anchore / anchore/syft

Add pkg-config cataloger

Open
#2,000 1 comment 0 reactions 0 assignees View on GitHub
enhancement good-first-issue new-cataloger
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
1d 5h
Merged PRs (30d)
42

Description

**What would you like to be added**:

On traditional UNIX platforms, installed SDKs frequently install themselves in the pkg-config database. It would be useful to catalog these SDKs as part of an SBOM.

**Why is this needed**:

By checking the pkg-config versions of a SDK, we can detect vulnerable dependencies which register themselves with the pkg-config database.

**Additional context**:

I happen to have a pkg-config database parser at https://github.com/chainguard-dev/go-pkgconfig :)

Contributor guide

Open the contributing guide

Research direction

Start by reviewing Syft's existing catalogers and the referenced go-pkgconfig parser for how a pkg-config database is read. Define the cataloger's input and output around SDK versions registered in pkg-config, then verify that discovered dependencies can support vulnerability detection and SBOM generation.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
devtools, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.