# Latest **URL:** https://anchorecommunity.discourse.group/latest.md?page=2 [Latest](https://anchorecommunity.discourse.group/latest.md) · [Categories](https://anchorecommunity.discourse.group/categories.md) · [Tags](https://anchorecommunity.discourse.group/tags.md) **Page:** 3 --- ## [Anchore Open Source Weekly Report, Week 37, 2025](https://anchorecommunity.discourse.group/t/anchore-open-source-weekly-report-week-37-2025/560)
**Author:** [@popey](https://anchorecommunity.discourse.group/u/popey)\ **Replies:** 0\ **Last updated:** [September 15, 2025, 10:42am UTC](https://anchorecommunity.discourse.group/t/anchore-open-source-weekly-report-week-37-2025/560 "2025-09-15T10:42:21Z")
Anchore Open Source Weekly Report This report covers the community activity in Anchore Open Source Projects from September 7, 2025 to September 13, 2025. Executive Summary The Anchore Open Source ecosystem had a product… --- ## [September 11th | Open Source Gardening | Live Stream](https://anchorecommunity.discourse.group/t/september-11th-open-source-gardening-live-stream/556)
**Author:** [@popey](https://anchorecommunity.discourse.group/u/popey)\ **Replies:** 1\ **Last updated:** [September 14, 2025, 10:47am UTC](https://anchorecommunity.discourse.group/t/september-11th-open-source-gardening-live-stream/556 "2025-09-14T10:47:39Z")
:wave: Hello everyone! We’re back with the Anchore Open Source team running a live stream to discuss issues, pull requests, and future roadmap planning in our SBOM and vulnerability tools. :alarm\_clock: Starts at 2015-0… --- ## [Should I create a template, or just post-process to get an SPDX SBOM containing PURLs only?](https://anchorecommunity.discourse.group/t/should-i-create-a-template-or-just-post-process-to-get-an-spdx-sbom-containing-purls-only/558)
**Author:** [@eherget](https://anchorecommunity.discourse.group/u/eherget)\ **Replies:** 2\ **Last updated:** [September 11, 2025, 7:48pm UTC](https://anchorecommunity.discourse.group/t/should-i-create-a-template-or-just-post-process-to-get-an-spdx-sbom-containing-purls-only/558 "2025-09-11T19:48:24Z")
I would like to have syft generate SPDX SBOMs containing PURLs only, no CPEs. My thought is that using a template would be the “clean” way to do it. The alternative is to generate an SPDX SBOM, then post-process the ou… --- ## [Update: Raise in false positives due to missing NVD overrides](https://anchorecommunity.discourse.group/t/update-raise-in-false-positives-due-to-missing-nvd-overrides/557)
**Author:** [@wagoodman](https://anchorecommunity.discourse.group/u/wagoodman)\ **Replies:** 0\ **Last updated:** [September 11, 2025, 1:05pm UTC](https://anchorecommunity.discourse.group/t/update-raise-in-false-positives-due-to-missing-nvd-overrides/557 "2025-09-11T13:05:26Z")
We identified a recent issue where Grype databases were missing override data from anchore/nvd-data-overrides (~15k records). This was caused by a code change that prevented these records from being included during incre… --- ## [Adding support for container first distro: 0-deb](https://anchorecommunity.discourse.group/t/adding-support-for-container-first-distro-0-deb/555)
**Author:** [@abhishek](https://anchorecommunity.discourse.group/u/abhishek)\ **Replies:** 2\ **Last updated:** [September 10, 2025, 11:59am UTC](https://anchorecommunity.discourse.group/t/adding-support-for-container-first-distro-0-deb/555 "2025-09-10T11:59:10Z")
Hi Anchore team, We at KoalaLab(https://www.koalalab.com) have built a container first distro: 0-deb. The idea is to package upstream sources as per debian standards but with minimalism and container in mind. We use thi… --- ## [Components missing from CycloneDX json format SBOM when generation is part of a test](https://anchorecommunity.discourse.group/t/components-missing-from-cyclonedx-json-format-sbom-when-generation-is-part-of-a-test/553)
**Author:** [@danrollason](https://anchorecommunity.discourse.group/u/danrollason)\ **Replies:** 5\ **Last updated:** [September 9, 2025, 2:18pm UTC](https://anchorecommunity.discourse.group/t/components-missing-from-cyclonedx-json-format-sbom-when-generation-is-part-of-a-test/553 "2025-09-09T14:18:40Z")
Hi, We are using Syft as a library to generate CycloneDX json format SBOMs. Our code runs on a scratch container and works fine. We added a /tmp directory to the scratch container and in our example generates a 2000+ … --- ## [SBOM container tools comparison](https://anchorecommunity.discourse.group/t/sbom-container-tools-comparison/551)
**Author:** [@Jakub\_Bochenski](https://anchorecommunity.discourse.group/u/Jakub_Bochenski)\ **Replies:** 2\ **Last updated:** [September 9, 2025, 1:22pm UTC](https://anchorecommunity.discourse.group/t/sbom-container-tools-comparison/551 "2025-09-09T13:22:48Z")
I put together a comparison of container scanning tools: GitHub - jakub-bochenski/container-sbom-shootout: Comparison of different tools for generating CycloneDX SBOMs for container images. I’m looking for feedback — if… --- ## [Anchore Open Source Weekly Report - Week 36, 2025](https://anchorecommunity.discourse.group/t/anchore-open-source-weekly-report-week-36-2025/554)
**Author:** [@popey](https://anchorecommunity.discourse.group/u/popey)\ **Replies:** 0\ **Last updated:** [September 8, 2025, 12:52pm UTC](https://anchorecommunity.discourse.group/t/anchore-open-source-weekly-report-week-36-2025/554 "2025-09-08T12:52:38Z")
Anchore Open Source Weekly Report This report covers the community activity in Anchore Open Source Projects from September 1, 2025 to September 5, 2025. Executive Summary The Anchore Open Source ecosystem delivered stea… --- ## [Cyclonedx SBOM files do not pass cyclonedx cli validate command when SMAIL-GPL included as licenses](https://anchorecommunity.discourse.group/t/cyclonedx-sbom-files-do-not-pass-cyclonedx-cli-validate-command-when-smail-gpl-included-as-licenses/552)
**Author:** [@Diamantis\_Sellis](https://anchorecommunity.discourse.group/u/Diamantis_Sellis)\ **Replies:** 4\ **Last updated:** [September 5, 2025, 6:48pm UTC](https://anchorecommunity.discourse.group/t/cyclonedx-sbom-files-do-not-pass-cyclonedx-cli-validate-command-when-smail-gpl-included-as-licenses/552 "2025-09-05T18:48:55Z")
I am using syft version 1.32.0 to scan docker images but the resulting files do not pass validation by dependency-tracker nor by the cyclonedx-cli, so I can’t really use them, e.g. : $\> syft scan docker:nginx -o cyclone… --- ## [Any plans for AIBOM using Syft or Grype](https://anchorecommunity.discourse.group/t/any-plans-for-aibom-using-syft-or-grype/543)
**Author:** [@anvitha\_haviligi](https://anchorecommunity.discourse.group/u/anvitha_haviligi)\ **Replies:** 4\ **Last updated:** [September 2, 2025, 6:57pm UTC](https://anchorecommunity.discourse.group/t/any-plans-for-aibom-using-syft-or-grype/543 "2025-09-02T18:57:39Z")
Hi Team, Any plans to support generate AIBOM using Syft or Grype Regards, Anvitha --- ## [September 4th | Open Source Gardening | Live Stream](https://anchorecommunity.discourse.group/t/september-4th-open-source-gardening-live-stream/550)
**Author:** [@popey](https://anchorecommunity.discourse.group/u/popey)\ **Replies:** 0\ **Last updated:** [September 1, 2025, 11:30am UTC](https://anchorecommunity.discourse.group/t/september-4th-open-source-gardening-live-stream/550 "2025-09-01T11:30:16Z")
:wave: Hello everyone! We’re back with the Anchore Open Source team running a live stream to discuss issues, pull requests, and future roadmap planning in our SBOM and vulnerability tools. :alarm\_clock: Starts at 2025-0… --- ## [Anchore Open Source Weekly Report - Week 35, 2025](https://anchorecommunity.discourse.group/t/anchore-open-source-weekly-report-week-35-2025/549)
**Author:** [@popey](https://anchorecommunity.discourse.group/u/popey)\ **Replies:** 0\ **Last updated:** [September 1, 2025, 10:28am UTC](https://anchorecommunity.discourse.group/t/anchore-open-source-weekly-report-week-35-2025/549 "2025-09-01T10:28:34Z")
Anchore Open Source Weekly Report - Week 35, 2025 This report covers the community activity in Anchore Open Source Projects from August 19, 2025 to August 30, 2025. Community Team Meeting Before we get into the “meat an… --- ## ["we track the complete list in our open source SBOM eBook." - the repo is gone](https://anchorecommunity.discourse.group/t/we-track-the-complete-list-in-our-open-source-sbom-ebook-the-repo-is-gone/547)
**Author:** [@Jakub\_Bochenski](https://anchorecommunity.discourse.group/u/Jakub_Bochenski)\ **Replies:** 1\ **Last updated:** [September 1, 2025, 7:34am UTC](https://anchorecommunity.discourse.group/t/we-track-the-complete-list-in-our-open-source-sbom-ebook-the-repo-is-gone/547 "2025-09-01T07:34:03Z")
How to Generate an SBOM with Free Open Source Tools | Anchore the linked repo https://github.com/popey/sbom\_ebook is not available @popey --- ## [Grype - v0.99.1 released](https://anchorecommunity.discourse.group/t/grype-v0-99-1-released/548)
**Author:** [@popey](https://anchorecommunity.discourse.group/u/popey)\ **Replies:** 0\ **Last updated:** [September 1, 2025, 6:08am UTC](https://anchorecommunity.discourse.group/t/grype-v0-99-1-released/548 "2025-09-01T06:08:19Z")
:sparkles: Help shape the future of Grype! Share your thoughts in our quick 5-question survey. Your feedback will guide our development priorities and help us better serve your needs. Thank you! :raising\_hands: Release… --- ## [August 28th | Open Source Gardening | Live Stream](https://anchorecommunity.discourse.group/t/august-28th-open-source-gardening-live-stream/546)
**Author:** [@popey](https://anchorecommunity.discourse.group/u/popey)\ **Replies:** 0\ **Last updated:** [August 28, 2025, 10:40am UTC](https://anchorecommunity.discourse.group/t/august-28th-open-source-gardening-live-stream/546 "2025-08-28T10:40:56Z")
:wave: Hello everyone! We’re back with the Anchore Open Source team running a live stream to discuss issues, pull requests, and future roadmap planning in our SBOM and vulnerability tools. :alarm\_clock: Starts at 2025-0… --- ## [Grype .98 misidentifies package versions](https://anchorecommunity.discourse.group/t/grype-98-misidentifies-package-versions/541)
**Author:** [@wagner-robert](https://anchorecommunity.discourse.group/u/wagner-robert)\ **Replies:** 10\ **Last updated:** [August 27, 2025, 2:11pm UTC](https://anchorecommunity.discourse.group/t/grype-98-misidentifies-package-versions/541 "2025-08-27T14:11:08Z")
All, I logged this bug. Grype .98 misidentifies the container package version · Issue #2884 · anchore/grype I am trying to see if there is a way to debug this and better understand exactly why Grype is saying I have ve… --- ## [Grype - v0.99.0 released](https://anchorecommunity.discourse.group/t/grype-v0-99-0-released/545)
**Author:** [@popey](https://anchorecommunity.discourse.group/u/popey)\ **Replies:** 0\ **Last updated:** [August 27, 2025, 8:47am UTC](https://anchorecommunity.discourse.group/t/grype-v0-99-0-released/545 "2025-08-27T08:47:24Z")
:sparkles: Help shape the future of Grype! Share your thoughts in our quick 5-question survey. Your feedback will guide our development priorities and help us better serve your needs. Thank you! :raising\_hands: Release… --- ## [Syft - v1.32.0 released](https://anchorecommunity.discourse.group/t/syft-v1-32-0-released/544)
**Author:** [@popey](https://anchorecommunity.discourse.group/u/popey)\ **Replies:** 0\ **Last updated:** [August 26, 2025, 10:01pm UTC](https://anchorecommunity.discourse.group/t/syft-v1-32-0-released/544 "2025-08-26T22:01:16Z")
:sparkles: Help shape the future of Syft! Share your thoughts in our quick 5-question survey. Your feedback will guide our development priorities and help us better serve your needs. Thank you! :raising\_hands: Release … --- ## [Reducing 'unknowns' via targeted fuzzy binary catalogers](https://anchorecommunity.discourse.group/t/reducing-unknowns-via-targeted-fuzzy-binary-catalogers/542)
**Author:** [@popey](https://anchorecommunity.discourse.group/u/popey)\ **Replies:** 1\ **Last updated:** [August 26, 2025, 6:37am UTC](https://anchorecommunity.discourse.group/t/reducing-unknowns-via-targeted-fuzzy-binary-catalogers/542 "2025-08-26T06:37:30Z")
A question for you on the topic of binary fingerprinting like the recent ffmpeg one. tl;dr; Some ecosystems of different software containers have numerous, common “unknown unknowns” in their SBOMs. Would it be advantage… --- ## [Why does local anchore/syft image take up more space than reported on DockerHub page?](https://anchorecommunity.discourse.group/t/why-does-local-anchore-syft-image-take-up-more-space-than-reported-on-dockerhub-page/539)
**Author:** [@calvinstephen487-oss](https://anchorecommunity.discourse.group/u/calvinstephen487-oss)\ **Replies:** 1\ **Last updated:** [August 25, 2025, 4:33pm UTC](https://anchorecommunity.discourse.group/t/why-does-local-anchore-syft-image-take-up-more-space-than-reported-on-dockerhub-page/539 "2025-08-25T16:33:58Z")
Anchore: Why is the size of syft image higher than what is mentioned in DockerHub. when i install its around 100 MB. Why is it that so? --- ## [Anchore Open Source Weekly Report - Week 34, 2025](https://anchorecommunity.discourse.group/t/anchore-open-source-weekly-report-week-34-2025/540)
**Author:** [@popey](https://anchorecommunity.discourse.group/u/popey)\ **Replies:** 0\ **Last updated:** [August 25, 2025, 1:06pm UTC](https://anchorecommunity.discourse.group/t/anchore-open-source-weekly-report-week-34-2025/540 "2025-08-25T13:06:01Z")
This report covers the community activity in Anchore Open Source Projects from August 19, 2025 to August 23, 2025. Executive Summary The Anchore Open Source ecosystem achieved substantial progress this week with 21 issu… --- ## [Adding Ignore Filters for Vex Entries](https://anchorecommunity.discourse.group/t/adding-ignore-filters-for-vex-entries/537)
**Author:** [@CrosleyZack](https://anchorecommunity.discourse.group/u/CrosleyZack)\ **Replies:** 3\ **Last updated:** [August 21, 2025, 8:57pm UTC](https://anchorecommunity.discourse.group/t/adding-ignore-filters-for-vex-entries/537 "2025-08-21T20:57:29Z")
I am working on adding an OpenVEX feed from Chainguard to help filter out false positive vulnerability results in Chainguard Libraries. So far, I have PRs adding OpenVEX parsing to vunnel and store as data.Entry’s in gry… --- ## [August 21st | Open Source Gardening | Live Stream](https://anchorecommunity.discourse.group/t/august-21st-open-source-gardening-live-stream/534)
**Author:** [@popey](https://anchorecommunity.discourse.group/u/popey)\ **Replies:** 0\ **Last updated:** [August 18, 2025, 1:06pm UTC](https://anchorecommunity.discourse.group/t/august-21st-open-source-gardening-live-stream/534 "2025-08-18T13:06:35Z")
:wave: Hello everyone! We’re back with the Anchore Open Source team running a live stream to discuss issues, pull requests, and future roadmap planning in our SBOM and vulnerability tools. :alarm\_clock: Starts at 2025-0… --- ## [PURL is empty for "graalvm-native-image-cataloger"](https://anchorecommunity.discourse.group/t/purl-is-empty-for-graalvm-native-image-cataloger/535)
**Author:** [@santhosh](https://anchorecommunity.discourse.group/u/santhosh)\ **Replies:** 5\ **Last updated:** [August 20, 2025, 5:21pm UTC](https://anchorecommunity.discourse.group/t/purl-is-empty-for-graalvm-native-image-cataloger/535 "2025-08-20T17:21:56Z")
I am generating SBOM for graal-vm-native binaries. I have created a simple maven project with few dependencies. downloaded graalvm-jdk-21 Built maven project using mvn clean package Generated native binary using comman… --- ## [Vcpkg custom registry](https://anchorecommunity.discourse.group/t/vcpkg-custom-registry/532)
**Author:** [@gabetrau](https://anchorecommunity.discourse.group/u/gabetrau)\ **Replies:** 5\ **Last updated:** [August 18, 2025, 3:13pm UTC](https://anchorecommunity.discourse.group/t/vcpkg-custom-registry/532 "2025-08-18T15:13:08Z")
Could someone initialize a project for me here anchore/vcpkg-test-fixture · GitHub ? It won’t let me make a pull request since it’s empty --- ## [Exploring VM Disk Image Scanning: sbom-vm Project](https://anchorecommunity.discourse.group/t/exploring-vm-disk-image-scanning-sbom-vm-project/326)
**Author:** [@popey](https://anchorecommunity.discourse.group/u/popey)\ **Replies:** 3\ **Last updated:** [August 18, 2025, 3:00pm UTC](https://anchorecommunity.discourse.group/t/exploring-vm-disk-image-scanning-sbom-vm-project/326 "2025-08-18T15:00:30Z")
Exploring VM Disk Image Scanning: sbom-vm Project Hi everyone! Following up on our previous discussions about improvements to scanning whole machines, I wanted to share a project I’ve been working on this weekend that e… --- ## [Anchore Open Source Weekly Report - Week 33, 2025](https://anchorecommunity.discourse.group/t/anchore-open-source-weekly-report-week-33-2025/533)
**Author:** [@popey](https://anchorecommunity.discourse.group/u/popey)\ **Replies:** 0\ **Last updated:** [August 18, 2025, 9:56am UTC](https://anchorecommunity.discourse.group/t/anchore-open-source-weekly-report-week-33-2025/533 "2025-08-18T09:56:50Z")
Anchore Open Source Weekly Report This report covers the community activity in Anchore Open Source Projects from August 11, 2025 to August 17, 2025. Executive Summary The Anchore Open Source ecosystem experienced steady… --- ## [August 14th | Open Source Gardening | Live Stream](https://anchorecommunity.discourse.group/t/august-14th-open-source-gardening-live-stream/529)
**Author:** [@popey](https://anchorecommunity.discourse.group/u/popey)\ **Replies:** 1\ **Last updated:** [August 15, 2025, 9:53am UTC](https://anchorecommunity.discourse.group/t/august-14th-open-source-gardening-live-stream/529 "2025-08-15T09:53:46Z")
:wave: Hello everyone! We’re back with the Anchore Open Source team running a live stream to discuss issues, pull requests, and future roadmap planning in our SBOM and vulnerability tools. :alarm\_clock: Starts at 2025-0… --- ## [Syft - v1.31.0 released](https://anchorecommunity.discourse.group/t/syft-v1-31-0-released/530)
**Author:** [@popey](https://anchorecommunity.discourse.group/u/popey)\ **Replies:** 0\ **Last updated:** [August 13, 2025, 3:25pm UTC](https://anchorecommunity.discourse.group/t/syft-v1-31-0-released/530 "2025-08-13T15:25:42Z")
:sparkles: Help shape the future of Syft! Share your thoughts in our quick 5-question survey. Your feedback will guide our development priorities and help us better serve your needs. Thank you! :raising\_hands: Release … --- ## [Anchore Open Source Weekly Report - Week 32, 2025](https://anchorecommunity.discourse.group/t/anchore-open-source-weekly-report-week-32-2025/528)
**Author:** [@popey](https://anchorecommunity.discourse.group/u/popey)\ **Replies:** 0\ **Last updated:** [August 11, 2025, 8:13am UTC](https://anchorecommunity.discourse.group/t/anchore-open-source-weekly-report-week-32-2025/528 "2025-08-11T08:13:26Z")
This report covers the community activity in Anchore Open Source Projects from August 4, 2025 to August 8, 2025. Executive Summary The Anchore ecosystem saw focused development this week with 10 issues and pull requests… [Previous page](https://anchorecommunity.discourse.group/latest.md?page=1) [Next page](https://anchorecommunity.discourse.group/latest.md?page=3)