53 Commits

Include renames

Author	SHA1	Message	Date
Keith Zantow	7ac4d91f43	chore: reformat (#3754) ... Signed-off-by: Keith Zantow <kzantow@gmail.com>	2025-03-21 06:13:35 -04:00
Alex Goodman	e9b24a29d7	Remove mitchellh dependencies (#3748) ... * remove mitchellh dependencies Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix failing unit tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-03-20 10:19:19 -04:00
Alan PopeandAlex Goodman	5fa8e9c6e9	feat: add Debian archive (.deb) file cataloger (#3704) ... * feat: add Debian archive (.deb) file cataloger Add a cataloger that parses Debian package (.deb) archive files directly, allowing Syft to discover packages from .deb files without requiring them to be installed on the system. This implements issue #3315. Key features: - Parse .deb AR archives to extract package metadata - Support for gzip, xz, and zstd compressed control files - Extract package metadata from control files - Process file information from md5sums files - Mark configuration files from conffiles entries - Handle trailing slashes in archive member names Signed-off-by: Alan Pope <alan.pope@anchore.com> * chore: run go mod tidy to fix failing workflow Signed-off-by: Alan Pope <alan.pope@anchore.com> * add license processing to dpkg archive cataloger + add tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update json schema with dpkg archive type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update comments Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alan Pope <alan.pope@anchore.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-03-19 20:03:21 +00:00
Yoav Alon	6f70927bcc	fix(performance): reduce memory allocation in containsPath (#3730) ... Signed-off-by: Yoav Alon <yoav@orca.security>	2025-03-13 14:39:57 -04:00
3 people	bffe26bcc5	feat: add support for Bitnami cataloguer (#3341) ... * prototype: start bitnami cataloger Bitnami images have spdx SBOMs at predictable paths, and Syft could more accurately identify the software in these images by scanning those SBOMs. Start work on this by forking the sbom-cataloger as a new bitnami-cataloger. Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * wire up bitnami cataloger to run on images by default Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * feat: add support for Bitnami cataloguer Signed-off-by: juan131 <jariza@vmware.com> * feat: use a better SPDX sample for unit tests Signed-off-by: juan131 <jariza@vmware.com> * bugfix: only report bitnami pkgs Signed-off-by: juan131 <jariza@vmware.com> * feat: adapt JSON schema, spdxutil and packagemetadata Signed-off-by: juan131 <jariza@vmware.com> * bugfix: integration tests Signed-off-by: juan131 <jariza@vmware.com> * feat: implement FileOwner interface Signed-off-by: juan131 <jariza@vmware.com> * bugfix: update json schema Signed-off-by: juan131 <jariza@vmware.com> * [wip] add bitnami owned files and fix binary package ownership filtering Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * feat: obtain bitnami pkg files based on SPDX relationships tree Signed-off-by: juan131 <jariza@vmware.com> * preserve type switches Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename bitnami entry metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * restrict find main pkg logic Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add missing graalvm source info Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bugfix: integration tests Signed-off-by: juan131 <jariza@vmware.com> * bugfix: mod tidy Signed-off-by: juan131 <jariza@vmware.com> --------- Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> Signed-off-by: juan131 <jariza@vmware.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-02-18 09:07:47 -05:00
Keith Zantow	2328b20082	fix: reduce warn levels to debug for non-actionable errors (#3645) ... Signed-off-by: Keith Zantow <kzantow@gmail.com>	2025-02-07 13:22:55 -05:00
3 people	c10e904c28	feat(cataloger): add a terraform provider cataloger (#3378) ... * feat(cataloger): add a terraform provider cataloger * chore: bump schema from 16.0.19 -> 16.0.20 ------ Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2025-01-21 14:44:54 -05:00
Bert CoppensandAlex Goodman	512319337f	feat: add cataloger for NuGet packages (#3484) ... * add cataloger for dotnet packages.lock.json files Signed-off-by: Kemosabert <bert.coppens14@gmail.com> * add entry for dotnet packages.lock files Signed-off-by: Kemosabert <bert.coppens14@gmail.com> * add unit test for dotnet packages.lock cataloger Signed-off-by: Kemosabert <bert.coppens14@gmail.com> * add test for faulty packages.lock.json file Signed-off-by: Kemosabert <bert.coppens14@gmail.com> * add missing name metadata Signed-off-by: Kemosabert <bert.coppens14@gmail.com> * ensure package appears with version Signed-off-by: Kemosabert <bert.coppens14@gmail.com> * add example of conflicting dependencies Signed-off-by: Kemosabert <bert.coppens14@gmail.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema and fix tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * move section Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Kemosabert <bert.coppens14@gmail.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-01-16 14:57:17 -05:00
Alex Goodman	340b5e17f0	Add relationships for rust audit binary packages (#3500) ... * add rust audit binary pkg relationships Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-12-06 09:23:18 -05:00
Adam McClenaghan	21df38798e	Use file indexer directly when scanning with file source (#3333) ... * Use file indexer when scanning with file source Prevents filesystem walks when scanning a single file, to optimise memory & scan times in case the scanned file lives in a directory containing many files. Signed-off-by: adammcclenaghan <adam@mcclenaghan.co.uk> * Create filetree resolver Shared behaviour for resolving indexed filetrees. Signed-off-by: adammcclenaghan <adam@mcclenaghan.co.uk> --------- Signed-off-by: adammcclenaghan <adam@mcclenaghan.co.uk>	2024-11-22 11:53:53 -05:00
Christian Dupuis	92c1ddec5a	fix: correct excluded mount point comparison to file paths (#3269) ... Signed-off-by: Christian Dupuis <cd@docker.com>	2024-09-24 17:05:16 -04:00
Alex Goodman	01de99b253	Add JVM cataloger (#3217) ... * add jvm cataloger Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * simplify version selection Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * CPEs from JVM cataloger should be declared Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * ensure package overlap is enabled for sensitive use cases Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * more permissive glob Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-09-23 17:21:38 -04:00
Laurent Goderre	9c2799e379	Add the Ocaml ecosystem (#3112) ... Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-09-10 10:35:18 -04:00
anchore-actions-token-generator[bot]	dad253785e	chore(deps): update tools to latest versions (#3144)	2024-08-23 14:42:12 -04:00
anchore-actions-token-generator[bot]andspiffcs	4b7ae0ed3b	chore(deps): update tools to latest versions (#3121) ... * chore(deps): update tools to latest versions Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore: update code to reflect new linter settings for error messages Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> --------- Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>	2024-08-16 17:56:36 +00:00
Laurent Goderre	92d63df6f5	Added the SWI Prolog (swipl) ecosystem (#3076) ... * Add binary classifier for swipl Signed-off-by: Laurent Goderre <laurent.goderre@docker.com> * Added cataloger for SWI Prolog Pack packages Signed-off-by: Laurent Goderre <laurent.goderre@docker.com> --------- Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-07-31 16:13:26 -04:00
William MurphyandAlex Goodman	557ad73ee6	fix: only skip tmpfs mounts for some paths (#2918) ... * fix: only skip tmpfs mounts for some paths Signed-off-by: Will Murphy <will.murphy@anchore.com> * refactor and add tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add regression test for archive processing Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump to golang 1.22 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove rule 1 and add more tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Will Murphy <will.murphy@anchore.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-06-04 15:21:45 -04:00
Laurent Goderre	b51252dbdb	feat: Add Lua cataloger (#2613) ... Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-05-24 16:56:34 -04:00
William Murphy	b2ca5fbf89	fix Windows file paths in local go mod cache (#2654) ... Previously, the file resolver was created from incorrect calls (path.Join instead of filepath.Join) which resulted Go license searches always missing on Windows. Use filepath.* functions when initializing the Go config, and when the unindexed file resolver is being created. Signed-off-by: Will Murphy <will.murphy@anchore.com>	2024-05-09 13:08:58 -04:00
William Murphy	d3310a1830	fix: re-use embedded union reader if possible (#2814) ... * fix: re-use embedded union reader if possible Previously, because file.LocationReadCloser embeds a ReadCloser that might be a UnionReader, but doesn't implement the interface itself, the type assertion would fall and Syft would fall back to io.ReadAll to enable seeking on the underlying reader, resulting in a potentially large extra allocation. Instead, check whether the passed ReadCloser is a file.LocationReadCloser, and if so, try to use the embedded ReadCloser as a UnionReader. Signed-off-by: Will Murphy <will.murphy@anchore.com> * lint fix Signed-off-by: Will Murphy <will.murphy@anchore.com> * Assert that underlying reader is returned Signed-off-by: Will Murphy <will.murphy@anchore.com> --------- Signed-off-by: Will Murphy <will.murphy@anchore.com>	2024-04-26 10:21:38 -04:00
Laurent Goderre	e0233625cb	feat: cataloger for PHP Pecl and PEAR packages (#2604) ... Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-04-02 11:55:56 -04:00
3 people	6a2517b5d2	Add ELF binary package cataloger (#2396) ... * feat Adds Elf package catalogger Signed-off-by: Brian Ebarb <ebarb.brian@gmail.com> * Add test fixtures for elf package Signed-off-by: Colleen Divers <colleen.divers@gmail.com> * bump JSON schema to v16.0.6 + expand test fixtures Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * less verbose logging Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove dead test code Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove unreleated swift change Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Brian Ebarb <ebarb.brian@gmail.com> Signed-off-by: Colleen Divers <colleen.divers@gmail.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Colleen Divers <colleen.divers@gmail.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-03-14 11:16:03 -04:00
Alex Goodman	48e5672a87	Consider filesystem types for mount points when ignoring system paths (#2675) ... * consider fs types for mount points when ignoring system paths Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * address feedback Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-02-28 15:37:17 -05:00
Keith Zantow	a978966cad	feat: add --from flag, refactor source providers (#2610) ... Signed-off-by: Keith Zantow <kzantow@gmail.com>	2024-02-27 16:44:37 -05:00
Alex Goodman	65cadda486	Survive indexing dead symlinks (#2645) ... * survive indexing branches that start with a bad symlink Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add log statement Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-02-14 21:06:22 +00:00
Alex Goodman	a909e3cec9	fix considering base path when ignoring known bad unix paths (#2644) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-02-14 15:57:38 -05:00
Alexandr HacicheantandAlex Goodman	96ee2db875	feat: Add Wordpress cataloger (#2218) ... * Closes #1911 Wordpress cataloger Signed-off-by: disc <a.hacicheant@gmail.com> * Fixed a few unit tests and static analizer notices Signed-off-by: disc <a.hacicheant@gmail.com> * Updated `README.md` Signed-off-by: disc <a.hacicheant@gmail.com> * Fixed `golangci-lint` notices Added integration test for `wordpress-plugin` Signed-off-by: disc <a.hacicheant@gmail.com> * Fixed `gosimports` notices Signed-off-by: disc <a.hacicheant@gmail.com> * Updated `json schema` version Signed-off-by: disc <a.hacicheant@gmail.com> * Fixed CLI tests, increased expected package count Signed-off-by: disc <a.hacicheant@gmail.com> * Read first 4Kb of a plugins file's content Signed-off-by: disc <a.hacicheant@gmail.com> * replace JSON schema version Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * change wording on source info for wordpress packages Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * Minor changes after a huge refactoring Signed-off-by: disc <a.hacicheant@gmail.com> * Removed unused files Signed-off-by: disc <a.hacicheant@gmail.com> * Updated schema Signed-off-by: disc <a.hacicheant@gmail.com> * Fixed integration tests Signed-off-by: disc <a.hacicheant@gmail.com> * fix integration tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * Renamed `metadata.Name` to `metadata.PluginInstallDirectory` Signed-off-by: disc <a.hacicheant@gmail.com> * rename fields to be compliant with json conventions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: disc <a.hacicheant@gmail.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-02-14 16:03:25 +00:00
3 people	17ef243956	chore(deps): update tools to latest versions (#2616) ... * chore(deps): update tools to latest versions Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * fix: update to new linter rules Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> --------- Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>	2024-02-14 14:59:49 +00:00
Alex Goodman	25ae7bf55f	fix getting union reader for sif images (#2631) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-02-13 15:12:31 +00:00
Alex Goodmanandmikey strauss	c61f59e7b7	Finalize Conan v2 support (#2587) ... * Add support for conan lock v2 (#2461) * conan lock 2.x requires field support Signed-off-by: houdini91 <mdstrauss91@gmail.com> * PR review, struct renaming Signed-off-by: houdini91 <mdstrauss91@gmail.com> --------- Signed-off-by: houdini91 <mdstrauss91@gmail.com> * decompose conanlock parser + add tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: houdini91 <mdstrauss91@gmail.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: mikey strauss <mdstrauss91@gmail.com>	2024-02-07 08:24:02 -05:00
William Murphy	b735106848	chore: copy latest schema to stable path for easier diff (#2586) ... Because we generate a new JSON schema file every time the schema version changes, the git diff always shows that the file is completely new. Therefore, every time the file is re-generated, also write the schema to a stable path, so that the actual changes to the schema are easily visible in the git diff of the latest schema file. Signed-off-by: Will Murphy <will.murphy@anchore.com>	2024-02-02 17:09:28 -05:00
Asi GreenholtsandAlex Goodman	98de2e2f62	Adding metadata fields when parsing yarn.lock and poetry.lock (#2350) ... * Adding the resolved and integrity fields of yarn.lock to the parsed metadata. This addition is similar to the metadata added when parsing package-lock.json. Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com> * fix comment Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com> * Adding the Index field to metadeta when parsing poetry.lock similarly to the existing Pipfile metadata Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com> * fixing struct accoding to tests Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com> * remove old schema change Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove empty constants Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * re-generate JSON schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update document ref Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-02-02 19:53:42 +00:00
Alex Goodman	3023a5a7bc	Detect ELF security features (#2443) ... * add detection of ELF security features Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update json schema with file executable data Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update expected fixure when no tty present Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * more detailed differ Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * use json differ Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove json schema addition Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * regenerate json schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix mimtype set ref Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-02-02 16:51:18 +00:00
Alex Goodman	6107e5e2ad	translate maps to sequences in pkg metadata (#2553) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-02-01 11:58:10 -05:00
William Murphy	c6ce1de928	make AllLocations accept a context (#2518) ... The previous implementation would leak a goroutine if the caller of AllLocations stopped iterating early. Now, accept a context so that the caller can cancel the AllLocations iterator rather than leak the goroutine. Signed-off-by: Will Murphy <will.murphy@anchore.com>	2024-01-22 11:05:59 -05:00
Laurent Goderre	06b9a79e3d	chore: fix tests failing due to Mac Rosetta cache (#2374) ... Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2023-11-29 18:39:28 +00:00
Alex Goodman	3f13d209a5	rename file.Location.VirtualPath to AccessPath (#2288) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-11-09 11:30:08 -06:00
Alex Goodman	6c41f15975	change dir resolver to include virtual path (#2259) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-11-02 08:20:00 -04:00
Alex Goodman	1aaa644007	Remove MetadataType from core package object and normalize JSON metadataType values (#1983) ... * [wip] Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * distinct the package metadata functions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove metadata type from package core model Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * incorporate review feedback for names Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add RPM archive metadata and split parser helpers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * clarify the python package metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename the KB metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * break hackage and composer types by use case Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * linting fix Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix encoding and decoding for syft-json and cyclonedx Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema to 11 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx-xml snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update spdx-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update spdx-tv snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update syft-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * correct metadata type in stack yaml parser test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix bom-ref redactor for cyclonedx-xml Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for legacy package metadata names Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * regenerate json schema v11 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix legacy HackageMetadataType reflect type value check Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * packagemetadata discovery should account for type shadowing Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema version to v12 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update json schema to incorporate changes from main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add syft-json legacy config option Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests around v11-v12 json decoding Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add docs for SYFT_JSON_LEGACY Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename structs to be compliant with new naming scheme Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-30 12:12:04 -04:00
Alex Goodman	7392d607b6	Split the sbom.Format interface by encode and decode use cases (#2186) ... * split up sbom.Format into encode and decode ops Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cmd pkg to inject format configs Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump cyclonedx schema to 1.5 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * redact image metadata from github encoder tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add more testing around format decoder identify Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add test case for format version options Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix CLI test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * [wip] - review comments Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * keep encoder creation out of post load function Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * keep decider and identify functions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add a few more doc comments Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove format encoder default function helpers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * address PR feedback Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * move back to streaming based decode functions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * with common convention for encoder constructors Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix tests and allow for encoders to be created from cli options Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * buffer reads from stdin to support seeking Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-25 13:43:06 +00:00
Đỗ Trọng HảiandAlex Goodman	b7fa75d7f8	chore: switch to stdlib's slices pkg (#2148) ... * chore: switch to stdlib's slices pkg Signed-off-by: hainenber <dotronghai96@gmail.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: hainenber <dotronghai96@gmail.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-09-20 18:38:37 +00:00
William Murphy	b8f52d570e	chore: stop unit test switch on host arch (#2156) ... Now that the test fixture pins to a particular digest, there's no need for platform specific architecture switches in this test. Signed-off-by: Will Murphy <will.murphy@anchore.com>	2023-09-20 11:45:13 -04:00
Christopher Angelo Phillips	094b41b301	chore: pin and update all workflow dependencies; add permission scopes (#2138) ... --------- Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>	2023-09-15 14:18:42 -04:00
Chris SelzoandJoseph Palermo	5ceef48949	fix: do not double-prefix symlink paths that already contain volume names (#2051) ... Signed-off-by: Joseph Palermo <jpalermo@vmware.com> Signed-off-by: Chris Selzo <cselzo@vmware.com> Co-authored-by: Joseph Palermo <jpalermo@vmware.com>	2023-08-24 10:45:22 -04:00
Tristan Farkas	e1c1832f84	Add cataloger for Swift Package Manager. (#1919) ... Signed-off-by: Tristan Farkas <Tristan.Farkas@axis.com>	2023-07-25 14:35:21 -04:00
Dan LuhringandAlex Goodman	8478e0bef7	Add support for parsing .NET assemblies (#1943) ... * Add support for parsing .NET assemblies Signed-off-by: Dan Luhring <dluhring@chainguard.dev> Former-commit-id: 69c33fe4d77357d843c11590f3b07825bc6249ac * Add dll and exe files Signed-off-by: Dan Luhring <dluhring@chainguard.dev> Former-commit-id: b9d204efa6d2ef385b5fbb7a59a3474ecabea641 * Add PE cataloger to directory catalogers Signed-off-by: Dan Luhring <dluhring@chainguard.dev> Former-commit-id: 9711c00d9da92e2887e0c1f92edd740ea5345849 * Don't set language to dotnet for PEs Signed-off-by: Dan Luhring <dluhring@chainguard.dev> Former-commit-id: 368313fddac9160d8a06a01ebe8c5ac7990232f5 * Fix spelling of cataloger in constructor Signed-off-by: Dan Luhring <dluhring@chainguard.dev> Former-commit-id: e42fd77b2f8b6d42e076a84f6cce386861260941 * Adjust which cases in PE parsing return errors Signed-off-by: Dan Luhring <dluhring@chainguard.dev> Former-commit-id: 95b25f8fc3a7d4e18fe30e489b09851f316795ff * remove build binary from branch Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Former-commit-id: fa54c0d0aef0998d5520e9f44cae51f5f9cd38a2 * Fix failing CLI tests Signed-off-by: Dan Luhring <dluhring@chainguard.dev> --------- Signed-off-by: Dan Luhring <dluhring@chainguard.dev> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-07-19 15:34:07 -04:00
Alex Goodman	f8b832e6c3	Switch UI to bubbletea (#1888) ... * add bubbletea UI Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * swap pipeline to go 1.20.x and add attest guard for cosign binary Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update note in developing.md about the required golang version Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix merge conflict for windows path handling Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * temp test for attest handler Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add addtional test iterations for background reader Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-07-06 09:00:46 -04:00
DD (Devdatta) DeshpandeandKeith Zantow	a00a3df10c	fix: use filepath.EvalSymlinks if os.Readlink fails to evaluate the link (#1884) ... Signed-off-by: DD (Devdatta) Deshpande <dd@codewits.in> Co-authored-by: Keith Zantow <kzantow@gmail.com>	2023-07-05 14:49:22 -04:00
Alex Goodman	4da3be864f	Refactor source API (#1846) ... * refactor source API and syft json source block Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update source detection and format test utils Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * generate list of all source metadata types Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * extract base and root normalization into helper functions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * preserve syftjson model package name import ref Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * alias should not be a pointer Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-06-30 14:19:16 +00:00
Avi Deitcher	1764e1c3f6	fix: handle invalid symlinks (#1861) ... Signed-off-by: Avi Deitcher <avi@deitcher.net>	2023-06-05 15:04:14 -04:00