oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-02 07:26:34 +01:00
Code Issues Packages Projects Releases Wiki Activity
2,931 Commits 65 Branches 273 Tags
2d8e337d3469712c7d92770792f0117ad82c4ad3
Commit Graph
133 Commits
Author SHA1 Message Date
n-bes 170c4c41f4 use go.yaml.in/yaml (#4157) 
Signed-off-by: Nikita Besperstov <n.bes@pm.me>
 2025-08-26 11:24:23 -04:00
Alan Pope ada74a8121 Feature: Add ffmpeg binary cataloger (#3994) 
* Add ffmpeg binary cataloger

Signed-off-by: Alan Pope <alan.pope@anchore.com>

* add linux-amd64 snippet and test

Signed-off-by: Alan Pope <alan.pope@anchore.com>

* Widen scope of regex to two digit version numbers

Signed-off-by: Alan Pope <alan.pope@anchore.com>

* Add full test fixtures for ffmpeg

Signed-off-by: Alan Pope <alan.pope@anchore.com>

---------

Signed-off-by: Alan Pope <alan.pope@anchore.com>
 2025-08-25 07:50:04 -04:00
honigbot 80e61175ad fix: support multiple letters in openssl patch version (#4106) 
Signed-off-by: honigbot <thesoftbear@gmail.com>
 2025-08-12 10:30:41 -04:00
Keith Zantow 9f956dca8f fix: closed reader during java binary detection (#4129) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-08-12 08:58:28 -04:00
Will MurphyandKeith Zantow 594b309cdf feat: add binary classifier for hashicorp vault (#4121) 
* add binary classifier for hashicorp vault

The Go Binary Cataloger isn't able to parse the version out of the
binary shipped in the DockerHub images of hashicorp/vault because the
version of the main module isn't set in the binary. Therefore, add a
binary classifier cataloger for this binary.

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

* chore: add test fixtures, update vault

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: set binary classifier package type based on PURL

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: use github.com/hashicorp/vault as package name

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: update tests

Signed-off-by: Keith Zantow <kzantow@gmail.com>

---------

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
 2025-08-08 13:26:15 -04:00
Keith Zantow 48bf81cf7f fix: align binary java detection with jvm cataloger + support IBM (#4046) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-07-22 12:06:32 -04:00
Alex Goodman e23ca43a83 add PE binary cataloger (#3911) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-19 14:17:09 -04:00
Laurent GoderreandAlex Goodman a8e5b25632 Add PHP interpreter + extensions cataloger (#2585) 
* Add PHP extensions binary classifiers

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>

* [wip] add php extensions cataloger

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix linting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* find interpreters + extension

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* internalize binary cataloger utilities

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* default to linux/amd64 for test fixtures

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-15 08:22:50 -04:00
Christopher Angelo PhillipsandAlex Goodman f77d503892 detect license ID from full text when incidentally provided as a value (#3876) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-13 16:37:18 -04:00
Oleksandr Vodotiiets 78ef2cf53b fix: Improve detection of erlang binary in alpine Linux (#3839) 
Signed-off-by: Oleksandr Vodotiiets <alex.vodotiiets@gmail.com>
Signed-off-by: Oleksandr Vodotiiets <61548316+avodotiiets@users.noreply.github.com>
 2025-04-30 18:50:12 +00:00
VictorHuu fa599547a3 fix the fluent-bit regex detection pattern (#3817) 
Signed-off-by: Yuntao Hu <victorhu493@gmail.com>
 2025-04-25 11:50:45 -04:00
Stijn Taelemans df11561929 Support detection of Chrome binaries (#3136) 
* test: add test cases

Signed-off-by: Stijn Taelemans <taelemansst@gmail.com>

* feat: add classifier for chrome

Signed-off-by: Stijn Taelemans <taelemansst@gmail.com>

---------

Signed-off-by: Stijn Taelemans <taelemansst@gmail.com>
 2025-04-21 16:37:15 -04:00
VictorHuu ab570497b0 fix:allow golang tip image detection regex pattern (#3757) 
* Modify the Regex version matcher for golang in the binary classifiers to make it compatible with golang tip images

Signed-off-by: Victor Hu <victorhu493@gmail.com>
Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* Preliminary fix the regex matching for golang tip image and add the corresponding unit tests

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* consider VERSION.cache when it comes to golang tip images

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* consider VERSION.cache when it comes to golang tip images

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

---------

Signed-off-by: Victor Hu <victorhu493@gmail.com>
Signed-off-by: Yuntao Hu <victorhu493@gmail.com>
 2025-04-21 14:06:52 -04:00
Alan Pope c687b7bfa5 fix: improve fluent-bit binary detection regex pattern (#3701) 
* fix: improve fluent-bit binary detection regex pattern

This fixes issue #3133 by updating the regex pattern for fluent-bit binary detection
to better handle ANSI escape sequences and multiple null bytes between the version
string and "Fluent Bit" text. The change also makes the %s format specifier optional,
supporting all variations in fluent-bit binary signatures.

Signed-off-by: Alan Pope <alan.pope@anchore.com>

* test: add fluent-bit 1.7.0-dev-3 test fixture for issue #3133

Signed-off-by: Alan Pope <alan.pope@anchore.com>

---------

Signed-off-by: Alan Pope <alan.pope@anchore.com>
 2025-03-07 14:56:37 +00:00
Christopher Angelo Phillips 8198a706d6 chore: bump packageurl-go with new parsing rules (#3596) 
* chore: bump packageurl-go with new parsing rules
* test: update expectedPURL in unit tests to match new % encoding
---------

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-01-17 16:20:14 -05:00
Alex Goodman cbce129bb9 Use reader when scanning for package versions over reading entire binary into memory (#3558) 
* use streaming readers

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* replace redis search patterns

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address PR feedback

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-01-02 22:12:37 +00:00
witchcraze 2118295f19 fix: dart classifier for 2.x and ARM (#3475) 
Signed-off-by: witchcraze <witchcraze@gmail.com>
 2024-11-22 13:05:09 -05:00
witchcraze 066aadb4d1 update node classifier (#3419) 
Signed-off-by: witchcraze <witchcraze@gmail.com>
 2024-11-12 08:38:43 -05:00
Christopher Angelo PhillipsandKeith Zantow 8a41d77250 chore: prevent file resolver from bubbling errors in binary cataloger (#3410) 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
 2024-11-04 20:23:27 +00:00
Weston Steimel d7194bb00f fix: improve mariadb binary classifer to detect older versions (#3339) 
With older versions of mariadb the binary name was `mysql`, so this
adjusts the binary classifier to additionally search for the expected
version pattern in `mysql` binaries.

Signed-off-by: Weston Steimel <commits@weston.slmail.me>
 2024-10-16 12:43:50 -04:00
William Murphy 754cebee64 fix: stop some log.Warn spam due parsing an empty string as a CPE (#3330) 
* chore: don't try to parse empty string as CPE

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

* chore: improve OS name and version extraction from ELF metadata

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

---------

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
 2024-10-15 08:50:47 -04:00
Keith ZantowandAlex Goodman ccbee94b87 feat: report unknowns in sbom (#2998) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-10-07 16:11:37 -04:00
William MurphyandChristopher Phillips 770fdc53ea Fix: make failed CPE validation correctly return error (#2762) 
* Test CPE attributes correctly returns error

Previously, this method incorrectly return an empty Attributes object
and a nil error, leading to callers attempting to use the empty
attributes object.

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* chore: merge with main and refactor call that relied on old nil behavior

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

* test: add test to cover new OSCPE err pattern

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

---------

Signed-off-by: Will Murphy <will.murphy@anchore.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2024-10-03 16:42:57 -04:00
witchcraze 263ea6b1bb feat: update haproxy classifier (#3277) 
Signed-off-by: witchcraze <witchcraze@gmail.com>
 2024-10-02 15:10:39 -04:00
witchcraze f5f8005fe0 update redis classifier (#3281) 
* update redis classifier
Signed-off-by: witchcraze <witchcraze@gmail.com>

* Remove snippets to pass Validation.
In this case, 9000 byte was required...
Signed-off-by: witchcraze <witchcraze@gmail.com>
 2024-09-30 15:37:47 -04:00
witchcraze 2a3d171c10 fix: improve node classifier version matching (#3284) 
Signed-off-by: witchcraze <witchcraze@gmail.com>
 2024-09-27 08:53:35 -04:00
witchcraze 1a746b2c05 fix: update ruby classifier for -rc, -dev, etc. versions (#3285) 
Signed-off-by: witchcraze <witchcraze@gmail.com>
 2024-09-27 08:51:50 -04:00
Laurent Goderre 7815d8e4d9 feat: classifier for Dart lang binaries (#3265) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2024-09-23 14:21:31 -04:00
Krystian G.Krystian GornyAlex Goodman
 		6a95a5f2ed feat: add binary classifiers for lighttp, proftpd, zstd, xz, gzip, jq, and sqlcipher (#3252) 
* feat: detect lighttpd binaries

Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com>

* feat: detect proftpd binaries

Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com>

* feat: detect zstd binaries

Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com>

* feat: detect xz utils binarie

Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com>

* feat: detect gzip binaries

Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com>

* feat: detect sqlcipher binaries

Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com>

* feat: detect jq binaries

Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com>

* add tests + snippets

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Krystian Gorny <krystian.gorny@wipotec.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-09-19 13:21:02 +00:00
Krystian G.andGorny Krystian cb0de97bc3 fix: capture-snippet.sh can handle leading whitespaces now (#3249) (#3250) 
Signed-off-by: Gorny Krystian <krystian.gorny@wipotec.com>
Co-authored-by: Gorny Krystian <krystian.gorny@wipotec.com>
 2024-09-19 09:15:54 -04:00
Laurent Goderre dbc4238f63 Add haskell binaries cataloger (#3078) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2024-09-10 10:58:20 -04:00
Alex Goodman 0a3f513f92 Slim down docker cache size (#3190) 
* slim down docker cache size

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove old centos images

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* troubleshoot test failure

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix wget version ref

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* refactor caching mechanisms

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add cache cleanup steps

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* simplify deleting cache

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix first clone issue

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add tool dep

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-09-09 11:15:13 -04:00
witchcraze a343825685 fix: haproxy classifier for versions with -dev suffix (#3180) 
Signed-off-by: witchcraze <witchcraze@gmail.com>
 2024-09-05 14:52:19 -04:00
Weston Steimel 5ab43bafec fix: improve known CPEs and set NVD as source for all current binary classifiers (#3167) 
Signed-off-by: Weston Steimel <commits@weston.slmail.me>
 2024-08-27 17:36:34 +01:00
Alex Goodman e9a8c27be1 respond to authoratative CPEs from catalogers (#3166) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-08-27 10:26:35 -04:00
Weston Steimel 99be365f62 fix: use official CPE for curl binary cataloger (#3164) 
The official CPE for curl is `cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*`

Signed-off-by: Weston Steimel <commits@weston.slmail.me>
 2024-08-27 14:03:19 +01:00
anchore-actions-token-generator[bot] dad253785e chore(deps): update tools to latest versions (#3144) 2024-08-23 14:42:12 -04:00
KrysGor cff9d494df feat: detect curl binaries (#3146) 2024-08-23 14:41:08 -04:00
Keith Zantow 73b9d5aa42 fix: mysql 8.0.3x binary detection (#3142) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-08-21 09:48:28 -04:00
Laurent Goderre 92d63df6f5 Added the SWI Prolog (swipl) ecosystem (#3076) 
* Add binary classifier for swipl

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>

* Added cataloger for SWI Prolog Pack packages

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>

---------

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2024-07-31 16:13:26 -04:00
witchcraze 490e05adb2 fix: traefik classifier (#3077) 
Signed-off-by: witchcraze <witchcraze@gmail.com>
 2024-07-29 09:46:51 -04:00
dependabot[bot]andChristopher Phillips fe7c5a7174 chore(deps): bump github.com/charmbracelet/lipgloss from 0.11.1 to 0.12.1 (#3040) 
* chore(deps): bump github.com/charmbracelet/lipgloss

Bumps [github.com/charmbracelet/lipgloss](https://github.com/charmbracelet/lipgloss) from 0.11.1 to 0.12.1.
- [Release notes](https://github.com/charmbracelet/lipgloss/releases)
- [Changelog](https://github.com/charmbracelet/lipgloss/blob/master/.goreleaser.yml)
- [Commits](https://github.com/charmbracelet/lipgloss/compare/v0.11.1...v0.12.1)

---
updated-dependencies:
- dependency-name: github.com/charmbracelet/lipgloss
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore: pin fedora linux/amd64 to sha

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2024-07-22 10:43:17 -07:00
Keith Zantow 278b72d39b chore: pin fedora image for elf binary test (#3041) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-07-15 16:37:09 +00:00
Alex Goodman 573440b7cf Infer the package type from ELF package notes (#3008) 
* fix ELF package types to be honored

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* prefer OS packages over binary packages when there are duplicates

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-07-02 16:07:08 -04:00
Laurent Goderre ceced5eb27 Add detection of Erlang in Alpine linux (#2996) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2024-06-25 14:40:40 -07:00
Laurent Goderre 7a35de04ee fix: detection of arangodb 3.12 (#2979) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2024-06-20 11:11:03 -04:00
Alex Goodman 254a562b4e Add support for reading ELF package notes with section header (#2939) 
* add support for reading ELF package notes with section header

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add systemd elf package fields to json schema

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-07 14:38:54 -04:00
Brian Ebarb 5cdc0845fb feat: add license field to ELF binary package metadata (#2890) 
Signed-off-by: Brian Ebarb <ebarb.brian@gmail.com>

feat: add License component to elf binary packages

Signed-off-by: Brian Ebarb <ebarb.brian@gmail.com>

feat: fix elf_package_cataloger test

feat: elf package cataloger unit test updates
 2024-06-06 14:10:53 +00:00
Laurent Goderre b608ab77e1 feat: classifier for util-linux (#2933) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2024-06-05 17:32:52 -04:00
Keith Zantow ac34808b9c feat: detect fluent-bit binaries (#2905) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-05-28 10:13:06 -04:00