anchore / anchore/syft

Inability to scan a python wheel

Open
#3,753 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
23h 27m
Merged PRs (30d)
48

Description

In the readme for supported ecosystems
https://github.com/anchore/syft?tab=readme-ov-file#supported-ecosystems

it's noted that python wheels are supported

If I try to scan a python wheel with syft, it doesn't seem to know what to do with it

For example

```
bress@JBRESSERS ➜ p syft .
✔ Indexed file system .
✔ Cataloged contents cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a
├── ✔ Packages [0 packages]
└── ✔ Executables [0 executables]
[0000] WARN no explicit name and version provided for directory source, deriving artifact ID from t
[0000] WARN unable to build link resolution index for filetree search context error=unable to get n
No packages discovered
A newer version of syft is available for download: 1.21.0 (installed version is 1.20.0)
```

I would expect syft to inspect a wheel file it finds during a scan

Contributor guide

Open the contributing guide

Research direction

Start with the README's supported ecosystems section and reproduce the report by scanning a Python wheel through the syft CLI. Trace how filesystem sources are cataloged and how Python wheel packages are discovered; done means a wheel found during a scan produces the expected package information instead of zero packages.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, python
Domain
cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.