anchore-actions-token-generator[bot] and wagoodman
90761f449a
chore(deps): update CPE dictionary index ( #3702 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-03-06 09:03:31 -05:00
anchore-actions-token-generator[bot] and wagoodman
3b951648a8
chore(deps): update CPE dictionary index ( #3682 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-02-24 10:03:13 -05:00
RogueAI and Keith Zantow
aeea170b19
fix: disable cert validation in dotnet-portable-executable-cataloger by default ( #3677 )
...
Signed-off-by: rogueai <rogueai@users.noreply.github.com >
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
2025-02-21 15:08:06 -05:00
William Murphy
dd2ee2bbf7
fix: find bitnami files even when no relationships ( #3676 )
...
The bitnami cataloger assigns files under /opt/bitnami/PACKAGE to be
owned by PACKAGE unless they are otherwise owned. Previously, this main
package was identified only by relationships, leading to an edge case
where if there was a bitnami SBOM with a single package in it, there
were no relationships, and so there would be no main package to assign
the files to, leading to deduplication failures.
Instead, when encountering a bitnami SBOM with exactly one package in
it, assume that package is the main package of that SBOM.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2025-02-21 14:22:37 +00:00
anchore-actions-token-generator[bot] and wagoodman
aff025ba35
chore(deps): update CPE dictionary index ( #3666 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-02-20 14:59:10 -05:00
idhyt
52bd4acd23
fix: correctly trim conanfile line breaks ( #3672 )
...
Signed-off-by: idhyt <idhyt3r@gmail.com >
2025-02-20 09:18:39 -05:00
bffe26bcc5
feat: add support for Bitnami cataloguer ( #3341 )
...
* prototype: start bitnami cataloger
Bitnami images have spdx SBOMs at predictable paths, and Syft could more
accurately identify the software in these images by scanning those
SBOMs. Start work on this by forking the sbom-cataloger as a new
bitnami-cataloger.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* wire up bitnami cataloger to run on images by default
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* feat: add support for Bitnami cataloguer
Signed-off-by: juan131 <jariza@vmware.com >
* feat: use a better SPDX sample for unit tests
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: only report bitnami pkgs
Signed-off-by: juan131 <jariza@vmware.com >
* feat: adapt JSON schema, spdxutil and packagemetadata
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: integration tests
Signed-off-by: juan131 <jariza@vmware.com >
* feat: implement FileOwner interface
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: update json schema
Signed-off-by: juan131 <jariza@vmware.com >
* [wip] add bitnami owned files and fix binary package ownership filtering
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* feat: obtain bitnami pkg files based on SPDX relationships tree
Signed-off-by: juan131 <jariza@vmware.com >
* preserve type switches
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename bitnami entry metadata type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* restrict find main pkg logic
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add missing graalvm source info
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bugfix: integration tests
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: mod tidy
Signed-off-by: juan131 <jariza@vmware.com >
---------
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Signed-off-by: juan131 <jariza@vmware.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-02-18 09:07:47 -05:00
Weston Steimel
dce99543b2
feat: update to go 1.24.x ( #3660 )
...
* feat: update to go 1.24.x
Update to building with go 1.24.x so that the main module version gets
set during `go build`
Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>
* chore: bump golangci-lint for go 1.24.x support
Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>
* chore: appease the updated linter
Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>
* chore: fix test logging for go 1.24
Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>
---------
Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>
2025-02-13 10:08:10 -05:00
anchore-actions-token-generator[bot] and wagoodman
46f9bf4e4d
chore(deps): update CPE dictionary index ( #3649 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-02-09 22:45:31 -05:00
Keith Zantow
2328b20082
fix: reduce warn levels to debug for non-actionable errors ( #3645 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-02-07 13:22:55 -05:00
Christopher Angelo Phillips
e584c9f416
feat: 3626 add option enable license content; disable by default ( #3631 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-02-05 20:41:03 +00:00
Christopher Angelo Phillips
5e2ba43328
chore: replace all shorthand tags of mapstruct -> mapstructure ( #3633 )
...
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-02-03 10:43:06 -05:00
anchore-actions-token-generator[bot] and wagoodman
7a69f6fdd7
chore(deps): update CPE dictionary index ( #3638 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-02-03 09:44:44 -05:00
HeyeOpenSource and Christopher Phillips
f7e767fc25
feat: update licenses to including license content when SPDX expressions are unable to be determined ( #3366 )
...
---------
Signed-off-by: HeyeOpenSource <opensource@heye-international.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-01-28 18:05:27 +00:00
Martin Prpič
58dc43de86
fix: update namespace value for OpenSUSE distros ( #3615 )
...
Instead of namespacing them to the specific distro version, such as
Leap or Tumbleweed, the namespace value is set to the vendor itself:
"opensuse".
Resolves #3534
Signed-off-by: Martin Prpič <mprpic@redhat.com >
2025-01-28 12:56:55 -05:00
anchore-actions-token-generator[bot] and wagoodman
5b009dbc7b
chore(deps): update CPE dictionary index ( #3620 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-01-27 10:56:58 -05:00
c10e904c28
feat(cataloger): add a terraform provider cataloger ( #3378 )
...
* feat(cataloger): add a terraform provider cataloger
* chore: bump schema from 16.0.19 -> 16.0.20
------
Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-01-21 14:44:54 -05:00
anchore-actions-token-generator[bot] and wagoodman
4edfa4d138
chore(deps): update CPE dictionary index ( #3599 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-01-21 11:43:59 -05:00
Dominik Schmidt and Keith Zantow
19a75fe504
feat(golang): add license parsing from vendor dirs ( #3522 )
...
Signed-off-by: Dominik Schmidt <dev@dominik-schmidt.de >
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
2025-01-17 20:25:05 -05:00
Christopher Angelo Phillips
8198a706d6
chore: bump packageurl-go with new parsing rules ( #3596 )
...
* chore: bump packageurl-go with new parsing rules
* test: update expectedPURL in unit tests to match new % encoding
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-01-17 16:20:14 -05:00
Bert Coppens and Alex Goodman
512319337f
feat: add cataloger for NuGet packages ( #3484 )
...
* add cataloger for dotnet packages.lock.json files
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* add entry for dotnet packages.lock files
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* add unit test for dotnet packages.lock cataloger
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* add test for faulty packages.lock.json file
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* add missing name metadata
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* ensure package appears with version
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* add example of conflicting dependencies
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump json schema and fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* move section
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-01-16 14:57:17 -05:00
anchore-actions-token-generator[bot] and wagoodman
da62caee3d
chore(deps): update CPE dictionary index ( #3583 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-01-15 12:11:46 -05:00
Keith Zantow
a2a56dd3e9
fix: golang remote license search not executing when error reading local mod dir ( #3549 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-01-06 11:47:55 -05:00
anchore-actions-token-generator[bot]
dc01c5d052
chore(deps): update CPE dictionary index ( #3565 )
2025-01-06 11:15:13 -05:00
Alex Goodman
cbce129bb9
Use reader when scanning for package versions over reading entire binary into memory ( #3558 )
...
* use streaming readers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* replace redis search patterns
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address PR feedback
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-01-02 22:12:37 +00:00
anchore-actions-token-generator[bot] and spiffcs
1f4a48c3c1
chore(deps): update tools to latest versions ( #3556 )
...
* chore(deps): update tools to latest versions
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore: update build scripts with new architecture suffix
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
* chore: update suffix for new ppc64 arch
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
* chore(deps): update tools to latest versions
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore: lintfix
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-01-02 16:18:47 -05:00
anchore-actions-token-generator[bot] and wagoodman
5c47568362
chore(deps): update CPE dictionary index ( #3550 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-01-02 09:25:13 -05:00
anchore-actions-token-generator[bot] and wagoodman
453c429c5c
chore(deps): update CPE dictionary index ( #3544 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-12-23 09:37:58 -05:00
anchore-actions-token-generator[bot] and wagoodman
397eb9c10a
chore(deps): update CPE dictionary index ( #3526 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-12-16 10:37:35 -05:00
Christopher Angelo Phillips
561ed50c2d
chore: migrate syft to use the anchore fork of archiver without replace ( #3516 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2024-12-10 13:33:24 -05:00
anchore-actions-token-generator[bot] and wagoodman
cd0900e758
chore(deps): update CPE dictionary index ( #3507 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-12-09 09:54:52 -05:00
Alex Goodman
340b5e17f0
Add relationships for rust audit binary packages ( #3500 )
...
* add rust audit binary pkg relationships
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-12-06 09:23:18 -05:00
William Murphy
4adb56d2fe
fix order of rust dependencies and support git sources in Cargo.lock dependencies ( #3502 )
...
* fix: un-reverse Cargo.lock dependencies
Previously, dependencyOf was pointing the wrong way. Use dependency
specification helpers to build the dependency graph.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* feat: parse Cargo.lock git dependency relationships
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
---------
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2024-12-06 13:38:36 +00:00
anchore-actions-token-generator[bot] and wagoodman
0e880e83e6
chore(deps): update CPE dictionary index ( #3491 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-12-02 11:14:28 -05:00
anchore-actions-token-generator[bot] and wagoodman
ec5f3169db
chore(deps): update CPE dictionary index ( #3479 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-11-27 10:17:34 -05:00
witchcraze
2118295f19
fix: dart classifier for 2.x and ARM ( #3475 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2024-11-22 13:05:09 -05:00
anchore-actions-token-generator[bot] and wagoodman
d91150edea
chore(deps): update CPE dictionary index ( #3453 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-11-18 08:33:41 -05:00
William Murphy
bc35345afb
feat: emit dependency relationships found in Cargo.lock ( #3443 )
...
* feat: emit dependency relationships found in Cargo.lock
Include updating test Cargo.lock to have dependencies on multiple
versions of the same crate.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2024-11-14 16:45:00 -05:00
witchcraze
066aadb4d1
update node classifier ( #3419 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2024-11-12 08:38:43 -05:00
anchore-actions-token-generator[bot] and wagoodman
7c6483f84a
chore(deps): update CPE dictionary index ( #3429 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-11-12 08:36:41 -05:00
Christopher Angelo Phillips and Keith Zantow
8a41d77250
chore: prevent file resolver from bubbling errors in binary cataloger ( #3410 )
...
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
2024-11-04 20:23:27 +00:00
anchore-actions-token-generator[bot] and wagoodman
849e325408
chore(deps): update CPE dictionary index ( #3414 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-11-04 10:13:22 -05:00
Joel Rudsberg
fcf1350a0e
feat: support dependencies and purl for Native Image SBOMs ( #3399 )
...
Signed-off-by: Joel Rudsberg <joel.rudsberg@oracle.com >
2024-10-31 12:12:54 -04:00
Nathan Voss and Keith Zantow
a55b71d4ef
feat: exclude devDependencies from package-lock.json parsing ( #3371 )
...
Signed-off-by: Nathan Voss <njvoss299@gmail.com >
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
2024-10-30 12:02:27 -04:00
Keith Zantow
798c18a698
fix: stack overflow in spyingIoReadCloser ( #3392 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-10-29 08:23:57 -04:00
Keith Zantow
1118ac4ace
fix: bad pom files may cause infinite loop ( #3391 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-10-28 18:09:04 -04:00
anchore-actions-token-generator[bot] and wagoodman
c7c036660c
chore(deps): update CPE dictionary index ( #3387 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-10-28 08:03:08 -04:00
Keith Zantow
a00533c836
feat: Java dependency graph information ( #3363 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-10-23 11:17:34 -04:00
Nathan Voss
b505317e10
Expanded dpkg cataloger globs ( #3373 )
...
Signed-off-by: Nathan Voss <njvoss299@gmail.com >
2024-10-23 14:59:28 +00:00
Alex Goodman
e4e985b9b0
Create single license scanner for all catalogers ( #3348 )
...
* add single license scanner instance
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename testing license scanner
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-10-21 16:17:12 +00:00
