oss/syft - syft - Sa' Rocí Solutions

oss/syft

mirror of https://github.com/anchore/syft.git synced 2026-11-05 00:46:38 +01:00

Author	SHA1	Message	Date
Alex Goodman	cbce129bb9	Use reader when scanning for package versions over reading entire binary into memory (#3558 ) * use streaming readers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * replace redis search patterns Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * address PR feedback Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-01-02 22:12:37 +00:00
witchcraze	2118295f19	fix: dart classifier for 2.x and ARM (#3475 ) Signed-off-by: witchcraze <witchcraze@gmail.com>	2024-11-22 13:05:09 -05:00
witchcraze	066aadb4d1	update node classifier (#3419 ) Signed-off-by: witchcraze <witchcraze@gmail.com>	2024-11-12 08:38:43 -05:00
Christopher Angelo PhillipsandKeith Zantow	8a41d77250	chore: prevent file resolver from bubbling errors in binary cataloger (#3410 ) Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> Signed-off-by: Keith Zantow <kzantow@gmail.com> Co-authored-by: Keith Zantow <kzantow@gmail.com>	2024-11-04 20:23:27 +00:00
Weston Steimel	d7194bb00f	fix: improve mariadb binary classifer to detect older versions (#3339 ) With older versions of mariadb the binary name was `mysql`, so this adjusts the binary classifier to additionally search for the expected version pattern in `mysql` binaries. Signed-off-by: Weston Steimel <commits@weston.slmail.me>	2024-10-16 12:43:50 -04:00
William Murphy	754cebee64	fix: stop some log.Warn spam due parsing an empty string as a CPE (#3330 ) * chore: don't try to parse empty string as CPE Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * chore: improve OS name and version extraction from ELF metadata Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> --------- Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>	2024-10-15 08:50:47 -04:00
Keith ZantowandAlex Goodman	ccbee94b87	feat: report unknowns in sbom (#2998 ) Signed-off-by: Keith Zantow <kzantow@gmail.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-10-07 16:11:37 -04:00
William MurphyandChristopher Phillips	770fdc53ea	Fix: make failed CPE validation correctly return error (#2762 ) * Test CPE attributes correctly returns error Previously, this method incorrectly return an empty Attributes object and a nil error, leading to callers attempting to use the empty attributes object. Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: merge with main and refactor call that relied on old nil behavior Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> * test: add test to cover new OSCPE err pattern Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> --------- Signed-off-by: Will Murphy <will.murphy@anchore.com> Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2024-10-03 16:42:57 -04:00
witchcraze	263ea6b1bb	feat: update haproxy classifier (#3277 ) Signed-off-by: witchcraze <witchcraze@gmail.com>	2024-10-02 15:10:39 -04:00
witchcraze	f5f8005fe0	update redis classifier (#3281 ) * update redis classifier Signed-off-by: witchcraze <witchcraze@gmail.com> * Remove snippets to pass Validation. In this case, 9000 byte was required... Signed-off-by: witchcraze <witchcraze@gmail.com>	2024-09-30 15:37:47 -04:00
witchcraze	2a3d171c10	fix: improve node classifier version matching (#3284 ) Signed-off-by: witchcraze <witchcraze@gmail.com>	2024-09-27 08:53:35 -04:00
witchcraze	1a746b2c05	fix: update ruby classifier for -rc, -dev, etc. versions (#3285 ) Signed-off-by: witchcraze <witchcraze@gmail.com>	2024-09-27 08:51:50 -04:00
Laurent Goderre	7815d8e4d9	feat: classifier for Dart lang binaries (#3265 ) Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-09-23 14:21:31 -04:00
Krystian G.Krystian Gorny Alex Goodman	6a95a5f2ed	feat: add binary classifiers for lighttp, proftpd, zstd, xz, gzip, jq, and sqlcipher (#3252 ) * feat: detect lighttpd binaries Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com> * feat: detect proftpd binaries Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com> * feat: detect zstd binaries Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com> * feat: detect xz utils binarie Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com> * feat: detect gzip binaries Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com> * feat: detect sqlcipher binaries Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com> * feat: detect jq binaries Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com> * add tests + snippets Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Krystian Gorny <krystian.gorny@wipotec.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-09-19 13:21:02 +00:00
Krystian G.andGorny Krystian	cb0de97bc3	fix: capture-snippet.sh can handle leading whitespaces now (#3249 ) (#3250 ) Signed-off-by: Gorny Krystian <krystian.gorny@wipotec.com> Co-authored-by: Gorny Krystian <krystian.gorny@wipotec.com>	2024-09-19 09:15:54 -04:00
Laurent Goderre	dbc4238f63	Add haskell binaries cataloger (#3078 ) Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-09-10 10:58:20 -04:00
Alex Goodman	0a3f513f92	Slim down docker cache size (#3190 ) * slim down docker cache size Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove old centos images Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * troubleshoot test failure Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix wget version ref Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * refactor caching mechanisms Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add cache cleanup steps Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * simplify deleting cache Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix first clone issue Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tool dep Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-09-09 11:15:13 -04:00
witchcraze	a343825685	fix: haproxy classifier for versions with -dev suffix (#3180 ) Signed-off-by: witchcraze <witchcraze@gmail.com>	2024-09-05 14:52:19 -04:00
Weston Steimel	5ab43bafec	fix: improve known CPEs and set NVD as source for all current binary classifiers (#3167 ) Signed-off-by: Weston Steimel <commits@weston.slmail.me>	2024-08-27 17:36:34 +01:00
Alex Goodman	e9a8c27be1	respond to authoratative CPEs from catalogers (#3166 ) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-08-27 10:26:35 -04:00
Weston Steimel	99be365f62	fix: use official CPE for curl binary cataloger (#3164 ) The official CPE for curl is `cpe:2.3:a:haxx:curl::::::::` Signed-off-by: Weston Steimel <commits@weston.slmail.me>	2024-08-27 14:03:19 +01:00
anchore-actions-token-generator[bot]	dad253785e	chore(deps): update tools to latest versions (#3144 )	2024-08-23 14:42:12 -04:00
KrysGor	cff9d494df	feat: detect curl binaries (#3146 )	2024-08-23 14:41:08 -04:00
Keith Zantow	73b9d5aa42	fix: mysql 8.0.3x binary detection (#3142 ) Signed-off-by: Keith Zantow <kzantow@gmail.com>	2024-08-21 09:48:28 -04:00
Laurent Goderre	92d63df6f5	Added the SWI Prolog (swipl) ecosystem (#3076 ) * Add binary classifier for swipl Signed-off-by: Laurent Goderre <laurent.goderre@docker.com> * Added cataloger for SWI Prolog Pack packages Signed-off-by: Laurent Goderre <laurent.goderre@docker.com> --------- Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-07-31 16:13:26 -04:00
witchcraze	490e05adb2	fix: traefik classifier (#3077 ) Signed-off-by: witchcraze <witchcraze@gmail.com>	2024-07-29 09:46:51 -04:00
dependabot[bot]andChristopher Phillips	fe7c5a7174	chore(deps): bump github.com/charmbracelet/lipgloss from 0.11.1 to 0.12.1 (#3040 ) * chore(deps): bump github.com/charmbracelet/lipgloss Bumps [github.com/charmbracelet/lipgloss](https://github.com/charmbracelet/lipgloss) from 0.11.1 to 0.12.1. - [Release notes](https://github.com/charmbracelet/lipgloss/releases) - [Changelog](https://github.com/charmbracelet/lipgloss/blob/master/.goreleaser.yml) - [Commits](https://github.com/charmbracelet/lipgloss/compare/v0.11.1...v0.12.1) --- updated-dependencies: - dependency-name: github.com/charmbracelet/lipgloss dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore: pin fedora linux/amd64 to sha Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2024-07-22 10:43:17 -07:00
Keith Zantow	278b72d39b	chore: pin fedora image for elf binary test (#3041 ) Signed-off-by: Keith Zantow <kzantow@gmail.com>	2024-07-15 16:37:09 +00:00
Alex Goodman	573440b7cf	Infer the package type from ELF package notes (#3008 ) * fix ELF package types to be honored Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * prefer OS packages over binary packages when there are duplicates Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-07-02 16:07:08 -04:00
Laurent Goderre	ceced5eb27	Add detection of Erlang in Alpine linux (#2996 ) Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-06-25 14:40:40 -07:00
Laurent Goderre	7a35de04ee	fix: detection of arangodb 3.12 (#2979 ) Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-06-20 11:11:03 -04:00
Alex Goodman	254a562b4e	Add support for reading ELF package notes with section header (#2939 ) * add support for reading ELF package notes with section header Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add systemd elf package fields to json schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-06-07 14:38:54 -04:00
Brian Ebarb	5cdc0845fb	feat: add license field to ELF binary package metadata (#2890 ) Signed-off-by: Brian Ebarb <ebarb.brian@gmail.com> feat: add License component to elf binary packages Signed-off-by: Brian Ebarb <ebarb.brian@gmail.com> feat: fix elf_package_cataloger test feat: elf package cataloger unit test updates	2024-06-06 14:10:53 +00:00
Laurent Goderre	b608ab77e1	feat: classifier for util-linux (#2933 ) Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-06-05 17:32:52 -04:00
Keith Zantow	ac34808b9c	feat: detect fluent-bit binaries (#2905 ) Signed-off-by: Keith Zantow <kzantow@gmail.com>	2024-05-28 10:13:06 -04:00
Laurent Goderre	7071f1e498	feat: Added functionality to convert major, minor, patch to version for binary classifier (#2864 ) --------- Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-05-23 12:17:12 -04:00
Brian EbarbandAlex Goodman	4194a2cd34	feat: add relationships to ELF package discovery (#2715 ) This PR adds DependencyOf relationships when ELF packages have been discovered by the binary cataloger. The discovered file.Executable type has a []ImportedLibraries that's read from the file when discovered by syft. By mapping these imported libraries back to the package collection, syft is able to create relationships showing which packages are dependencies of other packages by just reading metadata from the ELF executable. --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: Brian Ebarb <ebarb.brian@sers.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-05-09 13:53:59 -04:00
Laurent Goderre	e7b6284039	Add binary classifier for ArangoDB (#2830 ) Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-05-07 12:06:32 -04:00
William Murphy	3713d97b7b	chore: use ruleguard to test for missing defer statements (#2837 ) * chore: ruleguard to enforce defer use Signed-off-by: Will Murphy <will.murphy@anchore.com> * fix go.mod location Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer close in linux release identifier Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: better lint suggestion Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: refactor binary classifier to defer close Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer close readers in gentoo cataloger Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: make go license parsing defer close readers Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer closing readers in alpine apm parser Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer close readers in graalvm parser Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer close readers in debian package parser Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer close readers in alpm parser Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer close readers in executable file cataloger Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer close readers in javascript license parser Signed-off-by: Will Murphy <will.murphy@anchore.com> * chore: defer close readers in go mod parser Signed-off-by: Will Murphy <will.murphy@anchore.com> --------- Signed-off-by: Will Murphy <will.murphy@anchore.com>	2024-05-07 05:42:29 -04:00
Laurent Goderre	5ca26ed3ca	fix: Add missing CPE for traefik, memcached, and postgres binaries (#2845 ) Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-05-06 15:06:30 -04:00
Laurent Goderre	e353214ef8	Add detection for newer version of ErLang/OTP (#2829 ) Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-05-06 11:47:54 -04:00
William Murphy	93a7d2ee27	fix: better clean up of file handles (#2823 ) * always close ELF cataloger file handles The elf-binary-package-cataloger does its own file IO to account for the possibility of a logical ELF package being broken across multiple physical files. However, this casued it to skip the normal invocation pattern in the generic cataloger code that prevented file leaks. Ensure this cataloger always closes its file handles. Signed-off-by: Will Murphy <will.murphy@anchore.com> * defer closing of generic cataloger file handles Otherwise, a panicking cataloger could leak file handles. Signed-off-by: Will Murphy <will.murphy@anchore.com> * add unit test for file closed on panic parser Signed-off-by: Will Murphy <will.murphy@anchore.com> * make invoke parser a static function Signed-off-by: Will Murphy <will.murphy@anchore.com> * push error logging down into invoke parser Signed-off-by: Will Murphy <will.murphy@anchore.com> --------- Signed-off-by: Will Murphy <will.murphy@anchore.com>	2024-05-01 12:58:17 -04:00
Laurent GoderreandKeith Zantow	c9aab4863b	fix: binary character in java version (#2766 ) Signed-off-by: Laurent Goderre <laurent.goderre@docker.com> Signed-off-by: Keith Zantow <kzantow@gmail.com> Co-authored-by: Keith Zantow <kzantow@gmail.com>	2024-04-11 10:32:24 -04:00
Laurent Goderre	619ace65c3	Differentiate between JRE and JDK (#2748 ) Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-04-05 15:10:58 -04:00
Christopher Angelo Phillips	e100776f22	chore: update anchore/packageurl-go to use latest commits (#2746 ) chore: update packageurl-go dependency to use latest commits chore: go mod tidy unit: update + -> %2B --------- Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>	2024-04-04 10:33:51 -04:00
Laurent GoderreandAlex Goodman	cf17bd69b2	Add detection for Oracle GraalVM (#2705 ) Signed-off-by: Laurent Goderre <laurent.goderre@docker.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-03-14 15:40:07 +00:00
brian-ebarb Colleen Divers Alex Goodman	6a2517b5d2	Add ELF binary package cataloger (#2396 ) * feat Adds Elf package catalogger Signed-off-by: Brian Ebarb <ebarb.brian@gmail.com> * Add test fixtures for elf package Signed-off-by: Colleen Divers <colleen.divers@gmail.com> * bump JSON schema to v16.0.6 + expand test fixtures Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * less verbose logging Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove dead test code Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove unreleated swift change Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Brian Ebarb <ebarb.brian@gmail.com> Signed-off-by: Colleen Divers <colleen.divers@gmail.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Colleen Divers <colleen.divers@gmail.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-03-14 11:16:03 -04:00
Harm Weites	356f7c92b4	fix: match OpenSSL letter releases (#2682 ) * chore: match openssl 1.1 letter releases Signed-off-by: Harm Weites <harm@weites.com> * chore: include image sha Signed-off-by: Harm Weites <harm@weites.com> --------- Signed-off-by: Harm Weites <harm@weites.com>	2024-02-29 14:39:23 +00:00
Keith Zantow	a978966cad	feat: add `--from` flag, refactor source providers (#2610 ) Signed-off-by: Keith Zantow <kzantow@gmail.com>	2024-02-27 16:44:37 -05:00
Alex Goodman	0c3b8ca4ed	rename binary classifier cataloger name (#2643 ) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-02-20 13:52:11 -05:00

1 2 3