oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-30 22:12:28 +01:00
Code Issues Packages Projects Releases Wiki Activity
974 Commits 65 Branches 273 Tags
fb699496a8fed5162ab7f08b0c2bbd4aae79a67f
Commit Graph
974 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Batuhan Apaydın 6c306efed2 Enhance container image labels for ArtifactHub (#839) v0.39.0 2022-02-24 11:15:36 -05:00
Alex Goodman 99bb93d0fe Resolve symlinks when fetching file contents (#782) 2022-02-24 10:01:59 -05:00
Alex Goodman 7eea98fcc5 Allow for CPE strings that can later be sanitized (#844) 2022-02-23 15:18:12 -05:00
Christopher Angelo Phillips 256e85bc12 510 - SBOM attestation stdout (#785) 
add syft attest command to produce an attestation as application/vnd.in-toto+json to standard out using on disk PKI

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-02-22 21:45:12 -05:00
Alex Goodman 738b3b60a5 Add exception for handlebars java package to generate nodejs CPE (#837) 2022-02-22 17:29:28 -05:00
Keith Zantow 20c1d14f6e Add CycloneDX decoder (#811) 2022-02-18 11:19:02 -05:00
Jonas Xavier 4b16737b2f ignore minor parsing error when reading dpkg status files (#786) 
* ignore minor parsing error when reading dpkg status files

helps with https://github.com/anchore/syft/issues/733

Question: should we add a smarter parser to guess approximate installed-size
value?

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* add datasize lib to help dpkg parsing

added unit tests to expand coverage of dpkg parsing

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* drop parse error

added unit tests to handleNewKeyValue

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* don't return parsing errors from dpkg

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* go mod tidy

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* test higher level functions

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* return parsing err to let cataloger handle it

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* feedback changes

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* ignore key parsing error

log warning with relevant context

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* go mod tidy

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* add context info to log lines

simpler error assertion

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* use error.As to assert error in chain

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>
 2022-02-17 14:05:11 -08:00
mikey strauss e6b5872bc8 Base64 encoder closing (#822) 
Signed-off-by: houdini91 <mdstrauss91@gmail.com>
 2022-02-17 13:10:08 -05:00
Dan Luhring 641c44f449 Fix panic in requirements.txt parsing (#834) 
* Stable sort for pipfile.lock parsing

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Adjust python parsing tests to use go-cmp

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Add failing cases for requirements.txt parsing

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Fix failing cases for requirements.txt parsing

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Refactor parseRequirementsTxt

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Fix static-analysis failure

Signed-off-by: Dan Luhring <dan+github@luhrings.com>

* Fix comment

Signed-off-by: Dan Luhring <dan+github@luhrings.com>
 2022-02-17 10:00:16 -05:00
Alex Goodman 55c7f3d1e7 Upgrade install.sh to support installations for previous versions (#830) 2022-02-15 22:23:11 +00:00
Christopher Angelo Phillips 52d2e62cdc remove duplicate manifest lines (#828) v0.38.0 2022-02-15 12:51:02 -05:00
Alex Goodman 51c6eb30f5 bump stereoscope to include functional options (#823) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-14 20:40:51 -05:00
Christopher Angelo Phillips e1e9ccb401 update golang crypto library dependency (#815) 
* bump golang crypto to resolve CVE-2020-29652

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* go mod tidy

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-02-11 13:36:52 -05:00
Alex Goodman 220f3a24fd deduplicate SPDX tag-value package IDs (#813) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-10 21:18:00 +00:00
Alex Goodman ca032434b3 Add pURL generation for java packages + fix NPM pURL generation (#812) 
* enhance pURL generation for java packages

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* optionally split out npm namespaces for pURL generation

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* nit updates

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-10 13:46:38 -05:00
j-k 5ab872c732 Add nix install details (#800) 
Signed-off-by: 06kellyjac <jack@control-plane.io>
 2022-02-09 14:33:26 -05:00
Jonas Xavier a04fa68539 Ensure completion of UI progress bar (#810) 
* update stereoscope

fetches latest fixes for UI

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* use context when getting image

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>
 2022-02-09 11:23:58 -08:00
Keith Zantow 76f8205936 Suport SPDX SBOM decoding (#738) 2022-02-09 14:11:20 -05:00
Jonas Xavier ca081ae5e0 use SYFT_LOG_FILE env var (#805) 
* use SYFT_LOG_FILE

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* enable debug logs when SYFT_LOG_FILE is set

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* set log.file and add tests

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* test log file in temp directory

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* add note on binding refactor

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* remove unused function

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>
 2022-02-09 10:04:08 -08:00
Christopher Angelo Phillips 8f96adacfb Upgrade golang to 1.17 (#809) 
* initial upgrade workflow

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* update go.mod

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-02-09 11:08:24 -05:00
Alex Goodman 8f292958a6 set version makefile var for updating version file (#808) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-09 08:25:31 -05:00
majinghe 23e1bd3984 add metadata filed on pod usage template (#788) 
Signed-off-by: xiaomage <jhma@gitlab.cn>
 2022-02-08 16:00:19 -05:00
Alex Goodman ac024f94a4 encapsulate showing the signing log with failing (#807) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-08 01:26:34 +00:00
Alex Goodman 0ed2842123 serialize notarization (#806) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
v0.37.10 		2022-02-07 23:47:47 +00:00
Alex Goodman b78c90d018 use parent dir for notarization zip (#804) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
v0.37.9 		2022-02-07 22:50:48 +00:00
Alex Goodman 2c62651c82 run signing as post-build step (#803) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
v0.37.8 		2022-02-07 16:55:15 -05:00
Alex Goodman 5519a25035 dont add signing artifact (#802) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
v0.37.7 		2022-02-07 17:03:09 +00:00
Alex Goodman 950ad681a0 Stabilize CI behavior (#796) 
* reduce parallelism of builds and increase install.sh test setup buffer

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* change logging mechanism for signing

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* restore automatic parallelism determination for goreleaser

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* rm logging goreleaser version

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
v0.37.6 		2022-02-07 07:55:11 -08:00
Keith Zantow 1e338502ff Update SPDX license list (#801) 2022-02-07 15:24:08 +00:00
Alex Goodman 37251f6179 Fix intermittent slow CLI tests (#797) 
* use a port that is porbably not in use

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* template cli test args

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-06 15:53:55 +00:00
Alex Goodman e474b2f23c docker auth must occur after setting up prod keychain (#795) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
v0.37.5 		2022-02-05 15:23:05 +00:00
Alex Goodman e7bef5e511 split signing setup into pre-release hook (#794) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
v0.37.4 		2022-02-04 16:49:42 -05:00
Alex Goodman e4ac7700dd pass notarize arg, not original archive (#793) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
v0.37.3 		2022-02-04 19:44:37 +00:00
Alex Goodman d3469801fc repackage all file in notarization temp dir (not from tar output) (#792) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
v0.37.2 		2022-02-04 19:04:15 +00:00
Alex Goodman 3f50bb8fa7 tput requires explicit terminal type in CI (#791) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
v0.37.1 		2022-02-04 18:23:30 +00:00
Alex Goodman 341288ba29 Normalize snapshot and release artifacts (#789) 
* refactor signing steps in release/snapshot workflows

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* show signing logs on snapshot or release failure

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update install.sh + tests to account for new goreleaser changes

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update cli tests to account for new goreleaser build names

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix acceptance test to use new snapshot bin path

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add notarization

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* address review comments

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
v0.37.0 		2022-02-04 12:41:37 -05:00
Jonas Xavier 40423d8eee update stereoscope version - include Podman support (#781) 
* update stereoscope

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* go mod tidy

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* fix FilesByMIMEType tests

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* change expected mime types in unit tests

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* test stereoscope fix

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

* remove mod replace and use latest stereoscope

Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>
 2022-02-01 14:47:15 -08:00
Alex Goodman f38b0b7256 Refactor install.sh (#765) 
* [wip] get assets based on gh api

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* put install.sh download_asset fn under test

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* put install.sh install_asset fn under test

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* use zip for darwin installs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix install.sh negative test cases

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* allow errors to propagate in install.sh

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove exit on error from install.sh tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add more docs around install.sh helpers

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add integration tests for install.sh

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add install.sh testing to pipeline

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add install test cache to CI

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* make colors globally available

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* test download against github release

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* always test release-based install against latest release

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* use better install.sh test names

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-02-01 16:58:47 -05:00
Idan Frimark ed1cbf50d9 Update README.md (#772) 
Update `Example attest`

Signed-off-by: Idan Frimark <idanf@cisco.com>
 2022-01-27 19:59:36 +00:00
Alex Goodman d7a23e4bb2 Extract language and package type from pURLs on SBOM decode (#777) 
* add language detection from pURLs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add package type detection from pURLs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add cargo and npm pURL support

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix npm tests and linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-01-27 09:35:16 -05:00
Vijay Pillai 9f7104d4f1 update go-bouncer to version 0.3.0 for ARM support (#776) 
Signed-off-by: Vijay Pillai <vijay.pillai@anchore.com>
 2022-01-26 16:19:37 +00:00
Joris van Eijden a3b8ef709c Add PHP (#770) 
PHP Composer packages are also supported.

Signed-off-by: Joris van Eijden <joris.vaneijden@oneshoe.nl>
 2022-01-26 10:25:32 -05:00
Christopher Angelo Phillipsandhectorj2f 024a5a9f3f Add dependencies to cyclonedx (#768) 
Add dependencies to cyclonedx

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: hectorj2f <hectorf@vmware.com>
 2022-01-25 15:34:16 -05:00
Peter BaloghandAlex Goodman 161fa7be4a [CycloneDX] Add artifactID and groupID to the cycloneDX properties (support lower level struct as properties) (#758) 
* [CycloneDX] Add artifactID and groupID to the cycloneDX properties

Signed-off-by: Peter Balogh <p.balogh.sa@gmail.com>

* update comment

Signed-off-by: Peter Balogh <p.balogh.sa@gmail.com>

* additional checks for value

Signed-off-by: Peter Balogh <p.balogh.sa@gmail.com>

* fill group filed with groupID in the case of Java

Signed-off-by: Peter Balogh <p.balogh.sa@gmail.com>

* fix linter warning

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2022-01-25 10:36:15 -05:00
Alex Goodman 6f0fad7ffd encode upstream qualifier on os package pURLs (#769) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-01-25 09:55:56 -05:00
Christopher Angelo Phillips d2e815a2c5 Add attestation workflow to README (#759) 
* add attestation workflow to README

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-01-24 15:04:57 +00:00
Weston Steimel f7a44b3d2c convert from deprecated org.label-schema to OCI Annotations in Dockerfile (#763) 
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2022-01-21 21:58:10 +00:00
Christopher Angelo Phillips f3d3eddc96 update config so on copy paste it works without edits (#762) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-01-21 14:15:22 +00:00
Alex Goodman 1350d6c5bf Improve package URL support (#754) 
* rename npm metadata struct

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* improve os package URLs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* improve language package URLs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* wire up composer pURL method

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2022-01-19 22:30:29 +00:00
Christopher Angelo Phillips c350bd55f6 update sign sed command to include windows zip (#755) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2022-01-19 17:08:04 -05:00