fix: add correct CPE vendor/product candidates for Git for Windows PE binary (#5156)

Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>

.github/workflows/release.yaml

@@ -89,13 +89,13 @@ jobs:
         uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Login to Docker Hub
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 #v4.5.1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f #v4.6.0
         with:
           username: ${{ secrets.ANCHOREOSSWRITE_DH_USERNAME }}
           password: ${{ secrets.ANCHOREOSSWRITE_DH_PAT }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 #v4.5.1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f #v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

README.md

@@ -8,7 +8,6 @@
 
 <p align="center">
  &nbsp;<a href="https://github.com/anchore/syft/actions/workflows/validations.yaml" target="_blank"><img alt="Validations" src="https://github.com/anchore/syft/actions/workflows/validations.yaml/badge.svg"></a>&nbsp;
- &nbsp;<a href="https://goreportcard.com/report/github.com/anchore/syft" target="_blank"><img alt="Go Report Card" src="https://goreportcard.com/badge/github.com/anchore/syft"></a>&nbsp;
  &nbsp;<a href="https://github.com/anchore/syft/releases/latest" target="_blank"><img alt="GitHub release" src="https://img.shields.io/github/release/anchore/syft.svg"></a>&nbsp;
  &nbsp;<a href="https://github.com/anchore/syft" target="_blank"><img alt="GitHub go.mod Go version" src="https://img.shields.io/github/go-mod/go-version/anchore/syft.svg"></a>&nbsp;
  &nbsp;<a href="https://github.com/anchore/syft/blob/main/LICENSE" target="_blank"><img alt="License: Apache-2.0" src="https://img.shields.io/badge/License-Apache%202.0-blue.svg"></a>&nbsp;

cmd/syft/internal/options/catalog.go

@@ -199,7 +199,8 @@ func (cfg Catalog) ToPackagesConfig() pkgcataloging.Config {
 					WithFromLDFlags(cfg.Golang.MainModuleVersion.FromLDFlags),
 			).
 			WithUsePackagesLib(*multiLevelOption(true, enrichmentEnabled(cfg.Enrich, task.Go, task.Golang), cfg.Golang.UsePackagesLib)).
-			WithCaptureSymbols(cfg.Golang.CaptureSymbols),
+			WithCaptureSymbols(cfg.Golang.CaptureSymbols).
+			WithCaptureSymbolsModules(cfg.Golang.CaptureSymbolsModules),
 		JavaScript: javascript.DefaultCatalogerConfig().
 			WithIncludeDevDependencies(*multiLevelOption(false, cfg.JavaScript.IncludeDevDependencies)).
 			WithSearchRemoteLicenses(*multiLevelOption(false, enrichmentEnabled(cfg.Enrich, task.JavaScript, task.Node, task.NPM), cfg.JavaScript.SearchRemoteLicenses)).

cmd/syft/internal/options/golang.go

@@ -4,6 +4,7 @@ import (
 	"strings"
 
 	"github.com/anchore/clio"
+	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/cataloging"
 	"github.com/anchore/syft/syft/pkg/cataloger/golang"
 )
@@ -19,6 +20,7 @@ type golangConfig struct {
 	MainModuleVersion           golangMainModuleVersionConfig `json:"main-module-version" yaml:"main-module-version" mapstructure:"main-module-version"`
 	UsePackagesLib              *bool                         `json:"use-packages-lib" yaml:"use-packages-lib" mapstructure:"use-packages-lib"`
 	CaptureSymbols              cataloging.SymbolScope        `json:"capture-symbols" yaml:"capture-symbols" mapstructure:"capture-symbols"`
+	CaptureSymbolsModules       []string                      `json:"capture-symbols-modules" yaml:"capture-symbols-modules" mapstructure:"capture-symbols-modules"`
 }
 
 var _ interface {
@@ -42,8 +44,16 @@ if unset this defaults to $GONOPROXY`)
 always show (devel) as the version. Use these options to control heuristics to guess
 a more accurate version from the binary.`)
 	descriptions.Add(&o.UsePackagesLib, `use the golang.org/x/tools/go/packages library, which executes golang tooling found on the path in addition to potential network access to get the most accurate results`)
+	// note: descriptions must be static string literals; the app config discovery that generates the
+	// capability docs reads them straight out of the AST
 	descriptions.Add(&o.CaptureSymbols, `capture function symbols from the binary symbol table (pclntab). valid values are:
-"none" (disabled), "stdlib" (only the synthetic stdlib package), and "all" (all module packages plus stdlib)`)
+"none" (disabled), "stdlib" (only the synthetic stdlib package), "extended-stdlib" (stdlib plus every
+module under golang.org/x/), and "all" (all module packages plus stdlib)`)
+	descriptions.Add(&o.CaptureSymbolsModules, `glob patterns matched against go module paths (e.g. github.com/klauspost/**) that should have symbols
+captured in addition to whatever capture-symbols selects. ** crosses path separators, * does not.
+a trailing major version suffix is ignored when matching, so github.com/foo/* covers github.com/foo/bar/v2;
+spelling a suffix out in the pattern selects only that major version.
+this can only widen the selection, never narrow it, and is inert when capture-symbols is none`)
 	descriptions.Add(&o.MainModuleVersion.FromLDFlags, `look for LD flags that appear to be setting a version (e.g. -X main.version=1.0.0)`)
 	descriptions.Add(&o.MainModuleVersion.FromBuildSettings, `use the build settings (e.g. vcs.version & vcs.time) to craft a v0 pseudo version
 (e.g. v0.0.0-20220308212642-53e6d0aaf6fb) when a more accurate version cannot be found otherwise`)
@@ -51,7 +61,24 @@ a more accurate version from the binary.`)
 }
 
 func (o *golangConfig) PostLoad() error {
+	raw := strings.TrimSpace(string(o.CaptureSymbols))
 	o.CaptureSymbols = o.CaptureSymbols.Parse()
+
+	// an unrecognized value still resolves to "none", but say so rather than silently capturing nothing.
+	// stay quiet for unset and an explicit "none", which is the default and would otherwise warn on nearly
+	// every scan.
+	if o.CaptureSymbols == cataloging.SymbolScopeNone && raw != "" && !strings.EqualFold(raw, string(cataloging.SymbolScopeNone)) {
+		log.Warnf("unknown golang.capture-symbols value %q, defaulting to %q (valid values: none, stdlib, extended-stdlib, all)", raw, cataloging.SymbolScopeNone)
+	}
+
+	// trim only, deliberately not Flatten: viper already splits a comma-separated scalar (env var or a bare
+	// yaml string) into a slice before this point, and there is no CLI flag feeding this key. The one thing
+	// Flatten would add is splitting commas *inside* a list entry, which silently breaks doublestar brace
+	// alternation like github.com/{foo,bar}/**. Viper's split does not trim, so that part is still needed.
+	for i, pattern := range o.CaptureSymbolsModules {
+		o.CaptureSymbolsModules[i] = strings.TrimSpace(pattern)
+	}
+
 	return nil
 }
 
@@ -76,7 +103,8 @@ func defaultGolangConfig() golangConfig {
 			FromContents:      def.MainModuleVersion.FromContents,
 			FromBuildSettings: def.MainModuleVersion.FromBuildSettings,
 		},
-		UsePackagesLib: nil, // this defaults to true, which is the API default
-		CaptureSymbols: def.CaptureSymbols,
+		UsePackagesLib:        nil, // this defaults to true, which is the API default
+		CaptureSymbols:        def.CaptureSymbols,
+		CaptureSymbolsModules: def.CaptureSymbolsModules,
 	}
 }

cmd/syft/internal/options/golang_test.go

@@ -10,10 +10,11 @@ import (
 
 func Test_golangConfig_PostLoad(t *testing.T) {
 	tests := []struct {
-		name     string
-		cfg      golangConfig
-		expected cataloging.SymbolScope
-		wantErr  assert.ErrorAssertionFunc
+		name            string
+		cfg             golangConfig
+		expected        cataloging.SymbolScope
+		expectedModules []string
+		wantErr         assert.ErrorAssertionFunc
 	}{
 		{
 			name:     "normalize all",
@@ -25,6 +26,32 @@ func Test_golangConfig_PostLoad(t *testing.T) {
 			cfg:      golangConfig{CaptureSymbols: "stdlib"},
 			expected: cataloging.SymbolScopeStdlib,
 		},
+		{
+			name:     "normalize extended-stdlib",
+			cfg:      golangConfig{CaptureSymbols: " Extended-Stdlib "},
+			expected: cataloging.SymbolScopeExtendedStdlib,
+		},
+		{
+			name: "module patterns keep embedded commas",
+			cfg: golangConfig{
+				CaptureSymbols: "stdlib",
+				// brace alternation contains a comma; splitting on it would corrupt the pattern
+				CaptureSymbolsModules: []string{"github.com/{foo,bar}/**", "golang.org/x/**"},
+			},
+			expected:        cataloging.SymbolScopeStdlib,
+			expectedModules: []string{"github.com/{foo,bar}/**", "golang.org/x/**"},
+		},
+		{
+			// viper splits a comma-separated scalar (env var or bare yaml string) but does not trim,
+			// so a leading space would otherwise survive into a pattern that silently matches nothing
+			name: "module patterns are trimmed",
+			cfg: golangConfig{
+				CaptureSymbols:        "stdlib",
+				CaptureSymbolsModules: []string{"golang.org/x/**", " github.com/foo/** "},
+			},
+			expected:        cataloging.SymbolScopeStdlib,
+			expectedModules: []string{"golang.org/x/**", "github.com/foo/**"},
+		},
 		{
 			name:     "empty defaults to none",
 			cfg:      golangConfig{CaptureSymbols: ""},
@@ -32,7 +59,7 @@ func Test_golangConfig_PostLoad(t *testing.T) {
 		},
 		{
 			name:     "invalid value defaults to none",
-			cfg:      golangConfig{CaptureSymbols: "bogus"},
+			cfg:      golangConfig{CaptureSymbols: "stdlbi"},
 			expected: cataloging.SymbolScopeNone,
 		},
 		{
@@ -40,6 +67,16 @@ func Test_golangConfig_PostLoad(t *testing.T) {
 			cfg:      golangConfig{CaptureSymbols: "true"},
 			expected: cataloging.SymbolScopeNone,
 		},
+		{
+			name:     "explicit none resolves to none",
+			cfg:      golangConfig{CaptureSymbols: "none"},
+			expected: cataloging.SymbolScopeNone,
+		},
+		{
+			name:     "explicit none is not case sensitive",
+			cfg:      golangConfig{CaptureSymbols: " NONE "},
+			expected: cataloging.SymbolScopeNone,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -52,6 +89,7 @@ func Test_golangConfig_PostLoad(t *testing.T) {
 				return
 			}
 			assert.Equal(t, tt.expected, tt.cfg.CaptureSymbols)
+			assert.Equal(t, tt.expectedModules, tt.cfg.CaptureSymbolsModules)
 		})
 	}
 }

go.mod

@@ -42,7 +42,7 @@ require (
 	github.com/github/go-spdx/v2 v2.7.0
 	github.com/gkampitakis/go-snaps v0.5.23
 	github.com/go-git/go-billy/v5 v5.9.1
-	github.com/go-git/go-git/v5 v5.19.1
+	github.com/go-git/go-git/v5 v5.19.2
 	github.com/go-test/deep v1.1.1
 	github.com/go-viper/mapstructure/v2 v2.5.0
 	github.com/goccy/go-yaml v1.19.2
@@ -91,7 +91,7 @@ require (
 	github.com/xeipuuv/gojsonschema v1.2.0
 	github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1
 	go.uber.org/goleak v1.3.0
-	go.yaml.in/yaml/v3 v3.0.4
+	go.yaml.in/yaml/v3 v3.0.5
 	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
 	golang.org/x/mod v0.38.0
 	golang.org/x/net v0.57.0

go.sum

@@ -422,8 +422,8 @@ github.com/go-git/go-billy/v5 v5.9.1 h1:8U73XiOTfINdItHVa6z4Gv7ToObcZ6grkqQbLryL
 github.com/go-git/go-billy/v5 v5.9.1/go.mod h1:ExsU+jcGwXTBOnyilvAnEM1wug1IxHr4yP2ZXsNRtV0=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.19.1 h1:nX27AnaU43/K5bKktKwgBmR9lawoYVe1Ckg0rgzzN00=
-github.com/go-git/go-git/v5 v5.19.1/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ=
+github.com/go-git/go-git/v5 v5.19.2 h1:wkfn7vOlUBu8ivAWKBWisTiwJK4jYHzTF8Ndv1LyGqY=
+github.com/go-git/go-git/v5 v5.19.2/go.mod h1:QqCBE1EFN5ddFmrliLQ3/ntRCUjZU3EJuwuB/jWEHjk=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -1022,8 +1022,9 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
 go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 go.yaml.in/yaml/v4 v4.0.0-rc.2 h1:/FrI8D64VSr4HtGIlUtlFMGsm7H7pWTbj6vOLVZcA6s=
 go.yaml.in/yaml/v4 v4.0.0-rc.2/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
 go4.org v0.0.0-20230225012048-214862532bf5 h1:nifaUDeh+rPaBCMPMQHZmvJf+QdpLFnuQPwx+LxVmtc=

internal/capabilities/appconfig.yaml

@@ -15,7 +15,9 @@ application: # AUTO-GENERATED - application-level config keys
   - key: dotnet.relax-dll-claims-when-bundling-detected
     description: show all packages from the deps.json if bundling tooling is present as a dependency (e.g. ILRepack)
   - key: golang.capture-symbols
-    description: 'capture function symbols from the binary symbol table (pclntab). valid values are: "none" (disabled), "stdlib" (only the synthetic stdlib package), and "all" (all module packages plus stdlib)'
+    description: 'capture function symbols from the binary symbol table (pclntab). valid values are: "none" (disabled), "stdlib" (only the synthetic stdlib package), "extended-stdlib" (stdlib plus every module under golang.org/x/), and "all" (all module packages plus stdlib)'
+  - key: golang.capture-symbols-modules
+    description: glob patterns matched against go module paths (e.g. github.com/klauspost/**) that should have symbols captured in addition to whatever capture-symbols selects. ** crosses path separators, * does not. a trailing major version suffix is ignored when matching, so github.com/foo/* covers github.com/foo/bar/v2; spelling a suffix out in the pattern selects only that major version. this can only widen the selection, never narrow it, and is inert when capture-symbols is none
   - key: golang.local-mod-cache-dir
     description: specify an explicit go mod cache directory, if unset this defaults to $GOPATH/pkg/mod or $HOME/go/pkg/mod
   - key: golang.local-vendor-dir

schema/json/README.md

@@ -35,3 +35,24 @@ Create the new schema by running `make generate-json-schema` from the root of th
 - If there is an existing schema for the given version and the new schema **does not** match the existing schema, an error is shown indicating to increment the version appropriately (see the "Versioning" section)
 
 ***Note: never delete a JSON schema and never change an existing JSON schema once it has been published in a release!*** Only add new schemas with a newly incremented version. All previous schema files must be stored in the `schema/json/` directory.
+
+### Exception: `description`-only corrections
+
+A published schema may be amended in place for one narrow case: the change touches only `description` text and leaves the data shape identical. Descriptions are documentation carried alongside the schema rather than constraints a validator evaluates, so correcting one cannot invalidate a document that already validated against that version. Minting a new version instead would leave the old one permanently describing the tool incorrectly, and spend a version number on no semantic change.
+
+This applies when **every** one of the following holds:
+
+- the only differences are `description` values
+- no field, type, enum, `required` entry, or `$ref` is added, removed, or altered
+- the `$id` version is unchanged
+
+Anything else, including adding a field that happens to be optional, is a schema change and needs a version bump per the "Versioning" section above.
+
+The generator blocks an in-place edit by design, since it refuses to overwrite a file that differs from what it would produce. To amend one, delete the schema file and regenerate so it is rewritten from the current Go doc comments:
+
+```bash
+rm schema/json/schema-$VERSION.json
+make generate-json-schema
+```
+
+The result is byte-identical to what the generator produces, so do not hand-edit the JSON. Re-running `make generate-json-schema` afterwards should report `No change to the existing schema!`, and `make check-json-schema-drift` should pass. Confirm with `git diff` that the only changes are the intended description lines.

schema/json/schema-16.1.10.json

@@ -1662,7 +1662,7 @@
             "type": "array"
           },
           "type": "object",
-          "description": "Symbols are the function symbols from this module that are compiled into the binary, extracted from\nthe binary symbol table (pclntab) and grouped by the import path of the package that owns them. Each\nvalue is the sorted, deduplicated list of symbol names local to that package, i.e. with the import\npath prefix stripped (e.g. import path \"github.com/foo/bar\" -\u003e \"(*Type).Method\"). The fully qualified\nname is the import path, a \".\", and the local name. One exception: the binary's main package appears\nunder the key \"main\" (the name the linker assigns), not its original source import path, which is not\nrecoverable from the binary. Populated only when the golang cataloger's capture-symbols scope covers\nthis package: the \"all\" scope populates every module package plus the synthetic stdlib package, while\nthe \"stdlib\" scope populates only the stdlib package."
+          "description": "Symbols are the function symbols from this module that are compiled into the binary, extracted from\nthe binary symbol table (pclntab) and grouped by the import path of the package that owns them. Each\nvalue is the sorted, deduplicated list of symbol names local to that package, i.e. with the import\npath prefix stripped (e.g. import path \"github.com/foo/bar\" -\u003e \"(*Type).Method\"). The fully qualified\nname is the import path, a \".\", and the local name. One exception: the binary's main package appears\nunder the key \"main\" (the name the linker assigns), not its original source import path, which is not\nrecoverable from the binary. Populated only when the golang cataloger's capture-symbols scope covers\nthis package: the \"all\" scope populates every module package plus the synthetic stdlib package, the\n\"extended-stdlib\" scope populates the stdlib package plus every module under golang.org/x/, and the\n\"stdlib\" scope populates only the stdlib package. The capture-symbols-modules glob patterns populate\nany additional modules they match."
         }
       },
       "type": "object",

schema/json/schema-latest.json

@@ -1662,7 +1662,7 @@
             "type": "array"
           },
           "type": "object",
-          "description": "Symbols are the function symbols from this module that are compiled into the binary, extracted from\nthe binary symbol table (pclntab) and grouped by the import path of the package that owns them. Each\nvalue is the sorted, deduplicated list of symbol names local to that package, i.e. with the import\npath prefix stripped (e.g. import path \"github.com/foo/bar\" -\u003e \"(*Type).Method\"). The fully qualified\nname is the import path, a \".\", and the local name. One exception: the binary's main package appears\nunder the key \"main\" (the name the linker assigns), not its original source import path, which is not\nrecoverable from the binary. Populated only when the golang cataloger's capture-symbols scope covers\nthis package: the \"all\" scope populates every module package plus the synthetic stdlib package, while\nthe \"stdlib\" scope populates only the stdlib package."
+          "description": "Symbols are the function symbols from this module that are compiled into the binary, extracted from\nthe binary symbol table (pclntab) and grouped by the import path of the package that owns them. Each\nvalue is the sorted, deduplicated list of symbol names local to that package, i.e. with the import\npath prefix stripped (e.g. import path \"github.com/foo/bar\" -\u003e \"(*Type).Method\"). The fully qualified\nname is the import path, a \".\", and the local name. One exception: the binary's main package appears\nunder the key \"main\" (the name the linker assigns), not its original source import path, which is not\nrecoverable from the binary. Populated only when the golang cataloger's capture-symbols scope covers\nthis package: the \"all\" scope populates every module package plus the synthetic stdlib package, the\n\"extended-stdlib\" scope populates the stdlib package plus every module under golang.org/x/, and the\n\"stdlib\" scope populates only the stdlib package. The capture-symbols-modules glob patterns populate\nany additional modules they match."
         }
       },
       "type": "object",

syft/cataloging/symbols.go

@@ -12,6 +12,10 @@ const (
 	// SymbolScopeStdlib captures symbols only for the synthetic "stdlib" package, leaving module packages without symbols.
 	SymbolScopeStdlib SymbolScope = "stdlib"
 
+	// SymbolScopeExtendedStdlib captures symbols for the synthetic "stdlib" package as well as every module
+	// under golang.org/x/ (the extended standard library).
+	SymbolScopeExtendedStdlib SymbolScope = "extended-stdlib"
+
 	// SymbolScopeAll captures symbols for all module packages as well as the synthetic "stdlib" package.
 	SymbolScopeAll SymbolScope = "all"
 )
@@ -21,6 +25,8 @@ func (s SymbolScope) Parse() SymbolScope {
 	switch strings.ToLower(strings.TrimSpace(string(s))) {
 	case string(SymbolScopeAll):
 		return SymbolScopeAll
+	case string(SymbolScopeExtendedStdlib):
+		return SymbolScopeExtendedStdlib
 	case string(SymbolScopeStdlib):
 		return SymbolScopeStdlib
 	}

syft/cataloging/symbols_test.go

@@ -16,6 +16,11 @@ func Test_SymbolScope_Parse(t *testing.T) {
 		{"  all  ", SymbolScopeAll},
 		{"stdlib", SymbolScopeStdlib},
 		{"Stdlib", SymbolScopeStdlib},
+		{"extended-stdlib", SymbolScopeExtendedStdlib},
+		{"Extended-Stdlib", SymbolScopeExtendedStdlib},
+		{"EXTENDED-STDLIB", SymbolScopeExtendedStdlib},
+		{"  extended-stdlib  ", SymbolScopeExtendedStdlib},
+		{"extended_stdlib", SymbolScopeNone},
 		{"none", SymbolScopeNone},
 		{"", SymbolScopeNone},
 		{"true", SymbolScopeNone},

syft/pkg/cataloger/binary/classifiers.go

@@ -898,13 +898,7 @@ func DefaultClassifiers() []binutils.Classifier {
 		{
 			Class:    "gzip-binary",
 			FileGlob: "**/gzip",
-			// GNU gzip assembles its version banner at runtime from argv[0], so the version is stored as a
-			// bare NUL-delimited token with nothing to anchor against. Require a gzip-specific string
-			// elsewhere in the file before trusting that token, otherwise any binary reachable by a path
-			// named "gzip" (such as the busybox multicall binary, which provides a gzip applet by symlink)
-			// is reported as GNU gzip with an arbitrary version.
 			EvidenceMatcher: m.FileContentsVersionMatcher(
-				`not in gzip format|bug-gzip@gnu\.org|GZIP environment variable`,
 				`\x00(?P<version>[0-9]+\.[0-9]+)\x00`,
 			),
 			Package: "gzip",

syft/pkg/cataloger/golang/capabilities.yaml

@@ -25,8 +25,11 @@ configs: # AUTO-GENERATED - config structs and their fields
         description: NoProxy is a list of glob patterns that match go module names that should not be fetched from the go proxy. When not set, syft will use the GOPRIVATE and GONOPROXY env vars.
         app_key: golang.no-proxy
       - key: CaptureSymbols
-        description: CaptureSymbols controls extracting function symbols from the binary symbol table (pclntab). Valid values are "none" (disabled), "stdlib" (only the synthetic stdlib package), and "all" (all module packages plus stdlib).
+        description: CaptureSymbols controls extracting function symbols from the binary symbol table (pclntab). Valid values are "none" (disabled), "stdlib" (only the synthetic stdlib package), "extended-stdlib" (stdlib plus every module under golang.org/x/), and "all" (all module packages plus stdlib).
         app_key: golang.capture-symbols
+      - key: CaptureSymbolsModules
+        description: 'CaptureSymbolsModules is a list of glob patterns (doublestar syntax, where ** crosses path separators and * does not) matched against go module paths. Matching modules get symbols in addition to whatever CaptureSymbols selects, so this can only widen the selection and never narrow it. It has no effect under the "none" scope. A trailing major version suffix is not part of a module''s identity, so a pattern matches with or without it: both "github.com/foo/bar" and "github.com/foo/*" select "github.com/foo/bar/v2". A pattern that spells out a suffix selects only that major version.'
+        app_key: golang.capture-symbols-modules
 catalogers:
   - ecosystem: go # MANUAL
     name: go-module-binary-cataloger # AUTO-GENERATED

syft/pkg/cataloger/golang/config.go

@@ -51,10 +51,20 @@ type CatalogerConfig struct {
 	MainModuleVersion MainModuleVersionConfig `yaml:"main-module-version" json:"main-module-version" mapstructure:"main-module-version"`
 
 	// CaptureSymbols controls extracting function symbols from the binary symbol table (pclntab). Valid values are
-	// "none" (disabled), "stdlib" (only the synthetic stdlib package), and "all" (all module packages plus stdlib).
+	// "none" (disabled), "stdlib" (only the synthetic stdlib package), "extended-stdlib" (stdlib plus every module
+	// under golang.org/x/), and "all" (all module packages plus stdlib).
 	// app-config: golang.capture-symbols
 	CaptureSymbols cataloging.SymbolScope `yaml:"capture-symbols" json:"capture-symbols" mapstructure:"capture-symbols"`
 
+	// CaptureSymbolsModules is a list of glob patterns (doublestar syntax, where ** crosses path separators
+	// and * does not) matched against go module paths. Matching modules get symbols in addition to whatever
+	// CaptureSymbols selects, so this can only widen the selection and never narrow it. It has no effect
+	// under the "none" scope. A trailing major version suffix is not part of a module's identity, so a
+	// pattern matches with or without it: both "github.com/foo/bar" and "github.com/foo/*" select
+	// "github.com/foo/bar/v2". A pattern that spells out a suffix selects only that major version.
+	// app-config: golang.capture-symbols-modules
+	CaptureSymbolsModules []string `yaml:"capture-symbols-modules,omitempty" json:"capture-symbols-modules,omitempty" mapstructure:"capture-symbols-modules"`
+
 	// Whether to use the golang.org/x/tools/go/packages, which executes golang tooling found on the path in addition to potential network access
 	UsePackagesLib bool `json:"use-packages-lib" yaml:"use-packages-lib" mapstructure:"use-packages-lib"`
 }
@@ -196,6 +206,11 @@ func (g CatalogerConfig) WithCaptureSymbols(input cataloging.SymbolScope) Catalo
 	return g
 }
 
+func (g CatalogerConfig) WithCaptureSymbolsModules(input []string) CatalogerConfig {
+	g.CaptureSymbolsModules = input
+	return g
+}
+
 func (g CatalogerConfig) WithUsePackagesLib(useLib bool) CatalogerConfig {
 	g.UsePackagesLib = useLib
 	return g

syft/pkg/cataloger/golang/parse_go_binary.go

@@ -21,7 +21,6 @@ import (
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
-	"github.com/anchore/syft/syft/cataloging"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/internal/unionreader"
 	"github.com/anchore/syft/syft/pkg"
@@ -51,7 +50,7 @@ const devel = "(devel)"
 type goBinaryCataloger struct {
 	licenseResolver   goLicenseResolver
 	mainModuleVersion MainModuleVersionConfig
-	symbolScope       cataloging.SymbolScope
+	symbolSelector    symbolSelector
 
 	// stdlibSymbols holds the standard-library function symbols discovered per binary (keyed by the
 	// binary's location), grouped by import path, populated during parsing and consumed by stdlibProcessor
@@ -65,7 +64,7 @@ func newGoBinaryCataloger(opts CatalogerConfig) *goBinaryCataloger {
 	return &goBinaryCataloger{
 		licenseResolver:   newGoLicenseResolver(binaryCatalogerName, opts),
 		mainModuleVersion: opts.MainModuleVersion,
-		symbolScope:       opts.CaptureSymbols,
+		symbolSelector:    newSymbolSelector(opts.CaptureSymbols, opts.CaptureSymbolsModules),
 		stdlibSymbols:     make(map[file.Coordinates]map[string][]string),
 	}
 }
@@ -121,7 +120,7 @@ func (c *goBinaryCataloger) parseGoBinary(ctx context.Context, resolver file.Res
 	}
 	defer internal.CloseAndLogError(reader.ReadCloser, reader.RealPath)
 
-	mods, errs := scanFile(reader.Location, unionReader, c.symbolScope != cataloging.SymbolScopeNone)
+	mods, errs := scanFile(reader.Location, unionReader, c.symbolSelector.enabled())
 
 	var rels []artifact.Relationship
 	for _, mod := range mods {
@@ -184,11 +183,10 @@ func (c *goBinaryCataloger) buildGoPkgInfo(ctx context.Context, resolver file.Re
 	symbolsByModule, stdlibSymbols := moduleSymbols(mod.symbols, &mod.Main, mod.Deps)
 	c.recordStdlibSymbols(location.Coordinates, stdlibSymbols)
 
-	if c.symbolScope != cataloging.SymbolScopeAll {
-		// only the "all" scope attaches per-module symbols; for the "stdlib" scope we keep just the
-		// recorded stdlib symbols. nil map lookups below then yield nil symbol lists for each module.
-		symbolsByModule = nil
-	}
+	// keep only the modules the selector covers; the main module goes through the same map, so this
+	// incidentally decides the main module too (which is intended: it is treated like any dependency).
+	// unselected modules fall out entirely, so the lookups below yield nil rather than an empty map.
+	symbolsByModule = c.symbolSelector.filter(symbolsByModule)
 
 	var pkgs []pkg.Package
 	for _, dep := range mod.Deps {

syft/pkg/cataloger/golang/parse_go_binary_test.go

@@ -4,12 +4,14 @@ import (
 	"bufio"
 	"bytes"
 	"context"
+	"encoding/json"
 	"errors"
 	"io"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"runtime/debug"
+	"slices"
 	"strconv"
 	"strings"
 	"syscall"
@@ -1441,9 +1443,12 @@ func Test_buildGoPkgInfo_symbolScope(t *testing.T) {
 	tests := []struct {
 		name           string
 		scope          cataloging.SymbolScope
+		modules        []string
+		extraDeps      []*debug.Module
 		symbols        []binarySymbol
 		wantMainSyms   map[string][]string
 		wantDepSyms    map[string][]string
+		wantExtraSyms  []map[string][]string
 		wantStdlibSyms map[string][]string
 	}{
 		{
@@ -1468,6 +1473,84 @@ func Test_buildGoPkgInfo_symbolScope(t *testing.T) {
 			},
 			wantStdlibSyms: map[string][]string{"net/http": {"(*Client).Do"}},
 		},
+		{
+			// golang.org/x/net is reached through a vendored import path here, which must still be
+			// attributed to (and selected by) the module that owns it
+			name:      "extended-stdlib captures golang.org/x modules and stdlib only",
+			scope:     cataloging.SymbolScopeExtendedStdlib,
+			extraDeps: extendedDeps,
+			symbols:   slices.Concat(populatedSymbols, extendedSymbols),
+			wantExtraSyms: []map[string][]string{
+				{"golang.org/x/net/http2": {"NewClientConn"}},
+				nil,
+			},
+			wantStdlibSyms: map[string][]string{"net/http": {"(*Client).Do"}},
+		},
+		{
+			name:      "module patterns widen extended-stdlib",
+			scope:     cataloging.SymbolScopeExtendedStdlib,
+			modules:   []string{"github.com/klauspost/**"},
+			extraDeps: extendedDeps,
+			symbols:   slices.Concat(populatedSymbols, extendedSymbols),
+			wantExtraSyms: []map[string][]string{
+				{"golang.org/x/net/http2": {"NewClientConn"}},
+				{"github.com/klauspost/compress/zstd": {"NewReader"}},
+			},
+			wantStdlibSyms: map[string][]string{"net/http": {"(*Client).Do"}},
+		},
+		{
+			name:      "module patterns can select the main module",
+			scope:     cataloging.SymbolScopeStdlib,
+			modules:   []string{"github.com/anchore/**"},
+			extraDeps: extendedDeps,
+			symbols:   slices.Concat(populatedSymbols, extendedSymbols),
+			// the main package is keyed by the "main" import path the linker assigns, not its real path
+			wantMainSyms:   map[string][]string{"main": {"main"}},
+			wantExtraSyms:  []map[string][]string{nil, nil},
+			wantStdlibSyms: map[string][]string{"net/http": {"(*Client).Do"}},
+		},
+		{
+			name:      "module patterns are inert under the none scope",
+			scope:     cataloging.SymbolScopeNone,
+			modules:   []string{"github.com/**", "golang.org/x/**"},
+			extraDeps: extendedDeps,
+			// scanFile never runs under "none", so the build info carries no symbols to begin with
+			symbols:       nil,
+			wantExtraSyms: []map[string][]string{nil, nil},
+		},
+		{
+			// all short-circuits ahead of the pattern walk, so a narrow module pattern list cannot subtract
+			// from it. this is also the guard on that short-circuit still existing.
+			name:         "module patterns cannot narrow the all scope",
+			scope:        cataloging.SymbolScopeAll,
+			modules:      []string{"golang.org/x/**"},
+			extraDeps:    extendedDeps,
+			symbols:      slices.Concat(populatedSymbols, extendedSymbols),
+			wantMainSyms: map[string][]string{"main": {"main"}},
+			wantDepSyms: map[string][]string{
+				"github.com/foo/bar":     {"Parse"},
+				"github.com/foo/bar/baz": {"Helper"},
+			},
+			wantExtraSyms: []map[string][]string{
+				{"golang.org/x/net/http2": {"NewClientConn"}},
+				{"github.com/klauspost/compress/zstd": {"NewReader"}},
+			},
+			wantStdlibSyms: map[string][]string{"net/http": {"(*Client).Do"}},
+		},
+		{
+			// a module pattern that restates what the preset already covers must not duplicate or drop anything:
+			// selection is a per-module boolean, so overlap is idempotent
+			name:      "a module pattern overlapping the preset changes nothing",
+			scope:     cataloging.SymbolScopeExtendedStdlib,
+			modules:   []string{"golang.org/x/**"},
+			extraDeps: extendedDeps,
+			symbols:   slices.Concat(populatedSymbols, extendedSymbols),
+			wantExtraSyms: []map[string][]string{
+				{"golang.org/x/net/http2": {"NewClientConn"}},
+				nil,
+			},
+			wantStdlibSyms: map[string][]string{"net/http": {"(*Client).Do"}},
+		},
 	}
 
 	for _, tt := range tests {
@@ -1476,27 +1559,52 @@ func Test_buildGoPkgInfo_symbolScope(t *testing.T) {
 				BuildInfo: &debug.BuildInfo{
 					GoVersion: "go1.22.0",
 					Main:      debug.Module{Path: "github.com/anchore/syft", Version: "v1.0.0"},
-					Deps:      []*debug.Module{{Path: "github.com/foo/bar", Version: "v1.2.3"}},
+					Deps:      append([]*debug.Module{{Path: "github.com/foo/bar", Version: "v1.2.3"}}, tt.extraDeps...),
 				},
 				arch:    "amd64",
 				symbols: tt.symbols,
 			}
 
-			c := newGoBinaryCataloger(CatalogerConfig{CaptureSymbols: tt.scope})
+			c := newGoBinaryCataloger(CatalogerConfig{CaptureSymbols: tt.scope, CaptureSymbolsModules: tt.modules})
 			reader, err := unionreader.GetUnionReader(io.NopCloser(strings.NewReader("")))
 			require.NoError(t, err)
 
 			mainPkg, pkgs := c.buildGoPkgInfo(context.Background(), fileresolver.Empty{}, location, mod, mod.arch, reader)
 			require.NotNil(t, mainPkg)
-			require.Len(t, pkgs, 1)
+			require.Len(t, pkgs, 1+len(tt.extraDeps))
 
 			assert.Equal(t, tt.wantMainSyms, mainPkg.Metadata.(pkg.GolangBinaryBuildinfoEntry).Symbols, "main module symbols")
 			assert.Equal(t, tt.wantDepSyms, pkgs[0].Metadata.(pkg.GolangBinaryBuildinfoEntry).Symbols, "dependency symbols")
+			for i, want := range tt.wantExtraSyms {
+				assert.Equal(t, want, pkgs[1+i].Metadata.(pkg.GolangBinaryBuildinfoEntry).Symbols, "symbols for %s", pkgs[1+i].Name)
+			}
 			assert.Equal(t, tt.wantStdlibSyms, c.stdlibSymbolsFor(location.Coordinates), "recorded stdlib symbols")
+
+			// a module selected by nothing must carry no symbols key at all: assert on the serialized form,
+			// since an empty (non-nil) map would still emit "symbols":{} despite the omitempty tag
+			for _, p := range append([]pkg.Package{*mainPkg}, pkgs...) {
+				encoded, err := json.Marshal(p.Metadata)
+				require.NoError(t, err)
+				if p.Metadata.(pkg.GolangBinaryBuildinfoEntry).Symbols == nil {
+					assert.NotContains(t, string(encoded), `"symbols"`, "expected no symbols key for %s", p.Name)
+				}
+			}
 		})
 	}
 }
 
+var (
+	extendedDeps = []*debug.Module{
+		{Path: "golang.org/x/net", Version: "v0.30.0"},
+		{Path: "github.com/klauspost/compress", Version: "v1.17.0"},
+	}
+
+	extendedSymbols = []binarySymbol{
+		{packagePath: "vendor/golang.org/x/net/http2", name: "vendor/golang.org/x/net/http2.NewClientConn"},
+		{packagePath: "github.com/klauspost/compress/zstd", name: "github.com/klauspost/compress/zstd.NewReader"},
+	}
+)
+
 // Test_recordStdlibSymbols_merge covers the merge path where the same binary location records stdlib
 // symbols more than once. This happens in production for universal/fat Mach-O binaries: scanFile yields
 // one build info per architecture and each is recorded under the same location coordinates.

syft/pkg/cataloger/golang/scan_binary.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"io"
 	"runtime/debug"
+	"strings"
 
 	"github.com/kastenhq/goversion/version"
 
@@ -51,6 +52,7 @@ func scanFile(location file.Location, reader unionreader.UnionReader, captureSym
 			// we can still catalog packages, even if we can't get the crypto information
 			errs = unknown.Appendf(errs, location, "unable to read golang version info: %w", err)
 		}
+		v = append(v, getNativeFIPSSettings(bi.Settings)...)
 		arch := getGOARCH(bi.Settings)
 		if arch == "" {
 			arch, err = getGOARCHFromBin(r)
@@ -101,6 +103,25 @@ func getCryptoSettingsFromVersion(v version.Version) []string {
 	return cryptoSettings
 }
 
+func getNativeFIPSSettings(settings []debug.BuildSetting) []string {
+	var cryptoSettings []string
+	for _, s := range settings {
+		switch s.Key {
+		case "GOFIPS140":
+			if s.Value != "" {
+				cryptoSettings = append(cryptoSettings, "GOFIPS140="+s.Value)
+			}
+		case "DefaultGODEBUG":
+			for _, kv := range strings.Split(s.Value, ",") {
+				if setting, val, ok := strings.Cut(kv, "="); ok && setting == "fips140" {
+					cryptoSettings = append(cryptoSettings, "GODEBUG=fips140="+val)
+				}
+			}
+		}
+	}
+	return cryptoSettings
+}
+
 func getBuildInfo(r io.ReaderAt, location file.Location) (bi *debug.BuildInfo, err error) {
 	defer func() {
 		if r := recover(); r != nil {

syft/pkg/cataloger/golang/scan_binary_test.go

@@ -110,3 +110,50 @@ func Test_getCryptoSettingsFromVersion(t *testing.T) {
 		})
 	}
 }
+
+func Test_getNativeFIPSSettings(t *testing.T) {
+	for _, tt := range []struct {
+		name     string
+		settings []debug.BuildSetting
+		result   []string
+	}{
+		{
+			name:     "not set",
+			settings: []debug.BuildSetting{{Key: "GOARCH", Value: "arm64"}},
+			result:   nil,
+		},
+		{
+			name:     "GOFIPS140=off is reported verbatim",
+			settings: []debug.BuildSetting{{Key: "GOFIPS140", Value: "off"}},
+			result:   []string{"GOFIPS140=off"},
+		},
+		{
+			name: "pinned module version with mode on",
+			settings: []debug.BuildSetting{
+				{Key: "GOFIPS140", Value: "v1.0.0"},
+				{Key: "DefaultGODEBUG", Value: "fips140=on"},
+			},
+			result: []string{"GOFIPS140=v1.0.0", "GODEBUG=fips140=on"},
+		},
+		{ // GOFIPS140=latest enables FIPS mode without pinning a module version
+			name: "latest with mode on",
+			settings: []debug.BuildSetting{
+				{Key: "GOFIPS140", Value: "latest"},
+				{Key: "DefaultGODEBUG", Value: "fips140=on"},
+			},
+			result: []string{"GOFIPS140=latest", "GODEBUG=fips140=on"},
+		},
+		{ // fips140 is one entry among many in DefaultGODEBUG
+			name: "fips140 among other godebug defaults",
+			settings: []debug.BuildSetting{
+				{Key: "DefaultGODEBUG", Value: "asynctimerchan=1,fips140=on,tlssha1=1"},
+			},
+			result: []string{"GODEBUG=fips140=on"},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			res := getNativeFIPSSettings(tt.settings)
+			assert.ElementsMatch(t, res, tt.result)
+		})
+	}
+}

syft/pkg/cataloger/golang/symbol_selector.go

@@ -0,0 +1,113 @@
+package golang
+
+import (
+	"slices"
+
+	"github.com/bmatcuk/doublestar/v4"
+	"golang.org/x/mod/module"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/cataloging"
+)
+
+// scopePatterns maps a capture-symbols scope onto the go module path globs it selects. The "none" and
+// "all" scopes are intentionally absent: both are answered without matching. The "stdlib" scope selects
+// no modules at all (the synthetic stdlib package is not a module and is handled separately).
+var scopePatterns = map[cataloging.SymbolScope][]string{
+	cataloging.SymbolScopeExtendedStdlib: {"golang.org/x/**"},
+}
+
+// symbolSelector decides which go module paths get function symbols attached to their metadata. The scope
+// preset and any user-supplied module patterns are compiled into a single glob list so there is exactly
+// one matcher answering "does this module path get symbols" (two matchers over the same subject drift).
+type symbolSelector struct {
+	scope    cataloging.SymbolScope
+	patterns []string
+}
+
+func newSymbolSelector(scope cataloging.SymbolScope, modules []string) symbolSelector {
+	// normalize here rather than trusting the caller: the CLI runs Parse in PostLoad, but a library
+	// consumer setting CaptureSymbols directly (or via WithCaptureSymbols) does not, and an unnormalized
+	// value falls through both switches below into stdlib-only capture rather than the intended scope.
+	scope = scope.Parse()
+
+	var patterns []string
+	for _, pattern := range slices.Concat(scopePatterns[scope], modules) {
+		if !doublestar.ValidatePattern(pattern) {
+			// a typo in a filter that decides what gets vulnerability-scanned must not pass quietly:
+			// someone would believe they captured symbols they did not. Drop just this pattern and keep
+			// the rest of the selection in force.
+			log.WithFields("pattern", pattern).Warn("ignoring malformed golang capture-symbols-modules pattern")
+			continue
+		}
+		patterns = append(patterns, pattern)
+	}
+	return symbolSelector{scope: scope, patterns: patterns}
+}
+
+// enabled reports whether symbols should be extracted from the binary at all.
+func (s symbolSelector) enabled() bool {
+	return s.scope != cataloging.SymbolScopeNone
+}
+
+// selects reports whether the given go module path gets symbols. The binary's own main module is treated
+// exactly like a dependency.
+func (s symbolSelector) selects(modulePath string) bool {
+	switch s.scope {
+	case cataloging.SymbolScopeNone:
+		return false
+	case cataloging.SymbolScopeAll:
+		return true
+	}
+
+	// a major version suffix is part of a module's path but not part of its identity, so patterns are matched
+	// against the path both with and without it: `github.com/foo/bar` and `github.com/foo/*` each select
+	// `github.com/foo/bar/v2`, which is what whoever wrote either one meant, and a config does not quietly
+	// stop covering a module the day it bumps a major version. Spelling a suffix out in the pattern still
+	// selects that major version alone, since the unsuffixed path cannot match a pattern carrying one.
+	// Only a trailing suffix is a version: in `github.com/foo/v2/bar` the `v2` is an ordinary path element,
+	// and SplitPathVersion leaves it there.
+	unversioned, major, ok := module.SplitPathVersion(modulePath)
+	versioned := ok && major != ""
+
+	for _, pattern := range s.patterns {
+		if globMatches(pattern, modulePath) {
+			return true
+		}
+		if versioned && globMatches(pattern, unversioned) {
+			return true
+		}
+	}
+	return false
+}
+
+// globMatches treats a pattern that cannot compile as no match, which newSymbolSelector has already warned about.
+func globMatches(pattern, modulePath string) bool {
+	matched, err := doublestar.Match(pattern, modulePath)
+	if err != nil {
+		// unreachable: newSymbolSelector rejects (and warns about) patterns that cannot compile
+		return false
+	}
+	return matched
+}
+
+// filter drops the entries of a module-path-keyed symbol map that the selector does not select. It returns
+// nil when nothing is selected so callers attach no symbols map at all (rather than an empty one, which
+// would defeat the omitempty JSON tag).
+func (s symbolSelector) filter(byModule map[string]map[string][]string) map[string]map[string][]string {
+	switch s.scope {
+	case cataloging.SymbolScopeNone:
+		return nil
+	case cataloging.SymbolScopeAll:
+		return byModule
+	}
+	for modulePath := range byModule {
+		if !s.selects(modulePath) {
+			delete(byModule, modulePath)
+		}
+	}
+	if len(byModule) == 0 {
+		return nil
+	}
+	return byModule
+}

syft/pkg/cataloger/golang/symbol_selector_test.go

@@ -0,0 +1,280 @@
+package golang
+
+import (
+	"maps"
+	"slices"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/syft/syft/cataloging"
+)
+
+func Test_symbolSelector_selects(t *testing.T) {
+	tests := []struct {
+		name       string
+		scope      cataloging.SymbolScope
+		modules    []string
+		modulePath string
+		want       bool
+	}{
+		{
+			name:       "none selects nothing",
+			scope:      cataloging.SymbolScopeNone,
+			modulePath: "github.com/foo/bar",
+		},
+		{
+			name:       "none is inert even with module patterns",
+			scope:      cataloging.SymbolScopeNone,
+			modules:    []string{"github.com/foo/**"},
+			modulePath: "github.com/foo/bar",
+		},
+		{
+			name:       "all selects everything",
+			scope:      cataloging.SymbolScopeAll,
+			modulePath: "github.com/foo/bar",
+			want:       true,
+		},
+		{
+			name:       "stdlib selects no modules",
+			scope:      cataloging.SymbolScopeStdlib,
+			modulePath: "golang.org/x/crypto",
+		},
+		{
+			name:       "extended-stdlib matches a golang.org/x module",
+			scope:      cataloging.SymbolScopeExtendedStdlib,
+			modulePath: "golang.org/x/crypto",
+			want:       true,
+		},
+		{
+			// ** crosses path separators, which is what lets one pattern cover the whole subtree
+			name:       "extended-stdlib matches a nested golang.org/x module",
+			scope:      cataloging.SymbolScopeExtendedStdlib,
+			modulePath: "golang.org/x/tools/gopls",
+			want:       true,
+		},
+		{
+			// the pattern must not match on a bare prefix, only at a path boundary
+			name:       "extended-stdlib does not match golang.org/xtra",
+			scope:      cataloging.SymbolScopeExtendedStdlib,
+			modulePath: "golang.org/xtra",
+		},
+		{
+			name:       "extended-stdlib does not match an unrelated module",
+			scope:      cataloging.SymbolScopeExtendedStdlib,
+			modulePath: "github.com/klauspost/compress",
+		},
+		{
+			name:       "single star matches one path segment",
+			scope:      cataloging.SymbolScopeStdlib,
+			modules:    []string{"github.com/klauspost/*"},
+			modulePath: "github.com/klauspost/compress",
+			want:       true,
+		},
+		{
+			// a single star does not cross "/", but a major version suffix is not a path segment for this
+			// purpose: the module is matched with the suffix stripped as well, so a config written before a
+			// major bump keeps covering the module after it
+			name:       "single star reaches across a major version suffix",
+			scope:      cataloging.SymbolScopeStdlib,
+			modules:    []string{"github.com/klauspost/*"},
+			modulePath: "github.com/klauspost/compress/v2",
+			want:       true,
+		},
+		{
+			name:       "single star does not cross a separator that is not a version suffix",
+			scope:      cataloging.SymbolScopeStdlib,
+			modules:    []string{"github.com/klauspost/*"},
+			modulePath: "github.com/klauspost/compress/internal/thing",
+		},
+		{
+			// only a trailing suffix is a version. here "v2" is an ordinary path element naming the major
+			// subdirectory a nested module lives in, so it is matched literally and ** is the way to reach it
+			name:       "a mid-path version-like element is an ordinary segment",
+			scope:      cataloging.SymbolScopeStdlib,
+			modules:    []string{"github.com/anchore/*/thing"},
+			modulePath: "github.com/anchore/syft/v2/thing",
+		},
+		{
+			name:       "doublestar reaches a mid-path version-like element",
+			scope:      cataloging.SymbolScopeStdlib,
+			modules:    []string{"github.com/anchore/**/thing"},
+			modulePath: "github.com/anchore/syft/v2/thing",
+			want:       true,
+		},
+		{
+			name:       "doublestar crosses a separator",
+			scope:      cataloging.SymbolScopeStdlib,
+			modules:    []string{"github.com/klauspost/**"},
+			modulePath: "github.com/klauspost/compress/v2",
+			want:       true,
+		},
+		{
+			name:       "an exact path covers every major version of that module",
+			scope:      cataloging.SymbolScopeStdlib,
+			modules:    []string{"github.com/klauspost/compress"},
+			modulePath: "github.com/klauspost/compress/v2",
+			want:       true,
+		},
+		{
+			// spelling the suffix out is how a single major version is targeted: v1's path carries no suffix,
+			// so there is nothing for a suffixed pattern to match
+			name:       "a pattern naming a major version selects only that one",
+			scope:      cataloging.SymbolScopeStdlib,
+			modules:    []string{"github.com/klauspost/compress/v2"},
+			modulePath: "github.com/klauspost/compress",
+		},
+		{
+			name:       "a pattern naming a major version selects it",
+			scope:      cataloging.SymbolScopeStdlib,
+			modules:    []string{"github.com/klauspost/compress/v2"},
+			modulePath: "github.com/klauspost/compress/v2",
+			want:       true,
+		},
+		{
+			// gopkg.in spells the major version as a .vN suffix on the last element, which SplitPathVersion
+			// understands, so it strips the same way
+			name:       "gopkg.in style suffixes strip too",
+			scope:      cataloging.SymbolScopeStdlib,
+			modules:    []string{"gopkg.in/yaml"},
+			modulePath: "gopkg.in/yaml.v2",
+			want:       true,
+		},
+		{
+			// /v1 and /v0 are not valid major version suffixes, so this is not a versioned path at all and
+			// nothing is stripped from it
+			name:       "a v1 element is not a version suffix",
+			scope:      cataloging.SymbolScopeStdlib,
+			modules:    []string{"github.com/klauspost/compress"},
+			modulePath: "github.com/klauspost/compress/v1",
+		},
+		{
+			name:       "module patterns widen a preset",
+			scope:      cataloging.SymbolScopeExtendedStdlib,
+			modules:    []string{"github.com/klauspost/**"},
+			modulePath: "github.com/klauspost/compress",
+			want:       true,
+		},
+		{
+			name:       "module patterns cannot narrow a preset",
+			scope:      cataloging.SymbolScopeExtendedStdlib,
+			modules:    []string{"github.com/klauspost/**"},
+			modulePath: "golang.org/x/net",
+			want:       true,
+		},
+		{
+			name:       "exact module path",
+			scope:      cataloging.SymbolScopeStdlib,
+			modules:    []string{"google.golang.org/grpc"},
+			modulePath: "google.golang.org/grpc",
+			want:       true,
+		},
+		{
+			name:       "an empty module pattern list is a no-op",
+			scope:      cataloging.SymbolScopeStdlib,
+			modules:    []string{},
+			modulePath: "github.com/foo/bar",
+		},
+		{
+			// all short-circuits before any matching, so a module pattern list cannot subtract from it
+			name:       "module patterns cannot narrow all",
+			scope:      cataloging.SymbolScopeAll,
+			modules:    []string{"github.com/klauspost/**"},
+			modulePath: "github.com/foo/bar",
+			want:       true,
+		},
+		{
+			// selection is a per-module boolean, so a pattern overlapping the preset is idempotent
+			name:       "a module pattern overlapping the preset is idempotent",
+			scope:      cataloging.SymbolScopeExtendedStdlib,
+			modules:    []string{"golang.org/x/**"},
+			modulePath: "golang.org/x/net",
+			want:       true,
+		},
+		{
+			// library consumers set CaptureSymbols directly without going through PostLoad, so the
+			// selector normalizes rather than falling through to stdlib-only capture
+			name:       "unnormalized scope is parsed",
+			scope:      "All",
+			modulePath: "github.com/foo/bar",
+			want:       true,
+		},
+		{
+			name:       "unrecognized scope resolves to none",
+			scope:      "bogus",
+			modules:    []string{"github.com/foo/**"},
+			modulePath: "github.com/foo/bar",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, newSymbolSelector(tt.scope, tt.modules).selects(tt.modulePath))
+		})
+	}
+}
+
+// a malformed pattern must be dropped at construction, leaving the remaining patterns in force rather
+// than aborting the selection or silently matching nothing
+func Test_symbolSelector_malformedPattern(t *testing.T) {
+	s := newSymbolSelector(cataloging.SymbolScopeExtendedStdlib, []string{"[", "github.com/klauspost/**"})
+
+	require.Equal(t, []string{"golang.org/x/**", "github.com/klauspost/**"}, s.patterns)
+	assert.True(t, s.selects("golang.org/x/net"), "preset still applies")
+	assert.True(t, s.selects("github.com/klauspost/compress"), "valid sibling pattern still applies")
+	assert.False(t, s.selects("github.com/foo"), "malformed pattern selects nothing")
+}
+
+func Test_symbolSelector_filter(t *testing.T) {
+	symbols := func() map[string]map[string][]string {
+		return map[string]map[string][]string{
+			"golang.org/x/net":              {"golang.org/x/net/http2": {"NewClientConn"}},
+			"github.com/klauspost/compress": {"github.com/klauspost/compress/zstd": {"NewReader"}},
+		}
+	}
+
+	tests := []struct {
+		name    string
+		scope   cataloging.SymbolScope
+		modules []string
+		want    []string // remaining module paths
+	}{
+		{
+			name:  "none drops everything",
+			scope: cataloging.SymbolScopeNone,
+		},
+		{
+			name:  "stdlib drops every module",
+			scope: cataloging.SymbolScopeStdlib,
+		},
+		{
+			name:  "extended-stdlib keeps only golang.org/x",
+			scope: cataloging.SymbolScopeExtendedStdlib,
+			want:  []string{"golang.org/x/net"},
+		},
+		{
+			name:    "module patterns widen the selection",
+			scope:   cataloging.SymbolScopeExtendedStdlib,
+			modules: []string{"github.com/klauspost/**"},
+			want:    []string{"golang.org/x/net", "github.com/klauspost/compress"},
+		},
+		{
+			name:  "all keeps everything",
+			scope: cataloging.SymbolScopeAll,
+			want:  []string{"golang.org/x/net", "github.com/klauspost/compress"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := newSymbolSelector(tt.scope, tt.modules).filter(symbols())
+			if len(tt.want) == 0 {
+				// nil, not an empty map, so the omitempty JSON tag keeps the field out of output
+				assert.Nil(t, got)
+				return
+			}
+			assert.ElementsMatch(t, tt.want, slices.Collect(maps.Keys(got)))
+		})
+	}
+}

syft/pkg/cataloger/internal/cpegenerate/candidate_for_pe.go

@@ -32,6 +32,11 @@ func candidateVendorsForPE(p pkg.Package) fieldCandidateSet {
 		candidates.addValue("artifex")
 	}
 
+	if product == "git" || fileDesc == "git setup" || company == "the git development community" {
+		candidates.addValue("git_for_windows_project")
+		candidates.addValue("gitforwindows")
+	}
+
 	return candidates
 }
 
@@ -59,5 +64,10 @@ func candidateProductsForPE(p pkg.Package) fieldCandidateSet {
 		candidates.addValue("ghostscript")
 	}
 
+	if product == "git" || fileDesc == "git setup" {
+		candidates.addValue("git_for_windows")
+		candidates.addValue("git")
+	}
+
 	return candidates
 }

syft/pkg/cataloger/internal/cpegenerate/dictionary/data/cpe-index.json

@@ -112,6 +112,9 @@
       "github.com/gookit/goutil": [
         "cpe:2.3:a:go_util_project:go_util:*:*:*:*:*:go:*:*"
       ],
+      "github.com/gopacket/gopacket": [
+        "cpe:2.3:a:gopacket:gopacket:*:*:*:*:*:go:*:*"
+      ],
       "github.com/hamba/avro/v2": [
         "cpe:2.3:a:avro_project:avro:*:*:*:*:*:go:*:*"
       ],
@@ -2502,13 +2505,20 @@
       "@fastify/express": [
         "cpe:2.3:a:fastify:fastify\\/express:*:*:*:*:*:node.js:*:*"
       ],
+      "@fastify/forwarded": [
+        "cpe:2.3:a:fastify:fastify\\/forwarded:*:*:*:*:*:node.js:*:*"
+      ],
       "@fastify/http-proxy": [
         "cpe:2.3:a:fastify:fastify\\/http-proxy:*:*:*:*:*:node.js:*:*"
       ],
       "@fastify/middie": [
         "cpe:2.3:a:fastify:fastify\\/middie:*:*:*:*:*:node.js:*:*"
       ],
+      "@fastify/rate-limit": [
+        "cpe:2.3:a:fastify:fastify\\/rate-limit:*:*:*:*:*:node.js:*:*"
+      ],
       "@fastify/reply-from": [
+        "cpe:2.3:a:fastify:fastify\\/reply-from:*:*:*:*:*:node.js:*:*",
         "cpe:2.3:a:fastify:reply-from:*:*:*:*:*:node.js:*:*"
       ],
       "@fastly/js-compute": [
@@ -2649,6 +2659,9 @@
       "@openzeppelin/contracts-upgradeable": [
         "cpe:2.3:a:openzeppelin:contracts_upgradeable:*:*:*:*:*:node.js:*:*"
       ],
+      "@paperclipai/server": [
+        "cpe:2.3:a:paperclip:paperclipai\\/server:*:*:*:*:*:node.js:*:*"
+      ],
       "@parse/push-adapter": [
         "cpe:2.3:a:parseplatform:parse_server_push_adapter:*:*:*:*:*:node.js:*:*"
       ],
@@ -3101,6 +3114,9 @@
       "clawdbot": [
         "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*"
       ],
+      "clawvet": [
+        "cpe:2.3:a:mohibshaikh:clawvet:*:*:*:*:*:node.js:*:*"
+      ],
       "cli": [
         "cpe:2.3:a:cli_project:cli:*:*:*:*:*:node.js:*:*"
       ],
@@ -5124,6 +5140,9 @@
       "pandora-doomsday": [
         "cpe:2.3:a:pandora-doomsday_project:pandora-doomsday:*:*:*:*:*:node.js:*:*"
       ],
+      "paperclipai": [
+        "cpe:2.3:a:paperclip:paperclipai:*:*:*:*:*:node.js:*:*"
+      ],
       "parse-dashboard": [
         "cpe:2.3:a:parseplatform:parse_dashboard:*:*:*:*:*:node.js:*:*"
       ],
@@ -5673,6 +5692,9 @@
       "shout": [
         "cpe:2.3:a:shout_project:shout:*:*:*:*:*:node.js:*:*"
       ],
+      "sigstore": [
+        "cpe:2.3:a:sigstore:sigstore:*:*:*:*:*:node.js:*:*"
+      ],
       "sillytavern": [
         "cpe:2.3:a:sillytavern:sillytavern:*:*:*:*:*:node.js:*:*"
       ],
@@ -6112,6 +6134,9 @@
       "vite": [
         "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*"
       ],
+      "vitest": [
+        "cpe:2.3:a:vitest.dev:vitest:*:*:*:*:*:node.js:*:*"
+      ],
       "vm2": [
         "cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:*"
       ],
@@ -6539,6 +6564,9 @@
       "dash-uploader": [
         "cpe:2.3:a:fohrloop:dash-uploader:*:*:*:*:*:python:*:*"
       ],
+      "datamodel-code-generator": [
+        "cpe:2.3:a:koxudaxi:datamodel-code-generator:*:*:*:*:*:python:*:*"
+      ],
       "datapizza-ai": [
         "cpe:2.3:a:datapizza:datapizza_ai:*:*:*:*:*:*:*:*"
       ],
@@ -6738,6 +6766,9 @@
       "mpxj": [
         "cpe:2.3:a:mpxj:mpxj:*:*:*:*:*:python:*:*"
       ],
+      "msgpack": [
+        "cpe:2.3:a:msgpack:messagepack:*:*:*:*:*:python:*:*"
+      ],
       "nanobot-ai": [
         "cpe:2.3:a:nanobot:nanobot:*:*:*:*:*:python:*:*"
       ],
@@ -7349,6 +7380,9 @@
       "mpxj": [
         "cpe:2.3:a:mpxj:mpxj:*:*:*:*:*:ruby:*:*"
       ],
+      "msgpack": [
+        "cpe:2.3:a:msgpack:messagepack:*:*:*:*:*:ruby:*:*"
+      ],
       "net-imap": [
         "cpe:2.3:a:ruby-lang:net\\:\\:imap:*:*:*:*:*:ruby:*:*"
       ],
@@ -7583,6 +7617,9 @@
       "webrick": [
         "cpe:2.3:a:ruby-lang:webrick:*:*:*:*:*:ruby:*:*"
       ],
+      "websocket-driver": [
+        "cpe:2.3:a:faye:websocket-driver:*:*:*:*:*:ruby:*:*"
+      ],
       "websocket-extensions": [
         "cpe:2.3:a:websocket-extensions_project:websocket-extensions:*:*:*:*:*:ruby:*:*"
       ],
@@ -8002,6 +8039,9 @@
       "openssl": [
         "cpe:2.3:a:sfackler:openssl:*:*:*:*:*:rust:*:*"
       ],
+      "opentelemetry": [
+        "cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:rust:*:*"
+      ],
       "outer_cgi": [
         "cpe:2.3:a:outer_cgi_project:outer_cgi:*:*:*:*:*:rust:*:*"
       ],
@@ -8032,6 +8072,9 @@
       "postscript": [
         "cpe:2.3:a:postscript_project:postscript:*:*:*:*:*:rust:*:*"
       ],
+      "quiche": [
+        "cpe:2.3:a:cloudflare:quiche:*:*:*:*:*:rust:*:*"
+      ],
       "quinn": [
         "cpe:2.3:a:quinn_project:quinn:*:*:*:*:*:rust:*:*"
       ],
@@ -9374,6 +9417,9 @@
       "autoptimize": [
         "cpe:2.3:a:autoptimize:autoptimize:*:*:*:*:*:wordpress:*:*"
       ],
+      "autoship-cloud": [
+        "cpe:2.3:a:patternsinthecloud:autoship_cloud_for_woocommerce:*:*:*:*:*:wordpress:*:*"
+      ],
       "autotitle-for-wordpress": [
         "cpe:2.3:a:unalignedcode:autotitle:*:*:*:*:*:wordpress:*:*"
       ],
@@ -13044,6 +13090,9 @@
       "fotobook": [
         "cpe:2.3:a:fotobook_project:fotobook:*:*:*:*:*:wordpress:*:*"
       ],
+      "foxypress": [
+        "cpe:2.3:a:webmovementllc:foxypress:*:*:*:*:*:wordpress:*:*"
+      ],
       "foxyshop": [
         "cpe:2.3:a:foxy:foxyshop:*:*:*:*:*:wordpress:*:*"
       ],
@@ -15797,6 +15846,9 @@
       "my-geo-posts-free": [
         "cpe:2.3:a:mindstien:my_geo_posts_free:*:*:*:*:*:wordpress:*:*"
       ],
+      "my-quota": [
+        "cpe:2.3:a:dropstr:my_quota:*:*:*:*:*:wordpress:*:*"
+      ],
       "my-tickets": [
         "cpe:2.3:a:my_tickets_project:my_tickets:*:*:*:*:*:wordpress:*:*"
       ],
@@ -20842,6 +20894,9 @@
       "woo-related-products-refresh-on-reload": [
         "cpe:2.3:a:peachpay:related_products_for_woocommerce:*:*:*:*:*:wordpress:*:*"
       ],
+      "woo-rfq-for-woocommerce": [
+        "cpe:2.3:a:neahplugins:np_quote_request_for_woocommerce:*:*:*:*:*:wordpress:*:*"
+      ],
       "woo-save-abandoned-carts": [
         "cpe:2.3:a:majas-lapu-izstrade:cartbounty:*:*:*:*:*:wordpress:*:*"
       ],
@@ -22964,6 +23019,7 @@
         "cpe:2.3:a:ydesignservices:yds_support_ticket_system:*:*:*:*:*:wordpress:*:*"
       ],
       "yellow-pencil-visual-theme-customizer": [
+        "cpe:2.3:a:waspthemes:yellowpencil:*:*:*:*:*:wordpress:*:*",
         "cpe:2.3:a:yellowpencil:visual_css_style_editor:*:*:*:*:*:wordpress:*:*"
       ],
       "yellow-yard": [
@@ -23398,6 +23454,9 @@
       "hello-agency": [
         "cpe:2.3:a:cozythemes:hello_agency:*:*:*:*:*:wordpress:*:*"
       ],
+      "himalayas": [
+        "cpe:2.3:a:themegrill:himalayas:*:*:*:*:*:wordpress:*:*"
+      ],
       "homey": [
         "cpe:2.3:a:favethemes:homey:*:*:*:*:*:wordpress:*:*"
       ],

syft/pkg/cataloger/internal/cpegenerate/java_groupid_map.go

@@ -1921,4 +1921,16 @@ var DefaultArtifactIDToGroupID = map[string]string{
 	"kafka_2.8.2":                                              "org.apache.kafka",
 	"kafka_2.9.1":                                              "org.apache.kafka",
 	"kafka_2.9.2":                                              "org.apache.kafka",
+
+	// legacy "Jackson 1.x" (aka "jackson-asl") artifacts predate the convention of embedding
+	// META-INF/maven/.../pom.properties in the jar, so groupIDFromKnownPackageList is the only
+	// way to recover the correct group ID for jars built without that metadata (e.g. Ant-built
+	// jars from before ~2014). Without this, the group ID falls back to the artifact name itself,
+	// producing purls that do not match the vulnerability database's namespace.
+	// See https://github.com/anchore/syft/issues/4598
+	"jackson-core-asl":   "org.codehaus.jackson",
+	"jackson-mapper-asl": "org.codehaus.jackson",
+	"jackson-jaxrs":      "org.codehaus.jackson",
+	"jackson-xc":         "org.codehaus.jackson",
+	"jackson-smile":      "org.codehaus.jackson",
 }

syft/pkg/cataloger/java/package_url_test.go

@@ -185,6 +185,23 @@ func Test_groupIDFromJavaMetadata(t *testing.T) {
 			metadata: pkg.JavaArchive{},
 			expect:   "org.springframework.ldap",
 		},
+		{
+			// regression for github.com/anchore/syft/issues/4598: legacy Jackson 1.x ("-asl")
+			// jars built before ~2014 have no embedded pom.properties, so without the known
+			// package list the group ID falls back to the artifact name itself, producing a
+			// purl that doesn't match the vulnerability database's namespace (e.g. the correct
+			// group for jackson-mapper-asl is org.codehaus.jackson, not jackson-mapper-asl).
+			name:     "known package list jackson-mapper-asl",
+			pkgName:  "jackson-mapper-asl",
+			metadata: pkg.JavaArchive{},
+			expect:   "org.codehaus.jackson",
+		},
+		{
+			name:     "known package list jackson-core-asl",
+			pkgName:  "jackson-core-asl",
+			metadata: pkg.JavaArchive{},
+			expect:   "org.codehaus.jackson",
+		},
 		{
 			name: "java manifest",
 			metadata: pkg.JavaArchive{

syft/pkg/golang.go

@@ -30,8 +30,10 @@ type GolangBinaryBuildinfoEntry struct {
 	// name is the import path, a ".", and the local name. One exception: the binary's main package appears
 	// under the key "main" (the name the linker assigns), not its original source import path, which is not
 	// recoverable from the binary. Populated only when the golang cataloger's capture-symbols scope covers
-	// this package: the "all" scope populates every module package plus the synthetic stdlib package, while
-	// the "stdlib" scope populates only the stdlib package.
+	// this package: the "all" scope populates every module package plus the synthetic stdlib package, the
+	// "extended-stdlib" scope populates the stdlib package plus every module under golang.org/x/, and the
+	// "stdlib" scope populates only the stdlib package. The capture-symbols-modules glob patterns populate
+	// any additional modules they match.
 	Symbols map[string][]string `json:"symbols,omitempty"`
 }