update to use latest version of syft and grype

deepfence · May 3, 2024 · 45d09a6 · 45d09a6
1 parent b71f06c
commit 45d09a6
Show file tree

Hide file tree

Showing 4 changed files with 24 additions and 20 deletions.
diff --git a/run-once.go b/run-once.go
@@ -156,7 +156,7 @@ func RunOnce(config utils.Config) {
 	exploitable, others := GroupByExploitability(&filtered)
 
 	if *output != utils.JSONOutput {
-		fmt.Printf("summary:\n total=%d %s=%d %s=%d %s=%d %s=%d\n",
+		fmt.Printf("summary:\n total=%d %s=%d %s=%d %s=%d %s=%d %s=%d\n",
 			details.Total,
 			utils.CRITICAL, details.Severity.Critical,
 			utils.HIGH, details.Severity.High,

diff --git a/sbom/syft/syft.go b/sbom/syft/syft.go
@@ -97,7 +97,9 @@ func runCommand(cmd *exec.Cmd) (*bytes.Buffer, error) {
 
 func GenerateSBOM(ctx context.Context, config utils.Config) ([]byte, error) {
 	jsonFile := filepath.Join("/tmp", utils.RandomString(12)+"output.json")
-	syftArgs := []string{"packages", config.Source, "-o", "json", "--file", jsonFile, "-q"}
+
+	syftArgs := []string{"scan", config.Source, "-o", fmt.Sprintf("syft-json=%s", jsonFile), "-q"}
+
 	if strings.HasPrefix(config.Source, "dir:") || config.Source == "." {
 		for _, excludeDir := range linuxExcludeDirs {
 			syftArgs = append(syftArgs, "--exclude", "."+excludeDir+"/**")
@@ -178,8 +180,7 @@ func GenerateSBOM(ctx context.Context, config utils.Config) ([]byte, error) {
 	}
 
 	if config.ScanType != "" && config.ScanType != "all" {
-		isRegistry := config.RegistryID != "" && config.NodeType == utils.NodeTypeImage
-		syftArgs = append(syftArgs, buildCatalogersArg(config.ScanType, isRegistry)...)
+		syftArgs = append(syftArgs, buildCatalogersArg(config.ScanType)...)
 	}
 
 	if config.IsRegistry {
@@ -234,33 +235,34 @@ func GenerateSBOM(ctx context.Context, config utils.Config) ([]byte, error) {
 	return sbom, nil
 }
 
-func buildCatalogersArg(scanType string, isRegistry bool) []string {
+func buildCatalogersArg(scanType string) []string {
 	syftArgs := []string{}
 	scanTypes := strings.Split(scanType, ",")
 	for _, s := range scanTypes {
 		switch s {
 		case utils.ScanTypeBase:
-			syftArgs = append(syftArgs, "--catalogers", "dpkgdb-cataloger", "--catalogers", "rpm-db-cataloger", "--catalogers", "rpm-file-cataloger", "--catalogers", "apkdb-cataloger", "--catalogers", "alpmdb-cataloger", "--catalogers", "linux-kernel-cataloger")
+			syftArgs = append(syftArgs, "--select-catalogers", "os")
 		case utils.ScanTypeRuby:
-			syftArgs = append(syftArgs, "--catalogers", "ruby-gemfile-cataloger", "--catalogers", "ruby-gemspec-cataloger")
+			syftArgs = append(syftArgs, "--select-catalogers", "ruby")
 		case utils.ScanTypePython:
-			syftArgs = append(syftArgs, "--catalogers", "python-index-cataloger", "--catalogers", "python-package-cataloger")
+			syftArgs = append(syftArgs, "--select-catalogers", "python")
 		case utils.ScanTypeJavaScript:
-			syftArgs = append(syftArgs, "--catalogers", "javascript-lock-cataloger", "--catalogers", "javascript-package-cataloger")
+			syftArgs = append(syftArgs, "--select-catalogers", "javascript")
 		case utils.ScanTypePhp:
-			syftArgs = append(syftArgs, "--catalogers", "php-composer-installed-cataloger", "--catalogers", "php-composer-lock-cataloger")
+			syftArgs = append(syftArgs, "--select-catalogers", "php")
 		case utils.ScanTypeGolang:
-			syftArgs = append(syftArgs, "--catalogers", "go-mod-file-cataloger")
+			syftArgs = append(syftArgs, "--select-catalogers", "golang")
 		case utils.ScanTypeGolangBinary:
-			syftArgs = append(syftArgs, "--catalogers", "go-module-binary-cataloger")
+			syftArgs = append(syftArgs, "--select-catalogers", "golang")
 		case utils.ScanTypeJava:
-			syftArgs = append(syftArgs, "--catalogers", "java-cataloger", "--catalogers", "java-gradle-lockfile-cataloger", "--catalogers", "java-pom-cataloger")
+			syftArgs = append(syftArgs, "--select-catalogers", "java")
 		case utils.ScanTypeRust:
-			syftArgs = append(syftArgs, "--catalogers", "rust-cargo-lock-cataloger")
+			syftArgs = append(syftArgs, "--select-catalogers", "rust")
 		case utils.ScanTypeRustBinary:
-			syftArgs = append(syftArgs, "--catalogers", "cargo-auditable-binary-cataloger")
+			syftArgs = append(syftArgs, "--select-catalogers", "rust")
 		case utils.ScanTypeDotnet:
-			syftArgs = append(syftArgs, "--catalogers", "dotnet-deps-cataloger")
+			syftArgs = append(syftArgs, "--select-catalogers", "dotnet")
+
 		}
 	}
 	return syftArgs

diff --git a/tools/grype-bin/get_grype.sh b/tools/grype-bin/get_grype.sh
@@ -2,7 +2,7 @@
 
 set -eux
 
-VERSION=0.73.1
+VERSION=v0.77.2
 
 HOST_OS=$(uname -s | tr '[:upper:]' '[:lower:]')
 HOST_ARCH="${GOARCH:=$(uname -m)}"
@@ -21,7 +21,7 @@ IFS=/ read BUILD_OS BUILD_ARCH <<< $ARCHITECTURE
 
 rm -rf grype*
 
-git clone https://github.com/anchore/grype.git --branch v$VERSION || true
+git clone https://github.com/anchore/grype.git --branch $VERSION || true
 (
     cd grype/cmd/grype
     export CGO_ENABLED=0

diff --git a/tools/syft-bin/get_syft.sh b/tools/syft-bin/get_syft.sh
@@ -2,7 +2,8 @@
 
 set -eux
 
-RELEASE=optimise-resolver-2
+# RELEASE=optimise-resolver-2
+RELEASE=v1.3.0
 
 HOST_OS=$(uname -s | tr '[:upper:]' '[:lower:]')
 HOST_ARCH="${GOARCH:=$(uname -m)}"
@@ -21,7 +22,8 @@ IFS=/ read BUILD_OS BUILD_ARCH <<< $ARCHITECTURE
 
 rm -rf syft*
 
-git clone https://github.com/deepfence/syft.git --branch $RELEASE || true
+# git clone https://github.com/deepfence/syft.git --branch $RELEASE || true
+git clone https://github.com/anchore/syft.git --branch $RELEASE || true
 (
     cd syft/cmd/syft
     export CGO_ENABLED=0