mirror of
https://github.com/anchore/syft.git
synced 2026-08-20 17:18:30 +02:00
08e913a2ce
* report each hardlink as its own file when scanning images image scans previously collapsed a set of hardlinks onto a single file, so only one path per inode showed up in results. dir scans report every hardlink path, which made image vs dir SBOMs of the same filesystem diverge (and produce different SPDX `packageVerificationCode` values for packages that own hardlinked files). now both image resolvers (squash and all-layers) surface each hardlink at its own path as a regular file bound to the target's content, matching dir scans. user-facing impact: - SBOMs for images containing hardlinks will list more `file` entries - SPDX `packageVerificationCode` values change for affected packages, now matching the equivalent `dir:` scan - adds `file.NewVirtualLocationFromImage` to the public API fixes #5019 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix busybox test assertion Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>