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * ensure tests do not use go test cache Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * sort json output for info command Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * docs: fix ocaml, php, and portage capabilities yaml Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * chore: update erlang capabilities Signed-off-by: Keith Zantow <kzantow@gmail.com> * chore: update java capabilities Signed-off-by: Keith Zantow <kzantow@gmail.com> * chore: update javascript capabilities Signed-off-by: Keith Zantow <kzantow@gmail.com> * chore: update linux kernel capabilities Signed-off-by: Keith Zantow <kzantow@gmail.com> * remove missing tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix package.yaml references Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * revert license list change Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * check for drift in capability descriptions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * regenerate capabilities Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * test cleanup Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * use fixture cache in static analysis Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * claim fixtures pre-req for cap generation Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update documentation with correct regeneration procedure Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * chore: ruby-gemspec-cataloger finds no dependencies Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * chore: fix python docs and config comment Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * chore: commit re-generated java yaml Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * add cataloger selection to caps command Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * re-generate cap yamls Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix tests for cataloger selection Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add missing tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename cmd to `cataloger info` Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * [wip] change capability description locations Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * [wip] continued Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * [wip] adjust for import cycles Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * correct docs Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: Keith Zantow <kzantow@gmail.com> Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> Co-authored-by: Keith Zantow <kzantow@gmail.com> Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com>	2025-12-22 19:34:10 +00:00
Chris Greeno	568b7601bb	fix(javascript): remove debug print statement in dependency parser (#4412) ... Removes an accidental `fmt.Println("error", err)` that was left in the javascript dependency parser. This causes noisy output to stdout when parsing npm package-lock.json files that contain dependency specifiers that aren't valid PURLs. Signed-off-by: Chris Greeno <chris@fresha.com>	2025-12-10 13:42:09 -05:00
Tim Olshansky	4e06a7ab32	feat(javascript): Add dependency parsing (#4304) ... * feat: Add dependency parsing to javascript package locks Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com> * Bump schema version Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com> * Add support for yarn and pnpm, excl. yarn v1 Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com> * Add support for dependencies for v1 yarn lock files Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com> * Ensure schema is correctly generated Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com> * Fix tests Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com> * PR feedback Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com> --------- Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com>	2025-11-06 16:03:43 -05:00
Keith Zantow	a400c675fc	feat: license file search (#4327) ... Signed-off-by: Keith Zantow <kzantow@gmail.com>	2025-11-03 14:16:05 -05:00
Alex Goodman	538430d65d	describe cataloger capabilities via test observations (#4318) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-10-30 13:19:42 -04:00
Tim Olshansky	c0f32e1dba	feat: add option to fetch remote licenses for pnpm-lock.yaml files (#4286) ... Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com>	2025-10-16 12:23:06 -04:00
Alex Goodman	d22914baf5	add docs to configs (#4281) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-10-14 13:58:31 -04:00
Bernardo de Araujo	231f04ae0e	feat: Parse pnpm v9 lockfiles (#4256) ... Signed-off-by: bernardoamc <bernardo.amc@gmail.com>	2025-10-09 15:07:59 -04:00
n-bes	170c4c41f4	use go.yaml.in/yaml (#4157) ... Signed-off-by: Nikita Besperstov <n.bes@pm.me>	2025-08-26 11:24:23 -04:00
Alan PopeandChristopher Phillips	87e1d8cb87	feat: add support for authors, maintainers, and contributors in package.json. (#4003) ... Fixes #2250 --------- Signed-off-by: Alan Pope <alan.pope@anchore.com> Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2025-08-13 17:55:15 -04:00
Christopher Angelo PhillipsandAlex Goodman	f77d503892	detect license ID from full text when incidentally provided as a value (#3876) ... --------- Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-05-13 16:37:18 -04:00
anchore-actions-token-generator[bot]andspiffcs	f11377fe30	chore(deps): update tools to latest versions (#3775) ... --------- Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>	2025-04-03 17:35:26 +00:00
Alex Goodman	e9b24a29d7	Remove mitchellh dependencies (#3748) ... * remove mitchellh dependencies Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix failing unit tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-03-20 10:19:19 -04:00
Keith Zantow	2328b20082	fix: reduce warn levels to debug for non-actionable errors (#3645) ... Signed-off-by: Keith Zantow <kzantow@gmail.com>	2025-02-07 13:22:55 -05:00
Christopher Angelo Phillips	5e2ba43328	chore: replace all shorthand tags of mapstruct -> mapstructure (#3633) ... Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2025-02-03 10:43:06 -05:00
Nathan VossandKeith Zantow	a55b71d4ef	feat: exclude devDependencies from package-lock.json parsing (#3371) ... Signed-off-by: Nathan Voss <njvoss299@gmail.com> Signed-off-by: Keith Zantow <kzantow@gmail.com> Co-authored-by: Keith Zantow <kzantow@gmail.com>	2024-10-30 12:02:27 -04:00
Keith ZantowandAlex Goodman	ccbee94b87	feat: report unknowns in sbom (#2998) ... Signed-off-by: Keith Zantow <kzantow@gmail.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-10-07 16:11:37 -04:00
Piotr RadkowskiandPiotr Radkowski	3b9c55d28b	Fix: Parse package.json with non-standard fields in 'author' section (#3300) ... * Improved parsing of package.json 'author' section Signed-off-by: Piotr Radkowski <piotr.radkowski@contractors.roche.com> * test: parse 'package.json' files with non-standard fields in author section Signed-off-by: Piotr Radkowski <piotr.radkowski@contractors.roche.com> --------- Signed-off-by: Piotr Radkowski <piotr.radkowski@contractors.roche.com> Co-authored-by: Piotr Radkowski <piotr.radkowski@contractors.roche.com>	2024-10-07 10:26:04 -04:00
Keith Zantow	95b4a88256	fix: logging for remote network calls (#3140) ... Signed-off-by: Keith Zantow <kzantow@gmail.com>	2024-08-20 11:45:33 -04:00
William Murphy	3713d97b7b	chore: use ruleguard to test for missing defer statements (#2837) ... * chore: ruleguard to enforce defer use Signed-off-by: Will Murphy <will.murphy@anchore.com> * fix go.mod location Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer close in linux release identifier Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: better lint suggestion Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: refactor binary classifier to defer close Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer close readers in gentoo cataloger Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: make go license parsing defer close readers Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer closing readers in alpine apm parser Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer close readers in graalvm parser Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer close readers in debian package parser Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer close readers in alpm parser Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer close readers in executable file cataloger Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer close readers in javascript license parser Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer close readers in go mod parser Signed-off-by: Will Murphy <will.murphy@anchore.com> --------- Signed-off-by: Will Murphy <will.murphy@anchore.com>	2024-05-07 05:42:29 -04:00
Colm O hEigeartaigh	f4e18961b9	Adding the ability to retrieve remote licenses from package.lock (#2708) ... Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>	2024-03-21 13:20:04 -04:00
Asi GreenholtsandAlex Goodman	98de2e2f62	Adding metadata fields when parsing yarn.lock and poetry.lock (#2350) ... * Adding the resolved and integrity fields of yarn.lock to the parsed metadata. This addition is similar to the metadata added when parsing package-lock.json. Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com> * fix comment Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com> * Adding the Index field to metadeta when parsing poetry.lock similarly to the existing Pipfile metadata Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com> * fixing struct accoding to tests Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com> * remove old schema change Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove empty constants Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * re-generate JSON schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update document ref Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-02-02 19:53:42 +00:00
Alex Goodman	cdad5e767a	plumb context through catalogers (#2528) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-01-22 15:54:51 -05:00
Alex Goodman	4eace4b141	refactor javascript cataloger to use configuration options when creating packages (#2438) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-12-15 17:11:02 -05:00
Colm O hEigeartaighandChristopher Phillips	16dee41b4b	feat: add ability to retrieve remote licenses for yarn.lock (#2338) ... --------- Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org> Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>	2023-12-05 13:38:28 -05:00
Alex Goodman	1cfc4c7387	Normalize cataloger configuration patterns (#2365) ... * normalize cataloger patterns Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove central reference for maven configurable Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-11-28 17:02:43 +00:00
Alex Goodman	3f13d209a5	rename file.Location.VirtualPath to AccessPath (#2288) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-11-09 11:30:08 -06:00
Alex Goodman	b2f4d7eda2	Follow convention for naming catalogers (#2277) ... * follow convention for naming catalogers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cataloger name example Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-11-02 12:39:42 +00:00
Alex Goodman	1aaa644007	Remove MetadataType from core package object and normalize JSON metadataType values (#1983) ... * [wip] Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * distinct the package metadata functions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove metadata type from package core model Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * incorporate review feedback for names Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add RPM archive metadata and split parser helpers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * clarify the python package metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename the KB metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * break hackage and composer types by use case Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * linting fix Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix encoding and decoding for syft-json and cyclonedx Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema to 11 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx-xml snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update spdx-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update spdx-tv snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update syft-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * correct metadata type in stack yaml parser test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix bom-ref redactor for cyclonedx-xml Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for legacy package metadata names Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * regenerate json schema v11 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix legacy HackageMetadataType reflect type value check Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * packagemetadata discovery should account for type shadowing Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema version to v12 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update json schema to incorporate changes from main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add syft-json legacy config option Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests around v11-v12 json decoding Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add docs for SYFT_JSON_LEGACY Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename structs to be compliant with new naming scheme Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-30 12:12:04 -04:00
Alex Goodman	7018573bf7	Remove internal string set (#2219) ... * remove internal string set Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * incorporate changes from #2227 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * beef up the pkg.License.Merg() doc string Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-17 12:52:11 -04:00
Alex Goodman	07e76907f6	Migrate location-related structs to the file package (#1751) ... * migrate location structs to file package Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * replace source.Location refs with file package call Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * fix linting Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * remove hardlink test for file based catalogers Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * remove hardlink test for all-regular-files testing Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * migrate file resolver implementations to separate package Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * fix linting Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * [wip] migrate resolvers to internal Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * migrate resolvers to syft/internal Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Signed-off-by: <>	2023-05-24 17:06:38 -04:00
Keith Zantow	a3c5550217	fix: duplicate packages, support pnpm lockfile v6 (#1778)	2023-05-23 10:24:25 -04:00
Christopher Angelo Phillips	42fa9e4965	feat: update syft license concept to complex struct (#1743) ... this PR makes the following changes to update the underlying license model to have more expressive capabilities it also provides some guarantee's surrounding the license values themselves - Licenses are updated from string -> pkg.LicenseSet which contain pkg.License with the following fields: - original `Value` read by syft - If it's possible to construct licenses will always have a valid SPDX expression for downstream consumption - the above is run against a generated list of SPDX license ID to try and find the correct ID - SPDX concluded vs declared is added to the new struct - URL source for license is added to the new struct - Location source is added to the new struct to show where the expression was pulled from	2023-05-15 16:23:39 -04:00
Shane Dell	13485ca5e7	fix: Improve pnpm support (#1752) ... Signed-off-by: Shane Dell <shanedell100@gmail.com>	2023-04-21 17:58:23 +00:00
Alex Goodman	5d156b8241	Add annotations for evidence on package locations (#1723) ... * add location annotations + deb evidence annotations Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * rename LocationData struct and Annotation helper function Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add failing integration test for evidence coverage Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add evidence to aplm cataloger locations Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * change location annotation helper to return a location copy Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add evidence to binary cataloger locations Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * updated remaining catalogers with location annotations Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * fix unit tests Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * fix linting Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * bump json schema Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * partial addressing of review comments Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * rename location.WithAnnotation Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2023-04-13 17:02:29 -04:00