-
Notifications
You must be signed in to change notification settings - Fork 721
Description
What would you like to be added:
Enable the swift-package-manager-cataloger to run on Docker image scans when Package.swift and Package.resolved files are present in the image.
Why is this needed:
Many Swift containerized applications use multi-stage builds that intentionally copy Package.swift and Package.resolved into the final image for SBOM generation and compliance. Currently, syft skips the
Swift cataloger on image scans (only tagged with directory, not image), resulting in incomplete SBOMs that miss all Swift dependencies.
This forces teams to maintain separate directory scans and manually merge SBOMs, or accept incomplete vulnerability scanning results.
Additional context:
Verification that files exist but aren't cataloged:
// Files are present in the image
$ docker run --rm --entrypoint ls image:tag -la /app/
-rw-r--r-- 1 root root 25604 Package.resolved
-rw-r--r-- 1 root root 29613 Package.swift
// But cataloger is skipped on image scans
$ syft image:tag --select-catalogers swift-package-manager-cataloger
No packages discovered
Current tags: declared, directory, language, package, spm, swift
Proposed: Add image tag to enable scanning when manifest files exist in container images, similar to Go, Python, and JavaScript catalogers.
Metadata
Metadata
Assignees
Labels
Type
Projects
Status