Inability to scan a python wheel
- Dominant language
- Go
- Stars
- 9.6k
- Forks
- 954
- Avg merge
- 23h 27m
- Merged PRs (30d)
- 48
Description
In the readme for supported ecosystems
https://github.com/anchore/syft?tab=readme-ov-file#supported-ecosystems
it's noted that python wheels are supported
If I try to scan a python wheel with syft, it doesn't seem to know what to do with it
For example
```
bress@JBRESSERS ➜ p syft .
✔ Indexed file system .
✔ Cataloged contents cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a
├── ✔ Packages [0 packages]
└── ✔ Executables [0 executables]
[0000] WARN no explicit name and version provided for directory source, deriving artifact ID from t
[0000] WARN unable to build link resolution index for filetree search context error=unable to get n
No packages discovered
A newer version of syft is available for download: 1.21.0 (installed version is 1.20.0)
```
I would expect syft to inspect a wheel file it finds during a scan
Contributor guide
Research direction
Start with the README's supported ecosystems section and reproduce the report by scanning a Python wheel through the syft CLI. Trace how filesystem sources are cataloged and how Python wheel packages are discovered; done means a wheel found during a scan produces the expected package information instead of zero packages.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, python
- Domain
- cli
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100