mirror of
https://github.com/anchore/syft.git
synced 2025-11-17 00:13:15 +01:00
bffe26bcc5
* prototype: start bitnami cataloger Bitnami images have spdx SBOMs at predictable paths, and Syft could more accurately identify the software in these images by scanning those SBOMs. Start work on this by forking the sbom-cataloger as a new bitnami-cataloger. Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * wire up bitnami cataloger to run on images by default Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * feat: add support for Bitnami cataloguer Signed-off-by: juan131 <jariza@vmware.com> * feat: use a better SPDX sample for unit tests Signed-off-by: juan131 <jariza@vmware.com> * bugfix: only report bitnami pkgs Signed-off-by: juan131 <jariza@vmware.com> * feat: adapt JSON schema, spdxutil and packagemetadata Signed-off-by: juan131 <jariza@vmware.com> * bugfix: integration tests Signed-off-by: juan131 <jariza@vmware.com> * feat: implement FileOwner interface Signed-off-by: juan131 <jariza@vmware.com> * bugfix: update json schema Signed-off-by: juan131 <jariza@vmware.com> * [wip] add bitnami owned files and fix binary package ownership filtering Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * feat: obtain bitnami pkg files based on SPDX relationships tree Signed-off-by: juan131 <jariza@vmware.com> * preserve type switches Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename bitnami entry metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * restrict find main pkg logic Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add missing graalvm source info Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bugfix: integration tests Signed-off-by: juan131 <jariza@vmware.com> * bugfix: mod tidy Signed-off-by: juan131 <jariza@vmware.com> --------- Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> Signed-off-by: juan131 <jariza@vmware.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
262 lines
12 KiB
Modula-2
262 lines
12 KiB
Modula-2
module github.com/anchore/syft
|
|
|
|
go 1.24.0
|
|
|
|
require (
|
|
github.com/CycloneDX/cyclonedx-go v0.9.2
|
|
github.com/Masterminds/semver v1.5.0
|
|
github.com/Masterminds/sprig/v3 v3.3.0
|
|
github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
|
|
github.com/acobaugh/osrelease v0.1.0
|
|
github.com/anchore/bubbly v0.0.0-20231115134915-def0aba654a9
|
|
github.com/anchore/clio v0.0.0-20241115144204-29e89f9fa837
|
|
github.com/anchore/fangs v0.0.0-20241014201141-b6e4b3469f10
|
|
github.com/anchore/go-collections v0.0.0-20240216171411-9321230ce537
|
|
github.com/anchore/go-logger v0.0.0-20230725134548-c21dafa1ec5a
|
|
github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb
|
|
github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
|
|
github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
|
|
github.com/anchore/packageurl-go v0.1.1-0.20250117185454-edf36a908b10
|
|
github.com/anchore/stereoscope v0.0.13
|
|
github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
|
|
// we are hinting brotli to latest due to warning when installing archiver v3:
|
|
// go: warning: github.com/andybalholm/brotli@v1.0.1: retracted by module author: occasional panics and data corruption
|
|
github.com/aquasecurity/go-pep440-version v0.0.1
|
|
github.com/bmatcuk/doublestar/v4 v4.8.1
|
|
github.com/charmbracelet/bubbles v0.20.0
|
|
github.com/charmbracelet/bubbletea v1.2.4
|
|
github.com/charmbracelet/lipgloss v1.0.0
|
|
github.com/dave/jennifer v1.7.1
|
|
github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da
|
|
github.com/distribution/reference v0.6.0
|
|
github.com/docker/docker v27.5.1+incompatible
|
|
github.com/dustin/go-humanize v1.0.1
|
|
github.com/elliotchance/phpserialize v1.4.0
|
|
github.com/facebookincubator/nvdtools v0.1.5
|
|
github.com/github/go-spdx/v2 v2.3.2
|
|
github.com/gkampitakis/go-snaps v0.5.10
|
|
github.com/go-git/go-billy/v5 v5.6.2
|
|
github.com/go-git/go-git/v5 v5.13.2
|
|
github.com/go-test/deep v1.1.1
|
|
github.com/google/go-cmp v0.6.0
|
|
github.com/google/go-containerregistry v0.20.3
|
|
github.com/google/licensecheck v0.3.1
|
|
github.com/google/uuid v1.6.0
|
|
github.com/gookit/color v1.5.4
|
|
github.com/hashicorp/go-multierror v1.1.1
|
|
github.com/iancoleman/strcase v0.3.0
|
|
github.com/invopop/jsonschema v0.7.0
|
|
github.com/jedib0t/go-pretty/v6 v6.6.6
|
|
github.com/jinzhu/copier v0.4.0
|
|
github.com/kastenhq/goversion v0.0.0-20230811215019-93b2f8823953
|
|
github.com/knqyf263/go-rpmdb v0.1.1
|
|
github.com/microsoft/go-rustaudit v0.0.0-20220730194248-4b17361d90a5
|
|
github.com/mitchellh/go-homedir v1.1.0
|
|
github.com/mitchellh/hashstructure/v2 v2.0.2
|
|
github.com/mitchellh/mapstructure v1.5.0
|
|
github.com/moby/sys/mountinfo v0.7.2
|
|
github.com/olekukonko/tablewriter v0.0.5
|
|
github.com/opencontainers/go-digest v1.0.0
|
|
github.com/pelletier/go-toml v1.9.5
|
|
github.com/quasilyte/go-ruleguard/dsl v0.3.22
|
|
github.com/saferwall/pe v1.5.6
|
|
github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d
|
|
github.com/sanity-io/litter v1.5.6
|
|
github.com/sassoftware/go-rpmutils v0.4.0
|
|
// pinned to pull in 386 arch fix: https://github.com/scylladb/go-set/commit/cc7b2070d91ebf40d233207b633e28f5bd8f03a5
|
|
github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e
|
|
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3
|
|
github.com/spdx/tools-golang v0.5.5
|
|
github.com/spf13/afero v1.12.0
|
|
github.com/spf13/cobra v1.8.1
|
|
github.com/stretchr/testify v1.10.0
|
|
github.com/vbatts/go-mtree v0.5.4
|
|
github.com/vifraa/gopom v1.0.0
|
|
github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651
|
|
github.com/wagoodman/go-progress v0.0.0-20230925121702-07e42b3cdba0
|
|
github.com/xeipuuv/gojsonschema v1.2.0
|
|
github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1
|
|
go.uber.org/goleak v1.3.0
|
|
golang.org/x/mod v0.23.0
|
|
golang.org/x/net v0.35.0
|
|
gopkg.in/yaml.v3 v3.0.1
|
|
modernc.org/sqlite v1.35.0
|
|
)
|
|
|
|
require google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 // indirect
|
|
|
|
require (
|
|
github.com/BurntSushi/toml v1.4.0
|
|
github.com/OneOfOne/xxhash v1.2.8
|
|
github.com/adrg/xdg v0.5.3
|
|
github.com/anchore/archiver/v3 v3.5.3-0.20241210171143-5b1d8d1c7c51
|
|
github.com/bitnami/go-version v0.0.0-20250131085805-b1f57a8634ef
|
|
github.com/hashicorp/hcl/v2 v2.23.0
|
|
github.com/magiconair/properties v1.8.9
|
|
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
|
|
)
|
|
|
|
require (
|
|
dario.cat/mergo v1.0.1 // indirect
|
|
github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
|
|
github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0 // indirect
|
|
github.com/DataDog/zstd v1.5.5 // indirect
|
|
github.com/Masterminds/goutils v1.1.1 // indirect
|
|
github.com/Masterminds/semver/v3 v3.3.0 // indirect
|
|
github.com/Microsoft/go-winio v0.6.2 // indirect
|
|
github.com/Microsoft/hcsshim v0.11.7 // indirect
|
|
github.com/ProtonMail/go-crypto v1.1.5 // indirect
|
|
github.com/agext/levenshtein v1.2.1 // indirect; indirectt
|
|
github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092 // indirect
|
|
github.com/andybalholm/brotli v1.1.1 // indirect
|
|
github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
|
|
github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
|
|
github.com/aquasecurity/go-version v0.0.1 // indirect
|
|
github.com/atotto/clipboard v0.1.4 // indirect
|
|
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
|
|
github.com/becheran/wildmatch-go v1.0.0 // indirect
|
|
github.com/charmbracelet/harmonica v0.2.0 // indirect
|
|
github.com/charmbracelet/x/ansi v0.4.5 // indirect
|
|
github.com/charmbracelet/x/term v0.2.1 // indirect
|
|
github.com/cloudflare/circl v1.3.8 // indirect
|
|
github.com/containerd/cgroups v1.1.0 // indirect
|
|
github.com/containerd/containerd v1.7.24 // indirect
|
|
github.com/containerd/containerd/api v1.7.19 // indirect
|
|
github.com/containerd/continuity v0.4.2 // indirect
|
|
github.com/containerd/errdefs v0.3.0 // indirect
|
|
github.com/containerd/fifo v1.1.0 // indirect
|
|
github.com/containerd/log v0.1.0 // indirect
|
|
github.com/containerd/platforms v0.2.1 // indirect
|
|
github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect
|
|
github.com/containerd/ttrpc v1.2.5 // indirect
|
|
github.com/containerd/typeurl/v2 v2.1.1 // indirect
|
|
github.com/cyphar/filepath-securejoin v0.3.6 // indirect
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
|
github.com/docker/cli v27.5.0+incompatible // indirect
|
|
github.com/docker/distribution v2.8.3+incompatible // indirect
|
|
github.com/docker/docker-credential-helpers v0.8.2 // indirect
|
|
github.com/docker/go-connections v0.5.0 // indirect
|
|
github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
|
|
github.com/docker/go-units v0.5.0 // indirect
|
|
github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 // indirect
|
|
github.com/edsrzf/mmap-go v1.1.0 // indirect
|
|
github.com/emirpasic/gods v1.18.1 // indirect
|
|
github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
|
|
github.com/felixge/fgprof v0.9.5 // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/fsnotify/fsnotify v1.7.0 // indirect
|
|
github.com/gabriel-vasile/mimetype v1.4.8 // indirect
|
|
github.com/gkampitakis/ciinfo v0.3.1 // indirect
|
|
github.com/gkampitakis/go-diff v1.3.2 // indirect
|
|
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
|
|
github.com/go-logr/logr v1.4.2 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/go-restruct/restruct v1.2.0-alpha // indirect
|
|
github.com/goccy/go-yaml v1.15.13 // indirect
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
|
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
|
|
github.com/golang/snappy v0.0.4 // indirect
|
|
github.com/google/pprof v0.0.0-20240409012703-83162a5b38cd // indirect
|
|
github.com/hashicorp/errwrap v1.1.0 // indirect
|
|
github.com/hashicorp/hcl v1.0.0 // indirect
|
|
github.com/huandu/xstrings v1.5.0 // indirect
|
|
github.com/iancoleman/orderedmap v0.0.0-20190318233801-ac98e3ecb4b0 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
|
|
github.com/kevinburke/ssh_config v1.2.0 // indirect
|
|
github.com/klauspost/compress v1.17.11 // indirect
|
|
github.com/klauspost/pgzip v1.2.6 // indirect
|
|
github.com/kr/pretty v0.3.1 // indirect
|
|
github.com/kr/text v0.2.0 // indirect
|
|
github.com/logrusorgru/aurora v2.0.3+incompatible // indirect
|
|
github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
|
|
github.com/maruel/natural v1.1.1 // indirect
|
|
github.com/mattn/go-colorable v0.1.13 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75 // indirect
|
|
github.com/mattn/go-runewidth v0.0.16 // indirect
|
|
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
|
|
github.com/mitchellh/copystructure v1.2.0 // indirect
|
|
github.com/mitchellh/go-wordwrap v0.0.0-20150314170334-ad45545899c7 // indirect
|
|
github.com/mitchellh/reflectwalk v1.0.2 // indirect
|
|
github.com/moby/docker-image-spec v1.3.1 // indirect
|
|
github.com/moby/locker v1.0.1 // indirect
|
|
github.com/moby/sys/sequential v0.5.0 // indirect
|
|
github.com/moby/sys/signal v0.7.0 // indirect
|
|
github.com/moby/sys/user v0.3.0 // indirect
|
|
github.com/moby/sys/userns v0.1.0 // indirect
|
|
github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
|
|
github.com/muesli/cancelreader v0.2.2 // indirect
|
|
github.com/muesli/termenv v0.15.2 // indirect
|
|
github.com/ncruces/go-strftime v0.1.9 // indirect
|
|
github.com/nwaples/rardecode v1.1.3 // indirect
|
|
github.com/opencontainers/image-spec v1.1.0 // indirect
|
|
github.com/opencontainers/runtime-spec v1.1.0 // indirect
|
|
github.com/opencontainers/selinux v1.11.0 // indirect
|
|
github.com/pborman/indent v1.2.1 // indirect
|
|
github.com/pelletier/go-toml/v2 v2.2.2 // indirect
|
|
github.com/pierrec/lz4/v4 v4.1.21 // indirect
|
|
github.com/pjbgf/sha1cd v0.3.2 // indirect
|
|
github.com/pkg/errors v0.9.1 // indirect
|
|
github.com/pkg/profile v1.7.0 // indirect
|
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
github.com/rivo/uniseg v0.4.7 // indirect
|
|
github.com/rogpeppe/go-internal v1.13.1 // indirect
|
|
github.com/sagikazarmark/locafero v0.4.0 // indirect
|
|
github.com/sagikazarmark/slog-shim v0.1.0 // indirect
|
|
github.com/sahilm/fuzzy v0.1.1 // indirect
|
|
github.com/secDre4mer/pkcs7 v0.0.0-20240322103146-665324a4461d // indirect
|
|
github.com/shopspring/decimal v1.4.0 // indirect
|
|
github.com/sirupsen/logrus v1.9.3 // indirect
|
|
github.com/skeema/knownhosts v1.3.0 // indirect
|
|
github.com/sourcegraph/conc v0.3.0 // indirect
|
|
github.com/spf13/cast v1.7.0 // indirect
|
|
github.com/spf13/pflag v1.0.5 // indirect
|
|
github.com/spf13/viper v1.19.0 // indirect
|
|
github.com/subosito/gotenv v1.6.0 // indirect
|
|
github.com/sylabs/sif/v2 v2.20.2 // indirect
|
|
github.com/sylabs/squashfs v1.0.4 // indirect
|
|
github.com/therootcompany/xz v1.0.1 // indirect
|
|
github.com/tidwall/gjson v1.18.0 // indirect
|
|
github.com/tidwall/match v1.1.1 // indirect
|
|
github.com/tidwall/pretty v1.2.1 // indirect
|
|
github.com/tidwall/sjson v1.2.5 // indirect
|
|
github.com/ulikunitz/xz v0.5.12 // indirect
|
|
github.com/vbatts/tar-split v0.11.6 // indirect
|
|
github.com/xanzy/ssh-agent v0.3.3 // indirect
|
|
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
|
|
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
|
|
github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
|
|
github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
|
|
github.com/zclconf/go-cty v1.13.0 // indirect
|
|
go.opencensus.io v0.24.0 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
|
|
go.opentelemetry.io/otel v1.33.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.33.0 // indirect
|
|
go.opentelemetry.io/otel/trace v1.33.0 // indirect
|
|
go.uber.org/atomic v1.9.0 // indirect
|
|
go.uber.org/multierr v1.9.0 // indirect
|
|
golang.org/x/crypto v0.33.0 // indirect
|
|
golang.org/x/sync v0.11.0 // indirect
|
|
golang.org/x/sys v0.30.0 // indirect
|
|
golang.org/x/term v0.29.0 // indirect
|
|
golang.org/x/text v0.22.0 // indirect
|
|
golang.org/x/tools v0.29.0 // indirect
|
|
golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20241223144023-3abc09e42ca8 // indirect
|
|
google.golang.org/grpc v1.67.3 // indirect
|
|
google.golang.org/protobuf v1.36.3 // indirect
|
|
gopkg.in/ini.v1 v1.67.0 // indirect
|
|
gopkg.in/warnings.v0 v0.1.2 // indirect
|
|
modernc.org/libc v1.61.13 // indirect
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
modernc.org/memory v1.8.2 // indirect
|
|
)
|
|
|
|
retract (
|
|
v0.53.2
|
|
v0.53.1 // Published accidentally with incorrect license in depdencies
|
|
)
|