# Package detect, binary NOT detect

**URL:** <https://anchorecommunity.discourse.group/t/package-detect-binary-not-detect/299>\
**Category:** Syft\
**Created:** [January 6, 2025, 5:39am UTC](https://anchorecommunity.discourse.group/t/package-detect-binary-not-detect/299 "2025-01-06T05:39:24Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![witchcraze](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/witchcraze/32/222_2.png) [@witchcraze](https://anchorecommunity.discourse.group/u/witchcraze)\
**Post date:** [January 6, 2025, 5:39am UTC](https://anchorecommunity.discourse.group/t/package-detect-binary-not-detect/299/1 "2025-01-06T05:39:24Z")

</div>

Hi,

I notice a case - package is detected, but binary is NOT detected.

php packages including php-cli are detected

```auto
$ syft -q cimg/php:5.6.40 | grep php
libapache2-mod-php5.6 5.6.40-29+ubuntu18.04.1+deb.sury.org+1 deb
php-common 2:76+ubuntu18.04.1+deb.sury.org+9 deb
php-pear 1:1.10.8+submodules+notgz-1+ubuntu18.04.1+deb.sury.org+1 deb
php-xml 2:7.4+76+ubuntu18.04.1+deb.sury.org+9 deb
php5.6 5.6.40-29+ubuntu18.04.1+deb.sury.org+1 deb
php5.6-cli 5.6.40-29+ubuntu18.04.1+deb.sury.org+1 deb
php5.6-common 5.6.40-29+ubuntu18.04.1+deb.sury.org+1 deb
php5.6-curl 5.6.40-29+ubuntu18.04.1+deb.sury.org+1 deb
php5.6-dev 5.6.40-29+ubuntu18.04.1+deb.sury.org+1 deb
php5.6-gd 5.6.40-29+ubuntu18.04.1+deb.sury.org+1 deb
php5.6-json 5.6.40-29+ubuntu18.04.1+deb.sury.org+1 deb
php5.6-mbstring 5.6.40-29+ubuntu18.04.1+deb.sury.org+1 deb
php5.6-mysql 5.6.40-29+ubuntu18.04.1+deb.sury.org+1 deb
php5.6-opcache 5.6.40-29+ubuntu18.04.1+deb.sury.org+1 deb
php5.6-readline 5.6.40-29+ubuntu18.04.1+deb.sury.org+1 deb
php5.6-xml 5.6.40-29+ubuntu18.04.1+deb.sury.org+1 deb
php5.6-zip 5.6.40-29+ubuntu18.04.1+deb.sury.org+1 deb
php7.4-common 7.4.6-1+ubuntu18.04.1+deb.sury.org+1 deb
php7.4-xml 7.4.6-1+ubuntu18.04.1+deb.sury.org+1 deb
pkg-php-tools 1.35ubuntu1 deb

```

But php-cli binary is not detected (libphp is detected)

```auto
$ syft -q cimg/php:5.6.40 --override-default-catalogers "binary"
NAME VERSION TYPE
bash 4.4.20 binary
curl 7.58.0 binary
gzip 1.6 binary
libphp 5.6.40 binary
openssl 1.1.1 binary
python 3.6.9 binary
util-linux 2.31.1 binary
xz 5.2.2 binary

```

php-cli target file exists

```auto
$ docker run -it --rm cimg/php:5.6.40 which php
/usr/bin/php
$ docker run -it --rm cimg/php:5.6.40 /usr/bin/php -v
PHP 5.6.40-29+ubuntu18.04.1+deb.sury.org+1 (cli)
Copyright (c) 1997-2016 The PHP Group
Zend Engine v2.6.0, Copyright (c) 1998-2016 Zend Technologies
    with Zend OPcache v7.0.6-dev, Copyright (c) 1999-2016, by Zend Technologies

```

I think this isn’t problem in most cases.  
But, I’d like to hear if others have a different perspective on this.  
If this is considered an issue or someone wants php-cli binary detections, I’ll open a GitHub issue.

---

<div class="post-metadata">

**Author:** ![spiffcs](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/spiffcs/32/14_2.png) [@spiffcs](https://anchorecommunity.discourse.group/u/spiffcs)\
**Post date:** [January 8, 2025, 8:11pm UTC](https://anchorecommunity.discourse.group/t/package-detect-binary-not-detect/299/2 "2025-01-08T20:11:29Z")

</div>

> [@witchcraze](#):
>
> `syft -q cimg/php:5.6.40 --override-default-catalogers "binary"`

Thanks for the question witchcraze!

I just ruled out that it was a deduplication of the php cataloger vs the binary cataloger.

I ran against the original image (no catalog modifiers) with the following syft config and did not see a binary result:

```auto
package:
  # allows users to exclude synthetic binary packages from the sbom
  # these packages are removed if an overlap with a non-synthetic package is found (env: SYFT_PACKAGE_EXCLUDE_BINARY_OVERLAP_BY_OWNERSHIP)
  exclude-binary-overlap-by-ownership: false

```

This tells me there might be something wrong with the classifier for `php-cli` classifier.

> <https://github.com/anchore/syft/blob/b4e7b64d5ce04b6636b46ffe4b900936a51a4ddd/syft/pkg/cataloger/binary/classifiers.go#L220-L229>

It looks like we should be matching on the file correctly.

I ran  
`docker run -it cimg/php:5.6.40 /bin/bash`

And then in the container to confirm it’s installed

```auto
apt show php5.6-cli

```

Checking the contents of the cli:

```auto
circleci@7b0fca49301e:~/project$ strings /usr/bin/php | grep X-Powered
X-Powered-By: PHP/5.6.40-29+ubuntu18.04.1+deb.sury.org+1

```

This does match the evidence matcher:

 ![Screenshot 2025-01-08 at 3.09.50 PM](https://global.discourse-cdn.com/free1/uploads/anchorecommunity/original/1X/e0296da69cd314d30b8f02098822f016d250220d.png)

After this far on the investigation I’m a little stumped as to why it’s not being picked up so will close this reply and come back after I step through the syft with a debugger to see why this might not be firing correctly.

Thanks for the report and reproduction instructions!

---

<div class="post-metadata">

**Author:** ![witchcraze](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/witchcraze/32/222_2.png) [@witchcraze](https://anchorecommunity.discourse.group/u/witchcraze)\
**Post date:** [April 12, 2025, 4:37am UTC](https://anchorecommunity.discourse.group/t/package-detect-binary-not-detect/299/3 "2025-04-12T04:37:32Z")

</div>

Let me report similar topic.  
Mariadb binary is not detected from recent library/mariadb build. (deb packages are detected.)  
Do you think this need updating binary detection pettern ?

```auto
$ syft -q library/mariadb:11.4.4 | grep maria
libmariadb3 1:11.4.4+maria~ubu2404 deb
mariadb-backup 1:11.4.4+maria~ubu2404 deb
mariadb-client 1:11.4.4+maria~ubu2404 deb
mariadb-client-core 1:11.4.4+maria~ubu2404 deb
mariadb-common 1:11.4.4+maria~ubu2404 deb
mariadb-server 1:11.4.4+maria~ubu2404 deb
mariadb-server-core 1:11.4.4+maria~ubu2404 deb
mysql-common 1:11.4.4+maria~ubu2404 deb
$ syft -q library/mariadb:11.4.4 --override-default-catalogers "binary" | grep maria
mariadb 11.4.4 binary

```

```auto
$ syft -q library/mariadb:11.4.5 | grep maria
libmariadb3 1:11.4.5+maria~ubu2404 deb
mariadb-backup 1:11.4.5+maria~ubu2404 deb
mariadb-client 1:11.4.5+maria~ubu2404 deb
mariadb-client-core 1:11.4.5+maria~ubu2404 deb
mariadb-common 1:11.4.5+maria~ubu2404 deb
mariadb-server 1:11.4.5+maria~ubu2404 deb
mariadb-server-core 1:11.4.5+maria~ubu2404 deb
mysql-common 1:11.4.5+maria~ubu2404 deb
$ syft -q library/mariadb:11.4.5 --override-default-catalogers "binary" | grep maria
mariadb 1:11.4.5+maria~ubu2404 deb

```

---

<div class="post-metadata">

**Author:** ![kzantow](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/kzantow/32/17_2.png) [@kzantow](https://anchorecommunity.discourse.group/u/kzantow)\
**Post date:** [April 14, 2025, 3:34pm UTC](https://anchorecommunity.discourse.group/t/package-detect-binary-not-detect/299/4 "2025-04-14T15:34:49Z")

</div>

I was surprised to see a `deb` result when you ran `syft -q library/mariadb:11.4.5 --override-default-catalogers "binary"`. This deb result is causing the binary result to be deduplicated and dropped.

I think what’s happening here is you are not being specific enough when you selected `binary` as the cataloger type – this actually results in 4 package catalogers:

```auto
$ syft cataloger list --override-default-catalogers binary                         
[0000] WARN adding 'file' tag to the default cataloger selection, to override add '-file' to the cataloger selection request
Default selections: 2
  • 'binary'
  • 'file'
Selection expressions: 0
...
┌──────────────────────────────────┬───────────────────────────────────────────────────────────────────────────┐
│ PACKAGE CATALOGER │ TAGS │
├──────────────────────────────────┼───────────────────────────────────────────────────────────────────────────┤
│ binary-classifier-cataloger │ binary, declared, directory, image, installed, package │
│ cargo-auditable-binary-cataloger │ binary, directory, image, installed, language, package, rust │
│ elf-binary-package-cataloger │ binary, declared, directory, elf-package, image, installed, package │
│ go-module-binary-cataloger │ binary, directory, go, golang, gomod, image, installed, language, package │
└──────────────────────────────────┴───────────────────────────────────────────────────────────────────────────┘

```

And, in this image it seems the ELF metadata actually has package information which we are surfacing as the more correct DEB result.

Note if you run with `binary-classifier-cataloger`, you will see:

```auto
$ syft -q library/mariadb:11.4.5 --override-default-catalogers binary-classifier-cataloger | grep maria
mariadb 11.4.5 binary    

```

So… It seems like Syft is doing the best job it can here surfacing the best results for you, at least for the mariadb images and it doesn’t look like we need to update anything, just remember to use the `binary-classifier-cataloger` instead of the tag `binary`.

For the PHP images you might be right that there are some updates needed, I don’t see the binaries showing up.

Apologies if I’ve missed something!

---

<div class="post-metadata">

**Author:** ![witchcraze](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/witchcraze/32/222_2.png) [@witchcraze](https://anchorecommunity.discourse.group/u/witchcraze)\
**Post date:** [April 15, 2025, 9:55am UTC](https://anchorecommunity.discourse.group/t/package-detect-binary-not-detect/299/5 "2025-04-15T09:55:45Z")

</div>

Thank you for your confirmation.

My usage/understanding about cataloger option was wrong.  
This mariadb image is not issue.

`cataloger list` seems very useful.  
I think I can use cataloger option more clearlly with this command.

* * *

By the way, sample option written in wiki makes error.  
Need update wiki ? Or my understanding is still wrong ?

> **[Package Cataloger Selection](https://github.com/anchore/syft/wiki/Package-Cataloger-Selection)**
>
> CLI tool and library for generating a Software Bill of Materials from container images and filesystems - anchore/syft

```auto
$ syft cataloger list --override-default-catalogers "go-module-binary-cataloger,go-module-file-cataloger"
[0000] WARN adding 'file' tag to the default cataloger selection, to override add '-file' to the cataloger selection request
[0000] ERROR unable to generate cataloger list report: unable to select catalogers: no cataloger tasks respond to the following selections: go-module-binary-cataloger,go-module-file-cataloger

```

---

<div class="post-metadata">

**Author:** ![kzantow](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/kzantow/32/17_2.png) [@kzantow](https://anchorecommunity.discourse.group/u/kzantow)\
**Post date:** [April 15, 2025, 1:09pm UTC](https://anchorecommunity.discourse.group/t/package-detect-binary-not-detect/299/6 "2025-04-15T13:09:37Z")

</div>

It looks like what’s in the docs does work properly for _scanning_:

```auto
$ syft -q --override-default-catalogers "go-module-binary-cataloger,go-module-file-cataloger" alpine:latest
No packages discovered

```

But the same `--override-default-catalogers` does not work in `cataloger list` due to it not splitting the options the same way. I’ve added [an issue](https://github.com/anchore/syft/issues/3801). ~~I’ll follow this up with a PR unless someone beats me to it.~~ [PR here](https://github.com/anchore/syft/pull/3804)