bound buildinfo read in go toolchain detection

gate `buildinfo.Read` on `elfutil.CheckSectionNameTable`, same as the golang cataloger's `readBuildInfo`

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

.binny.yaml

@@ -24,7 +24,7 @@ tools:
   # used to parse JSON/YAML annotations on the fixture cache image
   - name: yq
     version:
-      want: v4.54.1
+      want: v4.53.6
     method: github-release
     with:
       repo: mikefarah/yq

.gitattributes

@@ -1,7 +0,0 @@
-# check out text files with lf on every platform (regardless of core.autocrlf), letting git detect binary files
-* text=auto eol=lf
-
-# fixtures that must keep their crlf line endings byte for byte
-syft/linux/testdata/unprintable -text
-syft/pkg/cataloger/bitnami/testdata/no-rel/opt/bitnami/redis/.spdx-redis.spdx -text
-syft/pkg/cataloger/java/testdata/jar-metadata/**/META-INF/MANIFEST.MF -text

.github/actions/bootstrap/action.yaml

@@ -30,7 +30,7 @@ runs:
   using: "composite"
   steps:
     - name: Setup go + go-make tooling
-      uses: anchore/go-make/.github/actions/setup@abf41688f36f2cbec13105747abbe8e60f5c56ca # v0.9.3
+      uses: anchore/go-make/.github/actions/setup@fa5421b3bf24c9d18f11a736c5eb4172f2b7d683 # v0.8.1
       with:
         go-version: ${{ inputs.go-version }}
         cache-key-prefix: ${{ inputs.cache-key-prefix }}

.github/dependabot.yml

@@ -21,11 +21,6 @@ updates:
       - dependency-name: "github.com/aquasecurity/go-version"
       - dependency-name: "github.com/knqyf263/go-apk-version"
       - dependency-name: "github.com/knqyf263/go-deb-version"
-      # v1 changed SlicesAsSets hashing, which changes every artifact ID syft produces
-      - dependency-name: "github.com/gohugoio/hashstructure"
-        update-types: ["version-update:semver-major"]
-      # go-make module and action refs are bumped together by automation
-      - dependency-name: "github.com/anchore/go-make"
 
   - package-ecosystem: "github-actions"
     directories:
@@ -39,6 +34,3 @@ updates:
     open-pull-requests-limit: 10
     labels:
       - "dependencies"
-    ignore:
-      # go-make module and action refs are bumped together by automation
-      - dependency-name: "anchore/go-make/*"

.github/workflows/release.yaml

@@ -46,7 +46,7 @@ jobs:
       # these are checks that should be run on pull-request and merges to main.
       # we do NOT want to kick off a release if these have not been verified on main.
       # Please see the validations.yaml workflow for the names that should be used here.
-      checks: '["Acceptance tests (Linux)", "Acceptance tests (Mac)", "Build snapshot artifacts", "CLI tests (Linux)", "Containers-storage tests (Podman)", "Containers-storage tests (Buildah)", "Integration tests", "Static analysis", "Unit tests"]'
+      checks: '["Acceptance tests (Linux)", "Acceptance tests (Mac)", "Build snapshot artifacts", "CLI tests (Linux)", "Integration tests", "Static analysis", "Unit tests"]'
 
   release:
     needs: [check-gate, version-available]
@@ -118,7 +118,7 @@ jobs:
           # for updating brew formula in anchore/homebrew-syft
           GITHUB_BREW_TOKEN: ${{ secrets.ANCHOREOPS_GITHUB_OSS_WRITE_TOKEN }}
 
-      - uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c #v0.24.3
+      - uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 #v0.24.2
         continue-on-error: true
         with:
           file: go.mod

.github/workflows/validations.yaml

@@ -27,7 +27,7 @@ jobs:
     #   enough; a 4 vCPU instance can't pull much more than that anyway.
     #   note: s3-cache intentionally omitted -- PR runs are untrusted and must not write to the
     #   shared cache backend that the trusted release workflow reads from (cache poisoning).
-    runs-on: &test-runner "runs-on=${{ github.run_id }}/cpu=4+8/ram=16+32/family=m6+m7+m8+c6+c7+c8/spot=price-capacity-optimized/volume=100gb"
+    runs-on: &test-runner "runs-on=${{ github.run_id }}/cpu=4+8/ram=16+32/family=m5+m6+m7+m8+c5+c6+c7+c8/spot=price-capacity-optimized/volume=100gb"
     permissions:
       contents: read
     steps:
@@ -49,24 +49,6 @@ jobs:
   Unit-Test:
     # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
     name: "Unit tests"
-    runs-on: ubuntu-latest
-    needs: [Unit-Test-Linux, Unit-Test-Windows]
-    # a skipped job satisfies a required check, so this job must always run and fail explicitly
-    # unless every dependency succeeded (otherwise a failing PR can still be auto-merged)
-    if: ${{ always() }}
-    steps:
-      - name: Require all unit test jobs to succeed
-        env:
-          NEEDS: ${{ toJSON(needs) }}
-        run: |
-          echo "$NEEDS" | jq -e 'length > 0 and all(.[]; .result == "success")' > /dev/null || {
-            echo "$NEEDS" | jq -r 'to_entries[] | "\(.key): \(.value.result)"'
-            exit 1
-          }
-          echo All unit tests passed!
-
-  Unit-Test-Linux:
-    name: "Unit tests (Linux)"
     runs-on: *test-runner
     permissions:
       contents: read
@@ -86,35 +68,6 @@ jobs:
       - name: Check for capability drift
         run: make check-capability-drift
 
-  Unit-Test-Windows:
-    name: "Unit tests (Windows)"
-    runs-on: windows-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
-        with:
-          persist-credentials: false
-
-      # go-make's setup only (not ./.github/actions/bootstrap): binny ships no windows release, so binny tools
-      # are unavailable here (`make unit` skips the fixture refresh on windows)
-      - name: Setup go + go-make tooling
-        uses: anchore/go-make/.github/actions/setup@abf41688f36f2cbec13105747abbe8e60f5c56ca # v0.9.3
-        with:
-          # keep in sync with the go-version default in ./.github/actions/bootstrap
-          go-version: "1.26.2"
-
-      # the binny-free version of `make download-test-fixture-cache` (keep the oras version in sync with .binny.yaml)
-      - name: Download test fixture cache
-        shell: bash
-        run: |
-          curl -sSfL https://github.com/oras-project/oras/releases/download/v1.3.4/oras_1.3.4_windows_amd64.zip -o "$RUNNER_TEMP/oras.zip"
-          unzip -q "$RUNNER_TEMP/oras.zip" oras.exe -d "$RUNNER_TEMP"
-          "$RUNNER_TEMP/oras.exe" pull ghcr.io/anchore/oss-cache/syft-test-fixture-cache:v2
-
-      - name: Run unit tests
-        run: make unit
-
   Integration-Test:
     # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
     name: "Integration tests"
@@ -177,72 +130,6 @@ jobs:
           path: snapshot/
           retention-days: 30
 
-  Containers-Storage-Podman:
-    name: "Containers-storage tests (Podman)"
-    needs: [Build-Snapshot-Artifacts]
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
-        with:
-          persist-credentials: false
-
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
-        with:
-          name: snapshot
-          path: snapshot
-
-      # go-make's setup only (not ./.github/actions/bootstrap): the test only needs make + the snapshot binary
-      - name: Setup go + go-make tooling
-        uses: anchore/go-make/.github/actions/setup@abf41688f36f2cbec13105747abbe8e60f5c56ca # v0.9.3
-        with:
-          # keep in sync with the go-version default in ./.github/actions/bootstrap
-          go-version: "1.26.2"
-
-      - name: Install Podman
-        run: |
-          sudo apt-get update
-          sudo apt-get install --no-install-recommends -y jq podman uidmap
-
-      - name: Scan image from Podman's local store
-        run: make containers-storage-test
-        env:
-          BUILDER: podman
-
-  Containers-Storage-Buildah:
-    name: "Containers-storage tests (Buildah)"
-    needs: [Build-Snapshot-Artifacts]
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
-        with:
-          persist-credentials: false
-
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
-        with:
-          name: snapshot
-          path: snapshot
-
-      # go-make's setup only (not ./.github/actions/bootstrap): the test only needs make + the snapshot binary
-      - name: Setup go + go-make tooling
-        uses: anchore/go-make/.github/actions/setup@abf41688f36f2cbec13105747abbe8e60f5c56ca # v0.9.3
-        with:
-          # keep in sync with the go-version default in ./.github/actions/bootstrap
-          go-version: "1.26.2"
-
-      - name: Install Buildah
-        run: |
-          sudo apt-get update
-          sudo apt-get install --no-install-recommends -y buildah jq uidmap
-
-      - name: Scan image from Buildah's local store
-        run: make containers-storage-test
-        env:
-          BUILDER: buildah
-
   Acceptance-Linux:
     # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
     name: "Acceptance tests (Linux)"

.golangci.yaml

@@ -1,10 +1,6 @@
 version: "2"
 run:
   tests: false
-  # keep in sync with buildTags in .make/main.go
-  build-tags:
-    - containers_image_openpgp
-    - exclude_graphdriver_btrfs
 linters:
   default: none
   enable:

.goreleaser.yaml

@@ -15,7 +15,6 @@ builds:
     binary: syft
     goos: [linux]
     goarch: [amd64, arm64, ppc64le, riscv64, s390x]
-    tags: [containers_image_openpgp, exclude_graphdriver_btrfs]
     mod_timestamp: &build-timestamp '{{ .CommitTimestamp }}'
     ldflags: &build-ldflags |
       -w
@@ -168,13 +167,16 @@ sboms:
       - "--output"
       - "json=$document"
 
-# the signature, certificate, and transparency log proof all land in a single sigstore bundle.
 signs:
   - cmd: .tool/cosign
-    signature: "${artifact}.sigstore.json"
+    signature: "${artifact}.sig"
+    certificate: "${artifact}.pem"
     args:
       - "sign-blob"
-      - "--bundle=${signature}"
+      - "--use-signing-config=false"
+      - "--oidc-issuer=https://token.actions.githubusercontent.com"
+      - "--output-certificate=${certificate}"
+      - "--output-signature=${signature}"
       - "${artifact}"
       - "--yes"
     artifacts: checksum

.make/go.mod

@@ -1,12 +1,12 @@
 module github.com/anchore/syft/.make
 
-go 1.26.0
+go 1.25.8
 
-require github.com/anchore/go-make v0.9.3
+require github.com/anchore/go-make v0.8.1
 
 require (
-	github.com/bmatcuk/doublestar/v4 v4.10.2 // indirect
+	github.com/bmatcuk/doublestar/v4 v4.10.0 // indirect
 	github.com/goccy/go-yaml v1.19.2 // indirect
-	golang.org/x/mod v0.41.0 // indirect
-	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/mod v0.40.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
 )

.make/go.sum

@@ -1,10 +1,10 @@
-github.com/anchore/go-make v0.9.3 h1:D+MkpvEJsOGwkOqKN0rd2zYi9jEzwKtZreNysH0DenI=
-github.com/anchore/go-make v0.9.3/go.mod h1:4HuELygGhxex2SaCEgfCbZ0geJ3xFkqtWpmt1NrYwPg=
-github.com/bmatcuk/doublestar/v4 v4.10.2 h1:eF7W7HWKg3z9NrWV9pTLnNeoXaqq3Tq9DNKXVMfoCnw=
-github.com/bmatcuk/doublestar/v4 v4.10.2/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
+github.com/anchore/go-make v0.8.1 h1:GAhPXR+9qVQhFB1pfVlHFOzxAt3dTDTUIA7Tp7nx9tg=
+github.com/anchore/go-make v0.8.1/go.mod h1:xALbVsPsDoJnJxdkjPlxOLZV7GbAdT5Pv3gd0kP1Lz0=
+github.com/bmatcuk/doublestar/v4 v4.10.0 h1:zU9WiOla1YA122oLM6i4EXvGW62DvKZVxIe6TYWexEs=
+github.com/bmatcuk/doublestar/v4 v4.10.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
 github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
-golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
-golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
-golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
-golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=
+golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

.make/main.go

@@ -16,12 +16,6 @@ import (
 	"github.com/anchore/go-make/tasks/gotest"
 )
 
-// buildTags must match the linux build in .goreleaser.yaml so tests and lint compile the same code that ships
-// (containers_image_openpgp compiles in stereoscope's real containers-storage provider instead of its stub).
-// exclude_graphdriver_btrfs drops the cgo-only btrfs driver, which needs libbtrfs headers whenever cgo is on (e.g.
-// under -race); release builds are CGO_ENABLED=0 and never include it anyway.
-const buildTags = "containers_image_openpgp,exclude_graphdriver_btrfs"
-
 func main() {
 	Makefile(
 		// shared anchore tasks
@@ -35,7 +29,6 @@ func main() {
 			gotest.Name("unit"),
 			gotest.ExcludeGlob("**/test/**"),
 			gotest.CoverageThreshold(62),
-			gotest.Tags(buildTags),
 			race(),
 		),
 
@@ -59,7 +52,7 @@ func main() {
 					raceFlag = " -race"
 				}
 				Run(
-					"go test -count=1 -timeout=30m -tags="+buildTags+raceFlag+" ./cmd/syft/internal/test/integration/...",
+					"go test -count=1 -timeout=30m -v"+raceFlag+" ./cmd/syft/internal/test/integration/...",
 					run.Env("GODEBUG", "dontfreezetheworld=1"),
 				)
 			},
@@ -73,7 +66,7 @@ func main() {
 					Log("race detector disabled (RACE=false); skipping race smoke")
 					return
 				}
-				Run("go run -race -tags="+buildTags+" cmd/syft/main.go anchore/test_images:grype-quality-dotnet-69f15d2")
+				Run("go run -race cmd/syft/main.go anchore/test_images:grype-quality-dotnet-69f15d2")
 			},
 		},
 
@@ -103,24 +96,6 @@ func main() {
 			},
 		},
 
-		// containers-storage tests: build a fixture image with BUILDER (podman or buildah) into an isolated local store
-		// and scan it with the snapshot binary. Linux only, and not hooked into "test" since it needs the builder installed.
-		Task{
-			Name:        "containers-storage-test",
-			Description: "Run containers-storage tests (BUILDER=podman|buildah)",
-			Run: func() {
-				bin := snapshotBinPath()
-				if !file.Exists(bin) {
-					Log("snapshot binary not found at %s; building single-target snapshot", bin)
-					Run("make snapshot:single-target")
-				}
-				Run(
-					"bash test/containers-storage/source-test.sh "+config.Env("BUILDER", "podman"),
-					run.Env("SYFT_BINARY_LOCATION", bin),
-				)
-			},
-		},
-
 		// default validation pipeline (replaces Taskfile `default`/`pr-validations`/`validations`).
 		Task{
 			Name:         "default",
@@ -164,7 +139,7 @@ func main() {
 		Task{
 			Name:         "unit:syft",
 			RunsOn:       lang.List("unit"),
-			Dependencies: unitFixtureDeps(),
+			Dependencies: Deps("refresh-fixtures"),
 		},
 		Task{
 			Name:   "clean:syft",
@@ -192,15 +167,6 @@ func raceEnabled() bool {
 	return config.CI && !config.Windows
 }
 
-// unitFixtureDeps skips the fixture cache refresh on windows: it needs binny-managed tools (binny ships
-// no windows release) and linux docker, so fixture-backed tests there have to skip themselves instead.
-func unitFixtureDeps() []string {
-	if config.Windows {
-		return nil
-	}
-	return Deps("refresh-fixtures")
-}
-
 // race applies raceEnabled() to a gotest suite. gotest exposes no functional option
 // for the race detector, but gotest.Config.Race is exported.
 func race() gotest.Option {

CONTRIBUTORS.md

@@ -1,6 +1,6 @@
 # Syft Contributors
 
-This file credits notable contributions from external authors and organizations; see `git log` for everyone who has contributed to Syft.
+The following Syft components were contributed by external authors/organizations.
 
 ## GraalVM Native Image
 

COPYRIGHT

@@ -1,4 +0,0 @@
-Copyright (c) Anchore, Inc.
-
-See LICENSE for the full license text.
-See CONTRIBUTORS.md and git log for a full list of contributors.

README.md

@@ -61,18 +61,6 @@ syft <image> -o cyclonedx-json
 syft <image> -o spdx-json=./spdx.json -o cyclonedx-json=./cdx.json
 ```
 
-### Local containers-storage images
-
-On Linux, syft can scan images from a local containers-storage store (e.g. built with Buildah or Podman) when asked explicitly; plain image references never look there:
-
-```bash
-syft --from containers-storage localhost/myimage:latest
-
-# rootless stores must be read from inside the builder's user namespace
-podman unshare syft --from containers-storage localhost/myimage:latest
-```
-
-This is included in the Linux release binaries. When building from source, add `-tags containers_image_openpgp,exclude_graphdriver_btrfs`.
 
 > [!TIP]
 > **Check out the [Getting Started guide](https://oss.anchore.com/docs/guides/sbom/getting-started/)** to explore all of the capabilities and features.

cmd/syft/cli/cli_test.go

@@ -1,25 +0,0 @@
-package cli
-
-import (
-	"io"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/anchore/clio"
-	"github.com/anchore/syft/internal/redact"
-)
-
-func TestCommandCanRunMultipleTimes(t *testing.T) {
-	// https://github.com/anchore/syft/issues/2285
-	t.Cleanup(redact.Reset)
-
-	for i := 0; i < 2; i++ {
-		_, cmd := create(clio.Identification{Name: "syft"}, io.Discard)
-		cmd.SetArgs([]string{"cataloger", "list", "-o", "json"})
-		require.NoError(t, cmd.Execute())
-
-		// the store is released at the end of each run so the next one can set its own
-		require.Nil(t, redact.Get())
-	}
-}

cmd/syft/cli/ui/handle_attestation.go

@@ -158,11 +158,6 @@ func (l *backgroundLineReader) read(reader io.Reader, stage *progress.Stage) {
 
 		l.lock.Unlock()
 	}
-	if err := s.Err(); err != nil {
-		log.WithFields("error", err).Debug("unable to read attestation output")
-		// keep draining so the writer never blocks on a full pipe
-		_, _ = io.Copy(io.Discard, reader)
-	}
 }
 
 func (l backgroundLineReader) Lines() []string {

cmd/syft/internal/clio_setup_config.go

@@ -41,8 +41,6 @@ func AppClioSetupConfig(id clio.Identification, out io.Writer) *clio.SetupConfig
 				stereoscope.SetBus(state.Bus)
 				bus.Set(state.Bus)
 
-				// the redact store is process-global and only cleared when a run ends (see the post-run below), so
-				// setting it while another run is still in flight panics rather than splitting secrets across stores.
 				redact.Set(state.RedactStore)
 
 				log.Set(state.Logger)
@@ -50,14 +48,8 @@ func AppClioSetupConfig(id clio.Identification, out io.Writer) *clio.SetupConfig
 				return nil
 			},
 		).
-		WithPostRuns(func(state *clio.State, _ error) {
+		WithPostRuns(func(_ *clio.State, _ error) {
 			stereoscope.Cleanup() //nolint:staticcheck // we don't have access to the image object here
-
-			// release the redact store now that nothing in this run can report anymore, so a later run in the same
-			// process (e.g. syft embedded as a library) can set its own. Only release the store this run set.
-			if redact.Get() == state.RedactStore {
-				redact.Reset()
-			}
 		})
 	return clioCfg
 }

cmd/syft/internal/clio_setup_config_test.go

@@ -1,32 +0,0 @@
-package internal
-
-import (
-	"io"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/anchore/clio"
-	"github.com/anchore/go-logger/adapter/discard"
-	gologgerredact "github.com/anchore/go-logger/adapter/redact"
-	"github.com/anchore/syft/internal/redact"
-)
-
-func TestAppClioSetupConfigInitializerPanicsWhileRunInFlight(t *testing.T) {
-	t.Cleanup(redact.Reset)
-
-	cfg := AppClioSetupConfig(clio.Identification{Name: "syft"}, io.Discard)
-	require.Len(t, cfg.Initializers, 1)
-
-	newState := func() *clio.State {
-		return &clio.State{Logger: discard.New(), RedactStore: gologgerredact.NewStore()}
-	}
-
-	require.NoError(t, cfg.Initializers[0](newState()))
-
-	// a second run starting before the first has finished must not silently replace the store, otherwise
-	// secrets added to the first store would no longer be redacted
-	require.PanicsWithValue(t, "replace existing redaction store (probably unintentional)", func() {
-		_ = cfg.Initializers[0](newState())
-	})
-}

cmd/syft/internal/commands/convert.go

@@ -114,10 +114,6 @@ func RunConvert(ctx context.Context, opts *ConvertOptions, userInput string) err
 		if err != nil {
 			return err
 		}
-		// output files are opened up front; release them if we bail out before writing
-		if c, ok := writer.(io.Closer); ok {
-			defer func() { _ = c.Close() }()
-		}
 	}
 
 	for _, output := range unchanged {

cmd/syft/internal/commands/scan.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"io"
 	"os"
 	"reflect"
 	"strings"
@@ -182,10 +181,6 @@ func runScan(ctx context.Context, id clio.Identification, opts *scanOptions, use
 	if err != nil {
 		return err
 	}
-	// output files are opened up front; release them if we bail out before writing
-	if c, ok := writer.(io.Closer); ok {
-		defer func() { _ = c.Close() }()
-	}
 
 	sources := opts.From
 	if len(sources) == 0 {

cmd/syft/internal/options/cache_test.go

@@ -4,7 +4,6 @@ import (
 	"io"
 	"os"
 	"path/filepath"
-	"runtime"
 	"strings"
 	"testing"
 	"time"
@@ -23,10 +22,9 @@ func Test_defaultDir(t *testing.T) {
 	homeDir := filepath.Join(tmpDir, "fake-home")
 
 	tests := []struct {
-		name          string
-		env           map[string]string
-		expected      string
-		skipOnWindows bool
+		name     string
+		env      map[string]string
+		expected string
 	}{
 		{
 			name: "no-xdg",
@@ -34,8 +32,6 @@ func Test_defaultDir(t *testing.T) {
 				"HOME": homeDir,
 			},
 			expected: homeDir,
-			// xdg falls back to LOCALAPPDATA on windows, not HOME
-			skipOnWindows: true,
 		},
 		{
 			name: "xdg-cache",
@@ -63,9 +59,6 @@ func Test_defaultDir(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			if test.skipOnWindows && runtime.GOOS == "windows" {
-				t.Skip("posix-only cache dir fallback")
-			}
 			restoreCache(t)
 
 			for k, v := range test.env {

cmd/syft/internal/options/catalog.go

@@ -17,8 +17,6 @@ import (
 	"github.com/anchore/syft/syft/cataloging"
 	"github.com/anchore/syft/syft/cataloging/filecataloging"
 	"github.com/anchore/syft/syft/cataloging/pkgcataloging"
-	"github.com/anchore/syft/syft/file/cataloger/executable"
-	"github.com/anchore/syft/syft/file/cataloger/filecontent"
 	"github.com/anchore/syft/syft/pkg/cataloger/binary"
 	"github.com/anchore/syft/syft/pkg/cataloger/cpp"
 	"github.com/anchore/syft/syft/pkg/cataloger/dotnet"
@@ -147,18 +145,14 @@ func (cfg Catalog) ToFilesConfig() filecataloging.Config {
 		log.WithFields("error", err).Warn("unable to configure file hashers")
 	}
 
-	return filecataloging.Config{
-		Selection: cfg.File.Metadata.Selection,
-		Hashers:   hashers,
-		Content: filecontent.Config{
-			Globs:              cfg.File.Content.Globs,
-			SkipFilesAboveSize: cfg.File.Content.SkipFilesAboveSize,
-		},
-		Executable: executable.Config{
-			MIMETypes: executable.DefaultConfig().MIMETypes,
-			Globs:     cfg.File.Executable.Globs,
-		},
-	}
+	c := filecataloging.DefaultConfig()
+	c.Selection = cfg.File.Metadata.Selection
+	c.Hashers = hashers
+	c.Content.Globs = cfg.File.Content.Globs
+	c.Content.SkipFilesAboveSize = cfg.File.Content.SkipFilesAboveSize
+	c.Executable.Globs = cfg.File.Executable.Globs
+
+	return c
 }
 
 func (cfg Catalog) ToLicenseConfig() cataloging.LicenseConfig {

cmd/syft/internal/options/file.go

@@ -64,7 +64,7 @@ func (c *fileConfig) PostLoad() error {
 }
 
 func (c *fileConfig) DescribeFields(descriptions clio.FieldDescriptionSet) {
-	descriptions.Add(&c.Metadata.Selection, `select which files should be captured by the file-metadata cataloger and included in the SBOM. 
+	descriptions.Add(&c.Metadata.Selection, `select which files should be captured by the file-metadata cataloger and included in the SBOM.
 Options include:
  - "all": capture all files from the search space
  - "owned-by-package": capture only files owned by packages

cmd/syft/internal/options/source.go

@@ -36,7 +36,7 @@ var _ clio.PostLoader = (*imageSource)(nil)
 func (o *sourceConfig) DescribeFields(descriptions clio.FieldDescriptionSet) {
 	descriptions.Add(&o.File.Digests, `the file digest algorithms to use on the scanned file (options: "md5", "sha1", "sha224", "sha256", "sha384", "sha512")`)
 	descriptions.Add(&o.Image.DefaultPullSource, `allows users to specify which image source should be used to generate the sbom
-valid values are: registry, docker, podman, containers-storage`)
+valid values are: registry, docker, podman`)
 }
 
 type imageSource struct {
@@ -74,7 +74,7 @@ func (c *imageSource) PostLoad() error {
 	return checkDefaultSourceValues(c.DefaultPullSource)
 }
 
-var validDefaultSourceValues = []string{"registry", "docker", "podman", "containers-storage", ""}
+var validDefaultSourceValues = []string{"registry", "docker", "podman", ""}
 
 func checkDefaultSourceValues(source string) error {
 	validValues := strset.New(validDefaultSourceValues...)

cmd/syft/internal/options/writer.go

@@ -2,11 +2,10 @@ package options
 
 import (
 	"bytes"
-	"errors"
 	"fmt"
 	"io"
 	"os"
-	"path/filepath"
+	"path"
 	"sort"
 	"strings"
 
@@ -21,10 +20,7 @@ import (
 	"github.com/anchore/syft/syft/sbom"
 )
 
-var _ interface {
-	io.Closer
-	sbom.Writer
-} = (*sbomMultiWriter)(nil)
+var _ sbom.Writer = (*sbomMultiWriter)(nil)
 
 var _ interface {
 	io.Closer
@@ -168,12 +164,6 @@ func newSBOMMultiWriter(options ...sbomWriterDescription) (_ *sbomMultiWriter, e
 	}
 
 	out := &sbomMultiWriter{}
-	defer func() {
-		// don't leak the files already opened when a later output fails
-		if err != nil {
-			_ = out.Close()
-		}
-	}()
 
 	for _, option := range options {
 		switch len(option.Path) {
@@ -182,8 +172,8 @@ func newSBOMMultiWriter(options ...sbomWriterDescription) (_ *sbomMultiWriter, e
 				format: option.Format,
 			})
 		default:
-			// create any missing subdirectories (option.Path is a host path, so this must be filepath)
-			dir := filepath.Dir(option.Path)
+			// create any missing subdirectories
+			dir := path.Dir(option.Path)
 			if dir != "" {
 				s, err := os.Stat(dir)
 				if err != nil {
@@ -220,20 +210,6 @@ func (m *sbomMultiWriter) Write(s sbom.SBOM) (errs error) {
 	return errs
 }
 
-// Close releases any files held by the writers. Write already closes each file it writes to, so this matters
-// when the SBOM is never written (e.g. an error after the writer was created).
-func (m *sbomMultiWriter) Close() error {
-	var errs error
-	for _, w := range m.writers {
-		if c, ok := w.(io.Closer); ok {
-			if err := c.Close(); err != nil && !errors.Is(err, os.ErrClosed) {
-				errs = multierror.Append(errs, err)
-			}
-		}
-	}
-	return errs
-}
-
 // sbomStreamWriter implements sbom.Writer for a given format and io.Writer, also providing a close function for cleanup
 type sbomStreamWriter struct {
 	format sbom.FormatEncoder

cmd/syft/internal/options/writer_test.go

@@ -202,9 +202,9 @@ func Test_newSBOMMultiWriter(t *testing.T) {
 			if test.err {
 				assert.Error(t, err)
 				return
+			} else {
+				assert.NoError(t, err)
 			}
-			require.NoError(t, err)
-			t.Cleanup(func() { _ = mw.Close() })
 
 			assert.Len(t, mw.writers, len(test.expected))
 

cmd/syft/internal/test/integration/catalog_packages_cases_test.go

@@ -524,12 +524,4 @@ var commonTestCases = []testCase{
 			"kong": "3.7.0-0",
 		},
 	},
-	{
-		name:        "find cpan distribution",
-		pkgType:     pkg.CpanPkg,
-		pkgLanguage: pkg.Perl,
-		pkgInfo: map[string]string{
-			"URI": "5.35",
-		},
-	},
 }

cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/perl5/x86_64-linux/.meta/URI-5.35/MYMETA.json

@@ -1,9 +0,0 @@
-{
-  "abstract": "Uniform Resource Identifiers (absolute and relative)",
-  "license": ["perl_5"],
-  "meta-spec": {"version": 2},
-  "name": "URI",
-  "prereqs": {"runtime": {"requires": {"Carp": "0", "perl": "5.008001"}}},
-  "release_status": "stable",
-  "version": "5.35"
-}

cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/perl5/x86_64-linux/.meta/URI-5.35/install.json

@@ -1,11 +0,0 @@
-{
-  "dist": "URI-5.35",
-  "name": "URI",
-  "pathname": "O/OA/OALDERS/URI-5.35.tar.gz",
-  "provides": {
-    "URI": {"file": "lib/URI.pm", "version": "5.35"},
-    "URI::Escape": {"file": "lib/URI/Escape.pm", "version": "5.35"}
-  },
-  "target": "URI",
-  "version": "5.35"
-}

go.mod

@@ -18,16 +18,16 @@ require (
 	github.com/anchore/go-homedir v0.1.1
 	github.com/anchore/go-logger v0.2.0
 	github.com/anchore/go-macholibre v0.1.1
-	github.com/anchore/go-rpmdb v0.2.2
+	github.com/anchore/go-rpmdb v0.2.0
 	github.com/anchore/go-sync v0.1.2
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.2.0
-	github.com/anchore/stereoscope v0.3.4
+	github.com/anchore/stereoscope v0.3.2
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
 	github.com/aquasecurity/go-pep440-version v0.0.1
 	github.com/bitnami/go-version v0.0.0-20250131085805-b1f57a8634ef
 	github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
-	github.com/bmatcuk/doublestar/v4 v4.10.2
+	github.com/bmatcuk/doublestar/v4 v4.10.0
 	github.com/cespare/xxhash/v2 v2.3.0
 	github.com/charmbracelet/bubbles v1.0.0
 	github.com/charmbracelet/bubbletea v1.3.10
@@ -41,8 +41,8 @@ require (
 	github.com/facebookincubator/nvdtools v0.1.5
 	github.com/github/go-spdx/v2 v2.7.0
 	github.com/gkampitakis/go-snaps v0.5.23
-	github.com/go-git/go-billy/v5 v5.9.2
-	github.com/go-git/go-git/v5 v5.19.3
+	github.com/go-git/go-billy/v5 v5.9.1
+	github.com/go-git/go-git/v5 v5.19.2
 	github.com/go-test/deep v1.1.1
 	github.com/go-viper/mapstructure/v2 v2.5.0
 	github.com/goccy/go-yaml v1.19.2
@@ -52,7 +52,7 @@ require (
 	github.com/google/licensecheck v0.3.1
 	github.com/google/uuid v1.6.0
 	github.com/gookit/color v1.6.1
-	github.com/gpustack/gguf-parser-go v0.26.4
+	github.com/gpustack/gguf-parser-go v0.26.3
 	github.com/hashicorp/go-cleanhttp v0.5.2
 	github.com/hashicorp/go-getter v1.8.9
 	github.com/hashicorp/go-multierror v1.1.1
@@ -62,7 +62,7 @@ require (
 	github.com/jedib0t/go-pretty/v6 v6.8.3
 	github.com/jinzhu/copier v0.4.0
 	github.com/kastenhq/goversion v0.0.0-20230811215019-93b2f8823953
-	github.com/klauspost/compress v1.20.1
+	github.com/klauspost/compress v1.20.0
 	github.com/magiconair/properties v1.18.12
 	github.com/mholt/archives v0.1.5
 	github.com/moby/sys/mountinfo v0.7.2
@@ -83,7 +83,7 @@ require (
 	github.com/spf13/afero v1.15.0
 	github.com/spf13/cobra v1.10.2
 	github.com/stretchr/testify v1.12.1
-	github.com/ulikunitz/xz v0.5.17
+	github.com/ulikunitz/xz v0.5.16
 	github.com/vbatts/go-mtree v0.7.0
 	github.com/vifraa/gopom v1.0.0
 	github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651
@@ -96,12 +96,12 @@ require (
 	golang.org/x/mod v0.41.0
 	golang.org/x/net v0.59.0
 	golang.org/x/time v0.16.0
-	golang.org/x/tools v0.51.0
-	modernc.org/sqlite v1.60.1
+	golang.org/x/tools v0.50.0
+	modernc.org/sqlite v1.59.0
 )
 
 require (
-	github.com/pb33f/ordered-map/v2 v2.3.2
+	github.com/pb33f/ordered-map/v2 v2.3.1
 	github.com/tailscale/hujson v0.0.0-20260302212456-ecc657c15afd
 	howett.net/plist v1.0.1
 )
@@ -115,7 +115,6 @@ require (
 	cloud.google.com/go/iam v1.12.0 // indirect
 	cloud.google.com/go/monitoring v1.30.0 // indirect
 	cloud.google.com/go/storage v1.65.1 // indirect
-	cyphar.com/go-pathrs v0.2.5 // indirect
 	dario.cat/mergo v1.0.2 // indirect
 	github.com/DataDog/zstd v1.5.5 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 // indirect
@@ -123,10 +122,9 @@ require (
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.57.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29 // indirect
-	github.com/Microsoft/hcsshim v0.15.0-rc.4 // indirect
+	github.com/Microsoft/hcsshim v0.15.0-rc.1 // indirect
 	github.com/ProtonMail/go-crypto v1.4.1 // indirect
 	github.com/STARRY-S/zip v0.2.3 // indirect
-	github.com/VividCortex/ewma v1.2.0 // indirect
 	github.com/agext/levenshtein v1.2.1 // indirect
 	github.com/anchore/go-lzo v0.1.1 // indirect
 	github.com/anchore/go-struct-converter v0.2.0-rc2 // indirect
@@ -171,25 +169,20 @@ require (
 	github.com/cloudflare/circl v1.6.3 // indirect
 	github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 // indirect
 	github.com/containerd/cgroups/v3 v3.1.3 // indirect
-	github.com/containerd/containerd/api v1.12.0 // indirect
-	github.com/containerd/containerd/v2 v2.4.1 // indirect
+	github.com/containerd/containerd/api v1.11.1 // indirect
+	github.com/containerd/containerd/v2 v2.3.6 // indirect
 	github.com/containerd/continuity v0.5.0 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/fifo v1.1.0 // indirect
-	github.com/containerd/log v0.2.0 // indirect
-	github.com/containerd/log/otel v0.1.0 // indirect
+	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/platforms v1.0.0-rc.5 // indirect
 	github.com/containerd/plugin v1.1.0 // indirect
-	github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect
-	github.com/containerd/ttrpc v1.2.9 // indirect
-	github.com/containerd/typeurl/v2 v2.3.0 // indirect
-	github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 // indirect
-	github.com/containers/ocicrypt v1.3.2 // indirect
-	github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 // indirect
-	github.com/cyphar/filepath-securejoin v0.7.0 // indirect
-	github.com/docker/cli v29.8.2+incompatible // indirect
-	github.com/docker/docker-credential-helpers v0.9.8 // indirect
+	github.com/containerd/ttrpc v1.2.8 // indirect
+	github.com/containerd/typeurl/v2 v2.2.3 // indirect
+	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
+	github.com/docker/cli v29.8.0+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.9.5 // indirect
 	github.com/docker/go-connections v0.8.1 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect
@@ -199,17 +192,17 @@ require (
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
 	github.com/fatih/color v1.19.0 // indirect
 	github.com/felixge/fgprof v0.9.5 // indirect
-	github.com/felixge/httpsnoop v1.1.0 // indirect
-	github.com/fsnotify/fsnotify v1.10.1 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.15 // indirect
 	github.com/gkampitakis/ciinfo v0.3.4 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.5 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
 	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-restruct/restruct v1.2.0-alpha // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
-	github.com/google/go-intervals v0.0.2 // indirect
 	github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.20 // indirect
@@ -224,6 +217,7 @@ require (
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
+	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
 	github.com/kr/pretty v0.3.1 // indirect
 	github.com/kr/text v0.2.0 // indirect
@@ -232,13 +226,10 @@ require (
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75 // indirect
-	github.com/mattn/go-runewidth v0.0.27 // indirect
-	github.com/mattn/go-sqlite3 v1.14.48 // indirect
+	github.com/mattn/go-runewidth v0.0.21 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
-	github.com/miekg/pkcs11 v1.1.2 // indirect
 	github.com/mikelolasagasti/xz v1.0.1 // indirect
 	github.com/minio/minlz v1.0.1 // indirect
-	github.com/mistifyio/go-zfs/v4 v4.0.0 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
@@ -247,87 +238,73 @@ require (
 	github.com/moby/locker v1.0.1 // indirect
 	github.com/moby/moby/api v1.56.0 // indirect
 	github.com/moby/moby/client v0.6.0 // indirect
-	github.com/moby/sys/capability v0.4.0 // indirect
+	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/moby/sys/signal v0.7.1 // indirect
-	github.com/moby/sys/user v0.4.1 // indirect
-	github.com/moby/sys/userns v0.2.1 // indirect
+	github.com/moby/sys/user v0.4.0 // indirect
+	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/muesli/termenv v0.16.0 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
-	github.com/nwaples/rardecode/v2 v2.4.1 // indirect
+	github.com/nwaples/rardecode/v2 v2.2.0 // indirect
 	github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect
 	github.com/olekukonko/errors v1.2.0 // indirect
 	github.com/olekukonko/ll v0.1.6 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/opencontainers/runtime-spec v1.3.0 // indirect
-	github.com/opencontainers/selinux v1.15.1 // indirect
-	github.com/pb33f/go-yaml v0.1.0 // indirect
 	github.com/pborman/indent v1.2.1 // indirect
 	github.com/pelletier/go-toml/v2 v2.4.3 // indirect
 	github.com/pierrec/lz4/v4 v4.1.26 // indirect
 	github.com/piprate/json-gold v0.7.0 // indirect
-	github.com/pjbgf/sha1cd v0.7.0 // indirect
+	github.com/pjbgf/sha1cd v0.6.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/profile v1.7.0 // indirect
 	github.com/pkg/xattr v0.4.12 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/pquerna/cachecontrol v0.0.0-20180517163645-1555304b9b35 // indirect
-	github.com/proglottis/gpgme v0.1.6 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/sagikazarmark/locafero v0.11.0 // indirect
 	github.com/sahilm/fuzzy v0.1.1 // indirect
-	github.com/secure-systems-lab/go-securesystemslib v0.11.1 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
-	github.com/sigstore/fulcio v1.8.7 // indirect
-	github.com/sigstore/protobuf-specs v0.5.2 // indirect
-	github.com/sigstore/sigstore v1.10.11 // indirect
-	github.com/sirupsen/logrus v1.10.2 // indirect
+	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/skeema/knownhosts v1.3.1 // indirect
 	github.com/smallnest/ringbuffer v0.0.0-20241116012123-461381446e3d // indirect
-	github.com/smallstep/pkcs7 v0.2.1 // indirect
 	github.com/sorairolake/lzip-go v0.3.8 // indirect
 	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/spf13/viper v1.21.0 // indirect
 	github.com/spiffe/go-spiffe/v2 v2.7.0 // indirect
-	github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 // indirect
 	github.com/stretchr/objx v0.5.3 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/sylabs/sif/v2 v2.24.2 // indirect
+	github.com/sylabs/sif/v2 v2.24.1 // indirect
 	github.com/sylabs/squashfs v1.0.6 // indirect
-	github.com/tchap/go-patricia/v2 v2.3.3 // indirect
 	github.com/therootcompany/xz v1.0.1 // indirect
 	github.com/tidwall/gjson v1.19.0 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/tidwall/sjson v1.2.5 // indirect
-	github.com/vbatts/tar-split v0.12.3 // indirect
-	github.com/vbauerster/cupwriter v0.0.4 // indirect
-	github.com/vbauerster/mpb/v8 v8.14.0 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
 	github.com/zclconf/go-cty v1.19.0 // indirect
+	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/detectors/gcp v1.44.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.71.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 // indirect
-	go.opentelemetry.io/otel v1.46.0 // indirect
-	go.opentelemetry.io/otel/metric v1.46.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.46.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.46.0 // indirect
-	go.opentelemetry.io/otel/trace v1.46.0 // indirect
-	go.podman.io/image/v5 v5.41.2 // indirect
-	go.podman.io/storage v1.64.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect
+	go.opentelemetry.io/otel v1.45.0 // indirect
+	go.opentelemetry.io/otel/metric v1.45.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.45.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.45.0 // indirect
+	go.opentelemetry.io/otel/trace v1.45.0 // indirect
+	go.yaml.in/yaml/v4 v4.0.0-rc.2 // indirect
 	go4.org v0.0.0-20230225012048-214862532bf5 // indirect
 	golang.org/x/crypto v0.57.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
@@ -339,12 +316,12 @@ require (
 	gonum.org/v1/gonum v0.17.0 // indirect
 	google.golang.org/api v0.294.0 // indirect
 	google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260825221802-da73d73af1c5 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260715232425-e75dac1f907d // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect
 	google.golang.org/grpc v1.83.2 // indirect
 	google.golang.org/protobuf v1.36.12 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
-	modernc.org/libc v1.77.1 // indirect
+	modernc.org/libc v1.75.7 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.12.1 // indirect
 )

go.sum

@@ -67,8 +67,6 @@ cloud.google.com/go/storage v1.65.1 h1:LRRpBJUTf+OXDPX9jZUKZ3mSLIsz3htG+qUpeNZov
 cloud.google.com/go/storage v1.65.1/go.mod h1:UsS9OgFg/XHOSYakQ8ZtLWWeyGkk1WnmD/GsGfN0BHM=
 cloud.google.com/go/trace v1.16.0 h1:GmQovzFc5F0CNfl0VLgL64aoTtu7xsM0YajW2GlG9+E=
 cloud.google.com/go/trace v1.16.0/go.mod h1:r+bdAn16dKLSV1G2D5v3e58IlQlizfxWrUfjx7kM7X0=
-cyphar.com/go-pathrs v0.2.5 h1:SnX9FBvnoyn3lUs1dkMgZ52bAETpirNu3FTRh5HlRik=
-cyphar.com/go-pathrs v0.2.5/go.mod h1:y8f1EMG7r+hCuFf/rXsKqMJrJAUoADZGNh5/vZPKcGc=
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
 dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
@@ -101,8 +99,8 @@ github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSC
 github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
 github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29 h1:0kQAzHq8vLs7Pptv+7TxjdETLf/nIqJpIB4oC6Ba4vY=
 github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29/go.mod h1:ZWa7ssZJT30CCDGJ7fk/2SBTq9BIQrrVjrcss0UW2s0=
-github.com/Microsoft/hcsshim v0.15.0-rc.4 h1:aZFX4LH0S20Lgjq0wG61StIClj7im4yzrxIClkaR8Z8=
-github.com/Microsoft/hcsshim v0.15.0-rc.4/go.mod h1:BA9CBztgu4h/6Jsvo1O1M4qjWw09PoYpaEYgexPE578=
+github.com/Microsoft/hcsshim v0.15.0-rc.1 h1:FbbwtQmiD+BVHynGkx5S65JkLyhkEiiTP8nrpmg2SZw=
+github.com/Microsoft/hcsshim v0.15.0-rc.1/go.mod h1:HWvvUPIy9HF6LotILj1G4VyS065rcLQ6tqj6tMUdOfI=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/OneOfOne/xxhash v1.2.8 h1:31czK/TI9sNkxIKfaUfGlU47BAxQ0ztGgd9vPyqimf8=
 github.com/OneOfOne/xxhash v1.2.8/go.mod h1:eZbhyaAYD41SGSSsnmcpxVoRiQ/MPUTjUdIIOT9Um7Q=
@@ -110,8 +108,6 @@ github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67
 github.com/ProtonMail/go-crypto v1.4.1/go.mod h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo=
 github.com/STARRY-S/zip v0.2.3 h1:luE4dMvRPDOWQdeDdUxUoZkzUIpTccdKdhHHsQJ1fm4=
 github.com/STARRY-S/zip v0.2.3/go.mod h1:lqJ9JdeRipyOQJrYSOtpNAiaesFO6zVDsE8GIGFaoSk=
-github.com/VividCortex/ewma v1.2.0 h1:f58SaIzcDXrSy3kWaHNvuJgJ3Nmz59Zji6XoJR/q1ow=
-github.com/VividCortex/ewma v1.2.0/go.mod h1:nz4BbCtbLyFDeC9SUHbtcT5644juEuWfUAUnGx7j5l4=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d/go.mod h1:asat636LX7Bqt5lYEZ27JNDcqxfjdBQuJ/MM4CN/Lzo=
 github.com/acobaugh/osrelease v0.1.0 h1:Yb59HQDGGNhCj4suHaFQQfBps5wyoKLSSX/J/+UifRE=
@@ -140,8 +136,8 @@ github.com/anchore/go-lzo v0.1.1 h1:IwL/fvkdtlIrYIXck6WxZ3nb8WjjHziYYmGxlooyOnM=
 github.com/anchore/go-lzo v0.1.1/go.mod h1:3kLx0bve2oN1iDwgM1U5zGku1Tfbdb0No5qp1eL1fIk=
 github.com/anchore/go-macholibre v0.1.1 h1:sTBHi3S1WVIOCamc6NyT8Sn9mBmD30DCTfjfVm4k6/M=
 github.com/anchore/go-macholibre v0.1.1/go.mod h1:YNq2610RlvGCK0Za+Klz/OCMtUaEnwwAGA/VfUAQaro=
-github.com/anchore/go-rpmdb v0.2.2 h1:44VC7mvFAxV9t5JUZYg3S9sqG+E94iZvyWACMDq9hSk=
-github.com/anchore/go-rpmdb v0.2.2/go.mod h1:Y64EbetdqhryMjtk8IzXkdCQw/aNDx+feZCT9aj6rjs=
+github.com/anchore/go-rpmdb v0.2.0 h1:ixcyMg/guhBL9XjBVwhTv9CG48xO07Qkg2uDX2+zx/c=
+github.com/anchore/go-rpmdb v0.2.0/go.mod h1:ATsRlpCXstnoYfzqBfhwGw0U2dolx1BBQ9rAU8jWBAw=
 github.com/anchore/go-struct-converter v0.2.0-rc2 h1:q+859fW2/jbHJHB2etbNfRlFwYpknyvbqqk1hUdamQ4=
 github.com/anchore/go-struct-converter v0.2.0-rc2/go.mod h1:cDBA5vhcR62nXWo8QH9/Kk2807o65ISaHPNPX66L+Uw=
 github.com/anchore/go-sync v0.1.2 h1:RDD5RCanrWqhbtBulqPSZpERadUlgcYjpybYzYd3Uk8=
@@ -150,8 +146,8 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZV
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/packageurl-go v0.2.0 h1:CkrM4RMUwrEGAiE1OVlxaZNzWj0TuHRey7o4T/EAErk=
 github.com/anchore/packageurl-go v0.2.0/go.mod h1:2JCgOQMIsqZ7TmliXG4PnUthPJAKE3mWQbsW2XHjAOE=
-github.com/anchore/stereoscope v0.3.4 h1:dT5AfjCTXUJowMiRIc+VBQVwvwnIEwnxxwA1GwAkMxw=
-github.com/anchore/stereoscope v0.3.4/go.mod h1:+HxqHTt7dvH8mea0mf3ulqkf084VvHiT1grpAQf5uEs=
+github.com/anchore/stereoscope v0.3.2 h1:A2FDMSU56m3rErO1e0CtWAVcDS8tc2iX4UXTw1hyPnI=
+github.com/anchore/stereoscope v0.3.2/go.mod h1:/IUDVDka+4gufc8kDw+JO3gFl9PkpCjJ2r3bd9UWouM=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ=
 github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
@@ -229,8 +225,8 @@ github.com/bitnami/go-version v0.0.0-20250131085805-b1f57a8634ef h1:TSFnfbbu2oAO
 github.com/bitnami/go-version v0.0.0-20250131085805-b1f57a8634ef/go.mod h1:9iglf1GG4oNRJ39bZ5AZrjgAFD2RwQbXw6Qf7Cs47wo=
 github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb h1:m935MPodAbYS46DG4pJSv7WO+VECIWUQ7OJYSoTrMh4=
 github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb/go.mod h1:PkYb9DJNAwrSvRx5DYA+gUcOIgTGVMNkfSCbZM8cWpI=
-github.com/bmatcuk/doublestar/v4 v4.10.2 h1:eF7W7HWKg3z9NrWV9pTLnNeoXaqq3Tq9DNKXVMfoCnw=
-github.com/bmatcuk/doublestar/v4 v4.10.2/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
+github.com/bmatcuk/doublestar/v4 v4.10.0 h1:zU9WiOla1YA122oLM6i4EXvGW62DvKZVxIe6TYWexEs=
+github.com/bmatcuk/doublestar/v4 v4.10.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/bodgit/plumbing v1.3.0 h1:pf9Itz1JOQgn7vEOE7v7nlEfBykYqvUYioC61TwWCFU=
 github.com/bodgit/plumbing v1.3.0/go.mod h1:JOTb4XiRu5xfnmdnDJo6GmSbSbtSyufrsyZFByMtKEs=
 github.com/bodgit/sevenzip v1.6.1 h1:kikg2pUMYC9ljU7W9SaqHXhym5HyKm8/M/jd31fYan4=
@@ -298,10 +294,10 @@ github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 h1:aBangftG7EVZoUb69Os
 github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2/go.mod h1:qwXFYgsP6T7XnJtbKlf1HP8AjxZZyzxMmc+Lq5GjlU4=
 github.com/containerd/cgroups/v3 v3.1.3 h1:eUNflyMddm18+yrDmZPn3jI7C5hJ9ahABE5q6dyLYXQ=
 github.com/containerd/cgroups/v3 v3.1.3/go.mod h1:PKZ2AcWmSBsY/tJUVhtS/rluX0b1uq1GmPO1ElCmbOw=
-github.com/containerd/containerd/api v1.12.0 h1:kuQm82SbDrCuO4n7hf2L8zsBtZLuympyq5X/VotfX2A=
-github.com/containerd/containerd/api v1.12.0/go.mod h1:EBcSzoi9Vl18cdODaXUCskf3D2NT8lsSXeZJnU5jIUc=
-github.com/containerd/containerd/v2 v2.4.1 h1:DUx/ZJN7cEu0WuzHClDB+68H/bqMEH5pWoEjf0ae4hc=
-github.com/containerd/containerd/v2 v2.4.1/go.mod h1:vgLdtvl3prFk1d3ZVqQcsDD5Q9IKM+vAIdU54U85w+I=
+github.com/containerd/containerd/api v1.11.1 h1:h8nfoDW9+fNsC/9TwiAHj8B1GzXKtR4eFtkhi/X5RLU=
+github.com/containerd/containerd/api v1.11.1/go.mod h1:CaQFRu+N1MtbgL6JDOJLUB1hCKESU1lD6MuTJhgtdlw=
+github.com/containerd/containerd/v2 v2.3.6 h1:huoqZXaDW1x1kgPvFC4rMwxv92vUJnqgq7I5b1rSddM=
+github.com/containerd/containerd/v2 v2.3.6/go.mod h1:qaUSWKk9EchqbudSbhv1MxI8dXKGYHLpZtMQdkEkVZ4=
 github.com/containerd/continuity v0.5.0 h1:7a85HZpCSs+1Zps0Ee3DPSuAWY+0SJM1JNM51nlEVDg=
 github.com/containerd/continuity v0.5.0/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
@@ -310,33 +306,23 @@ github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151X
 github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
 github.com/containerd/fifo v1.1.0 h1:4I2mbh5stb1u6ycIABlBw9zgtlK8viPI9QkQNRQEEmY=
 github.com/containerd/fifo v1.1.0/go.mod h1:bmC4NWMbXlt2EZ0Hc7Fx7QzTFxgPID13eH0Qu+MAb2o=
-github.com/containerd/log v0.2.0 h1:BewD/umNgVnoczglOpX8eRMyEy5t5iPlu5AIpnWDONc=
-github.com/containerd/log v0.2.0/go.mod h1:/M7L7CXKcPTfNC74XzaK+5H5KbO5+4lJVpuVI6vRLoM=
-github.com/containerd/log/otel v0.1.0 h1:Az5rFFo0+c4v2yC8ROR63sWsZpKl/vhtUnUhqLSpE6U=
-github.com/containerd/log/otel v0.1.0/go.mod h1:65C5iYF2xIQByCyxzoO2KKKK1+/tGxD4XqhdlrTtvzE=
+github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
+github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
 github.com/containerd/platforms v1.0.0-rc.5 h1:vXd569rDrz8LeMXzAnBsy6LADV5YtsD8oyaRarxdmSU=
 github.com/containerd/platforms v1.0.0-rc.5/go.mod h1:lKlMXyLybmBedS/JJm11uDofzI8L2v0J2ZbYvNsbq1A=
 github.com/containerd/plugin v1.1.0 h1:O+7lczNJVMy8rz0YNx3xGB8tTf5qY4i5abF041Ew19U=
 github.com/containerd/plugin v1.1.0/go.mod h1:qBTum+A8lJ6lO44A19Eo7y1OlcLj4OWFH1DA/vnHmcc=
-github.com/containerd/stargz-snapshotter/estargz v0.18.2 h1:yXkZFYIzz3eoLwlTUZKz2iQ4MrckBxJjkmD16ynUTrw=
-github.com/containerd/stargz-snapshotter/estargz v0.18.2/go.mod h1:XyVU5tcJ3PRpkA9XS2T5us6Eg35yM0214Y+wvrZTBrY=
-github.com/containerd/ttrpc v1.2.9 h1:ha0ak962T0s3CA/RoZ6S6xiWZQF24GrBaEpiGX1uihg=
-github.com/containerd/ttrpc v1.2.9/go.mod h1:jjtQRwXm4DL3KsHKW8vDiUOV6wO0hi6IPhmJhxU7aEs=
-github.com/containerd/typeurl/v2 v2.3.0 h1:HZHPhRWo5XMy3QGQoPrUzbW/2ckwjfweHmOwlkIrPAQ=
-github.com/containerd/typeurl/v2 v2.3.0/go.mod h1:Qk+PAdUYArVj41TnGi6rJ+48RF0PkcTc4i/taoBcK0w=
-github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 h1:Qzk5C6cYglewc+UyGf6lc8Mj2UaPTHy/iF2De0/77CA=
-github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01/go.mod h1:9rfv8iPl1ZP7aqh9YA68wnZv2NUDbXdcdPHVz0pFbPY=
-github.com/containers/ocicrypt v1.3.2 h1:MuqHSfiPpGzoAQdgDSX85FgixSgIm9mSDXTLTgugY5E=
-github.com/containers/ocicrypt v1.3.2/go.mod h1:ntBZabYG0rlvstB/1rK/ba2laaU5EHE0pD5ioHoPTq4=
+github.com/containerd/ttrpc v1.2.8 h1:xbVu6D4qF2jihdh9rDVOKqUMiFBQk6YctTdo1zk087Y=
+github.com/containerd/ttrpc v1.2.8/go.mod h1:wyZW2K79t4Hfcxl+GUvkZqRBzJlqFFvgEeeWXa42tyE=
+github.com/containerd/typeurl/v2 v2.2.3 h1:yNA/94zxWdvYACdYO8zofhrTVuQY73fFU1y++dYSw40=
+github.com/containerd/typeurl/v2 v2.2.3/go.mod h1:95ljDnPfD3bAbDJRugOiShd/DlAAsxGtUBhJxIn7SCk=
 github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
 github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/cpuguy83/go-md2man/v2 v2.0.1/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 h1:uX1JmpONuD549D73r6cgnxyUu18Zb7yHAy5AYU0Pm4Q=
-github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467/go.mod h1:uzvlm1mxhHkdfqitSA92i7Se+S9ksOn3a3qmv/kyOCw=
-github.com/cyphar/filepath-securejoin v0.7.0 h1:s0Y3ITPy6sQn5xt54DuYvTF8hu134ooYLUb58DX/HjE=
-github.com/cyphar/filepath-securejoin v0.7.0/go.mod h1:ymLGms/u3BYaviIiuKFnUx8EkQEZeK6cInNoAPJA3o4=
+github.com/cyphar/filepath-securejoin v0.6.1 h1:5CeZ1jPXEiYt3+Z6zqprSAgSWiggmpVyciv8syjIpVE=
+github.com/cyphar/filepath-securejoin v0.6.1/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc=
 github.com/dave/jennifer v1.7.1 h1:B4jJJDHelWcDhlRQxWeo0Npa/pYKBLrirAQoTN45txo=
 github.com/dave/jennifer v1.7.1/go.mod h1:nXbxhEmQfOZhWml3D1cDK5M1FLnMSozpbFN/m3RmGZc=
 github.com/davecgh/go-spew v0.0.0-20161028175848-04cdfd42973b/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -353,12 +339,10 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c=
 github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0=
-github.com/docker/cli v29.8.2+incompatible h1:2zgdFuoFst2T80oS42vhKGxkd0JRo305eIEKTsxR7pQ=
-github.com/docker/cli v29.8.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
-github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker-credential-helpers v0.9.8 h1:bIREROb7So6PRlq6KTtdS9MPEjC29OQRkFNlvK2OX8Q=
-github.com/docker/docker-credential-helpers v0.9.8/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c=
+github.com/docker/cli v29.8.0+incompatible h1:ih0c2jq/nN7QfES8zIfwSzIhRScjs4ehER+kZ60aeSk=
+github.com/docker/cli v29.8.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/docker-credential-helpers v0.9.5 h1:EFNN8DHvaiK8zVqFA2DT6BjXE0GzfLOZ38ggPTKePkY=
+github.com/docker/docker-credential-helpers v0.9.5/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c=
 github.com/docker/go-connections v0.8.1 h1:JibmG5hULs5qXSr/cp/w3Pw5fZuStt4MOHMUExb29/M=
 github.com/docker/go-connections v0.8.1/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
@@ -397,8 +381,8 @@ github.com/envoyproxy/protoc-gen-validate v1.3.3 h1:MVQghNeW+LZcmXe7SY1V36Z+WFMD
 github.com/envoyproxy/protoc-gen-validate v1.3.3/go.mod h1:TsndJ/ngyIdQRhMcVVGDDHINPLWB7C82oDArY51KfB0=
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
-github.com/erofs/go-erofs v0.3.1 h1:Sux82Jq9yvyYhIoLgSHDp741p/+370HsOj9dAh1+VVs=
-github.com/erofs/go-erofs v0.3.1/go.mod h1:XkSeN9MHszGd4+3gcEjadJLYHCQpWzJ7/8yznzMuzJs=
+github.com/erofs/go-erofs v0.3.0 h1:o/W5ABAA3sHYl97WL93dacKEfeDpJhdFf3c2snAti7I=
+github.com/erofs/go-erofs v0.3.0/go.mod h1:XkSeN9MHszGd4+3gcEjadJLYHCQpWzJ7/8yznzMuzJs=
 github.com/facebookincubator/flog v0.0.0-20190930132826-d2511d0ce33c/go.mod h1:QGzNH9ujQ2ZUr/CjDGZGWeDAVStrWNjHeEcjJL96Nuk=
 github.com/facebookincubator/nvdtools v0.1.5 h1:jbmDT1nd6+k+rlvKhnkgMokrCAzHoASWE5LtHbX2qFQ=
 github.com/facebookincubator/nvdtools v0.1.5/go.mod h1:Kh55SAWnjckS96TBSrXI99KrEKH4iB0OJby3N8GRJO4=
@@ -412,13 +396,13 @@ github.com/fatih/set v0.2.1/go.mod h1:+RKtMCH+favT2+3YecHGxcc0b4KyVWA1QWWJUs4E0C
 github.com/felixge/fgprof v0.9.3/go.mod h1:RdbpDgzqYVh/T9fPELJyV7EYJuHB55UTEULNun8eiPw=
 github.com/felixge/fgprof v0.9.5 h1:8+vR6yu2vvSKn08urWyEuxx75NWPEvybbkBirEpsbVY=
 github.com/felixge/fgprof v0.9.5/go.mod h1:yKl+ERSa++RYOs32d8K6WEXCB4uXdLls4ZaZPpayhMM=
-github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=
-github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5Ai1i3InKU=
-github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
-github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 github.com/gabriel-vasile/mimetype v1.4.15 h1:05iP/CYtZ/w455R/KZM6rZ5ieAdh99UPtd+d3YzLmaI=
 github.com/gabriel-vasile/mimetype v1.4.15/go.mod h1:azpTcoLcDZRNgFou5j+APrqQx9HqVPWa6ijYQIIVswQ=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
@@ -428,23 +412,23 @@ github.com/gkampitakis/ciinfo v0.3.4 h1:5eBSibVuSMbb/H6Elc0IIEFbkzCJi3lm94n0+U7Z
 github.com/gkampitakis/ciinfo v0.3.4/go.mod h1:1NIwaOcFChN4fa/B0hEBdAb6npDlFL8Bwx4dfRLRqAo=
 github.com/gkampitakis/go-snaps v0.5.23 h1:okh5QR48zpUjpWtu65AtqxdCY8huJq+dEDuUzd1PuKg=
 github.com/gkampitakis/go-snaps v0.5.23/go.mod h1:uy3lVzCCRRsAwYqSocyw5fY8xRLCYEfqoOJNxr8HonM=
-github.com/glebarez/go-sqlite v1.23.0 h1:FyhIq4jqmgphQAUlY79zPldYGwISEZikaDfhiGWkkaI=
-github.com/glebarez/go-sqlite v1.23.0/go.mod h1:IIYrOH3L0rHY3jb4IXOHoWdklNajSGUN2eJcvK8WrnI=
+github.com/glebarez/go-sqlite v1.20.3 h1:89BkqGOXR9oRmG58ZrzgoY/Fhy5x0M+/WV48U5zVrZ4=
+github.com/glebarez/go-sqlite v1.20.3/go.mod h1:u3N6D/wftiAzIOJtZl6BmedqxmmkDfH3q+ihjqxC9u0=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
 github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
-github.com/go-git/go-billy/v5 v5.9.2 h1:OXFSRyz4g20upsGDJgQG9Bak1l/ZEv8GHVYB52O71sE=
-github.com/go-git/go-billy/v5 v5.9.2/go.mod h1:ExsU+jcGwXTBOnyilvAnEM1wug1IxHr4yP2ZXsNRtV0=
+github.com/go-git/go-billy/v5 v5.9.1 h1:8U73XiOTfINdItHVa6z4Gv7ToObcZ6grkqQbLryLCdA=
+github.com/go-git/go-billy/v5 v5.9.1/go.mod h1:ExsU+jcGwXTBOnyilvAnEM1wug1IxHr4yP2ZXsNRtV0=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.19.3 h1:qHttbZ+Am7wEjdTpR1XMQ4rl42FK9SIXzZ4o9x7s6M4=
-github.com/go-git/go-git/v5 v5.19.3/go.mod h1:Ye4C8dVigkqrv9UsB4NMdSLV4yAIkLiIhW61gcOyhl4=
+github.com/go-git/go-git/v5 v5.19.2 h1:wkfn7vOlUBu8ivAWKBWisTiwJK4jYHzTF8Ndv1LyGqY=
+github.com/go-git/go-git/v5 v5.19.2/go.mod h1:QqCBE1EFN5ddFmrliLQ3/ntRCUjZU3EJuwuB/jWEHjk=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-jose/go-jose/v4 v4.1.5 h1:RjgjO2LOtWOJKUC5wpwY9LR3B3vwVAz6JS2YHfYU6eA=
-github.com/go-jose/go-jose/v4 v4.1.5/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
+github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
@@ -469,6 +453,7 @@ github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
 github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/gohugoio/hashstructure v0.6.0 h1:7wMB/2CfXoThFYhdWRGv3u3rUM761Cq29CxUW+NltUg=
 github.com/gohugoio/hashstructure v0.6.0/go.mod h1:lapVLk9XidheHG1IQ4ZSbyYrXcaILU1ZEP/+vno5rBQ=
@@ -522,13 +507,10 @@ github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-containerregistry v0.22.1 h1:RZuuSYhTvlDvtsK+NkutoCZ//C0X2ebLK8X8l3ULs84=
 github.com/google/go-containerregistry v0.22.1/go.mod h1:bJR35SK8XgisYmhg/FMQ/5RK0S/XrOAqLBV5/LR2XE0=
-github.com/google/go-intervals v0.0.2 h1:FGrVEiUnTRKR8yE04qzXYaJMtnIYqobR5QbblK3ixcM=
-github.com/google/go-intervals v0.0.2/go.mod h1:MkaR3LNRfeKLPmqgJYs4E66z5InYjmCjbbr4TQlcT6Y=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/licensecheck v0.3.1 h1:QoxgoDkaeC4nFrtGN1jV7IPmDCHFNIVh54e5hSt6sPs=
 github.com/google/licensecheck v0.3.1/go.mod h1:ORkR35t/JjW+emNKtfJDII0zlciG9JgbT7SmsohlHmY=
@@ -561,7 +543,6 @@ github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm4
 github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/enterprise-certificate-proxy v0.3.20 h1:t/xL64VUoN69MuMRQuJETqYGOw4Z9mSRJK9epIEtwFk=
@@ -577,10 +558,8 @@ github.com/gookit/assert v0.1.1/go.mod h1:jS5bmIVQZTIwk42uXl4lyj4iaaxx32tqH16CFj
 github.com/gookit/color v1.2.5/go.mod h1:AhIE+pS6D4Ql0SQWbBeXPHw7gY0/sjHoA4s/n1KB7xg=
 github.com/gookit/color v1.6.1 h1:KoTnDxJPRgrL0SoX0f8rCFg2zI0t4E3GZZBMo2nN8LU=
 github.com/gookit/color v1.6.1/go.mod h1:9ACFc7/1IpHGBW8RwuDm/0YEnhg3dwwXpoMsmtyHfjs=
-github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
-github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
-github.com/gpustack/gguf-parser-go v0.26.4 h1:B9CRrQBcIB7I/MJFZvzPZ+e+cbc1xBzQJcmpi9l/mKU=
-github.com/gpustack/gguf-parser-go v0.26.4/go.mod h1:y4TwTtDqFWTK+xvprOjRUh+dowgU2TKCX37vRKvGiZ0=
+github.com/gpustack/gguf-parser-go v0.26.3 h1:F63PlUPIW56HGU5k4Crv0JAG9ojtz/TuwzgMYlb82Ec=
+github.com/gpustack/gguf-parser-go v0.26.3/go.mod h1:y4TwTtDqFWTK+xvprOjRUh+dowgU2TKCX37vRKvGiZ0=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
 github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.74 h1:mymLUKThnV9wFvogOK8NnsMP9/vlhnjXY98gr2QIGW8=
 github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.74/go.mod h1:Bh9qYL8ehmDxSg14Tk8oxFCP90XHfs6NxV1D84884xA=
@@ -666,9 +645,11 @@ github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
-github.com/klauspost/compress v1.20.1 h1:T7kKElXUMXrUJ2E9QhQhxFtcK5rPyLdsGZvdbLMPdiQ=
-github.com/klauspost/compress v1.20.1/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
+github.com/klauspost/compress v1.20.0 h1:a3C1ke2ohxFymNlb2HWAHjDeKCI90scRskErZkR0ezA=
+github.com/klauspost/compress v1.20.0/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
+github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
+github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
 github.com/klauspost/pgzip v1.2.6/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
@@ -711,10 +692,8 @@ github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsRe
 github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75 h1:P8UmIzZMYDR+NGImiFvErt6VWfIRPuGM+vyjiEdkmIw=
 github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
-github.com/mattn/go-runewidth v0.0.27 h1:Feg/Oou5zI/wnpgDF6omIU0OokC9GxLC/WRknhVlIR0=
-github.com/mattn/go-runewidth v0.0.27/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8=
-github.com/mattn/go-sqlite3 v1.14.48 h1:7XHIgl0a8HwOaiK4E47ozLkST78rR9+OtNGx27D/TFs=
-github.com/mattn/go-sqlite3 v1.14.48/go.mod h1:6JTjA44L93a0QCyJef5YvlPoKXntQPjzWv5gtm9sB6w=
+github.com/mattn/go-runewidth v0.0.21 h1:jJKAZiQH+2mIinzCJIaIG9Be1+0NR+5sz/lYEEjdM8w=
+github.com/mattn/go-runewidth v0.0.21/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
@@ -723,14 +702,10 @@ github.com/mholt/archives v0.1.5/go.mod h1:3TPMmBLPsgszL+1As5zECTuKwKvIfj6YcwWPp
 github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
 github.com/miekg/dns v1.1.26/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
 github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
-github.com/miekg/pkcs11 v1.1.2 h1:/VxmeAX5qU6Q3EwafypogwWbYryHFmF2RpkJmw3m4MQ=
-github.com/miekg/pkcs11 v1.1.2/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
 github.com/mikelolasagasti/xz v1.0.1 h1:Q2F2jX0RYJUG3+WsM+FJknv+6eVjsjXNDV0KJXZzkD0=
 github.com/mikelolasagasti/xz v1.0.1/go.mod h1:muAirjiOUxPRXwm9HdDtB3uoRPrGnL85XHtokL9Hcgc=
 github.com/minio/minlz v1.0.1 h1:OUZUzXcib8diiX+JYxyRLIdomyZYzHct6EShOKtQY2A=
 github.com/minio/minlz v1.0.1/go.mod h1:qT0aEB35q79LLornSzeDH75LBf3aH1MV+jB5w9Wasec=
-github.com/mistifyio/go-zfs/v4 v4.0.0 h1:sU0+5dX45tdDK5xNZ3HBi95nxUc48FS92qbIZEvpAg4=
-github.com/mistifyio/go-zfs/v4 v4.0.0/go.mod h1:weotFtXTHvBwhr9Mv96KYnDkTPBOHFUbm9cBmQpesL0=
 github.com/mitchellh/cli v1.1.0/go.mod h1:xcISNoH86gajksDmfB23e/pu+B+GeFRMYmoHXxx3xhI=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
@@ -752,16 +727,16 @@ github.com/moby/moby/api v1.56.0 h1:GQzua3NA599ASSIICx0iFgiJeO9YkdDARvQsm23ZZuQ=
 github.com/moby/moby/api v1.56.0/go.mod h1:sZ+THbVWkjOmBPPfbnzdD/G1LuIexWhqlSHHPTDQ1Uk=
 github.com/moby/moby/client v0.6.0 h1:AJjEB21QPbXSXjDsZorFBoDZPhMrfbpaPLgSMAW9Bgs=
 github.com/moby/moby/client v0.6.0/go.mod h1:OCo00wNRyA3m4lmJ228W3JbyCN4ZNNYjpOXiJydBdcQ=
-github.com/moby/sys/capability v0.4.0 h1:4D4mI6KlNtWMCM1Z/K0i7RV1FkX+DBDHKVJpCndZoHk=
-github.com/moby/sys/capability v0.4.0/go.mod h1:4g9IK291rVkms3LKCDOoYlnV8xKwoDTpIrNEE35Wq0I=
 github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
 github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
+github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
+github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
 github.com/moby/sys/signal v0.7.1 h1:PrQxdvxcGijdo6UXXo/lU/TvHUWyPhj7UOpSo8tuvk0=
 github.com/moby/sys/signal v0.7.1/go.mod h1:Se1VGehYokAkrSQwL4tDzHvETwUZlnY7S5XtQ50mQp8=
-github.com/moby/sys/user v0.4.1 h1:RgjRlaDKi/Xmyrz4t8lyzXT6v2ooFeO/7xtchmhVWE0=
-github.com/moby/sys/user v0.4.1/go.mod h1:E9QsW5WRe1kUAf7kW8hXKwu1uhsZEAdPLYHYSDudF4Y=
-github.com/moby/sys/userns v0.2.1 h1:4OvdM7BcPkASbuouHsbW3aeMJSFlYDldBRnXVZhaRk8=
-github.com/moby/sys/userns v0.2.1/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
+github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
+github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
+github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -783,8 +758,8 @@ github.com/nix-community/go-nix v0.0.0-20250101154619-4bdde671e0a1 h1:kpt9ZfKcm+
 github.com/nix-community/go-nix v0.0.0-20250101154619-4bdde671e0a1/go.mod h1:qgCw4bBKZX8qMgGeEZzGFVT3notl42dBjNqO2jut0M0=
 github.com/nsf/jsondiff v0.0.0-20210926074059-1e845ec5d249 h1:NHrXEjTNQY7P0Zfx1aMrNhpgxHmow66XQtm0aQLY0AE=
 github.com/nsf/jsondiff v0.0.0-20210926074059-1e845ec5d249/go.mod h1:mpRZBD8SJ55OIICQ3iWH0Yz3cjzA61JdqMLoWXeB2+8=
-github.com/nwaples/rardecode/v2 v2.4.1 h1:F7zNW2LdAuuBThHWXQaiFUGVD/sef299NfWSB1nHAl4=
-github.com/nwaples/rardecode/v2 v2.4.1/go.mod h1:7uz379lSxPe6j9nvzxUZ+n7mnJNgjsRNb6IbvGVHRmw=
+github.com/nwaples/rardecode/v2 v2.2.0 h1:4ufPGHiNe1rYJxYfehALLjup4Ls3ck42CWwjKiOqu0A=
+github.com/nwaples/rardecode/v2 v2.2.0/go.mod h1:7uz379lSxPe6j9nvzxUZ+n7mnJNgjsRNb6IbvGVHRmw=
 github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 h1:zrbMGy9YXpIeTnGj4EljqMiZsIcE09mmF8XsD5AYOJc=
 github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6/go.mod h1:rEKTHC9roVVicUIfZK7DYrdIoM0EOr8mK1Hj5s3JjH0=
 github.com/olekukonko/errors v1.2.0 h1:10Zcn4GeV59t/EGqJc8fUjtFT/FuUh5bTMzZ1XwmCRo=
@@ -801,15 +776,11 @@ github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJw
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
 github.com/opencontainers/runtime-spec v1.3.0 h1:YZupQUdctfhpZy3TM39nN9Ika5CBWT5diQ8ibYCRkxg=
 github.com/opencontainers/runtime-spec v1.3.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/selinux v1.15.1 h1:ERxeh5caJvCzNAKdI8WQbJmB1LDTn4BuaAg8wihLBpA=
-github.com/opencontainers/selinux v1.15.1/go.mod h1:LenyElirjUHszfxrjuFqC85HIeXZKumHcKMQtnaDlQQ=
 github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde/go.mod h1:nZgzbfBr3hhjoZnS66nKrHmduYNpc34ny7RK4z5/HM0=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
-github.com/pb33f/go-yaml v0.1.0 h1:zZ6Gg+ATbumXlXZNLMHIe7+zTkVqe20lx+TSYRrXEuY=
-github.com/pb33f/go-yaml v0.1.0/go.mod h1:QvWdkHP5VjFYAeHMQUkaPQqREaQnBNOXmWzAjNrnSdo=
-github.com/pb33f/ordered-map/v2 v2.3.2 h1:wDyaZ2Pv9QLh64X4utCeD5Zoi9nIv2aW3lwv172O5PQ=
-github.com/pb33f/ordered-map/v2 v2.3.2/go.mod h1:1OhFrXu3OYw3kM+FXF+Ug3ugmmZ9LE8z0JfQMLvtV0w=
+github.com/pb33f/ordered-map/v2 v2.3.1 h1:5319HDO0aw4DA4gzi+zv4FXU9UlSs3xGZ40wcP1nBjY=
+github.com/pb33f/ordered-map/v2 v2.3.1/go.mod h1:qxFQgd0PkVUtOMCkTapqotNgzRhMPL7VvaHKbd1HnmQ=
 github.com/pborman/indent v1.2.1 h1:lFiviAbISHv3Rf0jcuh489bi06hj98JsVMtIDZQb9yM=
 github.com/pborman/indent v1.2.1/go.mod h1:FitS+t35kIYtB5xWTZAPhnmrxcciEEOdbyrrpz5K6Vw=
 github.com/pelletier/go-toml v1.9.4/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
@@ -821,8 +792,8 @@ github.com/pierrec/lz4/v4 v4.1.26 h1:GrpZw1gZttORinvzBdXPUXATeqlJjqUG/D87TKMnhjY
 github.com/pierrec/lz4/v4 v4.1.26/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=
 github.com/piprate/json-gold v0.7.0 h1:bEMirgA5y8Z2loTQfxyIFfY+EflxH1CTP6r/KIlcJNw=
 github.com/piprate/json-gold v0.7.0/go.mod h1:RVhE35veDX19r5gfUAR+IYHkAUuPwJO8Ie/qVeFaIzw=
-github.com/pjbgf/sha1cd v0.7.0 h1:ZRNPKHj+gfkLBf0KJv/p1Hmz+7bqCT5o311YX0nq+DA=
-github.com/pjbgf/sha1cd v0.7.0/go.mod h1:pKR5Li+qTCo+ebqITZfwPlJGoCFCvSO00qxjbNtTUFQ=
+github.com/pjbgf/sha1cd v0.6.0 h1:3WJ8Wz8gvDz29quX1OcEmkAlUg9diU4GxJHqs0/XiwU=
+github.com/pjbgf/sha1cd v0.6.0/go.mod h1:lhpGlyHLpQZoxMv8HcgXvZEhcGs0PG/vsZnEJ7H0iCM=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -843,8 +814,6 @@ github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndr
 github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s=
 github.com/pquerna/cachecontrol v0.0.0-20180517163645-1555304b9b35 h1:J9b7z+QKAmPf4YLrFg6oQUotqHQeUNWwkvo7jZp1GLU=
 github.com/pquerna/cachecontrol v0.0.0-20180517163645-1555304b9b35/go.mod h1:prYjPmNq4d1NPVmpShWobRqXY3q7Vp+80DqgxxUrUIA=
-github.com/proglottis/gpgme v0.1.6 h1:8WpQ8VWggLdxkuTnW+sZ1r1t92XBNd8GZNDhQ4Rz+98=
-github.com/proglottis/gpgme v0.1.6/go.mod h1:5LoXMgpE4bttgwwdv9bLs/vwqv3qV7F4glEEZ7mRKrM=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.4.0/go.mod h1:e9GMxYsXl05ICDXkRhurwBS4Q3OK1iX/F2sw+iXX5zU=
@@ -857,8 +826,8 @@ github.com/prometheus/common v0.9.1/go.mod h1:yhUN8i9wzaXS3w1O07YhxHEBxD+W35wd8b
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A=
-github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
-github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
+github.com/prometheus/procfs v0.19.2 h1:zUMhqEW66Ex7OXIiDkll3tl9a1ZdilUOd/F6ZXw4Vws=
+github.com/prometheus/procfs v0.19.2/go.mod h1:M0aotyiemPhBCM0z5w87kL22CxfcH05ZpYlu+b4J7mw=
 github.com/quasilyte/go-ruleguard/dsl v0.3.23 h1:lxjt5B6ZCiBeeNO8/oQsegE6fLeCzuMRoVWSkXC4uvY=
 github.com/quasilyte/go-ruleguard/dsl v0.3.23/go.mod h1:KeCP03KrjuSO0H1kTuZQCWlQPulDV6YMIXmpQss17rU=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
@@ -884,8 +853,6 @@ github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d h1:hrujxIzL1woJ7
 github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d/go.mod h1:uugorj2VCxiV1x+LzaIdVa9b4S4qGAcH6cbhh4qVxOU=
 github.com/sanity-io/litter v1.5.8 h1:uM/2lKrWdGbRXDrIq08Lh9XtVYoeGtcQxk9rtQ7+rYg=
 github.com/sanity-io/litter v1.5.8/go.mod h1:9gzJgR2i4ZpjZHsKvUXIRQVk7P+yM3e+jAF7bU2UI5U=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/sassoftware/go-rpmutils v0.4.0 h1:ojND82NYBxgwrV+mX1CWsd5QJvvEZTKddtCdFLPWhpg=
 github.com/sassoftware/go-rpmutils v0.4.0/go.mod h1:3goNWi7PGAT3/dlql2lv3+MSN5jNYPjT5mVcQcIsYzI=
 github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e h1:7q6NSFZDeGfvvtIRwBrU/aegEYJYmvev0cHAwo17zZQ=
@@ -893,31 +860,21 @@ github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e/go.mod h1:DkpGd7
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
 github.com/sebdah/goldie/v2 v2.8.0 h1:dZb9wR8q5++oplmEiJT+U/5KyotVD+HNGCAc5gNr8rc=
 github.com/sebdah/goldie/v2 v2.8.0/go.mod h1:oZ9fp0+se1eapSRjfYbsV/0Hqhbuu3bJVvKI/NNtssI=
-github.com/secure-systems-lab/go-securesystemslib v0.11.1 h1:ayahDPjfSIqKegyt5YVGEvQ7SAi72GHXTy+b2YjUd5w=
-github.com/secure-systems-lab/go-securesystemslib v0.11.1/go.mod h1:UyOjhoZLi76ir63u1ptubEevVe6dlNPmNxwgVvKqFFY=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
 github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
 github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
-github.com/sigstore/fulcio v1.8.7 h1:d7QJQxukgXarqPCT9uDNeyzt1Bbt/biw58/VfOnwI/o=
-github.com/sigstore/fulcio v1.8.7/go.mod h1:7fX+QyigZxRGKTgHvTfOfxwwniCDxK02PVloHy5/vg4=
-github.com/sigstore/protobuf-specs v0.5.2 h1:RSWWUY8QrVTxbYH00jY/jg2e7YnjzrpwP+PeHTMll0E=
-github.com/sigstore/protobuf-specs v0.5.2/go.mod h1:DRBzpFuE+LnvQMN10/dU6nBeKwVLGEQ6o2FovN2Rats=
-github.com/sigstore/sigstore v1.10.11 h1:fjrwDfR0AWmRONYV/hKGJyqbT0osMtaBz9FTZ6MH9XI=
-github.com/sigstore/sigstore v1.10.11/go.mod h1:ecPk+ftLqP8/TmzQFJmn0+QrL2yUQIJvyzVKNmDiw6U=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.10.2 h1:G2SED73/qrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=
-github.com/sirupsen/logrus v1.10.2/go.mod h1:SLEg8TqYulVKKfIGHldVp2K2aYz2DKSVBq4g/H5bR7Q=
+github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
+github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
 github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8=
 github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
 github.com/smallnest/ringbuffer v0.0.0-20241116012123-461381446e3d h1:3VwvTjiRPA7cqtgOWddEL+JrcijMlXUmj99c/6YyZoY=
 github.com/smallnest/ringbuffer v0.0.0-20241116012123-461381446e3d/go.mod h1:tAG61zBM1DYRaGIPloumExGvScf08oHuo0kFoOqdbT0=
-github.com/smallstep/pkcs7 v0.2.1 h1:6Kfzr/QizdIuB6LSv8y1LJdZ3aPSfTNhTLqAx9CTLfA=
-github.com/smallstep/pkcs7 v0.2.1/go.mod h1:RcXHsMfL+BzH8tRhmrF1NkkpebKpq3JEM66cOFxanf0=
 github.com/sorairolake/lzip-go v0.3.8 h1:j5Q2313INdTA80ureWYRhX+1K78mUXfMoPZCw/ivWik=
 github.com/sorairolake/lzip-go v0.3.8/go.mod h1:JcBqGMV0frlxwrsE9sMWXDjqn3EeVf0/54YPsw66qkU=
 github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 h1:+jumHNA0Wrelhe64i8F6HNlS8pkoyMv5sreGx2Ry5Rw=
@@ -947,8 +904,6 @@ github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
 github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=
 github.com/spiffe/go-spiffe/v2 v2.7.0 h1:uXe1MflJoHw58wAUvxVlcM7WpKtijWG7I1UidcGh6g4=
 github.com/spiffe/go-spiffe/v2 v2.7.0/go.mod h1:47Q0Q9/AqGha8QLHp+kxpH4Wca7X7EnOtlIJy3mxZ3U=
-github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 h1:pnnLyeX7o/5aX8qUQ69P/mLojDqwda8hFOCBTmP/6hw=
-github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6/go.mod h1:39R/xuhNgVhi+K0/zst4TLrJrVmbm6LVgl4A0+ZFS5M=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
@@ -970,14 +925,12 @@ github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUm
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
-github.com/sylabs/sif/v2 v2.24.2 h1:rdkFf6z3xLC6yKweU7S9marlKfkS91Ht0ruIri6YWFY=
-github.com/sylabs/sif/v2 v2.24.2/go.mod h1:bbrkk0JhTX+xNJcnUtmDkivoO2r4DGWM3LxNR0U2ooA=
+github.com/sylabs/sif/v2 v2.24.1 h1:OhTOfTwBaGXfbWYWXK9C6Pojma3A1bTaNJ6CEhyuKok=
+github.com/sylabs/sif/v2 v2.24.1/go.mod h1:PRq9MoP0g+p0qE5ZRGrOhyVAUdHrPsAVmXHgoiW6VU0=
 github.com/sylabs/squashfs v1.0.6 h1:PvJcDzxr+vIm2kH56mEMbaOzvGu79gK7P7IX+R7BDZI=
 github.com/sylabs/squashfs v1.0.6/go.mod h1:DlDeUawVXLWAsSRa085Eo0ZenGzAB32JdAUFaB0LZfE=
 github.com/tailscale/hujson v0.0.0-20260302212456-ecc657c15afd h1:Rf9uhF1+VJ7ZHqxrG8pJ6YacmHvVCmByDmGbAWCc/gA=
 github.com/tailscale/hujson v0.0.0-20260302212456-ecc657c15afd/go.mod h1:EbW0wDK/qEUYI0A5bqq0C2kF8JTQwWONmGDBbzsxxHo=
-github.com/tchap/go-patricia/v2 v2.3.3 h1:xfNEsODumaEcCcY3gI0hYPZ/PcpVv5ju6RMAhgwZDDc=
-github.com/tchap/go-patricia/v2 v2.3.3/go.mod h1:VZRHKAb53DLaG+nA9EaYYiaEx6YztwDlLElMsnSHD4k=
 github.com/terminalstatic/go-xsd-validate v0.1.8 h1:UVrTCy1j3DhwaYTTUF+QYO/Nan13S0tf+Jwi+p45Bf0=
 github.com/terminalstatic/go-xsd-validate v0.1.8/go.mod h1:1kb47fi2c6onlf+B7UrrQ9VYraOhcYwFm3iG+J6F4Zo=
 github.com/therootcompany/xz v1.0.1 h1:CmOtsn1CbtmyYiusbfmhmkpAAETj0wBIH6kCYaX+xzw=
@@ -994,16 +947,10 @@ github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
 github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
 github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=
 github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
-github.com/ulikunitz/xz v0.5.17 h1:flR0y/x1hgM8EGV1AW3Xll6T413G0glV8UfBwR617V4=
-github.com/ulikunitz/xz v0.5.17/go.mod h1:H9Rt/W6/Qj27PGauhQc6nfCDy7vHpzsOThBSaYDoEhw=
+github.com/ulikunitz/xz v0.5.16 h1:ld6NyySjx5lowVKwJvMRLnW5nxKX/xnpSiFYZ/Lxur0=
+github.com/ulikunitz/xz v0.5.16/go.mod h1:H9Rt/W6/Qj27PGauhQc6nfCDy7vHpzsOThBSaYDoEhw=
 github.com/vbatts/go-mtree v0.7.0 h1:ytmOc3MTRidZiBi9VBCyZ2BHe4fZS47L5v7BVXDWW4E=
 github.com/vbatts/go-mtree v0.7.0/go.mod h1:EjdpFC+LZy1TXbRGNa1MKKgjQ+7ew3foMFJK8o4/TdY=
-github.com/vbatts/tar-split v0.12.3 h1:Cd46rkGXI3Td4yrVNwU8ripbxFaQbmesqhjBUUYAJSw=
-github.com/vbatts/tar-split v0.12.3/go.mod h1:sQOc6OlqGCr7HkGx/IDBeKiTIvqhmj8KffNhEXG4Nq0=
-github.com/vbauerster/cupwriter v0.0.4 h1:9sBPe0uXWLZuWQU5lqVbhyFlxX6c09asST/YfatFAys=
-github.com/vbauerster/cupwriter v0.0.4/go.mod h1:IFyzS6Xis5dnBH/rdAhrnuzg3c+KkUqEN6yE8lhJlDw=
-github.com/vbauerster/mpb/v8 v8.14.0 h1:55SR80dptMfASxIG/oCEkBXgBhxeSu4GrVsjl16oKmA=
-github.com/vbauerster/mpb/v8 v8.14.0/go.mod h1:HgpQPKfcWe3kbuGGPmi+jatHreMase5C3Fp5dpdAy0Q=
 github.com/vifraa/gopom v1.0.0 h1:L9XlKbyvid8PAIK8nr0lihMApJQg/12OBvMA28BcWh0=
 github.com/vifraa/gopom v1.0.0/go.mod h1:oPa1dcrGrtlO37WPDBm5SqHAT+wTgF8An1Q71Z6Vv4o=
 github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651 h1:jIVmlAFIqV3d+DOxazTR9v+zgj8+VYuQBzPgBZvWBHA=
@@ -1025,8 +972,6 @@ github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavM
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
 github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
-github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 h1:ilQV1hzziu+LLM3zUTJ0trRztfwgjqKnBWNtSRkbmwM=
-github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78/go.mod h1:aL8wCCfTfSfmXjznFBSZNN13rSJjlIOI1fUNAtF7rmI=
 github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -1049,33 +994,31 @@ go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
 go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
+go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
+go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/contrib/detectors/gcp v1.44.0 h1:NmLfL734pJhM0JKaYd2Y28+nY9dPRWYAAbxhRCrKXPw=
 go.opentelemetry.io/contrib/detectors/gcp v1.44.0/go.mod h1:tNAsgd8avTGke1+MndXlU5Cru4PQ9Ai/cCNWQv/ZJ/s=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.71.0 h1:B2h3uqicet1CT2N5TOFhS+Gq++9i0/CLmaxvhmhtP5s=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.71.0/go.mod h1:dylvB+ZiiwMvsDij9O84Uy7SijLgHMX4mbkncds+4Sw=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 h1:3g7B90UzBltIDKq1/5mrTGxTnOFDV0ICOhLoxiZ8jlg=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0/go.mod h1:Ef8SuTh59BT7+ofpDxN9z+yOlc4t2GjLmKDgYNJL/NU=
-go.opentelemetry.io/otel v1.46.0 h1:FHt5/CDyVxi/8IM1CH7VE/rRgq3kLHa2mSTVMO8AWyc=
-go.opentelemetry.io/otel v1.46.0/go.mod h1:Gj3SEScelsNC45tp4nSxRYlS+f5iez7W8XPMCt905kE=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 h1:0Qx7VGBacMm9ZENQ7TnNObTYI4ShC+lHI16seduaxZo=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0/go.mod h1:Sje3i3MjSPKTSPvVWCaL8ugBzJwik3u4smCjUeuupqg=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 h1:CqXxU8VOmDefoh0+ztfGaymYbhdB/tT3zs79QaZTNGY=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0/go.mod h1:BuhAPThV8PBHBvg8ZzZ/Ok3idOdhWIodywz2xEcRbJo=
+go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=
+go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=
 go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.44.0 h1:hqxVTu/GtBF+vJ8d1fzW7fRxZFvgoDjWcxwwCaFDYpU=
 go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.44.0/go.mod h1:z5fVEF4X5v0ESvlJqBrrFlBVoj5EQuefZpzsu7R+x5Q=
-go.opentelemetry.io/otel/metric v1.46.0 h1:yBnkXvgV7AXFILZc5K6IZe/CBFF3OS7BJ8ov6/lj0K8=
-go.opentelemetry.io/otel/metric v1.46.0/go.mod h1:iPmdWqifKUdzziPkvvzIJXITl56fQx2mGM/DHLB3/2o=
-go.opentelemetry.io/otel/metric/x v0.68.0 h1:TA/cBT23D3MnxYPwHL7YFOdYGdx0A0v+s7Mzotpd1dU=
-go.opentelemetry.io/otel/metric/x v0.68.0/go.mod h1:agudOmvWhwUTjgibWDzxD2PoWYnpw5Ht5jISYOD2Hd4=
-go.opentelemetry.io/otel/sdk v1.46.0 h1:h5CNQQjEbuQXY/JfZtgt3i7HVFV3aHPO2OAwO2eTYPI=
-go.opentelemetry.io/otel/sdk v1.46.0/go.mod h1:GAERFXFt5SYCEB+YiKUbMBeza6UaDH7GmGOZEfh2gSM=
-go.opentelemetry.io/otel/sdk/metric v1.46.0 h1:0piZ26EG4RBfebb2jhDH6ERCYHoVWduc3kLgPCwSnSE=
-go.opentelemetry.io/otel/sdk/metric v1.46.0/go.mod h1:I1PbKrdVc8Qu8HYVDNtqVIwLwjNrhsV/uFuxfwg8mO4=
-go.opentelemetry.io/otel/trace v1.46.0 h1:OULy7ccdJnZtJ0UDYFOIGaCmiWzJ8Vi2G/Rsu60qs1c=
-go.opentelemetry.io/otel/trace v1.46.0/go.mod h1:J7GAXweO77XSFkB/rmAqk9D6ihszhFjLU+d9WuUxDLI=
+go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=
+go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=
+go.opentelemetry.io/otel/metric/x v0.67.0 h1:PcicCNZFkZ4bXfSooXdo3WN7RBOVOtjVdo1wD358Uns=
+go.opentelemetry.io/otel/metric/x v0.67.0/go.mod h1:FBjCWZe6wgcqxcMtjdGiClDKXb2YxxXii0CXftE4QtI=
+go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw=
+go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA=
+go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o=
+go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA=
+go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=
+go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.podman.io/image/v5 v5.41.2 h1:YnVaFrGLPWSBmipKfNvlOsGcBtk5bUxlPxQ+A6CS/uo=
-go.podman.io/image/v5 v5.41.2/go.mod h1:T/bzxEFpdpAzyHabPmcq5K+my3wBsht22sFkFjJSKT4=
-go.podman.io/storage v1.64.1 h1:DqbG8scW/bD3xHiSRzV7O5fzn46qVC+SwmUN6C6Fr5w=
-go.podman.io/storage v1.64.1/go.mod h1:ft0DzCRMZs1yn0rszmLYXEEwgd7IIc66JRwSRPUDwwc=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
@@ -1084,6 +1027,8 @@ go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+go.yaml.in/yaml/v4 v4.0.0-rc.2 h1:/FrI8D64VSr4HtGIlUtlFMGsm7H7pWTbj6vOLVZcA6s=
+go.yaml.in/yaml/v4 v4.0.0-rc.2/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
 go4.org v0.0.0-20230225012048-214862532bf5 h1:nifaUDeh+rPaBCMPMQHZmvJf+QdpLFnuQPwx+LxVmtc=
 go4.org v0.0.0-20230225012048-214862532bf5/go.mod h1:F57wTi5Lrj6WLyswp5EYV1ncrEbFGHD4hhz6S1ZYeaU=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
@@ -1098,10 +1043,6 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
-golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
-golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
-golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M=
 golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
 golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -1143,10 +1084,6 @@ golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
 golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1192,12 +1129,7 @@ golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
-golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
-golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
 golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -1231,11 +1163,6 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
-golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
 golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1312,22 +1239,11 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
 golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
-golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
-golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
-golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
-golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
 golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
 golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1340,11 +1256,6 @@ golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
 golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
 golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1407,11 +1318,8 @@ golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI=
-golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA=
+golang.org/x/tools v0.50.0 h1:c2ifzfcuY7L90lZ2aKd8S4K2NpASF08SZx9ZuJkHmSU=
+golang.org/x/tools v0.50.0/go.mod h1:7ulVMw3831Mwi5EZD6RomGyffr4VFjuNYXf2BbCEAV0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1526,10 +1434,10 @@ google.golang.org/genproto v0.0.0-20211206160659-862468c7d6e0/go.mod h1:5CzLGKJ6
 google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d h1:C9v1o0/4quuhOAfmRXA2j+we0PqZIp8traLdeogF3Ms=
 google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d/go.mod h1:Wz2wFJntZFmLGo7pLDXZ3wYk5hyc0Mb+SkHhDDXT+lU=
-google.golang.org/genproto/googleapis/api v0.0.0-20260825221802-da73d73af1c5 h1:izFU9hz7aeLI/Mi1J0991ae+xcwRLr7hTqWnB/9aIIU=
-google.golang.org/genproto/googleapis/api v0.0.0-20260825221802-da73d73af1c5/go.mod h1:3LhxRw4YYkf+ylAfgaY9JlVLFKhokkCV8duhLLe7+t0=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5 h1:1VUiZAXyC+zmiFYi+WLtBzr68Cj8wOofHjjrA/kkizc=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA=
+google.golang.org/genproto/googleapis/api v0.0.0-20260715232425-e75dac1f907d h1:QwnJwPte4XXAkhPu26LTDIahnsMSUV0kK8HkxbC+Pc4=
+google.golang.org/genproto/googleapis/api v0.0.0-20260715232425-e75dac1f907d/go.mod h1:WRrQ7/7N19PypuT0fxLOL5Lq0waoiRri4FbtHDEKrGE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 h1:cYNAzI2sUwhmCcoj9TxvihSrqsxt6uIkj3rDRhSDmW4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -1608,10 +1516,10 @@ honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 howett.net/plist v1.0.1 h1:37GdZ8tP09Q35o9ych3ehygcsL+HqKSwzctveSlarvM=
 howett.net/plist v1.0.1/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
-modernc.org/cc/v4 v4.29.7 h1:q+NXGJ0bK3b4TXFYQQVr9pYETGnmwFWkrUzJnMya/Tg=
-modernc.org/cc/v4 v4.29.7/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
-modernc.org/ccgo/v4 v4.36.1 h1:ZNIUZAryN0UgnJwtyxrdEzcFc3yD4Cu4AzjfPXsLsIE=
-modernc.org/ccgo/v4 v4.36.1/go.mod h1:rrtGc2QkS239nYb/mQNuBMyjq3/y3ZXWbBjPoV3wqzA=
+modernc.org/cc/v4 v4.29.2 h1:h6+9ciCnPKutf4I03CvheAvDLX7+IHlqR6Iy6J+cgd8=
+modernc.org/cc/v4 v4.29.2/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
+modernc.org/ccgo/v4 v4.35.0 h1:F+TUsmw09QxLzmi3aeYYGxjAXarmZaKgj3mKQHNaA8w=
+modernc.org/ccgo/v4 v4.35.0/go.mod h1:qrVGs9S3Sr2Ztcg9ve+kTAYMp5a3YvWjo+SoN06kJ5I=
 modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
 modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
@@ -1620,8 +1528,8 @@ modernc.org/gc/v3 v3.1.5 h1:21ldfPfRYE31Tb7B3mwAK8gy1AxP4+dKjrOQPfqakoc=
 modernc.org/gc/v3 v3.1.5/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.77.1 h1:Ct8j47QtiZ1Enj2DtFXQtUqrPCAjdCmPjtCuvrYQ0Hs=
-modernc.org/libc v1.77.1/go.mod h1:87/pZ4L6nD1zqW4nItuS12YO7hN1igAah34xjnQo/W0=
+modernc.org/libc v1.75.7 h1:o3DTP9/0p9pKmY2WCKQaySW6wIiZhNM7wc2lUoyhfew=
+modernc.org/libc v1.75.7/go.mod h1:bO5o2ztHxBb2rjz0PgdHN0sSMw57CgxGFLZ3Qd/QpVQ=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
 modernc.org/memory v1.12.1 h1:nFMiWrpStgZczNl6XI9GnIk/rWhYIyHGUaR04pGbp9g=
@@ -1630,8 +1538,8 @@ modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
 modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.60.1 h1:/blz53O951KWFOso4QQvEs/Fq6cDBKLtMVrYNSeJVKw=
-modernc.org/sqlite v1.60.1/go.mod h1:1dIoEagfDE72QytD5scH1lxARtaUgKgHC/NuApA27r0=
+modernc.org/sqlite v1.59.0 h1:X1es1GpqBlS/5T+vbM4HLUdaa8OtQx468DF2vrx+38A=
+modernc.org/sqlite v1.59.0/go.mod h1:+paeT2A3iPRHkQDwG7oA6Tk0zQd5woMEI8q7orfry8k=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=

install.sh

@@ -8,6 +8,7 @@ REPO="${PROJECT_NAME}"
 GITHUB_DOWNLOAD_PREFIX=https://github.com/${OWNER}/${REPO}/releases/download
 INSTALL_SH_BASE_URL=https://get.anchore.io/${PROJECT_NAME}
 LEGACY_INSTALL_SH_BASE_URL=https://raw.githubusercontent.com/${OWNER}/${PROJECT_NAME}
+PROGRAM_ARGS=$@
 
 # signature verification options
 
@@ -18,8 +19,6 @@ VERIFY_SIGN=false
 VERIFY_SIGN_SUPPORTED_VERSION=v0.104.0
 # this is the earliest tag in the repo where the -v flag was introduced to this install.sh script
 VERIFY_SIGN_FLAG_VERSION=v1.6.0
-# releases at or after this version are signed with a sigstore bundle (.sigstore.json); earlier releases ship a separate .sig and .pem
-VERIFY_SIGN_BUNDLE_VERSION=v1.53.0
 
 # do not change the name of this parameter (this must always be backwards compatible)
 DOWNLOAD_TAG_INSTALL_SCRIPT=${DOWNLOAD_TAG_INSTALL_SCRIPT:-true}
@@ -387,8 +386,8 @@ download_github_release_checksums_files() (
   complete_url=$(github_release_asset_url "${download_url}" "${name}" "${version}" "${filename}")
   output_path="${output_dir}/${complete_filename}"
 
-  http_download "${output_path}" "${complete_url}" "" || return 1
-  asset_file_exists "${output_path}" || return 1
+  http_download "${output_path}" "${complete_url}" ""
+  asset_file_exists "${output_path}"
 
   log_trace "download_github_release_checksums_files() returned '${output_path}' for file '${complete_filename}'"
 
@@ -586,31 +585,28 @@ download_and_install_asset() (
   install_asset "${asset_filepath}" "${install_path}" "${binary}"
 )
 
-# verify_sign [checksums-file-path] [verification-material-flags...]
+# verify_sign [checksums-file-path] [certificate-reference] [signature-reference] [version]
 #
 # attempts verify the signature of the checksums file from the release workflow in Github Actions run against the main branch.
-# the verification material is either "--bundle <path>" or (for older releases) "--certificate <ref> --signature <ref>".
 #
 verify_sign() {
   checksums_file=$1
-  shift
+  cert_reference=$2
+  sig_reference=$3
 
-  log_trace "verifying artifact ${checksums_file}"
+  log_trace "verifying artifact $1"
 
   log_file=$(mktemp)
 
   ${COSIGN_BINARY} \
     verify-blob "$checksums_file" \
-      "$@" \
+      --certificate "$cert_reference" \
+      --signature "$sig_reference" \
       --certificate-identity "https://github.com/${OWNER}/${REPO}/.github/workflows/release.yaml@refs/heads/main" \
       --certificate-oidc-issuer "https://token.actions.githubusercontent.com" > "${log_file}" 2>&1
 
   if [ $? -ne 0 ]; then
     log_err "$(cat "${log_file}")"
-    # cosign older than v2.4.2 can't read the bundle's verification material and reports a missing cert
-    if [ "$1" = "--bundle" ] && grep -q "bundle does not contain cert" "${log_file}"; then
-      log_err "note: releases >= ${VERIFY_SIGN_BUNDLE_VERSION} are verified with a sigstore bundle, which requires cosign v2.5.0 or newer (check '${COSIGN_BINARY} version')"
-    fi
     rm -f "${log_file}"
     return 1
   fi
@@ -634,10 +630,7 @@ download_asset() (
 
   log_trace "download_asset(url=${download_url}, destination=${destination}, name=${name}, os=${os}, arch=${arch}, version=${version}, format=${format})"
 
-  if ! checksums_filepath=$(download_github_release_checksums "${download_url}" "${name}" "${version}" "${destination}"); then
-    log_err "unable to download checksums file"
-    return 1
-  fi
+  checksums_filepath=$(download_github_release_checksums "${download_url}" "${name}" "${version}" "${destination}")
 
   log_trace "checksums content:\n$(cat ${checksums_filepath})"
 
@@ -649,25 +642,13 @@ download_asset() (
   fi
 
   if [ "$VERIFY_SIGN" = true ]; then
-    if compare_semver "${version}" "${VERIFY_SIGN_BUNDLE_VERSION}"; then
-      if ! checksums_bundle_filepath=$(download_github_release_checksums_files "${download_url}" "${name}" "${version}" "${destination}" "checksums.txt.sigstore.json"); then
-        log_err "unable to download checksums signature bundle"
-        return 1
-      fi
-      log_trace "checksums bundle: ${checksums_bundle_filepath}"
+    checksum_sig_file_url=$(github_release_checksums_sig_url "${download_url}" "${name}" "${version}")
+    log_trace "checksums signature url: ${checksum_sig_file_url}"
 
-      set -- --bundle "${checksums_bundle_filepath}"
-    else
-      checksum_sig_file_url=$(github_release_checksums_sig_url "${download_url}" "${name}" "${version}")
-      log_trace "checksums signature url: ${checksum_sig_file_url}"
+    checksums_cert_file_url=$(github_release_checksums_cert_url "${download_url}" "${name}" "${version}")
+    log_trace "checksums certificate url: ${checksums_cert_file_url}"
 
-      checksums_cert_file_url=$(github_release_checksums_cert_url "${download_url}" "${name}" "${version}")
-      log_trace "checksums certificate url: ${checksums_cert_file_url}"
-
-      set -- --certificate "${checksums_cert_file_url}" --signature "${checksum_sig_file_url}"
-    fi
-
-    if ! verify_sign "${checksums_filepath}" "$@"; then
+    if ! verify_sign "${checksums_filepath}" "${checksums_cert_file_url}" "${checksum_sig_file_url}"; then
       log_err "signature verification failed"
       return 1
     fi
@@ -676,15 +657,9 @@ download_asset() (
 
   asset_url="${download_url}/${asset_filename}"
   asset_filepath="${destination}/${asset_filename}"
-  if ! http_download "${asset_filepath}" "${asset_url}" ""; then
-    log_err "unable to download asset '${asset_url}'"
-    return 1
-  fi
+  http_download "${asset_filepath}" "${asset_url}" ""
 
-  # this is what ties the asset to the (optionally signature verified) checksums file, so a mismatch must stop the install
-  if ! hash_sha256_verify "${asset_filepath}" "${checksums_filepath}"; then
-    return 1
-  fi
+  hash_sha256_verify "${asset_filepath}" "${checksums_filepath}"
 
   log_trace "download_asset_by_checksums_file() returned '${asset_filepath}'"
 
@@ -790,7 +765,7 @@ prep_signature_verification() {
   fi
 }
 
-parse_install_args() {
+main() (
   # parse arguments
 
   # note: never change default install directory (this must always be backwards compatible)
@@ -830,11 +805,6 @@ EOF
 
   set +u
   tag=$1
-  set -u
-}
-
-main() (
-  parse_install_args "$@"
 
   if [ -z "${tag}" ]; then
     log_info "checking github for the current release tag"
@@ -842,6 +812,7 @@ main() (
   else
     log_info "checking github for release tag='${tag}'"
   fi
+  set -u
 
   if ! tag=$(get_release_tag "${OWNER}" "${REPO}" "${tag}"); then
       log_err "unable to find tag='${tag}'"
@@ -872,7 +843,7 @@ main() (
           log_warn "failed to fetch from ${INSTALL_SH_BASE_URL}, trying fallback URL"
           install_script=$(http_copy "${LEGACY_INSTALL_SH_BASE_URL}/${tag}/install.sh" "")
       fi
-      echo "${install_script}" | sh -s -- "$@"
+      echo "${install_script}" | sh -s -- ${PROGRAM_ARGS}
       exit $?
   fi
 

internal/cache/filesystem_test.go

@@ -6,7 +6,6 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
-	"runtime"
 	"strings"
 	"testing"
 	"time"
@@ -96,9 +95,6 @@ func Test_makeDiskKey(t *testing.T) {
 }
 
 func Test_errors(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("windows ignores unix permission bits on directories")
-	}
 	tmp := t.TempDir()
 	cache := filepath.Join(tmp, "cache")
 	// make a non-writable directory

internal/capabilities/generate/discover_catalogers.go

@@ -212,7 +212,7 @@ func parseGenericCatalogerFunction(funcDecl *ast.FuncDecl, filePath, repoRoot st
 // extractPackageNameFromPath extracts the package name from a cataloger source file path
 // e.g., "syft/pkg/cataloger/swift/cataloger.go" -> "swift"
 func extractPackageNameFromPath(filePath string) string {
-	parts := strings.Split(filepath.ToSlash(filePath), "/")
+	parts := strings.Split(filePath, string(filepath.Separator))
 
 	// find the LAST occurrence of "cataloger" in the path
 	// (to handle test fixtures with multiple "cataloger" segments)

internal/capabilities/generate/discover_catalogers_test.go

@@ -4,7 +4,6 @@ import (
 	"go/ast"
 	"go/parser"
 	"go/token"
-	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -338,7 +337,7 @@ func TestResolveImportPath(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			got := resolveImportPath(tt.importPath, testRepoRoot)
-			require.Equal(t, filepath.FromSlash(tt.want), got)
+			require.Equal(t, tt.want, got)
 		})
 	}
 }

internal/capabilities/generate/merge.go

@@ -502,19 +502,6 @@ func convertToJSONSchemaTypesFromMetadata(metadataTypes []string) []string {
 	return result
 }
 
-// packageTypeConstName renders a package type using its go constant name, which is what the detector
-// "type" field reports (e.g. "BinaryPkg").
-// a switch rather than a derivation, since pkg.Type values don't reliably map back to their constant
-// names (e.g. "java-archive" is JavaPkg); add an arm when a classifier declares a new type.
-func packageTypeConstName(t pkg.Type) string {
-	switch t {
-	case pkg.CpanPkg:
-		return "CpanPkg"
-	default:
-		return "BinaryPkg"
-	}
-}
-
 // EnrichWithBinaryClassifier enriches an entry with binary classifier detectors if it's the binary-classifier-cataloger
 func (e *EnrichmentData) EnrichWithBinaryClassifier(catalogerName string, entry *capabilities.CatalogerEntry) {
 	// special handling for binary-classifier-cataloger: auto-generate one detector per classifier
@@ -536,7 +523,7 @@ func (e *EnrichmentData) EnrichWithBinaryClassifier(catalogerName string, entry
 					Name:  classifier.Package,
 					PURL:  purlStr,
 					CPEs:  cpeStrings,
-					Type:  packageTypeConstName(classifier.PackageType()),
+					Type:  "BinaryPkg",
 				},
 			}
 

internal/constants.go

@@ -17,5 +17,5 @@ const (
 	// 16.1.8 - add VcpkgManifest metadata type for vcpkg manifest support
 	// 16.1.9 - add Symbols (grouped by owning package import path) to GolangBinaryBuildinfoEntry metadata
 	// 16.1.10 - add SafeTensorsModelInfo metadata type for the safetensors AI model cataloger
-	// 16.1.11 - add CpanDistribution and CpanUnpackedRelease metadata types for the perl catalogers
+	// 16.1.11 - add file executable toolchain information
 )

internal/file/squashfs.go

@@ -4,7 +4,7 @@ import (
 	"errors"
 	"io/fs"
 	"os"
-	"path"
+	"path/filepath"
 	"strings"
 
 	"github.com/diskfs/go-diskfs/filesystem"
@@ -25,8 +25,7 @@ func WalkDiskDir(fsys filesystem.FileSystem, root string, fn WalkDiskDirFunc) er
 	}
 
 	for _, info := range infos {
-		// squashfs paths are posix regardless of host os
-		p := path.Join(root, info.Name())
+		p := filepath.Join(root, info.Name())
 		err = walkDiskDir(fsys, p, info, fn)
 		if err != nil {
 			if errors.Is(err, fs.SkipDir) {
@@ -75,7 +74,7 @@ func walkDiskDir(fsys filesystem.FileSystem, name string, d os.FileInfo, walkDir
 	}
 
 	for _, d1 := range dirs {
-		name1 := path.Join(name, d1.Name())
+		name1 := filepath.Join(name, d1.Name())
 		if err := walkDiskDir(fsys, name1, d1, walkDirFn); err != nil {
 			if errors.Is(err, fs.SkipDir) {
 				break

internal/file/squashfs_test.go

@@ -19,8 +19,6 @@ func createTestFS(t *testing.T) filesystem.FileSystem {
 	filename := "test.squashfs"
 	f, err := os.Create(filepath.Join(dir, filename))
 	require.NoError(t, err)
-	// windows can't remove the temp dir while the backing file is open
-	t.Cleanup(func() { _ = f.Close() })
 
 	b := file.New(f, false)
 	fsys, err := squashfs.Create(b, 0, 0, 4096)

internal/file/tar_file_traversal.go

@@ -84,8 +84,7 @@ func ExtractGlobsFromTarToUniqueTempFile(ctx context.Context, archivePath, dir s
 
 func matchesAnyGlob(name string, globs ...string) bool {
 	for _, glob := range globs {
-		// tar entry names are always posix, so don't match with the host separator (PathMatch)
-		if matches, err := doublestar.Match(glob, name); err == nil && matches {
+		if matches, err := doublestar.PathMatch(glob, name); err == nil && matches {
 			return true
 		}
 	}

internal/line_scanner.go

@@ -1,19 +0,0 @@
-package internal
-
-import (
-	"bufio"
-	"io"
-)
-
-// maxScannedLineSize is the longest line NewLineScanner will return before Scan stops with bufio.ErrTooLong.
-// The buffer only grows to this size when a line needs it.
-const maxScannedLineSize = 1024 * 1024
-
-// NewLineScanner returns a bufio.Scanner that accepts lines up to 1MB rather than the 64KB default, since
-// package metadata files carry long single-line fields (descriptions, license text, dependency lists). Callers
-// must still check Err() after scanning.
-func NewLineScanner(r io.Reader) *bufio.Scanner {
-	s := bufio.NewScanner(r)
-	s.Buffer(nil, maxScannedLineSize)
-	return s
-}

internal/line_scanner_test.go

@@ -1,24 +0,0 @@
-package internal
-
-import (
-	"bufio"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestNewLineScanner(t *testing.T) {
-	long := strings.Repeat("a", 100*1024)
-	s := NewLineScanner(strings.NewReader(long + "\nb\n"))
-	require.True(t, s.Scan())
-	require.Equal(t, long, s.Text())
-	require.True(t, s.Scan())
-	require.Equal(t, "b", s.Text())
-	require.False(t, s.Scan())
-	require.NoError(t, s.Err())
-
-	s = NewLineScanner(strings.NewReader(strings.Repeat("a", maxScannedLineSize+1)))
-	require.False(t, s.Scan())
-	require.ErrorIs(t, s.Err(), bufio.ErrTooLong)
-}

internal/os/feature_detection_test.go

@@ -16,7 +16,6 @@ import (
 	"github.com/anchore/syft/internal/os"
 	"github.com/anchore/syft/internal/sbomsync"
 	"github.com/anchore/syft/internal/task"
-	"github.com/anchore/syft/internal/testutils"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/linux"
@@ -85,7 +84,6 @@ func Test_EnvironmentTask(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			testutils.SkipWithoutLinuxContainers(t)
 			tarPath := imagetest.GetFixtureImageTarPath(t, test.name)
 
 			// get the source

internal/packagemetadata/generated.go

@@ -19,8 +19,6 @@ func AllTypes() []any {
 		pkg.ConanfileEntry{},
 		pkg.ConaninfoEntry{},
 		pkg.CondaMetaPackage{},
-		pkg.CpanDistribution{},
-		pkg.CpanUnpackedRelease{},
 		pkg.DartPubspec{},
 		pkg.DartPubspecLockEntry{},
 		pkg.DenoLockEntry{},

internal/packagemetadata/names.go

@@ -71,8 +71,6 @@ var jsonTypes = makeJSONTypes(
 	jsonNames(pkg.ConanV2LockEntry{}, "c-conan-lock-v2-entry"),
 	jsonNames(pkg.ConanfileEntry{}, "c-conan-file-entry", "ConanMetadataType"),
 	jsonNames(pkg.ConaninfoEntry{}, "c-conan-info-entry"),
-	jsonNames(pkg.CpanDistribution{}, "cpan-distribution"),
-	jsonNames(pkg.CpanUnpackedRelease{}, "cpan-unpacked-release"),
 	jsonNames(pkg.DartPubspecLockEntry{}, "dart-pubspec-lock-entry", "DartPubMetadata"),
 	jsonNames(pkg.DartPubspec{}, "dart-pubspec"),
 	jsonNames(pkg.DenoLockEntry{}, "deno-lock-entry"),

internal/packagemetadata/untyped_fields_test.go

@@ -1,74 +0,0 @@
-package packagemetadata
-
-import (
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// untypedFieldAllowlist holds package metadata fields that are allowed to carry untyped (interface) values.
-// Values in these fields come straight from whatever a parser decoded, so they are not shaped by syft
-// and can hold anything an encoder or hasher chokes on. Every entry is part of existing SBOM output and
-// cannot be retyped without breaking it; new entries need a reason and a review.
-var untypedFieldAllowlist = map[string]string{
-	"GGUFFileHeader.RemainingKeyValues": "raw GGUF header key-values; retyping changes the header output and metadataHash",
-}
-
-// TestNoUntypedMetadataFields fails when a package metadata type gains a field typed any, []any,
-// map[string]any (or any other interface) that is not on the allowlist.
-func TestNoUntypedMetadataFields(t *testing.T) {
-	var hits []string
-	for _, ty := range AllTypes() {
-		rt := reflect.TypeOf(ty)
-		collectUntyped(rt, rt.Name(), map[reflect.Type]bool{}, &hits)
-	}
-
-	seen := map[string]bool{}
-	for _, h := range hits {
-		seen[h] = true
-		if _, ok := untypedFieldAllowlist[h]; !ok {
-			t.Errorf("untyped field %s: use a concrete type, or add it to untypedFieldAllowlist with a reason", h)
-		}
-	}
-	for k := range untypedFieldAllowlist {
-		if !seen[k] {
-			t.Errorf("stale untypedFieldAllowlist entry %s: field no longer exists or is now typed", k)
-		}
-	}
-}
-
-// collectUntyped records "Struct.Field" for every field whose type reaches an interface, descending
-// through pointers, slices, arrays, maps and nested syft-owned structs.
-func collectUntyped(rt reflect.Type, path string, visited map[reflect.Type]bool, hits *[]string) {
-	switch rt.Kind() {
-	case reflect.Interface:
-		*hits = append(*hits, path)
-	case reflect.Pointer, reflect.Slice, reflect.Array:
-		collectUntyped(rt.Elem(), path, visited, hits)
-	case reflect.Map:
-		collectUntyped(rt.Key(), path, visited, hits)
-		collectUntyped(rt.Elem(), path, visited, hits)
-	case reflect.Struct:
-		if visited[rt] {
-			return
-		}
-		if rt.Name() != "" && !strings.HasPrefix(rt.PkgPath(), "github.com/anchore/syft/") {
-			// a third-party type in the model carries whatever shape the library gives it (the same leak as an
-			// interface field), so it counts as untyped. The standard library is left alone.
-			if strings.Contains(strings.Split(rt.PkgPath(), "/")[0], ".") {
-				*hits = append(*hits, path)
-			}
-			return
-		}
-		visited[rt] = true
-		for i := 0; i < rt.NumField(); i++ {
-			f := rt.Field(i)
-			// unexported embedded structs still promote their exported fields to the encoders and the hasher. A
-			// field is only out of reach when it is neither encoded nor hashed by SetID.
-			if (!f.IsExported() && !f.Anonymous) || (f.Tag.Get("json") == "-" && f.Tag.Get("hash") == "ignore") {
-				continue
-			}
-			collectUntyped(f.Type, rt.Name()+"."+f.Name, visited, hits)
-		}
-	}
-}

internal/redact/redact.go

@@ -13,14 +13,6 @@ func Set(s redact.Store) {
 	store = s
 }
 
-// Reset clears the global redaction store. It must only be called once a command
-// run has fully finished (nothing left to Add or Apply), so that a later run can
-// Set its own store. Calling it while a run is in flight would let a second Set
-// split secrets across two stores and leak the ones in the dropped store.
-func Reset() {
-	store = nil
-}
-
 func Get() redact.Store {
 	return store
 }

internal/relationship/by_file_ownership_test.go

@@ -279,46 +279,6 @@ func TestOwnershipByFilesRelationship(t *testing.T) {
 				return []pkg.Package{parent, child}, nil
 			},
 		},
-		{
-			// a CPAN distribution owns whatever its .packlist recorded, which is how a distribution that
-			// installed a binary or a shared object is related to the package cataloged from it
-			name: "cpan-distribution-owns-packlist-paths",
-			setup: func(t testing.TB) ([]pkg.Package, []artifact.Relationship) {
-				parent := pkg.Package{
-					Locations: file.NewLocationSet(
-						file.NewLocation("/usr/local/lib/perl5/site_perl/5.40.4/x86_64-linux/auto/Net/SSLeay/.packlist"),
-					),
-					Type: pkg.CpanPkg,
-					Metadata: pkg.CpanDistribution{
-						MainModule: "Net::SSLeay",
-						Files: []string{
-							"/usr/local/lib/perl5/site_perl/5.40.4/x86_64-linux/Net/SSLeay.pm",
-							"/usr/local/lib/perl5/site_perl/5.40.4/x86_64-linux/auto/Net/SSLeay/SSLeay.so",
-						},
-					},
-				}
-				parent.SetID()
-
-				child := pkg.Package{
-					Locations: file.NewLocationSet(
-						file.NewLocation("/usr/local/lib/perl5/site_perl/5.40.4/x86_64-linux/auto/Net/SSLeay/SSLeay.so"),
-					),
-					Type: pkg.BinaryPkg,
-				}
-				child.SetID()
-
-				return []pkg.Package{parent, child}, []artifact.Relationship{
-					{
-						From: parent,
-						To:   child,
-						Type: artifact.OwnershipByFileOverlapRelationship,
-						Data: ownershipByFilesMetadata{
-							Files: []string{"/usr/local/lib/perl5/site_perl/5.40.4/x86_64-linux/auto/Net/SSLeay/SSLeay.so"},
-						},
-					},
-				}
-			},
-		},
 	}
 
 	for _, test := range tests {

internal/spdxlicense/license.go

@@ -44,7 +44,6 @@ type LicenseInfo struct {
 // LicenseByURL returns the license ID and name for a given URL from the SPDX license list.
 // The URL should match one of the URLs in the seeAlso field of an SPDX license.
 // The scheme (http:// or https://) is stripped before lookup, so both schemes match.
-// opensource.org URLs additionally match regardless of the form used (see normalizeOpenSourceOrgURL).
 func LicenseByURL(url string) (LicenseInfo, bool) {
 	url = strings.TrimSpace(url)
 	url = stripScheme(url)
@@ -53,51 +52,9 @@ func LicenseByURL(url string) (LicenseInfo, bool) {
 			ID: id,
 		}, true
 	}
-	if normalized, ok := normalizeOpenSourceOrgURL(url); ok {
-		if id, exists := openSourceOrgURLToLicense[normalized]; exists {
-			return LicenseInfo{
-				ID: id,
-			}, true
-		}
-	}
 	return LicenseInfo{}, false
 }
 
-// openSourceOrgURLToLicense indexes the opensource.org entries of urlToLicense by normalized URL.
-var openSourceOrgURLToLicense = buildOpenSourceOrgURLToLicense(urlToLicense)
-
-func buildOpenSourceOrgURLToLicense(urls map[string]string) map[string]string {
-	index := make(map[string]string)
-	ambiguous := make(map[string]bool)
-	for url, id := range urls {
-		normalized, ok := normalizeOpenSourceOrgURL(url)
-		if !ok || ambiguous[normalized] {
-			continue
-		}
-		if existing, exists := index[normalized]; exists && existing != id {
-			// don't guess between licenses that only differ by URL form
-			delete(index, normalized)
-			ambiguous[normalized] = true
-			continue
-		}
-		index[normalized] = id
-	}
-	return index
-}
-
-// normalizeOpenSourceOrgURL reduces a scheme-less opensource.org URL to a canonical form.
-// SPDX has changed these URLs over time (e.g. 3.29.0 replaced opensource.org/licenses/MIT and
-// opensource.org/license/mit/ with opensource.org/license/MIT), while package metadata in the wild
-// still uses the older forms. The www. prefix, /licenses/ vs /license/, case, and trailing slash are ignored.
-func normalizeOpenSourceOrgURL(url string) (string, bool) {
-	url = strings.TrimPrefix(strings.ToLower(url), "www.")
-	if !strings.HasPrefix(url, "opensource.org/") {
-		return "", false
-	}
-	url = strings.Replace(url, "opensource.org/licenses/", "opensource.org/license/", 1)
-	return strings.TrimSuffix(url, "/"), true
-}
-
 // stripScheme removes http:// or https:// prefix from a URL.
 // This allows a single map entry to match both schemes.
 func stripScheme(url string) string {

internal/spdxlicense/license_list.go

@@ -2,7 +2,7 @@
 // This file was generated using data from https://spdx.org/licenses/licenses.json
 package spdxlicense
 
-const Version = "3.29.0"
+const Version = "3.28.0"
 
 var licenseIDs = map[string]string{
 	"0bsd":                                  "0BSD",
@@ -116,7 +116,6 @@ var licenseIDs = map[string]string{
 	"aswfdigitalassets1.0.0":                "ASWF-Digital-Assets-1.0",
 	"aswfdigitalassets1.1":                  "ASWF-Digital-Assets-1.1",
 	"aswfdigitalassets1.1.0":                "ASWF-Digital-Assets-1.1",
-	"atcgame":                               "atc-game",
 	"baekmuk":                               "Baekmuk",
 	"bahyph":                                "Bahyph",
 	"barr":                                  "Barr",
@@ -143,11 +142,8 @@ var licenseIDs = map[string]string{
 	"briangladman2.0clause":                 "Brian-Gladman-2-Clause",
 	"briangladman2clause":                   "Brian-Gladman-2-Clause",
 	"briangladman3.0.0clause":               "Brian-Gladman-3-Clause",
-	"briangladman3.0.0clausenoconversion":   "Brian-Gladman-3-Clause-no-conversion",
 	"briangladman3.0clause":                 "Brian-Gladman-3-Clause",
-	"briangladman3.0clausenoconversion":     "Brian-Gladman-3-Clause-no-conversion",
 	"briangladman3clause":                   "Brian-Gladman-3-Clause",
-	"briangladman3clausenoconversion":       "Brian-Gladman-3-Clause-no-conversion",
 	"bsd1.0.0clause":                        "BSD-1-Clause",
 	"bsd1.0clause":                          "BSD-1-Clause",
 	"bsd1clause":                            "BSD-1-Clause",
@@ -158,7 +154,6 @@ var licenseIDs = map[string]string{
 	"bsd2.0.0clausenetbsd":                  "BSD-2-Clause",
 	"bsd2.0.0clausepatent":                  "BSD-2-Clause-Patent",
 	"bsd2.0.0clausepkgconfdisclaimer":       "BSD-2-Clause-pkgconf-disclaimer",
-	"bsd2.0.0clauseposunchanged":            "BSD-2-Clause-pos-unchanged",
 	"bsd2.0.0clauseviews":                   "BSD-2-Clause-Views",
 	"bsd2.0clause":                          "BSD-2-Clause",
 	"bsd2.0clausedarwin":                    "BSD-2-Clause-Darwin",
@@ -167,7 +162,6 @@ var licenseIDs = map[string]string{
 	"bsd2.0clausenetbsd":                    "BSD-2-Clause",
 	"bsd2.0clausepatent":                    "BSD-2-Clause-Patent",
 	"bsd2.0clausepkgconfdisclaimer":         "BSD-2-Clause-pkgconf-disclaimer",
-	"bsd2.0clauseposunchanged":              "BSD-2-Clause-pos-unchanged",
 	"bsd2.0clauseviews":                     "BSD-2-Clause-Views",
 	"bsd2clause":                            "BSD-2-Clause",
 	"bsd2clausedarwin":                      "BSD-2-Clause-Darwin",
@@ -176,7 +170,6 @@ var licenseIDs = map[string]string{
 	"bsd2clausenetbsd":                      "BSD-2-Clause",
 	"bsd2clausepatent":                      "BSD-2-Clause-Patent",
 	"bsd2clausepkgconfdisclaimer":           "BSD-2-Clause-pkgconf-disclaimer",
-	"bsd2clauseposunchanged":                "BSD-2-Clause-pos-unchanged",
 	"bsd2clauseviews":                       "BSD-2-Clause-Views",
 	"bsd3.0.0clause":                        "BSD-3-Clause",
 	"bsd3.0.0clauseacpica":                  "BSD-3-Clause-acpica",
@@ -191,7 +184,6 @@ var licenseIDs = map[string]string{
 	"bsd3.0.0clausenonuclearlicense2014":    "BSD-3-Clause-No-Nuclear-License-2014",
 	"bsd3.0.0clausenonuclearwarranty":       "BSD-3-Clause-No-Nuclear-Warranty",
 	"bsd3.0.0clauseopenmpi":                 "BSD-3-Clause-Open-MPI",
-	"bsd3.0.0clauseopenwebui":               "BSD-3-Clause-OpenWebUI",
 	"bsd3.0.0clausesun":                     "BSD-3-Clause-Sun",
 	"bsd3.0.0clausetso":                     "BSD-3-Clause-Tso",
 	"bsd3.0clause":                          "BSD-3-Clause",
@@ -207,7 +199,6 @@ var licenseIDs = map[string]string{
 	"bsd3.0clausenonuclearlicense2014":      "BSD-3-Clause-No-Nuclear-License-2014",
 	"bsd3.0clausenonuclearwarranty":         "BSD-3-Clause-No-Nuclear-Warranty",
 	"bsd3.0clauseopenmpi":                   "BSD-3-Clause-Open-MPI",
-	"bsd3.0clauseopenwebui":                 "BSD-3-Clause-OpenWebUI",
 	"bsd3.0clausesun":                       "BSD-3-Clause-Sun",
 	"bsd3.0clausetso":                       "BSD-3-Clause-Tso",
 	"bsd3clause":                            "BSD-3-Clause",
@@ -223,7 +214,6 @@ var licenseIDs = map[string]string{
 	"bsd3clausenonuclearlicense2014":        "BSD-3-Clause-No-Nuclear-License-2014",
 	"bsd3clausenonuclearwarranty":           "BSD-3-Clause-No-Nuclear-Warranty",
 	"bsd3clauseopenmpi":                     "BSD-3-Clause-Open-MPI",
-	"bsd3clauseopenwebui":                   "BSD-3-Clause-OpenWebUI",
 	"bsd3clausesun":                         "BSD-3-Clause-Sun",
 	"bsd3clausetso":                         "BSD-3-Clause-Tso",
 	"bsd4.0.0clause":                        "BSD-4-Clause",
@@ -242,15 +232,12 @@ var licenseIDs = map[string]string{
 	"bsd4reno":                              "BSD-4.3RENO",
 	"bsd4tahoe":                             "BSD-4.3TAHOE",
 	"bsdadvertisingacknowledgement":         "BSD-Advertising-Acknowledgement",
-	"bsdasktoendorse":                       "BSD-ask-to-endorse",
 	"bsdattributionhpnddisclaimer":          "BSD-Attribution-HPND-disclaimer",
 	"bsdinfernonettverk":                    "BSD-Inferno-Nettverk",
 	"bsdmarkmodifications":                  "BSD-Mark-Modifications",
 	"bsdprotection":                         "BSD-Protection",
-	"bsdsourcealtgpl":                       "BSD-Source-alt-GPL",
 	"bsdsourcebeginningfile":                "BSD-Source-beginning-file",
 	"bsdsourcecode":                         "BSD-Source-Code",
-	"bsdsourcecodenodisclaimer":             "BSD-Source-Code-no-disclaimer",
 	"bsdsystemics":                          "BSD-Systemics",
 	"bsdsystemicsw3.0.0works":               "BSD-Systemics-W3Works",
 	"bsdsystemicsw3.0works":                 "BSD-Systemics-W3Works",
@@ -259,7 +246,6 @@ var licenseIDs = map[string]string{
 	"bsl1.0":                                "BSL-1.0",
 	"bsl1.0.0":                              "BSL-1.0",
 	"buddy":                                 "Buddy",
-	"bugroff":                               "Bugroff",
 	"busl1":                                 "BUSL-1.1",
 	"busl1.1":                               "BUSL-1.1",
 	"busl1.1.0":                             "BUSL-1.1",
@@ -330,11 +316,8 @@ var licenseIDs = map[string]string{
 	"ccbync3.0":                             "CC-BY-NC-3.0",
 	"ccbync3.0.0":                           "CC-BY-NC-3.0",
 	"ccbync3.0.0de":                         "CC-BY-NC-3.0-DE",
-	"ccbync3.0.0igo":                        "CC-BY-NC-3.0-IGO",
 	"ccbync3.0de":                           "CC-BY-NC-3.0-DE",
-	"ccbync3.0igo":                          "CC-BY-NC-3.0-IGO",
 	"ccbync3de":                             "CC-BY-NC-3.0-DE",
-	"ccbync3igo":                            "CC-BY-NC-3.0-IGO",
 	"ccbync4":                               "CC-BY-NC-4.0",
 	"ccbync4.0":                             "CC-BY-NC-4.0",
 	"ccbync4.0.0":                           "CC-BY-NC-4.0",
@@ -609,7 +592,6 @@ var licenseIDs = map[string]string{
 	"fair":                                  "Fair",
 	"fbm":                                   "FBM",
 	"fdkaac":                                "FDK-AAC",
-	"fdkmpegh":                              "FDK-MPEG-H",
 	"fergusontwofish":                       "Ferguson-Twofish",
 	"frameworx1":                            "Frameworx-1.0",
 	"frameworx1.0":                          "Frameworx-1.0",
@@ -785,9 +767,6 @@ var licenseIDs = map[string]string{
 	"hippocratic2":                          "Hippocratic-2.1",
 	"hippocratic2.1":                        "Hippocratic-2.1",
 	"hippocratic2.1.0":                      "Hippocratic-2.1",
-	"hippocratic3.0.0core":                  "Hippocratic-3.0-core",
-	"hippocratic3.0core":                    "Hippocratic-3.0-core",
-	"hippocratic3core":                      "Hippocratic-3.0-core",
 	"hp1986":                                "HP-1986",
 	"hp1986.0":                              "HP-1986",
 	"hp1986.0.0":                            "HP-1986",
@@ -834,7 +813,6 @@ var licenseIDs = map[string]string{
 	"imlib2":                                "Imlib2",
 	"imlib2.0":                              "Imlib2",
 	"imlib2.0.0":                            "Imlib2",
-	"informatica":                           "Informatica",
 	"infozip":                               "Info-ZIP",
 	"innernet2":                             "Inner-Net-2.0",
 	"innernet2.0":                           "Inner-Net-2.0",
@@ -1033,9 +1011,6 @@ var licenseIDs = map[string]string{
 	"mulanpsl2.0.0":                         "MulanPSL-2.0",
 	"multics":                               "Multics",
 	"mup":                                   "Mup",
-	"mvt1":                                  "MVT-1.1",
-	"mvt1.1":                                "MVT-1.1",
-	"mvt1.1.0":                              "MVT-1.1",
 	"naist2003":                             "NAIST-2003",
 	"naist2003.0":                           "NAIST-2003",
 	"naist2003.0.0":                         "NAIST-2003",
@@ -1514,8 +1489,6 @@ var urlToLicense = map[string]string{
 	"cdla.io/permissive-1-0":                                                                                       "CDLA-Permissive-1.0",
 	"cdla.io/sharing-1-0":                                                                                          "CDLA-Sharing-1.0",
 	"celestrak.org/publications/AIAA/2006-6753/faq.php":                                                            "SGP4",
-	"cgit.freebsd.org/src/plain/sys/dev/aic7xxx/aic7xxx_osm.c":                                                     "BSD-Source-alt-GPL",
-	"cgit.freebsd.org/src/tree/usr.bin/sockstat/sockstat.c":                                                        "BSD-2-Clause-pos-unchanged",
 	"cgit.freedesktop.org/libbsd/tree/man/setproctitle.3bsd":                                                       "libutil-David-Nugent",
 	"coil.apotheon.org/plaintext/01.0.txt":                                                                         "COIL-1.0",
 	"core.tcl-lang.org/tk/file?name=compat/unistd.h":                                                               "HPND-UC",
@@ -1539,7 +1512,6 @@ var urlToLicense = map[string]string{
 	"creativecommons.org/licenses/by-nc/2.0/legalcode":                                                             "CC-BY-NC-2.0",
 	"creativecommons.org/licenses/by-nc/2.5/legalcode":                                                             "CC-BY-NC-2.5",
 	"creativecommons.org/licenses/by-nc/3.0/de/legalcode":                                                          "CC-BY-NC-3.0-DE",
-	"creativecommons.org/licenses/by-nc/3.0/igo/legalcode":                                                         "CC-BY-NC-3.0-IGO",
 	"creativecommons.org/licenses/by-nc/3.0/legalcode":                                                             "CC-BY-NC-3.0",
 	"creativecommons.org/licenses/by-nc/4.0/legalcode":                                                             "CC-BY-NC-4.0",
 	"creativecommons.org/licenses/by-nd-nc/1.0/legalcode":                                                          "CC-BY-NC-ND-1.0",
@@ -1592,7 +1564,6 @@ var urlToLicense = map[string]string{
 	"directory.fsf.org/wiki/License:Fdk":                                                                           "FDK-AAC",
 	"doc.qt.io/archives/3.3/license.html":                                                                          "QPL-1.0",
 	"doc.qt.nokia.com/3.3/license.html":                                                                            "QPL-1.0",
-	"docs.mvt.re/en/latest/license/":                                                                               "MVT-1.1",
 	"docs.omniverse.nvidia.com/install-guide/latest/common/licenses.html":                                          "AML-glslang",
 	"docs.oracle.com/cd/E81115_01/html/E81116/licenses.html":                                                       "man2html",
 	"docs.python.org/3/license.html":                                                                               "Python-2.0.1",
@@ -1698,7 +1669,6 @@ var urlToLicense = map[string]string{
 	"fedoraproject.org/wiki/Licensing:Mplus?rd=Licensing/mplus":                                                    "mplus",
 	"fedoraproject.org/wiki/Licensing:ThorPublicLicense":                                                           "TPL-1.0",
 	"firstdonoharm.dev/version/2/1/license.html":                                                                   "Hippocratic-2.1",
-	"firstdonoharm.dev/version/3/0/core.txt":                                                                       "Hippocratic-3.0-core",
 	"forge.gouv.qc.ca/licence/fr/liliq-v1-1/":                                                                      "LiLiQ-P-1.1",
 	"forge.gouv.qc.ca/licence/liliq-p":                                                                             "LiLiQ-R-1.1",
 	"forge.gouv.qc.ca/licence/liliq-p/":                                                                            "LiLiQ-P-1.1",
@@ -1716,70 +1686,68 @@ var urlToLicense = map[string]string{
 	"ftp://ftp.tin.org/pub/news/utils/newsx/newsx-1.6.tar.gz":                                                      "Zeeff",
 	"gianluca.dellavedova.org/2011/01/03/clarified-artistic-license/":                                              "ClArtistic",
 	"git.denx.de/?p=u-boot.git;a=blob;f=arch/powerpc/cpu/ppc4xx/miiphy.c;h=297155fdafa064b955e53e9832de93bfb0cfb85b;hb=9fab4bf4cc077c21e43941866f3f2c196f28670d": "IBM-pibs",
-	"git.enlightenment.org/legacy/imlib2.git/tree/COPYING":                                                                                   "Imlib2",
-	"git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/man2/getcpu.2#n4":                                                              "Linux-man-pages-1-para",
-	"git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/man2/migrate_pages.2#n8":                                                       "Linux-man-pages-copyleft-2-para",
-	"git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/man2/move_pages.2#n5":                                                          "Linux-man-pages-copyleft-2-para",
-	"git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/man2/set_mempolicy.2#n5":                                                       "Linux-man-pages-copyleft-var",
-	"git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/infiniband/core/sa.h":                                           "Linux-OpenIB",
-	"git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net/sunrpc/auth_gss/gss_generic_token.c?h=v4.19":                        "HPND-sell-variant",
-	"git.openldap.org/openldap/openldap/-/blob/master/COPYRIGHT#L55-63":                                                                      "BSD-4.3RENO",
-	"git.openldap.org/openldap/openldap/-/blob/master/COPYRIGHT?ref_type=heads#L39-51":                                                       "Furuseth",
-	"git.openldap.org/openldap/openldap/-/blob/master/libraries/libldap/os-local.c?ref_type=heads#L19-23":                                    "PADL",
-	"git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/docs/FTL.TXT":                                                                     "FTL",
-	"git.savannah.gnu.org/cgit/gcl.git/tree/gcl/lsp/gcl_loop.lsp?h=Version_2_6_13pre":                                                        "LOOP",
-	"git.savannah.gnu.org/cgit/gnulib.git/tree/modules/COPYING?id=7b08932179d0d6b017f7df01a2ddf6e096b038e3":                                  "FSFULLRSD",
-	"git.savannah.gnu.org/cgit/indent.git/tree/doc/indent.texi?id=a74c6b4ee49397cf330b333da1042bffa60ed14f#n1788":                            "BSD-4.3TAHOE",
-	"git.savannah.gnu.org/cgit/indent.git/tree/doc/indent.texi?id=a74c6b4ee49397cf330b333da1042bffa60ed14f#n74":                              "Latex2e-translated-notice",
-	"git.savannah.gnu.org/cgit/kazlib.git/tree/except.c?id=0062df360c2d17d57f6af19b0e444c51feb99036":                                         "Kazlib",
-	"git.savannah.gnu.org/cgit/wget.git/tree/util/trunc.c?h=v1.21.3&id=40747a11e44ced5a8ac628a41f879ced3e2ebce9#n6":                          "FSFAP-no-warranty-disclaimer",
-	"git.sr.ht/~nabijaczleweli/ossp-var":                                                                                                     "OSSP",
-	"github.com/389ds/389-ds-base/blob/main/ldap/include/sysexits-compat.h#L15":                                                              "BSD-4.3TAHOE",
-	"github.com/AcademySoftwareFoundation/foundation/blob/main/digital_assets/aswf_digital_assets_license_v1.0.txt":                          "ASWF-Digital-Assets-1.0",
-	"github.com/AcademySoftwareFoundation/foundation/blob/main/digital_assets/aswf_digital_assets_license_v1.1.txt":                          "ASWF-Digital-Assets-1.1",
-	"github.com/AdaCore/gnatcoll-core/blob/master/docs/index.rst":                                                                            "AdaCore-doc",
-	"github.com/AdaCore/gnatcoll-db/blob/master/docs/index.rst":                                                                              "AdaCore-doc",
-	"github.com/AdaCore/xmlada/blob/master/docs/index.rst":                                                                                   "AdaCore-doc",
-	"github.com/BuildCraft/BuildCraft/blob/623d323b1868712f29f4a8b0979a02e8d1835131/LICENSE":                                                 "MMPL-1.0.1",
-	"github.com/CommunitySpecification/1.0/blob/master/1._Community_Specification_License-v1.md":                                             "Community-Spec-1.0",
-	"github.com/CorsixTH/deps/blob/fd339a9f526d1d9c9f01ccf39e438a015da50035/licences/libgsm.txt":                                             "TU-Berlin-2.0",
-	"github.com/Cyan4973/xxHash/blob/dev/doc/xxhash_spec.md":                                                                                 "LPD-document",
-	"github.com/DISIC/politique-de-contribution-open-source/blob/master/LICENSE.pdf":                                                         "etalab-2.0",
-	"github.com/Distrotech/hdparm/blob/4517550db29a91420fb2b020349523b1b4512df2/LICENSE.TXT":                                                 "hdparm",
-	"github.com/Distrotech/transfig/blob/master/transfig/transfig.c":                                                                         "Xfig",
-	"github.com/DrItanium/maya/blob/master/LICENSE.CLIPS":                                                                                    "Clips",
-	"github.com/Dual-Life/mime-base64/blob/master/Base64.xs#L12":                                                                             "metamail",
-	"github.com/EthicalSource/hippocratic-license/blob/58c0e646d64ff6fbee275bfe2b9492f914e3ab2a/LICENSE.txt":                                 "Hippocratic-2.1",
-	"github.com/Fraunhofer-IIS/mpeghdec/blob/main/LICENSE.txt":                                                                               "FDK-MPEG-H",
-	"github.com/FreeRADIUS/freeradius-client/blob/master/COPYRIGHT#L32":                                                                      "HPND-Fenneberg-Livingston",
-	"github.com/GNOME/gcr/blob/master/docs/COPYING":                                                                                          "GCR-docs",
-	"github.com/GNOME/libxml2/blob/master/dict.c":                                                                                            "ISC-Veillard",
-	"github.com/HDFGroup/hdf5/?tab=License-1-ov-file#readme":                                                                                 "HDF5",
-	"github.com/KhronosGroup/SPIRV-Cross/blob/main/LICENSES/LicenseRef-KhronosFreeUse.txt":                                                   "MIT-Khronos-old",
-	"github.com/KhronosGroup/glslang/blob/main/LICENSE.txt#L949":                                                                             "AML-glslang",
-	"github.com/MariaDB/server/blob/11.6/libmysqld/lib_sql.cc":                                                                               "Boehm-GC-without-fee",
-	"github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md":                                                                        "DRL-1.0",
-	"github.com/OGRECave/ogre/blob/master/OgreMain/include/OgreSingleton.h#L28C3-L35C46":                                                     "Game-Programming-Gems",
-	"github.com/Perl/perl5/blob/blead/util.c#L6136":                                                                                          "Martin-Birgmeier",
-	"github.com/PicoEFI/PicoEFI/blob/2263ac1a2bc98e5534d64a4896d3cfbbae00745a/LICENSES/LicenseRef-scancode-bsd-no-disclaimer-unmodified.txt": "BSD-Source-Code-no-disclaimer",
-	"github.com/PixarAnimationStudios/OpenSubdiv/blob/v3_5_0/opensubdiv/version.cpp#L2-L22":                                                  "Pixar",
-	"github.com/PixarAnimationStudios/OpenSubdiv/raw/v3_5_0/LICENSE.txt":                                                                     "Pixar",
-	"github.com/RTimothyEdwards/magic/blob/master/LICENSE":                                                                                   "HPND-UC-export-US",
-	"github.com/SELinuxProject/selinux/blob/master/libselinux/LICENSE":                                                                       "libselinux-1.0",
-	"github.com/SWI-Prolog/packages-clib/blob/master/sha1/brg_endian.h":                                                                      "Brian-Gladman-3-Clause",
-	"github.com/SWI-Prolog/packages-xpce/blob/161a40cd82004f731ba48024f9d30af388a7edf5/src/img/gifwrite.c#L21-L26":                           "FBM",
-	"github.com/SWI-Prolog/swipl-devel/blob/master/src/os/dtoa.c":                                                                            "dtoa",
-	"github.com/SigmaHQ/Detection-Rule-License/blob/6ec7fbde6101d101b5b5d1fcb8f9b69fbc76c04a/LICENSE.Detection.Rules.md":                     "DRL-1.1",
-	"github.com/Slicer/Slicer/blob/main/License.txt":                                                                                         "3D-Slicer-1.0",
-	"github.com/Unidata/UDUNITS-2/blob/master/COPYRIGHT":                                                                                     "UCAR",
-	"github.com/acpica/acpica/blob/master/source/common/acfileio.c#L119":                                                                     "BSD-3-Clause-acpica",
-	"github.com/adaptivecomputing/torque/blob/master/PBS_License.txt":                                                                        "OpenPBS-2.3",
-	"github.com/adversary-org/wtfnmf/raw/3f2cd8235a64350a57a51b9739715edaea63ec1a/COPYING.WTFNMFPL-utf8":                                     "WTFNMFPL",
-	"github.com/adversary-org/wtfnmf/raw/refs/tags/1.0/COPYING.WTFNMFPL":                                                                     "WTFNMFPL",
-	"github.com/ap/Text-Tabs/blob/master/lib.modern/Text/Tabs.pm#L148":                                                                       "TTWL",
-	"github.com/apache/apr/blob/trunk/LICENSE#L298C6-L298C29":                                                                                "Caldera-no-preamble",
-	"github.com/audacious-media-player/audacious/blob/master/COPYING":                                                                        "BSD-2-Clause-pkgconf-disclaimer",
-	"github.com/audacious-media-player/audacious/blob/master/src/audacious/main.cc":                                                          "BSD-2-Clause-pkgconf-disclaimer",
+	"git.enlightenment.org/legacy/imlib2.git/tree/COPYING":                                                               "Imlib2",
+	"git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/man2/getcpu.2#n4":                                          "Linux-man-pages-1-para",
+	"git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/man2/migrate_pages.2#n8":                                   "Linux-man-pages-copyleft-2-para",
+	"git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/man2/move_pages.2#n5":                                      "Linux-man-pages-copyleft-2-para",
+	"git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/man2/set_mempolicy.2#n5":                                   "Linux-man-pages-copyleft-var",
+	"git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/infiniband/core/sa.h":                       "Linux-OpenIB",
+	"git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net/sunrpc/auth_gss/gss_generic_token.c?h=v4.19":    "HPND-sell-variant",
+	"git.openldap.org/openldap/openldap/-/blob/master/COPYRIGHT#L55-63":                                                  "BSD-4.3RENO",
+	"git.openldap.org/openldap/openldap/-/blob/master/COPYRIGHT?ref_type=heads#L39-51":                                   "Furuseth",
+	"git.openldap.org/openldap/openldap/-/blob/master/libraries/libldap/os-local.c?ref_type=heads#L19-23":                "PADL",
+	"git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/docs/FTL.TXT":                                                 "FTL",
+	"git.savannah.gnu.org/cgit/gcl.git/tree/gcl/lsp/gcl_loop.lsp?h=Version_2_6_13pre":                                    "LOOP",
+	"git.savannah.gnu.org/cgit/gnulib.git/tree/modules/COPYING?id=7b08932179d0d6b017f7df01a2ddf6e096b038e3":              "FSFULLRSD",
+	"git.savannah.gnu.org/cgit/indent.git/tree/doc/indent.texi?id=a74c6b4ee49397cf330b333da1042bffa60ed14f#n1788":        "BSD-4.3TAHOE",
+	"git.savannah.gnu.org/cgit/indent.git/tree/doc/indent.texi?id=a74c6b4ee49397cf330b333da1042bffa60ed14f#n74":          "Latex2e-translated-notice",
+	"git.savannah.gnu.org/cgit/kazlib.git/tree/except.c?id=0062df360c2d17d57f6af19b0e444c51feb99036":                     "Kazlib",
+	"git.savannah.gnu.org/cgit/wget.git/tree/util/trunc.c?h=v1.21.3&id=40747a11e44ced5a8ac628a41f879ced3e2ebce9#n6":      "FSFAP-no-warranty-disclaimer",
+	"git.sr.ht/~nabijaczleweli/ossp-var":                                                                                 "OSSP",
+	"github.com/389ds/389-ds-base/blob/main/ldap/include/sysexits-compat.h#L15":                                          "BSD-4.3TAHOE",
+	"github.com/AcademySoftwareFoundation/foundation/blob/main/digital_assets/aswf_digital_assets_license_v1.0.txt":      "ASWF-Digital-Assets-1.0",
+	"github.com/AcademySoftwareFoundation/foundation/blob/main/digital_assets/aswf_digital_assets_license_v1.1.txt":      "ASWF-Digital-Assets-1.1",
+	"github.com/AdaCore/gnatcoll-core/blob/master/docs/index.rst":                                                        "AdaCore-doc",
+	"github.com/AdaCore/gnatcoll-db/blob/master/docs/index.rst":                                                          "AdaCore-doc",
+	"github.com/AdaCore/xmlada/blob/master/docs/index.rst":                                                               "AdaCore-doc",
+	"github.com/BuildCraft/BuildCraft/blob/623d323b1868712f29f4a8b0979a02e8d1835131/LICENSE":                             "MMPL-1.0.1",
+	"github.com/CommunitySpecification/1.0/blob/master/1._Community_Specification_License-v1.md":                         "Community-Spec-1.0",
+	"github.com/CorsixTH/deps/blob/fd339a9f526d1d9c9f01ccf39e438a015da50035/licences/libgsm.txt":                         "TU-Berlin-2.0",
+	"github.com/Cyan4973/xxHash/blob/dev/doc/xxhash_spec.md":                                                             "LPD-document",
+	"github.com/DISIC/politique-de-contribution-open-source/blob/master/LICENSE.pdf":                                     "etalab-2.0",
+	"github.com/Distrotech/hdparm/blob/4517550db29a91420fb2b020349523b1b4512df2/LICENSE.TXT":                             "hdparm",
+	"github.com/Distrotech/transfig/blob/master/transfig/transfig.c":                                                     "Xfig",
+	"github.com/DrItanium/maya/blob/master/LICENSE.CLIPS":                                                                "Clips",
+	"github.com/Dual-Life/mime-base64/blob/master/Base64.xs#L12":                                                         "metamail",
+	"github.com/EthicalSource/hippocratic-license/blob/58c0e646d64ff6fbee275bfe2b9492f914e3ab2a/LICENSE.txt":             "Hippocratic-2.1",
+	"github.com/FreeRADIUS/freeradius-client/blob/master/COPYRIGHT#L32":                                                  "HPND-Fenneberg-Livingston",
+	"github.com/GNOME/gcr/blob/master/docs/COPYING":                                                                      "GCR-docs",
+	"github.com/GNOME/libxml2/blob/master/dict.c":                                                                        "ISC-Veillard",
+	"github.com/HDFGroup/hdf5/?tab=License-1-ov-file#readme":                                                             "HDF5",
+	"github.com/KhronosGroup/SPIRV-Cross/blob/main/LICENSES/LicenseRef-KhronosFreeUse.txt":                               "MIT-Khronos-old",
+	"github.com/KhronosGroup/glslang/blob/main/LICENSE.txt#L949":                                                         "AML-glslang",
+	"github.com/MariaDB/server/blob/11.6/libmysqld/lib_sql.cc":                                                           "Boehm-GC-without-fee",
+	"github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md":                                                    "DRL-1.0",
+	"github.com/OGRECave/ogre/blob/master/OgreMain/include/OgreSingleton.h#L28C3-L35C46":                                 "Game-Programming-Gems",
+	"github.com/Perl/perl5/blob/blead/util.c#L6136":                                                                      "Martin-Birgmeier",
+	"github.com/PixarAnimationStudios/OpenSubdiv/blob/v3_5_0/opensubdiv/version.cpp#L2-L22":                              "Pixar",
+	"github.com/PixarAnimationStudios/OpenSubdiv/raw/v3_5_0/LICENSE.txt":                                                 "Pixar",
+	"github.com/RTimothyEdwards/magic/blob/master/LICENSE":                                                               "HPND-UC-export-US",
+	"github.com/SELinuxProject/selinux/blob/master/libselinux/LICENSE":                                                   "libselinux-1.0",
+	"github.com/SWI-Prolog/packages-clib/blob/master/sha1/brg_endian.h":                                                  "Brian-Gladman-3-Clause",
+	"github.com/SWI-Prolog/packages-xpce/blob/161a40cd82004f731ba48024f9d30af388a7edf5/src/img/gifwrite.c#L21-L26":       "FBM",
+	"github.com/SWI-Prolog/swipl-devel/blob/master/src/os/dtoa.c":                                                        "dtoa",
+	"github.com/SigmaHQ/Detection-Rule-License/blob/6ec7fbde6101d101b5b5d1fcb8f9b69fbc76c04a/LICENSE.Detection.Rules.md": "DRL-1.1",
+	"github.com/Slicer/Slicer/blob/main/License.txt":                                                                     "3D-Slicer-1.0",
+	"github.com/Unidata/UDUNITS-2/blob/master/COPYRIGHT":                                                                 "UCAR",
+	"github.com/acpica/acpica/blob/master/source/common/acfileio.c#L119":                                                 "BSD-3-Clause-acpica",
+	"github.com/adaptivecomputing/torque/blob/master/PBS_License.txt":                                                    "OpenPBS-2.3",
+	"github.com/adversary-org/wtfnmf/raw/3f2cd8235a64350a57a51b9739715edaea63ec1a/COPYING.WTFNMFPL-utf8":                 "WTFNMFPL",
+	"github.com/adversary-org/wtfnmf/raw/refs/tags/1.0/COPYING.WTFNMFPL":                                                 "WTFNMFPL",
+	"github.com/ap/Text-Tabs/blob/master/lib.modern/Text/Tabs.pm#L148":                                                   "TTWL",
+	"github.com/apache/apr/blob/trunk/LICENSE#L298C6-L298C29":                                                            "Caldera-no-preamble",
+	"github.com/audacious-media-player/audacious/blob/master/COPYING":                                                    "BSD-2-Clause-pkgconf-disclaimer",
+	"github.com/audacious-media-player/audacious/blob/master/src/audacious/main.cc":                                      "BSD-2-Clause-pkgconf-disclaimer",
 	"github.com/aws/mit-0": "MIT-0",
 	"github.com/awsdocs/aws-cloud9-user-guide/blob/master/LICENSE-SAMPLECODE":                                                 "MIT-0",
 	"github.com/bagder/curl/blob/master/COPYING":                                                                              "curl",
@@ -1804,7 +1772,6 @@ var urlToLicense = map[string]string{
 	"github.com/file/file/blob/master/COPYING":                                                                                                                            "BSD-2-Clause-Darwin",
 	"github.com/freebsd/freebsd-src/blob/main/lib/msun/src/e_acosh.c":                                                                                                     "SunPro",
 	"github.com/freebsd/freebsd-src/blob/main/lib/msun/src/e_lgammal.c":                                                                                                   "SunPro",
-	"github.com/freebsd/pkg/blob/main/src/add.c":                                                                                                                          "BSD-2-Clause-pos-unchanged",
 	"github.com/gabegundy/atlserver/blob/master/License.txt":                                                                                                              "MS-LPL",
 	"github.com/greymass/swift-eosio/blob/master/LICENSE":                                                                                                                 "BSD-3-Clause-No-Military-License",
 	"github.com/hamano/man2html/blob/master/man2html.c":                                                                                                                   "man2html",
@@ -1817,7 +1784,6 @@ var urlToLicense = map[string]string{
 	"github.com/jsommers/pytricia/blob/master/patricia.c#L33-L67":                                                                                                         "BSD-4-Clause",
 	"github.com/kfish/xsel/blob/master/COPYING":                                                                                                                           "HPND-sell-variant",
 	"github.com/kohler/t1utils/blob/master/LICENSE":                                                                                                                       "MIT-Click",
-	"github.com/krb5/krb5/blob/kfw-4.0.1-beta1/src/lib/crypto/builtin/aes/aesopt.h":                                                                                       "Brian-Gladman-3-Clause-no-conversion",
 	"github.com/krb5/krb5/blob/krb5-1.21.2-final/NOTICE#L111-L133":                                                                                                        "HPND-export2-US",
 	"github.com/krb5/krb5/blob/krb5-1.21.2-final/NOTICE#L1157-L1182":                                                                                                      "HPND-export-US-modify",
 	"github.com/krb5/krb5/blob/krb5-1.21.2-final/NOTICE#L140-L156":                                                                                                        "Brian-Gladman-2-Clause",
@@ -1827,7 +1793,6 @@ var urlToLicense = map[string]string{
 	"github.com/krb5/krb5/blob/krb5-1.21.2-final/NOTICE#L831-L852":                                                                                                        "HPND-export-US-acknowledgement",
 	"github.com/krzyzanowskim/CryptoSwift/blob/main/LICENSE":                                                                                                              "CryptoSwift",
 	"github.com/lattera/freebsd/blob/master/sys/cam/cam.c#L4":                                                                                                             "BSD-Source-beginning-file",
-	"github.com/libarchive/libarchive/blob/master/libarchive_fe/line_reader.c":                                                                                            "BSD-2-Clause-pos-unchanged",
 	"github.com/libcheck/check/blob/master/checkmk/checkmk.in":                                                                                                            "checkmk",
 	"github.com/libjpeg-turbo/libjpeg-turbo/blob/main/README.ijg#L117-L161":                                                                                               "IJG",
 	"github.com/lsof-org/lsof/blob/master/COPYING":                                                                                                                        "lsof",
@@ -1840,7 +1805,6 @@ var urlToLicense = map[string]string{
 	"github.com/mm2/Little-CMS/blob/master/src/cmssm.c#L207":                                                                                                              "softSurfer",
 	"github.com/mruby/mruby/blob/83d12f8d52522cdb7c8cc46fad34821359f453e6/mrbgems/mruby-dir/src/Win/dirent.c#L127-L140":                                                   "HPND-Kevlin-Henney",
 	"github.com/mtoyoda/sl/blob/master/LICENSE":                                                                                                                           "SL",
-	"github.com/mvt-project/mvt/blob/main/LICENSE":                                                                                                                        "MVT-1.1",
 	"github.com/n8n-io/n8n/blob/master/LICENSE.md":                                                                                                                        "SUL-1.0",
 	"github.com/ncbi/datasets/blob/0ea4cd16b61e5b799d9cc55aecfa016d6c9bd2bf/LICENSE.md":                                                                                   "NCBI-PD",
 	"github.com/ncbi/datasets/blob/master/LICENSE.md":                                                                                                                     "NCBI-PD",
@@ -1851,7 +1815,6 @@ var urlToLicense = map[string]string{
 	"github.com/novnc/noVNC/blob/master/core/crypto/des.js#L24":                                                                                                           "Widget-Workshop",
 	"github.com/oetiker/rrdtool-1.x/blob/master/src/plbasename.c#L8-L11":                                                                                                  "gtkbook",
 	"github.com/open-quantum-safe/liboqs/blob/40b01fdbb270f8614fde30e65d30e9da18c02393/src/common/rand/rand_nist.c#L1-L15":                                                "NIST-Software",
-	"github.com/open-webui/open-webui/blob/main/LICENSE":                                                                                                                  "BSD-3-Clause-OpenWebUI",
 	"github.com/openjdk/jdk/blob/6162e2c5213c5dd7c1127fd9616b543efa898962/LICENSE":                                                                                        "GPL-2.0-or-later",
 	"github.com/openssh/openssh-portable/blob/1b11ea7c58cd5c59838b5fa574cd456d6047b2d4/LICENCE#L10":                                                                       "SSH-OpenSSH",
 	"github.com/openssh/openssh-portable/blob/1b11ea7c58cd5c59838b5fa574cd456d6047b2d4/pathnames.h":                                                                       "SSH-short",
@@ -1883,7 +1846,6 @@ var urlToLicense = map[string]string{
 	"github.com/sigmavirus24/x11-ssh-askpass/blob/master/dynlist.c":                                                                                                       "HPND-sell-variant-MIT-disclaimer-rev",
 	"github.com/signal11/hidapi/blob/master/LICENSE-orig.txt":                                                                                                             "HIDAPI",
 	"github.com/slogan621/gtkbook":                                                                                                                                        "gtkbook",
-	"github.com/sudo-project/sudo/blob/c1307ea9ff340ce0538779f8e456501461fc44b7/plugins/sudoers/redblack.c#L24-L43":                                                       "BSD-ask-to-endorse",
 	"github.com/swh/ladspa/blob/7bf6f3799fdba70fda297c2d8fd9f526803d9680/gsm/COPYRIGHT":                                                                                   "TU-Berlin-1.0",
 	"github.com/tats/w3m/blob/master/COPYING":                                                                                                                             "w3m",
 	"github.com/tcheneau/Routing/blob/f09f46fcfe636107f22f2c98348188a65a135d98/README.md":                                                                                 "NIST-PD",
@@ -1894,7 +1856,6 @@ var urlToLicense = map[string]string{
 	"github.com/uim/libgcroots/blob/master/COPYING":                                                                                                                       "Boehm-GC",
 	"github.com/usnistgov/fipy/blob/86aaa5c2ba2c6f1be19593c5986071cf6568cc34/LICENSE.rst":                                                                                 "NIST-PD-fallback",
 	"github.com/usnistgov/jsip/blob/59700e6926cbe96c5cdae897d9a7d2656b42abe3/LICENSE":                                                                                     "NIST-PD-fallback",
-	"github.com/vattam/BSDGames/blob/master/atc/extern.c#L36":                                                                                                             "atc-game",
 	"github.com/vixie/cron/tree/545b3f5246824a9cda5905eeb7cf019c95e66995":                                                                                                 "Vixie-Cron",
 	"github.com/vstroebel/jpeg-encoder/blob/main/src/fdct.rs#L1-L72":                                                                                                      "IJG",
 	"github.com/wernerd/ZRTPCPP/blob/6b3cd8e6783642292bad0c21e3e5e5ce45ff3e03/cryptcommon/twofish.c#L113C3-L127":                                                          "Ferguson-Twofish",
@@ -1908,7 +1869,6 @@ var urlToLicense = map[string]string{
 	"gitlab.com/embeddable-common-lisp/ecl/-/blob/develop/src/lsp/loop.lsp":                                                                                               "LOOP",
 	"gitlab.com/libeigen/eigen/-/blob/master/COPYING.MINPACK":                                                                                                             "Minpack",
 	"gitlab.common-lisp.net/cmucl/cmucl/-/blob/master/src/code/loop.lisp":                                                                                                 "LOOP",
-	"gitlab.freedesktop.org/dbus/dbus/-/blob/789d97ad53044f94351a958e785c2923643b346a/COPYING#L11-207":                                                                    "AFL-2.1",
 	"gitlab.freedesktop.org/freetype/freetype/-/raw/master/docs/FTL.TXT":                                                                                                  "FTL",
 	"gitlab.freedesktop.org/libopenraw/libopenraw/blob/master/lib/ljpegdecompressor.cpp#L32":                                                                              "Cornell-Lossless-JPEG",
 	"gitlab.freedesktop.org/mesa/glw/-/blob/master/README?ref_type=heads":                                                                                                 "SGI-OpenGL",
@@ -1932,7 +1892,6 @@ var urlToLicense = map[string]string{
 	"gitlab.freedesktop.org/xorg/lib/libxinerama/-/blob/cc22c2f60c3862482562955116d5455263b443dc/COPYING#L44-66":                                                          "X11-no-permit-persons",
 	"gitlab.freedesktop.org/xorg/lib/libxtst/-/blob/master/COPYING?ref_type=heads#L108-117":                                                                               "HPND-doc-sell",
 	"gitlab.freedesktop.org/xorg/lib/libxtst/-/blob/master/COPYING?ref_type=heads#L70-77":                                                                                 "HPND-doc",
-	"gitlab.freedesktop.org/xorg/xserver/-/blob/dd5c2595a42d3ff0c4f18d9b53d1f6c3fd934fd4/COPYING#L365-389":                                                                "MIT",
 	"gitlab.freedesktop.org/xorg/xserver/-/blob/master/COPYING?ref_type=heads#L1781":                                                                                      "HPND-sell-MIT-disclaimer-xserver",
 	"gitlab.freedesktop.org/xorg/xserver/-/blob/master/COPYING?ref_type=heads#L239":                                                                                       "DEC-3-Clause",
 	"gitlab.freedesktop.org/xorg/xserver/-/blob/master/COPYING?ref_type=heads#L752":                                                                                       "Adobe-Display-PostScript",
@@ -1947,7 +1906,6 @@ var urlToLicense = map[string]string{
 	"heasarc.gsfc.nasa.gov/docs/software/ftools/fv/doc/license.html":                                                                                                      "CFITSIO",
 	"helixcommunity.org/content/rpsl":                                                                                                                                     "RPSL-1.0",
 	"hstechdocs.helpsystems.com/manuals/globalscape/archive/cuteftp6/open_ssl_license_agreement.htm":                                                                      "OpenSSL-standalone",
-	"interoperable-europe.ec.europa.eu/sites/default/files/inline-files/EUPL%20v1_2%20EN(1).txt":                                                                          "EUPL-1.2",
 	"java.net/projects/javaeetutorial/pages/BerkeleyLicense":                                                                                                              "BSD-3-Clause-No-Nuclear-License-2014",
 	"javaee.github.io/glassfish/LICENSE":                                                                                                                                  "CDDL-1.1",
 	"jogamp.org/git/?p=gluegen.git;a=blob_plain;f=LICENSE.txt":                                                                                                            "BSD-3-Clause-No-Nuclear-Warranty",
@@ -1966,7 +1924,6 @@ var urlToLicense = map[string]string{
 	"library.netapp.com/ecm/ecm_download_file/ECMP1196395":                                                                                                                "OpenSSL-standalone",
 	"license.coscl.org.cn/MulanPSL/":                                                                                                                                      "MulanPSL-1.0",
 	"license.coscl.org.cn/MulanPSL2":                                                                                                                                      "MulanPSL-2.0",
-	"license.mvt.re/1.1/":                                                                                                                                                 "MVT-1.1",
 	"lists.gnu.org/archive/html/autoconf/2012-04/msg00061.html":                                                                                                           "FSFULLRWD",
 	"lists.opensource.org/pipermail/license-discuss_lists.opensource.org/2002-November/006304.html":                                                                       "HPND",
 	"mariadb.com/bsl11/":                                                                                             "BUSL-1.1",
@@ -2008,105 +1965,99 @@ var urlToLicense = map[string]string{
 	"opensource.linux-mirror.org/licenses/afl-1.1.txt":                                                               "AFL-1.1",
 	"opensource.linux-mirror.org/licenses/afl-1.2.txt":                                                               "AFL-1.2",
 	"opensource.linux-mirror.org/licenses/afl-2.1.txt":                                                               "AFL-2.1",
-	"opensource.org/license/0BSD":                                                                                    "0BSD",
-	"opensource.org/license/AAL":                                                                                     "AAL",
-	"opensource.org/license/AFL-3.0":                                                                                 "AFL-3.0",
-	"opensource.org/license/AGPL-3.0":                                                                                "AGPL-3.0-or-later",
-	"opensource.org/license/AGPL-3.0-only":                                                                           "AGPL-3.0-only",
-	"opensource.org/license/APL-1.0":                                                                                 "APL-1.0",
-	"opensource.org/license/Artistic-1.0":                                                                            "Artistic-1.0-cl8",
-	"opensource.org/license/Artistic-2.0":                                                                            "Artistic-2.0",
-	"opensource.org/license/BSD-2-Clause":                                                                            "BSD-2-Clause",
-	"opensource.org/license/BSD-2-Clause-Patent":                                                                     "BSD-2-Clause-Patent",
-	"opensource.org/license/BSD-3-Clause":                                                                            "BSD-3-Clause",
-	"opensource.org/license/BSL-1.0":                                                                                 "BSL-1.0",
-	"opensource.org/license/CAL-1.0":                                                                                 "CAL-1.0-Combined-Work-Exception",
-	"opensource.org/license/CATOSL-1.1":                                                                              "CATOSL-1.1",
-	"opensource.org/license/CDDL-1.0":                                                                                "CDDL-1.0",
-	"opensource.org/license/CNRI-Python":                                                                             "CNRI-Python",
-	"opensource.org/license/CNRI-Python-GPL-Compatible":                                                              "CNRI-Python-GPL-Compatible",
-	"opensource.org/license/CPAL-1.0":                                                                                "CPAL-1.0",
-	"opensource.org/license/CPL-1.0":                                                                                 "CPL-1.0",
-	"opensource.org/license/CUA-OPL-1.0":                                                                             "CUA-OPL-1.0",
-	"opensource.org/license/ECL-1.0":                                                                                 "ECL-1.0",
-	"opensource.org/license/ECL-2.0":                                                                                 "ECL-2.0",
-	"opensource.org/license/EFL-1.0":                                                                                 "EFL-1.0",
-	"opensource.org/license/EFL-2.0":                                                                                 "EFL-2.0",
-	"opensource.org/license/EPL-1.0":                                                                                 "EPL-1.0",
-	"opensource.org/license/EUDatagrid":                                                                              "EUDatagrid",
-	"opensource.org/license/EUPL-1.1":                                                                                "EUPL-1.1",
-	"opensource.org/license/EUPL-1.2":                                                                                "EUPL-1.2",
-	"opensource.org/license/Entessa":                                                                                 "Entessa",
-	"opensource.org/license/Fair":                                                                                    "Fair",
-	"opensource.org/license/Frameworx-1.0":                                                                           "Frameworx-1.0",
-	"opensource.org/license/GPL-2.0":                                                                                 "GPL-2.0-or-later",
-	"opensource.org/license/GPL-2.0-only":                                                                            "GPL-2.0-only",
-	"opensource.org/license/GPL-3.0":                                                                                 "GPL-3.0-or-later",
-	"opensource.org/license/GPL-3.0-only":                                                                            "GPL-3.0-only",
-	"opensource.org/license/HPND":                                                                                    "HPND",
-	"opensource.org/license/IPA":                                                                                     "IPA",
-	"opensource.org/license/IPL-1.0":                                                                                 "IPL-1.0",
-	"opensource.org/license/ISC":                                                                                     "ISC",
-	"opensource.org/license/Intel":                                                                                   "Intel",
-	"opensource.org/license/LGPL-2.1":                                                                                "LGPL-2.1-or-later",
-	"opensource.org/license/LGPL-2.1-only":                                                                           "LGPL-2.1-only",
-	"opensource.org/license/LGPL-3.0":                                                                                "LGPL-3.0-or-later",
-	"opensource.org/license/LPL-1.0":                                                                                 "LPL-1.0",
-	"opensource.org/license/LPL-1.02":                                                                                "LPL-1.02",
-	"opensource.org/license/LPPL-1.3c":                                                                               "LPPL-1.3c",
-	"opensource.org/license/LiLiQ-P-1.1":                                                                             "LiLiQ-P-1.1",
-	"opensource.org/license/LiLiQ-R-1.1":                                                                             "LiLiQ-R-1.1",
-	"opensource.org/license/LiLiQ-Rplus-1.1":                                                                         "LiLiQ-Rplus-1.1",
-	"opensource.org/license/MIT":                                                                                     "MIT",
-	"opensource.org/license/MPL-1.0":                                                                                 "MPL-1.0",
-	"opensource.org/license/MPL-1.1":                                                                                 "MPL-1.1",
-	"opensource.org/license/MPL-2.0":                                                                                 "MPL-2.0-no-copyleft-exception",
-	"opensource.org/license/MS-PL":                                                                                   "MS-PL",
-	"opensource.org/license/MS-RL":                                                                                   "MS-RL",
-	"opensource.org/license/MirOS":                                                                                   "MirOS",
-	"opensource.org/license/Motosoto":                                                                                "Motosoto",
-	"opensource.org/license/Multics":                                                                                 "Multics",
-	"opensource.org/license/NASA-1.3":                                                                                "NASA-1.3",
-	"opensource.org/license/NCSA":                                                                                    "NCSA",
-	"opensource.org/license/NGPL":                                                                                    "NGPL",
-	"opensource.org/license/NPOSL-3.0":                                                                               "NPOSL-3.0",
-	"opensource.org/license/NTP":                                                                                     "NTP",
-	"opensource.org/license/Naumen":                                                                                  "Naumen",
-	"opensource.org/license/Nokia":                                                                                   "Nokia",
-	"opensource.org/license/OCLC-2.0":                                                                                "OCLC-2.0",
-	"opensource.org/license/OFL-1.1":                                                                                 "OFL-1.1-no-RFN",
-	"opensource.org/license/OGTSL":                                                                                   "OGTSL",
-	"opensource.org/license/OLFL-1.3":                                                                                "OLFL-1.3",
-	"opensource.org/license/OSC-1.0":                                                                                 "OSC-1.0",
-	"opensource.org/license/OSET-PL-2.1":                                                                             "OSET-PL-2.1",
-	"opensource.org/license/OSL-1.0":                                                                                 "OSL-1.0",
-	"opensource.org/license/OSL-2.1":                                                                                 "OSL-2.1",
-	"opensource.org/license/OSL-3.0":                                                                                 "OSL-3.0",
-	"opensource.org/license/PHP-3.0":                                                                                 "PHP-3.0",
-	"opensource.org/license/PSF-2-0":                                                                                 "PSF-2.0",
-	"opensource.org/license/PostgreSQL":                                                                              "PostgreSQL",
-	"opensource.org/license/Python-2.0":                                                                              "Python-2.0",
-	"opensource.org/license/Python-2.0.1":                                                                            "Python-2.0.1",
-	"opensource.org/license/QPL-1.0":                                                                                 "QPL-1.0",
-	"opensource.org/license/RPL-1.1":                                                                                 "RPL-1.1",
-	"opensource.org/license/RPL-1.5":                                                                                 "RPL-1.5",
-	"opensource.org/license/RPSL-1.0":                                                                                "RPSL-1.0",
-	"opensource.org/license/RSCPL":                                                                                   "RSCPL",
-	"opensource.org/license/SISSL":                                                                                   "SISSL",
-	"opensource.org/license/SPL-1.0":                                                                                 "SPL-1.0",
-	"opensource.org/license/SiMPL-2.0":                                                                               "SimPL-2.0",
-	"opensource.org/license/Sleepycat":                                                                               "Sleepycat",
-	"opensource.org/license/UCL-1.0":                                                                                 "UCL-1.0",
-	"opensource.org/license/UPL-1.0":                                                                                 "UPL-1.0",
-	"opensource.org/license/VSL-1.0":                                                                                 "VSL-1.0",
-	"opensource.org/license/W3C":                                                                                     "W3C",
-	"opensource.org/license/Watcom-1.0":                                                                              "Watcom-1.0",
-	"opensource.org/license/Xnet":                                                                                    "Xnet",
-	"opensource.org/license/ZPL-2.0":                                                                                 "ZPL-2.0",
-	"opensource.org/license/Zlib":                                                                                    "Zlib",
-	"opensource.org/license/apache-1.1":                                                                              "Apache-1.1",
-	"opensource.org/license/apache-2.0":                                                                              "Apache-2.0",
-	"opensource.org/license/curl":                                                                                    "curl",
+	"opensource.org/license/apache-2-0":                                                                              "Apache-2.0",
+	"opensource.org/license/mit/":                                                                                    "MIT",
+	"opensource.org/license/olfl-1-3/":                                                                               "OLFL-1.3",
+	"opensource.org/license/osc-license-1-0":                                                                         "OSC-1.0",
+	"opensource.org/licenses/0BSD":                                                                                   "0BSD",
+	"opensource.org/licenses/AGPL-3.0":                                                                               "AGPL-3.0-or-later",
+	"opensource.org/licenses/APL-1.0":                                                                                "APL-1.0",
+	"opensource.org/licenses/Apache-1.1":                                                                             "Apache-1.1",
+	"opensource.org/licenses/Apache-2.0":                                                                             "Apache-2.0",
+	"opensource.org/licenses/Artistic-1.0":                                                                           "Artistic-1.0-cl8",
+	"opensource.org/licenses/BSD-2-Clause":                                                                           "BSD-2-Clause",
+	"opensource.org/licenses/BSD-3-Clause":                                                                           "BSD-3-Clause",
+	"opensource.org/licenses/BSDplusPatent":                                                                          "BSD-2-Clause-Patent",
+	"opensource.org/licenses/BSL-1.0":                                                                                "BSL-1.0",
+	"opensource.org/licenses/CAL-1.0":                                                                                "CAL-1.0-Combined-Work-Exception",
+	"opensource.org/licenses/CATOSL-1.1":                                                                             "CATOSL-1.1",
+	"opensource.org/licenses/CNRI-Python":                                                                            "CNRI-Python",
+	"opensource.org/licenses/CPAL-1.0":                                                                               "CPAL-1.0",
+	"opensource.org/licenses/CPL-1.0":                                                                                "CPL-1.0",
+	"opensource.org/licenses/CUA-OPL-1.0":                                                                            "CUA-OPL-1.0",
+	"opensource.org/licenses/ECL-1.0":                                                                                "ECL-1.0",
+	"opensource.org/licenses/ECL-2.0":                                                                                "ECL-2.0",
+	"opensource.org/licenses/EFL-1.0":                                                                                "EFL-1.0",
+	"opensource.org/licenses/EFL-2.0":                                                                                "EFL-2.0",
+	"opensource.org/licenses/EPL-1.0":                                                                                "EPL-1.0",
+	"opensource.org/licenses/EUDatagrid":                                                                             "EUDatagrid",
+	"opensource.org/licenses/EUPL-1.1":                                                                               "EUPL-1.1",
+	"opensource.org/licenses/EUPL-1.2":                                                                               "EUPL-1.2",
+	"opensource.org/licenses/Entessa":                                                                                "Entessa",
+	"opensource.org/licenses/Fair":                                                                                   "Fair",
+	"opensource.org/licenses/Frameworx-1.0":                                                                          "Frameworx-1.0",
+	"opensource.org/licenses/GPL-2.0":                                                                                "GPL-2.0-or-later",
+	"opensource.org/licenses/GPL-3.0":                                                                                "GPL-3.0-or-later",
+	"opensource.org/licenses/HPND":                                                                                   "HPND",
+	"opensource.org/licenses/IPA":                                                                                    "IPA",
+	"opensource.org/licenses/IPL-1.0":                                                                                "IPL-1.0",
+	"opensource.org/licenses/ISC":                                                                                    "ISC",
+	"opensource.org/licenses/Intel":                                                                                  "Intel",
+	"opensource.org/licenses/LGPL-2.1":                                                                               "LGPL-2.1-or-later",
+	"opensource.org/licenses/LGPL-3.0":                                                                               "LGPL-3.0-or-later",
+	"opensource.org/licenses/LPL-1.0":                                                                                "LPL-1.0",
+	"opensource.org/licenses/LPL-1.02":                                                                               "LPL-1.02",
+	"opensource.org/licenses/LPPL-1.3c":                                                                              "LPPL-1.3c",
+	"opensource.org/licenses/LiLiQ-P-1.1":                                                                            "LiLiQ-P-1.1",
+	"opensource.org/licenses/LiLiQ-R-1.1":                                                                            "LiLiQ-R-1.1",
+	"opensource.org/licenses/LiLiQ-Rplus-1.1":                                                                        "LiLiQ-Rplus-1.1",
+	"opensource.org/licenses/MIT":                                                                                    "MIT",
+	"opensource.org/licenses/MPL-1.0":                                                                                "MPL-1.0",
+	"opensource.org/licenses/MPL-1.1":                                                                                "MPL-1.1",
+	"opensource.org/licenses/MPL-2.0":                                                                                "MPL-2.0-no-copyleft-exception",
+	"opensource.org/licenses/MS-PL":                                                                                  "MS-PL",
+	"opensource.org/licenses/MS-RL":                                                                                  "MS-RL",
+	"opensource.org/licenses/MirOS":                                                                                  "MirOS",
+	"opensource.org/licenses/Motosoto":                                                                               "Motosoto",
+	"opensource.org/licenses/Multics":                                                                                "Multics",
+	"opensource.org/licenses/NASA-1.3":                                                                               "NASA-1.3",
+	"opensource.org/licenses/NCSA":                                                                                   "NCSA",
+	"opensource.org/licenses/NGPL":                                                                                   "NGPL",
+	"opensource.org/licenses/NOSL3.0":                                                                                "NPOSL-3.0",
+	"opensource.org/licenses/NTP":                                                                                    "NTP",
+	"opensource.org/licenses/Naumen":                                                                                 "Naumen",
+	"opensource.org/licenses/OCLC-2.0":                                                                               "OCLC-2.0",
+	"opensource.org/licenses/OFL-1.1":                                                                                "OFL-1.1-no-RFN",
+	"opensource.org/licenses/OGTSL":                                                                                  "OGTSL",
+	"opensource.org/licenses/OPL-2.1":                                                                                "OSET-PL-2.1",
+	"opensource.org/licenses/OSL-1.0":                                                                                "OSL-1.0",
+	"opensource.org/licenses/OSL-2.1":                                                                                "OSL-2.1",
+	"opensource.org/licenses/OSL-3.0":                                                                                "OSL-3.0",
+	"opensource.org/licenses/PHP-3.0":                                                                                "PHP-3.0",
+	"opensource.org/licenses/PostgreSQL":                                                                             "PostgreSQL",
+	"opensource.org/licenses/Python-2.0":                                                                             "Python-2.0",
+	"opensource.org/licenses/QPL-1.0":                                                                                "QPL-1.0",
+	"opensource.org/licenses/RPL-1.1":                                                                                "RPL-1.1",
+	"opensource.org/licenses/RPL-1.5":                                                                                "RPL-1.5",
+	"opensource.org/licenses/RPSL-1.0":                                                                               "RPSL-1.0",
+	"opensource.org/licenses/RSCPL":                                                                                  "RSCPL",
+	"opensource.org/licenses/SISSL":                                                                                  "SISSL",
+	"opensource.org/licenses/SPL-1.0":                                                                                "SPL-1.0",
+	"opensource.org/licenses/SimPL-2.0":                                                                              "SimPL-2.0",
+	"opensource.org/licenses/Sleepycat":                                                                              "Sleepycat",
+	"opensource.org/licenses/UCL-1.0":                                                                                "UCL-1.0",
+	"opensource.org/licenses/UPL":                                                                                    "UPL-1.0",
+	"opensource.org/licenses/VSL-1.0":                                                                                "VSL-1.0",
+	"opensource.org/licenses/W3C":                                                                                    "W3C",
+	"opensource.org/licenses/Watcom-1.0":                                                                             "Watcom-1.0",
+	"opensource.org/licenses/Xnet":                                                                                   "Xnet",
+	"opensource.org/licenses/ZPL-2.0":                                                                                "ZPL-2.0",
+	"opensource.org/licenses/Zlib":                                                                                   "Zlib",
+	"opensource.org/licenses/afl-3.0":                                                                                "AFL-3.0",
+	"opensource.org/licenses/artistic-license-2.0":                                                                   "Artistic-2.0",
+	"opensource.org/licenses/attribution":                                                                            "AAL",
+	"opensource.org/licenses/cddl1":                                                                                  "CDDL-1.0",
+	"opensource.org/licenses/nokia":                                                                                  "Nokia",
 	"oss.sgi.com/projects/FreeB/":                                                                                    "SGI-B-1.1",
 	"oss.sgi.com/projects/FreeB/SGIFreeSWLicB.1.0.html":                                                              "SGI-B-1.0",
 	"oss.sgi.com/projects/FreeB/SGIFreeSWLicB.2.0.pdf":                                                               "SGI-B-2.0",
@@ -2131,40 +2082,37 @@ var urlToLicense = map[string]string{
 	"raw.githubusercontent.com/NTIA/scos-sensor/refs/heads/master/LICENSE.md":                                        "NTIA-PD",
 	"raw.githubusercontent.com/OpenMDW/OpenMDW/refs/heads/main/1.0/LICENSE.openmdw":                                  "OpenMDW-1.0",
 	"raw.githubusercontent.com/blackhole89/notekit/master/data/fonts/Charter%20license.txt":                          "Bitstream-Charter",
-	"raw.githubusercontent.com/landtuna/open-mtools/6c04c2882eca7c4313ec267766ea53ac9bfe129b/mdump.c": "Informatica",
-	"raw.githubusercontent.com/landtuna/open-mtools/6c04c2882eca7c4313ec267766ea53ac9bfe129b/msend.c": "Informatica",
-	"rc.quest.com/topics/openssh/license.php#tcpwrappers":                                             "TCP-wrappers",
-	"research.cs.wisc.edu/condor/license.html#condor":                                                 "Condor-1.1",
-	"research.scea.com/scea_shared_source_license.html":                                               "SCEA",
-	"romanrm.net/mit-zero":                                                                                                                       "MIT-0",
-	"sam.zoy.org/wtfpl/COPYING":                                                                                                                  "WTFPL",
-	"scancode-licensedb.aboutcode.org/bsd-unchanged":                                                                                             "BSD-2-Clause-pos-unchanged",
-	"scripts.sil.org/cms/scripts/page.php?item_id=OFL10_web":                                                                                     "OFL-1.0-no-RFN",
-	"scripts.sil.org/cms/scripts/page.php?item_id=OFL_web":                                                                                       "OFL-1.1-no-RFN",
-	"slicer.org/LICENSE":                                                                                                                         "3D-Slicer-1.0",
-	"solderpad.org/licenses/SHL-0.5/":                                                                                                            "SHL-0.5",
-	"solderpad.org/licenses/SHL-0.51/":                                                                                                           "SHL-0.51",
-	"source.icu-project.org/repos/icu/icu/trunk/license.html":                                                                                    "ICU",
-	"sourceforge.net/p/buddy/gitcode/ci/master/tree/README":                                                                                      "Buddy",
-	"sourceforge.net/p/ctrio/git/ci/master/tree/README":                                                                                          "ISC-Veillard",
-	"sourceforge.net/p/mcj/xfig/ci/master/tree/src/Makefile.am":                                                                                  "Xfig",
-	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/converter/other/pnmtorle.c":                                                            "URT-RLE",
-	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/converter/other/rletopnm.c":                                                            "URT-RLE",
-	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/converter/ppm/ppmtompeg/jrevdct.c#l1189":                                               "MPEG-SSG",
-	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/editor/pnmstitch.c#l2":                                                                 "pnmstitch",
-	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/netpbm.c#l8":                                                                           "HPND-Pbmplus",
-	"sourceforge.net/p/sbcl/sbcl/ci/master/tree/src/code/loop.lisp":                                                                              "LOOP",
-	"sourceforge.net/p/trustedqsl/tqsl/ci/master/tree/LICENSE.txt":                                                                               "TrustedQSL",
-	"sourceforge.net/p/xmedcon/code/ci/master/tree/libs/dicom/README":                                                                            "OFFIS",
-	"sourceforge.net/p/xmedcon/code/ci/master/tree/libs/ljpg/":                                                                                   "IJG-short",
-	"sourceforge.net/projects/sevenzip/files/LZMA%20SDK/":                                                                                        "LZMA-SDK-9.22",
-	"sources.debian.org/copyright/license/debianutils/4.11.2/":                                                                                   "SMAIL-GPL",
-	"sources.debian.org/src/openmpi/4.1.0-10/ompi/debuggers/msgq_interface.h/?hl=19#L19":                                                         "mpi-permissive",
-	"sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/licenses/BitTorrent?r1=1.1&r2=1.1.1.1&diff_format=s":                                       "BitTorrent-1.0",
-	"sourceware.org/bzip2/1.0.5/bzip2-manual-1.0.5.html":                                                                                         "bzip2-1.0.6",
-	"sourceware.org/cgit/binutils-gdb/tree/include/coff/sym.h#n11":                                                                               "MIPS",
-	"sourceware.org/cgit/binutils-gdb/tree/include/coff/symconst.h#n11":                                                                          "ThirdEye",
-	"sourceware.org/cgit/valgrind/tree/mpi/libmpiwrap.c":                                                                                         "bzip2-1.0.6",
+	"rc.quest.com/topics/openssh/license.php#tcpwrappers":                                                            "TCP-wrappers",
+	"research.cs.wisc.edu/condor/license.html#condor":                                                                "Condor-1.1",
+	"research.scea.com/scea_shared_source_license.html":                                                              "SCEA",
+	"romanrm.net/mit-zero":                                                                                           "MIT-0",
+	"sam.zoy.org/wtfpl/COPYING":                                                                                      "WTFPL",
+	"scripts.sil.org/cms/scripts/page.php?item_id=OFL10_web":                                                         "OFL-1.0-no-RFN",
+	"scripts.sil.org/cms/scripts/page.php?item_id=OFL_web":                                                           "OFL-1.1-no-RFN",
+	"slicer.org/LICENSE":                                                                                             "3D-Slicer-1.0",
+	"solderpad.org/licenses/SHL-0.5/":                                                                                "SHL-0.5",
+	"solderpad.org/licenses/SHL-0.51/":                                                                               "SHL-0.51",
+	"source.icu-project.org/repos/icu/icu/trunk/license.html":                                                        "ICU",
+	"sourceforge.net/p/buddy/gitcode/ci/master/tree/README":                                                          "Buddy",
+	"sourceforge.net/p/ctrio/git/ci/master/tree/README":                                                              "ISC-Veillard",
+	"sourceforge.net/p/mcj/xfig/ci/master/tree/src/Makefile.am":                                                      "Xfig",
+	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/converter/other/pnmtorle.c":                                "URT-RLE",
+	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/converter/other/rletopnm.c":                                "URT-RLE",
+	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/converter/ppm/ppmtompeg/jrevdct.c#l1189":                   "MPEG-SSG",
+	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/editor/pnmstitch.c#l2":                                     "pnmstitch",
+	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/netpbm.c#l8":                                               "HPND-Pbmplus",
+	"sourceforge.net/p/sbcl/sbcl/ci/master/tree/src/code/loop.lisp":                                                  "LOOP",
+	"sourceforge.net/p/trustedqsl/tqsl/ci/master/tree/LICENSE.txt":                                                   "TrustedQSL",
+	"sourceforge.net/p/xmedcon/code/ci/master/tree/libs/dicom/README":                                                "OFFIS",
+	"sourceforge.net/p/xmedcon/code/ci/master/tree/libs/ljpg/":                                                       "IJG-short",
+	"sourceforge.net/projects/sevenzip/files/LZMA%20SDK/":                                                            "LZMA-SDK-9.22",
+	"sources.debian.org/copyright/license/debianutils/4.11.2/":                                                       "SMAIL-GPL",
+	"sources.debian.org/src/openmpi/4.1.0-10/ompi/debuggers/msgq_interface.h/?hl=19#L19":                             "mpi-permissive",
+	"sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/licenses/BitTorrent?r1=1.1&r2=1.1.1.1&diff_format=s":           "BitTorrent-1.0",
+	"sourceware.org/bzip2/1.0.5/bzip2-manual-1.0.5.html":                                                             "bzip2-1.0.6",
+	"sourceware.org/cgit/binutils-gdb/tree/include/coff/sym.h#n11":                                                   "MIPS",
+	"sourceware.org/cgit/binutils-gdb/tree/include/coff/symconst.h#n11":                                              "ThirdEye",
+	"sourceware.org/cgit/valgrind/tree/mpi/libmpiwrap.c":                                                             "bzip2-1.0.6",
 	"sourceware.org/git/?p=binutils-gdb.git;a=blob;f=libiberty/strcasecmp.c;h=131d81c2ce7881fa48c363dc5bf5fb302c61ce0b;hb=HEAD":                  "BSD-4.3RENO",
 	"sourceware.org/git/?p=binutils-gdb.git;a=blob;f=readline/readline/support/wcwidth.c;h=0f5ec995796f4813abbcf4972aec0378ab74722a;hb=HEAD#l55": "HPND-Markus-Kuhn",
 	"sourceware.org/git/?p=bzip2.git;a=blob;f=LICENSE;hb=bzip2-1.0.6":                                                                            "bzip2-1.0.6",
@@ -2181,7 +2129,6 @@ var urlToLicense = map[string]string{
 	"tahoe-lafs.org/trac/tahoe-lafs/browser/trunk/COPYING.TGPPL.rst":                                                      "TGPPL-1.0",
 	"ti.arc.nasa.gov/opensource/nosa/":                                                                                    "NASA-1.3",
 	"trac.enlightenment.org/e/browser/trunk/imlib2/COPYING":                                                               "Imlib2",
-	"tunes.org/legalese/bugroff.html":                                                                                     "Bugroff",
 	"ubuntu.com/legal/font-licence":                                                                                       "Ubuntu-font-1.0",
 	"unlicense.org/":                                                                                                      "Unlicense",
 	"vimdoc.sourceforge.net/htmldoc/uganda.html":                                                                          "Vim",
@@ -2192,7 +2139,6 @@ var urlToLicense = map[string]string{
 	"web.archive.org/web/20041020171434/http://www.rosenlaw.com/osl2.0.html":                                              "OSL-2.0",
 	"web.archive.org/web/20050212003940/http://www.rosenlaw.com/osl21.htm":                                                "OSL-2.1",
 	"web.archive.org/web/20060319014854/http://info.borland.com/devsupport/interbase/opensource/IPL.html":                 "Interbase-1.0",
-	"web.archive.org/web/20061013013632/http://opensource.linux-mirror.org/licenses/afl-2.1.txt":                          "AFL-2.1",
 	"web.archive.org/web/20080207013128/http://www.gnome.org/fonts/":                                                      "Bitstream-Vera",
 	"web.archive.org/web/20100302225219/http://www.zimbra.com/license/zimbra-public-license-1-3.html":                     "Zimbra-1.3",
 	"web.archive.org/web/20111123062036/http://research.cs.wisc.edu/condor/license.html#condor":                           "Condor-1.1",
@@ -2297,11 +2243,11 @@ var urlToLicense = map[string]string{
 	"www.jython.org/license.html":                                                         "CNRI-Jython",
 	"www.kermitproject.org/ck90.html#source":                                              "HPND-export-US",
 	"www.kernel.org/doc/man-pages/licenses.html":                                          "Linux-man-pages-copyleft",
-	"www.latex-project.org/lppl/LPPL-1.3c.txt":                                            "LPPL-1.3c",
 	"www.latex-project.org/lppl/lppl-1-0.txt":                                             "LPPL-1.0",
 	"www.latex-project.org/lppl/lppl-1-1.txt":                                             "LPPL-1.1",
 	"www.latex-project.org/lppl/lppl-1-2.txt":                                             "LPPL-1.2",
 	"www.latex-project.org/lppl/lppl-1-3a.txt":                                            "LPPL-1.3a",
+	"www.latex-project.org/lppl/lppl-1-3c.txt":                                            "LPPL-1.3c",
 	"www.lemis.com/grog/UNIX/ancient-source-all.pdf":                                      "Caldera",
 	"www.libpng.org/pub/png/src/libpng-LICENSE.txt":                                       "libpng-2.0",
 	"www.mail-archive.com/debian-bugs-rc@lists.debian.org/msg11494.html":                  "Symlinks",
@@ -2323,17 +2269,16 @@ var urlToLicense = map[string]string{
 	"www.netlib.org/lapack/LICENSE.txt":                                                   "BSD-3-Clause-Open-MPI",
 	"www.netlib.org/minpack/disclaimer":                                                   "Minpack",
 	"www.networkcultures.org/_uploads/%233notebook_telekommunist.pdf":                     "PPL",
-	"www.nist.gov/open/copyright-fair-use-and-licensing-statements-srd-data-software-and-technical-series-publications": "NIST-Software",
-	"www.oclc.org/research/activities/software/license/v2final.htm":                                                     "OCLC-2.0",
-	"www.ogc.org/ogc/software/1.0":                                                                                  "OGC-1.0",
-	"www.ohwr.org/project/cernohl/wikis/Documents/CERN-OHL-version-2":                                               "CERN-OHL-W-2.0",
-	"www.ohwr.org/project/licenses/wikis/cern-ohl-v1.1":                                                             "CERN-OHL-1.1",
-	"www.ohwr.org/project/licenses/wikis/cern-ohl-v1.2":                                                             "CERN-OHL-1.2",
-	"www.open-mpi.org/community/license.php":                                                                        "BSD-3-Clause-Open-MPI",
-	"www.opencascade.com/content/occt-public-license":                                                               "OCCT-PL",
-	"www.opendatacommons.org/licenses/odbl/1.0/":                                                                    "ODbL-1.0",
-	"www.opengroup.org/testing/downloads/The_Open_Group_TSL.txt":                                                    "OGTSL",
-	"www.openhub.net/licenses/mslpl":                                                                                "MS-LPL",
+	"www.oclc.org/research/activities/software/license/v2final.htm":                       "OCLC-2.0",
+	"www.ogc.org/ogc/software/1.0":                                                        "OGC-1.0",
+	"www.ohwr.org/project/cernohl/wikis/Documents/CERN-OHL-version-2":                     "CERN-OHL-W-2.0",
+	"www.ohwr.org/project/licenses/wikis/cern-ohl-v1.1":                                   "CERN-OHL-1.1",
+	"www.ohwr.org/project/licenses/wikis/cern-ohl-v1.2":                                   "CERN-OHL-1.2",
+	"www.open-mpi.org/community/license.php":                                              "BSD-3-Clause-Open-MPI",
+	"www.opencascade.com/content/occt-public-license":                                     "OCCT-PL",
+	"www.opendatacommons.org/licenses/odbl/1.0/":                                          "ODbL-1.0",
+	"www.opengroup.org/testing/downloads/The_Open_Group_TSL.txt":                          "OGTSL",
+	"www.openhub.net/licenses/mslpl":                                                      "MS-LPL",
 	"www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=LICENSE;hb=1cae062821881f41b73012ba816434897abf4205": "OLDAP-2.6",
 	"www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=LICENSE;hb=37b4b3f6cc4bf34e1d3dec61e69914b9819d8894": "NBPL-1.0",
 	"www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=LICENSE;hb=42b0383c50c299977b5893ee695cf4e486fb0dc7": "OLDAP-1.2",
@@ -2356,7 +2301,7 @@ var urlToLicense = map[string]string{
 	"www.opensource.apple.com/license/apsl/":                                                             "APSL-2.0",
 	"www.opensource.apple.com/source/IOSerialFamily/IOSerialFamily-7/APPLE_LICENSE":                      "APSL-1.1",
 	"www.opensource.apple.com/source/tcl/tcl-5/tcl/generic/regfronts.c":                                  "Spencer-99",
-	"www.opensource.org/license/EPL-2.0":                                                                 "EPL-2.0",
+	"www.opensource.org/licenses/EPL-2.0":                                                                "EPL-2.0",
 	"www.openssl.org/source/license.html":                                                                "OpenSSL",
 	"www.osetfoundation.org/public-license":                                                              "OSET-PL-2.1",
 	"www.parliament.uk/site-information/copyright-parliament/open-parliament-licence/":                   "OPL-UK-3.0",

internal/spdxlicense/license_url_test.go

@@ -123,96 +123,6 @@ func TestLicenseByURL_AlternateScheme(t *testing.T) {
 	}
 }
 
-func TestLicenseByURL_OpenSourceOrgVariants(t *testing.T) {
-	// SPDX has changed the form of opensource.org URLs across list versions (e.g. 3.29.0 moved
-	// opensource.org/licenses/MIT to opensource.org/license/MIT); every form should keep resolving.
-	tests := []struct {
-		name   string
-		url    string
-		wantID string
-	}{
-		{name: "old plural path", url: "http://opensource.org/licenses/MIT", wantID: "MIT"},
-		{name: "new singular path", url: "https://opensource.org/license/MIT", wantID: "MIT"},
-		{name: "lowercase with trailing slash", url: "https://opensource.org/license/mit/", wantID: "MIT"},
-		{name: "plural path with trailing slash", url: "https://opensource.org/licenses/MIT/", wantID: "MIT"},
-		{name: "www prefix", url: "https://www.opensource.org/licenses/MIT", wantID: "MIT"},
-		{name: "uppercase host", url: "https://WWW.OpenSource.org/licenses/MIT", wantID: "MIT"},
-		{name: "old plural path BSD-3-Clause", url: "https://opensource.org/licenses/BSD-3-Clause", wantID: "BSD-3-Clause"},
-		{name: "new singular path BSD-3-Clause", url: "https://opensource.org/license/BSD-3-Clause", wantID: "BSD-3-Clause"},
-		{name: "lowercase BSD-3-Clause", url: "https://opensource.org/licenses/bsd-3-clause", wantID: "BSD-3-Clause"},
-		{name: "old plural path Apache-2.0", url: "http://opensource.org/licenses/Apache-2.0", wantID: "Apache-2.0"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			info, found := LicenseByURL(tt.url)
-			if !found {
-				t.Fatalf("LicenseByURL(%q) found = false, want true", tt.url)
-			}
-			if info.ID != tt.wantID {
-				t.Errorf("LicenseByURL(%q) ID = %v, want %v", tt.url, info.ID, tt.wantID)
-			}
-		})
-	}
-}
-
-func TestLicenseByURL_NonOpenSourceOrgStaysExact(t *testing.T) {
-	// the relaxed matching is scoped to opensource.org; other hosts may have case-sensitive paths
-	if _, found := LicenseByURL("https://www.apache.org/licenses/license-2.0"); found {
-		t.Errorf("LicenseByURL() found = true for case-altered non-opensource.org URL, want false")
-	}
-	if _, found := LicenseByURL("https://opensource.org/licenses/not-a-real-license"); found {
-		t.Errorf("LicenseByURL() found = true for unknown opensource.org URL, want false")
-	}
-}
-
-func TestNormalizeOpenSourceOrgURL(t *testing.T) {
-	tests := []struct {
-		url    string
-		want   string
-		wantOK bool
-	}{
-		{url: "opensource.org/licenses/MIT", want: "opensource.org/license/mit", wantOK: true},
-		{url: "opensource.org/license/mit/", want: "opensource.org/license/mit", wantOK: true},
-		{url: "www.opensource.org/licenses/EPL-2.0", want: "opensource.org/license/epl-2.0", wantOK: true},
-		{url: "lists.opensource.org/pipermail/license-discuss", wantOK: false},
-		{url: "www.apache.org/licenses/LICENSE-2.0", wantOK: false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.url, func(t *testing.T) {
-			got, ok := normalizeOpenSourceOrgURL(tt.url)
-			if ok != tt.wantOK {
-				t.Fatalf("normalizeOpenSourceOrgURL(%q) ok = %v, want %v", tt.url, ok, tt.wantOK)
-			}
-			if got != tt.want {
-				t.Errorf("normalizeOpenSourceOrgURL(%q) = %q, want %q", tt.url, got, tt.want)
-			}
-		})
-	}
-}
-
-func TestBuildOpenSourceOrgURLToLicense(t *testing.T) {
-	index := buildOpenSourceOrgURLToLicense(map[string]string{
-		"opensource.org/licenses/MIT": "MIT",
-		"opensource.org/license/mit/": "MIT",
-		"opensource.org/licenses/Foo": "Foo-1.0",
-		"opensource.org/license/foo":  "Foo-2.0",
-		"opensource.org/license/FOO/": "Foo-1.0",
-		"www.apache.org/licenses/Bar": "Bar",
-	})
-
-	if got := index["opensource.org/license/mit"]; got != "MIT" {
-		t.Errorf("index[mit] = %q, want MIT", got)
-	}
-	if got, exists := index["opensource.org/license/foo"]; exists {
-		t.Errorf("index[foo] = %q, want no entry for URL forms mapping to different licenses", got)
-	}
-	if len(index) != 1 {
-		t.Errorf("len(index) = %d, want 1 (non-opensource.org URLs excluded): %v", len(index), index)
-	}
-}
-
 func TestStripScheme(t *testing.T) {
 	tests := []struct {
 		name string

internal/task/package_tasks.go

@@ -27,7 +27,6 @@ import (
 	"github.com/anchore/syft/syft/pkg/cataloger/lua"
 	"github.com/anchore/syft/syft/pkg/cataloger/nix"
 	"github.com/anchore/syft/syft/pkg/cataloger/ocaml"
-	"github.com/anchore/syft/syft/pkg/cataloger/perl"
 	"github.com/anchore/syft/syft/pkg/cataloger/php"
 	"github.com/anchore/syft/syft/pkg/cataloger/python"
 	"github.com/anchore/syft/syft/pkg/cataloger/r"
@@ -133,10 +132,6 @@ func DefaultPackageTaskFactories() Factories {
 		newSimplePackageTaskFactory(swift.NewSwiftPackageManagerCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "swift", "spm"),
 		newSimplePackageTaskFactory(swipl.NewSwiplPackCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "swipl", "pack"),
 		newSimplePackageTaskFactory(ocaml.NewOpamPackageManagerCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "ocaml", "opam"),
-		// note: no image tag -- an unpacked release's own META.json describes a distribution present on
-		// disk but not installed into the interpreter's @INC, and declared information is not cataloged
-		// inside container images
-		newSimplePackageTaskFactory(perl.NewCpanMetaCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "perl", "cpan"),
 
 		// language-specific package for both image and directory scans (but not necessarily declared) ////////////////////////////////////////
 		newPackageTaskFactory(
@@ -167,7 +162,6 @@ func DefaultPackageTaskFactories() Factories {
 			pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, pkgcataloging.LanguageTag, "nix",
 		),
 		newSimplePackageTaskFactory(lua.NewPackageCataloger, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, pkgcataloging.LanguageTag, "lua"),
-		newSimplePackageTaskFactory(perl.NewCpanInstalledCataloger, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "perl", "cpan"),
 
 		// other package catalogers ///////////////////////////////////////////////////////////////////////////
 		newPackageTaskFactory(

internal/testutils/docker.go

@@ -1,30 +0,0 @@
-package testutils
-
-import (
-	"os/exec"
-	"runtime"
-	"strings"
-	"sync"
-	"testing"
-)
-
-var dockerServerOS = sync.OnceValue(func() string {
-	out, err := exec.Command("docker", "version", "--format", "{{.Server.Os}}").Output()
-	if err != nil {
-		return ""
-	}
-	return strings.TrimSpace(string(out))
-})
-
-// SkipWithoutLinuxContainers skips tests whose fixtures are linux container images (built or run via docker).
-// This only kicks in on windows, where the docker daemon is often running windows containers (or is absent),
-// so the linux fixture images can't be built. Everywhere else the fixture tooling is left to fail loudly.
-func SkipWithoutLinuxContainers(t testing.TB) {
-	t.Helper()
-	if runtime.GOOS != "windows" {
-		return
-	}
-	if os := dockerServerOS(); os != "linux" {
-		t.Skipf("linux container fixtures unavailable (docker server os=%q)", os)
-	}
-}

internal/tmpdir/tmpdir_test.go

@@ -265,9 +265,8 @@ func TestLazyCreation(t *testing.T) {
 	// root dir is not created until needed
 	assert.Equal(t, "", td.root)
 
-	f, _, err := td.NewFile("trigger-*")
+	_, _, err := td.NewFile("trigger-*")
 	require.NoError(t, err)
-	require.NoError(t, f.Close())
 
 	assert.NotEmpty(t, td.root)
 

schema/json/schema-16.1.11.json

@@ -729,72 +729,6 @@
       ],
       "description": "Coordinates contains the minimal information needed to describe how to find a file within any possible source object (e.g."
     },
-    "CpanDistribution": {
-      "properties": {
-        "dist": {
-          "type": "string",
-          "description": "Dist is the distvname install.json recorded (e.g. URI-5.35), the raw value the package name and\nversion were recovered from"
-        },
-        "mainModule": {
-          "type": "string",
-          "description": "MainModule is the module name recovered from the .packlist path (e.g. LWP for libwww-perl).\nEmpty when the name came from install.json, which is authoritative. Set, it means the name is the\ninstaller's NAME and may not be the distribution name."
-        },
-        "author": {
-          "type": "string",
-          "description": "Author is the PAUSE ID of the distribution author (e.g. OALDERS), parsed out of Path"
-        },
-        "path": {
-          "type": "string",
-          "description": "Path is the raw PAUSE path of the release archive (e.g. O/OA/OALDERS/URI-5.35.tar.gz)"
-        },
-        "modules": {
-          "items": {
-            "$ref": "#/$defs/CpanModule"
-          },
-          "type": "array",
-          "description": "Modules are the modules this distribution provides, sorted by name"
-        },
-        "files": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array",
-          "description": "Files are the paths the .packlist recorded as installed by this distribution, kept in the\npacklist's own order and unfiltered: a path the packlist claims and the filesystem lacks means the\nfile was removed or overwritten out from under the installer, which is signal rather than noise"
-        }
-      },
-      "type": "object",
-      "description": "CpanDistribution describes a CPAN distribution installed on disk, as recorded by a CPAN client's install.json and by the .packlist an installer wrote."
-    },
-    "CpanModule": {
-      "properties": {
-        "name": {
-          "type": "string",
-          "description": "Name is the module name as it would be used in a perl `use` statement (e.g. URI::Escape)"
-        },
-        "version": {
-          "type": "string",
-          "description": "Version is the module version, which may differ from the distribution version"
-        }
-      },
-      "type": "object",
-      "required": [
-        "name"
-      ],
-      "description": "CpanModule is a single perl module provided by a CPAN distribution."
-    },
-    "CpanUnpackedRelease": {
-      "properties": {
-        "modules": {
-          "items": {
-            "$ref": "#/$defs/CpanModule"
-          },
-          "type": "array",
-          "description": "Modules are the modules the release declares it provides, sorted by name"
-        }
-      },
-      "type": "object",
-      "description": "CpanUnpackedRelease describes an unpacked CPAN release found on disk, read from the release's own META.json or META.yml."
-    },
     "DartPubspec": {
       "properties": {
         "homepage": {
@@ -1464,6 +1398,13 @@
         "elfSecurityFeatures": {
           "$ref": "#/$defs/ELFSecurityFeatures",
           "description": "ELFSecurityFeatures contains ELF-specific security hardening information when Format is ELF."
+        },
+        "toolchains": {
+          "items": {
+            "$ref": "#/$defs/Toolchain"
+          },
+          "type": "array",
+          "description": "Toolchains captures information about the compiler, linker, runtime, or other toolchains used to build (or otherwise exist within) the executable."
         }
       },
       "type": "object",
@@ -2838,12 +2779,6 @@
             {
               "$ref": "#/$defs/CondaMetadataEntry"
             },
-            {
-              "$ref": "#/$defs/CpanDistribution"
-            },
-            {
-              "$ref": "#/$defs/CpanUnpackedRelease"
-            },
             {
               "$ref": "#/$defs/DartPubspec"
             },
@@ -4522,6 +4457,27 @@
       ],
       "description": "TerraformLockProviderEntry represents a single provider entry in a Terraform dependency lock file (.terraform.lock.hcl)."
     },
+    "Toolchain": {
+      "properties": {
+        "name": {
+          "type": "string",
+          "description": "Name is the name of the toolchain (e.g., \"gcc\", \"clang\", \"rust\", \"lld\", \"GNU AS\", etc.)."
+        },
+        "version": {
+          "type": "string",
+          "description": "Version is the version of the toolchain."
+        },
+        "component": {
+          "type": "string",
+          "description": "Component indicates which part of the toolchain this represents (e.g., compiler, linker, assembler)."
+        }
+      },
+      "type": "object",
+      "required": [
+        "name",
+        "component"
+      ]
+    },
     "VcpkgManifest": {
       "properties": {
         "description": {

schema/json/schema-latest.json

@@ -729,72 +729,6 @@
       ],
       "description": "Coordinates contains the minimal information needed to describe how to find a file within any possible source object (e.g."
     },
-    "CpanDistribution": {
-      "properties": {
-        "dist": {
-          "type": "string",
-          "description": "Dist is the distvname install.json recorded (e.g. URI-5.35), the raw value the package name and\nversion were recovered from"
-        },
-        "mainModule": {
-          "type": "string",
-          "description": "MainModule is the module name recovered from the .packlist path (e.g. LWP for libwww-perl).\nEmpty when the name came from install.json, which is authoritative. Set, it means the name is the\ninstaller's NAME and may not be the distribution name."
-        },
-        "author": {
-          "type": "string",
-          "description": "Author is the PAUSE ID of the distribution author (e.g. OALDERS), parsed out of Path"
-        },
-        "path": {
-          "type": "string",
-          "description": "Path is the raw PAUSE path of the release archive (e.g. O/OA/OALDERS/URI-5.35.tar.gz)"
-        },
-        "modules": {
-          "items": {
-            "$ref": "#/$defs/CpanModule"
-          },
-          "type": "array",
-          "description": "Modules are the modules this distribution provides, sorted by name"
-        },
-        "files": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array",
-          "description": "Files are the paths the .packlist recorded as installed by this distribution, kept in the\npacklist's own order and unfiltered: a path the packlist claims and the filesystem lacks means the\nfile was removed or overwritten out from under the installer, which is signal rather than noise"
-        }
-      },
-      "type": "object",
-      "description": "CpanDistribution describes a CPAN distribution installed on disk, as recorded by a CPAN client's install.json and by the .packlist an installer wrote."
-    },
-    "CpanModule": {
-      "properties": {
-        "name": {
-          "type": "string",
-          "description": "Name is the module name as it would be used in a perl `use` statement (e.g. URI::Escape)"
-        },
-        "version": {
-          "type": "string",
-          "description": "Version is the module version, which may differ from the distribution version"
-        }
-      },
-      "type": "object",
-      "required": [
-        "name"
-      ],
-      "description": "CpanModule is a single perl module provided by a CPAN distribution."
-    },
-    "CpanUnpackedRelease": {
-      "properties": {
-        "modules": {
-          "items": {
-            "$ref": "#/$defs/CpanModule"
-          },
-          "type": "array",
-          "description": "Modules are the modules the release declares it provides, sorted by name"
-        }
-      },
-      "type": "object",
-      "description": "CpanUnpackedRelease describes an unpacked CPAN release found on disk, read from the release's own META.json or META.yml."
-    },
     "DartPubspec": {
       "properties": {
         "homepage": {
@@ -1464,6 +1398,13 @@
         "elfSecurityFeatures": {
           "$ref": "#/$defs/ELFSecurityFeatures",
           "description": "ELFSecurityFeatures contains ELF-specific security hardening information when Format is ELF."
+        },
+        "toolchains": {
+          "items": {
+            "$ref": "#/$defs/Toolchain"
+          },
+          "type": "array",
+          "description": "Toolchains captures information about the compiler, linker, runtime, or other toolchains used to build (or otherwise exist within) the executable."
         }
       },
       "type": "object",
@@ -2838,12 +2779,6 @@
             {
               "$ref": "#/$defs/CondaMetadataEntry"
             },
-            {
-              "$ref": "#/$defs/CpanDistribution"
-            },
-            {
-              "$ref": "#/$defs/CpanUnpackedRelease"
-            },
             {
               "$ref": "#/$defs/DartPubspec"
             },
@@ -4522,6 +4457,27 @@
       ],
       "description": "TerraformLockProviderEntry represents a single provider entry in a Terraform dependency lock file (.terraform.lock.hcl)."
     },
+    "Toolchain": {
+      "properties": {
+        "name": {
+          "type": "string",
+          "description": "Name is the name of the toolchain (e.g., \"gcc\", \"clang\", \"rust\", \"lld\", \"GNU AS\", etc.)."
+        },
+        "version": {
+          "type": "string",
+          "description": "Version is the version of the toolchain."
+        },
+        "component": {
+          "type": "string",
+          "description": "Component indicates which part of the toolchain this represents (e.g., compiler, linker, assembler)."
+        }
+      },
+      "type": "object",
+      "required": [
+        "name",
+        "component"
+      ]
+    },
     "VcpkgManifest": {
       "properties": {
         "description": {

syft/file/cataloger/executable/cataloger.go

@@ -26,8 +26,11 @@ import (
 )
 
 type Config struct {
+	// MIMETypes are the MIME types that will be considered for executable cataloging.
 	MIMETypes []string `json:"mime-types" yaml:"mime-types" mapstructure:"mime-types"`
-	Globs     []string `json:"globs" yaml:"globs" mapstructure:"globs"`
+
+	// Globs are the glob patterns that will be used to filter which files are cataloged.
+	Globs []string `json:"globs" yaml:"globs" mapstructure:"globs"`
 }
 
 type Cataloger struct {
@@ -116,6 +119,51 @@ func processExecutableLocation(loc file.Location, resolver file.Resolver) (exec
 	return processExecutable(loc, uReader)
 }
 
+func processExecutable(loc file.Location, reader unionreader.UnionReader) (*file.Executable, error) {
+	data := file.Executable{}
+
+	// determine the executable format
+
+	format, err := findExecutableFormat(reader)
+	if err != nil {
+		log.Debugf("unable to determine executable kind for %v: %v", loc.RealPath, err)
+		return nil, fmt.Errorf("unable to determine executable kind: %w", err)
+	}
+
+	if format == "" {
+		// this is not an "unknown", so just log -- this binary does not have parseable data in it
+		log.Debugf("unable to determine executable format for %q", loc.RealPath)
+		return nil, nil
+	}
+
+	data.Format = format
+
+	switch format {
+	case file.ELF:
+		if err = findELFFeatures(&data, reader); err != nil {
+			log.WithFields("error", err, "path", loc.RealPath).Trace("unable to determine ELF features")
+			err = fmt.Errorf("unable to determine ELF features: %w", err)
+		}
+	case file.PE:
+		if err = findPEFeatures(&data, reader); err != nil {
+			log.WithFields("error", err, "path", loc.RealPath).Trace("unable to determine PE features")
+			err = fmt.Errorf("unable to determine PE features: %w", err)
+		}
+	case file.MachO:
+		if err = findMachoFeatures(&data, reader); err != nil {
+			log.WithFields("error", err, "path", loc.RealPath).Trace("unable to determine Macho features")
+			err = fmt.Errorf("unable to determine Macho features: %w", err)
+		}
+	}
+
+	// always allocate collections for presentation
+	if data.ImportedLibraries == nil {
+		data.ImportedLibraries = []string{}
+	}
+
+	return &data, err
+}
+
 func catalogingProgress(locations int64) *monitor.TaskProgress {
 	info := monitor.GenericTask{
 		Title: monitor.Title{
@@ -162,51 +210,6 @@ func locationMatchesGlob(loc file.Location, globs []string) (bool, error) {
 	return false, nil
 }
 
-func processExecutable(loc file.Location, reader unionreader.UnionReader) (*file.Executable, error) {
-	data := file.Executable{}
-
-	// determine the executable format
-
-	format, err := findExecutableFormat(reader)
-	if err != nil {
-		log.Debugf("unable to determine executable kind for %v: %v", loc.RealPath, err)
-		return nil, fmt.Errorf("unable to determine executable kind: %w", err)
-	}
-
-	if format == "" {
-		// this is not an "unknown", so just log -- this binary does not have parseable data in it
-		log.Debugf("unable to determine executable format for %q", loc.RealPath)
-		return nil, nil
-	}
-
-	data.Format = format
-
-	switch format {
-	case file.ELF:
-		if err = findELFFeatures(&data, reader); err != nil {
-			log.WithFields("error", err, "path", loc.RealPath).Trace("unable to determine ELF features")
-			err = fmt.Errorf("unable to determine ELF features: %w", err)
-		}
-	case file.PE:
-		if err = findPEFeatures(&data, reader); err != nil {
-			log.WithFields("error", err, "path", loc.RealPath).Trace("unable to determine PE features")
-			err = fmt.Errorf("unable to determine PE features: %w", err)
-		}
-	case file.MachO:
-		if err = findMachoFeatures(&data, reader); err != nil {
-			log.WithFields("error", err, "path", loc.RealPath).Trace("unable to determine Macho features")
-			err = fmt.Errorf("unable to determine Macho features: %w", err)
-		}
-	}
-
-	// always allocate collections for presentation
-	if data.ImportedLibraries == nil {
-		data.ImportedLibraries = []string{}
-	}
-
-	return &data, err
-}
-
 func findExecutableFormat(reader unionreader.UnionReader) (file.ExecutableFormat, error) {
 	// read the first sector of the file
 	buf := make([]byte, 512)

syft/file/cataloger/executable/elf.go

@@ -35,10 +35,33 @@ func findELFFeatures(data *file.Executable, reader unionreader.UnionReader) erro
 	data.ELFSecurityFeatures = findELFSecurityFeatures(f)
 	data.HasEntrypoint = elfHasEntrypoint(f)
 	data.HasExports = elfHasExports(f)
+	data.Toolchains = elfToolchains(reader, f)
 
 	return err
 }
 
+func elfToolchains(reader unionreader.UnionReader, f *elf.File) []file.Toolchain {
+	// parse the .comment section and symbol tables once and share them across the detectors
+	comments := elfComments(f)
+	symbols := elfSymbolSet(f)
+	return includeNoneNil(
+		golangToolchainEvidence(reader),
+		cToolchainEvidence(comments, symbols),
+		rustToolchainEvidence(comments),
+		linkerToolchainEvidence(f, comments),
+	)
+}
+
+func includeNoneNil(evidence ...*file.Toolchain) []file.Toolchain {
+	var toolchains []file.Toolchain
+	for _, e := range evidence {
+		if e != nil {
+			toolchains = append(toolchains, *e)
+		}
+	}
+	return toolchains
+}
+
 func findELFSecurityFeatures(f *elf.File) *file.ELFSecurityFeatures {
 	return &file.ELFSecurityFeatures{
 		SymbolTableStripped:           isElfSymbolTableStripped(f),
@@ -82,6 +105,28 @@ func boolRef(b bool) *bool {
 	return &b
 }
 
+// elfSymbolSet collects the names from the static and dynamic symbol tables into a single set, so
+// detectors can test for runtime markers without re-reading and re-iterating the symbol tables each
+// time. It covers both tables since some evidence (e.g. the Fortran MAIN__ entry) lives only in the
+// static symbol table.
+func elfSymbolSet(f *elf.File) *strset.Set {
+	set := strset.New()
+
+	if syms, err := f.Symbols(); err == nil {
+		for _, sym := range syms {
+			set.Add(sym.Name)
+		}
+	}
+
+	if dynSyms, err := f.DynamicSymbols(); err == nil {
+		for _, sym := range dynSyms {
+			set.Add(sym.Name)
+		}
+	}
+
+	return set
+}
+
 func checkElfNXProtection(file *elf.File) bool {
 	// find the program headers until you find the GNU_STACK segment
 	for _, prog := range file.Progs {

syft/file/cataloger/executable/elf_test.go

@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -314,3 +315,73 @@ func elfWithDynamicSection(t *testing.T, class elf.Class, dynamic []byte) []byte
 	buf.Write(dynamic)
 	return buf.Bytes()
 }
+
+func Test_elfGoToolchainDetection(t *testing.T) {
+	readerForFixture := func(t *testing.T, fixture string) unionreader.UnionReader {
+		t.Helper()
+		f, err := os.Open(filepath.Join("testdata/golang", fixture))
+		require.NoError(t, err)
+		return f
+	}
+
+	tests := []struct {
+		name        string
+		fixture     string
+		wantPresent bool
+	}{
+		{
+			name:        "go binary has toolchain",
+			fixture:     "bin/hello_linux",
+			wantPresent: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reader := readerForFixture(t, tt.fixture)
+			f, err := elf.NewFile(reader)
+			require.NoError(t, err)
+
+			toolchains := elfToolchains(reader, f)
+			assert.Equal(t, tt.wantPresent, hasGoToolchain(toolchains))
+
+			if tt.wantPresent {
+				require.NotEmpty(t, toolchains)
+				assert.Equal(t, "go", toolchains[0].Name)
+				assert.NotEmpty(t, toolchains[0].Version)
+				assert.Equal(t, file.ToolchainComponentCompiler, toolchains[0].Component)
+			}
+		})
+	}
+}
+
+func Test_elfCgoToolchainDetection(t *testing.T) {
+	readerForFixture := func(t *testing.T, fixture string) unionreader.UnionReader {
+		t.Helper()
+		f, err := os.Open(filepath.Join("testdata/golang", fixture))
+		require.NoError(t, err)
+		return f
+	}
+
+	t.Run("cgo binary has both go and c toolchains", func(t *testing.T) {
+		reader := readerForFixture(t, "bin/hello_linux_cgo")
+		f, err := elf.NewFile(reader)
+		require.NoError(t, err)
+
+		toolchains := elfToolchains(reader, f)
+
+		// versions are dynamic based on Docker image, so we ignore them in comparison
+		want := []file.Toolchain{
+			{Name: "go", Component: file.ToolchainComponentCompiler},
+			{Name: "gcc", Component: file.ToolchainComponentCompiler},
+		}
+
+		if d := cmp.Diff(want, toolchains, cmpopts.IgnoreFields(file.Toolchain{}, "Version")); d != "" {
+			t.Errorf("elfToolchains() mismatch (-want +got):\n%s", d)
+		}
+
+		// verify versions are populated
+		for _, tc := range toolchains {
+			assert.NotEmpty(t, tc.Version, "expected version to be set for %s toolchain", tc.Name)
+		}
+	})
+}

syft/file/cataloger/executable/macho.go

@@ -48,6 +48,8 @@ func findMachoFeatures(data *file.Executable, reader unionreader.UnionReader) er
 		if !data.HasExports {
 			data.HasExports = machoHasExports(f)
 		}
+
+		data.Toolchains = machoToolchains(reader)
 	}
 
 	// de-duplicate libraries
@@ -56,6 +58,12 @@ func findMachoFeatures(data *file.Executable, reader unionreader.UnionReader) er
 	return nil
 }
 
+func machoToolchains(reader unionreader.UnionReader) []file.Toolchain {
+	return includeNoneNil(
+		golangToolchainEvidence(reader),
+	)
+}
+
 func machoHasEntrypoint(f *macho.File) bool {
 	// derived from struct entry_point_command found from which explicitly calls out LC_MAIN:
 	// https://opensource.apple.com/source/xnu/xnu-2050.18.24/EXTERNAL_HEADERS/mach-o/loader.h

syft/file/cataloger/executable/macho_test.go

@@ -120,3 +120,39 @@ func Test_machoUniversal(t *testing.T) {
 		})
 	}
 }
+
+func Test_machoGoToolchainDetection(t *testing.T) {
+	readerForFixture := func(t *testing.T, fixture string) unionreader.UnionReader {
+		t.Helper()
+		f, err := os.Open(filepath.Join("testdata/golang", fixture))
+		require.NoError(t, err)
+		return f
+	}
+
+	tests := []struct {
+		name        string
+		fixture     string
+		wantPresent bool
+	}{
+		{
+			name:        "go binary has toolchain",
+			fixture:     "bin/hello_mac",
+			wantPresent: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reader := readerForFixture(t, tt.fixture)
+
+			toolchains := machoToolchains(reader)
+			assert.Equal(t, tt.wantPresent, hasGoToolchain(toolchains))
+
+			if tt.wantPresent {
+				require.NotEmpty(t, toolchains)
+				assert.Equal(t, "go", toolchains[0].Name)
+				assert.NotEmpty(t, toolchains[0].Version)
+				assert.Equal(t, file.ToolchainComponentCompiler, toolchains[0].Component)
+			}
+		})
+	}
+}

syft/file/cataloger/executable/pe.go

@@ -25,6 +25,7 @@ func findPEFeatures(data *file.Executable, reader unionreader.UnionReader) error
 	data.ImportedLibraries = libs
 	data.HasEntrypoint = peHasEntrypoint(f)
 	data.HasExports = peHasExports(f)
+	data.Toolchains = peToolchains(reader)
 
 	return nil
 }
@@ -82,3 +83,9 @@ func peHasExports(f *pe.File) bool {
 
 	return false
 }
+
+func peToolchains(reader unionreader.UnionReader) []file.Toolchain {
+	return includeNoneNil(
+		golangToolchainEvidence(reader),
+	)
+}

syft/file/cataloger/executable/pe_test.go

@@ -9,6 +9,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/internal/unionreader"
 )
 
@@ -78,3 +79,39 @@ func Test_peHasExports(t *testing.T) {
 		})
 	}
 }
+
+func Test_peGoToolchainDetection(t *testing.T) {
+	readerForFixture := func(t *testing.T, fixture string) unionreader.UnionReader {
+		t.Helper()
+		f, err := os.Open(filepath.Join("testdata/golang", fixture))
+		require.NoError(t, err)
+		return f
+	}
+
+	tests := []struct {
+		name        string
+		fixture     string
+		wantPresent bool
+	}{
+		{
+			name:        "go binary has toolchain",
+			fixture:     "bin/hello.exe",
+			wantPresent: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reader := readerForFixture(t, tt.fixture)
+
+			toolchains := peToolchains(reader)
+			assert.Equal(t, tt.wantPresent, hasGoToolchain(toolchains))
+
+			if tt.wantPresent {
+				require.NotEmpty(t, toolchains)
+				assert.Equal(t, "go", toolchains[0].Name)
+				assert.NotEmpty(t, toolchains[0].Version)
+				assert.Equal(t, file.ToolchainComponentCompiler, toolchains[0].Component)
+			}
+		})
+	}
+}

syft/file/cataloger/executable/testdata/.gitignore

@@ -1,3 +1,4 @@
 bin
 actual_verify
-Dockerfile.sha256
+Dockerfile.sha256
+*.fingerprint

syft/file/cataloger/executable/testdata/golang/Dockerfile

@@ -0,0 +1,18 @@
+FROM golang:1.24
+
+WORKDIR /app
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY main.go cgo_main.go ./
+
+# pure Go builds (no CGO)
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o /hello_linux .
+
+RUN CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 go build -o /hello_mac .
+
+RUN CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -o /hello.exe .
+
+# CGO-enabled build (Linux only, uses gcc)
+RUN CGO_ENABLED=1 GOOS=linux GOARCH=amd64 go build -o /hello_linux_cgo ./cgo_main.go

syft/file/cataloger/executable/testdata/golang/Makefile

@@ -0,0 +1,42 @@
+BIN=./bin
+TOOL_IMAGE=localhost/syft-golang-build-tools:latest
+FINGERPRINT_FILE=$(BIN).fingerprint
+
+ifndef BIN
+    $(error BIN is not set)
+endif
+
+.DEFAULT_GOAL := fixtures
+
+# requirement 1: 'fixtures' goal to generate any and all test fixtures
+fixtures: build
+
+# requirement 2: 'fingerprint' goal to determine if the fixture input that indicates any existing cache should be busted
+fingerprint: $(FINGERPRINT_FILE)
+
+tools-check:
+	@sha256sum -c Dockerfile.sha256 || (echo "Tools Dockerfile has changed" && exit 1)
+
+tools:
+	@(docker inspect $(TOOL_IMAGE) > /dev/null && make tools-check) || \
+		(docker build --platform=linux/amd64 -t $(TOOL_IMAGE) . && sha256sum Dockerfile > Dockerfile.sha256)
+
+build: tools
+	@mkdir -p $(BIN)
+	docker run -i -v $(shell pwd)/$(BIN):/out $(TOOL_IMAGE) sh -c \
+		"cp /hello_linux /hello_mac /hello.exe /hello_linux_cgo /out/"
+
+debug:
+	docker run -it --rm -v $(shell pwd):/mount -w /mount $(TOOL_IMAGE) sh
+
+# requirement 3: we always need to recalculate the fingerprint based on source regardless of any existing fingerprint
+.PHONY: $(FINGERPRINT_FILE)
+$(FINGERPRINT_FILE):
+	@find . -maxdepth 1 -type f \( -name "*.go" -o -name "go.*" -o -name "Dockerfile" -o -name "Makefile" \) \
+		-exec sha256sum {} \; | sort -k2 > $(FINGERPRINT_FILE)
+
+# requirement 4: 'clean' goal to remove all generated test fixtures
+clean:
+	rm -rf $(BIN) Dockerfile.sha256 $(FINGERPRINT_FILE)
+
+.PHONY: tools tools-check build debug clean fixtures fingerprint

syft/file/cataloger/executable/testdata/golang/cgo_main.go

@@ -0,0 +1,18 @@
+package main
+
+/*
+#include <string.h>
+#include <stdio.h>
+
+int get_length(const char* s) {
+    return strlen(s);
+}
+*/
+import "C"
+import "fmt"
+
+func main() {
+	msg := C.CString("Hello from CGO!")
+	length := C.get_length(msg)
+	fmt.Printf("String length: %d\n", int(length))
+}

syft/file/cataloger/executable/testdata/golang/go.mod

@@ -0,0 +1,8 @@
+module x
+
+go 1.24.4
+
+require (
+	github.com/davecgh/go-spew v1.1.1
+	golang.org/x/text v0.21.0
+)

syft/file/cataloger/executable/testdata/golang/go.sum

@@ -0,0 +1,4 @@
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
+golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=

syft/file/cataloger/executable/testdata/golang/main.go

@@ -0,0 +1,28 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/davecgh/go-spew/spew"
+	"golang.org/x/text/language"
+)
+
+func main() {
+	// use stdlib packages
+	fmt.Println("Hello from Go!")
+	fmt.Println(strings.ToUpper("test"))
+
+	// use golang.org/x package
+	tag := language.English
+	fmt.Println(tag.String())
+
+	// use third-party package
+	spew.Dump(os.Args)
+
+	// use encoding/json
+	data, _ := json.Marshal(map[string]string{"hello": "world"})
+	fmt.Println(string(data))
+}

syft/file/cataloger/executable/testdata/toolchains/.gitignore

@@ -0,0 +1,3 @@
+bin/
+Dockerfile.sha256
+*.fingerprint

syft/file/cataloger/executable/testdata/toolchains/Makefile

@@ -0,0 +1,39 @@
+# invoke all make files in subdirectories
+.PHONY: all gcc clang lld mold gold rust fortran gdc gccgo gnat
+
+all: gcc clang lld mold gold rust fortran gdc gccgo gnat
+
+gcc:
+	$(MAKE) -C gcc
+
+clang:
+	$(MAKE) -C clang
+
+lld:
+	$(MAKE) -C lld
+
+mold:
+	$(MAKE) -C mold
+
+gold:
+	$(MAKE) -C gold
+
+rust:
+	$(MAKE) -C rust
+
+fortran:
+	$(MAKE) -C fortran
+
+gdc:
+	$(MAKE) -C gdc
+
+gccgo:
+	$(MAKE) -C gccgo
+
+gnat:
+	$(MAKE) -C gnat
+
+%:
+	@for dir in gcc clang lld mold gold rust fortran gdc gccgo gnat; do \
+		$(MAKE) -C $$dir $@; \
+	done

syft/file/cataloger/executable/testdata/toolchains/clang/Dockerfile

@@ -0,0 +1,6 @@
+FROM alpine:3.21.7@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d65087abc07d
+
+RUN apk add --no-cache clang18 musl-dev make
+
+# create symlink so 'clang' command works (Alpine installs as clang-18)
+RUN ln -s /usr/bin/clang-18 /usr/bin/clang

syft/file/cataloger/executable/testdata/toolchains/clang/Makefile

@@ -0,0 +1,39 @@
+BIN=./bin
+TOOL_IMAGE=localhost/syft-toolchain-clang-build-tools:latest
+FINGERPRINT_FILE=$(BIN).fingerprint
+
+ifndef BIN
+    $(error BIN is not set)
+endif
+
+.DEFAULT_GOAL := fixtures
+
+# requirement 1: 'fixtures' goal to generate any and all test fixtures
+fixtures: build
+
+# requirement 2: 'fingerprint' goal to determine if the fixture input that indicates any existing cache should be busted
+fingerprint: $(FINGERPRINT_FILE)
+
+tools-check:
+	@sha256sum -c Dockerfile.sha256 || (echo "Tools Dockerfile has changed" && exit 1)
+
+tools:
+	@(docker inspect $(TOOL_IMAGE) > /dev/null && make tools-check) || (docker build --platform linux/amd64 -t $(TOOL_IMAGE) . && sha256sum Dockerfile > Dockerfile.sha256)
+
+build: tools
+	@mkdir -p $(BIN)
+	docker run --platform linux/amd64 -i -v $(shell pwd):/mount -w /mount/project $(TOOL_IMAGE) make
+
+debug:
+	docker run --platform linux/amd64 -i --rm -v $(shell pwd):/mount -w /mount/project $(TOOL_IMAGE) bash
+
+# requirement 3: we always need to recalculate the fingerprint based on source regardless of any existing fingerprint
+.PHONY: $(FINGERPRINT_FILE)
+$(FINGERPRINT_FILE):
+	@find project Dockerfile Makefile -type f -exec sha256sum {} \; | sort -k2 > $(FINGERPRINT_FILE)
+
+# requirement 4: 'clean' goal to remove all generated test fixtures
+clean:
+	rm -rf $(BIN) Dockerfile.sha256 $(FINGERPRINT_FILE)
+
+.PHONY: tools tools-check build debug clean

syft/file/cataloger/executable/testdata/toolchains/clang/project/Makefile

@@ -0,0 +1,9 @@
+BIN=../bin
+
+all: $(BIN)/hello_clang
+
+$(BIN)/hello_clang: hello.c
+	clang hello.c -o $(BIN)/hello_clang
+
+clean:
+	rm -f $(BIN)/hello_clang

syft/file/cataloger/executable/testdata/toolchains/clang/project/hello.c

@@ -0,0 +1,6 @@
+#include <stdio.h>
+
+int main() {
+    printf("Hello, World!\n");
+    return 0;
+}

syft/file/cataloger/executable/testdata/toolchains/fortran/Dockerfile

@@ -0,0 +1 @@
+FROM gcc:13.4.0@sha256:d49302cbe2faf1a2dece312e258325e0d39e32874ea4dec122b4ac86f45d5b50

syft/file/cataloger/executable/testdata/toolchains/fortran/Makefile

@@ -0,0 +1,39 @@
+BIN=./bin
+TOOL_IMAGE=localhost/syft-toolchain-fortran-build-tools:latest
+FINGERPRINT_FILE=$(BIN).fingerprint
+
+ifndef BIN
+    $(error BIN is not set)
+endif
+
+.DEFAULT_GOAL := fixtures
+
+# requirement 1: 'fixtures' goal to generate any and all test fixtures
+fixtures: build
+
+# requirement 2: 'fingerprint' goal to determine if the fixture input that indicates any existing cache should be busted
+fingerprint: $(FINGERPRINT_FILE)
+
+tools-check:
+	@sha256sum -c Dockerfile.sha256 || (echo "Tools Dockerfile has changed" && exit 1)
+
+tools:
+	@(docker inspect $(TOOL_IMAGE) > /dev/null && make tools-check) || (docker build --platform linux/amd64 -t $(TOOL_IMAGE) . && sha256sum Dockerfile > Dockerfile.sha256)
+
+build: tools
+	@mkdir -p $(BIN)
+	docker run --platform linux/amd64 -i -v $(shell pwd):/mount -w /mount/project $(TOOL_IMAGE) make
+
+debug:
+	docker run --platform linux/amd64 -i --rm -v $(shell pwd):/mount -w /mount/project $(TOOL_IMAGE) bash
+
+# requirement 3: we always need to recalculate the fingerprint based on source regardless of any existing fingerprint
+.PHONY: $(FINGERPRINT_FILE)
+$(FINGERPRINT_FILE):
+	@find project Dockerfile Makefile -type f -exec sha256sum {} \; | sort -k2 > $(FINGERPRINT_FILE)
+
+# requirement 4: 'clean' goal to remove all generated test fixtures
+clean:
+	rm -rf $(BIN) Dockerfile.sha256 $(FINGERPRINT_FILE)
+
+.PHONY: tools tools-check build debug clean

syft/file/cataloger/executable/testdata/toolchains/fortran/project/Makefile

@@ -0,0 +1,9 @@
+BIN=../bin
+
+all: $(BIN)/hello_fortran
+
+$(BIN)/hello_fortran: hello.f90
+	gfortran hello.f90 -o $(BIN)/hello_fortran
+
+clean:
+	rm -f $(BIN)/hello_fortran

syft/file/cataloger/executable/testdata/toolchains/fortran/project/hello.f90

@@ -0,0 +1,3 @@
+program hello
+    print *, "Hello, World!"
+end program hello

syft/file/cataloger/executable/testdata/toolchains/gcc/Dockerfile

@@ -0,0 +1 @@
+FROM gcc:13.4.0@sha256:d49302cbe2faf1a2dece312e258325e0d39e32874ea4dec122b4ac86f45d5b50

syft/file/cataloger/executable/testdata/toolchains/gcc/Makefile

@@ -0,0 +1,39 @@
+BIN=./bin
+TOOL_IMAGE=localhost/syft-toolchain-gcc-build-tools:latest
+FINGERPRINT_FILE=$(BIN).fingerprint
+
+ifndef BIN
+    $(error BIN is not set)
+endif
+
+.DEFAULT_GOAL := fixtures
+
+# requirement 1: 'fixtures' goal to generate any and all test fixtures
+fixtures: build
+
+# requirement 2: 'fingerprint' goal to determine if the fixture input that indicates any existing cache should be busted
+fingerprint: $(FINGERPRINT_FILE)
+
+tools-check:
+	@sha256sum -c Dockerfile.sha256 || (echo "Tools Dockerfile has changed" && exit 1)
+
+tools:
+	@(docker inspect $(TOOL_IMAGE) > /dev/null && make tools-check) || (docker build --platform linux/amd64 -t $(TOOL_IMAGE) . && sha256sum Dockerfile > Dockerfile.sha256)
+
+build: tools
+	@mkdir -p $(BIN)
+	docker run --platform linux/amd64 -i -v $(shell pwd):/mount -w /mount/project $(TOOL_IMAGE) make
+
+debug:
+	docker run --platform linux/amd64 -i --rm -v $(shell pwd):/mount -w /mount/project $(TOOL_IMAGE) bash
+
+# requirement 3: we always need to recalculate the fingerprint based on source regardless of any existing fingerprint
+.PHONY: $(FINGERPRINT_FILE)
+$(FINGERPRINT_FILE):
+	@find project Dockerfile Makefile -type f -exec sha256sum {} \; | sort -k2 > $(FINGERPRINT_FILE)
+
+# requirement 4: 'clean' goal to remove all generated test fixtures
+clean:
+	rm -rf $(BIN) Dockerfile.sha256 $(FINGERPRINT_FILE)
+
+.PHONY: tools tools-check build debug clean

syft/file/cataloger/executable/testdata/toolchains/gcc/project/Makefile

@@ -0,0 +1,9 @@
+BIN=../bin
+
+all: $(BIN)/hello_gcc
+
+$(BIN)/hello_gcc: hello.c
+	gcc hello.c -o $(BIN)/hello_gcc
+
+clean:
+	rm -f $(BIN)/hello_gcc

syft/file/cataloger/executable/testdata/toolchains/gcc/project/hello.c

@@ -0,0 +1,6 @@
+#include <stdio.h>
+
+int main() {
+    printf("Hello, World!\n");
+    return 0;
+}

syft/file/cataloger/executable/testdata/toolchains/gccgo/Dockerfile

@@ -0,0 +1,3 @@
+FROM debian:12.14@sha256:49ba348354a28e39c70beffd6cf43bdb8d55d81ce4b746b0428717d054b8bbc4
+
+RUN apt-get update && apt-get install -y --no-install-recommends gccgo make && rm -rf /var/lib/apt/lists/*

syft/file/cataloger/executable/testdata/toolchains/gccgo/Makefile

@@ -0,0 +1,39 @@
+BIN=./bin
+TOOL_IMAGE=localhost/syft-toolchain-gccgo-build-tools:latest
+FINGERPRINT_FILE=$(BIN).fingerprint
+
+ifndef BIN
+    $(error BIN is not set)
+endif
+
+.DEFAULT_GOAL := fixtures
+
+# requirement 1: 'fixtures' goal to generate any and all test fixtures
+fixtures: build
+
+# requirement 2: 'fingerprint' goal to determine if the fixture input that indicates any existing cache should be busted
+fingerprint: $(FINGERPRINT_FILE)
+
+tools-check:
+	@sha256sum -c Dockerfile.sha256 || (echo "Tools Dockerfile has changed" && exit 1)
+
+tools:
+	@(docker inspect $(TOOL_IMAGE) > /dev/null && make tools-check) || (docker build --platform linux/amd64 -t $(TOOL_IMAGE) . && sha256sum Dockerfile > Dockerfile.sha256)
+
+build: tools
+	@mkdir -p $(BIN)
+	docker run --platform linux/amd64 -i -v $(shell pwd):/mount -w /mount/project $(TOOL_IMAGE) make
+
+debug:
+	docker run --platform linux/amd64 -i --rm -v $(shell pwd):/mount -w /mount/project $(TOOL_IMAGE) bash
+
+# requirement 3: we always need to recalculate the fingerprint based on source regardless of any existing fingerprint
+.PHONY: $(FINGERPRINT_FILE)
+$(FINGERPRINT_FILE):
+	@find project Dockerfile Makefile -type f -exec sha256sum {} \; | sort -k2 > $(FINGERPRINT_FILE)
+
+# requirement 4: 'clean' goal to remove all generated test fixtures
+clean:
+	rm -rf $(BIN) Dockerfile.sha256 $(FINGERPRINT_FILE)
+
+.PHONY: tools tools-check build debug clean

syft/file/cataloger/executable/testdata/toolchains/gccgo/project/Makefile

@@ -0,0 +1,9 @@
+BIN=../bin
+
+all: $(BIN)/hello_gccgo
+
+$(BIN)/hello_gccgo: hello.go
+	gccgo hello.go -o $(BIN)/hello_gccgo
+
+clean:
+	rm -f $(BIN)/hello_gccgo

syft/file/cataloger/executable/testdata/toolchains/gccgo/project/hello.go

@@ -0,0 +1,5 @@
+package main
+
+func main() {
+	println("Hello, World!")
+}

syft/file/cataloger/executable/testdata/toolchains/gdc/Dockerfile

@@ -0,0 +1,3 @@
+FROM debian:12.14@sha256:49ba348354a28e39c70beffd6cf43bdb8d55d81ce4b746b0428717d054b8bbc4
+
+RUN apt-get update && apt-get install -y --no-install-recommends gdc make && rm -rf /var/lib/apt/lists/*

syft/file/cataloger/executable/testdata/toolchains/gdc/Makefile

@@ -0,0 +1,39 @@
+BIN=./bin
+TOOL_IMAGE=localhost/syft-toolchain-gdc-build-tools:latest
+FINGERPRINT_FILE=$(BIN).fingerprint
+
+ifndef BIN
+    $(error BIN is not set)
+endif
+
+.DEFAULT_GOAL := fixtures
+
+# requirement 1: 'fixtures' goal to generate any and all test fixtures
+fixtures: build
+
+# requirement 2: 'fingerprint' goal to determine if the fixture input that indicates any existing cache should be busted
+fingerprint: $(FINGERPRINT_FILE)
+
+tools-check:
+	@sha256sum -c Dockerfile.sha256 || (echo "Tools Dockerfile has changed" && exit 1)
+
+tools:
+	@(docker inspect $(TOOL_IMAGE) > /dev/null && make tools-check) || (docker build --platform linux/amd64 -t $(TOOL_IMAGE) . && sha256sum Dockerfile > Dockerfile.sha256)
+
+build: tools
+	@mkdir -p $(BIN)
+	docker run --platform linux/amd64 -i -v $(shell pwd):/mount -w /mount/project $(TOOL_IMAGE) make
+
+debug:
+	docker run --platform linux/amd64 -i --rm -v $(shell pwd):/mount -w /mount/project $(TOOL_IMAGE) bash
+
+# requirement 3: we always need to recalculate the fingerprint based on source regardless of any existing fingerprint
+.PHONY: $(FINGERPRINT_FILE)
+$(FINGERPRINT_FILE):
+	@find project Dockerfile Makefile -type f -exec sha256sum {} \; | sort -k2 > $(FINGERPRINT_FILE)
+
+# requirement 4: 'clean' goal to remove all generated test fixtures
+clean:
+	rm -rf $(BIN) Dockerfile.sha256 $(FINGERPRINT_FILE)
+
+.PHONY: tools tools-check build debug clean

syft/file/cataloger/executable/testdata/toolchains/gdc/project/Makefile

@@ -0,0 +1,9 @@
+BIN=../bin
+
+all: $(BIN)/hello_gdc
+
+$(BIN)/hello_gdc: hello.d
+	gdc hello.d -o $(BIN)/hello_gdc
+
+clean:
+	rm -f $(BIN)/hello_gdc

syft/file/cataloger/executable/testdata/toolchains/gdc/project/hello.d

@@ -0,0 +1,5 @@
+import std.stdio;
+
+void main() {
+    writeln("Hello, World!");
+}

syft/file/cataloger/executable/testdata/toolchains/gnat/Dockerfile

@@ -0,0 +1,3 @@
+FROM debian:12.14@sha256:49ba348354a28e39c70beffd6cf43bdb8d55d81ce4b746b0428717d054b8bbc4
+
+RUN apt-get update && apt-get install -y --no-install-recommends gnat make && rm -rf /var/lib/apt/lists/*

syft/file/cataloger/executable/testdata/toolchains/gnat/Makefile

@@ -0,0 +1,39 @@
+BIN=./bin
+TOOL_IMAGE=localhost/syft-toolchain-gnat-build-tools:latest
+FINGERPRINT_FILE=$(BIN).fingerprint
+
+ifndef BIN
+    $(error BIN is not set)
+endif
+
+.DEFAULT_GOAL := fixtures
+
+# requirement 1: 'fixtures' goal to generate any and all test fixtures
+fixtures: build
+
+# requirement 2: 'fingerprint' goal to determine if the fixture input that indicates any existing cache should be busted
+fingerprint: $(FINGERPRINT_FILE)
+
+tools-check:
+	@sha256sum -c Dockerfile.sha256 || (echo "Tools Dockerfile has changed" && exit 1)
+
+tools:
+	@(docker inspect $(TOOL_IMAGE) > /dev/null && make tools-check) || (docker build --platform linux/amd64 -t $(TOOL_IMAGE) . && sha256sum Dockerfile > Dockerfile.sha256)
+
+build: tools
+	@mkdir -p $(BIN)
+	docker run --platform linux/amd64 -i -v $(shell pwd):/mount -w /mount/project $(TOOL_IMAGE) make
+
+debug:
+	docker run --platform linux/amd64 -i --rm -v $(shell pwd):/mount -w /mount/project $(TOOL_IMAGE) bash
+
+# requirement 3: we always need to recalculate the fingerprint based on source regardless of any existing fingerprint
+.PHONY: $(FINGERPRINT_FILE)
+$(FINGERPRINT_FILE):
+	@find project Dockerfile Makefile -type f -exec sha256sum {} \; | sort -k2 > $(FINGERPRINT_FILE)
+
+# requirement 4: 'clean' goal to remove all generated test fixtures
+clean:
+	rm -rf $(BIN) Dockerfile.sha256 $(FINGERPRINT_FILE)
+
+.PHONY: tools tools-check build debug clean

syft/file/cataloger/executable/testdata/toolchains/gnat/project/Makefile

@@ -0,0 +1,9 @@
+BIN=../bin
+
+all: $(BIN)/hello_gnat
+
+$(BIN)/hello_gnat: hello.adb
+	gnatmake hello.adb -o $(BIN)/hello_gnat
+
+clean:
+	rm -f $(BIN)/hello_gnat *.o *.ali

syft/file/cataloger/executable/testdata/toolchains/gnat/project/hello.adb

@@ -0,0 +1,6 @@
+with Ada.Text_IO;
+
+procedure Hello is
+begin
+   Ada.Text_IO.Put_Line ("Hello, World!");
+end Hello;

syft/file/cataloger/executable/testdata/toolchains/gnat/project/hello.ali

@@ -0,0 +1,51 @@
+V "GNAT Lib v12"
+M P W=b
+P ZX
+
+RN
+RV NO_IO
+
+U hello%b		hello.adb		b6dbb388 NE OO SU
+W ada%s			ada.ads			ada.ali
+Z ada.strings.text_buffers%s  a-sttebu.adb	a-sttebu.ali
+W ada.text_io%s		a-textio.adb		a-textio.ali
+
+D ada.ads		20220819080952 76789da1 ada%s
+D a-except.ads		20220819080952 2a7d8d70 ada.exceptions%s
+D a-ioexce.ads		20220819080952 40018c65 ada.io_exceptions%s
+D a-stream.ads		20220819080952 119b8fb3 ada.streams%s
+D a-string.ads		20220819080952 90ac6797 ada.strings%s
+D a-sttebu.ads		20220819080952 18209c64 ada.strings.text_buffers%s
+D a-stuten.ads		20220819080952 33c54060 ada.strings.utf_encoding%s
+D a-tags.ads		20220819080952 9eaa38c6 ada.tags%s
+D a-textio.ads		20220819080952 deada98a ada.text_io%s
+D a-unccon.ads		20220819080952 0e9b276f ada.unchecked_conversion%s
+D hello.adb		20260618132941 68761a02 hello%b
+D interfac.ads		20220819080952 edec285f interfaces%s
+D i-cstrea.ads		20220819080952 e53d8b8e interfaces.c_streams%s
+D system.ads		20220819080952 a2da961d system%s
+D s-crtl.ads		20220819080952 8a0692f8 system.crtl%s
+D s-exctab.ads		20220819080952 91bef6ef system.exception_table%s
+D s-ficobl.ads		20220819080952 dc5161d4 system.file_control_block%s
+D s-parame.ads		20220819080952 d494a4a6 system.parameters%s
+D s-putima.ads		20220819080952 4e095881 system.put_images%s
+D s-secsta.ads		20220819080952 62cd9202 system.secondary_stack%s
+D s-soflin.ads		20220819080952 df77073e system.soft_links%s
+D s-stache.ads		20220819080952 0b81c1fe system.stack_checking%s
+D s-stalib.ads		20220819080952 1c9580f6 system.standard_library%s
+D s-stoele.ads		20220819080952 6d8e1ff4 system.storage_elements%s
+D s-stoele.adb		20220819080952 8f5a9db6 system.storage_elements%b
+D s-traent.ads		20220819080952 c81cbf8c system.traceback_entries%s
+D s-unstyp.ads		20220819080952 fa2a7f59 system.unsigned_types%s
+D s-wchcon.ads		20220819080952 d9032363 system.wch_con%s
+D unchconv.ads		20220819080952 ca2f9e18 unchecked_conversion%s
+G a e
+G c Z b b [hello standard 3 11 none]
+X 1 ada.ads
+16K9*Ada 20e8 11|1r6 5r4
+X 9 a-textio.ads
+58K13*Text_IO 727e16 11|1w10 5r8
+507U14*Put_Line 11|5s16
+X 11 hello.adb
+3U11*Hello 3b11 6l5 6t10
+

syft/file/cataloger/executable/testdata/toolchains/gold/Dockerfile

@@ -0,0 +1,3 @@
+FROM alpine:3.21.7@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d65087abc07d
+
+RUN apk add --no-cache gcc binutils-gold musl-dev make

syft/file/cataloger/executable/testdata/toolchains/gold/Makefile

@@ -0,0 +1,39 @@
+BIN=./bin
+TOOL_IMAGE=localhost/syft-toolchain-gold-build-tools:latest
+FINGERPRINT_FILE=$(BIN).fingerprint
+
+ifndef BIN
+    $(error BIN is not set)
+endif
+
+.DEFAULT_GOAL := fixtures
+
+# requirement 1: 'fixtures' goal to generate any and all test fixtures
+fixtures: build
+
+# requirement 2: 'fingerprint' goal to determine if the fixture input that indicates any existing cache should be busted
+fingerprint: $(FINGERPRINT_FILE)
+
+tools-check:
+	@sha256sum -c Dockerfile.sha256 || (echo "Tools Dockerfile has changed" && exit 1)
+
+tools:
+	@(docker inspect $(TOOL_IMAGE) > /dev/null && make tools-check) || (docker build --platform linux/amd64 -t $(TOOL_IMAGE) . && sha256sum Dockerfile > Dockerfile.sha256)
+
+build: tools
+	@mkdir -p $(BIN)
+	docker run --platform linux/amd64 -i -v $(shell pwd):/mount -w /mount/project $(TOOL_IMAGE) make
+
+debug:
+	docker run --platform linux/amd64 -i --rm -v $(shell pwd):/mount -w /mount/project $(TOOL_IMAGE) bash
+
+# requirement 3: we always need to recalculate the fingerprint based on source regardless of any existing fingerprint
+.PHONY: $(FINGERPRINT_FILE)
+$(FINGERPRINT_FILE):
+	@find project Dockerfile Makefile -type f -exec sha256sum {} \; | sort -k2 > $(FINGERPRINT_FILE)
+
+# requirement 4: 'clean' goal to remove all generated test fixtures
+clean:
+	rm -rf $(BIN) Dockerfile.sha256 $(FINGERPRINT_FILE)
+
+.PHONY: tools tools-check build debug clean