restore original release token

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

.github/ISSUE_TEMPLATE/bug_report.md

@@ -16,5 +16,5 @@ assignees: ''
 **Anything else we need to know?**:
 
 **Environment**:
-- syft version (use `syft version -v`):
+- Output of `syft version`:
 - OS (e.g: `cat /etc/os-release` or similar):

.github/workflows/release.yaml

@@ -126,7 +126,7 @@ jobs:
       - name: Build & publish release artifacts
         run: make release
         env:
-          GITHUB_TOKEN: ${{ secrets.TEMP_RELEASE_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.ANCHORE_GIT_READ_TOKEN }}
           GPG_PRIVATE_KEY: ${{ secrets.SIGNING_GPG_PRIVATE_KEY }}
           PASSPHRASE: ${{ secrets.SIGNING_GPG_PASSPHRASE }}
           SIGNING_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}

.github/workflows/static-unit-integration.yaml

@@ -2,6 +2,7 @@ name: 'Static Analysis + Unit + Integration'
 on:
   workflow_dispatch:
   push:
+  pull_request:
 jobs:
 
   Static-Analysis:

Makefile

@@ -130,7 +130,7 @@ unit: fixtures ## Run unit tests (with coverage)
 .PHONY: integration
 integration: ## Run integration tests
 	$(call title,Running integration tests)
-	go test -tags=integration ./test/integration
+	go test -tags=integration -v ./test/integration
 
 # note: this is used by CI to determine if the integration test fixture cache (docker image tars) should be busted
 integration-fingerprint:

README.md

@@ -1,6 +1,7 @@
 # syft
 
-[![CircleCI](https://circleci.com/gh/anchore/syft.svg?style=svg)](https://circleci.com/gh/anchore/syft)
+[![Static Analysis + Unit + Integration](https://github.com/anchore/syft/workflows/Static%20Analysis%20+%20Unit%20+%20Integration/badge.svg)](https://github.com/anchore/syft/actions?query=workflow%3A%22Static+Analysis+%2B+Unit+%2B+Integration%22)
+[![Acceptance](https://github.com/anchore/syft/workflows/Acceptance/badge.svg)](https://github.com/anchore/syft/actions?query=workflow%3AAcceptance)
 [![Go Report Card](https://goreportcard.com/badge/github.com/anchore/syft)](https://goreportcard.com/report/github.com/anchore/syft)
 [![GitHub release](https://img.shields.io/github/release/anchore/syft.svg)](https://github.com/anchore/syft/releases/latest)
 [![License: Apache-2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://github.com/anchore/syft/blob/main/LICENSE)
@@ -15,7 +16,7 @@ A CLI tool and go library for generating a Software Bill of Materials (SBOM) fro
 - Linux distribution identification (supports Alpine, BusyBox, CentOS/RedHat, Debian/Ubuntu flavored distributions)
 - Supports Docker and OCI image formats
 
-> :warning: **This is pre-release software** and it may not work as expected. If you encounter an issue, please [let us know using the issue tracker](https://github.com/anchore/syft/issues).
+If you encounter an issue, please [let us know using the issue tracker](https://github.com/anchore/syft/issues).
 
 ## Getting started
 
@@ -59,7 +60,7 @@ Where the `format`s available are:
 curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
 
 # install a specific version into a specific dir
-curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s <RELEASE_VERSION> -b <SOME_BIN_PATH>
+curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b <SOME_BIN_PATH> <RELEASE_VERSION>
 ```
 
 **macOS**

schema/json/schema.json

@@ -40,9 +40,6 @@
                             "architecture": {
                                 "type": "string"
                             },
-                            "authors": {
-                                "type": "null"
-                            },
                             "description": {
                                 "type": "string"
                             },
@@ -89,6 +86,9 @@
                             "gitCommitOfApkPort": {
                                 "type": "string"
                             },
+                            "homepage": {
+                                "type": "string"
+                            },
                             "installedSize": {
                                 "type": "integer"
                             },

syft/cataloger/apkdb/parse_apk_db.go

@@ -20,9 +20,14 @@ var _ common.ParserFn = parseApkDB
 // parseApkDb parses individual packages from a given Alpine DB file. For more information on specific fields
 // see https://wiki.alpinelinux.org/wiki/Apk_spec .
 func parseApkDB(_ string, reader io.Reader) ([]pkg.Package, error) {
+	// larger capacity for the scanner.
+	const maxScannerCapacity = 1024 * 1024
+	// a new larger buffer for the scanner
+	bufScan := make([]byte, maxScannerCapacity)
 	packages := make([]pkg.Package, 0)
 
 	scanner := bufio.NewScanner(reader)
+	scanner.Buffer(bufScan, maxScannerCapacity)
 	onDoubleLF := func(data []byte, atEOF bool) (advance int, token []byte, err error) {
 		for i := 0; i < len(data); i++ {
 			if i > 0 && data[i-1] == '\n' && data[i] == '\n' {

syft/cataloger/ruby/parse_gemspec_test.go

@@ -21,6 +21,7 @@ func TestParseGemspec(t *testing.T) {
 			Files:    []string{"exe/bundle", "exe/bundler"},
 			Authors:  []string{"André Arko", "Samuel Giddins", "Colby Swandale", "Hiroshi Shibata", "David Rodríguez", "Grey Baker", "Stephanie Morillo", "Chris Morris", "James Wen", "Tim Moore", "André Medeiros", "Jessica Lynn Suttles", "Terence Lee", "Carl Lerche", "Yehuda Katz"},
 			Licenses: []string{"MIT"},
+			Homepage: "https://bundler.io",
 		},
 	}
 

syft/pkg/gem_metadata.go

@@ -3,7 +3,8 @@ package pkg
 type GemMetadata struct {
 	Name     string   `mapstructure:"name" json:"name"`
 	Version  string   `mapstructure:"version" json:"version"`
-	Files    []string `mapstructure:"files" json:"files"`
-	Authors  []string `mapstructure:"authors" json:"authors"`
-	Licenses []string `mapstructure:"licenses" json:"licenses"`
+	Files    []string `mapstructure:"files" json:"files,omitempty"`
+	Authors  []string `mapstructure:"authors" json:"authors,omitempty"`
+	Licenses []string `mapstructure:"licenses" json:"licenses,omitempty"`
+	Homepage string   `mapstructure:"homepage" json:"homepage,omitempty"`
 }

test/integration/regression_test.go

@@ -0,0 +1,38 @@
+// +build integration
+
+package integration
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+
+	"github.com/anchore/stereoscope/pkg/imagetest"
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/scope"
+)
+
+func TestRegression212ApkBufferSize(t *testing.T) {
+	// This is a regression test for issue #212 (https://github.com/anchore/syft/issues/212) in which the apk db could
+	// not be processed due to a scanner buffer that was too small
+
+	fixtureImageName := "image-large-apk-data"
+	_, cleanup := imagetest.GetFixtureImage(t, "docker-archive", fixtureImageName)
+	tarPath := imagetest.GetFixtureImageTarPath(t, fixtureImageName)
+	defer cleanup()
+
+	catalog, _, _, err := syft.Catalog("docker-archive:"+tarPath, scope.SquashedScope)
+	if err != nil {
+		t.Fatalf("failed to catalog image: %+v", err)
+	}
+
+	expectedPkgs := 57
+	actualPkgs := 0
+	for range catalog.Enumerate(pkg.ApkPkg) {
+		actualPkgs += 1
+	}
+
+	if actualPkgs != expectedPkgs {
+		t.Errorf("unexpected number of APK packages: %d != %d", expectedPkgs, actualPkgs)
+	}
+}

test/integration/test-fixtures/image-large-apk-data/Dockerfile

@@ -0,0 +1,2 @@
+FROM alpine:latest
+RUN apk add tzdata vim alpine-sdk