oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-04 08:26:38 +01:00
Code Issues Packages Projects Releases Wiki Activity
1,840 Commits 66 Branches 274 Tags
873f6e403760c3ae95794285f2419a70005367fd
Commit Graph
808 Commits
Author SHA1 Message Date
Alex Goodman 4adfbeb5f0 Generalize UI events for cataloging tasks (#2369) 
* generalize ui events for cataloging tasks

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* moderate review comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* incorporate review comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* rename cataloger task progress object

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* migrate cataloger task fn to bus helper

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-30 16:25:50 +00:00
Laurent Goderre 06b9a79e3d chore: fix tests failing due to Mac Rosetta cache (#2374) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2023-11-29 18:39:28 +00:00
Keith Zantow ef5c1651ef fix: improve dotnet portable executable identification (#2133) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-11-29 12:51:24 -05:00
Alex Goodman 5c8dd4c3a7 fix file metadata cataloger to use resolved locations (#2370) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-29 09:42:34 -05:00
Keith Zantow f5a6b5a02f fix: logging level for parsing potential PE files (#2367) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-11-29 03:42:22 +00:00
William Murphy ea4a6747eb fix: hardcode xalan group ID (#2368) 
According to maven central, the package called "xalan" should just have
the group ID xalan, but currently syft isn't able to find that.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2023-11-28 14:40:03 -05:00
Alex Goodman 1cfc4c7387 Normalize cataloger configuration patterns (#2365) 
* normalize cataloger patterns

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove central reference for maven configurable

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-28 17:02:43 +00:00
Alex Goodman 4d0da703bf normalize enums to lowercase with hyphens (#2363) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-28 11:02:20 -05:00
William Murphy ce4b31757a fix: index file itself when file scan path has symlink (#2359) 
Previously, building the index of the filesystem when source was file
would fail if part of the path syft was passed to the file included a
symlinked directory, resulting in cataloging misses.

---------

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2023-11-28 09:41:28 -05:00
Alex Goodman 8ee209a5ae use read lock in pkg collection (#2341) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-21 13:48:25 -05:00
Weston Steimel ebeb768f59 fix: add manual namespace mapping for org.springframework jars (#2345) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-11-21 18:28:10 +00:00
Duane MayandAlex Goodman d4733fac1d Add binary classifiers for MySQL and MariaDB (#2316) 
* Add MySQL and MariaDB binary classifiers

Signed-off-by: Duane May <duanemay@gmail.com>
Signed-off-by: Duane May <mduane@vmware.com>

* use smallest possible binary fixtures

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Duane May <duanemay@gmail.com>
Signed-off-by: Duane May <mduane@vmware.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-21 16:54:41 +00:00
David Dooling 34774a0e10 Enhance redis binary classifier (#2329) 
Allow existing matcher to match host identifiers longer than 12
characters. The binaries distributed by redis have the version before
payload, so add a matcher for that. Add test fixtures covering these
scenarios.

Signed-off-by: David Dooling <david.dooling@docker.com>
 2023-11-21 16:24:59 +00:00
Weston Steimel 9d766c0325 fix: add manual namespace mapping for org.springframework.security jars (#2343) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-11-21 13:46:34 +00:00
Weston Steimel 5751b43608 fix: add manual namespace mapping for org.bouncycastle jars (#2342) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-11-21 08:17:07 -05:00
Alex Goodman 5565bdef0c Remove the power-user command and related catalogers (#2306) 
* remove the power-user command

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove secrets + classifier catalogers

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* bump json schema

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* regenerate json schema

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-20 15:44:28 +00:00
Alex Goodman 1676934c63 Add "pretty" json configuration and change default behavior to be space-efficient (#2275) 
* expose underlying format options

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove escape html options and address PR feedback

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* incorporate PR feedback

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix cli test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-20 15:29:34 +00:00
Alex Goodman 11a8cde8e4 export metadata type helper (#2328) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-15 19:05:18 +00:00
Weston Steimel dcd062cffb fix(java): add manual groupid mappings for org.apache.velocity jars (#2327) 
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2023-11-15 17:44:36 +00:00
Weston Steimel b9294976ef fix(java): skip maven bundle plugin logic if vendor id and symbolic name match (#2326) 
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2023-11-15 17:44:15 +00:00
Colm O hEigeartaigh 3e8a2304e8 Refine license searching from groupIDFromJavaMetadata to allow for having the artfactId in the groupId (#2313) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-11-15 10:04:31 -05:00
Colm O hEigeartaigh 0652998b9b Add license for golang stdlib (#2317) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-11-14 11:53:07 -05:00
Colm O hEigeartaigh 7ccbadff34 Fall back to searching maven central using groupIDFromJavaMetadata (#2295) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-11-10 22:02:53 -05:00
Alex Goodman 3f13d209a5 rename file.Location.VirtualPath to AccessPath (#2288) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-09 11:30:08 -06:00
Benji VisserandAlex Goodman 0891d35e07 include image labels in cycloneDX SBOM (#2294) 
* include image labels in SBOM

Signed-off-by: Benji Visser <benji@093b.org>

* update tests

Signed-off-by: Benji Visser <benji@093b.org>

* gocritic

Signed-off-by: Benji Visser <benji@093b.org>

* add properties

Signed-off-by: Benji Visser <benji@093b.org>

* add decoder

Signed-off-by: Benji Visser <benji@093b.org>

* update golden snapshots

Signed-off-by: Benji Visser <benji@093b.org>

* decodeProperties

Signed-off-by: Benji Visser <benji@093b.org>

* add test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove the snapshot test changes

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* restore snapshots

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Benji Visser <benji@093b.org>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-08 23:13:04 +00:00
Alex Goodman 502971a1b2 Add accessPath on Location objects to syft-json output (#2287) 
* add accessPath on Location objects to syft-json output

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* generate json schema v12.0.1

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-08 17:05:30 -06:00
Colm O hEigeartaighandAlex Goodman dc14dbb326 SPDX file has duplicate sha256 tag in versionInfo (#2300) 
* SPDX file has duplicate sha256 tag in versionInfo

Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>

* add tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-08 22:49:31 +00:00
Colm O hEigeartaigh bae5a2e741 Check maven central as well for licenses in parents poms for nested jars (#2302) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-11-08 10:26:12 -08:00
Keith Zantow d91c2dd842 fix: identify cyclone-json without $schema (#2303) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-11-08 11:54:22 -05:00
anchore-actions-token-generator[bot]andwagoodman 4ba92ac43b chore(deps): update CPE dictionary index (#2290) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
 2023-11-06 09:23:24 -05:00
Colm O hEigeartaigh 9fa11f2339 Wire though maven-url to java config (#2291) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-11-06 09:08:03 -05:00
Mark Severson 1470abaded Use case-insensitive matching for Go license files (#2286) 
Signed-off-by: Mark Severson <mark@kasten.io>
 2023-11-03 14:47:09 -04:00
Colm O hEigeartaighandChristopher Phillips 2d582f78a1 Add a new Java configuration option to recursively search parent poms… (#2274) 
- Add a new Java configuration option to recursively search parent poms for licenses
---------
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-11-03 10:33:02 -04:00
Alex Goodman b2f4d7eda2 Follow convention for naming catalogers (#2277) 
* follow convention for naming catalogers

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix cataloger name example

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-02 12:39:42 +00:00
Alex Goodman 6c41f15975 change dir resolver to include virtual path (#2259) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-02 08:20:00 -04:00
Colm O hEigeartaighandChristopher Phillips 26cdbfc299 fix: syft does not handle the case of parsing a jar with multiple poms (#2231) 
---------

Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-11-01 17:10:17 +00:00
Robbie Vanbrabant dc9bc58480 add PURLs when scanning Gradle lock files (#2278) 
This adds PURLs when scanning Gradle lock files.

Unintuitively the correct PURL type appears to be `maven` as opposed to
`gradle`. See https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst

- `gradle` for Gradle plugins
- `maven` for Maven JARs and related artifacts

Signed-off-by: Robbie Vanbrabant <robbie@monzo.com>
 2023-11-01 13:09:31 -04:00
Christopher Angelo Phillips ee4e69285a test: remove dll files and updates tests to use versionResources (#2276) 
* test: remove dll files and updates tests to use versionResources

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: update integration tests with dot net coverage

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* chore: move test cases to appropriate blocks

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* fix: chmod only the dll

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* fix: add primary annotation key to packages

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* chore: bump number of packages with new dotnet package

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-10-31 15:33:52 -04:00
Christopher Angelo Phillips 59c56a5666 fix: update dot net binary parsing logic to remove empty space (#2273) 
* fix: update parsing logic to remove empty space
* tests: update with test cases provided by community
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-10-31 10:43:29 -04:00
Colm O hEigeartaighandChristopher Phillips 78ac2f9797 Read a license from a parent pom stored in Maven Central (#2228) 
* Read a license from a parent pom stored in Maven Central
---------
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-10-30 17:48:16 -04:00
Alex Goodman 1aaa644007 Remove MetadataType from core package object and normalize JSON metadataType values (#1983) 
* [wip]

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* distinct the package metadata functions

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove metadata type from package core model

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* incorporate review feedback for names

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add RPM archive metadata and split parser helpers

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* clarify the python package metadata type

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* rename the KB metadata type

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* break hackage and composer types by use case

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* linting fix

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix encoding and decoding for syft-json and cyclonedx

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* bump json schema to 11

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update cyclonedx-json snapshots

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update cyclonedx-xml snapshots

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update spdx-json snapshots

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update spdx-tv snapshots

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update syft-json snapshots

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* correct metadata type in stack yaml parser test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix bom-ref redactor for cyclonedx-xml

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add tests for legacy package metadata names

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* regenerate json schema v11

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix legacy HackageMetadataType reflect type value check

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix linting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* packagemetadata discovery should account for type shadowing

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix linting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix cli tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* bump json schema version to v12

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update json schema to incorporate changes from main

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add syft-json legacy config option

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add tests around v11-v12 json decoding

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add docs for SYFT_JSON_LEGACY

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* rename structs to be compliant with new naming scheme

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-10-30 12:12:04 -04:00
anchore-actions-token-generator[bot]Will Murphywillmurphyscode
 		629aafc323 chore(deps): update CPE dictionary index (#2271) 
* chore(deps): update CPE dictionary index

Signed-off-by: GitHub <noreply@github.com>

---------

Signed-off-by: Will Murphy <will.murphy@anchore.com>
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: Will Murphy <will.murphy@anchore.com>
Co-authored-by: willmurphyscode <willmurphyscode@users.noreply.github.com>
 2023-10-30 09:48:03 -04:00
Colm O hEigeartaigh 1daf18fee9 feat: Perform case insensitive matching on Java license files (#2235) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-10-25 09:51:59 -04:00
Alex Goodman 7392d607b6 Split the sbom.Format interface by encode and decode use cases (#2186) 
* split up sbom.Format into encode and decode ops

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update cmd pkg to inject format configs

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* bump cyclonedx schema to 1.5

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* redact image metadata from github encoder tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add more testing around format decoder identify

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add test case for format version options

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix cli tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix CLI test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* [wip] - review comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* keep encoder creation out of post load function

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* keep decider and identify functions

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add a few more doc comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove format encoder default function helpers

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address PR feedback

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* move back to streaming based decode functions

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* with common convention for encoder constructors

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix tests and allow for encoders to be created from cli options

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix cli tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix linting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* buffer reads from stdin to support seeking

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-10-25 13:43:06 +00:00
Christopher Angelo Phillips cd530924d0 fix: 2179 jar chokes empty lines (#2254) 
---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-10-24 14:03:47 -04:00
anchore-actions-token-generator[bot]andAlex Goodman 73d5852119 chore(deps): update CPE dictionary index (#2253) 
* fix CPE workflow

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* chore(deps): update CPE dictionary index

Signed-off-by: GitHub <noreply@github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-10-24 13:22:02 -04:00
Stefan Profanter 234ce4e1f3 feat: add conaninfo.txt parser to detect conan packages in docker images (#2234) 
* feat: add conaninfo.txt parser to detect conan packages in docker images

Signed-off-by: Stefan Profanter <stefan.profanter@agile-robots.com>

* fix: add NewConanInfoCataloger as a separate cataloger

Signed-off-by: Stefan Profanter <stefan.profanter@agile-robots.com>

---------

Signed-off-by: Stefan Profanter <stefan.profanter@agile-robots.com>
 2023-10-23 16:17:50 -04:00
Chao LiandWill Murphy 671ff39933 Add ruby.NewGemSpecCataloger to DirectoryCatalogers. (#1971) 
* Add ruby.NewGemSpecCataloger to DirectoryCatalogers.

Signed-off-by: Evan <chaol@vmware.com>

* fixed tests

Signed-off-by: Evan <chaol@vmware.com>

* Addressed review comment

Signed-off-by: Evan <chaol@vmware.com>

* Remove NewInstalledGemSpecCataloger from default dir catalogers

Because the files that the installed gemspec cataloger work off of are a
subset of the files that the more general gemspec cataloger will work
off of, we shouldn't have both of them on by default, since this could
result in finding the same package twice.

Signed-off-by: Will Murphy <will.murphy@anchore.com>

---------

Signed-off-by: Evan <chaol@vmware.com>
Signed-off-by: Will Murphy <will.murphy@anchore.com>
Co-authored-by: Will Murphy <will.murphy@anchore.com>
 2023-10-23 08:49:57 -04:00
Christopher Angelo PhillipsandAuston-Zhang ef43294d0e Add download location when cataloging directory npm package lock (#2238) 
* added download locatoin (resolved) when cataloging a directory - javascript ecosystem- npm - packag-lock
	Signed-off by Auston(Aoxiang) Zhang <auston.zhang@dal.ca>

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* chore: get DCO to fire

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: Auston-Zhang <ax706429@dal.ca>
 2023-10-20 11:40:38 -04:00
Christopher Angelo Phillips e1ad340c2d fix: allow packages to be captured from DIST/EGG case (#2239) 
* fix: allow packages to be captured from DIST/EGG case

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: update expected glob paths

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-10-20 11:29:13 -04:00