mirror of
https://github.com/anchore/syft.git
synced 2026-10-11 21:57:22 +02:00
Silas ParkerandAlex Goodman
546c872c9d
* Add support for scanning IPK packages using the deb-archive-cataloger Signed-off-by: Silas Parker <silas@srp.me.uk> * fix(debian): share License field parsing between opkg status and archive control files - the control-file `License:` fallback now goes through the same helper as the opkg status DB path, so a package reports the same licenses whether found installed or as an archive - bitbake `&` / `|` are rewritten to SPDX `AND` / `OR` and the whole value is validated as one expression instead of split by hand, which kept grouping like `(A & B) | C` intact - non-SPDX values fall back to a deduped list of names with operators and parens dropped (previously the status DB path emitted `&`, `(BSD`, etc as licenses) - fields over 4KB are ignored, bounding work per archive and keeping deep paren nesting away from the recursive expression parser Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix(debian): split Yocto recipe filenames in the Source field Yocto writes the bitbake recipe filename (`Source: zlib_1.3.2.bb`) where dpkg expects a source package name. This is now split into `Source: zlib` / `SourceVersion: 1.3.2` for both ipk archives and opkg status DB entries, instead of surfacing the `.bb` filename as the upstream package. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix(debian): do not label ipk archives as Debian packages - `.ipk` archives no longer get a `pkg:deb` PURL from the assumed debian distro; opkg-based distros (Yocto, OpenWrt) have no purl type, so these now match packages found in an opkg status DB, which already get no PURL - docs now cover `.ipk` and note that only ar-framed ipks are supported (OpenWrt's older gzipped-tar framing is rejected as an invalid archive) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * test(debian): assemble the ipk fixture at build time instead of committing it The fixture Dockerfile now builds a Yocto-shaped `.ipk` from a checked-in `control/` directory (copied from the original poky-tiny build) using `tar`, `zstd` and binutils `ar`, the same way bitbake's `package_ipk` packs one. This drops the prebuilt binary and the 20-30 minute Yocto `Dockerfile.build` while keeping the same archive layout and control metadata. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Silas Parker <silas@srp.me.uk> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>