Releases: docker/scout-action
Releases · docker/scout-action
v1.6.3
Bug Fixes / Improvements
- improve package detection to ignore referenced but not installed packages
Contributors
v1.6.2
Bug Fixes / Improvements
- fix an issue when rendering markdown output using
sbom://prefix
Contributors
v1.6.1
Highlights
- Add support for passing in SBOM files in SDPX or in-toto SDPX format
uses: docker/scout-action@v1 with: command: cves image: sbom://alpine.spdx.json
- Add support for SBOM files in syft-json format
uses: docker/scout-action@v1 with: command: cves image: sbom://alpine.syft.json
Bug Fixes / Improvements
- Fix panic when indexing single image
oci-dirinput - Improve local attestation support with the
containerdimage store
Contributors
v1.5.2
General bug fixes and performance improvements
v1.5.0
Highlights
- Cache SBOM and attestations using the image index digest if exists
- Add file hashes/digest when generating SBOMs
- Upgrade
syftto 0.105.0 - Support local attestations from a containerd image store or OCI export
Bug fixes / Improvements
- fix reading SBOM for
gcr.io/distrolessimages - read distribution in SBOM from attestations
v1.4.1
These notes include changes part of v1.4.0
Highlights
- Update dependencies to address Leaky Vessels series of CVEs (CVE-2024-21626, CVE-2024-24557)
- Add initial VEX document to document false positive CVE-2020-8911 and CVE-2020-8912
- Support cosign SBOM attestations
- Support for VEX in-toto attestations
Bug fixes / Improvements
- Fix platform detection when an image index contains
linux/arm64/v8but the local platform is onlylinux/arm64 - Fix display of the base image in case the base image is not indexed by docker scout but defined in the provenance attestation (for private or non Docker Trusted Content base images)
Affectsquickviewandrecommendationscommands - Fix panic when an SBOM contains no packages
Especially when usingdocker scoutto analyse local file system, for instance usingdocker scout cves fs://. - Bump Syft to 102 to fix golang Purl with subpath
- Add support for subpaths in PURLs
For instance an image containing both packagesgithub.com/gofiber/templateandgithub.com/gofiber/template/django/v3, previously the two packages were visible under the samegithub.com/gofiber/templatename. Now both of them are correctly identified
v1.3.0
- Update
syfttov0.100.0 - Support
in-totoenvelope layer in attestations - Improve display of policy results in case of a boolean policy
v1.2.2
Contributors
cdupuis and felipecruz91
Assets 2
v1.2.0
What's Changed
- Display configurable policy names by @felipecruz91
- Add support for writing SDPX and CycloneDx to file by @cdupuis
- Support ACR in docker scout repo commands by @velll
- Docs cli reference refresh by @dvdksn
Contributors
cdupuis, velll, and 2 other contributors
Assets 2
v1.0.9
Remove EA note Signed-off-by: Yves Brissaud <yves.brissaud@docker.com>