oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-31 06:26:30 +01:00
Code Issues Packages Projects Releases Wiki Activity
3,050 Commits 65 Branches 273 Tags
4e06a7ab324626c4faa5db13e2dbc3cb438da2a4
Commit Graph
116 Commits
Author SHA1 Message Date
Tim Olshansky 4e06a7ab32 feat(javascript): Add dependency parsing (#4304) 
* feat: Add dependency parsing to javascript package locks

Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com>

* Bump schema version

Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com>

* Add support for yarn and pnpm, excl. yarn v1

Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com>

* Add support for dependencies for v1 yarn lock files

Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com>

* Ensure schema is correctly generated

Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com>

* Fix tests

Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com>

* PR feedback

Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com>

---------

Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com>
 2025-11-06 16:03:43 -05:00
Rez Moss 45bf8b14ab fix: omit records with empty PURL in GitHub format (#4312) 
Signed-off-by: Rez Moss <hi@rezmoss.com>
 2025-10-28 18:34:10 -04:00
Will Murphy 0d9ea69a66 Respect "rpmmod" PURL qualifier (#4314) 
Red Hat purls the RPM modularity info in a query param in the PURLs in
their vulnerability data. It would be nice if Syft respected this
qualifier so that Grype can use it when a Red Hat purl is passed.

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
 2025-10-28 09:35:11 -04:00
Pavel BuchartandKeith Zantow e923db2a94 Add PDM parser (#4234) 
Signed-off-by: Pavel Buchart <pavel@buchart.cz>
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
 2025-10-16 08:50:44 -04:00
Alex Goodman d22914baf5 add docs to configs (#4281) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-10-14 13:58:31 -04:00
Alex Goodman 4ae8f73583 migrate json schema generation (#4270) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-10-10 14:16:28 +00:00
Alan PopeandChristopher Phillips 0a36dabf23 feat(cataloger): add snap package cataloger for metadata extraction (#4151) 
---------
Signed-off-by: Alan Pope <alan.pope@anchore.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-09-26 10:42:29 -04:00
Christopher Angelo PhillipsandAlex Goodman 13ffeeb3d0 feat: combine go module file and go source discovery into single cataloger (#4127) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-08-26 19:35:44 +00:00
Simeon StoykovandChristopher Phillips a433045d51 feat: basic Conda ecosystem support (#4002) 
----------------------------------------------------------------
Signed-off-by: Simeon Stoykov <simeon.stoykov@quantco.com>
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-08-19 22:37:27 -04:00
Christopher Angelo Phillips 6b48bd4b5e feat: add package supplier flag (#4131) 
---------

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-08-12 14:49:41 -04:00
Christopher Angelo Phillips 89470ecdd3 feat: update syft license construction to be able to look up by URL (#4132) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-08-12 14:30:32 -04:00
Joshua Kuglerdependabot[bot]Alex Goodmananchore-actions-token-generator[bot]wagoodman
 		c491dab35b feat: add parsing for uv.lock (#3763) 
* feat: add parsing for uv.lock (#3268)

Signed-off-by: Joshua Kugler <tek30584@adobe.com>

* Still no tests, but much more complete

Next up: start writing tests! :)

Signed-off-by: Joshua Kugler <tek30584@adobe.com>

* chore: finish out functionality and write tests

Signed-off-by: Joshua Kugler <tek30584@adobe.com>

* Merge the .NET deps.json and PE binary catalogers (#3563)

* add combined deps.json + pe binary cataloger

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* deprecate pe and deps standalone catalogers

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* parse resource names + add tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix integration and CLI tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add some helpful code comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* allow for dropping Dep packages that are missing DLLs

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* migrate json schema changes to 24

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* keep application configuration

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* correct config help

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* [wip] detect claims of dlls within deps.json

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* [wip] fix tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add assembly repack detection

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* .net package count is lower due to dll claim requirement

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Joshua Kugler <tek30584@adobe.com>

* better .NET cpe generation (#3764)

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Joshua Kugler <tek30584@adobe.com>

* Better represent .NET runtime packages (#3768)

* clean up .NET runtime packages

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add runtime relationships

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove runtime references from binary package name

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Joshua Kugler <tek30584@adobe.com>

* chore(deps): update CPE dictionary index (#3769)

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>
Signed-off-by: Joshua Kugler <tek30584@adobe.com>

* chore(deps): bump modernc.org/sqlite from 1.36.1 to 1.37.0 (#3771)

Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.36.1 to 1.37.0.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.36.1...v1.37.0)

---
updated-dependencies:
- dependency-name: modernc.org/sqlite
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Joshua Kugler <tek30584@adobe.com>

* chore(deps): bump 8398a7/action-slack from 3.16.2 to 3.18.0 (#3767)

Bumps [8398a7/action-slack](https://github.com/8398a7/action-slack) from 3.16.2 to 3.18.0.
- [Release notes](https://github.com/8398a7/action-slack/releases)
- [Commits](https://github.com/8398a7/action-slack/compare/28ba43ae48961b90635b50953d216767a6bea486...1750b5085f3ec60384090fb7c52965ef822e869e)

---
updated-dependencies:
- dependency-name: 8398a7/action-slack
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Joshua Kugler <tek30584@adobe.com>

* chore(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 (#3766)

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.37.0 to 0.38.0.
- [Commits](https://github.com/golang/net/compare/v0.37.0...v0.38.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Joshua Kugler <tek30584@adobe.com>

* chore: move/modify code for lint issues

Signed-off-by: Joshua Kugler <tek30584@adobe.com>

* chore: make sure private structs are not exported

Signed-off-by: Joshua Kugler <tek30584@adobe.com>

* fix tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* generate json schema

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* chore: update readme to include uv

Signed-off-by: Joshua Kugler <tek30584@adobe.com>

* chore: use uv as the package manager name

Signed-off-by: Joshua Kugler <tek30584@adobe.com>

---------

Signed-off-by: Joshua Kugler <tek30584@adobe.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: anchore-actions-token-generator[bot] <102182147+anchore-actions-token-generator[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-07-17 18:26:56 +00:00
mikey strauss 9caad26ee5 Pkg Metadata type unmarshal bug (#4043) 
Signed-off-by: houdini91 <mdstrauss91@gmail.com>
 2025-07-14 10:28:38 -04:00
Keith ZantowandAlex Goodman 02703d5c80 feat: RHEL EUS detection (#4023) 
* feat: rhel eus detection

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: update tests

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: update more tests

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* rename feature detection functions

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-07-07 14:11:20 +00:00
Carlos Tadeu Panato JuniorandAlex Goodman 2111d4d0e4 chore: upgrade tablewriter dependency to use new API (#3990) 
* upgrade tablewriter

Signed-off-by: Carlos Panato <ctadeu@gmail.com>

* remove header line whitespace

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix static analysis

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Carlos Panato <ctadeu@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-07-01 16:16:16 -04:00
dependabot[bot]andAlex Goodman 179cc70a36 chore(deps): bump github.com/Masterminds/semver/v3 from 3.3.1 to 3.4.0 (#4040) 
* chore(deps): bump github.com/Masterminds/semver/v3 from 3.3.1 to 3.4.0

Bumps [github.com/Masterminds/semver/v3](https://github.com/Masterminds/semver) from 3.3.1 to 3.4.0.
- [Release notes](https://github.com/Masterminds/semver/releases)
- [Changelog](https://github.com/Masterminds/semver/blob/master/CHANGELOG.md)
- [Commits](https://github.com/Masterminds/semver/compare/v3.3.1...v3.4.0)

---
updated-dependencies:
- dependency-name: github.com/Masterminds/semver/v3
  dependency-version: 3.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* update error message expectations

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-07-01 19:21:02 +00:00
Alex Goodman 2bda086423 Add ability to scan snaps (as a source) (#3929) 2025-06-25 16:53:35 -04:00
Alex Goodman 96c34ffc43 account for non-import shapes (#3997) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-06-11 13:11:40 -04:00
Alex Goodman 79b6d5daa4 Allow decoding of anchorectl json files (#3973) 
* allow decoding of import sbom file shape

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address formatting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add file mode and type processing

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* use type to interpret the raw value

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* safe mode convert should use uint32

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* simpler decoder type

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-06-10 15:03:50 -04:00
Keith Zantow 9090c69708 fix: exclude packages with SPDX GENERATED_FROM source package indication (#3981) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-06-09 14:12:23 -04:00
Alex Goodman ac883f52ed add cdx group as purl namespace (#3922) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-20 15:56:08 -04:00
Alex Goodman e23ca43a83 add PE binary cataloger (#3911) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-19 14:17:09 -04:00
Christopher Angelo Phillips e1374f758e fix: update license content filtering default case to be 'none' for no content returned 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-05-16 14:25:15 +00:00
Alex Goodman 0521ccaf5e chore: update fixtures based on CI builds (#3894) 
* update fixtures based on ci builds

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix typo

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-14 21:30:20 +00:00
Christopher Angelo Phillips 3c7018a853 feat: remove full-text before release (#3889) 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-05-14 13:12:05 +00:00
Laurent GoderreandAlex Goodman 175a6719a9 Add cataloger for Dart pubspec (#3292) 
* Add cataloger for Dart pubspec

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>

* capture pubspec specific fields

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-13 21:51:49 +00:00
Christopher Angelo PhillipsandAlex Goodman f77d503892 detect license ID from full text when incidentally provided as a value (#3876) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-13 16:37:18 -04:00
Rez MossandAlex Goodman 12d91f47dc Add a homebrew cataloger (#3724) 
* Cataloger homebrew (#4)

* homebrew cataloger

* uptd

* fixed test

* fixed test

* fixed tests

* fixed lint

* inc schema ver

* upt schema

* fixed integration test

* fixed integration tst

* fixed test

Signed-off-by: Rez Moss <hi@rezmoss.com>

* Update parse_homebrew_test.go

Signed-off-by: Rez Moss <hi@rezmoss.com>

* Update parse_homebrew_test.go

fixed DCO

Signed-off-by: Rez Moss <hi@rezmoss.com>



Signed-off-by: Rez Moss <hi@rezmoss.com>

* Update parse_homebrew_test.go

add evd anno to test

Signed-off-by: Rez Moss <hi@rezmoss.com>

* lint

Signed-off-by: Rez Moss <hi@rezmoss.com>

* fixed test

Signed-off-by: Rez Moss <hi@rezmoss.com>

* with PR refactors

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* regenerate json schema

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* regenerate jsonschema

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* refactor homebrew parser + add tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* more resiliant variable extraction

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Rez Moss <hi@rezmoss.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-13 13:01:41 -04:00
Weston Steimel de88b973f8 chore: fix some logging output (#3884) 
Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>
 2025-05-13 13:15:19 +01:00
Alex Goodman 59b880f26a order locations by container layer order (#3858) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-13 00:02:07 -04:00
Keith Zantow 621d21eb04 feat: Add PURL list input/output format (#3853) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-05-12 13:33:24 -04:00
James NeateandAlex Goodman 00c4a4e72a Use package ID from decoded SBOMs when provided (#1872) 
* fix: use package id from cyclonedx when provided

Signed-off-by: James Neate <jamesmneate@gmail.com>

* override package IDs from converted SBOMs

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix typo

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove extractSyftID function

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: James Neate <jamesmneate@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-08 11:25:30 -04:00
Christopher Angelo Phillips 1ba1186410 fix: use "contents" field and remove "fullText" license field (#3857) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-05-05 21:40:09 +00:00
Christopher Angelo Phillips 6ba087c72c fix: Do not use hashes for SPDX license names/expressions (#3844) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-05-02 09:34:08 -04:00
Christopher Angelo Phillips 94e63eb367 feat: detect when full license text has been provided and preserve as separate field (#3450) 
* feat: add full text field to syft license struct
---------
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-05-01 15:00:46 -04:00
Alan PopeandAlex Goodman baa1080ef6 Update github.com/Masterminds/semver to v3 (#3836) 
* Update semver to v3. Fixes #3829

Signed-off-by: Alan Pope <alan.pope@anchore.com>

* use single instance of regex obj

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alan Pope <alan.pope@anchore.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-04-30 20:38:12 +00:00
Laurent GoderreandAlex Goodman 529840bfc0 Add support for PHP Pear (#2775) 
* Add support for PHP Pear and unify PECL with it

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove log statements

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix struct comment

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-04-30 20:16:58 +00:00
Alex Goodman 24df095a5e empty source during decoding should not be fatal (#3791) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-04-11 10:12:29 -04:00
anchore-actions-token-generator[bot]andspiffcs f11377fe30 chore(deps): update tools to latest versions (#3775) 
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>
 2025-04-03 17:35:26 +00:00
Alex Goodman 12f36420dd Parse GitHub actions comments (#3776) 
* add version comment parsing support to github actions

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update json schema with github actions metadata

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add originator processing for github actions type

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-04-03 14:46:27 +00:00
Keith Zantow 7ac4d91f43 chore: reformat (#3754) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-03-21 06:13:35 -04:00
Alex Goodman e9b24a29d7 Remove mitchellh dependencies (#3748) 
* remove mitchellh dependencies

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix failing unit tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-03-20 10:19:19 -04:00
Alan PopeandAlex Goodman 5fa8e9c6e9 feat: add Debian archive (.deb) file cataloger (#3704) 
* feat: add Debian archive (.deb) file cataloger

Add a cataloger that parses Debian package (.deb) archive files directly,
allowing Syft to discover packages from .deb files without requiring
them to be installed on the system. This implements issue #3315.

Key features:
- Parse .deb AR archives to extract package metadata
- Support for gzip, xz, and zstd compressed control files
- Extract package metadata from control files
- Process file information from md5sums files
- Mark configuration files from conffiles entries
- Handle trailing slashes in archive member names

Signed-off-by: Alan Pope <alan.pope@anchore.com>

* chore: run go mod tidy to fix failing workflow

Signed-off-by: Alan Pope <alan.pope@anchore.com>

* add license processing to dpkg archive cataloger + add tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update json schema with dpkg archive type

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alan Pope <alan.pope@anchore.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-03-19 20:03:21 +00:00
Keith Zantow 7571f8dfba chore: updates for go 1.24.1 (#3712) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-03-06 15:35:26 +00:00
Stef GracesandKeith Zantow 694eec4079 Add downloadLocation URI validation (#3697) 
* Add downloadLocation URI validation

Signed-off-by: Stef Graces <stefgraces@hotmail.com>

* Update function names

Signed-off-by: Stef Graces <stefgraces@hotmail.com>

* Fixes for make lint-fix + Changes to when NONE and NOASSERTION in downloadLocation

Signed-off-by: Stef Graces <stefgraces@hotmail.com>

---------

Signed-off-by: Stef Graces <stefgraces@hotmail.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
 2025-03-06 14:45:47 +00:00
Juan Ariza ToledanoWill MurphyAlex Goodman
 		bffe26bcc5 feat: add support for Bitnami cataloguer (#3341) 
* prototype: start bitnami cataloger

Bitnami images have spdx SBOMs at predictable paths, and Syft could more
accurately identify the software in these images by scanning those
SBOMs. Start work on this by forking the sbom-cataloger as a new
bitnami-cataloger.

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

* wire up bitnami cataloger to run on images by default

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

* feat: add support for Bitnami cataloguer

Signed-off-by: juan131 <jariza@vmware.com>

* feat: use a better SPDX sample for unit tests

Signed-off-by: juan131 <jariza@vmware.com>

* bugfix: only report bitnami pkgs

Signed-off-by: juan131 <jariza@vmware.com>

* feat: adapt JSON schema, spdxutil and packagemetadata

Signed-off-by: juan131 <jariza@vmware.com>

* bugfix: integration tests

Signed-off-by: juan131 <jariza@vmware.com>

* feat: implement FileOwner interface

Signed-off-by: juan131 <jariza@vmware.com>

* bugfix: update json schema

Signed-off-by: juan131 <jariza@vmware.com>

* [wip] add bitnami owned files and fix binary package ownership filtering

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* feat: obtain bitnami pkg files based on SPDX relationships tree

Signed-off-by: juan131 <jariza@vmware.com>

* preserve type switches

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* rename bitnami entry metadata type

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* restrict find main pkg logic

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add missing graalvm source info

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* bugfix: integration tests

Signed-off-by: juan131 <jariza@vmware.com>

* bugfix: mod tidy

Signed-off-by: juan131 <jariza@vmware.com>

---------

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
Signed-off-by: juan131 <jariza@vmware.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-02-18 09:07:47 -05:00
Keith Zantow 2328b20082 fix: reduce warn levels to debug for non-actionable errors (#3645) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-02-07 13:22:55 -05:00
Christopher Angelo Phillips 9a9195e5c4 feat: syft 3435 - add file components to cyclonedx bom output when file metadata is available (#3539) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-01-31 15:09:15 -05:00
HeyeOpenSourceandChristopher Phillips f7e767fc25 feat: update licenses to including license content when SPDX expressions are unable to be determined (#3366) 
---------
Signed-off-by: HeyeOpenSource <opensource@heye-international.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-01-28 18:05:27 +00:00
Thomas GosteliAlex GoodmanChristopher Phillips
 		c10e904c28 feat(cataloger): add a terraform provider cataloger (#3378) 
* feat(cataloger): add a terraform provider cataloger
* chore: bump schema from 16.0.19 -> 16.0.20
------
Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-01-21 14:44:54 -05:00