oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-01 06:56:40 +01:00
Code Issues Packages Projects Releases Wiki Activity
1,275 Commits 65 Branches 273 Tags
deb7052f419fc91ffe71e6be862be79c9475ef84
Commit Graph
61 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dan LuhringandAlex Goodman e58050bac0 Fix panic in apkdb parsing on empty "provides" values (#1494) 
* Add failing test for strip version specifiers panic

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

* Fix test

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

* Prevent panic scenario in helper func

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

* Fix lint issue

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

* add tests for apk stripVersionSpecifier() and remove caller empty value check

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2023-01-20 14:49:44 +00:00
Dan Luhring f6996f7b9a Fix parsing of apk databases with large entries (#1365) 
Closes https://github.com/anchore/syft/issues/1354
 2022-11-29 10:16:36 -05:00
Dan LuhringAlex GoodmanChristopher PhillipsTimothy Gerla
 		949cff158d Add support for dependency relationships for alpine (apk) (#1063) 
* Fix type of pull deps and add support for provides

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* [wip] apk dependency lookup

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update whitespace for linter

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* adjust test conditions

Signed-off-by: Timothy Gerla <tim@gerla.net>

* fix TODOs and improve Provides parser

* run simports after main merge

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* add tests to cover apk relationship parsing cases

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* generate JSON schema for breaking changes to apk metadata

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update tests to account for additional dependencies

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* [wip] fix relationship encoding for cyclonedx

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* simplify package relationships that can be expressed

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Signed-off-by: Dan Luhring <dan+github@luhrings.com>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Signed-off-by: Timothy Gerla <tim@gerla.net>
Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: Timothy Gerla <tim@gerla.net>
 2022-11-09 15:43:37 +00:00
Dan Luhring 37927b8b23 reduce logging severity for non-Go binaries (#983) 2022-05-03 09:38:14 -04:00
Dan Luhring 0bd3558fb2 reduce noise of log output (#976) 2022-05-02 14:54:30 +00:00
Dan Luhring 028cd9e27e Fix nil pointer dereference in directory resolver's indexPath method (#924) 
* Add failing test for dir resolver panic

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Fix panic

Signed-off-by: Dan Luhring <dan+github@luhrings.com>
 2022-03-28 13:15:09 -04:00
Dan Luhring 5549939cc6 Fixups and clarifications in README (#920) 
Signed-off-by: Dan Luhring <dan+github@luhrings.com>
 2022-03-25 11:36:43 -04:00
Dan Luhring a7db43f5ec Fix panic on empty sbom (#917) 
* Implement fmt.Stringer with format.ID

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Add failing test for formats processing empty SBOMs

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Account for nil SPDX document during Syft model conversion

Signed-off-by: Dan Luhring <dan+github@luhrings.com>
 2022-03-24 10:11:51 -04:00
Dan Luhring 752b03b2d6 Remove commit signing requirement (#899) 
Signed-off-by: Dan Luhring <dan+github@luhrings.com>
 2022-03-18 12:48:00 -04:00
Dan Luhring 1e75cb0418 Update to cosign v1.5.2 (#857) 2022-03-02 15:09:47 +00:00
Dan Luhring 641c44f449 Fix panic in requirements.txt parsing (#834) 
* Stable sort for pipfile.lock parsing

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Adjust python parsing tests to use go-cmp

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Add failing cases for requirements.txt parsing

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Fix failing cases for requirements.txt parsing

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Refactor parseRequirementsTxt

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Fix static-analysis failure

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Fix comment

Signed-off-by: Dan Luhring <dan+github@luhrings.com>
 2022-02-17 10:00:16 -05:00
Dan Luhring c61204f56d Add support for "file" source type in syftjson unmarshaling (#750) 
* Add tests for image and directory syftjson source

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Add failing test case for file source unmarshaling

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Fix file source unmarshaling

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Add test case for unknown source type

Signed-off-by: Dan Luhring <dan+github@luhrings.com>
 2022-01-18 13:40:39 -05:00
Dan Luhring 7de5e1288f Fix unhelpful error message for oci-archive scheme (#705) 
* Improve error message

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Return error from stereoscope immediately

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Bump version of stereoscope

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Conditionally retry image retrieval

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Update error message for source construction failure

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Update stereoscope

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Retry image pull without predetermined image source

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Add comment to image pull source determination

Signed-off-by: Dan Luhring <dan+github@luhrings.com>
 2021-12-22 18:53:23 +00:00
Dan Luhring 85ac5bcbf8 Handle extra empty lines in Java manifest parsing (#687) 
* Add failing test for extra empty lines in manifest

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Handle extra empty lines in Java manifests

Signed-off-by: Dan Luhring <dan+github@luhrings.com>
 2021-12-14 11:53:50 -05:00
Dan Luhring f98868b55e Find Java package versions in additional manifest sections (#673) 
* Add failing test for missing versions

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Look through all named sections for version

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Consistent installation of yajsv

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Adjust output text for test assertion

Signed-off-by: Dan Luhring <dan+github@luhrings.com>
 2021-12-13 15:39:42 -05:00
Dan Luhring 7957294b26 Add section for community meetings (#655) 
Signed-off-by: Dan Luhring <dan+github@luhrings.com>
 2021-12-06 12:18:34 -05:00
Dan Luhring ed84e43d67 Remove webinar announcement (#650) 
Signed-off-by: Dan Luhring <dan+github@luhrings.com>
 2021-12-01 19:07:10 +00:00
Dan Luhring f0b2d81599 Announce meetup on 2021-12-01 (#640) 
Signed-off-by: Dan Luhring <dan+github@luhrings.com>
 2021-11-22 10:13:18 -05:00
Dan Luhring 7b319e32bb Remove webinar announcement (#582) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-10-22 07:48:36 -04:00
Dan Luhring c0f55866ec Announce upcoming webinar (#553) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-10-15 12:13:28 -04:00
Dan Luhring 10368f6fe8 Add Syft logo (#545) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-10-11 21:06:27 +00:00
Dan Luhring 4b7217f052 Improve documentation (#525) 
* Make installation methods more obvious

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Create linkable section headers

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Add badge for joining Slack

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Document requirement for signed commits

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-10-04 09:29:27 -04:00
Dan Luhring 6480f06173 Update description for Slack link (#523) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-09-30 21:43:43 +00:00
Dan Luhring d1ac476986 Add announcement for KubeCon meetup (#515) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-09-24 11:42:06 -04:00
Dan Luhring dd23d49986 Prevent invalid CPE field values (#514) 
* Fix CPE set comparison mismatch

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Add failing test to assert CPE generation excludes URLs

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Add removeByCondition method to fieldCandidateSet

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Prevent invalid CPE values for products and vendors

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Introduce removeWhere and rename filter to condition

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Refactor fieldCandidateSet and condition logic

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Move CPE parsing filter to end of CPE generation

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-09-24 09:23:58 -04:00
Dan Luhring 316d4341c8 Use Anchore fork of packageurl lib without replace directive (#512) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-09-22 15:04:09 -04:00
Dan Luhring 035ef03b0c Add announcement for upcoming OSS meetup (#490) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-08-25 14:35:32 -04:00
Dan Luhring 66e71c39e2 Add callout for OSS meetup (#446) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-06-24 11:44:20 -04:00
Dan Luhring 50928ebd05 Add comments with examples for yarn.lock regexps (#439) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-06-17 09:24:05 -04:00
Dan Luhring 67b7d63875 Fix yarn.lock parsing (#437) 2021-06-15 09:57:54 -04:00
Dan Luhring 2754c889eb Replace links to Slack channels with public signup link (#424) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-05-26 09:18:25 -04:00
Dan Luhring 8be0d988e7 Fix go mod tidy release problem (#422) 
* Add go mod tidy check

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Run go mod tidy

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-05-25 17:13:58 -04:00
Dan Luhring 80e23bdb50 Add config option for import timeout (#421) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-05-25 15:01:02 -04:00
Dan Luhring 17bbf840cf Allow registry auth config without authority value (#420) 
* Allow registry auth config without authority value

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Update CLI tests for new stereoscope log output

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-05-24 16:05:56 -04:00
Dan Luhring 7ae4504182 Merge pull request #399 from anchore/java-cpe-group-id-handling 
Don't use pom groupId for Jenkins and Jira plugins
 2021-04-21 08:06:33 -04:00
Dan Luhring 8c178c497e Merge pull request #379 from anchore/fix-column-mismatch 
Expose column index for UI handler consumers
 2021-04-13 10:08:27 -04:00
Dan LuhringandAlex Goodman 6195002ae5 Add docker image and refactor release pipeline (#310) 
* Create independent build targets for Mac and Linux

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Create targets for macOS signing and notarization

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Create target for Linux packaging

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Update release workflow and leverage new make targets

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Add release assets to release draft

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Add homebrew formula release follow-up and improve Makefile

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Add follow-up workflow for updating version check file

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Get rid of fetch depth 0 for checkout action

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Add follow-up workflow for Docker images

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Restore wait-for-checks job

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Replace make functions with shell functions

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Account for envsubst command in bootstrap-ci-linux

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* move homebrew generation into script

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add release approval step; remove goreleaser; add docker image smoke testing in acceptance step

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* replace homebrew formula template file with heredoc template

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update release documentation

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2021-03-10 13:25:31 -05:00
Dan Luhring fee878028a Merge pull request #324 from anchore/etui-handle-signals 
Add handling of interrupting signals to the UI
 2021-02-12 09:21:16 -05:00
Dan Luhring 26d1975870 Merge pull request #318 from anchore/allow-path-prefixes 
Allow path prefixes
 2021-02-02 10:30:34 -05:00
Dan Luhring b22fd987db Merge pull request #316 from anchore/fix-zero-layers-panic 
Bring in fix from stereoscope for zero-layers panic
 2021-02-01 12:03:28 -05:00
Dan Luhring 407769e88c Merge pull request #314 from anchore/issue-291-java-parent-ref 
Ensure java parent pkg ref isn't nil when looking for parent matches
 2021-01-27 11:51:40 -05:00
Dan Luhring 7bcdafe745 Merge pull request #312 from anchore/omit-empty-packages 
Omit empty packages
 2021-01-22 16:10:06 -05:00
Dan Luhring 76446abd7d Merge pull request #299 from anchore/with-content-api-refactor 
Bump stereoscope to pull in content API refactors
 2021-01-04 14:41:00 -05:00
Dan Luhring e299a5355f Merge pull request #303 from anchore/fix-site-packages-dir 
Handle site packages based on which egg file is parsed
 2020-12-23 13:23:01 -05:00
Dan Luhring 737a81c38c Sort generated CPEs by specificity (#289) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2020-12-11 12:08:39 -05:00
Dan Luhring 65cbacd135 Clarify python wheel parsing process (#281) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2020-12-01 16:30:30 -05:00
Dan Luhring ae71b8832d Update stereoscope version to fix opaque directory merge issue (#278) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2020-11-30 11:37:44 -05:00
Dan Luhring a640a2c4cd Merge pull request #267 from anchore/improve-java-version-recognition 
Improve Java version recognition
 2020-11-17 10:59:54 -05:00
Dan Luhring a5b72405dd Merge pull request #265 from anchore/package-json-license-objects 
Improve package.json license parsing
 2020-11-14 13:06:24 -05:00
Dan Luhring 4c38ea595d Merge pull request #261 from anchore/fix-brew 
Add signed and notarized ZIP release asset
 2020-11-11 13:09:45 -05:00
Dan Luhring 3699a917fd Merge pull request #254 from anchore/updates-to-mac-releases 
Updates for macOS release process
 2020-11-06 13:49:54 -05:00
Dan Luhring ecfc471ce5 Resolve security warning for macOS users (#249) 
* Add support for macOS signing and notarization

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Use Docker to run the changelog generator locally

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2020-11-04 15:47:55 -05:00
Dan Luhring bffc4713a7 Update zip archive handling to match globs as expected (#244) 
* Refactor zip file tests

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Add glob support for leading slashes

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Update zip testing to account for glob matching

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Ignore .DS_STORE

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Improve normalization of zip entry names

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Rename zip test helpers file

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2020-10-28 16:50:40 -04:00
Dan Luhring f19cb03aa0 Update doublestar to include fix for open dirs issue (#240) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2020-10-26 11:19:25 -04:00
Dan Luhring 5adfce19e0 Set prerelease to auto (#189) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2020-09-29 16:33:40 -04:00
Dan Luhring b6dfdf16b6 Remove and update TODOs (#194) 
* Remove and update TODOs

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Update TODO with link

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2020-09-29 11:53:19 -04:00
Dan Luhring 47a0454084 Update dependencies (#147) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2020-08-13 12:12:05 -04:00
Dan Luhring 73ec35f513 Update installation method (#139) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2020-08-10 19:29:19 -04:00
Dan Luhring 89dc415e49 Add badges (#137) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2020-08-10 16:46:12 -04:00
Dan Luhring 4c7784da62 Add shell completion script (#131) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2020-08-10 09:31:02 -04:00
Dan Luhring 70e673204c Add poetry cataloger (#121) 
* Minor cleanup

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Update pkg Type definition to string

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Implement poetry.lock parsing

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Address CI issues

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Integrate Alex's changes

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2020-08-04 18:22:43 -04:00