oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-02 07:26:34 +01:00
Code Issues Packages Projects Releases Wiki Activity
1,840 Commits 65 Branches 273 Tags
873f6e403760c3ae95794285f2419a70005367fd
Commit Graph
808 Commits
Author SHA1 Message Date
Laurent Goderre 873f6e4037 Added classifier for wordpress cli binary 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2024-01-15 17:40:26 -05:00
anchore-actions-token-generator[bot]andwagoodman 0748413d6b chore(deps): update CPE dictionary index (#2491) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
 2024-01-15 05:56:34 +00:00
Alex Goodman b0ab75fd89 Replace core SBOM-creation API with builder pattern (#1383) 
* remove existing cataloging API

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add file cataloging config

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add package cataloging config

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add configs for cross-cutting concerns

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* rename CLI option configs to not require import aliases later

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update all nested structs for the Catalog struct

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update Catalog cli options

- add new cataloger selection options (selection and default)
- remove the excludeBinaryOverlapByOwnership
- deprecate "catalogers" flag
- add new javascript configuration

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* migrate relationship capabilities to separate internal package

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* refactor golang cataloger to use configuration options when creating packages

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* create internal object to facilitate reading from and writing to an SBOM

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* create a command-like object (task) to facilitate partial SBOM creation

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add cataloger selection capability

- be able to parse string expressions into a set of resolved actions against sets
- be able to use expressions to select/add/remove tasks to/from the final set of tasks to run

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add package, file, and environment related tasks

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update existing file catalogers to use nested UI elements

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add CreateSBOMConfig that drives the SBOM creation process

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* capture SBOM creation info as a struct

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add CreateSBOM() function

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update docs with SBOM selection help + breaking changes

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix multiple override default inputs

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix deprecation flag printing to stdout

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* refactor cataloger selection description to separate object

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address review comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* keep expression errors and show specific suggestions only

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address additional review feedback

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address more review comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* addressed additional PR review feedback

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix file selection references

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove guess language data generation option

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add tests for coordinatesForSelection

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* rename relationship attributes

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add descriptions to relationships config fields

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* improve documentation around configuration options

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add explicit errors around legacy config entries

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-01-12 17:39:13 -05:00
Andrew Garner 29c9857857 feat: binary classifiers for Percona Software For MySQL (#2478) 
Signed-off-by: Andrew Garner <garnera@vmware.com>
 2024-01-10 16:06:14 +00:00
Laurent Goderre d1e4ecba42 feat: binary classifier for pypy (#2474) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2024-01-10 10:59:25 -05:00
Laurent Goderre fecfb2f939 fix: support traefik binary from the official Docker image (#2484) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2024-01-10 15:57:32 +00:00
Laurent Goderre e61aac0b53 feat: binary classifier for GCC (#2479) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2024-01-10 10:50:38 -05:00
Christopher Angelo PhillipsandAlex Goodman 7182f5b519 Upgrade binary test fixtures management (#2444) 
* test: strip fixtures of any execution permissions

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* chore: add lint check for large files

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* add helper script to capture binary snippets

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* chore: update scripts and add new dir output for snippets

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: update erlang test to new generated format

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: update memcached to new generator pattern

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: update openjdk to named version

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: move openjdk lts to versioned folder

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: rename unversioned java to versioned folders

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: migrate bash fixture to new snippet workflow

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: update script to size 600 bytes

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: update go classifier to new snippet workflow

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: move haproxy new new snippet

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: add flatter haproxy example

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: update tests to new pattern

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: final version of snippet script

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* [wip] download bin helpers

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add manager for binary cataloger test fixtures

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add remaining binary cataloger patterns and snippets

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* adjust gitignore to be more permissive to snippets

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add rust darwin snippets

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* skip tests that are missing full binaries

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address PR feedback

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add tests for binary test fixture manager

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* highlight rows that do not have binaries or snippets

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* bump fixture limit to 1K (found exceptions when adding snippets)

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add redis and postgres snippets

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* improve formating of fixture listing

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-01-05 21:40:03 +00:00
Laurent GoderreandAlex Goodman a16a4ad6c9 Add ability to extend the binaries cataloguers (#2469) 
* Add ability to extend the binaries cataloguers

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>

* restrict binary classifier package attributes

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-01-05 15:32:07 -05:00
Laurent Goderre bf39456fbc fix: add missing purl for busybox (#2457) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2024-01-04 14:51:56 -05:00
Laurent Goderre c72d295719 Fix diff error obfuscating binary test failures message (#2468) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2024-01-04 12:54:52 -05:00
Alex Goodman 4c20a74d2f Replace packages command with scan (#2446) 
* replace packages command with scan

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add tests for packages alias

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update comments with referenes to the packages command

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* rename valiadte args function

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-01-04 16:56:57 +00:00
William Murphy 7c67df397e fix: PURLs with "nuget" type are dotnet packages (#2466) 
Otherwise, Grype won't match on well-formed .NET purls from other SBOM
tools.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2024-01-03 16:50:42 -05:00
anchore-actions-token-generator[bot]andwagoodman 8ea2425c97 chore(deps): update CPE dictionary index (#2458) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
 2024-01-02 06:12:32 -05:00
Christopher Angelo Phillips 2a04e06cbc chore: update binary to -x (#2456) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-12-22 09:50:32 -05:00
Laurent Goderre 3a6b6562d1 Add more functionality to the ErLang parser (#2390) 
* ERLang parser support for empty lists
* ERLang add support for single quote strings
* ERLang parser support for comments
---------
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2023-12-22 09:45:20 -05:00
Laurent GoderreandChristopher Phillips 63e7a004cb Added OpenSSL binary matcher (#2416) 
* Added OpenSSL binary matcher

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>

* chore: strip binary to smaller detection

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

---------

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-12-22 09:37:09 -05:00
Christopher Angelo Phillips 3cffa0b7fd chore: remove execute from test fixtures (#2450) 
* chore: remove execute from test fixtures

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* chore: add back ignored file

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-12-20 22:34:29 +00:00
William Murphyandhoudini91 4aa2d8c0af fix: don't panic when hackage missing in haskell stack yaml lock (#2448) 
Fixes a bug where previously the haskell cataloger would panic
when parsing a stack.yaml.lock file that had an entry with an empty
hackage string.

Signed-off-by: houdini91 <mdstrauss91@gmail.com>
Signed-off-by: Will Murphy <will.murphy@anchore.com>
Co-authored-by: houdini91 <mdstrauss91@gmail.com>
 2023-12-20 10:57:06 -05:00
Laurent Goderre a635d66657 Add binary classifier for the ERLang interpretter (#2417) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2023-12-18 15:00:49 -05:00
Laurent Goderre 51d3cd0066 Add binary classifier for Julia lang (#2427) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2023-12-18 15:00:21 -05:00
Laurent Goderre 4846639ee4 Add binary detection for PHP composer (#2432) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2023-12-18 14:59:45 -05:00
anchore-actions-token-generator[bot]andwagoodman 8b9194eb81 chore(deps): update CPE dictionary index (#2442) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
 2023-12-18 07:01:21 -05:00
Alex Goodman f4dd36ca9d fix syft-json test to use pretty json for snapshot testing (#2441) 
without this fix, capturing fixtures will result in hard-to-read
failures in testing.

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-12-15 17:23:21 -05:00
Alex Goodman 17c605822e refactor pkg.Collection (#2439) 
- remove "catalog" references
- add a separate add() function for readability

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-12-15 17:11:11 -05:00
Alex Goodman 4eace4b141 refactor javascript cataloger to use configuration options when creating packages (#2438) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-12-15 17:11:02 -05:00
Alex Goodman 05660da8d7 use single source of truth for archive options (#2437) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-12-15 17:07:55 -05:00
Alex Goodman 2f378d806e fix file digest cataloger when passed coordinates (#2436) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-12-15 14:43:09 -05:00
dependabot[bot] b83cc8485a chore(deps): bump github.com/CycloneDX/cyclonedx-go from 0.7.2 to 0.8.0 (#2413) 2023-12-14 17:18:37 -05:00
Colm O hEigeartaigh 38a12bd91a Look for a maven version in a pom from a parent dependency management section (#2423) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-12-14 13:15:14 -05:00
Colm O hEigeartaigh 649d152548 Parse Python licenses from LicenseExpression entry in the Wheel Metadata (#2431) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-12-14 12:41:41 -05:00
Colm O hEigeartaigh d39ef44e40 Parse Python licenses from LicenseFile entry in the Wheel Metadata (#2331) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-12-13 17:46:56 -05:00
Wayne Starr 8bca0ac39e fix: use filepath instead of path for file source exclusions (#2411) 
Signed-off-by: Wayne Starr <me@racer159.com>
 2023-12-13 17:45:34 -05:00
Colm O hEigeartaigh e789e0714d feat: add the option to retrieve remote licenses for projects defined in a maven pom (#2409) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-12-12 14:02:36 -05:00
anchore-actions-token-generator[bot]andwagoodman 68f35815d6 chore(deps): update CPE dictionary index (#2412) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
 2023-12-11 06:35:58 -05:00
Weston Steimel 4d4b502174 fix(java): improve identification for org.codehaus.groovy artifacts (#2404) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-08 05:02:01 -05:00
Weston Steimel ea80f94c0e fix(java): improve identification for commons-jelly artifacts (#2399) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-07 12:28:21 -05:00
Weston Steimel 2c145f70b2 fix(java): improve identification for io.minio artifacts (#2398) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-06 16:58:07 -05:00
Weston Steimel bcc7e90fcc fix(java): improve identification for com.graphql-java artifacts (#2397) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-06 18:04:43 +00:00
Colm O hEigeartaighandChristopher Phillips 16dee41b4b feat: add ability to retrieve remote licenses for yarn.lock (#2338) 
---------

Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-12-05 13:38:28 -05:00
Colm O hEigeartaigh 3ba9df4ff3 Retrieve remote licenses using pom.properties when there is no pom.xml (#2315) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-12-05 09:47:40 -05:00
Weston Steimel bbf223b2c9 fix(java): improve identification for org.apache.tapestry artifacts (#2384) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-04 11:23:40 -05:00
Weston Steimel b126276f97 fix(java): improve identification for io.ratpack artifacts (#2379) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-04 11:23:26 -05:00
Weston Steimel 40d766a257 fix(java): improve identification for org.apache.cassandra artifacts (#2386) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-01 10:51:14 -05:00
Weston Steimel 814960f65a fix(java): improve identification for org.neo4j.procedure artifacts (#2388) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-01 10:50:24 -05:00
Weston Steimel 11039f4b4e fix(java): improve identification for org.elasticsearch artifacts (#2383) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-01 09:22:33 -05:00
Weston Steimel 413ffdb233 fix(java): improve identification for org.apache.geode artifacts (#2382) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-01 12:48:15 +00:00
Weston Steimel e53fe51612 fix(java): improve identification for org.apache.tomcat.embed artifacts (#2381) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-01 07:13:13 -05:00
Weston Steimel facbc486a8 fix(java): improve identification for io.projectreactor.netty artifacts (#2378) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-01 07:09:06 -05:00
Weston Steimel 5d42a349e6 fix(java): improve identification for org.eclipse.platform artifacts (#2349) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-11-30 16:02:03 -05:00