What would you like to be added:

If I scan an image/directory/etc. with a kernel in it, capture kernel information

Why is this needed:

If my software includes a kernel, then that kernel is part of the software I am shipping

Additional context:

To be fair, I am not completely sure how a kernel's info should be scanned, or where it should be included in an SBoM. Those, however, are implementation considerations. From the perspective of answering the question, "Is this a valid and reasonably complete SBoM?", then the answer definitely is no, if it does not include the kernel and other dependencies.

To replicate this, I did something straightforward:

1. Downloaded the Ubuntu 5.15 kernel deb from here
2. Unpacked the .deb file, untarred the data.tar.zst to get the kernel file vmlinuz-5.15.0-051500-generic
3. Created a directory for it /tmp/kernel/ and put the kernel file in there
4. Scanned: syft packages dir:/tmp/kernel/

The result, of course, is:

$ syft packages dir:/tmp/kernel
 ✔ Indexed /tmp/kernel
 ✔ Cataloged packages      [0 packages]

No packages discovered