anchore / anchore/syft

Allow overriding/skipping of OS detection

Open
#3,955 3 comments 2 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
23h 27m
Merged PRs (30d)
48

Description

What would you like to be added:

The ability to optionally override or bypass the Environment (specifically linux.Release detection) used by catalogers during a scan.

Why is this needed:

1. Currently, Syft attempts to resolve linux.Release information for every scan. This presents a few challenges:
2. Directory Scans (Non-Root): When scanning a specific directory source that is not the root of an operating system (e.g., a subfolder containing application code), the automatic linux.Release detection might be irrelevant, potentially lead to incorrect assumptions, or add unnecessary processing time. In such scenarios, it would be beneficial to either:
- Skip the OS detection entirely.
- Allow the user to explicitly specify the target operating system if it's known, overriding the default detection.

File Catalogers: For catalogers that primarily focus on file content (e.g., language-specific package managers), the resolution of linux.Release often provides limited value and could be an unnecessary step. Providing an option to bypass this for relevant catalogers could streamline the scanning process.

Contributor guide

Open the contributing guide

Research direction

Start by tracing how scans resolve the Environment, especially linux.Release, and how that value is used by catalogers. Compare directory scans with file-focused catalogers and identify the configuration or scan entry points involved. Done means the intended behavior for skipping detection and explicitly overriding the target OS is defined, including how it is tested.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, devtools
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.