fix: correctly report supporting evidence for binary packages by kzantow · Pull Request #4558 · anchore/syft

kzantow · 2026-01-16T20:57:14Z

Description

This PR adjusts the binary classifier to more appropriately return "supporting" evidence locations marked as such rather than being marked as "primary". This primarily affects go, ruby, and python binary classifiers, where each of these looks at files beyond the binary executable if it can't find version information in the executable directly, for example: python searches for a matching libpython and go searches for a VERSION file containing something that looks like a go version. The logic has also been tweaked slightly so a VERSION file without a go binary does not return a package.

Before this change, multiple locations would be returned all with primary evidence e.g.:

    {
      "id": "d21881475fd270e3",
      "name": "go",
      "version": "1.18.1",
      "type": "binary",
      "foundBy": "binary-classifier-cataloger",
      "locations": [
        {
          "path": "/usr/local/go/VERSION",
          "layerID": "sha256:f55ac134ae7cb1b43fb9caeeb11f6d64219f062f8731ac76b6ece357aa6d73b0",
          "accessPath": "/usr/local/go/VERSION",
          "annotations": {
            "evidence": "primary"
          }
        },
        {
          "path": "/usr/local/go/bin/go",
          "layerID": "sha256:f55ac134ae7cb1b43fb9caeeb11f6d64219f062f8731ac76b6ece357aa6d73b0",
          "accessPath": "/usr/local/go/bin/go",
          "annotations": {
            "evidence": "primary"
          }
        }
      ],
...

After this PR, a user may see:

    {
      "id": "d21881475fd270e3",
      "name": "go",
      "version": "1.18.1",
      "type": "binary",
      "foundBy": "binary-classifier-cataloger",
      "locations": [
        {
          "path": "/usr/local/go/bin/go",
          "layerID": "sha256:f55ac134ae7cb1b43fb9caeeb11f6d64219f062f8731ac76b6ece357aa6d73b0",
          "accessPath": "/usr/local/go/bin/go",
          "annotations": {
            "evidence": "primary"
          }
        },
        {
          "path": "/usr/local/go/VERSION",
          "layerID": "sha256:f55ac134ae7cb1b43fb9caeeb11f6d64219f062f8731ac76b6ece357aa6d73b0",
          "accessPath": "/usr/local/go/VERSION",
          "annotations": {
            "evidence": "supporting"
          }
        }
      ],
...

Type of change

Bug fix (non-breaking change which fixes an issue)

Checklist

I have added unit tests that cover changed behavior
I have tested my code in common scenarios and confirmed there are no regressions
I have added comments to my code, particularly in hard-to-understand sections

Issue references

Signed-off-by: Keith Zantow <kzantow@gmail.com>

kzantow · 2026-01-22T22:03:50Z

syft/pkg/cataloger/binary/classifier_cataloger_test.go

-						t.Fatalf("locations do not match; expected: %v got: %v", expectedLocations, gotLocations)
-					}
-				}
-


Locations are already being tested below, in assertPackagesAreEqual 👇

kzantow · 2026-01-22T22:28:39Z

syft/pkg/cataloger/binary/classifier_cataloger_test.go

 	if len(expectedLocations) != len(gotLocations) {
-		failMessages = append(failMessages, "locations are not equal length")
+		failMessages = append(failMessages, fmt.Sprintf("locations are not equal: %v != %v", expectedLocations, gotLocations))
 	} else {
-		for i, expectedLocation := range expectedLocations {
-			gotLocation := gotLocations[i]
-			if expectedLocation.RealPath != gotLocation.RealPath {
-				failMessages = append(failMessages, fmt.Sprintf("locations do not match; expected: %v got: %v", expectedLocation.RealPath, gotLocation.RealPath))
+		for _, expectedLocation := range expectedLocations {
+			if !slices.ContainsFunc(gotLocations, func(gotLocation file.Location) bool {
+				return gotLocation.RealPath == expectedLocation.RealPath
+			}) {
+				failMessages = append(failMessages, fmt.Sprintf("location not found; expected: %v in set: %v", expectedLocation.RealPath, gotLocations))


These locations are not sorted identically in .ToSlice(), above, due to expected differences in evidence annotations. This change just asserts the sets contain the same elements, not the same order.

spiffcs

Approved with comment about a potential test typo

spiffcs · 2026-01-23T17:26:35Z

syft/pkg/cataloger/internal/binutils/classifier_test.go

+			classifier: Classifier{
+				FileGlob: "**/some-binary",
+				EvidenceMatcher: SupportingEvidenceMatcher("../version.txt",
+					FileContentsVersionMatcher("cataloger-name", `(?m)my-verison:(?P<version>[0-9.]+)`)),


Is this a typo in the regex? my-verison vs my-version

Sorta... a bit of a systemic typo, apparently! Fixed 👍

Signed-off-by: Keith Zantow <kzantow@gmail.com>

* main: (114 commits) fix: lookup alternate scheme on url->licenseID (anchore#4588) chore(deps): bump the go-minor-patch group with 2 updates (anchore#4583) feat: add Qt6 binary detection (anchore#4550) chore(deps): bump the actions-minor-patch group across 1 directory with 2 updates (anchore#4584) fix: snap cataloger incorrectly identifies snap container as deb package (anchore#4500) chore(deps): update tools to latest versions (anchore#4577) fix: update mixed case dependencies in python to be normalized (anchore#4573) chore(deps): update anchore dependencies (anchore#4575) chore(deps): update tools to latest versions (anchore#4570) feat: detect Debian version from /etc/debian_version (anchore#4569) fix: correctly report supporting evidence for binary packages (anchore#4558) chore(deps): bump the actions-minor-patch group across 2 directories with 3 updates (anchore#4568) chore(deps): bump the go-minor-patch group with 6 updates (anchore#4567) chore(deps): update tools to latest versions (anchore#4565) chore(deps): bump github.com/spdx/tools-golang (anchore#4557) ci: enable zizmor to fail PRs (anchore#4556) Chore new slack action (anchore#4553) chore(deps): update anchore dependencies (anchore#4552) chore(deps): update tools to latest versions (anchore#4551) chore(deps): update tools to latest versions (anchore#4545) ... Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

…o longer considered Due to the following PRs in syft, some matches which were previously TPs should now be considered FPs: - anchore/syft#4231 - anchore/syft#4558 Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>

…o longer considered (#179) Due to the following PRs in syft, some matches which were previously TPs should now be considered FPs: - anchore/syft#4231 - anchore/syft#4558 Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>

fix: do not indicate go VERSION file is primary evidence

5984142

Signed-off-by: Keith Zantow <kzantow@gmail.com>

kzantow marked this pull request as draft January 16, 2026 21:09

kzantow added 5 commits January 20, 2026 15:57

chore: better relative secondary file version extraction

e5b4d35

Signed-off-by: Keith Zantow <kzantow@gmail.com>

chore: better supporting file evidence naming, update tests

eb4b4d3

Signed-off-by: Keith Zantow <kzantow@gmail.com>

chore: update test

8cdcd90

Signed-off-by: Keith Zantow <kzantow@gmail.com>

chore: update capabilities

2b06649

Signed-off-by: Keith Zantow <kzantow@gmail.com>

fix: handle duplicate lib findings

29bd6f3

Signed-off-by: Keith Zantow <kzantow@gmail.com>

kzantow marked this pull request as ready for review January 22, 2026 20:01

kzantow commented Jan 22, 2026

View reviewed changes

kzantow changed the title ~~fix: do not indicate go VERSION file is primary evidence~~ fix: correctly report supporting evidence for binary packages Jan 22, 2026

spiffcs approved these changes Jan 23, 2026

View reviewed changes

chore: typo

b784d44

Signed-off-by: Keith Zantow <kzantow@gmail.com>

kzantow merged commit 836f358 into anchore:main Jan 23, 2026
10 checks passed

kzantow deleted the fix/go-version-file-as-primary-evidence branch January 23, 2026 18:01

kzantow added a commit that referenced this pull request Jan 26, 2026

fix: correctly report supporting evidence for binary packages (#4558)

0773492

Signed-off-by: Keith Zantow <kzantow@gmail.com>

willmurphyscode added the bug Something isn't working label Jan 27, 2026

BrewTestBot mentioned this pull request Jan 27, 2026

syft 1.41.0 Homebrew/homebrew-core#264710

Merged

westonsteimel mentioned this pull request Feb 2, 2026

update some labels to reflect that packages in deinstall status are n… anchore/vulnerability-match-labels#179

Merged

westonsteimel mentioned this pull request Mar 23, 2026

Support go binary various versions #4687

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: correctly report supporting evidence for binary packages#4558

fix: correctly report supporting evidence for binary packages#4558
kzantow merged 7 commits intoanchore:mainfrom
kzantow-anchore:fix/go-version-file-as-primary-evidence

kzantow commented Jan 16, 2026 •

edited

Loading

Uh oh!

kzantow Jan 22, 2026

Uh oh!

kzantow Jan 22, 2026 •

edited

Loading

Uh oh!

spiffcs left a comment

Uh oh!

spiffcs Jan 23, 2026

Uh oh!

kzantow Jan 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

kzantow commented Jan 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Type of change

Checklist

Issue references

Uh oh!

kzantow Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

kzantow Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

spiffcs left a comment

Choose a reason for hiding this comment

Uh oh!

spiffcs Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

kzantow Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

kzantow commented Jan 16, 2026 •

edited

Loading

kzantow Jan 22, 2026 •

edited

Loading