Keith Zantow
5f90d03718
fix: possible race condition ( #1639 )
2023-03-01 15:35:01 -05:00
Keith Zantow
24584a4d27
fix: handle individual cataloger panics ( #1636 )
2023-03-01 10:03:34 -05:00
Nils Hanke
fa0a9fe8f9
feat: set cosign attest predicate type based on Syft output type ( #1598 )
...
Signed-off-by: Nils Hanke <nils.hanke@outlook.de >
2023-02-24 15:08:40 -05:00
Alex Goodman
9b9a7d6c98
allow convert to take stdin ( #1570 )
...
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2023-02-14 10:03:47 -05:00
Keith Zantow
9650473298
feat: Allow specific versions of formats to be specified ( #1543 )
2023-02-07 10:40:43 -05:00
Nils Hanke
a1b82c9664
fix: don't hardcode Cosign attest type ( #1533 )
...
Signed-off-by: Nils Hanke <nils.hanke@outlook.de >
2023-02-02 12:47:12 -05:00
Keith Zantow
ba55963104
fix: allow template for syft convert ( #1521 )
2023-01-26 12:07:36 -05:00
Christopher Angelo Phillips
8c91605541
1465 attestation with private key ( #1502 )
...
1465 attestation with private key (#1502 )
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2023-01-26 11:19:13 -05:00
Christopher Angelo Phillips and Alex Goodman
44e8ae2577
fix: update attestation code to remove library dependencies and shellout for keyless flow ( #1442 )
...
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
2023-01-12 17:22:05 +00:00
Keith Zantow
4f39287216
feat: Generic Binary Cataloger ( #1336 )
2022-11-29 18:28:10 -05:00
Keith Zantow
42cb0a47a4
feat: SPDX 2.3 support ( #1311 )
2022-11-18 08:54:39 -05:00
0c4b99c1c2
SBOM cataloger ( #1029 )
...
* SBOM cataloger
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* sbom-cataloger: turn off by default
and add integration test
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* SBOM cataloger
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* SBOM cataloger (optimize)
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* SBOM cataloger (fix)
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* SBOM cataloger (fix imports #1172 )
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* SBOM cataloger (fix: support group attribute in CDX SBOMs)
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* port to generic cataloger and add relationship to original file
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* generalize parser for all format globs
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Co-authored-by: Tom Fay <tomfay@microsoft.com >
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
2022-11-16 14:11:45 -05:00
Christopher Angelo Phillips
0774ad15e2
chore: clean up linting configuration ( #1343 )
2022-11-16 16:28:09 +00:00
Justin Chadwell
10f43d75e0
feat: Add --name option to override name in output ( #1269 )
2022-11-10 14:03:23 -05:00
Alex Goodman
d8c659b65b
replace logger interface with anchore/go-logger ( #1279 )
...
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2022-10-21 15:12:14 +00:00
Arnaud J Le Hors and Christopher Phillips
d3ee24017e
Use in-toto CycloneDX predicate to be compatible with cosign ( #1270 )
...
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2022-10-19 09:37:52 -04:00
Keith Zantow
780e1c310c
refactor: Remove experimental Anchore Enterprise upload functionality ( #1257 )
2022-10-10 16:16:47 -04:00
Adam Hughes
40d294a89e
feat: attest support for Singularity images ( #1201 )
2022-10-04 12:34:59 -04:00
Christopher Angelo Phillips
0f99215b2c
bug: remove chance for panic; provide default attestation path ( #1214 )
2022-09-19 15:50:33 +00:00
Christopher Angelo Phillips
b48316742f
refactor: replace ioutil=>io; update linter ( #1211 )
2022-09-16 17:58:16 +00:00
Keith Zantow
b20310eaf8
Add gosimports ( #1205 )
2022-09-14 13:38:18 -04:00
Chapman Pendery
9097614f3b
refactor: move formats from internal into syft module ( #1172 )
2022-09-13 11:20:52 -04:00
Adam Hughes
999994f197
docs: improve Singularity image source docs ( #1190 )
2022-09-07 14:43:38 -04:00
Christopher Angelo Phillips
586d3fe77f
Revert "External sources configuration ( #1158 )" ( #1191 )
...
reverted as functionality is to be merged with dev branch of kubecon draft
2022-09-01 15:45:35 -04:00
Christopher Angelo Phillips and Alex Goodman
615f933d98
Bug fix for 1095 - syft conversion option error ( #1177 )
...
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2022-08-25 17:36:15 -04:00
anchore-actions-token-generator[bot] and Weston Steimel
b0fc955e0c
Update syft bootstrap tools to latest versions. ( #1171 )
...
* Update syft bootstrap tools to latest versions.
Signed-off-by: GitHub <noreply@github.com >
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
Co-authored-by: Weston Steimel <weston.steimel@anchore.com >
2022-08-23 20:36:59 +01:00
Marco Deicas
13296880cd
External sources configuration ( #1158 )
2022-08-22 11:22:18 -04:00
Adam Hughes and Alex Goodman
d361d40cfa
Singularity Image Support ( #974 )
...
* docs: add Singularity image support
Add "singularity-image" scheme to CLI documentation and README.
Signed-off-by: Adam Hughes <9903835+tri-adam@users.noreply.github.com >
* upgrade stereoscope + docs
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
2022-08-02 11:42:46 -04:00
Christopher Angelo Phillips
571de3602a
update help formatting ( #1105 )
2022-07-19 14:46:48 +00:00
cpendery
922663c987
fix: -o output option to include formats ( #1102 )
2022-07-15 09:55:15 -04:00
Batuhan Apaydın
5206193b23
feat: output attestation to file ( #1087 )
2022-07-08 13:05:20 -04:00
Batuhan Apaydın and Christopher Phillips
69134ed3b5
feat: add new login cmd ( #1068 )
...
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2022-07-05 11:57:28 -04:00
Alex Goodman and ramanan-ravi
ea611dab5f
Add catalogers configuration ( #1038 )
...
* Option to enable specific language or ecosystem cataloger
Signed-off-by: ramanan-ravi <ramanan@deepfence.io >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* Disable dotnet cataloger
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* Option to enable specific language or ecosystem cataloger
Signed-off-by: Ramanan Ravikumar <ramanan@deepfence.io >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* rename "enable-cataloger" option to "catalogers"
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* add cli test for --catalogers option
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update readme with latest cataloger names
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* enable dotnet cataloger
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix linting
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* fix cataloger imports
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update readme with alpmdb cataloger config example
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Co-authored-by: ramanan-ravi <ramanan@deepfence.io >
2022-06-21 13:06:25 +00:00
Jonas Xavier
aed1599c4d
add template output ( #1051 )
...
* add template output
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* remove dead code
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* fix template cli flag
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* implement template's own format type
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* simpler code
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* fix readme link to Go template
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* feedback changes
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* simpler func signature patter
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* nit
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* fix linter error
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
2022-06-17 14:04:31 -04:00
Weston Steimel and Christopher Phillips
b8d1a46e7e
bump cosign to v1.9.0 to resolve reporting of GHSA-66x3-6cw3-v5gj ( #1025 )
...
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2022-06-08 11:51:10 -04:00
Keith Zantow
91e2fd8532
Fix potential race condition during event subscription ( #993 )
2022-05-11 18:35:55 -04:00
Jonas Xavier and Keith Zantow
24f08e7738
Convert between SBOM formats ( #964 )
...
* add convert command
Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com >
* mvp
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* fix hanging bug
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* validate SBOM formats for conversion
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* move convert cmd to new structure
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* remove bin
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* drop event loop from convert cmd
extract SBOM type from document namespace
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* validate SPDX in tests
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* documenting convert cmd
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* support output format=file.json notation
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* test convertible formats
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* fix typo
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* clean up
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* more clean up and docs
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* feedback changes
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com >
* nit
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* feedback changes
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* re-use more code
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* undo encode-decode cycle test
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* remove unnecessary test constraint
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* fix readme
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* try verbose
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* cleaner README and no table conversion
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* simpler conversion
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* feedback changes and cleanup
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* nit space fix
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* use defer
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
* feedback changes
Signed-off-by: Jonas Xavier <jonasx@anchore.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
2022-05-09 17:28:33 -07:00
Christopher Angelo Phillips and Alex Goodman
d2d532f4a8
835 - Keyless Support for SBOM Attestations ( #910 )
...
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
2022-05-06 18:06:32 -04:00
Christopher Angelo Phillips
4ce2edda9e
add version info and remove double config call ( #977 )
2022-05-02 14:54:10 +00:00
Christopher Angelo Phillips
6029dd7c2e
refactor command package to remove globals and add dependency injection
2022-04-26 18:23:03 +00:00
Keith Zantow
7789506dc6
Experimental GitHub export ( #836 )
2022-03-10 22:38:12 -05:00
Christopher Angelo Phillips
003d28ad48
Add SchemaVersion to version command output ( #877 )
...
* make JsonSchemaVersion available programmatically via syft version command
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2022-03-09 13:12:52 -05:00
Sambhav Kothari
39737a2825
Update cyclonedx to v1.4 ( #820 )
2022-03-08 12:09:55 -05:00
Alex Goodman
07d3c9af52
Fix file creation for output options ( #875 )
2022-03-08 15:37:28 +00:00
Alex Goodman
a86dd3704e
Add platform selection ( #866 )
2022-03-04 22:41:38 +00:00
Alex Goodman
4af32c5bee
Migrate format definitions to sbom package ( #864 )
2022-03-04 17:22:40 -05:00
Jonas Xavier
640099ce2e
tiny aligment fix in example template ( #867 )
...
Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com >
2022-03-04 09:34:05 -08:00
Christopher Angelo Phillips
ad322b3314
bump error language and remove panic ( #862 )
...
* bump error language and remove panic
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2022-03-03 10:37:18 -05:00
Jonas Xavier
4a8a9ce290
add podman scheme to doc examples ( #860 )
2022-03-02 14:39:05 -08:00
Christopher Angelo Phillips and Alex Goodman
afc0c1acd9
855 attest registry source only ( #856 )
...
Add source.NewFromRegistry function so that the syft attest command can always explicitly ask for an OCIRegistry provider rather than rely on local daemon detection for image sources.
Attestation can not be used where local images loaded in a daemon are the source. Digest values for the layer identification step in attestation can sometimes vary across workstations.
This fix makes it so that attest is generating an SBOM for, and attesting to, a source that exists in an OCI registry. It should never load a source from a local user docker/podman daemon.
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
2022-03-01 23:16:42 -05:00
Keith Zantow
Nils Hanke
Alex Goodman
Christopher Angelo Phillips
Justin Chadwell
Arnaud J Le HorsandChristopher Phillips
Adam Hughes
Chapman Pendery
anchore-actions-token-generator[bot]andWeston Steimel
Marco Deicas
Batuhan Apaydın
Jonas Xavier
Sambhav Kothari
Jonas Xavier