Alex Goodman
07e76907f6
Migrate location-related structs to the file package ( #1751 )
...
* migrate location structs to file package
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* replace source.Location refs with file package call
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix linting
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* remove hardlink test for file based catalogers
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* remove hardlink test for all-regular-files testing
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* migrate file resolver implementations to separate package
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix linting
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* [wip] migrate resolvers to internal
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* migrate resolvers to syft/internal
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
---------
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: <>
2023-05-24 17:06:38 -04:00
Christopher Angelo Phillips
42fa9e4965
feat: update syft license concept to complex struct ( #1743 )
...
this PR makes the following changes to update the underlying license model to have more expressive capabilities
it also provides some guarantee's surrounding the license values themselves
- Licenses are updated from string -> pkg.LicenseSet which contain pkg.License with the following fields:
- original `Value` read by syft
- If it's possible to construct licenses will always have a valid SPDX expression for downstream consumption
- the above is run against a generated list of SPDX license ID to try and find the correct ID
- SPDX concluded vs declared is added to the new struct
- URL source for license is added to the new struct
- Location source is added to the new struct to show where the expression was pulled from
2023-05-15 16:23:39 -04:00
Keith Zantow
645206735e
chore: add more detail on SPDX file IDs ( #1769 )
2023-05-02 16:52:18 -04:00
Alex Goodman
5f3d4d285b
rename sbom.PackageCatalog to sbom.Packages ( #1773 )
...
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2023-05-01 10:19:58 -04:00
Alex Goodman
fd02bef0a3
rename pkg.Catalog to pkg.Collection ( #1764 )
...
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2023-04-26 13:56:33 -04:00
Alex Goodman
44422853be
Add package-to-file location evidence relationships ( #1698 )
...
* add evident-by relationship
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* wire up evident-by relationship geneation
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* handle evident-by relationship in spdx formats
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix decoding file info for syft json format
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* bump json schema to incorporate file size attribute
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* refactor to create relationships for primary evidence only
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix linting
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* remove unused 7.0.2 json schema
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
---------
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2023-04-14 15:08:46 -04:00
Keith Zantow
11e926ab2f
chore: fix flaky license sorting ( #1690 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2023-03-22 14:41:49 -04:00
Keith Zantow
7cfdffab5f
fix: sanitize SPDX LicenseRefs ( #1657 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2023-03-06 10:55:23 -05:00
Avi Deitcher
38a090c218
fix: add support for licenses not found on list ( #1540 )
...
Signed-off-by: Avi Deitcher <avi@deitcher.net >
2023-02-07 11:47:04 -05:00
Keith Zantow
1530ef354f
chore: update spdx/tools-golang to v0.5.0-rc1 ( #1503 )
2023-01-31 11:53:16 -05:00
Keith Zantow
934644232a
chore: revert GolangBinMetadata name and make analogous GolangModMetadata ( #1458 )
2023-01-13 16:46:12 -05:00
Christopher Angelo Phillips
3690f979b3
feat: update spdx format model to produce valid spdx json documents ( #1418 )
2022-12-21 15:56:03 -05:00
Keith Zantow
7b08608adb
feat: add h1digest when scanning go.mod ( #1405 )
...
Fixes https://github.com/anchore/syft/issues/1277
2022-12-20 02:18:35 +00:00
Christopher Angelo Phillips
0f1e8fca14
bug: spdx checksum empty array; allow syft to generate SHA1 for spdx-tag-value documents ( #1404 )
2022-12-20 00:10:35 +00:00
Keith Zantow
098e61dcc8
fix: sort relationships in SPDX output ( #1350 )
2022-11-21 09:26:24 -05:00
Christopher Angelo Phillips
da4b2df576
fix: spdx java checksum correctness ( #1348 )
2022-11-18 13:42:55 -05:00
Alex Goodman and Keith Zantow
9afc9231c0
Add spdx relationship encoding for dependencies ( #1342 )
...
Co-authored-by: Keith Zantow <kzantow@gmail.com >
2022-11-18 09:40:10 -05:00
Keith Zantow
42cb0a47a4
feat: SPDX 2.3 support ( #1311 )
2022-11-18 08:54:39 -05:00
Alex Goodman
Christopher Angelo Phillips
Keith Zantow
Avi Deitcher