Christopher Angelo Phillips
1e3d2a2927
chore: update tests to read from latest test-fixture-cache and fix cache publish ( #4042 )
...
* feat: update integration test with correct package for httpd
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
* chore: update integration and cli tests with new upstream expectations
- php interpreter 8.3.21 => 8.3.22
- runCycloneDXInDocker update for local arm64 qemu emulation CycloneDX
- getSyftBinaryLocationByOS update to detect arm64 v8.0 artifact path
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
* chore: add snalshot to test command for fixture builds
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
* chore: update cdx in docker for all GOOS
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-07-01 14:11:36 +00:00
Alex Goodman
0480b516f6
chore: fix publishing test fixture images ( #3896 )
...
* update pkg counts
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump max cache size
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-15 14:35:11 -04:00
Ralph Bean and Alex Goodman
b369b02f4f
Expose RPM signature information (for RPM DB and RPM archives) ( #3179 )
...
* feat: expose rpm signature information
This helps with more confident identification of an rpm.
In theory, two rpms can be built that have the same purl string, and
otherwise look identical in syft's output, but the PGP information
would distinguish them as signed either by different keys, or signed at
different times.
In practice, this usually makes no difference since rpms tend to have
unique name/version/release strings. This just gives increased
confidence about the identity of the rpm found in the db.
Signed-off-by: Ralph Bean <rbean@redhat.com >
* chore: generate json schema
Signed-off-by: Ralph Bean <rbean@redhat.com >
* re-generate json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename to a more generic signature field
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename rpm.pgp to rpm.signatures
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* split out signature fields
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* include RPM archives
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* dont fail on unknown signature type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Ralph Bean <rbean@redhat.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-15 16:01:00 +00:00
Rez Moss and Alex Goodman
12d91f47dc
Add a homebrew cataloger ( #3724 )
...
* Cataloger homebrew (#4 )
* homebrew cataloger
* uptd
* fixed test
* fixed test
* fixed tests
* fixed lint
* inc schema ver
* upt schema
* fixed integration test
* fixed integration tst
* fixed test
Signed-off-by: Rez Moss <hi@rezmoss.com >
* Update parse_homebrew_test.go
Signed-off-by: Rez Moss <hi@rezmoss.com >
* Update parse_homebrew_test.go
fixed DCO
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Rez Moss <hi@rezmoss.com >
* Update parse_homebrew_test.go
add evd anno to test
Signed-off-by: Rez Moss <hi@rezmoss.com >
* lint
Signed-off-by: Rez Moss <hi@rezmoss.com >
* fixed test
Signed-off-by: Rez Moss <hi@rezmoss.com >
* with PR refactors
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate jsonschema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* refactor homebrew parser + add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* more resiliant variable extraction
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-13 13:01:41 -04:00
GGMU and Alex Goodman
6db60c5975
Add deep-squashed scope to annotate all layers where a package exists ( #3138 )
...
* add squash all layers resolver
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* add squash with all layers logic
Signed-off-by: tomersein <tomersein@gmail.com >
* add squash with all layers logic
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squash with all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squash with all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* adjust resolver to strictly return squash paths only
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* show all packages have locations + primary evidence
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix race condition in test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* consider access paths
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: tomersein <tomersein@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-05 14:35:57 -04:00
Alex Goodman
d47a6c3a6d
Improve support for cataloging nix package relationships ( #3837 )
...
* add nix DB cataloger
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add derivation path to nix store pkg metadata
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* go mod tidy
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* allow for derivation path to be optional
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* repin build image and disable syscall filtering
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump storage capacity
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* track nix derivation details on packages
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* image fixture should have derivation examples
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-05 15:35:13 +00:00
Laurent Goderre and Alex Goodman
529840bfc0
Add support for PHP Pear ( #2775 )
...
* Add support for PHP Pear and unify PECL with it
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove log statements
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix struct comment
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-04-30 20:16:58 +00:00
Alex Goodman
ad9928cb2a
Merge the .NET deps.json and PE binary catalogers ( #3563 )
...
* add combined deps.json + pe binary cataloger
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* deprecate pe and deps standalone catalogers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* parse resource names + add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix integration and CLI tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add some helpful code comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* allow for dropping Dep packages that are missing DLLs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* migrate json schema changes to 24
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* keep application configuration
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* correct config help
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] detect claims of dlls within deps.json
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add assembly repack detection
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* .net package count is lower due to dll claim requirement
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-03-27 14:38:16 -04:00
Alex Goodman
2738291a96
swap centos images for rocky ( #3741 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-03-18 14:25:03 +00:00
bffe26bcc5
feat: add support for Bitnami cataloguer ( #3341 )
...
* prototype: start bitnami cataloger
Bitnami images have spdx SBOMs at predictable paths, and Syft could more
accurately identify the software in these images by scanning those
SBOMs. Start work on this by forking the sbom-cataloger as a new
bitnami-cataloger.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* wire up bitnami cataloger to run on images by default
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* feat: add support for Bitnami cataloguer
Signed-off-by: juan131 <jariza@vmware.com >
* feat: use a better SPDX sample for unit tests
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: only report bitnami pkgs
Signed-off-by: juan131 <jariza@vmware.com >
* feat: adapt JSON schema, spdxutil and packagemetadata
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: integration tests
Signed-off-by: juan131 <jariza@vmware.com >
* feat: implement FileOwner interface
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: update json schema
Signed-off-by: juan131 <jariza@vmware.com >
* [wip] add bitnami owned files and fix binary package ownership filtering
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* feat: obtain bitnami pkg files based on SPDX relationships tree
Signed-off-by: juan131 <jariza@vmware.com >
* preserve type switches
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename bitnami entry metadata type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* restrict find main pkg logic
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add missing graalvm source info
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bugfix: integration tests
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: mod tidy
Signed-off-by: juan131 <jariza@vmware.com >
---------
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Signed-off-by: juan131 <jariza@vmware.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-02-18 09:07:47 -05:00
Alex Goodman
684b6e3f98
Add file catalogers to selection configuration ( #3505 )
...
* add file catalogers to selection configuration
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix typos
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* warn when there is conflicting file cataloging configuration
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* allow for explicit removal of all package and file tasks
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address PR feedback
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-02-03 19:10:17 +00:00
c10e904c28
feat(cataloger): add a terraform provider cataloger ( #3378 )
...
* feat(cataloger): add a terraform provider cataloger
* chore: bump schema from 16.0.19 -> 16.0.20
------
Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-01-21 14:44:54 -05:00
Christopher Angelo Phillips
f9ffe7252e
test: removes latest license list test ( #3559 )
...
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-01-02 20:56:44 +00:00
Nathan Voss and Keith Zantow
a55b71d4ef
feat: exclude devDependencies from package-lock.json parsing ( #3371 )
...
Signed-off-by: Nathan Voss <njvoss299@gmail.com >
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
2024-10-30 12:02:27 -04:00
Keith Zantow
a00533c836
feat: Java dependency graph information ( #3363 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-10-23 11:17:34 -04:00
Laurent Goderre
9c2799e379
Add the Ocaml ecosystem ( #3112 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-09-10 10:35:18 -04:00
Alex Goodman
0a3f513f92
Slim down docker cache size ( #3190 )
...
* slim down docker cache size
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove old centos images
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* troubleshoot test failure
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix wget version ref
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* refactor caching mechanisms
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add cache cleanup steps
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* simplify deleting cache
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix first clone issue
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add tool dep
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-09-09 11:15:13 -04:00
Lukas Voetmand
3161e1847e
fix: read CycloneDX BOM components from metadata ( #3092 )
...
Signed-off-by: dervoeti <lukas.voetmand@stackable.tech >
2024-08-12 16:37:23 -04:00
Weston Steimel
df1e5b57fe
fix: improve groupid extraction for Jenkins plugins ( #2815 )
...
* fix: improve groupid extraction for Jenkins plugins
Consider the `Group-Id` java manifest property as this is typically set
for Jenkins plugins if there is no pom file
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
* test: update java purl integration test image
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
---------
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
2024-08-12 13:01:44 -04:00
Weston Steimel
19cc664cf8
test: increase java purl generation test coverage ( #3110 )
...
ensures correct package url generation for more java packages now that
syft has more deterministic results per https://github.com/anchore/syft/pull/3085
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
2024-08-09 10:14:10 +00:00
Laurent Goderre
92d63df6f5
Added the SWI Prolog (swipl) ecosystem ( #3076 )
...
* Add binary classifier for swipl
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
* Added cataloger for SWI Prolog Pack packages
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
---------
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-07-31 16:13:26 -04:00
mikcl
36f95d6828
python-cataloger: normalize package names ( #3069 )
...
Signed-off-by: mikcl <mikesmikes400@gmail.com >
2024-07-25 13:54:13 -04:00
Keith Zantow
741c8fb9bd
fix: SPDX output performance with many relationships ( #3053 )
2024-07-24 10:14:20 -04:00
Alex Goodman
573440b7cf
Infer the package type from ELF package notes ( #3008 )
...
* fix ELF package types to be honored
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* prefer OS packages over binary packages when there are duplicates
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-07-02 16:07:08 -04:00
Laurent Goderre
b51252dbdb
feat: Add Lua cataloger ( #2613 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-05-24 16:56:34 -04:00
Alex Goodman
c200896a96
fix pruning binary packages when considering ELF packages ( #2862 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-05-09 19:35:22 +00:00
Brian Ebarb and Alex Goodman
4194a2cd34
feat: add relationships to ELF package discovery ( #2715 )
...
This PR adds DependencyOf relationships when ELF packages have been discovered by the binary cataloger. The discovered file.Executable type has a []ImportedLibraries that's read from the file when discovered by syft. By mapping these imported libraries back to the package collection, syft is able to create relationships showing which packages are dependencies of other packages by just reading metadata from the ELF executable.
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Brian Ebarb <ebarb.brian@sers.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-05-09 13:53:59 -04:00
Laurent Goderre
e0233625cb
feat: cataloger for PHP Pecl and PEAR packages ( #2604 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-04-02 11:55:56 -04:00
Keith Zantow
a978966cad
feat: add --from flag, refactor source providers ( #2610 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-02-27 16:44:37 -05:00
Alexandr Hacicheant and Alex Goodman
96ee2db875
feat: Add Wordpress cataloger ( #2218 )
...
* Closes #1911 Wordpress cataloger
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed a few unit tests and static analizer notices
Signed-off-by: disc <a.hacicheant@gmail.com >
* Updated `README.md`
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed `golangci-lint` notices
Added integration test for `wordpress-plugin`
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed `gosimports` notices
Signed-off-by: disc <a.hacicheant@gmail.com >
* Updated `json schema` version
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed CLI tests, increased expected package count
Signed-off-by: disc <a.hacicheant@gmail.com >
* Read first 4Kb of a plugins file's content
Signed-off-by: disc <a.hacicheant@gmail.com >
* replace JSON schema version
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* change wording on source info for wordpress packages
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* Minor changes after a huge refactoring
Signed-off-by: disc <a.hacicheant@gmail.com >
* Removed unused files
Signed-off-by: disc <a.hacicheant@gmail.com >
* Updated schema
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed integration tests
Signed-off-by: disc <a.hacicheant@gmail.com >
* fix integration tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* Renamed `metadata.Name` to `metadata.PluginInstallDirectory`
Signed-off-by: disc <a.hacicheant@gmail.com >
* rename fields to be compliant with json conventions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: disc <a.hacicheant@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-14 16:03:25 +00:00
Alex Goodman
84576b93e1
Guess go main module version based on binary contents ( #2608 )
...
* guess go main module version based on binary contents
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add configuration options for golang main module version heuristics
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix test setup for go bin cataloger
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix unit test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix incorrect test assert ordering
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* handle error from seek
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-09 19:52:42 +00:00
Laurent Goderre and Alex Goodman
d7b9cc70b0
Add Erlang OTP Application cataloger ( #2403 )
...
* Add cataloger for Erlang OTP applications
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
* Add OTP Package type and Purl for ErLang
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
* remove erlang OTP metadata type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use OTP purl type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* restore otp fixture and adjust tests for dir-only results
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-02 13:40:18 -05:00
William Murphy
b7a6d5e946
feat: Record where CPEs come from ( #2552 )
...
Syft can get CPEs from several source, including generating them based on
package data, finding them in the NVD CPE dictionary, or finding them declared
in a manifest or existing SBOM. Record where Syft got CPEs so that consumers of
SBOMs can reason about how trustworthy they are.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2024-02-02 16:17:52 +00:00
Weston Steimel
3893f80052
fix(java): improve identification for org.apache.kafka artifacts ( #2573 )
...
Signed-off-by: Weston Steimel <weston.steimel@proton.me >
2024-01-31 16:34:56 -05:00
Alex Goodman
414fb2f8ad
fix migration of integration test ( #2546 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-25 15:18:36 +00:00
Alex Goodman
e0e1c4ba0a
Internalize majority of cmd package ( #2533 )
...
* internalize majority of cmd package and migrate integration tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add internal api encoder
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* create internal representation of all formats
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* export capability to get default encoders
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* restore test fixtures
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-24 13:29:51 -05:00
Christopher Angelo Phillips
Alex Goodman
Ralph BeanandAlex Goodman
Rez MossandAlex Goodman
GGMUandAlex Goodman
Laurent GoderreandAlex Goodman
Nathan VossandKeith Zantow
Lukas Voetmand
Weston Steimel
mikcl
Brian EbarbandAlex Goodman
Alexandr HacicheantandAlex Goodman
William Murphy
Weston Steimel