Weston Steimel
9604e3dc9c
feat: support multiple known CPEs in index ( #2813 )
...
It is possible that a given package has multiple known "official" CPEs
active in the dictionary at once, so the index should support a slice of
CPE strings per package
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
2024-04-25 15:22:26 +01:00
Alex Goodman
b6cbf82389
Internalize CPE generation logic ( #2541 )
...
* migrate CPE generation logic to internal
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove create function
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-26 12:16:05 -05:00
William Murphy
878df69330
chore: stop re-exporting wfn.Attributes ( #2534 )
...
* chore: stop re-exporting wfn.Attributes
Previously, Syft re-exported wfn.Attributes from the nvdtools package as
a member of the Package struct. However, Syft doesn't own this struct,
and so after Syft 1.0, might be forced to bump a semver major version
due to a breaking change in wfn.Attributes. Rather than incur this risk
going into 1.0, instead replace Syft's use of wfn.Attributes with Syft's
own cpe.CPE type. That type has some pass-through calls to
wfn.Attributes, but hides the dependency from the rest of the
application.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* chore: make cpe.CPE type a Stringer
Previously, the cpe.CPE type was an alias for wfn.Attributes from
nvdtools. Now that it is a type we control, make the String method take
the CPE as a receiver, rather than as a normal parameter, so that Syft's
cpe.CPE type implements Stringer.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
---------
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2024-01-24 08:59:03 -05:00
anchore-actions-token-generator[bot] and wagoodman
3046d43a8a
chore(deps): update CPE dictionary index ( #2523 )
...
Signed-off-by: GitHub <noreply@github.com >
Co-authored-by: wagoodman <wagoodman@users.noreply.github.com >
2024-01-22 08:32:31 -05:00
anchore-actions-token-generator[bot] and wagoodman
0748413d6b
chore(deps): update CPE dictionary index ( #2491 )
...
Signed-off-by: GitHub <noreply@github.com >
Co-authored-by: wagoodman <wagoodman@users.noreply.github.com >
2024-01-15 05:56:34 +00:00
anchore-actions-token-generator[bot] and wagoodman
8ea2425c97
chore(deps): update CPE dictionary index ( #2458 )
...
Signed-off-by: GitHub <noreply@github.com >
Co-authored-by: wagoodman <wagoodman@users.noreply.github.com >
2024-01-02 06:12:32 -05:00
anchore-actions-token-generator[bot] and wagoodman
8b9194eb81
chore(deps): update CPE dictionary index ( #2442 )
...
Signed-off-by: GitHub <noreply@github.com >
Co-authored-by: wagoodman <wagoodman@users.noreply.github.com >
2023-12-18 07:01:21 -05:00
anchore-actions-token-generator[bot] and wagoodman
68f35815d6
chore(deps): update CPE dictionary index ( #2412 )
...
Signed-off-by: GitHub <noreply@github.com >
Co-authored-by: wagoodman <wagoodman@users.noreply.github.com >
2023-12-11 06:35:58 -05:00
Weston Steimel
4d4b502174
fix(java): improve identification for org.codehaus.groovy artifacts ( #2404 )
...
Signed-off-by: Weston Steimel <weston.steimel@proton.me >
2023-12-08 05:02:01 -05:00
Weston Steimel
ea80f94c0e
fix(java): improve identification for commons-jelly artifacts ( #2399 )
...
Signed-off-by: Weston Steimel <weston.steimel@proton.me >
2023-12-07 12:28:21 -05:00
Weston Steimel
2c145f70b2
fix(java): improve identification for io.minio artifacts ( #2398 )
...
Signed-off-by: Weston Steimel <weston.steimel@proton.me >
2023-12-06 16:58:07 -05:00
Weston Steimel
bcc7e90fcc
fix(java): improve identification for com.graphql-java artifacts ( #2397 )
...
Signed-off-by: Weston Steimel <weston.steimel@proton.me >
2023-12-06 18:04:43 +00:00
Weston Steimel
bbf223b2c9
fix(java): improve identification for org.apache.tapestry artifacts ( #2384 )
...
Signed-off-by: Weston Steimel <weston.steimel@proton.me >
2023-12-04 11:23:40 -05:00
Weston Steimel
b126276f97
fix(java): improve identification for io.ratpack artifacts ( #2379 )
...
Signed-off-by: Weston Steimel <weston.steimel@proton.me >
2023-12-04 11:23:26 -05:00
Weston Steimel
40d766a257
fix(java): improve identification for org.apache.cassandra artifacts ( #2386 )
...
Signed-off-by: Weston Steimel <weston.steimel@proton.me >
2023-12-01 10:51:14 -05:00
Weston Steimel
814960f65a
fix(java): improve identification for org.neo4j.procedure artifacts ( #2388 )
...
Signed-off-by: Weston Steimel <weston.steimel@proton.me >
2023-12-01 10:50:24 -05:00
Weston Steimel
11039f4b4e
fix(java): improve identification for org.elasticsearch artifacts ( #2383 )
...
Signed-off-by: Weston Steimel <weston.steimel@proton.me >
2023-12-01 09:22:33 -05:00
Weston Steimel
413ffdb233
fix(java): improve identification for org.apache.geode artifacts ( #2382 )
...
Signed-off-by: Weston Steimel <weston.steimel@proton.me >
2023-12-01 12:48:15 +00:00
Weston Steimel
e53fe51612
fix(java): improve identification for org.apache.tomcat.embed artifacts ( #2381 )
...
Signed-off-by: Weston Steimel <weston.steimel@proton.me >
2023-12-01 07:13:13 -05:00
Weston Steimel
facbc486a8
fix(java): improve identification for io.projectreactor.netty artifacts ( #2378 )
...
Signed-off-by: Weston Steimel <weston.steimel@proton.me >
2023-12-01 07:09:06 -05:00
Weston Steimel
5d42a349e6
fix(java): improve identification for org.eclipse.platform artifacts ( #2349 )
...
Signed-off-by: Weston Steimel <weston.steimel@proton.me >
2023-11-30 16:02:03 -05:00
William Murphy
ea4a6747eb
fix: hardcode xalan group ID ( #2368 )
...
According to maven central, the package called "xalan" should just have
the group ID xalan, but currently syft isn't able to find that.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2023-11-28 14:40:03 -05:00
Weston Steimel
ebeb768f59
fix: add manual namespace mapping for org.springframework jars ( #2345 )
...
Signed-off-by: Weston Steimel <weston.steimel@proton.me >
2023-11-21 18:28:10 +00:00
Weston Steimel
9d766c0325
fix: add manual namespace mapping for org.springframework.security jars ( #2343 )
...
Signed-off-by: Weston Steimel <weston.steimel@proton.me >
2023-11-21 13:46:34 +00:00
Weston Steimel
5751b43608
fix: add manual namespace mapping for org.bouncycastle jars ( #2342 )
...
Signed-off-by: Weston Steimel <weston.steimel@proton.me >
2023-11-21 08:17:07 -05:00
Weston Steimel
dcd062cffb
fix(java): add manual groupid mappings for org.apache.velocity jars ( #2327 )
...
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
2023-11-15 17:44:36 +00:00
anchore-actions-token-generator[bot] and wagoodman
4ba92ac43b
chore(deps): update CPE dictionary index ( #2290 )
...
Signed-off-by: GitHub <noreply@github.com >
Co-authored-by: wagoodman <wagoodman@users.noreply.github.com >
2023-11-06 09:23:24 -05:00
Alex Goodman
1aaa644007
Remove MetadataType from core package object and normalize JSON metadataType values ( #1983 )
...
* [wip]
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* distinct the package metadata functions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove metadata type from package core model
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* incorporate review feedback for names
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add RPM archive metadata and split parser helpers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* clarify the python package metadata type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename the KB metadata type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* break hackage and composer types by use case
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* linting fix
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix encoding and decoding for syft-json and cyclonedx
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump json schema to 11
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update cyclonedx-json snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update cyclonedx-xml snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update spdx-json snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update spdx-tv snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update syft-json snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* correct metadata type in stack yaml parser test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix bom-ref redactor for cyclonedx-xml
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add tests for legacy package metadata names
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate json schema v11
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix legacy HackageMetadataType reflect type value check
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* packagemetadata discovery should account for type shadowing
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix cli tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump json schema version to v12
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update json schema to incorporate changes from main
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add syft-json legacy config option
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add tests around v11-v12 json decoding
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add docs for SYFT_JSON_LEGACY
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename structs to be compliant with new naming scheme
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-10-30 12:12:04 -04:00
629aafc323
chore(deps): update CPE dictionary index ( #2271 )
...
* chore(deps): update CPE dictionary index
Signed-off-by: GitHub <noreply@github.com >
---------
Signed-off-by: Will Murphy <will.murphy@anchore.com >
Signed-off-by: GitHub <noreply@github.com >
Co-authored-by: Will Murphy <will.murphy@anchore.com >
Co-authored-by: willmurphyscode <willmurphyscode@users.noreply.github.com >
2023-10-30 09:48:03 -04:00
anchore-actions-token-generator[bot] and Alex Goodman
73d5852119
chore(deps): update CPE dictionary index ( #2253 )
...
* fix CPE workflow
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* chore(deps): update CPE dictionary index
Signed-off-by: GitHub <noreply@github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: GitHub <noreply@github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-10-24 13:22:02 -04:00
Alex Goodman
7018573bf7
Remove internal string set ( #2219 )
...
* remove internal string set
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* incorporate changes from #2227
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* beef up the pkg.License.Merg() doc string
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-10-17 12:52:11 -04:00
William Murphy
e34adea749
fix: deterministic java purls ( #2170 )
...
Previously, which PURL was generated depended on the order of key iteration
in maps. Also update an integ test that was apparently only passing because
of the previous issue.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2023-09-25 09:28:18 -04:00
Đỗ Trọng Hải and Alex Goodman
b7fa75d7f8
chore: switch to stdlib's slices pkg ( #2148 )
...
* chore: switch to stdlib's slices pkg
Signed-off-by: hainenber <dotronghai96@gmail.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: hainenber <dotronghai96@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-09-20 18:38:37 +00:00
anchore-actions-token-generator[bot] and wagoodman
ec22f4b773
chore(deps): update CPE dictionary index ( #2114 )
...
Signed-off-by: GitHub <noreply@github.com >
Co-authored-by: wagoodman <wagoodman@users.noreply.github.com >
2023-09-11 09:42:59 -04:00
anchore-actions-token-generator[bot] and wagoodman
6800a5f64b
chore(deps): update CPE dictionary index ( #2089 )
...
Signed-off-by: GitHub <noreply@github.com >
Co-authored-by: wagoodman <wagoodman@users.noreply.github.com >
2023-09-07 09:30:18 -04:00
William Murphy
007b034ee3
fix: correct group IDs for commons-codec, okhttp, okio, and add integration tests for Java PURL generation ( #2075 )
...
Add overall integration test for java PURL detection.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2023-08-31 16:57:55 -04:00
witchcraze
cedfa05e93
fix: CPE generation for django ( #2068 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2023-08-28 08:28:01 -04:00
Christopher Angelo Phillips and Keith Zantow
ee121cff21
feat: 1944 - update purl generation to use a consistent groupID ( #2033 )
...
Separate the logic for CPE and PURL generation.
PURL generation needs a single answer for groupID based on a priority of discovering the field.
CPE generation still uses multiple potential groupID to populate the candidate cpe.
Improve GroupID detection.
Currently syft does not use any hierarchy for GroupID detection and treats all sources as equal.
It treats fields from the manifest file with priority. This change adds a hierarchy to the fields and returns a single answer based on that hierarchy.
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
2023-08-22 10:47:07 -04:00
anchore-actions-token-generator[bot] and wagoodman
01c7709e0d
chore(deps): update CPE dictionary index ( #2043 )
...
Signed-off-by: GitHub <noreply@github.com >
Co-authored-by: wagoodman <wagoodman@users.noreply.github.com >
2023-08-21 09:33:41 -04:00
Keith Zantow
4762ba0943
feat: use java package names to determine known groupids ( #2032 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2023-08-17 12:55:25 -04:00
anchore-actions-token-generator[bot] and wagoodman
28b06dae25
chore(deps): update CPE dictionary index ( #2025 )
...
Signed-off-by: GitHub <noreply@github.com >
Co-authored-by: wagoodman <wagoodman@users.noreply.github.com >
2023-08-14 11:35:57 -04:00
Alex Goodman
756d0f29af
add metadata types to all cpe test fixtures ( #1982 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-07-31 16:35:09 -04:00
Dan Luhring and Alex Goodman
99d172f0d1
Introduce indexed embedded CPE dictionary ( #1897 )
...
* Introduce indexed embedded CPE dictionary
Signed-off-by: Dan Luhring <dluhring@chainguard.dev >
* Don't generate cpe-index on make snapshot
Signed-off-by: Dan Luhring <dluhring@chainguard.dev >
* Add unit tests for individual addEntry funcs
Signed-off-by: Dan Luhring <dluhring@chainguard.dev >
* migrate CPE index build to go generate and add periodic workflow
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add test to ensure generated cpe index is wired up to function that uses it
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Dan Luhring <dluhring@chainguard.dev >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-07-21 13:54:19 +00:00
Dan Luhring and Christopher Phillips
9744f4c009
Fix CPE gen for k8s python client ( #1921 )
...
Signed-off-by: Dan Luhring <dluhring@chainguard.dev >
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2023-07-10 15:54:19 +00:00
Dan Luhring
c0c089ffd5
fix: Don't use the actual redis or grpc CPEs for gems ( #1926 )
...
Signed-off-by: Dan Luhring <dluhring@chainguard.dev >
2023-07-10 10:24:42 -04:00
Dan Luhring
81d8019207
Remove erroneous Java CPEs from generation ( #1918 )
...
Signed-off-by: Dan Luhring <dluhring@chainguard.dev >
2023-07-06 16:12:55 -04:00
Josh Bressers
0f1aed4477
Update the CPE generation for spring-security-core ( #1789 )
...
* Update the CPE generation for spring-security-core
* Add vendor test for spring-security
Signed-off-by: Josh Bressers <josh@bress.net >
---------
Signed-off-by: Josh Bressers <josh@bress.net >
2023-05-05 15:41:41 +00:00
Keith Zantow
302735097e
fix: remove author contributing to javascript CPEs ( #1669 )
2023-03-14 14:10:24 +00:00
Weston Steimel
096d2b7bff
fix: suppress some known incorrect vendor candidates for npm CPEs ( #1659 )
...
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
2023-03-07 10:18:44 -05:00
Weston Steimel
c4cbe211a3
feat: disable cpe vendor wildcards to reduce false positives ( #1647 )
...
* improved parsing of vendor from github url
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
* stop generating wildcard vendors
Add logic for parsing javascript and ruby package vendor candidates from
url and author fields and stop generating wildcard vendor candidates
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
---------
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
2023-03-03 17:26:46 +00:00
