Mirrors/grype
2
0
Fork 0
mirror of https://github.com/anchore/grype synced 2024-11-15 00:37:08 +00:00
Code Issues Projects Releases Packages Wiki Activity
929 commits 30 branches 157 tags 14 MiB
Commit graph

254 commits

Author SHA1 Message Date
Christopher Angelo Phillips
f3e3e832a8
bump syft to the newest 0.23.0 version - tidy mod (#414) 
* bump syft to the newest 0.23.0 version - tidy mod
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

* update integration test to use new pointer
syft source.New() was changed to return a pointer
rather than value for 0.23.0 this commit updates our 
integration tests to reflect that change
Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
 2021-09-13 16:46:41 -04:00
Zane Burstein
434a774106
Match against Alpine source packages (#407) 
* Update go-version package and add test

This is being updated due to an issue that was encountered in the lessThanEqual constraint in go-version: https://github.com/anchore/go-version/pull/2. Was disovered while adding tests for apk origin package matching

Signed-off-by: Zane Burstein <zane.burstein@anchore.com>

* Added matching with source package for apk

This change allows grype to match with a packages source package for apk. Adds APKMetadata with OriginPackage, new matching logic in apk matchers, and tests

Signed-off-by: Zane Burstein <zane.burstein@anchore.com>
 2021-09-09 07:42:11 -04:00
Keith Zantow
4e8794d610
Upgrade syft to 0.21.0 #385 (#396) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2021-08-23 15:15:42 -04:00
Alex Goodman
01a77d5c45
bump syft to v0.20.0 (#384) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-08-18 11:20:25 -04:00
Keith Zantow
7b044b1154
Add option to enable http registry connections #334 (#380) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2021-08-17 12:52:08 -04:00
Alex Goodman
fbc6bdfd8d
Update MSRC matching to include product ID in the suffix (#373) 
* use squashed grype-db branch

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add more tests around the msrc matcher

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* incorporate the grype-db updates for msrc

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-08-12 08:35:30 -04:00
Alex Goodman
729aec24a6
incorporate CPE generator enhancements from syft (#375) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-08-10 09:06:40 -04:00
Alex Goodman
c7f33a8e4f
bump grype-db version to use main branch 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-07-20 12:18:29 -04:00
Dan Luhring
6647373e4d
Run go mod tidy 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-07-01 14:45:01 -04:00
Dan Luhring
f4858fee44
Add test for nil distro 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-07-01 11:50:01 -04:00
Dan Luhring
787dfd8f02
Update syft to v0.19.0 (#352) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-06-30 11:09:44 -04:00
Dan Luhring
1714806a4c
Update syft to v0.18.0 (#351) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-06-29 21:34:26 +00:00
Alex Goodman
27c3437e26
ensure RPM epoch is optional 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-06-16 09:23:46 -04:00
Alex Goodman
ed054f2038
incorporate multiple match details to accomodate more accurate reported CPE matching info 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-05-30 11:51:14 -04:00
Alex Goodman
402a53d14c
fix tests for v3 schema updates 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-05-27 15:25:21 -04:00
Alex Goodman
80bb416daa
bump grype-db to pull in v3 schema changes + ensure related vulns are not nil 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-05-27 14:17:05 -04:00
Alex Goodman
1849d7eaea
add vendor advisories and adjust fixes data shape 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-05-26 13:54:19 -04:00
Alex Goodman
f99da01100 add staging update-url to cli tests + add pre-release check 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-05-26 12:30:21 -04:00
Alex Goodman
a6585f4842
add go.mod tidy CI check 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-05-25 13:43:53 -04:00
Dan Luhring
8da410c578
Allow registry auth config without authority value (#322) 
* Allow registry auth config without authority value

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Update CLI tests for new stereoscope log output

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-05-24 16:06:09 -04:00
Alex Goodman
594cfd05c9
add java virutal path to package metadata 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-05-24 11:23:31 -04:00
Alex Goodman
a8577eade7
add package sorting for artifacts in json document 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-05-11 16:40:27 -04:00
Alfredo Deza
6a7a0a7e01 update dependencies 
Signed-off-by: Alfredo Deza <adeza@anchore.com>
 2021-05-03 14:56:00 -04:00
Alex Goodman
28f6051204
update syft to v0.15.1 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-04-22 17:29:01 -04:00
Alex Goodman
871722dd1e
bump syft to add manifest metadata to source for registry source 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-04-14 08:10:09 -04:00
Alex Goodman
31f44b7302
update syft and stereoscope to pull in registry source 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-04-13 16:09:27 -04:00
Dan Luhring
d4c3fa5f3b
Add tests for template presenter and consolidate data generation code 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-04-09 09:34:58 -04:00
Alex Goodman
8704dbb2bc
pull in registry credential encoding fix 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-04-05 14:27:42 -04:00
Alex Goodman
ebe1371d47
bump syft to pull in repoDigests onto image metadata (#274) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-04-01 21:28:53 +00:00
Alex Goodman
976e3d68eb
pull in syft v0.14.0 and further decouple presenters from syft 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-04-01 10:01:07 -04:00
Alfredo Deza
f2b815d760 bump go dependencies to use grype-db with v2 schema 
This will cause grype to set its schema version requirement to 2

Signed-off-by: Alfredo Deza <adeza@anchore.com>
 2021-03-30 13:52:31 -04:00
Alex Goodman
a399647afc
add docker image to release process 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-03-23 10:00:13 -04:00
Alfredo Deza
6c3cb94c03 update grype-db dependency 
Signed-off-by: Alfredo Deza <adeza@anchore.com>
 2021-03-05 09:32:13 -05:00
Alex Goodman
0a9408005f
refactor constraint expression parser to allow for quoted versions 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2021-02-16 09:15:17 -05:00
Dan Luhring
7ec9212c70
Update syft to v0.12.4 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2021-01-27 12:29:54 -05:00
Alex Goodman
0699e6a6ca
add package provider abstraction and update json document input 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-12-14 07:55:54 -05:00
Alex Goodman
137be60f28
add grype pkg.Package adapter for syft pkg.Package and remove pkg.Catalog 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-12-14 07:55:54 -05:00
Alex Goodman
7779e71b7e
update syft from v0.9.1 to v0.9.2 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-12-03 16:57:36 -05:00
Dan Luhring
159e168867
Update syft from 0.9.0 to 0.9.1 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2020-12-02 18:24:07 -05:00
Dan Luhring
d78c665925
Update syft from 0.8.1 to 0.9.0 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2020-12-02 15:54:46 -05:00
Alex Goodman
627aa77842
remove CPE generation (rely on static CPES from syft instead) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-11-20 06:43:45 -05:00
Alex Goodman
25d6ec6c79
add SBOM JSON document input from syft 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-11-17 17:55:24 -05:00
Alex Goodman
4ed516e784
bump syft to v0.7.1 (with related fixes) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-11-12 10:02:40 -05:00
Dan Luhring
5d21595414
Update to Syft v0.5.1 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2020-11-05 13:11:11 -05:00
Alex Goodman
2dcb017295
update python and javascript catalogers 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-10-23 11:34:18 -04:00
Alex Goodman
da614aa4ac
bump syft version (add package.json, rename bundler to ruby) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-10-19 08:02:13 -04:00
Alex Goodman
9d06b57a0e
incorporate gemspec cataloger (#177) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-10-09 11:09:42 -04:00
Dan Luhring
04f88a80c6
Bump go.mod item versions (#173) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2020-09-29 16:24:12 -04:00
Alex Goodman
65ab6dacdb
Support file/dir tilde expansion + APK cataloger xattr fix (#170) 
* pull in upstream tilde expansion

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* pull in apk cataloger xattr checksum fix

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-09-28 17:37:39 -04:00
Alex Goodman
63a6dd33df
always return a cleanup function from scope (#166) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-09-25 16:29:15 -04:00
Dan Luhring
f13b9a76ed
Use latest versions of anchore repos (#164) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2020-09-25 15:00:15 -04:00
Alex Goodman
326afa3c41
Add OCI support + use URI schemes (#160) 
* add oci support + update image schemes

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* update to oci-dir

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* bump upstream stereoscope, testutils, and syft pins

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix malformed go.sum

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* pull in upstream syft json presenter updates

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-09-25 14:18:03 -04:00
Alex Goodman
9f6301bbc2
Change root of JSON presenter to a mapping (instead of a sequence) (#163) 
* update root of json presenter document

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* change vulnerabilities to matches in json output

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-09-25 14:06:28 -04:00
Alex Goodman
ed9f9bcb2b
remove duplicate rows from the summary table (#161) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-09-25 10:34:54 -04:00
Alfredo Deza
578afab216 update go.mod and go.sum 
Signed-off-by: Alfredo Deza <adeza@anchore.com>
 2020-09-23 16:58:14 -04:00
Alfredo Deza
2b8dfc2d75 temporary bump of go deps for testing 
Signed-off-by: Alfredo Deza <adeza@anchore.com>
 2020-09-21 11:17:51 -04:00
Samuel Dacanay
cb437b6721 Change kebab case to camelCase, use updated syft version 
Signed-off-by: Samuel Dacanay <sam.dacanay@anchore.com>

Ignore packageurl-go which is a dependency from syft, and has a weird license format

Signed-off-by: Samuel Dacanay <sam.dacanay@anchore.com>
 2020-09-21 08:12:31 -07:00
Sam Dacanay
293368e25e
Shell completion via Cobra utility (#149) 
* Add completion script, ValidArgsFunction to root command to list docker images using docker go sdk, and update README

Signed-off-by: Samuel Dacanay <sam.dacanay@anchore.com>

Remove support for zsh and powershell completion, as it doesnt work out of the box, and currently dont have a way to test powershell. Reported an issue with Cobra ZSH completion script generation as there are 2 bugs in it AFIACT

Signed-off-by: Samuel Dacanay <sam.dacanay@anchore.com>

* add zsh with cobra master branch

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
 2020-09-14 09:06:29 -07:00
Alex Goodman
1338850a8e
Add fixed-in-version to the presenters (#147) 
* add fix-in-version to the json and table presenters

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* incorporate grype-db fixed-in updates

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-09-09 12:55:22 -04:00
Alex Goodman
bd50ffc585
Change search key json output to a map (#146) 
* change search key json output to a map

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add documentation around the match object

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-09-08 11:23:29 -04:00
Alfredo Deza
8e8ad489f9 dependencies: update to latest syft and include uuid 
Signed-off-by: Alfredo Deza <adeza@anchore.com>
 2020-08-28 13:38:56 -04:00
Alfredo Deza
b8e9431f89 dependencies: bump to latest syft that includes setup.py support 
Signed-off-by: Alfredo Deza <adeza@anchore.com>
 2020-08-17 17:24:43 -04:00
Dan Luhring
d3987d7e3e
Update modules (#127) 
Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2020-08-13 14:20:53 -04:00
Alex Goodman
56b9576a19
Add inline-comparison as acceptance test (#106) 
* add inline-compare as acceptance tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* improve RPM matching with source indirection matching

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add comments to compare-* make targets

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* clean inline-compare image test names

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* bump syft version to get rpm field enhancements

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-08-10 11:03:48 -04:00
Alex Goodman
30d72dd476
fix spaces alignment on etui 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-08-07 18:19:25 -04:00
Alex Goodman
6de7e4030d
finalize the json output (no schema yet) (#102) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-08-07 13:05:58 -04:00
Alex Goodman
51479857e6
add description and cvss metadata to v1 schema (#100) 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
 2020-08-06 13:15:22 -04:00
Alex Goodman
f3756d0dc0
change default scope to squashed (from all-layers) (#95) 2020-08-06 08:27:09 -04:00
Dan Luhring
2cd127b932
Update pkg type (#87) 
* Integrate Alex's changes

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Fix test issues

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>

* Update syft dependency references

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
 2020-08-05 08:18:24 -04:00
Alex Goodman
e1f4c549d5
bump syft for docker pull + UI elements for pull status (#81) 2020-08-03 18:07:33 -04:00
Alex Goodman
11731fac40
replace zap logger with logrus (#80) 2020-08-01 11:58:10 -04:00
Alex Goodman
861883c8d4
pull in fix for bounds check progress formatting values in etui 2020-07-31 06:57:05 -04:00
Alex Goodman
6395481e73
Add ETUI (#77) 
* add base syft UI elements

* add etui with shared ui elements

* allow for concurrent download DB and fetch/catalog image
 2020-07-30 19:06:27 -04:00
Alfredo Deza
561f7577c1 dependencies: bump to latest syft that includes yarn support 
Signed-off-by: Alfredo Deza <adeza@anchore.com>
 2020-07-30 09:35:53 -04:00
Alex Goodman
6ec1ce6ca6
use explicitly the v1 db schema 2020-07-27 08:49:39 -04:00
Alex Goodman
5051c6202d
simplify schema checks and update grype-db 2020-07-25 19:03:33 -04:00
Alex Goodman
4220fc60a7
Add default table presenter (#59) 
* add default table presenter

* compress table output

* fix table presenter found-by to use only search key
 2020-07-25 11:38:08 -04:00
Alex Goodman
695cc0f640
support version constraint || operator conjunctions (#66) 2020-07-24 14:20:26 -04:00
Alex Goodman
03005af2f2
rename grype-db 2020-07-24 06:59:14 -04:00
Alex Goodman
6340b2da3a
add release pipeline & replace imgbom with syft (#60) 2020-07-23 21:26:03 -04:00
Alfredo Deza
8b17a43c28 dependencies: bump to latest imgbom 
Signed-off-by: Alfredo Deza <adeza@anchore.com>
 2020-07-23 13:30:12 -04:00
Alfredo Deza
6f06334b01 dependencies: bump to latest imgbom 
Signed-off-by: Alfredo Deza <adeza@anchore.com>
 2020-07-22 08:26:54 -04:00
Alex Goodman
bc3f298d64
use sqlite reader (remove a cgo dependency) (#57) 2020-07-21 13:41:48 -04:00
Alex Goodman
c8bca755ff
Add integration tests (#54) 
* add integration tests + add matcher types

* tweak db auto update var; rm dead cache cmd

* Update cmd/root.go

Co-authored-by: Alfredo Deza <adeza@anchore.com>

Co-authored-by: Alfredo Deza <adeza@anchore.com>
 2020-07-21 12:34:39 -04:00
Alfredo Deza
a9172fcd98 dependencies: update with latest imgbom 
Signed-off-by: Alfredo Deza <adeza@anchore.com>
 2020-07-17 13:58:07 -04:00
Alex Goodman
bbff869499
Add matching by CPE (#40) 
* Commit just to share progress, needs to be squashed/fixed-up once working.

Signed-off-by: Zach Hill <zach@anchore.com>

* minor fixes

* add cpe obj

* add cpe matching

* report cpe in search key

* add verbose logging for matches; bump vulnscan-db ver

* add dev profiler option; tweak logging

* test support for CPE URI bindings

addresses https://github.com/anchore/vulnscan/pull/40#discussion_r455389937

* rename nvdv2 to nvd

* reduce scope of cpe matching to non-distro packages

* normalize nil constraint strings

Co-authored-by: Zach Hill <zach@anchore.com>
 2020-07-16 15:12:19 -04:00
Alex Goodman
afb8597aa2
split vulnerability into index & metadata (#51) 2020-07-16 14:59:35 -04:00
Alex Goodman
12aeee3b92
add java matcher (#44) 2020-07-15 07:17:21 -04:00
Alex Goodman
2fa38cab3d
migrate to using siren-db lib (#48) 2020-07-14 10:21:20 -04:00
Alex Goodman
765d5dfb5b
add rpm version + constraint, rpmdb matching; refactor dpkg constraint 2020-07-07 09:22:14 -04:00
Alex Goodman
a004668056
add db archive import 2020-06-29 10:10:02 -04:00
Alex Goodman
92cf98ab12
sync vulnscan db changes 2020-06-28 07:22:27 -04:00
Alex Goodman
ce707a6f1a
fix testutils dependency 2020-06-22 14:42:14 -04:00
Alex Goodman
9c70953dfb
add curation of db file 2020-06-19 10:57:06 -04:00
Alfredo Deza
b484b85890 update dependencies 
Signed-off-by: Alfredo Deza <adeza@anchore.com>
 2020-06-18 10:12:41 -04:00
Alex Goodman
7593c31028
add python matcher 2020-06-05 10:00:14 -04:00
Alex Goodman
1ca035363a
add gem matcher 2020-06-04 15:40:40 -04:00
Alex Goodman
d9c922218c
add store provider tests 2020-06-02 20:54:19 -04:00
Alex Goodman
88eecbd2de
add indirect dpkg source matching 2020-06-02 17:22:57 -04:00
Alex Goodman
75ceb1af2d
pin to imgbom@master 2020-06-01 10:50:34 -04:00
Alex Goodman
aacc624033
add FindVulnerability lib function, wire up main with matcher 2020-06-01 07:21:07 -04:00
Alex Goodman
e8e8f416d0
add version & version constraint support 2020-06-01 07:13:53 -04:00
Alex Goodman
02556fdd9c
add basic matching execution flow 2020-05-28 18:28:29 -04:00
Alex Goodman
3c6ae01619
initial project structure 2020-05-26 10:41:23 -04:00