# PURL for kata-containers

**URL:** <https://anchorecommunity.discourse.group/t/purl-for-kata-containers/662>\
**Category:** Syft\
**Created:** [October 2, 2026, 5:28am UTC](https://anchorecommunity.discourse.group/t/purl-for-kata-containers/662 "2026-10-02T05:28:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dk\_g](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/dk_g/32/481_2.png) [@dk\_g](https://anchorecommunity.discourse.group/u/dk_g)\
**Post date:** [October 2, 2026, 5:28am UTC](https://anchorecommunity.discourse.group/t/purl-for-kata-containers/662/1 "2026-10-02T05:28:55Z")

</div>

Hi Team,  
I am building kata-containers rust-based binaries using cargo-auditable. One of these binaries is [container-shim-kata-v2](https://github.com/kata-containers/kata-containers/blob/main/src/runtime-rs/crates/shim/Cargo.toml) which when built with cargo-auditable embeds **.dep-v0 ELF section**.

When I run syft with the binary, it results in below PURLs

```auto
pkg:cargo/shim@0.1.0
pkg:cargo/runtime-rs@0.1.0

```

However, the CVEs of kata-containers [OSV - Open Source Vulnerabilities](https://osv.dev/vulnerability/CVE-2026-47243) are associated with the Github PURLs.

Our limitation is that we can identify vulnerabilities only using PURLs.

Is there a way we can embed and detect Github PURL from the rust binary?

---

<div class="post-metadata">

**Author:** ![kzantow](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/kzantow/32/17_2.png) [@kzantow](https://anchorecommunity.discourse.group/u/kzantow)\
**Post date:** [October 8, 2026, 5:29pm UTC](https://anchorecommunity.discourse.group/t/purl-for-kata-containers/662/2 "2026-10-08T17:29:02Z")

</div>

Hi @dk_g,

Just so I understand, you’re looking to scan with Syft, get an SBOM with the `github`-based PURL and then scan yourself using something other than Grype?

Since `cargo-auditable` is describing Cargo packages, I think the `cargo` PURLs make the most sense from a Syft perspective. Is this something that OSV might be able to include multiple packages spanning both ecosystems in the affected section? If we were talking about Grype, the OSV github ecosystem wouldn’t be included today anyway, but we might think about adding some aliases if we did include these records in the future.