oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-30 14:02:26 +01:00
Code Issues Packages Projects Releases Wiki Activity
1,719 Commits 65 Branches 273 Tags
0f3991799916af3c268dfd0a18b5a7c5bba12ff2
Commit Graph
1719 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
anchore-actions-token-generator[bot]andspiffcs 0f39917999 chore(deps): update tools to latest versions (#2318) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>
 2023-11-14 12:01:47 -05:00
Colm O hEigeartaigh 0652998b9b Add license for golang stdlib (#2317) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-11-14 11:53:07 -05:00
dependabot[bot] 43bdf6e1b2 chore(deps): bump github/codeql-action from 2.22.5 to 2.22.6 (#2321) 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.22.5 to 2.22.6.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/74483a38d39275f33fcff5f35b679b5ca4a26a99...689fdc5193eeb735ecb2e52e819e3382876f93f4)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-11-14 11:35:59 -05:00
Benji Visser 9aa9e0e09a docs: Update README.md for dotnet-portable-executable (#2322) 
Signed-off-by: Benji Visser <benji@093b.org>
 2023-11-14 10:37:56 -05:00
Colm O hEigeartaigh 7ccbadff34 Fall back to searching maven central using groupIDFromJavaMetadata (#2295) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-11-10 22:02:53 -05:00
Alex Goodman 3f13d209a5 rename file.Location.VirtualPath to AccessPath (#2288) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-09 11:30:08 -06:00
anchore-actions-token-generator[bot]andspiffcs baa3dc74d3 chore(deps): update tools to latest versions (#2308) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>
 2023-11-09 08:07:59 -08:00
dependabot[bot] 58f310c390 chore(deps): bump github.com/gkampitakis/go-snaps from 0.4.11 to 0.4.12 (#2310) 
Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps) from 0.4.11 to 0.4.12.
- [Release notes](https://github.com/gkampitakis/go-snaps/releases)
- [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.4.11...v0.4.12)

---
updated-dependencies:
- dependency-name: github.com/gkampitakis/go-snaps
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-11-09 08:06:50 -08:00
dependabot[bot] a383239217 chore(deps): bump golang.org/x/net from 0.17.0 to 0.18.0 (#2311) 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.17.0 to 0.18.0.
- [Commits](https://github.com/golang/net/compare/v0.17.0...v0.18.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-11-09 08:06:19 -08:00
Benji VisserandAlex Goodman 0891d35e07 include image labels in cycloneDX SBOM (#2294) 
* include image labels in SBOM

Signed-off-by: Benji Visser <benji@093b.org>

* update tests

Signed-off-by: Benji Visser <benji@093b.org>

* gocritic

Signed-off-by: Benji Visser <benji@093b.org>

* add properties

Signed-off-by: Benji Visser <benji@093b.org>

* add decoder

Signed-off-by: Benji Visser <benji@093b.org>

* update golden snapshots

Signed-off-by: Benji Visser <benji@093b.org>

* decodeProperties

Signed-off-by: Benji Visser <benji@093b.org>

* add test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove the snapshot test changes

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* restore snapshots

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Benji Visser <benji@093b.org>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
v0.96.0 		2023-11-08 23:13:04 +00:00
Alex Goodman 502971a1b2 Add accessPath on Location objects to syft-json output (#2287) 
* add accessPath on Location objects to syft-json output

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* generate json schema v12.0.1

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-08 17:05:30 -06:00
Colm O hEigeartaighandAlex Goodman dc14dbb326 SPDX file has duplicate sha256 tag in versionInfo (#2300) 
* SPDX file has duplicate sha256 tag in versionInfo

Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>

* add tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-08 22:49:31 +00:00
Colm O hEigeartaigh bae5a2e741 Check maven central as well for licenses in parents poms for nested jars (#2302) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-11-08 10:26:12 -08:00
dependabot[bot] 220655743b chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (#2293) 
Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra) from 1.7.0 to 1.8.0.
- [Release notes](https://github.com/spf13/cobra/releases)
- [Commits](https://github.com/spf13/cobra/compare/v1.7.0...v1.8.0)

---
updated-dependencies:
- dependency-name: github.com/spf13/cobra
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-11-08 10:23:40 -08:00
anchore-actions-token-generator[bot]andspiffcs 9fce006b8f chore(deps): update tools to latest versions (#2301) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>
 2023-11-08 09:33:59 -08:00
Keith Zantow d91c2dd842 fix: identify cyclone-json without $schema (#2303) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-11-08 11:54:22 -05:00
Christopher Angelo Phillips 9b98785aab chore: setup release task before calling go releaser (#2297) 
* chore: update release command to use config at repo root

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
v0.95.0 		2023-11-07 16:33:06 +00:00
anchore-actions-token-generator[bot]andspiffcs ad977ee0a1 chore(deps): update tools to latest versions (#2296) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>
 2023-11-07 06:44:39 -08:00
anchore-actions-token-generator[bot]andspiffcs 9eac737fe2 chore(deps): update tools to latest versions (#2289) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>
 2023-11-06 09:23:46 -05:00
anchore-actions-token-generator[bot]andwagoodman 4ba92ac43b chore(deps): update CPE dictionary index (#2290) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
 2023-11-06 09:23:24 -05:00
dependabot[bot] a4b895d31f chore(deps): bump golang.org/x/mod from 0.13.0 to 0.14.0 (#2292) 
Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.13.0 to 0.14.0.
- [Commits](https://github.com/golang/mod/compare/v0.13.0...v0.14.0)

---
updated-dependencies:
- dependency-name: golang.org/x/mod
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-11-06 14:12:40 +00:00
Colm O hEigeartaigh 9fa11f2339 Wire though maven-url to java config (#2291) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-11-06 09:08:03 -05:00
Mark Severson 1470abaded Use case-insensitive matching for Go license files (#2286) 
Signed-off-by: Mark Severson <mark@kasten.io>
 2023-11-03 14:47:09 -04:00
Colm O hEigeartaighandChristopher Phillips 2d582f78a1 Add a new Java configuration option to recursively search parent poms… (#2274) 
- Add a new Java configuration option to recursively search parent poms for licenses
---------
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-11-03 10:33:02 -04:00
anchore-actions-token-generator[bot]andspiffcs 793cef5086 chore(deps): update tools to latest versions (#2280) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>
 2023-11-02 09:20:27 -04:00
Alex Goodman b2f4d7eda2 Follow convention for naming catalogers (#2277) 
* follow convention for naming catalogers

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix cataloger name example

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-02 12:39:42 +00:00
Alex Goodman 6c41f15975 change dir resolver to include virtual path (#2259) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-02 08:20:00 -04:00
Colm O hEigeartaighandChristopher Phillips 26cdbfc299 fix: syft does not handle the case of parsing a jar with multiple poms (#2231) 
---------

Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-11-01 17:10:17 +00:00
Robbie Vanbrabant dc9bc58480 add PURLs when scanning Gradle lock files (#2278) 
This adds PURLs when scanning Gradle lock files.

Unintuitively the correct PURL type appears to be `maven` as opposed to
`gradle`. See https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst

- `gradle` for Gradle plugins
- `maven` for Maven JARs and related artifacts

Signed-off-by: Robbie Vanbrabant <robbie@monzo.com>
 2023-11-01 13:09:31 -04:00
dependabot[bot] a6d73e5659 chore(deps): bump modernc.org/sqlite from 1.26.0 to 1.27.0 (#2279) 
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.26.0 to 1.27.0.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.26.0...v1.27.0)

---
updated-dependencies:
- dependency-name: modernc.org/sqlite
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-11-01 10:35:20 -04:00
Christopher Angelo Phillips ee4e69285a test: remove dll files and updates tests to use versionResources (#2276) 
* test: remove dll files and updates tests to use versionResources

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: update integration tests with dot net coverage

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* chore: move test cases to appropriate blocks

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* fix: chmod only the dll

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* fix: add primary annotation key to packages

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* chore: bump number of packages with new dotnet package

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-10-31 15:33:52 -04:00
Christopher Angelo Phillips 59c56a5666 fix: update dot net binary parsing logic to remove empty space (#2273) 
* fix: update parsing logic to remove empty space
* tests: update with test cases provided by community
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-10-31 10:43:29 -04:00
Colm O hEigeartaighandChristopher Phillips 78ac2f9797 Read a license from a parent pom stored in Maven Central (#2228) 
* Read a license from a parent pom stored in Maven Central
---------
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-10-30 17:48:16 -04:00
Tim Gerla 262423b1e8 Update README.md to use canonical output format names (fixes #2269) (#2272) 
Signed-off-by: Timothy Gerla <tim@gerla.net>
 2023-10-30 17:25:30 -04:00
Alex Goodman 1aaa644007 Remove MetadataType from core package object and normalize JSON metadataType values (#1983) 
* [wip]

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* distinct the package metadata functions

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove metadata type from package core model

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* incorporate review feedback for names

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add RPM archive metadata and split parser helpers

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* clarify the python package metadata type

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* rename the KB metadata type

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* break hackage and composer types by use case

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* linting fix

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix encoding and decoding for syft-json and cyclonedx

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* bump json schema to 11

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update cyclonedx-json snapshots

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update cyclonedx-xml snapshots

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update spdx-json snapshots

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update spdx-tv snapshots

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update syft-json snapshots

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* correct metadata type in stack yaml parser test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix bom-ref redactor for cyclonedx-xml

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add tests for legacy package metadata names

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* regenerate json schema v11

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix legacy HackageMetadataType reflect type value check

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix linting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* packagemetadata discovery should account for type shadowing

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix linting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix cli tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* bump json schema version to v12

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update json schema to incorporate changes from main

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add syft-json legacy config option

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add tests around v11-v12 json decoding

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add docs for SYFT_JSON_LEGACY

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* rename structs to be compliant with new naming scheme

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-10-30 12:12:04 -04:00
dependabot[bot] f442586ec9 chore(deps): bump github.com/docker/docker (#2263) 
Bumps [github.com/docker/docker](https://github.com/docker/docker) from 24.0.6+incompatible to 24.0.7+incompatible.
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](https://github.com/docker/docker/compare/v24.0.6...v24.0.7)

---
updated-dependencies:
- dependency-name: github.com/docker/docker
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-10-30 09:55:19 -04:00
anchore-actions-token-generator[bot]andkzantow 12877ed863 chore(deps): update stereoscope to 5909e353ee88d7809f0e646c79f110a0e6b1d80d (#2265) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: kzantow <kzantow@users.noreply.github.com>
 2023-10-30 09:51:37 -04:00
anchore-actions-token-generator[bot]Will Murphywillmurphyscode
 		629aafc323 chore(deps): update CPE dictionary index (#2271) 
* chore(deps): update CPE dictionary index

Signed-off-by: GitHub <noreply@github.com>

---------

Signed-off-by: Will Murphy <will.murphy@anchore.com>
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: Will Murphy <will.murphy@anchore.com>
Co-authored-by: willmurphyscode <willmurphyscode@users.noreply.github.com>
 2023-10-30 09:48:03 -04:00
William Murphy f430788099 chore: fix cpe generation task (#2270) 
Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2023-10-30 12:51:26 +00:00
dependabot[bot] 58850d3258 chore(deps): bump github.com/google/uuid from 1.3.1 to 1.4.0 (#2262) 
Bumps [github.com/google/uuid](https://github.com/google/uuid) from 1.3.1 to 1.4.0.
- [Release notes](https://github.com/google/uuid/releases)
- [Changelog](https://github.com/google/uuid/blob/master/CHANGELOG.md)
- [Commits](https://github.com/google/uuid/compare/v1.3.1...v1.4.0)

---
updated-dependencies:
- dependency-name: github.com/google/uuid
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-10-27 09:55:04 -04:00
dependabot[bot] 2428d704e1 chore(deps): bump github/codeql-action from 2.22.4 to 2.22.5 (#2261) 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.22.4 to 2.22.5.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/49abf0ba24d0b7953cb586944e918a0b92074c80...74483a38d39275f33fcff5f35b679b5ca4a26a99)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-10-27 09:54:23 -04:00
anchore-actions-token-generator[bot]andspiffcs da07520121 chore(deps): update tools to latest versions (#2258) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>
 2023-10-26 10:15:13 -04:00
dependabot[bot] ae27dcdfa9 chore(deps): bump github.com/go-git/go-git/v5 from 5.9.0 to 5.10.0 (#2256) 
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.9.0 to 5.10.0.
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](https://github.com/go-git/go-git/compare/v5.9.0...v5.10.0)

---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-10-25 10:45:27 -04:00
Colm O hEigeartaigh 1daf18fee9 feat: Perform case insensitive matching on Java license files (#2235) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-10-25 09:51:59 -04:00
Alex Goodman 7392d607b6 Split the sbom.Format interface by encode and decode use cases (#2186) 
* split up sbom.Format into encode and decode ops

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update cmd pkg to inject format configs

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* bump cyclonedx schema to 1.5

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* redact image metadata from github encoder tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add more testing around format decoder identify

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add test case for format version options

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix cli tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix CLI test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* [wip] - review comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* keep encoder creation out of post load function

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* keep decider and identify functions

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add a few more doc comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove format encoder default function helpers

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address PR feedback

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* move back to streaming based decode functions

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* with common convention for encoder constructors

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix tests and allow for encoders to be created from cli options

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix cli tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix linting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* buffer reads from stdin to support seeking

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-10-25 13:43:06 +00:00
Alex Goodman 7315f83f9d Upgrade tool management (#2188) 
* migrate to binny and taskfile

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update binny to not require github token

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* added support for automatically building snapshots

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* detect source changes for snapshot builds

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fail workflow explicitly when snapshot cache restoral fails

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* match snapshot restoral paths

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-10-25 09:08:43 -04:00
Christopher Angelo Phillips cd530924d0 fix: 2179 jar chokes empty lines (#2254) 
---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-10-24 14:03:47 -04:00
anchore-actions-token-generator[bot]andAlex Goodman 73d5852119 chore(deps): update CPE dictionary index (#2253) 
* fix CPE workflow

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* chore(deps): update CPE dictionary index

Signed-off-by: GitHub <noreply@github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-10-24 13:22:02 -04:00
Alex Goodman c4b464e616 fix CPE workflow (#2252) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-10-24 15:07:49 +00:00
Stefan Profanter 234ce4e1f3 feat: add conaninfo.txt parser to detect conan packages in docker images (#2234) 
* feat: add conaninfo.txt parser to detect conan packages in docker images

Signed-off-by: Stefan Profanter <stefan.profanter@agile-robots.com>

* fix: add NewConanInfoCataloger as a separate cataloger

Signed-off-by: Stefan Profanter <stefan.profanter@agile-robots.com>

---------

Signed-off-by: Stefan Profanter <stefan.profanter@agile-robots.com>
 2023-10-23 16:17:50 -04:00