oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-11 21:57:22 +02:00
Code Issues Packages Projects Releases Wiki Activity
3,618 Commits 63 Branches 272 Tags
0a050b0e275b195329f9cf4469d77f6d46a8fef3
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Christopher Angelo PhillipsandAlex Goodman c33fa32cf1 fix(dotnet): resolve packages.lock dependencies deterministically (#5210) 
* fix(dotnet): resolve packages.lock dependencies within their target framework

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

* fix(dotnet): make packages.lock package metadata deterministic across target frameworks

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

* fix: parse packages lock tests

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

* fix: update lockfile parse to read into stable structure

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

* fix: remove stale comments

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

* test: new test for project entry case

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

* fix(dotnet): key packages.lock packages case-insensitively

NuGet IDs are case-insensitive, and edge lookup already treated them that way, but package identity used the exact-case name. Two spellings of one ID and version across target frameworks became two packages, and type precedence never ran between them.

- packages merge on the lowercased name + version, display name comes from the winning entry
- a package listing itself (under any casing) no longer produces a self edge

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2026-10-01 21:21:09 +00:00
Christopher Angelo Phillips 236755a6b1 fix(binary): gzip classifier & GNU gzip identity string (#5202) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2026-08-20 16:02:14 -04:00
Christopher Angelo PhillipsandAlex Goodman 31a352d030 fix(snap): release temp directories on every snap failure path 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2026-07-29 14:50:20 -04:00
Christopher Angelo Phillips 3e2bc6ed09 ci: add docker-container driver (#5071) 
* ci: add docker-container driver

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

* fix: update to v4.2.0

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

---------

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2026-07-16 10:21:22 -04:00
Christopher Angelo PhillipsandAlex Goodman aff2c247db feat: add safe tensor model type to SBOM output (#4844) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2026-07-15 17:14:03 -04:00
Christopher Angelo Phillips ed499fd2d0 chore: migrate .goreleaser config to use docker_v2 (#4608) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2026-07-15 16:52:46 -04:00
Christopher Angelo PhillipsandAlex Goodman f6b5d3e736 perf: group golang symbols by package path to reduce the sbom size (#5064) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2026-07-13 16:40:16 -04:00
Christopher Angelo PhillipsandAlex Goodman 1dcac54b0e feat: optionally capture golang binary symbols (#4988) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2026-07-13 10:30:23 -04:00
Christopher Angelo Phillips 2fe5f9c7b8 fix: bumps go mod version to 1.25; ci takes latest patch (#4628) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2026-02-17 12:04:51 -05:00
Christopher Angelo PhillipsandAlex Goodman 2c5e193f7a feat: Add support for scanning GGUF models from OCI registries (#4335) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2026-02-09 16:05:52 -05:00
Christopher Angelo Phillips c94d1ccf1c fix: lookup alternate scheme on url->licenseID (#4588) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2026-01-30 14:25:27 -05:00
Christopher Angelo Phillips 9a250a4b4b fix: update mixed case dependencies in python to be normalized (#4573) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2026-01-27 15:16:32 -05:00
Christopher Angelo Phillips 9aca8167b8 chore: drop cpe from gguf (#4383) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-11-19 05:37:40 -05:00
Christopher Angelo Phillips 4a60c41f38 feat: 4184 gguf parser (ai artifact cataloger) part 1 (#4279) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-11-13 17:43:48 -05:00
Christopher Angelo Phillips e9a8bc5ab9 chore: update to use old configuration on new cosign (#4287) 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-10-15 15:12:20 +00:00
Christopher Angelo PhillipsandAlex Goodman 13ffeeb3d0 feat: combine go module file and go source discovery into single cataloger (#4127) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-08-26 19:35:44 +00:00
Christopher Angelo Phillips 6b48bd4b5e feat: add package supplier flag (#4131) 
---------

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-08-12 14:49:41 -04:00
Christopher Angelo Phillips 89470ecdd3 feat: update syft license construction to be able to look up by URL (#4132) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-08-12 14:30:32 -04:00
Christopher Angelo Phillips 6f36b586ba chore: update release workflow to persist credentials for git tag step (#4069) 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-07-21 19:23:14 +00:00
Christopher Angelo Phillips 1e3d2a2927 chore: update tests to read from latest test-fixture-cache and fix cache publish (#4042) 
* feat: update integration test with correct package for httpd

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

* chore: update integration and cli tests with new upstream expectations

- php interpreter 8.3.21 => 8.3.22
- runCycloneDXInDocker update for local arm64 qemu emulation CycloneDX
- getSyftBinaryLocationByOS update to detect arm64 v8.0 artifact path

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

* chore: add snalshot to test command for fixture builds

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

* chore: update cdx in docker for all GOOS

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

---------

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-07-01 14:11:36 +00:00
Christopher Angelo Phillips a0be514184 feat: add syft schema version to version command (#3949) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-06-02 15:50:21 +00:00
Christopher Angelo Phillips b4ca04001c chore: update dockerfile base images to latest rolling tags (#3915) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-05-19 13:43:14 +00:00
Christopher Angelo Phillips e1374f758e fix: update license content filtering default case to be 'none' for no content returned 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-05-16 14:25:15 +00:00
Christopher Angelo Phillips 2a055690e6 chore: delete unused fixture (#3901) 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-05-15 17:30:36 +00:00
Christopher Angelo Phillips 4f73d35051 Include default config licenses (#3900) 
* fix: the licenses config was not being carried through causing content to show by default
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-05-15 16:48:18 +00:00
Christopher Angelo Phillips 3c7018a853 feat: remove full-text before release (#3889) 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-05-14 13:12:05 +00:00
Christopher Angelo Phillips e5d7760bb8 feat: improve dpkg cataloger license recognition for "license agreements" (#3888) 2025-05-14 08:41:48 -04:00
Christopher Angelo PhillipsandAlex Goodman f77d503892 detect license ID from full text when incidentally provided as a value (#3876) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-13 16:37:18 -04:00
Christopher Angelo Phillips 6eff158ad3 chore: update license sort to be stable with contents field (#3860) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-05-06 11:45:47 -04:00
Christopher Angelo Phillips 1ba1186410 fix: use "contents" field and remove "fullText" license field (#3857) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-05-05 21:40:09 +00:00
Christopher Angelo Phillips 00f53b1777 chore: upgrade fixtures to use version 4 lockfile (#3852) 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-05-05 14:38:23 +00:00
Christopher Angelo Phillips 6ba087c72c fix: Do not use hashes for SPDX license names/expressions (#3844) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-05-02 09:34:08 -04:00
Christopher Angelo Phillips 94e63eb367 feat: detect when full license text has been provided and preserve as separate field (#3450) 
* feat: add full text field to syft license struct
---------
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-05-01 15:00:46 -04:00
Christopher Angelo Phillips da62a82413 feat: adds the DirectoryTag to the r cataloger (#3774) 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-04-01 11:46:51 -04:00
Christopher Angelo Phillips e584c9f416 feat: 3626 add option enable license content; disable by default (#3631) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-02-05 20:41:03 +00:00
Christopher Angelo Phillips 5e2ba43328 chore: replace all shorthand tags of mapstruct -> mapstructure (#3633) 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-02-03 10:43:06 -05:00
Christopher Angelo Phillips 9a9195e5c4 feat: syft 3435 - add file components to cyclonedx bom output when file metadata is available (#3539) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-01-31 15:09:15 -05:00
Christopher Angelo Phillips d5e52bc2ce docs: update descriptions with correct options (#3630) 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-01-29 15:47:04 +00:00
Christopher Angelo Phillips 7f5dbf9872 chore: bump stereoscope to v0.0.13 (#3601) 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-01-21 15:50:42 -05:00
Christopher Angelo Phillips 8198a706d6 chore: bump packageurl-go with new parsing rules (#3596) 
* chore: bump packageurl-go with new parsing rules
* test: update expectedPURL in unit tests to match new % encoding
---------

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-01-17 16:20:14 -05:00
Christopher Angelo Phillips f9ffe7252e test: removes latest license list test (#3559) 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-01-02 20:56:44 +00:00
Christopher Angelo Phillips 561ed50c2d chore: migrate syft to use the anchore fork of archiver without replace (#3516) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2024-12-10 13:33:24 -05:00
Christopher Angelo Phillips f9e320c5b7 fix: convert file paths for spdx formats from absolute to relative (#3509) 
* feat: convert file paths for spdx formats from absolute to relative
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2024-12-09 13:02:54 -05:00
Christopher Angelo PhillipsFearkinWill Murphy
 		48190233f4 fix: emit NOASSERTION for copyright text to fix SPDX 2.2 validation failure (#3495) 
* fixes issue #3346

Signed-off-by: Fearkin <fearjin1@gmail.com>

* chore: update schema and unit tests to reflect new copyright property

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

* chore: revert schema changes

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

* fix: noassert copyright on spdx root package

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

* test: explicitly test spdx 2.2 with tools-java validator

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

* test: update snapshot files

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

---------

Signed-off-by: Fearkin <fearjin1@gmail.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
Co-authored-by: Fearkin <fearjin1@gmail.com>
Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com>
 2024-12-04 14:58:36 -05:00
Christopher Angelo Phillips f4cad63da1 3122 valid license url characters (#3449) 
* chore: strip unwanted characters from license URL
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2024-11-19 15:34:58 +00:00
Christopher Angelo Phillips e7b65c2c58 3030 license declared spdx correction (#3461) 
* feat: update hasExtractedLicense field to include license-ref candidates
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2024-11-19 15:00:59 +00:00
Christopher Angelo PhillipsandKeith Zantow 8a41d77250 chore: prevent file resolver from bubbling errors in binary cataloger (#3410) 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
 2024-11-04 20:23:27 +00:00
Christopher Angelo Phillips c84cb2cf84 fix: update mainModuleVersion function to always prefix v to findings (#3087) 
* chore: basic fix
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
* test: make sure ldflags are prefixed with v
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2024-08-01 11:29:07 -04:00
Christopher Angelo Phillips f7ffcc534f fix: stabilize cpe sorting during collection sort (#3009) 2024-07-09 14:24:21 -04:00
Christopher Angelo Phillips f5a917a5a2 docs: update cyclone-dx documentation (#2983) 
* chore: update docs to show 1.6 for cyclone-dx by default
* chore: update README showing version information for formats

---------

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2024-06-21 09:32:59 -07:00
Christopher Angelo PhillipsandAlex Goodman 22d5731482 fix: fix parsing for complex toml types (#2965) 
* fix: fix parsing for complex toml types
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-14 19:32:17 +00:00
Christopher Angelo Phillips 7508d75b2b fix: update unit tests to use pinned patch version (#2932) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2024-06-05 18:31:38 +00:00
Christopher Angelo Phillips b41d5cced5 chore: update spdx license list to 3.24.0 (#2895) 
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2024-05-23 13:10:36 +00:00
Christopher Angelo Phillips ee75aafa37 chore: fix small tooling error for go.mod (#2868) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2024-05-13 11:47:21 -04:00
Christopher Angelo Phillips e100776f22 chore: update anchore/packageurl-go to use latest commits (#2746) 
chore: update packageurl-go dependency to use latest commits
chore: go mod tidy
unit: update + -> %2B
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2024-04-04 10:33:51 -04:00
Christopher Angelo Phillips 4d0dd02d5a chore: update stereoscope (#2683) 
* chore: update stereoscope to account for traversal bug fix

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2024-02-29 13:32:18 -05:00
Christopher Angelo Phillips 9803db2949 fix: update runner size to use larger HD for codeql (#2641) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2024-02-14 10:31:05 -05:00
Christopher Angelo Phillips c0f43e5e2d chore: update license list, cpe dictionary (#2620) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2024-02-09 11:31:42 -05:00
Christopher Angelo Phillips bd0cb916df fix: incorrect conversion between integer types (#2605) 
* chore: match strconv.ParseInt to file mode type

if a string is parsed into an int using strconv.Atoi,
and subsequently that int is converted into another integer type of a smaller size,
the result can produce unexpected values.
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2024-02-07 20:41:00 +00:00
Christopher Angelo Phillips 630e7153e6 chore: pluralize the flag (#2564) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2024-01-31 13:21:09 -05:00
Christopher Angelo Phillips 22f3a29fd7 fix: remove second call to finalize as the task handles it (#2516) 
* fix: remove second call to finalize as the task handles it

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: add test to protect against dupe relationships in final SBOM

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2024-01-19 14:12:29 -05:00
Christopher Angelo PhillipsandAlex Goodman 7182f5b519 Upgrade binary test fixtures management (#2444) 
* test: strip fixtures of any execution permissions

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* chore: add lint check for large files

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* add helper script to capture binary snippets

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* chore: update scripts and add new dir output for snippets

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: update erlang test to new generated format

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: update memcached to new generator pattern

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: update openjdk to named version

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: move openjdk lts to versioned folder

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: rename unversioned java to versioned folders

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: migrate bash fixture to new snippet workflow

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: update script to size 600 bytes

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: update go classifier to new snippet workflow

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: move haproxy new new snippet

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: add flatter haproxy example

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: update tests to new pattern

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: final version of snippet script

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* [wip] download bin helpers

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add manager for binary cataloger test fixtures

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add remaining binary cataloger patterns and snippets

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* adjust gitignore to be more permissive to snippets

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add rust darwin snippets

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* skip tests that are missing full binaries

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address PR feedback

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add tests for binary test fixture manager

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* highlight rows that do not have binaries or snippets

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* bump fixture limit to 1K (found exceptions when adding snippets)

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add redis and postgres snippets

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* improve formating of fixture listing

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-01-05 21:40:03 +00:00
Christopher Angelo Phillips 2a04e06cbc chore: update binary to -x (#2456) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-12-22 09:50:32 -05:00
Christopher Angelo Phillips 3cffa0b7fd chore: remove execute from test fixtures (#2450) 
* chore: remove execute from test fixtures

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* chore: add back ignored file

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-12-20 22:34:29 +00:00
Christopher Angelo PhillipsandAlex Goodman ba80e490c2 feat: allow for stdout to be buffered on each command (#2335) 
* feat: add preRun func to version to restore stdout

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: add test to capture version in output

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* change stdout buffering to log to be opt-in per command

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-17 14:14:13 -05:00
Christopher Angelo Phillips 9b98785aab chore: setup release task before calling go releaser (#2297) 
* chore: update release command to use config at repo root

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-11-07 16:33:06 +00:00
Christopher Angelo Phillips ee4e69285a test: remove dll files and updates tests to use versionResources (#2276) 
* test: remove dll files and updates tests to use versionResources

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: update integration tests with dot net coverage

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* chore: move test cases to appropriate blocks

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* fix: chmod only the dll

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* fix: add primary annotation key to packages

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* chore: bump number of packages with new dotnet package

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-10-31 15:33:52 -04:00
Christopher Angelo Phillips 59c56a5666 fix: update dot net binary parsing logic to remove empty space (#2273) 
* fix: update parsing logic to remove empty space
* tests: update with test cases provided by community
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-10-31 10:43:29 -04:00
Christopher Angelo Phillips cd530924d0 fix: 2179 jar chokes empty lines (#2254) 
---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-10-24 14:03:47 -04:00
Christopher Angelo PhillipsandAuston-Zhang ef43294d0e Add download location when cataloging directory npm package lock (#2238) 
* added download locatoin (resolved) when cataloging a directory - javascript ecosystem- npm - packag-lock
	Signed-off by Auston(Aoxiang) Zhang <auston.zhang@dal.ca>

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* chore: get DCO to fire

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: Auston-Zhang <ax706429@dal.ca>
 2023-10-20 11:40:38 -04:00
Christopher Angelo Phillips e1ad340c2d fix: allow packages to be captured from DIST/EGG case (#2239) 
* fix: allow packages to be captured from DIST/EGG case

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: update expected glob paths

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-10-20 11:29:13 -04:00
Christopher Angelo PhillipsandAlex Goodman d1120ad56e chore: add automated homebrew action (#2164) 
* chore: add automated homebrew action

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* migrate homebrew publish step to separate post-release workflow

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-10-11 09:52:22 -04:00
Christopher Angelo Phillips f6c8057977 feat: add package for go compiler given binary detection (#2195) 
adds a unique synthetic package to the SBOM output that represents the go compiler when it is detected as a part of a package discovered by the go binary cataloger.

When using an SBOM generated by syft - downstream vulnerability scanners now have the opportunity to detect/report on the PURL/CPEs attached to the new stdlib package.
---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-10-06 13:15:50 -04:00
Christopher Angelo Phillips 30f0686353 chore: update license list to 3.22 (#2201) 2023-10-06 10:56:47 -04:00
Christopher Angelo Phillips 650f71cbe0 chore: update to latest stereoscope (#2151) 
* chore: update to latest stereoscope

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* chore: go mod tidy

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-09-19 15:22:10 -04:00
Christopher Angelo Phillips 594ba5f295 chore: pin workflow checkout for cpe update-cpe-dictionary-index (#2141) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-09-15 16:00:15 -04:00
Christopher Angelo Phillips 094b41b301 chore: pin and update all workflow dependencies; add permission scopes (#2138) 
---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-09-15 14:18:42 -04:00
Christopher Angelo Phillips 3e16c6813f feat: add cyclonedx schema version selection (#2123) 
---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-09-13 14:50:22 -04:00
Christopher Angelo Phillips 3842d28e90 fix: update codeql-analysis for go 1.21 (#2108) 
* fix: update codeql-analysis for go 1.21

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* nit: remove comment

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-09-07 15:54:42 -04:00
Christopher Angelo PhillipsandKeith Zantow ee121cff21 feat: 1944 - update purl generation to use a consistent groupID (#2033) 
Separate the logic for CPE and PURL generation. 

PURL generation needs a single answer for groupID based on a priority of discovering the field. 
CPE generation still uses multiple potential groupID to populate the candidate cpe.

Improve GroupID detection. 

Currently syft does not use any hierarchy for GroupID detection and treats all sources as equal. 
It treats fields from the manifest file with priority. This change adds a hierarchy to the fields and returns a single answer based on that hierarchy.
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
 2023-08-22 10:47:07 -04:00
Christopher Angelo Phillips 541c8d339b 1948-filter-pkg-by-type (#2011) 
---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-08-09 16:05:52 -04:00
Christopher Angelo Phillips 466da7cbda 931: binary cataloger exclusion defaults for ownership by overlap (#1948) 
Fixes #931

PR #1948 introduces a new implicit exclusion for binary packages that overlap by file ownership and have certain characteristics:

1) the relationship between packages is OwnershipByFileOverlap
2) the parent package is an "os" package - see changelog for included catalogers
3) the child is a synthetic package generated by the binary cataloger - see changelog for included catalogers
4) the package names are identical

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-08-08 13:00:52 -04:00
Christopher Angelo Phillips 78660022bf test: add coverage for new rpmdb paths (#1999) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-08-04 13:04:36 -04:00
Christopher Angelo Phillips e774006052 fix: update glob to use newer usr/lib/sysimage path (#1997) 
See this link for details on the path migration for the rpmdb
https://fedoraproject.org/wiki/Changes/RelocateRPMToUsr

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-08-03 16:23:50 -07:00
Christopher Angelo Phillips 8e893dfc20 feat: use originator logic to fill supplier (#1980) 
* feat: use Originator to fill supplier for NTIA minimum
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-08-01 17:19:49 -04:00
Christopher Angelo Phillips 3aae316456 chore: update to latest commit in tools-golang (#1969) 
* chore: update to latest commit in tools-golang

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-07-27 15:29:22 -04:00
Christopher Angelo Phillips 0327fdc88a docs: capture artifactory dev settings from 1895 (#1947) 
* docs: capture artifactory dev settings from 1895

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-07-19 16:54:18 +00:00
Christopher Angelo Phillips 204b790012 docs: update docs with new docker specific instructions (#1941) 
* docs: update docs with new docker specific instructions
---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Former-commit-id: c67c76e84df84e3e24aa307637d884ca8b7e3eea
 2023-07-17 18:19:21 +00:00
Christopher Angelo Phillips 2e7fd031d4 fix: remove indirect dependency of circl v1.1.0 (#1940) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-07-13 12:30:37 -04:00
Christopher Angelo Phillips 32296f5943 chore: move wait before iteration to guarantee read before tea (#1931) 
* chore: move wait before iteration to guarantee read before tea

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-07-12 13:59:31 -04:00
Christopher Angelo Phillips 38efe4ec5f fix: background reader apart from global handler for testing (#1929) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-07-12 12:37:19 -04:00
Christopher Angelo Phillips 72616db81f fix: "or-later" suffix updated to consider deprecated "+" operator (#1907) 
* fix: or-later suffix has been updated to consider deprecated +

If a given license has the suffix "or-later" it previously could have
been considered or represented with a "+". Example "GFDL-1.0-or-later"
could have been represented as "GFDL-1.0+". This PR allows the license
list generation to consider "or-later" as == to "+" when generating
permutations for upgrading deprecated licenses.

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-07-11 16:21:29 +00:00
Christopher Angelo Phillips d21fa84335 chore: update iterations to protect against race (#1927) 
* chore: update iterations to protect against race
---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-07-10 11:44:54 -04:00
Christopher Angelo Phillipsandguoguangwu f07581f504 Pr 1825 (#1865) 
chore: code cleanup

Signed-off-by: guoguangwu <guoguangwu@magic-shield.com>

---------

Signed-off-by: guoguangwu <guoguangwu@magic-shield.com>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: guoguangwu <guoguangwu@magic-shield.com>
 2023-06-05 17:01:00 +00:00
Christopher Angelo Phillips 4ac8fdf6df fix: add panic recovery for license parse (#1839) 
* fix: add panic recovery for license parse
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-05-23 16:58:49 +00:00
Christopher Angelo Phillips 4601ca3735 fix: update field plurality of 8.0.0 schema before release (#1820) 
to keep things consistent across the schema we want Locations and URLs to be plural fields now that they are fields on the License struct
---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-05-16 13:05:48 -04:00
Christopher Angelo Phillips 1a2a49840b fix: update cataloger to check for expressions before split (#1819) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-05-16 16:04:28 +00:00
Christopher Angelo Phillips 42fa9e4965 feat: update syft license concept to complex struct (#1743) 
this PR makes the following changes to update the underlying license model to have more expressive capabilities
it also provides some guarantee's surrounding the license values themselves

- Licenses are updated from string -> pkg.LicenseSet which contain pkg.License with the following fields:
- original `Value` read by syft
- If it's possible to construct licenses will always have a valid SPDX expression for downstream consumption
- the above is run against a generated list of SPDX license ID to try and find the correct ID
- SPDX concluded vs declared is added to the new struct
- URL source for license is added to the new struct
- Location source is added to the new struct to show where the expression was pulled from
 2023-05-15 16:23:39 -04:00
Christopher Angelo PhillipsandAlex Goodman c038f13d44 chore: go-rpmdb update (#1757) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2023-04-24 10:34:13 -04:00
Christopher Angelo Phillips a42bac6fcc fix: only cache java packages and not source content (#1750) 
* fix: only cache java packages and not source content

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* fix: add gradle to matched files for ci checksum

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-04-19 16:07:34 -04:00