Alex Goodman
d0e1e7be05
Harden cataloger parsers against truncated input (do not panic) ( #5355 )
...
* fix(javascript): don't panic on a yarn v1 lockfile line missing its value
A v1 `yarn.lock` dependency line without a version constraint, or a
`version`/`resolved`/`integrity` line without a value, indexed past the end of
the split line. Such dependencies are now skipped and empty fields left empty.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(alpine): don't panic on an apk db ACL or checksum line before its entry
An `M:`, `a:` or `Z:` line that comes before any directory or file entry in
`lib/apk/db/installed` indexed `files[-1]`. Such a line is now skipped.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(erlang): don't panic on a truncated rebar.lock or .app file
The term parser read past the end of the input when a file ended mid-term:
whitespace only, an unclosed list, a lone `<`, or a comment ending in `\r`.
These now return an "unexpected end of input" error.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(lua): don't panic on a truncated .rockspec
The rockspec parser read past the end of the input when a file ended mid-statement:
a lone `[`, an unclosed `[[...]]` value or `[...]` index, or a `local` assignment cut off
before its `=`, value, or line end. These now return an "unexpected end of input" error.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(swift): don't panic on a Podfile.lock pod without a version
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(gentoo): don't panic on a short obj line in portage CONTENTS
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(spdx): don't panic on an opam checksum without an algorithm
The opam cataloger stores checksums verbatim, so a malformed one reached the SPDX encoder and panicked there, outside the cataloger's recover. Checksums without an `=` are now skipped.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* refactor: use strings.Cut where a split was only indexed after a Contains check
Also guards `windows.FromPosix` against a path with no separator.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* test: guard untyped package metadata fields
- new `any`-typed metadata fields must be allowlisted with a reason
- allowlisted untyped fields are pushed through `SetID` and every encoder with
non-finite, deeply nested and large values
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* test: fuzz every generic cataloger parser
One fuzz target over every glob-selected parser in the capabilities data, run
through its cataloger task. Each input must not panic, must finish in time and
must keep allocations proportional to its size. Seeds come from each parser's
testdata plus the string literals in its package.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* test: scan malformed inputs under memory and time limits
A directory of small malformed files (deep nesting, oversized declared counts,
truncation, type mismatches, non-finite floats) is scanned by the CLI with a
memory limit and an RSS ceiling. The scan must exit 0 and write an SBOM.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* test: stop a fuzz input once its live heap passes the allocation limit
The allocation check only ran after the parser returned, so an input on its way to exhausting memory ran the machine into swap first. The harness now polls the live heap while the parser runs and panics past the same limit, which the fuzz engine saves as a crasher.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix: bound nesting depth and error context in the erlang and lua parsers
- a deeply nested rebar.lock or .rockspec overflowed the goroutine stack, which is fatal rather than a recoverable panic, so one file could take down the whole scan. Both parsers now stop at 1000 levels with an error.
- parse errors echoed whole input lines into the SBOM as unknowns, and lua appended another copy at every nesting level. `PrintError` now clips to a window around the error column, and lua decorates once at the top.
- the Podfile.lock error no longer echoes the pod entry.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* test: close ways the malformed-input checks could pass quietly
- a ctx-aware parser hitting the fuzz timeout now fails the input instead of racing the hard deadline
- the heap watchdog measures growth from a post-GC baseline rather than an absolute process-wide number
- a saved fuzz input naming a target that no longer exists fails instead of being skipped
- the CLI malformed-input scan fails on a recovered parser panic, not only on a non-zero exit
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-09-29 16:26:42 -04:00
Christopher Angelo Phillips and Alex Goodman
aff2c247db
feat: add safe tensor model type to SBOM output ( #4844 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-07-15 17:14:03 -04:00
gab and Alex Goodman
656a4d46d7
Vcpkg Cataloger ( #4081 )
...
* Vcpkg cataloger for vcpkg "Manifest Mode"
Find and parse vcpkg-lock.json to get HEAD commit hash
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* just use local vcpkg git repo if it exists, clone it if it doesn't
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* Config opt for git remote clones for vcpkg and README update
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
* Look in vcpkg cache git repo for custom git repos
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add triplet to metadata and support overlay-ports from config file
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* Add PURL to packages (not sure if this is correct)
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* flatten structs in pkg module and move vcpkg structs to resolver
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* account for overriden versions in toplevel manifest
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* generate json schema for vcpkg metadata
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
* test for basic vcpkg project
dependencies for vcpkg registry to be pulled in
add tree hashes and use correct git hash in builtin-baseline for helloworld test
vcpkg-registry for testing that uses object hashes from syft repo
fix broken tests
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
* formatting
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
* fix static-analysis violations
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix integration test failure
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
* remove uneeded files from vcpkg test fixture and use custom registry
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
* change vcpkg registry to anchore one
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* purl spec based on open PR
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* generate-json-schema
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rebased and generate json schema 16.0.40
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
* address low hanging fruit
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* handle additional comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* migrate to testdata
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* improve docs and testing
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix static analysis
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove license from pkg metadata
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix capabilities claim
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-07-01 09:11:33 -04:00
Rez Moss and Alex Goodman
148fe572bc
added macOS .app cataloger ( #4490 )
...
* added macOS .app cataloger, fixed #4010
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* added macOS .app cataloger, fixed #4010
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* added macOS .app cataloger, fixed #4010
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address review comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump schema to 16.1.7
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address static analysis failures
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* migrate to testdata
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* expand fields and improve test coverage
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-30 10:32:57 -04:00
Rez Moss and Christopher Phillips
fea4a50124
feat: deno cataloger #4417 ( #4523 )
...
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2026-06-23 10:58:22 -04:00
Yoonho Hann and Christopher Phillips
b08d3c2970
feat: add support for Bun lockfile ( #4625 )
...
---------
Signed-off-by: Yoonho Hann <hnnynh125@gmail.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2026-06-09 13:22:43 -04:00
anchore-oss-update-bot and anchore-oss-update-bot
5b58ec96b7
chore(deps): update Go version ( #4773 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-04-15 10:01:39 -04:00
Christopher Angelo Phillips and Alex Goodman
2c5e193f7a
feat: Add support for scanning GGUF models from OCI registries ( #4335 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-02-09 16:05:52 -05:00
b3c70da3ea
Add experimental cataloger capabilities command ( #4317 )
...
* add info command from generated capabilities
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* correct gentoo and arch ecosystems
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename os pkg types
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* better binary cataloger description
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* expose metadata and pacakge types in json
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* expose json schema types
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add completeness tests for metadata types
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* latest generation
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* improve testing a docs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests and linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* restore goreleaser config
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* tweak diagram
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix pdm
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* chore: java binary data
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* new capability descriptions for gguf and python
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* correct poetry lock integrity hash claim
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix compile error
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix: remove purl version from overrides
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* fix lua deps ref
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* keep gguf as ai ecosystem
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* split packages.yaml to multiple files by go package
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* ensure tests do not use go test cache
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* sort json output for info command
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* docs: fix ocaml, php, and portage capabilities yaml
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* chore: update erlang capabilities
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* chore: update java capabilities
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* chore: update javascript capabilities
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* chore: update linux kernel capabilities
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* remove missing tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix package.yaml references
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* revert license list change
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* check for drift in capability descriptions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate capabilities
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* test cleanup
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use fixture cache in static analysis
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* claim fixtures pre-req for cap generation
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update documentation with correct regeneration procedure
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* chore: ruby-gemspec-cataloger finds no dependencies
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* chore: fix python docs and config comment
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* chore: commit re-generated java yaml
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* add cataloger selection to caps command
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* re-generate cap yamls
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests for cataloger selection
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix cli test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add missing tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename cmd to `cataloger info`
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] change capability description locations
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] continued
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] adjust for import cycles
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* correct docs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2025-12-22 19:34:10 +00:00
VictorHuu and Christopher Phillips
afe28a2fc0
fix:handle compound aliases like ``.tgz`` when cataloging archives ( #4421 )
...
---------
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-12-02 16:55:32 -05:00
Christopher Angelo Phillips
4a60c41f38
feat: 4184 gguf parser (ai artifact cataloger) part 1 ( #4279 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-11-13 17:43:48 -05:00
Tim Olshansky
4e06a7ab32
feat(javascript): Add dependency parsing ( #4304 )
...
* feat: Add dependency parsing to javascript package locks
Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com >
* Bump schema version
Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com >
* Add support for yarn and pnpm, excl. yarn v1
Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com >
* Add support for dependencies for v1 yarn lock files
Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com >
* Ensure schema is correctly generated
Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com >
* Fix tests
Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com >
* PR feedback
Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com >
---------
Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com >
2025-11-06 16:03:43 -05:00
Alex Goodman
e5711e9b42
Update CPE processing to use NVD API ( #4332 )
...
* update NVD CPE dictionary processor to use API
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* pass linting with exceptions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-11-06 16:02:26 -05:00
Pavel Buchart and Keith Zantow
e923db2a94
Add PDM parser ( #4234 )
...
Signed-off-by: Pavel Buchart <pavel@buchart.cz >
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
2025-10-16 08:50:44 -04:00
Alex Goodman
d22914baf5
add docs to configs ( #4281 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-10-14 13:58:31 -04:00
Alex Goodman
4ae8f73583
migrate json schema generation ( #4270 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-10-10 14:16:28 +00:00
