oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-12 06:07:20 +02:00
Code Issues Packages Projects Releases Wiki Activity
3,616 Commits 63 Branches 272 Tags
7e713d106e7a13c667fe7a62172ff40260569c5a
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Keith Zantow ed76e96749 fix: panic when scanning squashfs symlinks (#5119) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2026-08-19 13:13:42 -04:00
Keith Zantow 16223e6dd7 fix: consider vendored golang packages in module attribution (#5093) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2026-07-27 15:20:49 -04:00
Keith Zantow 76ede661db fix: allow more PEP440-compliant characters in python versions (#4964) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2026-07-13 15:10:12 -04:00
Keith Zantow deee79411a fix: composite action version parsing (#4616) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2026-06-29 15:23:47 -04:00
Keith Zantow 9c321691d4 feat: SPDX 3 (#4269) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2026-06-22 10:59:34 -04:00
Keith Zantow 89773c0a12 fix: support CycloneDX 1.7 (#4967) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2026-06-11 09:40:42 -04:00
Keith Zantow 63232bf725 fix: local version identifiers in python requirements parsing (#4959) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2026-06-08 11:12:47 -04:00
Keith Zantow 834ddcb1c0 fix: golang version file regex (#4694) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2026-03-23 15:56:29 -04:00
Keith Zantow add2629446 fix: further improve go binary classifier, including windows (#4593) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2026-02-03 10:29:00 -05:00
Keith Zantow c65d023668 feat: detect Debian version from /etc/debian_version (#4569) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2026-01-23 17:52:21 -05:00
Keith Zantow 836f358cd4 fix: correctly report supporting evidence for binary packages (#4558) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2026-01-23 13:01:12 -05:00
Keith Zantow 9e3150b7ee fix: java archives excluded due to incorrect license glob results (#4449) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-12-08 15:58:13 -05:00
Keith Zantow 7014cb023f chore: options to run release-install-script without release (#4377) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-11-17 22:12:04 +00:00
Keith Zantow a400c675fc feat: license file search (#4327) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-11-03 14:16:05 -05:00
Keith Zantow 4343d04652 fix: panic during java archive maven resolution (#4290) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-10-16 07:00:31 -04:00
Keith Zantow 9217f2099f chore: update ffmpeg tests (#4249) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-10-01 13:11:36 +00:00
Keith Zantow 323fd3e34c docs: add GitHub actions to supported ecosystems (#4235) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-09-23 10:08:41 -04:00
Keith Zantow ca21ccf21d chore: redhat cataloger error when sqlite not regsitered (#4150) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-08-21 14:55:47 +00:00
Keith Zantow 9f956dca8f fix: closed reader during java binary detection (#4129) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-08-12 08:58:28 -04:00
Keith Zantow 8c6a2bcbb6 fix: nondeterministic Java archive cataloging and improve groupID (#4118) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-08-07 10:55:10 -04:00
Keith Zantow 48bf81cf7f fix: align binary java detection with jvm cataloger + support IBM (#4046) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-07-22 12:06:32 -04:00
Keith ZantowandAlex Goodman 02703d5c80 feat: RHEL EUS detection (#4023) 
* feat: rhel eus detection

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: update tests

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: update more tests

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* rename feature detection functions

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-07-07 14:11:20 +00:00
Keith Zantow 10f0631710 fix: provide separate nonroot image (#3998) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-06-11 17:00:55 -04:00
Keith Zantow 9090c69708 fix: exclude packages with SPDX GENERATED_FROM source package indication (#3981) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-06-09 14:12:23 -04:00
Keith Zantow 71d84603c1 fix: bump stereoscope to fix symlink performance issue (#3953) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-06-04 15:50:03 +00:00
Keith Zantow 576e729c84 fix: revert incorrect graalvm unknown behavior (#3944) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-05-30 11:36:57 -04:00
Keith Zantow 7bfb4c86a6 fix(dotnet-deps-cataloger): avoid repeated dependency resolution (#3930) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-05-21 21:28:40 -04:00
Keith Zantow b4d717fb30 chore: update mimetype contact info (#3887) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-05-13 17:47:05 +00:00
Keith Zantow 621d21eb04 feat: Add PURL list input/output format (#3853) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-05-12 13:33:24 -04:00
Keith Zantow b13ffdd304 fix: comma separated selectors in cataloger list command (#3804) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-04-16 10:41:48 -04:00
Keith Zantow 4a9437808e feat: parallelize catalogers per-file and hash contents in parallel (#3636) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-03-26 11:10:08 -04:00
Keith Zantow 7ac4d91f43 chore: reformat (#3754) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-03-21 06:13:35 -04:00
Keith Zantow 9a2c2ad401 chore: upload individual binaries as artifacts (#3714) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-03-13 12:15:13 -04:00
Keith Zantow 7571f8dfba chore: updates for go 1.24.1 (#3712) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-03-06 15:35:26 +00:00
Keith Zantow 2792013eb2 chore: disable line wrapping glow output (#3679) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-02-24 10:04:14 -05:00
Keith Zantow 46522bcc5d chore: update packageurl-go (#3678) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-02-21 15:31:16 -05:00
Keith Zantow a17fe480a0 chore: update runners to ubuntu-24.04 (#3657) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-02-11 21:34:12 +00:00
Keith Zantow 2328b20082 fix: reduce warn levels to debug for non-actionable errors (#3645) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-02-07 13:22:55 -05:00
Keith Zantow a2a56dd3e9 fix: golang remote license search not executing when error reading local mod dir (#3549) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-01-06 11:47:55 -05:00
Keith Zantow 16eedd81ec chore: build release sbom from go.mod (#3417) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-11-05 09:51:23 -05:00
Keith Zantow 798c18a698 fix: stack overflow in spyingIoReadCloser (#3392) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-10-29 08:23:57 -04:00
Keith Zantow 1118ac4ace fix: bad pom files may cause infinite loop (#3391) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-10-28 18:09:04 -04:00
Keith Zantow 759b898df5 feat: multi-level configuration and profiles (#3337) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-10-23 12:15:59 -04:00
Keith Zantow a00533c836 feat: Java dependency graph information (#3363) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-10-23 11:17:34 -04:00
Keith ZantowandAlex Goodman ccbee94b87 feat: report unknowns in sbom (#2998) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-10-07 16:11:37 -04:00
Keith Zantow 1b863268df feat: --enrich flag for data enrichment feature enablement (#3182) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-09-12 10:45:18 -04:00
Keith Zantow c33a51d3d8 chore: restore ci-check.sh script (#3218) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-09-10 15:19:05 -04:00
Keith Zantow 11d77b4a94 fix: cycles resolving relative path parent poms with parent-defined variables (#3170) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-08-28 15:12:13 -04:00
Keith Zantow 73b9d5aa42 fix: mysql 8.0.3x binary detection (#3142) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-08-21 09:48:28 -04:00
Keith Zantow 95b4a88256 fix: logging for remote network calls (#3140) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-08-20 11:45:33 -04:00
Keith Zantow cf85450e08 chore: fix failing python relationship test (#3117) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-08-12 12:07:47 -04:00
Keith Zantow 05a10e8bed chore: update release script to use gh from binny (#3084) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-07-31 20:10:17 -04:00
Keith Zantow a4b5dcd0df fix: improve determinism in java archive identification (#3085) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-07-30 12:02:52 -04:00
Keith Zantow 741c8fb9bd fix: SPDX output performance with many relationships (#3053) 2024-07-24 10:14:20 -04:00
Keith Zantow 125c787e40 chore: add debug logging for errors reading RPM files (#3051) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-07-22 13:05:04 -04:00
Keith Zantow ba31c2f1ae fix: include CPEs with Maven groupId as vendor (#3045) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-07-17 11:23:58 -07:00
Keith Zantow 278b72d39b chore: pin fedora image for elf binary test (#3041) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-07-15 16:37:09 +00:00
Keith Zantow bd1c1d260c fix: handle errors reading go licenses (#2985) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-06-24 10:27:03 -04:00
Keith Zantow af3aaa0397 fix: make caching options more explicit (#2966) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-06-14 18:45:48 +00:00
Keith Zantow ca0cc52d47 fix: separate golang license caches from mod dir (#2852) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-06-12 19:12:35 -04:00
Keith Zantow ac34808b9c feat: detect fluent-bit binaries (#2905) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-05-28 10:13:06 -04:00
Keith Zantow 1c37bab2b2 feat: add config command (#2892) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-05-23 15:18:09 -04:00
Keith Zantow b0c88ddea9 fix(spdx): include required fields (#2168) 
* fix(spdx): include required fields

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: missed update due to refactoring

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: update tools-golang

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: add test with packageVerificationCode included and excluded

Signed-off-by: Keith Zantow <kzantow@gmail.com>

---------

Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-04-30 13:28:42 -04:00
Keith Zantow 047e31a969 fix: add correct vendor for dnsmasq CPE (#2659) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-04-30 13:24:01 -04:00
Keith Zantow f7d3d552ce fix: exclude known instrumentation jars from being erroneously identified (#2796) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-04-22 15:03:17 -04:00
Keith ZantowandWill Murphy dde5d349b1 fix: more robust go main version extraction (#2767) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Will Murphy <will.murphy@anchore.com>
Co-authored-by: Will Murphy <will.murphy@anchore.com>
 2024-04-11 11:58:51 -04:00
Keith Zantow 01340b2a5c fix: conan poco project cpe (#2740) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-03-28 16:56:24 -04:00
Keith Zantow 410867ca0c fix: panic scanning binaries without symtab (#2739) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-03-27 13:51:45 -04:00
Keith Zantow f9e09aef19 docs: add simplest example from regsitry (#2691) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-03-06 14:25:37 -05:00
Keith Zantow 326ec57d4a docs: fix incorrect flag name in readme (#2677) 2024-02-28 15:39:43 -05:00
Keith Zantow a978966cad feat: add --from flag, refactor source providers (#2610) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-02-27 16:44:37 -05:00
Keith Zantow 2995c3c4fd fix: SPDX tag value version selector (#2665) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-02-23 08:22:10 -05:00
Keith Zantow 108a5dae9b chore: update busybox image for acceptance tests (#2663) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-02-22 15:32:17 -05:00
Keith Zantow 6288530835 fix: add BOMRef to CycloneDX OS Component (#2634) 2024-02-14 08:18:16 -05:00
Keith Zantow d26a5c4d30 fix: ensure version output to stdout (#2621) 2024-02-09 20:59:25 +00:00
Keith Zantow ef5c1651ef fix: improve dotnet portable executable identification (#2133) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-11-29 12:51:24 -05:00
Keith Zantow f5a6b5a02f fix: logging level for parsing potential PE files (#2367) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-11-29 03:42:22 +00:00
Keith Zantow a50a0f77d2 fix: capture root command stdout (#2364) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-11-28 15:04:28 -05:00
Keith Zantow 1c787f436f fix: prevent writing non-report output to stdout (#2324) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-11-16 17:45:25 -05:00
Keith Zantow d91c2dd842 fix: identify cyclone-json without $schema (#2303) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-11-08 11:54:22 -05:00
Keith Zantow 7d0d3e1977 fix: prevent errors from clobbering terminal (#2161) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-09-20 14:35:41 -04:00
Keith Zantow a46d12270f fix: encode and decode FileLicenses and FileContents in Syft JSON (#2083) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-09-13 16:14:20 -04:00
Keith ZantowandAlex Goodman 2b7a9d0be3 chore: update CLI to CLIO (#2001) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-08-29 15:52:26 -04:00
Keith Zantow dd09e0362e chore: update quill to the latest version (#2065) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-25 20:45:04 +00:00
Keith Zantow 4ae94c37eb fix: duplicate entries in cyclonedx dependency list (#2063) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-25 12:19:01 -04:00
Keith Zantow 4762ba0943 feat: use java package names to determine known groupids (#2032) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-17 12:55:25 -04:00
Keith Zantow d1635971a1 fix: inconsistent removal of binaries by overlap (#2036) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-17 15:27:31 +00:00
Keith Zantow 59107324ce chore: restore cataloger.DefaultConfig (#2028) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-14 20:28:07 +00:00
Keith Zantow b3d7ba569b fix: read direct package files when decoding SPDX tag-value (#2014) 
* fix: read direct package files when decoding SPDX tag-value

---------

Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-14 11:37:24 -04:00
Keith Zantow c7272fd6a5 fix: SPDX license values and download location (#2007) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-08 15:55:50 -04:00
Keith Zantow aaf767f8d3 chore: improve spdx purl decoding (#1996) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-04 11:43:21 -04:00
Keith Zantow 79014ed8c8 fix: gradle lockfile parser groupId handling (#1995) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-04 11:42:26 -04:00
Keith Zantow 3f0475efb7 chore: update bubbly to fix hanging (#1990) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-08-02 10:28:35 -04:00
Keith Zantow e2f7befbfb fix: default image source name to user input (#1979) 
* fix: default image source name to user input

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: add test

Signed-off-by: Keith Zantow <kzantow@gmail.com>

---------

Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-07-31 17:29:18 +00:00
Keith Zantow 9480f10ccd feat: support top-level SPDX package and graph (#1934) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-07-26 13:54:32 -04:00
Keith Zantow f79cb9587f fix: only output valid cyclonedx license choices (#1879) 
* fix: only output valid cyclonedx license choices

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: update tests

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: return nil for emtpty cdx license list

Signed-off-by: Keith Zantow <kzantow@gmail.com>

---------

Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-06-22 12:05:38 -04:00
Keith Zantow 631d50d038 chore: update SPDX license list to 3.21 (#1885) 2023-06-20 15:47:02 +00:00
Keith Zantow 79a955b1a9 feat: source-version flag (#1859) 2023-06-05 10:36:34 -04:00
Keith Zantow a3c5550217 fix: duplicate packages, support pnpm lockfile v6 (#1778) 2023-05-23 10:24:25 -04:00
Keith Zantow ddb338d834 chore: do not HTML escape PackageURLs (#1782) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-05-05 10:08:04 -04:00