From 83dfbcc24a5ddc8390474c3527e9e49e7cedecce Mon Sep 17 00:00:00 2001
From: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Date: Thu, 13 Aug 2026 13:35:48 -0400
Subject: [PATCH] fix(binary): require gzip identity evidence in gzip
 classifier

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
---
 syft/pkg/cataloger/binary/classifiers.go        |   6 ++++++
 .../binary/testdata/classifiers/negative/gzip   | Bin 0 -> 164 bytes
 .../snippets/gzip/1.12/linux-amd64/gzip         | Bin 346 -> 346 bytes
 3 files changed, 6 insertions(+)
 create mode 100644 syft/pkg/cataloger/binary/testdata/classifiers/negative/gzip

diff --git a/syft/pkg/cataloger/binary/classifiers.go b/syft/pkg/cataloger/binary/classifiers.go
index afd4c7536..58c1e3e46 100644
--- a/syft/pkg/cataloger/binary/classifiers.go
+++ b/syft/pkg/cataloger/binary/classifiers.go
@@ -898,7 +898,13 @@ func DefaultClassifiers() []binutils.Classifier {
 		{
 			Class:    "gzip-binary",
 			FileGlob: "**/gzip",
+			// GNU gzip assembles its version banner at runtime from argv[0], so the version is stored as a
+			// bare NUL-delimited token with nothing to anchor against. Require a gzip-specific string
+			// elsewhere in the file before trusting that token, otherwise any binary reachable by a path
+			// named "gzip" (such as the busybox multicall binary, which provides a gzip applet by symlink)
+			// is reported as GNU gzip with an arbitrary version.
 			EvidenceMatcher: m.FileContentsVersionMatcher(
+				`not in gzip format|bug-gzip@gnu\.org|GZIP environment variable`,
 				`\x00(?P<version>[0-9]+\.[0-9]+)\x00`,
 			),
 			Package: "gzip",
diff --git a/syft/pkg/cataloger/binary/testdata/classifiers/negative/gzip b/syft/pkg/cataloger/binary/testdata/classifiers/negative/gzip
new file mode 100644
index 0000000000000000000000000000000000000000..cb82dd43995e0fa4f7f0331efbdaeb068fa0fe22
GIT binary patch
literal 164
zcmZY1Jr08)00vNIPw^#P+ChT!hm_Io?P3oAN(vFw2%6f{m(D%FdpitcG7`zUh-k;f
zcep<q1eID_6ncr99^VLyPp)j0_t0)o^M=`|)|w8hQyCk)K5l}VCT|kr7Q7q!qRzU`
kdadYDP=-Bc{8X}Q$uHnco`qxr&*pac|0(%}gjAG~FV&zlA^-pY

literal 0
HcmV?d00001

diff --git a/syft/pkg/cataloger/binary/testdata/classifiers/snippets/gzip/1.12/linux-amd64/gzip b/syft/pkg/cataloger/binary/testdata/classifiers/snippets/gzip/1.12/linux-amd64/gzip
index 64510d6c4de9f3b608baf906b49210a910c8ab55..4fd3dbe2b3d5275763e1c65a8e3b84d8585c7318 100644
GIT binary patch
delta 201
zcmXwxIS#@w6hy6*J^-Si_)R(##WrzbDz4%+vM_d(1yD{wu9wq*3yP7RG;d}v_TqCW
zYOx(pH_N!v)G6Hx)ii<&Q*$F3=StePV}>z8J0%)TT0$w|S_r|NR2R)^%R08r@ogYE
za6VX!a5-HeC#D&Egnsn{xHLZGj8U)=%CMYa@@oc+bQ;HH$mX!j75a}~a*RIq`3WN>
T4GdD>A=sx4h*X6B#9Vy=2$MRd

delta 174
zcmZ|EIS#@w5I|9rLm&zy+*pDJ;WcB?a1F|dJr+nfL9w|95x2`}SbBc(nm;#l^ISF_
zrq%kSA_N&?cTmc^mXwPQQfDm!B-G#ow%VZqt6d`W2EjT~QfuFOP-LdszmAK|nPsY%
qA#xtZz`sST#Cg5ukL=NhA>T(Tg(CayKQLkUG6})>whk3<W%mYNr!5!&