oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-30 14:02:26 +01:00
Code Issues Packages Projects Releases Wiki Activity
2,747 Commits 65 Branches 273 Tags
d47a6c3a6d777b491fda10decb446599acdec90c
Commit Graph
271 Commits
Author SHA1 Message Date
Alex Goodman d47a6c3a6d Improve support for cataloging nix package relationships (#3837) 
* add nix DB cataloger

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add derivation path to nix store pkg metadata

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* go mod tidy

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* allow for derivation path to be optional

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* repin build image and disable syscall filtering

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* bump storage capacity

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* track nix derivation details on packages

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* image fixture should have derivation examples

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-05-05 15:35:13 +00:00
Laurent GoderreandAlex Goodman 529840bfc0 Add support for PHP Pear (#2775) 
* Add support for PHP Pear and unify PECL with it

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove log statements

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix struct comment

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-04-30 20:16:58 +00:00
Alex Goodman df18edf905 Consider DLL claims for dependencies of .NET packages from deps.json (#3822) 
* consider child dll claims for .NET packages from deps.json

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* make dll claim propagation configurable

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-04-24 11:59:16 -04:00
Keith Zantow b13ffdd304 fix: comma separated selectors in cataloger list command (#3804) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-04-16 10:41:48 -04:00
anchore-actions-token-generator[bot]andspiffcs f11377fe30 chore(deps): update tools to latest versions (#3775) 
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>
 2025-04-03 17:35:26 +00:00
Alex Goodman ad9928cb2a Merge the .NET deps.json and PE binary catalogers (#3563) 
* add combined deps.json + pe binary cataloger

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* deprecate pe and deps standalone catalogers

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* parse resource names + add tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix integration and CLI tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add some helpful code comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* allow for dropping Dep packages that are missing DLLs

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* migrate json schema changes to 24

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* keep application configuration

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* correct config help

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* [wip] detect claims of dlls within deps.json

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* [wip] fix tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add assembly repack detection

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* .net package count is lower due to dll claim requirement

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-03-27 14:38:16 -04:00
Keith Zantow 4a9437808e feat: parallelize catalogers per-file and hash contents in parallel (#3636) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-03-26 11:10:08 -04:00
Keith Zantow 7ac4d91f43 chore: reformat (#3754) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-03-21 06:13:35 -04:00
Alex Goodman e9b24a29d7 Remove mitchellh dependencies (#3748) 
* remove mitchellh dependencies

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix failing unit tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-03-20 10:19:19 -04:00
Alex Goodman 2738291a96 swap centos images for rocky (#3741) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-03-18 14:25:03 +00:00
dependabot[bot] 6b0425ebad chore(deps): bump github.com/charmbracelet/bubbletea from 1.2.4 to 1.3.4 (#3690) 
Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea) from 1.2.4 to 1.3.4.
- [Release notes](https://github.com/charmbracelet/bubbletea/releases)
- [Changelog](https://github.com/charmbracelet/bubbletea/blob/main/.goreleaser.yml)
- [Commits](https://github.com/charmbracelet/bubbletea/compare/v1.2.4...v1.3.4)

---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbletea
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-03-06 15:00:19 +00:00
RogueAIandKeith Zantow aeea170b19 fix: disable cert validation in dotnet-portable-executable-cataloger by default (#3677) 
Signed-off-by: rogueai <rogueai@users.noreply.github.com>
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
 2025-02-21 15:08:06 -05:00
Juan Ariza ToledanoWill MurphyAlex Goodman
 		bffe26bcc5 feat: add support for Bitnami cataloguer (#3341) 
* prototype: start bitnami cataloger

Bitnami images have spdx SBOMs at predictable paths, and Syft could more
accurately identify the software in these images by scanning those
SBOMs. Start work on this by forking the sbom-cataloger as a new
bitnami-cataloger.

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

* wire up bitnami cataloger to run on images by default

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

* feat: add support for Bitnami cataloguer

Signed-off-by: juan131 <jariza@vmware.com>

* feat: use a better SPDX sample for unit tests

Signed-off-by: juan131 <jariza@vmware.com>

* bugfix: only report bitnami pkgs

Signed-off-by: juan131 <jariza@vmware.com>

* feat: adapt JSON schema, spdxutil and packagemetadata

Signed-off-by: juan131 <jariza@vmware.com>

* bugfix: integration tests

Signed-off-by: juan131 <jariza@vmware.com>

* feat: implement FileOwner interface

Signed-off-by: juan131 <jariza@vmware.com>

* bugfix: update json schema

Signed-off-by: juan131 <jariza@vmware.com>

* [wip] add bitnami owned files and fix binary package ownership filtering

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* feat: obtain bitnami pkg files based on SPDX relationships tree

Signed-off-by: juan131 <jariza@vmware.com>

* preserve type switches

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* rename bitnami entry metadata type

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* restrict find main pkg logic

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add missing graalvm source info

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* bugfix: integration tests

Signed-off-by: juan131 <jariza@vmware.com>

* bugfix: mod tidy

Signed-off-by: juan131 <jariza@vmware.com>

---------

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
Signed-off-by: juan131 <jariza@vmware.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-02-18 09:07:47 -05:00
Keith Zantow 2328b20082 fix: reduce warn levels to debug for non-actionable errors (#3645) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2025-02-07 13:22:55 -05:00
Christopher Angelo Phillips e584c9f416 feat: 3626 add option enable license content; disable by default (#3631) 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-02-05 20:41:03 +00:00
Alex Goodman 684b6e3f98 Add file catalogers to selection configuration (#3505) 
* add file catalogers to selection configuration

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix typos

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* warn when there is conflicting file cataloging configuration

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* allow for explicit removal of all package and file tasks

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address PR feedback

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2025-02-03 19:10:17 +00:00
Christopher Angelo Phillips d5e52bc2ce docs: update descriptions with correct options (#3630) 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-01-29 15:47:04 +00:00
Thomas GosteliAlex GoodmanChristopher Phillips
 		c10e904c28 feat(cataloger): add a terraform provider cataloger (#3378) 
* feat(cataloger): add a terraform provider cataloger
* chore: bump schema from 16.0.19 -> 16.0.20
------
Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-01-21 14:44:54 -05:00
Dominik SchmidtandKeith Zantow 19a75fe504 feat(golang): add license parsing from vendor dirs (#3522) 
Signed-off-by: Dominik Schmidt <dev@dominik-schmidt.de>
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
 2025-01-17 20:25:05 -05:00
Christopher Angelo Phillips f9ffe7252e test: removes latest license list test (#3559) 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2025-01-02 20:56:44 +00:00
Alex Goodman 340b5e17f0 Add relationships for rust audit binary packages (#3500) 
* add rust audit binary pkg relationships

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix linting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-12-06 09:23:18 -05:00
GGMU 59e943385d feat: set max layer size (#3464) 
Signed-off-by: tomersein <tomersein@gmail.com>
 2024-12-02 11:29:42 -05:00
anchore-actions-token-generator[bot]spiffcsAlex Goodman
 		ac8be4ad41 chore(deps): update tools to latest versions (#3413) 
* chore(deps): update tools to latest versions

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* fix linting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-11-12 15:53:27 +00:00
Alex Goodman b0bffef1a2 restore log on ui teardown (#3427) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-11-08 12:31:38 -05:00
Artemii 6a1e3f32fe Issue #3143 – fixed format conversion docs link (#3407) 
* chore: fixed format conversion docs link (#3143)

Signed-off-by: Artemii Fedotov <artemii.fedotov@tutamail.com>

* changed link to wiki docs

Signed-off-by: Artemii Fedotov <artemii.fedotov@tutamail.com>

---------

Signed-off-by: Artemii Fedotov <artemii.fedotov@tutamail.com>
 2024-11-01 11:43:00 -04:00
Nathan VossandKeith Zantow a55b71d4ef feat: exclude devDependencies from package-lock.json parsing (#3371) 
Signed-off-by: Nathan Voss <njvoss299@gmail.com>
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
 2024-10-30 12:02:27 -04:00
Keith Zantow 759b898df5 feat: multi-level configuration and profiles (#3337) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-10-23 12:15:59 -04:00
Keith Zantow a00533c836 feat: Java dependency graph information (#3363) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-10-23 11:17:34 -04:00
William Murphy 0c71bf23c5 docs: clearer deprecation message for --file (#3310) 
It's not clear to users that they shoudl use --output FORMAT=PATH
instead of --file. Directly suggest the FORMAT=PATH syntax.

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
 2024-10-10 13:11:45 -04:00
Keith ZantowandAlex Goodman ccbee94b87 feat: report unknowns in sbom (#2998) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-10-07 16:11:37 -04:00
Alex Goodman 01de99b253 Add JVM cataloger (#3217) 
* add jvm cataloger

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* simplify version selection

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* CPEs from JVM cataloger should be declared

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* ensure package overlap is enabled for sensitive use cases

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* more permissive glob

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-09-23 17:21:38 -04:00
Alex Goodman 963ea594c8 Add compliance policy for empty name and version (#3257) 
* add policy for empty name and version

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* default stub version

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* modifying ids requires augmenting relationships

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-09-20 12:50:47 -04:00
Keith Zantow 1b863268df feat: --enrich flag for data enrichment feature enablement (#3182) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-09-12 10:45:18 -04:00
Laurent Goderre 9c2799e379 Add the Ocaml ecosystem (#3112) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2024-09-10 10:35:18 -04:00
Alex Goodman 0a3f513f92 Slim down docker cache size (#3190) 
* slim down docker cache size

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove old centos images

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* troubleshoot test failure

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix wget version ref

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* refactor caching mechanisms

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add cache cleanup steps

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* simplify deleting cache

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix first clone issue

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add tool dep

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-09-09 11:15:13 -04:00
anchore-actions-token-generator[bot] dad253785e chore(deps): update tools to latest versions (#3144) 2024-08-23 14:42:12 -04:00
anchore-actions-token-generator[bot]andspiffcs 4b7ae0ed3b chore(deps): update tools to latest versions (#3121) 
* chore(deps): update tools to latest versions

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* chore: update code to reflect new linter settings for error messages

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

---------

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>
 2024-08-16 17:56:36 +00:00
Lukas Voetmand 3161e1847e fix: read CycloneDX BOM components from metadata (#3092) 
Signed-off-by: dervoeti <lukas.voetmand@stackable.tech>
 2024-08-12 16:37:23 -04:00
Weston Steimel df1e5b57fe fix: improve groupid extraction for Jenkins plugins (#2815) 
* fix: improve groupid extraction for Jenkins plugins

Consider the `Group-Id` java manifest property as this is typically set
for Jenkins plugins if there is no pom file

Signed-off-by: Weston Steimel <commits@weston.slmail.me>

* test: update java purl integration test image

Signed-off-by: Weston Steimel <commits@weston.slmail.me>

---------

Signed-off-by: Weston Steimel <commits@weston.slmail.me>
 2024-08-12 13:01:44 -04:00
luozexuan c19cf626ab chore: fix some comments (#3114) 
Signed-off-by: luozexuan <fetchcode@139.com>
 2024-08-12 12:08:04 -04:00
Weston Steimel 19cc664cf8 test: increase java purl generation test coverage (#3110) 
ensures correct package url generation for more java packages now that
syft has more deterministic results per https://github.com/anchore/syft/pull/3085

Signed-off-by: Weston Steimel <commits@weston.slmail.me>
 2024-08-09 10:14:10 +00:00
Gijs CalisandKeith Zantow 9d40d1152e feat: improved java maven property resolution (#2769) 
Signed-off-by: Gijs Calis <51088038+GijsCalis@users.noreply.github.com>
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
 2024-08-05 11:30:47 -04:00
Laurent Goderre 92d63df6f5 Added the SWI Prolog (swipl) ecosystem (#3076) 
* Add binary classifier for swipl

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>

* Added cataloger for SWI Prolog Pack packages

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>

---------

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2024-07-31 16:13:26 -04:00
mikcl 36f95d6828 python-cataloger: normalize package names (#3069) 
Signed-off-by: mikcl <mikesmikes400@gmail.com>
 2024-07-25 13:54:13 -04:00
Keith Zantow 741c8fb9bd fix: SPDX output performance with many relationships (#3053) 2024-07-24 10:14:20 -04:00
Alex Goodman 573440b7cf Infer the package type from ELF package notes (#3008) 
* fix ELF package types to be honored

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* prefer OS packages over binary packages when there are duplicates

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-07-02 16:07:08 -04:00
Keith Zantow af3aaa0397 fix: make caching options more explicit (#2966) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-06-14 18:45:48 +00:00
Keith Zantow ca0cc52d47 fix: separate golang license caches from mod dir (#2852) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-06-12 19:12:35 -04:00
Laurent Goderre b51252dbdb feat: Add Lua cataloger (#2613) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2024-05-24 16:56:34 -04:00
Keith Zantow 1c37bab2b2 feat: add config command (#2892) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-05-23 15:18:09 -04:00