Mirrors/grype
2
0
Fork 0
mirror of https://github.com/anchore/grype synced 2024-11-14 00:07:08 +00:00
Code Issues Projects Releases Packages Wiki Activity
491 commits 32 branches 157 tags 14 MiB
Commit graph

108 commits

Author SHA1 Message Date
Dan Luhring
e6831d9444
Update Syft to v0.24.1 (#433) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-09-28 16:55:50 -04:00
Alex Goodman
608e126dc6
pull in grype-db default language namespace namer + fix imbalanced version v prefixes (#434) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-09-28 16:55:27 -04:00
Vijay Pillai
1a7c9d1779
Bugfixes + Integration test for sbom input vs grype library comparison (#424) 
This change both adds a test to identify and fixes differences between loading sboms from json and loading sboms from Syft as a library.
* adds integration test that compares SBOM input vs image input
* fix integration test cache path
* Add handler for ApkMetadataType in partialSyftPackage.UnmarshalJSON
* Fix Epoch missing from Package.New RpmdbMetadataType handler and update RpmDbMetadata test in TestNew_MetadataExtraction
* bump syft to version 0.24.0
* update license check for packageurl-go

Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
Co-authored-by: Vijay Pillai <vijay.pillai@anchore.com>

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Signed-off-by: Vijay Pillai <vijay.pillai@anchore.com>
 2021-09-22 21:53:32 -04:00
Dan Palmer
83c6ee23a9
Update grype-db dependency, add some SLES tests (#413) 
* Update grype-db dependency, add some SLES tests

Signed-off-by: Dan Palmer <dan.palmer@anchore.com>
 2021-09-14 15:08:32 -04:00
Christopher Angelo Phillips
f3e3e832a8
bump syft to the newest 0.23.0 version - tidy mod (#414) 
* bump syft to the newest 0.23.0 version - tidy mod
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* update integration test to use new pointer
syft source.New() was changed to return a pointer
rather than value for 0.23.0 this commit updates our 
integration tests to reflect that change
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-09-13 16:46:41 -04:00
Zane Burstein
434a774106
Match against Alpine source packages (#407) 
* Update go-version package and add test

This is being updated due to an issue that was encountered in the lessThanEqual constraint in go-version: https://github.com/anchore/go-version/pull/2. Was disovered while adding tests for apk origin package matching

Signed-off-by: Zane Burstein <zane.burstein@anchore.com>

* Added matching with source package for apk

This change allows grype to match with a packages source package for apk. Adds APKMetadata with OriginPackage, new matching logic in apk matchers, and tests

Signed-off-by: Zane Burstein <zane.burstein@anchore.com>
 2021-09-09 07:42:11 -04:00
Keith Zantow
4e8794d610
Upgrade syft to 0.21.0 #385 (#396) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2021-08-23 15:15:42 -04:00
Alex Goodman
01a77d5c45
bump syft to v0.20.0 (#384) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-08-18 11:20:25 -04:00
Keith Zantow
7b044b1154
Add option to enable http registry connections #334 (#380) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2021-08-17 12:52:08 -04:00
Alex Goodman
fbc6bdfd8d
Update MSRC matching to include product ID in the suffix (#373) 
* use squashed grype-db branch

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add more tests around the msrc matcher

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* incorporate the grype-db updates for msrc

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-08-12 08:35:30 -04:00
Alex Goodman
729aec24a6
incorporate CPE generator enhancements from syft (#375) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-08-10 09:06:40 -04:00
Alex Goodman
c7f33a8e4f
bump grype-db version to use main branch 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-07-20 12:18:29 -04:00
Dan Luhring
6647373e4d
Run go mod tidy 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-07-01 14:45:01 -04:00
Dan Luhring
f4858fee44
Add test for nil distro 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-07-01 11:50:01 -04:00
Dan Luhring
787dfd8f02
Update syft to v0.19.0 (#352) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-06-30 11:09:44 -04:00
Dan Luhring
1714806a4c
Update syft to v0.18.0 (#351) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-06-29 21:34:26 +00:00
Alex Goodman
27c3437e26
ensure RPM epoch is optional 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-06-16 09:23:46 -04:00
Alex Goodman
ed054f2038
incorporate multiple match details to accomodate more accurate reported CPE matching info 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-05-30 11:51:14 -04:00
Alex Goodman
402a53d14c
fix tests for v3 schema updates 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-05-27 15:25:21 -04:00
Alex Goodman
80bb416daa
bump grype-db to pull in v3 schema changes + ensure related vulns are not nil 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-05-27 14:17:05 -04:00
Alex Goodman
1849d7eaea
add vendor advisories and adjust fixes data shape 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-05-26 13:54:19 -04:00
Alex Goodman
f99da01100 add staging update-url to cli tests + add pre-release check 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-05-26 12:30:21 -04:00
Alex Goodman
a6585f4842
add go.mod tidy CI check 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-05-25 13:43:53 -04:00
Dan Luhring
8da410c578
Allow registry auth config without authority value (#322) 
* Allow registry auth config without authority value

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Update CLI tests for new stereoscope log output

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-05-24 16:06:09 -04:00
Alex Goodman
594cfd05c9
add java virutal path to package metadata 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-05-24 11:23:31 -04:00
Alex Goodman
a8577eade7
add package sorting for artifacts in json document 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-05-11 16:40:27 -04:00
Alfredo Deza
6a7a0a7e01 update dependencies 
Signed-off-by: Alfredo Deza <adeza@anchore.com>
 2021-05-03 14:56:00 -04:00
Alex Goodman
28f6051204
update syft to v0.15.1 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-04-22 17:29:01 -04:00
Alex Goodman
871722dd1e
bump syft to add manifest metadata to source for registry source 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-04-14 08:10:09 -04:00
Alex Goodman
31f44b7302
update syft and stereoscope to pull in registry source 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-04-13 16:09:27 -04:00
Dan Luhring
d4c3fa5f3b
Add tests for template presenter and consolidate data generation code 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-04-09 09:34:58 -04:00
Alex Goodman
8704dbb2bc
pull in registry credential encoding fix 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-04-05 14:27:42 -04:00
Alex Goodman
ebe1371d47
bump syft to pull in repoDigests onto image metadata (#274) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-04-01 21:28:53 +00:00
Alex Goodman
976e3d68eb
pull in syft v0.14.0 and further decouple presenters from syft 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-04-01 10:01:07 -04:00
Alfredo Deza
f2b815d760 bump go dependencies to use grype-db with v2 schema 
This will cause grype to set its schema version requirement to 2

Signed-off-by: Alfredo Deza <adeza@anchore.com>
 2021-03-30 13:52:31 -04:00
Alex Goodman
a399647afc
add docker image to release process 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-03-23 10:00:13 -04:00
Alfredo Deza
6c3cb94c03 update grype-db dependency 
Signed-off-by: Alfredo Deza <adeza@anchore.com>
 2021-03-05 09:32:13 -05:00
Alex Goodman
0a9408005f
refactor constraint expression parser to allow for quoted versions 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-02-16 09:15:17 -05:00
Dan Luhring
7ec9212c70
Update syft to v0.12.4 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-01-27 12:29:54 -05:00
Alex Goodman
0699e6a6ca
add package provider abstraction and update json document input 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-12-14 07:55:54 -05:00
Alex Goodman
137be60f28
add grype pkg.Package adapter for syft pkg.Package and remove pkg.Catalog 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-12-14 07:55:54 -05:00
Alex Goodman
7779e71b7e
update syft from v0.9.1 to v0.9.2 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-12-03 16:57:36 -05:00
Dan Luhring
159e168867
Update syft from 0.9.0 to 0.9.1 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2020-12-02 18:24:07 -05:00
Dan Luhring
d78c665925
Update syft from 0.8.1 to 0.9.0 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2020-12-02 15:54:46 -05:00
Alex Goodman
627aa77842
remove CPE generation (rely on static CPES from syft instead) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-11-20 06:43:45 -05:00
Alex Goodman
25d6ec6c79
add SBOM JSON document input from syft 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-11-17 17:55:24 -05:00
Alex Goodman
4ed516e784
bump syft to v0.7.1 (with related fixes) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-11-12 10:02:40 -05:00
Dan Luhring
5d21595414
Update to Syft v0.5.1 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2020-11-05 13:11:11 -05:00
Alex Goodman
2dcb017295
update python and javascript catalogers 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-10-23 11:34:18 -04:00
Alex Goodman
da614aa4ac
bump syft version (add package.json, rename bundler to ruby) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-10-19 08:02:13 -04:00