oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-12 06:07:20 +02:00
Code Issues Packages Projects Releases Wiki Activity
3,620 Commits 63 Branches 272 Tags
740beb6dc4c2044418585a1571ef12ed889feee6
Commit Graph
35 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Weston Steimel 8219f8d55b fix: discover deb file relationships in distroless images (#1901) 
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2023-06-28 13:28:20 +01:00
Weston Steimel ee80349ea0 chore: bump stereoscope to latest version (#1741) 
Resolves reporting of GHSA-hw7c-3rfg-p46j

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2023-04-18 15:44:03 +00:00
Weston Steimel 096d2b7bff fix: suppress some known incorrect vendor candidates for npm CPEs (#1659) 
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2023-03-07 10:18:44 -05:00
Weston Steimel c4cbe211a3 feat: disable cpe vendor wildcards to reduce false positives (#1647) 
* improved parsing of vendor from github url

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* stop generating wildcard vendors

Add logic for parsing javascript and ruby package vendor candidates from
url and author fields and stop generating wildcard vendor candidates

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

---------

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2023-03-03 17:26:46 +00:00
Weston Steimel e2ebc9769f fix: remove APK OriginPackage cpe candidates (#1637) 
Adding APK OriginPackage CPE candidates to the child package
results in false positives in grype because it can't associate
CPE-based findings to the corresponding OriginPackage APK fixes.

This reverts changing the `upstream` in the PURL for APK packages
as the logic in Grype that uses it expects it to be an APK package
name.  This also allows refactoring to unexport and move the APK
CPE candidate generation logic closer to where CPE generation occurs

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2023-03-01 17:24:43 +00:00
Weston Steimel 8e1205f7ab fix: apk product/vendor generation for old metadata (#1635) 
This fixes some instances where the improved APK CPE generation
logic caused regressions for older alpine package APK metadata.
It now generates multiple "upstream" candidates with both name
and package type which reduces the amount of duplicated code in
the apk cpe gen logic.  This also improves the handling of stream
version packages, so now we can correctly identify packages such
as ruby3.2-rexml as the rexml ruby gem.

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2023-03-01 14:58:35 +00:00
Weston Steimel e92b0fa629 feat: rust toolchain binary cataloger (#1601) 
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2023-03-01 14:53:37 +00:00
Weston Steimel bcc0751a40 feat: retain go package info when no module declared (#1632) 
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2023-03-01 14:26:44 +00:00
Weston Steimel f1169e56fc fix: improved CPE-generation for several more APK packages (#1631) 
* fix: correct vendor for musl

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix: correct vendor for firefox and thunderbird

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix: correct vendor/product for chromium

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix: correct product for apache http server

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix: correct product for tiff

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix: correct vendor for ghostscript

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix: correct vendor for openjpeg

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix: correct vendor/product for xorg-server

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix: correct vendor for podofo

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix: correct vendor for wpa_supplicant

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

---------

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2023-03-01 08:55:40 -05:00
Weston Steimel fbda21f4f4 fix: further improvements to CPE generation for apk packages (#1623) 
* fix: consider upstream logic during apk cpe gen
* fix: correct apk CPE for go
* fix: correct apk CPE for ruby
* fix: correct apk CPE for bazel
* fix: correct apk CPE for clang
* fix: correct apk CPE for openjdk
* fix: correct apk CPE for glibc
* fix: correct apk CPE for gli
* fix: correct apk CPE for bas
* fix: correct apk CPE for alsa-lib
* fix: correct apk CPE for alsa
* fix: determine apk cpe vendor from known URLs
* fix: add more url prefix->vendor mappings for apk
* refactor: allow reuse of vendor by url prefix logic
* feat: extract username as vendor candidate from github/gitlab

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2023-02-27 13:16:04 -05:00
Weston Steimel 3ee1af0dc6 fix: correct apk purls for other distros (#1620) 
The apk purl spec allows for vendor-specific namespace.  I noticed
in the embedded SBOMs from wolfi that the purls are of the form
`pkg:apk/wolfi/curl@7.83.0-r0?arch=x86`, but the current logic in
syft actually prevents purl generation entirely if the distro isn't
alpine, so this corrects that behaviour.

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2023-02-24 15:07:07 -05:00
Weston Steimel 0c5f03235e refactor: move apk upstream logic to apk metadata (#1619) 
* refactor: move apk upstream logic to apk metadata

Export the logic for parsing upstream APK package names
so it can be accessed from apk metadata objects directly.

This also tightens the upstream regex pattern as several
edge cases were being missed.

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix: ensure correct handling for apk packages beginning with digits

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix: upstream generation for ruby

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

---------

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2023-02-24 15:59:19 +00:00
Weston Steimel 0c05855131 fix: determine upstream for apk version streams (#1610) 
Determines better upstream package name for version-stream apk packages:

Examples:

- postgresql-13 -> postgresql
- postgresql15 -> postgresql
- go-1.19 -> go
- perl100.55 -> perl

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2023-02-23 17:32:34 +00:00
Weston Steimel 1150772d06 fix: improve CPE generation for curl APK (#1608) 
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2023-02-23 17:32:12 +00:00
Weston Steimel 57a13ae355 fix: improve CPE and upstream generation logic for Alpine packages (#1567) 
* fix: improved CPE-generation logic for alpine packages

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix: improved alpine upstream name generation

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix: improve CPE vendor for alpine

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix: python vendor CPE gen

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix: alpine cpe gen logic

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix: apk CPE update for nodejs-current

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix: CPE update for python pip

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix: CPE update for some ruby packages

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix linting

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

---------

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2023-02-13 17:23:13 +00:00
Weston Steimel e236054668 fix: python CPE generation for alpine (#1564) 
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2023-02-10 18:04:16 +00:00
Weston Steimel 4c0aef09b8 fix: add relevant CPEs to python and busybox classifiers (#1517) 
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2023-01-25 17:18:24 +00:00
Weston Steimel fc4d28f365 fix: bump golang.org/x/net to v0.4.0 (#1467) 
resolves reporting of CVE-2022-41717

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2023-01-17 17:02:34 +00:00
Weston Steimel 5290dfb9c2 fix: bump golang.org/x/text to v0.3.8 (#1466) 
This resolves reporting of GHSA-69ch-w2m2-3vjp

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2023-01-17 15:50:02 +00:00
Weston Steimel e87cfe7319 chore: remove bumping cosign in go.mod when updating bootstrap tools (#1452) 2023-01-12 16:21:01 -05:00
Weston Steimel 09bf5b062c chore: add unit test for wolfi os release identification (#1340) 
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2022-11-14 18:57:31 -05:00
Weston Steimel 919c929798 update go-rpmdb to improve parsing of installed files (#1297) 2022-10-30 23:55:17 -04:00
Weston Steimel 6949a2500f Fix update-bootstrap-tools workflow (#1170) 2022-08-22 16:17:28 +00:00
Weston Steimel 5282820b5d workflow to create automated PRs to update bootstrap tools (#1167) 2022-08-22 11:28:24 -04:00
Weston Steimel fce83321ba bump cosign to v1.10.1 (#1144) 2022-08-04 19:03:57 +00:00
Weston Steimel fb8f24dc1e bump bouncer to v0.4.0 (#1125) 
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2022-07-29 16:57:59 +01:00
Weston SteimelandChristopher Phillips 62897fbc89 bump goreleaser to v1.10.3 (#1123) 
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-07-28 17:10:32 +00:00
Weston Steimel d1729ee7e2 bump golangci-lint to v1.47.2 (#1122) 2022-07-28 09:40:53 -04:00
Weston Steimel 43715d380b bump cosign in bootstrap-tools to v1.10.0 (#1121) 2022-07-28 09:40:42 -04:00
Weston Steimel b720a3c81c bump cosign to v1.10.0 (#1114) 
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2022-07-22 09:41:38 -04:00
Weston SteimelandChristopher Phillips b8d1a46e7e bump cosign to v1.9.0 to resolve reporting of GHSA-66x3-6cw3-v5gj (#1025) 
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-06-08 11:51:10 -04:00
Weston Steimel 05be9e25ce improve LanguageByName and add unit tests (#1034) 
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2022-06-07 14:09:09 +01:00
Weston Steimel 8420612724 bump cosign to v1.8.0 (#1003) 
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2022-05-18 17:17:21 +01:00
Weston Steimel 15e45a8ce1 add additional vendors for springframework (#945) 
The Official CPE dictionary currently contains entries for springframework with three different vendors: springsource, vmware, and pivotal_software.  This appears to be because ownership has changed over time.

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2022-04-11 14:38:52 +01:00
Weston Steimel f7a44b3d2c convert from deprecated org.label-schema to OCI Annotations in Dockerfile (#763) 
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2022-01-21 21:58:10 +00:00