Weston Steimel
ebeb768f59
fix: add manual namespace mapping for org.springframework jars ( #2345 )
...
Signed-off-by: Weston Steimel <weston.steimel@proton.me >
2023-11-21 18:28:10 +00:00
Duane May and Alex Goodman
d4733fac1d
Add binary classifiers for MySQL and MariaDB ( #2316 )
...
* Add MySQL and MariaDB binary classifiers
Signed-off-by: Duane May <duanemay@gmail.com >
Signed-off-by: Duane May <mduane@vmware.com >
* use smallest possible binary fixtures
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Duane May <duanemay@gmail.com >
Signed-off-by: Duane May <mduane@vmware.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-11-21 16:54:41 +00:00
David Dooling
34774a0e10
Enhance redis binary classifier ( #2329 )
...
Allow existing matcher to match host identifiers longer than 12
characters. The binaries distributed by redis have the version before
payload, so add a matcher for that. Add test fixtures covering these
scenarios.
Signed-off-by: David Dooling <david.dooling@docker.com >
2023-11-21 16:24:59 +00:00
Weston Steimel
9d766c0325
fix: add manual namespace mapping for org.springframework.security jars ( #2343 )
...
Signed-off-by: Weston Steimel <weston.steimel@proton.me >
2023-11-21 13:46:34 +00:00
Weston Steimel
5751b43608
fix: add manual namespace mapping for org.bouncycastle jars ( #2342 )
...
Signed-off-by: Weston Steimel <weston.steimel@proton.me >
2023-11-21 08:17:07 -05:00
Alex Goodman
5565bdef0c
Remove the power-user command and related catalogers ( #2306 )
...
* remove the power-user command
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove secrets + classifier catalogers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-11-20 15:44:28 +00:00
Alex Goodman
1676934c63
Add "pretty" json configuration and change default behavior to be space-efficient ( #2275 )
...
* expose underlying format options
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove escape html options and address PR feedback
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* incorporate PR feedback
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix cli test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-11-20 15:29:34 +00:00
Alex Goodman
11a8cde8e4
export metadata type helper ( #2328 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-11-15 19:05:18 +00:00
Weston Steimel
dcd062cffb
fix(java): add manual groupid mappings for org.apache.velocity jars ( #2327 )
...
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
2023-11-15 17:44:36 +00:00
Weston Steimel
b9294976ef
fix(java): skip maven bundle plugin logic if vendor id and symbolic name match ( #2326 )
...
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
2023-11-15 17:44:15 +00:00
Colm O hEigeartaigh
3e8a2304e8
Refine license searching from groupIDFromJavaMetadata to allow for having the artfactId in the groupId ( #2313 )
...
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org >
2023-11-15 10:04:31 -05:00
Colm O hEigeartaigh
0652998b9b
Add license for golang stdlib ( #2317 )
...
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org >
2023-11-14 11:53:07 -05:00
Colm O hEigeartaigh
7ccbadff34
Fall back to searching maven central using groupIDFromJavaMetadata ( #2295 )
...
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org >
2023-11-10 22:02:53 -05:00
Alex Goodman
3f13d209a5
rename file.Location.VirtualPath to AccessPath ( #2288 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-11-09 11:30:08 -06:00
Benji Visser and Alex Goodman
0891d35e07
include image labels in cycloneDX SBOM ( #2294 )
...
* include image labels in SBOM
Signed-off-by: Benji Visser <benji@093b.org >
* update tests
Signed-off-by: Benji Visser <benji@093b.org >
* gocritic
Signed-off-by: Benji Visser <benji@093b.org >
* add properties
Signed-off-by: Benji Visser <benji@093b.org >
* add decoder
Signed-off-by: Benji Visser <benji@093b.org >
* update golden snapshots
Signed-off-by: Benji Visser <benji@093b.org >
* decodeProperties
Signed-off-by: Benji Visser <benji@093b.org >
* add test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove the snapshot test changes
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* restore snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Benji Visser <benji@093b.org >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-11-08 23:13:04 +00:00
Alex Goodman
502971a1b2
Add accessPath on Location objects to syft-json output ( #2287 )
...
* add accessPath on Location objects to syft-json output
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* generate json schema v12.0.1
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-11-08 17:05:30 -06:00
Colm O hEigeartaigh and Alex Goodman
dc14dbb326
SPDX file has duplicate sha256 tag in versionInfo ( #2300 )
...
* SPDX file has duplicate sha256 tag in versionInfo
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org >
* add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-11-08 22:49:31 +00:00
Colm O hEigeartaigh
bae5a2e741
Check maven central as well for licenses in parents poms for nested jars ( #2302 )
...
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org >
2023-11-08 10:26:12 -08:00
Keith Zantow
d91c2dd842
fix: identify cyclone-json without $schema ( #2303 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2023-11-08 11:54:22 -05:00
anchore-actions-token-generator[bot] and wagoodman
4ba92ac43b
chore(deps): update CPE dictionary index ( #2290 )
...
Signed-off-by: GitHub <noreply@github.com >
Co-authored-by: wagoodman <wagoodman@users.noreply.github.com >
2023-11-06 09:23:24 -05:00
Colm O hEigeartaigh
9fa11f2339
Wire though maven-url to java config ( #2291 )
...
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org >
2023-11-06 09:08:03 -05:00
Mark Severson
1470abaded
Use case-insensitive matching for Go license files ( #2286 )
...
Signed-off-by: Mark Severson <mark@kasten.io >
2023-11-03 14:47:09 -04:00
Colm O hEigeartaigh and Christopher Phillips
2d582f78a1
Add a new Java configuration option to recursively search parent poms… ( #2274 )
...
- Add a new Java configuration option to recursively search parent poms for licenses
---------
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org >
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2023-11-03 10:33:02 -04:00
Alex Goodman
b2f4d7eda2
Follow convention for naming catalogers ( #2277 )
...
* follow convention for naming catalogers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix cataloger name example
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-11-02 12:39:42 +00:00
Alex Goodman
6c41f15975
change dir resolver to include virtual path ( #2259 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-11-02 08:20:00 -04:00
Colm O hEigeartaigh and Christopher Phillips
26cdbfc299
fix: syft does not handle the case of parsing a jar with multiple poms ( #2231 )
...
---------
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org >
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2023-11-01 17:10:17 +00:00
Robbie Vanbrabant
dc9bc58480
add PURLs when scanning Gradle lock files ( #2278 )
...
This adds PURLs when scanning Gradle lock files.
Unintuitively the correct PURL type appears to be `maven` as opposed to
`gradle`. See https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst
- `gradle` for Gradle plugins
- `maven` for Maven JARs and related artifacts
Signed-off-by: Robbie Vanbrabant <robbie@monzo.com >
2023-11-01 13:09:31 -04:00
Christopher Angelo Phillips
ee4e69285a
test: remove dll files and updates tests to use versionResources ( #2276 )
...
* test: remove dll files and updates tests to use versionResources
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
* test: update integration tests with dot net coverage
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
* chore: move test cases to appropriate blocks
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
* fix: chmod only the dll
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
* fix: add primary annotation key to packages
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
* chore: bump number of packages with new dotnet package
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2023-10-31 15:33:52 -04:00
Christopher Angelo Phillips
59c56a5666
fix: update dot net binary parsing logic to remove empty space ( #2273 )
...
* fix: update parsing logic to remove empty space
* tests: update with test cases provided by community
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2023-10-31 10:43:29 -04:00
Colm O hEigeartaigh and Christopher Phillips
78ac2f9797
Read a license from a parent pom stored in Maven Central ( #2228 )
...
* Read a license from a parent pom stored in Maven Central
---------
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org >
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2023-10-30 17:48:16 -04:00
Alex Goodman
1aaa644007
Remove MetadataType from core package object and normalize JSON metadataType values ( #1983 )
...
* [wip]
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* distinct the package metadata functions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove metadata type from package core model
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* incorporate review feedback for names
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add RPM archive metadata and split parser helpers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* clarify the python package metadata type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename the KB metadata type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* break hackage and composer types by use case
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* linting fix
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix encoding and decoding for syft-json and cyclonedx
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump json schema to 11
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update cyclonedx-json snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update cyclonedx-xml snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update spdx-json snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update spdx-tv snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update syft-json snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* correct metadata type in stack yaml parser test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix bom-ref redactor for cyclonedx-xml
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add tests for legacy package metadata names
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate json schema v11
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix legacy HackageMetadataType reflect type value check
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* packagemetadata discovery should account for type shadowing
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix cli tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump json schema version to v12
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update json schema to incorporate changes from main
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add syft-json legacy config option
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add tests around v11-v12 json decoding
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add docs for SYFT_JSON_LEGACY
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename structs to be compliant with new naming scheme
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-10-30 12:12:04 -04:00
629aafc323
chore(deps): update CPE dictionary index ( #2271 )
...
* chore(deps): update CPE dictionary index
Signed-off-by: GitHub <noreply@github.com >
---------
Signed-off-by: Will Murphy <will.murphy@anchore.com >
Signed-off-by: GitHub <noreply@github.com >
Co-authored-by: Will Murphy <will.murphy@anchore.com >
Co-authored-by: willmurphyscode <willmurphyscode@users.noreply.github.com >
2023-10-30 09:48:03 -04:00
Colm O hEigeartaigh
1daf18fee9
feat: Perform case insensitive matching on Java license files ( #2235 )
...
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org >
2023-10-25 09:51:59 -04:00
Alex Goodman
7392d607b6
Split the sbom.Format interface by encode and decode use cases ( #2186 )
...
* split up sbom.Format into encode and decode ops
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update cmd pkg to inject format configs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump cyclonedx schema to 1.5
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* redact image metadata from github encoder tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add more testing around format decoder identify
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add test case for format version options
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix cli tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix CLI test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] - review comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* keep encoder creation out of post load function
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* keep decider and identify functions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add a few more doc comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove format encoder default function helpers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address PR feedback
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* move back to streaming based decode functions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* with common convention for encoder constructors
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests and allow for encoders to be created from cli options
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix cli tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* buffer reads from stdin to support seeking
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-10-25 13:43:06 +00:00
Christopher Angelo Phillips
cd530924d0
fix: 2179 jar chokes empty lines ( #2254 )
...
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2023-10-24 14:03:47 -04:00
anchore-actions-token-generator[bot] and Alex Goodman
73d5852119
chore(deps): update CPE dictionary index ( #2253 )
...
* fix CPE workflow
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* chore(deps): update CPE dictionary index
Signed-off-by: GitHub <noreply@github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: GitHub <noreply@github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-10-24 13:22:02 -04:00
Stefan Profanter
234ce4e1f3
feat: add conaninfo.txt parser to detect conan packages in docker images ( #2234 )
...
* feat: add conaninfo.txt parser to detect conan packages in docker images
Signed-off-by: Stefan Profanter <stefan.profanter@agile-robots.com >
* fix: add NewConanInfoCataloger as a separate cataloger
Signed-off-by: Stefan Profanter <stefan.profanter@agile-robots.com >
---------
Signed-off-by: Stefan Profanter <stefan.profanter@agile-robots.com >
2023-10-23 16:17:50 -04:00
Chao Li and Will Murphy
671ff39933
Add ruby.NewGemSpecCataloger to DirectoryCatalogers. ( #1971 )
...
* Add ruby.NewGemSpecCataloger to DirectoryCatalogers.
Signed-off-by: Evan <chaol@vmware.com >
* fixed tests
Signed-off-by: Evan <chaol@vmware.com >
* Addressed review comment
Signed-off-by: Evan <chaol@vmware.com >
* Remove NewInstalledGemSpecCataloger from default dir catalogers
Because the files that the installed gemspec cataloger work off of are a
subset of the files that the more general gemspec cataloger will work
off of, we shouldn't have both of them on by default, since this could
result in finding the same package twice.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
---------
Signed-off-by: Evan <chaol@vmware.com >
Signed-off-by: Will Murphy <will.murphy@anchore.com >
Co-authored-by: Will Murphy <will.murphy@anchore.com >
2023-10-23 08:49:57 -04:00
Christopher Angelo Phillips and Auston-Zhang
ef43294d0e
Add download location when cataloging directory npm package lock ( #2238 )
...
* added download locatoin (resolved) when cataloging a directory - javascript ecosystem- npm - packag-lock
Signed-off by Auston(Aoxiang) Zhang <auston.zhang@dal.ca >
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
* chore: get DCO to fire
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
Co-authored-by: Auston-Zhang <ax706429@dal.ca >
2023-10-20 11:40:38 -04:00
Christopher Angelo Phillips
e1ad340c2d
fix: allow packages to be captured from DIST/EGG case ( #2239 )
...
* fix: allow packages to be captured from DIST/EGG case
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
* test: update expected glob paths
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2023-10-20 11:29:13 -04:00
07f13049da
Account for maven bundle plugin and fix filename matching ( #2220 )
...
* account for maven bundle plugin and fix filename matching
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add in-repo jar tests based on metadata to cover #2130
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* tests: fix test merge commit
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
Co-authored-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2023-10-19 17:57:23 -04:00
Alex Goodman
7018573bf7
Remove internal string set ( #2219 )
...
* remove internal string set
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* incorporate changes from #2227
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* beef up the pkg.License.Merg() doc string
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-10-17 12:52:11 -04:00
Alex Goodman
31f1d7dbf0
Fix panic for empty input to Swift cataloger ( #2226 )
...
* survive invalid input in swift parser
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add empty file
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-10-16 11:04:33 -04:00
Colm O hEigeartaigh
2687100e6a
Detect a license file in the root directory or META-INF of a jar ( #2213 )
...
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org >
2023-10-12 11:09:53 -04:00
Benji Visser and Alex Goodman
fe7a417fb2
Parse donet dependency trees ( #2143 )
...
* add dependency information for .NET pkgs
Signed-off-by: Benji Visser <benji@093b.org >
* update pkg coverage directory test
Signed-off-by: Benji Visser <benji@093b.org >
* reverse dependsOn relationship
Signed-off-by: Benji Visser <benji@093b.org >
* update root pkg parsing
Signed-off-by: Benji Visser <benji@093b.org >
* add comments about the test relationships represented
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add docs around relationship sorting functions + update test helpers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Benji Visser <benji@093b.org >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-10-11 18:01:24 +00:00
Alex Goodman
ef759038f5
Add relationships for dpkg packages ( #2212 )
...
* add relationships for deb packages
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* small refactor to remove duplicate code
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-10-11 08:56:26 -04:00
0748945c83
Parse the Maven license from the pom.xml if not contained in the mani… ( #2115 )
...
* Parse the Maven license from the pom.xml if not contained in the manifest
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org >
* chore: restore 10.0.2 schema
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
* chore: generate new 11.0.1 schema
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
* refactor: remove schema change
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
* test: update unit tests to align with new pattern
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
* chore: pr feedback
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
* chore: remove struct tags
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
* keep license name and url semantics preserved on the pkg object
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org >
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2023-10-10 13:09:44 -04:00
Mohammad Sharief Baig
d16ecdf715
Fix algo lookup by converting key to lower case ( #2207 )
...
Signed-off-by: Mohammad Sharief Baig <shariefmohammad007@gmail.com >
2023-10-09 13:07:18 -04:00
Christopher Angelo Phillips
f6c8057977
feat: add package for go compiler given binary detection ( #2195 )
...
adds a unique synthetic package to the SBOM output that represents the go compiler when it is detected as a part of a package discovered by the go binary cataloger.
When using an SBOM generated by syft - downstream vulnerability scanners now have the opportunity to detect/report on the PURL/CPEs attached to the new stdlib package.
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2023-10-06 13:15:50 -04:00
dependabot[bot] and Christopher Phillips
87e57aa925
chore(deps): bump github.com/docker/distribution from 2.8.2+incompatible to 2.8.3+incompatible ( #2193 )
...
* chore(deps): bump github.com/docker/distribution
Bumps [github.com/docker/distribution](https://github.com/docker/distribution ) from 2.8.2+incompatible to 2.8.3+incompatible.
- [Release notes](https://github.com/docker/distribution/releases )
- [Commits](https://github.com/docker/distribution/compare/v2.8.2...v2.8.3 )
---
updated-dependencies:
- dependency-name: github.com/docker/distribution
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
* chore: update reference import
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
---------
Signed-off-by: dependabot[bot] <support@github.com >
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2023-10-06 12:54:19 -04:00
Weston Steimel
Duane MayandAlex Goodman
David Dooling
Colm O hEigeartaigh
Benji VisserandAlex Goodman
Keith Zantow
anchore-actions-token-generator[bot]andwagoodman
Mark Severson
Robbie Vanbrabant
Christopher Angelo Phillips
Stefan Profanter
Chao LiandWill Murphy
Mohammad Sharief Baig
dependabot[bot]andChristopher Phillips