mirror of
https://github.com/anchore/syft.git
synced 2026-10-13 22:57:19 +02:00
Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Christopher Phillips
|
66bf43c0cc |
+5
-5
@@ -42,7 +42,7 @@ tools:
|
||||
# used for signing the checksums file at release
|
||||
- name: cosign
|
||||
version:
|
||||
want: v2.6.0
|
||||
want: v2.5.3
|
||||
method: github-release
|
||||
with:
|
||||
repo: sigstore/cosign
|
||||
@@ -58,7 +58,7 @@ tools:
|
||||
# used to release all artifacts
|
||||
- name: goreleaser
|
||||
version:
|
||||
want: v2.12.0
|
||||
want: v2.11.2
|
||||
method: github-release
|
||||
with:
|
||||
repo: goreleaser/goreleaser
|
||||
@@ -98,7 +98,7 @@ tools:
|
||||
# used for triggering a release
|
||||
- name: gh
|
||||
version:
|
||||
want: v2.79.0
|
||||
want: v2.78.0
|
||||
method: github-release
|
||||
with:
|
||||
repo: cli/cli
|
||||
@@ -106,7 +106,7 @@ tools:
|
||||
# used to upload test fixture cache
|
||||
- name: oras
|
||||
version:
|
||||
want: v1.3.0
|
||||
want: v1.2.3
|
||||
method: github-release
|
||||
with:
|
||||
repo: oras-project/oras
|
||||
@@ -114,7 +114,7 @@ tools:
|
||||
# used to upload test fixture cache
|
||||
- name: yq
|
||||
version:
|
||||
want: v4.47.2
|
||||
want: v4.47.1
|
||||
method: github-release
|
||||
with:
|
||||
repo: mikefarah/yq
|
||||
|
||||
@@ -29,7 +29,7 @@ runs:
|
||||
using: "composite"
|
||||
steps:
|
||||
# note: go mod and build is automatically cached on default with v4+
|
||||
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
|
||||
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
|
||||
if: inputs.go-version != ''
|
||||
with:
|
||||
go-version: ${{ inputs.go-version }}
|
||||
|
||||
@@ -41,13 +41,13 @@ jobs:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Install Go
|
||||
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 #v6.0.0
|
||||
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 #v5.5.0
|
||||
with:
|
||||
go-version-file: go.mod
|
||||
|
||||
# Initializes the CodeQL tools for scanning.
|
||||
- name: Initialize CodeQL
|
||||
uses: github/codeql-action/init@192325c86100d080feab897ff886c34abd4c83a3 #v3.29.5
|
||||
uses: github/codeql-action/init@3c3833e0f8c1c83d449a7478aa59c036a9165498 #v3.29.5
|
||||
with:
|
||||
languages: ${{ matrix.language }}
|
||||
# If you wish to specify custom queries, you can do so here or in a config file.
|
||||
@@ -58,7 +58,7 @@ jobs:
|
||||
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
|
||||
# If this step fails, then you should remove it and run the build manually (see below)
|
||||
- name: Autobuild
|
||||
uses: github/codeql-action/autobuild@192325c86100d080feab897ff886c34abd4c83a3 #v3.29.5
|
||||
uses: github/codeql-action/autobuild@3c3833e0f8c1c83d449a7478aa59c036a9165498 #v3.29.5
|
||||
|
||||
# ℹ️ Command-line programs to run using the OS shell.
|
||||
# 📚 https://git.io/JvXDl
|
||||
@@ -72,4 +72,4 @@ jobs:
|
||||
# make release
|
||||
|
||||
- name: Perform CodeQL Analysis
|
||||
uses: github/codeql-action/analyze@192325c86100d080feab897ff886c34abd4c83a3 #v3.29.5
|
||||
uses: github/codeql-action/analyze@3c3833e0f8c1c83d449a7478aa59c036a9165498 #v3.29.5
|
||||
|
||||
@@ -167,7 +167,7 @@ jobs:
|
||||
file: go.mod
|
||||
artifact-name: sbom.spdx.json
|
||||
|
||||
- uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e #v3.19.0
|
||||
- uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e #v3.18.0
|
||||
continue-on-error: true
|
||||
with:
|
||||
status: ${{ job.status }}
|
||||
|
||||
@@ -47,7 +47,7 @@ jobs:
|
||||
Update CPE dictionary index based on the latest available CPE dictionary
|
||||
token: ${{ steps.generate-token.outputs.token }}
|
||||
|
||||
- uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e #v3.19.0
|
||||
- uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e #v3.18.0
|
||||
with:
|
||||
status: ${{ job.status }}
|
||||
fields: workflow,eventName,job
|
||||
|
||||
@@ -28,7 +28,7 @@ jobs:
|
||||
persist-credentials: false
|
||||
|
||||
- name: "Run zizmor"
|
||||
uses: zizmorcore/zizmor-action@e673c3917a1aef3c65c972347ed84ccd013ecda4 # v0.2.0
|
||||
uses: zizmorcore/zizmor-action@5ca5fc7a4779c5263a3ffa0e1f693009994446d1 # v0.1.2
|
||||
with:
|
||||
config-file: .github/zizmor.yml
|
||||
sarif-upload: true
|
||||
|
||||
@@ -133,7 +133,7 @@ jobs:
|
||||
|
||||
- run: npm install @actions/artifact@2.2.2
|
||||
|
||||
- uses: actions/github-script@v8
|
||||
- uses: actions/github-script@v7
|
||||
with:
|
||||
script: |
|
||||
const { readdirSync } = require('fs')
|
||||
@@ -210,7 +210,7 @@ jobs:
|
||||
runs-on: macos-latest
|
||||
steps:
|
||||
- name: Install Cosign
|
||||
uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
|
||||
uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
|
||||
|
||||
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
|
||||
with:
|
||||
|
||||
@@ -24,14 +24,14 @@ require (
|
||||
github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
|
||||
github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
|
||||
github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115
|
||||
github.com/anchore/stereoscope v0.1.10
|
||||
github.com/anchore/stereoscope v0.1.9-0.20250826202322-ef061ea78385
|
||||
github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
|
||||
github.com/aquasecurity/go-pep440-version v0.0.1
|
||||
github.com/bitnami/go-version v0.0.0-20250131085805-b1f57a8634ef
|
||||
github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
|
||||
github.com/bmatcuk/doublestar/v4 v4.9.1
|
||||
github.com/charmbracelet/bubbles v0.21.0
|
||||
github.com/charmbracelet/bubbletea v1.3.9
|
||||
github.com/charmbracelet/bubbletea v1.3.6
|
||||
github.com/charmbracelet/lipgloss v1.1.0
|
||||
github.com/dave/jennifer v1.7.1
|
||||
github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da
|
||||
@@ -51,9 +51,9 @@ require (
|
||||
github.com/google/go-containerregistry v0.20.6
|
||||
github.com/google/licensecheck v0.3.1
|
||||
github.com/google/uuid v1.6.0
|
||||
github.com/gookit/color v1.6.0
|
||||
github.com/gookit/color v1.5.4
|
||||
github.com/hashicorp/go-cleanhttp v0.5.2
|
||||
github.com/hashicorp/go-getter v1.8.0
|
||||
github.com/hashicorp/go-getter v1.7.9
|
||||
github.com/hashicorp/go-multierror v1.1.1
|
||||
github.com/hashicorp/hcl/v2 v2.24.0
|
||||
github.com/iancoleman/strcase v0.3.0
|
||||
@@ -78,10 +78,10 @@ require (
|
||||
github.com/sergi/go-diff v1.4.0
|
||||
github.com/spdx/gordf v0.0.0-20201111095634-7098f93598fb
|
||||
github.com/spdx/tools-golang v0.5.5
|
||||
github.com/spf13/afero v1.15.0
|
||||
github.com/spf13/cobra v1.10.1
|
||||
github.com/stretchr/testify v1.11.1
|
||||
github.com/vbatts/go-mtree v0.6.0
|
||||
github.com/spf13/afero v1.14.0
|
||||
github.com/spf13/cobra v1.9.1
|
||||
github.com/stretchr/testify v1.11.0
|
||||
github.com/vbatts/go-mtree v0.5.4
|
||||
github.com/vifraa/gopom v1.0.0
|
||||
github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651
|
||||
github.com/wagoodman/go-progress v0.0.0-20230925121702-07e42b3cdba0
|
||||
@@ -90,9 +90,9 @@ require (
|
||||
go.uber.org/goleak v1.3.0
|
||||
go.yaml.in/yaml/v3 v3.0.4
|
||||
golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b
|
||||
golang.org/x/mod v0.28.0
|
||||
golang.org/x/net v0.44.0
|
||||
modernc.org/sqlite v1.39.0
|
||||
golang.org/x/mod v0.27.0
|
||||
golang.org/x/net v0.43.0
|
||||
modernc.org/sqlite v1.38.2
|
||||
)
|
||||
|
||||
require (
|
||||
@@ -109,7 +109,7 @@ require (
|
||||
github.com/Masterminds/goutils v1.1.1 // indirect
|
||||
github.com/Microsoft/go-winio v0.6.2 // indirect
|
||||
github.com/Microsoft/hcsshim v0.11.7 // indirect
|
||||
github.com/ProtonMail/go-crypto v1.3.0 // indirect
|
||||
github.com/ProtonMail/go-crypto v1.2.0 // indirect
|
||||
github.com/STARRY-S/zip v0.2.1 // indirect
|
||||
github.com/agext/levenshtein v1.2.1 // indirect; indirectt
|
||||
github.com/anchore/go-lzo v0.1.0 // indirect
|
||||
@@ -118,6 +118,7 @@ require (
|
||||
github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
|
||||
github.com/aquasecurity/go-version v0.0.1 // indirect
|
||||
github.com/atotto/clipboard v0.1.4 // indirect
|
||||
github.com/aws/aws-sdk-go v1.44.122 // indirect
|
||||
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
|
||||
github.com/becheran/wildmatch-go v1.0.0 // indirect
|
||||
github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
|
||||
@@ -126,7 +127,7 @@ require (
|
||||
github.com/bodgit/windows v1.0.1 // indirect
|
||||
github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc // indirect
|
||||
github.com/charmbracelet/harmonica v0.2.0 // indirect
|
||||
github.com/charmbracelet/x/ansi v0.10.1 // indirect
|
||||
github.com/charmbracelet/x/ansi v0.9.3 // indirect
|
||||
github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd // indirect
|
||||
github.com/charmbracelet/x/term v0.2.1 // indirect
|
||||
github.com/cloudflare/circl v1.6.1 // indirect
|
||||
@@ -144,9 +145,9 @@ require (
|
||||
github.com/containerd/typeurl/v2 v2.2.0 // indirect
|
||||
github.com/cyphar/filepath-securejoin v0.4.1 // indirect
|
||||
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
||||
github.com/docker/cli v28.4.0+incompatible // indirect
|
||||
github.com/docker/cli v28.3.2+incompatible // indirect
|
||||
github.com/docker/distribution v2.8.3+incompatible // indirect
|
||||
github.com/docker/docker v28.4.0+incompatible // indirect
|
||||
github.com/docker/docker v28.3.3+incompatible // indirect
|
||||
github.com/docker/docker-credential-helpers v0.9.3 // indirect
|
||||
github.com/docker/go-connections v0.6.0 // indirect
|
||||
github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
|
||||
@@ -154,7 +155,7 @@ require (
|
||||
github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect
|
||||
github.com/emirpasic/gods v1.18.1 // indirect
|
||||
github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
|
||||
github.com/fatih/color v1.18.0 // indirect
|
||||
github.com/fatih/color v1.17.0 // indirect
|
||||
github.com/felixge/fgprof v0.9.5 // indirect
|
||||
github.com/felixge/httpsnoop v1.0.4 // indirect
|
||||
github.com/fsnotify/fsnotify v1.8.0 // indirect
|
||||
@@ -181,6 +182,7 @@ require (
|
||||
github.com/iancoleman/orderedmap v0.0.0-20190318233801-ac98e3ecb4b0 // indirect
|
||||
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
||||
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
|
||||
github.com/jmespath/go-jmespath v0.4.0 // indirect
|
||||
github.com/kevinburke/ssh_config v1.2.0 // indirect
|
||||
github.com/klauspost/compress v1.18.0 // indirect
|
||||
github.com/klauspost/pgzip v1.2.6 // indirect
|
||||
@@ -189,7 +191,7 @@ require (
|
||||
github.com/logrusorgru/aurora v2.0.3+incompatible // indirect
|
||||
github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
|
||||
github.com/maruel/natural v1.1.1 // indirect
|
||||
github.com/mattn/go-colorable v0.1.14 // indirect
|
||||
github.com/mattn/go-colorable v0.1.13 // indirect
|
||||
github.com/mattn/go-isatty v0.0.20 // indirect
|
||||
github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75 // indirect
|
||||
github.com/mattn/go-runewidth v0.0.16 // indirect
|
||||
@@ -236,18 +238,18 @@ require (
|
||||
github.com/sorairolake/lzip-go v0.3.5 // indirect
|
||||
github.com/sourcegraph/conc v0.3.0 // indirect
|
||||
github.com/spf13/cast v1.7.1 // indirect
|
||||
github.com/spf13/pflag v1.0.9 // indirect
|
||||
github.com/spf13/pflag v1.0.6 // indirect
|
||||
github.com/spf13/viper v1.20.0 // indirect
|
||||
github.com/stretchr/objx v0.5.2 // indirect
|
||||
github.com/subosito/gotenv v1.6.0 // indirect
|
||||
github.com/sylabs/sif/v2 v2.22.0 // indirect
|
||||
github.com/sylabs/sif/v2 v2.21.1 // indirect
|
||||
github.com/sylabs/squashfs v1.0.6 // indirect
|
||||
github.com/therootcompany/xz v1.0.1 // indirect
|
||||
github.com/tidwall/gjson v1.18.0 // indirect
|
||||
github.com/tidwall/match v1.1.1 // indirect
|
||||
github.com/tidwall/pretty v1.2.1 // indirect
|
||||
github.com/tidwall/sjson v1.2.5 // indirect
|
||||
github.com/ulikunitz/xz v0.5.15 // indirect
|
||||
github.com/ulikunitz/xz v0.5.12 // indirect
|
||||
github.com/vbatts/tar-split v0.12.1 // indirect
|
||||
github.com/xanzy/ssh-agent v0.3.3 // indirect
|
||||
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
|
||||
@@ -265,21 +267,21 @@ require (
|
||||
go.uber.org/atomic v1.9.0 // indirect
|
||||
go.uber.org/multierr v1.9.0 // indirect
|
||||
go4.org v0.0.0-20230225012048-214862532bf5 // indirect
|
||||
golang.org/x/crypto v0.42.0 // indirect
|
||||
golang.org/x/crypto v0.41.0 // indirect
|
||||
golang.org/x/oauth2 v0.30.0 // indirect
|
||||
golang.org/x/sync v0.17.0 // indirect
|
||||
golang.org/x/sys v0.36.0 // indirect
|
||||
golang.org/x/term v0.35.0 // indirect
|
||||
golang.org/x/text v0.29.0 // indirect
|
||||
golang.org/x/sync v0.16.0 // indirect
|
||||
golang.org/x/sys v0.35.0 // indirect
|
||||
golang.org/x/term v0.34.0 // indirect
|
||||
golang.org/x/text v0.28.0 // indirect
|
||||
golang.org/x/time v0.12.0 // indirect
|
||||
golang.org/x/tools v0.37.0
|
||||
golang.org/x/tools v0.35.0
|
||||
golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
|
||||
google.golang.org/api v0.203.0 // indirect
|
||||
google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 // indirect
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20241113202542-65e8d215514f // indirect
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20241223144023-3abc09e42ca8 // indirect
|
||||
google.golang.org/grpc v1.67.3 // indirect
|
||||
google.golang.org/protobuf v1.36.6 // indirect
|
||||
google.golang.org/protobuf v1.36.4 // indirect
|
||||
gopkg.in/warnings.v0 v0.1.2 // indirect
|
||||
gopkg.in/yaml.v3 v3.0.1 // indirect
|
||||
modernc.org/libc v1.66.3 // indirect
|
||||
@@ -287,28 +289,6 @@ require (
|
||||
modernc.org/memory v1.11.0 // indirect
|
||||
)
|
||||
|
||||
require (
|
||||
github.com/aws/aws-sdk-go-v2 v1.36.5 // indirect
|
||||
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10 // indirect
|
||||
github.com/aws/aws-sdk-go-v2/config v1.29.17 // indirect
|
||||
github.com/aws/aws-sdk-go-v2/credentials v1.17.70 // indirect
|
||||
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.32 // indirect
|
||||
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.36 // indirect
|
||||
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.36 // indirect
|
||||
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
|
||||
github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34 // indirect
|
||||
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.4 // indirect
|
||||
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.2 // indirect
|
||||
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.17 // indirect
|
||||
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15 // indirect
|
||||
github.com/aws/aws-sdk-go-v2/service/s3 v1.80.1 // indirect
|
||||
github.com/aws/aws-sdk-go-v2/service/sso v1.25.5 // indirect
|
||||
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.3 // indirect
|
||||
github.com/aws/aws-sdk-go-v2/service/sts v1.34.0 // indirect
|
||||
github.com/aws/smithy-go v1.22.4 // indirect
|
||||
github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.65 // indirect
|
||||
)
|
||||
|
||||
retract (
|
||||
v1.25.0 // published with a replace directive (confusing for API users)
|
||||
v0.53.2
|
||||
|
||||
@@ -54,12 +54,6 @@ var identityFiles = []parseEntry{
|
||||
// /////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
}
|
||||
|
||||
// after a parser function returns a Release, it may have incomplete information; supplementers can be used to
|
||||
// fill in missing details based on other files present in the filesystem
|
||||
var supplementers = []func(file.Resolver, *Release){
|
||||
supplementDebianVersion,
|
||||
}
|
||||
|
||||
// IdentifyRelease parses distro-specific files to discover and raise linux distribution release details.
|
||||
func IdentifyRelease(resolver file.Resolver) *Release {
|
||||
logger := log.Nested("operation", "identify-release")
|
||||
@@ -73,9 +67,6 @@ func IdentifyRelease(resolver file.Resolver) *Release {
|
||||
for _, location := range locations {
|
||||
release := tryParseReleaseInfo(resolver, location, logger, entry)
|
||||
if release != nil {
|
||||
for _, supplementer := range supplementers {
|
||||
supplementer(resolver, release)
|
||||
}
|
||||
return release
|
||||
}
|
||||
}
|
||||
|
||||
@@ -74,7 +74,7 @@ func TestIdentifyRelease(t *testing.T) {
|
||||
},
|
||||
},
|
||||
{
|
||||
fixture: "test-fixtures/os/debian/from-os-release",
|
||||
fixture: "test-fixtures/os/debian",
|
||||
release: &Release{
|
||||
PrettyName: "Debian GNU/Linux 8 (jessie)",
|
||||
Name: "Debian GNU/Linux",
|
||||
@@ -87,20 +87,6 @@ func TestIdentifyRelease(t *testing.T) {
|
||||
BugReportURL: "https://bugs.debian.org/",
|
||||
},
|
||||
},
|
||||
{
|
||||
fixture: "test-fixtures/os/debian/from-debian_version",
|
||||
release: &Release{
|
||||
PrettyName: "Distroless",
|
||||
Name: "Debian GNU/Linux",
|
||||
ID: "debian",
|
||||
IDLike: nil,
|
||||
Version: "10.8",
|
||||
VersionID: "10.8",
|
||||
HomeURL: "https://github.com/GoogleContainerTools/distroless",
|
||||
SupportURL: "https://github.com/GoogleContainerTools/distroless/blob/master/README.md",
|
||||
BugReportURL: "https://github.com/GoogleContainerTools/distroless/issues/new",
|
||||
},
|
||||
},
|
||||
{
|
||||
fixture: "test-fixtures/os/fedora",
|
||||
release: &Release{
|
||||
|
||||
@@ -1,51 +0,0 @@
|
||||
package linux
|
||||
|
||||
import (
|
||||
"io"
|
||||
"regexp"
|
||||
"strings"
|
||||
|
||||
"github.com/anchore/syft/internal"
|
||||
"github.com/anchore/syft/internal/log"
|
||||
"github.com/anchore/syft/syft/file"
|
||||
)
|
||||
|
||||
func supplementDebianVersion(resolver file.Resolver, release *Release) {
|
||||
// we're only looking for version information for debian when none is present in /etc/os-release
|
||||
if release.Version != "" || release.VersionID != "" || !strings.EqualFold(release.ID, "debian") {
|
||||
return
|
||||
}
|
||||
// if we have a debian release with no version, look for a debian_version
|
||||
locations, err := resolver.FilesByGlob("/etc/debian_version")
|
||||
if err != nil {
|
||||
log.Debugf("error reading /etc/debian_version: %v", err)
|
||||
return
|
||||
}
|
||||
for _, location := range locations {
|
||||
version := readDebianVersionFile(resolver, location)
|
||||
if version != "" {
|
||||
release.Version = version
|
||||
release.VersionID = version
|
||||
return // keep the first result
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func readDebianVersionFile(resolver file.Resolver, location file.Location) string {
|
||||
rdr, err := resolver.FileContentsByLocation(location)
|
||||
if err != nil {
|
||||
log.Debugf("error getting contents for %s: %v", location.RealPath, err)
|
||||
return ""
|
||||
}
|
||||
defer internal.CloseAndLogError(rdr, location.RealPath)
|
||||
contents, err := io.ReadAll(rdr)
|
||||
if err != nil {
|
||||
log.Debugf("error reading %s: %v", location.RealPath, err)
|
||||
return ""
|
||||
}
|
||||
version := strings.TrimSpace(string(contents))
|
||||
if regexp.MustCompile(`^\d+(?:\.\d+)?$`).MatchString(version) {
|
||||
return version
|
||||
}
|
||||
return ""
|
||||
}
|
||||
@@ -1 +0,0 @@
|
||||
10.8
|
||||
@@ -1,6 +0,0 @@
|
||||
PRETTY_NAME="Distroless"
|
||||
NAME="Debian GNU/Linux"
|
||||
ID="debian"
|
||||
HOME_URL="https://github.com/GoogleContainerTools/distroless"
|
||||
SUPPORT_URL="https://github.com/GoogleContainerTools/distroless/blob/master/README.md"
|
||||
BUG_REPORT_URL="https://github.com/GoogleContainerTools/distroless/issues/new"
|
||||
@@ -64,10 +64,6 @@ func (c cataloger) Catalog(_ context.Context, resolver file.Resolver) ([]pkg.Pac
|
||||
var relationships []artifact.Relationship
|
||||
var errs error
|
||||
|
||||
// we do not run these classifiers in parallel currently because: when determining primary vs. supporting evidence,
|
||||
// we take preference to the classifier that was defined first, if we modify this to run in parallel,
|
||||
// we need to retain this behavior by giving precedence to the classifier defined first in the c.classifiers list;
|
||||
// if this is ever made parallel, we will need to account for this to have deterministic behavior
|
||||
for _, cls := range c.classifiers {
|
||||
log.WithFields("classifier", cls.Class).Trace("cataloging binaries")
|
||||
newPkgs, err := catalog(resolver, cls)
|
||||
@@ -105,26 +101,8 @@ func mergePackages(target *pkg.Package, extra *pkg.Package) {
|
||||
if extra.Type != pkg.BinaryPkg && target.Type == pkg.BinaryPkg {
|
||||
target.Type = extra.Type
|
||||
}
|
||||
addedEvidence := false
|
||||
// when merging locations together, we need to maintain primary vs. supporting evidence -
|
||||
// if we are merging two packages together that have overlapping evidence, e.g. libpython
|
||||
// which are found by 2 different classifiers, we want to deduplicate evidence for the same
|
||||
// locations when merging so libpython is not considered primary evidence. This allows cases
|
||||
// where we find python binary with version info coming from libpython to deduplicate the libpython
|
||||
// entries, but also surface results for libpython separately as primary evidence when there is
|
||||
// no python binary referencing it
|
||||
for _, location := range extra.Locations.ToSlice() {
|
||||
// if we already have the same location, don't include duplicates
|
||||
if target.Locations.Contains(location) {
|
||||
continue
|
||||
}
|
||||
addedEvidence = true
|
||||
target.Locations.Add(location)
|
||||
}
|
||||
// only include the additional metadata if we added evidence, as it was likely duplicated e.g. libpython
|
||||
if !addedEvidence {
|
||||
return
|
||||
}
|
||||
// add the locations
|
||||
target.Locations.Add(extra.Locations.ToSlice()...)
|
||||
// update the metadata to indicate which classifiers were used
|
||||
meta, _ := target.Metadata.(pkg.BinarySignature)
|
||||
if m, ok := extra.Metadata.(pkg.BinarySignature); ok {
|
||||
|
||||
@@ -6,7 +6,6 @@ import (
|
||||
"flag"
|
||||
"fmt"
|
||||
"io"
|
||||
"slices"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
@@ -480,6 +479,7 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
|
||||
Metadata: metadata("python-binary-lib"),
|
||||
},
|
||||
},
|
||||
|
||||
{
|
||||
// note: dynamic (non-snippet) test case
|
||||
logicalFixture: "python-slim-shared-libs/3.11/linux-amd64",
|
||||
@@ -492,6 +492,7 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
|
||||
Matches: []pkg.ClassifierMatch{
|
||||
match("python-binary", "python3.11"),
|
||||
match("python-binary", "libpython3.11.so.1.0"),
|
||||
match("python-binary-lib", "libpython3.11.so.1.0"),
|
||||
},
|
||||
},
|
||||
},
|
||||
@@ -508,6 +509,7 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
|
||||
Matches: []pkg.ClassifierMatch{
|
||||
match("python-binary", "python3.9"),
|
||||
match("python-binary", "libpython3.9.so.1.0"),
|
||||
match("python-binary-lib", "libpython3.9.so.1.0"),
|
||||
},
|
||||
},
|
||||
},
|
||||
@@ -539,6 +541,7 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
|
||||
Matches: []pkg.ClassifierMatch{
|
||||
match("python-binary", "python3.4"),
|
||||
match("python-binary", "libpython3.4m.so.1.0"),
|
||||
match("python-binary-lib", "libpython3.4m.so.1.0"),
|
||||
},
|
||||
},
|
||||
},
|
||||
@@ -654,8 +657,8 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
|
||||
Name: "go",
|
||||
Version: "1.15",
|
||||
PURL: "pkg:generic/go@1.15",
|
||||
Locations: locations("bin/go", "VERSION"),
|
||||
Metadata: metadata("go-binary"),
|
||||
Locations: locations("VERSION"),
|
||||
Metadata: metadata("go-binary-hint"),
|
||||
},
|
||||
},
|
||||
{
|
||||
@@ -665,8 +668,8 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
|
||||
Name: "go",
|
||||
Version: "1.25-d524e1e",
|
||||
PURL: "pkg:generic/go@1.25-d524e1e",
|
||||
Locations: locations("bin/go", "VERSION.cache"),
|
||||
Metadata: metadata("go-binary"),
|
||||
Locations: locations("VERSION.cache"),
|
||||
Metadata: metadata("go-binary-hint"),
|
||||
},
|
||||
},
|
||||
{
|
||||
@@ -1452,6 +1455,17 @@ func Test_Cataloger_DefaultClassifiers_PositiveCases_Image(t *testing.T) {
|
||||
require.NoError(t, err)
|
||||
|
||||
for _, p := range packages {
|
||||
expectedLocations := test.expected.Locations.ToSlice()
|
||||
gotLocations := p.Locations.ToSlice()
|
||||
require.Len(t, gotLocations, len(expectedLocations))
|
||||
|
||||
for i, expectedLocation := range expectedLocations {
|
||||
gotLocation := gotLocations[i]
|
||||
if expectedLocation.RealPath != gotLocation.RealPath {
|
||||
t.Fatalf("locations do not match; expected: %v got: %v", expectedLocations, gotLocations)
|
||||
}
|
||||
}
|
||||
|
||||
assertPackagesAreEqual(t, test.expected, p)
|
||||
}
|
||||
})
|
||||
@@ -1641,13 +1655,12 @@ func assertPackagesAreEqual(t *testing.T, expected pkg.Package, p pkg.Package) {
|
||||
gotLocations := p.Locations.ToSlice()
|
||||
|
||||
if len(expectedLocations) != len(gotLocations) {
|
||||
failMessages = append(failMessages, fmt.Sprintf("locations are not equal: %v != %v", expectedLocations, gotLocations))
|
||||
failMessages = append(failMessages, "locations are not equal length")
|
||||
} else {
|
||||
for _, expectedLocation := range expectedLocations {
|
||||
if !slices.ContainsFunc(gotLocations, func(gotLocation file.Location) bool {
|
||||
return gotLocation.RealPath == expectedLocation.RealPath
|
||||
}) {
|
||||
failMessages = append(failMessages, fmt.Sprintf("location not found; expected: %v in set: %v", expectedLocation.RealPath, gotLocations))
|
||||
for i, expectedLocation := range expectedLocations {
|
||||
gotLocation := gotLocations[i]
|
||||
if expectedLocation.RealPath != gotLocation.RealPath {
|
||||
failMessages = append(failMessages, fmt.Sprintf("locations do not match; expected: %v got: %v", expectedLocation.RealPath, gotLocation.RealPath))
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -71,14 +71,8 @@ func DefaultClassifiers() []binutils.Classifier {
|
||||
{
|
||||
Class: "go-binary",
|
||||
FileGlob: "**/go",
|
||||
EvidenceMatcher: binutils.MatchAny(
|
||||
m.FileContentsVersionMatcher(
|
||||
`(?m)go(?P<version>[0-9]+\.[0-9]+(\.[0-9]+|beta[0-9]+|alpha[0-9]+|rc[0-9]+)?)\x00`),
|
||||
binutils.SupportingEvidenceMatcher("../VERSION*",
|
||||
m.FileContentsVersionMatcher(
|
||||
`(?m)go(?P<version>[0-9]+\.[0-9]+(\.[0-9]+|beta[0-9]+|alpha[0-9]+|rc[0-9]+|-[_0-9a-z]+)?)\s`),
|
||||
),
|
||||
),
|
||||
EvidenceMatcher: m.FileContentsVersionMatcher(
|
||||
`(?m)go(?P<version>[0-9]+\.[0-9]+(\.[0-9]+|beta[0-9]+|alpha[0-9]+|rc[0-9]+)?)\x00`),
|
||||
Package: "go",
|
||||
PURL: mustPURL("pkg:generic/go@version"),
|
||||
CPEs: singleCPE("cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", cpe.NVDDictionaryLookupSource),
|
||||
@@ -134,6 +128,15 @@ func DefaultClassifiers() []binutils.Classifier {
|
||||
PURL: mustPURL("pkg:generic/node@version"),
|
||||
CPEs: singleCPE("cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*", cpe.NVDDictionaryLookupSource),
|
||||
},
|
||||
{
|
||||
Class: "go-binary-hint",
|
||||
FileGlob: "**/VERSION*",
|
||||
EvidenceMatcher: m.FileContentsVersionMatcher(
|
||||
`(?m)go(?P<version>[0-9]+\.[0-9]+(\.[0-9]+|beta[0-9]+|alpha[0-9]+|rc[0-9]+)?(-[0-9a-f]{7})?)`),
|
||||
Package: "go",
|
||||
PURL: mustPURL("pkg:generic/go@version"),
|
||||
CPEs: singleCPE("cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", cpe.NVDDictionaryLookupSource),
|
||||
},
|
||||
{
|
||||
Class: "busybox-binary",
|
||||
FileGlob: "**/busybox",
|
||||
|
||||
@@ -1,12 +1,18 @@
|
||||
package binary
|
||||
|
||||
import (
|
||||
"runtime"
|
||||
"testing"
|
||||
|
||||
"github.com/anchore/syft/syft/pkg/cataloger/internal/pkgtest"
|
||||
)
|
||||
|
||||
func Test_JavaBinaryImage(t *testing.T) {
|
||||
// no match for platform in manifest on Apple Silicon
|
||||
if runtime.GOOS == "darwin" && runtime.GOARCH == "arm64" {
|
||||
t.Skip("Java binary images not supported on Apple Silicon (darwin/arm64)")
|
||||
}
|
||||
|
||||
tests := []struct {
|
||||
image string
|
||||
expected []string
|
||||
|
||||
+1
-1
@@ -1 +1 @@
|
||||
go1.15 Fri 2003
|
||||
go1.15-beta2
|
||||
-1
@@ -1 +0,0 @@
|
||||
no version in this binary
|
||||
-1
@@ -1 +0,0 @@
|
||||
no version in this binary
|
||||
@@ -10,7 +10,7 @@ import (
|
||||
)
|
||||
|
||||
func Test_BranchingMatcher(t *testing.T) {
|
||||
matchingTest := FileContentsVersionMatcher("", `my-version:(?<version>\d+\.\d+)`)
|
||||
matchingTest := FileContentsVersionMatcher("", `my-verison:(?<version>\d+\.\d+)`)
|
||||
notMatchingTest := MatchPath("**/not-version*")
|
||||
|
||||
tests := []struct {
|
||||
|
||||
@@ -9,7 +9,6 @@ import (
|
||||
"fmt"
|
||||
"io"
|
||||
"maps"
|
||||
"path"
|
||||
"regexp"
|
||||
"strconv"
|
||||
"strings"
|
||||
@@ -274,7 +273,9 @@ func SharedLibraryLookup(sharedLibraryPattern string, sharedLibraryMatcher Evide
|
||||
}
|
||||
for _, p := range pkgs {
|
||||
// set the source binary as the first location
|
||||
makePrimaryLocation(&p, context.Location)
|
||||
locationSet := file.NewLocationSet(context.Location)
|
||||
locationSet.Add(p.Locations.ToSlice()...)
|
||||
p.Locations = locationSet
|
||||
meta, _ := p.Metadata.(pkg.BinarySignature)
|
||||
p.Metadata = pkg.BinarySignature{
|
||||
Matches: append([]pkg.ClassifierMatch{
|
||||
@@ -308,28 +309,6 @@ func MatchPath(path string) EvidenceMatcher {
|
||||
}
|
||||
}
|
||||
|
||||
// SupportingEvidenceMatcher defines an evidence matcher that searches for secondary evidence with path globs
|
||||
// relative to a primary file, for example: a VERSION file in the same or a parent directory to another binary
|
||||
func SupportingEvidenceMatcher(relativePathGlob string, evidenceMatcher EvidenceMatcher) EvidenceMatcher {
|
||||
return func(classifier Classifier, context MatcherContext) ([]pkg.Package, error) {
|
||||
f := path.Dir(context.Location.RealPath)
|
||||
f = path.Join(f, relativePathGlob)
|
||||
f = path.Clean(f)
|
||||
// this would ideally be RelativeFileByPath but with a glob search:
|
||||
relativeFiles, err := context.Resolver.FilesByGlob(f)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
for _, relativeFile := range relativeFiles {
|
||||
evidence, err := collectSupportingEvidence(classifier, context, relativeFile, evidenceMatcher)
|
||||
if evidence != nil || err != nil {
|
||||
return evidence, err
|
||||
}
|
||||
}
|
||||
return nil, nil
|
||||
}
|
||||
}
|
||||
|
||||
func getReader(context MatcherContext) (unionreader.UnionReader, error) {
|
||||
if context.GetReader != nil {
|
||||
return context.GetReader(context)
|
||||
@@ -389,43 +368,3 @@ func sharedLibraries(context MatcherContext) ([]string, error) {
|
||||
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
func makePrimaryLocation(p *pkg.Package, primaryLocation file.Location) {
|
||||
locationSet := file.NewLocationSet(primaryLocation.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation))
|
||||
for _, l := range p.Locations.ToSlice() {
|
||||
if locationSet.Contains(l) { // no need for duplicate locations
|
||||
continue
|
||||
}
|
||||
locationSet.Add(l.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.SupportingEvidenceAnnotation))
|
||||
}
|
||||
p.Locations = locationSet
|
||||
}
|
||||
|
||||
func collectSupportingEvidence(classifier Classifier, context MatcherContext, relativeFile file.Location, evidenceMatcher EvidenceMatcher) ([]pkg.Package, error) {
|
||||
rdr, err := context.Resolver.FileContentsByLocation(relativeFile)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer internal.CloseAndLogError(rdr, relativeFile.Path())
|
||||
ur, err := unionreader.GetUnionReader(rdr)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
newContext := MatcherContext{
|
||||
Resolver: context.Resolver,
|
||||
Location: relativeFile,
|
||||
GetReader: func(_ MatcherContext) (unionreader.UnionReader, error) {
|
||||
return ur, nil
|
||||
},
|
||||
}
|
||||
packages, err := evidenceMatcher(classifier, newContext)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
for i := range packages {
|
||||
p := &(packages[i])
|
||||
// relative files are supporting evidence, like a VERSION file near a go binary, mark the results as supporting
|
||||
makePrimaryLocation(p, context.Location)
|
||||
}
|
||||
return packages, nil
|
||||
}
|
||||
|
||||
@@ -12,8 +12,6 @@ import (
|
||||
"github.com/anchore/syft/syft/cpe"
|
||||
"github.com/anchore/syft/syft/file"
|
||||
"github.com/anchore/syft/syft/internal/unionreader"
|
||||
"github.com/anchore/syft/syft/source"
|
||||
"github.com/anchore/syft/syft/source/directorysource"
|
||||
)
|
||||
|
||||
func Test_ClassifierCPEs(t *testing.T) {
|
||||
@@ -29,7 +27,7 @@ func Test_ClassifierCPEs(t *testing.T) {
|
||||
classifier: Classifier{
|
||||
Package: "some-app",
|
||||
FileGlob: "**/version.txt",
|
||||
EvidenceMatcher: FileContentsVersionMatcher("cataloger-name", `(?m)my-version:(?P<version>[0-9.]+)`),
|
||||
EvidenceMatcher: FileContentsVersionMatcher("cataloger-name", `(?m)my-verison:(?P<version>[0-9.]+)`),
|
||||
CPEs: []cpe.CPE{},
|
||||
},
|
||||
cpes: nil,
|
||||
@@ -40,7 +38,7 @@ func Test_ClassifierCPEs(t *testing.T) {
|
||||
classifier: Classifier{
|
||||
Package: "some-app",
|
||||
FileGlob: "**/version.txt",
|
||||
EvidenceMatcher: FileContentsVersionMatcher("cataloger-name", `(?m)my-version:(?P<version>[0-9.]+)`),
|
||||
EvidenceMatcher: FileContentsVersionMatcher("cataloger-name", `(?m)my-verison:(?P<version>[0-9.]+)`),
|
||||
CPEs: []cpe.CPE{
|
||||
cpe.Must("cpe:2.3:a:some:app:*:*:*:*:*:*:*:*", cpe.GeneratedSource),
|
||||
},
|
||||
@@ -55,7 +53,7 @@ func Test_ClassifierCPEs(t *testing.T) {
|
||||
classifier: Classifier{
|
||||
Package: "some-app",
|
||||
FileGlob: "**/version.txt",
|
||||
EvidenceMatcher: FileContentsVersionMatcher("cataloger-name", `(?m)my-version:(?P<version>[0-9.]+)`),
|
||||
EvidenceMatcher: FileContentsVersionMatcher("cataloger-name", `(?m)my-verison:(?P<version>[0-9.]+)`),
|
||||
CPEs: []cpe.CPE{
|
||||
cpe.Must("cpe:2.3:a:some:app:*:*:*:*:*:*:*:*", cpe.GeneratedSource),
|
||||
cpe.Must("cpe:2.3:a:some:apps:*:*:*:*:*:*:*:*", cpe.GeneratedSource),
|
||||
@@ -185,61 +183,3 @@ func TestFileContentsVersionMatcher(t *testing.T) {
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func Test_SupportingEvidenceMatcher(t *testing.T) {
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
classifier Classifier
|
||||
expected string
|
||||
}{
|
||||
{
|
||||
name: "simple version string regexp",
|
||||
classifier: Classifier{
|
||||
FileGlob: "**/some-binary",
|
||||
EvidenceMatcher: SupportingEvidenceMatcher("../version.txt",
|
||||
FileContentsVersionMatcher("cataloger-name", `(?m)my-version:(?P<version>[0-9.]+)`)),
|
||||
Package: "some-binary",
|
||||
},
|
||||
expected: "1.8",
|
||||
},
|
||||
{
|
||||
name: "not matching version string regexp",
|
||||
classifier: Classifier{
|
||||
FileGlob: "**/some-binary",
|
||||
EvidenceMatcher: SupportingEvidenceMatcher("../version.txt",
|
||||
FileContentsVersionMatcher("cataloger-name", `(?m)my-version:(?P<version>abdd)`)),
|
||||
Package: "some-binary",
|
||||
},
|
||||
expected: "",
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
s, err := directorysource.NewFromPath("test-fixtures")
|
||||
require.NoError(t, err)
|
||||
r, err := s.FileResolver(source.AllLayersScope)
|
||||
require.NoError(t, err)
|
||||
|
||||
results, err := r.FilesByGlob(tt.classifier.FileGlob)
|
||||
require.NoError(t, err)
|
||||
for _, result := range results {
|
||||
got, err := tt.classifier.EvidenceMatcher(tt.classifier, MatcherContext{
|
||||
Resolver: r,
|
||||
Location: result,
|
||||
GetReader: func(ctx MatcherContext) (unionreader.UnionReader, error) {
|
||||
return getReader(ctx)
|
||||
},
|
||||
})
|
||||
require.NoError(t, err)
|
||||
if tt.expected != "" {
|
||||
require.NotEmpty(t, got)
|
||||
require.Equal(t, tt.expected, got[0].Version)
|
||||
} else {
|
||||
require.Empty(t, got)
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
a binary
|
||||
@@ -1 +1 @@
|
||||
my-version:1.8
|
||||
my-verison:1.8
|
||||
@@ -508,7 +508,7 @@ func (ni nativeImagePE) fetchPkgs() (pkgs []pkg.Package, relationships []artifac
|
||||
}
|
||||
|
||||
// fetchPkgs provides the packages available in a UnionReader.
|
||||
func fetchPkgs(reader unionreader.UnionReader, location file.Location) ([]pkg.Package, []artifact.Relationship) {
|
||||
func fetchPkgs(reader unionreader.UnionReader, filename string) ([]pkg.Package, []artifact.Relationship) {
|
||||
var pkgs []pkg.Package
|
||||
var relationships []artifact.Relationship
|
||||
imageFormats := []func(string, io.ReaderAt) (nativeImage, error){newElf, newMachO, newPE}
|
||||
@@ -520,7 +520,6 @@ func fetchPkgs(reader unionreader.UnionReader, location file.Location) ([]pkg.Pa
|
||||
log.Debugf("failed to open the java native-image binary: %v", err)
|
||||
return nil, nil
|
||||
}
|
||||
filename := location.RealPath
|
||||
for _, r := range readers {
|
||||
for _, makeNativeImage := range imageFormats {
|
||||
ni, err := makeNativeImage(filename, r)
|
||||
@@ -535,10 +534,6 @@ func fetchPkgs(reader unionreader.UnionReader, location file.Location) ([]pkg.Pa
|
||||
log.Tracef("unable to extract SBOM from possible java native-image %s: %v", filename, err)
|
||||
continue
|
||||
}
|
||||
// Associate extracted packages with the native image location
|
||||
for i := range newPkgs {
|
||||
newPkgs[i].Locations.Add(location)
|
||||
}
|
||||
pkgs = append(pkgs, newPkgs...)
|
||||
relationships = append(relationships, newRelationships...)
|
||||
}
|
||||
@@ -579,6 +574,6 @@ func processLocation(location file.Location, resolver file.Resolver) ([]pkg.Pack
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
pkgs, relationships := fetchPkgs(reader, location)
|
||||
pkgs, relationships := fetchPkgs(reader, location.RealPath)
|
||||
return pkgs, relationships, nil
|
||||
}
|
||||
|
||||
+1
-1
@@ -36,7 +36,7 @@ type RpmDBEntry struct {
|
||||
Signatures []RpmSignature `json:"signatures,omitempty" cyclonedx:"signatures"`
|
||||
Size int `json:"size" cyclonedx:"size"`
|
||||
Vendor string `json:"vendor"`
|
||||
ModularityLabel *string `json:"modularityLabel,omitempty" cyclonedx:"modularityLabel"`
|
||||
ModularityLabel *string `json:"modularityLabel,omitempty"`
|
||||
Provides []string `json:"provides,omitempty"`
|
||||
Requires []string `json:"requires,omitempty"`
|
||||
Files []RpmFileRecord `json:"files"`
|
||||
|
||||
Reference in New Issue
Block a user