# July 24th | Open Source Gardening | Live Stream **URL:** \ **Category:** General\ **Created:** [July 21, 2025, 10:03am UTC](https://anchorecommunity.discourse.group/t/july-24th-open-source-gardening-live-stream/504 "2025-07-21T10:03:31Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![popey](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/popey/32/429_2.png) [@popey](https://anchorecommunity.discourse.group/u/popey)\ **Post date:** [July 21, 2025, 10:03am UTC](https://anchorecommunity.discourse.group/t/july-24th-open-source-gardening-live-stream/504/1 "2025-07-21T10:03:31Z")
# 👋 Hello everyone! We’re back with the Anchore Open Source team running a [live stream](https://www.youtube.com/live/pm8aCjXFCuI) to discuss issues, pull requests, and future [roadmap](https://github.com/orgs/anchore/projects/22/views/18) planning in our [SBOM](https://anchore.com/sbom) and [vulnerability](https://anchore.com/container-vulnerability-scanning/) tools. ⏰ Starts at 2025-07-24T19:00:00Z for about an hour. Expect engineering and project management discussions, a bit of GitHub issue gardening on [Syft](https://github.com/anchore/syft), [Grype](https://github.com/anchore/grype), and the rest of the [family](https://github.com/anchore). Join us today for a relaxed, educational, and productive live stream. [![](https://global.discourse-cdn.com/free1/uploads/anchorecommunity/original/1X/2756cae5f9b0d29d80173281e3904712fb13a8a8.jpeg "Live SBOM & Security Fixes: Anchore Devs Improve Syft & Grype (July 24th)") ](https://www.youtube.com/watch?v=pm8aCjXFCuI) ## Topics - [Issues](https://github.com/search?q=org%3Aanchore+label%3Aneeds-discussion&type=issues&s=updated&o=desc) - Open issues with “needs-discussion” label - [Pull Requests](https://github.com/search?q=org%3Aanchore+label%3Aneeds-discussion&type=pullrequests&s=updated&o=desc) - Open PRs with “needs-discussion” label - [Discourse topics](https://anchorecommunity.discourse.group/filter?q=posts-max:2%20category%3Asyft%2Cgrype%2Cgeneral%20status%3Aopen%20status%3Apublic%20order%3Alatest-post) - Open topics from #General #Syft and #Grype with few or no replies - Questions from the audience ---
**Author:** ![popey](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/popey/32/429_2.png) [@popey](https://anchorecommunity.discourse.group/u/popey)\ **Post date:** [July 28, 2025, 10:57am UTC](https://anchorecommunity.discourse.group/t/july-24th-open-source-gardening-live-stream/504/2 "2025-07-28T10:57:19Z")
Hello! Here is a summary of the discussions from the Anchore Open Source Team’s live stream on July 24th. How to do Vulnerability Scanning with Nix SBOMs At around the 2 minute and 18 second mark, the team discussed the challenges of vulnerability scanning for Nix/NixOS systems. The conversation referenced a [Discourse thread on the NixOS forum](https://discourse.nixos.org/t/how-to-do-vulnerability-scanning-with-nix-sboms/66161). The main challenge is that Nix builds packages in a unique way, which can make it difficult for standard vulnerability scanners to identify installed packages and their versions accurately. The team likely discussed how Syft could be improved to better support Nix, and how Grype could then use that information to provide more accurate vulnerability reports. [Add an option to fail on vulnerabilities without VEX statements](https://github.com/anchore/grype/issues/2813) The team then moved on to discuss a feature request for Grype, issue [#2813](https://github.com/anchore/grype/issues/2813). This issue, raised at approximately the 8 minute and 31 second mark, suggests adding a new flag to Grype that would cause a scan to fail if it finds a vulnerability for which there is no corresponding VEX (Vulnerability Exploitability eXchange) statement. This would be useful for teams that want to enforce a policy where every discovered vulnerability must be addressed, either by fixing it or by documenting why it’s not a threat in a VEX file. This would help to ensure that all vulnerabilities are accounted for and that the security posture of the application is clear. [Improve JVM Scan Accuracy for JDK and JRE Detection](https://github.com/anchore/syft/issues/4071) Later in the stream, at roughly the 45 minute and 28 second mark, the discussion turned to Syft and an issue related to its Java scanning capabilities, issue [#4071](https://github.com/anchore/syft/issues/4071). The issue highlights several areas where Syft’s accuracy could be improved when scanning for Java installations: - **Distinguishing between OpenJDK and Oracle JDK:** Syft sometimes misidentifies Oracle JREs as OpenJDK. - **Duplicate JDK detection:** When scanning a JDK folder, Syft can report two JDK versions. - **Incorrect JRE classification:** Syft may misclassify some JREs. The team likely discussed potential solutions to these problems, such as improving how Syft parses version information from Java binaries and release files.