oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-31 14:36:33 +01:00
Code Issues Packages Projects Releases Wiki Activity
3,222 Commits 65 Branches 273 Tags
35278f3d3d78ee9dd708c75096fc7481f491e180
Commit Graph
1296 Commits
Author SHA1 Message Date
Dimitri John LedkovandKeith Zantow 35278f3d3d fix(java): improve lz4 detection (#4642) 
Signed-off-by: Dimitri John Ledkov <dimitri.ledkov@surgut.co.uk>
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
 2026-02-27 14:38:05 -05:00
Paweł Pałucha db76d85d51 fix: use correct hashes for empty files (#4620) 
Signed-off-by: Paweł Pałucha <pawel.palucha@chainguard.dev>
 2026-02-24 09:52:29 -05:00
witchcraze e9e7e20cc8 fix: grafana classifier (#4635) 
Signed-off-by: witchcraze <witchcraze@gmail.com>
 2026-02-23 09:38:02 -05:00
anchore-actions-token-generator[bot]andwagoodman eb072deb9c chore(deps): update CPE dictionary index (#4636) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>
 2026-02-23 08:19:30 -05:00
Will Murphy 0a3f7bb06e chore: call cleanup on tmpfile and replace some io.ReadAlls with streams (#4629) 
* fix(deb and snaps): prevent excess reads

Previously, Syft could allocate excess memory or tempfile space if there
were highly compressed objects in deb archives, or at paths where the
kernel changelog was expected by the snap cataloger. Use io.LimitReaders
for extracting parts of deb archives, and refactor the snap cataloger's
reading of the kernel changelog to use a streaming parsing, eliminating
the possibility of excess allocation.

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

* fix: always cleanup temp file from file source

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

* use streaming strategy for deb archives

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

---------

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
 2026-02-17 17:32:35 -05:00
anchore-actions-token-generator[bot]andwagoodman fb3f560e43 chore(deps): update CPE dictionary index (#4623) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>
 2026-02-17 09:50:12 -05:00
Scott Hebert 89b901b20b Use redhat as namespace for hummingbird rpms (#4615) 
The namespace value of `redhat` signifies this as an RPM package
produced and distributed by Red Hat.

Signed-off-by: Scott Hebert <scoheb@gmail.com>
 2026-02-11 14:19:20 -05:00
Christopher Angelo PhillipsandAlex Goodman 2c5e193f7a feat: Add support for scanning GGUF models from OCI registries (#4335) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2026-02-09 16:05:52 -05:00
anchore-actions-token-generator[bot]andwagoodman 3a23cfff1d chore(deps): update CPE dictionary index (#4610) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>
 2026-02-08 22:02:34 -05:00
Rez MossandChristopher Phillips c185657d71 feat: add yarn lock dev dep detection; fixed #4548 
---------
Signed-off-by: Rez Moss <hi@rezmoss.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2026-02-05 22:27:17 +00:00
anchore-actions-token-generator[bot]andwillmurphyscode 0b05f0ed69 chore(deps): update CPE dictionary index (#4601) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com>
 2026-02-05 15:29:00 +00:00
Will Murphy 138cb1be0e fix(cpe-generation): set start and end date (#4600) 
* fix(cpe-generation): set start and end date

Previously, the update job was silently failing because the NVD API
returns a 404 with no body if a start date is specified but not an end
date. Further, the API returns an error if more than 120 days are in
range of the start and end date.

Update the API client to:
1. Return a non-nil error on http 404
2. Chunk the date range into 120 day chunks
3. Pass start and end date to avoid errors.

Also add more tolerant timestamp parsing since the previous update job
would fail with timestamp format errors.

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

* refactor(cpe-generator): remove callbacks

Previously, this job had callbacks that were there to make sure that
incremental progress could be written to disk. However, incremental
progress was not being written to disk, and there were issues related to
the callbacks like double logging. Therefore, just remove the callbacks
and do simple imperative code to page through the API results.

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

---------

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
 2026-02-05 09:54:24 -05:00
Peter Bücker 6755377554 fix: CPE detection for APK libavif to use aomedia vendor (#4597) 
NVD uses "aomedia" as the vendor for libavif CVEs. This change adds
libavif to the APK package CPE candidate additions with "aomedia" as
an additional vendor, enabling Syft/Grype to match CVEs like
CVE-2025-48174 and CVE-2025-48175.

Signed-off-by: Peter Bücker <peter.buecker@gmail.com>
 2026-02-05 09:11:44 +00:00
Keith Zantow add2629446 fix: further improve go binary classifier, including windows (#4593) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2026-02-03 10:29:00 -05:00
Rez MossandChristopher Phillips 94c8088542 feat: add Qt6 binary detection (#4550) 
---------
Signed-off-by: Rez Moss <hi@rezmoss.com>
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2026-01-30 15:35:33 +00:00
Alan PopeandChristopher Phillips 0bca34f986 fix: snap cataloger incorrectly identifies snap container as deb package (#4500) 
Signed-off-by: Alan Pope <alan@popey.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2026-01-30 10:19:26 -05:00
Christopher Angelo Phillips 9a250a4b4b fix: update mixed case dependencies in python to be normalized (#4573) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2026-01-27 15:16:32 -05:00
Keith Zantow c65d023668 feat: detect Debian version from /etc/debian_version (#4569) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2026-01-23 17:52:21 -05:00
Keith Zantow 836f358cd4 fix: correctly report supporting evidence for binary packages (#4558) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2026-01-23 13:01:12 -05:00
Rez Moss 2f3a504acf Feat/catalog mongodb bin (#4541) 
* fixed #4550, catalog mongodb bin

Signed-off-by: Rez Moss <hi@rezmoss.com>

* fixed #4550, catalog mongodb bin

Signed-off-by: Rez Moss <hi@rezmoss.com>

---------

Signed-off-by: Rez Moss <hi@rezmoss.com>
 2026-01-08 12:18:51 -05:00
Rez MossandAlex Goodman 3a3a86eb01 fixed #4430 exclude dev pnpm pkg (#4487) 
* fixed #4430 exclude dev pnpm pkg

Signed-off-by: Rez Moss <hi@rezmoss.com>

* use existing dev deps option

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fixed #4430 exclude dev pnpm pkg, add test

Signed-off-by: Rez Moss <hi@rezmoss.com>

* fixed #4430 exclude dev pnpm pkg, add test

Signed-off-by: Rez Moss <hi@rezmoss.com>

---------

Signed-off-by: Rez Moss <hi@rezmoss.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2026-01-07 10:39:16 -05:00
witchcraze 6509b7079e add istio classifier (#4521) 
Signed-off-by: witchcraze <witchcraze@gmail.com>
 2026-01-07 10:36:39 -05:00
Rez Moss 7f1d57d06f feat: detect older bitnami img packages (#4532) 
Signed-off-by: Rez Moss <hi@rezmoss.com>
 2026-01-07 10:07:33 -05:00
Alex Goodman ed339e4fed fix: ensure java image build failures stop the build (#4531) 
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2026-01-06 11:43:51 -05:00
witchcraze 81dd955871 add envoy binary classifier (#4530) 
* add envoy classifier
Signed-off-by: witchcraze <witchcraze@gmail.com>

* add envoy classifier
Signed-off-by: witchcraze <witchcraze@gmail.com>
 2026-01-06 08:45:01 -05:00
Alex Goodman 48948ddb8f add container support for graalvm fixture (#4528) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2026-01-05 14:18:12 -05:00
Luis Miguel SantosandLuis M. Santos ea43506196 fix: corrects handling of UNC root paths in windows. 
---------
Signed-off-by: Luis M. Santos <luis.santos2@nih.gov>
Co-authored-by: Luis M. Santos <luis.santos2@nih.gov>
 2026-01-05 11:32:07 -05:00
Rez Moss 2c96279df9 fix: traefik binary classifier (#4499) 
Signed-off-by: Rez Moss <hi@rezmoss.com>
 2026-01-05 11:14:00 -05:00
witchcraze c8184bdb4c add grafana classifier (#4516) 
Signed-off-by: witchcraze <witchcraze@gmail.com>
 2026-01-05 09:51:41 -05:00
witchcraze 15af992225 add valkey classifier (#4509) 
* add valkey classifier
Signed-off-by: witchcraze <witchcraze@gmail.com>

* fix test path
Signed-off-by: witchcraze <witchcraze@gmail.com>

* Run 'go generate ./internal/capabilities'
Signed-off-by: witchcraze <witchcraze@gmail.com>
 2026-01-05 09:40:35 -05:00
Alex GoodmanKeith ZantowWill Murphy
 		b3c70da3ea Add experimental cataloger capabilities command (#4317) 
* add info command from generated capabilities

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* correct gentoo and arch ecosystems

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* rename os pkg types

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* better binary cataloger description

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* expose metadata and pacakge types in json

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* expose json schema types

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add completeness tests for metadata types

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* latest generation

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix linting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* improve testing a docs

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix tests and linting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* restore goreleaser config

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* tweak diagram

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix pdm

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* chore: java binary data

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* new capability descriptions for gguf and python

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* correct poetry lock integrity hash claim

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix compile error

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix: remove purl version from overrides

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* fix lua deps ref

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* keep gguf as ai ecosystem

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* split packages.yaml to multiple files by go package

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* ensure tests do not use go test cache

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* sort json output for info command

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* docs: fix ocaml, php, and portage capabilities yaml

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

* chore: update erlang capabilities

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: update java capabilities

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: update javascript capabilities

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: update linux kernel capabilities

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* remove missing tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix package.yaml references

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* revert license list change

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* check for drift in capability descriptions

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* regenerate capabilities

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* test cleanup

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* use fixture cache in static analysis

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* claim fixtures pre-req for cap generation

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update documentation with correct regeneration procedure

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* chore: ruby-gemspec-cataloger finds no dependencies

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

* chore: fix python docs and config comment

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

* chore: commit re-generated java yaml

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

* add cataloger selection to caps command

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* re-generate cap yamls

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix tests for cataloger selection

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix cli test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add missing tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix linting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* rename cmd to `cataloger info`

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* [wip] change capability description locations

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* [wip] continued

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* [wip] adjust for import cycles

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* correct docs

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix linting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com>
 2025-12-22 19:34:10 +00:00
Alex Goodman 0ea920ba6d Decompress UPX packed binaries to extract golang build info (ELF formatted binaries with lzma method only) (#4480) 
* decompress upx packed binaries

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix linting and remove dead code

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-12-22 14:17:38 +00:00
VictorHuu c9760d2341 feat: snap can be queried by revision and ``track/risk/branch`` (#4439) 
---------
Signed-off-by: Yuntao Hu <victorhu493@gmail.com>
 2025-12-18 15:41:36 -05:00
Rez MossandChristopher Phillips 74c9380248 fix: 4423 dotnet-deps cataloger skips project type by def 
---------
Signed-off-by: Rez Moss <hi@rezmoss.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-12-18 13:38:47 -05:00
Rez MossandAlex Goodman c79a57b6a1 Detect embedded deps.json in .NET binaries (#4375) 
* syft detect embedded deps.json,dotnet , fixed #4344

Signed-off-by: Rez Moss <hi@rezmoss.com>

* [wip] have pe utils process embedded dep.json

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* [wip] add PoC bundler processing

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* [wip] search for bundle marker within pe sections

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* put bundle parsing for multiple .net versions under test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Rez Moss <hi@rezmoss.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-12-16 08:35:19 -05:00
Alex Goodman beb70891e5 unapply base path for resolver inbound requests (#4478) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-12-16 08:28:12 -05:00
Rez MossandKeith Zantow e0b61a3ae3 fix: golang PURL should include full module (#4395) 
* fixed #4316 go mod with ver purl

Signed-off-by: Rez Moss <hi@rezmoss.com>

* go mod purl fixed, added func to handle go.mod

Signed-off-by: Rez Moss <hi@rezmoss.com>

* fix: use module name in PURL string everywhere

Signed-off-by: Keith Zantow <kzantow@gmail.com>

---------

Signed-off-by: Rez Moss <hi@rezmoss.com>
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
 2025-12-12 14:19:26 -05:00
VictorHuuandAlex Goodman 4c38ee1932 fix:best effort to get the os info of an ELF binary (#4438) 
* fix:the os of an elf binary should be detected even when the os version is empty

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* chore:revoke the update of appCpe

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* chore:resume the testcase

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* fix:revoke the possible compromise to the json schema

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* fix:align with the json schema

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* add a json schema(pre-relase,may be in conflict with others')

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* chore:add a json schema

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* chore:revert the accidental change to 16.1.0

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* regression/fix:best effort to get the os info

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* chore:resume the previous json file

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* update the schema ver to 16.2.0

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* chore:no breaking behavior

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* chore: follow the guide of the README.md

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* appCpe is temporarily unused

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* preserve json field for osCPE

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-12-12 19:13:59 +00:00
Alexandre Steppé ea1f4cba38 feat: add support for Gemfile.next.lock (#4457) 
Signed-off-by: Alexandre Steppé <alexandre.steppe@gmail.com>
 2025-12-12 10:20:53 -05:00
Chris Greeno 568b7601bb fix(javascript): remove debug print statement in dependency parser (#4412) 
Removes an accidental `fmt.Println("error", err)` that was left in
the javascript dependency parser. This causes noisy output to stdout
when parsing npm package-lock.json files that contain dependency
specifiers that aren't valid PURLs.

Signed-off-by: Chris Greeno <chris@fresha.com>
 2025-12-10 13:42:09 -05:00
Kendrick 7fdb08c0b6 Validating download_url for github repositories, and updating if necessary (#4390) 
* Adding a second function to validate/correct urls that are just github repositories

Signed-off-by: Kendrick <kmartinix@gmail.com>

* Adding test case to capture github repositories

Signed-off-by: Kendrick <kmartinix@gmail.com>

---------

Signed-off-by: Kendrick <kmartinix@gmail.com>
 2025-12-10 13:41:00 -05:00
Keith Zantow 9e3150b7ee fix: java archives excluded due to incorrect license glob results (#4449) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-12-08 15:58:13 -05:00
Will Murphy d950ac1fae fix: use vercel for vendor in nextjs CPE (#4450) 
The recent react / next CVE uses "vercel" as the vendor, see
https://nvd.nist.gov/vuln/detail/CVE-2025-55182

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
 2025-12-08 20:23:36 +00:00
VictorHuu baca32f04a fix:after compliance applied,the relationship concerning the original one should be omitted (#4419) 
---------
Signed-off-by: Yuntao Hu <victorhu493@gmail.com>
 2025-12-04 15:30:16 -05:00
VictorHuuandChristopher Phillips afe28a2fc0 fix:handle compound aliases like ``.tgz`` when cataloging archives (#4421) 
---------
Signed-off-by: Yuntao Hu <victorhu493@gmail.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-12-02 16:55:32 -05:00
Will Murphy a0f7148608 chore: ignore .DS_Store in test fixtures (#4422) 
Otherwise, we get test failures on macOS if macOS has decided to put
.DS_Store entries in the test fixtures.

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
 2025-12-01 10:15:35 -05:00
Adam ChovanecandAdam Chovanec 5b96d1d69d chore: rename test func for CPE decoder (#4379) 
Signed-off-by: Adam Chovanec <git@adamchovanec.cz>
Co-authored-by: Adam Chovanec <git@adamchovanec.cz>
 2025-11-25 23:05:31 -05:00
Will Murphy c95893209d fix: normalize python package names from dependency lists (#4408) 
Because package names in METADATA files may have upper case like
Werkzeug or Jinja2, but Syft artifacts have normalized names and are
lower case, like werkzeug or jinja2, Syft would miss emitting dependency
relationships. Therefore, normalize dependency names before comparing
with existing artifacts.

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
 2025-11-25 10:20:21 -05:00
Christopher Angelo Phillips 9aca8167b8 chore: drop cpe from gguf (#4383) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-11-19 05:37:40 -05:00
Will Murphy 759909f611 fix: emit lua rockspec dependencies in metadata (#4376) 
The types / schema allowed for this field to begin with but it wasn't
set.

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
 2025-11-18 09:19:41 -05:00