oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-30 14:02:26 +01:00
Code Issues Packages Projects Releases Wiki Activity
863 Commits 65 Branches 273 Tags
51c6eb30f5cb9fe9af6bb55277ed4c728d0f6906
Commit Graph
863 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Alex Goodman 51c6eb30f5 bump stereoscope to include functional options (#823) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-14 20:40:51 -05:00
Christopher Angelo Phillips e1e9ccb401 update golang crypto library dependency (#815) 
* bump golang crypto to resolve CVE-2020-29652

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* go mod tidy

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-02-11 13:36:52 -05:00
Alex Goodman 220f3a24fd deduplicate SPDX tag-value package IDs (#813) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-10 21:18:00 +00:00
Alex Goodman ca032434b3 Add pURL generation for java packages + fix NPM pURL generation (#812) 
* enhance pURL generation for java packages

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* optionally split out npm namespaces for pURL generation

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* nit updates

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-10 13:46:38 -05:00
j-k 5ab872c732 Add nix install details (#800) 
Signed-off-by: 06kellyjac <jack@control-plane.io>
 2022-02-09 14:33:26 -05:00
Jonas Xavier a04fa68539 Ensure completion of UI progress bar (#810) 
* update stereoscope

fetches latest fixes for UI

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* use context when getting image

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>
 2022-02-09 11:23:58 -08:00
Keith Zantow 76f8205936 Suport SPDX SBOM decoding (#738) 2022-02-09 14:11:20 -05:00
Jonas Xavier ca081ae5e0 use SYFT_LOG_FILE env var (#805) 
* use SYFT_LOG_FILE

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* enable debug logs when SYFT_LOG_FILE is set

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* set log.file and add tests

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* test log file in temp directory

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* add note on binding refactor

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* remove unused function

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>
 2022-02-09 10:04:08 -08:00
Christopher Angelo Phillips 8f96adacfb Upgrade golang to 1.17 (#809) 
* initial upgrade workflow

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* update go.mod

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-02-09 11:08:24 -05:00
Alex Goodman 8f292958a6 set version makefile var for updating version file (#808) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-09 08:25:31 -05:00
majinghe 23e1bd3984 add metadata filed on pod usage template (#788) 
Signed-off-by: xiaomage <jhma@gitlab.cn>
 2022-02-08 16:00:19 -05:00
Alex Goodman ac024f94a4 encapsulate showing the signing log with failing (#807) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-08 01:26:34 +00:00
Alex Goodman 0ed2842123 serialize notarization (#806) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
v0.37.10 		2022-02-07 23:47:47 +00:00
Alex Goodman b78c90d018 use parent dir for notarization zip (#804) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
v0.37.9 		2022-02-07 22:50:48 +00:00
Alex Goodman 2c62651c82 run signing as post-build step (#803) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
v0.37.8 		2022-02-07 16:55:15 -05:00
Alex Goodman 5519a25035 dont add signing artifact (#802) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
v0.37.7 		2022-02-07 17:03:09 +00:00
Alex Goodman 950ad681a0 Stabilize CI behavior (#796) 
* reduce parallelism of builds and increase install.sh test setup buffer

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* change logging mechanism for signing

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* restore automatic parallelism determination for goreleaser

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* rm logging goreleaser version

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
v0.37.6 		2022-02-07 07:55:11 -08:00
Keith Zantow 1e338502ff Update SPDX license list (#801) 2022-02-07 15:24:08 +00:00
Alex Goodman 37251f6179 Fix intermittent slow CLI tests (#797) 
* use a port that is porbably not in use

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* template cli test args

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-06 15:53:55 +00:00
Alex Goodman e474b2f23c docker auth must occur after setting up prod keychain (#795) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
v0.37.5 		2022-02-05 15:23:05 +00:00
Alex Goodman e7bef5e511 split signing setup into pre-release hook (#794) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
v0.37.4 		2022-02-04 16:49:42 -05:00
Alex Goodman e4ac7700dd pass notarize arg, not original archive (#793) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
v0.37.3 		2022-02-04 19:44:37 +00:00
Alex Goodman d3469801fc repackage all file in notarization temp dir (not from tar output) (#792) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
v0.37.2 		2022-02-04 19:04:15 +00:00
Alex Goodman 3f50bb8fa7 tput requires explicit terminal type in CI (#791) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
v0.37.1 		2022-02-04 18:23:30 +00:00
Alex Goodman 341288ba29 Normalize snapshot and release artifacts (#789) 
* refactor signing steps in release/snapshot workflows

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* show signing logs on snapshot or release failure

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update install.sh + tests to account for new goreleaser changes

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update cli tests to account for new goreleaser build names

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix acceptance test to use new snapshot bin path

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add notarization

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* address review comments

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
v0.37.0 		2022-02-04 12:41:37 -05:00
Jonas Xavier 40423d8eee update stereoscope version - include Podman support (#781) 
* update stereoscope

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* go mod tidy

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* fix FilesByMIMEType tests

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* change expected mime types in unit tests

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* test stereoscope fix

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* remove mod replace and use latest stereoscope

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>
 2022-02-01 14:47:15 -08:00
Alex Goodman f38b0b7256 Refactor install.sh (#765) 
* [wip] get assets based on gh api

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* put install.sh download_asset fn under test

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* put install.sh install_asset fn under test

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* use zip for darwin installs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix install.sh negative test cases

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* allow errors to propagate in install.sh

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove exit on error from install.sh tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add more docs around install.sh helpers

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add integration tests for install.sh

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add install.sh testing to pipeline

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add install test cache to CI

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* make colors globally available

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* test download against github release

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* always test release-based install against latest release

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* use better install.sh test names

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-01 16:58:47 -05:00
Idan Frimark ed1cbf50d9 Update README.md (#772) 
Update `Example attest`

Signed-off-by: Idan Frimark <idanf@cisco.com>
 2022-01-27 19:59:36 +00:00
Alex Goodman d7a23e4bb2 Extract language and package type from pURLs on SBOM decode (#777) 
* add language detection from pURLs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add package type detection from pURLs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add cargo and npm pURL support

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix npm tests and linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-01-27 09:35:16 -05:00
Vijay Pillai 9f7104d4f1 update go-bouncer to version 0.3.0 for ARM support (#776) 
Signed-off-by: Vijay Pillai <vijay.pillai@anchore.com>
 2022-01-26 16:19:37 +00:00
Joris van Eijden a3b8ef709c Add PHP (#770) 
PHP Composer packages are also supported.

Signed-off-by: Joris van Eijden <joris.vaneijden@oneshoe.nl>
 2022-01-26 10:25:32 -05:00
Christopher Angelo Phillipsandhectorj2f 024a5a9f3f Add dependencies to cyclonedx (#768) 
Add dependencies to cyclonedx

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: hectorj2f <hectorf@vmware.com>
 2022-01-25 15:34:16 -05:00
Peter BaloghandAlex Goodman 161fa7be4a [CycloneDX] Add artifactID and groupID to the cycloneDX properties (support lower level struct as properties) (#758) 
* [CycloneDX] Add artifactID and groupID to the cycloneDX properties

Signed-off-by: Peter Balogh <p.balogh.sa@gmail.com>

* update comment

Signed-off-by: Peter Balogh <p.balogh.sa@gmail.com>

* additional checks for value

Signed-off-by: Peter Balogh <p.balogh.sa@gmail.com>

* fill group filed with groupID in the case of Java

Signed-off-by: Peter Balogh <p.balogh.sa@gmail.com>

* fix linter warning

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2022-01-25 10:36:15 -05:00
Alex Goodman 6f0fad7ffd encode upstream qualifier on os package pURLs (#769) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-01-25 09:55:56 -05:00
Christopher Angelo Phillips d2e815a2c5 Add attestation workflow to README (#759) 
* add attestation workflow to README

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-01-24 15:04:57 +00:00
Weston Steimel f7a44b3d2c convert from deprecated org.label-schema to OCI Annotations in Dockerfile (#763) 
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2022-01-21 21:58:10 +00:00
Christopher Angelo Phillips f3d3eddc96 update config so on copy paste it works without edits (#762) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-01-21 14:15:22 +00:00
Alex Goodman 1350d6c5bf Improve package URL support (#754) 
* rename npm metadata struct

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* improve os package URLs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* improve language package URLs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* wire up composer pURL method

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-01-19 22:30:29 +00:00
Christopher Angelo Phillips c350bd55f6 update sign sed command to include windows zip (#755) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-01-19 17:08:04 -05:00
Sambhav Kothari aebe843c6f Improve CycloneDX format output (#710) 
* Improve CycloneDX format output

## Additions to CycloneDX output

* CPEs
* Authors
* Publishers
* External References (Website, Distribution, VCS)
* Description

Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net>
v0.36.0 		2022-01-19 11:43:16 -05:00
Alex Goodman 829e500aa9 Add additional PHP metadata (#753) 
* add php related metadata

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* enable decoding of php metadata for syftjson format

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add php metadata to json schema

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-01-19 11:42:16 -05:00
Toure Dunnon 814f2bf8b9 Update Syft formats for SyftJson (#752) 
* Update Syft formats for SyftJson

This change will introduce omitempty struct tag to PackageCustomData.
This struct tag will cause null and empty values to be dropped on serialization
for consumers downstream.

Signed-off-by: Toure Dunnon <toure.dunnon@anchore.com>

* Updated the golden files for syftjson to allow for proper
test coverage.

Signed-off-by: Toure Dunnon <toure.dunnon@anchore.com>
 2022-01-18 17:18:34 -05:00
Dan Luhring c61204f56d Add support for "file" source type in syftjson unmarshaling (#750) 
* Add tests for image and directory syftjson source

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Add failing test case for file source unmarshaling

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Fix file source unmarshaling

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Add test case for unknown source type

Signed-off-by: Dan Luhring <dan+github@luhrings.com>
 2022-01-18 13:40:39 -05:00
Weston Steimel 46dcc84f1a support .sar for java ecosystem (#748) 
Signed-off-by: Weston Steimel <weston.steimel@gmail.com>
 2022-01-18 09:22:02 -05:00
Alex Goodman 86c3c1c531 Start developer documentation (#746) 
* draft outline for developing docs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update outline

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* list testing dependencies

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix header indention

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix title

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-01-14 06:17:25 -05:00
Keith Zantow f59af255e3 Align SPDX export more with SPDX 2.2 specification (#743) 2022-01-13 15:27:06 -05:00
Alex Goodman 706f291679 Replace distro type (#742) 
* remove strong distro type

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* bump json schema to v3 (breaking distro shape)

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* allow for v2 decoding of distro idLikes field in v3 json decoder

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix casing in simple linux release name

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* use discovered name as pretty name in simple linux release

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-01-12 12:13:42 -05:00
Christopher Angelo Phillips dfefd2ea4e update goreleaser with windows checksums (#740) 
* update goreleaser with windows checksums

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* update format to be closer to our previous implementation

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* remove linux replacement

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* typo

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-01-10 14:52:31 -05:00
Christopher Angelo Phillips b77ddfc29c bump stereoscope version to remove old containerd (#741) 
* bump stereoscope version to remove old containerd

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* go mod tidy

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
v0.35.1 		2022-01-10 13:40:24 -05:00
Keith Zantow 5e5312c72d Add support for multiple output files in different formats (#732) v0.35.0 2022-01-06 17:52:20 -05:00