This is a list of major changes in inspector-sbomgen's version history.

---------------------------------------------------------------------------
1.2.0 - June 4th 2024
---------------------------------------------------------------------------

* sbomgen can now scan stand alone Dockerfiles, as well as build history from pre-built container images, for common security misconfigurations.

* sbomgen now collects development dependencies from Pipfile.lock

* The following sbomgen properties are no longer displayed by default; to display these debug properties, add the following argument to your sbomgen commands: --enable-debug-props
    * amazon:inspector:sbom_generator:source_file_scanner
    * amazon:inspector:sbom_generator:source_package_collector

* Ubuntu source packages are now listed as components under their parent package, rather than being listed as stand alone components.

* Debian source packages now include a PURL qualifier listing the source package parent, for example:
    * pkg:deb/debian/sysvinit-utils@3.06-4?arch=amd64&distro=bookworm&epoch=0&source=sysvinit

* Resolved a bug that would, in some cases, prevent sbomgen from properly unpacking zip archives.

---------------------------------------------------------------------------
1.1.1 - April 22nd 2024
---------------------------------------------------------------------------

* Added property to identify kernel-specific SBOM components:

    {
      "purl": "pkg:rpm/amazon/kernel-livepatch-4.14.203-156.332@1.0-0.amzn2?arch=x86_64&distro=2&epoch=0",
      "properties": [
        {
          "name": "amazon:inspector:sbom_generator:kernel",
          "value": "true"
        }
      ]
    }

* Sbomgen now provides module stream information in rpm-based package URLs with 'stream=' qualifier
* Minor accuracy improvements to Go package collector
* Minor accuracy improvements to Java package collector
* Updated sbomgen's package dependencies
* Fixed issue that caused sbomgen to fail to generate its own SHA-256 hash if invoked from a relative path
* Fixed issue that caused sbomgen to fail when scanning container images that do not contain /etc/os-release, such as scratch images


---------------------------------------------------------------------------
1.1.0 - February 15th 2024
---------------------------------------------------------------------------

* inspector-sbomgen can now send SBOMs to Amazon Inspector for vulnerability identification:

    ./inspector-sbomgen container --image alpine:latest \
                                  --scan-sbom \
                                  --aws-profile <your_profile> \
                                  --aws-region <your_region> \
                                  --outfile /tmp/alpine_scan.json

note: you can optionally authenticate to AWS and Inspector using an IAM role:

    ./inspector-sbomgen container --image alpine:latest \
                                  --scan-sbom \
                                  --aws-profile <your_profile> \
                                  --aws-region <your_region> \
                                  --aws-iam-role-arn arn:aws:iam::123456789012:role/your_role


* inspector-sbomgen can now generate SBOMs from directories and archives (.zip, .tar, and .tar.gz):

   ./inspector-sbomgen directory --path /path/to/directory

   ./inspector-sbomgen archive --path /path/to/archive

* inspector-sbomgen can now generate SBOMs from compiled Go and Rust binaries. Packed or obfuscated binaries are not supported:

  ./inspector-sbomgen binary --path /path/to/binary

* Added OS component to container SBOMs

* Removed deprecated tools object from CycloneDX metadata, and replaced with updated v1.5 tools object

* Fixed issue that caused abnormally high RAM consumption on container images that contain very large files
