mirror of
https://github.com/anchore/syft.git
synced 2026-11-05 08:56:41 +01:00
fa02ff2d26
* feat(executable): capture GNU ELF build IDs Capture GNU ELF build IDs in Syft JSON so consumers can correlate otherwise unidentified binaries with known artifacts or build records. Read GNU build-ID notes from .note.gnu.build-id, with a 64 KiB read limit. Validate the note owner and type before recording the identifier. Add focused extraction and JSON round-trip tests and update the schema. Signed-off-by: Mario Corchero <mcorcherojim@bloomberg.net> * chore: bump JSON schema to 16.1.13 for executable identifiers 16.1.12 landed on main for coordinate fullPath, so the identifiers addition moves to the next version. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * feat(executable): capture go build IDs from .note.go.buildid The go linker only writes a GNU build ID with -B or when linking externally, so most pure-Go binaries had no identifier. Every go ELF carries .note.go.buildid, captured as kind `go-build-id` in the form `go tool buildid` prints. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * docs(executable): describe identifiers generically Identifier field docs (and the published schema) now give GNU hex and Go build IDs as examples instead of stating every value is a GNU build ID in lowercase hex, so the contract holds as more kinds are added. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix(executable): keep identifier notes inside elfutil bounds Register `.note.gnu.build-id` and `.note.go.buildid` in elfutil's sectionsReadByName as that list asks, and never open a compressed identifier note. Real ones are SHF_ALLOC and cannot be compressed, so this drops the only decompression path into these reads. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * test(executable): check identifiers from real linker output Cross-compiles a tiny go program with `-B` so the test sees a GNU build ID and a go build ID written by an actual linker and read through the cataloger entrypoint. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Mario Corchero <mcorcherojim@bloomberg.net> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Mario Corchero <mcorcherojim@bloomberg.net> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
24 lines
1.5 KiB
Go
24 lines
1.5 KiB
Go
package internal
|
|
|
|
const (
|
|
// JSONSchemaVersion is the current schema version output by the JSON encoder
|
|
// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
|
|
JSONSchemaVersion = "16.1.13"
|
|
|
|
// Changelog
|
|
// 16.1.0 - reformulated the python pdm fields (added "URL" and removed the unused "path" field).
|
|
// 16.1.1 - correct elf package osCpe field according to the document of systemd (also add appCpe field)
|
|
// 16.1.2 - placeholder for 16.1.2 changelog
|
|
// 16.1.3 - add GGUFFileParts to GGUFFileHeader metadata
|
|
// 16.1.4 - add BunLockEntry metadata type for bun.lock support
|
|
// 16.1.5 - add DenoLockEntry and DenoRemoteLockEntry metadata types for deno.lock support
|
|
// 16.1.6 - add Dependencies to ElixirMixLockEntry metadata
|
|
// 16.1.7 - add AppleAppBundleEntry metadata type for the apple app bundle cataloger
|
|
// 16.1.8 - add VcpkgManifest metadata type for vcpkg manifest support
|
|
// 16.1.9 - add Symbols (grouped by owning package import path) to GolangBinaryBuildinfoEntry metadata
|
|
// 16.1.10 - add SafeTensorsModelInfo metadata type for the safetensors AI model cataloger
|
|
// 16.1.11 - add CpanDistribution and CpanUnpackedRelease metadata types for the perl catalogers
|
|
// 16.1.12 - add fullPath to file coordinates, naming the nested archive chain a file was found in (blank for files not within an archive)
|
|
// 16.1.13 - add executable identifiers (ELF GNU and Go build IDs)
|
|
)
|