Add pkg-config cataloger
- Dominant language
- Go
- Stars
- 9.6k
- Forks
- 954
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 42
Description
**What would you like to be added**:
On traditional UNIX platforms, installed SDKs frequently install themselves in the pkg-config database. It would be useful to catalog these SDKs as part of an SBOM.
**Why is this needed**:
By checking the pkg-config versions of a SDK, we can detect vulnerable dependencies which register themselves with the pkg-config database.
**Additional context**:
I happen to have a pkg-config database parser at https://github.com/chainguard-dev/go-pkgconfig :)
Contributor guide
Research direction
Start by reviewing Syft's existing catalogers and the referenced go-pkgconfig parser for how a pkg-config database is read. Define the cataloger's input and output around SDK versions registered in pkg-config, then verify that discovered dependencies can support vulnerability detection and SBOM generation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- devtools, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100