Mirrors/grype
2
0
Fork 0
mirror of https://github.com/anchore/grype synced 2024-11-10 14:44:12 +00:00
Code Issues Projects Releases Packages Wiki Activity
grype/.gitignore

46 lines
505 B
Text
Raw Normal View History

Ignore/add match results based on OpenVEX documents (#1397) * go.mod: Pull OpenVEX go modules This commit pulls the OpenVEX libraries into the grype source. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add generic VEX processor package This commit adds a generic VEX processor package. It is implementation agnostic. It has a single option for now: The documents used to load the VEX data. The processor has a single method: ApplyVEX() which takes a set of scan results and applies VEX data to them. For now, the only modification that is done is filtering of results, that is moving results to the ignored list as a response to VEX documents. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * vex: Add OpenVEX processor implementation This commit adds an openvex implementation of the vex processor. It also wires the VEX processor to use it as default. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Table presenter: Highligt results suppressed by VEX This commit marks results suppressed by VEX when presenting them to the user. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Define VEX status constants This commit defines a set of local constants of each of the VEX statuses based on the openvex constants. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add VexStatus to ignore rules This commit modifies the ignore rules structure to support defining a vex status. Any rules defining vex are ignored by the standard ignore rules processing as they will be handled by the VEX processor. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add IgnoreRule HasConditions method Adds a new HasConditions method to the IgnoreRule object to check if the rule is empty. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Control VEX filtering through IgnoreRules This commit modifies how the vex processor is controlled. The processor now takes a list of IgnoreRules which can act on the VEX status in addition to the regular rule parameters. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * vex: Allow rules to match on VEX justification This commit expands the ingore rules to also work on vex the justification of not_affected statements. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Use go-vex merge implementation Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add OpenVEX matcher to matcher list This commit adds a new entry to the matchers: An openvex matcher This matcher is used when openvex augments results, moving matches from the ignore list to the active results. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Add vex.AugmentMatches() to the vex processor This commit adds a new AugmentMatches() phase to the VEX processor. This new step goes throught the configured ignore rules and acts on any that have `affected` or `under_investigtion` as status. The purpose of this rule is to move matches back from the ignored matches list to the active results when a statement with either of those statuses apply to ignored matches. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Parse context identifiers using GGC This commit modifies the identifier synthesizer function to parse references using GGCR. It also adds a simple test. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Bump funlen linter to 73 This commit bumps the maximum function length to 73 to accomodate the new flag in AddFlags() Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@chainguard.dev> * Add VEX testing to matchers test This commit adds a new test and fixtures to test the VEX matchers along the rest of the matchers in TestMatchByImage(). As the VEX matchers operate on previously ignored matches a new loop was added to the test to accomodate the different testing model. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * add vex status and justification to ignored rule json model Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * nit rename + add TODO question about augmenting ignored matches Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * nit document comment updates + common variable extraction Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * migrate legacy matcher function to vulnerability matcher object Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update tui to respond to ignored and dropped matches Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * migrate vex processing to vulnerability match object Based on Alex's previous caommit Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * Migrate VEX options and app config from legacy CLI Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> * update table snapshot tests with suppressed vex entries Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for match.Matches.Diff() Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for vex processor Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting and restore global funlen rule Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove grpc pin Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * always return remaining and ignroed matches from matcher object Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * Add VEX documentation to main README This commit adds a VEX section to the main Grype README. It adds an example document and details on how vex rules can be written. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> --------- Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev> Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@chainguard.dev> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-09-13 19:26:12 +00:00
/.tool-versions
bump syft to pre-release of v0.81.0 (#1310) Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
2023-05-22 14:17:34 +00:00
/go.work
/go.work.sum
Add registry certificate verification support (#1232) * add registry certificate verification support * modify go.mod * rename registry cert options, add docs, and add test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update to account for changes in anchore/stereoscope#195 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: lishituo <24578666@qq.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
2023-08-29 15:51:27 +00:00
/.grype.yaml
bump syft to pre-release of v0.81.0 (#1310) Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
2023-05-22 14:17:34 +00:00
add changelog generation into the release process (#167) Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
2020-09-25 20:59:00 +00:00
CHANGELOG.md
fix: use PEP440 for Python package version comparison (#1510) Previously, grype used fuzzy matcher for Python packages, since there are cases in PEP440 that are not strictly semver. Switch to a library that does PEP440 parsing and comparison for python version constraints. Signed-off-by: Will Murphy <will.murphy@anchore.com>
2023-09-22 17:32:48 +00:00
/VERSION
add json presenter snapshots
2020-07-24 01:43:14 +00:00
/snapshot/
/dist/
Add matching by CPE (#40) * Commit just to share progress, needs to be squashed/fixed-up once working. Signed-off-by: Zach Hill <zach@anchore.com> * minor fixes * add cpe obj * add cpe matching * report cpe in search key * add verbose logging for matches; bump vulnscan-db ver * add dev profiler option; tweak logging * test support for CPE URI bindings addresses https://github.com/anchore/vulnscan/pull/40#discussion_r455389937 * rename nvdv2 to nvd * reduce scope of cpe matching to non-distro packages * normalize nil constraint strings Co-authored-by: Zach Hill <zach@anchore.com>
2020-07-16 19:12:19 +00:00
*.profile
.server
Add inline-comparison as acceptance test (#106) * add inline-compare as acceptance tests Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * improve RPM matching with source indirection matching Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add comments to compare-* make targets Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * clean inline-compare image test names Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * bump syft version to get rpm field enhancements Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
2020-08-10 15:03:48 +00:00
*.fingerprint
Add matching by CPE (#40) * Commit just to share progress, needs to be squashed/fixed-up once working. Signed-off-by: Zach Hill <zach@anchore.com> * minor fixes * add cpe obj * add cpe matching * report cpe in search key * add verbose logging for matches; bump vulnscan-db ver * add dev profiler option; tweak logging * test support for CPE URI bindings addresses https://github.com/anchore/vulnscan/pull/40#discussion_r455389937 * rename nvdv2 to nvd * reduce scope of cpe matching to non-distro packages * normalize nil constraint strings Co-authored-by: Zach Hill <zach@anchore.com>
2020-07-16 19:12:19 +00:00
/metadata.json
/listing.json
add FindVulnerability lib function, wire up main with matcher
2020-06-01 11:21:07 +00:00
.vscode/
*.db
Add matching by CPE (#40) * Commit just to share progress, needs to be squashed/fixed-up once working. Signed-off-by: Zach Hill <zach@anchore.com> * minor fixes * add cpe obj * add cpe matching * report cpe in search key * add verbose logging for matches; bump vulnscan-db ver * add dev profiler option; tweak logging * test support for CPE URI bindings addresses https://github.com/anchore/vulnscan/pull/40#discussion_r455389937 * rename nvdv2 to nvd * reduce scope of cpe matching to non-distro packages * normalize nil constraint strings Co-authored-by: Zach Hill <zach@anchore.com>
2020-07-16 19:12:19 +00:00
*.db-journal
add curation of db file
2020-06-19 14:12:29 +00:00
!**/test-fixtures/**/*.db
initial project structure
2020-05-26 14:37:28 +00:00
*.tar
Add matching by CPE (#40) * Commit just to share progress, needs to be squashed/fixed-up once working. Signed-off-by: Zach Hill <zach@anchore.com> * minor fixes * add cpe obj * add cpe matching * report cpe in search key * add verbose logging for matches; bump vulnscan-db ver * add dev profiler option; tweak logging * test support for CPE URI bindings addresses https://github.com/anchore/vulnscan/pull/40#discussion_r455389937 * rename nvdv2 to nvd * reduce scope of cpe matching to non-distro packages * normalize nil constraint strings Co-authored-by: Zach Hill <zach@anchore.com>
2020-07-16 19:12:19 +00:00
*tar.gz
initial project structure
2020-05-26 14:37:28 +00:00
.idea/
chore(deps): update Syft to v0.80.0 (#1276)
2023-05-07 17:57:12 +00:00
*.iml
initial project structure
2020-05-26 14:37:28 +00:00
*.log
.images
.tmp/
add rpm version + constraint, rpmdb matching; refactor dpkg constraint
2020-07-07 13:12:31 +00:00
*.tmp
initial project structure
2020-05-26 14:37:28 +00:00
coverage.txt
fix: Exclude binary packages that have overlap by file ownership relationship (#1024)
2022-12-12 20:59:47 +00:00
# OS files
.DS_Store
initial project structure
2020-05-26 14:37:28 +00:00
# Binaries for programs and plugins
*.exe
*.exe~
*.dll
*.so
*.dylib
chore: update codeql to pinned v2 with correct write permissions
2022-11-14 15:39:45 +00:00
/grype/grype
add main bin ignore (#1305) Signed-off-by: guoguangwu <guoguangwu@magic-shield.com>
2023-05-22 13:14:31 +00:00
main
initial project structure
2020-05-26 14:37:28 +00:00
# Test binary, build with `go test -c`
*.test
# Output of the go coverage tool, specifically when used with LiteIDE
add FindVulnerability lib function, wire up main with matcher
2020-06-01 11:21:07 +00:00
*.out
Reference in a new issue Copy permalink