oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-30 14:02:26 +01:00
Code Issues Packages Projects Releases Wiki Activity
1,783 Commits 65 Branches 273 Tags
9cb7c3d3502e1f72c6d280a46e2f1ddb23a0201a
Commit Graph
1783 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
dependabot[bot] 9cb7c3d350 chore(deps): bump dawidd6/action-homebrew-bump-formula (#2420) 
Bumps [dawidd6/action-homebrew-bump-formula](https://github.com/dawidd6/action-homebrew-bump-formula) from 3.10.0 to 3.10.1.
- [Release notes](https://github.com/dawidd6/action-homebrew-bump-formula/releases)
- [Commits](https://github.com/dawidd6/action-homebrew-bump-formula/compare/d3667e5ae14df19579e4414897498e3e88f2f458...75ed025ff3ad1d617862838b342b06d613a0ddf3)

---
updated-dependencies:
- dependency-name: dawidd6/action-homebrew-bump-formula
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-12-12 14:43:43 -05:00
Colm O hEigeartaigh e789e0714d feat: add the option to retrieve remote licenses for projects defined in a maven pom (#2409) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-12-12 14:02:36 -05:00
dependabot[bot] 790ecc6f28 chore(deps): bump github/codeql-action from 2.22.8 to 2.22.9 (#2400) 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.22.8 to 2.22.9.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/407ffafae6a767df3e0230c3df91b6443ae8df75...c0d1daa7f7e14667747d73a7dbbe8c074bc8bfe2)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-12-12 13:59:39 -05:00
dependabot[bot] b9462db59e chore(deps): bump github.com/saferwall/pe from 1.4.7 to 1.4.8 (#2415) 
Bumps [github.com/saferwall/pe](https://github.com/saferwall/pe) from 1.4.7 to 1.4.8.
- [Release notes](https://github.com/saferwall/pe/releases)
- [Changelog](https://github.com/saferwall/pe/blob/main/CHANGELOG.md)
- [Commits](https://github.com/saferwall/pe/compare/v1.4.7...v1.4.8)

---
updated-dependencies:
- dependency-name: github.com/saferwall/pe
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-12-11 12:37:20 -05:00
dependabot[bot] bfad9659a8 chore(deps): bump github.com/go-git/go-git/v5 from 5.10.1 to 5.11.0 (#2414) 
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.10.1 to 5.11.0.
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](https://github.com/go-git/go-git/compare/v5.10.1...v5.11.0)

---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-12-11 08:58:26 -05:00
dependabot[bot] b345752f49 chore(deps): bump actions/setup-go from 4.1.0 to 5.0.0 (#2401) 
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 4.1.0 to 5.0.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/93397bea11091df50f3d7e59dc26a7711a8bcfbe...0c52d547c9bc32b1aa3301fd7a9cb496313a4491)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-12-11 06:38:05 -05:00
anchore-actions-token-generator[bot]andspiffcs ba9dd1d5fd chore(deps): update tools to latest versions (#2408) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>
 2023-12-11 06:36:51 -05:00
anchore-actions-token-generator[bot]andwagoodman 68f35815d6 chore(deps): update CPE dictionary index (#2412) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
 2023-12-11 06:35:58 -05:00
Weston Steimel 4d4b502174 fix(java): improve identification for org.codehaus.groovy artifacts (#2404) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-08 05:02:01 -05:00
Weston Steimel ea80f94c0e fix(java): improve identification for commons-jelly artifacts (#2399) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-07 12:28:21 -05:00
Weston Steimel 2c145f70b2 fix(java): improve identification for io.minio artifacts (#2398) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-06 16:58:07 -05:00
Weston Steimel bcc7e90fcc fix(java): improve identification for com.graphql-java artifacts (#2397) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-06 18:04:43 +00:00
anchore-actions-token-generator[bot] fa1baabc05 chore(deps): update tools to latest versions (#2395) 2023-12-06 10:49:07 -05:00
Weston Steimel b5906824cb chore: enhance java purl generation integration test (#2393) 
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2023-12-06 15:31:16 +00:00
Colm O hEigeartaighandChristopher Phillips 16dee41b4b feat: add ability to retrieve remote licenses for yarn.lock (#2338) 
---------

Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-12-05 13:38:28 -05:00
dependabot[bot] 23778de112 chore(deps): bump anchore/sbom-action from 0.15.0 to 0.15.1 (#2392) 
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.15.0 to 0.15.1.
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Commits](https://github.com/anchore/sbom-action/compare/fd74a6fb98a204a1ad35bbfae0122c1a302ff88b...5ecf649a417b8ae17dc8383dc32d46c03f2312df)

---
updated-dependencies:
- dependency-name: anchore/sbom-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-12-05 09:48:40 -05:00
Colm O hEigeartaigh 3ba9df4ff3 Retrieve remote licenses using pom.properties when there is no pom.xml (#2315) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2023-12-05 09:47:40 -05:00
Weston Steimel bbf223b2c9 fix(java): improve identification for org.apache.tapestry artifacts (#2384) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-04 11:23:40 -05:00
Weston Steimel b126276f97 fix(java): improve identification for io.ratpack artifacts (#2379) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-04 11:23:26 -05:00
Weston Steimel 40d766a257 fix(java): improve identification for org.apache.cassandra artifacts (#2386) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-01 10:51:14 -05:00
Weston Steimel 814960f65a fix(java): improve identification for org.neo4j.procedure artifacts (#2388) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-01 10:50:24 -05:00
William Murphy 13758260dd fix: bump fangs for ptr summarize fix (#2387) 
Previously, pointers to primitive types in config summarization could be
printed literally (like "0x123aefef"). Pull in fangs to get the fix for
this.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2023-12-01 14:37:42 +00:00
Weston Steimel 11039f4b4e fix(java): improve identification for org.elasticsearch artifacts (#2383) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-01 09:22:33 -05:00
Weston Steimel 413ffdb233 fix(java): improve identification for org.apache.geode artifacts (#2382) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-01 12:48:15 +00:00
Weston Steimel e53fe51612 fix(java): improve identification for org.apache.tomcat.embed artifacts (#2381) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-01 07:13:13 -05:00
Weston Steimel facbc486a8 fix(java): improve identification for io.projectreactor.netty artifacts (#2378) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-12-01 07:09:06 -05:00
Weston Steimel 5d42a349e6 fix(java): improve identification for org.eclipse.platform artifacts (#2349) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-11-30 16:02:03 -05:00
Alex Goodman 4adfbeb5f0 Generalize UI events for cataloging tasks (#2369) 
* generalize ui events for cataloging tasks

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* moderate review comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* incorporate review comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* rename cataloger task progress object

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* migrate cataloger task fn to bus helper

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-30 16:25:50 +00:00
anchore-actions-token-generator[bot]andspiffcs b943da6433 chore(deps): update tools to latest versions (#2376) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>
 2023-11-30 09:25:02 -05:00
dependabot[bot] e8119acf93 chore(deps): bump github.com/google/go-containerregistry (#2377) 
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.16.1 to 0.17.0.
- [Release notes](https://github.com/google/go-containerregistry/releases)
- [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml)
- [Commits](https://github.com/google/go-containerregistry/compare/v0.16.1...v0.17.0)

---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-11-30 09:24:25 -05:00
Laurent Goderre 06b9a79e3d chore: fix tests failing due to Mac Rosetta cache (#2374) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2023-11-29 18:39:28 +00:00
Keith Zantow ef5c1651ef fix: improve dotnet portable executable identification (#2133) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-11-29 12:51:24 -05:00
Alex Goodman 5c8dd4c3a7 fix file metadata cataloger to use resolved locations (#2370) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
v0.98.0 		2023-11-29 09:42:34 -05:00
Keith Zantow f5a6b5a02f fix: logging level for parsing potential PE files (#2367) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-11-29 03:42:22 +00:00
Alex Goodman c379d21e9a only remove breaking-change label when there are schema changes (#2371) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-28 17:59:04 -05:00
Keith Zantow a50a0f77d2 fix: capture root command stdout (#2364) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-11-28 15:04:28 -05:00
William Murphy ea4a6747eb fix: hardcode xalan group ID (#2368) 
According to maven central, the package called "xalan" should just have
the group ID xalan, but currently syft isn't able to find that.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2023-11-28 14:40:03 -05:00
Alex Goodman 1cfc4c7387 Normalize cataloger configuration patterns (#2365) 
* normalize cataloger patterns

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove central reference for maven configurable

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-28 17:02:43 +00:00
Alex Goodman 4d0da703bf normalize enums to lowercase with hyphens (#2363) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-28 11:02:20 -05:00
anchore-actions-token-generator[bot]andspiffcs 4ee6be3777 chore(deps): update tools to latest versions (#2358) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>
 2023-11-28 10:22:57 -05:00
dependabot[bot] 5d44e49d2f chore(deps): bump github.com/spf13/afero from 1.10.0 to 1.11.0 (#2361) 
Bumps [github.com/spf13/afero](https://github.com/spf13/afero) from 1.10.0 to 1.11.0.
- [Release notes](https://github.com/spf13/afero/releases)
- [Commits](https://github.com/spf13/afero/compare/v1.10.0...v1.11.0)

---
updated-dependencies:
- dependency-name: github.com/spf13/afero
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-11-28 10:22:21 -05:00
dependabot[bot] 5dd3b127b0 chore(deps): bump github.com/go-git/go-git/v5 from 5.10.0 to 5.10.1 (#2362) 
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.10.0 to 5.10.1.
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](https://github.com/go-git/go-git/compare/v5.10.0...v5.10.1)

---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-11-28 10:21:59 -05:00
William Murphy ce4b31757a fix: index file itself when file scan path has symlink (#2359) 
Previously, building the index of the filesystem when source was file
would fail if part of the path syft was passed to the file included a
symlinked directory, resulting in cataloging misses.

---------

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2023-11-28 09:41:28 -05:00
dependabot[bot] c08b0990ca chore(deps): bump github/codeql-action from 2.22.7 to 2.22.8 (#2351) 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.22.7 to 2.22.8.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/66b90a5db151a8042fa97405c6cf843bbe433f7b...407ffafae6a767df3e0230c3df91b6443ae8df75)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-11-24 06:42:30 -05:00
Alex Goodman 8ee209a5ae use read lock in pkg collection (#2341) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-21 13:48:25 -05:00
Alex Goodman 4712246897 Fix the attest command (#2337) 
* fix attest command

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add notification on how to access the attestation

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix integration test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-21 18:29:58 +00:00
Weston Steimel ebeb768f59 fix: add manual namespace mapping for org.springframework jars (#2345) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2023-11-21 18:28:10 +00:00
Duane MayandAlex Goodman d4733fac1d Add binary classifiers for MySQL and MariaDB (#2316) 
* Add MySQL and MariaDB binary classifiers

Signed-off-by: Duane May <duanemay@gmail.com>
Signed-off-by: Duane May <mduane@vmware.com>

* use smallest possible binary fixtures

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Duane May <duanemay@gmail.com>
Signed-off-by: Duane May <mduane@vmware.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-11-21 16:54:41 +00:00
David Dooling 34774a0e10 Enhance redis binary classifier (#2329) 
Allow existing matcher to match host identifiers longer than 12
characters. The binaries distributed by redis have the version before
payload, so add a matcher for that. Add test fixtures covering these
scenarios.

Signed-off-by: David Dooling <david.dooling@docker.com>
 2023-11-21 16:24:59 +00:00
dependabot[bot] 1c582f0aa5 chore(deps): bump anchore/sbom-action from 0.14.3 to 0.15.0 (#2344) 
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.14.3 to 0.15.0.
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Commits](https://github.com/anchore/sbom-action/compare/78fc58e266e87a38d4194b2137a3d4e9bcaf7ca1...fd74a6fb98a204a1ad35bbfae0122c1a302ff88b)

---
updated-dependencies:
- dependency-name: anchore/sbom-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-11-21 11:12:43 -05:00