Laurent Goderre and Alex Goodman
175a6719a9
Add cataloger for Dart pubspec ( #3292 )
...
* Add cataloger for Dart pubspec
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
* capture pubspec specific fields
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-13 21:51:49 +00:00
Christopher Angelo Phillips and Alex Goodman
f77d503892
detect license ID from full text when incidentally provided as a value ( #3876 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-13 16:37:18 -04:00
Rez Moss and Alex Goodman
12d91f47dc
Add a homebrew cataloger ( #3724 )
...
* Cataloger homebrew (#4 )
* homebrew cataloger
* uptd
* fixed test
* fixed test
* fixed tests
* fixed lint
* inc schema ver
* upt schema
* fixed integration test
* fixed integration tst
* fixed test
Signed-off-by: Rez Moss <hi@rezmoss.com >
* Update parse_homebrew_test.go
Signed-off-by: Rez Moss <hi@rezmoss.com >
* Update parse_homebrew_test.go
fixed DCO
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Rez Moss <hi@rezmoss.com >
* Update parse_homebrew_test.go
add evd anno to test
Signed-off-by: Rez Moss <hi@rezmoss.com >
* lint
Signed-off-by: Rez Moss <hi@rezmoss.com >
* fixed test
Signed-off-by: Rez Moss <hi@rezmoss.com >
* with PR refactors
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate jsonschema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* refactor homebrew parser + add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* more resiliant variable extraction
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-13 13:01:41 -04:00
Weston Steimel
de88b973f8
chore: fix some logging output ( #3884 )
...
Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>
2025-05-13 13:15:19 +01:00
Alex Goodman
59b880f26a
order locations by container layer order ( #3858 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-13 00:02:07 -04:00
Keith Zantow
621d21eb04
feat: Add PURL list input/output format ( #3853 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-05-12 13:33:24 -04:00
James Neate and Alex Goodman
00c4a4e72a
Use package ID from decoded SBOMs when provided ( #1872 )
...
* fix: use package id from cyclonedx when provided
Signed-off-by: James Neate <jamesmneate@gmail.com >
* override package IDs from converted SBOMs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix typo
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove extractSyftID function
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: James Neate <jamesmneate@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-08 11:25:30 -04:00
Christopher Angelo Phillips
1ba1186410
fix: use "contents" field and remove "fullText" license field ( #3857 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-05-05 21:40:09 +00:00
Christopher Angelo Phillips
6ba087c72c
fix: Do not use hashes for SPDX license names/expressions ( #3844 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-05-02 09:34:08 -04:00
Christopher Angelo Phillips
94e63eb367
feat: detect when full license text has been provided and preserve as separate field ( #3450 )
...
* feat: add full text field to syft license struct
---------
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com >
2025-05-01 15:00:46 -04:00
Laurent Goderre and Alex Goodman
529840bfc0
Add support for PHP Pear ( #2775 )
...
* Add support for PHP Pear and unify PECL with it
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove log statements
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix struct comment
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-04-30 20:16:58 +00:00
anchore-actions-token-generator[bot] and spiffcs
f11377fe30
chore(deps): update tools to latest versions ( #3775 )
...
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-04-03 17:35:26 +00:00
Alex Goodman
12f36420dd
Parse GitHub actions comments ( #3776 )
...
* add version comment parsing support to github actions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update json schema with github actions metadata
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add originator processing for github actions type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-04-03 14:46:27 +00:00
Alan Pope and Alex Goodman
5fa8e9c6e9
feat: add Debian archive (.deb) file cataloger ( #3704 )
...
* feat: add Debian archive (.deb) file cataloger
Add a cataloger that parses Debian package (.deb) archive files directly,
allowing Syft to discover packages from .deb files without requiring
them to be installed on the system. This implements issue #3315 .
Key features:
- Parse .deb AR archives to extract package metadata
- Support for gzip, xz, and zstd compressed control files
- Extract package metadata from control files
- Process file information from md5sums files
- Mark configuration files from conffiles entries
- Handle trailing slashes in archive member names
Signed-off-by: Alan Pope <alan.pope@anchore.com >
* chore: run go mod tidy to fix failing workflow
Signed-off-by: Alan Pope <alan.pope@anchore.com >
* add license processing to dpkg archive cataloger + add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update json schema with dpkg archive type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alan Pope <alan.pope@anchore.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-03-19 20:03:21 +00:00
Keith Zantow
7571f8dfba
chore: updates for go 1.24.1 ( #3712 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-03-06 15:35:26 +00:00
Stef Graces and Keith Zantow
694eec4079
Add downloadLocation URI validation ( #3697 )
...
* Add downloadLocation URI validation
Signed-off-by: Stef Graces <stefgraces@hotmail.com >
* Update function names
Signed-off-by: Stef Graces <stefgraces@hotmail.com >
* Fixes for make lint-fix + Changes to when NONE and NOASSERTION in downloadLocation
Signed-off-by: Stef Graces <stefgraces@hotmail.com >
---------
Signed-off-by: Stef Graces <stefgraces@hotmail.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
2025-03-06 14:45:47 +00:00
bffe26bcc5
feat: add support for Bitnami cataloguer ( #3341 )
...
* prototype: start bitnami cataloger
Bitnami images have spdx SBOMs at predictable paths, and Syft could more
accurately identify the software in these images by scanning those
SBOMs. Start work on this by forking the sbom-cataloger as a new
bitnami-cataloger.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* wire up bitnami cataloger to run on images by default
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* feat: add support for Bitnami cataloguer
Signed-off-by: juan131 <jariza@vmware.com >
* feat: use a better SPDX sample for unit tests
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: only report bitnami pkgs
Signed-off-by: juan131 <jariza@vmware.com >
* feat: adapt JSON schema, spdxutil and packagemetadata
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: integration tests
Signed-off-by: juan131 <jariza@vmware.com >
* feat: implement FileOwner interface
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: update json schema
Signed-off-by: juan131 <jariza@vmware.com >
* [wip] add bitnami owned files and fix binary package ownership filtering
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* feat: obtain bitnami pkg files based on SPDX relationships tree
Signed-off-by: juan131 <jariza@vmware.com >
* preserve type switches
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename bitnami entry metadata type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* restrict find main pkg logic
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add missing graalvm source info
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bugfix: integration tests
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: mod tidy
Signed-off-by: juan131 <jariza@vmware.com >
---------
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Signed-off-by: juan131 <jariza@vmware.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-02-18 09:07:47 -05:00
Keith Zantow
2328b20082
fix: reduce warn levels to debug for non-actionable errors ( #3645 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-02-07 13:22:55 -05:00
HeyeOpenSource and Christopher Phillips
f7e767fc25
feat: update licenses to including license content when SPDX expressions are unable to be determined ( #3366 )
...
---------
Signed-off-by: HeyeOpenSource <opensource@heye-international.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-01-28 18:05:27 +00:00
c10e904c28
feat(cataloger): add a terraform provider cataloger ( #3378 )
...
* feat(cataloger): add a terraform provider cataloger
* chore: bump schema from 16.0.19 -> 16.0.20
------
Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-01-21 14:44:54 -05:00
Bert Coppens and Alex Goodman
512319337f
feat: add cataloger for NuGet packages ( #3484 )
...
* add cataloger for dotnet packages.lock.json files
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* add entry for dotnet packages.lock files
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* add unit test for dotnet packages.lock cataloger
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* add test for faulty packages.lock.json file
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* add missing name metadata
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* ensure package appears with version
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* add example of conflicting dependencies
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump json schema and fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* move section
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-01-16 14:57:17 -05:00
William Murphy
445142886e
fix: stop omitting redundantly parenthesized licenses in CDX formatter ( #3517 )
...
Previously, a bug in the formatter would cause SPDX expressions that
were surrounded in redundant parentheses to be dropped instead of
normalized.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2024-12-11 10:06:08 -05:00
48190233f4
fix: emit NOASSERTION for copyright text to fix SPDX 2.2 validation failure ( #3495 )
...
* fixes issue #3346
Signed-off-by: Fearkin <fearjin1@gmail.com >
* chore: update schema and unit tests to reflect new copyright property
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
* chore: revert schema changes
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
* fix: noassert copyright on spdx root package
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* test: explicitly test spdx 2.2 with tools-java validator
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* test: update snapshot files
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
---------
Signed-off-by: Fearkin <fearjin1@gmail.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Co-authored-by: Fearkin <fearjin1@gmail.com >
Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2024-12-04 14:58:36 -05:00
Alex Goodman
01de99b253
Add JVM cataloger ( #3217 )
...
* add jvm cataloger
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* simplify version selection
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* CPEs from JVM cataloger should be declared
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* ensure package overlap is enabled for sensitive use cases
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* more permissive glob
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-09-23 17:21:38 -04:00
Laurent Goderre
9c2799e379
Add the Ocaml ecosystem ( #3112 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-09-10 10:35:18 -04:00
Mikail
f2caf45695
fix: properly decode SPDX license expressions in CycloneDX format ( #3175 )
...
Signed-off-by: Mikail Kocak <mikail-gh@pm.me >
2024-08-29 11:05:43 -04:00
anchore-actions-token-generator[bot]
dad253785e
chore(deps): update tools to latest versions ( #3144 )
2024-08-23 14:42:12 -04:00
Lukas Voetmand
3161e1847e
fix: read CycloneDX BOM components from metadata ( #3092 )
...
Signed-off-by: dervoeti <lukas.voetmand@stackable.tech >
2024-08-12 16:37:23 -04:00
Harippriya Sivapatham
cc15edca62
fix: use organization for package supplier when reading Java vendor fields ( #3093 )
...
Signed-off-by: Harippriya Sivapatham <harippriyasivapatham@gmail.com >
2024-08-03 16:00:55 -04:00
Laurent Goderre
92d63df6f5
Added the SWI Prolog (swipl) ecosystem ( #3076 )
...
* Add binary classifier for swipl
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
* Added cataloger for SWI Prolog Pack packages
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
---------
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-07-31 16:13:26 -04:00
Laurent Goderre
b101f44aba
Map the downloadLocation field for PHP Composer packages ( #3011 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-07-09 09:01:58 -07:00
Rajan Agaskar
ae0683074e
feat: update syft to generate cyclone-dx 1.6 by default ( #2978 )
...
- Resolves #2974
- add detailed instructions re: updating schemas (a necessary task
when a new CycloneDX spec version becomes available).
- The DefaultVersion constant has been updated to "1.6" -- it's not
clear to me how this is used at this time (it may be redundant given
other code), but effectively unless a specific spec version is
configured, `syft` will emit the "most recent" spec version available
for cyclonedx. Users who wish to pin back to a "older" specVersion
(e.g. to preserve compatibilty with utilities that have not yet bumped
to latest) can either set this in a syft config file or pass a
name@spec_version pair to the output flag (e.g. `-o
cyclonedx-json@1.5=some-1.5-spec-bom.cdx.json`)
- Regenerate relevant .golden files (there seems to be a way to do this
via flags, but I couldn't quite figure out the right set to pass
correctly, esp. since (as a relative go novice) I found it difficult
to run just a single test file. I ended up "brute-forcing it" by
changing the *updateSnapshot val to "true" and running it in Goland.
A brief comment giving an example of regenerating fixtures usage would
be helpful.
Signed-off-by: Rajan Agaskar <ragaskar@gmail.com >
2024-06-21 08:51:27 -07:00
Laurent Goderre
b51252dbdb
feat: Add Lua cataloger ( #2613 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-05-24 16:56:34 -04:00
Take
338ce51fd8
Fix outdated spdx links ( #2865 )
...
Signed-off-by: Takeru Tanaka <takeru.tt5672@gmail.com >
2024-05-14 17:58:36 +00:00
Alex Goodman
5b03788300
Fill in SPDX originator for all supported package types ( #2822 )
...
* add failing test + beef up doc comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* cover more metadata types in spdx originator processing
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-04-29 16:33:00 -04:00
Laurent Goderre
e0233625cb
feat: cataloger for PHP Pecl and PEAR packages ( #2604 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-04-02 11:55:56 -04:00
Keith Zantow
a978966cad
feat: add --from flag, refactor source providers ( #2610 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-02-27 16:44:37 -05:00
Alexandr Hacicheant and Alex Goodman
96ee2db875
feat: Add Wordpress cataloger ( #2218 )
...
* Closes #1911 Wordpress cataloger
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed a few unit tests and static analizer notices
Signed-off-by: disc <a.hacicheant@gmail.com >
* Updated `README.md`
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed `golangci-lint` notices
Added integration test for `wordpress-plugin`
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed `gosimports` notices
Signed-off-by: disc <a.hacicheant@gmail.com >
* Updated `json schema` version
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed CLI tests, increased expected package count
Signed-off-by: disc <a.hacicheant@gmail.com >
* Read first 4Kb of a plugins file's content
Signed-off-by: disc <a.hacicheant@gmail.com >
* replace JSON schema version
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* change wording on source info for wordpress packages
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* Minor changes after a huge refactoring
Signed-off-by: disc <a.hacicheant@gmail.com >
* Removed unused files
Signed-off-by: disc <a.hacicheant@gmail.com >
* Updated schema
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed integration tests
Signed-off-by: disc <a.hacicheant@gmail.com >
* fix integration tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* Renamed `metadata.Name` to `metadata.PluginInstallDirectory`
Signed-off-by: disc <a.hacicheant@gmail.com >
* rename fields to be compliant with json conventions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: disc <a.hacicheant@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-14 16:03:25 +00:00
Laurent Goderre and Alex Goodman
d7b9cc70b0
Add Erlang OTP Application cataloger ( #2403 )
...
* Add cataloger for Erlang OTP applications
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
* Add OTP Package type and Purl for ErLang
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
* remove erlang OTP metadata type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use OTP purl type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* restore otp fixture and adjust tests for dir-only results
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-02 13:40:18 -05:00
William Murphy
b7a6d5e946
feat: Record where CPEs come from ( #2552 )
...
Syft can get CPEs from several source, including generating them based on
package data, finding them in the NVD CPE dictionary, or finding them declared
in a manifest or existing SBOM. Record where Syft got CPEs so that consumers of
SBOMs can reason about how trustworthy they are.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2024-02-02 16:17:52 +00:00
Alex Goodman
f893933336
internalize format helpers ( #2543 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-26 12:16:26 -05:00
Alex Goodman
0fe13888d5
swap format readseekers for readers ( #2515 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-23 16:44:57 -05:00
Alex Goodman
1676934c63
Add "pretty" json configuration and change default behavior to be space-efficient ( #2275 )
...
* expose underlying format options
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove escape html options and address PR feedback
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* incorporate PR feedback
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix cli test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-11-20 15:29:34 +00:00
Alex Goodman
1aaa644007
Remove MetadataType from core package object and normalize JSON metadataType values ( #1983 )
...
* [wip]
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* distinct the package metadata functions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove metadata type from package core model
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* incorporate review feedback for names
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add RPM archive metadata and split parser helpers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* clarify the python package metadata type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename the KB metadata type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* break hackage and composer types by use case
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* linting fix
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix encoding and decoding for syft-json and cyclonedx
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump json schema to 11
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update cyclonedx-json snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update cyclonedx-xml snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update spdx-json snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update spdx-tv snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update syft-json snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* correct metadata type in stack yaml parser test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix bom-ref redactor for cyclonedx-xml
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add tests for legacy package metadata names
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate json schema v11
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix legacy HackageMetadataType reflect type value check
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* packagemetadata discovery should account for type shadowing
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix cli tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump json schema version to v12
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update json schema to incorporate changes from main
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add syft-json legacy config option
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add tests around v11-v12 json decoding
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add docs for SYFT_JSON_LEGACY
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename structs to be compliant with new naming scheme
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-10-30 12:12:04 -04:00
Alex Goodman
7392d607b6
Split the sbom.Format interface by encode and decode use cases ( #2186 )
...
* split up sbom.Format into encode and decode ops
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update cmd pkg to inject format configs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump cyclonedx schema to 1.5
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* redact image metadata from github encoder tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add more testing around format decoder identify
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add test case for format version options
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix cli tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix CLI test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] - review comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* keep encoder creation out of post load function
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* keep decider and identify functions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add a few more doc comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove format encoder default function helpers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address PR feedback
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* move back to streaming based decode functions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* with common convention for encoder constructors
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests and allow for encoders to be created from cli options
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix cli tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* buffer reads from stdin to support seeking
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-10-25 13:43:06 +00:00
Laurent GoderreandAlex Goodman
Christopher Angelo PhillipsandAlex Goodman
Rez MossandAlex Goodman
Weston Steimel
Keith Zantow
James NeateandAlex Goodman
anchore-actions-token-generator[bot]andspiffcs
Alan PopeandAlex Goodman
Stef GracesandKeith Zantow
HeyeOpenSourceandChristopher Phillips
Bert CoppensandAlex Goodman
Mikail
Lukas Voetmand
Harippriya Sivapatham
Rajan Agaskar
Take
Alexandr HacicheantandAlex Goodman
William Murphy