Hi @laoshanxi, it can be difficult to determine packages and dependencies for C/C++ projects.
There are a couple ways Syft is able to determine packages from binaries, for example using ELF notes, embedded go mod information, or version resources; but these require something during the build step to put the information in the binary and I assume you’re not talking about one of these.
Beyond those, we are able to identify software from arbitrary binaries using the binary cataloger, which examines the bytes for specific version patterns and other information but is certainly one of the least desirable ways to determine what software we found. This only works on well-known binaries like MySQL or bash that we have determined patterns that seem to identify them appropriately, and these do not include dependency information. This method is fairly brittle and still probably isn’t what you are asking about.
If you’re referring to a binary created by yourself that doesn’t fall into the above categories, Syft is probably not going to identify the libraries used to build it today unless you’re able to add it at build time.
However, there are some dependency managers like Conan that are supported and others we could implement such as vpkg, so you could scan your source code to get this information at build time and possibly embed it as ELF notes if you chose to.
Do any of the above methods help with the specific artifact you are trying to scan? Is there something else you’re looking for?