oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-12 06:07:20 +02:00
Code Issues Packages Projects Releases Wiki Activity
1,560 Commits 63 Branches 272 Tags
ee121cff215a223bf4c6186e101f40f75914a5a8
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Christopher Angelo PhillipsandKeith Zantow ee121cff21 feat: 1944 - update purl generation to use a consistent groupID (#2033) 
Separate the logic for CPE and PURL generation. 

PURL generation needs a single answer for groupID based on a priority of discovering the field. 
CPE generation still uses multiple potential groupID to populate the candidate cpe.

Improve GroupID detection. 

Currently syft does not use any hierarchy for GroupID detection and treats all sources as equal. 
It treats fields from the manifest file with priority. This change adds a hierarchy to the fields and returns a single answer based on that hierarchy.
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
 2023-08-22 10:47:07 -04:00
Christopher Angelo Phillips 541c8d339b 1948-filter-pkg-by-type (#2011) 
---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-08-09 16:05:52 -04:00
Christopher Angelo Phillips 466da7cbda 931: binary cataloger exclusion defaults for ownership by overlap (#1948) 
Fixes #931

PR #1948 introduces a new implicit exclusion for binary packages that overlap by file ownership and have certain characteristics:

1) the relationship between packages is OwnershipByFileOverlap
2) the parent package is an "os" package - see changelog for included catalogers
3) the child is a synthetic package generated by the binary cataloger - see changelog for included catalogers
4) the package names are identical

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-08-08 13:00:52 -04:00
Christopher Angelo Phillips 78660022bf test: add coverage for new rpmdb paths (#1999) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-08-04 13:04:36 -04:00
Christopher Angelo Phillips e774006052 fix: update glob to use newer usr/lib/sysimage path (#1997) 
See this link for details on the path migration for the rpmdb
https://fedoraproject.org/wiki/Changes/RelocateRPMToUsr

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-08-03 16:23:50 -07:00
Christopher Angelo Phillips 8e893dfc20 feat: use originator logic to fill supplier (#1980) 
* feat: use Originator to fill supplier for NTIA minimum
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-08-01 17:19:49 -04:00
Christopher Angelo Phillips 3aae316456 chore: update to latest commit in tools-golang (#1969) 
* chore: update to latest commit in tools-golang

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-07-27 15:29:22 -04:00
Christopher Angelo Phillips 0327fdc88a docs: capture artifactory dev settings from 1895 (#1947) 
* docs: capture artifactory dev settings from 1895

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-07-19 16:54:18 +00:00
Christopher Angelo Phillips 204b790012 docs: update docs with new docker specific instructions (#1941) 
* docs: update docs with new docker specific instructions
---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Former-commit-id: c67c76e84df84e3e24aa307637d884ca8b7e3eea
 2023-07-17 18:19:21 +00:00
Christopher Angelo Phillips 2e7fd031d4 fix: remove indirect dependency of circl v1.1.0 (#1940) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-07-13 12:30:37 -04:00
Christopher Angelo Phillips 32296f5943 chore: move wait before iteration to guarantee read before tea (#1931) 
* chore: move wait before iteration to guarantee read before tea

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-07-12 13:59:31 -04:00
Christopher Angelo Phillips 38efe4ec5f fix: background reader apart from global handler for testing (#1929) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-07-12 12:37:19 -04:00
Christopher Angelo Phillips 72616db81f fix: "or-later" suffix updated to consider deprecated "+" operator (#1907) 
* fix: or-later suffix has been updated to consider deprecated +

If a given license has the suffix "or-later" it previously could have
been considered or represented with a "+". Example "GFDL-1.0-or-later"
could have been represented as "GFDL-1.0+". This PR allows the license
list generation to consider "or-later" as == to "+" when generating
permutations for upgrading deprecated licenses.

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-07-11 16:21:29 +00:00
Christopher Angelo Phillips d21fa84335 chore: update iterations to protect against race (#1927) 
* chore: update iterations to protect against race
---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-07-10 11:44:54 -04:00
Christopher Angelo Phillipsandguoguangwu f07581f504 Pr 1825 (#1865) 
chore: code cleanup

Signed-off-by: guoguangwu <guoguangwu@magic-shield.com>

---------

Signed-off-by: guoguangwu <guoguangwu@magic-shield.com>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: guoguangwu <guoguangwu@magic-shield.com>
 2023-06-05 17:01:00 +00:00
Christopher Angelo Phillips 4ac8fdf6df fix: add panic recovery for license parse (#1839) 
* fix: add panic recovery for license parse
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-05-23 16:58:49 +00:00
Christopher Angelo Phillips 4601ca3735 fix: update field plurality of 8.0.0 schema before release (#1820) 
to keep things consistent across the schema we want Locations and URLs to be plural fields now that they are fields on the License struct
---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-05-16 13:05:48 -04:00
Christopher Angelo Phillips 1a2a49840b fix: update cataloger to check for expressions before split (#1819) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-05-16 16:04:28 +00:00
Christopher Angelo Phillips 42fa9e4965 feat: update syft license concept to complex struct (#1743) 
this PR makes the following changes to update the underlying license model to have more expressive capabilities
it also provides some guarantee's surrounding the license values themselves

- Licenses are updated from string -> pkg.LicenseSet which contain pkg.License with the following fields:
- original `Value` read by syft
- If it's possible to construct licenses will always have a valid SPDX expression for downstream consumption
- the above is run against a generated list of SPDX license ID to try and find the correct ID
- SPDX concluded vs declared is added to the new struct
- URL source for license is added to the new struct
- Location source is added to the new struct to show where the expression was pulled from
 2023-05-15 16:23:39 -04:00
Christopher Angelo PhillipsandAlex Goodman c038f13d44 chore: go-rpmdb update (#1757) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2023-04-24 10:34:13 -04:00
Christopher Angelo Phillips a42bac6fcc fix: only cache java packages and not source content (#1750) 
* fix: only cache java packages and not source content

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* fix: add gradle to matched files for ci checksum

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-04-19 16:07:34 -04:00
Christopher Angelo Phillips 55a90a2ee0 fix: update cache.fingerprint file to java-builds dir (#1748) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-04-19 12:17:07 -04:00
Christopher Angelo Phillips dfcc07e512 feat: Add config option to allow user to select the default image source location 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-03-31 10:04:10 -04:00
Christopher Angelo Phillips f473bb75a8 1577 spdxlicense generate (#1691) 
Update the license_list.go to have more permissible inputs for greater SPDXID matching.
EX:
GPL3 gpl3 gpl-3 and GPL-3 can all map to GPL-3.0-only

By moving all strings to lower and removing the "-" we're able to return valid SPDX license ID for a greater diversity of input strings.
---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-03-23 11:48:24 -04:00
Christopher Angelo Phillips 928c4a55ff feat: add shared dir for easier cleanup (#1676) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-03-16 16:05:34 -04:00
Christopher Angelo Phillips 61362c04fa fix: move defer after error to protect panic case (#1670) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-03-15 15:29:10 -04:00
Christopher Angelo Phillips 98e737fc27 chore: update deprecated release flag (#1629) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-02-27 15:57:56 -05:00
Christopher Angelo Phillips 9995950c70 fix: update config struct to not decode password/key (#1538) 
* fix: update config struct to not decode password/key
* test: update tests to confirm no secrets in output

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-02-03 18:06:14 +00:00
Christopher Angelo Phillips 8c91605541 1465 attestation with private key (#1502) 
1465 attestation with private key (#1502)

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-01-26 11:19:13 -05:00
Christopher Angelo Phillips 03971ace43 chore: use checkout v3 with new depth (#1471) 2023-01-17 21:26:39 +00:00
Christopher Angelo Phillips 07aee798b0 chore: use checkout v2 for tag depth (#1470) 2023-01-17 21:03:29 +00:00
Christopher Angelo PhillipsandAlex Goodman 44e8ae2577 fix: update attestation code to remove library dependencies and shellout for keyless flow (#1442) 
Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2023-01-12 17:22:05 +00:00
Christopher Angelo Phillips 795a63f1c9 docs: add cataloger construction summary (#1434) 2023-01-05 17:03:00 +00:00
Christopher Angelo Phillips 3690f979b3 feat: update spdx format model to produce valid spdx json documents (#1418) 2022-12-21 15:56:03 -05:00
Christopher Angelo Phillips c8b8b1ca11 docs: update schema name to 2.3 (#1416) 2022-12-20 02:57:19 +00:00
Christopher Angelo Phillips 0f1e8fca14 bug: spdx checksum empty array; allow syft to generate SHA1 for spdx-tag-value documents (#1404) 2022-12-20 00:10:35 +00:00
Christopher Angelo Phillips 23a3173c9f feat: add catalog delete (#1377) 2022-12-12 12:55:12 -05:00
Christopher Angelo Phillips 730d3e3187 chore: update latest cyclonedx library (#1390) 2022-12-08 11:36:08 -05:00
Christopher Angelo Phillips 0cbd0cc703 fix: guard for locations < 1 in alpmdb parse (#1366) 2022-11-28 15:43:18 +00:00
Christopher Angelo Phillips b290a445ca fix: remove cabal.project.freeze panic on last pkg (#1363) 2022-11-23 22:33:18 +00:00
Christopher Angelo Phillips bcfe38c009 fix: requirements.txt - return unicode only letter/num for version (#1361) 2022-11-22 10:43:05 -05:00
Christopher Angelo Phillips da4b2df576 fix: spdx java checksum correctness (#1348) 2022-11-18 13:42:55 -05:00
Christopher Angelo Phillips 67888ee855 1111 clean name bug (#1347) 2022-11-18 14:45:18 +00:00
Christopher Angelo Phillips 0774ad15e2 chore: clean up linting configuration (#1343) 2022-11-16 16:28:09 +00:00
Christopher Angelo Phillips 10464642e9 fix: only generate PURL on empty string (#1312) 2022-11-03 10:00:14 -04:00
Christopher Angelo Phillips 4c5c6f6319 fix: update ci secret to use new password (#1304) 2022-11-01 14:30:29 +00:00
Christopher Angelo Phillips 1b69fbd566 fix: update secret value to use new cert cahin (#1303) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-11-01 00:05:40 +00:00
Christopher Angelo Phillips 7ed91c0e31 fix: verbose quill release failures (#1302) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-10-31 22:21:30 +00:00
Christopher Angelo Phillips 8e2fc29bc7 fix: unterminated quoted string (#1300) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-10-31 20:07:43 +00:00
Christopher Angelo Phillips e9fbc38064 fix: update Makefile to remove old signing arch (#1299) 2022-10-31 18:56:30 +00:00
Christopher Angelo Phillips edeba9c01c feat: add nodejs-binary package classifier (#1296) 2022-10-31 16:45:11 +00:00
Christopher Angelo Phillips 6e764815d0 fix: move reproduction to top of issue (#1264) 2022-10-19 12:51:38 -04:00
Christopher Angelo Phillips ec229b993c fix: update syftjson ID to match major schema version (#1274) 2022-10-19 16:08:38 +00:00
Christopher Angelo Phillips 89575199b8 feat: add RelationshipsBySourceOwnership to syft json output (#1248) 2022-10-11 15:11:03 -04:00
Christopher Angelo Phillips fa0b3c0438 fix: reset merged package into map; (#1258) 2022-10-11 18:35:46 +00:00
Christopher Angelo Phillips 7d2fe9d95e feat: add identifiable field to source object (#1243) 2022-10-05 14:01:40 -04:00
Christopher Angelo Phillips dd7c654ed0 update requires to use list; remove field (#1234) 2022-09-30 11:57:13 -04:00
Christopher Angelo Phillips e6502536a7 add sequence diagrams and flesh out TODO notes (#1233) 2022-09-28 13:05:49 -04:00
Christopher Angelo Phillipsandhoudini91 04d288b364 feat: catalog python files for installed-files.txt file metadata (#1217) 
Co-authored-by: houdini91 <mdstrauss91@gmail.com>
 2022-09-19 20:08:02 +00:00
Christopher Angelo Phillips 0f99215b2c bug: remove chance for panic; provide default attestation path (#1214) 2022-09-19 15:50:33 +00:00
Christopher Angelo Phillips ad263e6562 refactor: update Makefile organization; update DEVELOPING.md instructions (#1212) 2022-09-19 10:38:12 -04:00
Christopher Angelo Phillips b48316742f refactor: replace ioutil=>io; update linter (#1211) 2022-09-16 17:58:16 +00:00
Christopher Angelo Phillips 586d3fe77f Revert "External sources configuration (#1158)" (#1191) 
reverted as functionality is to be merged with dev branch of kubecon draft
 2022-09-01 15:45:35 -04:00
Christopher Angelo Phillips a7966a4d9d update stereoscope to latest (#1181) 2022-08-29 19:28:19 +00:00
Christopher Angelo PhillipsandAlex Goodman 615f933d98 Bug fix for 1095 - syft conversion option error (#1177) 
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2022-08-25 17:36:15 -04:00
Christopher Angelo Phillips 5be7e081f5 retraction for mispublished versions (#1147) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-08-06 10:52:21 -04:00
Christopher Angelo Phillips 042304ee4c Correct squashfs import and fix incorrect bouncer configuration (#1138) 2022-08-03 09:46:14 -04:00
Christopher Angelo Phillips e68f384063 disable release for docker assets (#1137) 2022-08-02 14:47:07 -04:00
Christopher Angelo Phillips f5d02d4e52 improve docker release bootstrap (#1136) 2022-08-02 15:44:24 +00:00
Christopher Angelo Phillips b7f587f5dc remove docker login from keychain (#1135) 2022-08-02 09:42:12 -04:00
Christopher Angelo Phillips d196ab70a0 remove ENV checks from siging script (#1134) 2022-08-01 22:08:41 +00:00
Christopher Angelo Phillips 1bf97af3fb remove docker assets from main goreleaser configuration to reduce mac-os runner friction (#1133) 2022-08-01 21:08:38 +00:00
Christopher Angelo Phillips ca69fb8370 remove prefixed v from tag to match release (#1131) 2022-08-01 15:07:58 +00:00
Christopher Angelo Phillips 8f21180681 rollback actions-setup-docker to earlier version (#1130) 2022-08-01 14:10:50 +00:00
Christopher Angelo Phillips 20ad59ad1b Delete pr_action.yaml (#1120) 2022-07-27 17:12:00 +00:00
Christopher Angelo Phillips 5dc729b67e patch-distroless-ghcr (#1110) 2022-07-20 16:51:49 -04:00
Christopher Angelo Phillips 7bae9d4b4e add distroless debug image to published release (#1106) 
add debug distroless image to published release

Debian was chosen based on the fact that it is the smallest available distroless image
The new tag is `anchore/syft:debug`

Closes #833
 2022-07-20 15:54:46 +00:00
Christopher Angelo Phillips 571de3602a update help formatting (#1105) 2022-07-19 14:46:48 +00:00
Christopher Angelo Phillips 64b4852c2a moves go-rpmdb to latest; libc => v1.16.7 (#1098) 2022-07-12 10:30:21 -04:00
Christopher Angelo Phillips ba685eada8 Add PR action back to workflow with new token (#1086) 2022-07-06 09:31:51 -04:00
Christopher Angelo Phillips 47df66960f update AltRpmDbGlob with comment and context (#1085) 2022-07-05 11:29:31 -04:00
Christopher Angelo Phillips 3ce1a4aac1 remove pr automation until service account creation (#1080) 2022-06-30 21:43:24 +00:00
Christopher Angelo Phillips bafc66a5e7 remove OSS Meetup message (#1057) 2022-06-23 18:07:23 +00:00
Christopher Angelo Phillips 03e37044d4 update stereoscope to latest version (#1052) 2022-06-16 14:56:33 -04:00
Christopher Angelo Phillips 9e72771b85 update zip_read_closer to incorporate zip64 support (#1041) 2022-06-16 10:43:18 -04:00
Christopher Angelo Phillips f35a252ecf add workflows to test new project automation (#1023) 2022-06-08 09:42:53 -04:00
Christopher Angelo Phillips 82de24cf7c change draft to false for release process (#1016) 2022-06-01 11:55:33 -04:00
Christopher Angelo Phillips 03ee4fdf5e add integration tests for validating CycloneDX output using cyclonedx-cli (#1000) 2022-05-12 12:56:04 -04:00
Christopher Angelo Phillips a83506628c Add README updates for Keyless features (#988) 2022-05-09 16:07:28 +00:00
Christopher Angelo PhillipsandAlex Goodman d2d532f4a8 835 - Keyless Support for SBOM Attestations (#910) 
Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2022-05-06 18:06:32 -04:00
Christopher Angelo Phillips 03d51c36d0 golang.org/x/crypto upgrade (#979) 2022-05-02 21:33:40 +00:00
Christopher Angelo Phillips 4ce2edda9e add version info and remove double config call (#977) 2022-05-02 14:54:10 +00:00
Christopher Angelo Phillips 6029dd7c2e refactor command package to remove globals and add dependency injection 2022-04-26 18:23:03 +00:00
Christopher Angelo Phillips b46d044d7e Update spdx22json to only take uppercase checksum algorithm (#946) 2022-04-11 14:56:04 -04:00
Christopher Angelo Phillips 782b2e3348 Add digest property to parent and nested java package metadata (#941) 2022-04-08 15:12:32 -04:00
Christopher Angelo Phillips 4231f38fa2 add case to decode GolangBinMetadata for syftjson model (#901) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-03-18 15:15:10 -04:00
Christopher Angelo Phillips 93d2d57cd3 update README with OSS Meetup information (#890) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-03-15 11:37:56 -04:00
Christopher Angelo Phillips fa03723617 Upgrade vault api from v1.3.1 to v1.4.1 (#878) 
* move v1.3.1 => v1.4.1
* go mod tidy

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-03-09 15:11:07 -05:00
Christopher Angelo Phillips 003d28ad48 Add SchemaVersion to version command output (#877) 
* make JsonSchemaVersion available programmatically via syft version command

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-03-09 13:12:52 -05:00
Christopher Angelo Phillips ad322b3314 bump error language and remove panic (#862) 
* bump error language and remove panic

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-03-03 10:37:18 -05:00