Skip to content

feat: support cataloging chisel manifest files - #5091

Draft
kzantow wants to merge 1 commit into
anchore:mainfrom
kzantow-anchore:feat/chisel-support
Draft

feat: support cataloging chisel manifest files#5091
kzantow wants to merge 1 commit into
anchore:mainfrom
kzantow-anchore:feat/chisel-support

Conversation

@kzantow

@kzantow kzantow commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

Description

This PR adds support for parsing Chisel manifest files, which are used by Ubuntu, among others in a number of scenarios where DPKG DB or other metadata is no longer present.

Type of change

  • New feature (non-breaking change which adds functionality)

Checklist

  • I have added unit tests that cover changed behavior
  • I have tested my code in common scenarios and confirmed there are no regressions
  • I have added comments to my code, particularly in hard-to-understand sections

Issue references

Fixes: #3824
Fixes: #4816

Signed-off-by: Keith Zantow <kzantow@gmail.com>
@oss-housekeeper oss-housekeeper Bot added the dependencies dealing with project dependencies label Jul 22, 2026
@kzantow

kzantow commented Jul 22, 2026

Copy link
Copy Markdown
Contributor Author

@zhijie-yang are you able to have a look at this PR? Are there some sample images you could point me to that would be representative of common chiseled containers that I could use to ensure correctness and performance? Thanks!

To run if you clone this branch, you ran just run using go like: go run ./cmd/syft <image> or similar.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies dealing with project dependencies

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Syft produces duplicate entries for openssl/python/bash in Ubuntu container image created using Chisel Support for Canonical's "Chiseled Containers"

1 participant