mirror of
https://github.com/anchore/syft.git
synced 2026-10-28 21:12:25 +01:00
Compare commits
+1
-1
@@ -16,7 +16,7 @@ tools:
|
||||
# used to upload test fixture cache
|
||||
- name: oras
|
||||
version:
|
||||
want: v1.3.4
|
||||
want: v1.3.5
|
||||
method: github-release
|
||||
with:
|
||||
repo: oras-project/oras
|
||||
|
||||
@@ -6,10 +6,6 @@ description: "Bootstrap all syft tools and dependencies on top of go-make's setu
|
||||
# We add the syft-specific extras here: apt packages and the test fixture cache.
|
||||
|
||||
inputs:
|
||||
go-version:
|
||||
description: "Go version to install (passed to go-make/setup)"
|
||||
required: true
|
||||
default: "1.26.2"
|
||||
cache-key-prefix:
|
||||
description: "Prefix all cache keys with this value (passed to go-make/setup)"
|
||||
required: true
|
||||
@@ -30,9 +26,8 @@ runs:
|
||||
using: "composite"
|
||||
steps:
|
||||
- name: Setup go + go-make tooling
|
||||
uses: anchore/go-make/.github/actions/setup@abf41688f36f2cbec13105747abbe8e60f5c56ca # v0.9.3
|
||||
uses: anchore/go-make/.github/actions/setup@cf465259f4c9f0b0b0bcb35164ede11f7dc6d9f6 # v0.9.6
|
||||
with:
|
||||
go-version: ${{ inputs.go-version }}
|
||||
cache-key-prefix: ${{ inputs.cache-key-prefix }}
|
||||
cache-enabled: ${{ inputs.cache-enabled }}
|
||||
|
||||
|
||||
@@ -25,7 +25,7 @@ jobs:
|
||||
persist-credentials: false
|
||||
|
||||
- name: "Run zizmor"
|
||||
uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
|
||||
uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
|
||||
with:
|
||||
# there is a pass/fail gate as a repo ruleset (if there is no ruleset configured then the action will pass by default)
|
||||
advanced-security: true
|
||||
|
||||
@@ -99,10 +99,7 @@ jobs:
|
||||
# go-make's setup only (not ./.github/actions/bootstrap): binny ships no windows release, so binny tools
|
||||
# are unavailable here (`make unit` skips the fixture refresh on windows)
|
||||
- name: Setup go + go-make tooling
|
||||
uses: anchore/go-make/.github/actions/setup@abf41688f36f2cbec13105747abbe8e60f5c56ca # v0.9.3
|
||||
with:
|
||||
# keep in sync with the go-version default in ./.github/actions/bootstrap
|
||||
go-version: "1.26.2"
|
||||
uses: anchore/go-make/.github/actions/setup@cf465259f4c9f0b0b0bcb35164ede11f7dc6d9f6 # v0.9.6
|
||||
|
||||
# the binny-free version of `make download-test-fixture-cache` (keep the oras version in sync with .binny.yaml)
|
||||
- name: Download test fixture cache
|
||||
@@ -195,10 +192,7 @@ jobs:
|
||||
|
||||
# go-make's setup only (not ./.github/actions/bootstrap): the test only needs make + the snapshot binary
|
||||
- name: Setup go + go-make tooling
|
||||
uses: anchore/go-make/.github/actions/setup@abf41688f36f2cbec13105747abbe8e60f5c56ca # v0.9.3
|
||||
with:
|
||||
# keep in sync with the go-version default in ./.github/actions/bootstrap
|
||||
go-version: "1.26.2"
|
||||
uses: anchore/go-make/.github/actions/setup@cf465259f4c9f0b0b0bcb35164ede11f7dc6d9f6 # v0.9.6
|
||||
|
||||
- name: Install Podman
|
||||
run: |
|
||||
@@ -228,10 +222,7 @@ jobs:
|
||||
|
||||
# go-make's setup only (not ./.github/actions/bootstrap): the test only needs make + the snapshot binary
|
||||
- name: Setup go + go-make tooling
|
||||
uses: anchore/go-make/.github/actions/setup@abf41688f36f2cbec13105747abbe8e60f5c56ca # v0.9.3
|
||||
with:
|
||||
# keep in sync with the go-version default in ./.github/actions/bootstrap
|
||||
go-version: "1.26.2"
|
||||
uses: anchore/go-make/.github/actions/setup@cf465259f4c9f0b0b0bcb35164ede11f7dc6d9f6 # v0.9.6
|
||||
|
||||
- name: Install Buildah
|
||||
run: |
|
||||
|
||||
+4
-4
@@ -2,11 +2,11 @@ module github.com/anchore/syft/.make
|
||||
|
||||
go 1.26.0
|
||||
|
||||
require github.com/anchore/go-make v0.9.3
|
||||
require github.com/anchore/go-make v0.9.6
|
||||
|
||||
require (
|
||||
github.com/bmatcuk/doublestar/v4 v4.10.2 // indirect
|
||||
github.com/bmatcuk/doublestar/v4 v4.10.3 // indirect
|
||||
github.com/goccy/go-yaml v1.19.2 // indirect
|
||||
golang.org/x/mod v0.41.0 // indirect
|
||||
golang.org/x/sys v0.48.0 // indirect
|
||||
golang.org/x/mod v0.42.0 // indirect
|
||||
golang.org/x/sys v0.49.0 // indirect
|
||||
)
|
||||
|
||||
+8
-8
@@ -1,10 +1,10 @@
|
||||
github.com/anchore/go-make v0.9.3 h1:D+MkpvEJsOGwkOqKN0rd2zYi9jEzwKtZreNysH0DenI=
|
||||
github.com/anchore/go-make v0.9.3/go.mod h1:4HuELygGhxex2SaCEgfCbZ0geJ3xFkqtWpmt1NrYwPg=
|
||||
github.com/bmatcuk/doublestar/v4 v4.10.2 h1:eF7W7HWKg3z9NrWV9pTLnNeoXaqq3Tq9DNKXVMfoCnw=
|
||||
github.com/bmatcuk/doublestar/v4 v4.10.2/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
|
||||
github.com/anchore/go-make v0.9.6 h1:HjO7H/M/WZ4v3B73/EuShuQHHblQJGwHDrl/MqCavWs=
|
||||
github.com/anchore/go-make v0.9.6/go.mod h1:zE6KeB+nY+sMSWHYx2uaiOznLAq3CD9JvFlzWDDpKw4=
|
||||
github.com/bmatcuk/doublestar/v4 v4.10.3 h1:1UIv1+fqH3++ViVkpnaPTB+Pi1UHycnPFAq14zgK+gI=
|
||||
github.com/bmatcuk/doublestar/v4 v4.10.3/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
|
||||
github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
|
||||
github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
|
||||
golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
|
||||
golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
|
||||
golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
|
||||
golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
|
||||
golang.org/x/mod v0.42.0 h1:ICeL3t2L30ljSPHHxDnR4fqVcBt/zR2zJAb9juavmQg=
|
||||
golang.org/x/mod v0.42.0/go.mod h1:u5fzIrRInkL8MaO1cbRkUHT64v303YIT5KEqpNr7jRs=
|
||||
golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
|
||||
golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
|
||||
|
||||
@@ -27,7 +27,7 @@ require (
|
||||
github.com/aquasecurity/go-pep440-version v0.0.1
|
||||
github.com/bitnami/go-version v0.0.0-20250131085805-b1f57a8634ef
|
||||
github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
|
||||
github.com/bmatcuk/doublestar/v4 v4.10.2
|
||||
github.com/bmatcuk/doublestar/v4 v4.10.3
|
||||
github.com/cespare/xxhash/v2 v2.3.0
|
||||
github.com/charmbracelet/bubbles v1.0.0
|
||||
github.com/charmbracelet/bubbletea v1.3.10
|
||||
@@ -43,7 +43,7 @@ require (
|
||||
github.com/gkampitakis/go-snaps v0.5.23
|
||||
github.com/go-git/go-billy/v5 v5.9.2
|
||||
github.com/go-git/go-git/v5 v5.19.3
|
||||
github.com/go-test/deep v1.1.1
|
||||
github.com/go-test/deep v1.1.2
|
||||
github.com/go-viper/mapstructure/v2 v2.5.0
|
||||
github.com/goccy/go-yaml v1.19.2
|
||||
github.com/gohugoio/hashstructure v0.6.0
|
||||
@@ -51,7 +51,7 @@ require (
|
||||
github.com/google/go-containerregistry v0.22.1
|
||||
github.com/google/licensecheck v0.3.1
|
||||
github.com/google/uuid v1.6.0
|
||||
github.com/gookit/color v1.6.2
|
||||
github.com/gookit/color v1.6.3
|
||||
github.com/gpustack/gguf-parser-go v0.26.4
|
||||
github.com/hashicorp/go-cleanhttp v0.5.2
|
||||
github.com/hashicorp/go-getter v1.8.10
|
||||
@@ -62,7 +62,7 @@ require (
|
||||
github.com/jedib0t/go-pretty/v6 v6.8.3
|
||||
github.com/jinzhu/copier v0.4.0
|
||||
github.com/kastenhq/goversion v0.0.0-20230811215019-93b2f8823953
|
||||
github.com/klauspost/compress v1.20.1
|
||||
github.com/klauspost/compress v1.20.3
|
||||
github.com/magiconair/properties v1.18.12
|
||||
github.com/mholt/archives v0.1.5
|
||||
github.com/moby/sys/mountinfo v0.7.2
|
||||
@@ -93,10 +93,10 @@ require (
|
||||
go.uber.org/goleak v1.3.0
|
||||
go.yaml.in/yaml/v3 v3.0.5
|
||||
golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
|
||||
golang.org/x/mod v0.41.0
|
||||
golang.org/x/mod v0.42.0
|
||||
golang.org/x/net v0.61.0
|
||||
golang.org/x/time v0.16.0
|
||||
golang.org/x/tools v0.51.0
|
||||
golang.org/x/tools v0.52.0
|
||||
modernc.org/sqlite v1.60.1
|
||||
)
|
||||
|
||||
|
||||
@@ -229,8 +229,8 @@ github.com/bitnami/go-version v0.0.0-20250131085805-b1f57a8634ef h1:TSFnfbbu2oAO
|
||||
github.com/bitnami/go-version v0.0.0-20250131085805-b1f57a8634ef/go.mod h1:9iglf1GG4oNRJ39bZ5AZrjgAFD2RwQbXw6Qf7Cs47wo=
|
||||
github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb h1:m935MPodAbYS46DG4pJSv7WO+VECIWUQ7OJYSoTrMh4=
|
||||
github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb/go.mod h1:PkYb9DJNAwrSvRx5DYA+gUcOIgTGVMNkfSCbZM8cWpI=
|
||||
github.com/bmatcuk/doublestar/v4 v4.10.2 h1:eF7W7HWKg3z9NrWV9pTLnNeoXaqq3Tq9DNKXVMfoCnw=
|
||||
github.com/bmatcuk/doublestar/v4 v4.10.2/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
|
||||
github.com/bmatcuk/doublestar/v4 v4.10.3 h1:1UIv1+fqH3++ViVkpnaPTB+Pi1UHycnPFAq14zgK+gI=
|
||||
github.com/bmatcuk/doublestar/v4 v4.10.3/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
|
||||
github.com/bodgit/plumbing v1.3.0 h1:pf9Itz1JOQgn7vEOE7v7nlEfBykYqvUYioC61TwWCFU=
|
||||
github.com/bodgit/plumbing v1.3.0/go.mod h1:JOTb4XiRu5xfnmdnDJo6GmSbSbtSyufrsyZFByMtKEs=
|
||||
github.com/bodgit/sevenzip v1.6.1 h1:kikg2pUMYC9ljU7W9SaqHXhym5HyKm8/M/jd31fYan4=
|
||||
@@ -458,8 +458,8 @@ github.com/go-restruct/restruct v1.2.0-alpha h1:2Lp474S/9660+SJjpVxoKuWX09JsXHSr
|
||||
github.com/go-restruct/restruct v1.2.0-alpha/go.mod h1:KqrpKpn4M8OLznErihXTGLlsXFGeLxHUrLRRI/1YjGk=
|
||||
github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
|
||||
github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
|
||||
github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
|
||||
github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
|
||||
github.com/go-test/deep v1.1.2 h1:JUuyv17rKrqYfLFnP9A4Yh6hw0635ugB93bMg2bwuDQ=
|
||||
github.com/go-test/deep v1.1.2/go.mod h1:lwVFiFFWPjydTsV3xGJ/YTQsnWwi8zxBFM+gOVcwINE=
|
||||
github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
|
||||
github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
|
||||
github.com/gobwas/httphead v0.1.0/go.mod h1:O/RXo79gxV8G+RqlR/otEwx4Q36zl9rqC5u12GKvMCM=
|
||||
@@ -575,8 +575,8 @@ github.com/googleapis/gax-go/v2 v2.24.1/go.mod h1:bWeBei0NVwaNZKb2y1HUBS7gLXIF3/
|
||||
github.com/gookit/assert v0.1.1 h1:lh3GcawXe/p+cU7ESTZ5Ui3Sm/x8JWpIis4/1aF0mY0=
|
||||
github.com/gookit/assert v0.1.1/go.mod h1:jS5bmIVQZTIwk42uXl4lyj4iaaxx32tqH16CFj0VX2E=
|
||||
github.com/gookit/color v1.2.5/go.mod h1:AhIE+pS6D4Ql0SQWbBeXPHw7gY0/sjHoA4s/n1KB7xg=
|
||||
github.com/gookit/color v1.6.2 h1:M6TJRJMuDFPYkrWmjOvMj+E0xIjcHq8lMPy7+vv0z1Y=
|
||||
github.com/gookit/color v1.6.2/go.mod h1:9ACFc7/1IpHGBW8RwuDm/0YEnhg3dwwXpoMsmtyHfjs=
|
||||
github.com/gookit/color v1.6.3 h1:m6E49x+KftGaspcLtPLMsyci2ARhWIUW0PUV1owMlhs=
|
||||
github.com/gookit/color v1.6.3/go.mod h1:9ACFc7/1IpHGBW8RwuDm/0YEnhg3dwwXpoMsmtyHfjs=
|
||||
github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
|
||||
github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
|
||||
github.com/gpustack/gguf-parser-go v0.26.4 h1:B9CRrQBcIB7I/MJFZvzPZ+e+cbc1xBzQJcmpi9l/mKU=
|
||||
@@ -666,8 +666,8 @@ github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF
|
||||
github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
|
||||
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
|
||||
github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
|
||||
github.com/klauspost/compress v1.20.1 h1:T7kKElXUMXrUJ2E9QhQhxFtcK5rPyLdsGZvdbLMPdiQ=
|
||||
github.com/klauspost/compress v1.20.1/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
|
||||
github.com/klauspost/compress v1.20.3 h1:zWNoFqq/lSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=
|
||||
github.com/klauspost/compress v1.20.3/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
|
||||
github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
|
||||
github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
|
||||
github.com/klauspost/pgzip v1.2.6/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
|
||||
@@ -1147,8 +1147,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
|
||||
golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
|
||||
golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
|
||||
golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
|
||||
golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
|
||||
golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
|
||||
golang.org/x/mod v0.42.0 h1:ICeL3t2L30ljSPHHxDnR4fqVcBt/zR2zJAb9juavmQg=
|
||||
golang.org/x/mod v0.42.0/go.mod h1:u5fzIrRInkL8MaO1cbRkUHT64v303YIT5KEqpNr7jRs=
|
||||
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
@@ -1410,8 +1410,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
|
||||
golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
|
||||
golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
|
||||
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
|
||||
golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI=
|
||||
golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA=
|
||||
golang.org/x/tools v0.52.0 h1:ryxg4U63oaUYk7uOLTF37n43f4qgtGvqV4Ioit1BaEs=
|
||||
golang.org/x/tools v0.52.0/go.mod h1:ItcP5UNaVGG+Yc4eIYmaFLNJ4soEopkx5Y2d4lcEurs=
|
||||
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
|
||||
@@ -2131,40 +2131,40 @@ var urlToLicense = map[string]string{
|
||||
"raw.githubusercontent.com/NTIA/scos-sensor/refs/heads/master/LICENSE.md": "NTIA-PD",
|
||||
"raw.githubusercontent.com/OpenMDW/OpenMDW/refs/heads/main/1.0/LICENSE.openmdw": "OpenMDW-1.0",
|
||||
"raw.githubusercontent.com/blackhole89/notekit/master/data/fonts/Charter%20license.txt": "Bitstream-Charter",
|
||||
"raw.githubusercontent.com/landtuna/open-mtools/6c04c2882eca7c4313ec267766ea53ac9bfe129b/mdump.c": "Informatica",
|
||||
"raw.githubusercontent.com/landtuna/open-mtools/6c04c2882eca7c4313ec267766ea53ac9bfe129b/msend.c": "Informatica",
|
||||
"rc.quest.com/topics/openssh/license.php#tcpwrappers": "TCP-wrappers",
|
||||
"research.cs.wisc.edu/condor/license.html#condor": "Condor-1.1",
|
||||
"research.scea.com/scea_shared_source_license.html": "SCEA",
|
||||
"romanrm.net/mit-zero": "MIT-0",
|
||||
"sam.zoy.org/wtfpl/COPYING": "WTFPL",
|
||||
"scancode-licensedb.aboutcode.org/bsd-unchanged": "BSD-2-Clause-pos-unchanged",
|
||||
"scripts.sil.org/cms/scripts/page.php?item_id=OFL10_web": "OFL-1.0-no-RFN",
|
||||
"scripts.sil.org/cms/scripts/page.php?item_id=OFL_web": "OFL-1.1-no-RFN",
|
||||
"slicer.org/LICENSE": "3D-Slicer-1.0",
|
||||
"solderpad.org/licenses/SHL-0.5/": "SHL-0.5",
|
||||
"solderpad.org/licenses/SHL-0.51/": "SHL-0.51",
|
||||
"source.icu-project.org/repos/icu/icu/trunk/license.html": "ICU",
|
||||
"sourceforge.net/p/buddy/gitcode/ci/master/tree/README": "Buddy",
|
||||
"sourceforge.net/p/ctrio/git/ci/master/tree/README": "ISC-Veillard",
|
||||
"sourceforge.net/p/mcj/xfig/ci/master/tree/src/Makefile.am": "Xfig",
|
||||
"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/converter/other/pnmtorle.c": "URT-RLE",
|
||||
"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/converter/other/rletopnm.c": "URT-RLE",
|
||||
"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/converter/ppm/ppmtompeg/jrevdct.c#l1189": "MPEG-SSG",
|
||||
"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/editor/pnmstitch.c#l2": "pnmstitch",
|
||||
"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/netpbm.c#l8": "HPND-Pbmplus",
|
||||
"sourceforge.net/p/sbcl/sbcl/ci/master/tree/src/code/loop.lisp": "LOOP",
|
||||
"sourceforge.net/p/trustedqsl/tqsl/ci/master/tree/LICENSE.txt": "TrustedQSL",
|
||||
"sourceforge.net/p/xmedcon/code/ci/master/tree/libs/dicom/README": "OFFIS",
|
||||
"sourceforge.net/p/xmedcon/code/ci/master/tree/libs/ljpg/": "IJG-short",
|
||||
"sourceforge.net/projects/sevenzip/files/LZMA%20SDK/": "LZMA-SDK-9.22",
|
||||
"sources.debian.org/copyright/license/debianutils/4.11.2/": "SMAIL-GPL",
|
||||
"sources.debian.org/src/openmpi/4.1.0-10/ompi/debuggers/msgq_interface.h/?hl=19#L19": "mpi-permissive",
|
||||
"sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/licenses/BitTorrent?r1=1.1&r2=1.1.1.1&diff_format=s": "BitTorrent-1.0",
|
||||
"sourceware.org/bzip2/1.0.5/bzip2-manual-1.0.5.html": "bzip2-1.0.6",
|
||||
"sourceware.org/cgit/binutils-gdb/tree/include/coff/sym.h#n11": "MIPS",
|
||||
"sourceware.org/cgit/binutils-gdb/tree/include/coff/symconst.h#n11": "ThirdEye",
|
||||
"sourceware.org/cgit/valgrind/tree/mpi/libmpiwrap.c": "bzip2-1.0.6",
|
||||
"raw.githubusercontent.com/landtuna/open-mtools/6c04c2882eca7c4313ec267766ea53ac9bfe129b/mdump.c": "Informatica",
|
||||
"raw.githubusercontent.com/landtuna/open-mtools/6c04c2882eca7c4313ec267766ea53ac9bfe129b/msend.c": "Informatica",
|
||||
"rc.quest.com/topics/openssh/license.php#tcpwrappers": "TCP-wrappers",
|
||||
"research.cs.wisc.edu/condor/license.html#condor": "Condor-1.1",
|
||||
"research.scea.com/scea_shared_source_license.html": "SCEA",
|
||||
"romanrm.net/mit-zero": "MIT-0",
|
||||
"sam.zoy.org/wtfpl/COPYING": "WTFPL",
|
||||
"scancode-licensedb.aboutcode.org/bsd-unchanged": "BSD-2-Clause-pos-unchanged",
|
||||
"scripts.sil.org/cms/scripts/page.php?item_id=OFL10_web": "OFL-1.0-no-RFN",
|
||||
"scripts.sil.org/cms/scripts/page.php?item_id=OFL_web": "OFL-1.1-no-RFN",
|
||||
"slicer.org/LICENSE": "3D-Slicer-1.0",
|
||||
"solderpad.org/licenses/SHL-0.5/": "SHL-0.5",
|
||||
"solderpad.org/licenses/SHL-0.51/": "SHL-0.51",
|
||||
"source.icu-project.org/repos/icu/icu/trunk/license.html": "ICU",
|
||||
"sourceforge.net/p/buddy/gitcode/ci/master/tree/README": "Buddy",
|
||||
"sourceforge.net/p/ctrio/git/ci/master/tree/README": "ISC-Veillard",
|
||||
"sourceforge.net/p/mcj/xfig/ci/master/tree/src/Makefile.am": "Xfig",
|
||||
"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/converter/other/pnmtorle.c": "URT-RLE",
|
||||
"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/converter/other/rletopnm.c": "URT-RLE",
|
||||
"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/converter/ppm/ppmtompeg/jrevdct.c#l1189": "MPEG-SSG",
|
||||
"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/editor/pnmstitch.c#l2": "pnmstitch",
|
||||
"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/netpbm.c#l8": "HPND-Pbmplus",
|
||||
"sourceforge.net/p/sbcl/sbcl/ci/master/tree/src/code/loop.lisp": "LOOP",
|
||||
"sourceforge.net/p/trustedqsl/tqsl/ci/master/tree/LICENSE.txt": "TrustedQSL",
|
||||
"sourceforge.net/p/xmedcon/code/ci/master/tree/libs/dicom/README": "OFFIS",
|
||||
"sourceforge.net/p/xmedcon/code/ci/master/tree/libs/ljpg/": "IJG-short",
|
||||
"sourceforge.net/projects/sevenzip/files/LZMA%20SDK/": "LZMA-SDK-9.22",
|
||||
"sources.debian.org/copyright/license/debianutils/4.11.2/": "SMAIL-GPL",
|
||||
"sources.debian.org/src/openmpi/4.1.0-10/ompi/debuggers/msgq_interface.h/?hl=19#L19": "mpi-permissive",
|
||||
"sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/licenses/BitTorrent?r1=1.1&r2=1.1.1.1&diff_format=s": "BitTorrent-1.0",
|
||||
"sourceware.org/bzip2/1.0.5/bzip2-manual-1.0.5.html": "bzip2-1.0.6",
|
||||
"sourceware.org/cgit/binutils-gdb/tree/include/coff/sym.h#n11": "MIPS",
|
||||
"sourceware.org/cgit/binutils-gdb/tree/include/coff/symconst.h#n11": "ThirdEye",
|
||||
"sourceware.org/cgit/valgrind/tree/mpi/libmpiwrap.c": "bzip2-1.0.6",
|
||||
"sourceware.org/git/?p=binutils-gdb.git;a=blob;f=libiberty/strcasecmp.c;h=131d81c2ce7881fa48c363dc5bf5fb302c61ce0b;hb=HEAD": "BSD-4.3RENO",
|
||||
"sourceware.org/git/?p=binutils-gdb.git;a=blob;f=readline/readline/support/wcwidth.c;h=0f5ec995796f4813abbcf4972aec0378ab74722a;hb=HEAD#l55": "HPND-Markus-Kuhn",
|
||||
"sourceware.org/git/?p=bzip2.git;a=blob;f=LICENSE;hb=bzip2-1.0.6": "bzip2-1.0.6",
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
package binary
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"errors"
|
||||
"flag"
|
||||
@@ -20,6 +21,7 @@ import (
|
||||
"github.com/anchore/syft/internal/testutils"
|
||||
"github.com/anchore/syft/syft/cpe"
|
||||
"github.com/anchore/syft/syft/file"
|
||||
"github.com/anchore/syft/syft/internal/unionreader"
|
||||
"github.com/anchore/syft/syft/pkg"
|
||||
"github.com/anchore/syft/syft/pkg/cataloger/binary/internal/manager/testutil"
|
||||
"github.com/anchore/syft/syft/pkg/cataloger/internal/binutils"
|
||||
@@ -2176,6 +2178,28 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
|
||||
Metadata: metadata("istio-binary"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "istio_pilot-discovery/1.19.0-rc.0/linux-amd64",
|
||||
expected: pkg.Package{
|
||||
Name: "pilot-discovery",
|
||||
Version: "1.19.0-rc.0",
|
||||
Type: "binary",
|
||||
PURL: "pkg:generic/istio@1.19.0-rc.0",
|
||||
Locations: locations("pilot-discovery"),
|
||||
Metadata: metadata("istio-binary"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "istio_pilot-discovery/1.15.0-beta.0/linux-amd64",
|
||||
expected: pkg.Package{
|
||||
Name: "pilot-discovery",
|
||||
Version: "1.15.0-beta.0",
|
||||
Type: "binary",
|
||||
PURL: "pkg:generic/istio@1.15.0-beta.0",
|
||||
Locations: locations("pilot-discovery"),
|
||||
Metadata: metadata("istio-binary"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "istio_pilot-discovery/1.10-dev/linux-amd64",
|
||||
expected: pkg.Package{
|
||||
@@ -2198,6 +2222,17 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
|
||||
Metadata: metadata("istio-binary"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "istio_pilot-discovery/1.5.0-alpha.0/linux-amd64",
|
||||
expected: pkg.Package{
|
||||
Name: "pilot-discovery",
|
||||
Version: "1.5.0-alpha.0",
|
||||
Type: "binary",
|
||||
PURL: "pkg:generic/istio@1.5.0-alpha.0",
|
||||
Locations: locations("pilot-discovery"),
|
||||
Metadata: metadata("istio-binary"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "istio_pilot-discovery/1.3.8/linux-amd64",
|
||||
expected: pkg.Package{
|
||||
@@ -2220,6 +2255,17 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
|
||||
Metadata: metadata("istio-binary"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "istio_pilot-discovery/1.0.0-snapshot.0/linux-amd64",
|
||||
expected: pkg.Package{
|
||||
Name: "pilot-discovery",
|
||||
Version: "1.0.0-snapshot.0",
|
||||
Type: "binary",
|
||||
PURL: "pkg:generic/istio@1.0.0-snapshot.0",
|
||||
Locations: locations("pilot-discovery"),
|
||||
Metadata: metadata("istio-binary"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "istio_pilot-agent/1.29.0-alpha.0/linux-amd64",
|
||||
expected: pkg.Package{
|
||||
@@ -2264,6 +2310,28 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
|
||||
Metadata: metadata("istio-binary"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "istio_pilot-agent/1.19.0-rc.0/linux-amd64",
|
||||
expected: pkg.Package{
|
||||
Name: "pilot-agent",
|
||||
Version: "1.19.0-rc.0",
|
||||
Type: "binary",
|
||||
PURL: "pkg:generic/istio@1.19.0-rc.0",
|
||||
Locations: locations("pilot-agent"),
|
||||
Metadata: metadata("istio-binary"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "istio_pilot-agent/1.15.0-beta.0/linux-amd64",
|
||||
expected: pkg.Package{
|
||||
Name: "pilot-agent",
|
||||
Version: "1.15.0-beta.0",
|
||||
Type: "binary",
|
||||
PURL: "pkg:generic/istio@1.15.0-beta.0",
|
||||
Locations: locations("pilot-agent"),
|
||||
Metadata: metadata("istio-binary"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "istio_pilot-agent/1.10-dev/linux-amd64",
|
||||
expected: pkg.Package{
|
||||
@@ -2286,6 +2354,17 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
|
||||
Metadata: metadata("istio-binary"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "istio_pilot-agent/1.5.0-alpha.0/linux-amd64",
|
||||
expected: pkg.Package{
|
||||
Name: "pilot-agent",
|
||||
Version: "1.5.0-alpha.0",
|
||||
Type: "binary",
|
||||
PURL: "pkg:generic/istio@1.5.0-alpha.0",
|
||||
Locations: locations("pilot-agent"),
|
||||
Metadata: metadata("istio-binary"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "istio_pilot-agent/1.1.17/linux-amd64",
|
||||
expected: pkg.Package{
|
||||
@@ -2297,6 +2376,17 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
|
||||
Metadata: metadata("istio-binary"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "istio_pilot-agent/1.0.0-snapshot.0/linux-amd64",
|
||||
expected: pkg.Package{
|
||||
Name: "pilot-agent",
|
||||
Version: "1.0.0-snapshot.0",
|
||||
Type: "binary",
|
||||
PURL: "pkg:generic/istio@1.0.0-snapshot.0",
|
||||
Locations: locations("pilot-agent"),
|
||||
Metadata: metadata("istio-binary"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "grafana/12.4.0-22081664032/linux-amd64",
|
||||
expected: pkg.Package{
|
||||
@@ -2539,6 +2629,39 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
|
||||
Metadata: metadata("grafana-binary"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "envoy/1.40.1/linux-amd64",
|
||||
expected: pkg.Package{
|
||||
Name: "envoy",
|
||||
Version: "1.40.1",
|
||||
Type: "binary",
|
||||
PURL: "pkg:generic/envoy@1.40.1",
|
||||
Locations: locations("envoy"),
|
||||
Metadata: metadata("envoy-binary"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "envoy/1.40.0/linux-amd64",
|
||||
expected: pkg.Package{
|
||||
Name: "envoy",
|
||||
Version: "1.40.0",
|
||||
Type: "binary",
|
||||
PURL: "pkg:generic/envoy@1.40.0",
|
||||
Locations: locations("envoy"),
|
||||
Metadata: metadata("envoy-binary"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "envoy/1.37.1/linux-amd64",
|
||||
expected: pkg.Package{
|
||||
Name: "envoy",
|
||||
Version: "1.37.1",
|
||||
Type: "binary",
|
||||
PURL: "pkg:generic/envoy@1.37.1",
|
||||
Locations: locations("envoy"),
|
||||
Metadata: metadata("envoy-binary"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "envoy/1.36.4/linux-amd64",
|
||||
expected: pkg.Package{
|
||||
@@ -3192,6 +3315,134 @@ func Test_Cataloger_DefaultClassifiers_PositiveCases_Image(t *testing.T) {
|
||||
// Test_Cataloger_PackageTypes covers what assertPackagesAreEqual deliberately ignores: the package type and CPEs.
|
||||
// The perl interpreter is reported as cpan so it lines up with the rest of the CPAN ecosystem, everything else
|
||||
// keeps the default binary type.
|
||||
// Test_Cataloger_ffmpeg_versionSuffix verifies the ffmpeg classifiers no longer
|
||||
// unconditionally truncate the embedded "FFmpeg version <ver>" string to X.Y[.Z].
|
||||
// Semver build metadata (a backported-patch stamp such as
|
||||
// "9.0.3+dev.9.0.2.p1.eb9cef3") must be preserved in the reported version, because
|
||||
// it compares equal to its core version and so does not disturb vulnerability
|
||||
// matching. A "-" pre-release suffix (a distro revision such as "6.1.1-3ubuntu5")
|
||||
// must stay truncated: it sorts below the release in semver and would corrupt
|
||||
// version-range matching. Suffix-free binaries match exactly as before, and
|
||||
// trailing non-version text (or NUL padding) is never absorbed into the version.
|
||||
func Test_Cataloger_ffmpeg_versionSuffix(t *testing.T) {
|
||||
// collect the ffmpeg classifiers under test, keyed by their FileGlob
|
||||
classifiers := map[string]binutils.Classifier{}
|
||||
for _, c := range DefaultClassifiers() {
|
||||
if c.Package == "ffmpeg" {
|
||||
classifiers[c.FileGlob] = c
|
||||
}
|
||||
}
|
||||
require.NotEmpty(t, classifiers, "expected to find ffmpeg classifiers")
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
fileGlob string // which classifier to run
|
||||
data string // simulated binary contents
|
||||
want string // expected reported version ("" = no match expected)
|
||||
}{
|
||||
{
|
||||
name: "library bare version unchanged",
|
||||
fileGlob: "**/libav*",
|
||||
data: "FFmpeg version 7.1.1",
|
||||
want: "7.1.1",
|
||||
},
|
||||
{
|
||||
name: "library two-component version unchanged",
|
||||
fileGlob: "**/libav*",
|
||||
data: "FFmpeg version 6.0",
|
||||
want: "6.0",
|
||||
},
|
||||
{
|
||||
name: "library build metadata with patch provenance preserved",
|
||||
fileGlob: "**/libav*",
|
||||
data: "FFmpeg version 9.0.3+dev.9.0.2.p1.eb9cef3",
|
||||
want: "9.0.3+dev.9.0.2.p1.eb9cef3",
|
||||
},
|
||||
{
|
||||
name: "library build metadata short sha preserved",
|
||||
fileGlob: "**/libav*",
|
||||
data: "FFmpeg version 9.0.2+eb9cef3",
|
||||
want: "9.0.2+eb9cef3",
|
||||
},
|
||||
{
|
||||
// a "-" pre-release suffix is intentionally NOT captured: it sorts below
|
||||
// the release in semver and would corrupt version-range vulnerability
|
||||
// matching, so distro revisions stay truncated exactly as before
|
||||
name: "library distro hyphen revision truncated",
|
||||
fileGlob: "**/libav*",
|
||||
data: "FFmpeg version 6.1.1-3ubuntu5",
|
||||
want: "6.1.1",
|
||||
},
|
||||
{
|
||||
name: "library distro dotted hyphen revision truncated",
|
||||
fileGlob: "**/libav*",
|
||||
data: "FFmpeg version 4.4.2-0ubuntu0.22.04.1",
|
||||
want: "4.4.2",
|
||||
},
|
||||
{
|
||||
name: "library trailing text not captured",
|
||||
fileGlob: "**/libav*",
|
||||
data: "FFmpeg version 6.1.1 Copyright (c) 2000-2023 the FFmpeg developers",
|
||||
want: "6.1.1",
|
||||
},
|
||||
{
|
||||
name: "library NUL-padded version not over-captured",
|
||||
fileGlob: "**/libav*",
|
||||
data: "FFmpeg version 9.0.3\x00libavformat.so",
|
||||
want: "9.0.3",
|
||||
},
|
||||
{
|
||||
name: "libswresample build metadata preserved",
|
||||
fileGlob: "**/libswresample*",
|
||||
data: "FFmpeg version 9.0.3+dev.9.0.2.p1.eb9cef3",
|
||||
want: "9.0.3+dev.9.0.2.p1.eb9cef3",
|
||||
},
|
||||
{
|
||||
// the compiled-in printf format string in the ffmpeg binary is the
|
||||
// literal "%s version <ver>" (the program name is substituted at runtime)
|
||||
name: "binary build metadata preserved",
|
||||
fileGlob: "**/ffmpeg",
|
||||
data: "%s version 9.0.3+dev.9.0.2.p1.eb9cef3",
|
||||
want: "9.0.3+dev.9.0.2.p1.eb9cef3",
|
||||
},
|
||||
{
|
||||
name: "binary bare version unchanged",
|
||||
fileGlob: "**/ffmpeg",
|
||||
data: "%s version 7.1.1",
|
||||
want: "7.1.1",
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
cls, ok := classifiers[tt.fileGlob]
|
||||
require.Truef(t, ok, "no ffmpeg classifier for glob %q", tt.fileGlob)
|
||||
|
||||
ctx := binutils.MatcherContext{
|
||||
GetReader: func(binutils.MatcherContext) (unionreader.UnionReader, error) {
|
||||
return unionreader.GetUnionReader(io.NopCloser(bytes.NewBufferString(tt.data)))
|
||||
},
|
||||
}
|
||||
|
||||
pkgs, err := cls.EvidenceMatcher(cls, ctx)
|
||||
require.NoError(t, err)
|
||||
|
||||
if tt.want == "" {
|
||||
require.Empty(t, pkgs, "expected no package match")
|
||||
return
|
||||
}
|
||||
require.Len(t, pkgs, 1, "expected exactly one package")
|
||||
assert.Equal(t, tt.want, pkgs[0].Version)
|
||||
// the fuller version must also flow into the PURL so the SBOM is not lossy;
|
||||
// compare the decoded PURL version, since packageurl-go percent-encodes
|
||||
// reserved characters (e.g. '+' -> %2B) in the serialized form
|
||||
parsed, err := packageurl.FromString(pkgs[0].PURL)
|
||||
require.NoError(t, err, "PURL should parse")
|
||||
assert.Equal(t, tt.want, parsed.Version)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func Test_Cataloger_PackageTypes(t *testing.T) {
|
||||
tests := []struct {
|
||||
logicalFixture string
|
||||
|
||||
@@ -972,7 +972,10 @@ func DefaultClassifiers() []binutils.Classifier {
|
||||
EvidenceMatcher: m.FileContentsVersionMatcher(
|
||||
// Pattern found in the binary: "%s version 7.1.1" or "%s version 6.0"
|
||||
// When executed outputs: "ffmpeg version 7.1.1" or "ffmpeg version 6.0"
|
||||
`(?m)%s version (?P<version>[0-9]+\.[0-9]+(\.[0-9]+)?)`,
|
||||
// The optional "+" suffix preserves semver build metadata (e.g. a
|
||||
// backported-patch stamp like "9.0.3+dev.9.0.2.p1.eb9cef3"); see the
|
||||
// ffmpeg-library classifier for why "-" pre-release suffixes stay truncated.
|
||||
`(?m)%s version (?P<version>[0-9]+\.[0-9]+(\.[0-9]+)?(?:\+[0-9A-Za-z]+(?:\.[0-9A-Za-z]+)*)?)`,
|
||||
),
|
||||
Package: "ffmpeg",
|
||||
PURL: mustPURL("pkg:generic/ffmpeg@version"),
|
||||
@@ -982,8 +985,15 @@ func DefaultClassifiers() []binutils.Classifier {
|
||||
Class: "ffmpeg-library",
|
||||
FileGlob: "**/libav*",
|
||||
EvidenceMatcher: binutils.MatchAny(
|
||||
// Primary pattern: FFmpeg version found in most libraries
|
||||
m.FileContentsVersionMatcher(`(?m)FFmpeg version (?P<version>[0-9]+\.[0-9]+(\.[0-9]+)?)`),
|
||||
// Primary pattern: FFmpeg version found in most libraries.
|
||||
// The optional "+" suffix preserves semver build metadata (e.g. a
|
||||
// backported-patch stamp like "9.0.3+dev.9.0.2.p1.eb9cef3") instead of
|
||||
// truncating to X.Y[.Z]. Build metadata compares equal to its core
|
||||
// version, so this does not change vulnerability matching. A "-"
|
||||
// pre-release suffix (e.g. a distro revision "6.1.1-3ubuntu5") is
|
||||
// deliberately NOT captured: it sorts below the release in semver and
|
||||
// would corrupt version-range matching, so it stays truncated as before.
|
||||
m.FileContentsVersionMatcher(`(?m)FFmpeg version (?P<version>[0-9]+\.[0-9]+(\.[0-9]+)?(?:\+[0-9A-Za-z]+(?:\.[0-9A-Za-z]+)*)?)`),
|
||||
// Fallback: library-specific version patterns for libavcodec and libavformat
|
||||
m.FileContentsVersionMatcher(`(?m)Lavc(?P<version>[0-9]+\.[0-9]+\.[0-9]+)`),
|
||||
m.FileContentsVersionMatcher(`(?m)Lavf(?P<version>[0-9]+\.[0-9]+\.[0-9]+)`),
|
||||
@@ -996,8 +1006,9 @@ func DefaultClassifiers() []binutils.Classifier {
|
||||
Class: "ffmpeg-library",
|
||||
FileGlob: "**/libswresample*",
|
||||
EvidenceMatcher: m.FileContentsVersionMatcher(
|
||||
// FFmpeg version pattern for libswresample
|
||||
`(?m)FFmpeg version (?P<version>[0-9]+\.[0-9]+(\.[0-9]+)?)`),
|
||||
// FFmpeg version pattern for libswresample. Same optional "+" build
|
||||
// metadata handling as the ffmpeg-library classifier above.
|
||||
`(?m)FFmpeg version (?P<version>[0-9]+\.[0-9]+(\.[0-9]+)?(?:\+[0-9A-Za-z]+(?:\.[0-9A-Za-z]+)*)?)`),
|
||||
Package: "ffmpeg",
|
||||
PURL: mustPURL("pkg:generic/ffmpeg@version"),
|
||||
CPEs: singleCPE("cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*", cpe.NVDDictionaryLookupSource),
|
||||
@@ -1031,13 +1042,16 @@ func DefaultClassifiers() []binutils.Classifier {
|
||||
EvidenceMatcher: binutils.MatchAny(
|
||||
// [NUL]1.26.8[NUL][NUL]1.26.8[NUL]
|
||||
// [NUL]1.3.7[NUL][NUL][NUL]1.3.8[NUL]
|
||||
m.FileContentsVersionMatcher(`[0-9]+\.[0-9]+\.[0-9]+\x00+(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-dev)?)\x00+`),
|
||||
// [NUL]1.15.0-beta.0[NUL][NUL][NUL]1.15.0-beta.0[NUL] (pre-release builds repeat the full version, suffix included)
|
||||
m.FileContentsVersionMatcher(`[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-snapshot\.[0-9]+|-dev)?\x00+(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-snapshot\.[0-9]+|-dev)?)\x00+`),
|
||||
// [NUL][NUL][NUL]1.0.0-snapshot.0[NUL][NUL][NUL] (snapshot builds record the version only once)
|
||||
m.FileContentsVersionMatcher(`\x00+(?P<version>[0-9]+\.[0-9]+\.[0-9]+-snapshot\.[0-9]+)\x00+`),
|
||||
// Clean[NUL][NUL][NUL]1.8.0[NUL]
|
||||
m.FileContentsVersionMatcher(`Clean\x00+(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-dev)?)\x00+`),
|
||||
m.FileContentsVersionMatcher(`Clean\x00+(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-snapshot\.[0-9]+|-dev)?)\x00+`),
|
||||
// Modified[NUL][NUL][NUL][NUL][NUL][NUL][NUL][NUL]1.10-dev[NUL][NUL][NUL]
|
||||
m.FileContentsVersionMatcher(`Modified\x00+(?P<version>[0-9]+\.[0-9]+-dev)\x00+`),
|
||||
// 1.1.17[NUL]...S=v<y5
|
||||
m.FileContentsVersionMatcher(`(?s)(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-dev)?)\x00+.{1,100}S?=v<y5`),
|
||||
m.FileContentsVersionMatcher(`(?s)(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-snapshot\.[0-9]+|-dev)?)\x00+.{1,100}S?=v<y5`),
|
||||
),
|
||||
Package: "pilot-discovery",
|
||||
PURL: mustPURL("pkg:generic/istio@version"),
|
||||
@@ -1048,13 +1062,16 @@ func DefaultClassifiers() []binutils.Classifier {
|
||||
FileGlob: "**/pilot-agent",
|
||||
EvidenceMatcher: binutils.MatchAny(
|
||||
// [NUL]1.26.8[NUL][NUL]1.26.8[NUL]
|
||||
m.FileContentsVersionMatcher(`[0-9]+\.[0-9]+\.[0-9]+\x00+(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-dev)?)\x00+`),
|
||||
// [NUL]1.15.0-beta.0[NUL][NUL][NUL]1.15.0-beta.0[NUL] (pre-release builds repeat the full version, suffix included)
|
||||
m.FileContentsVersionMatcher(`[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-snapshot\.[0-9]+|-dev)?\x00+(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-snapshot\.[0-9]+|-dev)?)\x00+`),
|
||||
// [NUL][NUL][NUL]1.0.0-snapshot.0[NUL][NUL][NUL] (snapshot builds record the version only once)
|
||||
m.FileContentsVersionMatcher(`\x00+(?P<version>[0-9]+\.[0-9]+\.[0-9]+-snapshot\.[0-9]+)\x00+`),
|
||||
// Clean[NUL][NUL][NUL]1.8.0[NUL]
|
||||
m.FileContentsVersionMatcher(`Clean\x00+(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-dev)?)\x00+`),
|
||||
m.FileContentsVersionMatcher(`Clean\x00+(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-snapshot\.[0-9]+|-dev)?)\x00+`),
|
||||
// Modified[NUL][NUL][NUL][NUL][NUL][NUL][NUL][NUL]1.10-dev[NUL][NUL][NUL]
|
||||
m.FileContentsVersionMatcher(`Modified\x00+(?P<version>[0-9]+\.[0-9]+-dev)\x00+`),
|
||||
// 1.1.17[NUL]...S=v<y5
|
||||
m.FileContentsVersionMatcher(`(?s)(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-dev)?)\x00+.{1,100}S?=v<y5`),
|
||||
m.FileContentsVersionMatcher(`(?s)(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-snapshot\.[0-9]+|-dev)?)\x00+.{1,100}S?=v<y5`),
|
||||
),
|
||||
Package: "pilot-agent",
|
||||
PURL: mustPURL("pkg:generic/istio@version"),
|
||||
@@ -1118,9 +1135,12 @@ func DefaultClassifiers() []binutils.Classifier {
|
||||
FileGlob: "**/envoy",
|
||||
EvidenceMatcher: binutils.MatchAny(
|
||||
// 1.3x [NUL]1.36.4[NUL]...envoy_reloadable_features
|
||||
// 1.4x [NUL]1.40.1[NUL]...envoy_reloadable_features
|
||||
// 1.34.5 [NUL]1.34.5[NUL]...envoy.reloadable_features
|
||||
m.FileContentsVersionMatcher(`(?s)\x00(?P<version>1\.3[0-9]\.[0-9]+(-dev)?)\x00.{0,1000}envoy_reloadable_features`),
|
||||
m.FileContentsVersionMatcher(`(?s)\x00(?P<version>1\.[34][0-9]\.[0-9]+(-dev)?)\x00.{0,1000}envoy_reloadable_features`),
|
||||
m.FileContentsVersionMatcher(`(?s)\x00(?P<version>1\.34\.5)\x00.{0,200}envoy\.reloadable_features`),
|
||||
// 1.37.1 DeltaDiscoveryResponse.removed_resources[NUL]1.37.1[NUL]the default now-
|
||||
m.FileContentsVersionMatcher(`(?s)DeltaDiscoveryResponse\.removed_resources\x00(?P<version>1\.[34][0-9]\.[0-9]+(-dev)?)\x00`),
|
||||
// 1.2x envoy_quic_...[NUL]1.28.7[NUL]
|
||||
m.FileContentsVersionMatcher(`(?s)envoy_quic_.{0,1000}\x00(?P<version>1\.2[0-9]\.[0-9]+(-dev)?)\x00`),
|
||||
// 1.2x [NUL]1.20.7[NUL]Unable to
|
||||
|
||||
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
+85
@@ -1203,6 +1203,22 @@ from-images:
|
||||
paths:
|
||||
- /usr/local/bin/pilot-discovery
|
||||
|
||||
- name: istio_pilot-discovery
|
||||
version: 1.19.0-rc.0
|
||||
images:
|
||||
- ref: istio/pilot:1.19.0-rc.0@sha256:09c3c80be369a9724f11e1edfc60cc0b4d58612a6a99ac7314f620254986b159
|
||||
platform: linux/amd64
|
||||
paths:
|
||||
- /usr/local/bin/pilot-discovery
|
||||
|
||||
- name: istio_pilot-discovery
|
||||
version: 1.15.0-beta.0
|
||||
images:
|
||||
- ref: istio/pilot:1.15.0-beta.0@sha256:07a1fd1b14ce51c47f0051f597e9b581020a2e5cc53d144592e85f3fa07bbef6
|
||||
platform: linux/amd64
|
||||
paths:
|
||||
- /usr/local/bin/pilot-discovery
|
||||
|
||||
- name: istio_pilot-discovery
|
||||
version: 1.10-dev
|
||||
images:
|
||||
@@ -1219,6 +1235,14 @@ from-images:
|
||||
paths:
|
||||
- /usr/local/bin/pilot-discovery
|
||||
|
||||
- name: istio_pilot-discovery
|
||||
version: 1.5.0-alpha.0
|
||||
images:
|
||||
- ref: istio/pilot:1.5.0-alpha.0@sha256:b372bcbacd5af241afe097bd017e16773514b6ba17152ca02b7d5285e290b110
|
||||
platform: linux/amd64
|
||||
paths:
|
||||
- /usr/local/bin/pilot-discovery
|
||||
|
||||
- name: istio_pilot-discovery
|
||||
version: 1.3.8
|
||||
images:
|
||||
@@ -1235,6 +1259,14 @@ from-images:
|
||||
paths:
|
||||
- /usr/local/bin/pilot-discovery
|
||||
|
||||
- name: istio_pilot-discovery
|
||||
version: 1.0.0-snapshot.0
|
||||
images:
|
||||
- ref: istio/pilot:1.0.0-snapshot.0@sha256:3b32619b36014eeafaad8199d8af48f7725e9e75a01c0b1abfba1d7166e53b66
|
||||
platform: linux/amd64
|
||||
paths:
|
||||
- /usr/local/bin/pilot-discovery
|
||||
|
||||
- name: istio_pilot-agent
|
||||
version: 1.29.0-alpha.0
|
||||
images:
|
||||
@@ -1267,6 +1299,22 @@ from-images:
|
||||
paths:
|
||||
- /usr/local/bin/pilot-agent
|
||||
|
||||
- name: istio_pilot-agent
|
||||
version: 1.19.0-rc.0
|
||||
images:
|
||||
- ref: istio/proxyv2:1.19.0-rc.0@sha256:8c23abb1663e83ec19cac1e3de46c3cf7e942329936463646ca7a8d8088806b4
|
||||
platform: linux/amd64
|
||||
paths:
|
||||
- /usr/local/bin/pilot-agent
|
||||
|
||||
- name: istio_pilot-agent
|
||||
version: 1.15.0-beta.0
|
||||
images:
|
||||
- ref: istio/proxyv2:1.15.0-beta.0@sha256:9f54e6fa64c6ef6bb8b3e72e513c4f0415f1576ae755b4fe9a5be8c8b38694de
|
||||
platform: linux/amd64
|
||||
paths:
|
||||
- /usr/local/bin/pilot-agent
|
||||
|
||||
- name: istio_pilot-agent
|
||||
version: 1.10-dev
|
||||
images:
|
||||
@@ -1283,6 +1331,14 @@ from-images:
|
||||
paths:
|
||||
- /usr/local/bin/pilot-agent
|
||||
|
||||
- name: istio_pilot-agent
|
||||
version: 1.5.0-alpha.0
|
||||
images:
|
||||
- ref: istio/proxyv2:1.5.0-alpha.0@sha256:6d31b7e373622b2d483124bdc46974ff7b39c9b3fff8a9dc73a47d91344a24f6
|
||||
platform: linux/amd64
|
||||
paths:
|
||||
- /usr/local/bin/pilot-agent
|
||||
|
||||
- name: istio_pilot-agent
|
||||
version: 1.1.17
|
||||
images:
|
||||
@@ -1291,6 +1347,14 @@ from-images:
|
||||
paths:
|
||||
- /usr/local/bin/pilot-agent
|
||||
|
||||
- name: istio_pilot-agent
|
||||
version: 1.0.0-snapshot.0
|
||||
images:
|
||||
- ref: istio/proxyv2:1.0.0-snapshot.0@sha256:13c352cd8b82c326d6e36a8d0a1eed9debe6b1816e30cfe79970d316c9e59714
|
||||
platform: linux/amd64
|
||||
paths:
|
||||
- /usr/local/bin/pilot-agent
|
||||
|
||||
- name: grafana
|
||||
version: 12.3.1
|
||||
images:
|
||||
@@ -1515,6 +1579,27 @@ from-images:
|
||||
paths:
|
||||
- /usr/lib/x86_64-linux-gnu/libkrb5.so.26.0.0
|
||||
|
||||
- version: 1.40.1
|
||||
images:
|
||||
- ref: envoyproxy/envoy:v1.40.1@sha256:713bb146f1a7c97ebc70e13d259f77ff36f2c5d00f3145677816af5af9bd1530
|
||||
platform: linux/amd64
|
||||
paths:
|
||||
- /usr/local/bin/envoy
|
||||
|
||||
- version: 1.40.0
|
||||
images:
|
||||
- ref: envoyproxy/envoy:v1.40.0@sha256:459f2a6404c340fe6afccd69d85527012d47f3c036765493e6f8f3113fa384de
|
||||
platform: linux/amd64
|
||||
paths:
|
||||
- /usr/local/bin/envoy
|
||||
|
||||
- version: 1.37.1
|
||||
images:
|
||||
- ref: envoyproxy/envoy:v1.37.1@sha256:29496a88fba9c4c9cdef4afe8fec70f536c5ba111b1c2bddbc5436b091ceca33
|
||||
platform: linux/amd64
|
||||
paths:
|
||||
- /usr/local/bin/envoy
|
||||
|
||||
- version: 1.36.4
|
||||
images:
|
||||
- ref: envoyproxy/envoy:v1.36.4@sha256:ae31562b8cede20913a2d3d6a4f44c8479a50551e033cb8ef7bb8e38cec4b573
|
||||
|
||||
@@ -10,6 +10,7 @@ import (
|
||||
|
||||
"github.com/anchore/syft/internal/log"
|
||||
"github.com/anchore/syft/syft/artifact"
|
||||
"github.com/anchore/syft/syft/cpe"
|
||||
"github.com/anchore/syft/syft/file"
|
||||
"github.com/anchore/syft/syft/format"
|
||||
"github.com/anchore/syft/syft/pkg"
|
||||
@@ -57,6 +58,7 @@ func parseSBOM(_ context.Context, resolver file.Resolver, _ *generic.Environment
|
||||
|
||||
p.FoundBy = catalogerName
|
||||
p.Type = pkg.BitnamiPkg
|
||||
setApplicationPart(p.CPEs)
|
||||
// replace all locations on the package with the location of the SBOM file.
|
||||
// Why not keep the original list of locations? Since the "locations" field is meant to capture
|
||||
// where there is evidence of this file, and the catalogers have not run against any file other than,
|
||||
@@ -178,3 +180,13 @@ func findMainPkgID(relationships []artifact.Relationship) artifact.ID {
|
||||
|
||||
return ""
|
||||
}
|
||||
|
||||
// setApplicationPart marks CPEs with an unspecified part as applications, since Bitnami SBOMs
|
||||
// describe application packages but leave the CPE part as a wildcard.
|
||||
func setApplicationPart(cpes []cpe.CPE) {
|
||||
for i := range cpes {
|
||||
if cpes[i].Attributes.Part == cpe.Any {
|
||||
cpes[i].Attributes.Part = "a"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -37,7 +37,7 @@ func TestBitnamiCataloger(t *testing.T) {
|
||||
FoundBy: catalogerName,
|
||||
PURL: "pkg:bitnami/postgresql@17.2.0-8?arch=arm64&distro=debian-12",
|
||||
CPEs: mustCPEs(
|
||||
"cpe:2.3:*:postgresql:postgresql:17.2.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:postgresql:postgresql:17.2.0:*:*:*:*:*:*:*",
|
||||
),
|
||||
Metadata: &pkg.BitnamiSBOMEntry{
|
||||
Name: "postgresql",
|
||||
@@ -64,7 +64,7 @@ func TestBitnamiCataloger(t *testing.T) {
|
||||
FoundBy: catalogerName,
|
||||
PURL: "pkg:bitnami/geos@3.13.0?arch=arm64&distro=debian-12",
|
||||
CPEs: mustCPEs(
|
||||
"cpe:2.3:*:libgeos:geos:3.13.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:libgeos:geos:3.13.0:*:*:*:*:*:*:*",
|
||||
),
|
||||
Metadata: &pkg.BitnamiSBOMEntry{
|
||||
Name: "geos",
|
||||
@@ -86,7 +86,7 @@ func TestBitnamiCataloger(t *testing.T) {
|
||||
FoundBy: catalogerName,
|
||||
PURL: "pkg:bitnami/proj@6.3.2?arch=arm64&distro=debian-12",
|
||||
CPEs: mustCPEs(
|
||||
"cpe:2.3:*:proj:proj:6.3.2:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:proj:proj:6.3.2:*:*:*:*:*:*:*",
|
||||
),
|
||||
Metadata: &pkg.BitnamiSBOMEntry{
|
||||
Name: "proj",
|
||||
@@ -108,7 +108,7 @@ func TestBitnamiCataloger(t *testing.T) {
|
||||
FoundBy: catalogerName,
|
||||
PURL: "pkg:bitnami/gdal@3.10.1?arch=arm64&distro=debian-12",
|
||||
CPEs: mustCPEs(
|
||||
"cpe:2.3:*:osgeo:gdal:3.10.1:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:osgeo:gdal:3.10.1:*:*:*:*:*:*:*",
|
||||
),
|
||||
Metadata: &pkg.BitnamiSBOMEntry{
|
||||
Name: "gdal",
|
||||
@@ -130,7 +130,7 @@ func TestBitnamiCataloger(t *testing.T) {
|
||||
FoundBy: catalogerName,
|
||||
PURL: "pkg:bitnami/json-c@0.16.20220414?arch=arm64&distro=debian-12",
|
||||
CPEs: mustCPEs(
|
||||
"cpe:2.3:*:json-c_project:json-c:0.16.20220414:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:json-c_project:json-c:0.16.20220414:*:*:*:*:*:*:*",
|
||||
),
|
||||
Metadata: &pkg.BitnamiSBOMEntry{
|
||||
Name: "json-c",
|
||||
@@ -152,7 +152,7 @@ func TestBitnamiCataloger(t *testing.T) {
|
||||
FoundBy: catalogerName,
|
||||
PURL: "pkg:bitnami/orafce@4.14.1?arch=arm64&distro=debian-12",
|
||||
CPEs: mustCPEs(
|
||||
"cpe:2.3:*:orafce:orafce:4.14.1:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:orafce:orafce:4.14.1:*:*:*:*:*:*:*",
|
||||
),
|
||||
Metadata: &pkg.BitnamiSBOMEntry{
|
||||
Name: "orafce",
|
||||
@@ -174,7 +174,7 @@ func TestBitnamiCataloger(t *testing.T) {
|
||||
FoundBy: catalogerName,
|
||||
PURL: "pkg:bitnami/pljava@1.6.8?arch=arm64&distro=debian-12",
|
||||
CPEs: mustCPEs(
|
||||
"cpe:2.3:*:pl/java_project:pl/java:1.6.8:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:pl/java_project:pl/java:1.6.8:*:*:*:*:*:*:*",
|
||||
),
|
||||
Metadata: &pkg.BitnamiSBOMEntry{
|
||||
Name: "pljava",
|
||||
@@ -201,7 +201,7 @@ func TestBitnamiCataloger(t *testing.T) {
|
||||
FoundBy: catalogerName,
|
||||
PURL: "pkg:bitnami/unixodbc@2.3.12?arch=arm64&distro=debian-12",
|
||||
CPEs: mustCPEs(
|
||||
"cpe:2.3:*:unixodbc:unixodbc:2.3.12:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:unixodbc:unixodbc:2.3.12:*:*:*:*:*:*:*",
|
||||
),
|
||||
Metadata: &pkg.BitnamiSBOMEntry{
|
||||
Name: "unixodbc",
|
||||
@@ -223,7 +223,7 @@ func TestBitnamiCataloger(t *testing.T) {
|
||||
FoundBy: catalogerName,
|
||||
PURL: "pkg:bitnami/psqlodbc@16.0.0?arch=arm64&distro=debian-12",
|
||||
CPEs: mustCPEs(
|
||||
"cpe:2.3:*:postgresql:psqlodbc:16.0.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:postgresql:psqlodbc:16.0.0:*:*:*:*:*:*:*",
|
||||
),
|
||||
Metadata: &pkg.BitnamiSBOMEntry{
|
||||
Name: "psqlodbc",
|
||||
@@ -245,7 +245,7 @@ func TestBitnamiCataloger(t *testing.T) {
|
||||
FoundBy: catalogerName,
|
||||
PURL: "pkg:bitnami/protobuf@3.21.12?arch=arm64&distro=debian-12",
|
||||
CPEs: mustCPEs(
|
||||
"cpe:2.3:*:golang:protobuf:3.21.12:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:golang:protobuf:3.21.12:*:*:*:*:*:*:*",
|
||||
),
|
||||
Metadata: &pkg.BitnamiSBOMEntry{
|
||||
Name: "protobuf",
|
||||
@@ -267,7 +267,7 @@ func TestBitnamiCataloger(t *testing.T) {
|
||||
FoundBy: catalogerName,
|
||||
PURL: "pkg:bitnami/protobuf-c@1.5.1?arch=arm64&distro=debian-12",
|
||||
CPEs: mustCPEs(
|
||||
"cpe:2.3:*:protobuf-c:protobuf-c:1.5.1:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:protobuf-c:protobuf-c:1.5.1:*:*:*:*:*:*:*",
|
||||
),
|
||||
Metadata: &pkg.BitnamiSBOMEntry{
|
||||
Name: "protobuf-c",
|
||||
@@ -289,7 +289,7 @@ func TestBitnamiCataloger(t *testing.T) {
|
||||
FoundBy: catalogerName,
|
||||
PURL: "pkg:bitnami/postgis@3.4.4?arch=arm64&distro=debian-12",
|
||||
CPEs: mustCPEs(
|
||||
"cpe:2.3:*:postgis:postgis:3.4.4:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:postgis:postgis:3.4.4:*:*:*:*:*:*:*",
|
||||
),
|
||||
Metadata: &pkg.BitnamiSBOMEntry{
|
||||
Name: "postgis",
|
||||
@@ -330,7 +330,7 @@ func TestBitnamiCataloger(t *testing.T) {
|
||||
FoundBy: catalogerName,
|
||||
PURL: "pkg:bitnami/pgbackrest@2.54.2?arch=arm64&distro=debian-12",
|
||||
CPEs: mustCPEs(
|
||||
"cpe:2.3:*:pgbackrest:pgbackrest:2.54.2:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:pgbackrest:pgbackrest:2.54.2:*:*:*:*:*:*:*",
|
||||
),
|
||||
Metadata: &pkg.BitnamiSBOMEntry{
|
||||
Name: "pgbackrest",
|
||||
@@ -352,7 +352,7 @@ func TestBitnamiCataloger(t *testing.T) {
|
||||
FoundBy: catalogerName,
|
||||
PURL: "pkg:bitnami/wal2json@2.6.0?arch=arm64&distro=debian-12",
|
||||
CPEs: mustCPEs(
|
||||
"cpe:2.3:*:wal2json:wal2json:2.6.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:wal2json:wal2json:2.6.0:*:*:*:*:*:*:*",
|
||||
),
|
||||
Metadata: &pkg.BitnamiSBOMEntry{
|
||||
Name: "wal2json",
|
||||
@@ -374,7 +374,7 @@ func TestBitnamiCataloger(t *testing.T) {
|
||||
FoundBy: catalogerName,
|
||||
PURL: "pkg:bitnami/nss_wrapper@1.1.16?arch=arm64&distro=debian-12",
|
||||
CPEs: mustCPEs(
|
||||
"cpe:2.3:*:nss_wrapper:nss_wrapper:1.1.16:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:nss_wrapper:nss_wrapper:1.1.16:*:*:*:*:*:*:*",
|
||||
),
|
||||
Metadata: &pkg.BitnamiSBOMEntry{
|
||||
Name: "nss_wrapper",
|
||||
@@ -410,7 +410,7 @@ func TestBitnamiCataloger(t *testing.T) {
|
||||
FoundBy: catalogerName,
|
||||
PURL: "pkg:bitnami/render-template@1.0.7-4?arch=arm64&distro=debian-12",
|
||||
CPEs: mustCPEs(
|
||||
"cpe:2.3:*:render-template:render-template:1.0.7:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:render-template:render-template:1.0.7:*:*:*:*:*:*:*",
|
||||
),
|
||||
Metadata: &pkg.BitnamiSBOMEntry{
|
||||
Name: "render-template",
|
||||
@@ -435,7 +435,7 @@ func TestBitnamiCataloger(t *testing.T) {
|
||||
FoundBy: catalogerName,
|
||||
PURL: "pkg:bitnami/redis@7.4.0-0?arch=arm64&distro=debian-12",
|
||||
CPEs: mustCPEs(
|
||||
"cpe:2.3:*:redis:redis:7.4.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:redis:redis:7.4.0:*:*:*:*:*:*:*",
|
||||
),
|
||||
Metadata: &pkg.BitnamiSBOMEntry{
|
||||
Name: "redis",
|
||||
|
||||
@@ -137,9 +137,9 @@ func (c *goModCataloger) loadPackages(modDir string, loc file.Location) (pkgs ma
|
||||
for _, p := range rootPkgs {
|
||||
if len(p.Errors) > 0 {
|
||||
// Log errors but continue processing
|
||||
for _, e := range p.Errors {
|
||||
log.Debugf("package load error for %s: %v", p.PkgPath, e)
|
||||
unknownErr = unknown.Append(unknownErr, loc, err)
|
||||
for _, pe := range p.Errors {
|
||||
log.Debugf("package load error for %s: %v", p.PkgPath, pe)
|
||||
unknownErr = unknown.Append(unknownErr, loc, pe)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -2434,7 +2434,8 @@
|
||||
"cpe:2.3:a:linuxfoundation:backstage\\/integration:*:*:*:*:*:node.js:*:*"
|
||||
],
|
||||
"@backstage/plugin-auth-backend": [
|
||||
"cpe:2.3:a:linuxfoundation:auth_backend:*:*:*:*:*:node.js:*:*"
|
||||
"cpe:2.3:a:linuxfoundation:auth_backend:*:*:*:*:*:node.js:*:*",
|
||||
"cpe:2.3:a:linuxfoundation:backstage\\/plugin-auth-backend:*:*:*:*:*:node.js:*:*"
|
||||
],
|
||||
"@backstage/plugin-catalog-backend": [
|
||||
"cpe:2.3:a:linuxfoundation:backstage\\/plugin-catalog-backend-module-unprocessed:*:*:*:*:*:node.js:*:*"
|
||||
@@ -6578,9 +6579,15 @@
|
||||
"Pillow": [
|
||||
"cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*"
|
||||
],
|
||||
"PraisonAI": [
|
||||
"cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:*"
|
||||
],
|
||||
"PyAMF": [
|
||||
"cpe:2.3:a:pyamf:pyamf:*:*:*:*:*:*:*:*"
|
||||
],
|
||||
"PyJWT": [
|
||||
"cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:*"
|
||||
],
|
||||
"PyPDF2": [
|
||||
"cpe:2.3:a:pypdf2_project:pypdf2:*:*:*:*:*:*:*:*"
|
||||
],
|
||||
@@ -7880,6 +7887,9 @@
|
||||
"anchor-lang": [
|
||||
"cpe:2.3:a:anchor-lang:anchor:*:*:*:*:*:rust:*:*"
|
||||
],
|
||||
"anode": [
|
||||
"cpe:2.3:a:obsidiandynamics:anode:*:*:*:*:*:rust:*:*"
|
||||
],
|
||||
"anymap": [
|
||||
"cpe:2.3:a:anymap_project:anymap:*:*:*:*:*:rust:*:*"
|
||||
],
|
||||
@@ -8003,6 +8013,9 @@
|
||||
"capnp": [
|
||||
"cpe:2.3:a:capnproto:capnp:*:*:*:*:*:rust:*:*"
|
||||
],
|
||||
"cargo": [
|
||||
"cpe:2.3:a:rust-lang:cargo:*:*:*:*:*:rust:*:*"
|
||||
],
|
||||
"cbox": [
|
||||
"cpe:2.3:a:cbox_project:cbox:*:*:*:*:*:rust:*:*"
|
||||
],
|
||||
@@ -10570,6 +10583,9 @@
|
||||
"captcha": [
|
||||
"cpe:2.3:a:bestwebsoft:captcha:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"captcha-bank": [
|
||||
"cpe:2.3:a:tech-banker:captcha_bank:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"captchinoo-captcha-for-login-form-protection": [
|
||||
"cpe:2.3:a:wp-buy:captchinoo:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
@@ -18654,6 +18670,9 @@
|
||||
"sharable-password-protected-posts": [
|
||||
"cpe:2.3:a:fabiantodt:private_post_share:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"share-button": [
|
||||
"cpe:2.3:a:maxfoundry:social_share_buttons:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"share-buttons": [
|
||||
"cpe:2.3:a:artlosk:share_buttons:*:*:*:*:*:wordpress:*:*",
|
||||
"cpe:2.3:a:artlosk:social_share_buttons:*:*:*:*:*:wordpress:*:*"
|
||||
|
||||
@@ -35,6 +35,11 @@ func parseGradleLockfile(_ context.Context, _ file.Resolver, _ *generic.Environm
|
||||
// Trim leading and trailing whitespace from the line
|
||||
line = strings.TrimSpace(line)
|
||||
|
||||
// skip comment lines (e.g. the header gradle writes), which may contain ':' and '=' characters
|
||||
if strings.HasPrefix(line, "#") {
|
||||
continue
|
||||
}
|
||||
|
||||
groupNameVersion := line
|
||||
groupNameVersion = strings.Split(groupNameVersion, "=")[0]
|
||||
parts := strings.Split(groupNameVersion, ":")
|
||||
|
||||
@@ -87,3 +87,19 @@ func Test_parserGradleLockfile_lineTooLong(t *testing.T) {
|
||||
require.Len(t, pkgs, 1)
|
||||
assert.Equal(t, "before", pkgs[0].Name)
|
||||
}
|
||||
|
||||
func Test_parserGradleLockfile_skipsComments(t *testing.T) {
|
||||
contents := `# This is a Gradle generated file for dependency locking.
|
||||
# To regenerate this file, run: ./gradlew :dependencies --write-locks
|
||||
# indented: comment=too
|
||||
com.squareup.okhttp3:okhttp:4.12.0=compileClasspath,runtimeClasspath
|
||||
empty=annotationProcessor
|
||||
`
|
||||
reader := file.NewLocationReadCloser(file.NewLocation("gradle.lockfile"), io.NopCloser(strings.NewReader(contents)))
|
||||
|
||||
pkgs, _, err := parseGradleLockfile(context.Background(), nil, nil, reader)
|
||||
require.NoError(t, err)
|
||||
require.Len(t, pkgs, 1)
|
||||
assert.Equal(t, "okhttp", pkgs[0].Name)
|
||||
assert.Equal(t, "4.12.0", pkgs[0].Version)
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user