Alex Goodman
e9b24a29d7
Remove mitchellh dependencies ( #3748 )
...
* remove mitchellh dependencies
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix failing unit tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-03-20 10:19:19 -04:00
William Murphy
e2ed89f700
Pad artifact IDs ( #1882 )
...
Otherwise the hash can sometimes be short if it results in a low uint64.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2023-06-16 13:26:18 -04:00
Alex Goodman
44422853be
Add package-to-file location evidence relationships ( #1698 )
...
* add evident-by relationship
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* wire up evident-by relationship geneation
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* handle evident-by relationship in spdx formats
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix decoding file info for syft json format
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* bump json schema to incorporate file size attribute
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* refactor to create relationships for primary evidence only
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix linting
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* remove unused 7.0.2 json schema
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
---------
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2023-04-14 15:08:46 -04:00
Christopher Angelo Phillips
0f1e8fca14
bug: spdx checksum empty array; allow syft to generate SHA1 for spdx-tag-value documents ( #1404 )
2022-12-20 00:10:35 +00:00
0c4b99c1c2
SBOM cataloger ( #1029 )
...
* SBOM cataloger
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* sbom-cataloger: turn off by default
and add integration test
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* SBOM cataloger
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* SBOM cataloger (optimize)
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* SBOM cataloger (fix)
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* SBOM cataloger (fix imports #1172 )
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* SBOM cataloger (fix: support group attribute in CDX SBOMs)
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* port to generic cataloger and add relationship to original file
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* generalize parser for all format globs
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Co-authored-by: Tom Fay <tomfay@microsoft.com >
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
2022-11-16 14:11:45 -05:00
Christopher Angelo Phillips
0774ad15e2
chore: clean up linting configuration ( #1343 )
2022-11-16 16:28:09 +00:00
949cff158d
Add support for dependency relationships for alpine (apk) ( #1063 )
...
* Fix type of pull deps and add support for provides
Signed-off-by: Dan Luhring <dan+github@luhrings.com >
* [wip] apk dependency lookup
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update whitespace for linter
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
* adjust test conditions
Signed-off-by: Timothy Gerla <tim@gerla.net >
* fix TODOs and improve Provides parser
* run simports after main merge
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
* add tests to cover apk relationship parsing cases
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* generate JSON schema for breaking changes to apk metadata
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update tests to account for additional dependencies
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* [wip] fix relationship encoding for cyclonedx
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* simplify package relationships that can be expressed
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Dan Luhring <dan+github@luhrings.com >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
Signed-off-by: Timothy Gerla <tim@gerla.net >
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
Co-authored-by: Timothy Gerla <tim@gerla.net >
2022-11-09 15:43:37 +00:00
Christopher Angelo Phillips and hectorj2f
024a5a9f3f
Add dependencies to cyclonedx ( #768 )
...
Add dependencies to cyclonedx
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
Co-authored-by: hectorj2f <hectorf@vmware.com >
2022-01-25 15:34:16 -05:00
Alex Goodman
a27907659d
Performance improvements around package ID ( #698 )
...
* set package ID in catalogers and improve hashing performance
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update setting ID + tests
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2021-12-16 08:55:53 -05:00
Alex Goodman
bd9007fc0e
Migrate SPDX-JSON relationships to SBOM model ( #634 )
...
* remove power-user document shape
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* add power-user specific fields to syft-json format
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* port remaining spdx-json relationships to sbom model
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* add coordinate set
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* add SBOM file path helper
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* use internal mimetype helper in go binary cataloger
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* add new package-of relationship
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update json schema to v2
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* replace power-user presenter with syft-json format
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix tests and linting
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* remove "package-of" relationship (in favor of "contains")
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* add tests for spdx22json format encoding enhancements
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update TODO and log entries
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* introduce sbom.Descriptor
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2021-11-23 14:54:17 -05:00
Alex Goodman
ef627d82ef
Introduce relationships as first-class objects ( #607 )
...
* migrate pkg.ID and pkg.Relationship to artifact package
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* return relationships from tasks
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix more tests
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* add artifact.Identifiable by Identity() method
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix linting
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* remove catalog ID assignment
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* adjust spdx helpers to use copy of packages
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* stabilize package ID relative to encode-decode format cycles
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* rename Identity() to ID()
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* use zero value for nils in ID generation
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* enable source.Location to be identifiable
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* hoist up package relationship discovery to analysis stage
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update ownership-by-file-overlap relationship description
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* add test reminders to put new relationships under test
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* adjust PHP composer.lock parser function to return relationships
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2021-11-16 14:14:13 -05:00
Alex Goodman
William Murphy
Christopher Angelo Phillips
