This is a list of major changes in inspector-sbomgen's version history.

---------------------------------------------------------------------------
1.3.1 - July 15th 2024
---------------------------------------------------------------------------
* On RPM-based systems, source packages have been moved from components to Package URL qualifiers to reduce false positives in some cases.
* Fixed issue that would sometimes result in a crash when using the --skip-files argument while processing a container image.
* Clarified console log message when processing a Ruby gemspec file that contains unsupported or malformed package names or version numbers

---------------------------------------------------------------------------
1.3.0 - July 9th 2024
---------------------------------------------------------------------------
* sbomgen can now scan zstd and bzip2 compressed archives
* sbomgen can now scan Apache httpd installations
* sbomgen can now scan Oracle JDK installations
* sbomgen can now scan stand alone files when using the directory sub-command, for example:
    ./inspector-sbomgen directory --path /path/to/Dockerfile
* Improved handling of directories and relative paths when using the directory and localhost sub-commands
* Improved processing of Gemfile.lock files with multi-Gem sections
* Improved handling of whiteout files in container images


---------------------------------------------------------------------------
1.2.1 - June 14th 2024
---------------------------------------------------------------------------
* Improved detection of C# packages.config files

---------------------------------------------------------------------------
1.2.0 - June 4th 2024
---------------------------------------------------------------------------

* sbomgen can now scan stand alone Dockerfiles, as well as build history from pre-built container images, for common security misconfigurations.

* sbomgen now collects development dependencies from Pipfile.lock

* The following sbomgen properties are no longer displayed by default; to display these debug properties, add the following argument to your sbomgen commands: --enable-debug-props
    * amazon:inspector:sbom_generator:source_file_scanner
    * amazon:inspector:sbom_generator:source_package_collector

* Ubuntu source packages are now listed as components under their parent package, rather than being listed as stand alone components.

* Debian source packages now include a PURL qualifier listing the source package parent, for example:
    * pkg:deb/debian/sysvinit-utils@3.06-4?arch=amd64&distro=bookworm&epoch=0&source=sysvinit

* Resolved a bug that would, in some cases, prevent sbomgen from properly unpacking zip archives.

---------------------------------------------------------------------------
1.1.1 - April 22nd 2024
---------------------------------------------------------------------------

* Added property to identify kernel-specific SBOM components:

    {
      "purl": "pkg:rpm/amazon/kernel-livepatch-4.14.203-156.332@1.0-0.amzn2?arch=x86_64&distro=2&epoch=0",
      "properties": [
        {
          "name": "amazon:inspector:sbom_generator:kernel",
          "value": "true"
        }
      ]
    }

* Sbomgen now provides module stream information in rpm-based package URLs with 'stream=' qualifier
* Minor accuracy improvements to Go package collector
* Minor accuracy improvements to Java package collector
* Updated sbomgen's package dependencies
* Fixed issue that caused sbomgen to fail to generate its own SHA-256 hash if invoked from a relative path
* Fixed issue that caused sbomgen to fail when scanning container images that do not contain /etc/os-release, such as scratch images


---------------------------------------------------------------------------
1.1.0 - February 15th 2024
---------------------------------------------------------------------------

* inspector-sbomgen can now send SBOMs to Amazon Inspector for vulnerability identification:

    ./inspector-sbomgen container --image alpine:latest \
                                  --scan-sbom \
                                  --aws-profile <your_profile> \
                                  --aws-region <your_region> \
                                  --outfile /tmp/alpine_scan.json

note: you can optionally authenticate to AWS and Inspector using an IAM role:

    ./inspector-sbomgen container --image alpine:latest \
                                  --scan-sbom \
                                  --aws-profile <your_profile> \
                                  --aws-region <your_region> \
                                  --aws-iam-role-arn arn:aws:iam::123456789012:role/your_role


* inspector-sbomgen can now generate SBOMs from directories and archives (.zip, .tar, and .tar.gz):

   ./inspector-sbomgen directory --path /path/to/directory

   ./inspector-sbomgen archive --path /path/to/archive

* inspector-sbomgen can now generate SBOMs from compiled Go and Rust binaries. Packed or obfuscated binaries are not supported:

  ./inspector-sbomgen binary --path /path/to/binary

* Added OS component to container SBOMs

* Removed deprecated tools object from CycloneDX metadata, and replaced with updated v1.5 tools object

* Fixed issue that caused abnormally high RAM consumption on container images that contain very large files
