* Package name    : syft
* Version         : 1.20.0
* Upstream Author : Anchore, Inc. <dev@anchore.com>
* URL             : https://github.com/anchore/syft
* License         : Apache-2.0
*  Programming Lang: Go
* Description     : CLI tool for generating Software Bill of Materials from
container images and filesystems

syft is a CLI tool and Go library for generating a Software Bill of
Materials (SBOM) from container images and filesystems.

Features:
 - Generates SBOMs for container images, filesystems, and archives
 - Supports dozens of package ecosystems (Alpine, Debian, RPM, Go,
   Python, Java, JavaScript, Ruby, Rust, PHP, .NET, and more)
 - Supports OCI, Docker, and Singularity image formats
 - Multiple output formats (CycloneDX, SPDX, Syft JSON)
 - Works seamlessly with Grype for vulnerability scanning
 - Can create signed SBOM attestations using in-toto specification

This package is essential for software supply chain security workflows and
complements existing efforts to bring Sigstore tools (cosign, gitsign) into
Debian.

This package is essential for software supply chain security workflows
and complements existing efforts to bring Sigstore tools (cosign, grype,
gitsign)
into Debian.

The Debian NEW review of syft 1.42.3+ds-1 has been completed.

Decision: REJECTED
Reviewer: Reinhard Tartler

Review comment:

Hi,





I have to reject the package due to a DFSG violation regarding copyright attribution.





1. DFSG Violation (Blocker)





debian/copyright (L73) states: "Copyright: 2014-2025 The respective authors and contributors".


This is insufficient. Permissive licenses (Apache, BSD, MIT) require the verbatim reproduction of upstream copyright and permission notices. A catch-all statement fails to satisfy these license conditions. Please audit the source tree and include the verbatim notices.





2. Packaging & Architecture Review (Feedback)


For future uploads, please address the following issues regarding your Go packaging methodology:





Vendoring: The package heavily bundles dependencies (e.g., containerd, docker/cli, moby/sys). Debian strictly requires utilizing shared archive packages whenever possible. Vendoring introduces severe security maintenance burdens (CVE tracking across embedded copies) and unnecessary archive bloat.





dh-golang integration (debian/rules):





override_dh_auto_build: Hardcoding obj-x86_64-linux-gnu breaks cross-compilation and will FTBFS on non-amd64 architectures (e.g., arm64). Rely on standard dh-golang variables.





override_dh_auto_test: Disabling the entire test suite degrades build-time QA. Please patch out/skip only the specific network-dependent tests and run the offline test suite.





override_dh_golang: Bypassing this target due to go:embed directives causes the build to lose necessary helper functionality.





If you require assistance resolving the go:embed or un-vendoring issues, I recommend consulting the pkg-go team on IRC or their mailing list.





Regards,

Full review details: https://dfsg-new-queue.debian.org/reviews/syft

The Debian NEW review of syft 1.42.4+ds-1 has been completed.

Decision: REJECTED
Reviewer: Reinhard Tartler

Review comment:

I have reviewed the `syft` source package and it is currently not suitable for inclusion in the Debian archive.

**Critical Issues:**

*   **Excessive Vendoring and Maintainability**: This package currently ships over 340MB of vendored sources, accounting for approximately 88% of the entire source tree. This level of vendoring is a serious concern for maintainability, security tracking, and causes unnecessary bookkeeping and reviewing overhead. **This is a partial review**; a full rescan will be required only after the vendor tree has been significantly reduced by utilizing existing Debian libraries where possible.
*   **Incomplete DFSG Repack**: The `.orig.tar.gz` contains non-free license text in test fixtures (e.g., NVIDIA/CUDA license). Patching these out is insufficient; they **must be removed from the upstream tarball** using a proper `+ds` repack (e.g., `Files-Excluded` in `debian/copyright`).
*   **Missing Author Attributions**: A scan identified 64 missing author attributions. Apache, MIT, and BSD licenses require the full reproduction of the copyright notice. Missing authors include:
    *   `WebGPU native developers`, `Mihai Bazon`, `Sam Lantinga`, `David Schultz`, `Emscripten authors`, `Alibaba Cloud`, `Oracle America, Inc`, and many others found in `internal/` and `testdata/`.
*   **Inaccurate Copyright Declarations**:
    *   `syft/pkg/cataloger/golang/internal/xcoff/*`: Misattributed to Anchore/Apache-2.0 instead of Go Authors/BSD-3-clause.
    *   `vendor/github.com/ProtonMail/go-crypto`: Incomplete entry; missing `Proton AG` and `ProtonTech AG`.
    *   Missing entries: `vendor/github.com/kr/pretty`, `vendor/github.com/kr/text`, and `vendor/cyphar.com/go-pathrs`.

Given the complexity and the scale of the Go dependencies, it is essential that you reach out to the **Debian Go Team** (pkg-go-maintainers@lists.alioth.debian.org). This package should ideally be maintained within the Go team to ensure it aligns with team standards for unvendoring and dependency management.

Please perform a proper DFSG-clean repack, significantly reduce the vendored code, and ensure all required copyrights are fully reproduced before resubmitting.

Thanks Reinhard for taking a look again, and Arturo for the initial review.


I will follow your advice and start a discussion with the pkg-go-maintainers team to address the issue with the vendored dependencies, while having a look to the licenses, and check the repack.

By the way, do you use any particular tool for checking all the copyrights?


Have a great start of the week,

Juan

El lunes, 20 de abril de 2026 a las 15:57, siretart@debian.org <siretart@debian.org> escribió: