mirror of
https://github.com/anchore/syft.git
synced 2026-10-11 21:57:22 +02:00
f7f3c6efc3
* fix(ai): use go.yaml.in/yaml/v3 to parse model card frontmatter gopkg.in/yaml.v3 panics on some malformed merge-key payloads (for example "<<:\r? 0:"), which crashed the gguf and safetensors catalogers when a model README contained such frontmatter. Switch the Hugging Face frontmatter parser to the maintained go.yaml.in/yaml/v3 fork, which is already used by the other catalogers and returns an error instead of panicking. The existing error path logs and skips the frontmatter. Fixes #5327 Signed-off-by: tk1475 <118763009+tk1475@users.noreply.github.com> Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: finish moving off gopkg.in/yaml.v3 - move the snap catalogers and `internal/capabilities` to `go.yaml.in/yaml/v3`. The snap parsers decode yaml from scanned sources and hit the same merge-key panic as #5327 - enable `depguard` with a deny rule for `gopkg.in/yaml.v3` so it can't be reintroduced Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: tk1475 <118763009+tk1475@users.noreply.github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
130 lines
4.1 KiB
YAML
130 lines
4.1 KiB
YAML
version: "2"
|
|
run:
|
|
tests: false
|
|
linters:
|
|
default: none
|
|
enable:
|
|
- asciicheck
|
|
- bodyclose
|
|
- copyloopvar
|
|
- depguard
|
|
- dogsled
|
|
- dupl
|
|
- errcheck
|
|
- funlen
|
|
- gocognit
|
|
- goconst
|
|
- gocritic
|
|
- gocyclo
|
|
- goprintffuncname
|
|
- gosec
|
|
- govet
|
|
- ineffassign
|
|
- misspell
|
|
- nakedret
|
|
- nolintlint
|
|
- revive
|
|
- staticcheck
|
|
- unconvert
|
|
- unparam
|
|
- unused
|
|
- whitespace
|
|
settings:
|
|
depguard:
|
|
rules:
|
|
yaml:
|
|
deny:
|
|
# gopkg.in/yaml.v3 is unmaintained and panics on some malformed input (see #5327)
|
|
- pkg: gopkg.in/yaml.v3
|
|
desc: use go.yaml.in/yaml/v3 instead
|
|
funlen:
|
|
lines: 70
|
|
statements: 50
|
|
goconst:
|
|
# the default of 3 turns every repeated literal in a lookup table or a test fixture into a finding.
|
|
# 5 keeps the ones worth hoisting without flagging data that reads better written out.
|
|
min-occurrences: 5
|
|
gocritic:
|
|
enabled-checks:
|
|
- deferInLoop
|
|
- ruleguard
|
|
settings:
|
|
ruleguard:
|
|
rules: test/rules/rules.go
|
|
gosec:
|
|
excludes:
|
|
- G115
|
|
exclusions:
|
|
generated: lax
|
|
presets:
|
|
- comments
|
|
- common-false-positives
|
|
- legacy
|
|
- std-error-handling
|
|
rules:
|
|
# we have multiple packages in syft that might overlap with the stblib; their names reflect their purpose
|
|
- linters:
|
|
- revive
|
|
text: "var-naming: avoid package names that conflict"
|
|
# cpegenerate is almost entirely lookup tables mapping artifact names to vendors, products, and
|
|
# maven group ids. The repeated strings are the data itself, so hoisting them to constants would
|
|
# replace a readable table with indirection for no gain.
|
|
- linters:
|
|
- goconst
|
|
path: syft/pkg/cataloger/internal/cpegenerate/
|
|
paths:
|
|
- third_party$
|
|
- builtin$
|
|
- examples$
|
|
|
|
# do not enable...
|
|
# - deadcode # The owner seems to have abandoned the linter. Replaced by "unused".
|
|
# - goprintffuncname # does not catch all cases and there are exceptions
|
|
# - nakedret # does not catch all cases and should not fail a build
|
|
# - gochecknoglobals
|
|
# - gochecknoinits # this is too aggressive
|
|
# - rowserrcheck disabled per generics https://github.com/golangci/golangci-lint/issues/2649
|
|
# - godot
|
|
# - godox
|
|
# - goerr113
|
|
# - golint # deprecated
|
|
# - gomnd # this is too aggressive
|
|
# - interfacer # this is a good idea, but is no longer supported and is prone to false positives
|
|
# - lll # without a way to specify per-line exception cases, this is not usable
|
|
# - maligned # this is an excellent linter, but tricky to optimize and we are not sensitive to memory layout optimizations
|
|
# - nestif
|
|
# - prealloc # following this rule isn't consistently a good idea, as it sometimes forces unnecessary allocations that result in less idiomatic code
|
|
# - rowserrcheck # not in a repo with sql, so this is not useful
|
|
# - scopelint # deprecated
|
|
# - structcheck # The owner seems to have abandoned the linter. Replaced by "unused".
|
|
# - testpackage
|
|
# - varcheck # The owner seems to have abandoned the linter. Replaced by "unused".
|
|
# - wsl # this doens't have an auto-fixer yet and is pretty noisy (https://github.com/bombsimon/wsl/issues/90)
|
|
|
|
issues:
|
|
max-same-issues: 25
|
|
uniq-by-line: false
|
|
|
|
# TODO: enable this when we have coverage on docstring comments
|
|
# # The list of ids of default excludes to include or disable.
|
|
# include:
|
|
# - EXC0002 # disable excluding of issues about comments from golint
|
|
|
|
formatters:
|
|
enable:
|
|
- gci
|
|
- gofmt
|
|
exclusions:
|
|
generated: lax
|
|
paths:
|
|
- third_party$
|
|
- builtin$
|
|
- examples$
|
|
settings:
|
|
gci:
|
|
# See https://golangci-lint.run/docs/formatters/configuration/#gci
|
|
sections:
|
|
- standard # Standard section: captures all standard packages.
|
|
- default # Default section: contains all imports that could not be matched to another section type.
|
|
- prefix(github.com/anchore)
|