Justin Chadwell
e3d6ffd30e
fix: typo in os.Getwd error message ( #1433 )
...
Signed-off-by: Justin Chadwell <me@jedevc.com >
2023-01-03 14:56:20 +00:00
Justin Chadwell
8d36b21237
fix: additional excessive go binary warnings ( #1432 )
...
The original fix b125ea83bame@jedevc.com >
2023-01-03 09:54:08 -05:00
Rui Chen
6a7d6e6071
docs: migrate to homebrew-core ( #1427 )
2023-01-02 08:16:32 -05:00
Keith Zantow
e1e489a284
fix: unicode output in cyclonedx-json format ( #1420 )
2022-12-23 08:37:47 -05:00
Keith Zantow
b125ea83ba
fix: excessive go binary warnings ( #1424 )
2022-12-23 08:36:49 -05:00
Christopher Angelo Phillips
3690f979b3
feat: update spdx format model to produce valid spdx json documents ( #1418 )
2022-12-21 15:56:03 -05:00
Alex Goodman
5dd726fc86
clean package names in python parsers ( #1417 )
...
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2022-12-21 18:31:49 +00:00
Christopher Angelo Phillips
c8b8b1ca11
docs: update schema name to 2.3 ( #1416 )
2022-12-20 02:57:19 +00:00
Keith Zantow
7b08608adb
feat: add h1digest when scanning go.mod ( #1405 )
...
Fixes https://github.com/anchore/syft/issues/1277
2022-12-20 02:18:35 +00:00
dja-fr
82f32c7301
feat: Add license parsing for java ( #1385 )
2022-12-19 20:10:15 -05:00
Keith Zantow
4ffbeeeea5
fix: cyclonedx component type for binaries ( #1406 )
2022-12-19 19:49:27 -05:00
Keith Zantow
b1d6dae203
fix: openjdk detection pattern ( #1415 )
2022-12-19 19:49:04 -05:00
Christopher Angelo Phillips
0f1e8fca14
bug: spdx checksum empty array; allow syft to generate SHA1 for spdx-tag-value documents ( #1404 )
2022-12-20 00:10:35 +00:00
Thomas Klausner
8b38549b79
Add NetBSD support. ( #1412 )
2022-12-19 16:59:50 -05:00
Christopher Angelo Phillips
23a3173c9f
feat: add catalog delete ( #1377 )
2022-12-12 12:55:12 -05:00
Keith Zantow
17aa8287e6
docs: remove file classifier ( #1397 )
2022-12-08 16:50:29 +00:00
Christopher Angelo Phillips
730d3e3187
chore: update latest cyclonedx library ( #1390 )
2022-12-08 11:36:08 -05:00
Keith Zantow
997fbdfcf3
feat: Add Java binary catalogers ( #1392 )
2022-12-08 10:50:28 -05:00
Marc-Etienne Vargenau
13ceed9336
chore: Update SPDX license list to 3.19 ( #1389 )
2022-12-08 10:29:27 -05:00
Chapman Pendery
668f102340
fix: add manual vendor/product removal to fix false flags ( #1070 )
...
Closes https://github.com/anchore/syft/issues/1066
Closes https://github.com/anchore/grype/issues/800
Closes https://github.com/anchore/grype/issues/491
2022-12-08 09:57:42 -05:00
anchore-actions-token-generator[bot]
f1a124209a
Update Stereoscope to c5ff155d72f166e2332e160a75c3ff2b8e9c7e2e ( #1395 )
...
Signed-off-by: GitHub <noreply@github.com >
2022-12-08 08:32:49 +00:00
Keith Zantow
5dbb3fc41d
chore: fix test busybox image sha ( #1393 )
2022-12-07 20:15:39 -05:00
Keith Zantow
614ea00905
fix: go version not properly identified in binary ( #1384 )
2022-12-02 13:24:36 -05:00
anchore-actions-token-generator[bot] and wagoodman
247b054ab5
Update Stereoscope to 3b80d983223f6e6fc2d33b0ffa003d30268418e9 ( #1376 )
...
Signed-off-by: GitHub <noreply@github.com >
Signed-off-by: GitHub <noreply@github.com >
Co-authored-by: wagoodman <wagoodman@users.noreply.github.com >
2022-11-30 16:11:57 +00:00
Keith Zantow
9e43725951
fix: Update node binary package name ( #1375 )
2022-11-30 10:30:57 -05:00
Keith Zantow
4f39287216
feat: Generic Binary Cataloger ( #1336 )
2022-11-29 18:28:10 -05:00
Alex Goodman
7a69e2129b
recover from bad parsing of golang binary ( #1371 )
...
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2022-11-29 15:56:46 +00:00
Dan Luhring
f6996f7b9a
Fix parsing of apk databases with large entries ( #1365 )
...
Closes https://github.com/anchore/syft/issues/1354
2022-11-29 10:16:36 -05:00
anchore-actions-token-generator[bot] and spiffcs
bd523bdb5d
Update syft bootstrap tools to latest versions. ( #1369 )
...
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com >
2022-11-29 10:13:00 -05:00
Christopher Angelo Phillips
0cbd0cc703
fix: guard for locations < 1 in alpmdb parse ( #1366 )
2022-11-28 15:43:18 +00:00
Christopher Angelo Phillips
b290a445ca
fix: remove cabal.project.freeze panic on last pkg ( #1363 )
2022-11-23 22:33:18 +00:00
Christopher Angelo Phillips
bcfe38c009
fix: requirements.txt - return unicode only letter/num for version ( #1361 )
2022-11-22 10:43:05 -05:00
anchore-actions-token-generator[bot] and spiffcs
74967a28ea
Update syft bootstrap tools to latest versions. ( #1356 )
...
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com >
2022-11-21 09:57:49 -05:00
Keith Zantow
098e61dcc8
fix: sort relationships in SPDX output ( #1350 )
2022-11-21 09:26:24 -05:00
Keith Zantow
0dddf51fd5
chore: add debug logging for decode errors ( #1352 )
2022-11-21 09:26:11 -05:00
mikcl
04880c06ce
feat(npm): handle aliases in package-lock.json ( #1349 )
2022-11-20 11:32:10 -05:00
Christopher Angelo Phillips
da4b2df576
fix: spdx java checksum correctness ( #1348 )
2022-11-18 13:42:55 -05:00
Rob Cresswell
9d8244bae6
feat: Add support for npm lockfile version 3 ( #1206 )
...
This PR adds support for npm lockfile version 3, which drops the
"dependencies" key and uses "packages" instead. I've refactored the
lockfile parser to make the distinction between the versions explicit
rather than the implicit behaviour before. It _might_ be worth splitting
into separate files at some point, but the logic is so minimal that I
haven't done it.
Fixes #1203
Signed-off-by: Rob Cresswell <robcresswell@users.noreply.github.com >
2022-11-18 12:41:31 -05:00
Christopher Angelo Phillips
67888ee855
1111 clean name bug ( #1347 )
2022-11-18 14:45:18 +00:00
Alex Goodman and Keith Zantow
9afc9231c0
Add spdx relationship encoding for dependencies ( #1342 )
...
Co-authored-by: Keith Zantow <kzantow@gmail.com >
2022-11-18 09:40:10 -05:00
Keith Zantow
42cb0a47a4
feat: SPDX 2.3 support ( #1311 )
2022-11-18 08:54:39 -05:00
0c4b99c1c2
SBOM cataloger ( #1029 )
...
* SBOM cataloger
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* sbom-cataloger: turn off by default
and add integration test
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* SBOM cataloger
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* SBOM cataloger (optimize)
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* SBOM cataloger (fix)
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* SBOM cataloger (fix imports #1172 )
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* SBOM cataloger (fix: support group attribute in CDX SBOMs)
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
* port to generic cataloger and add relationship to original file
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* generalize parser for all format globs
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Patrik Beno <patrik.beno@greenhorn.sk >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Co-authored-by: Tom Fay <tomfay@microsoft.com >
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
2022-11-16 14:11:45 -05:00
Christopher Angelo Phillips
0774ad15e2
chore: clean up linting configuration ( #1343 )
2022-11-16 16:28:09 +00:00
Keith Zantow
f8be64d312
fix: Unmarshal Syft JSON with missing metadata ( #1338 )
2022-11-15 13:00:10 -05:00
Alex Goodman
1ae577a035
fix apk decode for older data shapes ( #1341 )
...
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2022-11-15 16:38:31 +00:00
Weston Steimel
09bf5b062c
chore: add unit test for wolfi os release identification ( #1340 )
...
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
2022-11-14 18:57:31 -05:00
Keith Zantow
c1fdfce5f1
fix: Output only valid CPEs for CycloneDX OS components ( #1339 )
2022-11-14 15:24:19 -05:00
Justin Chadwell
10f43d75e0
feat: Add --name option to override name in output ( #1269 )
2022-11-10 14:03:23 -05:00
949cff158d
Add support for dependency relationships for alpine (apk) ( #1063 )
...
* Fix type of pull deps and add support for provides
Signed-off-by: Dan Luhring <dan+github@luhrings.com >
* [wip] apk dependency lookup
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update whitespace for linter
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
* adjust test conditions
Signed-off-by: Timothy Gerla <tim@gerla.net >
* fix TODOs and improve Provides parser
* run simports after main merge
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
* add tests to cover apk relationship parsing cases
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* generate JSON schema for breaking changes to apk metadata
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* update tests to account for additional dependencies
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* [wip] fix relationship encoding for cyclonedx
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
* simplify package relationships that can be expressed
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Dan Luhring <dan+github@luhrings.com >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
Signed-off-by: Timothy Gerla <tim@gerla.net >
Co-authored-by: Alex Goodman <alex.goodman@anchore.com >
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
Co-authored-by: Timothy Gerla <tim@gerla.net >
2022-11-09 15:43:37 +00:00
Alex Goodman
e58d0aecb8
normalize alpm md5 refs ( #1333 )
...
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
2022-11-09 15:04:15 +00:00
Justin Chadwell
Rui Chen
Keith Zantow
Christopher Angelo Phillips
Alex Goodman
dja-fr
Thomas Klausner
Marc-Etienne Vargenau
Chapman Pendery
anchore-actions-token-generator[bot]
Dan Luhring
mikcl
Rob Cresswell
Weston Steimel
