Alex Goodman
048df17e3d
Use values in relationship To/From fields ( #2871 )
...
* use pkg values in relationship fields
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add linter rule for using values in relationships
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use new cmptest package for comparing relationships
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* create cmptest for common cmp.Diff options in test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* condense matches for relationship ruleguard
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove relationship type from rules
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* restore build tag
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* suggest using values
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* nil check pkgs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-05-14 13:48:33 -04:00
Alex Goodman
7ad7627d5d
add support for RPM DB package relationships ( #2872 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-05-14 13:48:19 -04:00
Alex Goodman
4a18895545
Add abstraction for adding relationships from package cataloger results ( #2853 )
...
* add internal dependency resolver
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* refactor dependency relationship resolution to common object
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* replace cataloger decorator with generic processor
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* refactor resolver to be a single function
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use common dependency specifier for debian
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use common dependency specifier for arch
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use common dependency specifier for alpine
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* allow for generic pkg and rel assertions in testpkg helper
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* do not allow for empty results
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* move stable deduplicate comment
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove relationship resolver type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-05-14 13:27:36 +00:00
Alex Goodman
c200896a96
fix pruning binary packages when considering ELF packages ( #2862 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-05-09 19:35:22 +00:00
Brian Ebarb and Alex Goodman
4194a2cd34
feat: add relationships to ELF package discovery ( #2715 )
...
This PR adds DependencyOf relationships when ELF packages have been discovered by the binary cataloger. The discovered file.Executable type has a []ImportedLibraries that's read from the file when discovered by syft. By mapping these imported libraries back to the package collection, syft is able to create relationships showing which packages are dependencies of other packages by just reading metadata from the ELF executable.
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Brian Ebarb <ebarb.brian@sers.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-05-09 13:53:59 -04:00
Alex Goodman
ada8f009d2
Add relationships for ALPM packages (arch linux) ( #2851 )
...
* add alpm relationships
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* tweak reader linter rule to check for reader impl
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update JSON schema with alpm dependency information
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-05-07 13:29:46 -04:00
Alex Goodman
a56eff90d6
fix ui race for package count ( #2839 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-05-06 11:45:52 -04:00
Weston Steimel
9604e3dc9c
feat: support multiple known CPEs in index ( #2813 )
...
It is possible that a given package has multiple known "official" CPEs
active in the dictionary at once, so the index should support a slice of
CPE strings per package
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
2024-04-25 15:22:26 +01:00
Laurent Goderre
e0233625cb
feat: cataloger for PHP Pecl and PEAR packages ( #2604 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-04-02 11:55:56 -04:00
6a2517b5d2
Add ELF binary package cataloger ( #2396 )
...
* feat Adds Elf package catalogger
Signed-off-by: Brian Ebarb <ebarb.brian@gmail.com >
* Add test fixtures for elf package
Signed-off-by: Colleen Divers <colleen.divers@gmail.com >
* bump JSON schema to v16.0.6 + expand test fixtures
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* less verbose logging
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove dead test code
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove unreleated swift change
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Brian Ebarb <ebarb.brian@gmail.com >
Signed-off-by: Colleen Divers <colleen.divers@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Colleen Divers <colleen.divers@gmail.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-03-14 11:16:03 -04:00
Alex Goodman
47fc909700
Show binary exports, entrypoint, and imports ( #2626 )
...
show binary exports, entrypoint, and imports for macho, elf, and pe formats
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-03-12 22:04:02 +00:00
Alexandr Hacicheant and Alex Goodman
96ee2db875
feat: Add Wordpress cataloger ( #2218 )
...
* Closes #1911 Wordpress cataloger
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed a few unit tests and static analizer notices
Signed-off-by: disc <a.hacicheant@gmail.com >
* Updated `README.md`
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed `golangci-lint` notices
Added integration test for `wordpress-plugin`
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed `gosimports` notices
Signed-off-by: disc <a.hacicheant@gmail.com >
* Updated `json schema` version
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed CLI tests, increased expected package count
Signed-off-by: disc <a.hacicheant@gmail.com >
* Read first 4Kb of a plugins file's content
Signed-off-by: disc <a.hacicheant@gmail.com >
* replace JSON schema version
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* change wording on source info for wordpress packages
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* Minor changes after a huge refactoring
Signed-off-by: disc <a.hacicheant@gmail.com >
* Removed unused files
Signed-off-by: disc <a.hacicheant@gmail.com >
* Updated schema
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed integration tests
Signed-off-by: disc <a.hacicheant@gmail.com >
* fix integration tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* Renamed `metadata.Name` to `metadata.PluginInstallDirectory`
Signed-off-by: disc <a.hacicheant@gmail.com >
* rename fields to be compliant with json conventions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: disc <a.hacicheant@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-14 16:03:25 +00:00
Alex Goodman
98b700e83c
rename binary cataloger to be more unique ( #2633 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-14 11:01:55 -05:00
17ef243956
chore(deps): update tools to latest versions ( #2616 )
...
* chore(deps): update tools to latest versions
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* fix: update to new linter rules
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2024-02-14 14:59:49 +00:00
Christopher Angelo Phillips
c0f43e5e2d
chore: update license list, cpe dictionary ( #2620 )
...
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2024-02-09 11:31:42 -05:00
Alex Goodman and mikey strauss
c61f59e7b7
Finalize Conan v2 support ( #2587 )
...
* Add support for conan lock v2 (#2461 )
* conan lock 2.x requires field support
Signed-off-by: houdini91 <mdstrauss91@gmail.com >
* PR review, struct renaming
Signed-off-by: houdini91 <mdstrauss91@gmail.com >
---------
Signed-off-by: houdini91 <mdstrauss91@gmail.com >
* decompose conanlock parser + add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: houdini91 <mdstrauss91@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: mikey strauss <mdstrauss91@gmail.com >
2024-02-07 08:24:02 -05:00
Asi Greenholts and Alex Goodman
98de2e2f62
Adding metadata fields when parsing yarn.lock and poetry.lock ( #2350 )
...
* Adding the resolved and integrity fields of yarn.lock to the parsed metadata. This addition is similar to the metadata added when parsing package-lock.json.
Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com >
* fix comment
Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com >
* Adding the Index field to metadeta when parsing poetry.lock similarly to the existing Pipfile metadata
Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com >
* fixing struct accoding to tests
Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com >
* remove old schema change
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove empty constants
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* re-generate JSON schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update document ref
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-02 19:53:42 +00:00
Laurent Goderre and Alex Goodman
d7b9cc70b0
Add Erlang OTP Application cataloger ( #2403 )
...
* Add cataloger for Erlang OTP applications
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
* Add OTP Package type and Purl for ErLang
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
* remove erlang OTP metadata type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use OTP purl type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* restore otp fixture and adjust tests for dir-only results
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-02 13:40:18 -05:00
Alex Goodman
3023a5a7bc
Detect ELF security features ( #2443 )
...
* add detection of ELF security features
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update json schema with file executable data
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update expected fixure when no tty present
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* more detailed differ
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use json differ
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove json schema addition
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix mimtype set ref
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-02 16:51:18 +00:00
William Murphy
b7a6d5e946
feat: Record where CPEs come from ( #2552 )
...
Syft can get CPEs from several source, including generating them based on
package data, finding them in the NVD CPE dictionary, or finding them declared
in a manifest or existing SBOM. Record where Syft got CPEs so that consumers of
SBOMs can reason about how trustworthy they are.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2024-02-02 16:17:52 +00:00
Alex Goodman
6107e5e2ad
translate maps to sequences in pkg metadata ( #2553 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-01 11:58:10 -05:00
Alex Goodman
f893933336
internalize format helpers ( #2543 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-26 12:16:26 -05:00
Alex Goodman
bf3cd9ed3b
allow for RPM modularity to be optional ( #2540 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-24 13:21:59 -05:00
Alex Goodman
cdad5e767a
plumb context through catalogers ( #2528 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-22 15:54:51 -05:00
Alex Goodman
03b7938fbf
Turn off the SBOM cataloger by default ( #2527 )
...
* turn off the SBOM cataloger by default
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix integration tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-22 12:32:45 -05:00
Alex Goodman
4c77783461
Re-introduce linux kernel cataloger ( #2526 )
...
* re-add linux kernel cataloger
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* ensure there is at least a directory or image tag on each task
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix CLI tests to account for kernel finding (+2)
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-22 16:31:41 +00:00
Dan Luhring
df582e8463
fix: minor cataloger and docs nits ( #2519 )
...
Signed-off-by: Dan Luhring <dluhring@chainguard.dev >
2024-01-19 17:29:47 -05:00
Alex Goodman
3eab5932e5
Deduplicate digests from user configuration ( #2522 )
...
* deduplicate digests from user configuration
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* backout pointer reciever change on imageSource
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-19 21:51:55 +00:00
Alex Goodman
b0ab75fd89
Replace core SBOM-creation API with builder pattern ( #1383 )
...
* remove existing cataloging API
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add file cataloging config
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add package cataloging config
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add configs for cross-cutting concerns
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename CLI option configs to not require import aliases later
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update all nested structs for the Catalog struct
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update Catalog cli options
- add new cataloger selection options (selection and default)
- remove the excludeBinaryOverlapByOwnership
- deprecate "catalogers" flag
- add new javascript configuration
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* migrate relationship capabilities to separate internal package
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* refactor golang cataloger to use configuration options when creating packages
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* create internal object to facilitate reading from and writing to an SBOM
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* create a command-like object (task) to facilitate partial SBOM creation
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add cataloger selection capability
- be able to parse string expressions into a set of resolved actions against sets
- be able to use expressions to select/add/remove tasks to/from the final set of tasks to run
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add package, file, and environment related tasks
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update existing file catalogers to use nested UI elements
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add CreateSBOMConfig that drives the SBOM creation process
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* capture SBOM creation info as a struct
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add CreateSBOM() function
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update docs with SBOM selection help + breaking changes
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix multiple override default inputs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix deprecation flag printing to stdout
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* refactor cataloger selection description to separate object
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address review comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* keep expression errors and show specific suggestions only
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address additional review feedback
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address more review comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* addressed additional PR review feedback
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix file selection references
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove guess language data generation option
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add tests for coordinatesForSelection
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename relationship attributes
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add descriptions to relationships config fields
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* improve documentation around configuration options
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add explicit errors around legacy config entries
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-12 17:39:13 -05:00
Alex Goodman
4adfbeb5f0
Generalize UI events for cataloging tasks ( #2369 )
...
* generalize ui events for cataloging tasks
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* moderate review comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* incorporate review comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename cataloger task progress object
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* migrate cataloger task fn to bus helper
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-11-30 16:25:50 +00:00
Alex Goodman
5565bdef0c
Remove the power-user command and related catalogers ( #2306 )
...
* remove the power-user command
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove secrets + classifier catalogers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-11-20 15:44:28 +00:00
Alex Goodman
502971a1b2
Add accessPath on Location objects to syft-json output ( #2287 )
...
* add accessPath on Location objects to syft-json output
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* generate json schema v12.0.1
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-11-08 17:05:30 -06:00
Alex Goodman
1aaa644007
Remove MetadataType from core package object and normalize JSON metadataType values ( #1983 )
...
* [wip]
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* distinct the package metadata functions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove metadata type from package core model
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* incorporate review feedback for names
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add RPM archive metadata and split parser helpers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* clarify the python package metadata type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename the KB metadata type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* break hackage and composer types by use case
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* linting fix
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix encoding and decoding for syft-json and cyclonedx
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump json schema to 11
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update cyclonedx-json snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update cyclonedx-xml snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update spdx-json snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update spdx-tv snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update syft-json snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* correct metadata type in stack yaml parser test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix bom-ref redactor for cyclonedx-xml
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add tests for legacy package metadata names
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate json schema v11
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix legacy HackageMetadataType reflect type value check
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* packagemetadata discovery should account for type shadowing
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix cli tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump json schema version to v12
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update json schema to incorporate changes from main
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add syft-json legacy config option
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add tests around v11-v12 json decoding
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add docs for SYFT_JSON_LEGACY
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename structs to be compliant with new naming scheme
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-10-30 12:12:04 -04:00
Colm O hEigeartaigh
1daf18fee9
feat: Perform case insensitive matching on Java license files ( #2235 )
...
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org >
2023-10-25 09:51:59 -04:00
Alex Goodman
7392d607b6
Split the sbom.Format interface by encode and decode use cases ( #2186 )
...
* split up sbom.Format into encode and decode ops
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update cmd pkg to inject format configs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump cyclonedx schema to 1.5
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* redact image metadata from github encoder tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add more testing around format decoder identify
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add test case for format version options
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix cli tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix CLI test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] - review comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* keep encoder creation out of post load function
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* keep decider and identify functions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add a few more doc comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove format encoder default function helpers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address PR feedback
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* move back to streaming based decode functions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* with common convention for encoder constructors
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests and allow for encoders to be created from cli options
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix cli tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* buffer reads from stdin to support seeking
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-10-25 13:43:06 +00:00
Alex Goodman
7018573bf7
Remove internal string set ( #2219 )
...
* remove internal string set
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* incorporate changes from #2227
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* beef up the pkg.License.Merg() doc string
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-10-17 12:52:11 -04:00
Colm O hEigeartaigh and Alex Goodman
144ed725a7
Add additional license filenames ( #2227 )
...
* Add additional license filenames
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org >
* add comment about the license list being manually updated
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-10-16 13:20:00 +00:00
Alex Goodman
ef759038f5
Add relationships for dpkg packages ( #2212 )
...
* add relationships for deb packages
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* small refactor to remove duplicate code
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-10-11 08:56:26 -04:00
Christopher Angelo Phillips
30f0686353
chore: update license list to 3.22 ( #2201 )
2023-10-06 10:56:47 -04:00
Stefan Profanter
ec4d595920
feat: add dependency information to conan lockfile parser ( #2131 )
...
Signed-off-by: Stefan Profanter <stefan.profanter@agile-robots.com >
2023-09-15 14:31:08 -04:00
Keith Zantow
a46d12270f
fix: encode and decode FileLicenses and FileContents in Syft JSON ( #2083 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2023-09-13 16:14:20 -04:00
Keith Zantow and Alex Goodman
2b7a9d0be3
chore: update CLI to CLIO ( #2001 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-08-29 15:52:26 -04:00
b03e9c6868
Add registry certificate verification support ( #1734 )
...
* add registry certificate verification support
* replace stereoscope version
* modify go.mod
* pull in stereoscope update
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename registry cert options, add docs, and add test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update to account for changes in anchore/stereoscope#195
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix cli tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: lishituo <24578666@qq.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-08-29 11:45:20 -04:00
Sirish Bathina
62f689824c
Detect golang boring crypto and fipsonly modules ( #2021 )
...
* Extending build info to include crypto settings
Signed-off-by: Sirish Bathina <sirish@kasten.io >
* Use kasten fork for goversion module
Signed-off-by: Sirish Bathina <sirish@kasten.io >
* go mod tidy
Signed-off-by: Sirish Bathina <sirish@kasten.io >
* change key to GoCryptoSettings and lint fix
Signed-off-by: Sirish Bathina <sirish@kasten.io >
* Addressing feedback
Signed-off-by: Sirish Bathina <sirish@kasten.io >
---------
Signed-off-by: Sirish Bathina <sirish@kasten.io >
2023-08-24 09:49:59 -04:00
Christopher Angelo Phillips
466da7cbda
931: binary cataloger exclusion defaults for ownership by overlap ( #1948 )
...
Fixes #931
PR #1948 introduces a new implicit exclusion for binary packages that overlap by file ownership and have certain characteristics:
1) the relationship between packages is OwnershipByFileOverlap
2) the parent package is an "os" package - see changelog for included catalogers
3) the child is a synthetic package generated by the binary cataloger - see changelog for included catalogers
4) the package names are identical
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2023-08-08 13:00:52 -04:00
Alex Goodman and manifestori
063e9da65d
Guess unpinned versions in python requirements.txt ( #1966 )
...
* feat: python requirements.txt parsing inclusive
Signed-off-by: manifestori <ori@manifestcyber.com >
* refactor: parseVersion
Signed-off-by: manifestori <ori@manifestcyber.com >
* add python config for optional requirements version constraint resolution
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* allow for python requirements metadata to be optional
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* restore cyclonedx dependency
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: manifestori <ori@manifestcyber.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Co-authored-by: manifestori <ori@manifestcyber.com >
2023-07-27 14:26:59 -04:00
Alex Goodman
d84120f499
bump JSON schema to account for simplified python env markers ( #1967 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-07-27 14:13:17 +00:00
Tristan Farkas
e1c1832f84
Add cataloger for Swift Package Manager. ( #1919 )
...
Signed-off-by: Tristan Farkas <Tristan.Farkas@axis.com >
2023-07-25 14:35:21 -04:00
Dan Luhring and Alex Goodman
8478e0bef7
Add support for parsing .NET assemblies ( #1943 )
...
* Add support for parsing .NET assemblies
Signed-off-by: Dan Luhring <dluhring@chainguard.dev >
Former-commit-id: 69c33fe4d77357d843c11590f3b07825bc6249ac
* Add dll and exe files
Signed-off-by: Dan Luhring <dluhring@chainguard.dev >
Former-commit-id: b9d204efa6d2ef385b5fbb7a59a3474ecabea641
* Add PE cataloger to directory catalogers
Signed-off-by: Dan Luhring <dluhring@chainguard.dev >
Former-commit-id: 9711c00d9da92e2887e0c1f92edd740ea5345849
* Don't set language to dotnet for PEs
Signed-off-by: Dan Luhring <dluhring@chainguard.dev >
Former-commit-id: 368313fddac9160d8a06a01ebe8c5ac7990232f5
* Fix spelling of cataloger in constructor
Signed-off-by: Dan Luhring <dluhring@chainguard.dev >
Former-commit-id: e42fd77b2f8b6d42e076a84f6cce386861260941
* Adjust which cases in PE parsing return errors
Signed-off-by: Dan Luhring <dluhring@chainguard.dev >
Former-commit-id: 95b25f8fc3a7d4e18fe30e489b09851f316795ff
* remove build binary from branch
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Former-commit-id: fa54c0d0aef0998d5520e9f44cae51f5f9cd38a2
* Fix failing CLI tests
Signed-off-by: Dan Luhring <dluhring@chainguard.dev >
---------
Signed-off-by: Dan Luhring <dluhring@chainguard.dev >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-07-19 15:34:07 -04:00
Christopher Angelo Phillips
72616db81f
fix: "or-later" suffix updated to consider deprecated "+" operator ( #1907 )
...
* fix: or-later suffix has been updated to consider deprecated +
If a given license has the suffix "or-later" it previously could have
been considered or represented with a "+". Example "GFDL-1.0-or-later"
could have been represented as "GFDL-1.0+". This PR allows the license
list generation to consider "or-later" as == to "+" when generating
permutations for upgrading deprecated licenses.
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2023-07-11 16:21:29 +00:00
Alex Goodman
Brian EbarbandAlex Goodman
Weston Steimel
Laurent Goderre
Alexandr HacicheantandAlex Goodman
Asi GreenholtsandAlex Goodman
William Murphy
Dan Luhring
Colm O hEigeartaigh
Stefan Profanter
Keith Zantow
Sirish Bathina
Tristan Farkas