mirror of
https://github.com/anchore/syft.git
synced 2025-11-17 08:23:15 +01:00
b369b02f4f
* feat: expose rpm signature information This helps with more confident identification of an rpm. In theory, two rpms can be built that have the same purl string, and otherwise look identical in syft's output, but the PGP information would distinguish them as signed either by different keys, or signed at different times. In practice, this usually makes no difference since rpms tend to have unique name/version/release strings. This just gives increased confidence about the identity of the rpm found in the db. Signed-off-by: Ralph Bean <rbean@redhat.com> * chore: generate json schema Signed-off-by: Ralph Bean <rbean@redhat.com> * re-generate json schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename to a more generic signature field Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename rpm.pgp to rpm.signatures Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * split out signature fields Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * include RPM archives Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update json schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * dont fail on unknown signature type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Ralph Bean <rbean@redhat.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
269 lines
13 KiB
Modula-2
269 lines
13 KiB
Modula-2
module github.com/anchore/syft
|
|
|
|
go 1.24.1
|
|
|
|
require (
|
|
github.com/BurntSushi/toml v1.5.0
|
|
github.com/CycloneDX/cyclonedx-go v0.9.2
|
|
github.com/Masterminds/semver/v3 v3.3.1
|
|
github.com/Masterminds/sprig/v3 v3.3.0
|
|
github.com/OneOfOne/xxhash v1.2.8
|
|
github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
|
|
github.com/acobaugh/osrelease v0.1.0
|
|
github.com/adrg/xdg v0.5.3
|
|
github.com/anchore/archiver/v3 v3.5.3-0.20241210171143-5b1d8d1c7c51
|
|
github.com/anchore/bubbly v0.0.0-20231115134915-def0aba654a9
|
|
github.com/anchore/clio v0.0.0-20250319180342-2cfe4b0cb716
|
|
github.com/anchore/fangs v0.0.0-20250319222917-446a1e748ec2
|
|
github.com/anchore/go-collections v0.0.0-20240216171411-9321230ce537
|
|
github.com/anchore/go-homedir v0.0.0-20250319154043-c29668562e4d
|
|
github.com/anchore/go-logger v0.0.0-20250318195838-07ae343dd722
|
|
github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb
|
|
github.com/anchore/go-sync v0.0.0-20250326131806-4eda43a485b6
|
|
github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
|
|
github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
|
|
github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115
|
|
github.com/anchore/stereoscope v0.1.4
|
|
github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
|
|
github.com/aquasecurity/go-pep440-version v0.0.1
|
|
github.com/bitnami/go-version v0.0.0-20250131085805-b1f57a8634ef
|
|
github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
|
|
github.com/bmatcuk/doublestar/v4 v4.8.1
|
|
github.com/charmbracelet/bubbles v0.21.0
|
|
github.com/charmbracelet/bubbletea v1.3.5
|
|
github.com/charmbracelet/lipgloss v1.1.0
|
|
github.com/dave/jennifer v1.7.1
|
|
github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da
|
|
github.com/distribution/reference v0.6.0
|
|
github.com/dustin/go-humanize v1.0.1
|
|
github.com/elliotchance/phpserialize v1.4.0
|
|
github.com/facebookincubator/nvdtools v0.1.5
|
|
github.com/github/go-spdx/v2 v2.3.3
|
|
github.com/gkampitakis/go-snaps v0.5.11
|
|
github.com/go-git/go-billy/v5 v5.6.2
|
|
github.com/go-git/go-git/v5 v5.16.0
|
|
github.com/go-test/deep v1.1.1
|
|
github.com/go-viper/mapstructure/v2 v2.2.1
|
|
github.com/gohugoio/hashstructure v0.5.0
|
|
github.com/google/go-cmp v0.7.0
|
|
github.com/google/go-containerregistry v0.20.3
|
|
github.com/google/licensecheck v0.3.1
|
|
github.com/google/uuid v1.6.0
|
|
github.com/gookit/color v1.5.4
|
|
github.com/hashicorp/go-multierror v1.1.1
|
|
github.com/hashicorp/hcl/v2 v2.23.0
|
|
github.com/iancoleman/strcase v0.3.0
|
|
github.com/invopop/jsonschema v0.7.0
|
|
github.com/jedib0t/go-pretty/v6 v6.6.7
|
|
github.com/jinzhu/copier v0.4.0
|
|
github.com/kastenhq/goversion v0.0.0-20230811215019-93b2f8823953
|
|
github.com/knqyf263/go-rpmdb v0.1.1
|
|
github.com/magiconair/properties v1.8.10
|
|
github.com/mholt/archives v0.1.2
|
|
github.com/moby/sys/mountinfo v0.7.2
|
|
github.com/nix-community/go-nix v0.0.0-20250101154619-4bdde671e0a1
|
|
github.com/olekukonko/tablewriter v0.0.5
|
|
github.com/opencontainers/go-digest v1.0.0
|
|
github.com/pelletier/go-toml v1.9.5
|
|
github.com/quasilyte/go-ruleguard/dsl v0.3.22
|
|
github.com/rust-secure-code/go-rustaudit v0.0.0-20250226111315-e20ec32e963c
|
|
github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d
|
|
github.com/sanity-io/litter v1.5.8
|
|
github.com/sassoftware/go-rpmutils v0.4.0
|
|
// pinned to pull in 386 arch fix: https://github.com/scylladb/go-set/commit/cc7b2070d91ebf40d233207b633e28f5bd8f03a5
|
|
github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e
|
|
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3
|
|
github.com/spdx/gordf v0.0.0-20201111095634-7098f93598fb
|
|
github.com/spdx/tools-golang v0.5.5
|
|
github.com/spf13/afero v1.14.0
|
|
github.com/spf13/cobra v1.9.1
|
|
github.com/stretchr/testify v1.10.0
|
|
github.com/vbatts/go-mtree v0.5.4
|
|
github.com/vifraa/gopom v1.0.0
|
|
github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651
|
|
github.com/wagoodman/go-progress v0.0.0-20230925121702-07e42b3cdba0
|
|
github.com/xeipuuv/gojsonschema v1.2.0
|
|
github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1
|
|
go.uber.org/goleak v1.3.0
|
|
golang.org/x/exp v0.0.0-20250305212735-054e65f0b394
|
|
golang.org/x/mod v0.24.0
|
|
golang.org/x/net v0.40.0
|
|
gopkg.in/yaml.v3 v3.0.1
|
|
modernc.org/sqlite v1.37.0
|
|
)
|
|
|
|
require (
|
|
dario.cat/mergo v1.0.1 // indirect
|
|
github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
|
|
github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0 // indirect
|
|
github.com/DataDog/zstd v1.5.5 // indirect
|
|
github.com/Masterminds/goutils v1.1.1 // indirect
|
|
github.com/Microsoft/go-winio v0.6.2 // indirect
|
|
github.com/Microsoft/hcsshim v0.11.7 // indirect
|
|
github.com/ProtonMail/go-crypto v1.2.0 // indirect
|
|
github.com/STARRY-S/zip v0.2.1 // indirect
|
|
github.com/agext/levenshtein v1.2.1 // indirect; indirectt
|
|
github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092 // indirect
|
|
github.com/andybalholm/brotli v1.1.2-0.20250424173009-453214e765f3 // indirect
|
|
github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
|
|
github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
|
|
github.com/aquasecurity/go-version v0.0.1 // indirect
|
|
github.com/atotto/clipboard v0.1.4 // indirect
|
|
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
|
|
github.com/becheran/wildmatch-go v1.0.0 // indirect
|
|
github.com/bodgit/plumbing v1.3.0 // indirect
|
|
github.com/bodgit/sevenzip v1.6.0 // indirect
|
|
github.com/bodgit/windows v1.0.1 // indirect
|
|
github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc // indirect
|
|
github.com/charmbracelet/harmonica v0.2.0 // indirect
|
|
github.com/charmbracelet/x/ansi v0.8.0 // indirect
|
|
github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd // indirect
|
|
github.com/charmbracelet/x/term v0.2.1 // indirect
|
|
github.com/cloudflare/circl v1.6.1 // indirect
|
|
github.com/containerd/cgroups v1.1.0 // indirect
|
|
github.com/containerd/containerd v1.7.27 // indirect
|
|
github.com/containerd/containerd/api v1.8.0 // indirect
|
|
github.com/containerd/continuity v0.4.4 // indirect
|
|
github.com/containerd/errdefs v0.3.0 // indirect
|
|
github.com/containerd/fifo v1.1.0 // indirect
|
|
github.com/containerd/log v0.1.0 // indirect
|
|
github.com/containerd/platforms v0.2.1 // indirect
|
|
github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect
|
|
github.com/containerd/ttrpc v1.2.7 // indirect
|
|
github.com/containerd/typeurl/v2 v2.1.1 // indirect
|
|
github.com/cyphar/filepath-securejoin v0.4.1 // indirect
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
|
github.com/docker/cli v28.1.1+incompatible // indirect
|
|
github.com/docker/distribution v2.8.3+incompatible // indirect
|
|
github.com/docker/docker v28.1.1+incompatible // indirect
|
|
github.com/docker/docker-credential-helpers v0.8.2 // indirect
|
|
github.com/docker/go-connections v0.5.0 // indirect
|
|
github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
|
|
github.com/docker/go-units v0.5.0 // indirect
|
|
github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect
|
|
github.com/emirpasic/gods v1.18.1 // indirect
|
|
github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
|
|
github.com/felixge/fgprof v0.9.5 // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/fsnotify/fsnotify v1.8.0 // indirect
|
|
github.com/gabriel-vasile/mimetype v1.4.9 // indirect
|
|
github.com/gkampitakis/ciinfo v0.3.1 // indirect
|
|
github.com/gkampitakis/go-diff v1.3.2 // indirect
|
|
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
|
|
github.com/go-logr/logr v1.4.2 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/go-restruct/restruct v1.2.0-alpha // indirect
|
|
github.com/goccy/go-yaml v1.15.13 // indirect
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
|
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
|
|
github.com/golang/snappy v0.0.4 // indirect
|
|
github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e // indirect
|
|
github.com/hashicorp/errwrap v1.1.0 // indirect
|
|
github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
|
|
github.com/huandu/xstrings v1.5.0 // indirect
|
|
github.com/iancoleman/orderedmap v0.0.0-20190318233801-ac98e3ecb4b0 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
|
|
github.com/kevinburke/ssh_config v1.2.0 // indirect
|
|
github.com/klauspost/compress v1.18.0 // indirect
|
|
github.com/klauspost/pgzip v1.2.6 // indirect
|
|
github.com/kr/pretty v0.3.1 // indirect
|
|
github.com/kr/text v0.2.0 // indirect
|
|
github.com/logrusorgru/aurora v2.0.3+incompatible // indirect
|
|
github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
|
|
github.com/maruel/natural v1.1.1 // indirect
|
|
github.com/mattn/go-colorable v0.1.13 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75 // indirect
|
|
github.com/mattn/go-runewidth v0.0.16 // indirect
|
|
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
|
|
github.com/minio/minlz v1.0.0 // indirect
|
|
github.com/mitchellh/copystructure v1.2.0 // indirect
|
|
github.com/mitchellh/go-homedir v1.1.0 // indirect
|
|
github.com/mitchellh/go-wordwrap v1.0.1 // indirect
|
|
github.com/mitchellh/reflectwalk v1.0.2 // indirect
|
|
github.com/moby/docker-image-spec v1.3.1 // indirect
|
|
github.com/moby/locker v1.0.1 // indirect
|
|
github.com/moby/sys/sequential v0.6.0 // indirect
|
|
github.com/moby/sys/signal v0.7.0 // indirect
|
|
github.com/moby/sys/user v0.3.0 // indirect
|
|
github.com/moby/sys/userns v0.1.0 // indirect
|
|
github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
|
|
github.com/muesli/cancelreader v0.2.2 // indirect
|
|
github.com/muesli/termenv v0.16.0 // indirect
|
|
github.com/ncruces/go-strftime v0.1.9 // indirect
|
|
github.com/nwaples/rardecode v1.1.3 // indirect
|
|
github.com/nwaples/rardecode/v2 v2.1.0 // indirect
|
|
github.com/opencontainers/image-spec v1.1.1 // indirect
|
|
github.com/opencontainers/runtime-spec v1.1.0 // indirect
|
|
github.com/opencontainers/selinux v1.11.0 // indirect
|
|
github.com/pborman/indent v1.2.1 // indirect
|
|
github.com/pelletier/go-toml/v2 v2.2.3 // indirect
|
|
github.com/pierrec/lz4/v4 v4.1.22 // indirect
|
|
github.com/pjbgf/sha1cd v0.3.2 // indirect
|
|
github.com/pkg/errors v0.9.1 // indirect
|
|
github.com/pkg/profile v1.7.0 // indirect
|
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
github.com/rivo/uniseg v0.4.7 // indirect
|
|
github.com/rogpeppe/go-internal v1.14.1 // indirect
|
|
github.com/sagikazarmark/locafero v0.7.0 // indirect
|
|
github.com/sahilm/fuzzy v0.1.1 // indirect
|
|
github.com/shopspring/decimal v1.4.0 // indirect
|
|
github.com/sirupsen/logrus v1.9.3 // indirect
|
|
github.com/skeema/knownhosts v1.3.1 // indirect
|
|
github.com/sorairolake/lzip-go v0.3.5 // indirect
|
|
github.com/sourcegraph/conc v0.3.0 // indirect
|
|
github.com/spf13/cast v1.7.1 // indirect
|
|
github.com/spf13/pflag v1.0.6 // indirect
|
|
github.com/spf13/viper v1.20.0 // indirect
|
|
github.com/subosito/gotenv v1.6.0 // indirect
|
|
github.com/sylabs/sif/v2 v2.21.1 // indirect
|
|
github.com/sylabs/squashfs v1.0.6 // indirect
|
|
github.com/therootcompany/xz v1.0.1 // indirect
|
|
github.com/tidwall/gjson v1.18.0 // indirect
|
|
github.com/tidwall/match v1.1.1 // indirect
|
|
github.com/tidwall/pretty v1.2.1 // indirect
|
|
github.com/tidwall/sjson v1.2.5 // indirect
|
|
github.com/ulikunitz/xz v0.5.12 // indirect
|
|
github.com/vbatts/tar-split v0.11.6 // indirect
|
|
github.com/xanzy/ssh-agent v0.3.3 // indirect
|
|
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
|
|
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
|
|
github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
|
|
github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
|
|
github.com/zclconf/go-cty v1.13.0 // indirect
|
|
go.opencensus.io v0.24.0 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
|
|
go.opentelemetry.io/otel v1.33.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.33.0 // indirect
|
|
go.opentelemetry.io/otel/trace v1.33.0 // indirect
|
|
go.uber.org/atomic v1.9.0 // indirect
|
|
go.uber.org/multierr v1.9.0 // indirect
|
|
go4.org v0.0.0-20230225012048-214862532bf5 // indirect
|
|
golang.org/x/crypto v0.38.0 // indirect
|
|
golang.org/x/sync v0.14.0 // indirect
|
|
golang.org/x/sys v0.33.0 // indirect
|
|
golang.org/x/term v0.32.0 // indirect
|
|
golang.org/x/text v0.25.0 // indirect
|
|
golang.org/x/tools v0.31.0 // indirect
|
|
golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
|
|
google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20241223144023-3abc09e42ca8 // indirect
|
|
google.golang.org/grpc v1.67.3 // indirect
|
|
google.golang.org/protobuf v1.36.4 // indirect
|
|
gopkg.in/warnings.v0 v0.1.2 // indirect
|
|
modernc.org/libc v1.62.1 // indirect
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
modernc.org/memory v1.9.1 // indirect
|
|
)
|
|
|
|
retract (
|
|
v0.53.2
|
|
v0.53.1 // Published accidentally with incorrect license in depdencies
|
|
)
|
|
|
|
// adds RSA Headers from RPMDB via https://github.com/knqyf263/go-rpmdb/pull/58 (in review)
|
|
replace github.com/knqyf263/go-rpmdb => github.com/anchore/go-rpmdb v0.0.0-20250515153519-38be2efee8ed
|