424 Commits

Include renames

Author	SHA1	Message	Date
witchcraze	e2e5e223ab	feat: mysqld, ndbd, ndbmtd and ndb_mgmd classifier (#4907) ... Signed-off-by: witchcraze <witchcraze@gmail.com>	2026-05-14 11:29:42 -04:00
witchcraze	e2007d9bf2	feat: add aws-lc classifier (#4882) ... Signed-off-by: witchcraze <witchcraze@gmail.com>	2026-05-06 16:43:34 -04:00
Sai Asish Y	758324b3e8	fix: propagate non-EOF errors out of safeCopy (#4807) ... Signed-off-by: SAY-5 <SAY-5@users.noreply.github.com>	2026-04-22 12:06:03 -04:00
anchore-oss-update-botandanchore-oss-update-bot	5b58ec96b7	chore(deps): update Go version (#4773) ... Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com> Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>	2026-04-15 10:01:39 -04:00
Will Murphy	e38851143e	chore: centralize temp files and prefer streaming IO (#4668) ... * chore: centralize temp files and prefer streaming IO Catalogers that create temp files ad-hoc can easily forget cleanup, leaking files on disk. Similarly, io.ReadAll is convenient but risks OOM on large or malicious inputs. Introduce internal/tmpdir to manage all cataloger temp storage under a single root directory with automatic cleanup. Prefer streaming parsers (bufio.Scanner, json/yaml.NewDecoder, io.LimitReader) over buffering entire inputs into memory. Add ruleguard rules to enforce both practices going forward. Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * chore: go back to old release parsing Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * simplify to limit reader in version check Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * chore: regex change postponed Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * simplify supplement release to limitreader Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> --------- Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>	2026-03-18 10:53:51 -04:00
anchore-actions-token-generator[bot]andwagoodman	d2461a9e0a	chore(deps): update SPDX license list (#4637) ... Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>	2026-03-09 11:02:47 -04:00
Alex Goodman	b5e85c3ea5	chore: migrate fixtures to testdata (#4651) ... * migrate fixtures to testdata Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix: correct broken symlinks after testdata migration The migration from test-fixtures to testdata broke several symlinks: - elf-test-fixtures symlinks pointed to old test-fixtures paths - elf-test-fixtures needed to be renamed to elf-testdata - image-pkg-coverage symlink pointed to test-fixtures instead of testdata Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix: handle missing classifiers/bin directory in Makefile The clean-fingerprint target was failing when classifiers/bin doesn't exist (e.g., on fresh clone without downloaded binaries). Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix: add gitignore negation for jar/zip fixtures in test/cli The jar and zip files in test/cli/testdata/image-unknowns were being gitignored by the root .gitignore patterns. This caused them to be untracked and not included when building docker images in CI, resulting in Test_Unknowns failures since the test expects errors from corrupt archive files that weren't present. Add a .gitignore in test/cli/testdata to negate the exclusions for these specific test fixture files. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * switch fixture cache to v2 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * test: update expected versions for rebuilt fixtures Update test expectations for packages that have been updated in upstream repositories when docker images are rebuilt: - glibc: 2.42-r4 → 2.43-r1 (wolfi) - php: 8.2.29 → 8.2.30 (ubuntu/apache) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgrade go Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix: add go-shlex dependency for testdata manager tool The manager tool in syft/pkg/cataloger/binary/testdata/ imports go-shlex, but since it's in a testdata directory, Go doesn't track its dependencies. This caused CI failures when go.mod didn't explicitly list the dependency. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * refactor: move binary classifier manager to internal/ Move the manager tool from testdata/manager to internal/manager so that Go properly tracks its dependencies. Code in testdata directories is ignored by Go for dependency tracking, which caused CI failures when go.mod didn't explicitly list transitive dependencies. This is a cleaner solution than manually adding dependencies to go.mod for code that happens to live in testdata. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix: add gitignore negations for test fixtures blocked by root patterns Multiple test fixtures were being blocked by root-level gitignore patterns like bin/, *.jar, *.tar, and *.exe. This adds targeted .gitignore files with negation patterns to allow these specific test fixtures to be tracked: - syft/linux/testdata/os/busybox/bin/busybox (blocked by bin/) - syft/pkg/cataloger/java/testdata/corrupt/example.{jar,tar} (blocked by *.jar, *.tar) - syft/pkg/cataloger/binary/testdata/classifiers/snippets/go-version-hint/**/bin/go (blocked by bin/) - syft/pkg/cataloger/bitnami/testdata/no-rel/.../bin/redis-server (blocked by bin/) Also updates the bitnami test expectation to include the newly required .gitignore files in the test fixture. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * test: update glibc version expectation (2.43-r1 -> 2.43-r2) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add capability drift check as unit step Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * dont clear test observations before drift detection Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump stereoscope commit to main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2026-03-06 19:42:04 +00:00
Paweł Pałucha	db76d85d51	fix: use correct hashes for empty files (#4620) ... Signed-off-by: Paweł Pałucha <pawel.palucha@chainguard.dev>	2026-02-24 09:52:29 -05:00
Christopher Angelo PhillipsandAlex Goodman	2c5e193f7a	feat: Add support for scanning GGUF models from OCI registries (#4335) ... --------- Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2026-02-09 16:05:52 -05:00
Christopher Angelo Phillips	c94d1ccf1c	fix: lookup alternate scheme on url->licenseID (#4588) ... --------- Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2026-01-30 14:25:27 -05:00
Will Murphy	83a4528fff	chore: sync generated file immediately (#4538) ... A CI failure was observed where a generated file was only partly written when the CI job immediately tried to read it. Put in an fs.Sync call to eliminate this flakiness. Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>	2026-01-08 09:01:17 -05:00
promalert	cc1a7dfae8	chore: fix some comments to improve readability (#4533) ... Signed-off-by: promalert <promalert@outlook.com>	2026-01-07 15:48:40 +00:00
dependabot[bot]andAlex Goodman	3ea6a03cd0	chore(deps): bump the go-minor-patch group with 3 updates (#4524) ... * chore(deps): bump the go-minor-patch group with 3 updates Bumps the go-minor-patch group with 3 updates: [github.com/BurntSushi/toml](https://github.com/BurntSushi/toml), [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) and [github.com/invopop/jsonschema](https://github.com/invopop/jsonschema). Updates `github.com/BurntSushi/toml` from 1.5.0 to 1.6.0 - [Release notes](https://github.com/BurntSushi/toml/releases) - [Commits](https://github.com/BurntSushi/toml/compare/v1.5.0...v1.6.0) Updates `github.com/go-git/go-git/v5` from 5.16.3 to 5.16.4 - [Release notes](https://github.com/go-git/go-git/releases) - [Commits](https://github.com/go-git/go-git/compare/v5.16.3...v5.16.4) Updates `github.com/invopop/jsonschema` from 0.7.0 to 0.13.0 - [Commits](https://github.com/invopop/jsonschema/compare/v0.7.0...v0.13.0) --- updated-dependencies: - dependency-name: github.com/BurntSushi/toml dependency-version: 1.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-patch - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.16.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-minor-patch - dependency-name: github.com/invopop/jsonschema dependency-version: 0.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com> * port breaking jsonschema lib changes Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * regenerate the existing json schema with new generation code Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2026-01-06 15:25:43 +00:00
3 people	b3c70da3ea	Add experimental cataloger capabilities command (#4317) ... * add info command from generated capabilities Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * correct gentoo and arch ecosystems Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename os pkg types Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * better binary cataloger description Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * expose metadata and pacakge types in json Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * expose json schema types Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add completeness tests for metadata types Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * latest generation Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * improve testing a docs Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix tests and linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * restore goreleaser config Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * tweak diagram Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix pdm Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * chore: java binary data Signed-off-by: Keith Zantow <kzantow@gmail.com> * new capability descriptions for gguf and python Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * correct poetry lock integrity hash claim Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix compile error Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix: remove purl version from overrides Signed-off-by: Keith Zantow <kzantow@gmail.com> * fix lua deps ref Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * keep gguf as ai ecosystem Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * split packages.yaml to multiple files by go package Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * ensure tests do not use go test cache Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * sort json output for info command Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * docs: fix ocaml, php, and portage capabilities yaml Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * chore: update erlang capabilities Signed-off-by: Keith Zantow <kzantow@gmail.com> * chore: update java capabilities Signed-off-by: Keith Zantow <kzantow@gmail.com> * chore: update javascript capabilities Signed-off-by: Keith Zantow <kzantow@gmail.com> * chore: update linux kernel capabilities Signed-off-by: Keith Zantow <kzantow@gmail.com> * remove missing tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix package.yaml references Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * revert license list change Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * check for drift in capability descriptions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * regenerate capabilities Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * test cleanup Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * use fixture cache in static analysis Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * claim fixtures pre-req for cap generation Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update documentation with correct regeneration procedure Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * chore: ruby-gemspec-cataloger finds no dependencies Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * chore: fix python docs and config comment Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * chore: commit re-generated java yaml Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * add cataloger selection to caps command Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * re-generate cap yamls Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix tests for cataloger selection Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add missing tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename cmd to `cataloger info` Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * [wip] change capability description locations Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * [wip] continued Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * [wip] adjust for import cycles Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * correct docs Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: Keith Zantow <kzantow@gmail.com> Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> Co-authored-by: Keith Zantow <kzantow@gmail.com> Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com>	2025-12-22 19:34:10 +00:00
Rez MossandChristopher Phillips	74c9380248	fix: 4423 dotnet-deps cataloger skips project type by def ... --------- Signed-off-by: Rez Moss <hi@rezmoss.com> Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com> Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2025-12-18 13:38:47 -05:00
VictorHuuandAlex Goodman	4c38ee1932	fix:best effort to get the os info of an ELF binary (#4438) ... * fix:the os of an elf binary should be detected even when the os version is empty Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * chore:revoke the update of appCpe Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * chore:resume the testcase Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * fix:revoke the possible compromise to the json schema Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * fix:align with the json schema Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * add a json schema(pre-relase,may be in conflict with others') Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * chore:add a json schema Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * chore:revert the accidental change to 16.1.0 Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * regression/fix:best effort to get the os info Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * chore:resume the previous json file Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * update the schema ver to 16.2.0 Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * chore:no breaking behavior Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * chore: follow the guide of the README.md Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * appCpe is temporarily unused Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * preserve json field for osCPE Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Yuntao Hu <victorhu493@gmail.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-12-12 19:13:59 +00:00
Keith Zantow	9e3150b7ee	fix: java archives excluded due to incorrect license glob results (#4449) ... Signed-off-by: Keith Zantow <kzantow@gmail.com>	2025-12-08 15:58:13 -05:00
VictorHuu	baca32f04a	fix:after compliance applied,the relationship concerning the original one should be omitted (#4419) ... --------- Signed-off-by: Yuntao Hu <victorhu493@gmail.com>	2025-12-04 15:30:16 -05:00
VictorHuuandChristopher Phillips	afe28a2fc0	fix:handle compound aliases like ``.tgz`` when cataloging archives (#4421) ... --------- Signed-off-by: Yuntao Hu <victorhu493@gmail.com> Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2025-12-02 16:55:32 -05:00
Alex Goodman	7bf7bcc461	Support extras statements in Python PDM cataloger (#4352) ... * fix pdm Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update json schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add test for metadata construction Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add missing test fixture Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * conserve markers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update json schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add additional tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-11-14 15:13:10 -05:00
Kudryavcev Nikolay	89842bd2f6	chore: migrate syft to use mholt/archives instead of anchore fork (#4029) ... --------- Signed-off-by: Kudryavcev Nikolay <kydry.nikolau@gmail.com> Signed-off-by: Christopher Phillips <spiffcs@users.noreply.github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-11-13 23:04:43 +00:00
Christopher Angelo Phillips	4a60c41f38	feat: 4184 gguf parser (ai artifact cataloger) part 1 (#4279) ... --------- Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2025-11-13 17:43:48 -05:00
Tim Olshansky	bbef262b8f	feat: Add license enrichment from pypi to python packages (#4295) ... * feat: Add license enrichment from pypi to python packages * Implement license caching and improve test coverage --------- Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com>	2025-11-06 16:05:08 -05:00
Tim Olshansky	4e06a7ab32	feat(javascript): Add dependency parsing (#4304) ... * feat: Add dependency parsing to javascript package locks Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com> * Bump schema version Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com> * Add support for yarn and pnpm, excl. yarn v1 Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com> * Add support for dependencies for v1 yarn lock files Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com> * Ensure schema is correctly generated Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com> * Fix tests Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com> * PR feedback Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com> --------- Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com>	2025-11-06 16:03:43 -05:00
Alex Goodman	e5711e9b42	Update CPE processing to use NVD API (#4332) ... * update NVD CPE dictionary processor to use API Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * pass linting with exceptions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-11-06 16:02:26 -05:00
Alex Goodman	538430d65d	describe cataloger capabilities via test observations (#4318) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-10-30 13:19:42 -04:00
Alex Goodman	5db3a9bf55	add workflow to create PR for spdx license list updates (#4319) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-10-30 12:14:13 -04:00
Kudryavcev Nikolay	f5c765192c	Refactor fileresolver to not require base path (#4298) ... * ref: close source in test and examples Signed-off-by: Kudryavcev Nikolay <kydry.nikolau@gmail.com> * ref: pretty file/directory source resolver (make them more similar) Signed-off-by: Kudryavcev Nikolay <kydry.nikolau@gmail.com> * ref: move absoluteSymlinkFreePathToParent to file resolver Signed-off-by: Kudryavcev Nikolay <kydry.nikolau@gmail.com> * revert breaking change Signed-off-by: Kudryavcev Nikolay <kydry.nikolau@gmail.com> --------- Signed-off-by: Kudryavcev Nikolay <kydry.nikolau@gmail.com>	2025-10-29 10:41:18 -04:00
Pavel BuchartandKeith Zantow	e923db2a94	Add PDM parser (#4234) ... Signed-off-by: Pavel Buchart <pavel@buchart.cz> Signed-off-by: Keith Zantow <kzantow@gmail.com> Co-authored-by: Keith Zantow <kzantow@gmail.com>	2025-10-16 08:50:44 -04:00
Alex Goodman	d22914baf5	add docs to configs (#4281) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-10-14 13:58:31 -04:00
Alex Goodman	4ae8f73583	migrate json schema generation (#4270) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-10-10 14:16:28 +00:00
Sebastien Dionne	bd013fe99a	docs: Fix typos and linguistic errors in documentation (#4257) ... Signed-off-by: Sebastien Dionne <survivant00@gmail.com>	2025-10-06 14:22:22 +00:00
Alan PopeandChristopher Phillips	0a36dabf23	feat(cataloger): add snap package cataloger for metadata extraction (#4151) ... --------- Signed-off-by: Alan Pope <alan.pope@anchore.com> Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2025-09-26 10:42:29 -04:00
Christopher Angelo PhillipsandAlex Goodman	13ffeeb3d0	feat: combine go module file and go source discovery into single cataloger (#4127) ... --------- Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-08-26 19:35:44 +00:00
Simeon StoykovandChristopher Phillips	a433045d51	feat: basic Conda ecosystem support (#4002) ... ---------------------------------------------------------------- Signed-off-by: Simeon Stoykov <simeon.stoykov@quantco.com> Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com> Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2025-08-19 22:37:27 -04:00
Christopher Angelo Phillips	6b48bd4b5e	feat: add package supplier flag (#4131) ... --------- Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2025-08-12 14:49:41 -04:00
Christopher Angelo Phillips	89470ecdd3	feat: update syft license construction to be able to look up by URL (#4132) ... --------- Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2025-08-12 14:30:32 -04:00
Keith Zantow	48bf81cf7f	fix: align binary java detection with jvm cataloger + support IBM (#4046) ... Signed-off-by: Keith Zantow <kzantow@gmail.com>	2025-07-22 12:06:32 -04:00
5 people	c491dab35b	feat: add parsing for uv.lock (#3763) ... * feat: add parsing for uv.lock (#3268) Signed-off-by: Joshua Kugler <tek30584@adobe.com> * Still no tests, but much more complete Next up: start writing tests! :) Signed-off-by: Joshua Kugler <tek30584@adobe.com> * chore: finish out functionality and write tests Signed-off-by: Joshua Kugler <tek30584@adobe.com> * Merge the .NET deps.json and PE binary catalogers (#3563) * add combined deps.json + pe binary cataloger Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * deprecate pe and deps standalone catalogers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * parse resource names + add tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix integration and CLI tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add some helpful code comments Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * allow for dropping Dep packages that are missing DLLs Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * migrate json schema changes to 24 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * keep application configuration Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * correct config help Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * [wip] detect claims of dlls within deps.json Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * [wip] fix tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add assembly repack detection Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * .net package count is lower due to dll claim requirement Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: Joshua Kugler <tek30584@adobe.com> * better .NET cpe generation (#3764) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: Joshua Kugler <tek30584@adobe.com> * Better represent .NET runtime packages (#3768) * clean up .NET runtime packages Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add runtime relationships Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove runtime references from binary package name Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: Joshua Kugler <tek30584@adobe.com> * chore(deps): update CPE dictionary index (#3769) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com> Signed-off-by: Joshua Kugler <tek30584@adobe.com> * chore(deps): bump modernc.org/sqlite from 1.36.1 to 1.37.0 (#3771) Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.36.1 to 1.37.0. - [Commits](https://gitlab.com/cznic/sqlite/compare/v1.36.1...v1.37.0) --- updated-dependencies: - dependency-name: modernc.org/sqlite dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Joshua Kugler <tek30584@adobe.com> * chore(deps): bump 8398a7/action-slack from 3.16.2 to 3.18.0 (#3767) Bumps [8398a7/action-slack](https://github.com/8398a7/action-slack) from 3.16.2 to 3.18.0. - [Release notes](https://github.com/8398a7/action-slack/releases) - [Commits](https://github.com/8398a7/action-slack/compare/28ba43ae48961b90635b50953d216767a6bea486...1750b5085f3ec60384090fb7c52965ef822e869e) --- updated-dependencies: - dependency-name: 8398a7/action-slack dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Joshua Kugler <tek30584@adobe.com> * chore(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 (#3766) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.37.0 to 0.38.0. - [Commits](https://github.com/golang/net/compare/v0.37.0...v0.38.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Joshua Kugler <tek30584@adobe.com> * chore: move/modify code for lint issues Signed-off-by: Joshua Kugler <tek30584@adobe.com> * chore: make sure private structs are not exported Signed-off-by: Joshua Kugler <tek30584@adobe.com> * fix tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * generate json schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * chore: update readme to include uv Signed-off-by: Joshua Kugler <tek30584@adobe.com> * chore: use uv as the package manager name Signed-off-by: Joshua Kugler <tek30584@adobe.com> --------- Signed-off-by: Joshua Kugler <tek30584@adobe.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: anchore-actions-token-generator[bot] <102182147+anchore-actions-token-generator[bot]@users.noreply.github.com> Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-07-17 18:26:56 +00:00
Keith ZantowandAlex Goodman	02703d5c80	feat: RHEL EUS detection (#4023) ... * feat: rhel eus detection Signed-off-by: Keith Zantow <kzantow@gmail.com> * chore: update tests Signed-off-by: Keith Zantow <kzantow@gmail.com> * chore: update more tests Signed-off-by: Keith Zantow <kzantow@gmail.com> * rename feature detection functions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Keith Zantow <kzantow@gmail.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-07-07 14:11:20 +00:00
Alex Goodman	2bda086423	Add ability to scan snaps (as a source) (#3929)	2025-06-25 16:53:35 -04:00
Dan LuhringandKeith Zantow	bbf3bb5856	fix(relationship): favor real paths over symlinks for ownership by file (#3923) ... Signed-off-by: Dan Luhring <dluhring@chainguard.dev> Signed-off-by: Keith Zantow <kzantow@gmail.com> Co-authored-by: Keith Zantow <kzantow@gmail.com>	2025-05-23 14:33:19 -04:00
Alex Goodman	e23ca43a83	add PE binary cataloger (#3911) ... Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-05-19 14:17:09 -04:00
Christopher Angelo Phillips	e1374f758e	fix: update license content filtering default case to be 'none' for no content returned ... --------- Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2025-05-16 14:25:15 +00:00
Ralph BeanandAlex Goodman	b369b02f4f	Expose RPM signature information (for RPM DB and RPM archives) (#3179) ... * feat: expose rpm signature information This helps with more confident identification of an rpm. In theory, two rpms can be built that have the same purl string, and otherwise look identical in syft's output, but the PGP information would distinguish them as signed either by different keys, or signed at different times. In practice, this usually makes no difference since rpms tend to have unique name/version/release strings. This just gives increased confidence about the identity of the rpm found in the db. Signed-off-by: Ralph Bean <rbean@redhat.com> * chore: generate json schema Signed-off-by: Ralph Bean <rbean@redhat.com> * re-generate json schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename to a more generic signature field Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename rpm.pgp to rpm.signatures Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * split out signature fields Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * include RPM archives Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update json schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * dont fail on unknown signature type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Ralph Bean <rbean@redhat.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-05-15 16:01:00 +00:00
Laurent GoderreandAlex Goodman	a8e5b25632	Add PHP interpreter + extensions cataloger (#2585) ... * Add PHP extensions binary classifiers Signed-off-by: Laurent Goderre <laurent.goderre@docker.com> * [wip] add php extensions cataloger Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * find interpreters + extension Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * internalize binary cataloger utilities Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * default to linux/amd64 for test fixtures Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Laurent Goderre <laurent.goderre@docker.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-05-15 08:22:50 -04:00
Christopher Angelo Phillips	3c7018a853	feat: remove full-text before release (#3889) ... Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2025-05-14 13:12:05 +00:00
Laurent GoderreandAlex Goodman	175a6719a9	Add cataloger for Dart pubspec (#3292) ... * Add cataloger for Dart pubspec Signed-off-by: Laurent Goderre <laurent.goderre@docker.com> * capture pubspec specific fields Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Laurent Goderre <laurent.goderre@docker.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-05-13 21:51:49 +00:00
Christopher Angelo PhillipsandAlex Goodman	f77d503892	detect license ID from full text when incidentally provided as a value (#3876) ... --------- Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-05-13 16:37:18 -04:00
Rez MossandAlex Goodman	12d91f47dc	Add a homebrew cataloger (#3724) ... * Cataloger homebrew (#4) * homebrew cataloger * uptd * fixed test * fixed test * fixed tests * fixed lint * inc schema ver * upt schema * fixed integration test * fixed integration tst * fixed test Signed-off-by: Rez Moss <hi@rezmoss.com> * Update parse_homebrew_test.go Signed-off-by: Rez Moss <hi@rezmoss.com> * Update parse_homebrew_test.go fixed DCO Signed-off-by: Rez Moss <hi@rezmoss.com> Signed-off-by: Rez Moss <hi@rezmoss.com> * Update parse_homebrew_test.go add evd anno to test Signed-off-by: Rez Moss <hi@rezmoss.com> * lint Signed-off-by: Rez Moss <hi@rezmoss.com> * fixed test Signed-off-by: Rez Moss <hi@rezmoss.com> * with PR refactors Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * regenerate json schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * regenerate jsonschema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * refactor homebrew parser + add tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * more resiliant variable extraction Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Rez Moss <hi@rezmoss.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-05-13 13:01:41 -04:00