3067 Commits

Author SHA1 Message Date
anchore-actions-token-generator[bot]
1d7529d01f
chore(deps): update tools to latest versions (#3815)
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>
2025-04-22 13:10:35 -04:00
Will Murphy
a69f6aec90
docs: document test commands (#3816)
So that contributors can quickly figure out how to run tests.

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
2025-04-22 10:23:52 -04:00
Stijn Taelemans
df11561929
Support detection of Chrome binaries (#3136)
* test: add test cases

Signed-off-by: Stijn Taelemans <taelemansst@gmail.com>

* feat: add classifier for chrome

Signed-off-by: Stijn Taelemans <taelemansst@gmail.com>

---------

Signed-off-by: Stijn Taelemans <taelemansst@gmail.com>
2025-04-21 16:37:15 -04:00
VictorHuu
ab570497b0
fix:allow golang tip image detection regex pattern (#3757)
* Modify the Regex version matcher for golang in the binary classifiers to make it compatible with golang tip images

Signed-off-by: Victor Hu <victorhu493@gmail.com>
Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* Preliminary fix the regex matching for golang tip image and add the corresponding unit tests

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* consider VERSION.cache when it comes to golang tip images

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* consider VERSION.cache when it comes to golang tip images

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

---------

Signed-off-by: Victor Hu <victorhu493@gmail.com>
Signed-off-by: Yuntao Hu <victorhu493@gmail.com>
2025-04-21 14:06:52 -04:00
VictorHuu
ea7e9e696b
fix:Make the parse of the replace part in ``go.mod`` more compliant and traceable (#3812)
* We only need to replace the name of a GoLang package when the name is a web link

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* make the detection of a localfile path pattern more easy

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* consider the m.New.Version so the granularity is narrowed

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* to pass the static-analysis

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* to pass the static-analysis

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* add test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
2025-04-21 17:58:54 +00:00
Adam McClenaghan
1f15361ecf
(fix): delete collection name/type key entries when empty (#3797)
Signed-off-by: Adam McClenaghan <adam@mcclenaghan.co.uk>
2025-04-21 13:41:39 -04:00
anchore-actions-token-generator[bot]
0bcf2881c4
chore(deps): update CPE dictionary index (#3813)
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>
2025-04-21 09:59:06 -04:00
anchore-actions-token-generator[bot]
b9ae936731
chore(deps): update tools to latest versions (#3806)
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>
2025-04-17 12:26:29 -04:00
dependabot[bot]
e452cc7623
chore(deps): bump github.com/go-git/go-git/v5 from 5.15.0 to 5.16.0 (#3807)
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.15.0 to 5.16.0.
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](https://github.com/go-git/go-git/compare/v5.15.0...v5.16.0)

---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
  dependency-version: 5.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-17 12:26:18 -04:00
Keith Zantow
b13ffdd304
fix: comma separated selectors in cataloger list command (#3804)
Signed-off-by: Keith Zantow <kzantow@gmail.com>
2025-04-16 10:41:48 -04:00
dependabot[bot]
a5da154327
chore(deps): bump github.com/anchore/stereoscope from 0.1.2 to 0.1.3 (#3803) 2025-04-15 19:31:45 +00:00
Musang Kim
1866e25f9a
chore: fix conan parser typos (#3802)
Signed-off-by: Musang <s.musang.kim@gmail.com>
2025-04-15 10:51:02 -04:00
anchore-actions-token-generator[bot]
1e336e3f07
chore(deps): update tools to latest versions (#3798)
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>
2025-04-14 14:43:53 -04:00
anchore-actions-token-generator[bot]
eee9d0a41e
chore(deps): update CPE dictionary index (#3799)
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>
2025-04-14 14:43:25 -04:00
dependabot[bot]
a5632c0044
chore(deps): bump github.com/mholt/archives from 0.1.0 to 0.1.1 (#3778)
Bumps [github.com/mholt/archives](https://github.com/mholt/archives) from 0.1.0 to 0.1.1.
- [Release notes](https://github.com/mholt/archives/releases)
- [Commits](https://github.com/mholt/archives/compare/v0.1.0...v0.1.1)

---
updated-dependencies:
- dependency-name: github.com/mholt/archives
  dependency-version: 0.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-11 14:50:51 -04:00
dependabot[bot]
2a409488a0
chore(deps): bump marocchino/sticky-pull-request-comment (#3788)
Bumps [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment) from 2.9.1 to 2.9.2.
- [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases)
- [Commits](52423e0164...67d0dec7b0)

---
updated-dependencies:
- dependency-name: marocchino/sticky-pull-request-comment
  dependency-version: 2.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-11 12:43:11 -04:00
dependabot[bot]
d145e80c20
chore(deps): bump github.com/magiconair/properties from 1.8.9 to 1.8.10 (#3789)
Bumps [github.com/magiconair/properties](https://github.com/magiconair/properties) from 1.8.9 to 1.8.10.
- [Release notes](https://github.com/magiconair/properties/releases)
- [Commits](https://github.com/magiconair/properties/compare/v1.8.9...v1.8.10)

---
updated-dependencies:
- dependency-name: github.com/magiconair/properties
  dependency-version: 1.8.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-11 12:42:57 -04:00
dependabot[bot]
05de0d2a1b
chore(deps): bump github.com/charmbracelet/bubbles from 0.20.0 to 0.21.0 (#3790)
Bumps [github.com/charmbracelet/bubbles](https://github.com/charmbracelet/bubbles) from 0.20.0 to 0.21.0.
- [Release notes](https://github.com/charmbracelet/bubbles/releases)
- [Changelog](https://github.com/charmbracelet/bubbles/blob/master/.goreleaser.yml)
- [Commits](https://github.com/charmbracelet/bubbles/compare/v0.20.0...v0.21.0)

---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbles
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-11 12:42:46 -04:00
Alex Goodman
24df095a5e
empty source during decoding should not be fatal (#3791)
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2025-04-11 10:12:29 -04:00
dependabot[bot]
e7f0a602c2
chore(deps): bump github.com/go-git/go-git/v5 from 5.14.0 to 5.15.0 (#3792)
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.14.0 to 5.15.0.
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](https://github.com/go-git/go-git/compare/v5.14.0...v5.15.0)

---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
  dependency-version: 5.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-11 10:12:05 -04:00
anchore-actions-token-generator[bot]
e73293cd45
chore(deps): update tools to latest versions (#3785)
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>
2025-04-08 14:03:29 -04:00
dependabot[bot]
3b3943d2d6
chore(deps): bump github/codeql-action from 3.28.13 to 3.28.15 (#3786)
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.28.13 to 3.28.15.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](1b549b9259...45775bd823)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.28.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-08 14:03:06 -04:00
dependabot[bot]
97228af539
chore(deps): bump golang.org/x/net from 0.38.0 to 0.39.0 (#3787)
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.38.0 to 0.39.0.
- [Commits](https://github.com/golang/net/compare/v0.38.0...v0.39.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-version: 0.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-08 14:02:48 -04:00
anchore-actions-token-generator[bot]
987ba83674
chore(deps): update CPE dictionary index (#3782)
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>
2025-04-07 10:01:11 -04:00
anchore-actions-token-generator[bot]
f11377fe30
chore(deps): update tools to latest versions (#3775)
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>
2025-04-03 17:35:26 +00:00
Alex Goodman
12f36420dd
Parse GitHub actions comments (#3776)
* add version comment parsing support to github actions

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update json schema with github actions metadata

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add originator processing for github actions type

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2025-04-03 14:46:27 +00:00
Alex Goodman
f851085668
Expand python license scanning to cover unclaimed files (#3779)
* expand python license scanning to cover unclaimed files

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* speed up tests using the license scanner

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2025-04-03 10:31:02 -04:00
Christopher Angelo Phillips
da62a82413
feat: adds the DirectoryTag to the r cataloger (#3774)
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
2025-04-01 11:46:51 -04:00
anchore-actions-token-generator[bot]
9ab83874ed
chore(deps): update anchore dependencies (#3772)
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>
v1.22.0
2025-04-01 14:09:34 +00:00
Alex Goodman
d033ad7de6
unpin go version in ci (#3773)
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2025-04-01 13:27:15 +00:00
dependabot[bot]
b948f2e254
chore(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 (#3766)
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.37.0 to 0.38.0.
- [Commits](https://github.com/golang/net/compare/v0.37.0...v0.38.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-31 15:02:30 +00:00
dependabot[bot]
6d792aa9dd
chore(deps): bump 8398a7/action-slack from 3.16.2 to 3.18.0 (#3767)
Bumps [8398a7/action-slack](https://github.com/8398a7/action-slack) from 3.16.2 to 3.18.0.
- [Release notes](https://github.com/8398a7/action-slack/releases)
- [Commits](28ba43ae48...1750b5085f)

---
updated-dependencies:
- dependency-name: 8398a7/action-slack
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-31 10:43:47 -04:00
dependabot[bot]
72a0fa4aa3
chore(deps): bump modernc.org/sqlite from 1.36.1 to 1.37.0 (#3771)
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.36.1 to 1.37.0.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.36.1...v1.37.0)

---
updated-dependencies:
- dependency-name: modernc.org/sqlite
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-31 10:41:53 -04:00
anchore-actions-token-generator[bot]
ec130b977e
chore(deps): update CPE dictionary index (#3769)
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>
2025-03-31 11:51:04 +01:00
Alex Goodman
c53f2fbad3
Better represent .NET runtime packages (#3768)
* clean up .NET runtime packages

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add runtime relationships

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove runtime references from binary package name

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2025-03-28 13:36:27 -04:00
Alex Goodman
40dd5d0bbd
better .NET cpe generation (#3764)
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2025-03-28 10:58:59 -04:00
Alex Goodman
ad9928cb2a
Merge the .NET deps.json and PE binary catalogers (#3563)
* add combined deps.json + pe binary cataloger

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* deprecate pe and deps standalone catalogers

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* parse resource names + add tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix integration and CLI tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add some helpful code comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* allow for dropping Dep packages that are missing DLLs

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* migrate json schema changes to 24

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* keep application configuration

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* correct config help

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* [wip] detect claims of dlls within deps.json

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* [wip] fix tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add assembly repack detection

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* .net package count is lower due to dll claim requirement

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2025-03-27 14:38:16 -04:00
Keith Zantow
4a9437808e
feat: parallelize catalogers per-file and hash contents in parallel (#3636)
Signed-off-by: Keith Zantow <kzantow@gmail.com>
2025-03-26 11:10:08 -04:00
dependabot[bot]
dbe29ed4ab
chore(deps): bump github/codeql-action from 3.28.12 to 3.28.13 (#3758)
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.28.12 to 3.28.13.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](5f8171a638...1b549b9259)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-24 14:28:25 -04:00
anchore-actions-token-generator[bot]
d0018c921e
chore(deps): update CPE dictionary index (#3756)
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>
2025-03-24 10:02:21 -04:00
Keith Zantow
7ac4d91f43
chore: reformat (#3754)
Signed-off-by: Keith Zantow <kzantow@gmail.com>
2025-03-21 06:13:35 -04:00
anchore-actions-token-generator[bot]
410b85e1c9
chore(deps): update tools to latest versions (#3747)
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>
2025-03-20 10:19:45 -04:00
Alex Goodman
e9b24a29d7
Remove mitchellh dependencies (#3748)
* remove mitchellh dependencies

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix failing unit tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2025-03-20 10:19:19 -04:00
dependabot[bot]
35d666b27d
chore(deps): bump actions/upload-artifact from 4.6.1 to 4.6.2 (#3750)
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.1 to 4.6.2.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](4cec3d8aa0...ea165f8d65)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-20 10:02:50 -04:00
dependabot[bot]
b036d75e8a
chore(deps): bump github.com/docker/docker (#3749)
Bumps [github.com/docker/docker](https://github.com/docker/docker) from 28.0.1+incompatible to 28.0.2+incompatible.
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](https://github.com/docker/docker/compare/v28.0.1...v28.0.2)

---
updated-dependencies:
- dependency-name: github.com/docker/docker
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-20 10:02:35 -04:00
dependabot[bot]
f1bc8f8a2a
chore(deps): bump actions/cache from 4.2.2 to 4.2.3 (#3751)
Bumps [actions/cache](https://github.com/actions/cache) from 4.2.2 to 4.2.3.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](d4323d4df1...5a3ec84eff)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-20 10:02:21 -04:00
dependabot[bot]
e986750cbc
chore(deps): bump actions/cache in /.github/actions/bootstrap (#3752)
Bumps [actions/cache](https://github.com/actions/cache) from 4.2.2 to 4.2.3.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](d4323d4df1...5a3ec84eff)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-20 10:02:05 -04:00
Alan Pope
5fa8e9c6e9
feat: add Debian archive (.deb) file cataloger (#3704)
* feat: add Debian archive (.deb) file cataloger

Add a cataloger that parses Debian package (.deb) archive files directly,
allowing Syft to discover packages from .deb files without requiring
them to be installed on the system. This implements issue #3315.

Key features:
- Parse .deb AR archives to extract package metadata
- Support for gzip, xz, and zstd compressed control files
- Extract package metadata from control files
- Process file information from md5sums files
- Mark configuration files from conffiles entries
- Handle trailing slashes in archive member names

Signed-off-by: Alan Pope <alan.pope@anchore.com>

* chore: run go mod tidy to fix failing workflow

Signed-off-by: Alan Pope <alan.pope@anchore.com>

* add license processing to dpkg archive cataloger + add tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update json schema with dpkg archive type

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alan Pope <alan.pope@anchore.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
2025-03-19 20:03:21 +00:00
dependabot[bot]
be0959cabf
chore(deps): bump actions/setup-go in /.github/actions/bootstrap (#3742)
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.3.0 to 5.4.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](f111f3307d...0aaccfd150)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-19 13:46:54 -04:00
dependabot[bot]
78dc6f7546
chore(deps): bump actions/setup-go from 5.3.0 to 5.4.0 (#3743)
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.3.0 to 5.4.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](f111f3307d...0aaccfd150)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-19 13:46:51 -04:00