mirror of
https://github.com/anchore/syft.git
synced 2026-11-01 23:16:30 +01:00
Jason PaulosandAlex Goodman
74073aa481
* Update steroscope to include OCI platform metadata Signed-off-by: Jason Paulos <jasonpaulos@users.noreply.github.com> * chore(deps): point stereoscope at anchore/main drops the fork `replace` directive and moves to a pseudo-version off stereoscope main (`a22e5ae`, anchore/stereoscope#657). no tag carries it yet, so this should move to a real version once one is cut. `readImageMetadata` now fills os/architecture/variant for every provider, not just oci. the docker tarball provider set neither before, so image metadata and the image purl change for docker-archive input too: - `"architecture": ""` -> `"amd64"` - `"os": ""` -> `"linux"` - `?arch=` -> `?arch=amd64` the empty `arch=` qualifier was never right, but it is user-visible output. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * test: cover single-platform oci layouts the pr only added assertions to the multiplatform fixture, which already reported the right platform. the behavior that actually changed is single-image layouts: they used to report empty os/arch and silently ignore `--platform`, and now report what the image config says and fail with a platform mismatch. also drops the non-linux skip on the default-platform test. the oci providers default to `linux/<GOARCH>` regardless of host os, so it holds on macos too. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Jason Paulos <jasonpaulos@users.noreply.github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
248 lines
6.3 KiB
Plaintext
248 lines
6.3 KiB
Plaintext
{
|
|
"spdxVersion": "SPDX-2.3",
|
|
"dataLicense": "CC0-1.0",
|
|
"SPDXID": "SPDXRef-DOCUMENT",
|
|
"name": "user-image-input",
|
|
"documentNamespace":"redacted",
|
|
"creationInfo": {
|
|
"licenseListVersion":"redacted",
|
|
"creators": [
|
|
"Organization: Anchore, Inc",
|
|
"Tool: syft-v0.42.0-bogus"
|
|
],
|
|
"created":"redacted"
|
|
},
|
|
"packages": [
|
|
{
|
|
"name": "package-1",
|
|
"SPDXID": "SPDXRef-Package-python-package-1-2f52f617f1548337",
|
|
"versionInfo": "1.0.1",
|
|
"supplier": "NOASSERTION",
|
|
"downloadLocation": "NOASSERTION",
|
|
"filesAnalyzed": false,
|
|
"sourceInfo": "acquired package info from installed python package manifest file: /somefile-1.txt",
|
|
"licenseConcluded": "NOASSERTION",
|
|
"licenseDeclared": "MIT",
|
|
"copyrightText": "NOASSERTION",
|
|
"externalRefs": [
|
|
{
|
|
"referenceCategory": "SECURITY",
|
|
"referenceType": "cpe23Type",
|
|
"referenceLocator": "cpe:2.3:*:some:package:1:*:*:*:*:*:*:*"
|
|
},
|
|
{
|
|
"referenceCategory": "PACKAGE-MANAGER",
|
|
"referenceType": "purl",
|
|
"referenceLocator": "a-purl-1"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"name": "package-2",
|
|
"SPDXID": "SPDXRef-Package-deb-package-2-4b756c6f6fb127a3",
|
|
"versionInfo": "2.0.1",
|
|
"supplier": "NOASSERTION",
|
|
"downloadLocation": "NOASSERTION",
|
|
"filesAnalyzed": false,
|
|
"sourceInfo": "acquired package info from DPKG DB: /somefile-2.txt",
|
|
"licenseConcluded": "NOASSERTION",
|
|
"licenseDeclared": "NOASSERTION",
|
|
"copyrightText": "NOASSERTION",
|
|
"externalRefs": [
|
|
{
|
|
"referenceCategory": "SECURITY",
|
|
"referenceType": "cpe23Type",
|
|
"referenceLocator": "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"
|
|
},
|
|
{
|
|
"referenceCategory": "PACKAGE-MANAGER",
|
|
"referenceType": "purl",
|
|
"referenceLocator": "pkg:deb/debian/package-2@2.0.1"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"name": "user-image-input",
|
|
"SPDXID": "SPDXRef-DocumentRoot-Image-user-image-input",
|
|
"versionInfo": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368",
|
|
"supplier": "NOASSERTION",
|
|
"downloadLocation": "NOASSERTION",
|
|
"filesAnalyzed": false,
|
|
"checksums": [
|
|
{
|
|
"algorithm": "SHA256",
|
|
"checksumValue": "2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368"
|
|
}
|
|
],
|
|
"licenseConcluded": "NOASSERTION",
|
|
"licenseDeclared": "NOASSERTION",
|
|
"copyrightText": "NOASSERTION",
|
|
"externalRefs": [
|
|
{
|
|
"referenceCategory": "PACKAGE-MANAGER",
|
|
"referenceType": "purl",
|
|
"referenceLocator": "pkg:oci/user-image-input@sha256%3A2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368?arch=amd64"
|
|
}
|
|
],
|
|
"primaryPackagePurpose": "CONTAINER"
|
|
}
|
|
],
|
|
"files": [
|
|
{
|
|
"fileName": "a1/f6",
|
|
"SPDXID": "SPDXRef-File-a1-f6-9c2f7510199b17f6",
|
|
"fileTypes": [
|
|
"OTHER"
|
|
],
|
|
"checksums": [
|
|
{
|
|
"algorithm": "SHA1",
|
|
"checksumValue": "0000000000000000000000000000000000000000"
|
|
}
|
|
],
|
|
"licenseConcluded": "NOASSERTION",
|
|
"licenseInfoInFiles": [
|
|
"NOASSERTION"
|
|
],
|
|
"copyrightText": "NOASSERTION"
|
|
},
|
|
{
|
|
"fileName": "d1/f3",
|
|
"SPDXID": "SPDXRef-File-d1-f3-c6f5b29dca12661f",
|
|
"fileTypes": [
|
|
"OTHER"
|
|
],
|
|
"checksums": [
|
|
{
|
|
"algorithm": "SHA1",
|
|
"checksumValue": "0000000000000000000000000000000000000000"
|
|
}
|
|
],
|
|
"licenseConcluded": "NOASSERTION",
|
|
"licenseInfoInFiles": [
|
|
"NOASSERTION"
|
|
],
|
|
"copyrightText": "NOASSERTION"
|
|
},
|
|
{
|
|
"fileName": "d2/f4",
|
|
"SPDXID": "SPDXRef-File-d2-f4-c641caa71518099f",
|
|
"fileTypes": [
|
|
"OTHER"
|
|
],
|
|
"checksums": [
|
|
{
|
|
"algorithm": "SHA1",
|
|
"checksumValue": "0000000000000000000000000000000000000000"
|
|
}
|
|
],
|
|
"licenseConcluded": "NOASSERTION",
|
|
"licenseInfoInFiles": [
|
|
"NOASSERTION"
|
|
],
|
|
"copyrightText": "NOASSERTION"
|
|
},
|
|
{
|
|
"fileName": "f1",
|
|
"SPDXID": "SPDXRef-File-f1-5265a4dde3edbf7c",
|
|
"fileTypes": [
|
|
"OTHER"
|
|
],
|
|
"checksums": [
|
|
{
|
|
"algorithm": "SHA1",
|
|
"checksumValue": "0000000000000000000000000000000000000000"
|
|
}
|
|
],
|
|
"licenseConcluded": "NOASSERTION",
|
|
"licenseInfoInFiles": [
|
|
"NOASSERTION"
|
|
],
|
|
"copyrightText": "NOASSERTION"
|
|
},
|
|
{
|
|
"fileName": "f2",
|
|
"SPDXID": "SPDXRef-File-f2-f9e49132a4b96ccd",
|
|
"fileTypes": [
|
|
"OTHER"
|
|
],
|
|
"checksums": [
|
|
{
|
|
"algorithm": "SHA1",
|
|
"checksumValue": "0000000000000000000000000000000000000000"
|
|
}
|
|
],
|
|
"licenseConcluded": "NOASSERTION",
|
|
"licenseInfoInFiles": [
|
|
"NOASSERTION"
|
|
],
|
|
"copyrightText": "NOASSERTION"
|
|
},
|
|
{
|
|
"fileName": "z1/f5",
|
|
"SPDXID": "SPDXRef-File-z1-f5-839d99ee67d9d174",
|
|
"fileTypes": [
|
|
"OTHER"
|
|
],
|
|
"checksums": [
|
|
{
|
|
"algorithm": "SHA1",
|
|
"checksumValue": "0000000000000000000000000000000000000000"
|
|
}
|
|
],
|
|
"licenseConcluded": "NOASSERTION",
|
|
"licenseInfoInFiles": [
|
|
"NOASSERTION"
|
|
],
|
|
"copyrightText": "NOASSERTION"
|
|
}
|
|
],
|
|
"relationships": [
|
|
{
|
|
"spdxElementId": "SPDXRef-Package-python-package-1-2f52f617f1548337",
|
|
"relatedSpdxElement": "SPDXRef-File-f1-5265a4dde3edbf7c",
|
|
"relationshipType": "CONTAINS"
|
|
},
|
|
{
|
|
"spdxElementId": "SPDXRef-Package-python-package-1-2f52f617f1548337",
|
|
"relatedSpdxElement": "SPDXRef-File-z1-f5-839d99ee67d9d174",
|
|
"relationshipType": "CONTAINS"
|
|
},
|
|
{
|
|
"spdxElementId": "SPDXRef-Package-python-package-1-2f52f617f1548337",
|
|
"relatedSpdxElement": "SPDXRef-File-a1-f6-9c2f7510199b17f6",
|
|
"relationshipType": "CONTAINS"
|
|
},
|
|
{
|
|
"spdxElementId": "SPDXRef-Package-python-package-1-2f52f617f1548337",
|
|
"relatedSpdxElement": "SPDXRef-File-d2-f4-c641caa71518099f",
|
|
"relationshipType": "CONTAINS"
|
|
},
|
|
{
|
|
"spdxElementId": "SPDXRef-Package-python-package-1-2f52f617f1548337",
|
|
"relatedSpdxElement": "SPDXRef-File-d1-f3-c6f5b29dca12661f",
|
|
"relationshipType": "CONTAINS"
|
|
},
|
|
{
|
|
"spdxElementId": "SPDXRef-Package-python-package-1-2f52f617f1548337",
|
|
"relatedSpdxElement": "SPDXRef-File-f2-f9e49132a4b96ccd",
|
|
"relationshipType": "CONTAINS"
|
|
},
|
|
{
|
|
"spdxElementId": "SPDXRef-DocumentRoot-Image-user-image-input",
|
|
"relatedSpdxElement": "SPDXRef-Package-python-package-1-2f52f617f1548337",
|
|
"relationshipType": "CONTAINS"
|
|
},
|
|
{
|
|
"spdxElementId": "SPDXRef-DocumentRoot-Image-user-image-input",
|
|
"relatedSpdxElement": "SPDXRef-Package-deb-package-2-4b756c6f6fb127a3",
|
|
"relationshipType": "CONTAINS"
|
|
},
|
|
{
|
|
"spdxElementId": "SPDXRef-DOCUMENT",
|
|
"relatedSpdxElement": "SPDXRef-DocumentRoot-Image-user-image-input",
|
|
"relationshipType": "DESCRIBES"
|
|
}
|
|
]
|
|
}
|