Christopher Angelo Phillips and Alex Goodman
13ffeeb3d0
feat: combine go module file and go source discovery into single cataloger ( #4127 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-08-26 19:35:44 +00:00
Simeon Stoykov and Christopher Phillips
a433045d51
feat: basic Conda ecosystem support ( #4002 )
...
----------------------------------------------------------------
Signed-off-by: Simeon Stoykov <simeon.stoykov@quantco.com >
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-08-19 22:37:27 -04:00
Alex Goodman
f0a990b85f
chore: add source completion tester ( #4077 )
...
* add source completion tester
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add missing t.Helper calls
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-07-23 13:49:47 +00:00
c491dab35b
feat: add parsing for uv.lock ( #3763 )
...
* feat: add parsing for uv.lock (#3268 )
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* Still no tests, but much more complete
Next up: start writing tests! :)
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore: finish out functionality and write tests
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* Merge the .NET deps.json and PE binary catalogers (#3563 )
* add combined deps.json + pe binary cataloger
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* deprecate pe and deps standalone catalogers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* parse resource names + add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix integration and CLI tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add some helpful code comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* allow for dropping Dep packages that are missing DLLs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* migrate json schema changes to 24
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* keep application configuration
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* correct config help
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] detect claims of dlls within deps.json
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add assembly repack detection
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* .net package count is lower due to dll claim requirement
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* better .NET cpe generation (#3764 )
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* Better represent .NET runtime packages (#3768 )
* clean up .NET runtime packages
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add runtime relationships
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove runtime references from binary package name
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore(deps): update CPE dictionary index (#3769 )
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore(deps): bump modernc.org/sqlite from 1.36.1 to 1.37.0 (#3771 )
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.36.1 to 1.37.0.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.36.1...v1.37.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore(deps): bump 8398a7/action-slack from 3.16.2 to 3.18.0 (#3767 )
Bumps [8398a7/action-slack](https://github.com/8398a7/action-slack ) from 3.16.2 to 3.18.0.
- [Release notes](https://github.com/8398a7/action-slack/releases )
- [Commits](https://github.com/8398a7/action-slack/compare/28ba43ae48961b90635b50953d216767a6bea486...1750b5085f3ec60384090fb7c52965ef822e869e )
---
updated-dependencies:
- dependency-name: 8398a7/action-slack
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 (#3766 )
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.37.0 to 0.38.0.
- [Commits](https://github.com/golang/net/compare/v0.37.0...v0.38.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore: move/modify code for lint issues
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore: make sure private structs are not exported
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* generate json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* chore: update readme to include uv
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore: use uv as the package manager name
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
---------
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: anchore-actions-token-generator[bot] <102182147+anchore-actions-token-generator[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-17 18:26:56 +00:00
Alex Goodman
2bda086423
Add ability to scan snaps (as a source) ( #3929 )
2025-06-25 16:53:35 -04:00
Keith Zantow
71d84603c1
fix: bump stereoscope to fix symlink performance issue ( #3953 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-06-04 15:50:03 +00:00
Alex Goodman
e23ca43a83
add PE binary cataloger ( #3911 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-19 14:17:09 -04:00
Laurent Goderre and Alex Goodman
175a6719a9
Add cataloger for Dart pubspec ( #3292 )
...
* Add cataloger for Dart pubspec
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
* capture pubspec specific fields
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-13 21:51:49 +00:00
Rez Moss and Alex Goodman
12d91f47dc
Add a homebrew cataloger ( #3724 )
...
* Cataloger homebrew (#4 )
* homebrew cataloger
* uptd
* fixed test
* fixed test
* fixed tests
* fixed lint
* inc schema ver
* upt schema
* fixed integration test
* fixed integration tst
* fixed test
Signed-off-by: Rez Moss <hi@rezmoss.com >
* Update parse_homebrew_test.go
Signed-off-by: Rez Moss <hi@rezmoss.com >
* Update parse_homebrew_test.go
fixed DCO
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Rez Moss <hi@rezmoss.com >
* Update parse_homebrew_test.go
add evd anno to test
Signed-off-by: Rez Moss <hi@rezmoss.com >
* lint
Signed-off-by: Rez Moss <hi@rezmoss.com >
* fixed test
Signed-off-by: Rez Moss <hi@rezmoss.com >
* with PR refactors
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate jsonschema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* refactor homebrew parser + add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* more resiliant variable extraction
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-13 13:01:41 -04:00
Weston Steimel
de88b973f8
chore: fix some logging output ( #3884 )
...
Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>
2025-05-13 13:15:19 +01:00
Alex Goodman
59b880f26a
order locations by container layer order ( #3858 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-13 00:02:07 -04:00
James Neate and Alex Goodman
00c4a4e72a
Use package ID from decoded SBOMs when provided ( #1872 )
...
* fix: use package id from cyclonedx when provided
Signed-off-by: James Neate <jamesmneate@gmail.com >
* override package IDs from converted SBOMs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix typo
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove extractSyftID function
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: James Neate <jamesmneate@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-08 11:25:30 -04:00
Alex Goodman
7b25ea5eda
annotate hidden paths in all-layers scope ( #3855 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-06 09:50:04 -04:00
GGMU and Alex Goodman
6db60c5975
Add deep-squashed scope to annotate all layers where a package exists ( #3138 )
...
* add squash all layers resolver
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* add squash with all layers logic
Signed-off-by: tomersein <tomersein@gmail.com >
* add squash with all layers logic
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squash with all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squash with all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* adjust resolver to strictly return squash paths only
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* show all packages have locations + primary evidence
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix race condition in test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* consider access paths
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: tomersein <tomersein@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-05 14:35:57 -04:00
Laurent Goderre and Alex Goodman
529840bfc0
Add support for PHP Pear ( #2775 )
...
* Add support for PHP Pear and unify PECL with it
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove log statements
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix struct comment
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-04-30 20:16:58 +00:00
VictorHuu
09c3b7cbea
fix:Resolve ancestral symlinks correctly ( #3783 )
...
* Resolve upstream symlinks correctly
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* in case of the root directory
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* for static analysis check pass
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* add unit test cases for the symlink scenarios
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
---------
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
2025-04-30 14:47:32 -04:00
VictorHuu and Alex Goodman
9af087d213
fix: Make the fileresolver Support Prefix Match of Files ( #3820 )
...
* fix the dpkg files pattern detection
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* consider slash before the path is concatenated
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* add test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-04-24 17:38:05 +00:00
anchore-actions-token-generator[bot] and spiffcs
f11377fe30
chore(deps): update tools to latest versions ( #3775 )
...
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-04-03 17:35:26 +00:00
Alex Goodman
12f36420dd
Parse GitHub actions comments ( #3776 )
...
* add version comment parsing support to github actions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update json schema with github actions metadata
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add originator processing for github actions type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-04-03 14:46:27 +00:00
Alex Goodman
ad9928cb2a
Merge the .NET deps.json and PE binary catalogers ( #3563 )
...
* add combined deps.json + pe binary cataloger
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* deprecate pe and deps standalone catalogers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* parse resource names + add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix integration and CLI tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add some helpful code comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* allow for dropping Dep packages that are missing DLLs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* migrate json schema changes to 24
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* keep application configuration
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* correct config help
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] detect claims of dlls within deps.json
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add assembly repack detection
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* .net package count is lower due to dll claim requirement
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-03-27 14:38:16 -04:00
Keith Zantow
7ac4d91f43
chore: reformat ( #3754 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-03-21 06:13:35 -04:00
Alex Goodman
e9b24a29d7
Remove mitchellh dependencies ( #3748 )
...
* remove mitchellh dependencies
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix failing unit tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-03-20 10:19:19 -04:00
Alan Pope and Alex Goodman
5fa8e9c6e9
feat: add Debian archive (.deb) file cataloger ( #3704 )
...
* feat: add Debian archive (.deb) file cataloger
Add a cataloger that parses Debian package (.deb) archive files directly,
allowing Syft to discover packages from .deb files without requiring
them to be installed on the system. This implements issue #3315 .
Key features:
- Parse .deb AR archives to extract package metadata
- Support for gzip, xz, and zstd compressed control files
- Extract package metadata from control files
- Process file information from md5sums files
- Mark configuration files from conffiles entries
- Handle trailing slashes in archive member names
Signed-off-by: Alan Pope <alan.pope@anchore.com >
* chore: run go mod tidy to fix failing workflow
Signed-off-by: Alan Pope <alan.pope@anchore.com >
* add license processing to dpkg archive cataloger + add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update json schema with dpkg archive type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alan Pope <alan.pope@anchore.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-03-19 20:03:21 +00:00
Yoav Alon
6f70927bcc
fix(performance): reduce memory allocation in containsPath ( #3730 )
...
Signed-off-by: Yoav Alon <yoav@orca.security >
2025-03-13 14:39:57 -04:00
bffe26bcc5
feat: add support for Bitnami cataloguer ( #3341 )
...
* prototype: start bitnami cataloger
Bitnami images have spdx SBOMs at predictable paths, and Syft could more
accurately identify the software in these images by scanning those
SBOMs. Start work on this by forking the sbom-cataloger as a new
bitnami-cataloger.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* wire up bitnami cataloger to run on images by default
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* feat: add support for Bitnami cataloguer
Signed-off-by: juan131 <jariza@vmware.com >
* feat: use a better SPDX sample for unit tests
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: only report bitnami pkgs
Signed-off-by: juan131 <jariza@vmware.com >
* feat: adapt JSON schema, spdxutil and packagemetadata
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: integration tests
Signed-off-by: juan131 <jariza@vmware.com >
* feat: implement FileOwner interface
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: update json schema
Signed-off-by: juan131 <jariza@vmware.com >
* [wip] add bitnami owned files and fix binary package ownership filtering
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* feat: obtain bitnami pkg files based on SPDX relationships tree
Signed-off-by: juan131 <jariza@vmware.com >
* preserve type switches
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename bitnami entry metadata type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* restrict find main pkg logic
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add missing graalvm source info
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bugfix: integration tests
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: mod tidy
Signed-off-by: juan131 <jariza@vmware.com >
---------
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Signed-off-by: juan131 <jariza@vmware.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-02-18 09:07:47 -05:00
Keith Zantow
2328b20082
fix: reduce warn levels to debug for non-actionable errors ( #3645 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-02-07 13:22:55 -05:00
c10e904c28
feat(cataloger): add a terraform provider cataloger ( #3378 )
...
* feat(cataloger): add a terraform provider cataloger
* chore: bump schema from 16.0.19 -> 16.0.20
------
Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-01-21 14:44:54 -05:00
Bert Coppens and Alex Goodman
512319337f
feat: add cataloger for NuGet packages ( #3484 )
...
* add cataloger for dotnet packages.lock.json files
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* add entry for dotnet packages.lock files
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* add unit test for dotnet packages.lock cataloger
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* add test for faulty packages.lock.json file
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* add missing name metadata
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* ensure package appears with version
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* add example of conflicting dependencies
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump json schema and fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* move section
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-01-16 14:57:17 -05:00
Alex Goodman
340b5e17f0
Add relationships for rust audit binary packages ( #3500 )
...
* add rust audit binary pkg relationships
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-12-06 09:23:18 -05:00
Adam McClenaghan
21df38798e
Use file indexer directly when scanning with file source ( #3333 )
...
* Use file indexer when scanning with file source
Prevents filesystem walks when scanning a single file, to
optimise memory & scan times in case the scanned file
lives in a directory containing many files.
Signed-off-by: adammcclenaghan <adam@mcclenaghan.co.uk >
* Create filetree resolver
Shared behaviour for resolving indexed filetrees.
Signed-off-by: adammcclenaghan <adam@mcclenaghan.co.uk >
---------
Signed-off-by: adammcclenaghan <adam@mcclenaghan.co.uk >
2024-11-22 11:53:53 -05:00
Christian Dupuis
92c1ddec5a
fix: correct excluded mount point comparison to file paths ( #3269 )
...
Signed-off-by: Christian Dupuis <cd@docker.com >
2024-09-24 17:05:16 -04:00
Alex Goodman
01de99b253
Add JVM cataloger ( #3217 )
...
* add jvm cataloger
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* simplify version selection
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* CPEs from JVM cataloger should be declared
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* ensure package overlap is enabled for sensitive use cases
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* more permissive glob
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-09-23 17:21:38 -04:00
Laurent Goderre
9c2799e379
Add the Ocaml ecosystem ( #3112 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-09-10 10:35:18 -04:00
anchore-actions-token-generator[bot]
dad253785e
chore(deps): update tools to latest versions ( #3144 )
2024-08-23 14:42:12 -04:00
anchore-actions-token-generator[bot] and spiffcs
4b7ae0ed3b
chore(deps): update tools to latest versions ( #3121 )
...
* chore(deps): update tools to latest versions
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore: update code to reflect new linter settings for error messages
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-08-16 17:56:36 +00:00
Laurent Goderre
92d63df6f5
Added the SWI Prolog (swipl) ecosystem ( #3076 )
...
* Add binary classifier for swipl
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
* Added cataloger for SWI Prolog Pack packages
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
---------
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-07-31 16:13:26 -04:00
William Murphy and Alex Goodman
557ad73ee6
fix: only skip tmpfs mounts for some paths ( #2918 )
...
* fix: only skip tmpfs mounts for some paths
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* refactor and add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add regression test for archive processing
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump to golang 1.22
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove rule 1 and add more tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Will Murphy <will.murphy@anchore.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-06-04 15:21:45 -04:00
Laurent Goderre
b51252dbdb
feat: Add Lua cataloger ( #2613 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-05-24 16:56:34 -04:00
William Murphy
b2ca5fbf89
fix Windows file paths in local go mod cache ( #2654 )
...
Previously, the file resolver was created from incorrect calls
(path.Join instead of filepath.Join) which resulted Go license searches
always missing on Windows. Use filepath.* functions when initializing
the Go config, and when the unindexed file resolver is being created.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2024-05-09 13:08:58 -04:00
William Murphy
d3310a1830
fix: re-use embedded union reader if possible ( #2814 )
...
* fix: re-use embedded union reader if possible
Previously, because file.LocationReadCloser embeds a ReadCloser that
might be a UnionReader, but doesn't implement the interface itself, the
type assertion would fall and Syft would fall back to io.ReadAll to
enable seeking on the underlying reader, resulting in a potentially
large extra allocation.
Instead, check whether the passed ReadCloser is a
file.LocationReadCloser, and if so, try to use the embedded ReadCloser
as a UnionReader.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* lint fix
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* Assert that underlying reader is returned
Signed-off-by: Will Murphy <will.murphy@anchore.com >
---------
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2024-04-26 10:21:38 -04:00
Laurent Goderre
e0233625cb
feat: cataloger for PHP Pecl and PEAR packages ( #2604 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-04-02 11:55:56 -04:00
6a2517b5d2
Add ELF binary package cataloger ( #2396 )
...
* feat Adds Elf package catalogger
Signed-off-by: Brian Ebarb <ebarb.brian@gmail.com >
* Add test fixtures for elf package
Signed-off-by: Colleen Divers <colleen.divers@gmail.com >
* bump JSON schema to v16.0.6 + expand test fixtures
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* less verbose logging
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove dead test code
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove unreleated swift change
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Brian Ebarb <ebarb.brian@gmail.com >
Signed-off-by: Colleen Divers <colleen.divers@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Colleen Divers <colleen.divers@gmail.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-03-14 11:16:03 -04:00
Alex Goodman
48e5672a87
Consider filesystem types for mount points when ignoring system paths ( #2675 )
...
* consider fs types for mount points when ignoring system paths
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address feedback
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-28 15:37:17 -05:00
Keith Zantow
a978966cad
feat: add --from flag, refactor source providers ( #2610 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-02-27 16:44:37 -05:00
Alex Goodman
65cadda486
Survive indexing dead symlinks ( #2645 )
...
* survive indexing branches that start with a bad symlink
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add log statement
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-14 21:06:22 +00:00
Alex Goodman
a909e3cec9
fix considering base path when ignoring known bad unix paths ( #2644 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-14 15:57:38 -05:00
Alexandr Hacicheant and Alex Goodman
96ee2db875
feat: Add Wordpress cataloger ( #2218 )
...
* Closes #1911 Wordpress cataloger
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed a few unit tests and static analizer notices
Signed-off-by: disc <a.hacicheant@gmail.com >
* Updated `README.md`
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed `golangci-lint` notices
Added integration test for `wordpress-plugin`
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed `gosimports` notices
Signed-off-by: disc <a.hacicheant@gmail.com >
* Updated `json schema` version
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed CLI tests, increased expected package count
Signed-off-by: disc <a.hacicheant@gmail.com >
* Read first 4Kb of a plugins file's content
Signed-off-by: disc <a.hacicheant@gmail.com >
* replace JSON schema version
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* change wording on source info for wordpress packages
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* Minor changes after a huge refactoring
Signed-off-by: disc <a.hacicheant@gmail.com >
* Removed unused files
Signed-off-by: disc <a.hacicheant@gmail.com >
* Updated schema
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed integration tests
Signed-off-by: disc <a.hacicheant@gmail.com >
* fix integration tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* Renamed `metadata.Name` to `metadata.PluginInstallDirectory`
Signed-off-by: disc <a.hacicheant@gmail.com >
* rename fields to be compliant with json conventions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: disc <a.hacicheant@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-14 16:03:25 +00:00
17ef243956
chore(deps): update tools to latest versions ( #2616 )
...
* chore(deps): update tools to latest versions
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* fix: update to new linter rules
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2024-02-14 14:59:49 +00:00
Alex Goodman
25ae7bf55f
fix getting union reader for sif images ( #2631 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-13 15:12:31 +00:00
Alex Goodman and mikey strauss
c61f59e7b7
Finalize Conan v2 support ( #2587 )
...
* Add support for conan lock v2 (#2461 )
* conan lock 2.x requires field support
Signed-off-by: houdini91 <mdstrauss91@gmail.com >
* PR review, struct renaming
Signed-off-by: houdini91 <mdstrauss91@gmail.com >
---------
Signed-off-by: houdini91 <mdstrauss91@gmail.com >
* decompose conanlock parser + add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: houdini91 <mdstrauss91@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: mikey strauss <mdstrauss91@gmail.com >
2024-02-07 08:24:02 -05:00
Christopher Angelo PhillipsandAlex Goodman
Simeon StoykovandChristopher Phillips
Keith Zantow
Laurent GoderreandAlex Goodman
Rez MossandAlex Goodman
Weston Steimel
James NeateandAlex Goodman
GGMUandAlex Goodman
VictorHuu
Alan PopeandAlex Goodman
Yoav Alon
Bert CoppensandAlex Goodman
Adam McClenaghan
Christian Dupuis
William MurphyandAlex Goodman
Alexandr HacicheantandAlex Goodman
