oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-01 15:06:36 +01:00
Code Issues Packages Projects Releases Wiki Activity
1,118 Commits 65 Branches 273 Tags
e52aa3bc034b0f882c5f2b34b2ec4ee448bc09bb
Commit Graph
88 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Christopher Angelo Phillips 6e764815d0 fix: move reproduction to top of issue (#1264) 2022-10-19 12:51:38 -04:00
Christopher Angelo Phillips ec229b993c fix: update syftjson ID to match major schema version (#1274) 2022-10-19 16:08:38 +00:00
Christopher Angelo Phillips 89575199b8 feat: add RelationshipsBySourceOwnership to syft json output (#1248) 2022-10-11 15:11:03 -04:00
Christopher Angelo Phillips fa0b3c0438 fix: reset merged package into map; (#1258) 2022-10-11 18:35:46 +00:00
Christopher Angelo Phillips 7d2fe9d95e feat: add identifiable field to source object (#1243) 2022-10-05 14:01:40 -04:00
Christopher Angelo Phillips dd7c654ed0 update requires to use list; remove field (#1234) 2022-09-30 11:57:13 -04:00
Christopher Angelo Phillips e6502536a7 add sequence diagrams and flesh out TODO notes (#1233) 2022-09-28 13:05:49 -04:00
Christopher Angelo Phillipsandhoudini91 04d288b364 feat: catalog python files for installed-files.txt file metadata (#1217) 
Co-authored-by: houdini91 <mdstrauss91@gmail.com>
 2022-09-19 20:08:02 +00:00
Christopher Angelo Phillips 0f99215b2c bug: remove chance for panic; provide default attestation path (#1214) 2022-09-19 15:50:33 +00:00
Christopher Angelo Phillips ad263e6562 refactor: update Makefile organization; update DEVELOPING.md instructions (#1212) 2022-09-19 10:38:12 -04:00
Christopher Angelo Phillips b48316742f refactor: replace ioutil=>io; update linter (#1211) 2022-09-16 17:58:16 +00:00
Christopher Angelo Phillips 586d3fe77f Revert "External sources configuration (#1158)" (#1191) 
reverted as functionality is to be merged with dev branch of kubecon draft
 2022-09-01 15:45:35 -04:00
Christopher Angelo Phillips a7966a4d9d update stereoscope to latest (#1181) 2022-08-29 19:28:19 +00:00
Christopher Angelo PhillipsandAlex Goodman 615f933d98 Bug fix for 1095 - syft conversion option error (#1177) 
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2022-08-25 17:36:15 -04:00
Christopher Angelo Phillips 5be7e081f5 retraction for mispublished versions (#1147) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-08-06 10:52:21 -04:00
Christopher Angelo Phillips 042304ee4c Correct squashfs import and fix incorrect bouncer configuration (#1138) 2022-08-03 09:46:14 -04:00
Christopher Angelo Phillips e68f384063 disable release for docker assets (#1137) 2022-08-02 14:47:07 -04:00
Christopher Angelo Phillips f5d02d4e52 improve docker release bootstrap (#1136) 2022-08-02 15:44:24 +00:00
Christopher Angelo Phillips b7f587f5dc remove docker login from keychain (#1135) 2022-08-02 09:42:12 -04:00
Christopher Angelo Phillips d196ab70a0 remove ENV checks from siging script (#1134) 2022-08-01 22:08:41 +00:00
Christopher Angelo Phillips 1bf97af3fb remove docker assets from main goreleaser configuration to reduce mac-os runner friction (#1133) 2022-08-01 21:08:38 +00:00
Christopher Angelo Phillips ca69fb8370 remove prefixed v from tag to match release (#1131) 2022-08-01 15:07:58 +00:00
Christopher Angelo Phillips 8f21180681 rollback actions-setup-docker to earlier version (#1130) 2022-08-01 14:10:50 +00:00
Christopher Angelo Phillips 20ad59ad1b Delete pr_action.yaml (#1120) 2022-07-27 17:12:00 +00:00
Christopher Angelo Phillips 5dc729b67e patch-distroless-ghcr (#1110) 2022-07-20 16:51:49 -04:00
Christopher Angelo Phillips 7bae9d4b4e add distroless debug image to published release (#1106) 
add debug distroless image to published release

Debian was chosen based on the fact that it is the smallest available distroless image
The new tag is `anchore/syft:debug`

Closes #833
 2022-07-20 15:54:46 +00:00
Christopher Angelo Phillips 571de3602a update help formatting (#1105) 2022-07-19 14:46:48 +00:00
Christopher Angelo Phillips 64b4852c2a moves go-rpmdb to latest; libc => v1.16.7 (#1098) 2022-07-12 10:30:21 -04:00
Christopher Angelo Phillips ba685eada8 Add PR action back to workflow with new token (#1086) 2022-07-06 09:31:51 -04:00
Christopher Angelo Phillips 47df66960f update AltRpmDbGlob with comment and context (#1085) 2022-07-05 11:29:31 -04:00
Christopher Angelo Phillips 3ce1a4aac1 remove pr automation until service account creation (#1080) 2022-06-30 21:43:24 +00:00
Christopher Angelo Phillips bafc66a5e7 remove OSS Meetup message (#1057) 2022-06-23 18:07:23 +00:00
Christopher Angelo Phillips 03e37044d4 update stereoscope to latest version (#1052) 2022-06-16 14:56:33 -04:00
Christopher Angelo Phillips 9e72771b85 update zip_read_closer to incorporate zip64 support (#1041) 2022-06-16 10:43:18 -04:00
Christopher Angelo Phillips f35a252ecf add workflows to test new project automation (#1023) 2022-06-08 09:42:53 -04:00
Christopher Angelo Phillips 82de24cf7c change draft to false for release process (#1016) 2022-06-01 11:55:33 -04:00
Christopher Angelo Phillips 03ee4fdf5e add integration tests for validating CycloneDX output using cyclonedx-cli (#1000) 2022-05-12 12:56:04 -04:00
Christopher Angelo Phillips a83506628c Add README updates for Keyless features (#988) 2022-05-09 16:07:28 +00:00
Christopher Angelo PhillipsandAlex Goodman d2d532f4a8 835 - Keyless Support for SBOM Attestations (#910) 
Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2022-05-06 18:06:32 -04:00
Christopher Angelo Phillips 03d51c36d0 golang.org/x/crypto upgrade (#979) 2022-05-02 21:33:40 +00:00
Christopher Angelo Phillips 4ce2edda9e add version info and remove double config call (#977) 2022-05-02 14:54:10 +00:00
Christopher Angelo Phillips 6029dd7c2e refactor command package to remove globals and add dependency injection 2022-04-26 18:23:03 +00:00
Christopher Angelo Phillips b46d044d7e Update spdx22json to only take uppercase checksum algorithm (#946) 2022-04-11 14:56:04 -04:00
Christopher Angelo Phillips 782b2e3348 Add digest property to parent and nested java package metadata (#941) 2022-04-08 15:12:32 -04:00
Christopher Angelo Phillips 4231f38fa2 add case to decode GolangBinMetadata for syftjson model (#901) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-03-18 15:15:10 -04:00
Christopher Angelo Phillips 93d2d57cd3 update README with OSS Meetup information (#890) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-03-15 11:37:56 -04:00
Christopher Angelo Phillips fa03723617 Upgrade vault api from v1.3.1 to v1.4.1 (#878) 
* move v1.3.1 => v1.4.1
* go mod tidy

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-03-09 15:11:07 -05:00
Christopher Angelo Phillips 003d28ad48 Add SchemaVersion to version command output (#877) 
* make JsonSchemaVersion available programmatically via syft version command

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-03-09 13:12:52 -05:00
Christopher Angelo Phillips ad322b3314 bump error language and remove panic (#862) 
* bump error language and remove panic

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-03-03 10:37:18 -05:00
Christopher Angelo PhillipsandAlex Goodman afc0c1acd9 855 attest registry source only (#856) 
Add source.NewFromRegistry function so that the syft attest command can always explicitly ask for an OCIRegistry provider rather than rely on local daemon detection for image sources.

Attestation can not be used where local images loaded in a daemon are the source. Digest values for the layer identification step in attestation can sometimes vary across workstations.

This fix makes it so that attest is generating an SBOM for, and attesting to, a source that exists in an OCI registry. It should never load a source from a local user docker/podman daemon.

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2022-03-01 23:16:42 -05:00
Christopher Angelo Phillips bb3d713b97 cpe generation update (#850) 
* do not allow empty CPE to be returned as part of a packages list

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-02-25 17:06:05 -05:00
Christopher Angelo Phillips 256e85bc12 510 - SBOM attestation stdout (#785) 
add syft attest command to produce an attestation as application/vnd.in-toto+json to standard out using on disk PKI

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-02-22 21:45:12 -05:00
Christopher Angelo Phillips 52d2e62cdc remove duplicate manifest lines (#828) 2022-02-15 12:51:02 -05:00
Christopher Angelo Phillips e1e9ccb401 update golang crypto library dependency (#815) 
* bump golang crypto to resolve CVE-2020-29652

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* go mod tidy

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-02-11 13:36:52 -05:00
Christopher Angelo Phillips 8f96adacfb Upgrade golang to 1.17 (#809) 
* initial upgrade workflow

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* update go.mod

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-02-09 11:08:24 -05:00
Christopher Angelo Phillipsandhectorj2f 024a5a9f3f Add dependencies to cyclonedx (#768) 
Add dependencies to cyclonedx

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: hectorj2f <hectorf@vmware.com>
 2022-01-25 15:34:16 -05:00
Christopher Angelo Phillips d2e815a2c5 Add attestation workflow to README (#759) 
* add attestation workflow to README

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-01-24 15:04:57 +00:00
Christopher Angelo Phillips f3d3eddc96 update config so on copy paste it works without edits (#762) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-01-21 14:15:22 +00:00
Christopher Angelo Phillips c350bd55f6 update sign sed command to include windows zip (#755) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-01-19 17:08:04 -05:00
Christopher Angelo Phillips dfefd2ea4e update goreleaser with windows checksums (#740) 
* update goreleaser with windows checksums

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* update format to be closer to our previous implementation

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* remove linux replacement

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* typo

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-01-10 14:52:31 -05:00
Christopher Angelo Phillips b77ddfc29c bump stereoscope version to remove old containerd (#741) 
* bump stereoscope version to remove old containerd

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* go mod tidy

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-01-10 13:40:24 -05:00
Christopher Angelo Phillips 01dc78ccc3 683 windows filepath (#735) 
Support Windows Directory Resolver
Add function that converts windows to posix functionality
Add function that converts posix to windows
Add build tags to remove windows developer environment errors
redact carriage return specific windows issues

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-01-06 11:39:04 -05:00
Christopher Angelo Phillips a689fb1213 update cp statement for core_utils_upgrade (#719) 
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-12-22 20:01:34 +00:00
Christopher Angelo Phillips 0849539729 Update concurrency primitives for relationships in command layer (#639) 
* update concurrency primitives for relationships in command layer

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-11-20 03:44:17 -05:00
Christopher Angelo Phillips 4f0099583a promote catalog task pattern to all commands (#636) 
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-11-19 13:26:23 -05:00
Christopher Angelo Phillips 45ea4177e8 update SPDX license list => 3.15 (#630) 
* update SPDX license list 

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-11-15 14:41:46 -05:00
Christopher Angelo Phillips fc39710d06 287 - Add retry for image fetch using user's input (#626) 
* add fallback to user input if source hint fails

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* refactor for smaller functions

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-11-12 17:57:04 -05:00
Christopher Angelo Phillips 319c6ee2eb document current draft for iana submission (#618) 
* document current draft for IANA submission

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-11-10 11:28:47 -05:00
Christopher Angelo PhillipsandAlex Goodman 9bbc9ff633 Add layer information for go-module-binary-cataloger (#620) 
* update functions to pass Location

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* update unit tests to pass new locations

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* fix image source.FileResolvers to include layer info

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add non-empty location in golang binary cataloger testing

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-08 16:05:53 -05:00
Christopher Angelo Phillips 3e20edee55 update readme with private registry section (#610) 2021-11-02 15:00:56 -04:00
Christopher Angelo Phillips a2882ee810 Update package identifier to be constant across multiple syft run (#595) 
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-10-29 16:00:36 +00:00
Christopher Angelo Phillips 3286a4d4cc update docker manifest tagging (#600) 
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-10-28 15:41:39 -04:00
Christopher Angelo Phillips 0ff7013382 update manifest to use Tag over Version 
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-10-28 15:05:34 -04:00
Christopher Angelo Phillips 71708e5bf8 update goreleaser with correct tag information (#598) 
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-10-28 13:37:22 -04:00
Christopher Angelo Phillips 1c63943055 Add arm64 image support and Darwin M1 support to .goreleaser.yaml (#591) 
* update support arm64

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* small update syntax

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* restore release command

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* add docker manifests

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-10-26 09:42:35 -04:00
Christopher Angelo Phillips 10fa8dc7c9 Add windows support (#548) 
* update  build tags, ui support, and stereoscope, and release for windows support

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-10-21 12:49:36 -04:00
Christopher Angelo Phillips 7a005fec06 update to point at new script for new release (#551) 
* update to point at local script release

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-10-15 13:26:34 -04:00
Christopher Angelo Phillips 9ea6330ebc update split in py package_cataloger to cap at 2 (#549) 
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-10-14 12:32:06 -04:00
Christopher Angelo Phillips 7d13fbf0d4 540 add additional go package metadata (#546) 
* update with distinct golang metadata types

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-10-13 11:00:28 -04:00
Christopher Angelo Phillips b25f5b664b (464) - remove mod and cargo from image cataloger (#539) 
* remove mod and cargo from image cataloger

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* update test error messages for clear failures

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-10-07 15:18:20 -04:00
Christopher Angelo PhillipsandAlex Goodman 3462e18af3 478 identify go binaries and extract mod information (#534) 
* add query by MIME type to source.FileResolver

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* import stereoscope lib changes to find mime type

- add bin cataloger
- add bin parser
- add mime type go utils
- import new resolver

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* add go std library code to unpack bin

- keep them in their own (original) files
- add note for "this code was copied from"
- comment the lines the required changing

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-07 12:16:38 -04:00
Christopher Angelo Phillips f47a6a88b1 (#495) Update documentNamespace uniqueness for spdx-json output (#528) 
* add unique namespace identifier

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-10-05 13:10:49 -04:00
Christopher Angelo Phillips 5e4b668e5a 497 stable sorted CPE array (JSON and SPDX) (#522) 
* add small sorting change to our specificity

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-10-01 15:31:17 -04:00
Christopher Angelo Phillips 75aed5f3ec (#460) Extend license mapping for common SPDX license names (#509) 
Fixes #460 
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-09-30 16:54:36 -04:00
Christopher Angelo Phillips 3e8afc5274 update log file permissions to 0644 (#511) 
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-09-21 10:34:10 -04:00
Christopher Angelo Phillips 93d00dc340 Populate Files and Relationship fields for spdx-json output (#507) 
* update spdx22 Document model to include relationships field

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* update document and relationship to match current JSON spec
https://github.com/spdx/spdx-spec/blob/development/v2.2.1/schemas/spdx-schema.json
https://github.com/spdx/spdx-spec/pull/528
https://github.com/spdx/spdx-spec/pull/528#issuecomment-904180177

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* update File struct based on SPDX schema

Required fields:
[ "SPDXID", "fileName", "copyrightText", "licenseConcluded" ]
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-09-17 09:06:12 -04:00
Christopher Angelo Phillips 95df7dd035 Add command examples to release documentation (#503) 
* update release document with commands run
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* small edits
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-09-14 09:08:37 -04:00
Christopher Angelo Phillips 3f305aa6cd (#342) - remove strong distro check (#496) 
* add Type conversion to remove strong distro type limit
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* update signatures to be correct variable from os-release
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-09-09 13:05:22 -04:00