Weston Steimel
0c5f03235e
refactor: move apk upstream logic to apk metadata ( #1619 )
...
* refactor: move apk upstream logic to apk metadata
Export the logic for parsing upstream APK package names
so it can be accessed from apk metadata objects directly.
This also tightens the upstream regex pattern as several
edge cases were being missed.
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
* fix: ensure correct handling for apk packages beginning with digits
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
* fix: upstream generation for ruby
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
---------
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
2023-02-24 15:59:19 +00:00
Weston Steimel
0c05855131
fix: determine upstream for apk version streams ( #1610 )
...
Determines better upstream package name for version-stream apk packages:
Examples:
- postgresql-13 -> postgresql
- postgresql15 -> postgresql
- go-1.19 -> go
- perl100.55 -> perl
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
2023-02-23 17:32:34 +00:00
Weston Steimel
1150772d06
fix: improve CPE generation for curl APK ( #1608 )
...
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
2023-02-23 17:32:12 +00:00
Weston Steimel
57a13ae355
fix: improve CPE and upstream generation logic for Alpine packages ( #1567 )
...
* fix: improved CPE-generation logic for alpine packages
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
* fix: improved alpine upstream name generation
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
* fix: improve CPE vendor for alpine
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
* fix: python vendor CPE gen
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
* fix: alpine cpe gen logic
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
* fix: apk CPE update for nodejs-current
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
* fix: CPE update for python pip
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
* fix: CPE update for some ruby packages
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
* fix linting
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
---------
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
2023-02-13 17:23:13 +00:00
Weston Steimel
e236054668
fix: python CPE generation for alpine ( #1564 )
...
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
2023-02-10 18:04:16 +00:00
Weston Steimel
4c0aef09b8
fix: add relevant CPEs to python and busybox classifiers ( #1517 )
...
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
2023-01-25 17:18:24 +00:00
Weston Steimel
fc4d28f365
fix: bump golang.org/x/net to v0.4.0 ( #1467 )
...
resolves reporting of CVE-2022-41717
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
2023-01-17 17:02:34 +00:00
Weston Steimel
5290dfb9c2
fix: bump golang.org/x/text to v0.3.8 ( #1466 )
...
This resolves reporting of GHSA-69ch-w2m2-3vjp
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
2023-01-17 15:50:02 +00:00
Weston Steimel
e87cfe7319
chore: remove bumping cosign in go.mod when updating bootstrap tools ( #1452 )
2023-01-12 16:21:01 -05:00
Weston Steimel
09bf5b062c
chore: add unit test for wolfi os release identification ( #1340 )
...
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
2022-11-14 18:57:31 -05:00
Weston Steimel
919c929798
update go-rpmdb to improve parsing of installed files ( #1297 )
2022-10-30 23:55:17 -04:00
Weston Steimel
6949a2500f
Fix update-bootstrap-tools workflow ( #1170 )
2022-08-22 16:17:28 +00:00
Weston Steimel
5282820b5d
workflow to create automated PRs to update bootstrap tools ( #1167 )
2022-08-22 11:28:24 -04:00
Weston Steimel
fce83321ba
bump cosign to v1.10.1 ( #1144 )
2022-08-04 19:03:57 +00:00
Weston Steimel
fb8f24dc1e
bump bouncer to v0.4.0 ( #1125 )
...
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
2022-07-29 16:57:59 +01:00
Weston Steimel and Christopher Phillips
62897fbc89
bump goreleaser to v1.10.3 ( #1123 )
...
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2022-07-28 17:10:32 +00:00
Weston Steimel
d1729ee7e2
bump golangci-lint to v1.47.2 ( #1122 )
2022-07-28 09:40:53 -04:00
Weston Steimel
43715d380b
bump cosign in bootstrap-tools to v1.10.0 ( #1121 )
2022-07-28 09:40:42 -04:00
Weston Steimel
b720a3c81c
bump cosign to v1.10.0 ( #1114 )
...
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
2022-07-22 09:41:38 -04:00
Weston Steimel and Christopher Phillips
b8d1a46e7e
bump cosign to v1.9.0 to resolve reporting of GHSA-66x3-6cw3-v5gj ( #1025 )
...
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2022-06-08 11:51:10 -04:00
Weston Steimel
05be9e25ce
improve LanguageByName and add unit tests ( #1034 )
...
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
2022-06-07 14:09:09 +01:00
Weston Steimel
8420612724
bump cosign to v1.8.0 ( #1003 )
...
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
2022-05-18 17:17:21 +01:00
Weston Steimel
15e45a8ce1
add additional vendors for springframework ( #945 )
...
The Official CPE dictionary currently contains entries for springframework with three different vendors: springsource, vmware, and pivotal_software. This appears to be because ownership has changed over time.
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
2022-04-11 14:38:52 +01:00
Weston Steimel
f7a44b3d2c
convert from deprecated org.label-schema to OCI Annotations in Dockerfile ( #763 )
...
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
2022-01-21 21:58:10 +00:00
Weston Steimel
