oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-30 14:02:26 +01:00
Code Issues Packages Projects Releases Wiki Activity
1,198 Commits 65 Branches 273 Tags
bc1edb9c8a2fb4824bfdcac6147edc2bbf47aaf6
Commit Graph
44 Commits
Author SHA1 Message Date
patrikbenoTom FayAlex Goodman
 		0c4b99c1c2 SBOM cataloger (#1029) 
* SBOM cataloger

Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk>

* sbom-cataloger: turn off by default

and add integration test

Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk>

* SBOM cataloger

Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk>

* SBOM cataloger (optimize)

Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk>

* SBOM cataloger (fix)

Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk>

* SBOM cataloger (fix imports #1172)

Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk>

* SBOM cataloger (fix: support group attribute in CDX SBOMs)

Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk>

* port to generic cataloger and add relationship to original file

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* generalize parser for all format globs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Co-authored-by: Tom Fay <tomfay@microsoft.com>
Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2022-11-16 14:11:45 -05:00
Keith Zantow 4d2f18218c fix: Follow symlinks when searching for globs in all-layers scope (#1221) 2022-09-30 13:01:08 -04:00
Keith Zantow 7d4f333ec4 enhance development support on macOS ARM (#1163) 2022-08-24 13:48:14 -04:00
Tom Fay 9896ff1b1f add a cataloger for binaries built with rust-audit (#1116) 
* add a cataloger for binaries built with rust-audit

Signed-off-by: Tom Fay <tomfay@microsoft.com>
 2022-07-28 18:17:38 +00:00
cpendery 9b1adce19a feat: implement haskell support (#1096) 2022-07-18 15:33:54 -04:00
cpendery 470b13045b feat: add support for cocoapods (Swift/Objective-C) (#1081) 2022-07-11 10:09:08 -04:00
Zac MedicoandChristopher Phillips 4c55c62834 Add portage support for Gentoo Linux (#1076) 
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-07-06 16:18:54 -04:00
cpendery 57323a1666 feat: add support for conan packages (C/C++) (#1083) 2022-07-05 10:49:24 -04:00
MikiandChristopher Phillips d5e12ff89c Updates parsing of yarn.lock to use resolved URLs that are pulled from yarn and npm registries (#926) 
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-06-24 11:05:25 -04:00
Jonas XavierandChristopher Phillips 1d14f22e45 add pom.xml cataloger (#1055) 
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-06-22 14:19:10 -04:00
Tom Fay 3f6afd572a Add support for CBL-Mariner distroless images (#1045) 2022-06-21 13:27:03 -04:00
Morten LinderudandChristopher Phillips e72d68b0c6 Add pacman (alpm) parser support (#943) 
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-06-13 18:51:37 +00:00
Tom FayandAlex Goodman 3db3efacdc Support RPM distros with newer RPM db formats (#1018) 
* Support RPM distros with newer db formats

Recent RPM distros (Fedora 33+, CBL-Mariner 2.0+, amazonlinux 2022+)
use an sqlite package database in /var/lib/rpm/rpmdb.sqlite, or
"ndb" format (SUSE).

Remove anchore's fork in favour of the upstream,
https://github.com/knqyf263/go-rpmdb, to gain support for
these formats.

Signed-off-by: Tom Fay <tomfay@microsoft.com>

* add exception for modernc.org repos

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* shorten rpmdb helper function

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2022-05-31 17:25:22 -04:00
Christian KotzbauerandAlex Goodman 1cea0ecd5c feat: add initial dotnet-support (#951) 
* feat: add initial dotnet-support

Signed-off-by: Christian Kotzbauer <git@ckotzbauer.de>

* fix: add path, sha512 and hashpath

Signed-off-by: Christian Kotzbauer <git@ckotzbauer.de>

* fix: add missing dot

Signed-off-by: Christian Kotzbauer <git@ckotzbauer.de>

* fix: lint warnings

Signed-off-by: Christian Kotzbauer <git@ckotzbauer.de>

* fix CLI test package counts to account for dotnet

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix: updated packagurl-go

Signed-off-by: Christian Kotzbauer <git@ckotzbauer.de>

* tidy go.sum

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update json schema

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2022-05-05 15:32:02 -04:00
Alex Goodman f24bbc1838 Deduplicate packages across multiple container image layers (#930) 2022-03-31 15:45:51 -04:00
Eric LarssenandAlex Goodman cb3e73e308 Add dart support (#919) 
Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2022-03-31 15:44:55 -04:00
Alex Goodman 706f291679 Replace distro type (#742) 
* remove strong distro type

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* bump json schema to v3 (breaking distro shape)

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* allow for v2 decoding of distro idLikes field in v3 json decoder

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix casing in simple linux release name

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* use discovered name as pretty name in simple linux release

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-01-12 12:13:42 -05:00
Blaize KayeandAlex Goodman 6af132e088 Adds composer installed.json parser (#643) 
* Adds installed.json functionality and tests

Signed-off-by: Blaize Kaye <blaize.kaye@amazee.com>

* Adds php-installed-cataloger

Signed-off-by: Blaize Kaye <blaize.kaye@amazee.com>

* Changes fallback logic

Signed-off-by: Blaize Kaye <blaize.kaye@amazee.com>

* Adds image tests for installed.json composer packages

Signed-off-by: Blaize Kaye <blaize.kaye@amazee.com>

* tweak PHP cataloger names

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* unexport PHP types and fix CLI tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* rename PHP cataloger file

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-30 11:36:08 -05:00
NikitaandAlex Goodman 25835ef589 PHP parser composer.lock (#609) 
* PHP parse composer.lock

Signed-off-by: Nikita <33390074+Zilborg@users.noreply.github.com>

* rename PHP package type

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add PHP composer package support to source info SPDX helper

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update directory cataloger integration tests (make exception for images)

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-10 14:08:41 -05:00
Alex GoodmanandChristopher Angelo Phillips bb0f35bac4 Introduce a single SBOM document (#606) 
* [wip] single sbom doc

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix more tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update cli tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove scope in import path

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* swap SPDX tag-value formatter to single sbom document

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* bust CLI cache

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update fixture to byte diff

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* byte for byte

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* bust the cache

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* who needs cache

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* add jar for testing

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* no more bit flips

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* update apk with the delta for image and directory cases

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* restore cache workflow

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

Co-authored-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-11-05 10:05:49 -04:00
Christopher Angelo PhillipsandAlex Goodman 3462e18af3 478 identify go binaries and extract mod information (#534) 
* add query by MIME type to source.FileResolver

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* import stereoscope lib changes to find mime type

- add bin cataloger
- add bin parser
- add mime type go utils
- import new resolver

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* add go std library code to unpack bin

- keep them in their own (original) files
- add note for "this code was copied from"
- comment the lines the required changing

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-07 12:16:38 -04:00
Keith Zantow ff828fbac2 Skip package-lock.json and yarn.lock in node_modules #431 (#485) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2021-08-20 13:50:28 -04:00
Weston Steimel ba81bfe529 add cataloger for rust crates from Cargo.lock files 
Signed-off-by: Weston Steimel <weston.steimel@gmail.com>
 2021-03-18 03:12:51 +00:00
Weston Steimel 6c80f9910f add to dpkg integration test cases to detect packages from /var/lib/dpkg/status.d/ 
Signed-off-by: Weston Steimel <weston.steimel@gmail.com>
 2021-02-27 01:58:59 +00:00
Alex Goodman 6d5ff0fd8e Mark package relations by file ownership (#329) 
* add marking package relations by file ownership

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* correct json schema version; ensure fileOwners dont return dups; pin test pkg versions

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* extract package relationships into separate section

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* pull in client-go features for import of PackageRelationships

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* move unit test for ownership by files relationship further down

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* rename relationship to "ownership-by-file-overlap"

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-02-25 13:47:13 -05:00
Dan Luhring 0ccfee03f1 Fix dependency resolution issue in test image 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-01-27 10:30:49 -05:00
Dan Luhring ae7cd6bbb7 Add test for Java cataloging with no main package 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-01-27 10:12:41 -05:00
Dan Luhring 9ec3ad58c8 Update regression test expected value and pin deps 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-01-22 14:03:50 -05:00
Alex Goodman 133d180eec update gemspec glob to include named spec dirs 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-01-04 19:33:52 -05:00
Alex Goodman 2e5ff4a995 add top_level.txt processing to python package cataloger 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-10-22 12:39:03 -04:00
Alex Goodman 1414d1fbc3 add test coverage for python pacakge cataloger and update catalog interface 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-10-22 09:51:29 -04:00
Alex Goodman 0ce8701e73 split python package catalogers by image vs directory 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-10-21 11:48:26 -04:00
Toure Dunnon 27c62e34f2 Add support for package.json #200 
Signed-off-by: Toure Dunnon <toure.dunnon@anchore.com>
 2020-10-16 11:28:54 -04:00
Alex Goodman 5d0909f31e add regression test to cover issue #212 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-10-14 07:22:19 -04:00
Alex Goodman 335a6b022f add acceptance test to cover gem cataloger + fix gem cataloger parent dir (#207) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-10-08 13:13:31 -04:00
Alex Goodman 10b44f5311 split catalogers into two sets, one for images another for directory scans 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-10-08 10:23:24 -04:00
Sam Dacanay 11334b632e Expand matching of requirements.txt file to include any prefixes or suffixes (#168) 
* Expand matching of requirements.txt file to include any prefixes or suffixes

Signed-off-by: Samuel Dacanay <sam.dacanay@anchore.com>

* Add some test cases to integration test (ensure syft can pick up multiple requirements files)

Signed-off-by: Samuel Dacanay <sam.dacanay@anchore.com>

* Run lint-fix

Signed-off-by: Samuel Dacanay <sam.dacanay@anchore.com>
 2020-09-08 10:23:37 -07:00
Alfredo Deza 861806f1dd test: add setup.py integration cases 
Signed-off-by: Alfredo Deza <adeza@anchore.com>
 2020-08-17 16:00:49 -04:00
Alex Goodman e2a874a277 finalize json output & add schema (#118) 2020-08-04 16:05:53 -04:00
Alfredo Deza caecce9b41 tests: update integration tests to include yarn packages 
Signed-off-by: Alfredo Deza <adeza@anchore.com>
 2020-07-28 15:35:45 -04:00
Alex Goodman 9ec5da24dd fix py globs to include partial matches (#101) 2020-07-24 08:22:56 -04:00
Alex Goodman a4016d35ce rename to syft 2020-07-23 20:54:04 -04:00
Alex Goodman 2132700198 add apk/alpine support (#98) 2020-07-23 20:35:57 -04:00
Alex GoodmanandAlfredo Deza ba4f63099d Add release process (#89) 
* add check for app update; fix ETUI error handling

* validate user args

* add goreleaser support

* replace cgo dependencies (go-rpm) with go equivalents

* add acceptance tests against build snapshot

* add brew tap + acceptance test pipeline

* add mac acceptance tests

* fix compare makefile

* fix mac acceptance tests

* add release pipeline with wait checks

* add token to release step

* rm dir presenters int test

* enforce dpkg to be non interactive

Co-authored-by: Alfredo Deza <adeza@anchore.com>

* pin brew formulae

* pin skopeo to formulae url

* only run acceptance tests

Co-authored-by: Alfredo Deza <adeza@anchore.com>
 2020-07-23 10:52:44 -04:00