oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-01 15:06:36 +01:00
Code Issues Packages Projects Releases Wiki Activity
1,118 Commits 65 Branches 273 Tags
e52aa3bc034b0f882c5f2b34b2ec4ee448bc09bb
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Alex Goodman e52aa3bc03 port haskell cataloger to new generic cataloger pattern (#1290) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-10-27 11:30:22 -04:00
Alex Goodman 6826d7603b port golang cataloger to new generic cataloger pattern (#1289) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-10-25 16:42:50 +00:00
Alex Goodman 52cb7269bf port deb/dpkg cataloger to new generic cataloger pattern (#1288) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-10-25 15:47:32 +00:00
Alex Goodman bd5adbc9b3 update cataloger tests to use pkgtest utils (#1287) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-10-25 11:20:02 -04:00
Alex Goodman c7a653060d port dotnet cataloger to new generic cataloger pattern (#1286) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-10-24 21:17:27 +00:00
Alex Goodman fbdde6d4f4 port dart cataloger to new generic cataloger pattern (#1285) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-10-24 20:37:42 +00:00
Alex Goodman eb8ebd9ffc port conan cataloger to new generic cataloger pattern (#1284) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-10-24 20:11:20 +00:00
Alex Goodman f36c0ca971 port apk cataloger to new generic cataloger pattern (#1283) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-10-24 13:51:09 -04:00
Alex Goodman 28cadfdb5d replace signing tooling with quill (#1280) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-10-24 13:03:10 -04:00
Alex Goodman b44f441c82 Upgrade generic cataloger (#1281) 
* add second generation of generic cataloger

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* upgrade aplm cataloger to use generic.Cataloger

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove pacakge found-by attribute from the definition of a package ID

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-10-24 11:12:12 -04:00
Alex Goodman d8c659b65b replace logger interface with anchore/go-logger (#1279) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-10-21 15:12:14 +00:00
Alex Goodman 48f0a4680f fix apkdb checksum representation (#1247) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-10-05 16:29:05 -04:00
Alex Goodman c5dca001e2 warn on errors from RPM DB parsing (#1200) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-09-09 18:59:42 +00:00
Alex Goodman 2693a8c19a metadata decoding should be optional (#1154) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-08-10 16:20:53 +00:00
Alex Goodmanandramanan-ravi ea611dab5f Add catalogers configuration (#1038) 
* Option to enable specific language or ecosystem cataloger

Signed-off-by: ramanan-ravi <ramanan@deepfence.io>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* Disable dotnet cataloger

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* Option to enable specific language or ecosystem cataloger

Signed-off-by: Ramanan Ravikumar <ramanan@deepfence.io>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* rename "enable-cataloger" option to "catalogers"

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add cli test for --catalogers option

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update readme with latest cataloger names

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* enable dotnet cataloger

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix cataloger imports

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update readme with alpmdb cataloger config example

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Co-authored-by: ramanan-ravi <ramanan@deepfence.io>
 2022-06-21 13:06:25 +00:00
Alex Goodman d2f053bc71 unblock timeout for power-user select CLI tests (#985) 
* update to use shared secretsFixture to prevent race

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-05-05 15:12:11 +00:00
Alex Goodman 172ecc0d77 Preserve syft IDs on SBOM decode (#963) 2022-04-18 18:10:55 +00:00
Alex Goodman e415bb21e7 Update write permissions and log into ghcr.io for release (#942) 2022-04-06 21:15:55 +00:00
Alex Goodman 748cfbf006 Retry auth URL lookup without docker credentialhelper workaround (#939) 2022-04-06 16:27:13 +00:00
Alex Goodman 68b7ad9770 Additionally publish docker images to GHCR (#934) 2022-04-01 11:30:21 -04:00
Alex Goodman f24bbc1838 Deduplicate packages across multiple container image layers (#930) 2022-03-31 15:45:51 -04:00
Alex Goodman f157d7a862 Pull from DockerHub fails for public images when using SSO (#928) 2022-03-30 17:32:49 +00:00
Alex Goodman cc2c0e57a0 bump strset version to fix 386 builds (#911) 2022-03-23 14:34:54 -04:00
Alex Goodman 5253da4b36 Rollback referencing docker config items (#912) 2022-03-23 18:33:41 +00:00
Alex Goodman cffcaf5984 Improve docker config support (#906) 2022-03-22 11:02:54 -04:00
Alex Goodman 7f9edf346a Bump golangci-lint to 1.45.0 (#909) 2022-03-22 11:02:36 -04:00
Alex Goodman 03e193e577 Add platform option to the README (#889) 2022-03-21 12:02:15 -04:00
Alex Goodman 069aa68b63 Fix image cleanup when there is an error (#905) 2022-03-21 14:48:11 +00:00
Alex Goodman 2946813a74 RPM Epoch should be optional in the json schema (#880) 2022-03-09 14:51:43 -05:00
Alex Goodman 9d9669e62f Add artifacthub owner (#876) 2022-03-09 12:50:31 +00:00
Alex Goodman 07d3c9af52 Fix file creation for output options (#875) 2022-03-08 15:37:28 +00:00
Alex GoodmanandChristopher Phillips 5123f073c7 Update containerd via stereoscope (#870) 
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-03-07 17:37:20 +00:00
Alex Goodman 991af0d857 Include root path in directory resolve index (#869) 2022-03-07 11:34:16 -05:00
Alex Goodman a86dd3704e Add platform selection (#866) 2022-03-04 22:41:38 +00:00
Alex Goodman 4af32c5bee Migrate format definitions to sbom package (#864) 2022-03-04 17:22:40 -05:00
Alex Goodman 635904fcb6 Reduce PR check failures (#858) 2022-03-02 17:51:37 +00:00
Alex Goodman d2f28e0eb1 Restore single goreleaser file (#853) 2022-02-28 14:46:41 +00:00
Alex Goodman 1d1a7de314 Fix goreleaser generated config path (#852) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-26 07:30:38 -05:00
Alex Goodman 24cd39089a Share import mac code signing certificate steps for release (#851) 2022-02-25 20:07:03 -05:00
Alex Goodman c89131bcf3 Bump release timeout (#848) 2022-02-25 16:32:57 +00:00
Alex Goodman 99bb93d0fe Resolve symlinks when fetching file contents (#782) 2022-02-24 10:01:59 -05:00
Alex Goodman 7eea98fcc5 Allow for CPE strings that can later be sanitized (#844) 2022-02-23 15:18:12 -05:00
Alex Goodman 738b3b60a5 Add exception for handlebars java package to generate nodejs CPE (#837) 2022-02-22 17:29:28 -05:00
Alex Goodman 55c7f3d1e7 Upgrade install.sh to support installations for previous versions (#830) 2022-02-15 22:23:11 +00:00
Alex Goodman 51c6eb30f5 bump stereoscope to include functional options (#823) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-14 20:40:51 -05:00
Alex Goodman 220f3a24fd deduplicate SPDX tag-value package IDs (#813) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-10 21:18:00 +00:00
Alex Goodman ca032434b3 Add pURL generation for java packages + fix NPM pURL generation (#812) 
* enhance pURL generation for java packages

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* optionally split out npm namespaces for pURL generation

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* nit updates

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-10 13:46:38 -05:00
Alex Goodman 8f292958a6 set version makefile var for updating version file (#808) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-09 08:25:31 -05:00
Alex Goodman ac024f94a4 encapsulate showing the signing log with failing (#807) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-08 01:26:34 +00:00
Alex Goodman 0ed2842123 serialize notarization (#806) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-07 23:47:47 +00:00
Alex Goodman b78c90d018 use parent dir for notarization zip (#804) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-07 22:50:48 +00:00
Alex Goodman 2c62651c82 run signing as post-build step (#803) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-07 16:55:15 -05:00
Alex Goodman 5519a25035 dont add signing artifact (#802) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-07 17:03:09 +00:00
Alex Goodman 950ad681a0 Stabilize CI behavior (#796) 
* reduce parallelism of builds and increase install.sh test setup buffer

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* change logging mechanism for signing

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* restore automatic parallelism determination for goreleaser

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* rm logging goreleaser version

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-07 07:55:11 -08:00
Alex Goodman 37251f6179 Fix intermittent slow CLI tests (#797) 
* use a port that is porbably not in use

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* template cli test args

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-06 15:53:55 +00:00
Alex Goodman e474b2f23c docker auth must occur after setting up prod keychain (#795) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-05 15:23:05 +00:00
Alex Goodman e7bef5e511 split signing setup into pre-release hook (#794) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-04 16:49:42 -05:00
Alex Goodman e4ac7700dd pass notarize arg, not original archive (#793) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-04 19:44:37 +00:00
Alex Goodman d3469801fc repackage all file in notarization temp dir (not from tar output) (#792) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-04 19:04:15 +00:00
Alex Goodman 3f50bb8fa7 tput requires explicit terminal type in CI (#791) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-04 18:23:30 +00:00
Alex Goodman 341288ba29 Normalize snapshot and release artifacts (#789) 
* refactor signing steps in release/snapshot workflows

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* show signing logs on snapshot or release failure

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update install.sh + tests to account for new goreleaser changes

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update cli tests to account for new goreleaser build names

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix acceptance test to use new snapshot bin path

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add notarization

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* address review comments

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-04 12:41:37 -05:00
Alex Goodman f38b0b7256 Refactor install.sh (#765) 
* [wip] get assets based on gh api

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* put install.sh download_asset fn under test

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* put install.sh install_asset fn under test

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* use zip for darwin installs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix install.sh negative test cases

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* allow errors to propagate in install.sh

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove exit on error from install.sh tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add more docs around install.sh helpers

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add integration tests for install.sh

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add install.sh testing to pipeline

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add install test cache to CI

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* make colors globally available

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* test download against github release

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* always test release-based install against latest release

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* use better install.sh test names

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-01 16:58:47 -05:00
Alex Goodman d7a23e4bb2 Extract language and package type from pURLs on SBOM decode (#777) 
* add language detection from pURLs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add package type detection from pURLs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add cargo and npm pURL support

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix npm tests and linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-01-27 09:35:16 -05:00
Alex Goodman 6f0fad7ffd encode upstream qualifier on os package pURLs (#769) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-01-25 09:55:56 -05:00
Alex Goodman 1350d6c5bf Improve package URL support (#754) 
* rename npm metadata struct

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* improve os package URLs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* improve language package URLs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* wire up composer pURL method

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-01-19 22:30:29 +00:00
Alex Goodman 829e500aa9 Add additional PHP metadata (#753) 
* add php related metadata

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* enable decoding of php metadata for syftjson format

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add php metadata to json schema

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-01-19 11:42:16 -05:00
Alex Goodman 86c3c1c531 Start developer documentation (#746) 
* draft outline for developing docs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update outline

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* list testing dependencies

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix header indention

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix title

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-01-14 06:17:25 -05:00
Alex Goodman 706f291679 Replace distro type (#742) 
* remove strong distro type

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* bump json schema to v3 (breaking distro shape)

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* allow for v2 decoding of distro idLikes field in v3 json decoder

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix casing in simple linux release name

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* use discovered name as pretty name in simple linux release

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-01-12 12:13:42 -05:00
Alex Goodman 38c4b17847 Add support for searching for jars within archives (#734) 
* add support for searching jars within archives

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add package cataloger config options

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* address review comments + factor out safeCopy helper

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update config docs regarding package archive search options

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* show that unindexed archive cataloging defaults to false

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove lies about -s

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* address review comments

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update search archive note about java

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-01-06 21:40:51 +00:00
Alex Goodman a18fbacae7 Revert "bump goreleaser to v1.2 (#720)" (#731) 
This reverts commit 8535ee5b2e.

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2022-01-03 15:19:00 +00:00
Alex Goodman 7f8cb0bd80 remove unstable CLI test (bad binaries) (#721) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-12-22 15:55:37 -05:00
Alex Goodman 8535ee5b2e bump goreleaser to v1.2 (#720) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-12-22 20:37:48 +00:00
Alex Goodman a27907659d Performance improvements around package ID (#698) 
* set package ID in catalogers and improve hashing performance

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update setting ID + tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-12-16 08:55:53 -05:00
Alex Goodman 727b84ce0d prefer warning over erroring out when parsing java manifests (#688) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-12-14 12:17:05 -05:00
Alex Goodman 3d8c16649d Fix M1 install (#686) 
* M1 install.sh script should use zip

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add arm64 binary extraction

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-12-14 15:54:46 +00:00
Alex Goodman ab9fe53ff2 Recover from panics from the stdlib when cataloging malformed binaries (#663) 
* recover from panics in stdlib binary parsing

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add CLI test to cover regression case

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-12-10 11:49:50 -05:00
Alex Goodman da0b17b719 Add cataloging of macho multi-architecture binaries (#657) 
* add cataloging within universal binaries

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update json test fixtures

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add comments + correct 32 bit multi arch magic check

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-12-08 16:25:24 -05:00
Alex Goodman c7752f0f6c fix panic from reading nonexistent reader (#658) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-12-08 20:28:47 +00:00
Alex Goodman 22c4b275e7 bump containerd and image-spec (#654) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-12-03 16:12:43 +00:00
Alex Goodman ffccfc8f3f update stereoscope to bump docker dependency (#648) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-12-02 11:18:00 -05:00
Alex Goodman 5aec918683 reduce relationship noise (#653) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-12-02 09:51:18 -05:00
Alex Goodman da62387545 Fix SPDX namespace value (#649) 
* fix spdx namespace and add scheme range assertions

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* validate SPDX document name from source metadata

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* comment why namespace tests only check prefix

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-12-02 14:10:40 +00:00
Alex Goodman 21d1738b27 fix directory content fetching (#651) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-12-02 09:02:54 -05:00
Alex Goodman fe616acd98 directory resolver should account for the proc cwd relative to the root path (#644) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-30 15:34:37 -05:00
Alex Goodman 00206233e6 use smaller jotframe event buffer (#647) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-30 11:23:16 -05:00
Alex Goodman bd9007fc0e Migrate SPDX-JSON relationships to SBOM model (#634) 
* remove power-user document shape

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add power-user specific fields to syft-json format

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* port remaining spdx-json relationships to sbom model

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add coordinate set

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add SBOM file path helper

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* use internal mimetype helper in go binary cataloger

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add new package-of relationship

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update json schema to v2

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* replace power-user presenter with syft-json format

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix tests and linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove "package-of" relationship (in favor of "contains")

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add tests for spdx22json format encoding enhancements

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update TODO and log entries

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* introduce sbom.Descriptor

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-23 14:54:17 -05:00
Alex Goodman e3b34813d7 ignore partybus unsubscribe errors (#641) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-22 16:07:55 -05:00
Alex Goodman d76c868481 Catalog archive contents for single-file input (#637) 
* add first-level archive processing when input is a file

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add license exception for github.com/xi2/xz

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* always return cleanup function

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* change source.NewFromFile log entry to warn

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* ensure file source always has cleanup function

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* ensure we are always preferring the unarchive cleanup function for source

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-19 14:16:25 +00:00
Alex GoodmanandDan Luhring e38cde35ed Introduce minimal source coordinates (#623) 
* split source.Location and create source.Coordinates for minimal path addressing

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* move coordinates into separate file

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* Update syft/source/coordinates.go

Co-authored-by: Dan Luhring <luhring@users.noreply.github.com>
 2021-11-18 18:13:22 +00:00
Alex Goodman 9090c3a772 bump stereoscope, docker, and GGCR (#633) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-16 19:43:46 +00:00
Alex Goodman ef627d82ef Introduce relationships as first-class objects (#607) 
* migrate pkg.ID and pkg.Relationship to artifact package

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* return relationships from tasks

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix more tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add artifact.Identifiable by Identity() method

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove catalog ID assignment

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* adjust spdx helpers to use copy of packages

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* stabilize package ID relative to encode-decode format cycles

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* rename Identity() to ID()

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* use zero value for nils in ID generation

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* enable source.Location to be identifiable

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* hoist up package relationship discovery to analysis stage

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update ownership-by-file-overlap relationship description

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add test reminders to put new relationships under test

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* adjust PHP composer.lock parser function to return relationships

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-16 14:14:13 -05:00
Alex Goodman e28b7b53b0 bump chronicle to v0.3.0 (#627) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-13 18:56:25 -08:00
Alex Goodman 9c27fa7b0b use sbom.SBOM in ImportConfig (#621) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-08 18:39:06 -05:00
Alex GoodmanandChristopher Angelo Phillips bb0f35bac4 Introduce a single SBOM document (#606) 
* [wip] single sbom doc

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix more tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update cli tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove scope in import path

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* swap SPDX tag-value formatter to single sbom document

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* bust CLI cache

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update fixture to byte diff

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* byte for byte

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* bust the cache

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* who needs cache

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* add jar for testing

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* no more bit flips

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* update apk with the delta for image and directory cases

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* restore cache workflow

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

Co-authored-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-11-05 10:05:49 -04:00
Alex Goodman 23a67dd729 document file scheme (#613) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-02 19:47:25 -04:00
Alex Goodman 8ec3f1d102 Use anchore fork of go-presenter (#611) 
* use anchore fork of go-presenter

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* drop coverage threshold

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-02 18:09:26 +00:00
Alex Goodman ecab44bba1 Add SPDX tag-value format object (#605) 
* add new spdx tag-value format

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove public presenter package

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-02 13:45:34 -04:00
Alex GoodmanandChristopher Angelo Phillips 484284706c Use named pipe bit when checking for piped input (#603) 
* use named pipe bit when checking for piped input

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Co-authored-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-11-02 16:41:02 +00:00
Alex Goodman 3ac95ac4f6 Allow for cataloging a single file (#608) 
* allow for cataloging a single file

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* use all catalogers for file schemes

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-11-02 12:09:06 -04:00
Alex Goodman 358b3a2cf8 port text presenter to a format object (#604) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-10-29 11:31:15 -04:00