You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tooling.apache.org by ar...@apache.org on 2026/09/30 14:32:55 UTC
(tooling-trusted-releases) branch arm updated: #1621 - update syft
This is an automated email from the ASF dual-hosted git repository.
alitheg pushed a commit to branch arm
in repository https://gitbox.apache.org/repos/asf/tooling-trusted-releases.git
The following commit(s) were added to refs/heads/arm by this push:
new 688cda99 #1621 - update syft
688cda99 is described below
commit 688cda990642e3ac9bb8235b55879e3d78f36a0c
Author: Alastair McFarlane <ar...@apache.org>
AuthorDate: Wed Sep 30 15:32:30 2026 +0100
#1621 - update syft
---
Dockerfile.alpine | 6 +++---
atr/docs/dependency-updates.md | 2 +-
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/Dockerfile.alpine b/Dockerfile.alpine
index 99e39590..55d8ce4f 100644
--- a/Dockerfile.alpine
+++ b/Dockerfile.alpine
@@ -65,10 +65,10 @@ RUN set -eux; \
rm -rf /tmp/apache-rat
# WORKDIR /var/run
-ENV SYFT_VERSION=1.51.1
+ENV SYFT_VERSION=1.52.0
ENV SYFT_INSTALL_SHA256=ea054f8b6754db17d34129482ecda1ab733cadab57c1c9202bbe98eb5fe18d24
-ENV SYFT_SHA256_amd64=abca2def61de9952fa06d3977bb1e064818facb9badfce502b450d3d6846a91f
-ENV SYFT_SHA256_arm64=617cef943234e0cae184b4901414ca4059ad6c6923a9c9decb46f49f6a2c6573
+ENV SYFT_SHA256_amd64=15a52d0122953081d16e6695f48055216a4de293bb005948663bb739a63880f9
+ENV SYFT_SHA256_arm64=27563e0bee8b2f4c938e1d5a8c3391cf7f4b2481aec2eb74778d0d9ec4fffadc
# RUN GOPATH=/usr/local go install github.com/anchore/syft/cmd/syft@v${SYFT_VERSION}
# Faster than a go-install; the resulting binary is pinned by SHA after install
RUN case "$TARGETARCH" in \
diff --git a/atr/docs/dependency-updates.md b/atr/docs/dependency-updates.md
index cd5d3c45..e05746a2 100644
--- a/atr/docs/dependency-updates.md
+++ b/atr/docs/dependency-updates.md
@@ -89,7 +89,7 @@ time, each pinned to a specific version in
* **Apache RAT** (`0.18`) - downloaded from the ASF distribution mirrors and
checked against the published `.sha512` checksum.
-* **syft** (`1.51.1`) - installed through the pinned upstream `install.sh`, which
+* **syft** (`1.52.0`) - installed through the pinned upstream `install.sh`, which
is itself verified against a recorded sha256; the resulting binary is then
verified against a per-architecture sha256.
* **cyclonedx-cli** (`0.33.1`) - downloaded as a per-architecture release asset
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org