oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-31 06:26:30 +01:00
Code Issues Packages Projects Releases Wiki Activity
2,285 Commits 65 Branches 273 Tags
95b4a88256bddebb91831250f28f602f8c36552a
Commit Graph
110 Commits
Author SHA1 Message Date
Weston Steimel df1e5b57fe fix: improve groupid extraction for Jenkins plugins (#2815) 
* fix: improve groupid extraction for Jenkins plugins

Consider the `Group-Id` java manifest property as this is typically set
for Jenkins plugins if there is no pom file

Signed-off-by: Weston Steimel <commits@weston.slmail.me>

* test: update java purl integration test image

Signed-off-by: Weston Steimel <commits@weston.slmail.me>

---------

Signed-off-by: Weston Steimel <commits@weston.slmail.me>
 2024-08-12 13:01:44 -04:00
GGMU 91cf066db6 support .kar files (#3113) 
* add kar

Signed-off-by: tomersein <tomersein@gmail.com>
 2024-08-12 12:10:03 -04:00
Gijs CalisandKeith Zantow 9d40d1152e feat: improved java maven property resolution (#2769) 
Signed-off-by: Gijs Calis <51088038+GijsCalis@users.noreply.github.com>
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
 2024-08-05 11:30:47 -04:00
Dor Hayunanddor-hayun 48f1e975f0 fix: update 'guessMainPackageNameAndVersionFromPomInfo' and 'artifactIDMatchesFilename' (#3054) 
- Correct retrieval of package name when main POM file exists
- Address issue where wrong package name was retrieved for certain jars
- Example case: 'jansi' jar containing multiple jars like 'jansi-win32'
- Ensure true is returned when filename matches the artifact ID, prevent random retrieval by checking prefix and suffix
- Use fallback check with suffix and prefix if no POM properties file matches the exact artifact name

Signed-off-by: dor-hayun <dor.hayun@mend.io>
Co-authored-by: dor-hayun <dor.hayun@mend.io>
 2024-08-01 13:47:15 -04:00
Keith Zantow a4b5dcd0df fix: improve determinism in java archive identification (#3085) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-07-30 12:02:52 -04:00
William Murphy 3713d97b7b chore: use ruleguard to test for missing defer statements (#2837) 
* chore: ruleguard to enforce defer use

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* fix go.mod location

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* chore: defer close in linux release identifier

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* chore: better lint suggestion

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* chore: refactor binary classifier to defer close

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* chore: defer close readers in gentoo cataloger

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* chore: make go license parsing defer close readers

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* chore: defer closing readers in alpine apm parser

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* chore: defer close readers in graalvm parser

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* chore: defer close readers in debian package parser

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* chore: defer close readers in alpm parser

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* chore: defer close readers in executable file cataloger

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* chore: defer close readers in javascript license parser

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* chore: defer close readers in go mod parser

Signed-off-by: Will Murphy <will.murphy@anchore.com>

---------

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2024-05-07 05:42:29 -04:00
camcuiandChristopher Phillips 80d196a8c9 chore: fix function name in comment (#2771) 
Signed-off-by: camcui <cuishua@sina.cn>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2024-05-01 18:04:02 +00:00
Keith Zantow f7d3d552ce fix: exclude known instrumentation jars from being erroneously identified (#2796) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-04-22 15:03:17 -04:00
William Murphy 6440f26b5a fix: return empty string if dereferncing pom var fails (#2797) 
Previously, Syft would attempt to dereference pom variables, but if it
detected a cycle or failed to get back to a non-variable value, it would
return the last variable. Instead, return an empty string. Otherwise,
certain jars will have versions like "${project.version}" in the SBOM,
which is not helpful.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2024-04-19 19:38:36 +00:00
William Murphy 3e71f46fc8 Fix: repeatedly dereference pom variables (#2781) 
* Fix: repeatedly dereference pom variables

Previously, if there was more than one layer of variable indirection in
the pom property (propert A says it has the same value as property B,
property B says it has the same value as property C), then Syft would
only dereference one layer. Add a loop to dereference variables until
either dereferencing fails, or until the variable is completely
dereferenced back to a literal.

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* switch to recursive implementation

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* add test cases for degenerate poms

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* switch to recursive implementation

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* remove redundant pieces of test cases

Signed-off-by: Will Murphy <will.murphy@anchore.com>

---------

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2024-04-16 15:44:02 -04:00
anchore-actions-token-generator[bot]spiffcsChristopher Phillips
 		17ef243956 chore(deps): update tools to latest versions (#2616) 
* chore(deps): update tools to latest versions

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* fix: update to new linter rules

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

---------

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2024-02-14 14:59:49 +00:00
Alex Goodman 3023a5a7bc Detect ELF security features (#2443) 
* add detection of ELF security features

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix linting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update json schema with file executable data

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update expected fixure when no tty present

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* more detailed differ

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* use json differ

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove json schema addition

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* regenerate json schema

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix mimtype set ref

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-02 16:51:18 +00:00
William Murphy b7a6d5e946 feat: Record where CPEs come from (#2552) 
Syft can get CPEs from several source, including generating them based on
package data, finding them in the NVD CPE dictionary, or finding them declared
in a manifest or existing SBOM. Record where Syft got CPEs so that consumers of
SBOMs can reason about how trustworthy they are.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2024-02-02 16:17:52 +00:00
Alex Goodman 5a9b664fef swap format readseekers for readers (#2581) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-01 14:18:13 -05:00
Alex Goodman 6107e5e2ad translate maps to sequences in pkg metadata (#2553) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-01 11:58:10 -05:00
William Murphy 31e0fc36e3 fix: Better test for group ID in filename (#2565) 
This fixes an issue where filenames containing a period that aren't a
group ID, such as some-jar.12.jar, would be mistakenly be reported as
having the name "12" by syft, instead of the name "some-jar.12".

It works by testing whether the parts of the filename split on "."
are all valid Java identifiers.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2024-01-31 08:21:33 -05:00
Alex Goodman f893933336 internalize format helpers (#2543) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-01-26 12:16:26 -05:00
Alex Goodman b6cbf82389 Internalize CPE generation logic (#2541) 
* migrate CPE generation logic to internal

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove create function

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-01-26 12:16:05 -05:00
Alex Goodman 11c0b1c234 Unexport types and functions cataloger packages (#2530) 
* unexport as many types and functions from cataloger packages as possible

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* capture type and signature information in convention test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* check that we return pkg.Cataloger from constructors

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-01-24 16:12:46 -05:00
Alex Goodman cdad5e767a plumb context through catalogers (#2528) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-01-22 15:54:51 -05:00
Dan Luhring df582e8463 fix: minor cataloger and docs nits (#2519) 
Signed-off-by: Dan Luhring <dluhring@chainguard.dev>
 2024-01-19 17:29:47 -05:00
Alex Goodman 05660da8d7 use single source of truth for archive options (#2437) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-12-15 17:07:55 -05:00
Colm O hEigeartaigh 38a12bd91a Look for a maven version in a pom from a parent dependency management section (#2423) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-12-14 13:15:14 -05:00
Colm O hEigeartaigh e789e0714d feat: add the option to retrieve remote licenses for projects defined in a maven pom (#2409) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-12-12 14:02:36 -05:00
Colm O hEigeartaigh 3ba9df4ff3 Retrieve remote licenses using pom.properties when there is no pom.xml (#2315) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-12-05 09:47:40 -05:00
Weston Steimel 5d42a349e6 fix(java): improve identification for org.eclipse.platform artifacts (#2349) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-11-30 16:02:03 -05:00
Alex Goodman 1cfc4c7387 Normalize cataloger configuration patterns (#2365) 
* normalize cataloger patterns

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove central reference for maven configurable

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-28 17:02:43 +00:00
Weston Steimel b9294976ef fix(java): skip maven bundle plugin logic if vendor id and symbolic name match (#2326) 
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2023-11-15 17:44:15 +00:00
Colm O hEigeartaigh 3e8a2304e8 Refine license searching from groupIDFromJavaMetadata to allow for having the artfactId in the groupId (#2313) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-11-15 10:04:31 -05:00
Colm O hEigeartaigh 7ccbadff34 Fall back to searching maven central using groupIDFromJavaMetadata (#2295) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-11-10 22:02:53 -05:00
Alex Goodman 3f13d209a5 rename file.Location.VirtualPath to AccessPath (#2288) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-09 11:30:08 -06:00
Colm O hEigeartaigh bae5a2e741 Check maven central as well for licenses in parents poms for nested jars (#2302) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-11-08 10:26:12 -08:00
Colm O hEigeartaigh 9fa11f2339 Wire though maven-url to java config (#2291) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-11-06 09:08:03 -05:00
Colm O hEigeartaighandChristopher Phillips 2d582f78a1 Add a new Java configuration option to recursively search parent poms… (#2274) 
- Add a new Java configuration option to recursively search parent poms for licenses
---------
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-11-03 10:33:02 -04:00
Alex Goodman b2f4d7eda2 Follow convention for naming catalogers (#2277) 
* follow convention for naming catalogers

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix cataloger name example

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-02 12:39:42 +00:00
Colm O hEigeartaighandChristopher Phillips 26cdbfc299 fix: syft does not handle the case of parsing a jar with multiple poms (#2231) 
---------

Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-11-01 17:10:17 +00:00
Robbie Vanbrabant dc9bc58480 add PURLs when scanning Gradle lock files (#2278) 
This adds PURLs when scanning Gradle lock files.

Unintuitively the correct PURL type appears to be `maven` as opposed to
`gradle`. See https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst

- `gradle` for Gradle plugins
- `maven` for Maven JARs and related artifacts

Signed-off-by: Robbie Vanbrabant <robbie@monzo.com>
 2023-11-01 13:09:31 -04:00
Colm O hEigeartaighandChristopher Phillips 78ac2f9797 Read a license from a parent pom stored in Maven Central (#2228) 
* Read a license from a parent pom stored in Maven Central
---------
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-10-30 17:48:16 -04:00
Alex Goodman 1aaa644007 Remove MetadataType from core package object and normalize JSON metadataType values (#1983) 
* [wip]

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* distinct the package metadata functions

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove metadata type from package core model

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* incorporate review feedback for names

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add RPM archive metadata and split parser helpers

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* clarify the python package metadata type

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* rename the KB metadata type

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* break hackage and composer types by use case

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* linting fix

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix encoding and decoding for syft-json and cyclonedx

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* bump json schema to 11

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update cyclonedx-json snapshots

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update cyclonedx-xml snapshots

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update spdx-json snapshots

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update spdx-tv snapshots

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update syft-json snapshots

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* correct metadata type in stack yaml parser test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix bom-ref redactor for cyclonedx-xml

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add tests for legacy package metadata names

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* regenerate json schema v11

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix legacy HackageMetadataType reflect type value check

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix linting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* packagemetadata discovery should account for type shadowing

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix linting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix cli tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* bump json schema version to v12

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update json schema to incorporate changes from main

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add syft-json legacy config option

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add tests around v11-v12 json decoding

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add docs for SYFT_JSON_LEGACY

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* rename structs to be compliant with new naming scheme

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-10-30 12:12:04 -04:00
Colm O hEigeartaigh 1daf18fee9 feat: Perform case insensitive matching on Java license files (#2235) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-10-25 09:51:59 -04:00
Christopher Angelo Phillips cd530924d0 fix: 2179 jar chokes empty lines (#2254) 
---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-10-24 14:03:47 -04:00
Alex GoodmanChristopher Angelo PhillipsChristopher Phillips
 		07f13049da Account for maven bundle plugin and fix filename matching (#2220) 
* account for maven bundle plugin and fix filename matching

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add in-repo jar tests based on metadata to cover #2130

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* tests: fix test merge commit

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-10-19 17:57:23 -04:00
Alex Goodman 7018573bf7 Remove internal string set (#2219) 
* remove internal string set

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* incorporate changes from #2227

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* beef up the pkg.License.Merg() doc string

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-10-17 12:52:11 -04:00
Colm O hEigeartaigh 2687100e6a Detect a license file in the root directory or META-INF of a jar (#2213) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-10-12 11:09:53 -04:00
Colm O hEigeartaighChristopher Angelo PhillipsChristopher PhillipsAlex Goodman
 		0748945c83 Parse the Maven license from the pom.xml if not contained in the mani… (#2115) 
* Parse the Maven license from the pom.xml if not contained in the manifest

Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>

* chore: restore 10.0.2 schema

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* chore: generate new 11.0.1 schema

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* refactor: remove schema change

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* test: update unit tests to align with new pattern

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* chore: pr feedback

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* chore: remove struct tags

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* keep license name and url semantics preserved on the pkg object

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-10-10 13:09:44 -04:00
William Murphy 51d38f8e59 fix: in some cases, try to use pom info to guess name and version to top level jar (#2080) 
Otherwise, small renames like 'hudson-war-2.2.1.war' to 'hudson.war', would cause
syft to incorrectly catolog the archive.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2023-08-31 10:19:55 -04:00
William Murphy d08e2be768 Fix panic in pom parsing (#2064) 
A recent update to gopom changed many fields to be omitted when empty,
resulting in a number of nil pointers inside the nested structure of the
pom that previously didn't exist. Defend against these in the search for
the property value.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2023-08-25 12:04:57 -04:00
William Murphy faa902209e Fix: don't validate pom declared group (#2054) 
Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2023-08-24 13:28:40 -04:00
William Murphy 9a2a988e7f chore: trace log pom property reflect usage (#2059) 
This reflect code occasionally throws an obscure panic, but not enough
information is logged before the panic to know why it panicked. Log
enough to tell what property and package are being analyzed when the
panic occurs.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2023-08-24 11:28:44 -04:00
Alex Goodman 17d4203bbb Enable reading non-utf-8 encodings for java pom.xml files (#2047) 
* fix reading non utf8 encodings

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* in cases where we cant tell the encoding use the UTF8 replacement char

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* decompose the xml decoding func to get a valid utf8 reader first and test unknown encoding

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-08-23 10:06:34 -04:00