oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-05 08:56:41 +01:00
Code Issues Packages Projects Releases Wiki Activity
3,016 Commits 65 Branches 274 Tags
538b4a21946ba685a051aed51f942c1769e3b960
Commit Graph
111 Commits
Author SHA1 Message Date
Alex Goodman d22914baf5 add docs to configs (#4281) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-10-14 13:58:31 -04:00
Christopher Angelo PhillipsandAlex Goodman 13ffeeb3d0 feat: combine go module file and go source discovery into single cataloger (#4127) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-08-26 19:35:44 +00:00
Christopher Angelo PhillipsandAlex Goodman f77d503892 detect license ID from full text when incidentally provided as a value (#3876) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-13 16:37:18 -04:00
Weston Steimel de88b973f8 chore: fix some logging output (#3884) 
Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>
 2025-05-13 13:15:19 +01:00
Alex Goodman f9d0fa81ab do not search binary contents for version for go package (#3874) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-09 17:49:17 +00:00
Alex Goodman a7816dc9e7 clear devel version for go packages (#3873) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-09 13:36:52 -04:00
VictorHuuandAlex Goodman ea7e9e696b fix:Make the parse of the replace part in ``go.mod`` more compliant and traceable (#3812) 
* We only need to replace the name of a GoLang package when the name is a web link

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* make the detection of a localfile path pattern more easy

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* consider the m.New.Version so the granularity is narrowed

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* to pass the static-analysis

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* to pass the static-analysis

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>

* add test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-04-21 17:58:54 +00:00
anchore-actions-token-generator[bot]andspiffcs f11377fe30 chore(deps): update tools to latest versions (#3775) 
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>
 2025-04-03 17:35:26 +00:00
Keith Zantow 7ac4d91f43 chore: reformat (#3754) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-03-21 06:13:35 -04:00
Alex Goodman e9b24a29d7 Remove mitchellh dependencies (#3748) 
* remove mitchellh dependencies

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix failing unit tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-03-20 10:19:19 -04:00
Alex Goodman 34e5ff753f Location order on packages should consider evidence annotations when sorting (#3720) 
* fix: sorting locations should consider pkg evidence

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* simplify location test options for comparison

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-03-11 10:34:37 -04:00
TechVest 04941c8b97 chore: fix some function names in comment (#3717) 
Signed-off-by: TechVest <techdashen@qq.com>
 2025-03-10 11:34:10 -04:00
Keith Zantow 2328b20082 fix: reduce warn levels to debug for non-actionable errors (#3645) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-02-07 13:22:55 -05:00
Christopher Angelo Phillips e584c9f416 feat: 3626 add option enable license content; disable by default (#3631) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-02-05 20:41:03 +00:00
HeyeOpenSourceandChristopher Phillips f7e767fc25 feat: update licenses to including license content when SPDX expressions are unable to be determined (#3366) 
---------
Signed-off-by: HeyeOpenSource <opensource@heye-international.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-01-28 18:05:27 +00:00
Dominik SchmidtandKeith Zantow 19a75fe504 feat(golang): add license parsing from vendor dirs (#3522) 
Signed-off-by: Dominik Schmidt <dev@dominik-schmidt.de>
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
 2025-01-17 20:25:05 -05:00
Christopher Angelo Phillips 8198a706d6 chore: bump packageurl-go with new parsing rules (#3596) 
* chore: bump packageurl-go with new parsing rules
* test: update expectedPURL in unit tests to match new % encoding
---------

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-01-17 16:20:14 -05:00
Keith Zantow a2a56dd3e9 fix: golang remote license search not executing when error reading local mod dir (#3549) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-01-06 11:47:55 -05:00
Alex Goodman cbce129bb9 Use reader when scanning for package versions over reading entire binary into memory (#3558) 
* use streaming readers

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* replace redis search patterns

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address PR feedback

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-01-02 22:12:37 +00:00
Christopher Angelo Phillips 561ed50c2d chore: migrate syft to use the anchore fork of archiver without replace (#3516) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2024-12-10 13:33:24 -05:00
Alex Goodman e4e985b9b0 Create single license scanner for all catalogers (#3348) 
* add single license scanner instance

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* rename testing license scanner

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-10-21 16:17:12 +00:00
Weston Steimel e962c10da7 fix: improve go binary semver extraction for traefik (#3325) 
Improves the go cataloger semver extraction logic to include getting the
release version of traefik.  This is based off of the regex pattern that
already existed in the traefik binary classifier.

Signed-off-by: Weston Steimel <commits@weston.slmail.me>
 2024-10-14 09:41:34 -04:00
Keith ZantowandAlex Goodman ccbee94b87 feat: report unknowns in sbom (#2998) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-10-07 16:11:37 -04:00
Alex Goodman 0a3f513f92 Slim down docker cache size (#3190) 
* slim down docker cache size

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove old centos images

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* troubleshoot test failure

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix wget version ref

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* refactor caching mechanisms

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add cache cleanup steps

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* simplify deleting cache

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix first clone issue

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add tool dep

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-09-09 11:15:13 -04:00
Keith Zantow 95b4a88256 fix: logging for remote network calls (#3140) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-08-20 11:45:33 -04:00
Christopher Angelo Phillips c84cb2cf84 fix: update mainModuleVersion function to always prefix v to findings (#3087) 
* chore: basic fix
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
* test: make sure ldflags are prefixed with v
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2024-08-01 11:29:07 -04:00
Laurent Goderre 4882d2e8ce Only match ldflag version if it matches the main module or targets main.version (#3062) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2024-07-25 13:56:55 -04:00
Alex Goodman 9573f557d1 better go mod detection from partial package builds (#3060) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-07-24 09:34:40 -04:00
William Murphy 75902b0540 fix: stop panicking on "devel" version go stdlib (#3043) 
Previously, if a Go binary was cataloged with build info indicating that
the go compiler version used was "deve", syft would panic on a nil
pointer dereference. Instead, skip creating a Go stdlib reference and
relationship for such a package.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2024-07-16 09:51:14 -04:00
Keith Zantow bd1c1d260c fix: handle errors reading go licenses (#2985) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-06-24 10:27:03 -04:00
Weston SteimelandAlex Goodman 749ccc59c1 fix(golang): improve version extraction from ldflags for pingcap TiDB (#2962) 
* fix(golang): improve version extraction from ldflags for pingcap TiDB

Signed-off-by: Weston Steimel <commits@weston.slmail.me>

* loosen ld flag parsing requirements

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Weston Steimel <commits@weston.slmail.me>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-14 14:35:14 +01:00
Keith Zantow ca0cc52d47 fix: separate golang license caches from mod dir (#2852) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-06-12 19:12:35 -04:00
Alex Goodman db0c33481e pin golang image (#2944) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-10 09:59:33 -04:00
Christopher Angelo Phillips 7508d75b2b fix: update unit tests to use pinned patch version (#2932) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2024-06-05 18:31:38 +00:00
Alex Goodman f4a69e6d35 add relationships for go binary packages (#2912) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-05-30 11:37:17 -04:00
Jon JohnsonandWill Murphy c314e05aae Handle GOEXPERIMENTs in go version (#2893) 
* Handle GOEXPERIMENTs in go version

Signed-off-by: Jon Johnson <jon.johnson@chainguard.dev>

* bump JSON schema

Signed-off-by: Will Murphy <will.murphy@anchore.com>

---------

Signed-off-by: Jon Johnson <jon.johnson@chainguard.dev>
Signed-off-by: Will Murphy <will.murphy@anchore.com>
Co-authored-by: Will Murphy <will.murphy@anchore.com>
 2024-05-25 20:23:30 +00:00
Russell Haering 2356787053 Go Mod Cataloger: Remove Replaced Packages (#2891) 
When the goModCataloger processes a Replace directive it currently adds the new
package to the resulting package list, but does not remove the old one unless
the path is unchanged.

Based on an existing comment in the code, removing the old one seems to be the
intended behavior, and results in a more expected end-result, so this does so.

Signed-off-by: Russell Haering <russellhaering@gmail.com>
 2024-05-22 14:26:40 -04:00
Christopher Angelo Phillips ee75aafa37 chore: fix small tooling error for go.mod (#2868) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2024-05-13 11:47:21 -04:00
William Murphy b2ca5fbf89 fix Windows file paths in local go mod cache (#2654) 
Previously, the file resolver was created from incorrect calls
(path.Join instead of filepath.Join) which resulted Go license searches
always missing on Windows. Use filepath.* functions when initializing
the Go config, and when the unindexed file resolver is being created.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2024-05-09 13:08:58 -04:00
William Murphy 3713d97b7b chore: use ruleguard to test for missing defer statements (#2837) 
* chore: ruleguard to enforce defer use

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* fix go.mod location

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* chore: defer close in linux release identifier

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* chore: better lint suggestion

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* chore: refactor binary classifier to defer close

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* chore: defer close readers in gentoo cataloger

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* chore: make go license parsing defer close readers

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* chore: defer closing readers in alpine apm parser

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* chore: defer close readers in graalvm parser

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* chore: defer close readers in debian package parser

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* chore: defer close readers in alpm parser

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* chore: defer close readers in executable file cataloger

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* chore: defer close readers in javascript license parser

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* chore: defer close readers in go mod parser

Signed-off-by: Will Murphy <will.murphy@anchore.com>

---------

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2024-05-07 05:42:29 -04:00
Keith ZantowandWill Murphy dde5d349b1 fix: more robust go main version extraction (#2767) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Will Murphy <will.murphy@anchore.com>
Co-authored-by: Will Murphy <will.murphy@anchore.com>
 2024-04-11 11:58:51 -04:00
Christopher Angelo Phillips e100776f22 chore: update anchore/packageurl-go to use latest commits (#2746) 
chore: update packageurl-go dependency to use latest commits
chore: go mod tidy
unit: update + -> %2B
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2024-04-04 10:33:51 -04:00
guangwu ebb9d4edb6 chore: remove deprecated os.SEEK_SET os.SEEK_CUR (#2693) 
Signed-off-by: guoguangwu <guoguangwug@gmail.com>
 2024-03-07 13:10:48 -05:00
William Murphy 63171b55dd fix: stop emitting bus events on go mod events (#2673) 
Previously, the TUI would hang when scanning directories with lots of go
packages, possibly because this path was spamming the TUI with too
many events. Since checking on a particular go module is fast, don't
show TUI events for each one.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2024-02-28 14:14:46 -05:00
Alex Goodman 84576b93e1 Guess go main module version based on binary contents (#2608) 
* guess go main module version based on binary contents

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add configuration options for golang main module version heuristics

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix test setup for go bin cataloger

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix unit test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix incorrect test assert ordering

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* handle error from seek

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-09 19:52:42 +00:00
Alex Goodman 3023a5a7bc Detect ELF security features (#2443) 
* add detection of ELF security features

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix linting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update json schema with file executable data

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update expected fixure when no tty present

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* more detailed differ

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* use json differ

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove json schema addition

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* regenerate json schema

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix mimtype set ref

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-02 16:51:18 +00:00
William Murphy b7a6d5e946 feat: Record where CPEs come from (#2552) 
Syft can get CPEs from several source, including generating them based on
package data, finding them in the NVD CPE dictionary, or finding them declared
in a manifest or existing SBOM. Record where Syft got CPEs so that consumers of
SBOMs can reason about how trustworthy they are.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2024-02-02 16:17:52 +00:00
Alex Goodman 6107e5e2ad translate maps to sequences in pkg metadata (#2553) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-01 11:58:10 -05:00
Alex Goodman f893933336 internalize format helpers (#2543) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-01-26 12:16:26 -05:00
Laurent Goderre d7c51e5c82 Implement golang Purl subpath (#2547) 
* Added test for golang package that include subpath into the module

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>

* Implement golang purl subpath

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>

---------

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2024-01-25 17:04:28 -05:00