oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-01 15:06:36 +01:00
Code Issues Packages Projects Releases Wiki Activity
992 Commits 65 Branches 273 Tags
1e3ffbebb9de2dccadd76b2d283c2f64fb3e40ea
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Alex Goodmanandramanan-ravi ea611dab5f Add catalogers configuration (#1038) 
* Option to enable specific language or ecosystem cataloger

Signed-off-by: ramanan-ravi <ramanan@deepfence.io>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* Disable dotnet cataloger

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* Option to enable specific language or ecosystem cataloger

Signed-off-by: Ramanan Ravikumar <ramanan@deepfence.io>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* rename "enable-cataloger" option to "catalogers"

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add cli test for --catalogers option

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update readme with latest cataloger names

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* enable dotnet cataloger

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix cataloger imports

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update readme with alpmdb cataloger config example

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Co-authored-by: ramanan-ravi <ramanan@deepfence.io>
 2022-06-21 13:06:25 +00:00
Alex Goodman d2f053bc71 unblock timeout for power-user select CLI tests (#985) 
* update to use shared secretsFixture to prevent race

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-05-05 15:12:11 +00:00
Alex Goodman 172ecc0d77 Preserve syft IDs on SBOM decode (#963) 2022-04-18 18:10:55 +00:00
Alex Goodman e415bb21e7 Update write permissions and log into ghcr.io for release (#942) 2022-04-06 21:15:55 +00:00
Alex Goodman 748cfbf006 Retry auth URL lookup without docker credentialhelper workaround (#939) 2022-04-06 16:27:13 +00:00
Alex Goodman 68b7ad9770 Additionally publish docker images to GHCR (#934) 2022-04-01 11:30:21 -04:00
Alex Goodman f24bbc1838 Deduplicate packages across multiple container image layers (#930) 2022-03-31 15:45:51 -04:00
Alex Goodman f157d7a862 Pull from DockerHub fails for public images when using SSO (#928) 2022-03-30 17:32:49 +00:00
Alex Goodman cc2c0e57a0 bump strset version to fix 386 builds (#911) 2022-03-23 14:34:54 -04:00
Alex Goodman 5253da4b36 Rollback referencing docker config items (#912) 2022-03-23 18:33:41 +00:00
Alex Goodman cffcaf5984 Improve docker config support (#906) 2022-03-22 11:02:54 -04:00
Alex Goodman 7f9edf346a Bump golangci-lint to 1.45.0 (#909) 2022-03-22 11:02:36 -04:00
Alex Goodman 03e193e577 Add platform option to the README (#889) 2022-03-21 12:02:15 -04:00
Alex Goodman 069aa68b63 Fix image cleanup when there is an error (#905) 2022-03-21 14:48:11 +00:00
Alex Goodman 2946813a74 RPM Epoch should be optional in the json schema (#880) 2022-03-09 14:51:43 -05:00
Alex Goodman 9d9669e62f Add artifacthub owner (#876) 2022-03-09 12:50:31 +00:00
Alex Goodman 07d3c9af52 Fix file creation for output options (#875) 2022-03-08 15:37:28 +00:00
Alex GoodmanandChristopher Phillips 5123f073c7 Update containerd via stereoscope (#870) 
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-03-07 17:37:20 +00:00
Alex Goodman 991af0d857 Include root path in directory resolve index (#869) 2022-03-07 11:34:16 -05:00
Alex Goodman a86dd3704e Add platform selection (#866) 2022-03-04 22:41:38 +00:00
Alex Goodman 4af32c5bee Migrate format definitions to sbom package (#864) 2022-03-04 17:22:40 -05:00
Alex Goodman 635904fcb6 Reduce PR check failures (#858) 2022-03-02 17:51:37 +00:00
Alex Goodman d2f28e0eb1 Restore single goreleaser file (#853) 2022-02-28 14:46:41 +00:00
Alex Goodman 1d1a7de314 Fix goreleaser generated config path (#852) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-26 07:30:38 -05:00
Alex Goodman 24cd39089a Share import mac code signing certificate steps for release (#851) 2022-02-25 20:07:03 -05:00
Alex Goodman c89131bcf3 Bump release timeout (#848) 2022-02-25 16:32:57 +00:00
Alex Goodman 99bb93d0fe Resolve symlinks when fetching file contents (#782) 2022-02-24 10:01:59 -05:00
Alex Goodman 7eea98fcc5 Allow for CPE strings that can later be sanitized (#844) 2022-02-23 15:18:12 -05:00
Alex Goodman 738b3b60a5 Add exception for handlebars java package to generate nodejs CPE (#837) 2022-02-22 17:29:28 -05:00
Alex Goodman 55c7f3d1e7 Upgrade install.sh to support installations for previous versions (#830) 2022-02-15 22:23:11 +00:00
Alex Goodman 51c6eb30f5 bump stereoscope to include functional options (#823) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-14 20:40:51 -05:00
Alex Goodman 220f3a24fd deduplicate SPDX tag-value package IDs (#813) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-10 21:18:00 +00:00
Alex Goodman ca032434b3 Add pURL generation for java packages + fix NPM pURL generation (#812) 
* enhance pURL generation for java packages

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* optionally split out npm namespaces for pURL generation

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* nit updates

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-10 13:46:38 -05:00
Alex Goodman 8f292958a6 set version makefile var for updating version file (#808) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-09 08:25:31 -05:00
Alex Goodman ac024f94a4 encapsulate showing the signing log with failing (#807) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-08 01:26:34 +00:00
Alex Goodman 0ed2842123 serialize notarization (#806) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-07 23:47:47 +00:00
Alex Goodman b78c90d018 use parent dir for notarization zip (#804) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-07 22:50:48 +00:00
Alex Goodman 2c62651c82 run signing as post-build step (#803) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-07 16:55:15 -05:00
Alex Goodman 5519a25035 dont add signing artifact (#802) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-07 17:03:09 +00:00
Alex Goodman 950ad681a0 Stabilize CI behavior (#796) 
* reduce parallelism of builds and increase install.sh test setup buffer

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* change logging mechanism for signing

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* restore automatic parallelism determination for goreleaser

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* rm logging goreleaser version

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-07 07:55:11 -08:00
Alex Goodman 37251f6179 Fix intermittent slow CLI tests (#797) 
* use a port that is porbably not in use

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* template cli test args

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-06 15:53:55 +00:00
Alex Goodman e474b2f23c docker auth must occur after setting up prod keychain (#795) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-05 15:23:05 +00:00
Alex Goodman e7bef5e511 split signing setup into pre-release hook (#794) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-04 16:49:42 -05:00
Alex Goodman e4ac7700dd pass notarize arg, not original archive (#793) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-04 19:44:37 +00:00
Alex Goodman d3469801fc repackage all file in notarization temp dir (not from tar output) (#792) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-04 19:04:15 +00:00
Alex Goodman 3f50bb8fa7 tput requires explicit terminal type in CI (#791) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-04 18:23:30 +00:00
Alex Goodman 341288ba29 Normalize snapshot and release artifacts (#789) 
* refactor signing steps in release/snapshot workflows

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* show signing logs on snapshot or release failure

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update install.sh + tests to account for new goreleaser changes

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update cli tests to account for new goreleaser build names

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix acceptance test to use new snapshot bin path

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add notarization

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* address review comments

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-04 12:41:37 -05:00
Alex Goodman f38b0b7256 Refactor install.sh (#765) 
* [wip] get assets based on gh api

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* put install.sh download_asset fn under test

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* put install.sh install_asset fn under test

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* use zip for darwin installs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix install.sh negative test cases

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* allow errors to propagate in install.sh

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove exit on error from install.sh tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add more docs around install.sh helpers

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add integration tests for install.sh

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add install.sh testing to pipeline

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add install test cache to CI

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* make colors globally available

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* test download against github release

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* always test release-based install against latest release

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* use better install.sh test names

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-01 16:58:47 -05:00
Alex Goodman d7a23e4bb2 Extract language and package type from pURLs on SBOM decode (#777) 
* add language detection from pURLs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add package type detection from pURLs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add cargo and npm pURL support

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix npm tests and linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-01-27 09:35:16 -05:00
Alex Goodman 6f0fad7ffd encode upstream qualifier on os package pURLs (#769) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-01-25 09:55:56 -05:00
Alex Goodman 1350d6c5bf Improve package URL support (#754) 
* rename npm metadata struct

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* improve os package URLs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* improve language package URLs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* wire up composer pURL method

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-01-19 22:30:29 +00:00
Alex Goodman 829e500aa9 Add additional PHP metadata (#753) 
* add php related metadata

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* enable decoding of php metadata for syftjson format

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add php metadata to json schema

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-01-19 11:42:16 -05:00
Alex Goodman 86c3c1c531 Start developer documentation (#746) 
* draft outline for developing docs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update outline

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* list testing dependencies

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix header indention

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix title

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-01-14 06:17:25 -05:00
Alex Goodman 706f291679 Replace distro type (#742) 
* remove strong distro type

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* bump json schema to v3 (breaking distro shape)

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* allow for v2 decoding of distro idLikes field in v3 json decoder

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix casing in simple linux release name

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* use discovered name as pretty name in simple linux release

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-01-12 12:13:42 -05:00
Alex Goodman 38c4b17847 Add support for searching for jars within archives (#734) 
* add support for searching jars within archives

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add package cataloger config options

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* address review comments + factor out safeCopy helper

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update config docs regarding package archive search options

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* show that unindexed archive cataloging defaults to false

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove lies about -s

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* address review comments

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update search archive note about java

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-01-06 21:40:51 +00:00
Alex Goodman a18fbacae7 Revert "bump goreleaser to v1.2 (#720)" (#731) 
This reverts commit 8535ee5b2e.

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2022-01-03 15:19:00 +00:00
Alex Goodman 7f8cb0bd80 remove unstable CLI test (bad binaries) (#721) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-12-22 15:55:37 -05:00
Alex Goodman 8535ee5b2e bump goreleaser to v1.2 (#720) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-12-22 20:37:48 +00:00
Alex Goodman a27907659d Performance improvements around package ID (#698) 
* set package ID in catalogers and improve hashing performance

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update setting ID + tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-12-16 08:55:53 -05:00
Alex Goodman 727b84ce0d prefer warning over erroring out when parsing java manifests (#688) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-12-14 12:17:05 -05:00
Alex Goodman 3d8c16649d Fix M1 install (#686) 
* M1 install.sh script should use zip

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add arm64 binary extraction

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-12-14 15:54:46 +00:00
Alex Goodman ab9fe53ff2 Recover from panics from the stdlib when cataloging malformed binaries (#663) 
* recover from panics in stdlib binary parsing

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add CLI test to cover regression case

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-12-10 11:49:50 -05:00
Alex Goodman da0b17b719 Add cataloging of macho multi-architecture binaries (#657) 
* add cataloging within universal binaries

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update json test fixtures

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add comments + correct 32 bit multi arch magic check

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-12-08 16:25:24 -05:00
Alex Goodman c7752f0f6c fix panic from reading nonexistent reader (#658) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-12-08 20:28:47 +00:00
Alex Goodman 22c4b275e7 bump containerd and image-spec (#654) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-12-03 16:12:43 +00:00
Alex Goodman ffccfc8f3f update stereoscope to bump docker dependency (#648) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-12-02 11:18:00 -05:00
Alex Goodman 5aec918683 reduce relationship noise (#653) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-12-02 09:51:18 -05:00
Alex Goodman da62387545 Fix SPDX namespace value (#649) 
* fix spdx namespace and add scheme range assertions

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* validate SPDX document name from source metadata

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* comment why namespace tests only check prefix

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-12-02 14:10:40 +00:00
Alex Goodman 21d1738b27 fix directory content fetching (#651) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-12-02 09:02:54 -05:00
Alex Goodman fe616acd98 directory resolver should account for the proc cwd relative to the root path (#644) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-30 15:34:37 -05:00
Alex Goodman 00206233e6 use smaller jotframe event buffer (#647) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-30 11:23:16 -05:00
Alex Goodman bd9007fc0e Migrate SPDX-JSON relationships to SBOM model (#634) 
* remove power-user document shape

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add power-user specific fields to syft-json format

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* port remaining spdx-json relationships to sbom model

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add coordinate set

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add SBOM file path helper

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* use internal mimetype helper in go binary cataloger

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add new package-of relationship

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update json schema to v2

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* replace power-user presenter with syft-json format

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix tests and linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove "package-of" relationship (in favor of "contains")

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add tests for spdx22json format encoding enhancements

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update TODO and log entries

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* introduce sbom.Descriptor

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-23 14:54:17 -05:00
Alex Goodman e3b34813d7 ignore partybus unsubscribe errors (#641) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-22 16:07:55 -05:00
Alex Goodman d76c868481 Catalog archive contents for single-file input (#637) 
* add first-level archive processing when input is a file

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add license exception for github.com/xi2/xz

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* always return cleanup function

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* change source.NewFromFile log entry to warn

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* ensure file source always has cleanup function

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* ensure we are always preferring the unarchive cleanup function for source

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-19 14:16:25 +00:00
Alex GoodmanandDan Luhring e38cde35ed Introduce minimal source coordinates (#623) 
* split source.Location and create source.Coordinates for minimal path addressing

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* move coordinates into separate file

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* Update syft/source/coordinates.go

Co-authored-by: Dan Luhring <luhring@users.noreply.github.com>
 2021-11-18 18:13:22 +00:00
Alex Goodman 9090c3a772 bump stereoscope, docker, and GGCR (#633) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-16 19:43:46 +00:00
Alex Goodman ef627d82ef Introduce relationships as first-class objects (#607) 
* migrate pkg.ID and pkg.Relationship to artifact package

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* return relationships from tasks

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix more tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add artifact.Identifiable by Identity() method

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove catalog ID assignment

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* adjust spdx helpers to use copy of packages

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* stabilize package ID relative to encode-decode format cycles

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* rename Identity() to ID()

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* use zero value for nils in ID generation

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* enable source.Location to be identifiable

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* hoist up package relationship discovery to analysis stage

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update ownership-by-file-overlap relationship description

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add test reminders to put new relationships under test

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* adjust PHP composer.lock parser function to return relationships

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-16 14:14:13 -05:00
Alex Goodman e28b7b53b0 bump chronicle to v0.3.0 (#627) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-13 18:56:25 -08:00
Alex Goodman 9c27fa7b0b use sbom.SBOM in ImportConfig (#621) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-08 18:39:06 -05:00
Alex GoodmanandChristopher Angelo Phillips bb0f35bac4 Introduce a single SBOM document (#606) 
* [wip] single sbom doc

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix more tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update cli tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove scope in import path

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* swap SPDX tag-value formatter to single sbom document

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* bust CLI cache

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update fixture to byte diff

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* byte for byte

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* bust the cache

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* who needs cache

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* add jar for testing

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* no more bit flips

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* update apk with the delta for image and directory cases

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* restore cache workflow

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

Co-authored-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-11-05 10:05:49 -04:00
Alex Goodman 23a67dd729 document file scheme (#613) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-02 19:47:25 -04:00
Alex Goodman 8ec3f1d102 Use anchore fork of go-presenter (#611) 
* use anchore fork of go-presenter

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* drop coverage threshold

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-02 18:09:26 +00:00
Alex Goodman ecab44bba1 Add SPDX tag-value format object (#605) 
* add new spdx tag-value format

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove public presenter package

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-02 13:45:34 -04:00
Alex GoodmanandChristopher Angelo Phillips 484284706c Use named pipe bit when checking for piped input (#603) 
* use named pipe bit when checking for piped input

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Co-authored-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-11-02 16:41:02 +00:00
Alex Goodman 3ac95ac4f6 Allow for cataloging a single file (#608) 
* allow for cataloging a single file

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* use all catalogers for file schemes

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-02 12:09:06 -04:00
Alex Goodman 358b3a2cf8 port text presenter to a format object (#604) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-29 11:31:15 -04:00
Alex Goodman 9aca23f766 Add SPDX JSON format object (#584) 
* remove existing spdxjson presenter + helpers

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add new spdx22json format

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add common sdpxhelpers (migrated)

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* use new common spdx helpers

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* wire up new spdx22json format object

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove lossless syft-specific property bags

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove spdxjson decoder and validator

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add nil checks in spdx test helpers

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove empty default case

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* use explicit golden snapshot

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-29 14:55:20 +00:00
Alex Goodman 4a2d1d7225 Port cyclonedx presenter to format object (#589) 
* add new cyclonedx format object

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove cyclonedx presenter

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove cyclonedx presenter call

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove dependence on golden images for format tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* wire up new formt + rename all-presenters ref

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add CLI test to ensure that all formats can be expressed as report output

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add cyclonedx version and encoding format to package name

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* optionally preserve format snapshot images

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix linting + text unit tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-29 10:17:03 -04:00
Alex Goodman ff5fa2dc1d pull in space suffix fix (#587) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-25 10:14:17 -04:00
Alex Goodman fb588ff500 replace table presenter with format object (#586) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-24 08:09:27 -04:00
Alex Goodman d5b425e1b5 force exiting the etui upon worker error (#583) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-22 13:44:50 -04:00
Alex Goodman 89242e6ed3 bump chronicle to v0.2.0-beta (#581) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-21 18:34:17 +00:00
Alex Goodman 4bf08e6b6d swap out the changelog generator for chronicle tool (#580) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-21 13:37:13 -04:00
Alex Goodman 87ce9fff06 swap go binary parsing warning logging entry (#579) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-21 17:03:07 +00:00
Alex Goodman 560b05c2c9 Introduce new format pattern + port json processing (#550) 
* add new format pattern

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add syftjson format

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add internal formats helper

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add SBOM encode/decode to lib API

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove json presenter + update presenter tests to use common utils

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove presenter format enum type + add formats shim in presenter helper

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add MustCPE helper for tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update usage of format enum

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add test fixtures for encode/decode tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix integration test

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* migrate format detection to use reader

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* address review comments

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-20 21:36:34 +00:00
Alex Goodman 5e315c0f17 Disable ETUI for piped input (#571) 
* fixed piped input

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* allow pipedinput helper to raise an error

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* factor out verbosity check to function

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-20 12:40:52 -04:00
Alex Goodman 6f3fa494d7 Show help text when no args are given (#573) 
* show help text when no args are given

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* repurpose the input args validation function

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* ensure app does not check for update in cli tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-20 09:51:05 -04:00
Alex GoodmanandChristopher Angelo Phillips a82463574b Rollback goreleaser version (#570) 
* rollback goreleaser version

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update go sum

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

Co-authored-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-10-19 12:01:51 -04:00
Alex Goodman cbdb72ea22 remove unnecessary codeql checkout from second parent commit (#567) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-18 13:31:19 -04:00
Alex Goodman 05ac3f1eff split application configuration parsing to multiple methods (#532) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-06 09:48:53 -04:00