Mirrors/grype
2
0
Fork 0
mirror of https://github.com/anchore/grype synced 2024-11-10 14:44:12 +00:00
Code Issues Projects Releases Packages Wiki Activity
grype/go.mod

198 lines
9.2 KiB
Modula-2
Raw Normal View History

rename to grype
2020-07-24 01:29:05 +00:00
module github.com/anchore/grype
initial project structure
2020-05-26 14:37:28 +00:00
chore: prune cosign dependency for grype builds (#1100) * feat: segment cosign dependency for grype builds for faster build times Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-01-31 16:42:40 +00:00
go 1.19
initial project structure
2020-05-26 14:37:28 +00:00
require (
chore(deps): bump github.com/CycloneDX/cyclonedx-go from 0.7.1-0.20221222100750-41a1ac565cce to 0.7.1 (#1213) * chore(deps): bump github.com/CycloneDX/cyclonedx-go Bumps [github.com/CycloneDX/cyclonedx-go](https://github.com/CycloneDX/cyclonedx-go) from 0.7.1-0.20221222100750-41a1ac565cce to 0.7.1. - [Release notes](https://github.com/CycloneDX/cyclonedx-go/releases) - [Changelog](https://github.com/CycloneDX/cyclonedx-go/blob/master/.goreleaser.yml) - [Commits](https://github.com/CycloneDX/cyclonedx-go/commits/v0.7.1) --- updated-dependencies: - dependency-name: github.com/CycloneDX/cyclonedx-go dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * fix: update test fixtures Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-04 14:41:03 +00:00
github.com/CycloneDX/cyclonedx-go v0.7.1
chore(deps): bump github.com/Masterminds/sprig/v3 from 3.2.2 to 3.2.3 (#1083) Bumps [github.com/Masterminds/sprig/v3](https://github.com/Masterminds/sprig) from 3.2.2 to 3.2.3. - [Release notes](https://github.com/Masterminds/sprig/releases) - [Changelog](https://github.com/Masterminds/sprig/blob/master/CHANGELOG.md) - [Commits](https://github.com/Masterminds/sprig/compare/v3.2.2...v3.2.3) --- updated-dependencies: - dependency-name: github.com/Masterminds/sprig/v3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-01-25 17:17:03 +00:00
github.com/Masterminds/sprig/v3 v3.2.3
update syft and stereoscope to pull in registry source Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
2021-04-13 20:08:02 +00:00
github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
github.com/adrg/xdg v0.4.0
always return a cleanup function from scope (#166) Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
2020-09-25 20:29:15 +00:00
github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
Match against Alpine source packages (#407) * Update go-version package and add test This is being updated due to an issue that was encountered in the lessThanEqual constraint in go-version: https://github.com/anchore/go-version/pull/2. Was disovered while adding tests for apk origin package matching Signed-off-by: Zane Burstein <zane.burstein@anchore.com> * Added matching with source package for apk This change allows grype to match with a packages source package for apk. Adds APKMetadata with OriginPackage, new matching logic in apk matchers, and tests Signed-off-by: Zane Burstein <zane.burstein@anchore.com>
2021-09-09 11:42:11 +00:00
github.com/anchore/go-version v1.2.2-0.20210903204242-51efa5b487c4
chore: update Syft to v0.66.2 (#1060)
2023-01-18 17:50:46 +00:00
github.com/anchore/packageurl-go v0.1.1-0.20230104203445-02e0a6721501
chore: bump syft to latest version v0.79.0 (#1250) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-21 16:58:02 +00:00
github.com/anchore/stereoscope v0.0.0-20230412183729-8602f1afc574
Feature: Specifying ignore rules for vulnerability matches (#430) * Preliminary implementation of ignore rules Signed-off-by: Dan Luhring <dan.luhring@anchore.com> * Support ignoring matches by package type Signed-off-by: Dan Luhring <dan.luhring@anchore.com> * Add tests for ignore functionality Signed-off-by: Dan Luhring <dan.luhring@anchore.com> * Add documentation for ignore rules and clean up README Signed-off-by: Dan Luhring <dan.luhring@anchore.com> * Add test for glob location matching Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
2021-09-29 19:44:36 +00:00
github.com/bmatcuk/doublestar/v2 v2.0.4
chore(deps): bump github.com/docker/docker (#1241) Bumps [github.com/docker/docker](https://github.com/docker/docker) from 23.0.3+incompatible to 23.0.4+incompatible. - [Release notes](https://github.com/docker/docker/releases) - [Commits](https://github.com/docker/docker/compare/v23.0.3...v23.0.4) --- updated-dependencies: - dependency-name: github.com/docker/docker dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-04-18 16:57:38 +00:00
github.com/docker/docker v23.0.4+incompatible
Update Syft to v0.68.1 (#1086) Signed-off-by: GitHub <noreply@github.com> Signed-off-by: GitHub <noreply@github.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com>
2023-01-26 10:07:49 +00:00
github.com/dustin/go-humanize v1.0.1
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
github.com/facebookincubator/nvdtools v0.1.5
chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.1 to 1.4.2 (#1166) Bumps [github.com/gabriel-vasile/mimetype](https://github.com/gabriel-vasile/mimetype) from 1.4.1 to 1.4.2. - [Release notes](https://github.com/gabriel-vasile/mimetype/releases) - [Commits](https://github.com/gabriel-vasile/mimetype/compare/v1.4.1...v1.4.2) --- updated-dependencies: - dependency-name: github.com/gabriel-vasile/mimetype dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-03-09 15:06:26 +00:00
github.com/gabriel-vasile/mimetype v1.4.2
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
github.com/go-test/deep v1.1.0
Bump github.com/sigstore/cosign from 1.11.1 to 1.12.0 (#927) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-09-19 15:46:11 +00:00
github.com/google/go-cmp v0.5.9
Bump syft to release version v0.39.0 (#645) * bump syft to v0.39.0 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update ByCriteria to log error on failure Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * integration tests now pass Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * bump to v0.39.3 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * raise search failures to warn Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * tidy go.mod/sum Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-26 22:28:08 +00:00
github.com/google/uuid v1.3.0
chore(deps): bump github.com/gookit/color from 1.5.2 to 1.5.3 (#1192)
2023-03-24 11:49:36 +00:00
github.com/gookit/color v1.5.3
Support for private certificate authorities during DB curation (#494) * Add injectable HTTP client to file getter Signed-off-by: Dan Luhring <dan.luhring@anchore.com> * WIP: Map config for custom CA certs Signed-off-by: Dan Luhring <dan.luhring@anchore.com> * update curator and add tests Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add TLS helper scripts Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * remove grype-db local mod edit Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * tidy go modules Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * use ssl.context over deprecated fn Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * disallow tls 1 and 1.1 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * suppress non-archive sources for fetch-to-dir capability Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * ensure DB load failure does not panic Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * address review comments Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2021-11-22 16:59:38 +00:00
github.com/hashicorp/go-cleanhttp v0.5.2
chore(deps): bump github.com/hashicorp/go-getter from 1.7.0 to 1.7.1 (#1181)
2023-03-21 13:51:55 +00:00
github.com/hashicorp/go-getter v1.7.1
Bump syft to release version v0.39.0 (#645) * bump syft to v0.39.0 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update ByCriteria to log error on failure Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * integration tests now pass Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * bump to v0.39.3 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * raise search failures to warn Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * tidy go.mod/sum Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-26 22:28:08 +00:00
github.com/hashicorp/go-multierror v1.1.1
update golanci-lint, goreleaser, cosign (#850)
2022-07-28 18:55:14 +00:00
github.com/hashicorp/go-version v1.6.0
Add APK version constraint parsing (#455) Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
2021-10-18 17:27:02 +00:00
github.com/knqyf263/go-apk-version v0.0.0-20200609155635-041fdbb8563f
add version & version constraint support
2020-06-01 11:13:53 +00:00
github.com/knqyf263/go-deb-version v0.0.0-20190517075300-09fca494f03d
Add additional DB archive decompressors (#657)
2022-03-07 16:44:43 +00:00
github.com/mholt/archiver/v3 v3.5.1
initial project structure
2020-05-26 14:37:28 +00:00
github.com/mitchellh/go-homedir v1.1.0
Add ability to merge matches (#602) * enable merging of matches Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add ability for matches constructor to take initial matches Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update tests to include IDs on package objects Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * rename common matcher helper package to search package Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * rename search functions and add SearchByCriteria Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * cleanup imports Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
2022-01-25 15:29:16 +00:00
github.com/mitchellh/hashstructure/v2 v2.0.2
Bump syft to release version v0.39.0 (#645) * bump syft to v0.39.0 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update ByCriteria to log error on failure Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * integration tests now pass Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * bump to v0.39.3 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * raise search failures to warn Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * tidy go.mod/sum Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-26 22:28:08 +00:00
github.com/olekukonko/tablewriter v0.0.5
Add SARIF presenter option (#654)
2022-03-14 16:13:37 +00:00
github.com/owenrumney/go-sarif v1.1.1
chore(deps): bump github.com/pkg/profile from 1.6.0 to 1.7.0 (#1079) Bumps [github.com/pkg/profile](https://github.com/pkg/profile) from 1.6.0 to 1.7.0. - [Release notes](https://github.com/pkg/profile/releases) - [Commits](https://github.com/pkg/profile/compare/v1.6.0...v1.7.0) --- updated-dependencies: - dependency-name: github.com/pkg/profile dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-01-25 17:21:34 +00:00
github.com/pkg/profile v1.7.0
Bump strset version to fix 386 builds (#689)
2022-03-23 18:27:11 +00:00
// pinned to pull in 386 arch fix: https://github.com/scylladb/go-set/commit/cc7b2070d91ebf40d233207b633e28f5bd8f03a5
github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
github.com/sergi/go-diff v1.3.1
Update Syft to v0.54.0 (#881) Signed-off-by: GitHub <noreply@github.com> Signed-off-by: GitHub <noreply@github.com> Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
2022-08-17 19:36:54 +00:00
github.com/sirupsen/logrus v1.9.0
Update Syft to v0.74.1 (#1168) Signed-off-by: GitHub <noreply@github.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com>
2023-03-09 14:37:02 +00:00
github.com/spf13/afero v1.9.5
chore(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 (#1216) Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra) from 1.6.1 to 1.7.0. - [Release notes](https://github.com/spf13/cobra/releases) - [Commits](https://github.com/spf13/cobra/compare/v1.6.1...v1.7.0) --- updated-dependencies: - dependency-name: github.com/spf13/cobra dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-04-04 18:32:16 +00:00
github.com/spf13/cobra v1.7.0
Upgrade config, UI, and command package patterns (#406) * split and upgrade config processing Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * upgrade UI organization Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * expose logger writter Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add (unused) signal handler Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add (unused) event loop abstraction Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update aux commands to use Cobra RunE over Run Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * upgrade root command to use new event loop and signal handler Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update CLI test to account for config representation Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update dependencies + fix linting Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * decompose application config parse func + add missing config struct tags Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * restore unparam lint exclusion for registry config Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
2021-10-01 17:03:50 +00:00
github.com/spf13/pflag v1.0.5
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
github.com/spf13/viper v1.15.0
chore(deps): bump github.com/stretchr/testify from 1.8.1 to 1.8.2 (#1144) Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.8.1 to 1.8.2. - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](https://github.com/stretchr/testify/compare/v1.8.1...v1.8.2) --- updated-dependencies: - dependency-name: github.com/stretchr/testify dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-02-27 17:25:04 +00:00
github.com/stretchr/testify v1.8.2
Update syft to v0.18.0 (#351) Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
2021-06-29 21:34:26 +00:00
github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5
chore: update progress monitor handling (#1149)
2023-03-01 21:47:01 +00:00
github.com/wagoodman/go-progress v0.0.0-20230301185719-21920a456ad5
Update syft, jotframe, and validations pipeline (#512) * update syft and jotframe Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update validations and release pipeline Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * moved terminal package to golang.org/x/term Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update integration tests to account for package relationships Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add license exception for xz Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update Location and Coordinate references Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * remove benchmark tests Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * remove mac acceptance tests Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add syft-grype relationship notes in DEVELOPING.md Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
2021-11-30 18:10:07 +00:00
github.com/wagoodman/jotframe v0.0.0-20211129225309-56b0d0a4aebb
replace zap logger with logrus (#80)
2020-08-01 15:58:10 +00:00
github.com/x-cray/logrus-prefixed-formatter v0.5.2
chore(deps): bump golang.org/x/term from 0.6.0 to 0.7.0 (#1217) Bumps [golang.org/x/term](https://github.com/golang/term) from 0.6.0 to 0.7.0. - [Release notes](https://github.com/golang/term/releases) - [Commits](https://github.com/golang/term/compare/v0.6.0...v0.7.0) --- updated-dependencies: - dependency-name: golang.org/x/term dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-04-05 23:05:38 +00:00
golang.org/x/term v0.7.0
Add windows support (#464) * update grype to compile windows Signed-off-by: spiffcs <christopher.phillips@anchore.com> Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com> * update go mod with new stereoscope Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com> * update build comments Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com> * small build tags Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com> * add goreleaser windows Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com> * bump syft version Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com> * update tests Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com> * update test images to use newest pinned golang Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
2021-10-22 17:46:56 +00:00
gopkg.in/yaml.v2 v2.4.0
chore(deps): bump gorm.io/gorm from 1.23.5 to 1.23.10 (#1157) Bumps [gorm.io/gorm](https://github.com/go-gorm/gorm) from 1.23.5 to 1.23.10. - [Release notes](https://github.com/go-gorm/gorm/releases) - [Commits](https://github.com/go-gorm/gorm/compare/v1.23.5...v1.23.10) --- updated-dependencies: - dependency-name: gorm.io/gorm dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-03-03 17:26:49 +00:00
gorm.io/gorm v1.23.10
initial project structure
2020-05-26 14:37:28 +00:00
)
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
Consume attestation files (#706) * add key flag to attest validation Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * mvp: verify sig and extract sbom Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * wip read attestation without scheme Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * go mod tidy Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * mvp consuming attestations - needs unit tests Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * remove prototype file Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * drop local syft from go.mod Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * fix order of sbom parsing strategies Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * handle implicit attestation input Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * wip Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * add test for invalid attestation key Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * rebase and go-mod-tidy Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * consume attestation via stdin Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * attestation test for stdin Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * validate input and content for attestation Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * add stdin test Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * fix config tags Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * add int test to ignore attestation validation Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * fix cycloneDX attestation fixture Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * add tampered att test Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * add tampered predicate type test Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * improve docs/help on atttestation Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * feedback changes Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * upgrade to latest syft Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * fall through when guessing between sbom and att Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * go mod tidy Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * fix butter finger rebase Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * drop default key value Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * assert error messages Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * better test/cli coverage Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * fix stdin decode test Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * fix goimports Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * tui - verified attestation and feedback changes Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * better naming Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * add attestation section to config file Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * emit event for skipped verification Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * use public key name Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * feedback changes Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * nit Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
2022-04-21 18:52:42 +00:00
require (
chore: update syft to v0.60.3 (#978)
2022-11-03 16:19:03 +00:00
github.com/anchore/go-logger v0.0.0-20220728155337-03b66a5207d8
use anchore fork of glebarez/sqlite (#778) This overcomes an issue with duplicate registration of sqlite drivers between glebarez/sqlite and knqyf263/go-rpmdb by just using modernc.org/sqlite directly within our fork Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
2022-06-08 13:41:15 +00:00
github.com/anchore/sqlite v1.4.6-0.20220607210448-bcc6ee5c4963
chore: bump syft to latest version v0.79.0 (#1250) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-21 16:58:02 +00:00
github.com/anchore/syft v0.79.0
add db staleness check (#785) * add db staleness check Signed-off-by: Jonas Xavier <jonasx@anchore.com> * less config fields Signed-off-by: Jonas Xavier <jonasx@anchore.com> * fix import order Signed-off-by: Jonas Xavier <jonasx@anchore.com> * warn even when set to not error on staleness Signed-off-by: Jonas Xavier <jonasx@anchore.com> * nits Signed-off-by: Jonas Xavier <jonasx@anchore.com> * nits Signed-off-by: Jonas Xavier <jonasx@anchore.com> * feedback changes Signed-off-by: Jonas Xavier <jonasx@anchore.com> * lint fix Signed-off-by: Jonas Xavier <jonasx@anchore.com> * fix test Signed-off-by: Jonas Xavier <jonasx@anchore.com> * consistent log message Signed-off-by: Jonas Xavier <jonasx@anchore.com> * consistent new version message Signed-off-by: Jonas Xavier <jonasx@anchore.com> * feedback changes Signed-off-by: Jonas Xavier <jonasx@anchore.com> * human friendly time durations Signed-off-by: Jonas Xavier <jonasx@anchore.com> * fix typo Signed-off-by: Jonas Xavier <jonasx@anchore.com> * feedback changes Signed-off-by: Jonas Xavier <jonasx@anchore.com> * cleaner tests and default db value Signed-off-by: Jonas Xavier <jonasx@anchore.com>
2022-06-15 16:48:10 +00:00
github.com/hako/durafmt v0.0.0-20210608085754-5c1018a4e16b
implement v5 db schema to support improved matching between rpm appstream modules (#944) Adds support for a `package_qualifiers` column to allow evaluating package matches to vulnerabilities based on more than just version constraints. Currently adds an rpm-modularity qualifier in order to support matching to correct app stream module in order to reduce false positives within rpm-based distro ecosystems. In order to prevent an increase in false positive matches for previous versions of grype using the v4 schema, this change (along with the vulnerability source driver parser updates) requires bumping the schema to v5. Signed-off-by: Weston Steimel <weston.steimel@anchore.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2022-10-17 23:34:47 +00:00
github.com/mitchellh/mapstructure v1.5.0
Consume attestation files (#706) * add key flag to attest validation Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * mvp: verify sig and extract sbom Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * wip read attestation without scheme Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * go mod tidy Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * mvp consuming attestations - needs unit tests Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * remove prototype file Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * drop local syft from go.mod Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * fix order of sbom parsing strategies Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * handle implicit attestation input Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * wip Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * add test for invalid attestation key Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * rebase and go-mod-tidy Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * consume attestation via stdin Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * attestation test for stdin Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * validate input and content for attestation Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * add stdin test Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * fix config tags Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * add int test to ignore attestation validation Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * fix cycloneDX attestation fixture Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * add tampered att test Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * add tampered predicate type test Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * improve docs/help on atttestation Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * feedback changes Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * upgrade to latest syft Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * fall through when guessing between sbom and att Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * go mod tidy Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * fix butter finger rebase Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * drop default key value Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * assert error messages Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * better test/cli coverage Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * fix stdin decode test Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * fix goimports Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * tui - verified attestation and feedback changes Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * better naming Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * add attestation section to config file Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * emit event for skipped verification Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * use public key name Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * feedback changes Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com> * nit Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
2022-04-21 18:52:42 +00:00
)
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
require (
chore: bump syft to latest version v0.79.0 (#1250) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-21 16:58:02 +00:00
cloud.google.com/go v0.110.0 // indirect
cloud.google.com/go/compute v1.19.0 // indirect
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
cloud.google.com/go/compute/metadata v0.2.3 // indirect
chore: bump syft to latest version v0.79.0 (#1250) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-21 16:58:02 +00:00
cloud.google.com/go/iam v0.13.0 // indirect
cloud.google.com/go/storage v1.28.1 // indirect
Add support for scanning RPM files (#917)
2022-09-09 18:56:37 +00:00
github.com/DataDog/zstd v1.4.5 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/Masterminds/goutils v1.1.1 // indirect
chore(deps): bump github.com/Masterminds/sprig/v3 from 3.2.2 to 3.2.3 (#1083) Bumps [github.com/Masterminds/sprig/v3](https://github.com/Masterminds/sprig) from 3.2.2 to 3.2.3. - [Release notes](https://github.com/Masterminds/sprig/releases) - [Changelog](https://github.com/Masterminds/sprig/blob/master/CHANGELOG.md) - [Commits](https://github.com/Masterminds/sprig/compare/v3.2.2...v3.2.3) --- updated-dependencies: - dependency-name: github.com/Masterminds/sprig/v3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-01-25 17:17:03 +00:00
github.com/Masterminds/semver/v3 v3.2.0 // indirect
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
github.com/Microsoft/go-winio v0.6.0 // indirect
chore(deps): update Syft to v0.78.0 (#1242) * chore(deps): update Syft to v0.78.0 Signed-off-by: GitHub <noreply@github.com> * fix test location references and package types Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2023-04-19 17:38:06 +00:00
github.com/ProtonMail/go-crypto v0.0.0-20230217124315-7d5c6f04bbb8 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/acobaugh/osrelease v0.1.0 // indirect
chore(deps): update Syft to v0.78.0 (#1242) * chore(deps): update Syft to v0.78.0 Signed-off-by: GitHub <noreply@github.com> * fix test location references and package types Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2023-04-19 17:38:06 +00:00
github.com/acomagu/bufpipe v1.0.4 // indirect
upgrade github workflows to go 1.18 (#649) * upgrade github workflows to go 1.18 Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * upgrade syft & set go1.18 for CI workflows Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * go mod tidy Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * add go1.17 static analysis Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * fix yaml comment Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>
2022-03-17 21:58:20 +00:00
github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb // indirect
Update Syft to v0.69.1 (#1111) Signed-off-by: GitHub <noreply@github.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com>
2023-02-01 08:28:50 +00:00
github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/andybalholm/brotli v1.0.4 // indirect
chore(deps): bump github.com/sigstore/sigstore from 1.4.4 to 1.5.1 (#1081) Bumps [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) from 1.4.4 to 1.5.1. - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](https://github.com/sigstore/sigstore/compare/v1.4.4...v1.5.1) --- updated-dependencies: - dependency-name: github.com/sigstore/sigstore dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-01-25 19:42:48 +00:00
github.com/aws/aws-sdk-go v1.44.180 // indirect
Update Syft to v0.71.0 (#1126)
2023-02-10 15:14:01 +00:00
github.com/becheran/wildmatch-go v1.0.0 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
github.com/bmatcuk/doublestar/v4 v4.6.0 // indirect
chore(deps): update Syft to v0.78.0 (#1242) * chore(deps): update Syft to v0.78.0 Signed-off-by: GitHub <noreply@github.com> * fix test location references and package types Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2023-04-19 17:38:06 +00:00
github.com/cloudflare/circl v1.1.0 // indirect
chore: bump syft to latest version v0.79.0 (#1250) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-21 16:58:02 +00:00
github.com/containerd/containerd v1.7.0 // indirect
chore(deps): bump github.com/anchore/syft from 0.75.0 to 0.76.0 (#1207) * chore(deps): bump github.com/anchore/syft from 0.75.0 to 0.76.0 Bumps [github.com/anchore/syft](https://github.com/anchore/syft) from 0.75.0 to 0.76.0. - [Release notes](https://github.com/anchore/syft/releases) - [Changelog](https://github.com/anchore/syft/blob/main/.goreleaser.yaml) - [Commits](https://github.com/anchore/syft/compare/v0.75.0...v0.76.0) --- updated-dependencies: - dependency-name: github.com/anchore/syft dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore: update ParseInput signature with new syft version Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * fix: update integration tests Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-03 14:48:33 +00:00
github.com/containerd/stargz-snapshotter/estargz v0.14.3 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/davecgh/go-spew v1.1.1 // indirect
chore(deps): update Syft to v0.78.0 (#1242) * chore(deps): update Syft to v0.78.0 Signed-off-by: GitHub <noreply@github.com> * fix test location references and package types Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2023-04-19 17:38:06 +00:00
github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da // indirect
chore(deps): bump github.com/anchore/syft from 0.75.0 to 0.76.0 (#1207) * chore(deps): bump github.com/anchore/syft from 0.75.0 to 0.76.0 Bumps [github.com/anchore/syft](https://github.com/anchore/syft) from 0.75.0 to 0.76.0. - [Release notes](https://github.com/anchore/syft/releases) - [Changelog](https://github.com/anchore/syft/blob/main/.goreleaser.yaml) - [Commits](https://github.com/anchore/syft/compare/v0.75.0...v0.76.0) --- updated-dependencies: - dependency-name: github.com/anchore/syft dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore: update ParseInput signature with new syft version Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * fix: update integration tests Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-03 14:48:33 +00:00
github.com/docker/cli v23.0.1+incompatible // indirect
update grype to use syft v0.52.0 (#838)
2022-07-22 16:12:18 +00:00
github.com/docker/distribution v2.8.1+incompatible // indirect
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
github.com/docker/docker-credential-helpers v0.7.0 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/docker/go-connections v0.4.0 // indirect
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
github.com/docker/go-units v0.5.0 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 // indirect
chore(deps): update Syft to v0.78.0 (#1242) * chore(deps): update Syft to v0.78.0 Signed-off-by: GitHub <noreply@github.com> * fix test location references and package types Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2023-04-19 17:38:06 +00:00
github.com/emirpasic/gods v1.18.1 // indirect
chore(deps): bump github.com/pkg/profile from 1.6.0 to 1.7.0 (#1079) Bumps [github.com/pkg/profile](https://github.com/pkg/profile) from 1.6.0 to 1.7.0. - [Release notes](https://github.com/pkg/profile/releases) - [Commits](https://github.com/pkg/profile/compare/v1.6.0...v1.7.0) --- updated-dependencies: - dependency-name: github.com/pkg/profile dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-01-25 17:21:34 +00:00
github.com/felixge/fgprof v0.9.3 // indirect
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
github.com/fsnotify/fsnotify v1.6.0 // indirect
chore(deps): update Syft to v0.78.0 (#1242) * chore(deps): update Syft to v0.78.0 Signed-off-by: GitHub <noreply@github.com> * fix test location references and package types Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2023-04-19 17:38:06 +00:00
github.com/go-git/gcfg v1.5.0 // indirect
github.com/go-git/go-billy/v5 v5.4.1 // indirect
github.com/go-git/go-git/v5 v5.6.1 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/go-restruct/restruct v1.2.0-alpha // indirect
github.com/gogo/protobuf v1.3.2 // indirect
Bump syft to release version v0.39.0 (#645) * bump syft to v0.39.0 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update ByCriteria to log error on failure Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * integration tests now pass Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * bump to v0.39.3 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * raise search failures to warn Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * tidy go.mod/sum Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-26 22:28:08 +00:00
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
chore(deps): bump github.com/anchore/syft from 0.75.0 to 0.76.0 (#1207) * chore(deps): bump github.com/anchore/syft from 0.75.0 to 0.76.0 Bumps [github.com/anchore/syft](https://github.com/anchore/syft) from 0.75.0 to 0.76.0. - [Release notes](https://github.com/anchore/syft/releases) - [Changelog](https://github.com/anchore/syft/blob/main/.goreleaser.yaml) - [Commits](https://github.com/anchore/syft/compare/v0.75.0...v0.76.0) --- updated-dependencies: - dependency-name: github.com/anchore/syft dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore: update ParseInput signature with new syft version Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * fix: update integration tests Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-03 14:48:33 +00:00
github.com/golang/protobuf v1.5.3 // indirect
Bump syft to release version v0.39.0 (#645) * bump syft to v0.39.0 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update ByCriteria to log error on failure Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * integration tests now pass Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * bump to v0.39.3 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * raise search failures to warn Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * tidy go.mod/sum Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-26 22:28:08 +00:00
github.com/golang/snappy v0.0.4 // indirect
chore(deps): bump github.com/anchore/syft from 0.75.0 to 0.76.0 (#1207) * chore(deps): bump github.com/anchore/syft from 0.75.0 to 0.76.0 Bumps [github.com/anchore/syft](https://github.com/anchore/syft) from 0.75.0 to 0.76.0. - [Release notes](https://github.com/anchore/syft/releases) - [Changelog](https://github.com/anchore/syft/blob/main/.goreleaser.yaml) - [Commits](https://github.com/anchore/syft/compare/v0.75.0...v0.76.0) --- updated-dependencies: - dependency-name: github.com/anchore/syft dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore: update ParseInput signature with new syft version Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * fix: update integration tests Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-03 14:48:33 +00:00
github.com/google/go-containerregistry v0.14.0 // indirect
github.com/google/licensecheck v0.3.1 // indirect
chore: bump syft to latest version v0.79.0 (#1250) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-21 16:58:02 +00:00
github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.2.3 // indirect
github.com/googleapis/gax-go/v2 v2.7.1 // indirect
Bump syft to release version v0.39.0 (#645) * bump syft to v0.39.0 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update ByCriteria to log error on failure Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * integration tests now pass Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * bump to v0.39.3 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * raise search failures to warn Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * tidy go.mod/sum Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-26 22:28:08 +00:00
github.com/hashicorp/errwrap v1.1.0 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/hashicorp/go-safetemp v1.0.0 // indirect
github.com/hashicorp/hcl v1.0.0 // indirect
chore(deps): bump github.com/Masterminds/sprig/v3 from 3.2.2 to 3.2.3 (#1083) Bumps [github.com/Masterminds/sprig/v3](https://github.com/Masterminds/sprig) from 3.2.2 to 3.2.3. - [Release notes](https://github.com/Masterminds/sprig/releases) - [Changelog](https://github.com/Masterminds/sprig/blob/master/CHANGELOG.md) - [Commits](https://github.com/Masterminds/sprig/compare/v3.2.2...v3.2.3) --- updated-dependencies: - dependency-name: github.com/Masterminds/sprig/v3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-01-25 17:17:03 +00:00
github.com/huandu/xstrings v1.3.3 // indirect
chore(deps): update Syft to v0.78.0 (#1242) * chore(deps): update Syft to v0.78.0 Signed-off-by: GitHub <noreply@github.com> * fix test location references and package types Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2023-04-19 17:38:06 +00:00
github.com/imdario/mergo v0.3.13 // indirect
chore(deps): bump github.com/anchore/syft from 0.75.0 to 0.76.0 (#1207) * chore(deps): bump github.com/anchore/syft from 0.75.0 to 0.76.0 Bumps [github.com/anchore/syft](https://github.com/anchore/syft) from 0.75.0 to 0.76.0. - [Release notes](https://github.com/anchore/syft/releases) - [Changelog](https://github.com/anchore/syft/blob/main/.goreleaser.yaml) - [Commits](https://github.com/anchore/syft/compare/v0.75.0...v0.76.0) --- updated-dependencies: - dependency-name: github.com/anchore/syft dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore: update ParseInput signature with new syft version Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * fix: update integration tests Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-03 14:48:33 +00:00
github.com/inconshreveable/mousetrap v1.1.0 // indirect
chore(deps): update Syft to v0.78.0 (#1242) * chore(deps): update Syft to v0.78.0 Signed-off-by: GitHub <noreply@github.com> * fix test location references and package types Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2023-04-19 17:38:06 +00:00
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
github.com/jinzhu/copier v0.3.5 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/jinzhu/inflection v1.0.0 // indirect
chore: bump syft to latest version v0.79.0 (#1250) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-21 16:58:02 +00:00
github.com/jinzhu/now v1.1.5 // indirect
Bump syft to release version v0.39.0 (#645) * bump syft to v0.39.0 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update ByCriteria to log error on failure Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * integration tests now pass Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * bump to v0.39.3 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * raise search failures to warn Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * tidy go.mod/sum Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-26 22:28:08 +00:00
github.com/jmespath/go-jmespath v0.4.0 // indirect
use anchore fork of glebarez/sqlite (#778) This overcomes an issue with duplicate registration of sqlite drivers between glebarez/sqlite and knqyf263/go-rpmdb by just using modernc.org/sqlite directly within our fork Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
2022-06-08 13:41:15 +00:00
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
chore(deps): update Syft to v0.78.0 (#1242) * chore(deps): update Syft to v0.78.0 Signed-off-by: GitHub <noreply@github.com> * fix test location references and package types Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2023-04-19 17:38:06 +00:00
github.com/kevinburke/ssh_config v1.2.0 // indirect
chore: bump syft to latest version v0.79.0 (#1250) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-21 16:58:02 +00:00
github.com/klauspost/compress v1.16.4 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/klauspost/pgzip v1.2.5 // indirect
chore: update syft to v0.60.3 (#978)
2022-11-03 16:19:03 +00:00
github.com/knqyf263/go-rpmdb v0.0.0-20221030135625-4082a22221ce // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/logrusorgru/aurora v0.0.0-20200102142835-e9ef32dff381 // indirect
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
github.com/magiconair/properties v1.8.7 // indirect
chore: update syft to v0.60.3 (#978)
2022-11-03 16:19:03 +00:00
github.com/mattn/go-colorable v0.1.13 // indirect
chore: bump syft to latest version v0.79.0 (#1250) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-21 16:58:02 +00:00
github.com/mattn/go-isatty v0.0.18 // indirect
Bump syft to release version v0.39.0 (#645) * bump syft to v0.39.0 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update ByCriteria to log error on failure Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * integration tests now pass Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * bump to v0.39.3 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * raise search failures to warn Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * tidy go.mod/sum Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-26 22:28:08 +00:00
github.com/mattn/go-runewidth v0.0.13 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
Update Syft to v0.53.4 (#856)
2022-08-04 13:37:48 +00:00
github.com/microsoft/go-rustaudit v0.0.0-20220730194248-4b17361d90a5 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/mitchellh/copystructure v1.2.0 // indirect
Bump syft to release version v0.39.0 (#645) * bump syft to v0.39.0 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update ByCriteria to log error on failure Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * integration tests now pass Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * bump to v0.39.3 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * raise search failures to warn Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * tidy go.mod/sum Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-26 22:28:08 +00:00
github.com/mitchellh/go-testing-interface v1.14.1 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/mitchellh/reflectwalk v1.0.2 // indirect
github.com/nwaples/rardecode v1.1.0 // indirect
chore: prune cosign dependency for grype builds (#1100) * feat: segment cosign dependency for grype builds for faster build times Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-01-31 16:42:40 +00:00
github.com/onsi/ginkgo v1.16.5 // indirect
github.com/onsi/gomega v1.19.0 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/opencontainers/go-digest v1.0.0 // indirect
chore: bump syft to latest version v0.79.0 (#1250) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-21 16:58:02 +00:00
github.com/opencontainers/image-spec v1.1.0-rc2.0.20221005185240-3a7f492d3f1b // indirect
update syft version to v0.47.0 (#781)
2022-06-09 20:03:14 +00:00
github.com/pelletier/go-toml v1.9.5 // indirect
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
github.com/pelletier/go-toml/v2 v2.0.6 // indirect
Update Syft to v0.55.0 (#906) Co-authored-by: kzantow <kzantow@users.noreply.github.com>
2022-08-30 13:18:17 +00:00
github.com/pierrec/lz4/v4 v4.1.15 // indirect
chore(deps): update Syft to v0.78.0 (#1242) * chore(deps): update Syft to v0.78.0 Signed-off-by: GitHub <noreply@github.com> * fix test location references and package types Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2023-04-19 17:38:06 +00:00
github.com/pjbgf/sha1cd v0.3.0 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/pkg/errors v0.9.1 // indirect
github.com/pmezard/go-difflib v1.0.0 // indirect
chore: bump syft to latest version v0.79.0 (#1250) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-21 16:58:02 +00:00
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
Bump syft to release version v0.39.0 (#645) * bump syft to v0.39.0 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update ByCriteria to log error on failure Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * integration tests now pass Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * bump to v0.39.3 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * raise search failures to warn Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * tidy go.mod/sum Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-26 22:28:08 +00:00
github.com/rivo/uniseg v0.2.0 // indirect
Add support for scanning RPM files (#917)
2022-09-09 18:56:37 +00:00
github.com/sassoftware/go-rpmutils v0.2.0 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/shopspring/decimal v1.2.0 // indirect
chore(deps): update Syft to v0.78.0 (#1242) * chore(deps): update Syft to v0.78.0 Signed-off-by: GitHub <noreply@github.com> * fix test location references and package types Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2023-04-19 17:38:06 +00:00
github.com/skeema/knownhosts v1.1.0 // indirect
github.com/spdx/tools-golang v0.5.0 // indirect
update syft version to v0.47.0 (#781)
2022-06-09 20:03:14 +00:00
github.com/spf13/cast v1.5.0 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/spf13/jwalterweatherman v1.1.0 // indirect
Update Syft to v0.64.0 (#1047)
2022-12-23 21:33:08 +00:00
github.com/stretchr/objx v0.5.0 // indirect
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
github.com/subosito/gotenv v1.4.2 // indirect
Update Syft to v0.59.0 (#957)
2022-10-17 20:07:39 +00:00
github.com/sylabs/sif/v2 v2.8.1 // indirect
Update Syft to v0.55.0 (#906) Co-authored-by: kzantow <kzantow@users.noreply.github.com>
2022-08-30 13:18:17 +00:00
github.com/sylabs/squashfs v0.6.1 // indirect
Update Syft to v0.53.4 (#856)
2022-08-04 13:37:48 +00:00
github.com/therootcompany/xz v1.0.1 // indirect
Bump syft to release version v0.39.0 (#645) * bump syft to v0.39.0 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update ByCriteria to log error on failure Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * integration tests now pass Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * bump to v0.39.3 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * raise search failures to warn Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * tidy go.mod/sum Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-26 22:28:08 +00:00
github.com/ulikunitz/xz v0.5.10 // indirect
chore(deps): bump github.com/anchore/syft from 0.75.0 to 0.76.0 (#1207) * chore(deps): bump github.com/anchore/syft from 0.75.0 to 0.76.0 Bumps [github.com/anchore/syft](https://github.com/anchore/syft) from 0.75.0 to 0.76.0. - [Release notes](https://github.com/anchore/syft/releases) - [Changelog](https://github.com/anchore/syft/blob/main/.goreleaser.yaml) - [Commits](https://github.com/anchore/syft/compare/v0.75.0...v0.76.0) --- updated-dependencies: - dependency-name: github.com/anchore/syft dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore: update ParseInput signature with new syft version Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * fix: update integration tests Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-03 14:48:33 +00:00
github.com/vbatts/go-mtree v0.5.3 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/vbatts/tar-split v0.11.2 // indirect
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
github.com/vifraa/gopom v0.2.1 // indirect
chore(deps): update Syft to v0.78.0 (#1242) * chore(deps): update Syft to v0.78.0 Signed-off-by: GitHub <noreply@github.com> * fix test location references and package types Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2023-04-19 17:38:06 +00:00
github.com/xanzy/ssh-agent v0.3.3 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778 // indirect
Add SARIF presenter option (#654)
2022-03-14 16:13:37 +00:00
github.com/zclconf/go-cty v1.10.0 // indirect
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
go.opencensus.io v0.24.0 // indirect
chore: prune cosign dependency for grype builds (#1100) * feat: segment cosign dependency for grype builds for faster build times Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-01-31 16:42:40 +00:00
go.uber.org/goleak v1.2.0 // indirect
chore(deps): update Syft to v0.78.0 (#1242) * chore(deps): update Syft to v0.78.0 Signed-off-by: GitHub <noreply@github.com> * fix test location references and package types Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2023-04-19 17:38:06 +00:00
golang.org/x/crypto v0.6.0 // indirect
Update Syft to v0.71.0 (#1126)
2023-02-10 15:14:01 +00:00
golang.org/x/exp v0.0.0-20230202163644-54bba9f4231b // indirect
chore(deps): update Syft to v0.78.0 (#1242) * chore(deps): update Syft to v0.78.0 Signed-off-by: GitHub <noreply@github.com> * fix test location references and package types Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2023-04-19 17:38:06 +00:00
golang.org/x/mod v0.10.0 // indirect
golang.org/x/net v0.9.0 // indirect
chore(deps): bump github.com/anchore/syft from 0.75.0 to 0.76.0 (#1207) * chore(deps): bump github.com/anchore/syft from 0.75.0 to 0.76.0 Bumps [github.com/anchore/syft](https://github.com/anchore/syft) from 0.75.0 to 0.76.0. - [Release notes](https://github.com/anchore/syft/releases) - [Changelog](https://github.com/anchore/syft/blob/main/.goreleaser.yaml) - [Commits](https://github.com/anchore/syft/compare/v0.75.0...v0.76.0) --- updated-dependencies: - dependency-name: github.com/anchore/syft dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore: update ParseInput signature with new syft version Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * fix: update integration tests Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-03 14:48:33 +00:00
golang.org/x/oauth2 v0.6.0 // indirect
Optionally orient results by CVE (#1020) Co-authored-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-12-08 20:22:40 +00:00
golang.org/x/sync v0.1.0 // indirect
chore(deps): bump golang.org/x/term from 0.6.0 to 0.7.0 (#1217) Bumps [golang.org/x/term](https://github.com/golang/term) from 0.6.0 to 0.7.0. - [Release notes](https://github.com/golang/term/releases) - [Commits](https://github.com/golang/term/compare/v0.6.0...v0.7.0) --- updated-dependencies: - dependency-name: golang.org/x/term dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-04-05 23:05:38 +00:00
golang.org/x/sys v0.7.0 // indirect
chore(deps): update Syft to v0.78.0 (#1242) * chore(deps): update Syft to v0.78.0 Signed-off-by: GitHub <noreply@github.com> * fix test location references and package types Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2023-04-19 17:38:06 +00:00
golang.org/x/text v0.9.0 // indirect
chore(deps): bump github.com/sigstore/sigstore from 1.4.4 to 1.5.1 (#1081) Bumps [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) from 1.4.4 to 1.5.1. - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](https://github.com/sigstore/sigstore/compare/v1.4.4...v1.5.1) --- updated-dependencies: - dependency-name: github.com/sigstore/sigstore dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-01-25 19:42:48 +00:00
golang.org/x/time v0.2.0 // indirect
chore: bump syft to latest version v0.79.0 (#1250) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-21 16:58:02 +00:00
golang.org/x/tools v0.8.0 // indirect
chore: update syft to v0.60.3 (#978)
2022-11-03 16:19:03 +00:00
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
chore: bump syft to latest version v0.79.0 (#1250) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-21 16:58:02 +00:00
google.golang.org/api v0.114.0 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
google.golang.org/appengine v1.6.7 // indirect
chore: bump syft to latest version v0.79.0 (#1250) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-21 16:58:02 +00:00
google.golang.org/genproto v0.0.0-20230403163135-c38d8f061ccd // indirect
google.golang.org/grpc v1.54.0 // indirect
google.golang.org/protobuf v1.30.0 // indirect
Update Syft to v0.55.0 (#906) Co-authored-by: kzantow <kzantow@users.noreply.github.com>
2022-08-30 13:18:17 +00:00
gopkg.in/ini.v1 v1.67.0 // indirect
chore(deps): update Syft to v0.78.0 (#1242) * chore(deps): update Syft to v0.78.0 Signed-off-by: GitHub <noreply@github.com> * fix test location references and package types Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2023-04-19 17:38:06 +00:00
gopkg.in/warnings.v0 v0.1.2 // indirect
update grype to use syft v0.52.0 (#838)
2022-07-22 16:12:18 +00:00
gopkg.in/yaml.v3 v3.0.1 // indirect
chore: bump syft to latest version v0.79.0 (#1250) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-21 16:58:02 +00:00
lukechampine.com/uint128 v1.3.0 // indirect
modernc.org/cc/v3 v3.40.0 // indirect
modernc.org/ccgo/v3 v3.16.13 // indirect
modernc.org/libc v1.22.4 // indirect
modernc.org/mathutil v1.5.0 // indirect
modernc.org/memory v1.5.0 // indirect
modernc.org/opt v0.1.3 // indirect
modernc.org/sqlite v1.21.2 // indirect
modernc.org/strutil v1.1.3 // indirect
modernc.org/token v1.1.0 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
)
Reference in a new issue Copy permalink