oss/syft - syft - Sa' Rocí Solutions

oss/syft

mirror of https://github.com/anchore/syft.git synced 2026-11-05 08:56:41 +01:00

Author	SHA1	Message	Date
Keith ZantowandAlex Goodman	ccbee94b87	feat: report unknowns in sbom (#2998 ) Signed-off-by: Keith Zantow <kzantow@gmail.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-10-07 16:11:37 -04:00
William MurphyandChristopher Phillips	770fdc53ea	Fix: make failed CPE validation correctly return error (#2762 ) * Test CPE attributes correctly returns error Previously, this method incorrectly return an empty Attributes object and a nil error, leading to callers attempting to use the empty attributes object. Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: merge with main and refactor call that relied on old nil behavior Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> * test: add test to cover new OSCPE err pattern Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> --------- Signed-off-by: Will Murphy <will.murphy@anchore.com> Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2024-10-03 16:42:57 -04:00
witchcraze	263ea6b1bb	feat: update haproxy classifier (#3277 ) Signed-off-by: witchcraze <witchcraze@gmail.com>	2024-10-02 15:10:39 -04:00
witchcraze	f5f8005fe0	update redis classifier (#3281 ) * update redis classifier Signed-off-by: witchcraze <witchcraze@gmail.com> * Remove snippets to pass Validation. In this case, 9000 byte was required... Signed-off-by: witchcraze <witchcraze@gmail.com>	2024-09-30 15:37:47 -04:00
witchcraze	2a3d171c10	fix: improve node classifier version matching (#3284 ) Signed-off-by: witchcraze <witchcraze@gmail.com>	2024-09-27 08:53:35 -04:00
witchcraze	1a746b2c05	fix: update ruby classifier for -rc, -dev, etc. versions (#3285 ) Signed-off-by: witchcraze <witchcraze@gmail.com>	2024-09-27 08:51:50 -04:00
Laurent Goderre	7815d8e4d9	feat: classifier for Dart lang binaries (#3265 ) Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-09-23 14:21:31 -04:00
Krystian G.Krystian Gorny Alex Goodman	6a95a5f2ed	feat: add binary classifiers for lighttp, proftpd, zstd, xz, gzip, jq, and sqlcipher (#3252 ) * feat: detect lighttpd binaries Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com> * feat: detect proftpd binaries Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com> * feat: detect zstd binaries Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com> * feat: detect xz utils binarie Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com> * feat: detect gzip binaries Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com> * feat: detect sqlcipher binaries Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com> * feat: detect jq binaries Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com> * add tests + snippets Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Krystian Gorny <krystian.gorny@wipotec.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-09-19 13:21:02 +00:00
Krystian G.andGorny Krystian	cb0de97bc3	fix: capture-snippet.sh can handle leading whitespaces now (#3249 ) (#3250 ) Signed-off-by: Gorny Krystian <krystian.gorny@wipotec.com> Co-authored-by: Gorny Krystian <krystian.gorny@wipotec.com>	2024-09-19 09:15:54 -04:00
Laurent Goderre	dbc4238f63	Add haskell binaries cataloger (#3078 ) Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-09-10 10:58:20 -04:00
Alex Goodman	0a3f513f92	Slim down docker cache size (#3190 ) * slim down docker cache size Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove old centos images Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * troubleshoot test failure Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix wget version ref Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * refactor caching mechanisms Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add cache cleanup steps Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * simplify deleting cache Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix first clone issue Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tool dep Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-09-09 11:15:13 -04:00
witchcraze	a343825685	fix: haproxy classifier for versions with -dev suffix (#3180 ) Signed-off-by: witchcraze <witchcraze@gmail.com>	2024-09-05 14:52:19 -04:00
Weston Steimel	5ab43bafec	fix: improve known CPEs and set NVD as source for all current binary classifiers (#3167 ) Signed-off-by: Weston Steimel <commits@weston.slmail.me>	2024-08-27 17:36:34 +01:00
Alex Goodman	e9a8c27be1	respond to authoratative CPEs from catalogers (#3166 ) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-08-27 10:26:35 -04:00
Weston Steimel	99be365f62	fix: use official CPE for curl binary cataloger (#3164 ) The official CPE for curl is `cpe:2.3:a:haxx:curl::::::::` Signed-off-by: Weston Steimel <commits@weston.slmail.me>	2024-08-27 14:03:19 +01:00
anchore-actions-token-generator[bot]	dad253785e	chore(deps): update tools to latest versions (#3144 )	2024-08-23 14:42:12 -04:00
KrysGor	cff9d494df	feat: detect curl binaries (#3146 )	2024-08-23 14:41:08 -04:00
Keith Zantow	73b9d5aa42	fix: mysql 8.0.3x binary detection (#3142 ) Signed-off-by: Keith Zantow <kzantow@gmail.com>	2024-08-21 09:48:28 -04:00
Laurent Goderre	92d63df6f5	Added the SWI Prolog (swipl) ecosystem (#3076 ) * Add binary classifier for swipl Signed-off-by: Laurent Goderre <laurent.goderre@docker.com> * Added cataloger for SWI Prolog Pack packages Signed-off-by: Laurent Goderre <laurent.goderre@docker.com> --------- Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-07-31 16:13:26 -04:00
witchcraze	490e05adb2	fix: traefik classifier (#3077 ) Signed-off-by: witchcraze <witchcraze@gmail.com>	2024-07-29 09:46:51 -04:00
dependabot[bot]andChristopher Phillips	fe7c5a7174	chore(deps): bump github.com/charmbracelet/lipgloss from 0.11.1 to 0.12.1 (#3040 ) * chore(deps): bump github.com/charmbracelet/lipgloss Bumps [github.com/charmbracelet/lipgloss](https://github.com/charmbracelet/lipgloss) from 0.11.1 to 0.12.1. - [Release notes](https://github.com/charmbracelet/lipgloss/releases) - [Changelog](https://github.com/charmbracelet/lipgloss/blob/master/.goreleaser.yml) - [Commits](https://github.com/charmbracelet/lipgloss/compare/v0.11.1...v0.12.1) --- updated-dependencies: - dependency-name: github.com/charmbracelet/lipgloss dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore: pin fedora linux/amd64 to sha Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2024-07-22 10:43:17 -07:00
Keith Zantow	278b72d39b	chore: pin fedora image for elf binary test (#3041 ) Signed-off-by: Keith Zantow <kzantow@gmail.com>	2024-07-15 16:37:09 +00:00
Alex Goodman	573440b7cf	Infer the package type from ELF package notes (#3008 ) * fix ELF package types to be honored Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * prefer OS packages over binary packages when there are duplicates Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-07-02 16:07:08 -04:00
Laurent Goderre	ceced5eb27	Add detection of Erlang in Alpine linux (#2996 ) Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-06-25 14:40:40 -07:00
Laurent Goderre	7a35de04ee	fix: detection of arangodb 3.12 (#2979 ) Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-06-20 11:11:03 -04:00
Alex Goodman	254a562b4e	Add support for reading ELF package notes with section header (#2939 ) * add support for reading ELF package notes with section header Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add systemd elf package fields to json schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-06-07 14:38:54 -04:00
Brian Ebarb	5cdc0845fb	feat: add license field to ELF binary package metadata (#2890 ) Signed-off-by: Brian Ebarb <ebarb.brian@gmail.com> feat: add License component to elf binary packages Signed-off-by: Brian Ebarb <ebarb.brian@gmail.com> feat: fix elf_package_cataloger test feat: elf package cataloger unit test updates	2024-06-06 14:10:53 +00:00
Laurent Goderre	b608ab77e1	feat: classifier for util-linux (#2933 ) Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-06-05 17:32:52 -04:00
Keith Zantow	ac34808b9c	feat: detect fluent-bit binaries (#2905 ) Signed-off-by: Keith Zantow <kzantow@gmail.com>	2024-05-28 10:13:06 -04:00
Laurent Goderre	7071f1e498	feat: Added functionality to convert major, minor, patch to version for binary classifier (#2864 ) --------- Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-05-23 12:17:12 -04:00
Brian EbarbandAlex Goodman	4194a2cd34	feat: add relationships to ELF package discovery (#2715 ) This PR adds DependencyOf relationships when ELF packages have been discovered by the binary cataloger. The discovered file.Executable type has a []ImportedLibraries that's read from the file when discovered by syft. By mapping these imported libraries back to the package collection, syft is able to create relationships showing which packages are dependencies of other packages by just reading metadata from the ELF executable. --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: Brian Ebarb <ebarb.brian@sers.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-05-09 13:53:59 -04:00
Laurent Goderre	e7b6284039	Add binary classifier for ArangoDB (#2830 ) Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-05-07 12:06:32 -04:00
William Murphy	3713d97b7b	chore: use ruleguard to test for missing defer statements (#2837 ) * chore: ruleguard to enforce defer use Signed-off-by: Will Murphy <will.murphy@anchore.com> * fix go.mod location Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer close in linux release identifier Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: better lint suggestion Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: refactor binary classifier to defer close Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer close readers in gentoo cataloger Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: make go license parsing defer close readers Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer closing readers in alpine apm parser Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer close readers in graalvm parser Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer close readers in debian package parser Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer close readers in alpm parser Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer close readers in executable file cataloger Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer close readers in javascript license parser Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer close readers in go mod parser Signed-off-by: Will Murphy <will.murphy@anchore.com> --------- Signed-off-by: Will Murphy <will.murphy@anchore.com>	2024-05-07 05:42:29 -04:00
Laurent Goderre	5ca26ed3ca	fix: Add missing CPE for traefik, memcached, and postgres binaries (#2845 ) Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-05-06 15:06:30 -04:00
Laurent Goderre	e353214ef8	Add detection for newer version of ErLang/OTP (#2829 ) Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-05-06 11:47:54 -04:00
William Murphy	93a7d2ee27	fix: better clean up of file handles (#2823 ) * always close ELF cataloger file handles The elf-binary-package-cataloger does its own file IO to account for the possibility of a logical ELF package being broken across multiple physical files. However, this casued it to skip the normal invocation pattern in the generic cataloger code that prevented file leaks. Ensure this cataloger always closes its file handles. Signed-off-by: Will Murphy <will.murphy@anchore.com> * defer closing of generic cataloger file handles Otherwise, a panicking cataloger could leak file handles. Signed-off-by: Will Murphy <will.murphy@anchore.com> * add unit test for file closed on panic parser Signed-off-by: Will Murphy <will.murphy@anchore.com> * make invoke parser a static function Signed-off-by: Will Murphy <will.murphy@anchore.com> * push error logging down into invoke parser Signed-off-by: Will Murphy <will.murphy@anchore.com> --------- Signed-off-by: Will Murphy <will.murphy@anchore.com>	2024-05-01 12:58:17 -04:00
Laurent GoderreandKeith Zantow	c9aab4863b	fix: binary character in java version (#2766 ) Signed-off-by: Laurent Goderre <laurent.goderre@docker.com> Signed-off-by: Keith Zantow <kzantow@gmail.com> Co-authored-by: Keith Zantow <kzantow@gmail.com>	2024-04-11 10:32:24 -04:00
Laurent Goderre	619ace65c3	Differentiate between JRE and JDK (#2748 ) Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-04-05 15:10:58 -04:00
Christopher Angelo Phillips	e100776f22	chore: update anchore/packageurl-go to use latest commits (#2746 ) chore: update packageurl-go dependency to use latest commits chore: go mod tidy unit: update + -> %2B --------- Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>	2024-04-04 10:33:51 -04:00
Laurent GoderreandAlex Goodman	cf17bd69b2	Add detection for Oracle GraalVM (#2705 ) Signed-off-by: Laurent Goderre <laurent.goderre@docker.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-03-14 15:40:07 +00:00
brian-ebarb Colleen Divers Alex Goodman	6a2517b5d2	Add ELF binary package cataloger (#2396 ) * feat Adds Elf package catalogger Signed-off-by: Brian Ebarb <ebarb.brian@gmail.com> * Add test fixtures for elf package Signed-off-by: Colleen Divers <colleen.divers@gmail.com> * bump JSON schema to v16.0.6 + expand test fixtures Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * less verbose logging Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove dead test code Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove unreleated swift change Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Brian Ebarb <ebarb.brian@gmail.com> Signed-off-by: Colleen Divers <colleen.divers@gmail.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Colleen Divers <colleen.divers@gmail.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-03-14 11:16:03 -04:00
Harm Weites	356f7c92b4	fix: match OpenSSL letter releases (#2682 ) * chore: match openssl 1.1 letter releases Signed-off-by: Harm Weites <harm@weites.com> * chore: include image sha Signed-off-by: Harm Weites <harm@weites.com> --------- Signed-off-by: Harm Weites <harm@weites.com>	2024-02-29 14:39:23 +00:00
Keith Zantow	a978966cad	feat: add `--from` flag, refactor source providers (#2610 ) Signed-off-by: Keith Zantow <kzantow@gmail.com>	2024-02-27 16:44:37 -05:00
Alex Goodman	0c3b8ca4ed	rename binary classifier cataloger name (#2643 ) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-02-20 13:52:11 -05:00
Alex Goodman	98b700e83c	rename binary cataloger to be more unique (#2633 ) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-02-14 11:01:55 -05:00
anchore-actions-token-generator[bot]spiffcs Christopher Phillips	17ef243956	chore(deps): update tools to latest versions (#2616 ) * chore(deps): update tools to latest versions Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * fix: update to new linter rules Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> --------- Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>	2024-02-14 14:59:49 +00:00
Alex Goodman	3023a5a7bc	Detect ELF security features (#2443 ) * add detection of ELF security features Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update json schema with file executable data Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update expected fixure when no tty present Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * more detailed differ Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * use json differ Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove json schema addition Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * regenerate json schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix mimtype set ref Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-02-02 16:51:18 +00:00
William Murphy	b7a6d5e946	feat: Record where CPEs come from (#2552 ) Syft can get CPEs from several source, including generating them based on package data, finding them in the NVD CPE dictionary, or finding them declared in a manifest or existing SBOM. Record where Syft got CPEs so that consumers of SBOMs can reason about how trustworthy they are. Signed-off-by: Will Murphy <will.murphy@anchore.com>	2024-02-02 16:17:52 +00:00
Alex Goodman	11c0b1c234	Unexport types and functions cataloger packages (#2530 ) * unexport as many types and functions from cataloger packages as possible Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * capture type and signature information in convention test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * check that we return pkg.Cataloger from constructors Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-01-24 16:12:46 -05:00
William Murphy	878df69330	chore: stop re-exporting wfn.Attributes (#2534 ) * chore: stop re-exporting wfn.Attributes Previously, Syft re-exported wfn.Attributes from the nvdtools package as a member of the Package struct. However, Syft doesn't own this struct, and so after Syft 1.0, might be forced to bump a semver major version due to a breaking change in wfn.Attributes. Rather than incur this risk going into 1.0, instead replace Syft's use of wfn.Attributes with Syft's own cpe.CPE type. That type has some pass-through calls to wfn.Attributes, but hides the dependency from the rest of the application. Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: make cpe.CPE type a Stringer Previously, the cpe.CPE type was an alias for wfn.Attributes from nvdtools. Now that it is a type we control, make the String method take the CPE as a receiver, rather than as a normal parameter, so that Syft's cpe.CPE type implements Stringer. Signed-off-by: Will Murphy <will.murphy@anchore.com> --------- Signed-off-by: Will Murphy <will.murphy@anchore.com>	2024-01-24 08:59:03 -05:00

1 2 3