oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-12 06:07:20 +02:00
Code Issues Packages Projects Releases Wiki Activity
1,662 Commits 63 Branches 272 Tags
ef43294d0e257f785533214da83f2c24619ea128
Commit Graph
1662 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
dependabot[bot] 3f5c601620 chore(deps): bump github.com/gookit/color from 1.5.3 to 1.5.4 (#1949) 
Bumps [github.com/gookit/color](https://github.com/gookit/color) from 1.5.3 to 1.5.4.
- [Release notes](https://github.com/gookit/color/releases)
- [Commits](https://github.com/gookit/color/compare/v1.5.3...v1.5.4)

---
updated-dependencies:
- dependency-name: github.com/gookit/color
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-07-21 08:50:47 -04:00
Dan LuhringandAlex Goodman 8478e0bef7 Add support for parsing .NET assemblies (#1943) 
* Add support for parsing .NET assemblies

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

Former-commit-id: 69c33fe4d77357d843c11590f3b07825bc6249ac

* Add dll and exe files

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

Former-commit-id: b9d204efa6d2ef385b5fbb7a59a3474ecabea641

* Add PE cataloger to directory catalogers

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

Former-commit-id: 9711c00d9da92e2887e0c1f92edd740ea5345849

* Don't set language to dotnet for PEs

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

Former-commit-id: 368313fddac9160d8a06a01ebe8c5ac7990232f5

* Fix spelling of cataloger in constructor

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

Former-commit-id: e42fd77b2f8b6d42e076a84f6cce386861260941

* Adjust which cases in PE parsing return errors

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

Former-commit-id: 95b25f8fc3a7d4e18fe30e489b09851f316795ff

* remove build binary from branch

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

Former-commit-id: fa54c0d0aef0998d5520e9f44cae51f5f9cd38a2

* Fix failing CLI tests

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

---------

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-07-19 15:34:07 -04:00
Christopher Angelo Phillips 0327fdc88a docs: capture artifactory dev settings from 1895 (#1947) 
* docs: capture artifactory dev settings from 1895

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-07-19 16:54:18 +00:00
Alex Goodman 88b3d1e9bb remove build binary and add explicit git ignore 
Former-commit-id: 6455f2d8a5f1910b4a8b681ddef79919886d638d
 2023-07-18 14:06:34 -04:00
Christopher Angelo Phillips 204b790012 docs: update docs with new docker specific instructions (#1941) 
* docs: update docs with new docker specific instructions
---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Former-commit-id: c67c76e84df84e3e24aa307637d884ca8b7e3eea
 2023-07-17 18:19:21 +00:00
Alex Goodman 35699f6fdc remove jotframe UI (#1932) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-07-13 13:21:52 -04:00
Christopher Angelo Phillips 2e7fd031d4 fix: remove indirect dependency of circl v1.1.0 (#1940) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-07-13 12:30:37 -04:00
Christopher Angelo Phillips 32296f5943 chore: move wait before iteration to guarantee read before tea (#1931) 
* chore: move wait before iteration to guarantee read before tea

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-07-12 13:59:31 -04:00
Alex Goodman 4fc17edd14 implement ui handle waiter (#1930) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
v0.85.0 		2023-07-12 13:14:54 -04:00
Christopher Angelo Phillips 38efe4ec5f fix: background reader apart from global handler for testing (#1929) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-07-12 12:37:19 -04:00
dependabot[bot] 05a61897f2 chore(deps): bump modernc.org/sqlite from 1.23.1 to 1.24.0 (#1928) 
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.23.1 to 1.24.0.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.23.1...v1.24.0)

---
updated-dependencies:
- dependency-name: modernc.org/sqlite
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-07-11 14:01:48 -04:00
James NeateandChristopher Phillips 5a7c200911 fix: allow valid cyclonedx input with no components (#1873) 
fix: allow valid cyclonedx input with no components
---------

Signed-off-by: James Neate <jamesmneate@gmail.com>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-07-11 13:56:36 -04:00
Christopher Angelo Phillips 72616db81f fix: "or-later" suffix updated to consider deprecated "+" operator (#1907) 
* fix: or-later suffix has been updated to consider deprecated +

If a given license has the suffix "or-later" it previously could have
been considered or represented with a "+". Example "GFDL-1.0-or-later"
could have been represented as "GFDL-1.0+". This PR allows the license
list generation to consider "or-later" as == to "+" when generating
permutations for upgrading deprecated licenses.

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-07-11 16:21:29 +00:00
Avi DeitcherandKeith Zantow 4ab9f393fc feat: CLI flag for directory base (#1867) 
Signed-off-by: Avi Deitcher <avi@deitcher.net>
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
 2023-07-10 13:36:41 -04:00
Dan LuhringandChristopher Phillips 9744f4c009 Fix CPE gen for k8s python client (#1921) 
Signed-off-by: Dan Luhring <dluhring@chainguard.dev>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-07-10 15:54:19 +00:00
Christopher Angelo Phillips d21fa84335 chore: update iterations to protect against race (#1927) 
* chore: update iterations to protect against race
---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2023-07-10 11:44:54 -04:00
anchore-actions-token-generator[bot]andspiffcs d5d95da3b6 chore(deps): update bootstrap tools to latest versions (#1922) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>
 2023-07-10 11:03:09 -04:00
Dan Luhring c0c089ffd5 fix: Don't use the actual redis or grpc CPEs for gems (#1926) 
Signed-off-by: Dan Luhring <dluhring@chainguard.dev>
 2023-07-10 10:24:42 -04:00
Lorenzo OrsattiandChristopher Phillips 376c42893b fix(install): return with right error code (#1915) 
This resolves #1566.

Signed-off-by: Lorenzo Orsatti <49567430+lorsatti@users.noreply.github.com>
Co-authored-by: Christopher Phillips <cphillips918@gmail.com>
 2023-07-06 16:56:07 -04:00
Dan Luhring 81d8019207 Remove erroneous Java CPEs from generation (#1918) 
Signed-off-by: Dan Luhring <dluhring@chainguard.dev>
 2023-07-06 16:12:55 -04:00
dependabot[bot] 8ce88e11fd chore(deps): bump golang.org/x/net from 0.11.0 to 0.12.0 (#1916) 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.11.0 to 0.12.0.
- [Commits](https://github.com/golang/net/compare/v0.11.0...v0.12.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-07-06 16:02:44 -04:00
Alex Goodman f8b832e6c3 Switch UI to bubbletea (#1888) 
* add bubbletea UI

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* swap pipeline to go 1.20.x and add attest guard for cosign binary

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update note in developing.md about the required golang version

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix merge conflict for windows path handling

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* temp test for attest handler

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add addtional test iterations for background reader

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-07-06 09:00:46 -04:00
DD (Devdatta) DeshpandeandKeith Zantow a00a3df10c fix: use filepath.EvalSymlinks if os.Readlink fails to evaluate the link (#1884) 
Signed-off-by: DD (Devdatta) Deshpande <dd@codewits.in>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
 2023-07-05 14:49:22 -04:00
Alex Goodman cfbb9f703b add file source digest support (#1914) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-07-05 13:47:13 -04:00
anchore-actions-token-generator[bot]andspiffcs 6280146c81 chore(deps): update bootstrap tools to latest versions (#1908) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>
 2023-07-05 11:06:22 -04:00
dependabot[bot] e8f7108e6e chore(deps): bump golang.org/x/mod from 0.11.0 to 0.12.0 (#1912) 
Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.11.0 to 0.12.0.
- [Commits](https://github.com/golang/mod/compare/v0.11.0...v0.12.0)

---
updated-dependencies:
- dependency-name: golang.org/x/mod
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-07-05 11:06:05 -04:00
dependabot[bot] 023ca1be32 chore(deps): bump golang.org/x/term from 0.9.0 to 0.10.0 (#1913) 
Bumps [golang.org/x/term](https://github.com/golang/term) from 0.9.0 to 0.10.0.
- [Commits](https://github.com/golang/term/compare/v0.9.0...v0.10.0)

---
updated-dependencies:
- dependency-name: golang.org/x/term
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-07-05 11:05:46 -04:00
Marco Damiani 2e3c7fa158 doc(readme): add installation section with scoop (#1909) 
Signed-off-by: drazen04 <hangtime23@hotmail.it>
 2023-07-03 13:50:01 -04:00
Alex Goodman 4da3be864f Refactor source API (#1846) 
* refactor source API and syft json source block

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update source detection and format test utils

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* generate list of all source metadata types

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* extract base and root normalization into helper functions

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* preserve syftjson model package name import ref

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* alias should not be a pointer

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-06-30 14:19:16 +00:00
anchore-actions-token-generator[bot]andspiffcs 608dbded06 chore(deps): update bootstrap tools to latest versions (#1905) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>
 2023-06-29 14:10:30 -04:00
anchore-actions-token-generator[bot]andkzantow 791d1f9552 chore(deps): update stereoscope to cd49355d934e9e09339e0b690398afe7bd9f63f1 (#1903) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: kzantow <kzantow@users.noreply.github.com>
v0.84.1 		2023-06-28 12:05:12 -04:00
anchore-actions-token-generator[bot]andspiffcs e5e97b5c4e chore(deps): update bootstrap tools to latest versions (#1902) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>
 2023-06-28 12:04:39 -04:00
Weston Steimel 8219f8d55b fix: discover deb file relationships in distroless images (#1901) 
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2023-06-28 13:28:20 +01:00
Alex Goodman 026be3c0f1 add oss community board auto-add workflow (#1898) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2023-06-27 15:53:59 -04:00
anchore-actions-token-generator[bot]andkzantow 0d4f19043e chore(deps): update stereoscope to 8c7173ebcf69187d480d4d8b0c6cafaa7aef7024 (#1890) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: kzantow <kzantow@users.noreply.github.com>
 2023-06-26 13:58:44 -04:00
anchore-actions-token-generator[bot]andspiffcs 38b47e484c chore(deps): update bootstrap tools to latest versions (#1894) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>
 2023-06-26 13:58:17 -04:00
Stephane Rufer 7943c73d3f fix: add support for Dart SDK package dependencies (#1891) 
Signed-off-by: Stephane Rufer <1128559+rufman@users.noreply.github.com>
 2023-06-23 12:40:46 -04:00
Alex Goodman 25ce245c03 Simplify the SBOM writer interface (#1892) 
* remove sbom.writer bytes call and consolidate helpers to options pkg

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* dont close stdout

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove close operation from multiwriter

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

---------

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2023-06-23 11:21:22 -04:00
Dan Luhring 7de7a7990a fix: improve version detection in Java archive name parsing (#1889) 
Signed-off-by: Dan Luhring <dluhring@chainguard.dev>
 2023-06-22 18:42:10 +00:00
Keith Zantow f79cb9587f fix: only output valid cyclonedx license choices (#1879) 
* fix: only output valid cyclonedx license choices

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: update tests

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* chore: return nil for emtpty cdx license list

Signed-off-by: Keith Zantow <kzantow@gmail.com>

---------

Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2023-06-22 12:05:38 -04:00
Tim Gerla c27d5b11d4 docs: clarify reasoning of default catalogers for images or directories (#1887) 
Add some explanation around why there are different default sets of catalogers for image scans versus directory scans. Hopefully clarify questions related to #1776.

Signed-off-by: Timothy Gerla <tim@gerla.net>
 2023-06-20 19:47:50 +00:00
William Murphy 5d54e6e847 Configure chronicle to pre-1.0 mode (#1886) 
Track a chronicle config file that causes chronicle to bump minor
version instead of major version in response to the "breaking-change"
label for pre-1.0 releases.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
v0.84.0 		2023-06-20 16:08:35 +00:00
Keith Zantow 631d50d038 chore: update SPDX license list to 3.21 (#1885) 2023-06-20 15:47:02 +00:00
anchore-actions-token-generator[bot] 269006bf04 chore(deps): update bootstrap tools to latest versions (#1880) 2023-06-20 10:22:18 -04:00
William Murphy e2ed89f700 Pad artifact IDs (#1882) 
Otherwise the hash can sometimes be short if it results in a low uint64.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2023-06-16 13:26:18 -04:00
dependabot[bot] badb957888 chore(deps): bump golang.org/x/mod from 0.10.0 to 0.11.0 (#1878) 
Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.10.0 to 0.11.0.
- [Commits](https://github.com/golang/mod/compare/v0.10.0...v0.11.0)

---
updated-dependencies:
- dependency-name: golang.org/x/mod
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-06-15 14:10:11 -04:00
dependabot[bot] a1bba36d51 chore(deps): bump modernc.org/sqlite from 1.23.0 to 1.23.1 (#1874) 
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.23.0 to 1.23.1.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.23.0...v1.23.1)

---
updated-dependencies:
- dependency-name: modernc.org/sqlite
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
v0.83.1 		2023-06-14 11:45:39 -04:00
anchore-actions-token-generator[bot]andkzantow c019cd51da chore(deps): update stereoscope to 5b5049bf4d3a99df9a2b1c31d5d52ddff7b5cec2 (#1871) 
Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: kzantow <kzantow@users.noreply.github.com>
 2023-06-14 11:29:39 -04:00
dependabot[bot] 5406d8a366 chore(deps): bump golang.org/x/net from 0.10.0 to 0.11.0 (#1876) 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.10.0 to 0.11.0.
- [Commits](https://github.com/golang/net/compare/v0.10.0...v0.11.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-06-14 10:30:19 -04:00
James Neate 098c255a2d fix: pom properties not setting artifact id (#1870) 
Signed-off-by: James Neate <jamesmneate@gmail.com>
 2023-06-12 09:59:14 -04:00