This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Capabilities

Summary of package analysis and vulnerability scanning capabilities across ecosystems

Capabilities describe the cross-cutting features available across Anchore’s tools:

  • Package analysis: What Syft can catalog from package manifests, lock files, and installed packages
  • Vulnerability scanning: What Grype can detect using vulnerability databases and matching rules

These capabilities are ecosystem-specific. For example, Python’s capabilities differ from Go’s, and Ubuntu’s capabilities differ from Alpine’s.

Default capabilities do not require to be online or have special configuration (other than having a vulnerability DB downloaded). Some capabilities may be conditionally supported, requiring additional configuration or online access to function.

Vulnerability scanning capabilities

Vulnerability data source qualities vary in the information they provide and how to interpret them correctly.

Disclosure and fix information

In terms of disclosures and fixes, each data source can be described along the following dimensions:

  • Independent Disclosure: Whether the advisory discloses the vulnerability regardless of fix availability. Sources with this capability report vulnerabilities even when no fix is available yet.

  • Disclosure Date: Whether the data source provides the date when a vulnerability was first publicly disclosed. This helps you understand the timeline of vulnerability exposure.

  • Fix Versions: Whether the data source specifies which package versions contain fixes for a vulnerability. This allows Grype to determine if an installed package version is vulnerable or fixed.

  • Fix Date: Whether the advisory includes a date when the fix was made available. This helps you understand the timeline of vulnerability remediation.

Track by source package

Some ecosystems have parent packages where the source code for the current package is maintained. For example, the libcrypto for debian is part of the larger openssl package (where openssl is denoted as the origin package). The same is true for redhat-based packages, except the parent package is denoted as the srcrpm package.

Ecosystems like this have vulnerabilities are often disclosed and fixed at the parent package level (origin and srcrpm). More critically, the parent packages are often not installed on the system, making it impossible to directly detect vulnerabilities against them. There tends to be package metadata on the downstream package that denotes the parent package name and version, which Syft can extract during package analysis.

Package analysis capabilities

Dependencies

We describe Syft’s ability to capture dependency information in the following dimentions:

  • Depth: How far into the true dependency graph we are able to discover package nodes.

    • direct: only captures dependencies explicitly declared by the project, but not necessarily dependencies of those dependencies

    • transitive: all possible depths of dependencies are captured

  • Edges: Whether we are able to capture relationships between packages, and if so, describe the topology of those relationships.

    • flat: we can capture the root package relative to all other dependencies, but are unaware of relationships between dependencies (a simple star topology, where all dependencies point to the root package)

    • complete: all possible relationships between packages are captured (the full dependency graph)

  • Kinds: The types of dependencies we are able to capture.

    • runtime: dependencies required for the package to function at runtime

    • dev: dependencies required for development

Licenses

Indicates whether Syft can detect and catalog license information from package metadata. When supported, Syft extracts license declarations from package manifests, metadata files, or installed package databases.

Package manager features

Syft can extract various package manager metadata beyond basic package information:

  • Files: Whether Syft can catalog the list of files that are part of a package installation. This provides visibility into all files installed by the package manager.

  • Digests: Whether Syft can capture file checksums (digests/hashes) for individual files within a package. This enables integrity verification of installed files. Note: this is not necessarily the actual hash of the file, but instead the claims made by the package manager about those files. We capture actual file hashes in the files section of the SBOM.

  • Integrity Hash: Whether Syft can capture a single package-level integrity hash used by package managers to verify the package archive itself (for example, the https://go.dev/ref/mod#go-sum-files for go packages).

Next steps

1 - Supported operating systems

A high-level summary of which OS’s are supported

Syft and Grype support several operating systems for package cataloging and vulnerability detection. The table below shows which OS versions are supported and where Grype’s vulnerability data comes from.

Operating SystemSupported VersionsVunnel ProviderData Source
Alpine Linux3.2+, edgealpineAlpine SecDB
Amazon Linux2, 2022, 2023amazonAmazon Linux Security Center
Azure Linux3.0marinerMicrosoft CBL-Mariner OVAL
CentOS5, 6, 7, 8rhelRed Hat Security Data API
Chainguard OSrollingchainguardChainguard Security
Debian7 (wheezy), 8 (jessie), 9 (stretch), 10 (buster), 11 (bullseye), 12 (bookworm), 13 (trixie), 14, unstabledebianDebian Security Tracker
Echo OSrollingechoECHO Security
CBL-Mariner1.0, 2.0marinerMicrosoft CBL-Mariner OVAL
MinimOSrollingminimosMINIMOS Security
Oracle Linux5, 6, 7, 8, 9, 10oracleOracle Linux Security
Raspberry Pi OS7 (wheezy), 8 (jessie), 9 (stretch), 10 (buster), 11 (bullseye), 12 (bookworm), 13 (trixie), 14, unstabledebianDebian Security Tracker
Red Hat Enterprise Linux5, 6, 7, 8, 9, 10
EUS: 5.9, 6.4+, 7, 8.1, 8.2, 8.4, 8.6, 8.8, 9		rhelRed Hat Security Data API
Rocky Linux5, 6, 7, 8, 9, 10rhelRed Hat Security Data API
SUSE Linux Enterprise Server11, 12, 15slesSUSE Security OVAL
Ubuntu12.04 (precise), 12.10 (quantal), 13.04 (raring), 14.04 (trusty), 14.10 (utopic), 15.04 (vivid), 15.10 (wily), 16.04 (xenial), 16.10 (yakkety), 17.04 (zesty), 17.10 (artful), 18.04 (bionic), 18.10 (cosmic), 19.04 (disco), 19.10 (eoan), 20.04 (focal), 20.10 (groovy), 21.04 (hirsute), 21.10 (impish), 22.04 (jammy), 22.10 (kinetic), 23.04 (lunar), 23.10 (mantic), 24.04 (noble), 24.10 (oracular), 25.04 (plucky), 25.10ubuntuUbuntu CVE Tracker
WolfirollingwolfiWolfi Security

2 - Supported package ecosystems

A high-level summary of all package detection capabilities across ecosystems

The table below shows which ecosystems support package analysis and vulnerability scanning.

EcosystemCataloger + EvidenceLicensesDependenciesFiles
Ai
gguf-cataloger
*.gguf
ALPM
alpm-db-cataloger
var/lib/pacman/local/**/desc
APK
apk-db-cataloger
lib/apk/db/installed
Binary
binary-classifier-cataloger
arangodb-binaryarangosh bash-binarybash busybox-binarybusybox chrome-binarychrome consul-binaryconsul curl-binarycurl dart-binarydart elixir-binaryelixir elixir-libraryelixir/ebin/elixir.app erlang-alpine-binarybeam.smp erlang-binaryerlexec erlang-libraryliberts_internal.a ffmpeg-binaryffmpeg ffmpeg-librarylibav*, libswresample* fluent-bit-binaryfluent-bit gcc-binarygcc go-binarygo go-binary-hintVERSION* gzip-binarygzip haproxy-binaryhaproxy hashicorp-vault-binaryvault haskell-cabal-binarycabal haskell-ghc-binaryghc* haskell-stack-binarystack helmhelm httpd-binaryhttpd java-binaryjava java-jdb-binaryjdb jq-binaryjq julia-binarylibjulia-internal.so lighttpd-binarylighttpd mariadb-binary{mariadb,mysql} memcached-binarymemcached mysql-binarymysql nginx-binarynginx nodejs-binarynode openssl-binaryopenssl perl-binaryperl php-composer-binarycomposer* postgresql-binarypostgres proftpd-binaryproftpd pypy-binary-liblibpypy*.so* python-binarypython* python-binary-liblibpython*.so* redis-binaryredis-server ruby-binaryruby rust-standard-library-linuxlibstd-*.so rust-standard-library-macoslibstd-*.dylib sqlcipher-binarysqlcipher swipl-binaryswipl traefik-binarytraefik util-linux-binarygetopt wordpress-cli-binarywp xtrabackup-binaryxtrabackup xz-binaryxz zstd-binaryzstd
elf-binary-package-cataloger
application/x-executable, application/x-mach-binary, application/x-elf, application/x-sharedlib, application/vnd.microsoft.portable-executable (mimetype)
pe-binary-package-cataloger
*.dll, *.exe
Bitnami
bitnami-cataloger
/opt/bitnami/**/.spdx-*.spdx
C/C++
conan-cataloger
conan.lock
conan-cataloger
conanfile.txt
conan-info-cataloger
conaninfo.txt
Conda
conda-meta-cataloger
conda-meta/*.json
Dart
dart-pubspec-cataloger
pubspec.yml, pubspec.yaml
dart-pubspec-lock-cataloger
pubspec.lock
DPKG
deb-archive-cataloger
*.deb
dpkg-db-cataloger
lib/dpkg/status, lib/dpkg/status.d/*, lib/opkg/info/*.control, lib/opkg/status
Elixir
elixir-mix-lock-cataloger
mix.lock
Erlang
erlang-otp-application-cataloger
*.app
erlang-rebar-lock-cataloger
rebar.lock
GitHub Actions
github-action-workflow-usage-cataloger
.github/workflows/*.yaml, .github/workflows/*.yml
github-actions-usage-cataloger
.github/actions/*/action.yml, .github/actions/*/action.yaml
github-actions-usage-cataloger
.github/workflows/*.yaml, .github/workflows/*.yml
Go
go-module-binary-cataloger
application/x-executable, application/x-mach-binary, application/x-elf, application/x-sharedlib, application/vnd.microsoft.portable-executable, application/x-executable (mimetype)
go-module-file-cataloger
go.mod
Haskell
haskell-cataloger
cabal.project.freeze
haskell-cataloger
stack.yaml.lock
haskell-cataloger
stack.yaml
Homebrew
homebrew-cataloger
Cellar/*/*/.brew/*.rb, Library/Taps/*/*/Formula/*.rb
Java
graalvm-native-image-cataloger
application/x-executable, application/x-mach-binary, application/x-elf, application/x-sharedlib, application/vnd.microsoft.portable-executable (mimetype)
java-archive-cataloger
*.jar, *.war, *.ear, *.par, *.sar, *.nar, *.jpi, *.hpi, *.kar, *.lpkg
java-archive-cataloger
*.zip
java-archive-cataloger
*.tar, *.tar.gz, *.tgz, *.tar.bz, *.tar.bz2, *.tbz, *.tbz2, *.tar.br, *.tbr, *.tar.lz4, *.tlz4, *.tar.sz, *.tsz, *.tar.xz, *.txz, *.tar.zst, *.tzst, *.tar.zstd, *.tzstd
java-gradle-lockfile-cataloger
gradle.lockfile*
java-jvm-cataloger
release
java-pom-cataloger
*pom.xml
JavaScript
javascript-lock-cataloger
pnpm-lock.yaml
javascript-lock-cataloger
yarn.lock
javascript-lock-cataloger
package-lock.json
javascript-package-cataloger
package.json
Linux
linux-kernel-cataloger
kernel, kernel-*, vmlinux, vmlinux-*, vmlinuz, vmlinuz-*, lib/modules/**/*.ko
Lua
lua-rock-cataloger
*.rockspec
.NET
dotnet-deps-binary-cataloger
*.deps.json, *.dll, *.exe
dotnet-deps-cataloger deprecated
*.deps.json
dotnet-packages-lock-cataloger
packages.lock.json
dotnet-portable-executable-cataloger deprecated
*.dll, *.exe
Nix
nix-cataloger
nix/var/nix/db/db.sqlite, nix/store/*, nix/store/*.drv
nix-store-cataloger deprecated
nix/store/*, nix/store/*.drv
OCaml
opam-cataloger
*opam
PHP
php-composer-installed-cataloger
installed.json
php-composer-lock-cataloger
composer.lock
php-interpreter-cataloger
php*/**/*.so, php-fpm*, apache*/**/libphp*.so
php-pear-serialized-cataloger
php/.registry/**/*.reg
php-pecl-serialized-cataloger deprecated
php/.registry/.channel.*/*.reg
Portage
portage-cataloger
var/db/pkg/*/*/CONTENTS
Prolog
swipl-pack-cataloger
pack.pl
Python
python-installed-package-cataloger
*.egg-info, *dist-info/METADATA, *egg-info/PKG-INFO, *DIST-INFO/METADATA, *EGG-INFO/PKG-INFO
python-package-cataloger
pdm.lock
python-package-cataloger
uv.lock
python-package-cataloger
setup.py
python-package-cataloger
Pipfile.lock
python-package-cataloger
poetry.lock
python-package-cataloger
*requirements*.txt
R
r-package-cataloger
DESCRIPTION
RPM
rpm-archive-cataloger
*.rpm
rpm-db-cataloger
var/lib/rpmmanifest/container-manifest-2
rpm-db-cataloger
{var/lib,usr/share,usr/lib/sysimage}/rpm/{Packages,Packages.db,rpmdb.sqlite}
Ruby
ruby-gemfile-cataloger
Gemfile.lock
ruby-gemspec-cataloger
*.gemspec
ruby-installed-gemspec-cataloger
specifications/**/*.gemspec
Rust
cargo-auditable-binary-cataloger
application/x-executable, application/x-mach-binary, application/x-elf, application/x-sharedlib, application/vnd.microsoft.portable-executable, application/x-executable (mimetype)
rust-cargo-lock-cataloger
Cargo.lock
SBOM
sbom-cataloger
*.syft.json, *.bom.*, *.bom, bom, *.sbom.*, *.sbom, sbom, *.cdx.*, *.cdx, *.spdx.*, *.spdx
Snap
snap-cataloger
snap/snapcraft.yaml
snap-cataloger
snap/manifest.yaml
snap-cataloger
doc/linux-modules-*/changelog.Debian.gz
snap-cataloger
usr/share/snappy/dpkg.yaml
snap-cataloger
meta/snap.yaml
Swift
cocoapods-cataloger
Podfile.lock
swift-package-manager-cataloger
Package.resolved, .package.resolved
Terraform
terraform-lock-cataloger
.terraform.lock.hcl
WordPress
wordpress-plugins-cataloger
wp-content/plugins/*/*.php

Legend:

  • : Supported by default
  • : Conditionally supported (requires configuration)
  • (empty): Not supported

3 - ALPM

ALPM package format used by Arch-based Linux distributions

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
alpm-db-cataloger
var/lib/pacman/local/**/desc
TransitiveCompleteRuntime

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
National Vulnerability Database (NVD)

Operating systems

Operating SystemSupported VersionsProviderData Source
Arch Linuxminimal support (CPE-based)nvdNational Vulnerability Database (NVD)

Contributing

Interested in contributing vulnerability scanning support?

Feel free to add a new vunnel provider for Arch-based distributions. See the existing issue in the Vunnel repository.

Next steps

4 - AI

AI model analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
gguf-cataloger
*.gguf

Vulnerability scanning

Unsupported at this time.

Next steps

5 - APK

APK package format analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
apk-db-cataloger
lib/apk/db/installed
TransitiveCompleteRuntime

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
Alpine SecDB
National Vulnerability Database (NVD)
Chainguard Security
MINIMOS Security
Wolfi Security

The APK vulnerability matcher searches all data sources for upstream packages, including NVD.

Operating systems

Operating SystemSupported VersionsProviderData Source
Alpine Linux3.2+, edgealpineAlpine SecDB
Chainguard OSrollingchainguardChainguard Security
MinimOSrollingminimosMINIMOS Security
WolfirollingwolfiWolfi Security

The APK vulnerability database (a.k.a. “SecDB”) includes data from the Alpine Security Tracker, which provides fix information for known vulnerabilities that affect Alpine Linux packages. This database only includes vulnerabilities that have fixes available and does not track unfixed vulnerabilities. The maintainers of the SecDB intend for the primary source of truth for disclosures to be the National Vulnerability Database (NVD).

This is true of other APK vulnerability data sources as well (such as Chainguard, Wolfi, and MinimOS).

Next steps

6 - Binary

Binary package analysis and vulnerability scanning capabilities

File analysis

Within the .files[].executable sections of the Syft JSON there is an analysis of what features and claims were found within a binary file.

This includes:

  • Imported libraries (use of shared libraries)
  • Exported symbols
  • Security features (like NX, PIE, RELRO, etc)

Security features that can be detected include:

  • if debugging symbols have been stripped
  • presence of Stack Canaries to protect against stack smashing (which lead to buffer overflows)
  • NoExecute (NX) bit support to prevent execution of code on the stack or heap
  • Relocation Read-Only (RelRO) to protect the Global Offset Table (GOT) from being overwritten (can be “partial” or “full”)
  • Position Independent Executable (PIE) support such that offsets are used instead of absolute addresses
  • if it is a Dynamic Shared Object (DSO) (not a security feature, but important for analysis)
  • LLVM SafeStack partitioning is in use, which separates unsafe stack objects from safe stack objects to mitigate stack-based memory corruption vulnerabilities
  • LLVM Control Flow Integrity (CFI) is in use, which adds runtime checks to ensure that indirect function calls only target valid functions, helping to prevent control-flow hijacking attacks
  • Clang Fortified Builds is enabled, which adds additional runtime checks for certain standard library functions to detect buffer overflows and other memory errors

When it comes to shared library requirement claims and exported symbol claims, these are used by Syft to:

  • associate file-to-file relationships (in the case of executables/shared libraries being distributed without a package manager)
  • associate file-to-package relationships (when an executable imports a shared library that is managed by a package manager)

Syft can synthesize a dependency graph from the imported libraries and exported symbols found within a set of binaries, even if all package manager information has been removed, allowing for a more complete SBOM to be generated. In a mixed case, where there are some packages managed by package managers and some binaries without package manager metadata, Syft can still use the binary analysis to fill in the gaps. Package-level relationships are preferred over file-level relationships when both are available, which simplifies the dependency graph.

Package analysis

ELF package notes

Syft is capable of looking at ELF formatted binaries, specifically the .note.package note, that are formatted using the convention established by the systemd project. This spec requires a PE/COFF section that wraps a json payload describing the package metadata for the binary, however, syft does not require the PE/COFF wrapping and can extract the json payload directly from the ELF note.

Here’s an example of what the json payload looks like:

{
  "name": "my-application",
  "version": "1.2.3",
  "purl": "pkg:deb/debian/my-application@1.2.3?arch=amd64&distro=debian-12",
  "cpe": "cpe:2.3:a:vendor:my-application:1.2.3:*:*:*:*:*:*:*",
  "license": "Apache-2.0",
  "type": "deb"
}

Which, if stored in payload.json, can be injected into an existing ELF binary using the following command:

objcopy --add-section .note.package=payload.json --set-section-flags .note.package=noload,readonly

Known patterns

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
binary-classifier-cataloger
(see table below)
elf-binary-package-cataloger
application/x-executable, application/x-mach-binary, application/x-elf, application/x-sharedlib, application/vnd.microsoft.portable-executable (mimetype)
pe-binary-package-cataloger
*.dll, *.exe

Binary Package Details
ClassFilesPURLCPEs
arangodb-binaryarangoshpkg:generic/arangodbcpe:2.3:a:arangodb:arangodb:*:*:*:*:*:*:*:*
bash-binarybashpkg:generic/bashcpe:2.3:a:gnu:bash:*:*:*:*:*:*:*:*
busybox-binarybusyboxpkg:generic/busyboxcpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*
chrome-binarychromepkg:generic/chromecpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
consul-binaryconsulpkg:golang/github.com/hashicorp/consulcpe:2.3:a:hashicorp:consul:*:*:*:*:*:*:*:*
curl-binarycurlpkg:generic/curlcpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*
dart-binarydartpkg:generic/dartcpe:2.3:a:dart:dart_software_development_kit:*:*:*:*:*:*:*:*
elixir-binaryelixirpkg:generic/elixircpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*
elixir-libraryelixir/ebin/elixir.apppkg:generic/elixircpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*
erlang-alpine-binarybeam.smppkg:generic/erlangcpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:*
erlang-binaryerlexecpkg:generic/erlangcpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:*
erlang-libraryliberts_internal.apkg:generic/erlangcpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:*
ffmpeg-binaryffmpegpkg:generic/ffmpegcpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
ffmpeg-librarylibav*pkg:generic/ffmpegcpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
ffmpeg-librarylibswresample*pkg:generic/ffmpegcpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
fluent-bit-binaryfluent-bitpkg:github/fluent/fluent-bitcpe:2.3:a:treasuredata:fluent_bit:*:*:*:*:*:*:*:*
gcc-binarygccpkg:generic/gcccpe:2.3:a:gnu:gcc:*:*:*:*:*:*:*:*
go-binarygopkg:generic/gocpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
go-binary-hintVERSION*pkg:generic/gocpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
gzip-binarygzippkg:generic/gzipcpe:2.3:a:gnu:gzip:*:*:*:*:*:*:*:*
haproxy-binaryhaproxypkg:generic/haproxycpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*
hashicorp-vault-binaryvaultpkg:golang/github.com/hashicorp/vaultcpe:2.3:a:hashicorp:vault:*:*:*:*:*:*:*:*
haskell-cabal-binarycabalpkg:generic/haskell/cabalcpe:2.3:a:haskell:cabal:*:*:*:*:*:*:*:*
haskell-ghc-binaryghc*pkg:generic/haskell/ghccpe:2.3:a:haskell:ghc:*:*:*:*:*:*:*:*
haskell-stack-binarystackpkg:generic/haskell/stackcpe:2.3:a:haskell:stack:*:*:*:*:*:*:*:*
helmhelmpkg:golang/helm.sh/helmcpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*
httpd-binaryhttpdpkg:generic/httpdcpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
java-binaryjavapkg:generic/oracle/graalvm
pkg:generic/azul/zulu
pkg:generic/oracle/openjdk
pkg:generic/oracle/openjdk
pkg:generic/ibm/java
pkg:generic/oracle/jre
pkg:generic/oracle/jre		cpe:2.3:a:oracle:graalvm:*:*:*:*:*:*:*:*
cpe:2.3:a:azul:zulu:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:openjdk:{{.primary}}:update{{.update}}:*:*:*:*:*:*
cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:java:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*
java-jdb-binaryjdbpkg:generic/oracle/graalvm
pkg:generic/azul/zulu
pkg:generic/oracle/openjdk
pkg:generic/ibm/java_sdk
pkg:generic/oracle/openjdk
pkg:generic/oracle/jdk		cpe:2.3:a:oracle:graalvm_for_jdk:*:*:*:*:*:*:*:*
cpe:2.3:a:azul:zulu:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:java_sdk:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*
jq-binaryjqpkg:generic/jqcpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*
julia-binarylibjulia-internal.sopkg:generic/juliacpe:2.3:a:julialang:julia:*:*:*:*:*:*:*:*
lighttpd-binarylighttpdpkg:generic/lighttpdcpe:2.3:a:lighttpd:lighttpd:*:*:*:*:*:*:*:*
mariadb-binary{mariadb,mysql}pkg:generic/mariadbcpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
memcached-binarymemcachedpkg:generic/memcachedcpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:*
mysql-binarymysqlpkg:generic/mysqlcpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*
mysql-binarymysqlpkg:generic/percona-servercpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*
cpe:2.3:a:percona:percona_server:*:*:*:*:*:*:*:*
mysql-binarymysqlpkg:generic/percona-xtradb-clustercpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*
cpe:2.3:a:percona:percona_server:*:*:*:*:*:*:*:*
cpe:2.3:a:percona:xtradb_cluster:*:*:*:*:*:*:*:*
nginx-binarynginxpkg:generic/nginxcpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*
cpe:2.3:a:nginx:nginx:*:*:*:*:*:*:*:*
nodejs-binarynodepkg:generic/nodecpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*
openssl-binaryopensslpkg:generic/opensslcpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
perl-binaryperlpkg:generic/perlcpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*
php-composer-binarycomposer*pkg:generic/composercpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:*
postgresql-binarypostgrespkg:generic/postgresqlcpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
proftpd-binaryproftpdpkg:generic/proftpdcpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*
pypy-binary-liblibpypy*.so*pkg:generic/pypy-
python-binarypython*pkg:generic/pythoncpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
python-binary-liblibpython*.so*pkg:generic/pythoncpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
redis-binaryredis-serverpkg:generic/rediscpe:2.3:a:redislabs:redis:*:*:*:*:*:*:*:*
cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*
ruby-binaryrubypkg:generic/rubycpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
rust-standard-library-linuxlibstd-*.sopkg:generic/rustcpe:2.3:a:rust-lang:rust:*:*:*:*:*:*:*:*
rust-standard-library-macoslibstd-*.dylibpkg:generic/rustcpe:2.3:a:rust-lang:rust:*:*:*:*:*:*:*:*
sqlcipher-binarysqlcipherpkg:generic/sqlciphercpe:2.3:a:zetetic:sqlcipher:*:*:*:*:*:*:*:*
swipl-binaryswiplpkg:generic/swiplcpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:*
traefik-binarytraefikpkg:generic/traefikcpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*
util-linux-binarygetoptpkg:generic/util-linuxcpe:2.3:a:kernel:util-linux:*:*:*:*:*:*:*:*
wordpress-cli-binarywppkg:generic/wp-clicpe:2.3:a:wp-cli:wp-cli:*:*:*:*:*:*:*:*
xtrabackup-binaryxtrabackuppkg:generic/percona-xtrabackupcpe:2.3:a:percona:xtrabackup:*:*:*:*:*:*:*:*
xz-binaryxzpkg:generic/xzcpe:2.3:a:tukaani:xz:*:*:*:*:*:*:*:*
zstd-binaryzstdpkg:generic/zstdcpe:2.3:a:facebook:zstandard:*:*:*:*:*:*:*:*

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.stock.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps

7 - Bitnami

Bitnami package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
bitnami-cataloger
/opt/bitnami/**/.spdx-*.spdx
TransitiveCompleteRuntime

Since all package data is gathered from SPDX SBOMs, the quality of the package analysis is dependent on the quality of the provided SBOMs.

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
Bitnami Vulnerability Database

Next steps

8 - Conda

Conda package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
conda-meta-cataloger
conda-meta/*.json
DirectRuntime

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.stock.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps

9 - C/C++

C/C++ package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
conan-cataloger
conan.lock
TransitiveRuntime, Build
conan-cataloger
conanfile.txt
DirectRuntime
conan-info-cataloger
conaninfo.txt
DirectFlatRuntime

We support package detection for v1 and v2 formatted conan.lock files.

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.stock.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps

10 - Dart

Dart package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
dart-pubspec-cataloger
pubspec.yml, pubspec.yaml
DirectRuntime
dart-pubspec-lock-cataloger
pubspec.lock
TransitiveRuntime, Dev

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.stock.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps

11 - DPKG

Debian package format used by Debian-based Linux distributions

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
deb-archive-cataloger
*.deb
dpkg-db-cataloger
lib/dpkg/status, lib/dpkg/status.d/*, lib/opkg/info/*.control, lib/opkg/status
TransitiveCompleteRuntime

There is additional functionality for:

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
Debian Security Tracker (DSA, DLA)
ECHO Security
Ubuntu CVE Tracker (USN)

Operating systems

Operating SystemSupported VersionsProviderData Source
Debian7 (wheezy), 8 (jessie), 9 (stretch), 10 (buster), 11 (bullseye), 12 (bookworm), 13 (trixie), 14, unstabledebianDebian Security Tracker
Echo OSrollingechoECHO Security
Raspberry Pi OS7 (wheezy), 8 (jessie), 9 (stretch), 10 (buster), 11 (bullseye), 12 (bookworm), 13 (trixie), 14, unstabledebianDebian Security Tracker
Ubuntu12.04 (precise), 12.10 (quantal), 13.04 (raring), 14.04 (trusty), 14.10 (utopic), 15.04 (vivid), 15.10 (wily), 16.04 (xenial), 16.10 (yakkety), 17.04 (zesty), 17.10 (artful), 18.04 (bionic), 18.10 (cosmic), 19.04 (disco), 19.10 (eoan), 20.04 (focal), 20.10 (groovy), 21.04 (hirsute), 21.10 (impish), 22.04 (jammy), 22.10 (kinetic), 23.04 (lunar), 23.10 (mantic), 24.04 (noble), 24.10 (oracular), 25.04 (plucky), 25.10ubuntuUbuntu CVE Tracker

Next steps

12 - .NET

.NET package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
dotnet-deps-binary-cataloger
*.deps.json, *.dll, *.exe
TransitiveCompleteRuntime
dotnet-deps-cataloger deprecated
*.deps.json
TransitiveCompleteRuntime
dotnet-packages-lock-cataloger
packages.lock.json
TransitiveCompleteRuntime, Dev, Build
dotnet-portable-executable-cataloger deprecated
*.dll, *.exe

Syft Configuration
Configuration KeyDescription
dotnet.dep-packages-must-claim-dllAllows for deps.json packages to be included only if there is a runtime/resource DLL claimed in the deps.json targets section. This does not require such claimed DLLs to exist on disk. The behavior of this
dotnet.dep-packages-must-have-dllAllows for deps.json packages to be included only if there is a DLL on disk for that package.
dotnet.propagate-dll-claims-to-parentsAllows for deps.json packages to be included if any child (transitive) package claims a DLL. This applies to both the claims configuration and evidence-on-disk configurations.
dotnet.relax-dll-claims-when-bundling-detectedWill look for indications of IL bundle tooling via deps.json package names and, if found (and this config option is enabled), will relax the DepPackagesMustClaimDLL value to `false` only in those cases.

When scanning a .NET application evidence from deps.json (compiler output) as well as any built binaries are used together to identify packages. This way we can enrich missing data from any one source and synthesize a more complete and accurate package graph.

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
GitHub Security Advisories (GHSA)
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.dotnet.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps

13 - Elixir

Elixir package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
elixir-mix-lock-cataloger
mix.lock
TransitiveRuntime, Dev

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.stock.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps

14 - Erlang

Erlang package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
erlang-otp-application-cataloger
*.app
DirectRuntime, Dev
erlang-rebar-lock-cataloger
rebar.lock
DirectRuntime, Dev

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.stock.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps

15 - GitHub Actions

GitHub Actions package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
github-action-workflow-usage-cataloger
.github/workflows/*.yaml, .github/workflows/*.yml
github-actions-usage-cataloger
.github/actions/*/action.yml, .github/actions/*/action.yaml
github-actions-usage-cataloger
.github/workflows/*.yaml, .github/workflows/*.yml

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
GitHub Security Advisories (GHSA)

Next steps

16 - Go

Go package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
go-module-binary-cataloger
application/x-executable, application/x-mach-binary, application/x-elf, application/x-sharedlib, application/vnd.microsoft.portable-executable, application/x-executable (mimetype)
TransitiveFlatRuntime, Dev
go-module-file-cataloger
go.mod
TransitiveFlatRuntime, Dev

Syft Configuration
Configuration KeyDescription
golang.local-mod-cache-dirSpecifies the location of the local go module cache directory. When not set, syft will attempt to discover the GOPATH env or default to $HOME/go.
golang.local-vendor-dirSpecifies the location of the local vendor directory. When not set, syft will search for a vendor directory relative to the go.mod file.
golang.no-proxyIs a list of glob patterns that match go module names that should not be fetched from the go proxy. When not set, syft will use the GOPRIVATE and GONOPROXY env vars.
golang.proxyIs a list of go module proxies to use when fetching go module metadata and licenses. When not set, syft will use the GOPROXY env or default to https://proxy.golang.org,direct.
golang.search-local-mod-cache-licensesEnables searching for go package licenses in the local GOPATH mod cache.
golang.search-local-vendor-licensesEnables searching for go package licenses in the local vendor directory relative to the go.mod file.
golang.search-remote-licensesEnables downloading go package licenses from the upstream go proxy (typically proxy.golang.org).

Version detection for binaries

When Syft scans a Go binary, the main module often has version (devel) because Go doesn’t embed version information by default. Syft attempts to detect the actual version using three strategies (configurable via golang.main-module-version.*):

  1. From ldflags (enabled by default): Looks for version strings passed during build like -ldflags="-X main.version=v1.2.3". Supports common patterns: *.version=, *.gitTag=, *.release=, etc.

  2. From build settings (enabled by default): Uses VCS metadata (commit hash and timestamp) embedded by Go 1.18+ to generate a pseudo-version like v0.0.0-20230101120000-abcdef123456.

  3. From contents (disabled by default): Scans binary contents for version string patterns. Can produce false positives.

Best practice: Use -ldflags when building to embed your version explicitly.

Example:

go build -ldflags="-X main.version=v1.2.3"

This ensures Syft (and Grype) can accurately identify your application version for vulnerability matching.

Standard library

Syft automatically creates a stdlib package for each Go binary, representing the Go standard library version used to compile it. The version is extracted from the binary’s build metadata (e.g., go1.22.2). This enables Grype to check for vulnerabilities reported against the go standard library.

Why this matters: Vulnerabilities in the Go compiler (like CVEs affecting the crypto library or net/http) can affect your application even if your code doesn’t directly use those packages.

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
GitHub Security Advisories (GHSA)
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.golang.using-cpesUse CPE package identifiers to find vulnerabilities
match.golang.always-use-cpe-for-stdlibuse CPE matching to find vulnerabilities for the Go standard library
match.golang.allow-main-module-pseudo-version-comparisonallow comparison between main module pseudo-versions (e.g. v0.0.0-20240413-2b432cf643...)

Main module filtering

Grype skips vulnerability matching for packages that match all these conditions:

  • Package name equals the main module name (from the SBOM metadata)
  • Package version is unreliable:
    • When allow-main-module-pseudo-version-comparison is false (default): version starts with v0.0.0- or is (devel)
    • When allow-main-module-pseudo-version-comparison is true: version is (devel) only

This filtering exists because Go doesn’t have a standard way to embed the main module’s version into compiled binaries (see golang/go#50603). Pseudo-versions in compiled binaries are often unreliable for vulnerability matching.

You can disable this filtering with the allow-main-module-pseudo-version-comparison configuration option.

Troubleshooting

No vulnerabilities found for main module

Cause: The main module has a pseudo-version (v0.0.0-*) or (devel), which Grype filters by default.

Solution: Enable pseudo-version matching in your Grype configuration:

match:
  golang:
    allow-main-module-pseudo-version-comparison: true

No vulnerabilities found for stdlib

Possible causes:

  • Missing CPEs: Verify Syft generates CPEs with generate-cpes: true in .syft.yaml
  • CPE matching disabled: Ensure always-use-cpe-for-stdlib: true in Grype config (default)
  • Incorrect version format: Stdlib version should be go1.18.3, not v1.18.3 (file a Syft bug if incorrect)

Next steps

17 - Haskell

Haskell package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
haskell-cataloger
cabal.project.freeze
TransitiveRuntime, Dev
haskell-cataloger
stack.yaml.lock
TransitiveRuntime, Dev
haskell-cataloger
stack.yaml
DirectRuntime, Dev

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.stock.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps

18 - Homebrew

Homebrew package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
homebrew-cataloger
Cellar/*/*/.brew/*.rb, Library/Taps/*/*/Formula/*.rb

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.stock.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps

19 - Java

Java package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
graalvm-native-image-cataloger
application/x-executable, application/x-mach-binary, application/x-elf, application/x-sharedlib, application/vnd.microsoft.portable-executable (mimetype)
TransitiveCompleteRuntime, Dev
java-archive-cataloger
*.jar, *.war, *.ear, *.par, *.sar, *.nar, *.jpi, *.hpi, *.kar, *.lpkg
TransitiveCompleteRuntime, Dev
java-archive-cataloger
*.zip
TransitiveCompleteRuntime, Dev
java-archive-cataloger
*.tar, *.tar.gz, *.tgz, *.tar.bz, *.tar.bz2, *.tbz, *.tbz2, *.tar.br, *.tbr, *.tar.lz4, *.tlz4, *.tar.sz, *.tsz, *.tar.xz, *.txz, *.tar.zst, *.tzst, *.tar.zstd, *.tzstd
TransitiveCompleteRuntime, Dev
java-gradle-lockfile-cataloger
gradle.lockfile*
TransitiveRuntime, Dev
java-jvm-cataloger
release
TransitiveRuntime, Dev
java-pom-cataloger
*pom.xml
DirectCompleteRuntime, Dev

Syft Configuration
Configuration KeyDescription
java.maven-local-repository-dirSpecifies the location of the local maven repository. When not set, defaults to ~/.m2/repository.
java.maven-urlSpecifies the base URL(s) to use for fetching POMs and metadata from maven central or other repositories. When not set, defaults to https://repo1.maven.org/maven2.
java.max-parent-recursive-depthLimits how many parent POMs will be fetched recursively before stopping. This prevents infinite loops or excessively deep parent chains.
java.resolve-transitive-dependenciesEnables resolving transitive dependencies for java packages found within archives.
java.use-maven-local-repositoryEnables searching the local maven repository (~/.m2/repository by default) for parent POMs and other metadata.
java.use-networkEnables network operations for java package metadata enrichment, such as fetching parent POMs and license information.

Archives

When scanning a Java archive (e.g. jar, war, ear, …), Syft will look for maven project evidence within the archive recursively. This means that if a jar file contains other jar files, Syft will also look for pom.xml files within those nested jar files to identify packages (such as with shaded jars).

Additionally, if opted-in via configuration, Syft will scan non-java archive files (e.g., zip, tar, tar.gz, …) for Java package evidence as well.

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
GitHub Security Advisories (GHSA)
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.java.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps

20 - JavaScript

JavaScript package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
javascript-lock-cataloger
pnpm-lock.yaml
TransitiveRuntime
javascript-lock-cataloger
yarn.lock
TransitiveRuntime, Dev
javascript-lock-cataloger
package-lock.json
TransitiveRuntime
javascript-package-cataloger
package.json
DirectRuntime

Syft Configuration
Configuration KeyDescription
javascript.include-dev-dependenciesControls whether development dependencies should be included in the catalog results, in addition to production dependencies.
javascript.npm-base-urlSpecifies the base URL for the NPM registry API used when searching for remote license information.
javascript.search-remote-licensesEnables querying the NPM registry API to retrieve license information for packages that are missing license data in their local metadata.

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
GitHub Security Advisories (GHSA)
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.javascript.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps

21 - Linux Kernel

Linux kernel archive and module analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
linux-kernel-cataloger
kernel, kernel-*, vmlinux, vmlinux-*, vmlinuz, vmlinuz-*, lib/modules/**/*.ko

Syft Configuration
Configuration KeyDescription
linux-kernel.catalog-modulesEnables cataloging linux kernel modules (*.ko files) in addition to the kernel itself.

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.stock.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps

22 - Lua

Lua package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
lua-rock-cataloger
*.rockspec

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.stock.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps

23 - Nix

Nix package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
nix-cataloger
nix/var/nix/db/db.sqlite, nix/store/*, nix/store/*.drv
TransitiveCompleteRuntime
nix-store-cataloger deprecated
nix/store/*, nix/store/*.drv
TransitiveCompleteRuntime

Syft Configuration
Configuration KeyDescription
nix.capture-owned-filesDetermines whether to record the list of files owned by each Nix package discovered in the store. Recording owned files provides more detailed information but increases processing time and memory usage.

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.stock.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps

24 - OCaml

OCaml package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
opam-cataloger
*opam
DirectRuntime

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.stock.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps

25 - PHP

PHP package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
php-composer-installed-cataloger
installed.json
TransitiveRuntime, Dev
php-composer-lock-cataloger
composer.lock
TransitiveRuntime
php-interpreter-cataloger
php*/**/*.so, php-fpm*, apache*/**/libphp*.so
DirectFlatRuntime
php-pear-serialized-cataloger
php/.registry/**/*.reg
DirectRuntime
php-pecl-serialized-cataloger deprecated
php/.registry/.channel.*/*.reg
DirectRuntime

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.stock.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps

26 - Portage

Portage package format used by Gentoo-based Linux distributions

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
portage-cataloger
var/db/pkg/*/*/CONTENTS
DirectRuntime

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
National Vulnerability Database (NVD)

Operating systems

Operating SystemSupported VersionsProviderData Source
Gentoo Linuxminimal support (CPE-based)nvdNational Vulnerability Database (NVD)

Next steps

27 - Prolog

Prolog package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
swipl-pack-cataloger
pack.pl
DirectRuntime, Dev

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.stock.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps

28 - Python

Python package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
python-installed-package-cataloger
*.egg-info, *dist-info/METADATA, *egg-info/PKG-INFO, *DIST-INFO/METADATA, *EGG-INFO/PKG-INFO
DirectCompleteRuntime
python-package-cataloger
pdm.lock
TransitiveCompleteRuntime, Dev, Optional
python-package-cataloger
uv.lock
TransitiveCompleteRuntime, Dev, Optional
python-package-cataloger
setup.py
Direct
python-package-cataloger
Pipfile.lock
TransitiveRuntime
python-package-cataloger
poetry.lock
TransitiveCompleteRuntime, Dev, Optional
python-package-cataloger
*requirements*.txt
DirectAny

Syft Configuration
Configuration KeyDescription
python.guess-unpinned-requirementsAttempts to infer package versions from version constraints when no explicit version is specified in requirements files.
python.pypi-base-urlSpecifies the base URL for the Pypi registry API used when searching for remote license information.
python.search-remote-licensesEnables querying the NPM registry API to retrieve license information for packages that are missing license data in their local metadata.

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
GitHub Security Advisories (GHSA)
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.python.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps

29 - R

R package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
r-package-cataloger
DESCRIPTION

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.stock.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps

30 - RPM

Red Hat Package Manager format used by Red Hat-based Linux distributions

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
rpm-archive-cataloger
*.rpm
rpm-db-cataloger
var/lib/rpmmanifest/container-manifest-2
TransitiveRuntime
rpm-db-cataloger
{var/lib,usr/share,usr/lib/sysimage}/rpm/{Packages,Packages.db,rpmdb.sqlite}
TransitiveCompleteRuntime

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
AlmaLinux OSV Database (ALSA)
Amazon Linux Security Center (ALAS)
Microsoft AzureLinux OVAL
Red Hat Security Data API (RHSA)
National Vulnerability Database (NVD)
Microsoft CBL-Mariner OVAL
Oracle Linux Security (ELSA)
SUSE Security OVAL (SUSE-SU)

Operating systems

Operating SystemSupported VersionsProviderData Source
AlmaLinux8, 9, 10almaAlmaLinux OSV Database
Amazon Linux2, 2022, 2023amazonAmazon Linux Security Center
Azure Linux3.0marinerMicrosoft CBL-Mariner OVAL
CentOS5, 6, 7, 8rhelRed Hat Security Data API
Fedoraminimal support (CPE-based)nvdNational Vulnerability Database (NVD)
CBL-Mariner1.0, 2.0marinerMicrosoft CBL-Mariner OVAL
OpenSUSE Leapminimal support (CPE-based)nvdNational Vulnerability Database (NVD)
Oracle Linux5, 6, 7, 8, 9, 10oracleOracle Linux Security
Photon OSminimal support (CPE-based)nvdNational Vulnerability Database (NVD)
Red Hat Enterprise Linux5, 6, 7, 8, 9, 10
EUS: 5.9, 6.4+, 7, 8.1, 8.2, 8.4, 8.6, 8.8, 9		rhelRed Hat Security Data API
Rocky Linux5, 6, 7, 8, 9, 10rhelRed Hat Security Data API
SUSE Linux Enterprise Server11, 12, 15slesSUSE Security OVAL

Next steps

31 - Ruby

Ruby package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
ruby-gemfile-cataloger
Gemfile.lock
TransitiveRuntime, Dev
ruby-gemspec-cataloger
*.gemspec
DirectRuntime
ruby-installed-gemspec-cataloger
specifications/**/*.gemspec
TransitiveRuntime

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
GitHub Security Advisories (GHSA)
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.ruby.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps

32 - Rust

Rust package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
cargo-auditable-binary-cataloger
application/x-executable, application/x-mach-binary, application/x-elf, application/x-sharedlib, application/vnd.microsoft.portable-executable, application/x-executable (mimetype)
TransitiveCompleteRuntime
rust-cargo-lock-cataloger
Cargo.lock
TransitiveCompleteRuntime, Dev, Build

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
GitHub Security Advisories (GHSA)
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.rust.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps

33 - SBOM

SBOM package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
sbom-cataloger
*.syft.json, *.bom.*, *.bom, bom, *.sbom.*, *.sbom, sbom, *.cdx.*, *.cdx, *.spdx.*, *.spdx

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.stock.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps

34 - Snap

Snap package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
snap-cataloger
snap/snapcraft.yaml
snap-cataloger
snap/manifest.yaml
snap-cataloger
doc/linux-modules-*/changelog.Debian.gz
snap-cataloger
usr/share/snappy/dpkg.yaml
snap-cataloger
meta/snap.yaml

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.stock.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps

35 - Swift

Swift package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
cocoapods-cataloger
Podfile.lock
TransitiveRuntime
swift-package-manager-cataloger
Package.resolved, .package.resolved
TransitiveRuntime

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.stock.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps

36 - Terraform

Terraform package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
terraform-lock-cataloger
.terraform.lock.hcl
DirectRuntime

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.stock.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps

37 - Wordpress

Wordpress package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + EvidenceLicenseDependenciesPackage Manager Claims
DepthEdgesKindsFilesDigestsIntegrity Hash
wordpress-plugins-cataloger
wp-content/plugins/*/*.php

Vulnerability scanning

Data SourceDisclosuresFixesTrack by
Source
Package
AffectedDateVersionsDate
National Vulnerability Database (NVD)

Grype Configuration
Configuration KeyDescription
match.stock.using-cpesUse CPE package identifiers to find vulnerabilities

Next steps