Keith Zantow
a1f7c52d89
fix: unknowns, better full vs local path handling
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2026-10-20 11:15:17 -04:00
Keith Zantow
3e4b036e22
fix: keep RealPath as top-level, use FullPath and utility functions FullNestedPath, LocalPath, Path
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2026-10-19 15:44:37 -04:00
Alex Goodman
23de18918e
fix: run root file catalogers after the archive task with owned-by-package selection
...
with nested cataloging on, java leaves root-level archives to the archive task, so a root `app.jar` package only exists once that task has run. With the default `FilesOwnedByPackageSelection` the root file catalogers ran in an earlier group, never saw the package, and `app.jar` got no file metadata or digests. It did get them with the feature off.
- in owned-by-package mode the groups are now packages, then the archive task, then the root file tasks. Other modes are unchanged
- the file tasks merge their results into the SBOM instead of replacing the maps, since the archive task has already written nested files into them
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-09-24 13:34:09 -04:00
Alex Goodman
9d820c6d94
fix: only look up owned-by-package files in the resolver's own frame
...
with `FilesOwnedByPackageSelection` the file catalogers take every package location in the SBOM and look it up by `RealPath` in the resolver they were given. Inside an archive, the java package's location is the archive itself *in its parent's frame* (`WEB-INF/lib/dep.jar`), so the sub-pipeline looked that path up inside `dep.jar`'s own resolver: a miss, or an unrelated same-named entry by coincidence. At the root, coordinates from inside archives were looked up against the scan root the same way.
`coordinatesForSelection` now keeps only coordinates whose `ArchivePath` matches the current frame (the traversal's `ContentsArchivePath()`, or blank at the root).
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-09-24 13:30:33 -04:00
Keith Zantow
4a9437808e
feat: parallelize catalogers per-file and hash contents in parallel ( #3636 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-03-26 11:10:08 -04:00
Alex Goodman
684b6e3f98
Add file catalogers to selection configuration ( #3505 )
...
* add file catalogers to selection configuration
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix typos
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* warn when there is conflicting file cataloging configuration
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* allow for explicit removal of all package and file tasks
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address PR feedback
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-02-03 19:10:17 +00:00
Keith Zantow and Alex Goodman
ccbee94b87
feat: report unknowns in sbom ( #2998 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-10-07 16:11:37 -04:00
Alex Goodman
13c6876906
Track supporting DPKG evidence ( #3228 )
...
* add dpkg evidence support
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use path over filepath
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-10-04 11:07:29 -04:00
17ef243956
chore(deps): update tools to latest versions ( #2616 )
...
* chore(deps): update tools to latest versions
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* fix: update to new linter rules
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2024-02-14 14:59:49 +00:00
Alex Goodman
3023a5a7bc
Detect ELF security features ( #2443 )
...
* add detection of ELF security features
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update json schema with file executable data
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update expected fixure when no tty present
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* more detailed differ
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use json differ
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove json schema addition
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix mimtype set ref
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-02 16:51:18 +00:00
Alex Goodman
cdad5e767a
plumb context through catalogers ( #2528 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-22 15:54:51 -05:00
Alex Goodman
b0ab75fd89
Replace core SBOM-creation API with builder pattern ( #1383 )
...
* remove existing cataloging API
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add file cataloging config
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add package cataloging config
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add configs for cross-cutting concerns
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename CLI option configs to not require import aliases later
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update all nested structs for the Catalog struct
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update Catalog cli options
- add new cataloger selection options (selection and default)
- remove the excludeBinaryOverlapByOwnership
- deprecate "catalogers" flag
- add new javascript configuration
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* migrate relationship capabilities to separate internal package
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* refactor golang cataloger to use configuration options when creating packages
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* create internal object to facilitate reading from and writing to an SBOM
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* create a command-like object (task) to facilitate partial SBOM creation
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add cataloger selection capability
- be able to parse string expressions into a set of resolved actions against sets
- be able to use expressions to select/add/remove tasks to/from the final set of tasks to run
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add package, file, and environment related tasks
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update existing file catalogers to use nested UI elements
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add CreateSBOMConfig that drives the SBOM creation process
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* capture SBOM creation info as a struct
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add CreateSBOM() function
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update docs with SBOM selection help + breaking changes
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix multiple override default inputs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix deprecation flag printing to stdout
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* refactor cataloger selection description to separate object
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address review comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* keep expression errors and show specific suggestions only
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address additional review feedback
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address more review comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* addressed additional PR review feedback
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix file selection references
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove guess language data generation option
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add tests for coordinatesForSelection
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename relationship attributes
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add descriptions to relationships config fields
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* improve documentation around configuration options
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add explicit errors around legacy config entries
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-12 17:39:13 -05:00
Keith Zantow
Alex Goodman
