oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-12 06:07:20 +02:00
Code Issues Packages Projects Releases Wiki Activity
1,932 Commits 63 Branches 272 Tags
84576b93e14117aa28827a2ba230642fead50fe6
Commit Graph
1932 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Alex Goodman 84576b93e1 Guess go main module version based on binary contents (#2608) 
* guess go main module version based on binary contents

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add configuration options for golang main module version heuristics

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix test setup for go bin cataloger

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix unit test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix incorrect test assert ordering

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* handle error from seek

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-09 19:52:42 +00:00
anchore-actions-token-generator[bot]kzantowChristopher Phillips
 		737c4e44c5 chore(deps): update stereoscope to 681f6715b0e35686d6e6f40bce109176de1ee274 (#2617) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2024-02-09 14:06:28 -05:00
Alex Goodman 7444a9f976 fix readme around templating options (#2612) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-09 13:44:41 -05:00
Alex Goodman 8683cba081 suppress executable parsing issues (#2614) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-09 17:13:58 +00:00
Christopher Angelo Phillips c0f43e5e2d chore: update license list, cpe dictionary (#2620) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2024-02-09 11:31:42 -05:00
anchore-actions-token-generator[bot]andspiffcs 397cf210de chore(deps): update tools to latest versions (#2606) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>
 2024-02-08 10:39:18 -05:00
Christopher Angelo Phillips bd0cb916df fix: incorrect conversion between integer types (#2605) 
* chore: match strconv.ParseInt to file mode type

if a string is parsed into an int using strconv.Atoi,
and subsequently that int is converted into another integer type of a smaller size,
the result can produce unexpected values.
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
v0.104.0 		2024-02-07 20:41:00 +00:00
dependabot[bot] da31eed637 chore(deps): bump golang.org/x/mod from 0.14.0 to 0.15.0 (#2602) 
Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.14.0 to 0.15.0.
- [Commits](https://github.com/golang/mod/compare/v0.14.0...v0.15.0)

---
updated-dependencies:
- dependency-name: golang.org/x/mod
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-02-07 11:31:49 -05:00
dependabot[bot] 704155eb22 chore(deps): bump github.com/docker/docker (#2601) 
Bumps [github.com/docker/docker](https://github.com/docker/docker) from 25.0.2+incompatible to 25.0.3+incompatible.
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](https://github.com/docker/docker/compare/v25.0.2...v25.0.3)

---
updated-dependencies:
- dependency-name: github.com/docker/docker
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-02-07 11:31:41 -05:00
William Murphy ce67927a98 Fix: unmarshal key values in Java, Go, and Conan metadata (#2603) 
Previously, Syft represented several metadata fields as map[string]string,
however this representation erased ordering, so Syft now represents these values
as []KeyValue. Add custom unmarshaling so that JSON that was written by
older versions of Syft using the map[string]string representation can be parsed
into the new []KeyValue representation.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2024-02-07 11:26:23 -05:00
Weston Steimel bbd34f61fd fix(dotnet): prefer portable executable product version when semantically greater than file version (#2600) 
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2024-02-07 13:28:37 +00:00
Alex Goodmanandmikey strauss c61f59e7b7 Finalize Conan v2 support (#2587) 
* Add support for conan lock v2 (#2461)

* conan lock 2.x requires field support

Signed-off-by: houdini91 <mdstrauss91@gmail.com>

* PR review, struct renaming

Signed-off-by: houdini91 <mdstrauss91@gmail.com>

---------

Signed-off-by: houdini91 <mdstrauss91@gmail.com>

* decompose conanlock parser + add tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: houdini91 <mdstrauss91@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: mikey strauss <mdstrauss91@gmail.com>
 2024-02-07 08:24:02 -05:00
anchore-actions-token-generator[bot]andspiffcs 00d6269e3c chore(deps): update tools to latest versions (#2595) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>
 2024-02-06 10:48:01 -05:00
dependabot[bot] 0bc5971085 chore(deps): bump actions/upload-artifact from 4.3.0 to 4.3.1 (#2597) 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.3.0 to 4.3.1.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/26f96dfa697d77e81fd5907df203aa23a56210a8...5d5d22a31266ced268874388b861e4b58bb5c2f3)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-02-06 10:44:51 -05:00
anchore-actions-token-generator[bot]andkzantow 91d7a8a992 chore(deps): update stereoscope to bfa15e446f061bda7f68305d2d6240b053f17e0c (#2589) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com>
 2024-02-05 10:27:12 -05:00
dependabot[bot] 05fa8ba4e9 chore(deps): bump actions/cache from 3.3.2 to 4.0.0 (#2592) 
Bumps [actions/cache](https://github.com/actions/cache) from 3.3.2 to 4.0.0.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v3.3.2...13aacd865c20de90d75de3b17ebe84f7a17d57d2)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-02-05 10:26:55 -05:00
dependabot[bot] e813a427b9 chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.0 to 0.5.2 (#2591) 
Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps) from 0.5.0 to 0.5.2.
- [Release notes](https://github.com/gkampitakis/go-snaps/releases)
- [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.5.0...v0.5.2)

---
updated-dependencies:
- dependency-name: github.com/gkampitakis/go-snaps
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-02-05 10:26:39 -05:00
dependabot[bot] 0618b2cb35 chore(deps): bump github/codeql-action from 3.23.2 to 3.24.0 (#2593) 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.23.2 to 3.24.0.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/b7bf0a3ed3ecfa44160715d7c442788f65f0f923...e8893c57a1f3a2b659b6b55564fdfdbbd2982911)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-02-05 09:46:22 -05:00
Alex Goodman fd3844853a labeler should ignore latest version (#2588) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-02 18:08:15 -05:00
William Murphy b735106848 chore: copy latest schema to stable path for easier diff (#2586) 
Because we generate a new JSON schema file every time the schema version
changes, the git diff always shows that the file is completely new.
Therefore, every time the file is re-generated, also write the schema to
a stable path, so that the actual changes to the schema are easily
visible in the git diff of the latest schema file.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2024-02-02 17:09:28 -05:00
Asi GreenholtsandAlex Goodman 98de2e2f62 Adding metadata fields when parsing yarn.lock and poetry.lock (#2350) 
* Adding the resolved and integrity fields of yarn.lock to the parsed metadata. This addition is similar to the metadata added when parsing package-lock.json.

Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com>

* fix comment

Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com>

* Adding the Index field to metadeta when parsing poetry.lock similarly to the existing Pipfile metadata

Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com>

* fixing struct accoding to tests

Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com>

* remove old schema change

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove empty constants

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* re-generate JSON schema

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update document ref

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix linting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-02 19:53:42 +00:00
Laurent GoderreandAlex Goodman d7b9cc70b0 Add Erlang OTP Application cataloger (#2403) 
* Add cataloger for Erlang OTP applications

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>

* Add OTP Package type and Purl for ErLang

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>

* remove erlang OTP metadata type

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* use OTP purl type

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* restore otp fixture and adjust tests for dir-only results

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-02 13:40:18 -05:00
Alex Goodman 3023a5a7bc Detect ELF security features (#2443) 
* add detection of ELF security features

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix linting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update json schema with file executable data

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update expected fixure when no tty present

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* more detailed differ

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* use json differ

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove json schema addition

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* regenerate json schema

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix mimtype set ref

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-02 16:51:18 +00:00
Alex Goodman 3da679066e Add API examples (#2517) 
* [wip] initial syft api examples

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* smooth over some rough edges in the API

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* embed example file

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address review comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* change name of builder function

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-02 16:26:44 +00:00
William Murphy b7a6d5e946 feat: Record where CPEs come from (#2552) 
Syft can get CPEs from several source, including generating them based on
package data, finding them in the NVD CPE dictionary, or finding them declared
in a manifest or existing SBOM. Record where Syft got CPEs so that consumers of
SBOMs can reason about how trustworthy they are.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2024-02-02 16:17:52 +00:00
anchore-actions-token-generator[bot]andkzantow 4fe50f4169 chore(deps): update stereoscope to 37291e81936d2b43b3cef56667a741ef715fbfe4 (#2583) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com>
 2024-02-02 10:27:26 -05:00
dependabot[bot] 78d362f91a chore(deps): bump github.com/charmbracelet/bubbles from 0.17.1 to 0.18.0 (#2584) 
Bumps [github.com/charmbracelet/bubbles](https://github.com/charmbracelet/bubbles) from 0.17.1 to 0.18.0.
- [Release notes](https://github.com/charmbracelet/bubbles/releases)
- [Commits](https://github.com/charmbracelet/bubbles/compare/v0.17.1...v0.18.0)

---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbles
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-02-02 10:27:09 -05:00
Alex Goodman 5a9b664fef swap format readseekers for readers (#2581) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-01 14:18:13 -05:00
Alex Goodman 6107e5e2ad translate maps to sequences in pkg metadata (#2553) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-01 11:58:10 -05:00
anchore-actions-token-generator[bot]andspiffcs fef0e54c0f chore(deps): update tools to latest versions (#2576) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>
 2024-02-01 10:27:01 -05:00
dependabot[bot] 4a98f9fbd3 chore(deps): bump anchore/sbom-action from 0.15.7 to 0.15.8 (#2578) 
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.15.7 to 0.15.8.
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Commits](https://github.com/anchore/sbom-action/compare/767b08fd8822486ad890abb8f1d31721bebd651c...b6a39da80722a2cb0ef5d197531764a89b5d48c3)

---
updated-dependencies:
- dependency-name: anchore/sbom-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-02-01 10:26:47 -05:00
dependabot[bot] db49c145f0 chore(deps): bump marocchino/sticky-pull-request-comment (#2579) 
Bumps [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment) from 2.8.0 to 2.9.0.
- [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases)
- [Commits](https://github.com/marocchino/sticky-pull-request-comment/compare/efaaab3fd41a9c3de579aba759d2552635e590fd...331f8f5b4215f0445d3c07b4967662a32a2d3e31)

---
updated-dependencies:
- dependency-name: marocchino/sticky-pull-request-comment
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-02-01 10:26:37 -05:00
dependabot[bot] 3ac7e43e3e chore(deps): bump github.com/docker/docker (#2580) 
Bumps [github.com/docker/docker](https://github.com/docker/docker) from 25.0.1+incompatible to 25.0.2+incompatible.
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](https://github.com/docker/docker/compare/v25.0.1...v25.0.2)

---
updated-dependencies:
- dependency-name: github.com/docker/docker
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-02-01 10:26:25 -05:00
anchore-actions-token-generator[bot]andkzantow 216e211dc8 chore(deps): update stereoscope to db7a4bedaba6ad93becf22ce794f306dfb07fcb9 (#2577) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com>
 2024-02-01 08:32:13 +00:00
William MurphyandAlex Goodman bbddac1f9d Fix attest with --key (#2551) 
Fix passing "--key" to the attest command. Additionally, pull in an update to
the clio CLI library to permit unit testing that flags and env vars are parsed
to the correct field on command options structs. This testing strategy was
needed here because testing attestation in an end to end test requires a
prohibitive amount of setup.

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Will Murphy <will.murphy@anchore.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-01-31 16:39:17 -05:00
Weston Steimel 3893f80052 fix(java): improve identification for org.apache.kafka artifacts (#2573) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2024-01-31 16:34:56 -05:00
Christopher Angelo Phillips 630e7153e6 chore: pluralize the flag (#2564) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2024-01-31 13:21:09 -05:00
anchore-actions-token-generator[bot]andspiffcs 28e9ee7106 chore(deps): update tools to latest versions (#2566) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>
 2024-01-31 13:20:34 -05:00
dependabot[bot] 43837f47f5 chore(deps): bump peter-evans/create-pull-request from 5.0.2 to 6.0.0 (#2567) 
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 5.0.2 to 6.0.0.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](https://github.com/peter-evans/create-pull-request/compare/153407881ec5c347639a548ade7d8ad1d6740e38...b1ddad2c994a25fbc81a28b3ec0e368bb2021c50)

---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-01-31 13:20:17 -05:00
dependabot[bot] e880e6dcd6 chore(deps): bump anchore/sbom-action from 0.15.6 to 0.15.7 (#2568) 
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.15.6 to 0.15.7.
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Commits](https://github.com/anchore/sbom-action/compare/c6aed38a4323b393d05372c58a74c39ae8386d02...767b08fd8822486ad890abb8f1d31721bebd651c)

---
updated-dependencies:
- dependency-name: anchore/sbom-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-01-31 13:19:50 -05:00
Alex Goodman 6ae5b2904d re-add cosign signing checksums file (#2572) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-01-31 13:19:41 -05:00
Alex Goodman 377538e4a6 revert cosign signing of release checksums file (#2571) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
v0.103.1 		2024-01-31 16:58:24 +00:00
Alex Goodman bbe7fa180a bump archiver and stereoscope (#2570) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
v0.103.0 		2024-01-31 11:24:33 -05:00
William Murphy 31e0fc36e3 fix: Better test for group ID in filename (#2565) 
This fixes an issue where filenames containing a period that aren't a
group ID, such as some-jar.12.jar, would be mistakenly be reported as
having the name "12" by syft, instead of the name "some-jar.12".

It works by testing whether the parts of the filename split on "."
are all valid Java identifiers.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2024-01-31 08:21:33 -05:00
Alex Goodman aa702a72b4 Sign checksums file and add SBOMs on release (#2548) 
* with release signature of checksums file
* attach SBOMs to the release
* update acceptance tests
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-01-30 13:16:40 -05:00
dependabot[bot] b113391638 chore(deps): bump anchore/sbom-action from 0.15.5 to 0.15.6 (#2560) 
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.15.5 to 0.15.6.
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Commits](https://github.com/anchore/sbom-action/compare/24b0d5238516480139aa8bc6f92eeb7b54a9eb0a...c6aed38a4323b393d05372c58a74c39ae8386d02)

---
updated-dependencies:
- dependency-name: anchore/sbom-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-01-30 13:15:22 -05:00
dependabot[bot] d4f31d6a3e chore(deps): bump github.com/google/go-containerregistry (#2561) 
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.18.0 to 0.19.0.
- [Release notes](https://github.com/google/go-containerregistry/releases)
- [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml)
- [Commits](https://github.com/google/go-containerregistry/compare/v0.18.0...v0.19.0)

---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-01-30 13:15:13 -05:00
dependabot[bot] bd4bcc4e89 chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.5.3 to 6.5.4 (#2562) 
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty) from 6.5.3 to 6.5.4.
- [Release notes](https://github.com/jedib0t/go-pretty/releases)
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.5.3...v6.5.4)

---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-01-30 13:15:06 -05:00
anchore-actions-token-generator[bot]andspiffcs cf48c3a0c9 chore(deps): update tools to latest versions (#2554) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>
 2024-01-29 12:32:53 -05:00
dependabot[bot] b4f565a620 chore(deps): bump github.com/sassoftware/go-rpmutils from 0.2.0 to 0.3.0 (#2556) 
Bumps [github.com/sassoftware/go-rpmutils](https://github.com/sassoftware/go-rpmutils) from 0.2.0 to 0.3.0.
- [Release notes](https://github.com/sassoftware/go-rpmutils/releases)
- [Commits](https://github.com/sassoftware/go-rpmutils/compare/v0.2.0...v0.3.0)

---
updated-dependencies:
- dependency-name: github.com/sassoftware/go-rpmutils
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-01-29 12:32:37 -05:00