Mirrors/grype
2
0
Fork 0
mirror of https://github.com/anchore/grype synced 2024-11-14 00:07:08 +00:00
Code Issues Projects Releases Packages Wiki Activity
grype/go.mod

261 lines
13 KiB
Modula-2
Raw Normal View History

rename to grype
2020-07-24 01:29:05 +00:00
module github.com/anchore/grype
initial project structure
2020-05-26 14:37:28 +00:00
chore: Update go declaration to have point version (#1484) Our understanding is that without the patch version, every run of "go mod tidy" will write a toolchain directive in the file, which will result in a diff from contributors with different point versions of go, which is noisy and prone to breaking CI. Signed-off-by: Will Murphy <will.murphy@anchore.com>
2023-09-11 12:08:53 +00:00
go 1.21.1
initial project structure
2020-05-26 14:37:28 +00:00
require (
Upgrade syft to v0.91.0 (#1508) * bump syft to main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgdate cyclonedx presenter fixtures (bump from cdx 1.4 to 1.5) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * allow for pkg type exceptions for github actions and workflows Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx json schema from v1.4 to v1.5 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump to syft v0.91.0 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgrade go-setup action to v4 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove asset upload from release workflow Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-09-20 20:39:23 +00:00
github.com/CycloneDX/cyclonedx-go v0.7.2
chore(deps): bump github.com/Masterminds/sprig/v3 from 3.2.2 to 3.2.3 (#1083) Bumps [github.com/Masterminds/sprig/v3](https://github.com/Masterminds/sprig) from 3.2.2 to 3.2.3. - [Release notes](https://github.com/Masterminds/sprig/releases) - [Changelog](https://github.com/Masterminds/sprig/blob/master/CHANGELOG.md) - [Commits](https://github.com/Masterminds/sprig/compare/v3.2.2...v3.2.3) --- updated-dependencies: - dependency-name: github.com/Masterminds/sprig/v3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-01-25 17:17:03 +00:00
github.com/Masterminds/sprig/v3 v3.2.3
update syft and stereoscope to pull in registry source Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
2021-04-13 20:08:02 +00:00
github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
github.com/adrg/xdg v0.4.0
Add registry certificate verification support (#1232) * add registry certificate verification support * modify go.mod * rename registry cert options, add docs, and add test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update to account for changes in anchore/stereoscope#195 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: lishituo <24578666@qq.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-08-29 15:51:27 +00:00
github.com/anchore/bubbly v0.0.0-20230801194016-acdb4981b461
bump clio to get stderr reporting fix (#1561) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-10-16 15:58:02 +00:00
github.com/anchore/clio v0.0.0-20231016125544-c98a83e1c7fc
chore(deps): update Syft to v0.89.0 (#1472) Signed-off-by: GitHub <noreply@github.com> Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
2023-08-31 16:02:11 +00:00
github.com/anchore/go-logger v0.0.0-20230725134548-c21dafa1ec5a
always return a cleanup function from scope (#166) Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
2020-09-25 20:29:15 +00:00
github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
Match against Alpine source packages (#407) * Update go-version package and add test This is being updated due to an issue that was encountered in the lessThanEqual constraint in go-version: https://github.com/anchore/go-version/pull/2. Was disovered while adding tests for apk origin package matching Signed-off-by: Zane Burstein <zane.burstein@anchore.com> * Added matching with source package for apk This change allows grype to match with a packages source package for apk. Adds APKMetadata with OriginPackage, new matching logic in apk matchers, and tests Signed-off-by: Zane Burstein <zane.burstein@anchore.com>
2021-09-09 11:42:11 +00:00
github.com/anchore/go-version v1.2.2-0.20210903204242-51efa5b487c4
chore: update Syft to v0.66.2 (#1060)
2023-01-18 17:50:46 +00:00
github.com/anchore/packageurl-go v0.1.1-0.20230104203445-02e0a6721501
chore(deps): update Syft to v0.97.1 (#1610) Signed-off-by: GitHub <noreply@github.com> Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
2023-11-17 21:27:07 +00:00
github.com/anchore/stereoscope v0.0.0-20231117203853-3610f4ef3e83
github.com/anchore/syft v0.97.1
fix: use PEP440 for Python package version comparison (#1510) Previously, grype used fuzzy matcher for Python packages, since there are cases in PEP440 that are not strictly semver. Switch to a library that does PEP440 parsing and comparison for python version constraints. Signed-off-by: Will Murphy <will.murphy@anchore.com>
2023-09-22 17:32:48 +00:00
github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46
Feature: Specifying ignore rules for vulnerability matches (#430) * Preliminary implementation of ignore rules Signed-off-by: Dan Luhring <dan.luhring@anchore.com> * Support ignoring matches by package type Signed-off-by: Dan Luhring <dan.luhring@anchore.com> * Add tests for ignore functionality Signed-off-by: Dan Luhring <dan.luhring@anchore.com> * Add documentation for ignore rules and clean up README Signed-off-by: Dan Luhring <dan.luhring@anchore.com> * Add test for glob location matching Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
2021-09-29 19:44:36 +00:00
github.com/bmatcuk/doublestar/v2 v2.0.4
Add registry certificate verification support (#1232) * add registry certificate verification support * modify go.mod * rename registry cert options, add docs, and add test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update to account for changes in anchore/stereoscope#195 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: lishituo <24578666@qq.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-08-29 15:51:27 +00:00
github.com/charmbracelet/bubbletea v0.24.2
chore(deps): bump github.com/charmbracelet/lipgloss from 0.9.0 to 0.9.1 (#1557) Bumps [github.com/charmbracelet/lipgloss](https://github.com/charmbracelet/lipgloss) from 0.9.0 to 0.9.1. - [Release notes](https://github.com/charmbracelet/lipgloss/releases) - [Commits](https://github.com/charmbracelet/lipgloss/compare/v0.9.0...v0.9.1) --- updated-dependencies: - dependency-name: github.com/charmbracelet/lipgloss dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-12 19:39:00 +00:00
github.com/charmbracelet/lipgloss v0.9.1
chore(deps): bump github.com/docker/docker (#1579) Bumps [github.com/docker/docker](https://github.com/docker/docker) from 24.0.6+incompatible to 24.0.7+incompatible. - [Release notes](https://github.com/docker/docker/releases) - [Commits](https://github.com/docker/docker/compare/v24.0.6...v24.0.7) --- updated-dependencies: - dependency-name: github.com/docker/docker dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-31 17:48:52 +00:00
github.com/docker/docker v24.0.7+incompatible
Update Syft to v0.68.1 (#1086) Signed-off-by: GitHub <noreply@github.com> Signed-off-by: GitHub <noreply@github.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com>
2023-01-26 10:07:49 +00:00
github.com/dustin/go-humanize v1.0.1
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
github.com/facebookincubator/nvdtools v0.1.5
chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.2 to 1.4.3 (#1558) Bumps [github.com/gabriel-vasile/mimetype](https://github.com/gabriel-vasile/mimetype) from 1.4.2 to 1.4.3. - [Release notes](https://github.com/gabriel-vasile/mimetype/releases) - [Commits](https://github.com/gabriel-vasile/mimetype/compare/v1.4.2...v1.4.3) --- updated-dependencies: - dependency-name: github.com/gabriel-vasile/mimetype dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-12 19:39:09 +00:00
github.com/gabriel-vasile/mimetype v1.4.3
chore(deps): bump github.com/gkampitakis/go-snaps from 0.4.11 to 0.4.12 (#1597) Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps) from 0.4.11 to 0.4.12. - [Release notes](https://github.com/gkampitakis/go-snaps/releases) - [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.4.11...v0.4.12) --- updated-dependencies: - dependency-name: github.com/gkampitakis/go-snaps dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-09 15:52:24 +00:00
github.com/gkampitakis/go-snaps v0.4.12
chore(deps): bump github.com/glebarez/sqlite from 1.9.0 to 1.10.0 (#1583) Bumps [github.com/glebarez/sqlite](https://github.com/glebarez/sqlite) from 1.9.0 to 1.10.0. - [Release notes](https://github.com/glebarez/sqlite/releases) - [Commits](https://github.com/glebarez/sqlite/compare/v1.9.0...v1.10.0) --- updated-dependencies: - dependency-name: github.com/glebarez/sqlite dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-30 17:39:54 +00:00
github.com/glebarez/sqlite v1.10.0
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
github.com/go-test/deep v1.1.0
chore(deps): bump github.com/google/go-cmp from 0.5.9 to 0.6.0 (#1552) Bumps [github.com/google/go-cmp](https://github.com/google/go-cmp) from 0.5.9 to 0.6.0. - [Release notes](https://github.com/google/go-cmp/releases) - [Commits](https://github.com/google/go-cmp/compare/v0.5.9...v0.6.0) --- updated-dependencies: - dependency-name: github.com/google/go-cmp dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-11 17:51:20 +00:00
github.com/google/go-cmp v0.6.0
Ignore/add match results based on OpenVEX documents (#1397) * go.mod: Pull OpenVEX go modules This commit pulls the OpenVEX libraries into the grype source. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add generic VEX processor package This commit adds a generic VEX processor package. It is implementation agnostic. It has a single option for now: The documents used to load the VEX data. The processor has a single method: ApplyVEX() which takes a set of scan results and applies VEX data to them. For now, the only modification that is done is filtering of results, that is moving results to the ignored list as a response to VEX documents. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * vex: Add OpenVEX processor implementation This commit adds an openvex implementation of the vex processor. It also wires the VEX processor to use it as default. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Table presenter: Highligt results suppressed by VEX This commit marks results suppressed by VEX when presenting them to the user. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Define VEX status constants This commit defines a set of local constants of each of the VEX statuses based on the openvex constants. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add VexStatus to ignore rules This commit modifies the ignore rules structure to support defining a vex status. Any rules defining vex are ignored by the standard ignore rules processing as they will be handled by the VEX processor. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add IgnoreRule HasConditions method Adds a new HasConditions method to the IgnoreRule object to check if the rule is empty. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Control VEX filtering through IgnoreRules This commit modifies how the vex processor is controlled. The processor now takes a list of IgnoreRules which can act on the VEX status in addition to the regular rule parameters. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * vex: Allow rules to match on VEX justification This commit expands the ingore rules to also work on vex the justification of not_affected statements. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Use go-vex merge implementation Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add OpenVEX matcher to matcher list This commit adds a new entry to the matchers: An openvex matcher This matcher is used when openvex augments results, moving matches from the ignore list to the active results. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add vex.AugmentMatches() to the vex processor This commit adds a new AugmentMatches() phase to the VEX processor. This new step goes throught the configured ignore rules and acts on any that have `affected` or `under_investigtion` as status. The purpose of this rule is to move matches back from the ignored matches list to the active results when a statement with either of those statuses apply to ignored matches. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Parse context identifiers using GGC This commit modifies the identifier synthesizer function to parse references using GGCR. It also adds a simple test. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Bump funlen linter to 73 This commit bumps the maximum function length to 73 to accomodate the new flag in AddFlags() Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@chainguard.dev> * Add VEX testing to matchers test This commit adds a new test and fixtures to test the VEX matchers along the rest of the matchers in TestMatchByImage(). As the VEX matchers operate on previously ignored matches a new loop was added to the test to accomodate the different testing model. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * add vex status and justification to ignored rule json model Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * nit rename + add TODO question about augmenting ignored matches Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * nit document comment updates + common variable extraction Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * migrate legacy matcher function to vulnerability matcher object Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update tui to respond to ignored and dropped matches Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * migrate vex processing to vulnerability match object Based on Alex's previous caommit Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Migrate VEX options and app config from legacy CLI Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * update table snapshot tests with suppressed vex entries Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for match.Matches.Diff() Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for vex processor Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting and restore global funlen rule Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove grpc pin Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * always return remaining and ignroed matches from matcher object Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * Add VEX documentation to main README This commit adds a VEX section to the main Grype README. It adds an example document and details on how vex rules can be written. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> --------- Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@chainguard.dev> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-09-13 19:26:12 +00:00
github.com/google/go-containerregistry v0.16.1
chore(deps): bump github.com/google/uuid from 1.3.1 to 1.4.0 (#1575) Bumps [github.com/google/uuid](https://github.com/google/uuid) from 1.3.1 to 1.4.0. - [Release notes](https://github.com/google/uuid/releases) - [Changelog](https://github.com/google/uuid/blob/master/CHANGELOG.md) - [Commits](https://github.com/google/uuid/compare/v1.3.1...v1.4.0) --- updated-dependencies: - dependency-name: github.com/google/uuid dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-26 17:30:37 +00:00
github.com/google/uuid v1.4.0
chore(deps): bump github.com/gookit/color from 1.5.3 to 1.5.4 (#1396) Bumps [github.com/gookit/color](https://github.com/gookit/color) from 1.5.3 to 1.5.4. - [Release notes](https://github.com/gookit/color/releases) - [Commits](https://github.com/gookit/color/compare/v1.5.3...v1.5.4) --- updated-dependencies: - dependency-name: github.com/gookit/color dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-07-20 16:28:06 +00:00
github.com/gookit/color v1.5.4
Add registry certificate verification support (#1232) * add registry certificate verification support * modify go.mod * rename registry cert options, add docs, and add test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update to account for changes in anchore/stereoscope#195 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: lishituo <24578666@qq.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-08-29 15:51:27 +00:00
github.com/hako/durafmt v0.0.0-20210608085754-5c1018a4e16b
Support for private certificate authorities during DB curation (#494) * Add injectable HTTP client to file getter Signed-off-by: Dan Luhring <dan.luhring@anchore.com> * WIP: Map config for custom CA certs Signed-off-by: Dan Luhring <dan.luhring@anchore.com> * update curator and add tests Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add TLS helper scripts Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * remove grype-db local mod edit Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * tidy go modules Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * use ssl.context over deprecated fn Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * disallow tls 1 and 1.1 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * suppress non-archive sources for fetch-to-dir capability Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * ensure DB load failure does not panic Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * address review comments Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2021-11-22 16:59:38 +00:00
github.com/hashicorp/go-cleanhttp v0.5.2
chore(deps): bump github.com/hashicorp/go-getter from 1.7.2 to 1.7.3 (#1549) Bumps [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter) from 1.7.2 to 1.7.3. - [Release notes](https://github.com/hashicorp/go-getter/releases) - [Changelog](https://github.com/hashicorp/go-getter/blob/main/.goreleaser.yml) - [Commits](https://github.com/hashicorp/go-getter/compare/v1.7.2...v1.7.3) --- updated-dependencies: - dependency-name: github.com/hashicorp/go-getter dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-10 17:32:48 +00:00
github.com/hashicorp/go-getter v1.7.3
Bump syft to release version v0.39.0 (#645) * bump syft to v0.39.0 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update ByCriteria to log error on failure Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * integration tests now pass Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * bump to v0.39.3 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * raise search failures to warn Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * tidy go.mod/sum Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-26 22:28:08 +00:00
github.com/hashicorp/go-multierror v1.1.1
update golanci-lint, goreleaser, cosign (#850)
2022-07-28 18:55:14 +00:00
github.com/hashicorp/go-version v1.6.0
Add APK version constraint parsing (#455) Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
2021-10-18 17:27:02 +00:00
github.com/knqyf263/go-apk-version v0.0.0-20200609155635-041fdbb8563f
add version & version constraint support
2020-06-01 11:13:53 +00:00
github.com/knqyf263/go-deb-version v0.0.0-20190517075300-09fca494f03d
Colorize severity in table output (#1284) * Colorize severity in table output - Create flag "--no-color" to allow disabling the color. By default its enabled. - When "--no-color" not specified highlight severity in its color: - Critical -> Bold Red - High -> Red - Medium -> Yellow - Low -> Green - Negligible -> Blue - Note: Golang doesn't have all colors available. Also, doesn't seem to be able use hex codes properly. - Add termenv to check if the terminal color profile supports colored output. If it doesn't default to noColor Closes #225 Signed-off-by: Shane Dell <shanedell100@gmail.com> * fix: adopt EnvColorProfile to support NO_COLOR Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * fix linting and update snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Shane Dell <shanedell100@gmail.com> Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-10-30 13:57:46 +00:00
github.com/masahiro331/go-mvn-version v0.0.0-20210429150710-d3157d602a08
Add additional DB archive decompressors (#657)
2022-03-07 16:44:43 +00:00
github.com/mholt/archiver/v3 v3.5.1
initial project structure
2020-05-26 14:37:28 +00:00
github.com/mitchellh/go-homedir v1.1.0
Add ability to merge matches (#602) * enable merging of matches Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add ability for matches constructor to take initial matches Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update tests to include IDs on package objects Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * rename common matcher helper package to search package Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * rename search functions and add SearchByCriteria Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * cleanup imports Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
2022-01-25 15:29:16 +00:00
github.com/mitchellh/hashstructure/v2 v2.0.2
Add registry certificate verification support (#1232) * add registry certificate verification support * modify go.mod * rename registry cert options, add docs, and add test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update to account for changes in anchore/stereoscope#195 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: lishituo <24578666@qq.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-08-29 15:51:27 +00:00
github.com/mitchellh/mapstructure v1.5.0
Bump syft to release version v0.39.0 (#645) * bump syft to v0.39.0 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update ByCriteria to log error on failure Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * integration tests now pass Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * bump to v0.39.3 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * raise search failures to warn Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * tidy go.mod/sum Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-26 22:28:08 +00:00
github.com/olekukonko/tablewriter v0.0.5
Ignore/add match results based on OpenVEX documents (#1397) * go.mod: Pull OpenVEX go modules This commit pulls the OpenVEX libraries into the grype source. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add generic VEX processor package This commit adds a generic VEX processor package. It is implementation agnostic. It has a single option for now: The documents used to load the VEX data. The processor has a single method: ApplyVEX() which takes a set of scan results and applies VEX data to them. For now, the only modification that is done is filtering of results, that is moving results to the ignored list as a response to VEX documents. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * vex: Add OpenVEX processor implementation This commit adds an openvex implementation of the vex processor. It also wires the VEX processor to use it as default. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Table presenter: Highligt results suppressed by VEX This commit marks results suppressed by VEX when presenting them to the user. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Define VEX status constants This commit defines a set of local constants of each of the VEX statuses based on the openvex constants. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add VexStatus to ignore rules This commit modifies the ignore rules structure to support defining a vex status. Any rules defining vex are ignored by the standard ignore rules processing as they will be handled by the VEX processor. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add IgnoreRule HasConditions method Adds a new HasConditions method to the IgnoreRule object to check if the rule is empty. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Control VEX filtering through IgnoreRules This commit modifies how the vex processor is controlled. The processor now takes a list of IgnoreRules which can act on the VEX status in addition to the regular rule parameters. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * vex: Allow rules to match on VEX justification This commit expands the ingore rules to also work on vex the justification of not_affected statements. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Use go-vex merge implementation Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add OpenVEX matcher to matcher list This commit adds a new entry to the matchers: An openvex matcher This matcher is used when openvex augments results, moving matches from the ignore list to the active results. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add vex.AugmentMatches() to the vex processor This commit adds a new AugmentMatches() phase to the VEX processor. This new step goes throught the configured ignore rules and acts on any that have `affected` or `under_investigtion` as status. The purpose of this rule is to move matches back from the ignored matches list to the active results when a statement with either of those statuses apply to ignored matches. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Parse context identifiers using GGC This commit modifies the identifier synthesizer function to parse references using GGCR. It also adds a simple test. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Bump funlen linter to 73 This commit bumps the maximum function length to 73 to accomodate the new flag in AddFlags() Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@chainguard.dev> * Add VEX testing to matchers test This commit adds a new test and fixtures to test the VEX matchers along the rest of the matchers in TestMatchByImage(). As the VEX matchers operate on previously ignored matches a new loop was added to the test to accomodate the different testing model. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * add vex status and justification to ignored rule json model Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * nit rename + add TODO question about augmenting ignored matches Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * nit document comment updates + common variable extraction Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * migrate legacy matcher function to vulnerability matcher object Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update tui to respond to ignored and dropped matches Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * migrate vex processing to vulnerability match object Based on Alex's previous caommit Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Migrate VEX options and app config from legacy CLI Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * update table snapshot tests with suppressed vex entries Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for match.Matches.Diff() Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for vex processor Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting and restore global funlen rule Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove grpc pin Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * always return remaining and ignroed matches from matcher object Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * Add VEX documentation to main README This commit adds a VEX section to the main Grype README. It adds an example document and details on how vex rules can be written. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> --------- Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@chainguard.dev> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-09-13 19:26:12 +00:00
github.com/openvex/go-vex v0.2.5
Colorize severity in table output (#1284) * Colorize severity in table output - Create flag "--no-color" to allow disabling the color. By default its enabled. - When "--no-color" not specified highlight severity in its color: - Critical -> Bold Red - High -> Red - Medium -> Yellow - Low -> Green - Negligible -> Blue - Note: Golang doesn't have all colors available. Also, doesn't seem to be able use hex codes properly. - Add termenv to check if the terminal color profile supports colored output. If it doesn't default to noColor Closes #225 Signed-off-by: Shane Dell <shanedell100@gmail.com> * fix: adopt EnvColorProfile to support NO_COLOR Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * fix linting and update snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Shane Dell <shanedell100@gmail.com> Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-10-30 13:57:46 +00:00
github.com/owenrumney/go-sarif v1.1.2-0.20231003122901-1000f5e05554
Bump strset version to fix 386 builds (#689)
2022-03-23 18:27:11 +00:00
// pinned to pull in 386 arch fix: https://github.com/scylladb/go-set/commit/cc7b2070d91ebf40d233207b633e28f5bd8f03a5
github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
github.com/sergi/go-diff v1.3.1
chore(deps): bump github.com/sirupsen/logrus from 1.9.2 to 1.9.3 (#1336) Bumps [github.com/sirupsen/logrus](https://github.com/sirupsen/logrus) from 1.9.2 to 1.9.3. - [Release notes](https://github.com/sirupsen/logrus/releases) - [Changelog](https://github.com/sirupsen/logrus/blob/master/CHANGELOG.md) - [Commits](https://github.com/sirupsen/logrus/compare/v1.9.2...v1.9.3) --- updated-dependencies: - dependency-name: github.com/sirupsen/logrus dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-05 16:50:01 +00:00
github.com/sirupsen/logrus v1.9.3
chore(deps): bump github.com/spf13/afero from 1.9.5 to 1.10.0 (#1514) Bumps [github.com/spf13/afero](https://github.com/spf13/afero) from 1.9.5 to 1.10.0. - [Release notes](https://github.com/spf13/afero/releases) - [Commits](https://github.com/spf13/afero/compare/v1.9.5...v1.10.0) --- updated-dependencies: - dependency-name: github.com/spf13/afero dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-09-22 17:34:47 +00:00
github.com/spf13/afero v1.10.0
chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (#1586) Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra) from 1.7.0 to 1.8.0. - [Release notes](https://github.com/spf13/cobra/releases) - [Commits](https://github.com/spf13/cobra/compare/v1.7.0...v1.8.0) --- updated-dependencies: - dependency-name: github.com/spf13/cobra dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-07 02:55:53 +00:00
github.com/spf13/cobra v1.8.0
chore(deps): bump github.com/stretchr/testify from 1.8.3 to 1.8.4 (#1324) Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.8.3 to 1.8.4. - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](https://github.com/stretchr/testify/compare/v1.8.3...v1.8.4) --- updated-dependencies: - dependency-name: github.com/stretchr/testify dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-05-30 16:42:46 +00:00
github.com/stretchr/testify v1.8.4
chore(deps): update Syft to v0.85.0 (#1383)
2023-07-13 15:06:41 +00:00
github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651
Add registry certificate verification support (#1232) * add registry certificate verification support * modify go.mod * rename registry cert options, add docs, and add test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update to account for changes in anchore/stereoscope#195 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: lishituo <24578666@qq.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-08-29 15:51:27 +00:00
github.com/wagoodman/go-presenter v0.0.0-20211015174752-f9c01afc824b
chore: bump stereoscope to fix data race in UI (#1517) Pulls in a fix to go-progress so that scanning large images no longer results in a data race in the UI code. Signed-off-by: Will Murphy <will.murphy@anchore.com>
2023-09-25 15:56:51 +00:00
github.com/wagoodman/go-progress v0.0.0-20230925121702-07e42b3cdba0
replace zap logger with logrus (#80)
2020-08-01 15:58:10 +00:00
github.com/x-cray/logrus-prefixed-formatter v0.5.2
chore(deps): bump github.com/charmbracelet/lipgloss from 0.8.0 to 0.9.0 (#1548) Bumps [github.com/charmbracelet/lipgloss](https://github.com/charmbracelet/lipgloss) from 0.8.0 to 0.9.0. - [Release notes](https://github.com/charmbracelet/lipgloss/releases) - [Commits](https://github.com/charmbracelet/lipgloss/compare/v0.8.0...v0.9.0) --- updated-dependencies: - dependency-name: github.com/charmbracelet/lipgloss dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-10 17:33:06 +00:00
golang.org/x/exp v0.0.0-20230905200255-921286631fa9
chore(deps): bump gorm.io/gorm from 1.25.4 to 1.25.5 (#1547) Bumps [gorm.io/gorm](https://github.com/go-gorm/gorm) from 1.25.4 to 1.25.5. - [Release notes](https://github.com/go-gorm/gorm/releases) - [Commits](https://github.com/go-gorm/gorm/compare/v1.25.4...v1.25.5) --- updated-dependencies: - dependency-name: gorm.io/gorm dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-10 17:33:26 +00:00
gorm.io/gorm v1.25.5
feat: add custom maven comparator (#1571) This PR takes the recommendation from #1526 and adapts the go-mvn-version to be used as a custom comparator for matching against packages that have the JavaPkg type. Packages of type JavaPkg will no longer use the stock matcher. --------- Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-10-27 18:24:56 +00:00
)
feat: update go-sarif library to use latest release (#1563) --------- Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-10-17 15:18:22 +00:00
chore: account for syft package metadata changes (#1423) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: Keith Zantow <kzantow@gmail.com> Co-authored-by: Keith Zantow <kzantow@gmail.com>
2023-11-07 20:17:36 +00:00
require github.com/dave/jennifer v1.7.0
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
require (
fix: bump fangs to enable setting golang CPE config using env var (#1585) * fix: bump fangs Bump fangs to pull in https://github.com/anchore/fangs/pull/27, which fixes an issue where env vars couldn't be used to set fields on embedded structs in the config struct. Signed-off-by: Will Murphy <will.murphy@anchore.com> * fix: bump fangs to pull in panic fix The previous fangs fix panicked when summarizing configs with embedded structs. Bump fangs to pull in https://github.com/anchore/fangs/pull/29 which fixes this panic. Signed-off-by: Will Murphy <will.murphy@anchore.com> * commit mod tidy Signed-off-by: Will Murphy <will.murphy@anchore.com> * Pull in dependency bumps from main to resolve conflicts Signed-off-by: Will Murphy <will.murphy@anchore.com> --------- Signed-off-by: Will Murphy <will.murphy@anchore.com>
2023-11-07 15:59:13 +00:00
cloud.google.com/go v0.110.7 // indirect
cloud.google.com/go/compute v1.23.0 // indirect
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
cloud.google.com/go/compute/metadata v0.2.3 // indirect
Incorporate format API changes from syft (#1582) * incorporate changes from anchore/syft#2228 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix testing utils to use syft SBOM Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-11-02 19:25:48 +00:00
cloud.google.com/go/iam v1.1.1 // indirect
cloud.google.com/go/storage v1.30.1 // indirect
chore(deps): update Syft to v0.86.1 (#1410) * chore(deps): update Syft to v0.86.0 Signed-off-by: GitHub <noreply@github.com> * fix python package metadata shape Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * account for new metadatas added in syft Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump syft to unreleased but fixed version Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
2023-07-31 17:58:36 +00:00
dario.cat/mergo v1.0.0 // indirect
Incorporate format API changes from syft (#1582) * incorporate changes from anchore/syft#2228 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix testing utils to use syft SBOM Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-11-02 19:25:48 +00:00
github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0 // indirect
Add support for scanning RPM files (#917)
2022-09-09 18:56:37 +00:00
github.com/DataDog/zstd v1.4.5 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/Masterminds/goutils v1.1.1 // indirect
bump syft to pre-release of v0.81.0 (#1310) Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
2023-05-22 14:17:34 +00:00
github.com/Masterminds/semver v1.5.0 // indirect
Ignore/add match results based on OpenVEX documents (#1397) * go.mod: Pull OpenVEX go modules This commit pulls the OpenVEX libraries into the grype source. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add generic VEX processor package This commit adds a generic VEX processor package. It is implementation agnostic. It has a single option for now: The documents used to load the VEX data. The processor has a single method: ApplyVEX() which takes a set of scan results and applies VEX data to them. For now, the only modification that is done is filtering of results, that is moving results to the ignored list as a response to VEX documents. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * vex: Add OpenVEX processor implementation This commit adds an openvex implementation of the vex processor. It also wires the VEX processor to use it as default. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Table presenter: Highligt results suppressed by VEX This commit marks results suppressed by VEX when presenting them to the user. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Define VEX status constants This commit defines a set of local constants of each of the VEX statuses based on the openvex constants. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add VexStatus to ignore rules This commit modifies the ignore rules structure to support defining a vex status. Any rules defining vex are ignored by the standard ignore rules processing as they will be handled by the VEX processor. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add IgnoreRule HasConditions method Adds a new HasConditions method to the IgnoreRule object to check if the rule is empty. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Control VEX filtering through IgnoreRules This commit modifies how the vex processor is controlled. The processor now takes a list of IgnoreRules which can act on the VEX status in addition to the regular rule parameters. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * vex: Allow rules to match on VEX justification This commit expands the ingore rules to also work on vex the justification of not_affected statements. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Use go-vex merge implementation Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add OpenVEX matcher to matcher list This commit adds a new entry to the matchers: An openvex matcher This matcher is used when openvex augments results, moving matches from the ignore list to the active results. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add vex.AugmentMatches() to the vex processor This commit adds a new AugmentMatches() phase to the VEX processor. This new step goes throught the configured ignore rules and acts on any that have `affected` or `under_investigtion` as status. The purpose of this rule is to move matches back from the ignored matches list to the active results when a statement with either of those statuses apply to ignored matches. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Parse context identifiers using GGC This commit modifies the identifier synthesizer function to parse references using GGCR. It also adds a simple test. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Bump funlen linter to 73 This commit bumps the maximum function length to 73 to accomodate the new flag in AddFlags() Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@chainguard.dev> * Add VEX testing to matchers test This commit adds a new test and fixtures to test the VEX matchers along the rest of the matchers in TestMatchByImage(). As the VEX matchers operate on previously ignored matches a new loop was added to the test to accomodate the different testing model. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * add vex status and justification to ignored rule json model Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * nit rename + add TODO question about augmenting ignored matches Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * nit document comment updates + common variable extraction Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * migrate legacy matcher function to vulnerability matcher object Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update tui to respond to ignored and dropped matches Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * migrate vex processing to vulnerability match object Based on Alex's previous caommit Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Migrate VEX options and app config from legacy CLI Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * update table snapshot tests with suppressed vex entries Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for match.Matches.Diff() Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for vex processor Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting and restore global funlen rule Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove grpc pin Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * always return remaining and ignroed matches from matcher object Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * Add VEX documentation to main README This commit adds a VEX section to the main Grype README. It adds an example document and details on how vex rules can be written. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> --------- Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@chainguard.dev> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-09-13 19:26:12 +00:00
github.com/Masterminds/semver/v3 v3.2.1 // indirect
bump syft to pre-release of v0.81.0 (#1310) Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
2023-05-22 14:17:34 +00:00
github.com/Microsoft/go-winio v0.6.1 // indirect
Incorporate format API changes from syft (#1582) * incorporate changes from anchore/syft#2228 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix testing utils to use syft SBOM Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-11-02 19:25:48 +00:00
github.com/Microsoft/hcsshim v0.11.1 // indirect
Upgrade syft to v0.91.0 (#1508) * bump syft to main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgdate cyclonedx presenter fixtures (bump from cdx 1.4 to 1.5) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * allow for pkg type exceptions for github actions and workflows Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx json schema from v1.4 to v1.5 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump to syft v0.91.0 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgrade go-setup action to v4 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove asset upload from release workflow Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-09-20 20:39:23 +00:00
github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/acobaugh/osrelease v0.1.0 // indirect
chore(deps): update Syft to v0.78.0 (#1242) * chore(deps): update Syft to v0.78.0 Signed-off-by: GitHub <noreply@github.com> * fix test location references and package types Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2023-04-19 17:38:06 +00:00
github.com/acomagu/bufpipe v1.0.4 // indirect
fix: bump fangs to enable setting golang CPE config using env var (#1585) * fix: bump fangs Bump fangs to pull in https://github.com/anchore/fangs/pull/27, which fixes an issue where env vars couldn't be used to set fields on embedded structs in the config struct. Signed-off-by: Will Murphy <will.murphy@anchore.com> * fix: bump fangs to pull in panic fix The previous fangs fix panicked when summarizing configs with embedded structs. Bump fangs to pull in https://github.com/anchore/fangs/pull/29 which fixes this panic. Signed-off-by: Will Murphy <will.murphy@anchore.com> * commit mod tidy Signed-off-by: Will Murphy <will.murphy@anchore.com> * Pull in dependency bumps from main to resolve conflicts Signed-off-by: Will Murphy <will.murphy@anchore.com> --------- Signed-off-by: Will Murphy <will.murphy@anchore.com>
2023-11-07 15:59:13 +00:00
github.com/anchore/fangs v0.0.0-20231106214039-d96c8f312db4 // indirect
upgrade github workflows to go 1.18 (#649) * upgrade github workflows to go 1.18 Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * upgrade syft & set go1.18 for CI workflows Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * go mod tidy Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * add go1.17 static analysis Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * fix yaml comment Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>
2022-03-17 21:58:20 +00:00
github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb // indirect
Update Syft to v0.69.1 (#1111) Signed-off-by: GitHub <noreply@github.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com>
2023-02-01 08:28:50 +00:00
github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/andybalholm/brotli v1.0.4 // indirect
feat: update go-sarif library to use latest release (#1563) --------- Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-10-17 15:18:22 +00:00
github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
chore(deps): update Syft to v0.86.1 (#1410) * chore(deps): update Syft to v0.86.0 Signed-off-by: GitHub <noreply@github.com> * fix python package metadata shape Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * account for new metadatas added in syft Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump syft to unreleased but fixed version Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
2023-07-31 17:58:36 +00:00
github.com/aquasecurity/go-version v0.0.0-20210121072130-637058cfe492 // indirect
Ignore/add match results based on OpenVEX documents (#1397) * go.mod: Pull OpenVEX go modules This commit pulls the OpenVEX libraries into the grype source. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add generic VEX processor package This commit adds a generic VEX processor package. It is implementation agnostic. It has a single option for now: The documents used to load the VEX data. The processor has a single method: ApplyVEX() which takes a set of scan results and applies VEX data to them. For now, the only modification that is done is filtering of results, that is moving results to the ignored list as a response to VEX documents. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * vex: Add OpenVEX processor implementation This commit adds an openvex implementation of the vex processor. It also wires the VEX processor to use it as default. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Table presenter: Highligt results suppressed by VEX This commit marks results suppressed by VEX when presenting them to the user. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Define VEX status constants This commit defines a set of local constants of each of the VEX statuses based on the openvex constants. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add VexStatus to ignore rules This commit modifies the ignore rules structure to support defining a vex status. Any rules defining vex are ignored by the standard ignore rules processing as they will be handled by the VEX processor. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add IgnoreRule HasConditions method Adds a new HasConditions method to the IgnoreRule object to check if the rule is empty. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Control VEX filtering through IgnoreRules This commit modifies how the vex processor is controlled. The processor now takes a list of IgnoreRules which can act on the VEX status in addition to the regular rule parameters. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * vex: Allow rules to match on VEX justification This commit expands the ingore rules to also work on vex the justification of not_affected statements. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Use go-vex merge implementation Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add OpenVEX matcher to matcher list This commit adds a new entry to the matchers: An openvex matcher This matcher is used when openvex augments results, moving matches from the ignore list to the active results. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add vex.AugmentMatches() to the vex processor This commit adds a new AugmentMatches() phase to the VEX processor. This new step goes throught the configured ignore rules and acts on any that have `affected` or `under_investigtion` as status. The purpose of this rule is to move matches back from the ignored matches list to the active results when a statement with either of those statuses apply to ignored matches. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Parse context identifiers using GGC This commit modifies the identifier synthesizer function to parse references using GGCR. It also adds a simple test. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Bump funlen linter to 73 This commit bumps the maximum function length to 73 to accomodate the new flag in AddFlags() Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@chainguard.dev> * Add VEX testing to matchers test This commit adds a new test and fixtures to test the VEX matchers along the rest of the matchers in TestMatchByImage(). As the VEX matchers operate on previously ignored matches a new loop was added to the test to accomodate the different testing model. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * add vex status and justification to ignored rule json model Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * nit rename + add TODO question about augmenting ignored matches Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * nit document comment updates + common variable extraction Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * migrate legacy matcher function to vulnerability matcher object Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update tui to respond to ignored and dropped matches Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * migrate vex processing to vulnerability match object Based on Alex's previous caommit Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Migrate VEX options and app config from legacy CLI Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * update table snapshot tests with suppressed vex entries Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for match.Matches.Diff() Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for vex processor Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting and restore global funlen rule Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove grpc pin Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * always return remaining and ignroed matches from matcher object Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * Add VEX documentation to main README This commit adds a VEX section to the main Grype README. It adds an example document and details on how vex rules can be written. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> --------- Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@chainguard.dev> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-09-13 19:26:12 +00:00
github.com/aws/aws-sdk-go v1.44.288 // indirect
Port UI to bubbletea (#1385) * initial port to bubbletea Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove jotframe UI Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add bubbletea component tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update main.go refs to cmd package Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * move goreleaser build dir to cmd Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgrade yardstick for grype source installs and fix post-ui tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * ensure stable severity map in UI component test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add windows support for tui Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-07-13 17:13:48 +00:00
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
Update Syft to v0.71.0 (#1126)
2023-02-10 15:14:01 +00:00
github.com/becheran/wildmatch-go v1.0.0 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
Incorporate format API changes from syft (#1582) * incorporate changes from anchore/syft#2228 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix testing utils to use syft SBOM Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-11-02 19:25:48 +00:00
github.com/bmatcuk/doublestar/v4 v4.6.1 // indirect
Port UI to bubbletea (#1385) * initial port to bubbletea Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove jotframe UI Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add bubbletea component tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update main.go refs to cmd package Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * move goreleaser build dir to cmd Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgrade yardstick for grype source installs and fix post-ui tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * ensure stable severity map in UI component test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add windows support for tui Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-07-13 17:13:48 +00:00
github.com/charmbracelet/bubbles v0.16.1 // indirect
github.com/charmbracelet/harmonica v0.2.0 // indirect
chore(deps): bump github.com/cloudflare/circl from 1.1.0 to 1.3.3 (#1289)
2023-05-17 13:45:58 +00:00
github.com/cloudflare/circl v1.3.3 // indirect
Upgrade syft to v0.91.0 (#1508) * bump syft to main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgdate cyclonedx presenter fixtures (bump from cdx 1.4 to 1.5) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * allow for pkg type exceptions for github actions and workflows Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx json schema from v1.4 to v1.5 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump to syft v0.91.0 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgrade go-setup action to v4 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove asset upload from release workflow Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-09-20 20:39:23 +00:00
github.com/containerd/cgroups v1.1.0 // indirect
Port UI to bubbletea (#1385) * initial port to bubbletea Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove jotframe UI Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add bubbletea component tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update main.go refs to cmd package Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * move goreleaser build dir to cmd Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgrade yardstick for grype source installs and fix post-ui tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * ensure stable severity map in UI component test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add windows support for tui Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-07-13 17:13:48 +00:00
github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81 // indirect
Incorporate format API changes from syft (#1582) * incorporate changes from anchore/syft#2228 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix testing utils to use syft SBOM Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-11-02 19:25:48 +00:00
github.com/containerd/containerd v1.7.8 // indirect
github.com/containerd/continuity v0.4.2 // indirect
Upgrade syft to v0.91.0 (#1508) * bump syft to main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgdate cyclonedx presenter fixtures (bump from cdx 1.4 to 1.5) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * allow for pkg type exceptions for github actions and workflows Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx json schema from v1.4 to v1.5 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump to syft v0.91.0 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgrade go-setup action to v4 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove asset upload from release workflow Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-09-20 20:39:23 +00:00
github.com/containerd/fifo v1.1.0 // indirect
Incorporate format API changes from syft (#1582) * incorporate changes from anchore/syft#2228 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix testing utils to use syft SBOM Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-11-02 19:25:48 +00:00
github.com/containerd/log v0.1.0 // indirect
chore(deps): bump github.com/anchore/syft from 0.75.0 to 0.76.0 (#1207) * chore(deps): bump github.com/anchore/syft from 0.75.0 to 0.76.0 Bumps [github.com/anchore/syft](https://github.com/anchore/syft) from 0.75.0 to 0.76.0. - [Release notes](https://github.com/anchore/syft/releases) - [Changelog](https://github.com/anchore/syft/blob/main/.goreleaser.yaml) - [Commits](https://github.com/anchore/syft/compare/v0.75.0...v0.76.0) --- updated-dependencies: - dependency-name: github.com/anchore/syft dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore: update ParseInput signature with new syft version Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * fix: update integration tests Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-03 14:48:33 +00:00
github.com/containerd/stargz-snapshotter/estargz v0.14.3 // indirect
Incorporate format API changes from syft (#1582) * incorporate changes from anchore/syft#2228 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix testing utils to use syft SBOM Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-11-02 19:25:48 +00:00
github.com/containerd/ttrpc v1.2.2 // indirect
github.com/containerd/typeurl/v2 v2.1.1 // indirect
Upgrade syft to v0.91.0 (#1508) * bump syft to main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgdate cyclonedx presenter fixtures (bump from cdx 1.4 to 1.5) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * allow for pkg type exceptions for github actions and workflows Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx json schema from v1.4 to v1.5 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump to syft v0.91.0 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgrade go-setup action to v4 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove asset upload from release workflow Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-09-20 20:39:23 +00:00
github.com/cyphar/filepath-securejoin v0.2.4 // indirect
fix: bump fangs to enable setting golang CPE config using env var (#1585) * fix: bump fangs Bump fangs to pull in https://github.com/anchore/fangs/pull/27, which fixes an issue where env vars couldn't be used to set fields on embedded structs in the config struct. Signed-off-by: Will Murphy <will.murphy@anchore.com> * fix: bump fangs to pull in panic fix The previous fangs fix panicked when summarizing configs with embedded structs. Bump fangs to pull in https://github.com/anchore/fangs/pull/29 which fixes this panic. Signed-off-by: Will Murphy <will.murphy@anchore.com> * commit mod tidy Signed-off-by: Will Murphy <will.murphy@anchore.com> * Pull in dependency bumps from main to resolve conflicts Signed-off-by: Will Murphy <will.murphy@anchore.com> --------- Signed-off-by: Will Murphy <will.murphy@anchore.com>
2023-11-07 15:59:13 +00:00
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
chore(deps): update Syft to v0.78.0 (#1242) * chore(deps): update Syft to v0.78.0 Signed-off-by: GitHub <noreply@github.com> * fix test location references and package types Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2023-04-19 17:38:06 +00:00
github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da // indirect
chore(deps): update Syft to v0.93.0 (#1550) * chore(deps): update Syft to v0.93.0 Signed-off-by: GitHub <noreply@github.com> * fix test to account for go pkg stdlib Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
2023-10-10 18:26:34 +00:00
github.com/distribution/reference v0.5.0 // indirect
chore(deps): update Syft to v0.87.1 (#1432)
2023-08-17 19:39:41 +00:00
github.com/docker/cli v24.0.0+incompatible // indirect
chore(deps): update Syft to v0.93.0 (#1550) * chore(deps): update Syft to v0.93.0 Signed-off-by: GitHub <noreply@github.com> * fix test to account for go pkg stdlib Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
2023-10-10 18:26:34 +00:00
github.com/docker/distribution v2.8.3+incompatible // indirect
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
github.com/docker/docker-credential-helpers v0.7.0 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/docker/go-connections v0.4.0 // indirect
Upgrade syft to v0.91.0 (#1508) * bump syft to main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgdate cyclonedx presenter fixtures (bump from cdx 1.4 to 1.5) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * allow for pkg type exceptions for github actions and workflows Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx json schema from v1.4 to v1.5 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump to syft v0.91.0 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgrade go-setup action to v4 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove asset upload from release workflow Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-09-20 20:39:23 +00:00
github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
github.com/docker/go-units v0.5.0 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 // indirect
chore(deps): update Syft to v0.86.1 (#1410) * chore(deps): update Syft to v0.86.0 Signed-off-by: GitHub <noreply@github.com> * fix python package metadata shape Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * account for new metadatas added in syft Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump syft to unreleased but fixed version Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
2023-07-31 17:58:36 +00:00
github.com/edsrzf/mmap-go v1.1.0 // indirect
chore(deps): update Syft to v0.78.0 (#1242) * chore(deps): update Syft to v0.78.0 Signed-off-by: GitHub <noreply@github.com> * fix test location references and package types Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2023-04-19 17:38:06 +00:00
github.com/emirpasic/gods v1.18.1 // indirect
chore(deps): bump github.com/pkg/profile from 1.6.0 to 1.7.0 (#1079) Bumps [github.com/pkg/profile](https://github.com/pkg/profile) from 1.6.0 to 1.7.0. - [Release notes](https://github.com/pkg/profile/releases) - [Commits](https://github.com/pkg/profile/compare/v1.6.0...v1.7.0) --- updated-dependencies: - dependency-name: github.com/pkg/profile dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-01-25 17:21:34 +00:00
github.com/felixge/fgprof v0.9.3 // indirect
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
github.com/fsnotify/fsnotify v1.6.0 // indirect
Upgrade syft to v0.91.0 (#1508) * bump syft to main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgdate cyclonedx presenter fixtures (bump from cdx 1.4 to 1.5) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * allow for pkg type exceptions for github actions and workflows Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx json schema from v1.4 to v1.5 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump to syft v0.91.0 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgrade go-setup action to v4 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove asset upload from release workflow Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-09-20 20:39:23 +00:00
github.com/github/go-spdx/v2 v2.2.0 // indirect
chore(deps): bump github.com/gkampitakis/go-snaps from 0.4.11 to 0.4.12 (#1597) Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps) from 0.4.11 to 0.4.12. - [Release notes](https://github.com/gkampitakis/go-snaps/releases) - [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.4.11...v0.4.12) --- updated-dependencies: - dependency-name: github.com/gkampitakis/go-snaps dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-09 15:52:24 +00:00
github.com/gkampitakis/ciinfo v0.3.0 // indirect
Port UI to bubbletea (#1385) * initial port to bubbletea Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove jotframe UI Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add bubbletea component tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update main.go refs to cmd package Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * move goreleaser build dir to cmd Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgrade yardstick for grype source installs and fix post-ui tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * ensure stable severity map in UI component test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add windows support for tui Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-07-13 17:13:48 +00:00
github.com/gkampitakis/go-diff v1.3.2 // indirect
chore(deps): remove dependency on sqlite fork; bump gorm.io/gorm from 1.23.10 to 1.25.4 (#1448) * chore: remove dependency on sqlite fork * chore(deps): bump gorm.io/gorm from 1.23.10 to 1.25.4 Removed the dependency on github.com/anchore/sqlite because the diff added to that fork was no longer needed. Bumps [gorm.io/gorm](https://github.com/go-gorm/gorm) from 1.23.10 to 1.25.4. - [Release notes](https://github.com/go-gorm/gorm/releases) - [Commits](https://github.com/go-gorm/gorm/compare/v1.23.10...v1.25.4) --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Will Murphy <will.murphy@anchore.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Will Murphy <will.murphy@anchore.com>
2023-09-18 15:34:54 +00:00
github.com/glebarez/go-sqlite v1.21.2 // indirect
chore(deps): update bootstrap tools to latest versions (#1334) * chore(deps): update bootstrap tools to latest versions Signed-off-by: GitHub <noreply@github.com> * chore: dependency clean-up Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * chore: fix s/a changes Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * fix: update PURL provider tests; remove unparam Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: westonsteimel <westonsteimel@users.noreply.github.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-06-05 21:17:20 +00:00
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
Upgrade syft to v0.91.0 (#1508) * bump syft to main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgdate cyclonedx presenter fixtures (bump from cdx 1.4 to 1.5) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * allow for pkg type exceptions for github actions and workflows Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx json schema from v1.4 to v1.5 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump to syft v0.91.0 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgrade go-setup action to v4 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove asset upload from release workflow Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-09-20 20:39:23 +00:00
github.com/go-git/go-billy/v5 v5.5.0 // indirect
Incorporate format API changes from syft (#1582) * incorporate changes from anchore/syft#2228 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix testing utils to use syft SBOM Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-11-02 19:25:48 +00:00
github.com/go-git/go-git/v5 v5.10.0 // indirect
Upgrade syft to v0.91.0 (#1508) * bump syft to main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgdate cyclonedx presenter fixtures (bump from cdx 1.4 to 1.5) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * allow for pkg type exceptions for github actions and workflows Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx json schema from v1.4 to v1.5 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump to syft v0.91.0 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgrade go-setup action to v4 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove asset upload from release workflow Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-09-20 20:39:23 +00:00
github.com/go-logr/logr v1.2.4 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/go-restruct/restruct v1.2.0-alpha // indirect
github.com/gogo/protobuf v1.3.2 // indirect
Bump syft to release version v0.39.0 (#645) * bump syft to v0.39.0 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update ByCriteria to log error on failure Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * integration tests now pass Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * bump to v0.39.3 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * raise search failures to warn Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * tidy go.mod/sum Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-26 22:28:08 +00:00
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
chore(deps): bump github.com/anchore/syft from 0.75.0 to 0.76.0 (#1207) * chore(deps): bump github.com/anchore/syft from 0.75.0 to 0.76.0 Bumps [github.com/anchore/syft](https://github.com/anchore/syft) from 0.75.0 to 0.76.0. - [Release notes](https://github.com/anchore/syft/releases) - [Changelog](https://github.com/anchore/syft/blob/main/.goreleaser.yaml) - [Commits](https://github.com/anchore/syft/compare/v0.75.0...v0.76.0) --- updated-dependencies: - dependency-name: github.com/anchore/syft dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore: update ParseInput signature with new syft version Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * fix: update integration tests Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-03 14:48:33 +00:00
github.com/golang/protobuf v1.5.3 // indirect
Bump syft to release version v0.39.0 (#645) * bump syft to v0.39.0 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update ByCriteria to log error on failure Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * integration tests now pass Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * bump to v0.39.3 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * raise search failures to warn Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * tidy go.mod/sum Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-26 22:28:08 +00:00
github.com/golang/snappy v0.0.4 // indirect
chore(deps): bump github.com/anchore/syft from 0.75.0 to 0.76.0 (#1207) * chore(deps): bump github.com/anchore/syft from 0.75.0 to 0.76.0 Bumps [github.com/anchore/syft](https://github.com/anchore/syft) from 0.75.0 to 0.76.0. - [Release notes](https://github.com/anchore/syft/releases) - [Changelog](https://github.com/anchore/syft/blob/main/.goreleaser.yaml) - [Commits](https://github.com/anchore/syft/compare/v0.75.0...v0.76.0) --- updated-dependencies: - dependency-name: github.com/anchore/syft dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore: update ParseInput signature with new syft version Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * fix: update integration tests Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-03 14:48:33 +00:00
github.com/google/licensecheck v0.3.1 // indirect
chore: bump syft to latest version v0.79.0 (#1250) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-21 16:58:02 +00:00
github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26 // indirect
fix: bump fangs to enable setting golang CPE config using env var (#1585) * fix: bump fangs Bump fangs to pull in https://github.com/anchore/fangs/pull/27, which fixes an issue where env vars couldn't be used to set fields on embedded structs in the config struct. Signed-off-by: Will Murphy <will.murphy@anchore.com> * fix: bump fangs to pull in panic fix The previous fangs fix panicked when summarizing configs with embedded structs. Bump fangs to pull in https://github.com/anchore/fangs/pull/29 which fixes this panic. Signed-off-by: Will Murphy <will.murphy@anchore.com> * commit mod tidy Signed-off-by: Will Murphy <will.murphy@anchore.com> * Pull in dependency bumps from main to resolve conflicts Signed-off-by: Will Murphy <will.murphy@anchore.com> --------- Signed-off-by: Will Murphy <will.murphy@anchore.com>
2023-11-07 15:59:13 +00:00
github.com/google/s2a-go v0.1.7 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.3.1 // indirect
github.com/googleapis/gax-go/v2 v2.12.0 // indirect
Bump syft to release version v0.39.0 (#645) * bump syft to v0.39.0 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update ByCriteria to log error on failure Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * integration tests now pass Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * bump to v0.39.3 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * raise search failures to warn Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * tidy go.mod/sum Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-26 22:28:08 +00:00
github.com/hashicorp/errwrap v1.1.0 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/hashicorp/go-safetemp v1.0.0 // indirect
github.com/hashicorp/hcl v1.0.0 // indirect
chore(deps): bump github.com/Masterminds/sprig/v3 from 3.2.2 to 3.2.3 (#1083) Bumps [github.com/Masterminds/sprig/v3](https://github.com/Masterminds/sprig) from 3.2.2 to 3.2.3. - [Release notes](https://github.com/Masterminds/sprig/releases) - [Changelog](https://github.com/Masterminds/sprig/blob/master/CHANGELOG.md) - [Commits](https://github.com/Masterminds/sprig/compare/v3.2.2...v3.2.3) --- updated-dependencies: - dependency-name: github.com/Masterminds/sprig/v3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-01-25 17:17:03 +00:00
github.com/huandu/xstrings v1.3.3 // indirect
chore(deps): update Syft to v0.89.0 (#1472) Signed-off-by: GitHub <noreply@github.com> Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
2023-08-31 16:02:11 +00:00
github.com/iancoleman/strcase v0.3.0 // indirect
chore(deps): update bootstrap tools to latest versions (#1334) * chore(deps): update bootstrap tools to latest versions Signed-off-by: GitHub <noreply@github.com> * chore: dependency clean-up Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * chore: fix s/a changes Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * fix: update PURL provider tests; remove unparam Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: westonsteimel <westonsteimel@users.noreply.github.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-06-05 21:17:20 +00:00
github.com/imdario/mergo v0.3.15 // indirect
chore(deps): bump github.com/anchore/syft from 0.75.0 to 0.76.0 (#1207) * chore(deps): bump github.com/anchore/syft from 0.75.0 to 0.76.0 Bumps [github.com/anchore/syft](https://github.com/anchore/syft) from 0.75.0 to 0.76.0. - [Release notes](https://github.com/anchore/syft/releases) - [Changelog](https://github.com/anchore/syft/blob/main/.goreleaser.yaml) - [Commits](https://github.com/anchore/syft/compare/v0.75.0...v0.76.0) --- updated-dependencies: - dependency-name: github.com/anchore/syft dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore: update ParseInput signature with new syft version Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * fix: update integration tests Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-03 14:48:33 +00:00
github.com/inconshreveable/mousetrap v1.1.0 // indirect
chore(deps): update Syft to v0.78.0 (#1242) * chore(deps): update Syft to v0.78.0 Signed-off-by: GitHub <noreply@github.com> * fix test location references and package types Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2023-04-19 17:38:06 +00:00
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
chore(deps): update Syft to v0.88.0 (#1466)
2023-08-25 21:23:52 +00:00
github.com/jinzhu/copier v0.4.0 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/jinzhu/inflection v1.0.0 // indirect
chore: bump syft to latest version v0.79.0 (#1250) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-21 16:58:02 +00:00
github.com/jinzhu/now v1.1.5 // indirect
Bump syft to release version v0.39.0 (#645) * bump syft to v0.39.0 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update ByCriteria to log error on failure Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * integration tests now pass Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * bump to v0.39.3 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * raise search failures to warn Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * tidy go.mod/sum Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-26 22:28:08 +00:00
github.com/jmespath/go-jmespath v0.4.0 // indirect
chore(deps): update Syft to v0.88.0 (#1466)
2023-08-25 21:23:52 +00:00
github.com/kastenhq/goversion v0.0.0-20230811215019-93b2f8823953 // indirect
chore(deps): update Syft to v0.78.0 (#1242) * chore(deps): update Syft to v0.78.0 Signed-off-by: GitHub <noreply@github.com> * fix test location references and package types Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2023-04-19 17:38:06 +00:00
github.com/kevinburke/ssh_config v1.2.0 // indirect
fix: bump fangs to enable setting golang CPE config using env var (#1585) * fix: bump fangs Bump fangs to pull in https://github.com/anchore/fangs/pull/27, which fixes an issue where env vars couldn't be used to set fields on embedded structs in the config struct. Signed-off-by: Will Murphy <will.murphy@anchore.com> * fix: bump fangs to pull in panic fix The previous fangs fix panicked when summarizing configs with embedded structs. Bump fangs to pull in https://github.com/anchore/fangs/pull/29 which fixes this panic. Signed-off-by: Will Murphy <will.murphy@anchore.com> * commit mod tidy Signed-off-by: Will Murphy <will.murphy@anchore.com> * Pull in dependency bumps from main to resolve conflicts Signed-off-by: Will Murphy <will.murphy@anchore.com> --------- Signed-off-by: Will Murphy <will.murphy@anchore.com>
2023-11-07 15:59:13 +00:00
github.com/klauspost/compress v1.17.0 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/klauspost/pgzip v1.2.5 // indirect
chore(deps): update Syft to v0.80.0 (#1276)
2023-05-07 17:57:12 +00:00
github.com/knqyf263/go-rpmdb v0.0.0-20230301153543-ba94b245509b // indirect
Port UI to bubbletea (#1385) * initial port to bubbletea Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove jotframe UI Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add bubbletea component tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update main.go refs to cmd package Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * move goreleaser build dir to cmd Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgrade yardstick for grype source installs and fix post-ui tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * ensure stable severity map in UI component test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add windows support for tui Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-07-13 17:13:48 +00:00
github.com/kr/pretty v0.3.1 // indirect
github.com/kr/text v0.2.0 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/logrusorgru/aurora v0.0.0-20200102142835-e9ef32dff381 // indirect
Port UI to bubbletea (#1385) * initial port to bubbletea Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove jotframe UI Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add bubbletea component tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update main.go refs to cmd package Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * move goreleaser build dir to cmd Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgrade yardstick for grype source installs and fix post-ui tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * ensure stable severity map in UI component test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add windows support for tui Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-07-13 17:13:48 +00:00
github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
github.com/magiconair/properties v1.8.7 // indirect
chore(deps): bump github.com/gkampitakis/go-snaps from 0.4.11 to 0.4.12 (#1597) Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps) from 0.4.11 to 0.4.12. - [Release notes](https://github.com/gkampitakis/go-snaps/releases) - [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.4.11...v0.4.12) --- updated-dependencies: - dependency-name: github.com/gkampitakis/go-snaps dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-09 15:52:24 +00:00
github.com/maruel/natural v1.1.0 // indirect
chore: update syft to v0.60.3 (#978)
2022-11-03 16:19:03 +00:00
github.com/mattn/go-colorable v0.1.13 // indirect
chore: bump syft to latest version v0.79.0 (#1250) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-21 16:58:02 +00:00
github.com/mattn/go-isatty v0.0.18 // indirect
Port UI to bubbletea (#1385) * initial port to bubbletea Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove jotframe UI Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add bubbletea component tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update main.go refs to cmd package Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * move goreleaser build dir to cmd Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgrade yardstick for grype source installs and fix post-ui tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * ensure stable severity map in UI component test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add windows support for tui Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-07-13 17:13:48 +00:00
github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75 // indirect
chore(deps): bump github.com/charmbracelet/lipgloss from 0.8.0 to 0.9.0 (#1548) Bumps [github.com/charmbracelet/lipgloss](https://github.com/charmbracelet/lipgloss) from 0.8.0 to 0.9.0. - [Release notes](https://github.com/charmbracelet/lipgloss/releases) - [Commits](https://github.com/charmbracelet/lipgloss/compare/v0.8.0...v0.9.0) --- updated-dependencies: - dependency-name: github.com/charmbracelet/lipgloss dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-10 17:33:06 +00:00
github.com/mattn/go-runewidth v0.0.15 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
Update Syft to v0.53.4 (#856)
2022-08-04 13:37:48 +00:00
github.com/microsoft/go-rustaudit v0.0.0-20220730194248-4b17361d90a5 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/mitchellh/copystructure v1.2.0 // indirect
Bump syft to release version v0.39.0 (#645) * bump syft to v0.39.0 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update ByCriteria to log error on failure Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * integration tests now pass Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * bump to v0.39.3 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * raise search failures to warn Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * tidy go.mod/sum Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-26 22:28:08 +00:00
github.com/mitchellh/go-testing-interface v1.14.1 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/mitchellh/reflectwalk v1.0.2 // indirect
Upgrade syft to v0.91.0 (#1508) * bump syft to main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgdate cyclonedx presenter fixtures (bump from cdx 1.4 to 1.5) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * allow for pkg type exceptions for github actions and workflows Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx json schema from v1.4 to v1.5 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump to syft v0.91.0 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgrade go-setup action to v4 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove asset upload from release workflow Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-09-20 20:39:23 +00:00
github.com/moby/locker v1.0.1 // indirect
github.com/moby/sys/mountinfo v0.6.2 // indirect
github.com/moby/sys/sequential v0.5.0 // indirect
github.com/moby/sys/signal v0.7.0 // indirect
Ignore/add match results based on OpenVEX documents (#1397) * go.mod: Pull OpenVEX go modules This commit pulls the OpenVEX libraries into the grype source. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add generic VEX processor package This commit adds a generic VEX processor package. It is implementation agnostic. It has a single option for now: The documents used to load the VEX data. The processor has a single method: ApplyVEX() which takes a set of scan results and applies VEX data to them. For now, the only modification that is done is filtering of results, that is moving results to the ignored list as a response to VEX documents. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * vex: Add OpenVEX processor implementation This commit adds an openvex implementation of the vex processor. It also wires the VEX processor to use it as default. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Table presenter: Highligt results suppressed by VEX This commit marks results suppressed by VEX when presenting them to the user. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Define VEX status constants This commit defines a set of local constants of each of the VEX statuses based on the openvex constants. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add VexStatus to ignore rules This commit modifies the ignore rules structure to support defining a vex status. Any rules defining vex are ignored by the standard ignore rules processing as they will be handled by the VEX processor. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add IgnoreRule HasConditions method Adds a new HasConditions method to the IgnoreRule object to check if the rule is empty. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Control VEX filtering through IgnoreRules This commit modifies how the vex processor is controlled. The processor now takes a list of IgnoreRules which can act on the VEX status in addition to the regular rule parameters. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * vex: Allow rules to match on VEX justification This commit expands the ingore rules to also work on vex the justification of not_affected statements. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Use go-vex merge implementation Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add OpenVEX matcher to matcher list This commit adds a new entry to the matchers: An openvex matcher This matcher is used when openvex augments results, moving matches from the ignore list to the active results. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add vex.AugmentMatches() to the vex processor This commit adds a new AugmentMatches() phase to the VEX processor. This new step goes throught the configured ignore rules and acts on any that have `affected` or `under_investigtion` as status. The purpose of this rule is to move matches back from the ignored matches list to the active results when a statement with either of those statuses apply to ignored matches. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Parse context identifiers using GGC This commit modifies the identifier synthesizer function to parse references using GGCR. It also adds a simple test. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Bump funlen linter to 73 This commit bumps the maximum function length to 73 to accomodate the new flag in AddFlags() Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@chainguard.dev> * Add VEX testing to matchers test This commit adds a new test and fixtures to test the VEX matchers along the rest of the matchers in TestMatchByImage(). As the VEX matchers operate on previously ignored matches a new loop was added to the test to accomodate the different testing model. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * add vex status and justification to ignored rule json model Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * nit rename + add TODO question about augmenting ignored matches Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * nit document comment updates + common variable extraction Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * migrate legacy matcher function to vulnerability matcher object Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update tui to respond to ignored and dropped matches Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * migrate vex processing to vulnerability match object Based on Alex's previous caommit Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Migrate VEX options and app config from legacy CLI Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * update table snapshot tests with suppressed vex entries Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for match.Matches.Diff() Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for vex processor Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting and restore global funlen rule Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove grpc pin Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * always return remaining and ignroed matches from matcher object Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * Add VEX documentation to main README This commit adds a VEX section to the main Grype README. It adds an example document and details on how vex rules can be written. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> --------- Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@chainguard.dev> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-09-13 19:26:12 +00:00
github.com/moby/term v0.5.0 // indirect
Port UI to bubbletea (#1385) * initial port to bubbletea Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove jotframe UI Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add bubbletea component tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update main.go refs to cmd package Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * move goreleaser build dir to cmd Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgrade yardstick for grype source installs and fix post-ui tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * ensure stable severity map in UI component test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add windows support for tui Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-07-13 17:13:48 +00:00
github.com/muesli/ansi v0.0.0-20211031195517-c9f0611b6c70 // indirect
github.com/muesli/cancelreader v0.2.2 // indirect
github.com/muesli/reflow v0.3.0 // indirect
chore(deps): update Syft to v0.88.0 (#1466)
2023-08-25 21:23:52 +00:00
github.com/muesli/termenv v0.15.2 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/nwaples/rardecode v1.1.0 // indirect
chore: prune cosign dependency for grype builds (#1100) * feat: segment cosign dependency for grype builds for faster build times Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-01-31 16:42:40 +00:00
github.com/onsi/ginkgo v1.16.5 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/opencontainers/go-digest v1.0.0 // indirect
bump syft to pre-release of v0.81.0 (#1310) Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
2023-05-22 14:17:34 +00:00
github.com/opencontainers/image-spec v1.1.0-rc3 // indirect
Upgrade syft to v0.91.0 (#1508) * bump syft to main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgdate cyclonedx presenter fixtures (bump from cdx 1.4 to 1.5) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * allow for pkg type exceptions for github actions and workflows Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx json schema from v1.4 to v1.5 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump to syft v0.91.0 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgrade go-setup action to v4 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove asset upload from release workflow Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-09-20 20:39:23 +00:00
github.com/opencontainers/runc v1.1.5 // indirect
github.com/opencontainers/runtime-spec v1.1.0-rc.1 // indirect
github.com/opencontainers/selinux v1.11.0 // indirect
Ignore/add match results based on OpenVEX documents (#1397) * go.mod: Pull OpenVEX go modules This commit pulls the OpenVEX libraries into the grype source. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add generic VEX processor package This commit adds a generic VEX processor package. It is implementation agnostic. It has a single option for now: The documents used to load the VEX data. The processor has a single method: ApplyVEX() which takes a set of scan results and applies VEX data to them. For now, the only modification that is done is filtering of results, that is moving results to the ignored list as a response to VEX documents. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * vex: Add OpenVEX processor implementation This commit adds an openvex implementation of the vex processor. It also wires the VEX processor to use it as default. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Table presenter: Highligt results suppressed by VEX This commit marks results suppressed by VEX when presenting them to the user. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Define VEX status constants This commit defines a set of local constants of each of the VEX statuses based on the openvex constants. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add VexStatus to ignore rules This commit modifies the ignore rules structure to support defining a vex status. Any rules defining vex are ignored by the standard ignore rules processing as they will be handled by the VEX processor. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add IgnoreRule HasConditions method Adds a new HasConditions method to the IgnoreRule object to check if the rule is empty. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Control VEX filtering through IgnoreRules This commit modifies how the vex processor is controlled. The processor now takes a list of IgnoreRules which can act on the VEX status in addition to the regular rule parameters. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * vex: Allow rules to match on VEX justification This commit expands the ingore rules to also work on vex the justification of not_affected statements. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Use go-vex merge implementation Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add OpenVEX matcher to matcher list This commit adds a new entry to the matchers: An openvex matcher This matcher is used when openvex augments results, moving matches from the ignore list to the active results. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add vex.AugmentMatches() to the vex processor This commit adds a new AugmentMatches() phase to the VEX processor. This new step goes throught the configured ignore rules and acts on any that have `affected` or `under_investigtion` as status. The purpose of this rule is to move matches back from the ignored matches list to the active results when a statement with either of those statuses apply to ignored matches. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Parse context identifiers using GGC This commit modifies the identifier synthesizer function to parse references using GGCR. It also adds a simple test. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Bump funlen linter to 73 This commit bumps the maximum function length to 73 to accomodate the new flag in AddFlags() Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@chainguard.dev> * Add VEX testing to matchers test This commit adds a new test and fixtures to test the VEX matchers along the rest of the matchers in TestMatchByImage(). As the VEX matchers operate on previously ignored matches a new loop was added to the test to accomodate the different testing model. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * add vex status and justification to ignored rule json model Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * nit rename + add TODO question about augmenting ignored matches Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * nit document comment updates + common variable extraction Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * migrate legacy matcher function to vulnerability matcher object Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update tui to respond to ignored and dropped matches Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * migrate vex processing to vulnerability match object Based on Alex's previous caommit Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Migrate VEX options and app config from legacy CLI Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * update table snapshot tests with suppressed vex entries Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for match.Matches.Diff() Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for vex processor Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting and restore global funlen rule Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove grpc pin Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * always return remaining and ignroed matches from matcher object Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * Add VEX documentation to main README This commit adds a VEX section to the main Grype README. It adds an example document and details on how vex rules can be written. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> --------- Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@chainguard.dev> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-09-13 19:26:12 +00:00
github.com/package-url/packageurl-go v0.1.1 // indirect
Port UI to bubbletea (#1385) * initial port to bubbletea Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove jotframe UI Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add bubbletea component tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update main.go refs to cmd package Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * move goreleaser build dir to cmd Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgrade yardstick for grype source installs and fix post-ui tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * ensure stable severity map in UI component test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add windows support for tui Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-07-13 17:13:48 +00:00
github.com/pborman/indent v1.2.1 // indirect
update syft version to v0.47.0 (#781)
2022-06-09 20:03:14 +00:00
github.com/pelletier/go-toml v1.9.5 // indirect
fix: bump fangs to enable setting golang CPE config using env var (#1585) * fix: bump fangs Bump fangs to pull in https://github.com/anchore/fangs/pull/27, which fixes an issue where env vars couldn't be used to set fields on embedded structs in the config struct. Signed-off-by: Will Murphy <will.murphy@anchore.com> * fix: bump fangs to pull in panic fix The previous fangs fix panicked when summarizing configs with embedded structs. Bump fangs to pull in https://github.com/anchore/fangs/pull/29 which fixes this panic. Signed-off-by: Will Murphy <will.murphy@anchore.com> * commit mod tidy Signed-off-by: Will Murphy <will.murphy@anchore.com> * Pull in dependency bumps from main to resolve conflicts Signed-off-by: Will Murphy <will.murphy@anchore.com> --------- Signed-off-by: Will Murphy <will.murphy@anchore.com>
2023-11-07 15:59:13 +00:00
github.com/pelletier/go-toml/v2 v2.1.0 // indirect
Update Syft to v0.55.0 (#906) Co-authored-by: kzantow <kzantow@users.noreply.github.com>
2022-08-30 13:18:17 +00:00
github.com/pierrec/lz4/v4 v4.1.15 // indirect
chore(deps): update Syft to v0.78.0 (#1242) * chore(deps): update Syft to v0.78.0 Signed-off-by: GitHub <noreply@github.com> * fix test location references and package types Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2023-04-19 17:38:06 +00:00
github.com/pjbgf/sha1cd v0.3.0 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/pkg/errors v0.9.1 // indirect
Colorize severity in table output (#1284) * Colorize severity in table output - Create flag "--no-color" to allow disabling the color. By default its enabled. - When "--no-color" not specified highlight severity in its color: - Critical -> Bold Red - High -> Red - Medium -> Yellow - Low -> Green - Negligible -> Blue - Note: Golang doesn't have all colors available. Also, doesn't seem to be able use hex codes properly. - Add termenv to check if the terminal color profile supports colored output. If it doesn't default to noColor Closes #225 Signed-off-by: Shane Dell <shanedell100@gmail.com> * fix: adopt EnvColorProfile to support NO_COLOR Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * fix linting and update snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Shane Dell <shanedell100@gmail.com> Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-10-30 13:57:46 +00:00
github.com/pkg/profile v1.7.0 // indirect
fix: bump fangs to enable setting golang CPE config using env var (#1585) * fix: bump fangs Bump fangs to pull in https://github.com/anchore/fangs/pull/27, which fixes an issue where env vars couldn't be used to set fields on embedded structs in the config struct. Signed-off-by: Will Murphy <will.murphy@anchore.com> * fix: bump fangs to pull in panic fix The previous fangs fix panicked when summarizing configs with embedded structs. Bump fangs to pull in https://github.com/anchore/fangs/pull/29 which fixes this panic. Signed-off-by: Will Murphy <will.murphy@anchore.com> * commit mod tidy Signed-off-by: Will Murphy <will.murphy@anchore.com> * Pull in dependency bumps from main to resolve conflicts Signed-off-by: Will Murphy <will.murphy@anchore.com> --------- Signed-off-by: Will Murphy <will.murphy@anchore.com>
2023-11-07 15:59:13 +00:00
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
chore: bump syft to latest version v0.79.0 (#1250) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-21 16:58:02 +00:00
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
Bump syft to release version v0.39.0 (#645) * bump syft to v0.39.0 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update ByCriteria to log error on failure Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * integration tests now pass Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * bump to v0.39.3 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * raise search failures to warn Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * tidy go.mod/sum Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-26 22:28:08 +00:00
github.com/rivo/uniseg v0.2.0 // indirect
chore(deps): bump github.com/gkampitakis/go-snaps from 0.4.8 to 0.4.10 (#1477) Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps) from 0.4.8 to 0.4.10. - [Release notes](https://github.com/gkampitakis/go-snaps/releases) - [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.4.8...v0.4.10) --- updated-dependencies: - dependency-name: github.com/gkampitakis/go-snaps dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-09-07 14:16:21 +00:00
github.com/rogpeppe/go-internal v1.11.0 // indirect
chore(deps): update Syft to v0.93.0 (#1550) * chore(deps): update Syft to v0.93.0 Signed-off-by: GitHub <noreply@github.com> * fix test to account for go pkg stdlib Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
2023-10-10 18:26:34 +00:00
github.com/saferwall/pe v1.4.7 // indirect
fix: bump fangs to enable setting golang CPE config using env var (#1585) * fix: bump fangs Bump fangs to pull in https://github.com/anchore/fangs/pull/27, which fixes an issue where env vars couldn't be used to set fields on embedded structs in the config struct. Signed-off-by: Will Murphy <will.murphy@anchore.com> * fix: bump fangs to pull in panic fix The previous fangs fix panicked when summarizing configs with embedded structs. Bump fangs to pull in https://github.com/anchore/fangs/pull/29 which fixes this panic. Signed-off-by: Will Murphy <will.murphy@anchore.com> * commit mod tidy Signed-off-by: Will Murphy <will.murphy@anchore.com> * Pull in dependency bumps from main to resolve conflicts Signed-off-by: Will Murphy <will.murphy@anchore.com> --------- Signed-off-by: Will Murphy <will.murphy@anchore.com>
2023-11-07 15:59:13 +00:00
github.com/sagikazarmark/locafero v0.3.0 // indirect
github.com/sagikazarmark/slog-shim v0.1.0 // indirect
chore(deps): update Syft to v0.88.0 (#1466)
2023-08-25 21:23:52 +00:00
github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d // indirect
Add support for scanning RPM files (#917)
2022-09-09 18:56:37 +00:00
github.com/sassoftware/go-rpmutils v0.2.0 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/shopspring/decimal v1.2.0 // indirect
chore(deps): update Syft to v0.86.1 (#1410) * chore(deps): update Syft to v0.86.0 Signed-off-by: GitHub <noreply@github.com> * fix python package metadata shape Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * account for new metadatas added in syft Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump syft to unreleased but fixed version Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
2023-07-31 17:58:36 +00:00
github.com/skeema/knownhosts v1.2.0 // indirect
fix: bump fangs to enable setting golang CPE config using env var (#1585) * fix: bump fangs Bump fangs to pull in https://github.com/anchore/fangs/pull/27, which fixes an issue where env vars couldn't be used to set fields on embedded structs in the config struct. Signed-off-by: Will Murphy <will.murphy@anchore.com> * fix: bump fangs to pull in panic fix The previous fangs fix panicked when summarizing configs with embedded structs. Bump fangs to pull in https://github.com/anchore/fangs/pull/29 which fixes this panic. Signed-off-by: Will Murphy <will.murphy@anchore.com> * commit mod tidy Signed-off-by: Will Murphy <will.murphy@anchore.com> * Pull in dependency bumps from main to resolve conflicts Signed-off-by: Will Murphy <will.murphy@anchore.com> --------- Signed-off-by: Will Murphy <will.murphy@anchore.com>
2023-11-07 15:59:13 +00:00
github.com/sourcegraph/conc v0.3.0 // indirect
chore(deps): update Syft to v0.86.1 (#1410) * chore(deps): update Syft to v0.86.0 Signed-off-by: GitHub <noreply@github.com> * fix python package metadata shape Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * account for new metadatas added in syft Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump syft to unreleased but fixed version Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
2023-07-31 17:58:36 +00:00
github.com/spdx/tools-golang v0.5.3 // indirect
chore(deps): bump github.com/spf13/viper from 1.15.0 to 1.16.0 (#1323) Bumps [github.com/spf13/viper](https://github.com/spf13/viper) from 1.15.0 to 1.16.0. - [Release notes](https://github.com/spf13/viper/releases) - [Commits](https://github.com/spf13/viper/compare/v1.15.0...v1.16.0) --- updated-dependencies: - dependency-name: github.com/spf13/viper dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-05-30 16:13:39 +00:00
github.com/spf13/cast v1.5.1 // indirect
Colorize severity in table output (#1284) * Colorize severity in table output - Create flag "--no-color" to allow disabling the color. By default its enabled. - When "--no-color" not specified highlight severity in its color: - Critical -> Bold Red - High -> Red - Medium -> Yellow - Low -> Green - Negligible -> Blue - Note: Golang doesn't have all colors available. Also, doesn't seem to be able use hex codes properly. - Add termenv to check if the terminal color profile supports colored output. If it doesn't default to noColor Closes #225 Signed-off-by: Shane Dell <shanedell100@gmail.com> * fix: adopt EnvColorProfile to support NO_COLOR Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * fix linting and update snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Shane Dell <shanedell100@gmail.com> Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-10-30 13:57:46 +00:00
github.com/spf13/pflag v1.0.5 // indirect
fix: bump fangs to enable setting golang CPE config using env var (#1585) * fix: bump fangs Bump fangs to pull in https://github.com/anchore/fangs/pull/27, which fixes an issue where env vars couldn't be used to set fields on embedded structs in the config struct. Signed-off-by: Will Murphy <will.murphy@anchore.com> * fix: bump fangs to pull in panic fix The previous fangs fix panicked when summarizing configs with embedded structs. Bump fangs to pull in https://github.com/anchore/fangs/pull/29 which fixes this panic. Signed-off-by: Will Murphy <will.murphy@anchore.com> * commit mod tidy Signed-off-by: Will Murphy <will.murphy@anchore.com> * Pull in dependency bumps from main to resolve conflicts Signed-off-by: Will Murphy <will.murphy@anchore.com> --------- Signed-off-by: Will Murphy <will.murphy@anchore.com>
2023-11-07 15:59:13 +00:00
github.com/spf13/viper v1.17.0 // indirect
github.com/subosito/gotenv v1.6.0 // indirect
chore(deps): update Syft to v0.86.1 (#1410) * chore(deps): update Syft to v0.86.0 Signed-off-by: GitHub <noreply@github.com> * fix python package metadata shape Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * account for new metadatas added in syft Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump syft to unreleased but fixed version Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
2023-07-31 17:58:36 +00:00
github.com/sylabs/sif/v2 v2.11.5 // indirect
Update Syft to v0.55.0 (#906) Co-authored-by: kzantow <kzantow@users.noreply.github.com>
2022-08-30 13:18:17 +00:00
github.com/sylabs/squashfs v0.6.1 // indirect
Update Syft to v0.53.4 (#856)
2022-08-04 13:37:48 +00:00
github.com/therootcompany/xz v1.0.1 // indirect
chore(deps): bump github.com/gkampitakis/go-snaps from 0.4.11 to 0.4.12 (#1597) Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps) from 0.4.11 to 0.4.12. - [Release notes](https://github.com/gkampitakis/go-snaps/releases) - [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.4.11...v0.4.12) --- updated-dependencies: - dependency-name: github.com/gkampitakis/go-snaps dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-09 15:52:24 +00:00
github.com/tidwall/gjson v1.17.0 // indirect
Port UI to bubbletea (#1385) * initial port to bubbletea Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove jotframe UI Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add bubbletea component tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update main.go refs to cmd package Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * move goreleaser build dir to cmd Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgrade yardstick for grype source installs and fix post-ui tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * ensure stable severity map in UI component test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add windows support for tui Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-07-13 17:13:48 +00:00
github.com/tidwall/match v1.1.1 // indirect
github.com/tidwall/pretty v1.2.1 // indirect
github.com/tidwall/sjson v1.2.5 // indirect
Bump syft to release version v0.39.0 (#645) * bump syft to v0.39.0 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update ByCriteria to log error on failure Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * integration tests now pass Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * bump to v0.39.3 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * raise search failures to warn Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * tidy go.mod/sum Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-26 22:28:08 +00:00
github.com/ulikunitz/xz v0.5.10 // indirect
chore(deps): bump github.com/anchore/syft from 0.75.0 to 0.76.0 (#1207) * chore(deps): bump github.com/anchore/syft from 0.75.0 to 0.76.0 Bumps [github.com/anchore/syft](https://github.com/anchore/syft) from 0.75.0 to 0.76.0. - [Release notes](https://github.com/anchore/syft/releases) - [Changelog](https://github.com/anchore/syft/blob/main/.goreleaser.yaml) - [Commits](https://github.com/anchore/syft/compare/v0.75.0...v0.76.0) --- updated-dependencies: - dependency-name: github.com/anchore/syft dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore: update ParseInput signature with new syft version Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> * fix: update integration tests Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-04-03 14:48:33 +00:00
github.com/vbatts/go-mtree v0.5.3 // indirect
bump syft to pre-release of v0.81.0 (#1310) Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
2023-05-22 14:17:34 +00:00
github.com/vbatts/tar-split v0.11.3 // indirect
chore(deps): update Syft to v0.87.1 (#1432)
2023-08-17 19:39:41 +00:00
github.com/vifraa/gopom v1.0.0 // indirect
chore(deps): update Syft to v0.78.0 (#1242) * chore(deps): update Syft to v0.78.0 Signed-off-by: GitHub <noreply@github.com> * fix test location references and package types Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2023-04-19 17:38:06 +00:00
github.com/xanzy/ssh-agent v0.3.3 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778 // indirect
feat: update go-sarif library to use latest release (#1563) --------- Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-10-17 15:18:22 +00:00
github.com/zclconf/go-cty v1.14.0 // indirect
fix: terminal clobbering when commands return errors (#1505) Signed-off-by: Keith Zantow <kzantow@gmail.com>
2023-09-20 16:17:33 +00:00
github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1 // indirect
chore(deps): update Syft to v0.86.1 (#1410) * chore(deps): update Syft to v0.86.0 Signed-off-by: GitHub <noreply@github.com> * fix python package metadata shape Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * account for new metadatas added in syft Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump syft to unreleased but fixed version Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
2023-07-31 17:58:36 +00:00
go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352 // indirect
Update Syft to v0.68.0 (#1064)
2023-01-21 14:40:51 +00:00
go.opencensus.io v0.24.0 // indirect
Upgrade syft to v0.91.0 (#1508) * bump syft to main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgdate cyclonedx presenter fixtures (bump from cdx 1.4 to 1.5) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * allow for pkg type exceptions for github actions and workflows Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx json schema from v1.4 to v1.5 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump to syft v0.91.0 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgrade go-setup action to v4 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove asset upload from release workflow Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-09-20 20:39:23 +00:00
go.opentelemetry.io/otel v1.14.0 // indirect
go.opentelemetry.io/otel/trace v1.14.0 // indirect
fix: bump fangs to enable setting golang CPE config using env var (#1585) * fix: bump fangs Bump fangs to pull in https://github.com/anchore/fangs/pull/27, which fixes an issue where env vars couldn't be used to set fields on embedded structs in the config struct. Signed-off-by: Will Murphy <will.murphy@anchore.com> * fix: bump fangs to pull in panic fix The previous fangs fix panicked when summarizing configs with embedded structs. Bump fangs to pull in https://github.com/anchore/fangs/pull/29 which fixes this panic. Signed-off-by: Will Murphy <will.murphy@anchore.com> * commit mod tidy Signed-off-by: Will Murphy <will.murphy@anchore.com> * Pull in dependency bumps from main to resolve conflicts Signed-off-by: Will Murphy <will.murphy@anchore.com> --------- Signed-off-by: Will Murphy <will.murphy@anchore.com>
2023-11-07 15:59:13 +00:00
go.uber.org/atomic v1.9.0 // indirect
chore: prune cosign dependency for grype builds (#1100) * feat: segment cosign dependency for grype builds for faster build times Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2023-01-31 16:42:40 +00:00
go.uber.org/goleak v1.2.0 // indirect
fix: bump fangs to enable setting golang CPE config using env var (#1585) * fix: bump fangs Bump fangs to pull in https://github.com/anchore/fangs/pull/27, which fixes an issue where env vars couldn't be used to set fields on embedded structs in the config struct. Signed-off-by: Will Murphy <will.murphy@anchore.com> * fix: bump fangs to pull in panic fix The previous fangs fix panicked when summarizing configs with embedded structs. Bump fangs to pull in https://github.com/anchore/fangs/pull/29 which fixes this panic. Signed-off-by: Will Murphy <will.murphy@anchore.com> * commit mod tidy Signed-off-by: Will Murphy <will.murphy@anchore.com> * Pull in dependency bumps from main to resolve conflicts Signed-off-by: Will Murphy <will.murphy@anchore.com> --------- Signed-off-by: Will Murphy <will.murphy@anchore.com>
2023-11-07 15:59:13 +00:00
go.uber.org/multierr v1.9.0 // indirect
chore(deps): update Syft to v0.97.0 (#1608) * chore(deps): update Syft to v0.97.0 Signed-off-by: GitHub <noreply@github.com> * fix syft api usage Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
2023-11-17 00:20:28 +00:00
golang.org/x/crypto v0.15.0 // indirect
chore(deps): update Syft to v0.95.0 (#1591)
2023-11-07 20:42:43 +00:00
golang.org/x/mod v0.14.0 // indirect
chore(deps): update Syft to v0.97.0 (#1608) * chore(deps): update Syft to v0.97.0 Signed-off-by: GitHub <noreply@github.com> * fix syft api usage Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
2023-11-17 00:20:28 +00:00
golang.org/x/net v0.18.0 // indirect
fix: bump fangs to enable setting golang CPE config using env var (#1585) * fix: bump fangs Bump fangs to pull in https://github.com/anchore/fangs/pull/27, which fixes an issue where env vars couldn't be used to set fields on embedded structs in the config struct. Signed-off-by: Will Murphy <will.murphy@anchore.com> * fix: bump fangs to pull in panic fix The previous fangs fix panicked when summarizing configs with embedded structs. Bump fangs to pull in https://github.com/anchore/fangs/pull/29 which fixes this panic. Signed-off-by: Will Murphy <will.murphy@anchore.com> * commit mod tidy Signed-off-by: Will Murphy <will.murphy@anchore.com> * Pull in dependency bumps from main to resolve conflicts Signed-off-by: Will Murphy <will.murphy@anchore.com> --------- Signed-off-by: Will Murphy <will.murphy@anchore.com>
2023-11-07 15:59:13 +00:00
golang.org/x/oauth2 v0.12.0 // indirect
chore(deps): update Syft to v0.90.0 (#1486) Signed-off-by: GitHub <noreply@github.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com>
2023-09-12 12:45:37 +00:00
golang.org/x/sync v0.3.0 // indirect
chore(deps): update Syft to v0.97.0 (#1608) * chore(deps): update Syft to v0.97.0 Signed-off-by: GitHub <noreply@github.com> * fix syft api usage Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>
2023-11-17 00:20:28 +00:00
golang.org/x/sys v0.14.0 // indirect
golang.org/x/term v0.14.0 // indirect
golang.org/x/text v0.14.0 // indirect
Upgrade syft to v0.91.0 (#1508) * bump syft to main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgdate cyclonedx presenter fixtures (bump from cdx 1.4 to 1.5) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * allow for pkg type exceptions for github actions and workflows Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx json schema from v1.4 to v1.5 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump to syft v0.91.0 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * upgrade go-setup action to v4 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove asset upload from release workflow Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-09-20 20:39:23 +00:00
golang.org/x/tools v0.13.0 // indirect
chore: update syft to v0.60.3 (#978)
2022-11-03 16:19:03 +00:00
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
fix: bump fangs to enable setting golang CPE config using env var (#1585) * fix: bump fangs Bump fangs to pull in https://github.com/anchore/fangs/pull/27, which fixes an issue where env vars couldn't be used to set fields on embedded structs in the config struct. Signed-off-by: Will Murphy <will.murphy@anchore.com> * fix: bump fangs to pull in panic fix The previous fangs fix panicked when summarizing configs with embedded structs. Bump fangs to pull in https://github.com/anchore/fangs/pull/29 which fixes this panic. Signed-off-by: Will Murphy <will.murphy@anchore.com> * commit mod tidy Signed-off-by: Will Murphy <will.murphy@anchore.com> * Pull in dependency bumps from main to resolve conflicts Signed-off-by: Will Murphy <will.murphy@anchore.com> --------- Signed-off-by: Will Murphy <will.murphy@anchore.com>
2023-11-07 15:59:13 +00:00
google.golang.org/api v0.143.0 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
google.golang.org/appengine v1.6.7 // indirect
fix: bump fangs to enable setting golang CPE config using env var (#1585) * fix: bump fangs Bump fangs to pull in https://github.com/anchore/fangs/pull/27, which fixes an issue where env vars couldn't be used to set fields on embedded structs in the config struct. Signed-off-by: Will Murphy <will.murphy@anchore.com> * fix: bump fangs to pull in panic fix The previous fangs fix panicked when summarizing configs with embedded structs. Bump fangs to pull in https://github.com/anchore/fangs/pull/29 which fixes this panic. Signed-off-by: Will Murphy <will.murphy@anchore.com> * commit mod tidy Signed-off-by: Will Murphy <will.murphy@anchore.com> * Pull in dependency bumps from main to resolve conflicts Signed-off-by: Will Murphy <will.murphy@anchore.com> --------- Signed-off-by: Will Murphy <will.murphy@anchore.com>
2023-11-07 15:59:13 +00:00
google.golang.org/genproto v0.0.0-20230913181813-007df8e322eb // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20230913181813-007df8e322eb // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20230920204549-e6e6cdab5c13 // indirect
Incorporate format API changes from syft (#1582) * incorporate changes from anchore/syft#2228 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix testing utils to use syft SBOM Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-11-02 19:25:48 +00:00
google.golang.org/grpc v1.58.3 // indirect
Ignore/add match results based on OpenVEX documents (#1397) * go.mod: Pull OpenVEX go modules This commit pulls the OpenVEX libraries into the grype source. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add generic VEX processor package This commit adds a generic VEX processor package. It is implementation agnostic. It has a single option for now: The documents used to load the VEX data. The processor has a single method: ApplyVEX() which takes a set of scan results and applies VEX data to them. For now, the only modification that is done is filtering of results, that is moving results to the ignored list as a response to VEX documents. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * vex: Add OpenVEX processor implementation This commit adds an openvex implementation of the vex processor. It also wires the VEX processor to use it as default. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Table presenter: Highligt results suppressed by VEX This commit marks results suppressed by VEX when presenting them to the user. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Define VEX status constants This commit defines a set of local constants of each of the VEX statuses based on the openvex constants. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add VexStatus to ignore rules This commit modifies the ignore rules structure to support defining a vex status. Any rules defining vex are ignored by the standard ignore rules processing as they will be handled by the VEX processor. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add IgnoreRule HasConditions method Adds a new HasConditions method to the IgnoreRule object to check if the rule is empty. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Control VEX filtering through IgnoreRules This commit modifies how the vex processor is controlled. The processor now takes a list of IgnoreRules which can act on the VEX status in addition to the regular rule parameters. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * vex: Allow rules to match on VEX justification This commit expands the ingore rules to also work on vex the justification of not_affected statements. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Use go-vex merge implementation Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add OpenVEX matcher to matcher list This commit adds a new entry to the matchers: An openvex matcher This matcher is used when openvex augments results, moving matches from the ignore list to the active results. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add vex.AugmentMatches() to the vex processor This commit adds a new AugmentMatches() phase to the VEX processor. This new step goes throught the configured ignore rules and acts on any that have `affected` or `under_investigtion` as status. The purpose of this rule is to move matches back from the ignored matches list to the active results when a statement with either of those statuses apply to ignored matches. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Parse context identifiers using GGC This commit modifies the identifier synthesizer function to parse references using GGCR. It also adds a simple test. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Bump funlen linter to 73 This commit bumps the maximum function length to 73 to accomodate the new flag in AddFlags() Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@chainguard.dev> * Add VEX testing to matchers test This commit adds a new test and fixtures to test the VEX matchers along the rest of the matchers in TestMatchByImage(). As the VEX matchers operate on previously ignored matches a new loop was added to the test to accomodate the different testing model. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * add vex status and justification to ignored rule json model Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * nit rename + add TODO question about augmenting ignored matches Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * nit document comment updates + common variable extraction Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * migrate legacy matcher function to vulnerability matcher object Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update tui to respond to ignored and dropped matches Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * migrate vex processing to vulnerability match object Based on Alex's previous caommit Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Migrate VEX options and app config from legacy CLI Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * update table snapshot tests with suppressed vex entries Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for match.Matches.Diff() Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for vex processor Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting and restore global funlen rule Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove grpc pin Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * always return remaining and ignroed matches from matcher object Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * Add VEX documentation to main README This commit adds a VEX section to the main Grype README. It adds an example document and details on how vex rules can be written. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> --------- Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@chainguard.dev> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-09-13 19:26:12 +00:00
google.golang.org/protobuf v1.31.0 // indirect
Update Syft to v0.55.0 (#906) Co-authored-by: kzantow <kzantow@users.noreply.github.com>
2022-08-30 13:18:17 +00:00
gopkg.in/ini.v1 v1.67.0 // indirect
chore(deps): update Syft to v0.78.0 (#1242) * chore(deps): update Syft to v0.78.0 Signed-off-by: GitHub <noreply@github.com> * fix test location references and package types Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
2023-04-19 17:38:06 +00:00
gopkg.in/warnings.v0 v0.1.2 // indirect
update grype to use syft v0.52.0 (#838)
2022-07-22 16:12:18 +00:00
gopkg.in/yaml.v3 v3.0.1 // indirect
chore(deps): update Syft to v0.95.0 (#1591)
2023-11-07 20:42:43 +00:00
modernc.org/libc v1.29.0 // indirect
modernc.org/mathutil v1.6.0 // indirect
modernc.org/memory v1.7.2 // indirect
modernc.org/sqlite v1.27.0 // indirect
update go -> 1.17 (#628) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
2022-02-11 15:50:13 +00:00
)
Reference in a new issue Copy permalink