* add marking package relations by file ownership
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* correct json schema version; ensure fileOwners dont return dups; pin test pkg versions
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* extract package relationships into separate section
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* pull in client-go features for import of PackageRelationships
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* move unit test for ownership by files relationship further down
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* rename relationship to "ownership-by-file-overlap"
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* bump stereoscope to pull in content API refactors
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* incorporate symlink fixes
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* with filetree.File() adjustments
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* regress all-layers scope to not include dead-links + default tests to squashed scope
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* restore all layers resolver glob behavior (custom + lazy link resolution)
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* incorporate filetree link resolution options and restore no-follow dead link option for resolvers
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* removed path from lower-level FileTree.File() calls
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* bump stereoscope to pull in latest link resolution fixes
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* bump doublestar to v2 for directory resolver
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* add support to upload results to enterprise
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* add package sbom upload
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* add dockerfile support
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* add manifest, index, and dockerfile import functions
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* schema version to json output + enhance json schema generation
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* modify package SBOM shape to be entire syft document + add etui updates
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* add import image config and manifest support
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* add config options for import to enterprise
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* incorporate final stereoscope and client-go deps
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* Add support for macOS signing and notarization
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
* Use Docker to run the changelog generator locally
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
* Adds java and npm package comparison
* Adds probable matching of extra packages syft found and missing packages that syft did not find (but inline did). This way there is a section of output that fuzzy-matches the package names to get a better sense of "real" problems (actual missing packages) vs slightly mismatched metadata during troubleshooting.
* Adds a set or probable missing packages to the report based on the probable matches (again, to aid in troubleshooting)
* Fixes image reference clean function to support references with registries
* Only shows metadata differences when the package was found by both inline and syft
* Splits the inline-compare code into more manageable pieces
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* Remove and update TODOs
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
* Update TODO with link
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
* Expand matching of requirements.txt file to include any prefixes or suffixes
Signed-off-by: Samuel Dacanay <sam.dacanay@anchore.com>
* Add some test cases to integration test (ensure syft can pick up multiple requirements files)
Signed-off-by: Samuel Dacanay <sam.dacanay@anchore.com>
* Run lint-fix
Signed-off-by: Samuel Dacanay <sam.dacanay@anchore.com>
* add package URL support to the CycloneDX presenter
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* wrap license tags with licenses
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* ensure acceptance tests fail when results are piped
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* fix spelling in inline-compare python script
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* add inline-compare as acceptance test
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* add additional RPM metadata
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* add comments and doc strings to the compare-* make targets
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
* Minor cleanup
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
* Update pkg Type definition to string
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
* Implement poetry.lock parsing
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
* Address CI issues
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
* Integrate Alex's changes
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
