From 236755a6b11c5fcab8a0a43759dcec30895c4c56 Mon Sep 17 00:00:00 2001
From: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com>
Date: Thu, 20 Aug 2026 16:02:14 -0400
Subject: [PATCH] fix(binary): gzip classifier & GNU gzip identity string
 (#5202)

---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
---
 syft/pkg/cataloger/binary/classifiers.go        |   5 +++++
 .../binary/testdata/classifiers/negative/gzip   | Bin 0 -> 148 bytes
 .../snippets/gzip/1.12/linux-amd64/gzip         | Bin 346 -> 376 bytes
 3 files changed, 5 insertions(+)
 create mode 100644 syft/pkg/cataloger/binary/testdata/classifiers/negative/gzip

diff --git a/syft/pkg/cataloger/binary/classifiers.go b/syft/pkg/cataloger/binary/classifiers.go
index 78f6e18ed..26fd9ce7f 100644
--- a/syft/pkg/cataloger/binary/classifiers.go
+++ b/syft/pkg/cataloger/binary/classifiers.go
@@ -899,6 +899,11 @@ func DefaultClassifiers() []binutils.Classifier {
 			Class:    "gzip-binary",
 			FileGlob: "**/gzip",
 			EvidenceMatcher: m.FileContentsVersionMatcher(
+				// GNU gzip keeps the version as a bare NUL-delimited token, so require an identifying
+				// string from the program as well. Without it any binary that happens to be named gzip
+				// (such as the busybox multicall binary behind a gzip applet symlink) would have an
+				// arbitrary NUL-delimited "N.N" token reported as a GNU gzip version.
+				`%s: %s: not in gzip format`,
 				`\x00(?P<version>[0-9]+\.[0-9]+)\x00`,
 			),
 			Package: "gzip",
diff --git a/syft/pkg/cataloger/binary/testdata/classifiers/negative/gzip b/syft/pkg/cataloger/binary/testdata/classifiers/negative/gzip
new file mode 100644
index 0000000000000000000000000000000000000000..e6c2a242f2355407ee2ab6e560c98fc14f856045
GIT binary patch
literal 148
zcmYk!u@1r@7)9aEJjG31+MxuhiAl%0>rx*8S`vtVp%F0h_7Yu8&ib7Ld`M<QvMwUp
zkZHyBHe*w1v1oOUMTa-GOvx>Z2-<n|EYQX}ze0JaeJ7I;%SO&WIyO}@Rq~Sjc;*7_
aAcj*fWDP=$-*BHV-EZ3eU0EZ!XxImVZZ1p!

literal 0
HcmV?d00001

diff --git a/syft/pkg/cataloger/binary/testdata/classifiers/snippets/gzip/1.12/linux-amd64/gzip b/syft/pkg/cataloger/binary/testdata/classifiers/snippets/gzip/1.12/linux-amd64/gzip
index 64510d6c4de9f3b608baf906b49210a910c8ab55..16433fd67b2de6ffb76e09fceccb0d8f625e7899 100644
GIT binary patch
delta 235
zcmXv|Ic~!+5M*5P0ZzM(yTIU*x~OlYH^5^h6JaPqq7uN3zu@F~c}dDhMT!{=FbC%6
z@OyY1F9La_G?r@*SPQ<SkTaFntC4lngBHF)>5+72z1T=~t*cPfmC~r3x6)Qdw9;7P
z8fvK~RVfl(V_S>b>93OR<O+G9<Y5|M2$4ABr=^D-X(|vBjJJ?snC5p=INR>PDXuTD
ugxfASbJIMpc~9oGoY{Z*)66NPabM!h8V}jHH;D8>k>MHT7Tm1wr{_PgB1UQe

delta 176
zcmaLEF%E(-6adib$N`+YkmzFQFD<{U9Kqe>(|&{m3bFMb8gJ)G9KC_>efOXJ^Kf-o
z%p7ldY^8##NO9UW&X<wE*j7S7uYBk$0B0Kp8!QgJF@!jfM(3%~mTENG4ot2lG?qbW
r?HY%`^()7Bw=<p0)521UNA&Bm-8m%=LjEC2b5=uH3VF<Hra7H{le#X~