1690 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
dependabot[bot]	a6d73e5659	chore(deps): bump modernc.org/sqlite from 1.26.0 to 1.27.0 (#2279) ... Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.26.0 to 1.27.0. - [Commits](https://gitlab.com/cznic/sqlite/compare/v1.26.0...v1.27.0) --- updated-dependencies: - dependency-name: modernc.org/sqlite dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-11-01 10:35:20 -04:00
Christopher Angelo Phillips	ee4e69285a	test: remove dll files and updates tests to use versionResources (#2276) ... * test: remove dll files and updates tests to use versionResources Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * test: update integration tests with dot net coverage Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * chore: move test cases to appropriate blocks Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * fix: chmod only the dll Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * fix: add primary annotation key to packages Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * chore: bump number of packages with new dotnet package Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> --------- Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>	2023-10-31 15:33:52 -04:00
Christopher Angelo Phillips	59c56a5666	fix: update dot net binary parsing logic to remove empty space (#2273) ... * fix: update parsing logic to remove empty space * tests: update with test cases provided by community --------- Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>	2023-10-31 10:43:29 -04:00
Colm O hEigeartaighandChristopher Phillips	78ac2f9797	Read a license from a parent pom stored in Maven Central (#2228) ... * Read a license from a parent pom stored in Maven Central --------- Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org> Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>	2023-10-30 17:48:16 -04:00
Tim Gerla	262423b1e8	Update README.md to use canonical output format names (fixes #2269) (#2272) ... Signed-off-by: Timothy Gerla <tim@gerla.net>	2023-10-30 17:25:30 -04:00
Alex Goodman	1aaa644007	Remove MetadataType from core package object and normalize JSON metadataType values (#1983) ... * [wip] Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * distinct the package metadata functions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove metadata type from package core model Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * incorporate review feedback for names Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add RPM archive metadata and split parser helpers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * clarify the python package metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename the KB metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * break hackage and composer types by use case Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * linting fix Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix encoding and decoding for syft-json and cyclonedx Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema to 11 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx-xml snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update spdx-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update spdx-tv snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update syft-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * correct metadata type in stack yaml parser test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix bom-ref redactor for cyclonedx-xml Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for legacy package metadata names Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * regenerate json schema v11 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix legacy HackageMetadataType reflect type value check Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * packagemetadata discovery should account for type shadowing Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema version to v12 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update json schema to incorporate changes from main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add syft-json legacy config option Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests around v11-v12 json decoding Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add docs for SYFT_JSON_LEGACY Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename structs to be compliant with new naming scheme Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-30 12:12:04 -04:00
dependabot[bot]	f442586ec9	chore(deps): bump github.com/docker/docker (#2263) ... Bumps [github.com/docker/docker](https://github.com/docker/docker) from 24.0.6+incompatible to 24.0.7+incompatible. - [Release notes](https://github.com/docker/docker/releases) - [Commits](https://github.com/docker/docker/compare/v24.0.6...v24.0.7) --- updated-dependencies: - dependency-name: github.com/docker/docker dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-10-30 09:55:19 -04:00
anchore-actions-token-generator[bot]andkzantow	12877ed863	chore(deps): update stereoscope to 5909e353ee88d7809f0e646c79f110a0e6b1d80d (#2265) ... Signed-off-by: GitHub <noreply@github.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com>	2023-10-30 09:51:37 -04:00
3 people	629aafc323	chore(deps): update CPE dictionary index (#2271) ... * chore(deps): update CPE dictionary index Signed-off-by: GitHub <noreply@github.com> --------- Signed-off-by: Will Murphy <will.murphy@anchore.com> Signed-off-by: GitHub <noreply@github.com> Co-authored-by: Will Murphy <will.murphy@anchore.com> Co-authored-by: willmurphyscode <willmurphyscode@users.noreply.github.com>	2023-10-30 09:48:03 -04:00
William Murphy	f430788099	chore: fix cpe generation task (#2270) ... Signed-off-by: Will Murphy <will.murphy@anchore.com>	2023-10-30 12:51:26 +00:00
dependabot[bot]	58850d3258	chore(deps): bump github.com/google/uuid from 1.3.1 to 1.4.0 (#2262) ... Bumps [github.com/google/uuid](https://github.com/google/uuid) from 1.3.1 to 1.4.0. - [Release notes](https://github.com/google/uuid/releases) - [Changelog](https://github.com/google/uuid/blob/master/CHANGELOG.md) - [Commits](https://github.com/google/uuid/compare/v1.3.1...v1.4.0) --- updated-dependencies: - dependency-name: github.com/google/uuid dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-10-27 09:55:04 -04:00
dependabot[bot]	2428d704e1	chore(deps): bump github/codeql-action from 2.22.4 to 2.22.5 (#2261) ... Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.22.4 to 2.22.5. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/49abf0ba24d0b7953cb586944e918a0b92074c80...74483a38d39275f33fcff5f35b679b5ca4a26a99) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-10-27 09:54:23 -04:00
anchore-actions-token-generator[bot]andspiffcs	da07520121	chore(deps): update tools to latest versions (#2258) ... Signed-off-by: GitHub <noreply@github.com> Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>	2023-10-26 10:15:13 -04:00
dependabot[bot]	ae27dcdfa9	chore(deps): bump github.com/go-git/go-git/v5 from 5.9.0 to 5.10.0 (#2256) ... Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.9.0 to 5.10.0. - [Release notes](https://github.com/go-git/go-git/releases) - [Commits](https://github.com/go-git/go-git/compare/v5.9.0...v5.10.0) --- updated-dependencies: - dependency-name: github.com/go-git/go-git/v5 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-10-25 10:45:27 -04:00
Colm O hEigeartaigh	1daf18fee9	feat: Perform case insensitive matching on Java license files (#2235) ... Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>	2023-10-25 09:51:59 -04:00
Alex Goodman	7392d607b6	Split the sbom.Format interface by encode and decode use cases (#2186) ... * split up sbom.Format into encode and decode ops Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cmd pkg to inject format configs Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump cyclonedx schema to 1.5 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * redact image metadata from github encoder tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add more testing around format decoder identify Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add test case for format version options Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix CLI test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * [wip] - review comments Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * keep encoder creation out of post load function Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * keep decider and identify functions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add a few more doc comments Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove format encoder default function helpers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * address PR feedback Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * move back to streaming based decode functions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * with common convention for encoder constructors Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix tests and allow for encoders to be created from cli options Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * buffer reads from stdin to support seeking Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-25 13:43:06 +00:00
Alex Goodman	7315f83f9d	Upgrade tool management (#2188) ... * migrate to binny and taskfile Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update binny to not require github token Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * added support for automatically building snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * detect source changes for snapshot builds Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fail workflow explicitly when snapshot cache restoral fails Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * match snapshot restoral paths Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-25 09:08:43 -04:00
Christopher Angelo Phillips	cd530924d0	fix: 2179 jar chokes empty lines (#2254) ... --------- Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>	2023-10-24 14:03:47 -04:00
anchore-actions-token-generator[bot]andAlex Goodman	73d5852119	chore(deps): update CPE dictionary index (#2253) ... * fix CPE workflow Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * chore(deps): update CPE dictionary index Signed-off-by: GitHub <noreply@github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: GitHub <noreply@github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-24 13:22:02 -04:00
Alex Goodman	c4b464e616	fix CPE workflow (#2252) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-24 15:07:49 +00:00
Stefan Profanter	234ce4e1f3	feat: add conaninfo.txt parser to detect conan packages in docker images (#2234) ... * feat: add conaninfo.txt parser to detect conan packages in docker images Signed-off-by: Stefan Profanter <stefan.profanter@agile-robots.com> * fix: add NewConanInfoCataloger as a separate cataloger Signed-off-by: Stefan Profanter <stefan.profanter@agile-robots.com> --------- Signed-off-by: Stefan Profanter <stefan.profanter@agile-robots.com>	2023-10-23 16:17:50 -04:00
anchore-actions-token-generator[bot]andspiffcs	f9433e7f9b	chore(deps): update bootstrap tools to latest versions (#2245) ... Signed-off-by: GitHub <noreply@github.com> Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>	2023-10-23 10:48:07 -04:00
dependabot[bot]	5a4778093d	chore(deps): bump github.com/bmatcuk/doublestar/v4 from 4.6.0 to 4.6.1 (#2248) ... Bumps [github.com/bmatcuk/doublestar/v4](https://github.com/bmatcuk/doublestar) from 4.6.0 to 4.6.1. - [Release notes](https://github.com/bmatcuk/doublestar/releases) - [Commits](https://github.com/bmatcuk/doublestar/compare/v4.6.0...v4.6.1) --- updated-dependencies: - dependency-name: github.com/bmatcuk/doublestar/v4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-10-23 10:42:17 -04:00
dependabot[bot]	bdbf927847	chore(deps): bump github/codeql-action from 2.22.3 to 2.22.4 (#2249) ... Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.22.3 to 2.22.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/0116bc2df50751f9724a2e35ef1f24d22f90e4e1...49abf0ba24d0b7953cb586944e918a0b92074c80) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-10-23 10:41:54 -04:00
Alex Goodman	f3d95aa3a9	fill version info from release and git directly (#2244) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-23 09:05:43 -04:00
Chao LiandWill Murphy	671ff39933	Add ruby.NewGemSpecCataloger to DirectoryCatalogers. (#1971) ... * Add ruby.NewGemSpecCataloger to DirectoryCatalogers. Signed-off-by: Evan <chaol@vmware.com> * fixed tests Signed-off-by: Evan <chaol@vmware.com> * Addressed review comment Signed-off-by: Evan <chaol@vmware.com> * Remove NewInstalledGemSpecCataloger from default dir catalogers Because the files that the installed gemspec cataloger work off of are a subset of the files that the more general gemspec cataloger will work off of, we shouldn't have both of them on by default, since this could result in finding the same package twice. Signed-off-by: Will Murphy <will.murphy@anchore.com> --------- Signed-off-by: Evan <chaol@vmware.com> Signed-off-by: Will Murphy <will.murphy@anchore.com> Co-authored-by: Will Murphy <will.murphy@anchore.com>	2023-10-23 08:49:57 -04:00
Alex Goodman	263be01faa	change homebrew release trigger (#2242) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-20 18:31:41 +00:00
Alex Goodman	8f6bdde666	Label PRs when the json schema changes (#2240) ... * label PRs when the json schema changes Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * moderate pr comments Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * be more strict about processing file names Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> v0.94.0	2023-10-20 13:00:15 -04:00
Christopher Angelo PhillipsandAuston-Zhang	ef43294d0e	Add download location when cataloging directory npm package lock (#2238) ... * added download locatoin (resolved) when cataloging a directory - javascript ecosystem- npm - packag-lock Signed-off by Auston(Aoxiang) Zhang <auston.zhang@dal.ca> Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * chore: get DCO to fire Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> --------- Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: Auston-Zhang <ax706429@dal.ca>	2023-10-20 11:40:38 -04:00
Christopher Angelo Phillips	e1ad340c2d	fix: allow packages to be captured from DIST/EGG case (#2239) ... * fix: allow packages to be captured from DIST/EGG case Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * test: update expected glob paths Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> --------- Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>	2023-10-20 11:29:13 -04:00
3 people	07f13049da	Account for maven bundle plugin and fix filename matching (#2220) ... * account for maven bundle plugin and fix filename matching Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add in-repo jar tests based on metadata to cover #2130 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * tests: fix test merge commit Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>	2023-10-19 17:57:23 -04:00
dependabot[bot]	6c7900f5b8	chore(deps): bump actions/checkout from 4.1.0 to 4.1.1 (#2236) ... Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.0 to 4.1.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/8ade135a41bc03ea155e62e844d188df1ea18608...b4ffde65f46336ab88eb53be808477a3936bae11) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-10-18 09:54:26 -04:00
Alex Goodman	7018573bf7	Remove internal string set (#2219) ... * remove internal string set Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * incorporate changes from #2227 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * beef up the pkg.License.Merg() doc string Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-17 12:52:11 -04:00
Alex Goodman	f3ad8cf250	bump clio to get stderr reporting fix (#2232) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-16 12:47:48 -04:00
Alex Goodman	31f1d7dbf0	Fix panic for empty input to Swift cataloger (#2226) ... * survive invalid input in swift parser Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add empty file Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-16 11:04:33 -04:00
Colm O hEigeartaighandAlex Goodman	144ed725a7	Add additional license filenames (#2227) ... * Add additional license filenames Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org> * add comment about the license list being manually updated Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-16 13:20:00 +00:00
dependabot[bot]	dcec2bc352	chore(deps): bump github/codeql-action from 2.22.2 to 2.22.3 (#2229) ... Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.22.2 to 2.22.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/d90b8d79de6dc1f58e83a1499aa58d6c93dc28de...0116bc2df50751f9724a2e35ef1f24d22f90e4e1) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-10-16 08:59:39 -04:00
dependabot[bot]	1fe0921a5b	chore(deps): bump github.com/charmbracelet/lipgloss from 0.9.0 to 0.9.1 (#2222) ... Bumps [github.com/charmbracelet/lipgloss](https://github.com/charmbracelet/lipgloss) from 0.9.0 to 0.9.1. - [Release notes](https://github.com/charmbracelet/lipgloss/releases) - [Commits](https://github.com/charmbracelet/lipgloss/compare/v0.9.0...v0.9.1) --- updated-dependencies: - dependency-name: github.com/charmbracelet/lipgloss dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-10-12 11:10:56 -04:00
dependabot[bot]	538fe5ee1d	chore(deps): bump github/codeql-action from 2.22.1 to 2.22.2 (#2224) ... Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.22.1 to 2.22.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/fdcae64e1484d349b3366718cdfef3d404390e85...d90b8d79de6dc1f58e83a1499aa58d6c93dc28de) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-10-12 11:10:45 -04:00
Colm O hEigeartaigh	2687100e6a	Detect a license file in the root directory or META-INF of a jar (#2213) ... Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>	2023-10-12 11:09:53 -04:00
Benji VisserandAlex Goodman	fe7a417fb2	Parse donet dependency trees (#2143) ... * add dependency information for .NET pkgs Signed-off-by: Benji Visser <benji@093b.org> * update pkg coverage directory test Signed-off-by: Benji Visser <benji@093b.org> * reverse dependsOn relationship Signed-off-by: Benji Visser <benji@093b.org> * update root pkg parsing Signed-off-by: Benji Visser <benji@093b.org> * add comments about the test relationships represented Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add docs around relationship sorting functions + update test helpers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Benji Visser <benji@093b.org> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-11 18:01:24 +00:00
dependabot[bot]	7732cd3b48	chore(deps): bump golang.org/x/net from 0.16.0 to 0.17.0 (#2214) ... Bumps [golang.org/x/net](https://github.com/golang/net) from 0.16.0 to 0.17.0. - [Commits](https://github.com/golang/net/compare/v0.16.0...v0.17.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-10-11 13:52:07 -04:00
dependabot[bot]	0302fc5b48	chore(deps): bump github.com/google/go-cmp from 0.5.9 to 0.6.0 (#2215) ... Bumps [github.com/google/go-cmp](https://github.com/google/go-cmp) from 0.5.9 to 0.6.0. - [Release notes](https://github.com/google/go-cmp/releases) - [Commits](https://github.com/google/go-cmp/compare/v0.5.9...v0.6.0) --- updated-dependencies: - dependency-name: github.com/google/go-cmp dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-10-11 09:53:00 -04:00
dependabot[bot]	b899536814	chore(deps): bump github.com/charmbracelet/lipgloss from 0.8.0 to 0.9.0 (#2216) ... Bumps [github.com/charmbracelet/lipgloss](https://github.com/charmbracelet/lipgloss) from 0.8.0 to 0.9.0. - [Release notes](https://github.com/charmbracelet/lipgloss/releases) - [Commits](https://github.com/charmbracelet/lipgloss/compare/v0.8.0...v0.9.0) --- updated-dependencies: - dependency-name: github.com/charmbracelet/lipgloss dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-10-11 09:52:42 -04:00
Christopher Angelo PhillipsandAlex Goodman	d1120ad56e	chore: add automated homebrew action (#2164) ... * chore: add automated homebrew action Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * migrate homebrew publish step to separate post-release workflow Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-11 09:52:22 -04:00
Alex Goodman	ef759038f5	Add relationships for dpkg packages (#2212) ... * add relationships for deb packages Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * small refactor to remove duplicate code Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-11 08:56:26 -04:00
4 people	0748945c83	Parse the Maven license from the pom.xml if not contained in the mani… (#2115) ... * Parse the Maven license from the pom.xml if not contained in the manifest Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org> * chore: restore 10.0.2 schema Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * chore: generate new 11.0.1 schema Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * refactor: remove schema change Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * test: update unit tests to align with new pattern Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * chore: pr feedback Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * chore: remove struct tags Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * keep license name and url semantics preserved on the pkg object Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org> Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com> v0.93.0	2023-10-10 13:09:44 -04:00
Alex Goodman	185d0d1bfa	Refine the docs for building a cataloger (#2175) ... * refine the docs for building a cataloger Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * incorporate comments Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2023-10-09 13:44:38 -04:00
Mohammad Sharief Baig	d16ecdf715	Fix algo lookup by converting key to lower case (#2207) ... Signed-off-by: Mohammad Sharief Baig <shariefmohammad007@gmail.com>	2023-10-09 13:07:18 -04:00
dependabot[bot]	68cf57ed03	chore(deps): bump github/codeql-action from 2.22.0 to 2.22.1 (#2208) ... Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.22.0 to 2.22.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2cb752a87e96af96708ab57187ab6372ee1973ab...fdcae64e1484d349b3366718cdfef3d404390e85) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-10-09 13:05:57 -04:00