oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-30 14:02:26 +01:00
Code Issues Packages Projects Releases Wiki Activity
731 Commits 65 Branches 273 Tags
c6447cb62b9ea2a196aa33b6a1a0e4ed27cbb3b4
Commit Graph
731 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Alex Goodman c6447cb62b update anchore import to use the new format option 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-10 18:59:46 -07:00
Alex Goodman bd89e22fe5 update the power-user JSON document to use the format model directory 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-10 18:59:13 -07:00
Alex Goodman 3ca797dc53 update existing presenter tests to use the shared format test helpers 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-10 18:58:34 -07:00
Alex Goodman 50408b52d1 update integration test to reference new format options 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-10 18:57:44 -07:00
Alex Goodman c00afc7fa9 add formats helper test fixtures 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-10 18:56:43 -07:00
Alex Goodman 4a82e4843a add encoder tests for spdx-json and syft json 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-10 18:56:16 -07:00
Alex Goodman d474281731 migrate and split common spdx format helpers 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-10 18:40:27 -07:00
Alex Goodman 0c0890ef44 remove spdx json presenter + model 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-10 18:38:28 -07:00
Alex Goodman 8d522efcf6 remove json presenter 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-10 18:36:23 -07:00
Alex Goodman 124cfd86c7 replace presenter.Option with format.Option 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-10 18:35:02 -07:00
Alex Goodman 12b44af471 add encode and decode to the syft lib interface 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-10 18:32:42 -07:00
Alex Goodman bcdebcadaf add internal.formats helper functions + identify tests 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-10 18:32:02 -07:00
Alex Goodman f6cc0c8628 migrate spdxjson presenter to spdxjson format object 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-10 18:30:30 -07:00
Alex Goodman c1346ad62c migrate json presenter to json format object 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-10 18:30:04 -07:00
Alex Goodman 9ded1c4c22 add basic format abstraction 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-10 18:28:40 -07:00
Alex Goodman 9189ed68df Add query by MIME type to source.FileResolver (#529) 
* add query by MIME type to source.FileResolver

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* pull in stereoscope MIME type feature

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-05 20:50:53 -04:00
Alex Goodman ba1cd8d753 specify optional file.Digests instances to abbreviate json output (#531) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-05 15:35:28 -04:00
Alex Goodman dd2c178085 add --file option to readme (#533) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-05 15:34:32 -04:00
Alex Goodman 1b23a94015 Add option to output SBOM report to a file (#530) 
* add output to file option

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* log errors on close of the report destination

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove file option from persistent args

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update file option comments and logging

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* allow for multiple UI fallback options

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update UI select signatures + tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-05 14:47:24 -04:00
Christopher Angelo Phillips f47a6a88b1 (#495) Update documentNamespace uniqueness for spdx-json output (#528) 
* add unique namespace identifier

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-10-05 13:10:49 -04:00
Dan Luhring 4b7217f052 Improve documentation (#525) 
* Make installation methods more obvious

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Create linkable section headers

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Add badge for joining Slack

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Document requirement for signed commits

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-10-04 09:29:27 -04:00
Christopher Angelo Phillips 5e4b668e5a 497 stable sorted CPE array (JSON and SPDX) (#522) 
* add small sorting change to our specificity

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-10-01 15:31:17 -04:00
Dan Luhring 6480f06173 Update description for Slack link (#523) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-09-30 21:43:43 +00:00
Christopher Angelo Phillips 75aed5f3ec (#460) Extend license mapping for common SPDX license names (#509) 
Fixes #460 
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-09-30 16:54:36 -04:00
Jamie Magee 270fbb7665 Add mariner to distro types (#520) 
Signed-off-by: Jamie Magee <jamie.magee@gmail.com>
 2021-09-30 13:20:15 -04:00
Alex GoodmanandChristopher Angelo Phillips 0395c47445 Add vendor + product known good CPE field values (#517) 
* add better infrastructure around CPE candidate additions

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add test cases for CPE candidate additions

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* small ergonomic updates

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* clean java OSGI directives from group ID

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* unquote CPE candidate field values (double quotes only)

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add remaining CPE vendor & product additions (+ tests)

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Co-authored-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
v0.24.1 		2021-09-27 18:31:59 -04:00
Keith Zantow e5caba043d Add SBOM to releases (#500) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2021-09-24 20:21:23 -04:00
Dan Luhring d1ac476986 Add announcement for KubeCon meetup (#515) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-09-24 11:42:06 -04:00
Dan Luhring dd23d49986 Prevent invalid CPE field values (#514) 
* Fix CPE set comparison mismatch

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Add failing test to assert CPE generation excludes URLs

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Add removeByCondition method to fieldCandidateSet

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Prevent invalid CPE values for products and vendors

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Introduce removeWhere and rename filter to condition

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Refactor fieldCandidateSet and condition logic

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Move CPE parsing filter to end of CPE generation

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-09-24 09:23:58 -04:00
Alex Goodman 6d4d083acc Filter out CPE product candidates that are asterisks (#513) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
v0.24.0 		2021-09-22 20:55:03 -04:00
Dan Luhring 316d4341c8 Use Anchore fork of packageurl lib without replace directive (#512) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-09-22 15:04:09 -04:00
Christopher Angelo Phillips 3e8afc5274 update log file permissions to 0644 (#511) 
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-09-21 10:34:10 -04:00
Christopher Angelo Phillips 93d00dc340 Populate Files and Relationship fields for spdx-json output (#507) 
* update spdx22 Document model to include relationships field

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* update document and relationship to match current JSON spec
https://github.com/spdx/spdx-spec/blob/development/v2.2.1/schemas/spdx-schema.json
https://github.com/spdx/spdx-spec/pull/528
https://github.com/spdx/spdx-spec/pull/528#issuecomment-904180177

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* update File struct based on SPDX schema

Required fields:
[ "SPDXID", "fileName", "copyrightText", "licenseConcluded" ]
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-09-17 09:06:12 -04:00
Alex Goodman 9fe1da8ee6 update go-rpmdb and restruct gomod references (#506) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-09-14 14:51:19 -04:00
Christopher Angelo Phillips 95df7dd035 Add command examples to release documentation (#503) 
* update release document with commands run
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* small edits
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-09-14 09:08:37 -04:00
Alex Goodman ddfc8e20c0 Revert "disable docker releases (workaround) (#493)" (#501) 
This reverts commit 06dcd3261d.

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
v0.23.0 		2021-09-13 13:06:23 -04:00
Christopher Angelo Phillips 3f305aa6cd (#342) - remove strong distro check (#496) 
* add Type conversion to remove strong distro type limit
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* update signatures to be correct variable from os-release
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-09-09 13:05:22 -04:00
houdini91 2f99a35f51 Power user command support for directory scans (#467) 
* Power-user directory source support
Signed-off-by: Mikey Strauss <mikey@scribe-security.com>

Signed-off-by: houdini91 <mdstrauss91@gmail.com>

* Remove newline

Signed-off-by: houdini91 <mdstrauss91@gmail.com>

* Shared filetree (#1)

* Shared directory resolver filetree

Signed-off-by: houdini91 <mdstrauss91@gmail.com>

* PR - change error ErrObserve to ErrPath

Signed-off-by: houdini91 <mdstrauss91@gmail.com>

* PR - share directory resolver
* Use pointer to source struct

Signed-off-by: houdini91 <mdstrauss91@gmail.com>

* Fix Lint

Signed-off-by: houdini91 <mdstrauss91@gmail.com>
 2021-09-08 09:18:53 -04:00
Alex Goodman 06dcd3261d disable docker releases (workaround) (#493) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
v0.22.0 		2021-09-03 21:29:34 +00:00
Alex Goodman abbba3fc19 Modify CPE vendor candidate generation approach (#484) 
* consider additional vendor candidates for ruby, python, rpm, npm, and java

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add java pom.xml processing

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* allow for downstream transform control in cpe generation processing

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* migrate CPE generation logic to dedicated package

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* split java manifest groupID extraction into two tiers

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* extract groupID from pom parent project during CPE generation

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update java groupID processing tests to cover multi-tier approach

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix constructor names for cpe.fieldCandidate

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* rename helper function to startsWithTopLevelDomain

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add nil changes for java manifest sections

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update comment to reflect parsing maven files

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* split out java description parsing

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* split out pom parent processing

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* simplify vendorsFromGroupIDs and associated tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* simplify test type for vendorsFromGroupIDs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* copy candidate varidations to new instances

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* rename CPE generation string util functions

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add an explanation around fieldCandidate

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* simplify type for the cpe.fieldCandidateSet

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* make CPE filter function names more readable

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update groupIDsFromJavaManifest to use a guard clause

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* extract groupID extraction from artifactID fields into a separate function

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* bump goreleaser version to combat failure

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-09-03 14:21:25 -04:00
Samuel Dacanay 0799fd9d46 Add support for older CentOS versions (6 & 5) by checking additional release files for information 
Signed-off-by: Samuel Dacanay <sam.dacanay@anchore.com>
 2021-09-03 16:06:10 +01:00
Alex Goodman 5de1a0a236 Revert "Add announcement for upcoming OSS meetup (#490)" (#491) 
This reverts commit 035ef03b0c.

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-09-02 10:59:51 -04:00
Dan Luhring 035ef03b0c Add announcement for upcoming OSS meetup (#490) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-08-25 14:35:32 -04:00
Toure Dunnon 9acabb8307 Merge pull request #489 from anchore/SLES_support_berkeleyDB 
Updated the distro package to include SLES
 2021-08-23 16:14:52 -04:00
Toure Dunnon 0f0fe59bf2 Updated the distro package to include SLES type to expand support, this change will not include the new sqlite3 rpmDB format 
Signed-off-by: Toure Dunnon <toure.dunnon@anchore.com>
 2021-08-23 15:05:39 -04:00
Keith Zantow ff828fbac2 Skip package-lock.json and yarn.lock in node_modules #431 (#485) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
v0.21.0 		2021-08-20 13:50:28 -04:00
NikitaAlex GoodmanAlex Goodman
 		cba5b5723b Added parser for Pipfile.lock to cataloger (#473) 
* Added parser for Pipfile.lock to cataloger

Signed-off-by: Nikita <33390074+Zilborg@users.noreply.github.com>

* make lint-fix

Signed-off-by: Nikita <33390074+Zilborg@users.noreply.github.com>

* Update syft/pkg/cataloger/python/parse_pipfile_lock.go

Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Nikita <33390074+Zilborg@users.noreply.github.com>

* fix _version

Signed-off-by: Nikita <33390074+Zilborg@users.noreply.github.com>

* swap method for trimming "==" prefix from pipfile pkg versions

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2021-08-19 10:32:10 -04:00
Alex Goodman b0e9b92a25 Merge pull request #483 from anchore/fix-gomod-gosum-validation 
Fix go module tidy checks for release pipeline
v0.20.0 		2021-08-18 11:00:49 -04:00
Alex Goodman d25d3b1fb3 fix go module tidy checks for release pipeline 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-08-18 10:13:56 -04:00
Keith Zantow 93b4bf9379 Add option to enable http registry connections (#482) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2021-08-17 12:52:51 -04:00