perf: build lower layer squashes only when a scan reads them

The image source provider now reads images with `image.WithLazyLayerSquashes`: the image squash is built during the read, and each lower layer's squash only when something reads it. A squashed scan never does, so it skips a full file tree copy per layer. - squashed scans: faster, much less memory on images with many layers - `scan`/`attest` with all-layers or deep-squashed stay eager (an internal ctx flag), since eager squashing overlaps with fetching and indexing and is faster when every layer gets read - library callers going through `syft.GetSource` get lazy for every scope, since the scope isn't known when the image is read. All-layers is still correct, just slower - no public API change Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
revert: drop the squash-only image read and bump stereoscope
2026-11-02 15:36:41 +01:00 · 2026-10-29 22:40:51 -04:00 · 2026-10-29 22:40:50 -04:00 · 2026-10-29 12:22:27 -04:00 · 2026-10-29 12:13:33 -04:00 · 2026-10-29 12:10:12 -04:00
33 changed files with 638 additions and 144 deletions
@@ -16,7 +16,7 @@ tools:
  # used to upload test fixture cache
  - name: oras
    version:
-      want: v1.3.4
+      want: v1.3.5
    method: github-release
    with:
      repo: oras-project/oras
@@ -6,10 +6,6 @@ description: "Bootstrap all syft tools and dependencies on top of go-make's setu
 # We add the syft-specific extras here: apt packages and the test fixture cache.

 inputs:
-  go-version:
-    description: "Go version to install (passed to go-make/setup)"
-    required: true
-    default: "1.26.2"
  cache-key-prefix:
    description: "Prefix all cache keys with this value (passed to go-make/setup)"
    required: true
@@ -30,9 +26,8 @@ runs:
  using: "composite"
  steps:
    - name: Setup go + go-make tooling
-      uses: anchore/go-make/.github/actions/setup@abf41688f36f2cbec13105747abbe8e60f5c56ca # v0.9.3
+      uses: anchore/go-make/.github/actions/setup@cf465259f4c9f0b0b0bcb35164ede11f7dc6d9f6 # v0.9.6
      with:
-        go-version: ${{ inputs.go-version }}
        cache-key-prefix: ${{ inputs.cache-key-prefix }}
        cache-enabled: ${{ inputs.cache-enabled }}

@@ -25,7 +25,7 @@ jobs:
          persist-credentials: false

      - name: "Run zizmor"
-        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
        with:
          # there is a pass/fail gate as a repo ruleset (if there is no ruleset configured then the action will pass by default)
          advanced-security: true
@@ -99,10 +99,7 @@ jobs:
      # go-make's setup only (not ./.github/actions/bootstrap): binny ships no windows release, so binny tools
      # are unavailable here (`make unit` skips the fixture refresh on windows)
      - name: Setup go + go-make tooling
-        uses: anchore/go-make/.github/actions/setup@abf41688f36f2cbec13105747abbe8e60f5c56ca # v0.9.3
-        with:
-          # keep in sync with the go-version default in ./.github/actions/bootstrap
-          go-version: "1.26.2"
+        uses: anchore/go-make/.github/actions/setup@cf465259f4c9f0b0b0bcb35164ede11f7dc6d9f6 # v0.9.6

      # the binny-free version of `make download-test-fixture-cache` (keep the oras version in sync with .binny.yaml)
      - name: Download test fixture cache
@@ -195,10 +192,7 @@ jobs:

      # go-make's setup only (not ./.github/actions/bootstrap): the test only needs make + the snapshot binary
      - name: Setup go + go-make tooling
-        uses: anchore/go-make/.github/actions/setup@abf41688f36f2cbec13105747abbe8e60f5c56ca # v0.9.3
-        with:
-          # keep in sync with the go-version default in ./.github/actions/bootstrap
-          go-version: "1.26.2"
+        uses: anchore/go-make/.github/actions/setup@cf465259f4c9f0b0b0bcb35164ede11f7dc6d9f6 # v0.9.6

      - name: Install Podman
        run: |
@@ -228,10 +222,7 @@ jobs:

      # go-make's setup only (not ./.github/actions/bootstrap): the test only needs make + the snapshot binary
      - name: Setup go + go-make tooling
-        uses: anchore/go-make/.github/actions/setup@abf41688f36f2cbec13105747abbe8e60f5c56ca # v0.9.3
-        with:
-          # keep in sync with the go-version default in ./.github/actions/bootstrap
-          go-version: "1.26.2"
+        uses: anchore/go-make/.github/actions/setup@cf465259f4c9f0b0b0bcb35164ede11f7dc6d9f6 # v0.9.6

      - name: Install Buildah
        run: |
@@ -2,11 +2,11 @@ module github.com/anchore/syft/.make

 go 1.26.0

-require github.com/anchore/go-make v0.9.3
+require github.com/anchore/go-make v0.9.6

 require (
-	github.com/bmatcuk/doublestar/v4 v4.10.2 // indirect
+	github.com/bmatcuk/doublestar/v4 v4.10.3 // indirect
 	github.com/goccy/go-yaml v1.19.2 // indirect
-	golang.org/x/mod v0.41.0 // indirect
-	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/mod v0.42.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
@@ -1,10 +1,10 @@
-github.com/anchore/go-make v0.9.3 h1:D+MkpvEJsOGwkOqKN0rd2zYi9jEzwKtZreNysH0DenI=
-github.com/anchore/go-make v0.9.3/go.mod h1:4HuELygGhxex2SaCEgfCbZ0geJ3xFkqtWpmt1NrYwPg=
-github.com/bmatcuk/doublestar/v4 v4.10.2 h1:eF7W7HWKg3z9NrWV9pTLnNeoXaqq3Tq9DNKXVMfoCnw=
-github.com/bmatcuk/doublestar/v4 v4.10.2/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
+github.com/anchore/go-make v0.9.6 h1:HjO7H/M/WZ4v3B73/EuShuQHHblQJGwHDrl/MqCavWs=
+github.com/anchore/go-make v0.9.6/go.mod h1:zE6KeB+nY+sMSWHYx2uaiOznLAq3CD9JvFlzWDDpKw4=
+github.com/bmatcuk/doublestar/v4 v4.10.3 h1:1UIv1+fqH3++ViVkpnaPTB+Pi1UHycnPFAq14zgK+gI=
+github.com/bmatcuk/doublestar/v4 v4.10.3/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
 github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
-golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
-golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
-golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
-golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/mod v0.42.0 h1:ICeL3t2L30ljSPHHxDnR4fqVcBt/zR2zJAb9juavmQg=
+golang.org/x/mod v0.42.0/go.mod h1:u5fzIrRInkL8MaO1cbRkUHT64v303YIT5KEqpNr7jRs=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
@@ -260,6 +260,11 @@ func getSource(ctx context.Context, opts *options.Catalog, userInput string, sou
 		cfg = cfg.WithDigestAlgorithms(hashers...)
 	}

+	if source.ParseScope(opts.Scope) != source.SquashedScope {
+		// every other scope reads each layer's squash, which is cheaper to build while the image is read
+		ctx = internal.WithEagerLayerSquashes(ctx)
+	}
+
 	src, err := syft.GetSource(ctx, userInput, cfg)
 	if err != nil {
 		return nil, fmt.Errorf("could not determine source: %w", err)
@@ -22,12 +22,12 @@ require (
 	github.com/anchore/go-sync v0.1.2
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.2.0
-	github.com/anchore/stereoscope v0.3.4
+	github.com/anchore/stereoscope v0.3.5-0.20261030023738-43c8f7e4fc46
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
 	github.com/aquasecurity/go-pep440-version v0.0.1
 	github.com/bitnami/go-version v0.0.0-20250131085805-b1f57a8634ef
 	github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
-	github.com/bmatcuk/doublestar/v4 v4.10.2
+	github.com/bmatcuk/doublestar/v4 v4.10.3
 	github.com/cespare/xxhash/v2 v2.3.0
 	github.com/charmbracelet/bubbles v1.0.0
 	github.com/charmbracelet/bubbletea v1.3.10
@@ -43,7 +43,7 @@ require (
 	github.com/gkampitakis/go-snaps v0.5.23
 	github.com/go-git/go-billy/v5 v5.9.2
 	github.com/go-git/go-git/v5 v5.19.3
-	github.com/go-test/deep v1.1.1
+	github.com/go-test/deep v1.1.2
 	github.com/go-viper/mapstructure/v2 v2.5.0
 	github.com/goccy/go-yaml v1.19.2
 	github.com/gohugoio/hashstructure v0.6.0
@@ -51,7 +51,7 @@ require (
 	github.com/google/go-containerregistry v0.22.1
 	github.com/google/licensecheck v0.3.1
 	github.com/google/uuid v1.6.0
-	github.com/gookit/color v1.6.2
+	github.com/gookit/color v1.6.3
 	github.com/gpustack/gguf-parser-go v0.26.4
 	github.com/hashicorp/go-cleanhttp v0.5.2
 	github.com/hashicorp/go-getter v1.8.10
@@ -62,7 +62,7 @@ require (
 	github.com/jedib0t/go-pretty/v6 v6.8.3
 	github.com/jinzhu/copier v0.4.0
 	github.com/kastenhq/goversion v0.0.0-20230811215019-93b2f8823953
-	github.com/klauspost/compress v1.20.1
+	github.com/klauspost/compress v1.20.3
 	github.com/magiconair/properties v1.18.12
 	github.com/mholt/archives v0.1.5
 	github.com/moby/sys/mountinfo v0.7.2
@@ -93,10 +93,10 @@ require (
 	go.uber.org/goleak v1.3.0
 	go.yaml.in/yaml/v3 v3.0.5
 	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
-	golang.org/x/mod v0.41.0
+	golang.org/x/mod v0.42.0
 	golang.org/x/net v0.61.0
 	golang.org/x/time v0.16.0
-	golang.org/x/tools v0.51.0
+	golang.org/x/tools v0.52.0
 	modernc.org/sqlite v1.60.1
 )

@@ -156,7 +156,6 @@ require (
 	github.com/aws/smithy-go v1.28.1 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/bahlo/generic-list-go v0.2.0 // indirect
-	github.com/becheran/wildmatch-go v1.0.0 // indirect
 	github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
 	github.com/bodgit/plumbing v1.3.0 // indirect
 	github.com/bodgit/sevenzip v1.6.1 // indirect
@@ -173,7 +172,7 @@ require (
 	github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 // indirect
 	github.com/containerd/cgroups/v3 v3.1.3 // indirect
 	github.com/containerd/containerd/api v1.12.0 // indirect
-	github.com/containerd/containerd/v2 v2.4.1 // indirect
+	github.com/containerd/containerd/v2 v2.4.2 // indirect
 	github.com/containerd/continuity v0.5.0 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
@@ -189,9 +188,9 @@ require (
 	github.com/containers/ocicrypt v1.3.2 // indirect
 	github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 // indirect
 	github.com/cyphar/filepath-securejoin v0.7.0 // indirect
-	github.com/docker/cli v29.8.2+incompatible // indirect
+	github.com/docker/cli v29.9.1+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.9.8 // indirect
-	github.com/docker/go-connections v0.8.1 // indirect
+	github.com/docker/go-connections v0.8.2 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
@@ -205,7 +204,7 @@ require (
 	github.com/gabriel-vasile/mimetype v1.4.15 // indirect
 	github.com/gkampitakis/ciinfo v0.3.4 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.5 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.6 // indirect
 	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-restruct/restruct v1.2.0-alpha // indirect
@@ -246,8 +245,8 @@ require (
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/locker v1.0.1 // indirect
-	github.com/moby/moby/api v1.56.0 // indirect
-	github.com/moby/moby/client v0.6.0 // indirect
+	github.com/moby/moby/api v1.56.1 // indirect
+	github.com/moby/moby/client v0.6.2 // indirect
 	github.com/moby/sys/capability v0.4.0 // indirect
 	github.com/moby/sys/signal v0.7.1 // indirect
 	github.com/moby/sys/user v0.4.1 // indirect
@@ -328,7 +327,7 @@ require (
 	go.opentelemetry.io/otel/sdk/metric v1.46.0 // indirect
 	go.opentelemetry.io/otel/trace v1.46.0 // indirect
 	go.podman.io/image/v5 v5.41.2 // indirect
-	go.podman.io/storage v1.64.1 // indirect
+	go.podman.io/storage v1.64.2 // indirect
 	go4.org v0.0.0-20230225012048-214862532bf5 // indirect
 	golang.org/x/crypto v0.58.0 // indirect
 	golang.org/x/oauth2 v0.37.0 // indirect
@@ -150,8 +150,8 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZV
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/packageurl-go v0.2.0 h1:CkrM4RMUwrEGAiE1OVlxaZNzWj0TuHRey7o4T/EAErk=
 github.com/anchore/packageurl-go v0.2.0/go.mod h1:2JCgOQMIsqZ7TmliXG4PnUthPJAKE3mWQbsW2XHjAOE=
-github.com/anchore/stereoscope v0.3.4 h1:dT5AfjCTXUJowMiRIc+VBQVwvwnIEwnxxwA1GwAkMxw=
-github.com/anchore/stereoscope v0.3.4/go.mod h1:+HxqHTt7dvH8mea0mf3ulqkf084VvHiT1grpAQf5uEs=
+github.com/anchore/stereoscope v0.3.5-0.20261030023738-43c8f7e4fc46 h1:0ZL8d1vjsJKNUu480/F8x41O701vbQvYgZFmoiKho7o=
+github.com/anchore/stereoscope v0.3.5-0.20261030023738-43c8f7e4fc46/go.mod h1:sfJpowN3ZfLVtx0QTc+3/kdM7ub37Hpi9aBVmdANqz4=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ=
 github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
@@ -217,8 +217,6 @@ github.com/aymanbagabas/go-udiff v0.3.1 h1:LV+qyBQ2pqe0u42ZsUEtPiCaUoqgA9gYRDs3v
 github.com/aymanbagabas/go-udiff v0.3.1/go.mod h1:G0fsKmG+P6ylD0r6N/KgQD/nWzgfnl8ZBcNLgcbrw8E=
 github.com/bahlo/generic-list-go v0.2.0 h1:5sz/EEAK+ls5wF+NeqDpk5+iNdMDXrh3z3nPnH1Wvgk=
 github.com/bahlo/generic-list-go v0.2.0/go.mod h1:2KvAjgMlE5NNynlg/5iLrrCCZ2+5xWbdbCW3pNTGyYg=
-github.com/becheran/wildmatch-go v1.0.0 h1:mE3dGGkTmpKtT4Z+88t8RStG40yN9T+kFEGj2PZFSzA=
-github.com/becheran/wildmatch-go v1.0.0/go.mod h1:gbMvj0NtVdJ15Mg/mH9uxk2R1QCistMyU7d9KFzroX4=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
@@ -229,8 +227,8 @@ github.com/bitnami/go-version v0.0.0-20250131085805-b1f57a8634ef h1:TSFnfbbu2oAO
 github.com/bitnami/go-version v0.0.0-20250131085805-b1f57a8634ef/go.mod h1:9iglf1GG4oNRJ39bZ5AZrjgAFD2RwQbXw6Qf7Cs47wo=
 github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb h1:m935MPodAbYS46DG4pJSv7WO+VECIWUQ7OJYSoTrMh4=
 github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb/go.mod h1:PkYb9DJNAwrSvRx5DYA+gUcOIgTGVMNkfSCbZM8cWpI=
-github.com/bmatcuk/doublestar/v4 v4.10.2 h1:eF7W7HWKg3z9NrWV9pTLnNeoXaqq3Tq9DNKXVMfoCnw=
-github.com/bmatcuk/doublestar/v4 v4.10.2/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
+github.com/bmatcuk/doublestar/v4 v4.10.3 h1:1UIv1+fqH3++ViVkpnaPTB+Pi1UHycnPFAq14zgK+gI=
+github.com/bmatcuk/doublestar/v4 v4.10.3/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/bodgit/plumbing v1.3.0 h1:pf9Itz1JOQgn7vEOE7v7nlEfBykYqvUYioC61TwWCFU=
 github.com/bodgit/plumbing v1.3.0/go.mod h1:JOTb4XiRu5xfnmdnDJo6GmSbSbtSyufrsyZFByMtKEs=
 github.com/bodgit/sevenzip v1.6.1 h1:kikg2pUMYC9ljU7W9SaqHXhym5HyKm8/M/jd31fYan4=
@@ -300,8 +298,8 @@ github.com/containerd/cgroups/v3 v3.1.3 h1:eUNflyMddm18+yrDmZPn3jI7C5hJ9ahABE5q6
 github.com/containerd/cgroups/v3 v3.1.3/go.mod h1:PKZ2AcWmSBsY/tJUVhtS/rluX0b1uq1GmPO1ElCmbOw=
 github.com/containerd/containerd/api v1.12.0 h1:kuQm82SbDrCuO4n7hf2L8zsBtZLuympyq5X/VotfX2A=
 github.com/containerd/containerd/api v1.12.0/go.mod h1:EBcSzoi9Vl18cdODaXUCskf3D2NT8lsSXeZJnU5jIUc=
-github.com/containerd/containerd/v2 v2.4.1 h1:DUx/ZJN7cEu0WuzHClDB+68H/bqMEH5pWoEjf0ae4hc=
-github.com/containerd/containerd/v2 v2.4.1/go.mod h1:vgLdtvl3prFk1d3ZVqQcsDD5Q9IKM+vAIdU54U85w+I=
+github.com/containerd/containerd/v2 v2.4.2 h1:p6Qg+xbEz8lvwdhHDx0U469xENvp4LgGBx+E7djXkGw=
+github.com/containerd/containerd/v2 v2.4.2/go.mod h1:vgLdtvl3prFk1d3ZVqQcsDD5Q9IKM+vAIdU54U85w+I=
 github.com/containerd/continuity v0.5.0 h1:7a85HZpCSs+1Zps0Ee3DPSuAWY+0SJM1JNM51nlEVDg=
 github.com/containerd/continuity v0.5.0/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
@@ -353,14 +351,14 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c=
 github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0=
-github.com/docker/cli v29.8.2+incompatible h1:2zgdFuoFst2T80oS42vhKGxkd0JRo305eIEKTsxR7pQ=
-github.com/docker/cli v29.8.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v29.9.1+incompatible h1:E4YGy7TMkPk7mFsXTVUyjHxVeJdjTDfIS0X4Q0+ioQ0=
+github.com/docker/cli v29.9.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker-credential-helpers v0.9.8 h1:bIREROb7So6PRlq6KTtdS9MPEjC29OQRkFNlvK2OX8Q=
 github.com/docker/docker-credential-helpers v0.9.8/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c=
-github.com/docker/go-connections v0.8.1 h1:JibmG5hULs5qXSr/cp/w3Pw5fZuStt4MOHMUExb29/M=
-github.com/docker/go-connections v0.8.1/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
+github.com/docker/go-connections v0.8.2 h1:9d9DEokx5W7qlr0shkFXIxEA7+TTD+llwzcykSlxMNc=
+github.com/docker/go-connections v0.8.2/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 h1:2tV76y6Q9BB+NEBasnqvs7e49aEBFI8ejC89PSnWH+4=
@@ -443,8 +441,8 @@ github.com/go-git/go-git/v5 v5.19.3/go.mod h1:Ye4C8dVigkqrv9UsB4NMdSLV4yAIkLiIhW
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-jose/go-jose/v4 v4.1.5 h1:RjgjO2LOtWOJKUC5wpwY9LR3B3vwVAz6JS2YHfYU6eA=
-github.com/go-jose/go-jose/v4 v4.1.5/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-jose/go-jose/v4 v4.1.6 h1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=
+github.com/go-jose/go-jose/v4 v4.1.6/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
@@ -458,8 +456,8 @@ github.com/go-restruct/restruct v1.2.0-alpha h1:2Lp474S/9660+SJjpVxoKuWX09JsXHSr
 github.com/go-restruct/restruct v1.2.0-alpha/go.mod h1:KqrpKpn4M8OLznErihXTGLlsXFGeLxHUrLRRI/1YjGk=
 github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
-github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
-github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
+github.com/go-test/deep v1.1.2 h1:JUuyv17rKrqYfLFnP9A4Yh6hw0635ugB93bMg2bwuDQ=
+github.com/go-test/deep v1.1.2/go.mod h1:lwVFiFFWPjydTsV3xGJ/YTQsnWwi8zxBFM+gOVcwINE=
 github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
 github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/gobwas/httphead v0.1.0/go.mod h1:O/RXo79gxV8G+RqlR/otEwx4Q36zl9rqC5u12GKvMCM=
@@ -575,8 +573,8 @@ github.com/googleapis/gax-go/v2 v2.24.1/go.mod h1:bWeBei0NVwaNZKb2y1HUBS7gLXIF3/
 github.com/gookit/assert v0.1.1 h1:lh3GcawXe/p+cU7ESTZ5Ui3Sm/x8JWpIis4/1aF0mY0=
 github.com/gookit/assert v0.1.1/go.mod h1:jS5bmIVQZTIwk42uXl4lyj4iaaxx32tqH16CFj0VX2E=
 github.com/gookit/color v1.2.5/go.mod h1:AhIE+pS6D4Ql0SQWbBeXPHw7gY0/sjHoA4s/n1KB7xg=
-github.com/gookit/color v1.6.2 h1:M6TJRJMuDFPYkrWmjOvMj+E0xIjcHq8lMPy7+vv0z1Y=
-github.com/gookit/color v1.6.2/go.mod h1:9ACFc7/1IpHGBW8RwuDm/0YEnhg3dwwXpoMsmtyHfjs=
+github.com/gookit/color v1.6.3 h1:m6E49x+KftGaspcLtPLMsyci2ARhWIUW0PUV1owMlhs=
+github.com/gookit/color v1.6.3/go.mod h1:9ACFc7/1IpHGBW8RwuDm/0YEnhg3dwwXpoMsmtyHfjs=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
 github.com/gpustack/gguf-parser-go v0.26.4 h1:B9CRrQBcIB7I/MJFZvzPZ+e+cbc1xBzQJcmpi9l/mKU=
@@ -666,8 +664,8 @@ github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
-github.com/klauspost/compress v1.20.1 h1:T7kKElXUMXrUJ2E9QhQhxFtcK5rPyLdsGZvdbLMPdiQ=
-github.com/klauspost/compress v1.20.1/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
+github.com/klauspost/compress v1.20.3 h1:zWNoFqq/lSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=
+github.com/klauspost/compress v1.20.3/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
 github.com/klauspost/pgzip v1.2.6/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
@@ -748,10 +746,10 @@ github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3N
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
-github.com/moby/moby/api v1.56.0 h1:GQzua3NA599ASSIICx0iFgiJeO9YkdDARvQsm23ZZuQ=
-github.com/moby/moby/api v1.56.0/go.mod h1:sZ+THbVWkjOmBPPfbnzdD/G1LuIexWhqlSHHPTDQ1Uk=
-github.com/moby/moby/client v0.6.0 h1:AJjEB21QPbXSXjDsZorFBoDZPhMrfbpaPLgSMAW9Bgs=
-github.com/moby/moby/client v0.6.0/go.mod h1:OCo00wNRyA3m4lmJ228W3JbyCN4ZNNYjpOXiJydBdcQ=
+github.com/moby/moby/api v1.56.1 h1:PpWkvVPB7Fr/No8w+TfyJ/I6rWZ2YPZhT3JorIg+06c=
+github.com/moby/moby/api v1.56.1/go.mod h1:sZ+THbVWkjOmBPPfbnzdD/G1LuIexWhqlSHHPTDQ1Uk=
+github.com/moby/moby/client v0.6.2 h1:ekSPlMccrZGcw6Scb8T9D39qE0mB+XupU/yS0zNw9N4=
+github.com/moby/moby/client v0.6.2/go.mod h1:DGcnO7qmPJrqobx/ggQgQ/AUk+2wgVdQv7uxB0/mEsc=
 github.com/moby/sys/capability v0.4.0 h1:4D4mI6KlNtWMCM1Z/K0i7RV1FkX+DBDHKVJpCndZoHk=
 github.com/moby/sys/capability v0.4.0/go.mod h1:4g9IK291rVkms3LKCDOoYlnV8xKwoDTpIrNEE35Wq0I=
 github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
@@ -1074,8 +1072,8 @@ go.opentelemetry.io/otel/trace v1.46.0/go.mod h1:J7GAXweO77XSFkB/rmAqk9D6ihszhFj
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 go.podman.io/image/v5 v5.41.2 h1:YnVaFrGLPWSBmipKfNvlOsGcBtk5bUxlPxQ+A6CS/uo=
 go.podman.io/image/v5 v5.41.2/go.mod h1:T/bzxEFpdpAzyHabPmcq5K+my3wBsht22sFkFjJSKT4=
-go.podman.io/storage v1.64.1 h1:DqbG8scW/bD3xHiSRzV7O5fzn46qVC+SwmUN6C6Fr5w=
-go.podman.io/storage v1.64.1/go.mod h1:ft0DzCRMZs1yn0rszmLYXEEwgd7IIc66JRwSRPUDwwc=
+go.podman.io/storage v1.64.2 h1:sIBU2vsdGo2gghTF17oxw4G4gojEZkPmt0LKiZWIwqc=
+go.podman.io/storage v1.64.2/go.mod h1:ft0DzCRMZs1yn0rszmLYXEEwgd7IIc66JRwSRPUDwwc=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
@@ -1147,8 +1145,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
-golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
+golang.org/x/mod v0.42.0 h1:ICeL3t2L30ljSPHHxDnR4fqVcBt/zR2zJAb9juavmQg=
+golang.org/x/mod v0.42.0/go.mod h1:u5fzIrRInkL8MaO1cbRkUHT64v303YIT5KEqpNr7jRs=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1410,8 +1408,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI=
-golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA=
+golang.org/x/tools v0.52.0 h1:ryxg4U63oaUYk7uOLTF37n43f4qgtGvqV4Ioit1BaEs=
+golang.org/x/tools v0.52.0/go.mod h1:ItcP5UNaVGG+Yc4eIYmaFLNJ4soEopkx5Y2d4lcEurs=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -0,0 +1,17 @@
+package internal
+
+import "context"
+
+type eagerLayerSquashesKey struct{}
+
+// WithEagerLayerSquashes has the image source provider build every layer's squashed tree while it reads the
+// image, instead of the first time each one is used. Set it when the scan will read lower layers (any scope but
+// squashed): eager squashing overlaps with fetching and indexing the layers, so those scans finish sooner.
+func WithEagerLayerSquashes(ctx context.Context) context.Context {
+	return context.WithValue(ctx, eagerLayerSquashesKey{}, true)
+}
+
+func EagerLayerSquashes(ctx context.Context) bool {
+	v, _ := ctx.Value(eagerLayerSquashesKey{}).(bool)
+	return v
+}
@@ -2131,40 +2131,40 @@ var urlToLicense = map[string]string{
 	"raw.githubusercontent.com/NTIA/scos-sensor/refs/heads/master/LICENSE.md":                                        "NTIA-PD",
 	"raw.githubusercontent.com/OpenMDW/OpenMDW/refs/heads/main/1.0/LICENSE.openmdw":                                  "OpenMDW-1.0",
 	"raw.githubusercontent.com/blackhole89/notekit/master/data/fonts/Charter%20license.txt":                          "Bitstream-Charter",
-	"raw.githubusercontent.com/landtuna/open-mtools/6c04c2882eca7c4313ec267766ea53ac9bfe129b/mdump.c": "Informatica",
-	"raw.githubusercontent.com/landtuna/open-mtools/6c04c2882eca7c4313ec267766ea53ac9bfe129b/msend.c": "Informatica",
-	"rc.quest.com/topics/openssh/license.php#tcpwrappers":                                             "TCP-wrappers",
-	"research.cs.wisc.edu/condor/license.html#condor":                                                 "Condor-1.1",
-	"research.scea.com/scea_shared_source_license.html":                                               "SCEA",
-	"romanrm.net/mit-zero":                                                                                                                       "MIT-0",
-	"sam.zoy.org/wtfpl/COPYING":                                                                                                                  "WTFPL",
-	"scancode-licensedb.aboutcode.org/bsd-unchanged":                                                                                             "BSD-2-Clause-pos-unchanged",
-	"scripts.sil.org/cms/scripts/page.php?item_id=OFL10_web":                                                                                     "OFL-1.0-no-RFN",
-	"scripts.sil.org/cms/scripts/page.php?item_id=OFL_web":                                                                                       "OFL-1.1-no-RFN",
-	"slicer.org/LICENSE":                                                                                                                         "3D-Slicer-1.0",
-	"solderpad.org/licenses/SHL-0.5/":                                                                                                            "SHL-0.5",
-	"solderpad.org/licenses/SHL-0.51/":                                                                                                           "SHL-0.51",
-	"source.icu-project.org/repos/icu/icu/trunk/license.html":                                                                                    "ICU",
-	"sourceforge.net/p/buddy/gitcode/ci/master/tree/README":                                                                                      "Buddy",
-	"sourceforge.net/p/ctrio/git/ci/master/tree/README":                                                                                          "ISC-Veillard",
-	"sourceforge.net/p/mcj/xfig/ci/master/tree/src/Makefile.am":                                                                                  "Xfig",
-	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/converter/other/pnmtorle.c":                                                            "URT-RLE",
-	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/converter/other/rletopnm.c":                                                            "URT-RLE",
-	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/converter/ppm/ppmtompeg/jrevdct.c#l1189":                                               "MPEG-SSG",
-	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/editor/pnmstitch.c#l2":                                                                 "pnmstitch",
-	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/netpbm.c#l8":                                                                           "HPND-Pbmplus",
-	"sourceforge.net/p/sbcl/sbcl/ci/master/tree/src/code/loop.lisp":                                                                              "LOOP",
-	"sourceforge.net/p/trustedqsl/tqsl/ci/master/tree/LICENSE.txt":                                                                               "TrustedQSL",
-	"sourceforge.net/p/xmedcon/code/ci/master/tree/libs/dicom/README":                                                                            "OFFIS",
-	"sourceforge.net/p/xmedcon/code/ci/master/tree/libs/ljpg/":                                                                                   "IJG-short",
-	"sourceforge.net/projects/sevenzip/files/LZMA%20SDK/":                                                                                        "LZMA-SDK-9.22",
-	"sources.debian.org/copyright/license/debianutils/4.11.2/":                                                                                   "SMAIL-GPL",
-	"sources.debian.org/src/openmpi/4.1.0-10/ompi/debuggers/msgq_interface.h/?hl=19#L19":                                                         "mpi-permissive",
-	"sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/licenses/BitTorrent?r1=1.1&r2=1.1.1.1&diff_format=s":                                       "BitTorrent-1.0",
-	"sourceware.org/bzip2/1.0.5/bzip2-manual-1.0.5.html":                                                                                         "bzip2-1.0.6",
-	"sourceware.org/cgit/binutils-gdb/tree/include/coff/sym.h#n11":                                                                               "MIPS",
-	"sourceware.org/cgit/binutils-gdb/tree/include/coff/symconst.h#n11":                                                                          "ThirdEye",
-	"sourceware.org/cgit/valgrind/tree/mpi/libmpiwrap.c":                                                                                         "bzip2-1.0.6",
+	"raw.githubusercontent.com/landtuna/open-mtools/6c04c2882eca7c4313ec267766ea53ac9bfe129b/mdump.c":                "Informatica",
+	"raw.githubusercontent.com/landtuna/open-mtools/6c04c2882eca7c4313ec267766ea53ac9bfe129b/msend.c":                "Informatica",
+	"rc.quest.com/topics/openssh/license.php#tcpwrappers":                                                            "TCP-wrappers",
+	"research.cs.wisc.edu/condor/license.html#condor":                                                                "Condor-1.1",
+	"research.scea.com/scea_shared_source_license.html":                                                              "SCEA",
+	"romanrm.net/mit-zero":                                                                                           "MIT-0",
+	"sam.zoy.org/wtfpl/COPYING":                                                                                      "WTFPL",
+	"scancode-licensedb.aboutcode.org/bsd-unchanged":                                                                 "BSD-2-Clause-pos-unchanged",
+	"scripts.sil.org/cms/scripts/page.php?item_id=OFL10_web":                                                         "OFL-1.0-no-RFN",
+	"scripts.sil.org/cms/scripts/page.php?item_id=OFL_web":                                                           "OFL-1.1-no-RFN",
+	"slicer.org/LICENSE":                                                                                             "3D-Slicer-1.0",
+	"solderpad.org/licenses/SHL-0.5/":                                                                                "SHL-0.5",
+	"solderpad.org/licenses/SHL-0.51/":                                                                               "SHL-0.51",
+	"source.icu-project.org/repos/icu/icu/trunk/license.html":                                                        "ICU",
+	"sourceforge.net/p/buddy/gitcode/ci/master/tree/README":                                                          "Buddy",
+	"sourceforge.net/p/ctrio/git/ci/master/tree/README":                                                              "ISC-Veillard",
+	"sourceforge.net/p/mcj/xfig/ci/master/tree/src/Makefile.am":                                                      "Xfig",
+	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/converter/other/pnmtorle.c":                                "URT-RLE",
+	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/converter/other/rletopnm.c":                                "URT-RLE",
+	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/converter/ppm/ppmtompeg/jrevdct.c#l1189":                   "MPEG-SSG",
+	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/editor/pnmstitch.c#l2":                                     "pnmstitch",
+	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/netpbm.c#l8":                                               "HPND-Pbmplus",
+	"sourceforge.net/p/sbcl/sbcl/ci/master/tree/src/code/loop.lisp":                                                  "LOOP",
+	"sourceforge.net/p/trustedqsl/tqsl/ci/master/tree/LICENSE.txt":                                                   "TrustedQSL",
+	"sourceforge.net/p/xmedcon/code/ci/master/tree/libs/dicom/README":                                                "OFFIS",
+	"sourceforge.net/p/xmedcon/code/ci/master/tree/libs/ljpg/":                                                       "IJG-short",
+	"sourceforge.net/projects/sevenzip/files/LZMA%20SDK/":                                                            "LZMA-SDK-9.22",
+	"sources.debian.org/copyright/license/debianutils/4.11.2/":                                                       "SMAIL-GPL",
+	"sources.debian.org/src/openmpi/4.1.0-10/ompi/debuggers/msgq_interface.h/?hl=19#L19":                             "mpi-permissive",
+	"sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/licenses/BitTorrent?r1=1.1&r2=1.1.1.1&diff_format=s":           "BitTorrent-1.0",
+	"sourceware.org/bzip2/1.0.5/bzip2-manual-1.0.5.html":                                                             "bzip2-1.0.6",
+	"sourceware.org/cgit/binutils-gdb/tree/include/coff/sym.h#n11":                                                   "MIPS",
+	"sourceware.org/cgit/binutils-gdb/tree/include/coff/symconst.h#n11":                                              "ThirdEye",
+	"sourceware.org/cgit/valgrind/tree/mpi/libmpiwrap.c":                                                             "bzip2-1.0.6",
 	"sourceware.org/git/?p=binutils-gdb.git;a=blob;f=libiberty/strcasecmp.c;h=131d81c2ce7881fa48c363dc5bf5fb302c61ce0b;hb=HEAD":                  "BSD-4.3RENO",
 	"sourceware.org/git/?p=binutils-gdb.git;a=blob;f=readline/readline/support/wcwidth.c;h=0f5ec995796f4813abbcf4972aec0378ab74722a;hb=HEAD#l55": "HPND-Markus-Kuhn",
 	"sourceware.org/git/?p=bzip2.git;a=blob;f=LICENSE;hb=bzip2-1.0.6":                                                                            "bzip2-1.0.6",
@@ -1,6 +1,7 @@
 package binary

 import (
+	"bytes"
 	"context"
 	"errors"
 	"flag"
@@ -20,6 +21,7 @@ import (
 	"github.com/anchore/syft/internal/testutils"
 	"github.com/anchore/syft/syft/cpe"
 	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/internal/unionreader"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/binary/internal/manager/testutil"
 	"github.com/anchore/syft/syft/pkg/cataloger/internal/binutils"
@@ -2176,6 +2178,28 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 				Metadata:  metadata("istio-binary"),
 			},
 		},
+		{
+			logicalFixture: "istio_pilot-discovery/1.19.0-rc.0/linux-amd64",
+			expected: pkg.Package{
+				Name:      "pilot-discovery",
+				Version:   "1.19.0-rc.0",
+				Type:      "binary",
+				PURL:      "pkg:generic/istio@1.19.0-rc.0",
+				Locations: locations("pilot-discovery"),
+				Metadata:  metadata("istio-binary"),
+			},
+		},
+		{
+			logicalFixture: "istio_pilot-discovery/1.15.0-beta.0/linux-amd64",
+			expected: pkg.Package{
+				Name:      "pilot-discovery",
+				Version:   "1.15.0-beta.0",
+				Type:      "binary",
+				PURL:      "pkg:generic/istio@1.15.0-beta.0",
+				Locations: locations("pilot-discovery"),
+				Metadata:  metadata("istio-binary"),
+			},
+		},
 		{
 			logicalFixture: "istio_pilot-discovery/1.10-dev/linux-amd64",
 			expected: pkg.Package{
@@ -2198,6 +2222,17 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 				Metadata:  metadata("istio-binary"),
 			},
 		},
+		{
+			logicalFixture: "istio_pilot-discovery/1.5.0-alpha.0/linux-amd64",
+			expected: pkg.Package{
+				Name:      "pilot-discovery",
+				Version:   "1.5.0-alpha.0",
+				Type:      "binary",
+				PURL:      "pkg:generic/istio@1.5.0-alpha.0",
+				Locations: locations("pilot-discovery"),
+				Metadata:  metadata("istio-binary"),
+			},
+		},
 		{
 			logicalFixture: "istio_pilot-discovery/1.3.8/linux-amd64",
 			expected: pkg.Package{
@@ -2220,6 +2255,17 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 				Metadata:  metadata("istio-binary"),
 			},
 		},
+		{
+			logicalFixture: "istio_pilot-discovery/1.0.0-snapshot.0/linux-amd64",
+			expected: pkg.Package{
+				Name:      "pilot-discovery",
+				Version:   "1.0.0-snapshot.0",
+				Type:      "binary",
+				PURL:      "pkg:generic/istio@1.0.0-snapshot.0",
+				Locations: locations("pilot-discovery"),
+				Metadata:  metadata("istio-binary"),
+			},
+		},
 		{
 			logicalFixture: "istio_pilot-agent/1.29.0-alpha.0/linux-amd64",
 			expected: pkg.Package{
@@ -2264,6 +2310,28 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 				Metadata:  metadata("istio-binary"),
 			},
 		},
+		{
+			logicalFixture: "istio_pilot-agent/1.19.0-rc.0/linux-amd64",
+			expected: pkg.Package{
+				Name:      "pilot-agent",
+				Version:   "1.19.0-rc.0",
+				Type:      "binary",
+				PURL:      "pkg:generic/istio@1.19.0-rc.0",
+				Locations: locations("pilot-agent"),
+				Metadata:  metadata("istio-binary"),
+			},
+		},
+		{
+			logicalFixture: "istio_pilot-agent/1.15.0-beta.0/linux-amd64",
+			expected: pkg.Package{
+				Name:      "pilot-agent",
+				Version:   "1.15.0-beta.0",
+				Type:      "binary",
+				PURL:      "pkg:generic/istio@1.15.0-beta.0",
+				Locations: locations("pilot-agent"),
+				Metadata:  metadata("istio-binary"),
+			},
+		},
 		{
 			logicalFixture: "istio_pilot-agent/1.10-dev/linux-amd64",
 			expected: pkg.Package{
@@ -2286,6 +2354,17 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 				Metadata:  metadata("istio-binary"),
 			},
 		},
+		{
+			logicalFixture: "istio_pilot-agent/1.5.0-alpha.0/linux-amd64",
+			expected: pkg.Package{
+				Name:      "pilot-agent",
+				Version:   "1.5.0-alpha.0",
+				Type:      "binary",
+				PURL:      "pkg:generic/istio@1.5.0-alpha.0",
+				Locations: locations("pilot-agent"),
+				Metadata:  metadata("istio-binary"),
+			},
+		},
 		{
 			logicalFixture: "istio_pilot-agent/1.1.17/linux-amd64",
 			expected: pkg.Package{
@@ -2297,6 +2376,17 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 				Metadata:  metadata("istio-binary"),
 			},
 		},
+		{
+			logicalFixture: "istio_pilot-agent/1.0.0-snapshot.0/linux-amd64",
+			expected: pkg.Package{
+				Name:      "pilot-agent",
+				Version:   "1.0.0-snapshot.0",
+				Type:      "binary",
+				PURL:      "pkg:generic/istio@1.0.0-snapshot.0",
+				Locations: locations("pilot-agent"),
+				Metadata:  metadata("istio-binary"),
+			},
+		},
 		{
 			logicalFixture: "grafana/12.4.0-22081664032/linux-amd64",
 			expected: pkg.Package{
@@ -2539,6 +2629,39 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 				Metadata:  metadata("grafana-binary"),
 			},
 		},
+		{
+			logicalFixture: "envoy/1.40.1/linux-amd64",
+			expected: pkg.Package{
+				Name:      "envoy",
+				Version:   "1.40.1",
+				Type:      "binary",
+				PURL:      "pkg:generic/envoy@1.40.1",
+				Locations: locations("envoy"),
+				Metadata:  metadata("envoy-binary"),
+			},
+		},
+		{
+			logicalFixture: "envoy/1.40.0/linux-amd64",
+			expected: pkg.Package{
+				Name:      "envoy",
+				Version:   "1.40.0",
+				Type:      "binary",
+				PURL:      "pkg:generic/envoy@1.40.0",
+				Locations: locations("envoy"),
+				Metadata:  metadata("envoy-binary"),
+			},
+		},
+		{
+			logicalFixture: "envoy/1.37.1/linux-amd64",
+			expected: pkg.Package{
+				Name:      "envoy",
+				Version:   "1.37.1",
+				Type:      "binary",
+				PURL:      "pkg:generic/envoy@1.37.1",
+				Locations: locations("envoy"),
+				Metadata:  metadata("envoy-binary"),
+			},
+		},
 		{
 			logicalFixture: "envoy/1.36.4/linux-amd64",
 			expected: pkg.Package{
@@ -3192,6 +3315,134 @@ func Test_Cataloger_DefaultClassifiers_PositiveCases_Image(t *testing.T) {
 // Test_Cataloger_PackageTypes covers what assertPackagesAreEqual deliberately ignores: the package type and CPEs.
 // The perl interpreter is reported as cpan so it lines up with the rest of the CPAN ecosystem, everything else
 // keeps the default binary type.
+// Test_Cataloger_ffmpeg_versionSuffix verifies the ffmpeg classifiers no longer
+// unconditionally truncate the embedded "FFmpeg version <ver>" string to X.Y[.Z].
+// Semver build metadata (a backported-patch stamp such as
+// "9.0.3+dev.9.0.2.p1.eb9cef3") must be preserved in the reported version, because
+// it compares equal to its core version and so does not disturb vulnerability
+// matching. A "-" pre-release suffix (a distro revision such as "6.1.1-3ubuntu5")
+// must stay truncated: it sorts below the release in semver and would corrupt
+// version-range matching. Suffix-free binaries match exactly as before, and
+// trailing non-version text (or NUL padding) is never absorbed into the version.
+func Test_Cataloger_ffmpeg_versionSuffix(t *testing.T) {
+	// collect the ffmpeg classifiers under test, keyed by their FileGlob
+	classifiers := map[string]binutils.Classifier{}
+	for _, c := range DefaultClassifiers() {
+		if c.Package == "ffmpeg" {
+			classifiers[c.FileGlob] = c
+		}
+	}
+	require.NotEmpty(t, classifiers, "expected to find ffmpeg classifiers")
+
+	tests := []struct {
+		name     string
+		fileGlob string // which classifier to run
+		data     string // simulated binary contents
+		want     string // expected reported version ("" = no match expected)
+	}{
+		{
+			name:     "library bare version unchanged",
+			fileGlob: "**/libav*",
+			data:     "FFmpeg version 7.1.1",
+			want:     "7.1.1",
+		},
+		{
+			name:     "library two-component version unchanged",
+			fileGlob: "**/libav*",
+			data:     "FFmpeg version 6.0",
+			want:     "6.0",
+		},
+		{
+			name:     "library build metadata with patch provenance preserved",
+			fileGlob: "**/libav*",
+			data:     "FFmpeg version 9.0.3+dev.9.0.2.p1.eb9cef3",
+			want:     "9.0.3+dev.9.0.2.p1.eb9cef3",
+		},
+		{
+			name:     "library build metadata short sha preserved",
+			fileGlob: "**/libav*",
+			data:     "FFmpeg version 9.0.2+eb9cef3",
+			want:     "9.0.2+eb9cef3",
+		},
+		{
+			// a "-" pre-release suffix is intentionally NOT captured: it sorts below
+			// the release in semver and would corrupt version-range vulnerability
+			// matching, so distro revisions stay truncated exactly as before
+			name:     "library distro hyphen revision truncated",
+			fileGlob: "**/libav*",
+			data:     "FFmpeg version 6.1.1-3ubuntu5",
+			want:     "6.1.1",
+		},
+		{
+			name:     "library distro dotted hyphen revision truncated",
+			fileGlob: "**/libav*",
+			data:     "FFmpeg version 4.4.2-0ubuntu0.22.04.1",
+			want:     "4.4.2",
+		},
+		{
+			name:     "library trailing text not captured",
+			fileGlob: "**/libav*",
+			data:     "FFmpeg version 6.1.1 Copyright (c) 2000-2023 the FFmpeg developers",
+			want:     "6.1.1",
+		},
+		{
+			name:     "library NUL-padded version not over-captured",
+			fileGlob: "**/libav*",
+			data:     "FFmpeg version 9.0.3\x00libavformat.so",
+			want:     "9.0.3",
+		},
+		{
+			name:     "libswresample build metadata preserved",
+			fileGlob: "**/libswresample*",
+			data:     "FFmpeg version 9.0.3+dev.9.0.2.p1.eb9cef3",
+			want:     "9.0.3+dev.9.0.2.p1.eb9cef3",
+		},
+		{
+			// the compiled-in printf format string in the ffmpeg binary is the
+			// literal "%s version <ver>" (the program name is substituted at runtime)
+			name:     "binary build metadata preserved",
+			fileGlob: "**/ffmpeg",
+			data:     "%s version 9.0.3+dev.9.0.2.p1.eb9cef3",
+			want:     "9.0.3+dev.9.0.2.p1.eb9cef3",
+		},
+		{
+			name:     "binary bare version unchanged",
+			fileGlob: "**/ffmpeg",
+			data:     "%s version 7.1.1",
+			want:     "7.1.1",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cls, ok := classifiers[tt.fileGlob]
+			require.Truef(t, ok, "no ffmpeg classifier for glob %q", tt.fileGlob)
+
+			ctx := binutils.MatcherContext{
+				GetReader: func(binutils.MatcherContext) (unionreader.UnionReader, error) {
+					return unionreader.GetUnionReader(io.NopCloser(bytes.NewBufferString(tt.data)))
+				},
+			}
+
+			pkgs, err := cls.EvidenceMatcher(cls, ctx)
+			require.NoError(t, err)
+
+			if tt.want == "" {
+				require.Empty(t, pkgs, "expected no package match")
+				return
+			}
+			require.Len(t, pkgs, 1, "expected exactly one package")
+			assert.Equal(t, tt.want, pkgs[0].Version)
+			// the fuller version must also flow into the PURL so the SBOM is not lossy;
+			// compare the decoded PURL version, since packageurl-go percent-encodes
+			// reserved characters (e.g. '+' -> %2B) in the serialized form
+			parsed, err := packageurl.FromString(pkgs[0].PURL)
+			require.NoError(t, err, "PURL should parse")
+			assert.Equal(t, tt.want, parsed.Version)
+		})
+	}
+}
+
 func Test_Cataloger_PackageTypes(t *testing.T) {
 	tests := []struct {
 		logicalFixture string
@@ -972,7 +972,10 @@ func DefaultClassifiers() []binutils.Classifier {
 			EvidenceMatcher: m.FileContentsVersionMatcher(
 				// Pattern found in the binary: "%s version 7.1.1" or "%s version 6.0"
 				// When executed outputs: "ffmpeg version 7.1.1" or "ffmpeg version 6.0"
-				`(?m)%s version (?P<version>[0-9]+\.[0-9]+(\.[0-9]+)?)`,
+				// The optional "+" suffix preserves semver build metadata (e.g. a
+				// backported-patch stamp like "9.0.3+dev.9.0.2.p1.eb9cef3"); see the
+				// ffmpeg-library classifier for why "-" pre-release suffixes stay truncated.
+				`(?m)%s version (?P<version>[0-9]+\.[0-9]+(\.[0-9]+)?(?:\+[0-9A-Za-z]+(?:\.[0-9A-Za-z]+)*)?)`,
 			),
 			Package: "ffmpeg",
 			PURL:    mustPURL("pkg:generic/ffmpeg@version"),
@@ -982,8 +985,15 @@ func DefaultClassifiers() []binutils.Classifier {
 			Class:    "ffmpeg-library",
 			FileGlob: "**/libav*",
 			EvidenceMatcher: binutils.MatchAny(
-				// Primary pattern: FFmpeg version found in most libraries
-				m.FileContentsVersionMatcher(`(?m)FFmpeg version (?P<version>[0-9]+\.[0-9]+(\.[0-9]+)?)`),
+				// Primary pattern: FFmpeg version found in most libraries.
+				// The optional "+" suffix preserves semver build metadata (e.g. a
+				// backported-patch stamp like "9.0.3+dev.9.0.2.p1.eb9cef3") instead of
+				// truncating to X.Y[.Z]. Build metadata compares equal to its core
+				// version, so this does not change vulnerability matching. A "-"
+				// pre-release suffix (e.g. a distro revision "6.1.1-3ubuntu5") is
+				// deliberately NOT captured: it sorts below the release in semver and
+				// would corrupt version-range matching, so it stays truncated as before.
+				m.FileContentsVersionMatcher(`(?m)FFmpeg version (?P<version>[0-9]+\.[0-9]+(\.[0-9]+)?(?:\+[0-9A-Za-z]+(?:\.[0-9A-Za-z]+)*)?)`),
 				// Fallback: library-specific version patterns for libavcodec and libavformat
 				m.FileContentsVersionMatcher(`(?m)Lavc(?P<version>[0-9]+\.[0-9]+\.[0-9]+)`),
 				m.FileContentsVersionMatcher(`(?m)Lavf(?P<version>[0-9]+\.[0-9]+\.[0-9]+)`),
@@ -996,8 +1006,9 @@ func DefaultClassifiers() []binutils.Classifier {
 			Class:    "ffmpeg-library",
 			FileGlob: "**/libswresample*",
 			EvidenceMatcher: m.FileContentsVersionMatcher(
-				// FFmpeg version pattern for libswresample
-				`(?m)FFmpeg version (?P<version>[0-9]+\.[0-9]+(\.[0-9]+)?)`),
+				// FFmpeg version pattern for libswresample. Same optional "+" build
+				// metadata handling as the ffmpeg-library classifier above.
+				`(?m)FFmpeg version (?P<version>[0-9]+\.[0-9]+(\.[0-9]+)?(?:\+[0-9A-Za-z]+(?:\.[0-9A-Za-z]+)*)?)`),
 			Package: "ffmpeg",
 			PURL:    mustPURL("pkg:generic/ffmpeg@version"),
 			CPEs:    singleCPE("cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*", cpe.NVDDictionaryLookupSource),
@@ -1031,13 +1042,16 @@ func DefaultClassifiers() []binutils.Classifier {
 			EvidenceMatcher: binutils.MatchAny(
 				// [NUL]1.26.8[NUL][NUL]1.26.8[NUL]
 				// [NUL]1.3.7[NUL][NUL][NUL]1.3.8[NUL]
-				m.FileContentsVersionMatcher(`[0-9]+\.[0-9]+\.[0-9]+\x00+(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-dev)?)\x00+`),
+				// [NUL]1.15.0-beta.0[NUL][NUL][NUL]1.15.0-beta.0[NUL]  (pre-release builds repeat the full version, suffix included)
+				m.FileContentsVersionMatcher(`[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-snapshot\.[0-9]+|-dev)?\x00+(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-snapshot\.[0-9]+|-dev)?)\x00+`),
+				// [NUL][NUL][NUL]1.0.0-snapshot.0[NUL][NUL][NUL] (snapshot builds record the version only once)
+				m.FileContentsVersionMatcher(`\x00+(?P<version>[0-9]+\.[0-9]+\.[0-9]+-snapshot\.[0-9]+)\x00+`),
 				// Clean[NUL][NUL][NUL]1.8.0[NUL]
-				m.FileContentsVersionMatcher(`Clean\x00+(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-dev)?)\x00+`),
+				m.FileContentsVersionMatcher(`Clean\x00+(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-snapshot\.[0-9]+|-dev)?)\x00+`),
 				// Modified[NUL][NUL][NUL][NUL][NUL][NUL][NUL][NUL]1.10-dev[NUL][NUL][NUL]
 				m.FileContentsVersionMatcher(`Modified\x00+(?P<version>[0-9]+\.[0-9]+-dev)\x00+`),
 				// 1.1.17[NUL]...S=v<y5
-				m.FileContentsVersionMatcher(`(?s)(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-dev)?)\x00+.{1,100}S?=v<y5`),
+				m.FileContentsVersionMatcher(`(?s)(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-snapshot\.[0-9]+|-dev)?)\x00+.{1,100}S?=v<y5`),
 			),
 			Package: "pilot-discovery",
 			PURL:    mustPURL("pkg:generic/istio@version"),
@@ -1048,13 +1062,16 @@ func DefaultClassifiers() []binutils.Classifier {
 			FileGlob: "**/pilot-agent",
 			EvidenceMatcher: binutils.MatchAny(
 				// [NUL]1.26.8[NUL][NUL]1.26.8[NUL]
-				m.FileContentsVersionMatcher(`[0-9]+\.[0-9]+\.[0-9]+\x00+(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-dev)?)\x00+`),
+				// [NUL]1.15.0-beta.0[NUL][NUL][NUL]1.15.0-beta.0[NUL]  (pre-release builds repeat the full version, suffix included)
+				m.FileContentsVersionMatcher(`[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-snapshot\.[0-9]+|-dev)?\x00+(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-snapshot\.[0-9]+|-dev)?)\x00+`),
+				// [NUL][NUL][NUL]1.0.0-snapshot.0[NUL][NUL][NUL] (snapshot builds record the version only once)
+				m.FileContentsVersionMatcher(`\x00+(?P<version>[0-9]+\.[0-9]+\.[0-9]+-snapshot\.[0-9]+)\x00+`),
 				// Clean[NUL][NUL][NUL]1.8.0[NUL]
-				m.FileContentsVersionMatcher(`Clean\x00+(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-dev)?)\x00+`),
+				m.FileContentsVersionMatcher(`Clean\x00+(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-snapshot\.[0-9]+|-dev)?)\x00+`),
 				// Modified[NUL][NUL][NUL][NUL][NUL][NUL][NUL][NUL]1.10-dev[NUL][NUL][NUL]
 				m.FileContentsVersionMatcher(`Modified\x00+(?P<version>[0-9]+\.[0-9]+-dev)\x00+`),
 				// 1.1.17[NUL]...S=v<y5
-				m.FileContentsVersionMatcher(`(?s)(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-dev)?)\x00+.{1,100}S?=v<y5`),
+				m.FileContentsVersionMatcher(`(?s)(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha\.[0-9]+|-beta\.[0-9]+|-rc\.[0-9]+|-snapshot\.[0-9]+|-dev)?)\x00+.{1,100}S?=v<y5`),
 			),
 			Package: "pilot-agent",
 			PURL:    mustPURL("pkg:generic/istio@version"),
@@ -1118,9 +1135,12 @@ func DefaultClassifiers() []binutils.Classifier {
 			FileGlob: "**/envoy",
 			EvidenceMatcher: binutils.MatchAny(
 				// 1.3x [NUL]1.36.4[NUL]...envoy_reloadable_features
+				// 1.4x [NUL]1.40.1[NUL]...envoy_reloadable_features
 				// 1.34.5 [NUL]1.34.5[NUL]...envoy.reloadable_features
-				m.FileContentsVersionMatcher(`(?s)\x00(?P<version>1\.3[0-9]\.[0-9]+(-dev)?)\x00.{0,1000}envoy_reloadable_features`),
+				m.FileContentsVersionMatcher(`(?s)\x00(?P<version>1\.[34][0-9]\.[0-9]+(-dev)?)\x00.{0,1000}envoy_reloadable_features`),
 				m.FileContentsVersionMatcher(`(?s)\x00(?P<version>1\.34\.5)\x00.{0,200}envoy\.reloadable_features`),
+				// 1.37.1 DeltaDiscoveryResponse.removed_resources[NUL]1.37.1[NUL]the default now-
+				m.FileContentsVersionMatcher(`(?s)DeltaDiscoveryResponse\.removed_resources\x00(?P<version>1\.[34][0-9]\.[0-9]+(-dev)?)\x00`),
 				// 1.2x envoy_quic_...[NUL]1.28.7[NUL]
 				m.FileContentsVersionMatcher(`(?s)envoy_quic_.{0,1000}\x00(?P<version>1\.2[0-9]\.[0-9]+(-dev)?)\x00`),
 				// 1.2x [NUL]1.20.7[NUL]Unable to
@@ -1203,6 +1203,22 @@ from-images:
    paths:
      - /usr/local/bin/pilot-discovery

+  - name: istio_pilot-discovery
+    version: 1.19.0-rc.0
+    images:
+      - ref: istio/pilot:1.19.0-rc.0@sha256:09c3c80be369a9724f11e1edfc60cc0b4d58612a6a99ac7314f620254986b159
+        platform: linux/amd64
+    paths:
+      - /usr/local/bin/pilot-discovery
+
+  - name: istio_pilot-discovery
+    version: 1.15.0-beta.0
+    images:
+      - ref: istio/pilot:1.15.0-beta.0@sha256:07a1fd1b14ce51c47f0051f597e9b581020a2e5cc53d144592e85f3fa07bbef6
+        platform: linux/amd64
+    paths:
+      - /usr/local/bin/pilot-discovery
+
  - name: istio_pilot-discovery
    version: 1.10-dev
    images:
@@ -1219,6 +1235,14 @@ from-images:
    paths:
      - /usr/local/bin/pilot-discovery

+  - name: istio_pilot-discovery
+    version: 1.5.0-alpha.0
+    images:
+      - ref: istio/pilot:1.5.0-alpha.0@sha256:b372bcbacd5af241afe097bd017e16773514b6ba17152ca02b7d5285e290b110
+        platform: linux/amd64
+    paths:
+      - /usr/local/bin/pilot-discovery
+
  - name: istio_pilot-discovery
    version: 1.3.8
    images:
@@ -1235,6 +1259,14 @@ from-images:
    paths:
      - /usr/local/bin/pilot-discovery

+  - name: istio_pilot-discovery
+    version: 1.0.0-snapshot.0
+    images:
+      - ref: istio/pilot:1.0.0-snapshot.0@sha256:3b32619b36014eeafaad8199d8af48f7725e9e75a01c0b1abfba1d7166e53b66
+        platform: linux/amd64
+    paths:
+      - /usr/local/bin/pilot-discovery
+
  - name: istio_pilot-agent
    version: 1.29.0-alpha.0
    images:
@@ -1267,6 +1299,22 @@ from-images:
    paths:
      - /usr/local/bin/pilot-agent

+  - name: istio_pilot-agent
+    version: 1.19.0-rc.0
+    images:
+      - ref: istio/proxyv2:1.19.0-rc.0@sha256:8c23abb1663e83ec19cac1e3de46c3cf7e942329936463646ca7a8d8088806b4
+        platform: linux/amd64
+    paths:
+      - /usr/local/bin/pilot-agent
+
+  - name: istio_pilot-agent
+    version: 1.15.0-beta.0
+    images:
+      - ref: istio/proxyv2:1.15.0-beta.0@sha256:9f54e6fa64c6ef6bb8b3e72e513c4f0415f1576ae755b4fe9a5be8c8b38694de
+        platform: linux/amd64
+    paths:
+      - /usr/local/bin/pilot-agent
+
  - name: istio_pilot-agent
    version: 1.10-dev
    images:
@@ -1283,6 +1331,14 @@ from-images:
    paths:
      - /usr/local/bin/pilot-agent

+  - name: istio_pilot-agent
+    version: 1.5.0-alpha.0
+    images:
+      - ref: istio/proxyv2:1.5.0-alpha.0@sha256:6d31b7e373622b2d483124bdc46974ff7b39c9b3fff8a9dc73a47d91344a24f6
+        platform: linux/amd64
+    paths:
+      - /usr/local/bin/pilot-agent
+
  - name: istio_pilot-agent
    version: 1.1.17
    images:
@@ -1291,6 +1347,14 @@ from-images:
    paths:
      - /usr/local/bin/pilot-agent

+  - name: istio_pilot-agent
+    version: 1.0.0-snapshot.0
+    images:
+      - ref: istio/proxyv2:1.0.0-snapshot.0@sha256:13c352cd8b82c326d6e36a8d0a1eed9debe6b1816e30cfe79970d316c9e59714
+        platform: linux/amd64
+    paths:
+      - /usr/local/bin/pilot-agent
+
  - name: grafana
    version: 12.3.1
    images:
@@ -1515,6 +1579,27 @@ from-images:
    paths:
      - /usr/lib/x86_64-linux-gnu/libkrb5.so.26.0.0

+  - version: 1.40.1
+    images:
+      - ref: envoyproxy/envoy:v1.40.1@sha256:713bb146f1a7c97ebc70e13d259f77ff36f2c5d00f3145677816af5af9bd1530
+        platform: linux/amd64
+    paths:
+      - /usr/local/bin/envoy
+
+  - version: 1.40.0
+    images:
+      - ref: envoyproxy/envoy:v1.40.0@sha256:459f2a6404c340fe6afccd69d85527012d47f3c036765493e6f8f3113fa384de
+        platform: linux/amd64
+    paths:
+      - /usr/local/bin/envoy
+
+  - version: 1.37.1
+    images:
+      - ref: envoyproxy/envoy:v1.37.1@sha256:29496a88fba9c4c9cdef4afe8fec70f536c5ba111b1c2bddbc5436b091ceca33
+        platform: linux/amd64
+    paths:
+      - /usr/local/bin/envoy
+
  - version: 1.36.4
    images:
      - ref: envoyproxy/envoy:v1.36.4@sha256:ae31562b8cede20913a2d3d6a4f44c8479a50551e033cb8ef7bb8e38cec4b573
@@ -10,6 +10,7 @@ import (

 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/cpe"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/format"
 	"github.com/anchore/syft/syft/pkg"
@@ -57,6 +58,7 @@ func parseSBOM(_ context.Context, resolver file.Resolver, _ *generic.Environment

 		p.FoundBy = catalogerName
 		p.Type = pkg.BitnamiPkg
+		setApplicationPart(p.CPEs)
 		// replace all locations on the package with the location of the SBOM file.
 		// Why not keep the original list of locations? Since the "locations" field is meant to capture
 		// where there is evidence of this file, and the catalogers have not run against any file other than,
@@ -178,3 +180,13 @@ func findMainPkgID(relationships []artifact.Relationship) artifact.ID {

 	return ""
 }
+
+// setApplicationPart marks CPEs with an unspecified part as applications, since Bitnami SBOMs
+// describe application packages but leave the CPE part as a wildcard.
+func setApplicationPart(cpes []cpe.CPE) {
+	for i := range cpes {
+		if cpes[i].Attributes.Part == cpe.Any {
+			cpes[i].Attributes.Part = "a"
+		}
+	}
+}
@@ -37,7 +37,7 @@ func TestBitnamiCataloger(t *testing.T) {
 		FoundBy: catalogerName,
 		PURL:    "pkg:bitnami/postgresql@17.2.0-8?arch=arm64&distro=debian-12",
 		CPEs: mustCPEs(
-			"cpe:2.3:*:postgresql:postgresql:17.2.0:*:*:*:*:*:*:*",
+			"cpe:2.3:a:postgresql:postgresql:17.2.0:*:*:*:*:*:*:*",
 		),
 		Metadata: &pkg.BitnamiSBOMEntry{
 			Name:         "postgresql",
@@ -64,7 +64,7 @@ func TestBitnamiCataloger(t *testing.T) {
 			FoundBy: catalogerName,
 			PURL:    "pkg:bitnami/geos@3.13.0?arch=arm64&distro=debian-12",
 			CPEs: mustCPEs(
-				"cpe:2.3:*:libgeos:geos:3.13.0:*:*:*:*:*:*:*",
+				"cpe:2.3:a:libgeos:geos:3.13.0:*:*:*:*:*:*:*",
 			),
 			Metadata: &pkg.BitnamiSBOMEntry{
 				Name:         "geos",
@@ -86,7 +86,7 @@ func TestBitnamiCataloger(t *testing.T) {
 			FoundBy: catalogerName,
 			PURL:    "pkg:bitnami/proj@6.3.2?arch=arm64&distro=debian-12",
 			CPEs: mustCPEs(
-				"cpe:2.3:*:proj:proj:6.3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:proj:proj:6.3.2:*:*:*:*:*:*:*",
 			),
 			Metadata: &pkg.BitnamiSBOMEntry{
 				Name:         "proj",
@@ -108,7 +108,7 @@ func TestBitnamiCataloger(t *testing.T) {
 			FoundBy: catalogerName,
 			PURL:    "pkg:bitnami/gdal@3.10.1?arch=arm64&distro=debian-12",
 			CPEs: mustCPEs(
-				"cpe:2.3:*:osgeo:gdal:3.10.1:*:*:*:*:*:*:*",
+				"cpe:2.3:a:osgeo:gdal:3.10.1:*:*:*:*:*:*:*",
 			),
 			Metadata: &pkg.BitnamiSBOMEntry{
 				Name:         "gdal",
@@ -130,7 +130,7 @@ func TestBitnamiCataloger(t *testing.T) {
 			FoundBy: catalogerName,
 			PURL:    "pkg:bitnami/json-c@0.16.20220414?arch=arm64&distro=debian-12",
 			CPEs: mustCPEs(
-				"cpe:2.3:*:json-c_project:json-c:0.16.20220414:*:*:*:*:*:*:*",
+				"cpe:2.3:a:json-c_project:json-c:0.16.20220414:*:*:*:*:*:*:*",
 			),
 			Metadata: &pkg.BitnamiSBOMEntry{
 				Name:         "json-c",
@@ -152,7 +152,7 @@ func TestBitnamiCataloger(t *testing.T) {
 			FoundBy: catalogerName,
 			PURL:    "pkg:bitnami/orafce@4.14.1?arch=arm64&distro=debian-12",
 			CPEs: mustCPEs(
-				"cpe:2.3:*:orafce:orafce:4.14.1:*:*:*:*:*:*:*",
+				"cpe:2.3:a:orafce:orafce:4.14.1:*:*:*:*:*:*:*",
 			),
 			Metadata: &pkg.BitnamiSBOMEntry{
 				Name:         "orafce",
@@ -174,7 +174,7 @@ func TestBitnamiCataloger(t *testing.T) {
 			FoundBy: catalogerName,
 			PURL:    "pkg:bitnami/pljava@1.6.8?arch=arm64&distro=debian-12",
 			CPEs: mustCPEs(
-				"cpe:2.3:*:pl/java_project:pl/java:1.6.8:*:*:*:*:*:*:*",
+				"cpe:2.3:a:pl/java_project:pl/java:1.6.8:*:*:*:*:*:*:*",
 			),
 			Metadata: &pkg.BitnamiSBOMEntry{
 				Name:         "pljava",
@@ -201,7 +201,7 @@ func TestBitnamiCataloger(t *testing.T) {
 			FoundBy: catalogerName,
 			PURL:    "pkg:bitnami/unixodbc@2.3.12?arch=arm64&distro=debian-12",
 			CPEs: mustCPEs(
-				"cpe:2.3:*:unixodbc:unixodbc:2.3.12:*:*:*:*:*:*:*",
+				"cpe:2.3:a:unixodbc:unixodbc:2.3.12:*:*:*:*:*:*:*",
 			),
 			Metadata: &pkg.BitnamiSBOMEntry{
 				Name:         "unixodbc",
@@ -223,7 +223,7 @@ func TestBitnamiCataloger(t *testing.T) {
 			FoundBy: catalogerName,
 			PURL:    "pkg:bitnami/psqlodbc@16.0.0?arch=arm64&distro=debian-12",
 			CPEs: mustCPEs(
-				"cpe:2.3:*:postgresql:psqlodbc:16.0.0:*:*:*:*:*:*:*",
+				"cpe:2.3:a:postgresql:psqlodbc:16.0.0:*:*:*:*:*:*:*",
 			),
 			Metadata: &pkg.BitnamiSBOMEntry{
 				Name:         "psqlodbc",
@@ -245,7 +245,7 @@ func TestBitnamiCataloger(t *testing.T) {
 			FoundBy: catalogerName,
 			PURL:    "pkg:bitnami/protobuf@3.21.12?arch=arm64&distro=debian-12",
 			CPEs: mustCPEs(
-				"cpe:2.3:*:golang:protobuf:3.21.12:*:*:*:*:*:*:*",
+				"cpe:2.3:a:golang:protobuf:3.21.12:*:*:*:*:*:*:*",
 			),
 			Metadata: &pkg.BitnamiSBOMEntry{
 				Name:         "protobuf",
@@ -267,7 +267,7 @@ func TestBitnamiCataloger(t *testing.T) {
 			FoundBy: catalogerName,
 			PURL:    "pkg:bitnami/protobuf-c@1.5.1?arch=arm64&distro=debian-12",
 			CPEs: mustCPEs(
-				"cpe:2.3:*:protobuf-c:protobuf-c:1.5.1:*:*:*:*:*:*:*",
+				"cpe:2.3:a:protobuf-c:protobuf-c:1.5.1:*:*:*:*:*:*:*",
 			),
 			Metadata: &pkg.BitnamiSBOMEntry{
 				Name:         "protobuf-c",
@@ -289,7 +289,7 @@ func TestBitnamiCataloger(t *testing.T) {
 			FoundBy: catalogerName,
 			PURL:    "pkg:bitnami/postgis@3.4.4?arch=arm64&distro=debian-12",
 			CPEs: mustCPEs(
-				"cpe:2.3:*:postgis:postgis:3.4.4:*:*:*:*:*:*:*",
+				"cpe:2.3:a:postgis:postgis:3.4.4:*:*:*:*:*:*:*",
 			),
 			Metadata: &pkg.BitnamiSBOMEntry{
 				Name:         "postgis",
@@ -330,7 +330,7 @@ func TestBitnamiCataloger(t *testing.T) {
 			FoundBy: catalogerName,
 			PURL:    "pkg:bitnami/pgbackrest@2.54.2?arch=arm64&distro=debian-12",
 			CPEs: mustCPEs(
-				"cpe:2.3:*:pgbackrest:pgbackrest:2.54.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:pgbackrest:pgbackrest:2.54.2:*:*:*:*:*:*:*",
 			),
 			Metadata: &pkg.BitnamiSBOMEntry{
 				Name:         "pgbackrest",
@@ -352,7 +352,7 @@ func TestBitnamiCataloger(t *testing.T) {
 			FoundBy: catalogerName,
 			PURL:    "pkg:bitnami/wal2json@2.6.0?arch=arm64&distro=debian-12",
 			CPEs: mustCPEs(
-				"cpe:2.3:*:wal2json:wal2json:2.6.0:*:*:*:*:*:*:*",
+				"cpe:2.3:a:wal2json:wal2json:2.6.0:*:*:*:*:*:*:*",
 			),
 			Metadata: &pkg.BitnamiSBOMEntry{
 				Name:         "wal2json",
@@ -374,7 +374,7 @@ func TestBitnamiCataloger(t *testing.T) {
 			FoundBy: catalogerName,
 			PURL:    "pkg:bitnami/nss_wrapper@1.1.16?arch=arm64&distro=debian-12",
 			CPEs: mustCPEs(
-				"cpe:2.3:*:nss_wrapper:nss_wrapper:1.1.16:*:*:*:*:*:*:*",
+				"cpe:2.3:a:nss_wrapper:nss_wrapper:1.1.16:*:*:*:*:*:*:*",
 			),
 			Metadata: &pkg.BitnamiSBOMEntry{
 				Name:         "nss_wrapper",
@@ -410,7 +410,7 @@ func TestBitnamiCataloger(t *testing.T) {
 		FoundBy: catalogerName,
 		PURL:    "pkg:bitnami/render-template@1.0.7-4?arch=arm64&distro=debian-12",
 		CPEs: mustCPEs(
-			"cpe:2.3:*:render-template:render-template:1.0.7:*:*:*:*:*:*:*",
+			"cpe:2.3:a:render-template:render-template:1.0.7:*:*:*:*:*:*:*",
 		),
 		Metadata: &pkg.BitnamiSBOMEntry{
 			Name:         "render-template",
@@ -435,7 +435,7 @@ func TestBitnamiCataloger(t *testing.T) {
 		FoundBy: catalogerName,
 		PURL:    "pkg:bitnami/redis@7.4.0-0?arch=arm64&distro=debian-12",
 		CPEs: mustCPEs(
-			"cpe:2.3:*:redis:redis:7.4.0:*:*:*:*:*:*:*",
+			"cpe:2.3:a:redis:redis:7.4.0:*:*:*:*:*:*:*",
 		),
 		Metadata: &pkg.BitnamiSBOMEntry{
 			Name:         "redis",
@@ -137,9 +137,9 @@ func (c *goModCataloger) loadPackages(modDir string, loc file.Location) (pkgs ma
 	for _, p := range rootPkgs {
 		if len(p.Errors) > 0 {
 			// Log errors but continue processing
-			for _, e := range p.Errors {
-				log.Debugf("package load error for %s: %v", p.PkgPath, e)
-				unknownErr = unknown.Append(unknownErr, loc, err)
+			for _, pe := range p.Errors {
+				log.Debugf("package load error for %s: %v", p.PkgPath, pe)
+				unknownErr = unknown.Append(unknownErr, loc, pe)
 			}
 		}
 	}
@@ -2434,7 +2434,8 @@
        "cpe:2.3:a:linuxfoundation:backstage\\/integration:*:*:*:*:*:node.js:*:*"
      ],
      "@backstage/plugin-auth-backend": [
-        "cpe:2.3:a:linuxfoundation:auth_backend:*:*:*:*:*:node.js:*:*"
+        "cpe:2.3:a:linuxfoundation:auth_backend:*:*:*:*:*:node.js:*:*",
+        "cpe:2.3:a:linuxfoundation:backstage\\/plugin-auth-backend:*:*:*:*:*:node.js:*:*"
      ],
      "@backstage/plugin-catalog-backend": [
        "cpe:2.3:a:linuxfoundation:backstage\\/plugin-catalog-backend-module-unprocessed:*:*:*:*:*:node.js:*:*"
@@ -6578,9 +6579,15 @@
      "Pillow": [
        "cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*"
      ],
+      "PraisonAI": [
+        "cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:*"
+      ],
      "PyAMF": [
        "cpe:2.3:a:pyamf:pyamf:*:*:*:*:*:*:*:*"
      ],
+      "PyJWT": [
+        "cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:*"
+      ],
      "PyPDF2": [
        "cpe:2.3:a:pypdf2_project:pypdf2:*:*:*:*:*:*:*:*"
      ],
@@ -7880,6 +7887,9 @@
      "anchor-lang": [
        "cpe:2.3:a:anchor-lang:anchor:*:*:*:*:*:rust:*:*"
      ],
+      "anode": [
+        "cpe:2.3:a:obsidiandynamics:anode:*:*:*:*:*:rust:*:*"
+      ],
      "anymap": [
        "cpe:2.3:a:anymap_project:anymap:*:*:*:*:*:rust:*:*"
      ],
@@ -8003,6 +8013,9 @@
      "capnp": [
        "cpe:2.3:a:capnproto:capnp:*:*:*:*:*:rust:*:*"
      ],
+      "cargo": [
+        "cpe:2.3:a:rust-lang:cargo:*:*:*:*:*:rust:*:*"
+      ],
      "cbox": [
        "cpe:2.3:a:cbox_project:cbox:*:*:*:*:*:rust:*:*"
      ],
@@ -10570,6 +10583,9 @@
      "captcha": [
        "cpe:2.3:a:bestwebsoft:captcha:*:*:*:*:*:wordpress:*:*"
      ],
+      "captcha-bank": [
+        "cpe:2.3:a:tech-banker:captcha_bank:*:*:*:*:*:wordpress:*:*"
+      ],
      "captchinoo-captcha-for-login-form-protection": [
        "cpe:2.3:a:wp-buy:captchinoo:*:*:*:*:*:wordpress:*:*"
      ],
@@ -18654,6 +18670,9 @@
      "sharable-password-protected-posts": [
        "cpe:2.3:a:fabiantodt:private_post_share:*:*:*:*:*:wordpress:*:*"
      ],
+      "share-button": [
+        "cpe:2.3:a:maxfoundry:social_share_buttons:*:*:*:*:*:wordpress:*:*"
+      ],
      "share-buttons": [
        "cpe:2.3:a:artlosk:share_buttons:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:artlosk:social_share_buttons:*:*:*:*:*:wordpress:*:*"
@@ -35,6 +35,11 @@ func parseGradleLockfile(_ context.Context, _ file.Resolver, _ *generic.Environm
 		// Trim leading and trailing whitespace from the line
 		line = strings.TrimSpace(line)

+		// skip comment lines (e.g. the header gradle writes), which may contain ':' and '=' characters
+		if strings.HasPrefix(line, "#") {
+			continue
+		}
+
 		groupNameVersion := line
 		groupNameVersion = strings.Split(groupNameVersion, "=")[0]
 		parts := strings.Split(groupNameVersion, ":")
@@ -87,3 +87,19 @@ func Test_parserGradleLockfile_lineTooLong(t *testing.T) {
 	require.Len(t, pkgs, 1)
 	assert.Equal(t, "before", pkgs[0].Name)
 }
+
+func Test_parserGradleLockfile_skipsComments(t *testing.T) {
+	contents := `# This is a Gradle generated file for dependency locking.
+# To regenerate this file, run: ./gradlew :dependencies --write-locks
+  # indented: comment=too
+com.squareup.okhttp3:okhttp:4.12.0=compileClasspath,runtimeClasspath
+empty=annotationProcessor
+`
+	reader := file.NewLocationReadCloser(file.NewLocation("gradle.lockfile"), io.NopCloser(strings.NewReader(contents)))
+
+	pkgs, _, err := parseGradleLockfile(context.Background(), nil, nil, reader)
+	require.NoError(t, err)
+	require.Len(t, pkgs, 1)
+	assert.Equal(t, "okhttp", pkgs[0].Name)
+	assert.Equal(t, "4.12.0", pkgs[0].Version)
+}
@@ -6,6 +6,7 @@ import (
 	"github.com/anchore/go-collections"
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/stereoscope/pkg/image"
+	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/syft/source"
 )

@@ -29,6 +30,10 @@ func (l stereoscopeImageSourceProvider) Name() string {
 }

 func (l stereoscopeImageSourceProvider) Provide(ctx context.Context) (source.Source, error) {
+	if !internal.EagerLayerSquashes(ctx) {
+		// lower layer squashes are only built if something reads them, so a squashed scan never pays for them
+		ctx = image.WithLazyLayerSquashes(ctx)
+	}
 	img, err := l.stereoscopeProvider.Provide(ctx)
 	if err != nil {
 		return nil, err
@@ -0,0 +1,76 @@
+package stereoscopesource
+
+import (
+	"context"
+	"path/filepath"
+	"testing"
+
+	"github.com/google/go-containerregistry/pkg/name"
+	"github.com/google/go-containerregistry/pkg/v1/random"
+	"github.com/google/go-containerregistry/pkg/v1/tarball"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/stereoscope"
+	"github.com/anchore/stereoscope/pkg/filetree"
+	"github.com/anchore/stereoscope/pkg/image"
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/syft/source"
+)
+
+func Test_stereoscopeImageSourceProvider_layerSquashes(t *testing.T) {
+	img, err := random.Image(1024, 3)
+	require.NoError(t, err)
+	tag, err := name.NewTag("localhost/layer-squashes:latest")
+	require.NoError(t, err)
+	archive := filepath.Join(t.TempDir(), "image.tar")
+	require.NoError(t, tarball.WriteToFile(archive, tag, img))
+
+	provide := func(t *testing.T, ctx context.Context) *stereoscopeImageSource {
+		providers := Providers(ProviderConfig{
+			StereoscopeImageProviderConfig: stereoscope.ImageProviderConfig{UserInput: archive},
+		})
+		for _, p := range providers {
+			if p.Value.Name() != image.DockerTarballSource {
+				continue
+			}
+			src, err := p.Value.Provide(ctx)
+			require.NoError(t, err)
+			t.Cleanup(func() { require.NoError(t, src.Close()) })
+			return src.(*stereoscopeImageSource)
+		}
+		t.Fatalf("no %s provider", image.DockerTarballSource)
+		return nil
+	}
+
+	lazy := provide(t, context.Background())
+	eager := provide(t, internal.WithEagerLayerSquashes(context.Background()))
+
+	// lower layers are built on first use unless eager was asked for, the top is the image squash either way
+	require.Len(t, lazy.image.Layers, 3)
+	for idx := range lazy.image.Layers {
+		_, isTree := lazy.image.Layers[idx].SquashedTree.(*filetree.FileTree)
+		assert.Equalf(t, idx == 2, isTree, "lazy layer %d", idx)
+		assert.IsTypef(t, &filetree.FileTree{}, eager.image.Layers[idx].SquashedTree, "eager layer %d", idx)
+	}
+
+	// every scope sees the same files either way
+	for _, scope := range []source.Scope{source.SquashedScope, source.AllLayersScope, source.DeepSquashedScope} {
+		t.Run(string(scope), func(t *testing.T) {
+			files := func(src *stereoscopeImageSource) []string {
+				res, err := src.FileResolver(scope)
+				require.NoError(t, err)
+				locs, err := res.FilesByGlob("**/*")
+				require.NoError(t, err)
+				var out []string
+				for _, l := range locs {
+					out = append(out, l.RealPath+"@"+l.FileSystemID)
+				}
+				return out
+			}
+			want := files(eager)
+			require.NotEmpty(t, want)
+			assert.ElementsMatch(t, want, files(lazy))
+		})
+	}
+}
Author	SHA1	Message	Date
Alex Goodman	1f667ad93a	perf: build lower layer squashes only when a scan reads them The image source provider now reads images with `image.WithLazyLayerSquashes`: the image squash is built during the read, and each lower layer's squash only when something reads it. A squashed scan never does, so it skips a full file tree copy per layer. - squashed scans: faster, much less memory on images with many layers - `scan`/`attest` with all-layers or deep-squashed stay eager (an internal ctx flag), since eager squashing overlaps with fetching and indexing and is faster when every layer gets read - library callers going through `syft.GetSource` get lazy for every scope, since the scope isn't known when the image is read. All-layers is still correct, just slower - no public API change Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2026-10-29 22:40:51 -04:00
Alex Goodman	8698886bf7	revert: drop the squash-only image read and bump stereoscope stereoscope is replacing `image.WithImageSquashOnly` with lazy layer squashes, where every layer keeps a usable squash. That removes the need for `GetSourceConfig.WithImageSquashOnly` and the scope guard in `FileResolver`, so both go. - bumps stereoscope to `feat/lazy-layer-squashes` (anchore/stereoscope `43c8f7e`), pending that PR merging Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2026-10-29 22:40:50 -04:00
Alex Goodman	4edc799fec	chore(deps): bump stereoscope to main for WithImageSquashOnly Drops the temporary replace to the contributor fork now that anchore/stereoscope#731 has merged. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2026-10-29 12:22:27 -04:00
Alex Goodman	b88eb7d410	chore(deps): temporarily pin stereoscope to anchore/stereoscope#731 Replaces stereoscope with the PR head on the contributor fork so this builds. Drop the replace and bump to a released version once that PR merges. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2026-10-29 12:13:33 -04:00
Alex Goodman	b2807f60d2	perf: keep only the image squash when scanning with the squashed scope - stereoscope builds a squashed tree for every layer, each a full copy of the one below, so memory grows with layers x files. The squashed scope only ever reads the top one. - new `GetSourceConfig.WithImageSquashOnly(bool)` (and `sourceproviders.Config` field) reads images with stereoscope's `image.WithImageSquashOnly`, scoped to that one read - the CLI turns it on when `--scope squashed` (the default) - an image source read this way returns an error from `FileResolver` for `all-layers` and `deep-squashed` instead of panicking on the missing layer squashes Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2026-10-29 12:10:12 -04:00
Pujitha PaladuguandPujitha Paladugu	12f0e2d837	fix(binary): detect envoy 1.37.1 and 1.40.x binaries (#5476 ) Motivation: the envoy binary classifier returns no package for envoy 1.37.1, 1.40.0 and 1.40.1 (the official envoyproxy/envoy images), while neighbouring versions such as 1.37.0 and 1.38.0 are detected. Approach: - the main matcher (NUL-delimited version followed by envoy_reloadable_features) only accepted 1.3x; widen it to 1.[34]x, which covers 1.40.0 and 1.40.1. - in the 1.37.1 binary the version string sits between different neighbouring strings, so the existing matchers do not fire. Add a matcher anchored on the preceding "DeltaDiscoveryResponse.removed_resources" string. - add snippets, config.yaml entries and test cases for 1.37.1, 1.40.0, 1.40.1 (linux/amd64 images, pinned by digest). Validation: - cd syft/pkg/cataloger/binary && go test . -run 'Test_Cataloger_PositiveCases/envoy' : the three new fixtures fail without the classifiers.go change and all envoy cases pass with it. - golangci-lint run ./syft/pkg/cataloger/binary/... : 0 issues. - Built syft before/after and scanned the full linux/arm64 envoy binaries from the official images: 1.37.1, 1.40.0 and 1.40.1 were not reported before and are reported with the right version after; 1.37.0 and 1.38.0 are unchanged. - Not run: the rest of the package test suite needs docker, which is not available here (Test_PEPackageCataloger etc.), and snippets for other binaries are not downloaded locally. The contrib-build fallback matchers still only accept 1.3x; they are untouched. Report: https://github.com/anchore/syft/issues/5470 Assisted-by: claude-sonnet-5-5 (via Claude Code) Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>	2026-10-28 11:01:40 -04:00
hsdfat	1636e1119a	fix(binary): match istio snapshot and older pre-release versions (#5121 ) The istio pilot-agent/pilot-discovery classifiers missed every -snapshot.N build and the older -alpha.N/-beta.N/-rc.N layouts. Two defects: 1. The doubled-version matcher anchored on a bare x.y.z followed by NULs, but pre-release builds repeat the full version including the suffix (1.15.0-beta.0 NUL NUL NUL 1.15.0-beta.0), so the anchor never matched. Only the capture group had been widened previously. 2. -snapshot.N was absent from every alternation, and snapshot builds store the version only once with no leading copy, so no existing matcher could reach it. Widen the leading anchor to accept the same optional pre-release suffix it already accepts in the capture group, add -snapshot.N to each alternation, and add a matcher for the standalone snapshot layout. The new matcher is second so it can never shadow a normal build. Adds real captured snippets for pilot-agent and pilot-discovery at 1.0.0-snapshot.0, 1.5.0-alpha.0, 1.15.0-beta.0 and 1.19.0-rc.0. Fixes #5060 Signed-off-by: phatlc <phatle.hsd@gmail.com>	2026-10-28 11:00:16 -04:00
anchore-oss-update-botandanchore-oss-update-bot	fb56f1eef1	chore(deps): update anchore dependencies (#5467 ) Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com> Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>	2026-10-26 18:35:31 +00:00
Vignesh	842d2b3deb	Fix Bitnami CPE application part (#5127 ) Signed-off-by: vigneshakaviki <kumarvignesh295@gmail.com>	2026-10-26 15:33:13 +00:00
idhyt	1401107138	fix(go-module-cataloger): use correct error variable in package load loop (#4983 ) In the loop over `rootPkgs`, the error appended to `unknownErr` was incorrectly using the outer `err` (from `packages.Load`) instead of the individual package error `e`. This could cause: - nil or stale error values to be recorded when package-specific errors existed. - Loss of detailed per-package error information in the final error report. Changed `unknown.Append(..., err)` to `unknown.Append(..., e)` to properly capture each package's load error. Signed-off-by: idhyt <idhyt3r@gmail.com>	2026-10-26 15:05:27 +00:00
Pujitha PaladuguandPujitha Paladugu	722df28ed1	fix(java): skip comment lines in gradle.lockfile (#5372 ) Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>	2026-10-26 10:46:54 -04:00
dependabot[bot]	4c500520d0	chore(deps): bump github.com/bmatcuk/doublestar/v4 from 4.10.2 to 4.10.3 (#5460 ) Bumps [github.com/bmatcuk/doublestar/v4](https://github.com/bmatcuk/doublestar) from 4.10.2 to 4.10.3. - [Release notes](https://github.com/bmatcuk/doublestar/releases) - [Commits](https://github.com/bmatcuk/doublestar/compare/v4.10.2...v4.10.3) --- updated-dependencies: - dependency-name: github.com/bmatcuk/doublestar/v4 dependency-version: 4.10.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-26 13:29:29 +00:00
anchore-oss-update-botandanchore-oss-update-bot	9f9751aade	chore(deps): update tool versions (#5475 ) Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com> Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>	2026-10-26 10:26:38 +00:00
anchore-oss-update-botandanchore-oss-update-bot	447ee20bdc	chore(deps): update CPE dictionary index (#5473 ) Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com> Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>	2026-10-26 01:43:08 +00:00
anchore-oss-update-botandanchore-oss-update-bot	eec916df6c	chore(deps): update anchore dependencies (#5420 ) Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com> Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>	2026-10-23 23:15:47 -04:00
Alex Goodman	1c4d672b28	chore: let go-make own the go version (#5464 ) * chore: let go-make own the go version Drops syft's own Go version pin so CI and releases use go-make setup's default. The pin predates the go-make port (#4773, carried through #4923) and had to be kept in sync in four places. - removes the `go-version` input from `.github/actions/bootstrap` and the three `go-version: "1.26.2"` overrides in `validations.yaml` - builds move from Go 1.26 to go-make's default (currently `1.27.2`). `go.mod` stays at `go 1.26.8`, so nothing changes for library consumers - this is groundwork for the emSign/eMudhra CA fix: Go `1.27.3` distrusts the compromised intermediates in `crypto/x509`. anchore/go-make#170 bumps the default, and the go-make pin here gets bumped once that is released. The `v1.55.0` images also still carry `emSign ECC Root CA - G3`, so a release is needed after the bump Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * chore: reformat generated license list with go 1.27 gofmt go 1.27 gofmt aligns long map keys differently, so the json schema drift check rewrote this file. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2026-10-23 11:22:18 -04:00
dependabot[bot]	44c215450b	chore(deps): bump golang.org/x/tools from 0.51.0 to 0.52.0 (#5463 ) Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.51.0 to 0.52.0. - [Release notes](https://github.com/golang/tools/releases) - [Commits](https://github.com/golang/tools/compare/v0.51.0...v0.52.0) --- updated-dependencies: - dependency-name: golang.org/x/tools dependency-version: 0.52.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-23 13:53:07 +00:00
dependabot[bot]	e1dcbd89df	chore(deps): bump github.com/gookit/color from 1.6.2 to 1.6.3 (#5459 ) Bumps [github.com/gookit/color](https://github.com/gookit/color) from 1.6.2 to 1.6.3. - [Release notes](https://github.com/gookit/color/releases) - [Commits](https://github.com/gookit/color/compare/v1.6.2...v1.6.3) --- updated-dependencies: - dependency-name: github.com/gookit/color dependency-version: 1.6.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-23 13:36:23 +00:00
dependabot[bot]	e61fb72e46	chore(deps): bump github.com/go-test/deep from 1.1.1 to 1.1.2 (#5462 ) Bumps [github.com/go-test/deep](https://github.com/go-test/deep) from 1.1.1 to 1.1.2. - [Release notes](https://github.com/go-test/deep/releases) - [Changelog](https://github.com/go-test/deep/blob/main/CHANGES.md) - [Commits](https://github.com/go-test/deep/compare/v1.1.1...v1.1.2) --- updated-dependencies: - dependency-name: github.com/go-test/deep dependency-version: 1.1.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-23 13:36:03 +00:00
dependabot[bot]	71fe033ab5	chore(deps): bump github.com/klauspost/compress from 1.20.1 to 1.20.3 (#5461 ) Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress) from 1.20.1 to 1.20.3. - [Release notes](https://github.com/klauspost/compress/releases) - [Commits](https://github.com/klauspost/compress/compare/v1.20.1...v1.20.3) --- updated-dependencies: - dependency-name: github.com/klauspost/compress dependency-version: 1.20.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-23 13:31:44 +00:00
dependabot[bot]	a5426c6642	chore(deps): bump zizmorcore/zizmor-action from 0.6.4 to 0.7.1 (#5457 ) Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.6.4 to 0.7.1. - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](https://github.com/zizmorcore/zizmor-action/compare/cc914d7f3750a2d13d75c7f184a1060aa0e9d482...85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e) --- updated-dependencies: - dependency-name: zizmorcore/zizmor-action dependency-version: 0.7.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-23 13:30:56 +00:00
dependabot[bot]	816106f0b2	chore(deps): bump golang.org/x/mod from 0.41.0 to 0.42.0 (#5458 ) Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.41.0 to 0.42.0. - [Commits](https://github.com/golang/mod/compare/v0.41.0...v0.42.0) --- updated-dependencies: - dependency-name: golang.org/x/mod dependency-version: 0.42.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-23 13:30:11 +00:00
akshaver	b55707f60f	fix(binary): preserve semver build metadata in ffmpeg version (#5452 ) Signed-off-by: Adam Shaver <ashaver@nvidia.com>	2026-10-21 17:10:43 -04:00