https://github.com/anchore/syft

containers cyclonedx docker go golang hacktoberfest oci sbom spdx static-analysis tool

Score: 34.22871032990069

Last synced: about 6 hours ago
JSON representation

Repository metadata:

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

Host: GitHub
URL: https://github.com/anchore/syft
Owner: anchore
License: apache-2.0
Created: 2020-05-07T18:19:29.000Z (over 6 years ago)
Default Branch: main
Last Pushed: 2026-09-30T13:08:16.000Z (2 days ago)
Last Synced: 2026-09-30T13:19:20.954Z (2 days ago)
Topics: containers, cyclonedx, docker, go, golang, hacktoberfest, oci, sbom, spdx, static-analysis, tool
Language: Go
Homepage:
Size: 25.5 MB
Stars: 9,628
Watchers: 74
Forks: 976
Open Issues: 653
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
- Security: SECURITY.md

Owner metadata:

Name: Anchore, Inc.
Login: anchore
Email: info@anchore.com
Kind: organization
Description:
Website: https://anchore.com/
Location:
Twitter:
Company:
Icon url: https://avatars.githubusercontent.com/u/16208487?v=4
Repositories: 111
Last Synced at: 2026-10-01T23:42:31.297Z
Profile URL: https://github.com/anchore

GitHub Events

Total

Create event: 586
Delete event: 569
Fork event: 171
Gollum event: 3
Issue comment event: 1129
Issues event: 398
Pull request event: 1268
Pull request review comment event: 562
Pull request review event: 1136
Push event: 1199
Release event: 22
Watch event: 1604
Total: 8647

Last Year

Create event: 145
Delete event: 128
Fork event: 32
Issue comment event: 140
Issues event: 97
Pull request event: 239
Pull request review comment event: 113
Pull request review event: 162
Push event: 348
Release event: 4
Watch event: 333
Total: 1741

Committers metadata

Last synced: 1 day ago

Total Commits: 3,456
Total Committers: 280
Avg Commits per committer: 12.343
Development Distribution Score (DDS): 0.754

Commits in past year: 618
Committers in past year: 102
Avg Commits per committer in past year: 6.059
Development Distribution Score (DDS) in past year: 0.662

Name	Email	Commits
dependabot[bot]	4****]	850
Alex Goodman	w****n	767
anchore-actions-token-generator[bot]	1****]	383
Christopher Angelo Phillips	3****s	217
Keith Zantow	k**w@g**m	196
Alfredo Deza	a**a@a**m	107
Dan Luhring	l****g	100
Weston Steimel	w**l@a**m	87
Will Murphy	w****e	86
witchcraze	6****e	37
Laurent Goderre	l**e@d**m	37
anchore-oss-update-bot	a**t@a**m	35
Jonas Xavier	j**x@g**m	28
Rez Moss	h**i@r**m	25
Colm O hEigeartaigh	c****a	20
cpendery	3****y	15
Alan Pope	a**e@a**m	13
Toure Dunnon	t**n@a**m	13
VictorHuu	v**3@g**m	10
Benji Visser	b**i@0**g	9
Sambhav Kothari	s**4@b**t	8
Avi Deitcher	d****h	8
Justin Chadwell	m**e@j**m	7
Marc-Etienne Vargenau	m**u@n**m	7
Samuel Dacanay	s**y@a**m	7
mikey strauss	m**1@g**m	7
Shane Dell	3****l	7
Tom Fay	t**y@m**m	6
Adam McClenaghan	a**m@m**k	6
GGMU	4****n	6
and 250 more...

Issue and Pull Request metadata

Last synced: 1 day ago

Total issues: 802
Total pull requests: 2,478
Average time to close issues: 5 months
Average time to close pull requests: 11 days
Total issue authors: 431
Total pull request authors: 233
Average comments per issue: 2.09
Average comments per pull request: 0.56
Merged pull request: 1,803
Bot issues: 11
Bot pull requests: 1,228

Past year issues: 68
Past year pull requests: 231
Past year average time to close issues: about 1 month
Past year average time to close pull requests: 23 days
Past year issue authors: 56
Past year pull request authors: 92
Past year average comments per issue: 1.0
Past year average comments per pull request: 0.97
Past year merged pull request: 97
Past year bot issues: 0
Past year bot pull requests: 40

More stats: https://issues.ecosyste.ms/repositories/lookup?url=https://github.com/anchore/syft

Top Issue Authors

wagoodman (75)
kzantow (42)
witchcraze (34)
spiffcs (22)
willmurphyscode (16)
tomerse-sg (11)
westonsteimel (10)
joshbressers (8)
tomersein (8)
vargenau (8)
luhring (8)
rezmoss (7)
popey (7)
anchore-actions-token-generator[bot] (6)
deitch (6)

Top Pull Request Authors

dependabot[bot] (836)
anchore-actions-token-generator[bot] (392)
wagoodman (262)
kzantow (132)
spiffcs (120)
willmurphyscode (79)
LaurentGoderre (56)
westonsteimel (51)
coheigea (20)
witchcraze (19)
popey (19)
VictorHuu (18)
anchore-oss-update-bot (16)
rezmoss (15)
tomersein (15)

Top Issue Labels

bug (403)
enhancement (309)
good-first-issue (35)
changelog-ignore (28)
new-cataloger (24)
question (16)
breaking-change (16)
good first issue (13)
license (13)
binary-analysis (13)
needs-investigation (11)
dependencies (11)
needs-discussion (8)
ecosystem:java (7)
needs-research (7)
format:spdx (6)
release (5)
format:cyclonedx (5)
ecosystem:windows (5)
ecosystem:python (5)
json (4)
ecosystem:go (4)
documentation (4)
ecosystem:dotnet (3)
cpe (3)
online (3)
I/O (3)
blocked (3)
unknowns (3)
duplicate (3)

Top Pull Request Labels

dependencies (1,234)
bug (153)
enhancement (118)
changelog-ignore (116)
go (108)
json-schema (66)
github_actions (56)
pre-release (21)
automation (16)
documentation (13)
breaking-change (12)
release (12)
python (11)
WIP (9)
needs-manual-review (7)
performance (7)
blocked (4)
binny (4)
needs-discussion (4)
ecosystem:php (3)
ecosystem:dotnet (2)
help-wanted (2)
.NET (2)
question (2)
license (2)
detected-breaking-change (2)
help wanted (1)
needs-tests (1)
java (1)
breaking change (1)

Package metadata

Total packages: 40
Total downloads:
- homebrew: 1,138 last-month
- conda: 13 total
Total docker downloads: 254,767,141
Total dependent packages: 217 (may contain duplicates)
Total dependent repositories: 180 (may contain duplicates)
Total versions: 1,345
Total maintainers: 4
Total advisories: 2

proxy.golang.org: github.com/anchore/syft

Homepage: https://github.com/anchore/syft
Documentation: https://pkg.go.dev/github.com/anchore/syft#section-documentation
Licenses: Apache-2.0
Latest release: v1.52.0 (published 15 days ago)
Last Synced: 2026-10-01T09:08:24.458Z (1 day ago)
Versions: 272
Dependent Packages: 217
Dependent Repositories: 179
Docker Downloads: 254,767,141
Rankings:
- Docker downloads count: 0.211%
- Dependent packages count: 0.334%
- Dependent repos count: 0.472%
- Average: 0.72%
- Stargazers count: 1.064%
- Forks count: 1.521%
Advisories:
- Syft improper temporary file cleanup
- Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set

alpine-v3.18: syft-fish-completion

Fish completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 0.84.1-r4 (published almost 3 years ago)
Last Synced: 2026-04-08T18:07:25.767Z (6 months ago)
Versions: 7
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 1.913%
- Stargazers count: 3.491%
- Forks count: 4.159%
Maintainers (1)
- michal@polanski.me

alpine-v3.18: syft-bash-completion

Bash completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 0.84.1-r4 (published almost 3 years ago)
Last Synced: 2026-04-17T13:05:03.096Z (6 months ago)
Versions: 7
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 1.913%
- Stargazers count: 3.491%
- Forks count: 4.159%
Maintainers (1)
- michal@polanski.me

alpine-v3.18: syft

Generate a Software Bill of Materials (SBOM) from container images and filesystems

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 0.84.1-r4 (published almost 3 years ago)
Last Synced: 2026-04-03T04:40:29.159Z (6 months ago)
Versions: 7
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 1.913%
- Stargazers count: 3.491%
- Forks count: 4.159%
Maintainers (1)
- michal@polanski.me

alpine-v3.18: syft-zsh-completion

Zsh completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 0.84.1-r4 (published almost 3 years ago)
Last Synced: 2026-04-09T03:02:45.282Z (6 months ago)
Versions: 7
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 1.913%
- Stargazers count: 3.491%
- Forks count: 4.159%
Maintainers (1)
- michal@polanski.me

proxy.golang.org: github.com/ANCHORE/syft

Homepage:
Documentation: https://pkg.go.dev/github.com/ANCHORE/syft#section-documentation
Licenses: apache-2.0
Latest release: v1.52.0 (published 13 days ago)
Last Synced: 2026-10-01T16:04:10.442Z (1 day ago)
Versions: 269
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent packages count: 5.017%
- Average: 5.186%
- Dependent repos count: 5.354%

proxy.golang.org: github.com/Anchore/syft

Homepage:
Documentation: https://pkg.go.dev/github.com/Anchore/syft#section-documentation
Licenses: apache-2.0
Latest release: v1.52.0 (published 15 days ago)
Last Synced: 2026-10-01T16:04:16.959Z (1 day ago)
Versions: 269
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent packages count: 5.255%
- Average: 5.431%
- Dependent repos count: 5.608%

alpine-edge: syft

Generate a Software Bill of Materials (SBOM) from container images and filesystems

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.46.0-r0 (published 3 months ago)
Last Synced: 2026-07-14T03:29:03.525Z (3 months ago)
Versions: 79
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Stargazers count: 3.698%
- Forks count: 5.636%
- Average: 5.994%
- Dependent packages count: 14.641%
Maintainers (1)
- michal@polanski.me

alpine-edge: syft-fish-completion

Fish completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.46.0-r0 (published 3 months ago)
Last Synced: 2026-07-14T03:29:07.677Z (3 months ago)
Versions: 69
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Average: 7.303%
- Dependent packages count: 14.607%
Maintainers (1)
- michal@polanski.me

alpine-edge: syft-bash-completion

Bash completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.46.0-r0 (published 3 months ago)
Last Synced: 2026-07-14T03:29:06.093Z (3 months ago)
Versions: 69
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Average: 7.303%
- Dependent packages count: 14.607%
Maintainers (1)
- michal@polanski.me

alpine-edge: syft-zsh-completion

Zsh completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.46.0-r0 (published 3 months ago)
Last Synced: 2026-07-14T03:29:09.275Z (3 months ago)
Versions: 69
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Average: 7.303%
- Dependent packages count: 14.607%
Maintainers (1)
- michal@polanski.me

alpine-v3.17: syft

Generate a Software Bill of Materials (SBOM) from container images and filesystems

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 0.77.0-r1 (published over 3 years ago)
Last Synced: 2026-04-01T03:49:06.013Z (6 months ago)
Versions: 6
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Stargazers count: 3.48%
- Forks count: 4.115%
- Average: 8.712%
- Dependent packages count: 27.254%
Maintainers (1)
- michal@polanski.me

formulae.brew.sh: syft

CLI for generating a Software Bill of Materials from container images

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.52.0 (published 15 days ago)
Last Synced: 2026-10-01T16:04:15.117Z (1 day ago)
Versions: 106
Dependent Packages: 0
Dependent Repositories: 1
Downloads: 1,138 Last month
Rankings:
- Stargazers count: 5.845%
- Forks count: 6.004%
- Downloads: 14.327%
- Average: 14.787%
- Dependent packages count: 18.441%
- Dependent repos count: 29.317%

anaconda.org: syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.51.1 (published about 1 month ago)
Last Synced: 2026-08-29T01:35:44.548Z (about 1 month ago)
Versions: 1
Dependent Packages: 0
Dependent Repositories: 0
Downloads: 13 Total
Rankings:
- Dependent packages count: 33.321%
- Dependent repos count: 36.332%
- Average: 47.47%
- Downloads: 72.755%

alpine-v3.19: syft-bash-completion

Bash completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 0.98.0-r3 (published over 2 years ago)
Last Synced: 2026-04-01T03:26:04.224Z (6 months ago)
Versions: 4
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

nixpkgs-24.05: syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

Homepage: https://github.com/anchore/syft
Documentation: https://github.com/NixOS/nixpkgs/blob/nixos-24.05/pkgs/by-name/sy/syft/package.nix#L77
Licenses: Apache-2.0
Latest release: 1.5.0 (published 8 months ago)
Last Synced: 2026-04-20T18:03:36.713Z (6 months ago)
Versions: 1
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (3)

alpine-v3.19: syft

Generate a Software Bill of Materials (SBOM) from container images and filesystems

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 0.98.0-r3 (published over 2 years ago)
Last Synced: 2026-04-01T03:23:31.062Z (6 months ago)
Versions: 4
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.20: syft-bash-completion

Bash completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.4.1-r2 (published about 2 years ago)
Last Synced: 2026-04-01T02:07:16.102Z (6 months ago)
Versions: 2
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

pkgsrc-netbsd-x86_64-10.1-all: devel/syft

Generate Software Bill of Materials from container images and file systems

Homepage: https://github.com/anchore/syft/
Documentation: https://pkgsrc.se/devel/syft
Licenses: apache-2.0
Latest release: 0.65.0nb32 (published 5 months ago)
Last Synced: 2026-05-27T06:49:08.054Z (4 months ago)
Versions: 1
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%

alpine-v3.21: syft

Generate a Software Bill of Materials (SBOM) from container images and filesystems

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.19.0-r5 (published over 1 year ago)
Last Synced: 2026-04-01T01:42:35.352Z (6 months ago)
Versions: 8
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.23: syft-zsh-completion

Zsh completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.38.0-r3 (published 8 months ago)
Last Synced: 2026-04-09T01:08:56.658Z (6 months ago)
Versions: 2
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

nixpkgs-24.11: syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

Homepage: https://github.com/anchore/syft
Documentation: https://github.com/NixOS/nixpkgs/blob/nixos-24.11/pkgs/by-name/sy/syft/package.nix#L77
Licenses: Apache-2.0
Latest release: 1.18.0 (published 8 months ago)
Last Synced: 2026-09-13T09:28:20.097Z (20 days ago)
Versions: 1
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (3)

nixpkgs-unstable: syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

Homepage: https://github.com/anchore/syft
Documentation: https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/by-name/sy/syft/package.nix#L78
Licenses: Apache-2.0
Latest release: 1.42.1 (published 7 months ago)
Last Synced: 2026-04-12T17:03:45.537Z (6 months ago)
Versions: 3
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (3)

alpine-v3.21: syft-fish-completion

Fish completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.19.0-r5 (published over 1 year ago)
Last Synced: 2026-04-01T01:46:28.014Z (6 months ago)
Versions: 8
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.19: syft-zsh-completion

Zsh completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 0.98.0-r3 (published over 2 years ago)
Last Synced: 2026-09-06T02:27:19.794Z (27 days ago)
Versions: 4
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.21: syft-zsh-completion

Zsh completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.19.0-r5 (published over 1 year ago)
Last Synced: 2026-09-20T00:28:43.720Z (13 days ago)
Versions: 8
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.19: syft-fish-completion

Fish completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 0.98.0-r3 (published over 2 years ago)
Last Synced: 2026-04-01T03:26:47.573Z (6 months ago)
Versions: 4
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.23: syft

Generate a Software Bill of Materials (SBOM) from container images and filesystems

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.38.0-r3 (published 8 months ago)
Last Synced: 2026-04-09T01:08:30.799Z (6 months ago)
Versions: 2
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

nixpkgs-23.11: syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

Homepage: https://github.com/anchore/syft
Documentation: https://github.com/NixOS/nixpkgs/blob/nixos-23.11/pkgs/tools/admin/syft/default.nix#L71
Licenses: Apache-2.0
Latest release: 0.97.1 (published 8 months ago)
Last Synced: 2026-08-13T08:30:37.805Z (about 2 months ago)
Versions: 1
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (3)

nixpkgs-23.05: syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

Homepage: https://github.com/anchore/syft
Documentation: https://github.com/NixOS/nixpkgs/blob/nixos-23.05/pkgs/tools/admin/syft/default.nix#L71
Licenses: Apache-2.0
Latest release: 0.80.0 (published 8 months ago)
Last Synced: 2026-04-13T11:29:35.423Z (6 months ago)
Versions: 1
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (2)
- 06kellyjac
- developer-guy

alpine-v3.22: syft-bash-completion

Bash completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.31.0-r4 (published 9 months ago)
Last Synced: 2026-04-01T01:56:18.675Z (6 months ago)
Versions: 9
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.22: syft-fish-completion

Fish completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.31.0-r4 (published 9 months ago)
Last Synced: 2026-04-01T01:55:50.841Z (6 months ago)
Versions: 9
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.20: syft-zsh-completion

Zsh completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.4.1-r2 (published about 2 years ago)
Last Synced: 2026-04-01T02:04:40.041Z (6 months ago)
Versions: 2
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.22: syft

Generate a Software Bill of Materials (SBOM) from container images and filesystems

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.31.0-r4 (published 9 months ago)
Last Synced: 2026-04-01T01:57:14.724Z (6 months ago)
Versions: 9
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.20: syft

Generate a Software Bill of Materials (SBOM) from container images and filesystems

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.4.1-r2 (published about 2 years ago)
Last Synced: 2026-04-01T02:06:15.632Z (6 months ago)
Versions: 2
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.22: syft-zsh-completion

Zsh completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.31.0-r4 (published 9 months ago)
Last Synced: 2026-04-01T01:56:19.551Z (6 months ago)
Versions: 9
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.23: syft-bash-completion

Bash completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.38.0-r3 (published 8 months ago)
Last Synced: 2026-04-09T01:08:56.568Z (6 months ago)
Versions: 2
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.21: syft-bash-completion

Bash completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.19.0-r5 (published over 1 year ago)
Last Synced: 2026-04-01T01:46:29.143Z (6 months ago)
Versions: 8
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.20: syft-fish-completion

Fish completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.4.1-r2 (published about 2 years ago)
Last Synced: 2026-04-01T02:08:19.965Z (6 months ago)
Versions: 2
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.23: syft-fish-completion

Fish completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.38.0-r3 (published 8 months ago)
Last Synced: 2026-04-13T00:08:18.415Z (6 months ago)
Versions: 2
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

Dependencies

.github/actions/bootstrap/action.yaml actions

actions/cache 704facf57e6136b1bc63b828d79edcd491f0ee84 composite
actions/setup-go 93397bea11091df50f3d7e59dc26a7711a8bcfbe composite

.github/workflows/release.yaml actions

./.github/actions/bootstrap * composite
8398a7/action-slack fbd6aa58ba854a740e11a35d0df80cb5d12101d8 composite
actions/checkout 3df4ab11eba7bda6032a0b82a6bb43b11571feac composite
anchore/sbom-action 78fc58e266e87a38d4194b2137a3d4e9bcaf7ca1 composite
docker/login-action 343f7c4344506bcbf9b4de18042ae17996df046d composite
fountainhead/action-wait-for-check 297be350cf8393728ea4d4b39435c7d7ae167c93 composite

.github/workflows/validations.yaml actions

./.github/actions/bootstrap * composite
actions/cache 704facf57e6136b1bc63b828d79edcd491f0ee84 composite
actions/cache/restore 704facf57e6136b1bc63b828d79edcd491f0ee84 composite
actions/cache/save 704facf57e6136b1bc63b828d79edcd491f0ee84 composite
actions/checkout 3df4ab11eba7bda6032a0b82a6bb43b11571feac composite

Dockerfile docker

gcr.io/distroless/static-debian11 debug@sha256 build
scratch latest build

go.mod go

dario.cat/mergo v1.0.0
github.com/AdaLogics/go-fuzz-headers v0.0.0-20230106234847-43070de90fa1
github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20221215162035-5330a85ea652
github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1
github.com/CycloneDX/cyclonedx-go v0.7.2
github.com/DataDog/zstd v1.4.5
github.com/Masterminds/goutils v1.1.1
github.com/Masterminds/semver v1.5.0
github.com/Masterminds/semver/v3 v3.2.0
github.com/Masterminds/sprig/v3 v3.2.3
github.com/Microsoft/go-winio v0.6.1
github.com/Microsoft/hcsshim v0.10.0-rc.7
github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371
github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
github.com/acobaugh/osrelease v0.1.0
github.com/acomagu/bufpipe v1.0.4
github.com/adrg/xdg v0.4.0
github.com/anchore/bubbly v0.0.0-20230801194016-acdb4981b461
github.com/anchore/clio v0.0.0-20230823172630-c42d666061af
github.com/anchore/fangs v0.0.0-20230818131516-2186b10924fe
github.com/anchore/go-logger v0.0.0-20230725134548-c21dafa1ec5a
github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb
github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092
github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
github.com/anchore/packageurl-go v0.1.1-0.20230104203445-02e0a6721501
github.com/anchore/stereoscope v0.0.0-20230919183137-5841b53a0375
github.com/andybalholm/brotli v1.0.4
github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46
github.com/aquasecurity/go-version v0.0.0-20210121072130-637058cfe492
github.com/aymanbagabas/go-osc52/v2 v2.0.1
github.com/becheran/wildmatch-go v1.0.0
github.com/bmatcuk/doublestar/v4 v4.6.0
github.com/charmbracelet/bubbles v0.16.1
github.com/charmbracelet/bubbletea v0.24.2
github.com/charmbracelet/harmonica v0.2.0
github.com/charmbracelet/lipgloss v0.8.0
github.com/cloudflare/circl v1.3.3
github.com/containerd/cgroups v1.1.0
github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81
github.com/containerd/containerd v1.7.0
github.com/containerd/continuity v0.3.0
github.com/containerd/fifo v1.1.0
github.com/containerd/stargz-snapshotter/estargz v0.14.3
github.com/containerd/ttrpc v1.2.1
github.com/containerd/typeurl/v2 v2.1.0
github.com/cyphar/filepath-securejoin v0.2.4
github.com/dave/jennifer v1.7.0
github.com/davecgh/go-spew v1.1.1
github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da
github.com/docker/cli v24.0.0+incompatible
github.com/docker/distribution v2.8.2+incompatible
github.com/docker/docker v24.0.6+incompatible
github.com/docker/docker-credential-helpers v0.7.0
github.com/docker/go-connections v0.4.0
github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c
github.com/docker/go-units v0.5.0
github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5
github.com/dustin/go-humanize v1.0.1
github.com/edsrzf/mmap-go v1.1.0
github.com/emirpasic/gods v1.18.1
github.com/facebookincubator/nvdtools v0.1.5
github.com/felixge/fgprof v0.9.3
github.com/fsnotify/fsnotify v1.6.0
github.com/gabriel-vasile/mimetype v1.4.0
github.com/github/go-spdx/v2 v2.2.0
github.com/gkampitakis/ciinfo v0.2.5
github.com/gkampitakis/go-diff v1.3.2
github.com/gkampitakis/go-snaps v0.4.10
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376
github.com/go-git/go-billy/v5 v5.5.0
github.com/go-git/go-git/v5 v5.9.0
github.com/go-logr/logr v1.2.3
github.com/go-logr/stdr v1.2.2
github.com/go-restruct/restruct v1.2.0-alpha
github.com/go-test/deep v1.1.0
github.com/gogo/protobuf v1.3.2
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da
github.com/golang/protobuf v1.5.3
github.com/golang/snappy v0.0.4
github.com/google/go-cmp v0.5.9
github.com/google/go-containerregistry v0.16.1
github.com/google/licensecheck v0.3.1
github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26
github.com/google/uuid v1.3.1
github.com/gookit/color v1.5.4
github.com/hashicorp/errwrap v1.1.0
github.com/hashicorp/go-multierror v1.1.1
github.com/hashicorp/hcl v1.0.0
github.com/huandu/xstrings v1.3.3
github.com/iancoleman/orderedmap v0.0.0-20190318233801-ac98e3ecb4b0
github.com/iancoleman/strcase v0.3.0
github.com/imdario/mergo v0.3.15
github.com/inconshreveable/mousetrap v1.1.0
github.com/invopop/jsonschema v0.7.0
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99
github.com/jinzhu/copier v0.4.0
github.com/kastenhq/goversion v0.0.0-20230811215019-93b2f8823953
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
github.com/kevinburke/ssh_config v1.2.0
github.com/klauspost/compress v1.16.5
github.com/klauspost/pgzip v1.2.5
github.com/knqyf263/go-rpmdb v0.0.0-20230301153543-ba94b245509b
github.com/kr/pretty v0.3.1
github.com/kr/text v0.2.0
github.com/logrusorgru/aurora v0.0.0-20200102142835-e9ef32dff381
github.com/lucasb-eyer/go-colorful v1.2.0
github.com/magiconair/properties v1.8.7
github.com/mattn/go-colorable v0.1.13
github.com/mattn/go-isatty v0.0.18
github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75
github.com/mattn/go-runewidth v0.0.14
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d
github.com/mholt/archiver/v3 v3.5.1
github.com/microsoft/go-rustaudit v0.0.0-20220730194248-4b17361d90a5
github.com/mitchellh/copystructure v1.2.0
github.com/mitchellh/go-homedir v1.1.0
github.com/mitchellh/hashstructure/v2 v2.0.2
github.com/mitchellh/mapstructure v1.5.0
github.com/mitchellh/reflectwalk v1.0.2
github.com/moby/locker v1.0.1
github.com/moby/sys/mountinfo v0.6.2
github.com/moby/sys/sequential v0.5.0
github.com/moby/sys/signal v0.7.0
github.com/muesli/ansi v0.0.0-20211031195517-c9f0611b6c70
github.com/muesli/cancelreader v0.2.2
github.com/muesli/reflow v0.3.0
github.com/muesli/termenv v0.15.2
github.com/nwaples/rardecode v1.1.0
github.com/olekukonko/tablewriter v0.0.5
github.com/opencontainers/go-digest v1.0.0
github.com/opencontainers/image-spec v1.1.0-rc3
github.com/opencontainers/runc v1.1.5
github.com/opencontainers/runtime-spec v1.1.0-rc.1
github.com/opencontainers/selinux v1.11.0
github.com/pborman/indent v1.2.1
github.com/pelletier/go-toml v1.9.5
github.com/pelletier/go-toml/v2 v2.0.8
github.com/pierrec/lz4/v4 v4.1.15
github.com/pjbgf/sha1cd v0.3.0
github.com/pkg/errors v0.9.1
github.com/pkg/profile v1.7.0
github.com/pmezard/go-difflib v1.0.0
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec
github.com/rivo/uniseg v0.2.0
github.com/rogpeppe/go-internal v1.11.0
github.com/saferwall/pe v1.4.5
github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d
github.com/sanity-io/litter v1.5.5
github.com/sassoftware/go-rpmutils v0.2.0
github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e
github.com/sergi/go-diff v1.3.1
github.com/shopspring/decimal v1.2.0
github.com/sirupsen/logrus v1.9.3
github.com/skeema/knownhosts v1.2.0
github.com/spdx/tools-golang v0.5.3
github.com/spf13/afero v1.9.5
github.com/spf13/cast v1.5.1
github.com/spf13/cobra v1.7.0
github.com/spf13/jwalterweatherman v1.1.0
github.com/spf13/pflag v1.0.5
github.com/spf13/viper v1.16.0
github.com/stretchr/testify v1.8.4
github.com/subosito/gotenv v1.4.2
github.com/sylabs/sif/v2 v2.11.5
github.com/sylabs/squashfs v0.6.1
github.com/therootcompany/xz v1.0.1
github.com/tidwall/gjson v1.16.0
github.com/tidwall/match v1.1.1
github.com/tidwall/pretty v1.2.1
github.com/tidwall/sjson v1.2.5
github.com/ulikunitz/xz v0.5.10
github.com/vbatts/go-mtree v0.5.3
github.com/vbatts/tar-split v0.11.3
github.com/vifraa/gopom v1.0.0
github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651
github.com/wagoodman/go-progress v0.0.0-20230911172108-cf810b7e365c
github.com/xanzy/ssh-agent v0.3.3
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415
github.com/xeipuuv/gojsonschema v1.2.0
github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8
github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778
github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1
go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352
go.opencensus.io v0.24.0
go.opentelemetry.io/otel v1.14.0
go.opentelemetry.io/otel/trace v1.14.0
golang.org/x/crypto v0.13.0
golang.org/x/mod v0.12.0
golang.org/x/net v0.15.0
golang.org/x/sync v0.3.0
golang.org/x/sys v0.12.0
golang.org/x/term v0.12.0
golang.org/x/text v0.13.0
golang.org/x/tools v0.13.0
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2
google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1
google.golang.org/grpc v1.55.0
google.golang.org/protobuf v1.30.0
gopkg.in/ini.v1 v1.67.0
gopkg.in/warnings.v0 v0.1.2
gopkg.in/yaml.v3 v3.0.1
lukechampine.com/uint128 v1.2.0
modernc.org/cc/v3 v3.40.0
modernc.org/ccgo/v3 v3.16.13
modernc.org/libc v1.24.1
modernc.org/mathutil v1.5.0
modernc.org/memory v1.6.0
modernc.org/opt v0.1.3
modernc.org/sqlite v1.25.0
modernc.org/strutil v1.1.3
modernc.org/token v1.0.1
retract (

go.sum go

1126 dependencies

.github/workflows/validate-github-actions.yaml actions

actions/checkout de0fac2e4500dabe0009e67214ff5f5447ce83dd composite
zizmorcore/zizmor-action 135698455da5c3b3e55f73f4419e481ab68cdd95 composite

syft/pkg/cataloger/r/testdata/installed/base/DESCRIPTION cran

methods * suggests

cmd/syft/internal/test/integration/testdata/image-java-no-main-package/Dockerfile docker

jenkins/jenkins 2.346.3-slim-jdk17@sha256 build
scratch latest build

syft/pkg/cataloger/binary/testdata/image-fedora-64bit/Dockerfile docker

fedora 41@sha256 build
scratch latest build

syft/pkg/cataloger/debian/testdata/image-dpkg/Dockerfile docker

scratch latest build

syft/pkg/cataloger/dotnet/testdata/image-net6-asp-libman/Dockerfile docker

busybox latest build
mcr.microsoft.com/dotnet/sdk 6.0 build

test/cli/testdata/image-hidden-packages/Dockerfile docker

alpine 3.20.2@sha256 build

syft/pkg/cataloger/githubactions/testdata/glob/.github/actions/bootstrap/action.yaml actions

.github/workflows/codeql.yaml actions

cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/rust/Cargo.lock cargo

memchr 2.3.3
nom 4.2.3
version_check 0.1.5

cmd/syft/internal/test/integration/testdata/image-photon-all-layers/Dockerfile docker

photon 5.0-20230729@sha256 build
scratch latest build

syft/pkg/cataloger/binary/testdata/image-busybox/Dockerfile docker

busybox 1.35@sha256 build

syft/pkg/cataloger/dotnet/testdata/image-net8-ilrepack/Dockerfile docker

busybox latest build
mcr.microsoft.com/dotnet/sdk 8.0-alpine@sha256 build

syft/pkg/cataloger/golang/testdata/go-mod-fixtures/relative-replace/go.mod go

github.com/aws/aws-sdk-go-v2 v1.36.3

cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/erlang/rebar.lock hex

certifi 2.9.0
idna 6.1.1
metrics 1.0.1
mimerl 1.2.0
parse_trans 3.3.1
ssl_verify_fun 1.1.6
unicode_util_compat 0.7.0

syft/pkg/cataloger/java/testdata/gradle/build.gradle maven

joda-time:joda-time 2.2 implementation
junit:junit 4.12 testImplementation

syft/pkg/cataloger/java/testdata/gradle/gradle.lockfile maven

joda-time:joda-time 2.2
junit:junit 4.12
org.apache.commons:commons-text 1.8
org.hamcrest:hamcrest-core 1.3

syft/pkg/cataloger/java/testdata/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-all/pom.xml maven

org.apache.directory.api:api-asn1-api *
org.apache.directory.api:api-asn1-ber *
org.apache.directory.api:api-dsml-engine *
org.apache.directory.api:api-dsml-parser *
org.apache.directory.api:api-i18n *
org.apache.directory.api:api-ldap-client-api *
org.apache.directory.api:api-ldap-codec-core *
org.apache.directory.api:api-ldap-codec-standalone *
org.apache.directory.api:api-ldap-extras-aci *
org.apache.directory.api:api-ldap-extras-codec *
org.apache.directory.api:api-ldap-extras-codec-api *
org.apache.directory.api:api-ldap-extras-sp *
org.apache.directory.api:api-ldap-extras-trigger *
org.apache.directory.api:api-ldap-extras-util *
org.apache.directory.api:api-ldap-model *
org.apache.directory.api:api-ldap-net-mina *
org.apache.directory.api:api-ldap-schema-converter *
org.apache.directory.api:api-ldap-schema-data *
org.apache.directory.api:api-util *

syft/pkg/cataloger/python/testdata/uv/nested-extras/uv.lock pypi

annotated-types 0.7.0
anyio 4.9.0
certifi 2025.1.31
click 8.1.8
colorama 0.4.6
dnspython 2.7.0
email-validator 2.2.0
fastapi 0.111.1
fastapi-cli 0.0.7
h11 0.14.0
httpcore 1.0.7
httptools 0.6.4
httpx 0.28.1
idna 3.10
itsdangerous 2.2.0
jinja2 3.1.6
markdown-it-py 3.0.0
markupsafe 3.0.2
mdurl 0.1.2
orjson 3.10.16
pydantic 2.11.0
pydantic-core 2.33.0
pydantic-extra-types 2.10.3
pydantic-settings 2.8.1
pygments 2.19.1
python-dotenv 1.1.0
python-multipart 0.0.20
pyyaml 6.0.2
rich 13.9.4
rich-toolkit 0.14.0
shellingham 1.5.4
sniffio 1.3.1
starlette 0.37.2
testpkg 0.1.0
typer 0.15.2
typing-extensions 4.13.0
typing-inspection 0.4.0
ujson 5.10.0
uvicorn 0.34.0
uvloop 0.21.0
watchfiles 1.0.4
websockets 15.0.1

cmd/syft/internal/test/integration/testdata/image-java-virtualpath-regression/Dockerfile docker

alpine 3.18.3@sha256 build
scratch latest build

syft/file/cataloger/filemetadata/testdata/image-file-type-mix/Dockerfile docker

busybox 1.28.1@sha256 build

syft/internal/fileresolver/testdata/image-files-deleted/Dockerfile docker

alpine 3.17.1@sha256 build
scratch latest build

syft/pkg/cataloger/binary/testdata/elf-testdata/Dockerfile docker

busybox 1.36.1-musl build
rockylinux 8 build

syft/pkg/cataloger/dotnet/testdata/image-net8-compile-target/Dockerfile docker

busybox latest build
mcr.microsoft.com/dotnet/sdk 8.0-alpine@sha256 build

syft/pkg/cataloger/dotnet/testdata/image-net8-privateassets/Dockerfile docker

busybox latest build
mcr.microsoft.com/dotnet/sdk 8.0-alpine@sha256 build

syft/pkg/cataloger/golang/testdata/image-not-a-module/Dockerfile docker

golang 1.23.2 build
scratch latest build

syft/pkg/cataloger/internal/dotnet/pe/testdata/image-dotnet31-single-file/Dockerfile docker

busybox latest build
mcr.microsoft.com/dotnet/core/sdk 3.1 build

syft/pkg/cataloger/internal/dotnet/pe/testdata/image-dotnet6-single-file/Dockerfile docker

busybox latest build
mcr.microsoft.com/dotnet/sdk 6.0 build

syft/pkg/cataloger/nix/testdata/image-nixos-jq-pkg-db/Dockerfile docker

nixos/nix 2.28.2@sha256 build
scratch latest build

cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/r/base/DESCRIPTION cran

methods * suggests

syft/pkg/cataloger/javascript/test-fixtures/deno/corrupt/deno.lock deno

cmd/syft/internal/test/integration/testdata/image-owning-package/Dockerfile docker

scratch latest build
ubuntu 20.04@sha256 build

cmd/syft/internal/test/integration/testdata/image-sbom-metadata-component/Dockerfile docker

scratch latest build

cmd/syft/internal/test/integration/testdata/image-test-java-purls/Dockerfile docker

docker.io/anchore/test_images java-88948cc@sha256 build
scratch latest build

syft/file/cataloger/executable/testdata/shared-info/Dockerfile docker

crazymax/osxcross ${OSXCROSS_VERSION}-ubuntu build
ubuntu 22.04 build

syft/pkg/cataloger/binary/testdata/image-java-binary/Dockerfile docker

anchore/test_images syft_bin-cf22714@sha256 build

syft/pkg/cataloger/binary/testdata/image-java-ibm-jre-8/Dockerfile docker

ibmjava 8-jre@sha256 build
scratch latest build

syft/pkg/cataloger/binary/testdata/image-java-ibm-sdk-8/Dockerfile docker

ibmjava 8-sdk-alpine@sha256 build
scratch latest build

syft/pkg/cataloger/dotnet/testdata/image-net2-app/Dockerfile docker

mcr.microsoft.com/dotnet/core/runtime 2.2 build
mcr.microsoft.com/dotnet/core/sdk 2.2 build

syft/pkg/cataloger/dotnet/testdata/image-net8-app/Dockerfile docker

busybox latest build
mcr.microsoft.com/dotnet/sdk 8.0-alpine@sha256 build

syft/pkg/cataloger/haskell/testdata/stack.yaml.lock hackage

HTTP 4000.3.16
configurator-pg 0.2.6
hasql-dynamic-statements 0.3.1.1
hasql-implicits 0.1.0.4
hasql-pool 0.5.2.2
lens-aeson 1.1.3
optparse-applicative 0.16.1.0
protolude 0.3.2
ptr 0.16.8.2

syft/pkg/cataloger/dotnet/testdata/image-net8-app-with-runtime/src/dotnetapp.csproj nuget

Humanizer 2.14.1
Newtonsoft.Json 13.0.3

cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/python/requires/test-requirements.txt pypi

python-dateutil ==2.8.1 test
python-swiftclient ==3.8.1 test
pytz ==2019.3 test

syft/pkg/cataloger/python/testdata/poetry/simple-deps/pyproject.toml pypi

python ^3.11
requests ^2.32.2

cmd/syft/internal/test/integration/testdata/yarn-lock/packages/nested-package/node_modules/async/bower.json bower

lodash >=2.4.1 development
nodelint >0.0.0 development
nodeunit >0.0.0 development
uglify-js 1.2.x development

cmd/syft/internal/test/integration/testdata/image-large-apk-data/Dockerfile docker

alpine@sha256 d9a7354e3845ea8466bb00b22224d9116b183e594527fb5b6c3d30bc01a20378 build
scratch latest build

cmd/syft/internal/test/integration/testdata/image-os-binary-overlap/Dockerfile docker

alpine 3.18.3@sha256 build

syft/pkg/cataloger/binary/testdata/image-fedora-32bit/Dockerfile docker

arm32v7/fedora 36 build
scratch latest build

cmd/syft/internal/test/integration/testdata/image-pkg-coverage/hackage/cabal.project.freeze hackage

Cabal 3.2.1.0
Diff 0.4.1
HUnit 1.6.2.0
OneTuple 0.3.1
Only 0.1
PyF 0.10.2.0
QuickCheck 2.14.2
RSA 2.4.1
SHA 1.6.4.4
Spock 0.14.0.0

syft/pkg/cataloger/elixir/testdata/glob-paths/src/mix.lock hex

syft/pkg/cataloger/elixir/testdata/relationships/mix.lock hex

cowboy 2.9.0
cowlib 2.11.0
ranch 1.8.0

syft/pkg/cataloger/lua/testdata/glob-paths/lua/package.rockspec luarocks

syft/pkg/cataloger/java/testdata/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-1/pom.xml maven

syft/pkg/cataloger/java/testdata/jar-metadata/org.multiple-thename/META-INF/maven/com.multiple/thename/pom.xml maven

syft/pkg/cataloger/java/testdata/java-builds/example-java-app/pom.xml maven

joda-time:joda-time 2.9.2
junit:junit 4.12 test

syft/pkg/cataloger/java/testdata/pom/example-java-app-maven/pom.xml maven

com.joda:joda-time 2.9.2
junit:junit 4.12 test

cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/javascript/package-lock/package-lock.json npm

get-stdin 8.0.0

syft/pkg/cataloger/cpp/testdata/conanfile-comment-in-requires.txt pypi

catch2 * test
cmake_find_package_multi * test
docopt.cpp * test

syft/pkg/cataloger/python/testdata/poetry/simple-deps/poetry.lock pypi

certifi 2024.2.2
charset-normalizer 3.3.2
idna 3.7
requests 2.32.2
urllib3 2.2.1

syft/pkg/cataloger/rust/testdata/path-deps/Cargo.lock cargo

memchr 2.7.4

syft/pkg/cataloger/cpp/testdata/glob-paths/somewhere/src/conanfile.txt conan

cmd/syft/internal/test/integration/testdata/image-distro-id/Dockerfile docker

busybox 1.31.1@sha256 build

cmd/syft/internal/test/integration/testdata/image-sbom-cataloger/go.mod go

github.com/anchore/packageurl-go v0.1.1-0.20220428202044-a072fa3cb6d7
github.com/bmatcuk/doublestar v1.3.1

syft/pkg/cataloger/golang/internal/gotestdata/go-source/go.mod go

github.com/davecgh/go-spew v1.1.1
github.com/fsnotify/fsnotify v1.8.0
github.com/go-viper/mapstructure/v2 v2.2.1
github.com/google/uuid v1.6.0
github.com/pelletier/go-toml/v2 v2.2.3
github.com/pmezard/go-difflib v1.0.0
github.com/sagikazarmark/locafero v0.7.0
github.com/sirupsen/logrus v1.9.3
github.com/sourcegraph/conc v0.3.0
github.com/spf13/afero v1.12.0
github.com/spf13/cast v1.7.1
github.com/spf13/pflag v1.0.6
github.com/spf13/viper v1.20.1
github.com/stretchr/testify v1.10.0
github.com/subosito/gotenv v1.6.0
go.uber.org/multierr v1.10.0
go.uber.org/zap v1.27.0
golang.org/x/sys v0.33.0
golang.org/x/text v0.21.0
gopkg.in/yaml.v3 v3.0.1

syft/pkg/cataloger/golang/testdata/archs/src/go.mod go

cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/rockspec/kong-3.7.0-0.rockspec luarocks

binaryheap >= 0.4
inspect == 3.1.3
kong-lapis == 1.16.0.1
kong-pgmoon == 1.16.2
lpeg == 1.1.0
lua-ffi-zlib == 0.6
lua-messagepack == 0.5.4
lua-protobuf == 0.5.0
lua-resty-acme == 0.12.0
lua-resty-aws == 1.3.6
lua-resty-counter == 0.2.1
lua-resty-healthcheck == 3.0.1
lua-resty-http == 0.17.1
lua-resty-ipmatcher == 0.6.1
lua-resty-jit-uuid == 0.0.7
lua-resty-ljsonschema == 1.1.6-2
lua-resty-openssl == 1.2.0
lua-resty-session == 4.0.5
lua-resty-timer-ng == 0.2.6
lua_pack == 2.0.0
lua_system_constants == 0.1.4
luasec == 1.3.2
luasocket == 3.0-rc1
luasyslog == 2.0.1
luatz == 0.4
luaxxhash >= 1.0
lyaml == 6.2.8
multipart == 0.5.9
penlight == 1.13.1
version == 1.0.1

syft/pkg/cataloger/lua/testdata/rockspec/luasyslog-2.0.1-1.rockspec luarocks

lua >= 5.1
lualogging >= 1.4.0, < 2.0.0

cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/java/pom.xml maven

joda-time:joda-time 2.9.2
junit:junit 4.12 test

syft/pkg/cataloger/java/internal/maven/testdata/local/child-1/pom.xml maven

org.apache.commons:commons-lang3 *

syft/pkg/cataloger/java/internal/maven/testdata/local/child-2/pom.xml maven

syft/pkg/cataloger/java/internal/maven/testdata/local/parent-2/pom.xml maven

org.apache.commons:commons-collections4 4.4
org.apache.commons:commons-text 1.12.0
junit:junit 4.13.2 test

syft/pkg/cataloger/java/testdata/java-builds/example-java-app/build.gradle maven

joda-time:joda-time 2.2 implementation
junit:junit 4.12 testImplementation

syft/pkg/cataloger/java/testdata/pom/commons-text-1.10.0/pom.xml maven

org.apache.commons:commons-lang3 3.12.0
commons-io:commons-io 2.11.0 test
org.apache.commons:commons-rng-simple 1.4 test
org.assertj:assertj-core 3.23.1 test
org.graalvm.js:js 22.0.0.2 test
org.graalvm.js:js-scriptengine 22.0.0.2 test
org.junit.jupiter:junit-jupiter * test
org.mockito:mockito-inline 4.8.0 test
org.openjdk.jmh:jmh-core 1.35 test
org.openjdk.jmh:jmh-generator-annprocess 1.35 test

cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/javascript/yarn/yarn.lock npm

@babel/code-frame 7.10.4

syft/pkg/cataloger/rust/testdata/glob-paths/src/Cargo.lock cargo

syft/pkg/cataloger/rust/testdata/image-audit/Cargo.toml cargo

syft/pkg/cataloger/swift/testdata/Podfile.lock cocoapods

GlossButtonNode 3.1.2
PINCache 3.0.3
PINOperation 1.2.1
PINRemoteImage 3.0.3
Reveal-SDK 33
SwiftGen 6.5.1
Texture 3.1.0
TextureSwiftSupport 3.13.0
TinyConstraints 4.0.2

syft/pkg/cataloger/internal/dotnet/pe/testdata/image-dotnet5-single-file/Dockerfile docker

busybox latest build
mcr.microsoft.com/dotnet/sdk 5.0 build

syft/pkg/cataloger/python/testdata/image-multi-site-package/Dockerfile docker

scratch latest build
ubuntu 20.04@sha256 build

.make/go.sum go

github.com/anchore/go-make v0.8.0
github.com/bmatcuk/doublestar/v4 v4.10.0
github.com/goccy/go-yaml v1.19.2
golang.org/x/mod v0.37.0
golang.org/x/sys v0.46.0

cmd/syft/internal/test/integration/testdata/image-go-bin-arch-coverage/go.mod go

golang.org/x/net v0.0.0-20211006190231-62292e806868
golang.org/x/sys v0.0.0-20211006194710-c8a6f5223071
golang.org/x/term v0.0.0-20210916214954-140adaaadfaf

cmd/syft/internal/test/integration/testdata/image-go-bin-arch-coverage/go.sum go

golang.org/x/net v0.0.0-20211006190231-62292e806868
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68
golang.org/x/sys v0.0.0-20210423082822-04245dca01da
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1
golang.org/x/sys v0.0.0-20211006194710-c8a6f5223071
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1
golang.org/x/term v0.0.0-20210916214954-140adaaadfaf
golang.org/x/text v0.3.6
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e

cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/go/go.mod go

github.com/bmatcuk/doublestar v1.3.1

syft/pkg/cataloger/swift/testdata/glob-paths/src/Podfile.lock cocoapods

syft/pkg/cataloger/cpp/testdata/conanlock-v2/conan.lock conan

matrix 1.1
sound32 1.0

cmd/syft/internal/test/integration/testdata/image-sqlite-rpmdb/Dockerfile docker

fedora 35@sha256 build
scratch latest build

internal/os/testdata/rhel_no_manifests/Dockerfile docker

scratch latest build

syft/source/testdata/image-simple/Dockerfile docker

scratch latest build

test/cli/testdata/image-bad-binaries/Dockerfile docker

debian sid@sha256 build

syft/pkg/cataloger/golang/testdata/go-sum-hashes/go.sum go

github.com/CycloneDX/cyclonedx-go v0.6.0
github.com/CycloneDX/cyclonedx-go v0.7.0
github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
github.com/bradleyjkemp/cupaloy/v2 v2.7.0
github.com/davecgh/go-spew v1.1.0
github.com/davecgh/go-spew v1.1.1
github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d
github.com/pmezard/go-difflib v1.0.0
github.com/stretchr/objx v0.1.0
github.com/stretchr/objx v0.1.1
github.com/stretchr/testify v1.6.1
github.com/stretchr/testify v1.7.1
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c

syft/pkg/cataloger/elixir/testdata/mix.lock hex

castore 0.1.17
connection 1.1.0
cowboy 2.9.0
cowboy_telemetry 0.4.0
cowlib 2.11.0
db_connection 2.4.2
decimal 2.0.0
earmark_parser 1.4.25
ecto 3.8.1
ecto_sql 3.8.1
enacl 2f50ba6289f2f2d9fef05d22a396c0bab4f64149
esbuild 0.5.0
ex_doc 0.28.4
gettext 0.19.1
hpax 0.1.1
jason 1.3.0

syft/pkg/cataloger/java/internal/maven/testdata/local/parent-3/pom.xml maven

cmd/syft/internal/test/integration/testdata/npm-lock/node_modules/collapse-white-space/package-lock.json npm

790 dependencies

syft/pkg/cataloger/php/testdata/glob-paths/src/composer.lock packagist