* upgrade tool management
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* update version file on release
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* docs: update README with newer data sources
Signed-off-by: Dan Luhring <dluhring@chainguard.dev>
* docs: add Wolfi to distro list
Signed-off-by: Dan Luhring <dluhring@chainguard.dev>
---------
Signed-off-by: Dan Luhring <dluhring@chainguard.dev>
config: add config opt in golang pseudo version main module comparison
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
* fix: adds ignore rules for kernel-headers indirect matches
Adds ignoring of kernel-headers indirect matches on kernel vulns
since the kernel-headers package does not have the kernel code in it
that kernel vulns are actually referring to.
Adds a config value to control this ignore behavior that defaults to
enabling the ignore rules.
Fixes: 1762
* Adds ignore rule support for match types and upstream package names.
* Adds default ignore rules for kernel-headers indirect matches on kernel
for rpms.
Signed-off-by: Zach Hill <zach@anchore.com>
* chore: add match-upstream-kernel-headers config to README.md
Signed-off-by: Zach Hill <zach@anchore.com>
* chore: update match labels
Signed-off-by: Keith Zantow <kzantow@gmail.com>
---------
Signed-off-by: Zach Hill <zach@anchore.com>
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
* Add --ignore-states flag for ignoring findings with by fix state
Signed-off-by: James Hebden <jhebden@gitlab.com>
* ignore options checked before scan, fail on invalid ignore states, ignore states comma-separated
Signed-off-by: James Hebden <jhebden@gitlab.com>
* Add CLI tests for new --ignore-states flag
Signed-off-by: Will Murphy <will.murphy@anchore.com>
---------
Signed-off-by: James Hebden <jhebden@gitlab.com>
Signed-off-by: Will Murphy <will.murphy@anchore.com>
Co-authored-by: Will Murphy <will.murphy@anchore.com>
* go.mod: Pull OpenVEX go modules
This commit pulls the OpenVEX libraries into the grype source.
Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
* Add generic VEX processor package
This commit adds a generic VEX processor package. It is implementation
agnostic. It has a single option for now: The documents used to load
the VEX data.
The processor has a single method: ApplyVEX() which takes a set of scan
results and applies VEX data to them. For now, the only modification that
is done is filtering of results, that is moving results to the ignored list
as a response to VEX documents.
Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
* vex: Add OpenVEX processor implementation
This commit adds an openvex implementation of the vex processor.
It also wires the VEX processor to use it as default.
Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
* Table presenter: Highligt results suppressed by VEX
This commit marks results suppressed by VEX when presenting them
to the user.
Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
* Define VEX status constants
This commit defines a set of local constants of each of the VEX statuses
based on the openvex constants.
Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
* Add VexStatus to ignore rules
This commit modifies the ignore rules structure to support defining a vex
status. Any rules defining vex are ignored by the standard ignore rules
processing as they will be handled by the VEX processor.
Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
* Add IgnoreRule HasConditions method
Adds a new HasConditions method to the IgnoreRule object to check if the rule is empty.
Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
* Control VEX filtering through IgnoreRules
This commit modifies how the vex processor is controlled. The processor now
takes a list of IgnoreRules which can act on the VEX status in addition to
the regular rule parameters.
Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
* vex: Allow rules to match on VEX justification
This commit expands the ingore rules to also work on vex the
justification of not_affected statements.
Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
* Use go-vex merge implementation
Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
* Add OpenVEX matcher to matcher list
This commit adds a new entry to the matchers: An openvex matcher
This matcher is used when openvex augments results, moving matches
from the ignore list to the active results.
Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
* Add vex.AugmentMatches() to the vex processor
This commit adds a new AugmentMatches() phase to the VEX processor.
This new step goes throught the configured ignore rules and acts on any
that have `affected` or `under_investigtion` as status.
The purpose of this rule is to move matches back from the ignored matches
list to the active results when a statement with either of those statuses
apply to ignored matches.
Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
* Parse context identifiers using GGC
This commit modifies the identifier synthesizer function to parse references
using GGCR. It also adds a simple test.
Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
* Bump funlen linter to 73
This commit bumps the maximum function length to 73 to accomodate
the new flag in AddFlags()
Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@chainguard.dev>
* Add VEX testing to matchers test
This commit adds a new test and fixtures to test the VEX matchers
along the rest of the matchers in TestMatchByImage(). As the VEX
matchers operate on previously ignored matches a new loop was added
to the test to accomodate the different testing model.
Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
* add vex status and justification to ignored rule json model
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* nit rename + add TODO question about augmenting ignored matches
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* nit document comment updates + common variable extraction
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* migrate legacy matcher function to vulnerability matcher object
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* update tui to respond to ignored and dropped matches
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* migrate vex processing to vulnerability match object
Based on Alex's previous caommit
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
* Migrate VEX options and app config from legacy CLI
Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
* update table snapshot tests with suppressed vex entries
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* add tests for match.Matches.Diff()
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* add tests for vex processor
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* fix linting and restore global funlen rule
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* remove grpc pin
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* always return remaining and ignroed matches from matcher object
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* Add VEX documentation to main README
This commit adds a VEX section to the main Grype README. It adds
an example document and details on how vex rules can be written.
Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
---------
Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@chainguard.dev>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
* add registry certificate verification support
* modify go.mod
* rename registry cert options, add docs, and add test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* update to account for changes in anchore/stereoscope#195
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* fix cli tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: lishituo <24578666@qq.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
* initial port to bubbletea
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* remove jotframe UI
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* add bubbletea component tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* update main.go refs to cmd package
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* move goreleaser build dir to cmd
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* upgrade yardstick for grype source installs and fix post-ui tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* ensure stable severity map in UI component test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* add windows support for tui
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Because the general set of sprig functions can used to access
environment variables, explicitly warn users never to run untrusted
templates.
---------
Signed-off-by: James Neate <jamesmneate@gmail.com>
Signed-off-by: Will Murphy <will.murphy@anchore.com>
Co-authored-by: Will Murphy <will.murphy@anchore.com>
#1204 surfaces the need for allowing a user to express a preference over the default-image-pull-source to be used when building an SBOM for vulnerability scanning.
This adds a config option into grype to consume the new syft behavior.
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
CVE-2017-41432 is not a valid ID but in theory could be one day. Changed it to CVE-2014-54321 which is one of a number sample IDs used during the Syntax change in 2013/2014. References: cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-54321 cve.mitre.org/data/board/archives/2013-04/msg00000.html
Co-authored-by: Jericho <3095424+attritionorg@users.noreply.github.com>
* add db staleness check
Signed-off-by: Jonas Xavier <jonasx@anchore.com>
* less config fields
Signed-off-by: Jonas Xavier <jonasx@anchore.com>
* fix import order
Signed-off-by: Jonas Xavier <jonasx@anchore.com>
* warn even when set to not error on staleness
Signed-off-by: Jonas Xavier <jonasx@anchore.com>
* nits
Signed-off-by: Jonas Xavier <jonasx@anchore.com>
* nits
Signed-off-by: Jonas Xavier <jonasx@anchore.com>
* feedback changes
Signed-off-by: Jonas Xavier <jonasx@anchore.com>
* lint fix
Signed-off-by: Jonas Xavier <jonasx@anchore.com>
* fix test
Signed-off-by: Jonas Xavier <jonasx@anchore.com>
* consistent log message
Signed-off-by: Jonas Xavier <jonasx@anchore.com>
* consistent new version message
Signed-off-by: Jonas Xavier <jonasx@anchore.com>
* feedback changes
Signed-off-by: Jonas Xavier <jonasx@anchore.com>
* human friendly time durations
Signed-off-by: Jonas Xavier <jonasx@anchore.com>
* fix typo
Signed-off-by: Jonas Xavier <jonasx@anchore.com>
* feedback changes
Signed-off-by: Jonas Xavier <jonasx@anchore.com>
* cleaner tests and default db value
Signed-off-by: Jonas Xavier <jonasx@anchore.com>
* support filtering matches based on Namespace
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
* support filtering matches based on package language
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
* add tests for filtering matches on Namespace and Language
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
* update README for new ignore rule criteria
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
* fix linting errors
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
* add key flag to attest validation
Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>
* mvp: verify sig and extract sbom
Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>
* wip read attestation without scheme
Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>
* go mod tidy
Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>
* mvp consuming attestations - needs unit tests
Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>
* remove prototype file
Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>
* drop local syft from go.mod
Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>
* fix order of sbom parsing strategies
Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>
* handle implicit attestation input
Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>
* wip
Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>
* add test for invalid attestation key
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* rebase and go-mod-tidy
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* consume attestation via stdin
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* attestation test for stdin
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* validate input and content for attestation
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* add stdin test
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* fix config tags
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* add int test to ignore attestation validation
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* fix cycloneDX attestation fixture
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* add tampered att test
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* add tampered predicate type test
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* improve docs/help on atttestation
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* feedback changes
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* upgrade to latest syft
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* fall through when guessing between sbom and att
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* go mod tidy
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* fix butter finger rebase
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* drop default key value
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* assert error messages
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* better test/cli coverage
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* fix stdin decode test
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* fix goimports
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* tui - verified attestation and feedback changes
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* better naming
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* add attestation section to config file
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* emit event for skipped verification
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* use public key name
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* feedback changes
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
* nit
Signed-off-by: Jonas Galvão Xavier <jonasx@anchore.com>
