* [wip] add initial poetry.lock relationship support
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* provide generic set for basic types
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* dependency resolver should allow for conditional deps
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* add tests for poetry lock relationship additions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* update schema with python poetry dependency refs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* dep specification data structure should not be recursive in nature
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* fix: only skip tmpfs mounts for some paths
Signed-off-by: Will Murphy <will.murphy@anchore.com>
* refactor and add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* add regression test for archive processing
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* bump to golang 1.22
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* remove rule 1 and add more tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
---------
Signed-off-by: Will Murphy <will.murphy@anchore.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
The namespace value of `redhat` signifies this as an RPM package
produced and distributed by Red Hat.
Using "rhel" in the namespace is not correct.
Signed-off-by: Ralph Bean <rbean@redhat.com>
* Add lua/rocksepc support for variables substitution
* Lua: Skip expressions in rockspec packages
* Lua: Add support for concatenation of string and variables
* Lua: Skip expressions in local
* Lua: Skip build sections in Rockspec files
* Lua: skip function blocks in Rockspec
* Lua: Add support for multi variable per line
---------
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
* Handle GOEXPERIMENTs in go version
Signed-off-by: Jon Johnson <jon.johnson@chainguard.dev>
* bump JSON schema
Signed-off-by: Will Murphy <will.murphy@anchore.com>
---------
Signed-off-by: Jon Johnson <jon.johnson@chainguard.dev>
Signed-off-by: Will Murphy <will.murphy@anchore.com>
Co-authored-by: Will Murphy <will.murphy@anchore.com>
* add python package relationships
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* nil for empty relationships collections
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* new json schema for optional python requiremenets
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* update format snapshots for python packages
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* decompose python parsers more + add tests around plural fields
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* update JSON schema with python dep refs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
When the goModCataloger processes a Replace directive it currently adds the new
package to the resulting package list, but does not remove the old one unless
the path is unchanged.
Based on an existing comment in the code, removing the old one seems to be the
intended behavior, and results in a more expected end-result, so this does so.
Signed-off-by: Russell Haering <russellhaering@gmail.com>
* chore: Reduce length of readme, moving lengthy content to the wiki
https://github.com/anchore/syft/wiki
---------
Signed-off-by: Alan Pope <alan@popey.com>
* use pkg values in relationship fields
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* add linter rule for using values in relationships
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* use new cmptest package for comparing relationships
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* create cmptest for common cmp.Diff options in test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* condense matches for relationship ruleguard
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* remove relationship type from rules
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* restore build tag
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* suggest using values
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* nil check pkgs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* add internal dependency resolver
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* refactor dependency relationship resolution to common object
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* replace cataloger decorator with generic processor
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* refactor resolver to be a single function
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* use common dependency specifier for debian
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* use common dependency specifier for arch
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* use common dependency specifier for alpine
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* allow for generic pkg and rel assertions in testpkg helper
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* do not allow for empty results
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* move stable deduplicate comment
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* remove relationship resolver type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
This PR adds DependencyOf relationships when ELF packages have been discovered by the binary cataloger. The discovered file.Executable type has a []ImportedLibraries that's read from the file when discovered by syft. By mapping these imported libraries back to the package collection, syft is able to create relationships showing which packages are dependencies of other packages by just reading metadata from the ELF executable.
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Brian Ebarb <ebarb.brian@sers.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
