Add package-to-file location evidence relationships #1698
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Benchmark Test ResultsBenchmark results from the latest changes vs base branch |
|
For interested folks, this PR will be refactored to use location annotations being introduced in #1723 and allow for expressing only primary evidence. |
…ships Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
|
JSON schema diff for reviewers: # ❯ diff schema/json/schema-7.1.3.json schema/json/schema-7.1.4.json
571a572,574
> },
> "size": {
> "type": "integer"
580c583,584
< "mimeType"
---
> "mimeType",
> "size" |
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
spiffcs
approved these changes
Apr 14, 2023
spiffcs
added a commit
that referenced
this pull request
Apr 17, 2023
* main: (35 commits) Fix kernel cataloger test fixtures (#1742) feat: Support scanning license files in golang packages over the network (#1630) Add package-to-file location evidence relationships (#1698) Add Linux Kernel cataloger (#1694) Add annotations for evidence on package locations (#1723) add format make target (#1733) Update tests to not fail on Mac M1's. (#1730) chore(deps): update bootstrap tools to latest versions (#1728) Add support for nar files. (#1727) add highlevel details about catalogers (#1726) chore(deps): bump golang.org/x/net from 0.8.0 to 0.9.0 (#1722) chore(deps): update stereoscope to e95d60a265e384df29b7a139f5c5402d6ad72e06 (#1721) feat: gradle lockfile support (#1719) chore(deps): bump github.com/docker/docker (#1715) chore(deps): bump golang.org/x/mod from 0.9.0 to 0.10.0 (#1713) chore(deps): bump golang.org/x/term from 0.6.0 to 0.7.0 (#1714) chore(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 (#1716) chore(deps): bump peter-evans/create-pull-request from 4 to 5 (#1712) chore: update tools-golang to v0.5.0 (#1717) Add Nix cataloger (#1696) ... Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
This was referenced Apr 18, 2023
Closed
GijsCalis
pushed a commit
to GijsCalis/syft
that referenced
this pull request
Feb 19, 2024
* add evident-by relationship Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * wire up evident-by relationship geneation Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * handle evident-by relationship in spdx formats Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * fix decoding file info for syft json format Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * bump json schema to incorporate file size attribute Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * refactor to create relationships for primary evidence only Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * fix linting Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * remove unused 7.0.2 json schema Signed-off-by: Alex Goodman <alex.goodman@anchore.com> --------- Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Each package tracks which files contributed to syft being able to detect the package's existence via the
pkg.Package.Locationsfield. This PR exposes these locations as package-to-file relationships to show that package X is "evident by" file Y. This is made possible with the newevident-byrelationship type, which maps to theOTHERSPDX relationship type and depends on a comment value to support decoding effectively.The current implementation takes all locations from
pkg.Package.Locationwith the "primary" evidence annotation and makes relationships for them. This is nice since there is a single, downstream point in the code that would be responsible for creating these relationships.In the future application configuration can be introduced which allows for supporting evidence to also be represented with an
evident-byrelationship type.This PR also:
CC: @jedevc @cdupuis