oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-11 21:57:22 +02:00
Code Issues Packages Projects Releases Wiki Activity
3,563 Commits 63 Branches 272 Tags
9d39701d50b767e137eb47e685fd42d46db93d91
Commit Graph
62 Commits
Author SHA1 Message Date
Christopher Angelo Phillips ed499fd2d0 chore: migrate .goreleaser config to use docker_v2 (#4608) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2026-07-15 16:52:46 -04:00
Ludovic Henry 05cc8ee5f4 Add support for linux-riscv64 (#4757) 2026-04-27 10:21:41 +00:00
Christopher Angelo Phillips e9a8bc5ab9 chore: update to use old configuration on new cosign (#4287) 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-10-15 15:12:20 +00:00
Saleem Abdulrasool 21d50d7c31 feat: add ARM64 Windows build target (#4237) 
Signed-off-by: Saleem Abdulrasool <compnerd@compnerd.org>
 2025-09-24 15:29:03 -04:00
Emmanuel Ferdman 21496e7a81 chore: update GoReleaser configurations (#4128) 
Signed-off-by: Emmanuel Ferdman <emmanuelferdman@gmail.com>
 2025-08-11 09:38:33 -04:00
Keith Zantow 10f0631710 fix: provide separate nonroot image (#3998) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-06-11 17:00:55 -04:00
Michael BrileyandAlex Goodman 868a6a7584 Harden Container Runtime with Non-Root User (#3941) 
* Update Dockerfile

Signed-off-by: Michael Briley <michael.briley937@gmail.com>

* Update Dockerfile

Signed-off-by: Michael Briley <michael.briley937@gmail.com>

* Update validations.yaml

Signed-off-by: Michael Briley <michael.briley937@gmail.com>

* Update validations.yaml

Signed-off-by: Michael Briley <michael.briley937@gmail.com>

* Update Dockerfile

Signed-off-by: Michael Briley <michael.briley937@gmail.com>

* Update validations.yaml

Signed-off-by: Michael Briley <michael.briley937@gmail.com>

* Update Dockerfile

Signed-off-by: Michael Briley <michael.briley937@gmail.com>

* Update .goreleaser.yaml

Signed-off-by: Michael Briley <michael.briley937@gmail.com>

* Update .goreleaser.yaml

Signed-off-by: Michael Briley <michael.briley937@gmail.com>

* use distroless/static-debian12:nonroot directly

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* keep manual manifest curation

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove qemu usage

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add smoke test for snapshot

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* split up manifests section with comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* correct ci step name

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix arch condition

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* keep path prefix

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Michael Briley <michael.briley937@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-06-05 12:36:23 -04:00
anchore-actions-token-generator[bot]andspiffcs bc20e66d08 chore(deps): update tools to latest versions (#2940) 
* chore(deps): update tools to latest versions

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* chore: update header and deprecated fields

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

---------

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>
 2024-06-07 16:55:32 +00:00
Alex Goodman 6ae5b2904d re-add cosign signing checksums file (#2572) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-01-31 13:19:41 -05:00
Alex Goodman 377538e4a6 revert cosign signing of release checksums file (#2571) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-01-31 16:58:24 +00:00
Alex Goodman aa702a72b4 Sign checksums file and add SBOMs on release (#2548) 
* with release signature of checksums file
* attach SBOMs to the release
* update acceptance tests
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-01-30 13:16:40 -05:00
Alex Goodman 7315f83f9d Upgrade tool management (#2188) 
* migrate to binny and taskfile

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update binny to not require github token

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* added support for automatically building snapshots

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* detect source changes for snapshot builds

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fail workflow explicitly when snapshot cache restoral fails

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* match snapshot restoral paths

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-10-25 09:08:43 -04:00
Keith ZantowandAlex Goodman 2b7a9d0be3 chore: update CLI to CLIO (#2001) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-08-29 15:52:26 -04:00
Alex Goodman 05611c283d bootstrap within composite action (#1461) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2023-01-17 10:04:22 -05:00
Keith Zantow 35f0f2931e chore: update goreleaser brew token (#1306) 2022-11-02 10:05:20 -04:00
Alex Goodman 28cadfdb5d replace signing tooling with quill (#1280) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-10-24 13:03:10 -04:00
Christopher Angelo Phillips 1bf97af3fb remove docker assets from main goreleaser configuration to reduce mac-os runner friction (#1133) 2022-08-01 21:08:38 +00:00
Mayur Waghmode f1c5463a6b Added ppc64le supported to the syft:debug image (#1124) 2022-07-28 14:18:11 -04:00
Mayur Waghmode af330c8a37 Added s390x support (#1117) 2022-07-27 16:33:54 -04:00
Mayur WaghmodeandChristopher Phillips 51727fcf2d Added ppc64le support (#1099) 
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-07-21 09:12:52 -04:00
Christopher Angelo Phillips 5dc729b67e patch-distroless-ghcr (#1110) 2022-07-20 16:51:49 -04:00
Christopher Angelo Phillips 7bae9d4b4e add distroless debug image to published release (#1106) 
add debug distroless image to published release

Debian was chosen based on the fact that it is the smallest available distroless image
The new tag is `anchore/syft:debug`

Closes #833
 2022-07-20 15:54:46 +00:00
Christopher Angelo Phillips 82de24cf7c change draft to false for release process (#1016) 2022-06-01 11:55:33 -04:00
Christopher Angelo Phillips 6029dd7c2e refactor command package to remove globals and add dependency injection 2022-04-26 18:23:03 +00:00
Alex Goodman 68b7ad9770 Additionally publish docker images to GHCR (#934) 2022-04-01 11:30:21 -04:00
Alex Goodman d2f28e0eb1 Restore single goreleaser file (#853) 2022-02-28 14:46:41 +00:00
Alex Goodman 24cd39089a Share import mac code signing certificate steps for release (#851) 2022-02-25 20:07:03 -05:00
Alex Goodman c89131bcf3 Bump release timeout (#848) 2022-02-25 16:32:57 +00:00
Christopher Angelo Phillips 52d2e62cdc remove duplicate manifest lines (#828) 2022-02-15 12:51:02 -05:00
Alex Goodman 2c62651c82 run signing as post-build step (#803) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-07 16:55:15 -05:00
Alex Goodman 5519a25035 dont add signing artifact (#802) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-07 17:03:09 +00:00
Alex Goodman e7bef5e511 split signing setup into pre-release hook (#794) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-04 16:49:42 -05:00
Alex Goodman 341288ba29 Normalize snapshot and release artifacts (#789) 
* refactor signing steps in release/snapshot workflows

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* show signing logs on snapshot or release failure

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update install.sh + tests to account for new goreleaser changes

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update cli tests to account for new goreleaser build names

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix acceptance test to use new snapshot bin path

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add notarization

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* address review comments

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-04 12:41:37 -05:00
Christopher Angelo Phillips c350bd55f6 update sign sed command to include windows zip (#755) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-01-19 17:08:04 -05:00
Christopher Angelo Phillips dfefd2ea4e update goreleaser with windows checksums (#740) 
* update goreleaser with windows checksums

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* update format to be closer to our previous implementation

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* remove linux replacement

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* typo

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-01-10 14:52:31 -05:00
Christopher Angelo Phillips 3286a4d4cc update docker manifest tagging (#600) 
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-10-28 15:41:39 -04:00
Christopher Angelo Phillips 0ff7013382 update manifest to use Tag over Version 
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-10-28 15:05:34 -04:00
Christopher Angelo Phillips 71708e5bf8 update goreleaser with correct tag information (#598) 
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-10-28 13:37:22 -04:00
Christopher Angelo Phillips 1c63943055 Add arm64 image support and Darwin M1 support to .goreleaser.yaml (#591) 
* update support arm64

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* small update syntax

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* restore release command

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* add docker manifests

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-10-26 09:42:35 -04:00
Christopher Angelo Phillips 10fa8dc7c9 Add windows support (#548) 
* update  build tags, ui support, and stereoscope, and release for windows support

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-10-21 12:49:36 -04:00
Alex Goodman ddfc8e20c0 Revert "disable docker releases (workaround) (#493)" (#501) 
This reverts commit 06dcd3261d.

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-09-13 13:06:23 -04:00
Alex Goodman 06dcd3261d disable docker releases (workaround) (#493) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-09-03 21:29:34 +00:00
Alex Goodman e3b1522394 upgrade goreleaser + constrain pipeline tool cache 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-03-23 06:58:30 -04:00
Alex Goodman 9f57e17887 add labels to the docker image + pin the docker pipeline install version 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-03-18 16:28:03 -04:00
Alex Goodman e9105c180a add dockerfile + docker build step 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-03-11 16:45:20 -05:00
Alex Goodman 5e62bca72f Revert "Add docker image and refactor release pipeline (#310)" 
This reverts commit 6195002ae5.

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2021-03-11 12:42:18 -05:00
Dan LuhringandAlex Goodman 6195002ae5 Add docker image and refactor release pipeline (#310) 
* Create independent build targets for Mac and Linux

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Create targets for macOS signing and notarization

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Create target for Linux packaging

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Update release workflow and leverage new make targets

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Add release assets to release draft

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Add homebrew formula release follow-up and improve Makefile

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Add follow-up workflow for updating version check file

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Get rid of fetch depth 0 for checkout action

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Add follow-up workflow for Docker images

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Restore wait-for-checks job

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Replace make functions with shell functions

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Account for envsubst command in bootstrap-ci-linux

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* move homebrew generation into script

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add release approval step; remove goreleaser; add docker image smoke testing in acceptance step

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* replace homebrew formula template file with heredoc template

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update release documentation

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2021-03-10 13:25:31 -05:00
Alex Goodman a56292e2e0 Revert "Add the ability to run syft from a scratch image." 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2020-12-16 16:54:34 -05:00
Toure Dunnon 07f2c2f702 Add the ability to run syft from a scratch image. 
This change will allow endusers or CI to run syft from a
minimum image which will simplify CI deployment.

Signed-off-by: Toure Dunnon <toure.dunnon@anchore.com>
 2020-12-14 08:10:46 -05:00
Alex Goodman 7e270bf76c restore the checksum file during release 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-11-11 15:11:51 -05:00