diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 4ddd1e48..9de24971 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -133,7 +133,7 @@ User-facing docs live in [`docs/`](docs/). Most pages are handwritten; some are Run `make generate` after changing any of: - `internal/config/config.go` — regenerates `docs/CONFIG_REFERENCE.md` -- `sdk/catalog.go`, `sdk/support_matrix.go`, `internal/registry/support.go` — regenerates `docs/SUPPORT_MATRIX.md` and `docs/detectors/ecosystems/*.md` +- `sdk/catalog.go`, `sdk/support_matrix.go`, `internal/registry/support.go` — regenerates `docs/SUPPORT_MATRIX.md` and `docs/detectors/*.md` - `internal/output/*` or scan/explain/diff response types — regenerates `docs/schemas/*.md` - `internal/support/component_docs.go` — regenerates `docs/{DETECTORS,MATCHERS,AUDITORS}.md` and `docs/matchers/*.md` diff --git a/docs/DETECTORS.md b/docs/DETECTORS.md index a0d015af..f118c387 100644 --- a/docs/DETECTORS.md +++ b/docs/DETECTORS.md @@ -20,7 +20,7 @@ For example, the `npm` chain is `npm-detector` → `syft-detector`: 1. `npm-detector` parses `package-lock.json` directly and resolves the full transitive graph. 2. `syft-detector` runs only if the native detector cannot produce graph data (for example, no lockfile present), and emits a flat package list. -Per-ecosystem chains are listed in [`detectors/ecosystems/`](detectors/ecosystems/). The full live list lives in the CLI: +Per-detector chains are listed in the [detector reference](detectors/). The full live list lives in the CLI: ```bash bomly plugins list --detectors @@ -82,7 +82,7 @@ resolution. The build-tool-primary detectors invoke commands you would already run locally (`go list`, `mvn dependency:tree`, `gradle dependencies`, `sbt dependencyTree`). Whether they hit the network is a property of those tools and your local cache state, not a Bomly choice. To keep these scans fully offline, pre-warm the local cache (`go mod download`, `mvn dependency:go-offline`, etc.) or commit a lockfile when the ecosystem supports one. -Per-PM pages under [`detectors/ecosystems/`](detectors/ecosystems/) document the exact command each detector runs and whether it touches the network. +Each page under [`detectors/`](detectors/) documents the exact command that detector runs and whether it touches the network. ## `--install-first` {#install-first} @@ -112,7 +112,7 @@ Pass `--install-first` to let supporting detectors run their normal dependency-i Detectors without an `Install` implementation (e.g. NuGet, GitHub Actions, SBOM ingest, Syft) silently skip the step when `--install-first` is set. Bomly does **not** install package managers themselves — only their dependencies. -Each package-manager page under [`detectors/ecosystems/`](detectors/ecosystems/) lists whether `--install-first` is supported and the exact command that runs. +Each page under [`detectors/`](detectors/) lists whether `--install-first` is supported and the exact command that runs. ### Customizing the install command with `--install-arg` @@ -182,7 +182,7 @@ bomly scan --image ghcr.io/example/app:latest ## See also -- [Ecosystem guides](detectors/ecosystems/) — generated per-ecosystem detector chains, evidence patterns, and `PATH` requirements +- [Detector reference](detectors/) — one generated page per native detector, plus [Syft fallback](detectors/syft.md) for everything else - [Support matrix](SUPPORT_MATRIX.md) — generated overview of every supported ecosystem - [CI-readiness warnings](CI_READINESS.md) — the package-manager mismatches detectors report alongside the graph - [Plugins](PLUGINS.md) — author and install external detectors diff --git a/docs/INTEGRATIONS.md b/docs/INTEGRATIONS.md index ec687013..3bc311a0 100644 --- a/docs/INTEGRATIONS.md +++ b/docs/INTEGRATIONS.md @@ -47,6 +47,20 @@ External detectors, matchers, and auditors install as managed plugins (versioned Write your own: [Plugins](PLUGINS.md) and the per-role implementation guides. +### Marketplace + +The [Bomly marketplace](https://bomly.dev/marketplace) lists every component that can take part in a scan — detectors, matchers, auditors, and analyzers — filterable by kind and ecosystem. It covers built-in components alongside external plugins, so you can see what already runs before installing anything. + +Each entry is labelled by origin, and the label tells you who wrote the code: + +- **Core** — Bomly's own components, shipped in the binary. +- **Bundled** — third-party engines compiled in, such as Syft and Grype. +- **External plugin** — installed at runtime from its own repository. + +External plugins run as separate processes and stay disabled until you enable them. Read [Security and Trust Boundaries](SECURITY.md) for what a plugin can and cannot reach, and [Plugins](PLUGINS.md) for the install, verify, and enable workflow. + +To get a plugin listed, open a submission from the marketplace page. Entries are reviewed and added by hand — there is no automatic index. + ## Community No community integrations are listed yet — if you've built one (a CI orb, an IDE extension, a dashboard that reads Bomly JSON), open a pull request adding it here with a one-line description and a link. diff --git a/docs/README.md b/docs/README.md index ab1a5d98..c538f84e 100644 --- a/docs/README.md +++ b/docs/README.md @@ -7,8 +7,8 @@ Start with [Getting Started](GETTING_STARTED.md) if you're new. Otherwise pick t Install Bomly and run your first scan. - [Getting Started](GETTING_STARTED.md) — first scan, enrich, audit, diff -- [Tutorial](TUTORIAL.md) — from first scan to a CI gate on a real project, with representative output from the workflow - [Installation](INSTALLATION.md) — install methods, `bomly` vs `bomly-lite`, checksum verification, uninstall +- [Tutorial](TUTORIAL.md) — from first scan to a CI gate on a real project, with representative output from the workflow - [Use Cases](USE_CASES.md) — recipes for PR gates, SBOMs, triage, license and offline scans - [Scan Targets](SCAN_TARGETS.md) — directories, Git repos, containers, SBOMs - [Output Formats](OUTPUT_FORMATS.md) — text, JSON, SARIF, SBOM @@ -19,43 +19,43 @@ Install Bomly and run your first scan. What Bomly does, and why each piece exists. -- [Architecture](ARCHITECTURE.md) — the scan pipeline, domain model, and network behavior -- [Network and Privacy](NETWORK.md) — every network trigger, what it transmits, and how to stay offline -- [Security and Trust Boundaries](SECURITY.md) — permissions, network behavior, plugins, input limits, and residual risks +- [Commands](COMMANDS.md) — per-command reference for [scan](commands/scan.md), [explain](commands/explain.md), and [diff](commands/diff.md) - [Detectors](DETECTORS.md) — turning project evidence into a dependency graph - [Matchers](MATCHERS.md) — enriching the graph with vulnerability, license, lifecycle data - [Auditors](AUDITORS.md) — evaluating the graph against policy -- [MCP Server](MCP.md) — connect Bomly to Claude Code, Cursor, VS Code, or another MCP client - [Plugins](PLUGINS.md) — install, trust, configure, and package external plugins - Plugin implementation guides: [detector](plugins/how-to-implement-detector.md), [matcher](plugins/how-to-implement-matcher.md), [auditor](plugins/how-to-implement-auditor.md) - Example plugin repos: [Bun detector](https://github.com/bomly-dev/bomly-plugin-bun-lock-detector), [ClearlyDefined matcher](https://github.com/bomly-dev/bomly-plugin-clearlydefined-matcher), [EOL lifecycle matcher](https://github.com/bomly-dev/bomly-plugin-eol-matcher), [Meme auditor](https://github.com/bomly-dev/bomly-plugin-meme-auditor) +- [MCP Server](MCP.md) — connect Bomly to Claude Code, Cursor, VS Code, or another MCP client +- [Bomly Guard](BOMLY_GUARD.md) — the turnkey GitHub Action for PR dependency review + +## Operations + +Running Bomly in CI and keeping pipelines healthy. + +- [Integrations](INTEGRATIONS.md) — CI actions, AI agents, code scanning, install channels, plugins, and the marketplace +- [CI Integration](CI_INTEGRATION.md) — GitHub Actions, GitLab, Jenkins, Azure, CircleCI +- [CI-Readiness Warnings](CI_READINESS.md) — package-manager, lockfile-format, and install-policy mismatches that fail CI on their own +- [Finding Baselines](BASELINES.md) — keep accepted package findings visible without failing audits +- [Troubleshooting](TROUBLESHOOTING.md) — common errors and fixes ## Reference -Specifications and matrices. The generated pages are regenerated from code by `make generate` — treat those as authoritative. +Specifications, matrices, and design deep dives. The generated pages are regenerated from code by `make generate` — treat those as authoritative. -- [Commands](COMMANDS.md) — per-command reference for [scan](commands/scan.md), [explain](commands/explain.md), and [diff](commands/diff.md) - [Support Matrix](SUPPORT_MATRIX.md) — every ecosystem and package manager - [Config Reference](CONFIG_REFERENCE.md) — every config key, env var, default, flag - [Exit Codes](EXIT_CODES.md) — what each process exit value means - [Interactive TUI](TUI.md) — keybindings and tabs for `--interactive` - [JSON Schemas](SCHEMAS.md) — scan, explain, diff output shapes -- [Glossary](GLOSSARY.md) — every term, one sentence each -- [Detector Ecosystem Guides](detectors/ecosystems/) — per-ecosystem detector chains +- [Detector Reference](detectors/) — per-ecosystem detector pages, plus [Syft fallback](detectors/syft.md) for everything else - [Matcher Reference](matchers/) — per-matcher behavior, cache, output - [Auditor Reference](auditors/) — per-auditor options, examples, limitations +- [Architecture](ARCHITECTURE.md) — the scan pipeline, domain model, and network behavior +- [Network and Privacy](NETWORK.md) — every network trigger, what it transmits, and how to stay offline +- [Security and Trust Boundaries](SECURITY.md) — permissions, network behavior, plugins, input limits, and residual risks - [Reproducible Evidence](EVIDENCE.md) — public inputs, commands, results, and limitations behind important behavior claims - -## Operations - -Running Bomly in CI and keeping pipelines healthy. - -- [Integrations](INTEGRATIONS.md) — CI actions, AI agents, code scanning, install channels, and plugins -- [CI Integration](CI_INTEGRATION.md) — GitHub Actions, GitLab, Jenkins, Azure, CircleCI -- [CI-Readiness Warnings](CI_READINESS.md) — package-manager, lockfile-format, and install-policy mismatches that fail CI on their own -- [Bomly Guard](BOMLY_GUARD.md) — the turnkey GitHub Action for PR dependency review -- [Finding Baselines](BASELINES.md) — keep accepted package findings visible without failing audits -- [Troubleshooting](TROUBLESHOOTING.md) — common errors and fixes +- [Glossary](GLOSSARY.md) — every term, one sentence each ## Experimental diff --git a/docs/SBOM.md b/docs/SBOM.md index 2829242b..cc88ec84 100644 --- a/docs/SBOM.md +++ b/docs/SBOM.md @@ -141,4 +141,4 @@ Bomly does not advertise a one-shot `convert` command — the scan pipeline is t - [Scan targets](SCAN_TARGETS.md) — every input Bomly accepts - [Output formats](OUTPUT_FORMATS.md) — text, JSON, SARIF, SBOM details -- [SBOM detector](detectors/ecosystems/sbom/sbom.md) — ingest specifics +- [SBOM detector](detectors/sbom/sbom.md) — ingest specifics diff --git a/docs/detectors/README.md b/docs/detectors/README.md new file mode 100644 index 00000000..d36cc5fc --- /dev/null +++ b/docs/detectors/README.md @@ -0,0 +1,46 @@ +# Detector Reference + + + +One page per package manager Bomly resolves natively, grouped by ecosystem, plus a single page for everything covered through the bundled Syft cataloger. + +## Native detectors + +These read a lockfile, manifest, or build tool directly and produce a full dependency graph with edges. + +| Ecosystem | Package manager | Detector chain | Install-first support | +| --- | --- | --- | --- | +| `cpp` | [`conan`](cpp/conan.md) | `conan-detector`, `syft-detector` | No | +| `dart` | [`pub`](dart/pub.md) | `pub-native-detector`, `pub-detector`, `syft-detector` | No | +| `dotnet` | [`nuget`](dotnet/nuget.md) | `nuget-detector`, `syft-detector` | No | +| `elixir` | [`mix`](elixir/mix.md) | `mix-detector`, `syft-detector` | No | +| `github-actions` | [`github-actions`](github-actions/github-actions.md) | `github-actions-detector`, `syft-detector` | No | +| `go` | [`gomod`](go/gomod.md) | `go-detector`, `syft-detector` | Yes | +| `maven` | [`gradle`](maven/gradle.md) | `gradle-detector`, `syft-detector` | Yes | +| | [`maven`](maven/maven.md) | `maven-detector`, `syft-detector` | Yes | +| `npm` | [`bun`](npm/bun.md) | `bun-detector`, `bun-native-detector`, `syft-detector` | Yes | +| | [`npm`](npm/npm.md) | `npm-detector`, `npm-native-detector`, `syft-detector` | Yes | +| | [`pnpm`](npm/pnpm.md) | `pnpm-detector`, `pnpm-native-detector`, `syft-detector` | Yes | +| | [`yarn`](npm/yarn.md) | `yarn-detector`, `yarn-native-detector`, `syft-detector` | Yes | +| `php` | [`composer`](php/composer.md) | `composer-detector`, `syft-detector` | Yes | +| `python` | [`pip`](python/pip.md) | `pip-detector`, `syft-detector` | Yes | +| | [`pipenv`](python/pipenv.md) | `pipenv-detector`, `syft-detector` | Yes | +| | [`poetry`](python/poetry.md) | `poetry-detector`, `syft-detector` | Yes | +| | [`uv`](python/uv.md) | `uv-detector`, `syft-detector` | Yes | +| `ruby` | [`bundler`](ruby/bundler.md) | `bundler-detector`, `syft-detector` | Yes | +| `rust` | [`cargo`](rust/cargo.md) | `cargo-detector`, `syft-detector` | Yes | +| `sbom` | [`sbom`](sbom/sbom.md) | `sbom-detector` | No | +| `scala` | [`sbt`](scala/sbt.md) | `sbt-native-detector`, `sbt-detector` | No | +| `swift` | [`cocoapods`](swift/cocoapods.md) | `cocoapods-detector`, `syft-detector` | No | +| | [`swiftpm`](swift/swiftpm.md) | `swiftpm-native-detector`, `swiftpm-detector`, `syft-detector` | No | + +## Syft-backed coverage + +[Syft fallback](syft.md) covers 23 more package managers, mostly OS package databases and ecosystems without a native detector. Those produce a flat package list rather than a graph. + +## How to read this + +- Bomly tries detector chains left to right. Later entries are fallbacks used when the preferred detector cannot produce graph data. +- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. That downloads packages and modifies the filesystem; see [Detectors](../DETECTORS.md#install-first). +- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors never choose the final action or change project files. +- Every ecosystem and package manager, native or not, is listed in the [Support matrix](../SUPPORT_MATRIX.md). diff --git a/docs/detectors/ecosystems/cpp/conan.md b/docs/detectors/cpp/conan.md similarity index 96% rename from docs/detectors/ecosystems/cpp/conan.md rename to docs/detectors/cpp/conan.md index 7f80afbd..9064efac 100644 --- a/docs/detectors/ecosystems/cpp/conan.md +++ b/docs/detectors/cpp/conan.md @@ -1,4 +1,4 @@ -# `conan` (cpp ecosystem) +# conan diff --git a/docs/detectors/ecosystems/dart/pub.md b/docs/detectors/dart/pub.md similarity index 96% rename from docs/detectors/ecosystems/dart/pub.md rename to docs/detectors/dart/pub.md index f15b1c38..29fd9d78 100644 --- a/docs/detectors/ecosystems/dart/pub.md +++ b/docs/detectors/dart/pub.md @@ -1,4 +1,4 @@ -# `pub` (dart ecosystem) +# pub diff --git a/docs/detectors/ecosystems/dotnet/nuget.md b/docs/detectors/dotnet/nuget.md similarity index 99% rename from docs/detectors/ecosystems/dotnet/nuget.md rename to docs/detectors/dotnet/nuget.md index 11308fac..71bbb412 100644 --- a/docs/detectors/ecosystems/dotnet/nuget.md +++ b/docs/detectors/dotnet/nuget.md @@ -1,4 +1,4 @@ -# `nuget` (dotnet ecosystem) +# nuget diff --git a/docs/detectors/ecosystems/README.md b/docs/detectors/ecosystems/README.md deleted file mode 100644 index 66d1c568..00000000 --- a/docs/detectors/ecosystems/README.md +++ /dev/null @@ -1,42 +0,0 @@ -# Detector Ecosystem Guides - - - -Bomly groups detectors by **ecosystem** (the package universe — `go`, `npm`, `python`, `maven`, …) and writes one page per **package manager** within that ecosystem (`pip`, `poetry`, `uv` are all under `python`). - -Pick your ecosystem to see the package managers it covers and how each one is detected. - -| Ecosystem | Package managers | -| --- | --- | -| [alpm](alpm/) | [`alpm`](alpm/alpm.md) | -| [apk](apk/) | [`apk`](apk/apk.md) | -| [conda](conda/) | [`conda`](conda/conda.md) | -| [cpp](cpp/) | [`conan`](cpp/conan.md) | -| [dart](dart/) | [`pub`](dart/pub.md) | -| [dotnet](dotnet/) | [`nuget`](dotnet/nuget.md) | -| [dpkg](dpkg/) | [`dpkg`](dpkg/dpkg.md) | -| [elixir](elixir/) | [`mix`](elixir/mix.md) | -| [erlang](erlang/) | [`otp`](erlang/otp.md), [`rebar`](erlang/rebar.md) | -| [github-actions](github-actions/) | [`github-actions`](github-actions/github-actions.md) | -| [go](go/) | [`gomod`](go/gomod.md) | -| [haskell](haskell/) | [`cabal`](haskell/cabal.md), [`stack`](haskell/stack.md) | -| [homebrew](homebrew/) | [`homebrew`](homebrew/homebrew.md) | -| [lua](lua/) | [`luarocks`](lua/luarocks.md) | -| [maven](maven/) | [`gradle`](maven/gradle.md), [`maven`](maven/maven.md) | -| [nix](nix/) | [`nix`](nix/nix.md) | -| [npm](npm/) | [`bun`](npm/bun.md), [`npm`](npm/npm.md), [`pnpm`](npm/pnpm.md), [`yarn`](npm/yarn.md) | -| [ocaml](ocaml/) | [`opam`](ocaml/opam.md) | -| [php](php/) | [`composer`](php/composer.md), [`pear`](php/pear.md) | -| [portage](portage/) | [`portage`](portage/portage.md) | -| [prolog](prolog/) | [`swipl-pack`](prolog/swipl-pack.md) | -| [python](python/) | [`pdm`](python/pdm.md), [`pip`](python/pip.md), [`pipenv`](python/pipenv.md), [`poetry`](python/poetry.md), [`setuppy`](python/setuppy.md), [`uv`](python/uv.md) | -| [r](r/) | [`r-package`](r/r-package.md) | -| [rpm](rpm/) | [`rpm`](rpm/rpm.md) | -| [ruby](ruby/) | [`bundler`](ruby/bundler.md), [`gemspec`](ruby/gemspec.md) | -| [rust](rust/) | [`cargo`](rust/cargo.md) | -| [sbom](sbom/) | [`sbom`](sbom/sbom.md) | -| [scala](scala/) | [`sbt`](scala/sbt.md) | -| [snap](snap/) | [`snap`](snap/snap.md) | -| [swift](swift/) | [`cocoapods`](swift/cocoapods.md), [`swiftpm`](swift/swiftpm.md) | -| [terraform](terraform/) | [`terraform`](terraform/terraform.md) | -| [wordpress](wordpress/) | [`wordpress`](wordpress/wordpress.md) | diff --git a/docs/detectors/ecosystems/alpm/README.md b/docs/detectors/ecosystems/alpm/README.md deleted file mode 100644 index b8bcafb4..00000000 --- a/docs/detectors/ecosystems/alpm/README.md +++ /dev/null @@ -1,18 +0,0 @@ -# Alpm - - - -Package managers Bomly recognizes in the `alpm` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`alpm`](alpm.md) | `syft-detector` | `var/lib/pacman/local/*/desc` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/alpm/alpm.md b/docs/detectors/ecosystems/alpm/alpm.md deleted file mode 100644 index b46bfe3e..00000000 --- a/docs/detectors/ecosystems/alpm/alpm.md +++ /dev/null @@ -1,18 +0,0 @@ -# `alpm` (alpm ecosystem) - - - -Bomly uses this chain when it finds `alpm` evidence. - -| Property | Value | -| --- | --- | -| Package manager | `alpm` | -| Ecosystem | `alpm` | -| Detector chain | `syft-detector` | -| Evidence patterns | `var/lib/pacman/local/*/desc` | -| Ignored directories | - | -| Ignored directory markers | - | -| Multi-module resolution | No | -| Install-first support | No | -| Remediation hints | None | -| Native command hints | `syft for bomly-lite` | diff --git a/docs/detectors/ecosystems/apk/README.md b/docs/detectors/ecosystems/apk/README.md deleted file mode 100644 index 00a2c191..00000000 --- a/docs/detectors/ecosystems/apk/README.md +++ /dev/null @@ -1,18 +0,0 @@ -# Apk - - - -Package managers Bomly recognizes in the `apk` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`apk`](apk.md) | `syft-detector` | `lib/apk/db/installed` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/apk/apk.md b/docs/detectors/ecosystems/apk/apk.md deleted file mode 100644 index 1422a6d2..00000000 --- a/docs/detectors/ecosystems/apk/apk.md +++ /dev/null @@ -1,18 +0,0 @@ -# `apk` (apk ecosystem) - - - -Bomly uses this chain when it finds `apk` evidence. - -| Property | Value | -| --- | --- | -| Package manager | `apk` | -| Ecosystem | `apk` | -| Detector chain | `syft-detector` | -| Evidence patterns | `lib/apk/db/installed` | -| Ignored directories | - | -| Ignored directory markers | - | -| Multi-module resolution | No | -| Install-first support | No | -| Remediation hints | None | -| Native command hints | `syft for bomly-lite` | diff --git a/docs/detectors/ecosystems/conda/README.md b/docs/detectors/ecosystems/conda/README.md deleted file mode 100644 index b84fa4d2..00000000 --- a/docs/detectors/ecosystems/conda/README.md +++ /dev/null @@ -1,18 +0,0 @@ -# Conda - - - -Package managers Bomly recognizes in the `conda` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`conda`](conda.md) | `syft-detector` | `conda-meta/*.json` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/conda/conda.md b/docs/detectors/ecosystems/conda/conda.md deleted file mode 100644 index 58dade1f..00000000 --- a/docs/detectors/ecosystems/conda/conda.md +++ /dev/null @@ -1,18 +0,0 @@ -# `conda` (conda ecosystem) - - - -Bomly uses this chain when it finds `conda` evidence. - -| Property | Value | -| --- | --- | -| Package manager | `conda` | -| Ecosystem | `conda` | -| Detector chain | `syft-detector` | -| Evidence patterns | `conda-meta/*.json` | -| Ignored directories | - | -| Ignored directory markers | - | -| Multi-module resolution | No | -| Install-first support | No | -| Remediation hints | None | -| Native command hints | `syft for bomly-lite` | diff --git a/docs/detectors/ecosystems/cpp/README.md b/docs/detectors/ecosystems/cpp/README.md deleted file mode 100644 index 3d664b42..00000000 --- a/docs/detectors/ecosystems/cpp/README.md +++ /dev/null @@ -1,18 +0,0 @@ -# Cpp - - - -Package managers Bomly recognizes in the `cpp` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`conan`](conan.md) | `conan-detector`, `syft-detector` | `conan.lock`, `conanfile.txt`, `conanfile.py`, `conaninfo.txt` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/dart/README.md b/docs/detectors/ecosystems/dart/README.md deleted file mode 100644 index f4ffe29e..00000000 --- a/docs/detectors/ecosystems/dart/README.md +++ /dev/null @@ -1,18 +0,0 @@ -# Dart - - - -Package managers Bomly recognizes in the `dart` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`pub`](pub.md) | `pub-native-detector`, `pub-detector`, `syft-detector` | `pubspec.lock`, `pubspec.yaml`, `pubspec.yml` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/dotnet/README.md b/docs/detectors/ecosystems/dotnet/README.md deleted file mode 100644 index 8c47c4f3..00000000 --- a/docs/detectors/ecosystems/dotnet/README.md +++ /dev/null @@ -1,18 +0,0 @@ -# Dotnet - - - -Package managers Bomly recognizes in the `dotnet` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`nuget`](nuget.md) | `nuget-detector`, `syft-detector` | `packages.lock.json`, `*.deps.json`, `packages.config`, `*.csproj`, `*.fsproj`, `*.vbproj`, `*.vcxproj`, `project.assets.json` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/dpkg/README.md b/docs/detectors/ecosystems/dpkg/README.md deleted file mode 100644 index 1709f9b0..00000000 --- a/docs/detectors/ecosystems/dpkg/README.md +++ /dev/null @@ -1,18 +0,0 @@ -# Dpkg - - - -Package managers Bomly recognizes in the `dpkg` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`dpkg`](dpkg.md) | `syft-detector` | `lib/dpkg/status`, `lib/dpkg/status.d/*`, `lib/opkg/info/*.control`, `lib/opkg/status` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/dpkg/dpkg.md b/docs/detectors/ecosystems/dpkg/dpkg.md deleted file mode 100644 index b0034246..00000000 --- a/docs/detectors/ecosystems/dpkg/dpkg.md +++ /dev/null @@ -1,18 +0,0 @@ -# `dpkg` (dpkg ecosystem) - - - -Bomly uses this chain when it finds `dpkg` evidence. - -| Property | Value | -| --- | --- | -| Package manager | `dpkg` | -| Ecosystem | `dpkg` | -| Detector chain | `syft-detector` | -| Evidence patterns | `lib/dpkg/status`, `lib/dpkg/status.d/*`, `lib/opkg/info/*.control`, `lib/opkg/status` | -| Ignored directories | - | -| Ignored directory markers | - | -| Multi-module resolution | No | -| Install-first support | No | -| Remediation hints | None | -| Native command hints | `syft for bomly-lite` | diff --git a/docs/detectors/ecosystems/elixir/README.md b/docs/detectors/ecosystems/elixir/README.md deleted file mode 100644 index a0ee1495..00000000 --- a/docs/detectors/ecosystems/elixir/README.md +++ /dev/null @@ -1,18 +0,0 @@ -# Elixir - - - -Package managers Bomly recognizes in the `elixir` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`mix`](mix.md) | `mix-detector`, `syft-detector` | `mix.lock`, `mix.exs` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/erlang/README.md b/docs/detectors/ecosystems/erlang/README.md deleted file mode 100644 index 9edb11c7..00000000 --- a/docs/detectors/ecosystems/erlang/README.md +++ /dev/null @@ -1,19 +0,0 @@ -# Erlang - - - -Package managers Bomly recognizes in the `erlang` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`otp`](otp.md) | `syft-detector` | `*.app` | None | No | -| [`rebar`](rebar.md) | `syft-detector` | `rebar.lock` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/erlang/otp.md b/docs/detectors/ecosystems/erlang/otp.md deleted file mode 100644 index aaa7ac88..00000000 --- a/docs/detectors/ecosystems/erlang/otp.md +++ /dev/null @@ -1,18 +0,0 @@ -# `otp` (erlang ecosystem) - - - -Bomly uses this chain when it finds `otp` evidence. - -| Property | Value | -| --- | --- | -| Package manager | `otp` | -| Ecosystem | `erlang` | -| Detector chain | `syft-detector` | -| Evidence patterns | `*.app` | -| Ignored directories | - | -| Ignored directory markers | - | -| Multi-module resolution | No | -| Install-first support | No | -| Remediation hints | None | -| Native command hints | `syft for bomly-lite` | diff --git a/docs/detectors/ecosystems/erlang/rebar.md b/docs/detectors/ecosystems/erlang/rebar.md deleted file mode 100644 index 087e60ad..00000000 --- a/docs/detectors/ecosystems/erlang/rebar.md +++ /dev/null @@ -1,18 +0,0 @@ -# `rebar` (erlang ecosystem) - - - -Bomly uses this chain when it finds `rebar` evidence. - -| Property | Value | -| --- | --- | -| Package manager | `rebar` | -| Ecosystem | `erlang` | -| Detector chain | `syft-detector` | -| Evidence patterns | `rebar.lock` | -| Ignored directories | - | -| Ignored directory markers | - | -| Multi-module resolution | No | -| Install-first support | No | -| Remediation hints | None | -| Native command hints | `syft for bomly-lite` | diff --git a/docs/detectors/ecosystems/github-actions/README.md b/docs/detectors/ecosystems/github-actions/README.md deleted file mode 100644 index 0ba0dc2b..00000000 --- a/docs/detectors/ecosystems/github-actions/README.md +++ /dev/null @@ -1,18 +0,0 @@ -# Github Actions - - - -Package managers Bomly recognizes in the `github-actions` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`github-actions`](github-actions.md) | `github-actions-detector`, `syft-detector` | `.github/workflows/*.yaml`, `.github/workflows/*.yml`, `.github/actions/*/action.yml`, `.github/actions/*/action.yaml` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/go/README.md b/docs/detectors/ecosystems/go/README.md deleted file mode 100644 index c6da2419..00000000 --- a/docs/detectors/ecosystems/go/README.md +++ /dev/null @@ -1,20 +0,0 @@ -# Go - - - -Package managers Bomly recognizes in the `go` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`gomod`](gomod.md) | `go-detector`, `syft-detector` | `go.mod` | `direct-bump`, `lockfile-refresh` | Yes | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. - - `direct-bump` means the detector knows how to update a package declared directly in the project. - - `lockfile-refresh` means the detector knows how to ask the package manager to resolve a newer indirect package version. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/haskell/README.md b/docs/detectors/ecosystems/haskell/README.md deleted file mode 100644 index 699bbe71..00000000 --- a/docs/detectors/ecosystems/haskell/README.md +++ /dev/null @@ -1,19 +0,0 @@ -# Haskell - - - -Package managers Bomly recognizes in the `haskell` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`cabal`](cabal.md) | `syft-detector` | `cabal.project.freeze` | None | No | -| [`stack`](stack.md) | `syft-detector` | `stack.yaml`, `stack.yaml.lock` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/haskell/cabal.md b/docs/detectors/ecosystems/haskell/cabal.md deleted file mode 100644 index ce7b4c1a..00000000 --- a/docs/detectors/ecosystems/haskell/cabal.md +++ /dev/null @@ -1,18 +0,0 @@ -# `cabal` (haskell ecosystem) - - - -Bomly uses this chain when it finds `cabal` evidence. - -| Property | Value | -| --- | --- | -| Package manager | `cabal` | -| Ecosystem | `haskell` | -| Detector chain | `syft-detector` | -| Evidence patterns | `cabal.project.freeze` | -| Ignored directories | - | -| Ignored directory markers | - | -| Multi-module resolution | No | -| Install-first support | No | -| Remediation hints | None | -| Native command hints | `syft for bomly-lite` | diff --git a/docs/detectors/ecosystems/haskell/stack.md b/docs/detectors/ecosystems/haskell/stack.md deleted file mode 100644 index 7cb65e2e..00000000 --- a/docs/detectors/ecosystems/haskell/stack.md +++ /dev/null @@ -1,18 +0,0 @@ -# `stack` (haskell ecosystem) - - - -Bomly uses this chain when it finds `stack` evidence. - -| Property | Value | -| --- | --- | -| Package manager | `stack` | -| Ecosystem | `haskell` | -| Detector chain | `syft-detector` | -| Evidence patterns | `stack.yaml`, `stack.yaml.lock` | -| Ignored directories | - | -| Ignored directory markers | - | -| Multi-module resolution | No | -| Install-first support | No | -| Remediation hints | None | -| Native command hints | `syft for bomly-lite` | diff --git a/docs/detectors/ecosystems/homebrew/README.md b/docs/detectors/ecosystems/homebrew/README.md deleted file mode 100644 index 0e6d24c7..00000000 --- a/docs/detectors/ecosystems/homebrew/README.md +++ /dev/null @@ -1,18 +0,0 @@ -# Homebrew - - - -Package managers Bomly recognizes in the `homebrew` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`homebrew`](homebrew.md) | `syft-detector` | `Cellar/*/*/.brew/*.rb`, `Library/Taps/*/*/Formula/*.rb` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/homebrew/homebrew.md b/docs/detectors/ecosystems/homebrew/homebrew.md deleted file mode 100644 index e1bf2b7e..00000000 --- a/docs/detectors/ecosystems/homebrew/homebrew.md +++ /dev/null @@ -1,18 +0,0 @@ -# `homebrew` (homebrew ecosystem) - - - -Bomly uses this chain when it finds `homebrew` evidence. - -| Property | Value | -| --- | --- | -| Package manager | `homebrew` | -| Ecosystem | `homebrew` | -| Detector chain | `syft-detector` | -| Evidence patterns | `Cellar/*/*/.brew/*.rb`, `Library/Taps/*/*/Formula/*.rb` | -| Ignored directories | - | -| Ignored directory markers | - | -| Multi-module resolution | No | -| Install-first support | No | -| Remediation hints | None | -| Native command hints | `syft for bomly-lite` | diff --git a/docs/detectors/ecosystems/lua/README.md b/docs/detectors/ecosystems/lua/README.md deleted file mode 100644 index 4bd1eff2..00000000 --- a/docs/detectors/ecosystems/lua/README.md +++ /dev/null @@ -1,18 +0,0 @@ -# Lua - - - -Package managers Bomly recognizes in the `lua` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`luarocks`](luarocks.md) | `syft-detector` | `*.rockspec` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/lua/luarocks.md b/docs/detectors/ecosystems/lua/luarocks.md deleted file mode 100644 index 8ed557ff..00000000 --- a/docs/detectors/ecosystems/lua/luarocks.md +++ /dev/null @@ -1,18 +0,0 @@ -# `luarocks` (lua ecosystem) - - - -Bomly uses this chain when it finds `luarocks` evidence. - -| Property | Value | -| --- | --- | -| Package manager | `luarocks` | -| Ecosystem | `lua` | -| Detector chain | `syft-detector` | -| Evidence patterns | `*.rockspec` | -| Ignored directories | - | -| Ignored directory markers | - | -| Multi-module resolution | No | -| Install-first support | No | -| Remediation hints | None | -| Native command hints | `syft for bomly-lite` | diff --git a/docs/detectors/ecosystems/maven/README.md b/docs/detectors/ecosystems/maven/README.md deleted file mode 100644 index 0dfb6016..00000000 --- a/docs/detectors/ecosystems/maven/README.md +++ /dev/null @@ -1,21 +0,0 @@ -# Maven - - - -Package managers Bomly recognizes in the `maven` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`gradle`](gradle.md) | `gradle-detector`, `syft-detector` | `build.gradle`, `build.gradle.kts`, `settings.gradle`, `settings.gradle.kts`, `gradle.lockfile*` | `direct-bump`, `transitive-override` | Yes | -| [`maven`](maven.md) | `maven-detector`, `syft-detector` | `pom.xml`, `*pom.xml` | `direct-bump`, `transitive-override` | Yes | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. - - `direct-bump` means the detector knows how to update a package declared directly in the project. - - `transitive-override` means the detector knows how to pin an indirect package with the package manager's override feature. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/nix/README.md b/docs/detectors/ecosystems/nix/README.md deleted file mode 100644 index 643cc43d..00000000 --- a/docs/detectors/ecosystems/nix/README.md +++ /dev/null @@ -1,18 +0,0 @@ -# Nix - - - -Package managers Bomly recognizes in the `nix` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`nix`](nix.md) | `syft-detector` | `nix/var/nix/db/db.sqlite`, `nix/store/*.drv` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/nix/nix.md b/docs/detectors/ecosystems/nix/nix.md deleted file mode 100644 index 9f55d0fc..00000000 --- a/docs/detectors/ecosystems/nix/nix.md +++ /dev/null @@ -1,18 +0,0 @@ -# `nix` (nix ecosystem) - - - -Bomly uses this chain when it finds `nix` evidence. - -| Property | Value | -| --- | --- | -| Package manager | `nix` | -| Ecosystem | `nix` | -| Detector chain | `syft-detector` | -| Evidence patterns | `nix/var/nix/db/db.sqlite`, `nix/store/*.drv` | -| Ignored directories | - | -| Ignored directory markers | - | -| Multi-module resolution | No | -| Install-first support | No | -| Remediation hints | None | -| Native command hints | `syft for bomly-lite` | diff --git a/docs/detectors/ecosystems/npm/README.md b/docs/detectors/ecosystems/npm/README.md deleted file mode 100644 index 4a407ebc..00000000 --- a/docs/detectors/ecosystems/npm/README.md +++ /dev/null @@ -1,24 +0,0 @@ -# Npm - - - -Package managers Bomly recognizes in the `npm` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`bun`](bun.md) | `bun-detector`, `bun-native-detector`, `syft-detector` | `bun.lock`, `bun.lockb` | `direct-bump`, `lockfile-refresh` | Yes | -| [`npm`](npm.md) | `npm-detector`, `npm-native-detector`, `syft-detector` | `npm-shrinkwrap.json`, `package-lock.json`, `package.json` | `direct-bump`, `transitive-override` | Yes | -| [`pnpm`](pnpm.md) | `pnpm-detector`, `pnpm-native-detector`, `syft-detector` | `pnpm-lock.yaml`, `package.json` | `direct-bump`, `transitive-override` | Yes | -| [`yarn`](yarn.md) | `yarn-detector`, `yarn-native-detector`, `syft-detector` | `yarn.lock`, `package.json` | `direct-bump`, `transitive-override` | Yes | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. - - `direct-bump` means the detector knows how to update a package declared directly in the project. - - `transitive-override` means the detector knows how to pin an indirect package with the package manager's override feature. - - `lockfile-refresh` means the detector knows how to ask the package manager to resolve a newer indirect package version. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/ocaml/README.md b/docs/detectors/ecosystems/ocaml/README.md deleted file mode 100644 index 0037578e..00000000 --- a/docs/detectors/ecosystems/ocaml/README.md +++ /dev/null @@ -1,18 +0,0 @@ -# Ocaml - - - -Package managers Bomly recognizes in the `ocaml` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`opam`](opam.md) | `syft-detector` | `*opam` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/ocaml/opam.md b/docs/detectors/ecosystems/ocaml/opam.md deleted file mode 100644 index 9c9beca1..00000000 --- a/docs/detectors/ecosystems/ocaml/opam.md +++ /dev/null @@ -1,18 +0,0 @@ -# `opam` (ocaml ecosystem) - - - -Bomly uses this chain when it finds `opam` evidence. - -| Property | Value | -| --- | --- | -| Package manager | `opam` | -| Ecosystem | `ocaml` | -| Detector chain | `syft-detector` | -| Evidence patterns | `*opam` | -| Ignored directories | - | -| Ignored directory markers | - | -| Multi-module resolution | No | -| Install-first support | No | -| Remediation hints | None | -| Native command hints | `syft for bomly-lite` | diff --git a/docs/detectors/ecosystems/php/README.md b/docs/detectors/ecosystems/php/README.md deleted file mode 100644 index ee12e08f..00000000 --- a/docs/detectors/ecosystems/php/README.md +++ /dev/null @@ -1,21 +0,0 @@ -# Php - - - -Package managers Bomly recognizes in the `php` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`composer`](composer.md) | `composer-detector`, `syft-detector` | `composer.lock`, `installed.json` | `direct-bump`, `transitive-override` | Yes | -| [`pear`](pear.md) | `syft-detector` | `php/.registry/**/*.reg` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. - - `direct-bump` means the detector knows how to update a package declared directly in the project. - - `transitive-override` means the detector knows how to pin an indirect package with the package manager's override feature. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/php/pear.md b/docs/detectors/ecosystems/php/pear.md deleted file mode 100644 index 605a75c8..00000000 --- a/docs/detectors/ecosystems/php/pear.md +++ /dev/null @@ -1,18 +0,0 @@ -# `pear` (php ecosystem) - - - -Bomly uses this chain when it finds `pear` evidence. - -| Property | Value | -| --- | --- | -| Package manager | `pear` | -| Ecosystem | `php` | -| Detector chain | `syft-detector` | -| Evidence patterns | `php/.registry/**/*.reg` | -| Ignored directories | - | -| Ignored directory markers | - | -| Multi-module resolution | No | -| Install-first support | No | -| Remediation hints | None | -| Native command hints | `syft for bomly-lite` | diff --git a/docs/detectors/ecosystems/portage/README.md b/docs/detectors/ecosystems/portage/README.md deleted file mode 100644 index 27eab12a..00000000 --- a/docs/detectors/ecosystems/portage/README.md +++ /dev/null @@ -1,18 +0,0 @@ -# Portage - - - -Package managers Bomly recognizes in the `portage` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`portage`](portage.md) | `syft-detector` | `var/db/pkg/*/*/CONTENTS` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/portage/portage.md b/docs/detectors/ecosystems/portage/portage.md deleted file mode 100644 index 8a90f9eb..00000000 --- a/docs/detectors/ecosystems/portage/portage.md +++ /dev/null @@ -1,18 +0,0 @@ -# `portage` (portage ecosystem) - - - -Bomly uses this chain when it finds `portage` evidence. - -| Property | Value | -| --- | --- | -| Package manager | `portage` | -| Ecosystem | `portage` | -| Detector chain | `syft-detector` | -| Evidence patterns | `var/db/pkg/*/*/CONTENTS` | -| Ignored directories | - | -| Ignored directory markers | - | -| Multi-module resolution | No | -| Install-first support | No | -| Remediation hints | None | -| Native command hints | `syft for bomly-lite` | diff --git a/docs/detectors/ecosystems/prolog/README.md b/docs/detectors/ecosystems/prolog/README.md deleted file mode 100644 index c15f0c0c..00000000 --- a/docs/detectors/ecosystems/prolog/README.md +++ /dev/null @@ -1,18 +0,0 @@ -# Prolog - - - -Package managers Bomly recognizes in the `prolog` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`swipl-pack`](swipl-pack.md) | `syft-detector` | `pack.pl` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/prolog/swipl-pack.md b/docs/detectors/ecosystems/prolog/swipl-pack.md deleted file mode 100644 index 5e17bef6..00000000 --- a/docs/detectors/ecosystems/prolog/swipl-pack.md +++ /dev/null @@ -1,18 +0,0 @@ -# `swipl-pack` (prolog ecosystem) - - - -Bomly uses this chain when it finds `swipl-pack` evidence. - -| Property | Value | -| --- | --- | -| Package manager | `swipl-pack` | -| Ecosystem | `prolog` | -| Detector chain | `syft-detector` | -| Evidence patterns | `pack.pl` | -| Ignored directories | - | -| Ignored directory markers | - | -| Multi-module resolution | No | -| Install-first support | No | -| Remediation hints | None | -| Native command hints | `syft for bomly-lite` | diff --git a/docs/detectors/ecosystems/python/README.md b/docs/detectors/ecosystems/python/README.md deleted file mode 100644 index 5340f548..00000000 --- a/docs/detectors/ecosystems/python/README.md +++ /dev/null @@ -1,25 +0,0 @@ -# Python - - - -Package managers Bomly recognizes in the `python` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`pdm`](pdm.md) | `syft-detector` | `pdm.lock`, `pyproject.toml` | None | No | -| [`pip`](pip.md) | `pip-detector`, `syft-detector` | `requirements.txt`, `requirements-dev.txt`, `requirements.in`, `requirements.lock`, `*requirements*.txt` | `direct-bump`, `transitive-override` | Yes | -| [`pipenv`](pipenv.md) | `pipenv-detector`, `syft-detector` | `Pipfile`, `Pipfile.lock` | `direct-bump`, `transitive-override` | Yes | -| [`poetry`](poetry.md) | `poetry-detector`, `syft-detector` | `poetry.lock`, `pyproject.toml` | `direct-bump`, `transitive-override` | Yes | -| [`setuppy`](setuppy.md) | `syft-detector` | `setup.py` | None | No | -| [`uv`](uv.md) | `uv-detector`, `syft-detector` | `uv.lock`, `pyproject.toml` | `direct-bump`, `transitive-override` | Yes | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. - - `direct-bump` means the detector knows how to update a package declared directly in the project. - - `transitive-override` means the detector knows how to pin an indirect package with the package manager's override feature. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/python/pdm.md b/docs/detectors/ecosystems/python/pdm.md deleted file mode 100644 index 63281cd3..00000000 --- a/docs/detectors/ecosystems/python/pdm.md +++ /dev/null @@ -1,18 +0,0 @@ -# `pdm` (python ecosystem) - - - -Bomly uses this chain when it finds `pdm` evidence. - -| Property | Value | -| --- | --- | -| Package manager | `pdm` | -| Ecosystem | `python` | -| Detector chain | `syft-detector` | -| Evidence patterns | `pdm.lock`, `pyproject.toml` | -| Ignored directories | - | -| Ignored directory markers | - | -| Multi-module resolution | No | -| Install-first support | No | -| Remediation hints | None | -| Native command hints | `syft for bomly-lite` | diff --git a/docs/detectors/ecosystems/python/setuppy.md b/docs/detectors/ecosystems/python/setuppy.md deleted file mode 100644 index 9eed2ebf..00000000 --- a/docs/detectors/ecosystems/python/setuppy.md +++ /dev/null @@ -1,18 +0,0 @@ -# `setuppy` (python ecosystem) - - - -Bomly uses this chain when it finds `setuppy` evidence. - -| Property | Value | -| --- | --- | -| Package manager | `setuppy` | -| Ecosystem | `python` | -| Detector chain | `syft-detector` | -| Evidence patterns | `setup.py` | -| Ignored directories | - | -| Ignored directory markers | - | -| Multi-module resolution | No | -| Install-first support | No | -| Remediation hints | None | -| Native command hints | `syft for bomly-lite` | diff --git a/docs/detectors/ecosystems/r/README.md b/docs/detectors/ecosystems/r/README.md deleted file mode 100644 index 652eed19..00000000 --- a/docs/detectors/ecosystems/r/README.md +++ /dev/null @@ -1,18 +0,0 @@ -# R - - - -Package managers Bomly recognizes in the `r` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`r-package`](r-package.md) | `syft-detector` | `DESCRIPTION` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/r/r-package.md b/docs/detectors/ecosystems/r/r-package.md deleted file mode 100644 index c29ca624..00000000 --- a/docs/detectors/ecosystems/r/r-package.md +++ /dev/null @@ -1,18 +0,0 @@ -# `r-package` (r ecosystem) - - - -Bomly uses this chain when it finds `r-package` evidence. - -| Property | Value | -| --- | --- | -| Package manager | `r-package` | -| Ecosystem | `r` | -| Detector chain | `syft-detector` | -| Evidence patterns | `DESCRIPTION` | -| Ignored directories | - | -| Ignored directory markers | - | -| Multi-module resolution | No | -| Install-first support | No | -| Remediation hints | None | -| Native command hints | `syft for bomly-lite` | diff --git a/docs/detectors/ecosystems/rpm/README.md b/docs/detectors/ecosystems/rpm/README.md deleted file mode 100644 index d55b71ae..00000000 --- a/docs/detectors/ecosystems/rpm/README.md +++ /dev/null @@ -1,18 +0,0 @@ -# Rpm - - - -Package managers Bomly recognizes in the `rpm` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`rpm`](rpm.md) | `syft-detector` | `var/lib/rpmmanifest/container-manifest-2`, `var/lib/rpm/Packages`, `var/lib/rpm/Packages.db`, `var/lib/rpm/rpmdb.sqlite`, `usr/share/rpm/Packages`, `usr/share/rpm/Packages.db`, `usr/share/rpm/rpmdb.sqlite`, `usr/lib/sysimage/rpm/Packages`, `usr/lib/sysimage/rpm/Packages.db`, `usr/lib/sysimage/rpm/rpmdb.sqlite` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/rpm/rpm.md b/docs/detectors/ecosystems/rpm/rpm.md deleted file mode 100644 index b4389c43..00000000 --- a/docs/detectors/ecosystems/rpm/rpm.md +++ /dev/null @@ -1,18 +0,0 @@ -# `rpm` (rpm ecosystem) - - - -Bomly uses this chain when it finds `rpm` evidence. - -| Property | Value | -| --- | --- | -| Package manager | `rpm` | -| Ecosystem | `rpm` | -| Detector chain | `syft-detector` | -| Evidence patterns | `var/lib/rpmmanifest/container-manifest-2`, `var/lib/rpm/Packages`, `var/lib/rpm/Packages.db`, `var/lib/rpm/rpmdb.sqlite`, `usr/share/rpm/Packages`, `usr/share/rpm/Packages.db`, `usr/share/rpm/rpmdb.sqlite`, `usr/lib/sysimage/rpm/Packages`, `usr/lib/sysimage/rpm/Packages.db`, `usr/lib/sysimage/rpm/rpmdb.sqlite` | -| Ignored directories | - | -| Ignored directory markers | - | -| Multi-module resolution | No | -| Install-first support | No | -| Remediation hints | None | -| Native command hints | `syft for bomly-lite` | diff --git a/docs/detectors/ecosystems/ruby/README.md b/docs/detectors/ecosystems/ruby/README.md deleted file mode 100644 index 8e32fba3..00000000 --- a/docs/detectors/ecosystems/ruby/README.md +++ /dev/null @@ -1,21 +0,0 @@ -# Ruby - - - -Package managers Bomly recognizes in the `ruby` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`bundler`](bundler.md) | `bundler-detector`, `syft-detector` | `Gemfile.lock`, `Gemfile.next.lock` | `direct-bump`, `transitive-override` | Yes | -| [`gemspec`](gemspec.md) | `syft-detector` | `*.gemspec` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. - - `direct-bump` means the detector knows how to update a package declared directly in the project. - - `transitive-override` means the detector knows how to pin an indirect package with the package manager's override feature. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/ruby/gemspec.md b/docs/detectors/ecosystems/ruby/gemspec.md deleted file mode 100644 index e4eecc6d..00000000 --- a/docs/detectors/ecosystems/ruby/gemspec.md +++ /dev/null @@ -1,18 +0,0 @@ -# `gemspec` (ruby ecosystem) - - - -Bomly uses this chain when it finds `gemspec` evidence. - -| Property | Value | -| --- | --- | -| Package manager | `gemspec` | -| Ecosystem | `ruby` | -| Detector chain | `syft-detector` | -| Evidence patterns | `*.gemspec` | -| Ignored directories | - | -| Ignored directory markers | - | -| Multi-module resolution | No | -| Install-first support | No | -| Remediation hints | None | -| Native command hints | `syft for bomly-lite` | diff --git a/docs/detectors/ecosystems/rust/README.md b/docs/detectors/ecosystems/rust/README.md deleted file mode 100644 index 03a5aa9e..00000000 --- a/docs/detectors/ecosystems/rust/README.md +++ /dev/null @@ -1,20 +0,0 @@ -# Rust - - - -Package managers Bomly recognizes in the `rust` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`cargo`](cargo.md) | `cargo-detector`, `syft-detector` | `Cargo.lock`, `Cargo.toml` | `direct-bump`, `lockfile-refresh` | Yes | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. - - `direct-bump` means the detector knows how to update a package declared directly in the project. - - `lockfile-refresh` means the detector knows how to ask the package manager to resolve a newer indirect package version. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/sbom/README.md b/docs/detectors/ecosystems/sbom/README.md deleted file mode 100644 index 3722bcbd..00000000 --- a/docs/detectors/ecosystems/sbom/README.md +++ /dev/null @@ -1,18 +0,0 @@ -# Sbom - - - -Package managers Bomly recognizes in the `sbom` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`sbom`](sbom.md) | `sbom-detector` | `*.syft.json`, `*.bom.*`, `*.bom`, `bom`, `*.sbom.*`, `*.sbom`, `sbom`, `*.cdx.*`, `*.cdx`, `*.spdx.*`, `*.spdx` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/scala/README.md b/docs/detectors/ecosystems/scala/README.md deleted file mode 100644 index 3ba8ee81..00000000 --- a/docs/detectors/ecosystems/scala/README.md +++ /dev/null @@ -1,18 +0,0 @@ -# Scala - - - -Package managers Bomly recognizes in the `scala` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`sbt`](sbt.md) | `sbt-native-detector`, `sbt-detector` | `build.sbt`, `project/plugins.sbt`, `project/build.properties` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/snap/README.md b/docs/detectors/ecosystems/snap/README.md deleted file mode 100644 index 38f439f5..00000000 --- a/docs/detectors/ecosystems/snap/README.md +++ /dev/null @@ -1,18 +0,0 @@ -# Snap - - - -Package managers Bomly recognizes in the `snap` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`snap`](snap.md) | `syft-detector` | `snap/snapcraft.yaml`, `snap/manifest.yaml`, `doc/linux-modules-*/changelog.Debian.gz`, `usr/share/snappy/dpkg.yaml` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/snap/snap.md b/docs/detectors/ecosystems/snap/snap.md deleted file mode 100644 index b38f9df1..00000000 --- a/docs/detectors/ecosystems/snap/snap.md +++ /dev/null @@ -1,18 +0,0 @@ -# `snap` (snap ecosystem) - - - -Bomly uses this chain when it finds `snap` evidence. - -| Property | Value | -| --- | --- | -| Package manager | `snap` | -| Ecosystem | `snap` | -| Detector chain | `syft-detector` | -| Evidence patterns | `snap/snapcraft.yaml`, `snap/manifest.yaml`, `doc/linux-modules-*/changelog.Debian.gz`, `usr/share/snappy/dpkg.yaml` | -| Ignored directories | - | -| Ignored directory markers | - | -| Multi-module resolution | No | -| Install-first support | No | -| Remediation hints | None | -| Native command hints | `syft for bomly-lite` | diff --git a/docs/detectors/ecosystems/swift/README.md b/docs/detectors/ecosystems/swift/README.md deleted file mode 100644 index 4e2aba99..00000000 --- a/docs/detectors/ecosystems/swift/README.md +++ /dev/null @@ -1,19 +0,0 @@ -# Swift - - - -Package managers Bomly recognizes in the `swift` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`cocoapods`](cocoapods.md) | `cocoapods-detector`, `syft-detector` | `Podfile.lock`, `Podfile` | None | No | -| [`swiftpm`](swiftpm.md) | `swiftpm-native-detector`, `swiftpm-detector`, `syft-detector` | `Package.resolved`, `.package.resolved`, `Package.swift`, `project.xcworkspace/xcshareddata/swiftpm/Package.resolved` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/terraform/README.md b/docs/detectors/ecosystems/terraform/README.md deleted file mode 100644 index 10d8ccd9..00000000 --- a/docs/detectors/ecosystems/terraform/README.md +++ /dev/null @@ -1,18 +0,0 @@ -# Terraform - - - -Package managers Bomly recognizes in the `terraform` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`terraform`](terraform.md) | `syft-detector` | `.terraform.lock.hcl` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/terraform/terraform.md b/docs/detectors/ecosystems/terraform/terraform.md deleted file mode 100644 index 3ab8f22d..00000000 --- a/docs/detectors/ecosystems/terraform/terraform.md +++ /dev/null @@ -1,18 +0,0 @@ -# `terraform` (terraform ecosystem) - - - -Bomly uses this chain when it finds `terraform` evidence. - -| Property | Value | -| --- | --- | -| Package manager | `terraform` | -| Ecosystem | `terraform` | -| Detector chain | `syft-detector` | -| Evidence patterns | `.terraform.lock.hcl` | -| Ignored directories | - | -| Ignored directory markers | - | -| Multi-module resolution | No | -| Install-first support | No | -| Remediation hints | None | -| Native command hints | `syft for bomly-lite` | diff --git a/docs/detectors/ecosystems/wordpress/README.md b/docs/detectors/ecosystems/wordpress/README.md deleted file mode 100644 index 14503e98..00000000 --- a/docs/detectors/ecosystems/wordpress/README.md +++ /dev/null @@ -1,18 +0,0 @@ -# Wordpress - - - -Package managers Bomly recognizes in the `wordpress` ecosystem: - -| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support | -| --- | --- | --- | --- | --- | -| [`wordpress`](wordpress.md) | `syft-detector` | `wp-content/plugins/*/*.php` | None | No | - -## How to read this - -- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported. -- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data. -- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first). -- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files. -- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive). -- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution. diff --git a/docs/detectors/ecosystems/wordpress/wordpress.md b/docs/detectors/ecosystems/wordpress/wordpress.md deleted file mode 100644 index d524e33f..00000000 --- a/docs/detectors/ecosystems/wordpress/wordpress.md +++ /dev/null @@ -1,18 +0,0 @@ -# `wordpress` (wordpress ecosystem) - - - -Bomly uses this chain when it finds `wordpress` evidence. - -| Property | Value | -| --- | --- | -| Package manager | `wordpress` | -| Ecosystem | `wordpress` | -| Detector chain | `syft-detector` | -| Evidence patterns | `wp-content/plugins/*/*.php` | -| Ignored directories | - | -| Ignored directory markers | - | -| Multi-module resolution | No | -| Install-first support | No | -| Remediation hints | None | -| Native command hints | `syft for bomly-lite` | diff --git a/docs/detectors/ecosystems/elixir/mix.md b/docs/detectors/elixir/mix.md similarity index 95% rename from docs/detectors/ecosystems/elixir/mix.md rename to docs/detectors/elixir/mix.md index 6be559a1..c3a84f3d 100644 --- a/docs/detectors/ecosystems/elixir/mix.md +++ b/docs/detectors/elixir/mix.md @@ -1,4 +1,4 @@ -# `mix` (elixir ecosystem) +# mix diff --git a/docs/detectors/ecosystems/github-actions/github-actions.md b/docs/detectors/github-actions/github-actions.md similarity index 98% rename from docs/detectors/ecosystems/github-actions/github-actions.md rename to docs/detectors/github-actions/github-actions.md index 3ce8e40b..d0955d05 100644 --- a/docs/detectors/ecosystems/github-actions/github-actions.md +++ b/docs/detectors/github-actions/github-actions.md @@ -1,4 +1,4 @@ -# `github-actions` (github-actions ecosystem) +# github-actions diff --git a/docs/detectors/ecosystems/go/gomod.md b/docs/detectors/go/gomod.md similarity index 99% rename from docs/detectors/ecosystems/go/gomod.md rename to docs/detectors/go/gomod.md index 438ad5ce..dd013468 100644 --- a/docs/detectors/ecosystems/go/gomod.md +++ b/docs/detectors/go/gomod.md @@ -1,4 +1,4 @@ -# `gomod` (go ecosystem) +# gomod diff --git a/docs/detectors/ecosystems/maven/gradle.md b/docs/detectors/maven/gradle.md similarity index 97% rename from docs/detectors/ecosystems/maven/gradle.md rename to docs/detectors/maven/gradle.md index e01ffa8c..fc2ae516 100644 --- a/docs/detectors/ecosystems/maven/gradle.md +++ b/docs/detectors/maven/gradle.md @@ -1,4 +1,4 @@ -# `gradle` (maven ecosystem) +# gradle @@ -98,7 +98,7 @@ Re-lock and re-scan. > **Experimental.** Reachability is opt-in via `--analyze`. The feature is stable in shape but may evolve; ecosystem coverage is expanding. -For Gradle packages, the analyzer is `jvmreach` at **Tier-3 (package)** — same caveats as Maven. See [REACHABILITY.md](../../../REACHABILITY.md#unreachable-is-not-safe). +For Gradle packages, the analyzer is `jvmreach` at **Tier-3 (package)** — same caveats as Maven. See [REACHABILITY.md](../../REACHABILITY.md#unreachable-is-not-safe). For multi-project builds, `jvmreach` reads standard `include(...)` declarations and `projectDir` overrides automatically. Dynamically computed settings and composite `includeBuild` closures remain best-effort. diff --git a/docs/detectors/ecosystems/maven/maven.md b/docs/detectors/maven/maven.md similarity index 98% rename from docs/detectors/ecosystems/maven/maven.md rename to docs/detectors/maven/maven.md index bf88b966..cf10f7a7 100644 --- a/docs/detectors/ecosystems/maven/maven.md +++ b/docs/detectors/maven/maven.md @@ -1,4 +1,4 @@ -# `maven` (maven ecosystem) +# maven @@ -105,7 +105,7 @@ Re-scan. > **Experimental.** Reachability is opt-in via `--analyze`. The feature is stable in shape but may evolve; ecosystem coverage is expanding. -For Maven packages, the analyzer is `jvmreach` at **Tier-3 (package)**. It walks `.java`, `.kt`, `.kts`, `.scala`, `.groovy` source files under the project root, parses top-of-file `import` statements, and maps fully-qualified-name prefixes to Maven coordinates via a curated longest-prefix map. See [REACHABILITY.md](../../../REACHABILITY.md#unreachable-is-not-safe). +For Maven packages, the analyzer is `jvmreach` at **Tier-3 (package)**. It walks `.java`, `.kt`, `.kts`, `.scala`, `.groovy` source files under the project root, parses top-of-file `import` statements, and maps fully-qualified-name prefixes to Maven coordinates via a curated longest-prefix map. See [REACHABILITY.md](../../REACHABILITY.md#unreachable-is-not-safe). For multi-module reactors, `jvmreach` reads parent `` declarations recursively and follows source namespace imports between consumed sibling modules before attributing external artifacts. diff --git a/docs/detectors/ecosystems/npm/bun.md b/docs/detectors/npm/bun.md similarity index 99% rename from docs/detectors/ecosystems/npm/bun.md rename to docs/detectors/npm/bun.md index aae879e2..0520e76a 100644 --- a/docs/detectors/ecosystems/npm/bun.md +++ b/docs/detectors/npm/bun.md @@ -1,4 +1,4 @@ -# `bun` (npm ecosystem) +# bun diff --git a/docs/detectors/ecosystems/npm/npm.md b/docs/detectors/npm/npm.md similarity index 97% rename from docs/detectors/ecosystems/npm/npm.md rename to docs/detectors/npm/npm.md index da34832e..2f2bba81 100644 --- a/docs/detectors/ecosystems/npm/npm.md +++ b/docs/detectors/npm/npm.md @@ -1,4 +1,4 @@ -# `npm` (npm ecosystem) +# npm @@ -97,7 +97,7 @@ bomly explain lodash --path ./monorepo > **Experimental.** Reachability is opt-in via `--analyze`. The feature is stable in shape but may evolve; ecosystem coverage is expanding. -For npm packages, the analyzer is `jsreach` at **Tier-3 (package)**. It walks app source from `package.json` entry points and reports a package as reachable when there is any path from app source to that package through the npm dep graph. See [REACHABILITY.md](../../../REACHABILITY.md#unreachable-is-not-safe) — Tier-3 "unreachable" is a triage signal, not a safety guarantee. +For npm packages, the analyzer is `jsreach` at **Tier-3 (package)**. It walks app source from `package.json` entry points and reports a package as reachable when there is any path from app source to that package through the npm dep graph. See [REACHABILITY.md](../../REACHABILITY.md#unreachable-is-not-safe) — Tier-3 "unreachable" is a triage signal, not a safety guarantee. In workspace monorepos, `jsreach` automatically follows imports between consumed sibling packages by workspace package name. Unused siblings do not widen the reachable set. diff --git a/docs/detectors/ecosystems/npm/pnpm.md b/docs/detectors/npm/pnpm.md similarity index 96% rename from docs/detectors/ecosystems/npm/pnpm.md rename to docs/detectors/npm/pnpm.md index e0910cb2..94b49b47 100644 --- a/docs/detectors/ecosystems/npm/pnpm.md +++ b/docs/detectors/npm/pnpm.md @@ -1,4 +1,4 @@ -# `pnpm` (npm ecosystem) +# pnpm @@ -84,7 +84,7 @@ Bomly scans each pnpm workspace as a separate subproject. `injected: true` depen > **Experimental.** Reachability is opt-in via `--analyze`. The feature is stable in shape but may evolve; ecosystem coverage is expanding. -For pnpm packages, the analyzer is `jsreach` at **Tier-3 (package)** — same caveats as npm. See [REACHABILITY.md](../../../REACHABILITY.md#unreachable-is-not-safe). +For pnpm packages, the analyzer is `jsreach` at **Tier-3 (package)** — same caveats as npm. See [REACHABILITY.md](../../REACHABILITY.md#unreachable-is-not-safe). `jsreach` reads `pnpm-workspace.yaml` package patterns automatically and follows imports between consumed sibling packages without depending on installed symlinks. diff --git a/docs/detectors/ecosystems/npm/yarn.md b/docs/detectors/npm/yarn.md similarity index 96% rename from docs/detectors/ecosystems/npm/yarn.md rename to docs/detectors/npm/yarn.md index d440f343..785f6937 100644 --- a/docs/detectors/ecosystems/npm/yarn.md +++ b/docs/detectors/npm/yarn.md @@ -1,4 +1,4 @@ -# `yarn` (npm ecosystem) +# yarn @@ -86,7 +86,7 @@ Bomly walks Berry workspaces and scans each as a subproject. Plug-and-Play (`.pn > **Experimental.** Reachability is opt-in via `--analyze`. The feature is stable in shape but may evolve; ecosystem coverage is expanding. -For Yarn packages, the analyzer is `jsreach` at **Tier-3 (package)** — same caveats as npm. See [REACHABILITY.md](../../../REACHABILITY.md#unreachable-is-not-safe). +For Yarn packages, the analyzer is `jsreach` at **Tier-3 (package)** — same caveats as npm. See [REACHABILITY.md](../../REACHABILITY.md#unreachable-is-not-safe). `jsreach` reads workspace arrays and Yarn-style `workspaces.packages` objects automatically, then follows imports between consumed sibling packages by package name. diff --git a/docs/detectors/ecosystems/php/composer.md b/docs/detectors/php/composer.md similarity index 99% rename from docs/detectors/ecosystems/php/composer.md rename to docs/detectors/php/composer.md index 7f674062..46f76cf1 100644 --- a/docs/detectors/ecosystems/php/composer.md +++ b/docs/detectors/php/composer.md @@ -1,4 +1,4 @@ -# `composer` (php ecosystem) +# composer diff --git a/docs/detectors/ecosystems/python/pip.md b/docs/detectors/python/pip.md similarity index 97% rename from docs/detectors/ecosystems/python/pip.md rename to docs/detectors/python/pip.md index 90c3051d..be5706e6 100644 --- a/docs/detectors/ecosystems/python/pip.md +++ b/docs/detectors/python/pip.md @@ -1,4 +1,4 @@ -# `pip` (python ecosystem) +# pip @@ -112,7 +112,7 @@ installs. Missing or malformed source data stays unknown. > **Experimental.** Reachability is opt-in via `--analyze`. The feature is stable in shape but may evolve; ecosystem coverage is expanding. -For pip-managed packages, the analyzer is `pyreach` at **Tier-3 (package)**. It walks every `.py` file under the project root, records imports, and maps module names to PyPI distribution names. See [REACHABILITY.md](../../../REACHABILITY.md#unreachable-is-not-safe) and the module-to-distribution map in `internal/analyzers/pyreach/moduletodist.go`. +For pip-managed packages, the analyzer is `pyreach` at **Tier-3 (package)**. It walks every `.py` file under the project root, records imports, and maps module names to PyPI distribution names. See [REACHABILITY.md](../../REACHABILITY.md#unreachable-is-not-safe) and the module-to-distribution map in `internal/analyzers/pyreach/moduletodist.go`. ## Limitations diff --git a/docs/detectors/ecosystems/python/pipenv.md b/docs/detectors/python/pipenv.md similarity index 97% rename from docs/detectors/ecosystems/python/pipenv.md rename to docs/detectors/python/pipenv.md index 27a8e577..6b118280 100644 --- a/docs/detectors/ecosystems/python/pipenv.md +++ b/docs/detectors/python/pipenv.md @@ -1,4 +1,4 @@ -# `pipenv` (python ecosystem) +# pipenv @@ -75,7 +75,7 @@ When Pipenv uses pip inspection, Bomly uses pip's `direct_url` record instead. > **Experimental.** Reachability is opt-in via `--analyze`. The feature is stable in shape but may evolve; ecosystem coverage is expanding. -For Pipenv-managed packages, the analyzer is `pyreach` at **Tier-3 (package)**. See [REACHABILITY.md](../../../REACHABILITY.md#unreachable-is-not-safe). +For Pipenv-managed packages, the analyzer is `pyreach` at **Tier-3 (package)**. See [REACHABILITY.md](../../REACHABILITY.md#unreachable-is-not-safe). ## Limitations diff --git a/docs/detectors/ecosystems/python/poetry.md b/docs/detectors/python/poetry.md similarity index 97% rename from docs/detectors/ecosystems/python/poetry.md rename to docs/detectors/python/poetry.md index 8f58302e..a4080d01 100644 --- a/docs/detectors/ecosystems/python/poetry.md +++ b/docs/detectors/python/poetry.md @@ -1,4 +1,4 @@ -# `poetry` (python ecosystem) +# poetry @@ -96,7 +96,7 @@ Bomly reads registry, Git, URL, and local-directory sources from each > **Experimental.** Reachability is opt-in via `--analyze`. The feature is stable in shape but may evolve; ecosystem coverage is expanding. -For Poetry-managed packages, the analyzer is `pyreach` at **Tier-3 (package)**. See [REACHABILITY.md](../../../REACHABILITY.md#unreachable-is-not-safe). +For Poetry-managed packages, the analyzer is `pyreach` at **Tier-3 (package)**. See [REACHABILITY.md](../../REACHABILITY.md#unreachable-is-not-safe). ## Limitations diff --git a/docs/detectors/ecosystems/python/uv.md b/docs/detectors/python/uv.md similarity index 97% rename from docs/detectors/ecosystems/python/uv.md rename to docs/detectors/python/uv.md index 3aa59aca..7352ae30 100644 --- a/docs/detectors/ecosystems/python/uv.md +++ b/docs/detectors/python/uv.md @@ -1,4 +1,4 @@ -# `uv` (python ecosystem) +# uv @@ -101,7 +101,7 @@ package source table. An entry without source evidence stays unknown. > **Experimental.** Reachability is opt-in via `--analyze`. The feature is stable in shape but may evolve; ecosystem coverage is expanding. -For uv-managed packages, the analyzer is `pyreach` at **Tier-3 (package)**. See [REACHABILITY.md](../../../REACHABILITY.md#unreachable-is-not-safe). +For uv-managed packages, the analyzer is `pyreach` at **Tier-3 (package)**. See [REACHABILITY.md](../../REACHABILITY.md#unreachable-is-not-safe). ## Limitations diff --git a/docs/detectors/ecosystems/ruby/bundler.md b/docs/detectors/ruby/bundler.md similarity index 99% rename from docs/detectors/ecosystems/ruby/bundler.md rename to docs/detectors/ruby/bundler.md index 3ef703c2..cbbf6686 100644 --- a/docs/detectors/ecosystems/ruby/bundler.md +++ b/docs/detectors/ruby/bundler.md @@ -1,4 +1,4 @@ -# `bundler` (ruby ecosystem) +# bundler diff --git a/docs/detectors/ecosystems/rust/cargo.md b/docs/detectors/rust/cargo.md similarity index 99% rename from docs/detectors/ecosystems/rust/cargo.md rename to docs/detectors/rust/cargo.md index f46b6ee2..2fcd327c 100644 --- a/docs/detectors/ecosystems/rust/cargo.md +++ b/docs/detectors/rust/cargo.md @@ -1,4 +1,4 @@ -# `cargo` (rust ecosystem) +# cargo diff --git a/docs/detectors/ecosystems/sbom/sbom.md b/docs/detectors/sbom/sbom.md similarity index 99% rename from docs/detectors/ecosystems/sbom/sbom.md rename to docs/detectors/sbom/sbom.md index 4339b009..7a5fc06f 100644 --- a/docs/detectors/ecosystems/sbom/sbom.md +++ b/docs/detectors/sbom/sbom.md @@ -1,4 +1,4 @@ -# `sbom` (sbom ecosystem) +# sbom diff --git a/docs/detectors/ecosystems/scala/sbt.md b/docs/detectors/scala/sbt.md similarity index 96% rename from docs/detectors/ecosystems/scala/sbt.md rename to docs/detectors/scala/sbt.md index 3740bc92..dfaa9db5 100644 --- a/docs/detectors/ecosystems/scala/sbt.md +++ b/docs/detectors/scala/sbt.md @@ -1,4 +1,4 @@ -# `sbt` (scala ecosystem) +# sbt diff --git a/docs/detectors/ecosystems/swift/cocoapods.md b/docs/detectors/swift/cocoapods.md similarity index 95% rename from docs/detectors/ecosystems/swift/cocoapods.md rename to docs/detectors/swift/cocoapods.md index 4bde1592..0001a3b8 100644 --- a/docs/detectors/ecosystems/swift/cocoapods.md +++ b/docs/detectors/swift/cocoapods.md @@ -1,4 +1,4 @@ -# `cocoapods` (swift ecosystem) +# cocoapods diff --git a/docs/detectors/ecosystems/swift/swiftpm.md b/docs/detectors/swift/swiftpm.md similarity index 97% rename from docs/detectors/ecosystems/swift/swiftpm.md rename to docs/detectors/swift/swiftpm.md index 5feb2e60..b67e5c2e 100644 --- a/docs/detectors/ecosystems/swift/swiftpm.md +++ b/docs/detectors/swift/swiftpm.md @@ -1,4 +1,4 @@ -# `swiftpm` (swift ecosystem) +# swiftpm diff --git a/docs/detectors/syft.md b/docs/detectors/syft.md new file mode 100644 index 00000000..68606b6f --- /dev/null +++ b/docs/detectors/syft.md @@ -0,0 +1,98 @@ +# Syft fallback + + + +Bomly bundles [Syft](https://github.com/anchore/syft) as the catch-all detector. It runs when no native detector applies, which is how Bomly covers OS package databases and ecosystems without a native graph resolver. + +| Property | Value | +| --- | --- | +| Detector | `syft-detector` | +| Graph shape | Flat package list — no dependency edges | +| Package managers covered | 23 (below) | +| Install-first support | No | +| Remediation hints | None | + +## Package managers covered + +These have no native Bomly detector — Syft is the only chain entry. + +| Ecosystem | Package manager | Evidence patterns | +| --- | --- | --- | +| `alpm` | `alpm` | `var/lib/pacman/local/*/desc` | +| `apk` | `apk` | `lib/apk/db/installed` | +| `conda` | `conda` | `conda-meta/*.json` | +| `dpkg` | `dpkg` | `lib/dpkg/status`, `lib/dpkg/status.d/*`, `lib/opkg/info/*.control`, `lib/opkg/status` | +| `erlang` | `otp` | `*.app` | +| `erlang` | `rebar` | `rebar.lock` | +| `haskell` | `cabal` | `cabal.project.freeze` | +| `haskell` | `stack` | `stack.yaml`, `stack.yaml.lock` | +| `homebrew` | `homebrew` | `Cellar/*/*/.brew/*.rb`, `Library/Taps/*/*/Formula/*.rb` | +| `lua` | `luarocks` | `*.rockspec` | +| `nix` | `nix` | `nix/var/nix/db/db.sqlite`, `nix/store/*.drv` | +| `ocaml` | `opam` | `*opam` | +| `php` | `pear` | `php/.registry/**/*.reg` | +| `portage` | `portage` | `var/db/pkg/*/*/CONTENTS` | +| `prolog` | `swipl-pack` | `pack.pl` | +| `python` | `pdm` | `pdm.lock`, `pyproject.toml` | +| `python` | `setuppy` | `setup.py` | +| `r` | `r-package` | `DESCRIPTION` | +| `rpm` | `rpm` | `var/lib/rpmmanifest/container-manifest-2`, `var/lib/rpm/Packages`, `var/lib/rpm/Packages.db`, `var/lib/rpm/rpmdb.sqlite`, `usr/share/rpm/Packages`, `usr/share/rpm/Packages.db`, `usr/share/rpm/rpmdb.sqlite`, `usr/lib/sysimage/rpm/Packages`, `usr/lib/sysimage/rpm/Packages.db`, `usr/lib/sysimage/rpm/rpmdb.sqlite` | +| `ruby` | `gemspec` | `*.gemspec` | +| `snap` | `snap` | `snap/snapcraft.yaml`, `snap/manifest.yaml`, `doc/linux-modules-*/changelog.Debian.gz`, `usr/share/snappy/dpkg.yaml` | +| `terraform` | `terraform` | `.terraform.lock.hcl` | +| `wordpress` | `wordpress` | `wp-content/plugins/*/*.php` | + +## Container operating systems + +Syft also identifies the base OS of a container image, which is where its package database catalogers come from. + +| OS family | Cataloger | Version source | +| --- | --- | --- | +| alpine | `apk-db-cataloger` | /etc/os-release | +| amazon linux (amzn) | `rpm-db-cataloger` | /etc/os-release | +| busybox | `busybox-cataloger` | busybox binary metadata | +| centos | `rpm-db-cataloger` | /etc/os-release | +| debian | `dpkg-db-cataloger` | /etc/os-release | +| distroless | `os-release-cataloger` | /etc/os-release | +| photon | `rpm-db-cataloger` | /etc/os-release | +| red hat (rhel, ubi) | `rpm-db-cataloger` | /etc/os-release | +| rocky linux (rocky) | `rpm-db-cataloger` | /etc/os-release | +| sles (suse, opensuse, opensuse leap) | `rpm-db-cataloger` | /etc/os-release | +| ubuntu | `dpkg-db-cataloger` | /etc/os-release | +| wolfi | `apk-db-cataloger` | /etc/os-release | + +## What Syft gives you + +Syft catalogs packages by pattern-matching files: OS package databases, installed-package manifests, and lockfiles it recognizes. It reports what is present, not how those packages relate to each other. + +That difference matters for the rest of the pipeline: + +- `bomly explain` needs edges to walk a path from your project to a package. Syft-catalogued packages have no edges, so there is no path to show. +- Scope filters like `--direct-only` rely on the direct/transitive distinction, which comes from the graph. Syft results carry no such distinction. +- Vulnerability and license enrichment work normally — matchers key off the package coordinates, which Syft does provide. + +## When Syft runs + +Syft is the last entry in almost every detector chain. It runs when the native detector ahead of it cannot produce graph data — no lockfile present, the build tool is missing from `PATH`, or the ecosystem has no native detector at all. + +For container images it does most of the work: Bomly scans the layers, and native detectors only apply where a recognizable lockfile made it into the image. + +## Turning it off + +Syft is a normal detector, so the standard selector grammar applies: + +```bash +# Drop the Syft fallback — native detectors only +bomly scan --detectors -syft-detector + +# Use only Syft +bomly scan --detectors syft-detector +``` + +Dropping Syft means a project it was covering resolves nothing, and the scan exits 3 with "no detector chain produced a graph". That is usually what you want in CI when a flat package list would pass a gate that a real graph would fail. + +## See also + +- [Support matrix](../SUPPORT_MATRIX.md) — every ecosystem and package manager, native and Syft-backed +- [Scan targets](../SCAN_TARGETS.md) — container images and the other input shapes Syft handles +- [Detectors](../DETECTORS.md) — chains, selection, and the native-vs-Syft comparison diff --git a/docs/manifest.json b/docs/manifest.json index 0b08bab2..4c0cd9df 100644 --- a/docs/manifest.json +++ b/docs/manifest.json @@ -10,16 +10,16 @@ "label": "How it works", "description": "What Bomly does, and why each piece exists." }, - { - "id": "reference", - "label": "Reference", - "description": "Generated specifications and supported matrices." - }, { "id": "operations", "label": "Operations", "description": "Running Bomly in CI and keeping pipelines healthy." }, + { + "id": "reference", + "label": "Reference", + "description": "Specifications, matrices, and design deep dives." + }, { "id": "experimental", "label": "Experimental", @@ -33,31 +33,24 @@ "description": "First scan, enrich, audit, diff — all in five minutes.", "group": "start" }, - { - "slug": "tutorial", - "title": "Tutorial", - "description": "From first scan to a CI gate on a real project, with representative output from the workflow.", - "group": "start" - }, { "slug": "installation", "title": "Installation", "description": "Install methods, `bomly` vs `bomly-lite`, checksum verification, upgrade, uninstall.", "group": "start" }, + { + "slug": "tutorial", + "title": "Tutorial", + "description": "From first scan to a CI gate on a real project, with representative output from the workflow.", + "group": "start" + }, { "slug": "use-cases", "title": "Use cases", "description": "Recipes for PR gates, SBOMs, triage, and license and offline scans.", "group": "start" }, - { - "slug": "evidence", - "title": "Reproducible evidence", - "description": "Public inputs, commands, results, and limitations behind important behavior claims.", - "group": "reference", - "hasChildren": true - }, { "slug": "scan-targets", "title": "Scan targets", @@ -77,22 +70,11 @@ "group": "start" }, { - "slug": "architecture", - "title": "Architecture", - "description": "How the scan pipeline is structured: targets, detectors, matchers, auditors.", - "group": "concepts" - }, - { - "slug": "network", - "title": "Network and privacy", - "description": "Every network trigger, what it contacts and transmits, and how to keep a run offline.", - "group": "concepts" - }, - { - "slug": "security", - "title": "Security and trust boundaries", - "description": "Permissions, network behavior, plugins, input limits, and residual risks.", - "group": "concepts" + "slug": "commands", + "title": "Commands", + "description": "Per-command reference for scan, explain, and diff, plus the shared option surface.", + "group": "concepts", + "hasChildren": true }, { "slug": "detectors", @@ -123,11 +105,46 @@ "hasChildren": true }, { - "slug": "commands", - "title": "Commands", - "description": "Per-command reference for scan, explain, and diff, plus the shared option surface.", - "group": "reference", - "hasChildren": true + "slug": "mcp", + "title": "MCP server", + "description": "Connect Bomly's dependency graph tools to Claude Code, Cursor, VS Code, or another MCP client.", + "group": "concepts" + }, + { + "slug": "bomly-guard", + "title": "Bomly Guard", + "description": "The turnkey GitHub Action that gates pull requests on dependency changes via `bomly diff`.", + "group": "concepts" + }, + { + "slug": "integrations", + "title": "Integrations", + "description": "CI actions, AI agents, code scanning, install channels, and plugins Bomly connects to.", + "group": "operations" + }, + { + "slug": "ci-integration", + "title": "CI integration", + "description": "Drop-in recipes for GitHub Actions, GitLab, Jenkins, Azure DevOps, and CircleCI.", + "group": "operations" + }, + { + "slug": "ci-readiness", + "title": "CI-readiness warnings", + "description": "Spot package-manager, lockfile-format, and install-policy mismatches that fail CI regardless of findings.", + "group": "operations" + }, + { + "slug": "baselines", + "title": "Finding baselines", + "description": "Keep accepted package findings visible without failing audits.", + "group": "operations" + }, + { + "slug": "troubleshooting", + "title": "Troubleshooting", + "description": "Common errors and how to fix them, organized by exit code and symptom.", + "group": "operations" }, { "slug": "support-matrix", @@ -161,52 +178,35 @@ "hasChildren": true }, { - "slug": "glossary", - "title": "Glossary", - "description": "Every Bomly term, one sentence each.", + "slug": "architecture", + "title": "Architecture", + "description": "How the scan pipeline is structured: targets, detectors, matchers, auditors.", "group": "reference" }, { - "slug": "integrations", - "title": "Integrations", - "description": "CI actions, AI agents, code scanning, install channels, and plugins Bomly connects to.", - "group": "operations" - }, - { - "slug": "ci-integration", - "title": "CI integration", - "description": "Drop-in recipes for GitHub Actions, GitLab, Jenkins, Azure DevOps, and CircleCI.", - "group": "operations" - }, - { - "slug": "ci-readiness", - "title": "CI-readiness warnings", - "description": "Spot package-manager, lockfile-format, and install-policy mismatches that fail CI regardless of findings.", - "group": "operations" - }, - { - "slug": "bomly-guard", - "title": "Bomly Guard", - "description": "The turnkey GitHub Action that gates pull requests on dependency changes via `bomly diff`.", - "group": "operations" + "slug": "network", + "title": "Network and privacy", + "description": "Every network trigger, what it contacts and transmits, and how to keep a run offline.", + "group": "reference" }, { - "slug": "baselines", - "title": "Finding baselines", - "description": "Keep accepted package findings visible without failing audits.", - "group": "operations" + "slug": "security", + "title": "Security and trust boundaries", + "description": "Permissions, network behavior, plugins, input limits, and residual risks.", + "group": "reference" }, { - "slug": "mcp", - "title": "MCP server", - "description": "Connect Bomly's dependency graph tools to Claude Code, Cursor, VS Code, or another MCP client.", - "group": "concepts" + "slug": "evidence", + "title": "Reproducible evidence", + "description": "Public inputs, commands, results, and limitations behind important behavior claims.", + "group": "reference", + "hasChildren": true }, { - "slug": "troubleshooting", - "title": "Troubleshooting", - "description": "Common errors and how to fix them, organized by exit code and symptom.", - "group": "operations" + "slug": "glossary", + "title": "Glossary", + "description": "Every Bomly term, one sentence each.", + "group": "reference" }, { "slug": "reachability", diff --git a/internal/support/component_docs.go b/internal/support/component_docs.go index c12eea6d..d5a1d0d4 100644 --- a/internal/support/component_docs.go +++ b/internal/support/component_docs.go @@ -8,6 +8,7 @@ import ( "sort" "strings" + rootdetectors "github.com/bomly-dev/bomly-cli/internal/detectors" "github.com/bomly-dev/bomly-cli/internal/registry" "github.com/bomly-dev/bomly-cli/sdk" "go.uber.org/zap" @@ -61,7 +62,7 @@ For example, the `+"`npm`"+` chain is `+"`npm-detector`"+` → `+"`syft-detector 1. `+"`npm-detector`"+` parses `+"`package-lock.json`"+` directly and resolves the full transitive graph. 2. `+"`syft-detector`"+` runs only if the native detector cannot produce graph data (for example, no lockfile present), and emits a flat package list. -Per-ecosystem chains are listed in [`+"`detectors/ecosystems/`"+`](detectors/ecosystems/). The full live list lives in the CLI: +Per-detector chains are listed in the [detector reference](detectors/). The full live list lives in the CLI: `+"```bash"+` bomly plugins list --detectors @@ -123,7 +124,7 @@ resolution. The build-tool-primary detectors invoke commands you would already run locally (`+"`go list`"+`, `+"`mvn dependency:tree`"+`, `+"`gradle dependencies`"+`, `+"`sbt dependencyTree`"+`). Whether they hit the network is a property of those tools and your local cache state, not a Bomly choice. To keep these scans fully offline, pre-warm the local cache (`+"`go mod download`"+`, `+"`mvn dependency:go-offline`"+`, etc.) or commit a lockfile when the ecosystem supports one. -Per-PM pages under [`+"`detectors/ecosystems/`"+`](detectors/ecosystems/) document the exact command each detector runs and whether it touches the network. +Each page under [`+"`detectors/`"+`](detectors/) documents the exact command that detector runs and whether it touches the network. ## `+"`--install-first`"+` {#install-first} @@ -153,7 +154,7 @@ Pass `+"`--install-first`"+` to let supporting detectors run their normal depend Detectors without an `+"`Install`"+` implementation (e.g. NuGet, GitHub Actions, SBOM ingest, Syft) silently skip the step when `+"`--install-first`"+` is set. Bomly does **not** install package managers themselves — only their dependencies. -Each package-manager page under [`+"`detectors/ecosystems/`"+`](detectors/ecosystems/) lists whether `+"`--install-first`"+` is supported and the exact command that runs. +Each page under [`+"`detectors/`"+`](detectors/) lists whether `+"`--install-first`"+` is supported and the exact command that runs. ### Customizing the install command with `+"`--install-arg`"+` @@ -223,7 +224,7 @@ bomly scan --image ghcr.io/example/app:latest ## See also -- [Ecosystem guides](detectors/ecosystems/) — generated per-ecosystem detector chains, evidence patterns, and `+"`PATH`"+` requirements +- [Detector reference](detectors/) — one generated page per native detector, plus [Syft fallback](detectors/syft.md) for everything else - [Support matrix](SUPPORT_MATRIX.md) — generated overview of every supported ecosystem - [CI-readiness warnings](CI_READINESS.md) — the package-manager mismatches detectors report alongside the graph - [Plugins](PLUGINS.md) — author and install external detectors @@ -555,7 +556,7 @@ func WriteComponentDocs(docsDir string) error { return err } } - if err := writeDetectorEcosystemDocs(filepath.Join(docsDir, "detectors", "ecosystems")); err != nil { + if err := writeDetectorDocs(filepath.Join(docsDir, "detectors")); err != nil { return err } if err := writeMatcherDocs(filepath.Join(docsDir, "matchers")); err != nil { @@ -567,130 +568,167 @@ func WriteComponentDocs(docsDir string) error { return nil } -func writeDetectorEcosystemDocs(outputDir string) error { - // Wipe and recreate the output directory so renamed or removed ecosystems - // and package managers don't leave orphan files behind. +// writeDetectorDocs writes one page per detector under docs/detectors/, +// grouped into a directory per ecosystem: +// +// docs/detectors/npm/{npm,pnpm,yarn,bun}.md +// docs/detectors/python/{pip,pipenv,poetry,uv}.md +// docs/detectors/syft.md +// +// Only ecosystems with a native detector get a directory. Everything Bomly +// sees through Syft alone shares the single top-level `syft.md` — those pages +// were near-identical, and one page describing the fallback is more useful +// than 23 copies of it. +func writeDetectorDocs(outputDir string) error { + // Wipe and recreate the output directory so renamed or removed detectors + // don't leave orphan files behind. This also clears the old + // detectors/ecosystems/ tree the first time the new layout is generated. if err := os.RemoveAll(outputDir); err != nil { return fmt.Errorf("clean %s: %w", outputDir, err) } if err := os.MkdirAll(outputDir, 0o755); err != nil { return fmt.Errorf("create %s: %w", outputDir, err) } - entries := registry.SupportEntries() - byEcosystem := make(map[sdk.Ecosystem][]registry.PackageManagerSupport) - for _, entry := range entries { - byEcosystem[entry.Ecosystem] = append(byEcosystem[entry.Ecosystem], entry) - } - ecosystems := make([]sdk.Ecosystem, 0, len(byEcosystem)) - for ecosystem := range byEcosystem { - ecosystems = append(ecosystems, ecosystem) + + var native, syftOnly []registry.PackageManagerSupport + for _, entry := range registry.SupportEntries() { + if isSyftOnlyChain(entry.Detectors) { + syftOnly = append(syftOnly, entry) + continue + } + native = append(native, entry) } - sort.Slice(ecosystems, func(i, j int) bool { return ecosystems[i] < ecosystems[j] }) - for _, ecosystem := range ecosystems { - ecosystemDir := filepath.Join(outputDir, string(ecosystem)) + sortSupportEntries(native) + sortSupportEntries(syftOnly) + + for _, entry := range native { + ecosystemDir := filepath.Join(outputDir, string(entry.Ecosystem)) if err := os.MkdirAll(ecosystemDir, 0o755); err != nil { return fmt.Errorf("create %s: %w", ecosystemDir, err) } - ecosystemEntries := byEcosystem[ecosystem] - sort.Slice(ecosystemEntries, func(i, j int) bool { - return ecosystemEntries[i].Manager.Name() < ecosystemEntries[j].Manager.Name() - }) - for _, entry := range ecosystemEntries { - path := filepath.Join(ecosystemDir, entry.Manager.Name()+".md") - if err := writeMarkdown(path, renderPackageManagerMarkdown(ecosystem, entry)); err != nil { - return err - } - } - if err := writeMarkdown(filepath.Join(ecosystemDir, "README.md"), renderEcosystemReadme(ecosystem, ecosystemEntries)); err != nil { + path := filepath.Join(ecosystemDir, entry.Manager.Name()+".md") + if err := writeMarkdown(path, renderPackageManagerMarkdown(entry.Ecosystem, entry)); err != nil { return err } } - return writeMarkdown(filepath.Join(outputDir, "README.md"), renderDetectorEcosystemIndex(ecosystems, byEcosystem)) + + if err := writeMarkdown(filepath.Join(outputDir, "syft.md"), renderSyftMarkdown(syftOnly)); err != nil { + return err + } + return writeMarkdown(filepath.Join(outputDir, "README.md"), renderDetectorIndex(native, syftOnly)) } -func renderDetectorEcosystemIndex(ecosystems []sdk.Ecosystem, byEcosystem map[sdk.Ecosystem][]registry.PackageManagerSupport) string { - var b strings.Builder - b.WriteString("# Detector Ecosystem Guides\n\n") - b.WriteString(generatedBanner + "\n\n") - b.WriteString("Bomly groups detectors by **ecosystem** (the package universe — `go`, `npm`, `python`, `maven`, …) and writes one page per **package manager** within that ecosystem (`pip`, `poetry`, `uv` are all under `python`).\n\n") - b.WriteString("Pick your ecosystem to see the package managers it covers and how each one is detected.\n\n") - b.WriteString("| Ecosystem | Package managers |\n") - b.WriteString("| --- | --- |\n") - for _, ecosystem := range ecosystems { - entries := byEcosystem[ecosystem] - links := make([]string, 0, len(entries)) - for _, entry := range entries { - name := entry.Manager.Name() - links = append(links, fmt.Sprintf("[`%s`](%s/%s.md)", name, ecosystem, name)) +// isSyftOnlyChain reports whether a package manager is only reachable through +// the bundled Syft cataloger — no native Bomly detector resolves it. +func isSyftOnlyChain(detectorNames []string) bool { + if len(detectorNames) == 0 { + return false + } + for _, name := range detectorNames { + if name != rootdetectors.NameSyft { + return false } - _, _ = fmt.Fprintf(&b, "| [%s](%s/) | %s |\n", ecosystem, ecosystem, strings.Join(links, ", ")) } - return b.String() + return true +} + +func sortSupportEntries(entries []registry.PackageManagerSupport) { + sort.Slice(entries, func(i, j int) bool { + if entries[i].Ecosystem != entries[j].Ecosystem { + return entries[i].Ecosystem < entries[j].Ecosystem + } + return entries[i].Manager.Name() < entries[j].Manager.Name() + }) } -func renderEcosystemReadme(ecosystem sdk.Ecosystem, entries []registry.PackageManagerSupport) string { +func renderDetectorIndex(native, syftOnly []registry.PackageManagerSupport) string { var b strings.Builder - _, _ = fmt.Fprintf(&b, "# %s\n\n", titleWords(string(ecosystem))) + b.WriteString("# Detector Reference\n\n") b.WriteString(generatedBanner + "\n\n") - _, _ = fmt.Fprintf(&b, "Package managers Bomly recognizes in the `%s` ecosystem:\n\n", ecosystem) - b.WriteString("| Package manager | Detector chain | Evidence patterns | Remediation hints | Install-first support |\n") - b.WriteString("| --- | --- | --- | --- | --- |\n") - for _, entry := range entries { + b.WriteString("One page per package manager Bomly resolves natively, grouped by ecosystem, plus a single page for everything covered through the bundled Syft cataloger.\n\n") + b.WriteString("## Native detectors\n\n") + b.WriteString("These read a lockfile, manifest, or build tool directly and produce a full dependency graph with edges.\n\n") + b.WriteString("| Ecosystem | Package manager | Detector chain | Install-first support |\n") + b.WriteString("| --- | --- | --- | --- |\n") + previousEcosystem := sdk.Ecosystem("") + for _, entry := range native { name := entry.Manager.Name() - _, _ = fmt.Fprintf(&b, "| [`%s`](%s.md) | %s | %s | %s | %s |\n", + // Only label the ecosystem on its first row, so a multi-manager + // ecosystem reads as one block instead of a repeated column. + ecosystem := "" + if entry.Ecosystem != previousEcosystem { + ecosystem = "`" + string(entry.Ecosystem) + "`" + previousEcosystem = entry.Ecosystem + } + _, _ = fmt.Fprintf(&b, "| %s | [`%s`](%s/%s.md) | %s | %s |\n", + ecosystem, name, + entry.Ecosystem, name, codeList(entry.Detectors), - codeListOrDash(entry.EvidencePatterns), - remediationActionsForChain(entry.Detectors, entry.Manager, false), yesNo(chainSupportsInstallFirst(entry.Detectors)), ) } - b.WriteString("\n## How to read this\n\n") - b.WriteString("- Each package-manager page documents the exact commands Bomly runs (if any), the network behavior, and the lockfile or manifest formats supported.\n") - b.WriteString("- Bomly tries detector chains from left to right. Later detectors in the chain are fallbacks Bomly uses when the preferred detector cannot produce graph data.\n") - b.WriteString("- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. This downloads packages and modifies the filesystem; see [docs/DETECTORS.md](../../../DETECTORS.md#install-first).\n") - b.WriteString("- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors do not choose the final action or change project files.\n") - for _, action := range remediationActionsForEntries(entries) { - switch action { - case sdk.RemediationActionDirectBump: - b.WriteString(" - `direct-bump` means the detector knows how to update a package declared directly in the project.\n") - case sdk.RemediationActionTransitiveOverride: - b.WriteString(" - `transitive-override` means the detector knows how to pin an indirect package with the package manager's override feature.\n") - case sdk.RemediationActionLockfileRefresh: - b.WriteString(" - `lockfile-refresh` means the detector knows how to ask the package manager to resolve a newer indirect package version.\n") - } - } - b.WriteString("- Each package-manager page also lists the directories its detectors declare as ignored during recursive discovery (`--recursive`) and whether the chain resolves nested workspace/reactor modules from a root manifest (multi-module); see [docs/SCAN_TARGETS.md](../../../SCAN_TARGETS.md#recursive-discovery----recursive).\n") - b.WriteString("- Syft-backed entries provide broad compatibility, especially for containers and ecosystems without native Bomly graph resolution.\n") + b.WriteString("\n## Syft-backed coverage\n\n") + _, _ = fmt.Fprintf(&b, "[Syft fallback](syft.md) covers %d more package managers, mostly OS package databases and ecosystems without a native detector. Those produce a flat package list rather than a graph.\n\n", len(syftOnly)) + b.WriteString("## How to read this\n\n") + b.WriteString("- Bomly tries detector chains left to right. Later entries are fallbacks used when the preferred detector cannot produce graph data.\n") + b.WriteString("- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. That downloads packages and modifies the filesystem; see [Detectors](../DETECTORS.md#install-first).\n") + b.WriteString("- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors never choose the final action or change project files.\n") + b.WriteString("- Every ecosystem and package manager, native or not, is listed in the [Support matrix](../SUPPORT_MATRIX.md).\n") return b.String() } -func remediationActionsForEntries(entries []registry.PackageManagerSupport) []sdk.RemediationAction { - seen := map[sdk.RemediationAction]struct{}{} +func renderSyftMarkdown(entries []registry.PackageManagerSupport) string { + var b strings.Builder + b.WriteString("# Syft fallback\n\n") + b.WriteString(generatedBanner + "\n\n") + b.WriteString("Bomly bundles [Syft](https://github.com/anchore/syft) as the catch-all detector. It runs when no native detector applies, which is how Bomly covers OS package databases and ecosystems without a native graph resolver.\n\n") + b.WriteString("| Property | Value |\n") + b.WriteString("| --- | --- |\n") + b.WriteString("| Detector | `" + rootdetectors.NameSyft + "` |\n") + b.WriteString("| Graph shape | Flat package list — no dependency edges |\n") + _, _ = fmt.Fprintf(&b, "| Package managers covered | %d (below) |\n", len(entries)) + b.WriteString("| Install-first support | No |\n") + b.WriteString("| Remediation hints | None |\n") + + b.WriteString("\n## Package managers covered\n\n") + b.WriteString("These have no native Bomly detector — Syft is the only chain entry.\n\n") + b.WriteString("| Ecosystem | Package manager | Evidence patterns |\n") + b.WriteString("| --- | --- | --- |\n") for _, entry := range entries { - for _, action := range remediationActionsForDetectorChain(entry.Detectors, entry.Manager) { - seen[action] = struct{}{} - } - } - ordered := []sdk.RemediationAction{ - sdk.RemediationActionDirectBump, - sdk.RemediationActionTransitiveOverride, - sdk.RemediationActionLockfileRefresh, + _, _ = fmt.Fprintf(&b, "| `%s` | `%s` | %s |\n", + entry.Ecosystem, + entry.Manager.Name(), + codeListOrDash(entry.EvidencePatterns), + ) } - result := make([]sdk.RemediationAction, 0, len(seen)) - for _, action := range ordered { - if _, ok := seen[action]; ok { - result = append(result, action) + + b.WriteString("\n## Container operating systems\n\n") + b.WriteString("Syft also identifies the base OS of a container image, which is where its package database catalogers come from.\n\n") + b.WriteString("| OS family | Cataloger | Version source |\n") + b.WriteString("| --- | --- | --- |\n") + for _, os := range registry.SupportedOperatingSystems() { + name := os.Name + if len(os.Aliases) > 0 { + name += " (" + strings.Join(os.Aliases, ", ") + ")" } + _, _ = fmt.Fprintf(&b, "| %s | `%s` | %s |\n", name, os.Provider, os.VersionSource) } - return result + + if prose := loadProse("detectors", "syft"); prose != "" { + b.WriteString("\n") + b.WriteString(prose) + } + return b.String() } func renderPackageManagerMarkdown(ecosystem sdk.Ecosystem, entry registry.PackageManagerSupport) string { name := entry.Manager.Name() var b strings.Builder - _, _ = fmt.Fprintf(&b, "# `%s` (%s ecosystem)\n\n", name, ecosystem) + // Plain name as the H1: it's what the landing page uses for the sidebar + // entry, and the ecosystem is the next row of the table below. + _, _ = fmt.Fprintf(&b, "# %s\n\n", name) b.WriteString(generatedBanner + "\n\n") _, _ = fmt.Fprintf(&b, "Bomly uses this chain when it finds `%s` evidence.\n\n", name) b.WriteString("| Property | Value |\n") diff --git a/internal/support/generate_test.go b/internal/support/generate_test.go index 5e427f14..ef556dea 100644 --- a/internal/support/generate_test.go +++ b/internal/support/generate_test.go @@ -99,13 +99,15 @@ func TestRenderComponentDocs_IncludeGeneratedGuides(t *testing.T) { filepath.Join(tmp, "DETECTORS.md"), filepath.Join(tmp, "MATCHERS.md"), filepath.Join(tmp, "AUDITORS.md"), - filepath.Join(tmp, "detectors", "ecosystems", "README.md"), - filepath.Join(tmp, "detectors", "ecosystems", "go", "README.md"), - filepath.Join(tmp, "detectors", "ecosystems", "go", "gomod.md"), - filepath.Join(tmp, "detectors", "ecosystems", "npm", "npm.md"), - filepath.Join(tmp, "detectors", "ecosystems", "npm", "pnpm.md"), - filepath.Join(tmp, "detectors", "ecosystems", "npm", "yarn.md"), - filepath.Join(tmp, "detectors", "ecosystems", "python", "pip.md"), + filepath.Join(tmp, "detectors", "README.md"), + filepath.Join(tmp, "detectors", "go", "gomod.md"), + filepath.Join(tmp, "detectors", "npm", "npm.md"), + filepath.Join(tmp, "detectors", "npm", "pnpm.md"), + filepath.Join(tmp, "detectors", "npm", "yarn.md"), + filepath.Join(tmp, "detectors", "python", "pip.md"), + // Every Syft-only package manager shares this one page rather than + // getting a near-identical page each. + filepath.Join(tmp, "detectors", "syft.md"), filepath.Join(tmp, "matchers", "osv.md"), filepath.Join(tmp, "auditors", "README.md"), filepath.Join(tmp, "auditors", "vulnerability.md"), diff --git a/internal/support/prose/README.md b/internal/support/prose/README.md index 4cb6a088..8277af55 100644 --- a/internal/support/prose/README.md +++ b/internal/support/prose/README.md @@ -65,7 +65,7 @@ Skip any section that's truly not applicable. Don't pad. 1. Edit or add a file under `prose/detectors/` or `prose/matchers/`. 2. Run `make generate`. 3. The new content appears at the bottom of the corresponding - `docs/detectors/ecosystems/.md` or `docs/matchers/.md`. + `docs/detectors/.md` or `docs/matchers/.md`. 4. Commit both the prose file and the regenerated docs. The embed is done via `//go:embed all:prose` in diff --git a/internal/support/prose/detectors/gradle.md b/internal/support/prose/detectors/gradle.md index 5bbabb80..b459ce18 100644 --- a/internal/support/prose/detectors/gradle.md +++ b/internal/support/prose/detectors/gradle.md @@ -76,7 +76,7 @@ Re-lock and re-scan. > **Experimental.** Reachability is opt-in via `--analyze`. The feature is stable in shape but may evolve; ecosystem coverage is expanding. -For Gradle packages, the analyzer is `jvmreach` at **Tier-3 (package)** — same caveats as Maven. See [REACHABILITY.md](../../../REACHABILITY.md#unreachable-is-not-safe). +For Gradle packages, the analyzer is `jvmreach` at **Tier-3 (package)** — same caveats as Maven. See [REACHABILITY.md](../../REACHABILITY.md#unreachable-is-not-safe). For multi-project builds, `jvmreach` reads standard `include(...)` declarations and `projectDir` overrides automatically. Dynamically computed settings and composite `includeBuild` closures remain best-effort. diff --git a/internal/support/prose/detectors/maven.md b/internal/support/prose/detectors/maven.md index 497df3bc..6e8a6d04 100644 --- a/internal/support/prose/detectors/maven.md +++ b/internal/support/prose/detectors/maven.md @@ -83,7 +83,7 @@ Re-scan. > **Experimental.** Reachability is opt-in via `--analyze`. The feature is stable in shape but may evolve; ecosystem coverage is expanding. -For Maven packages, the analyzer is `jvmreach` at **Tier-3 (package)**. It walks `.java`, `.kt`, `.kts`, `.scala`, `.groovy` source files under the project root, parses top-of-file `import` statements, and maps fully-qualified-name prefixes to Maven coordinates via a curated longest-prefix map. See [REACHABILITY.md](../../../REACHABILITY.md#unreachable-is-not-safe). +For Maven packages, the analyzer is `jvmreach` at **Tier-3 (package)**. It walks `.java`, `.kt`, `.kts`, `.scala`, `.groovy` source files under the project root, parses top-of-file `import` statements, and maps fully-qualified-name prefixes to Maven coordinates via a curated longest-prefix map. See [REACHABILITY.md](../../REACHABILITY.md#unreachable-is-not-safe). For multi-module reactors, `jvmreach` reads parent `` declarations recursively and follows source namespace imports between consumed sibling modules before attributing external artifacts. diff --git a/internal/support/prose/detectors/npm.md b/internal/support/prose/detectors/npm.md index 6217654b..77bd5b8b 100644 --- a/internal/support/prose/detectors/npm.md +++ b/internal/support/prose/detectors/npm.md @@ -75,7 +75,7 @@ bomly explain lodash --path ./monorepo > **Experimental.** Reachability is opt-in via `--analyze`. The feature is stable in shape but may evolve; ecosystem coverage is expanding. -For npm packages, the analyzer is `jsreach` at **Tier-3 (package)**. It walks app source from `package.json` entry points and reports a package as reachable when there is any path from app source to that package through the npm dep graph. See [REACHABILITY.md](../../../REACHABILITY.md#unreachable-is-not-safe) — Tier-3 "unreachable" is a triage signal, not a safety guarantee. +For npm packages, the analyzer is `jsreach` at **Tier-3 (package)**. It walks app source from `package.json` entry points and reports a package as reachable when there is any path from app source to that package through the npm dep graph. See [REACHABILITY.md](../../REACHABILITY.md#unreachable-is-not-safe) — Tier-3 "unreachable" is a triage signal, not a safety guarantee. In workspace monorepos, `jsreach` automatically follows imports between consumed sibling packages by workspace package name. Unused siblings do not widen the reachable set. diff --git a/internal/support/prose/detectors/pip.md b/internal/support/prose/detectors/pip.md index edf73578..af6dd3f0 100644 --- a/internal/support/prose/detectors/pip.md +++ b/internal/support/prose/detectors/pip.md @@ -90,7 +90,7 @@ installs. Missing or malformed source data stays unknown. > **Experimental.** Reachability is opt-in via `--analyze`. The feature is stable in shape but may evolve; ecosystem coverage is expanding. -For pip-managed packages, the analyzer is `pyreach` at **Tier-3 (package)**. It walks every `.py` file under the project root, records imports, and maps module names to PyPI distribution names. See [REACHABILITY.md](../../../REACHABILITY.md#unreachable-is-not-safe) and the module-to-distribution map in `internal/analyzers/pyreach/moduletodist.go`. +For pip-managed packages, the analyzer is `pyreach` at **Tier-3 (package)**. It walks every `.py` file under the project root, records imports, and maps module names to PyPI distribution names. See [REACHABILITY.md](../../REACHABILITY.md#unreachable-is-not-safe) and the module-to-distribution map in `internal/analyzers/pyreach/moduletodist.go`. ## Limitations diff --git a/internal/support/prose/detectors/pipenv.md b/internal/support/prose/detectors/pipenv.md index f6872cc7..aa820bf3 100644 --- a/internal/support/prose/detectors/pipenv.md +++ b/internal/support/prose/detectors/pipenv.md @@ -53,7 +53,7 @@ When Pipenv uses pip inspection, Bomly uses pip's `direct_url` record instead. > **Experimental.** Reachability is opt-in via `--analyze`. The feature is stable in shape but may evolve; ecosystem coverage is expanding. -For Pipenv-managed packages, the analyzer is `pyreach` at **Tier-3 (package)**. See [REACHABILITY.md](../../../REACHABILITY.md#unreachable-is-not-safe). +For Pipenv-managed packages, the analyzer is `pyreach` at **Tier-3 (package)**. See [REACHABILITY.md](../../REACHABILITY.md#unreachable-is-not-safe). ## Limitations diff --git a/internal/support/prose/detectors/pnpm.md b/internal/support/prose/detectors/pnpm.md index 8727b516..f785865e 100644 --- a/internal/support/prose/detectors/pnpm.md +++ b/internal/support/prose/detectors/pnpm.md @@ -62,7 +62,7 @@ Bomly scans each pnpm workspace as a separate subproject. `injected: true` depen > **Experimental.** Reachability is opt-in via `--analyze`. The feature is stable in shape but may evolve; ecosystem coverage is expanding. -For pnpm packages, the analyzer is `jsreach` at **Tier-3 (package)** — same caveats as npm. See [REACHABILITY.md](../../../REACHABILITY.md#unreachable-is-not-safe). +For pnpm packages, the analyzer is `jsreach` at **Tier-3 (package)** — same caveats as npm. See [REACHABILITY.md](../../REACHABILITY.md#unreachable-is-not-safe). `jsreach` reads `pnpm-workspace.yaml` package patterns automatically and follows imports between consumed sibling packages without depending on installed symlinks. diff --git a/internal/support/prose/detectors/poetry.md b/internal/support/prose/detectors/poetry.md index 9e4e7714..1bc646a9 100644 --- a/internal/support/prose/detectors/poetry.md +++ b/internal/support/prose/detectors/poetry.md @@ -74,7 +74,7 @@ Bomly reads registry, Git, URL, and local-directory sources from each > **Experimental.** Reachability is opt-in via `--analyze`. The feature is stable in shape but may evolve; ecosystem coverage is expanding. -For Poetry-managed packages, the analyzer is `pyreach` at **Tier-3 (package)**. See [REACHABILITY.md](../../../REACHABILITY.md#unreachable-is-not-safe). +For Poetry-managed packages, the analyzer is `pyreach` at **Tier-3 (package)**. See [REACHABILITY.md](../../REACHABILITY.md#unreachable-is-not-safe). ## Limitations diff --git a/internal/support/prose/detectors/syft.md b/internal/support/prose/detectors/syft.md new file mode 100644 index 00000000..41fdce06 --- /dev/null +++ b/internal/support/prose/detectors/syft.md @@ -0,0 +1,35 @@ +## What Syft gives you + +Syft catalogs packages by pattern-matching files: OS package databases, installed-package manifests, and lockfiles it recognizes. It reports what is present, not how those packages relate to each other. + +That difference matters for the rest of the pipeline: + +- `bomly explain` needs edges to walk a path from your project to a package. Syft-catalogued packages have no edges, so there is no path to show. +- Scope filters like `--direct-only` rely on the direct/transitive distinction, which comes from the graph. Syft results carry no such distinction. +- Vulnerability and license enrichment work normally — matchers key off the package coordinates, which Syft does provide. + +## When Syft runs + +Syft is the last entry in almost every detector chain. It runs when the native detector ahead of it cannot produce graph data — no lockfile present, the build tool is missing from `PATH`, or the ecosystem has no native detector at all. + +For container images it does most of the work: Bomly scans the layers, and native detectors only apply where a recognizable lockfile made it into the image. + +## Turning it off + +Syft is a normal detector, so the standard selector grammar applies: + +```bash +# Drop the Syft fallback — native detectors only +bomly scan --detectors -syft-detector + +# Use only Syft +bomly scan --detectors syft-detector +``` + +Dropping Syft means a project it was covering resolves nothing, and the scan exits 3 with "no detector chain produced a graph". That is usually what you want in CI when a flat package list would pass a gate that a real graph would fail. + +## See also + +- [Support matrix](../SUPPORT_MATRIX.md) — every ecosystem and package manager, native and Syft-backed +- [Scan targets](../SCAN_TARGETS.md) — container images and the other input shapes Syft handles +- [Detectors](../DETECTORS.md) — chains, selection, and the native-vs-Syft comparison diff --git a/internal/support/prose/detectors/uv.md b/internal/support/prose/detectors/uv.md index 1c768c38..df3cef63 100644 --- a/internal/support/prose/detectors/uv.md +++ b/internal/support/prose/detectors/uv.md @@ -79,7 +79,7 @@ package source table. An entry without source evidence stays unknown. > **Experimental.** Reachability is opt-in via `--analyze`. The feature is stable in shape but may evolve; ecosystem coverage is expanding. -For uv-managed packages, the analyzer is `pyreach` at **Tier-3 (package)**. See [REACHABILITY.md](../../../REACHABILITY.md#unreachable-is-not-safe). +For uv-managed packages, the analyzer is `pyreach` at **Tier-3 (package)**. See [REACHABILITY.md](../../REACHABILITY.md#unreachable-is-not-safe). ## Limitations diff --git a/internal/support/prose/detectors/yarn.md b/internal/support/prose/detectors/yarn.md index 1e03a01c..c83a4387 100644 --- a/internal/support/prose/detectors/yarn.md +++ b/internal/support/prose/detectors/yarn.md @@ -64,7 +64,7 @@ Bomly walks Berry workspaces and scans each as a subproject. Plug-and-Play (`.pn > **Experimental.** Reachability is opt-in via `--analyze`. The feature is stable in shape but may evolve; ecosystem coverage is expanding. -For Yarn packages, the analyzer is `jsreach` at **Tier-3 (package)** — same caveats as npm. See [REACHABILITY.md](../../../REACHABILITY.md#unreachable-is-not-safe). +For Yarn packages, the analyzer is `jsreach` at **Tier-3 (package)** — same caveats as npm. See [REACHABILITY.md](../../REACHABILITY.md#unreachable-is-not-safe). `jsreach` reads workspace arrays and Yarn-style `workspaces.packages` objects automatically, then follows imports between consumed sibling packages by package name.