oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-30 14:02:26 +01:00
Code Issues Packages Projects Releases Wiki Activity
784 Commits 65 Branches 273 Tags
7957294b26033cec99cffb34886f3aaafd21c831
Commit Graph
39 Commits
Author SHA1 Message Date
Jonas Galvão Xavier 5374a1dc6f add cyclone-json output format (#635) 
* add cyclone json format

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* adapt format to sbom.SBOM structure

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* cycloneDX json output with official lib

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* add cycloneDX 1.3 schema output in xml

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* fix lints errors

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* tidying go mod

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* remove cycloneDX 1.2 format

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* update cycloneDX xml schema

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* fix cyclone according to schema

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* use RFC 2141 URN form of uuid for serial number

add schema validation for cycloneDX 1.3 JSON output

add yajsv cli for JSON schema validation during tests

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* tidying go mod up

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* go get json schema validator

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* install yajsv without mess with go mod

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* reuse code between cycloneDX json & xml encoders

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* add output options for cyclone XML

add bom.json to .gitignore

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* add cyclone json format

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* adapt format to sbom.SBOM structure

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* cycloneDX json output with official lib

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* add cycloneDX 1.3 schema output in xml

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* fix lints errors

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* tidying go mod

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* remove cycloneDX 1.2 format

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* update cycloneDX xml schema

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* fix cyclone according to schema

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* use RFC 2141 URN form of uuid for serial number

add schema validation for cycloneDX 1.3 JSON output

add yajsv cli for JSON schema validation during tests

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* tidying go mod up

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* go get json schema validator

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* install yajsv without mess with go mod

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* reuse code between cycloneDX json & xml encoders

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* add output options for cyclone XML

add bom.json to .gitignore

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* fix cyclone12xml removal

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* feedback changes

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* go mod tidy

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>
 2021-12-03 17:06:23 -08:00
Alex Goodman bd9007fc0e Migrate SPDX-JSON relationships to SBOM model (#634) 
* remove power-user document shape

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add power-user specific fields to syft-json format

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* port remaining spdx-json relationships to sbom model

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add coordinate set

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add SBOM file path helper

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* use internal mimetype helper in go binary cataloger

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add new package-of relationship

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update json schema to v2

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* replace power-user presenter with syft-json format

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix tests and linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove "package-of" relationship (in favor of "contains")

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add tests for spdx22json format encoding enhancements

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update TODO and log entries

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* introduce sbom.Descriptor

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-23 14:54:17 -05:00
Christopher Angelo Phillips 319c6ee2eb document current draft for iana submission (#618) 
* document current draft for IANA submission

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-11-10 11:28:47 -05:00
Alex Goodman a000a2926b update linter + fix whitespace (#536) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-06 13:46:55 +00:00
Alex Goodman 706322f826 Add SPDX support (#445) 
* add initial spdx support

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* expose FileOwner and use in SPDX presenter

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add initial json support for SPDX

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add remaining package fields

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add spdx license list generation + tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* keep fileOwner unexported from pkg

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* restore cli test util

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add external refs to spdx tag-value format

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add golang support to CPE generation

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* use tag-value format as default "spdx" format flavor

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add tests around spdx presenters + refactor presenter tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add bouncer exception for spdx tools-golang repo

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove spdx model questions

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-06-25 16:30:41 -04:00
Alex Goodman 136e439dc2 use the standard file.Digest for apk checksums 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-04-19 16:42:17 -04:00
Alex Goodman 6edbae08e5 update json schema with extra rpm fields 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-04-16 10:25:47 -04:00
Alex Goodman 0c7706f254 add extra RPM file record fields (user, group, flags) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-04-16 10:25:46 -04:00
Alex Goodman d451a5ad30 update the json schema and tests with file contents section 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-04-12 17:33:20 -04:00
Alex Goodman 46fffe5c6f update json schema + presenter snapshots with file classification section 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-04-12 17:11:40 -04:00
Alex Goodman ba3407a767 add dpkg conffile update to json schema + json test snapshots 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-04-09 08:37:28 -04:00
Alex Goodman 9ec09add67 Add secrets search capability (#367) 
* add initial secrets cataloger

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update ETUI elements with new catalogers (file metadata, digests, and secrets)

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update secrets cataloger to read full contents into memory for searching

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* quick prototype of parallelization secret regex search

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* quick prototype with single aggregated regex

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* quick prototype for secret search line-by-line

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* quick prototype hybrid secrets search

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add secrets cataloger with line strategy

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* adjust verbiage towards SearchResults instead of Secrets + add tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update json schema with secrets cataloger results

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* address PR comments

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update readme with secrets config options

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* ensure file catalogers call AllLocations once

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-04-01 21:34:15 +00:00
Alex Goodman db35186c7d allow file metadata digests to be optional + add link destination 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-03-29 12:07:42 -04:00
Alex Goodman 36e4af1953 adjust jsom schema version + adopt java pom properies test fixtures 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-03-22 11:27:01 -04:00
Alex Goodman 6a960ec1f3 update json schema with optional poweruser data shape 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-03-22 10:56:16 -04:00
Alex Goodman 48a1d4711a update presenter tests with json schema 1.0.3 examples + rename rust metadata type 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-03-22 09:44:55 -04:00
Weston Steimel 35cc00b74a capture extra metadata about rust crates from the Cargo.lock file 
Signed-off-by: Weston Steimel <weston.steimel@gmail.com>
 2021-03-22 09:13:17 -04:00
Alex Goodman 6d5ff0fd8e Mark package relations by file ownership (#329) 
* add marking package relations by file ownership

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* correct json schema version; ensure fileOwners dont return dups; pin test pkg versions

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* extract package relationships into separate section

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* pull in client-go features for import of PackageRelationships

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* move unit test for ownership by files relationship further down

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* rename relationship to "ownership-by-file-overlap"

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-02-25 13:47:13 -05:00
Zach HillDan LuhringAlex Goodman
 		7962002f81 Split dpk source into name and version (#297) 
* Split dpk source into name and version

Signed-off-by: Zach Hill <zach@anchore.com>

* update dpkg status source name parsing

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Co-authored-by: Dan Luhring <luhring@users.noreply.github.com>
Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2020-12-18 14:08:19 -05:00
Alex Goodman 52bac6e2fd Add enterprise upload capability (#285) 
* add support to upload results to enterprise

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add package sbom upload

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add dockerfile support

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add manifest, index, and dockerfile import functions

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* schema version to json output + enhance json schema generation

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* modify package SBOM shape to be entire syft document + add etui updates

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add import image config and manifest support

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add config options for import to enterprise

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* incorporate final stereoscope and client-go deps

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-12-09 22:20:53 -05:00
Toure Dunnon a5fd83b21d added: correct the bom descriptor to meet the cyclonedx 1.2 
Signed-off-by: Toure Dunnon <toure.dunnon@anchore.com>
 2020-12-04 11:48:20 -05:00
Alex Goodman 8a17bfb69f generate json schema from struct definitions 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-11-20 15:47:10 -05:00
Alex Goodman f46de19c6b migrate scope option to image metadata (from source) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-11-17 12:37:12 -05:00
Alex Goodman 6f7a4fd3e4 move source metadata upstream and fix tests 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-11-17 12:37:12 -05:00
Alex Goodman aa0d444fd4 fix tests to use location instead of file.Reference 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-11-17 12:37:12 -05:00
Alex Goodman 2a329002b8 enhance dpkg support by parsing md5sum and copyright file sources 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-11-11 11:06:34 -05:00
Alex Goodman a5cba13ddf enable more flexible java manifest structure (closer to the spec) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-10-29 16:26:04 -04:00
Alex Goodman ab45be98b8 append java nested package names to the virtual path 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-10-29 13:52:34 -04:00
Alex Goodman 2675891110 remove parent java package from json && add java manifest section parsing 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-10-28 17:19:06 -04:00
Alex Goodman 8bcba7d830 update json schema and test for java virtualPath 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-10-28 15:25:30 -04:00
Alex Goodman 6eb36bc3c8 allow for optional fields in npm metadata 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-10-23 15:00:55 -04:00
Alex Goodman 7d55bca0a0 allow for python metadata fields to be optional 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-10-23 10:29:52 -04:00
Alex Goodman 1414d1fbc3 add test coverage for python pacakge cataloger and update catalog interface 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-10-22 09:51:29 -04:00
Toure Dunnon 27c62e34f2 Add support for package.json #200 
Signed-off-by: Toure Dunnon <toure.dunnon@anchore.com>
 2020-10-16 11:28:54 -04:00
Alex Goodman 3ba67a6bcc update json schema to account for optional gemspec fields (#225) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-10-15 13:56:59 -04:00
Alex Goodman 398d8903e7 finalize gemspec parser + update json schema to match 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-10-08 10:52:14 -04:00
Alex Goodman 49800b6747 Normalize the json image/dir source (#180) 
* normalize the json image/dir source

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update json image presenter golden file

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-09-25 14:07:38 -04:00
Samuel Dacanay 0567206b38 Change kebab case to camelCase in json keys throughout app 
Signed-off-by: Samuel Dacanay <sam.dacanay@anchore.com>
 2020-09-18 08:55:17 -07:00
Alex Goodman eda0f8c774 add bom descriptor schema + test against xml schemas in pipeline (#163) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-08-27 19:12:45 -04:00