oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-30 14:02:26 +01:00
Code Issues Packages Projects Releases Wiki Activity
1,474 Commits 65 Branches 273 Tags
7de7a7990a0d7315bac2d02f5eb6f7989fd6ef2f
Commit Graph
629 Commits
Author SHA1 Message Date
Dan Luhring 7de7a7990a fix: improve version detection in Java archive name parsing (#1889) 
Signed-off-by: Dan Luhring <dluhring@chainguard.dev>
 2023-06-22 18:42:10 +00:00
Keith Zantow f79cb9587f fix: only output valid cyclonedx license choices (#1879) 
* fix: only output valid cyclonedx license choices

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: update tests

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: return nil for emtpty cdx license list

Signed-off-by: Keith Zantow <kzantow@gmail.com>

---------

Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-06-22 12:05:38 -04:00
William Murphy e2ed89f700 Pad artifact IDs (#1882) 
Otherwise the hash can sometimes be short if it results in a low uint64.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2023-06-16 13:26:18 -04:00
James Neate 098c255a2d fix: pom properties not setting artifact id (#1870) 
Signed-off-by: James Neate <jamesmneate@gmail.com>
 2023-06-12 09:59:14 -04:00
Avi Deitcher 1764e1c3f6 fix: handle invalid symlinks (#1861) 
Signed-off-by: Avi Deitcher <avi@deitcher.net>
 2023-06-05 15:04:14 -04:00
dependabot[bot]andChristopher Phillips c560ffd811 chore(deps): bump github.com/spdx/tools-golang from 0.5.0 to 0.5.1 (#1850) 
* chore(deps): bump github.com/spdx/tools-golang from 0.5.0 to 0.5.1

Bumps [github.com/spdx/tools-golang](https://github.com/spdx/tools-golang) from 0.5.0 to 0.5.1.
- [Release notes](https://github.com/spdx/tools-golang/releases)
- [Changelog](https://github.com/spdx/tools-golang/blob/main/RELEASE-NOTES.md)
- [Commits](https://github.com/spdx/tools-golang/compare/v0.5.0...v0.5.1)

---
updated-dependencies:
- dependency-name: github.com/spdx/tools-golang
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore: update fixtures for spdx with new library changes

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-06-05 15:01:06 -04:00
anchore-actions-token-generator[bot]andChristopher Phillips 7d1b292ad0 chore(deps): update bootstrap tools to latest versions (#1857) 
* chore(deps): update bootstrap tools to latest versions

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-06-05 18:56:04 +00:00
Christopher Angelo Phillipsandguoguangwu f07581f504 Pr 1825 (#1865) 
chore: code cleanup

Signed-off-by: guoguangwu <guoguangwu@magic-shield.com>

---------

Signed-off-by: guoguangwu <guoguangwu@magic-shield.com>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: guoguangwu <guoguangwu@magic-shield.com>
 2023-06-05 17:01:00 +00:00
Keith Zantow 79a955b1a9 feat: source-version flag (#1859) 2023-06-05 10:36:34 -04:00
Avi Deitcher 68f8df9594 accept main.version ldflags even without vcs (#1855) 
Signed-off-by: Avi Deitcher <avi@deitcher.net>
 2023-06-01 08:34:46 -04:00
James Neate c69cdd9f4a feat: add scope to pom properties (#1779) 
* feat: add scope to pom properties

Signed-off-by: James Neate <jamesmneate@gmail.com>

* fix: fixed conflict with schema bump

Signed-off-by: James Neate <jamesmneate@gmail.com>

---------

Signed-off-by: James Neate <jamesmneate@gmail.com>
 2023-06-01 12:22:29 +00:00
Alex Goodman 6afbffce28 Fix directory resolver to consider CWD and root path input correctly (#1840) 
* [wip] put in initial fix

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* capture expected behavior of dir resolver in tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update tests + comments to reflect current dir resolver behavior

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add additional test cases

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix additional tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix bad merge conflict resolution

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

---------

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2023-05-25 13:41:18 +00:00
Alex Goodman 07e76907f6 Migrate location-related structs to the file package (#1751) 
* migrate location structs to file package

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* replace source.Location refs with file package call

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove hardlink test for file based catalogers

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove hardlink test for all-regular-files testing

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* migrate file resolver implementations to separate package

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* [wip] migrate resolvers to internal

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* migrate resolvers to syft/internal

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

---------

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Signed-off-by: <>
 2023-05-24 17:06:38 -04:00
Christopher Angelo Phillips 4ac8fdf6df fix: add panic recovery for license parse (#1839) 
* fix: add panic recovery for license parse
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-05-23 16:58:49 +00:00
Idan Frimark 087a6356b9 chore: return both failures when failed to retrieve an image with a scheme (#1801) 
Signed-off-by: Idan Frimark <idanf@cisco.com>
 2023-05-23 10:32:12 -04:00
Alex GoodmanandWeston Steimel 26c201f7f7 Extract go module versions from ldflags for binaries built by go (#1832) 
* wip

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* with golang bin ldflags refactor

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add test for golang binary cataloger for ldflag extraction

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove binary classfiers that overlap with new go ldflags detection

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

---------

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Co-authored-by: Weston Steimel <weston.steimel@anchore.com>
 2023-05-23 10:27:48 -04:00
Keith Zantow a3c5550217 fix: duplicate packages, support pnpm lockfile v6 (#1778) 2023-05-23 10:24:25 -04:00
Alex Goodman 334a775cb9 Keep original FileInfo persisted on file.Metadata structs (#1794) 
* pull in fileinfo changes from stereoscope #172

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix CLI test assumption about the docker daemon

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

---------

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Signed-off-by: <>
 2023-05-19 14:21:10 +00:00
Christopher Angelo Phillips 4601ca3735 fix: update field plurality of 8.0.0 schema before release (#1820) 
to keep things consistent across the schema we want Locations and URLs to be plural fields now that they are fields on the License struct
---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-05-16 13:05:48 -04:00
Christopher Angelo Phillips 1a2a49840b fix: update cataloger to check for expressions before split (#1819) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-05-16 16:04:28 +00:00
Christopher Angelo Phillips 42fa9e4965 feat: update syft license concept to complex struct (#1743) 
this PR makes the following changes to update the underlying license model to have more expressive capabilities
it also provides some guarantee's surrounding the license values themselves

- Licenses are updated from string -> pkg.LicenseSet which contain pkg.License with the following fields:
- original `Value` read by syft
- If it's possible to construct licenses will always have a valid SPDX expression for downstream consumption
- the above is run against a generated list of SPDX license ID to try and find the correct ID
- SPDX concluded vs declared is added to the new struct
- URL source for license is added to the new struct
- Location source is added to the new struct to show where the expression was pulled from
 2023-05-15 16:23:39 -04:00
Shane Alvarez 8046f09562 fix: cyclonedx depends-on relationship inverted (#1816) 
Signed-off-by: Shane Alvarez <shane.alv@gmail.com>
 2023-05-15 09:59:26 -04:00
mikey straussandEitan Goldenstein b4ed599481 fix: retain sbom cataloger relationships (#1509) 
Signed-off-by: Eitan Goldenstein <eitan@scribesecurity.com>
Co-authored-by: Eitan Goldenstein <eitan@scribesecurity.com>
 2023-05-15 09:57:21 -04:00
William Murphy e925d9d4a5 feat: warn if parsing newer SBOM (#1810) 
If syft is asked to parse an SBOM that was written by a newer version of
syft, emit a warning, since the current version of syft doesn't know about 
fields that may be added in the future.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2023-05-11 08:55:27 -04:00
William Murphy da3624644a feat: Add R cataloger (#1790) 
Add a cataloger that detects installed R packages by looking for DESCRIPTION
files. The base R package is now picked up in coverageImage tests in
test/cli/packages_cmd_test.go, so increment expected package counts for the
tests that use that image.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2023-05-10 12:30:11 -04:00
William Murphy 291da8cd12 fix: Reduce log spam on unknown relationship type (#1797) 
Rather than log a warning for every instance of an unknown relationship type,
or similar error, log a count of how many times each of these errors is
raised.

---------

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2023-05-10 09:51:12 -04:00
Josh Bressers 0f1aed4477 Update the CPE generation for spring-security-core (#1789) 
* Update the CPE generation for spring-security-core
* Add vendor test for spring-security

Signed-off-by: Josh Bressers <josh@bress.net>

---------

Signed-off-by: Josh Bressers <josh@bress.net>
 2023-05-05 15:41:41 +00:00
Keith Zantow ddb338d834 chore: do not HTML escape PackageURLs (#1782) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-05-05 10:08:04 -04:00
Keith Zantow 354c72bbf4 chore: do not include kernel module cataloger by default (#1784) 2023-05-05 09:54:24 -04:00
Jeff Squyres d63a1f5f80 chore(docs): Update lists of catalogers (#1780) 
Signed-off-by: Jeff Squyres <jeff@squyres.com>
 2023-05-04 15:36:22 -04:00
Keith Zantow 645206735e chore: add more detail on SPDX file IDs (#1769) 2023-05-02 16:52:18 -04:00
Filip PytlounandAlex Goodman 95a04cadea Search /usr/share for rpmdb to fix scan on ostree-managed images (#1756) 
Fixes: https://github.com/anchore/syft/issues/1755

Signed-off-by: Filip Pytloun <filip@pytloun.cz>
Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2023-05-02 16:43:52 -04:00
Alex Goodman 5f3d4d285b rename sbom.PackageCatalog to sbom.Packages (#1773) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2023-05-01 10:19:58 -04:00
Shane Dell a07bfe7dfa Create python requirements metadata (#1759) 
- Create new metadata struct and type for python requirements.
- Update parsing of python requirements to use python requirements metadata.
- Remove extras and url from line. Add them to metadata instead.
- Add unit test to test that extras are removed from package name.
- Update test to look at requirements metadata.
- Will need updated in future to support more than just == for the version constraint.
- Update JSON schema data

Closes anchore/grype#1246
Closes anchore/grype#1251

Signed-off-by: Shane Dell <shanedell100@gmail.com>
 2023-04-27 09:04:30 -04:00
Keith Zantow 451cb9d5ca chore: update test redactor ordering (#1765) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-04-26 20:42:43 +00:00
Alex Goodman fd02bef0a3 rename pkg.Catalog to pkg.Collection (#1764) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2023-04-26 13:56:33 -04:00
Christopher Angelo PhillipsandAlex Goodman c038f13d44 chore: go-rpmdb update (#1757) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2023-04-24 10:34:13 -04:00
dependabot[bot] 8102ad4edc chore(deps): bump github.com/CycloneDX/cyclonedx-go from 0.7.1-0.20221222100750-41a1ac565cce to 0.7.1 (#1706) 2023-04-24 10:20:12 -04:00
Shane Dell 13485ca5e7 fix: Improve pnpm support (#1752) 
Signed-off-by: Shane Dell <shanedell100@gmail.com>
 2023-04-21 17:58:23 +00:00
Alex Lehman b2b332e8b2 feat: Add template func hasField (#1754) 
Signed-off-by: Lehman, Alex <alex.lehman@gtri.gatech.edu>
 2023-04-21 09:34:06 -04:00
Christopher Angelo Phillips a42bac6fcc fix: only cache java packages and not source content (#1750) 
* fix: only cache java packages and not source content

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* fix: add gradle to matched files for ci checksum

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-04-19 16:07:34 -04:00
Shane Dell 98a6c6efbe Add sections of interest for Gemfile.lock cataloger (#1749) 
- Updated tests to reflect the new sections being added to show they function properly.

Closes #1660

Signed-off-by: Shane Dell <shanedell100@gmail.com>
 2023-04-19 12:18:17 -04:00
Christopher Angelo Phillips 55a90a2ee0 fix: update cache.fingerprint file to java-builds dir (#1748) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-04-19 12:17:07 -04:00
Shane Dell 6e835fd8fc Add ALPM Metadata to CYCLONEDX and SPDX output formats (#1747) 
Signed-off-by: Shane Dell <shanedell100@gmail.com>
 2023-04-18 11:53:02 -04:00
Weston Steimel ee80349ea0 chore: bump stereoscope to latest version (#1741) 
Resolves reporting of GHSA-hw7c-3rfg-p46j

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2023-04-18 15:44:03 +00:00
Shane Dell 244b797a19 Create consul binary classifier (#1738) 
* Create consul binary classifier

Closes #1590

Signed-off-by: Shane Dell <shanedell100@gmail.com>

* Create test for consul binary classifier

Signed-off-by: Shane Dell <shanedell100@gmail.com>

* Update version for consul. Add note that about consul version matcher is brittle

Signed-off-by: Shane Dell <shanedell100@gmail.com>

---------

Signed-off-by: Shane Dell <shanedell100@gmail.com>
 2023-04-17 12:26:07 -04:00
Alex Goodman 5a7bab972c Fix kernel cataloger test fixtures (#1742) 
* pin kernel and modules version for kernel fixtures

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* cache kernel fixtures in CI

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update CLI test image with pinned kernel deps

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update the kernel version found in integration tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

---------

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2023-04-17 11:44:46 -04:00
Avi DeitcherKeith ZantowAlex Goodman
 		b69259534d feat: Support scanning license files in golang packages over the network (#1630) 
Signed-off-by: Avi Deitcher <avi@deitcher.net>
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2023-04-14 15:13:29 -04:00
Alex Goodman 44422853be Add package-to-file location evidence relationships (#1698) 
* add evident-by relationship

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* wire up evident-by relationship geneation

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* handle evident-by relationship in spdx formats

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix decoding file info for syft json format

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* bump json schema to incorporate file size attribute

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* refactor to create relationships for primary evidence only

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove unused 7.0.2 json schema

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

---------

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2023-04-14 15:08:46 -04:00
Avi DeitcherandAlex Goodman cc731c7b19 Add Linux Kernel cataloger (#1694) 
* add kernel handler

Signed-off-by: Avi Deitcher <avi@deitcher.net>

* [wip] combine kernel and kernel module cataloging

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* [wip] combine kernel and kernel module cataloging

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Signed-off-by: Avi Deitcher <avi@deitcher.net>

* rename Kernel package to LinuxKernel package

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* split kernel and module packages within cataloger

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* wire up application configuration with kernel cataloger options

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* dont use references for packages on relationships

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix linting and tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* kernel cataloger should be resistent to partial failure

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* log upon kernel module metadata missing

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add tests for linux kernel cataloger

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update integration tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update cli package test counts

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add evidence annotations for kernel packages

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* reduce noise in cli test output

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* missed cli test to reduce noise for

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix package counts

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update docs with linux kernel cataloging refs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* bump json schema with new metadata fields

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

---------

Signed-off-by: Avi Deitcher <avi@deitcher.net>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Signed-off-by: <>
Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2023-04-14 14:33:36 -04:00