# Adding a new matcher **URL:** https://anchorecommunity.discourse.group/t/adding-a-new-matcher/656 **Category:** Grype **Created:** [July 21, 2026, 8:14pm UTC](https://anchorecommunity.discourse.group/t/adding-a-new-matcher/656 "2026-07-21T20:14:35Z") **Posts on this page:** 1 **Page:** 1
### Author: ![thaines](https://avatars.discourse-cdn.com/v4/letter/t/e36b37/32.png) [@thaines](https://anchorecommunity.discourse.group/u/thaines) #### Post date: [July 21, 2026, 8:14pm UTC](https://anchorecommunity.discourse.group/t/adding-a-new-matcher/656/1 "2026-07-21T20:14:35Z")
[spack](https://spack.readthedocs.io) is a package manager similar to conan or vcpkg that can build software from source covering a wide array of languages, runtimes, compilers, and configurations (it can also use signed packages from its public binary caches). Recently, support was added to generate SBOM data in SPDX format (support for Cyclone-DX is being considered). I am adding spack as a PURL type, and would like grype to be able to consume spack’s SBOMs for scanning. I have a few questions on getting started making a matcher for spack. Since spack can generate the SBOM, it seems like I don’t need to add anything to Syft. Is this correct? > No. You must implement a [cataloger](https://oss.anchore.com/docs/contributing/syft/#adding-a-new-cataloger) to satisfy the grype matcher interface. Specifically, > > `PackageTypes() []syftPkg.Type` Is there documentation on the grype/matcher interface? In particular, what features are required to be overridden by a new matcher. The level of complexity in the current matchers varies quite a lot, so it’s not entirely clear to me which parts are essential. > There is excellent documentation of the architecture of the entire anchore ecosystem. > > `anchore.com/docs/architecture/` > > and for grype specifically > > `https://oss.anchore.com/docs/architecture/grype/` Ideally, I would like to have spack work like the other scan targets such that `grype --from spack /path/to/spack/install` works and `grype /path/to/spack/install` automatically detects it as a spack source. Many thanks in advance for your help! - Tim **EDIT** As is usual for me, I found the answers to my questions right after I posted this. 🙃