oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-04 16:36:40 +01:00
Code Issues Packages Projects Releases Wiki Activity
2,973 Commits 66 Branches 274 Tags
7c644ea3d1cf5cd01c41da7684692716139c4c90
Commit Graph
42 Commits
Author SHA1 Message Date
Christopher Phillips 7a131ff462 chore: update config injection 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-09-26 14:51:29 -04:00
Christopher Phillips 6fa1831484 chore: update feature to include config to restore previous behavior 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-09-26 14:16:49 -04:00
Christopher Angelo Phillips 6b48bd4b5e feat: add package supplier flag (#4131) 
---------

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-08-12 14:49:41 -04:00
Christopher Angelo Phillips e1374f758e fix: update license content filtering default case to be 'none' for no content returned 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-05-16 14:25:15 +00:00
Christopher Angelo PhillipsandAlex Goodman f77d503892 detect license ID from full text when incidentally provided as a value (#3876) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-13 16:37:18 -04:00
Keith Zantow 621d21eb04 feat: Add PURL list input/output format (#3853) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-05-12 13:33:24 -04:00
Alex Goodman d47a6c3a6d Improve support for cataloging nix package relationships (#3837) 
* add nix DB cataloger

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add derivation path to nix store pkg metadata

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* go mod tidy

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* allow for derivation path to be optional

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* repin build image and disable syscall filtering

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* bump storage capacity

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* track nix derivation details on packages

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* image fixture should have derivation examples

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-05 15:35:13 +00:00
Alex Goodman df18edf905 Consider DLL claims for dependencies of .NET packages from deps.json (#3822) 
* consider child dll claims for .NET packages from deps.json

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* make dll claim propagation configurable

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-04-24 11:59:16 -04:00
Keith Zantow b13ffdd304 fix: comma separated selectors in cataloger list command (#3804) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-04-16 10:41:48 -04:00
anchore-actions-token-generator[bot]andspiffcs f11377fe30 chore(deps): update tools to latest versions (#3775) 
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>
 2025-04-03 17:35:26 +00:00
Alex Goodman ad9928cb2a Merge the .NET deps.json and PE binary catalogers (#3563) 
* add combined deps.json + pe binary cataloger

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* deprecate pe and deps standalone catalogers

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* parse resource names + add tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix integration and CLI tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add some helpful code comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* allow for dropping Dep packages that are missing DLLs

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* migrate json schema changes to 24

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* keep application configuration

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* correct config help

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* [wip] detect claims of dlls within deps.json

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* [wip] fix tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add assembly repack detection

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* .net package count is lower due to dll claim requirement

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-03-27 14:38:16 -04:00
Keith Zantow 4a9437808e feat: parallelize catalogers per-file and hash contents in parallel (#3636) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-03-26 11:10:08 -04:00
Keith Zantow 7ac4d91f43 chore: reformat (#3754) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-03-21 06:13:35 -04:00
Alex Goodman e9b24a29d7 Remove mitchellh dependencies (#3748) 
* remove mitchellh dependencies

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix failing unit tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-03-20 10:19:19 -04:00
RogueAIandKeith Zantow aeea170b19 fix: disable cert validation in dotnet-portable-executable-cataloger by default (#3677) 
Signed-off-by: rogueai <rogueai@users.noreply.github.com>
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
 2025-02-21 15:08:06 -05:00
Christopher Angelo Phillips e584c9f416 feat: 3626 add option enable license content; disable by default (#3631) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-02-05 20:41:03 +00:00
Alex Goodman 684b6e3f98 Add file catalogers to selection configuration (#3505) 
* add file catalogers to selection configuration

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix typos

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* warn when there is conflicting file cataloging configuration

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* allow for explicit removal of all package and file tasks

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address PR feedback

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-02-03 19:10:17 +00:00
Christopher Angelo Phillips d5e52bc2ce docs: update descriptions with correct options (#3630) 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-01-29 15:47:04 +00:00
Dominik SchmidtandKeith Zantow 19a75fe504 feat(golang): add license parsing from vendor dirs (#3522) 
Signed-off-by: Dominik Schmidt <dev@dominik-schmidt.de>
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
 2025-01-17 20:25:05 -05:00
Alex Goodman 340b5e17f0 Add relationships for rust audit binary packages (#3500) 
* add rust audit binary pkg relationships

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix linting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-12-06 09:23:18 -05:00
GGMU 59e943385d feat: set max layer size (#3464) 
Signed-off-by: tomersein <tomersein@gmail.com>
 2024-12-02 11:29:42 -05:00
Nathan VossandKeith Zantow a55b71d4ef feat: exclude devDependencies from package-lock.json parsing (#3371) 
Signed-off-by: Nathan Voss <njvoss299@gmail.com>
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
 2024-10-30 12:02:27 -04:00
Keith Zantow 759b898df5 feat: multi-level configuration and profiles (#3337) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-10-23 12:15:59 -04:00
Keith Zantow a00533c836 feat: Java dependency graph information (#3363) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-10-23 11:17:34 -04:00
William Murphy 0c71bf23c5 docs: clearer deprecation message for --file (#3310) 
It's not clear to users that they shoudl use --output FORMAT=PATH
instead of --file. Directly suggest the FORMAT=PATH syntax.

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
 2024-10-10 13:11:45 -04:00
Keith ZantowandAlex Goodman ccbee94b87 feat: report unknowns in sbom (#2998) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-10-07 16:11:37 -04:00
Alex Goodman 01de99b253 Add JVM cataloger (#3217) 
* add jvm cataloger

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* simplify version selection

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* CPEs from JVM cataloger should be declared

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* ensure package overlap is enabled for sensitive use cases

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* more permissive glob

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-09-23 17:21:38 -04:00
Alex Goodman 963ea594c8 Add compliance policy for empty name and version (#3257) 
* add policy for empty name and version

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* default stub version

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* modifying ids requires augmenting relationships

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-09-20 12:50:47 -04:00
Keith Zantow 1b863268df feat: --enrich flag for data enrichment feature enablement (#3182) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-09-12 10:45:18 -04:00
luozexuan c19cf626ab chore: fix some comments (#3114) 
Signed-off-by: luozexuan <fetchcode@139.com>
 2024-08-12 12:08:04 -04:00
Gijs CalisandKeith Zantow 9d40d1152e feat: improved java maven property resolution (#2769) 
Signed-off-by: Gijs Calis <51088038+GijsCalis@users.noreply.github.com>
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
 2024-08-05 11:30:47 -04:00
Keith Zantow af3aaa0397 fix: make caching options more explicit (#2966) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-06-14 18:45:48 +00:00
Keith Zantow ca0cc52d47 fix: separate golang license caches from mod dir (#2852) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-06-12 19:12:35 -04:00
Keith Zantow 1c37bab2b2 feat: add config command (#2892) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-05-23 15:18:09 -04:00
Keith Zantow a978966cad feat: add --from flag, refactor source providers (#2610) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-02-27 16:44:37 -05:00
Keith Zantow 2995c3c4fd fix: SPDX tag value version selector (#2665) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-02-23 08:22:10 -05:00
Alex Goodman 98b700e83c rename binary cataloger to be more unique (#2633) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-14 11:01:55 -05:00
Alex Goodman 84576b93e1 Guess go main module version based on binary contents (#2608) 
* guess go main module version based on binary contents

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add configuration options for golang main module version heuristics

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix test setup for go bin cataloger

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix unit test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix incorrect test assert ordering

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* handle error from seek

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-09 19:52:42 +00:00
Alex Goodman 3023a5a7bc Detect ELF security features (#2443) 
* add detection of ELF security features

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix linting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update json schema with file executable data

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update expected fixure when no tty present

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* more detailed differ

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* use json differ

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove json schema addition

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* regenerate json schema

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix mimtype set ref

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-02 16:51:18 +00:00
William MurphyandAlex Goodman bbddac1f9d Fix attest with --key (#2551) 
Fix passing "--key" to the attest command. Additionally, pull in an update to
the clio CLI library to permit unit testing that flags and env vars are parsed
to the correct field on command options structs. This testing strategy was
needed here because testing attestation in an end to end test requires a
prohibitive amount of setup.

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Will Murphy <will.murphy@anchore.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-01-31 16:39:17 -05:00
Alex Goodman a32b8d7fc6 Use the json schema as input for templating (#2542) 
* use the json schema as input for templating

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix cli tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-01-25 14:00:35 +00:00
Alex Goodman e0e1c4ba0a Internalize majority of cmd package (#2533) 
* internalize majority of cmd package and migrate integration tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add internal api encoder

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* create internal representation of all formats

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* export capability to get default encoders

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* restore test fixtures

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-01-24 13:29:51 -05:00