diff --git a/go.mod b/go.mod index 65458ac498..5155dacb2a 100644 --- a/go.mod +++ b/go.mod @@ -35,7 +35,7 @@ require ( github.com/google/go-cmp v0.7.0 github.com/google/go-containerregistry v0.21.6 github.com/google/go-github/v63 v63.0.0 - github.com/google/osv-scalibr v0.3.4 + github.com/google/osv-scalibr v0.4.5 github.com/google/uuid v1.6.0 github.com/gorilla/handlers v1.5.2 github.com/gorilla/securecookie v1.1.2 @@ -118,7 +118,7 @@ require ( cyphar.com/go-pathrs v0.2.1 // indirect deps.dev/api/v3 v3.0.0-20250903005441-604c45d5b44b // indirect deps.dev/api/v3alpha v0.0.0-20250903005441-604c45d5b44b // indirect - deps.dev/util/maven v0.0.0-20250903005441-604c45d5b44b // indirect + deps.dev/util/maven v0.0.0-20251104021112-20ad94767ddf // indirect deps.dev/util/pypi v0.0.0-20250903005441-604c45d5b44b // indirect deps.dev/util/resolve v0.0.0-20250903005441-604c45d5b44b // indirect deps.dev/util/semver v0.0.0-20250903005441-604c45d5b44b // indirect @@ -135,9 +135,11 @@ require ( github.com/Microsoft/hcsshim v0.14.1 // indirect github.com/Yiling-J/theine-go v0.6.2 // indirect github.com/a8m/envsubst v1.4.3 // indirect + github.com/aead/serpent v0.0.0-20160714141033-fba169763ea6 // indirect github.com/agext/levenshtein v1.2.3 // indirect github.com/alecthomas/chroma/v2 v2.18.0 // indirect github.com/alecthomas/participle/v2 v2.1.4 // indirect + github.com/anchore/go-lzo v0.1.0 // indirect github.com/anchore/go-struct-converter v0.1.0 // indirect github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op // indirect github.com/antlr4-go/antlr/v4 v4.13.1 // indirect @@ -158,6 +160,7 @@ require ( github.com/aws/smithy-go v1.25.1 // indirect github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect github.com/aymerick/douceur v0.2.0 // indirect + github.com/bazelbuild/buildtools v0.0.0-20250826111327-4006b543a694 // indirect github.com/buger/jsonparser v1.1.2 // indirect github.com/cenkalti/backoff/v5 v5.0.3 // indirect github.com/charmbracelet/colorprofile v0.4.3 // indirect @@ -170,6 +173,7 @@ require ( github.com/charmbracelet/x/windows v0.2.2 // indirect github.com/clipperhouse/displaywidth v0.11.0 // indirect github.com/clipperhouse/uax29/v2 v2.7.0 // indirect + github.com/compose-spec/compose-go/v2 v2.8.1 // indirect github.com/containerd/cgroups/v3 v3.1.2 // indirect github.com/containerd/containerd v1.7.33 // indirect github.com/containerd/containerd/api v1.10.0 // indirect @@ -187,14 +191,19 @@ require ( github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect github.com/deitch/magic v0.0.0-20240306090643-c67ab88f10cb // indirect github.com/dimchansky/utfbom v1.1.1 // indirect + github.com/diskfs/go-diskfs v1.7.0 // indirect github.com/distribution/reference v0.6.0 // indirect + github.com/djherbis/times v1.6.0 // indirect github.com/dlclark/regexp2 v1.11.5 // indirect github.com/docker/go-connections v0.7.0 // indirect github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect github.com/docker/go-units v0.5.0 // indirect + github.com/dsoprea/go-exfat v0.0.0-20190906070738-5e932fbdb589 // indirect + github.com/dsoprea/go-logging v0.0.0-20200710184922-b02d349568dd // indirect github.com/dustin/go-humanize v1.0.1 // indirect github.com/edsrzf/mmap-go v1.1.0 // indirect github.com/elliotchance/orderedmap v1.8.0 // indirect + github.com/elliotwutingfeng/asciiset v0.0.0-20230602022725-51bbb787efab // indirect github.com/emicklei/go-restful/v3 v3.13.0 // indirect github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect @@ -203,6 +212,7 @@ require ( github.com/felixge/httpsnoop v1.0.4 // indirect github.com/fxamacker/cbor/v2 v2.9.0 // indirect github.com/go-chi/chi/v5 v5.3.0 // indirect + github.com/go-errors/errors v1.0.2 // indirect github.com/go-jose/go-jose/v4 v4.1.4 // indirect github.com/go-ole/go-ole v1.2.6 // indirect github.com/go-openapi/runtime/server-middleware v0.30.0 // indirect @@ -217,6 +227,7 @@ require ( github.com/go-openapi/swag/stringutils v0.26.0 // indirect github.com/go-openapi/swag/typeutils v0.26.0 // indirect github.com/go-openapi/swag/yamlutils v0.26.0 // indirect + github.com/go-restruct/restruct v1.2.0-alpha // indirect github.com/go-sql-driver/mysql v1.10.0 // indirect github.com/goccy/go-yaml v1.18.0 // indirect github.com/gogo/protobuf v1.3.2 // indirect @@ -227,6 +238,8 @@ require ( github.com/gorilla/css v1.0.1 // indirect github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.1.0 // indirect + github.com/ianlancetaylor/demangle v0.0.0-20251118225945-96ee0021ea0f // indirect + github.com/icholy/digest v1.1.0 // indirect github.com/in-toto/attestation v1.2.0 // indirect github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect @@ -247,7 +260,10 @@ require ( github.com/lestrrat-go/jwx/v3 v3.1.1 // indirect github.com/lestrrat-go/option v1.0.1 // indirect github.com/lestrrat-go/option/v2 v2.0.0 // indirect + github.com/lunixbochs/struc v0.0.0-20200707160740-784aaebc1d40 // indirect + github.com/masahiro331/go-ext4-filesystem v0.0.0-20240620024024-ca14e6327bbd // indirect github.com/mattn/go-localereader v0.0.1 // indirect + github.com/mattn/go-shellwords v1.0.12 // indirect github.com/mfridman/interpolate v0.0.2 // indirect github.com/micromdm/plist v0.2.1 // indirect github.com/miekg/dns v1.1.61 // indirect @@ -282,8 +298,10 @@ require ( github.com/opencontainers/selinux v1.13.1 // indirect github.com/openfga/api/proto v0.0.0-20260319214821-f153694bfc20 // indirect github.com/openfga/language/pkg/go v0.2.1 // indirect - github.com/ossf/osv-schema/bindings/go v0.0.0-20250805051309-c463400aa925 // indirect + github.com/ossf/osv-schema/bindings/go v0.0.0-20260129002236-09a17f85b44a // indirect github.com/package-url/packageurl-go v0.1.3 // indirect + github.com/pierrec/lz4/v4 v4.1.26 // indirect + github.com/pkg/xattr v0.4.10 // indirect github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect github.com/pressly/goose/v3 v3.27.1 // indirect github.com/prometheus/otlptranslator v1.0.0 // indirect @@ -319,9 +337,11 @@ require ( github.com/tklauser/numcpus v0.10.0 // indirect github.com/tonistiigi/go-csvvalue v0.0.0-20240814133006-030d3b2625d0 // indirect github.com/transparency-dev/formats v0.1.1 // indirect + github.com/ulikunitz/xz v0.5.14 // indirect github.com/valyala/fastjson v1.6.10 // indirect github.com/vektah/gqlparser/v2 v2.5.34 // indirect github.com/x448/float16 v0.8.4 // indirect + github.com/xhit/go-str2duration/v2 v2.1.0 // indirect github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect @@ -355,11 +375,12 @@ require ( modernc.org/mathutil v1.7.1 // indirect modernc.org/memory v1.11.0 // indirect modernc.org/sqlite v1.52.0 // indirect - osv.dev/bindings/go v0.0.0-20250808040635-c189436f8791 // indirect + osv.dev/bindings/go v0.0.0-20251029235023-a02c549eeac2 // indirect sigs.k8s.io/controller-runtime v0.23.3 // indirect sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect sigs.k8s.io/randfill v1.0.0 // indirect sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect + www.velocidex.com/golang/go-ntfs v0.2.0 // indirect www.velocidex.com/golang/regparser v0.0.0-20250203141505-31e704a67ef7 // indirect ) diff --git a/go.sum b/go.sum index 94878718c0..f9b805227c 100644 --- a/go.sum +++ b/go.sum @@ -75,8 +75,8 @@ deps.dev/api/v3 v3.0.0-20250903005441-604c45d5b44b h1:4f6EeZ4EexJUGBtmyMaxptWMoB deps.dev/api/v3 v3.0.0-20250903005441-604c45d5b44b/go.mod h1:BWOjjNq4+j4makGArvrtyFhzBi5TXU7AGH2nDnRORk8= deps.dev/api/v3alpha v0.0.0-20250903005441-604c45d5b44b h1:iXre7CzhkmdmzAdiOi+u/Yk1iDMI9SYlFEnXgJd5Rnk= deps.dev/api/v3alpha v0.0.0-20250903005441-604c45d5b44b/go.mod h1:CJqVceLEA55Tu9QwNoaUX4HhvzRQnYjCL1jUdw/rhPQ= -deps.dev/util/maven v0.0.0-20250903005441-604c45d5b44b h1:rDwPZ29kX7RBvBWFwW7U72Gd/CIZQbb8/LxvYuW/ee4= -deps.dev/util/maven v0.0.0-20250903005441-604c45d5b44b/go.mod h1:eGrXziwI7scSGrwIj+5EBHtTeSxAZD/yi8Hb3nFXesA= +deps.dev/util/maven v0.0.0-20251104021112-20ad94767ddf h1:wfFm9buQJGKco1/uIlFpq9QKMhN5f8PA0f5vOK1u54M= +deps.dev/util/maven v0.0.0-20251104021112-20ad94767ddf/go.mod h1:eGrXziwI7scSGrwIj+5EBHtTeSxAZD/yi8Hb3nFXesA= deps.dev/util/pypi v0.0.0-20250903005441-604c45d5b44b h1:67FfxwUt82PEMle2FKlW4DZvzcfSODDoTnSGOT1bYtY= deps.dev/util/pypi v0.0.0-20250903005441-604c45d5b44b/go.mod h1:qmA0z/Lsfa1FMtuLd9JmVZLMHR3GBX/EmbM6z1X3EDU= deps.dev/util/resolve v0.0.0-20250903005441-604c45d5b44b h1:Ha9MFfZZ3kJGK8T4RJjyvRNEaXlAvcDMqzEufu5obOI= @@ -150,14 +150,20 @@ github.com/Yiling-J/theine-go v0.6.2 h1:1GeoXeQ0O0AUkiwj2S9Jc0Mzx+hpqzmqsJ4kIC4M github.com/Yiling-J/theine-go v0.6.2/go.mod h1:08QpMa5JZ2pKN+UJCRrCasWYO1IKCdl54Xa836rpmDU= github.com/a8m/envsubst v1.4.3 h1:kDF7paGK8QACWYaQo6KtyYBozY2jhQrTuNNuUxQkhJY= github.com/a8m/envsubst v1.4.3/go.mod h1:4jjHWQlZoaXPoLQUb7H2qT4iLkZDdmEQiOUogdUmqVU= +github.com/aead/serpent v0.0.0-20160714141033-fba169763ea6 h1:5L8Mj9Co9sJVgW3TpYk2gxGJnDjsYuboNTcRmbtGKGs= +github.com/aead/serpent v0.0.0-20160714141033-fba169763ea6/go.mod h1:3HgLJ9d18kXMLQlJvIY3+FszZYMxCz8WfE2MQ7hDY0w= github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo= github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558= github.com/agnivade/levenshtein v1.2.1 h1:EHBY3UOn1gwdy/VbFwgo4cxecRznFk7fKWN1KOX7eoM= github.com/agnivade/levenshtein v1.2.1/go.mod h1:QVVI16kDrtSuwcpd0p1+xMC6Z/VfhtCyDIjcwga4/DU= +github.com/alecthomas/assert v1.0.0 h1:3XmGh/PSuLzDbK3W2gUbRXwgW5lqPkuqvRgeQ30FI5o= +github.com/alecthomas/assert v1.0.0/go.mod h1:va/d2JC+M7F6s+80kl/R3G7FUiW6JzUO+hPhLyJ36ZY= github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0= github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k= github.com/alecthomas/chroma/v2 v2.18.0 h1:6h53Q4hW83SuF+jcsp7CVhLsMozzvQvO8HBbKQW+gn4= github.com/alecthomas/chroma/v2 v2.18.0/go.mod h1:RVX6AvYm4VfYe/zsk7mjHueLDZor3aWCNE14TFlepBk= +github.com/alecthomas/colour v0.1.0 h1:nOE9rJm6dsZ66RGWYSFrXw461ZIt9A6+nHgL7FRrDUk= +github.com/alecthomas/colour v0.1.0/go.mod h1:QO9JBoKquHd+jz9nshCh40fOfO+JzsoXy8qTHF68zU0= github.com/alecthomas/participle/v2 v2.1.4 h1:W/H79S8Sat/krZ3el6sQMvMaahJ+XcM9WSI2naI7w2U= github.com/alecthomas/participle/v2 v2.1.4/go.mod h1:8tqVbpTX20Ru4NfYQgZf4mP18eXPTBViyMWiArNEgGI= github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs= @@ -166,6 +172,8 @@ github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuy github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0= github.com/alexdrl/zerowater v0.0.3 h1:HXJ/81MQPZzuDkyYA0qJIeO+b0zfhbHx0AMwIYf8kpY= github.com/alexdrl/zerowater v0.0.3/go.mod h1:/saQVO5M1WksImbThtIC8kes8/mDqpO1KZe+gFXtGe0= +github.com/anchore/go-lzo v0.1.0 h1:NgAacnzqPeGH49Ky19QKLBZEuFRqtTG9cdaucc3Vncs= +github.com/anchore/go-lzo v0.1.0/go.mod h1:3kLx0bve2oN1iDwgM1U5zGku1Tfbdb0No5qp1eL1fIk= github.com/anchore/go-struct-converter v0.1.0 h1:2rDRssAl6mgKBSLNiVCMADgZRhoqtw9dedlWa0OhD30= github.com/anchore/go-struct-converter v0.1.0/go.mod h1:rYqSE9HbjzpHTI74vwPvae4ZVYZd1lue2ta6xHPdblA= github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8= @@ -240,6 +248,8 @@ github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuP github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4= github.com/barkimedes/go-deepcopy v0.0.0-20220514131651-17c30cfc62df h1:GSoSVRLoBaFpOOds6QyY1L8AX7uoY+Ln3BHc22W40X0= github.com/barkimedes/go-deepcopy v0.0.0-20220514131651-17c30cfc62df/go.mod h1:hiVxq5OP2bUGBRNS3Z/bt/reCLFNbdcST6gISi1fiOM= +github.com/bazelbuild/buildtools v0.0.0-20250826111327-4006b543a694 h1:LiKs9FsSfMx3NomNclXYkv9enY77oft5Mc/vX/AKHgI= +github.com/bazelbuild/buildtools v0.0.0-20250826111327-4006b543a694/go.mod h1:PLNUetjLa77TCCziPsz0EI8a6CUxgC+1jgmWv0H25tg= github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA= github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q= github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8= @@ -314,6 +324,8 @@ github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 h1:aBangftG7EVZoUb69Os github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2/go.mod h1:qwXFYgsP6T7XnJtbKlf1HP8AjxZZyzxMmc+Lq5GjlU4= github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb h1:EDmT6Q9Zs+SbUoc7Ik9EfrFqcylYqgPZ9ANSbTAntnE= github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb/go.mod h1:ZjrT6AXHbDs86ZSdt/osfBi5qfexBrKUdONk989Wnk4= +github.com/compose-spec/compose-go/v2 v2.8.1 h1:27O4dzyhiS/UEUKp1zHOHCBWD1WbxGsYGMNNaSejTk4= +github.com/compose-spec/compose-go/v2 v2.8.1/go.mod h1:veko/VB7URrg/tKz3vmIAQDaz+CGiXH8vZsW79NmAww= github.com/containerd/cgroups/v3 v3.1.2 h1:OSosXMtkhI6Qove637tg1XgK4q+DhR0mX8Wi8EhrHa4= github.com/containerd/cgroups/v3 v3.1.2/go.mod h1:PKZ2AcWmSBsY/tJUVhtS/rluX0b1uq1GmPO1ElCmbOw= github.com/containerd/containerd v1.7.33 h1:iAkYGC/ifR/V+0eR4iXWHNGYUF0DF2PmGV5iz4Irj5M= @@ -378,8 +390,12 @@ github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 h1:lxmTCgmHE1G github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7/go.mod h1:GvWntX9qiTlOud0WkQ6ewFm0LPy5JUR1Xo0Ngbd1w6Y= github.com/dimchansky/utfbom v1.1.1 h1:vV6w1AhK4VMnhBno/TPVCoK9U/LP0PkLCS9tbxHdi/U= github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE= +github.com/diskfs/go-diskfs v1.7.0 h1:vonWmt5CMowXwUc79jWyGrf2DIMeoOjkLlMnQYGVOs8= +github.com/diskfs/go-diskfs v1.7.0/go.mod h1:LhQyXqOugWFRahYUSw47NyZJPezFzB9UELwhpszLP/k= github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk= github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E= +github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c= +github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0= github.com/dlclark/regexp2 v1.11.5 h1:Q/sSnsKerHeCkc/jSTNq1oCm7KiVgUMZRDUoRu0JQZQ= github.com/dlclark/regexp2 v1.11.5/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8= github.com/docker/cli v29.4.3+incompatible h1:u+UliYm2J/rYrIh2FqHQg32neRG8GjbvNuwQRTzGspU= @@ -394,6 +410,12 @@ github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA= github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4= github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk= +github.com/dsoprea/go-exfat v0.0.0-20190906070738-5e932fbdb589 h1:LzrKhEeL5tqo8i86+5a8JgL5cEJBRspVm4FsKRK/gxA= +github.com/dsoprea/go-exfat v0.0.0-20190906070738-5e932fbdb589/go.mod h1:zs3tKt0dOHncKZ7QhimWwN9RP7f6W6CLdjRfscKvvcA= +github.com/dsoprea/go-logging v0.0.0-20190624164917-c4f10aab7696/go.mod h1:Nm/x2ZUNRW6Fe5C3LxdY1PyZY5wmDv/s5dkPJ/VB3iA= +github.com/dsoprea/go-logging v0.0.0-20200710184922-b02d349568dd h1:l+vLbuxptsC6VQyQsfD7NnEC8BZuFpz45PgY+pH8YTg= +github.com/dsoprea/go-logging v0.0.0-20200710184922-b02d349568dd/go.mod h1:7I+3Pe2o/YSU88W0hWlm9S22W7XI1JFNJ86U0zPKMf8= +github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk= github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY= github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto= github.com/edsrzf/mmap-go v1.1.0 h1:6EUwBLQ/Mcr1EYLE4Tn1VdW1A4ckqCQWZBw8Hr0kjpQ= @@ -402,6 +424,8 @@ github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE= github.com/elliotchance/orderedmap v1.8.0 h1:TrOREecvh3JbS+NCgwposXG5ZTFHtEsQiCGOhPElnMw= github.com/elliotchance/orderedmap v1.8.0/go.mod h1:wsDwEaX5jEoyhbs7x93zk2H/qv0zwuhg4inXhDkYqys= +github.com/elliotwutingfeng/asciiset v0.0.0-20230602022725-51bbb787efab h1:h1UgjJdAAhj+uPL68n7XASS6bU+07ZX1WJvVS2eyoeY= +github.com/elliotwutingfeng/asciiset v0.0.0-20230602022725-51bbb787efab/go.mod h1:GLo/8fDswSAniFG+BFIaiSPcK610jyzgEhWYPQwuQdw= github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes= github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc= github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc= @@ -450,6 +474,9 @@ github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1 github.com/go-chi/chi v4.0.2+incompatible/go.mod h1:eB3wogJHnLi3x/kFX2A+IbTBlXxmMeXJVKy9tTv1XzQ= github.com/go-chi/chi/v5 v5.3.0 h1:halUjDxhshgXHMrao5bB8eNBXo/rnzwr8m5m36glehM= github.com/go-chi/chi/v5 v5.3.0/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto= +github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q= +github.com/go-errors/errors v1.0.2 h1:xMxH9j2fNg/L4hLn/4y3M0IUsn0M6Wbu/Uh9QlOfBh4= +github.com/go-errors/errors v1.0.2/go.mod h1:psDX2osz5VnTOnFWbDeWwS7yejl+uV3FEWEp4lssFEs= github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI= github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic= github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmmBPA= @@ -536,6 +563,9 @@ github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJn github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY= github.com/go-playground/validator/v10 v10.30.3 h1:4MU6YkEwx7GbcPJOZxrtbu+QfF3pJLJuaYTeAH0DYy8= github.com/go-playground/validator/v10 v10.30.3/go.mod h1:4Axh7oCNGcoGkqLoE4YWt6n20mcEIsPRlB7vPk3lpyc= +github.com/go-restruct/restruct v0.0.0-20190418070341-acd4e4c2cb35/go.mod h1:e2k/t2/850rC773ilFYQSoqyJ78SpTx7gtFtOY6/AYA= +github.com/go-restruct/restruct v1.2.0-alpha h1:2Lp474S/9660+SJjpVxoKuWX09JsXHSrdV7Nv3/gkvc= +github.com/go-restruct/restruct v1.2.0-alpha/go.mod h1:KqrpKpn4M8OLznErihXTGLlsXFGeLxHUrLRRI/1YjGk= github.com/go-sql-driver/mysql v1.10.0 h1:Q+1LV8DkHJvSYAdR83XzuhDaTykuDx0l6fkXxoWCWfw= github.com/go-sql-driver/mysql v1.10.0/go.mod h1:M+cqaI7+xxXGG9swrdeUIoPG3Y3KCkF0pZej+SK+nWk= github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY= @@ -644,8 +674,8 @@ github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0= github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs= github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0= -github.com/google/osv-scalibr v0.3.4 h1:YoHviDLM6/FIEfqH1nuLdImmqmg4XGYL0kr0s+6T+sk= -github.com/google/osv-scalibr v0.3.4/go.mod h1:YeOH2wz0HlccjDbYYYTcX01ZyAuwqhZcpQFV7Cxsrwo= +github.com/google/osv-scalibr v0.4.5 h1:fiJWZg0jXKzFmJiYKs/BhIzUMYUGs0HT2oUZOoKSL+Q= +github.com/google/osv-scalibr v0.4.5/go.mod h1:cNGl//rZ1OcOiFkLXY5DNrhFN7JKMGf4ieQrENUfEZw= github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc= github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc= github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= @@ -728,6 +758,10 @@ github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSo github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef h1:A9HsByNhogrvm9cWb28sjiS3i7tcKCkflWFEkHfuAgM= github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef/go.mod h1:lADxMC39cJJqL93Duh1xhAs4I2Zs8mKS89XWXFGp9cs= github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= +github.com/ianlancetaylor/demangle v0.0.0-20251118225945-96ee0021ea0f h1:Fnl4pzx8SR7k7JuzyW8lEtSFH6EQ8xgcypgIn8pcGIE= +github.com/ianlancetaylor/demangle v0.0.0-20251118225945-96ee0021ea0f/go.mod h1:gx7rwoVhcfuVKG5uya9Hs3Sxj7EIvldVofAWIUtGouw= +github.com/icholy/digest v1.1.0 h1:HfGg9Irj7i+IX1o1QAmPfIBNu/Q5A5Tu3n/MED9k9H4= +github.com/icholy/digest v1.1.0/go.mod h1:QNrsSGQ5v7v9cReDI0+eyjsXGUoRSUZQHeQ5C4XLa0Y= github.com/in-toto/attestation v1.2.0 h1:aPRUZ3azbqD7yEBD5fP3TD8Dszf+YHo284SOcpahjQk= github.com/in-toto/attestation v1.2.0/go.mod h1:r79G45gOmzPismgObLSL+rZTFxUgZLOQJI6LofTZgXk= github.com/in-toto/in-toto-golang v0.11.0 h1:nfidMYBFx+E0lnmX5KUnN2Pdm8zdNKal1ayjJuzzRoA= @@ -770,6 +804,7 @@ github.com/jellydator/ttlcache/v3 v3.4.0 h1:YS4P125qQS0tNhtL6aeYkheEaB/m8HCqdMMP github.com/jellydator/ttlcache/v3 v3.4.0/go.mod h1:Hw9EgjymziQD3yGsQdf1FqFdpp7YjFMd4Srg5EJlgD4= github.com/jeremija/gosubmit v0.2.8 h1:mmSITBz9JxVtu8eqbN+zmmwX7Ij2RidQxhcwRVI4wqA= github.com/jeremija/gosubmit v0.2.8/go.mod h1:Ui+HS073lCFREXBbdfrJzMB57OI/bdxTiLtrDHHhFPI= +github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI= github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8= github.com/jinzhu/copier v0.4.0/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg= github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU= @@ -836,8 +871,12 @@ github.com/lithammer/shortuuid/v3 v3.0.7 h1:trX0KTHy4Pbwo/6ia8fscyHoGA+mf1jWbPJV github.com/lithammer/shortuuid/v3 v3.0.7/go.mod h1:vMk8ke37EmiewwolSO1NLW8vP4ZaKlRuDIi8tWWmAts= github.com/lucasb-eyer/go-colorful v1.3.0 h1:2/yBRLdWBZKrf7gB40FoiKfAWYQ0lqNcbuQwVHXptag= github.com/lucasb-eyer/go-colorful v1.3.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0= +github.com/lunixbochs/struc v0.0.0-20200707160740-784aaebc1d40 h1:EnfXoSqDfSNJv0VBNqY/88RNnhSGYkrHaO0mmFGbVsc= +github.com/lunixbochs/struc v0.0.0-20200707160740-784aaebc1d40/go.mod h1:vy1vK6wD6j7xX6O6hXe621WabdtNkou2h7uRtTfRMyg= github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE= github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0= +github.com/masahiro331/go-ext4-filesystem v0.0.0-20240620024024-ca14e6327bbd h1:JEIW94K3spsvBI5Xb9PGhKSIza9/jxO1lF30tPCAJlA= +github.com/masahiro331/go-ext4-filesystem v0.0.0-20240620024024-ca14e6327bbd/go.mod h1:3XMMY1M486mWGTD13WPItg6FsgflQR72ZMAkd+gsyoQ= github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg= github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE= github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= @@ -850,6 +889,8 @@ github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+Ei github.com/mattn/go-runewidth v0.0.12/go.mod h1:RAqKPSqVFrSLVXbA8x7dzmKdmGzieGRCM46jaSJTDAk= github.com/mattn/go-runewidth v0.0.21 h1:jJKAZiQH+2mIinzCJIaIG9Be1+0NR+5sz/lYEEjdM8w= github.com/mattn/go-runewidth v0.0.21/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs= +github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk= +github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y= github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0= github.com/mfridman/interpolate v0.0.2 h1:pnuTK7MQIxxFz1Gr+rjSIx9u7qVjf5VOoM/u6BbAxPY= github.com/mfridman/interpolate v0.0.2/go.mod h1:p+7uk6oE07mpE/Ik1b8EckO0O4ZXiGAfshKBWLUM9Xg= @@ -979,8 +1020,8 @@ github.com/openfga/language/pkg/go v0.2.1/go.mod h1:wg+EuPmYIaM855F2uPygT1hJoWco github.com/openfga/openfga v1.18.0 h1:aNQHPNZGDYyf4DqxdTzzTT/5nQM4yAtKw3S3ZFhSPn0= github.com/openfga/openfga v1.18.0/go.mod h1:se83OqKfGcb9Ddw/Bk85d2WE7PisFmDv/CeZQh3ZyIM= github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o= -github.com/ossf/osv-schema/bindings/go v0.0.0-20250805051309-c463400aa925 h1:+0cUosLHFxJHJwei+iA4aDesInPm0Xd4uCFud4Jopq8= -github.com/ossf/osv-schema/bindings/go v0.0.0-20250805051309-c463400aa925/go.mod h1:lILztSxHU7VsdlYqCnwgxSDBhbXMf7iEQWtldJCDXPo= +github.com/ossf/osv-schema/bindings/go v0.0.0-20260129002236-09a17f85b44a h1:XHKiGf7vsACh43gFCBb5lOxDjnY6CQYNoQXsO/SlI6k= +github.com/ossf/osv-schema/bindings/go v0.0.0-20260129002236-09a17f85b44a/go.mod h1:Eo7R19vlnflsCRdHW1ynyNUyoRwxdaTmTWD9MtKnJTc= github.com/package-url/packageurl-go v0.1.3 h1:4juMED3hHiz0set3Vq3KeQ75KD1avthoXLtmE3I0PLs= github.com/package-url/packageurl-go v0.1.3/go.mod h1:nKAWB8E6uk1MHqiS/lQb9pYBGH2+mdJ2PJc2s50dQY0= github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30/go.mod h1:85jBQOZwpVEaDAr341tbn15RS4fCAsIst0qp7i8ex1o= @@ -1072,6 +1113,8 @@ github.com/sassoftware/relic v7.2.1+incompatible h1:Pwyh1F3I0r4clFJXkSI8bOyJINGq github.com/sassoftware/relic v7.2.1+incompatible/go.mod h1:CWfAxv73/iLZ17rbyhIEq3K9hs5w6FpNMdUT//qR+zk= github.com/sassoftware/relic/v7 v7.6.2 h1:rS44Lbv9G9eXsukknS4mSjIAuuX+lMq/FnStgmZlUv4= github.com/sassoftware/relic/v7 v7.6.2/go.mod h1:kjmP0IBVkJZ6gXeAu35/KCEfca//+PKM6vTAsyDPY+k= +github.com/sebdah/goldie v1.0.0 h1:9GNhIat69MSlz/ndaBg48vl9dF5fI+NBB6kfOxgfkMc= +github.com/sebdah/goldie v1.0.0/go.mod h1:jXP4hmWywNEwZzhMuv2ccnqTSFpuq8iyQhtQdkkZBH4= github.com/secDre4mer/pkcs7 v0.0.0-20240322103146-665324a4461d h1:RQqyEogx5J6wPdoxqL132b100j8KjcVHO1c0KLRoIhc= github.com/secDre4mer/pkcs7 v0.0.0-20240322103146-665324a4461d/go.mod h1:PegD7EVqlN88z7TpCqH92hHP+GBpfomGCCnw1PFtNOA= github.com/secure-systems-lab/go-securesystemslib v0.11.0 h1:iuCR9kcMFD4QurdKrGvPLoKZLv9YvwPYVr0473BdtFs= @@ -1220,6 +1263,8 @@ github.com/transparency-dev/formats v0.1.1 h1:4bVHJc+KdBgpA1OJD1yjI+g0i5Z1graCpp github.com/transparency-dev/formats v0.1.1/go.mod h1:qtZ8goRuJ8FTBG9c9+Bj0rn2rUG7eG/AUTkr+Aw3jFw= github.com/transparency-dev/merkle v0.0.2 h1:Q9nBoQcZcgPamMkGn7ghV8XiTZ/kRxn1yCG81+twTK4= github.com/transparency-dev/merkle v0.0.2/go.mod h1:pqSy+OXefQ1EDUVmAJ8MUhHB9TXGuzVAT58PqBoHz1A= +github.com/ulikunitz/xz v0.5.14 h1:uv/0Bq533iFdnMHZdRBTOlaNMdb1+ZxXIlHDZHIHcvg= +github.com/ulikunitz/xz v0.5.14/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14= github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw= github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc= github.com/valyala/fastjson v1.6.10 h1:/yjJg8jaVQdYR3arGxPE2X5z89xrlhS0eGXdv+ADTh4= @@ -1238,6 +1283,8 @@ github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHo github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ= github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74= github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y= +github.com/xhit/go-str2duration/v2 v2.1.0 h1:lxklc02Drh6ynqX+DdPyp5pCKLUQpRT8bp8Ydu2Bstc= +github.com/xhit/go-str2duration/v2 v2.1.0/go.mod h1:ohY8p+0f07DiV6Em5LKB0s2YpLtXVyJfNt1+BlmyAsU= github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 h1:nIPpBwaJSVYIxUFsDv3M8ofmx9yWTog9BfvIu0q41lo= github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8/go.mod h1:HUYIGzjTL3rfEspMxjDjgmT5uz5wzYJKVo23qUhYTos= github.com/xitongsys/parquet-go v1.6.2 h1:MhCaXii4eqceKPu9BwrjLqyK10oX9WF+xGhwvwbw7xM= @@ -1396,6 +1443,7 @@ golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= @@ -1477,7 +1525,9 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220408201424-a24fb2fb8a0f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220615213510-4f61da869c0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= @@ -1741,8 +1791,8 @@ modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0= modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A= modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y= modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM= -osv.dev/bindings/go v0.0.0-20250808040635-c189436f8791 h1:UPwD9xNkZVS+WmfQv599Hd9HnD1Ph6MS3lPTInwmfV4= -osv.dev/bindings/go v0.0.0-20250808040635-c189436f8791/go.mod h1:U5TQCqNDZIFATIofBLLRrG+1SSBl6z/PjsXoExyaHJ0= +osv.dev/bindings/go v0.0.0-20251029235023-a02c549eeac2 h1:Vq0XOj9dIEhyhtxN38onins/un8Sv6na4GaqNqcl5XY= +osv.dev/bindings/go v0.0.0-20251029235023-a02c549eeac2/go.mod h1:Kkbt33FT7qAnsPbQtu8gjyxrFOOxUR/88d7/51Aecfg= pgregory.net/rapid v1.2.0 h1:keKAYRcjm+e1F0oAuU5F5+YPAWcyxNNRK2wud503Gnk= pgregory.net/rapid v1.2.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04= rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8= @@ -1762,5 +1812,7 @@ sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs= sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4= software.sslmate.com/src/go-pkcs12 v0.4.0 h1:H2g08FrTvSFKUj+D309j1DPfk5APnIdAQAB8aEykJ5k= software.sslmate.com/src/go-pkcs12 v0.4.0/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI= +www.velocidex.com/golang/go-ntfs v0.2.0 h1:JLS4hOQLupiVzo+1z4Xb8AZyIaXHDmiGnKyoM/bRYq0= +www.velocidex.com/golang/go-ntfs v0.2.0/go.mod h1:itvbHQcnLdTVIDY6fI3lR0zeBwXwBYBdUFtswE0x1vc= www.velocidex.com/golang/regparser v0.0.0-20250203141505-31e704a67ef7 h1:BMX/37sYwX+8JhHt+YNbPfbx7dXG1w1L1mXonNBtjt0= www.velocidex.com/golang/regparser v0.0.0-20250203141505-31e704a67ef7/go.mod h1:pxSECT5mWM3goJ4sxB4HCJNKnKqiAlpyT8XnvBwkLGU= diff --git a/internal/deps/scalibr/scalibr.go b/internal/deps/scalibr/scalibr.go index decb23251a..832892fd31 100644 --- a/internal/deps/scalibr/scalibr.go +++ b/internal/deps/scalibr/scalibr.go @@ -10,15 +10,20 @@ import ( "errors" "fmt" "io/fs" + "os" + "reflect" "slices" + "time" scalibr "github.com/google/osv-scalibr" - "github.com/google/osv-scalibr/extractor/filesystem/language/golang/gobinary" + scalibr_cfg "github.com/google/osv-scalibr/binary/proto/config_go_proto" scalibr_fs "github.com/google/osv-scalibr/fs" scalibr_plugin "github.com/google/osv-scalibr/plugin" "github.com/google/osv-scalibr/plugin/list" + "github.com/google/osv-scalibr/stats" "github.com/google/uuid" "github.com/protobom/protobom/pkg/sbom" + "github.com/rs/zerolog" ) // Extractor is a dependency extractor based on osv-scalibr. @@ -52,17 +57,37 @@ func scanFilesystem(ctx context.Context, iofs fs.FS) (*sbom.NodeList, error) { RunningSystem: false, } + // TODO: it's unfortunate that scalibr spills files to disk. File an upstream bug? + // NOTE: since we require NetworkOffline, we may not actually download anything... + tmpDir, err := os.MkdirTemp("", "minder-scalibr-*") + if err != nil { + return nil, fmt.Errorf("failed to create temporary scalibr directory: %w", err) + } + defer func() { + _ = os.RemoveAll(tmpDir) + }() + cfg := scalibr_cfg.PluginConfig{ + MaxFileSizeBytes: 1024 * 1024, + LocalRegistry: tmpDir, + DisableGoogleAuth: true, + } + scalibrFs := scalibr_fs.ScanRoot{FS: wrapped} - extractors := list.FromCapabilities(&desiredCaps) - // Don't run the go binary extractor; it sometimes panics on certain files. - extractors = slices.DeleteFunc(extractors, func(e scalibr_plugin.Plugin) bool { - _, ok := e.(*gobinary.Extractor) - return ok + plugins, err := list.FromCapabilities(&desiredCaps, &cfg) + if err != nil { + return nil, err + } + // unknownbinariesextr uses file extension to determine "binary-ness", and triggers on e.g. .py files + skipPlugins := []string{"ffa/unknownbinariesextr"} + plugins = slices.DeleteFunc(plugins, func(p scalibr_plugin.Plugin) bool { + return slices.Contains(skipPlugins, p.Name()) }) + // Ugly way to get statistics from each plugin, see https://github.com/google/osv-scalibr/issues/2316 + stats := errorStats{} + patchExtractorStats(plugins, &stats) scanConfig := scalibr.ScanConfig{ - ScanRoots: []*scalibr_fs.ScanRoot{&scalibrFs}, - // All includes Ruby, Dotnet which we're not ready to test yet, so use the more limited Default set. - Plugins: extractors, + ScanRoots: []*scalibr_fs.ScanRoot{&scalibrFs}, + Plugins: plugins, Capabilities: &desiredCaps, } @@ -72,10 +97,36 @@ func scanFilesystem(ctx context.Context, iofs fs.FS) (*sbom.NodeList, error) { if scanResults == nil || scanResults.Status == nil { return nil, fmt.Errorf("error scanning files: no results") } - if scanResults.Status.Status != scalibr_plugin.ScanStatusSucceeded { + switch scanResults.Status.Status { + case scalibr_plugin.ScanStatusSucceeded: + // success, continue + case scalibr_plugin.ScanStatusPartiallySucceeded: + // Scalibr runs a lot of plugins and aggregates the result. Some of these are picky, and + // fail for random reasons. Accept partial success, but log the failing plugins. + known_bad := []string{ + "endoflife/linuxdistro", // https://github.com/google/osv-scalibr/pull/2068 + "rust/cargoauditable", // https://github.com/go-git/go-billy/pull/208 + } + for _, ps := range scanResults.PluginStatus { + if ps.Status.Status != scalibr_plugin.ScanStatusSucceeded { + if !slices.Contains(known_bad, ps.Name) { + zerolog.Ctx(ctx).Warn().Str("plugin", ps.Name).Str("status", ps.Status.FailureReason). + Msg("Scalibr plugin failed") + } + } + } + case scalibr_plugin.ScanStatusUnspecified, scalibr_plugin.ScanStatusFailed: + fallthrough + default: return nil, fmt.Errorf("error scanning files: %s", scanResults.Status) } + for _, statErr := range stats.errs { + zerolog.Ctx(ctx).Info(). + Str("plugin", statErr.plugin).Str("path", statErr.path).Str("res", string(statErr.result)). + Msg("Scalibr require warning on file") + } + res := sbom.NewNodeList() for _, inv := range scanResults.Inventory.Packages { // TODO: use repo and commit from inv.SourceCode @@ -102,3 +153,79 @@ func scanFilesystem(ctx context.Context, iofs fs.FS) (*sbom.NodeList, error) { return res, nil } + +// Monkey-patch the plugins with stats.Collector, as Scalibr does not provide a nice interface +// for setting the collector which almost every plugin exposes. +// See https://github.com/google/osv-scalibr/issues/2316 +func patchExtractorStats(plugins []scalibr_plugin.Plugin, stats stats.Collector) { + for _, p := range plugins { + v := reflect.ValueOf(p) + if v.Kind() != reflect.Ptr || v.IsNil() { + continue + } + elem := v.Elem() + if elem.Kind() != reflect.Struct { + continue + } + statsField := elem.FieldByName("Stats") + if !statsField.IsValid() || !statsField.CanSet() { + continue + } + collectorVal := reflect.ValueOf(stats) + if collectorVal.Type().AssignableTo(statsField.Type()) { + statsField.Set(collectorVal) + continue + } + if collectorVal.Type().Implements(statsField.Type()) { + statsField.Set(collectorVal) + } + } +} + +var _ stats.Collector = (*errorStats)(nil) + +type statErr struct { + plugin string + path string + result string +} + +type errorStats struct { + errs []statErr + maxRSS int64 +} + +// AfterDetectorRun implements [stats.Collector]. +func (e *errorStats) AfterDetectorRun(name string, runtime time.Duration, err error) {} + +// AfterExtractorRun implements [stats.Collector]. +func (e *errorStats) AfterExtractorRun(pluginName string, extractorstats *stats.AfterExtractorStats) { +} + +// AfterFileExtracted implements [stats.Collector]. +func (e *errorStats) AfterFileExtracted(pluginName string, filestats *stats.FileExtractedStats) { + if filestats.Result != stats.FileExtractedResultSuccess { + e.errs = append(e.errs, statErr{pluginName, filestats.Path, string(filestats.Result)}) + } +} + +// AfterFileRequired implements [stats.Collector]. +func (e *errorStats) AfterFileRequired(pluginName string, filestats *stats.FileRequiredStats) { + if filestats.Result != stats.FileRequiredResultOK { + e.errs = append(e.errs, statErr{pluginName, filestats.Path, string(filestats.Result)}) + } +} + +// AfterInodeVisited implements [stats.Collector]. +func (e *errorStats) AfterInodeVisited(path string) {} + +// AfterResultsExported implements [stats.Collector]. +func (e *errorStats) AfterResultsExported(destination string, bytes int, err error) {} + +// AfterScan implements [stats.Collector]. +func (e *errorStats) AfterScan(runtime time.Duration, status *scalibr_plugin.ScanStatus) {} + +// MaxRSS implements [stats.Collector]. +func (e *errorStats) MaxRSS(maxRSS int64) { + e.maxRSS = maxRSS +} diff --git a/internal/deps/scalibr/scalibr_test.go b/internal/deps/scalibr/scalibr_test.go index bacf357b79..7bf1b2d4ac 100644 --- a/internal/deps/scalibr/scalibr_test.go +++ b/internal/deps/scalibr/scalibr_test.go @@ -4,6 +4,7 @@ package scalibr import ( + "bytes" "context" "fmt" "io/fs" @@ -13,6 +14,8 @@ import ( "github.com/go-git/go-billy/v5/helper/iofs" "github.com/go-git/go-billy/v5/memfs" "github.com/protobom/protobom/pkg/sbom" + "github.com/rs/zerolog" + "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) @@ -24,6 +27,7 @@ func TestScanFilesystem(t *testing.T) { mustErr bool expect *sbom.NodeList expectedLen int + expectedLog string }{ { name: "python-reqs-txt", @@ -73,6 +77,41 @@ func TestScanFilesystem(t *testing.T) { }, }, }, + { + name: "jumbo package lock (npm)", + makeFs: func() fs.FS { + t.Helper() + memFS := memfs.New() + f, err := memFS.Create("package-lock.json") + require.NoError(t, err) + fmt.Fprintf(f, `{"name":"test","version": "0.0.1", "lockfileVersion": 3, "requires": true, "packages": {`) + // Ensure the package-lock.json is over 1MB + for i := range 1000 { + fmt.Fprintf(f, `"package-%d": {"resolved": "https://myregistry/@fake/package-%900d.tgz",`, i, i) + fmt.Fprintf(f, ` "integrity": "sha512-00000000000000000000000000000000000000000000000000000000000000000000000000000000000000"},`) + } + // We put the root package at the end so we don't have to mess with trailing commas + fmt.Fprintf(f, `"": {"name": "test", "version": "0.0.1"}}}`) + require.NoError(t, f.Close()) + return iofs.New(memFS) + }, + expectedLen: 0, + expectedLog: `"path":"package-lock.json","res":"FILE_REQUIRED_RESULT_SIZE_LIMIT_EXCEEDED"`, + }, + { + name: "go-binary does not panic on python", + makeFs: func() fs.FS { + t.Helper() + memFS := memfs.New() + f, err := memFS.Create("binary.py") + require.NoError(t, err) + fmt.Fprint(f, `print("hello world")\n`) + require.NoError(t, f.Close()) + return iofs.New(memFS) + }, + expectedLen: 0, + expectedLog: `"plugin":"go/binary","path":"binary.py"`, + }, { name: "bad-fs", makeFs: func() fs.FS { @@ -84,11 +123,15 @@ func TestScanFilesystem(t *testing.T) { t.Run(tc.name, func(t *testing.T) { t.Parallel() fs := tc.makeFs() - nodelist, err := scanFilesystem(context.Background(), fs) + logOutput := new(bytes.Buffer) + ctx := zerolog.New(logOutput).WithContext(context.Background()) + nodelist, err := scanFilesystem(ctx, fs) if tc.mustErr { require.Error(t, err) return } + + assert.Contains(t, string(logOutput.String()), tc.expectedLog) require.NoError(t, err) require.Len(t, nodelist.Nodes, tc.expectedLen) diff --git a/internal/engine/ingester/deps/deps_test.go b/internal/engine/ingester/deps/deps_test.go index e3720aee1e..e94d5d08a5 100644 --- a/internal/engine/ingester/deps/deps_test.go +++ b/internal/engine/ingester/deps/deps_test.go @@ -221,7 +221,7 @@ func TestIngestRepo(t *testing.T) { Name: "vtop", Version: "0.6.1", Identifiers: map[int32]string{ - int32(sbom.SoftwareIdentifierType_PURL): "pkg:npm/vtop@0.6.1", + int32(sbom.SoftwareIdentifierType_PURL): "pkg:npm/vtop@0.6.1?source=UNKNOWN", }, Properties: []*sbom.Property{{ Name: "sourceFile", diff --git a/internal/engine/ingester/diff/diff.go b/internal/engine/ingester/diff/diff.go index 4412e58a7f..be29273f0c 100644 --- a/internal/engine/ingester/diff/diff.go +++ b/internal/engine/ingester/diff/diff.go @@ -10,6 +10,7 @@ import ( "context" "fmt" "math" + "os" "path/filepath" "regexp" "slices" @@ -19,6 +20,7 @@ import ( "github.com/go-git/go-billy/v5" "github.com/go-git/go-billy/v5/helper/iofs" scalibr "github.com/google/osv-scalibr" + scalibr_cfg "github.com/google/osv-scalibr/binary/proto/config_go_proto" "github.com/google/osv-scalibr/extractor" scalibr_fs "github.com/google/osv-scalibr/fs" scalibr_plugin "github.com/google/osv-scalibr/plugin" @@ -269,11 +271,34 @@ func scanFs(ctx context.Context, memFS billy.Filesystem, _ map[string]string) ([ RunningSystem: false, } + // TODO: it's unfortunate that scalibr spills files to disk. File an upstream bug? + // NOTE: since we require NetworkOffline, we may not actually download anything... + tmpDir, err := os.MkdirTemp("", "minder-scalibr-*") + if err != nil { + return nil, fmt.Errorf("failed to create temporary scalibr directory: %w", err) + } + defer func() { + _ = os.RemoveAll(tmpDir) + }() + cfg := scalibr_cfg.PluginConfig{ + MaxFileSizeBytes: 1024 * 1024, + LocalRegistry: tmpDir, + DisableGoogleAuth: true, + } + scalibrFs := scalibr_fs.ScanRoot{FS: wrapped} + plugins, err := list.FromCapabilities(&desiredCaps, &cfg) + if err != nil { + return nil, err + } + // unknownbinariesextr uses file extension to determine "binary-ness", and triggers on e.g. .py files + skipPlugins := []string{"ffa/unknownbinariesextr"} + plugins = slices.DeleteFunc(plugins, func(p scalibr_plugin.Plugin) bool { + return slices.Contains(skipPlugins, p.Name()) + }) scanConfig := scalibr.ScanConfig{ - ScanRoots: []*scalibr_fs.ScanRoot{&scalibrFs}, - // All includes Ruby, Dotnet which we're not ready to test yet, so use the more limited Default set. - Plugins: list.FromCapabilities(&desiredCaps), + ScanRoots: []*scalibr_fs.ScanRoot{&scalibrFs}, + Plugins: plugins, Capabilities: &desiredCaps, } @@ -283,11 +308,30 @@ func scanFs(ctx context.Context, memFS billy.Filesystem, _ map[string]string) ([ if scanResults == nil || scanResults.Status == nil { return nil, fmt.Errorf("error scanning files: no results") } - if scanResults.Status.Status != scalibr_plugin.ScanStatusSucceeded { + switch scanResults.Status.Status { + case scalibr_plugin.ScanStatusSucceeded: + return scanResults.Inventory.Packages, nil + // Scalibr runs a lot of plugins and aggregates the result. Some of these are picky, and + // fail for random reasons. Accept partial success, but log the failing plugins. + case scalibr_plugin.ScanStatusPartiallySucceeded: + known_bad := []string{ + "endoflife/linuxdistro", // https://github.com/google/osv-scalibr/pull/2068 + "rust/cargoauditable", // https://github.com/go-git/go-billy/pull/208 + } + for _, ps := range scanResults.PluginStatus { + if ps.Status.Status != scalibr_plugin.ScanStatusSucceeded { + if !slices.Contains(known_bad, ps.Name) { + zerolog.Ctx(ctx).Warn().Str("plugin", ps.Name).Str("status", ps.Status.FailureReason). + Msg("Scalibr plugin failed") + } + } + } + return scanResults.Inventory.Packages, nil + case scalibr_plugin.ScanStatusUnspecified, scalibr_plugin.ScanStatusFailed: + fallthrough + default: return nil, fmt.Errorf("error scanning files: %s", scanResults.Status) } - - return scanResults.Inventory.Packages, nil } func inventoryToEcosystem(inventory *extractor.Package) pbinternal.DepEcosystem { @@ -297,6 +341,9 @@ func inventoryToEcosystem(inventory *extractor.Package) pbinternal.DepEcosystem } package_url := inventory.PURL() + if package_url == nil { + package_url = &purl.PackageURL{} + } // Sometimes Scalibr uses the string "PyPI" instead of "pypi" when reporting the ecosystem. switch package_url.Type {