Timo
f45586b457
Remove Go Report Card badge from README ( #5130 )
...
Signed-off-by: Timo <57227498+EchterTimo@users.noreply.github.com >
2026-08-07 10:31:27 -04:00
Archy
1746e96ad3
fix: correct typos and update examples README ( #4703 )
...
Signed-off-by: Artem Muterko <artem@sopho.tech >
2026-06-29 11:16:50 -04:00
Alex Goodman
7ed733c3fb
signpost to docs site ( #4483 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-12-17 18:00:38 +00:00
Kudryavcev Nikolay
89842bd2f6
chore: migrate syft to use mholt/archives instead of anchore fork ( #4029 )
...
---------
Signed-off-by: Kudryavcev Nikolay <kydry.nikolau@gmail.com >
Signed-off-by: Christopher Phillips <spiffcs@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-11-13 23:04:43 +00:00
Brian Muenzenmeyer
9478cd974b
docs: update template link in README.md ( #4306 )
...
Signed-off-by: Brian Muenzenmeyer <brian.muenzenmeyer@gmail.com >
2025-10-28 11:29:07 -04:00
Marc
16f851c5d9
feat: include .rar files as Java archives for Java resource adapters ( #4137 )
...
Signed-off-by: Marc Thomas <marc.thomas@t-systems.com >
2025-10-24 11:55:02 -04:00
Keith Zantow
323fd3e34c
docs: add GitHub actions to supported ecosystems ( #4235 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-09-23 10:08:41 -04:00
Alex Goodman
8a7302c5cf
migrate to get.anchore.io ( #4095 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-07-30 10:54:22 -04:00
c491dab35b
feat: add parsing for uv.lock ( #3763 )
...
* feat: add parsing for uv.lock (#3268 )
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* Still no tests, but much more complete
Next up: start writing tests! :)
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore: finish out functionality and write tests
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* Merge the .NET deps.json and PE binary catalogers (#3563 )
* add combined deps.json + pe binary cataloger
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* deprecate pe and deps standalone catalogers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* parse resource names + add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix integration and CLI tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add some helpful code comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* allow for dropping Dep packages that are missing DLLs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* migrate json schema changes to 24
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* keep application configuration
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* correct config help
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] detect claims of dlls within deps.json
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add assembly repack detection
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* .net package count is lower due to dll claim requirement
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* better .NET cpe generation (#3764 )
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* Better represent .NET runtime packages (#3768 )
* clean up .NET runtime packages
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add runtime relationships
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove runtime references from binary package name
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore(deps): update CPE dictionary index (#3769 )
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore(deps): bump modernc.org/sqlite from 1.36.1 to 1.37.0 (#3771 )
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.36.1 to 1.37.0.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.36.1...v1.37.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore(deps): bump 8398a7/action-slack from 3.16.2 to 3.18.0 (#3767 )
Bumps [8398a7/action-slack](https://github.com/8398a7/action-slack ) from 3.16.2 to 3.18.0.
- [Release notes](https://github.com/8398a7/action-slack/releases )
- [Commits](https://github.com/8398a7/action-slack/compare/28ba43ae48961b90635b50953d216767a6bea486...1750b5085f3ec60384090fb7c52965ef822e869e )
---
updated-dependencies:
- dependency-name: 8398a7/action-slack
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 (#3766 )
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.37.0 to 0.38.0.
- [Commits](https://github.com/golang/net/compare/v0.37.0...v0.38.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore: move/modify code for lint issues
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore: make sure private structs are not exported
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* generate json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* chore: update readme to include uv
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore: use uv as the package manager name
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
---------
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: anchore-actions-token-generator[bot] <102182147+anchore-actions-token-generator[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-17 18:26:56 +00:00
Laurent Goderre and Alex Goodman
529840bfc0
Add support for PHP Pear ( #2775 )
...
* Add support for PHP Pear and unify PECL with it
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove log statements
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix struct comment
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-04-30 20:16:58 +00:00
bffe26bcc5
feat: add support for Bitnami cataloguer ( #3341 )
...
* prototype: start bitnami cataloger
Bitnami images have spdx SBOMs at predictable paths, and Syft could more
accurately identify the software in these images by scanning those
SBOMs. Start work on this by forking the sbom-cataloger as a new
bitnami-cataloger.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* wire up bitnami cataloger to run on images by default
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* feat: add support for Bitnami cataloguer
Signed-off-by: juan131 <jariza@vmware.com >
* feat: use a better SPDX sample for unit tests
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: only report bitnami pkgs
Signed-off-by: juan131 <jariza@vmware.com >
* feat: adapt JSON schema, spdxutil and packagemetadata
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: integration tests
Signed-off-by: juan131 <jariza@vmware.com >
* feat: implement FileOwner interface
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: update json schema
Signed-off-by: juan131 <jariza@vmware.com >
* [wip] add bitnami owned files and fix binary package ownership filtering
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* feat: obtain bitnami pkg files based on SPDX relationships tree
Signed-off-by: juan131 <jariza@vmware.com >
* preserve type switches
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename bitnami entry metadata type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* restrict find main pkg logic
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add missing graalvm source info
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bugfix: integration tests
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: mod tidy
Signed-off-by: juan131 <jariza@vmware.com >
---------
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Signed-off-by: juan131 <jariza@vmware.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-02-18 09:07:47 -05:00
c10e904c28
feat(cataloger): add a terraform provider cataloger ( #3378 )
...
* feat(cataloger): add a terraform provider cataloger
* chore: bump schema from 16.0.19 -> 16.0.20
------
Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-01-21 14:44:54 -05:00
Alex Mason
436b36916d
chore: update README.md's link to Nixpkgs ( #3578 )
...
Nixpkgs changed the location of packages to ease organisation, this should be the correct link.
Signed-off-by: Alex Mason <github@me.axman6.com >
2025-01-15 17:56:11 +00:00
Alan Pope
3c070e0ad9
doc: Add official Syft logo license information ( #3421 )
...
This clarifies the license under which the Syft "owl" logo is released. This is necessary to enable us to share the logo in certain online communities.
Signed-off-by: Alan Pope <alan.pope@anchore.com >
2024-11-07 14:23:57 +00:00
Alan Pope
b62b0cb800
[docs] Add mastodon link to README.md ( #3306 )
...
Hello friends.
This follows the same pattern as the other badges at the top of the readme. It adds the mastodon link to the Syft account.
This also means that the link back here from the Mastodon account's profile page will show as 'Validated' once landed, which gives more authenticity to the account.
Signed-off-by: Alan Pope <alan.pope@anchore.com >
2024-10-10 15:28:55 +01:00
Alan Pope
49d4e32241
update-slack-to-discourse ( #3111 )
...
Signed-off-by: Alan Pope <alan@popey.com >
2024-08-12 11:49:10 +01:00
Bradley Jones
4d23990dd4
docs: link to contrib/dev docs in readme ( #3029 )
...
These docs are full of great information so make them easily accessible
from the README so they aren't overlooked.
Signed-off-by: Bradley Jones <bradley.jones@anchore.com >
2024-07-16 06:59:31 -07:00
Adam McClenaghan
d4fa61e0a2
chore: Fix apache shield in readme ( #3021 )
...
Signed-off-by: Adam McClenaghan <adam@mcclenaghan.co.uk >
2024-07-16 06:59:14 -07:00
Christopher Angelo Phillips
f5a917a5a2
docs: update cyclone-dx documentation ( #2983 )
...
* chore: update docs to show 1.6 for cyclone-dx by default
* chore: update README showing version information for formats
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2024-06-21 09:32:59 -07:00
Alex Goodman
c43f4fb416
add signature verification to install.sh ( #2941 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-06-10 11:29:53 -04:00
Alan Pope
49c458b113
chore: Reduce length of readme, moving lengthy content to the wiki ( #2882 )
...
* chore: Reduce length of readme, moving lengthy content to the wiki
https://github.com/anchore/syft/wiki
---------
Signed-off-by: Alan Pope <alan@popey.com >
2024-05-20 13:46:32 -04:00
Jörg Thalheim
74b01a1c38
README.md: link to official wiki ( #2858 )
...
This commit updates the the link from the former, unofficial nixos wiki page to the new https://wiki.nixos.org
ref: NixOS/foundation#113
Signed-off-by: Jörg Thalheim <joerg@thalheim.io >
2024-05-09 13:49:37 -04:00
Keith Zantow
326ec57d4a
docs: fix incorrect flag name in readme ( #2677 )
2024-02-28 15:39:43 -05:00
Keith Zantow
a978966cad
feat: add --from flag, refactor source providers ( #2610 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-02-27 16:44:37 -05:00
Alexandr Hacicheant and Alex Goodman
96ee2db875
feat: Add Wordpress cataloger ( #2218 )
...
* Closes #1911 Wordpress cataloger
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed a few unit tests and static analizer notices
Signed-off-by: disc <a.hacicheant@gmail.com >
* Updated `README.md`
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed `golangci-lint` notices
Added integration test for `wordpress-plugin`
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed `gosimports` notices
Signed-off-by: disc <a.hacicheant@gmail.com >
* Updated `json schema` version
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed CLI tests, increased expected package count
Signed-off-by: disc <a.hacicheant@gmail.com >
* Read first 4Kb of a plugins file's content
Signed-off-by: disc <a.hacicheant@gmail.com >
* replace JSON schema version
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* change wording on source info for wordpress packages
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* Minor changes after a huge refactoring
Signed-off-by: disc <a.hacicheant@gmail.com >
* Removed unused files
Signed-off-by: disc <a.hacicheant@gmail.com >
* Updated schema
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed integration tests
Signed-off-by: disc <a.hacicheant@gmail.com >
* fix integration tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* Renamed `metadata.Name` to `metadata.PluginInstallDirectory`
Signed-off-by: disc <a.hacicheant@gmail.com >
* rename fields to be compliant with json conventions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: disc <a.hacicheant@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-14 16:03:25 +00:00
Alex Goodman
84576b93e1
Guess go main module version based on binary contents ( #2608 )
...
* guess go main module version based on binary contents
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add configuration options for golang main module version heuristics
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix test setup for go bin cataloger
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix unit test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix incorrect test assert ordering
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* handle error from seek
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-09 19:52:42 +00:00
Alex Goodman
7444a9f976
fix readme around templating options ( #2612 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-09 13:44:41 -05:00
Christopher Angelo Phillips
630e7153e6
chore: pluralize the flag ( #2564 )
...
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2024-01-31 13:21:09 -05:00
Alex Goodman
a32b8d7fc6
Use the json schema as input for templating ( #2542 )
...
* use the json schema as input for templating
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix cli tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-25 14:00:35 +00:00
Alex Goodman
0bc31f4e27
update readme and help output to be accurate to syft api ( #2520 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-19 16:18:47 -05:00
Alex Goodman
b0ab75fd89
Replace core SBOM-creation API with builder pattern ( #1383 )
...
* remove existing cataloging API
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add file cataloging config
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add package cataloging config
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add configs for cross-cutting concerns
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename CLI option configs to not require import aliases later
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update all nested structs for the Catalog struct
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update Catalog cli options
- add new cataloger selection options (selection and default)
- remove the excludeBinaryOverlapByOwnership
- deprecate "catalogers" flag
- add new javascript configuration
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* migrate relationship capabilities to separate internal package
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* refactor golang cataloger to use configuration options when creating packages
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* create internal object to facilitate reading from and writing to an SBOM
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* create a command-like object (task) to facilitate partial SBOM creation
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add cataloger selection capability
- be able to parse string expressions into a set of resolved actions against sets
- be able to use expressions to select/add/remove tasks to/from the final set of tasks to run
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add package, file, and environment related tasks
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update existing file catalogers to use nested UI elements
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add CreateSBOMConfig that drives the SBOM creation process
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* capture SBOM creation info as a struct
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add CreateSBOM() function
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update docs with SBOM selection help + breaking changes
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix multiple override default inputs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix deprecation flag printing to stdout
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* refactor cataloger selection description to separate object
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address review comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* keep expression errors and show specific suggestions only
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address additional review feedback
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address more review comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* addressed additional PR review feedback
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix file selection references
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove guess language data generation option
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add tests for coordinatesForSelection
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename relationship attributes
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add descriptions to relationships config fields
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* improve documentation around configuration options
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add explicit errors around legacy config entries
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-12 17:39:13 -05:00
dependabot[bot]
b83cc8485a
chore(deps): bump github.com/CycloneDX/cyclonedx-go from 0.7.2 to 0.8.0 ( #2413 )
2023-12-14 17:18:37 -05:00
Colm O hEigeartaigh and Christopher Phillips
16dee41b4b
feat: add ability to retrieve remote licenses for yarn.lock ( #2338 )
...
---------
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org >
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2023-12-05 13:38:28 -05:00
Alex Goodman
5565bdef0c
Remove the power-user command and related catalogers ( #2306 )
...
* remove the power-user command
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove secrets + classifier catalogers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-11-20 15:44:28 +00:00
Alex Goodman
1676934c63
Add "pretty" json configuration and change default behavior to be space-efficient ( #2275 )
...
* expose underlying format options
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove escape html options and address PR feedback
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* incorporate PR feedback
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix cli test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-11-20 15:29:34 +00:00
Benji Visser
9aa9e0e09a
docs: Update README.md for dotnet-portable-executable ( #2322 )
...
Signed-off-by: Benji Visser <benji@093b.org >
2023-11-14 10:37:56 -05:00
Colm O hEigeartaigh and Christopher Phillips
2d582f78a1
Add a new Java configuration option to recursively search parent poms… ( #2274 )
...
- Add a new Java configuration option to recursively search parent poms for licenses
---------
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org >
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2023-11-03 10:33:02 -04:00
Alex Goodman
b2f4d7eda2
Follow convention for naming catalogers ( #2277 )
...
* follow convention for naming catalogers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix cataloger name example
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-11-02 12:39:42 +00:00
Colm O hEigeartaigh and Christopher Phillips
78ac2f9797
Read a license from a parent pom stored in Maven Central ( #2228 )
...
* Read a license from a parent pom stored in Maven Central
---------
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org >
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2023-10-30 17:48:16 -04:00
Tim Gerla
262423b1e8
Update README.md to use canonical output format names ( fixes #2269 ) ( #2272 )
...
Signed-off-by: Timothy Gerla <tim@gerla.net >
2023-10-30 17:25:30 -04:00
Alex Goodman
1aaa644007
Remove MetadataType from core package object and normalize JSON metadataType values ( #1983 )
...
* [wip]
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* distinct the package metadata functions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove metadata type from package core model
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* incorporate review feedback for names
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add RPM archive metadata and split parser helpers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* clarify the python package metadata type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename the KB metadata type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* break hackage and composer types by use case
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* linting fix
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix encoding and decoding for syft-json and cyclonedx
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump json schema to 11
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update cyclonedx-json snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update cyclonedx-xml snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update spdx-json snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update spdx-tv snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update syft-json snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* correct metadata type in stack yaml parser test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix bom-ref redactor for cyclonedx-xml
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add tests for legacy package metadata names
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate json schema v11
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix legacy HackageMetadataType reflect type value check
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* packagemetadata discovery should account for type shadowing
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix cli tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump json schema version to v12
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update json schema to incorporate changes from main
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add syft-json legacy config option
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add tests around v11-v12 json decoding
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add docs for SYFT_JSON_LEGACY
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename structs to be compliant with new naming scheme
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-10-30 12:12:04 -04:00
Marc-Etienne Vargenau
235ad2e749
Add exact syntax of the conversion formats ( #2196 )
...
Signed-off-by: Marc-Etienne Vargenau <marc-etienne.vargenau@nokia.com >
2023-10-05 14:48:30 -04:00
23e3de75e3
Add containerd support ( #1793 )
...
* [wip] add containerd UI handlers
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* Add containerd support
- Add UI handlers (done by @wagoodman)
- Add containerd types and wrappers (done by @wagoodman)
- Add flag for specifying containerd address
Closes #201
Signed-off-by: Shane Dell <shanedell100@gmail.com >
* Fix lint
Signed-off-by: Shane Dell <shanedell100@gmail.com >
* add containerd ui handler
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add containerd scheme to readme
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add test for scheme detection
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Shane Dell <shanedell100@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-09-18 11:33:43 -04:00
b03e9c6868
Add registry certificate verification support ( #1734 )
...
* add registry certificate verification support
* replace stereoscope version
* modify go.mod
* pull in stereoscope update
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename registry cert options, add docs, and add test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update to account for changes in anchore/stereoscope#195
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix cli tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: lishituo <24578666@qq.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-08-29 11:45:20 -04:00
Christopher Angelo Phillips
541c8d339b
1948-filter-pkg-by-type ( #2011 )
...
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2023-08-09 16:05:52 -04:00
Christopher Angelo Phillips
466da7cbda
931: binary cataloger exclusion defaults for ownership by overlap ( #1948 )
...
Fixes #931
PR #1948 introduces a new implicit exclusion for binary packages that overlap by file ownership and have certain characteristics:
1) the relationship between packages is OwnershipByFileOverlap
2) the parent package is an "os" package - see changelog for included catalogers
3) the child is a synthetic package generated by the binary cataloger - see changelog for included catalogers
4) the package names are identical
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2023-08-08 13:00:52 -04:00
Alex Goodman and manifestori
063e9da65d
Guess unpinned versions in python requirements.txt ( #1966 )
...
* feat: python requirements.txt parsing inclusive
Signed-off-by: manifestori <ori@manifestcyber.com >
* refactor: parseVersion
Signed-off-by: manifestori <ori@manifestcyber.com >
* add python config for optional requirements version constraint resolution
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* allow for python requirements metadata to be optional
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* restore cyclonedx dependency
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: manifestori <ori@manifestcyber.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Co-authored-by: manifestori <ori@manifestcyber.com >
2023-07-27 14:26:59 -04:00
Tristan Farkas
e1c1832f84
Add cataloger for Swift Package Manager. ( #1919 )
...
Signed-off-by: Tristan Farkas <Tristan.Farkas@axis.com >
2023-07-25 14:35:21 -04:00
Alex Goodman
cfbb9f703b
add file source digest support ( #1914 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-07-05 13:47:13 -04:00
Marco Damiani
2e3c7fa158
doc(readme): add installation section with scoop ( #1909 )
...
Signed-off-by: drazen04 <hangtime23@hotmail.it >
2023-07-03 13:50:01 -04:00
Timo
Archy
Alex Goodman
Kudryavcev Nikolay
Brian Muenzenmeyer
Marc
Keith Zantow
Laurent GoderreandAlex Goodman
Alex Mason
Alan Pope
Bradley Jones
Adam McClenaghan
Alan Pope
Jörg Thalheim
Alexandr HacicheantandAlex Goodman
Colm O hEigeartaighandChristopher Phillips
Benji Visser
Tim Gerla
Marc-Etienne Vargenau
Tristan Farkas
Marco Damiani