Skip to content

perf: switch to kubescape/syft v1.32.0-ks.2 + disable file catalogers #798

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
matthyx merged 4 commits into from
Apr 29, 2026
+21 −3
Merged

perf: switch to kubescape/syft v1.32.0-ks.2 + disable file catalogers #798

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b3225ee
perf: disable file-digest/metadata/executable catalogers
slashben Apr 21, 2026
ca022e2
deps: switch to kubescape/syft v1.32.0-ks.2 for memory reduction
slashben Apr 28, 2026
b4ae37f
fix: check dep.Replace for actual fork version; add cataloger removal…
slashben Apr 28, 2026
5136072
fix: keep syft tool version at required version
matthyx Apr 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,7 @@ require (
go.uber.org/multierr v1.11.0
golang.org/x/net v0.53.0
golang.org/x/sys v0.43.0
golang.org/x/tools v0.43.0
gonum.org/v1/plot v0.14.0
google.golang.org/grpc v1.80.0
google.golang.org/protobuf v1.36.11
Expand Down Expand Up @@ -435,7 +436,6 @@ require (
golang.org/x/term v0.42.0 // indirect
golang.org/x/text v0.36.0 // indirect
golang.org/x/time v0.15.0 // indirect
golang.org/x/tools v0.43.0 // indirect
golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
google.golang.org/api v0.271.0 // indirect
google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 // indirect
Expand Down Expand Up @@ -468,3 +468,5 @@ require (
replace github.com/inspektor-gadget/inspektor-gadget => github.com/matthyx/inspektor-gadget v0.0.0-20260421100818-fd383d3d7db4

replace github.com/cilium/ebpf => github.com/matthyx/ebpf v0.0.0-20260421101317-8a32d06def6c

replace github.com/anchore/syft => github.com/kubescape/syft v1.32.0-ks.2
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Apr 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Verify replace directive exists
rg -n '^replace github.com/anchore/syft => ' go.mod

# Verify runtime version extraction does not currently inspect dep.Replace
rg -n -A8 -B4 'func packageVersion\(name string\) string|debug.ReadBuildInfo|dep\.Replace|return dep\.Version' pkg/sbommanager/v1/sbom_manager.go

Repository: kubescape/node-agent

Length of output: 622

🏁 Script executed:

# Find all calls to packageVersion to see what packages are being queried
rg -n 'packageVersion\(' pkg/sbommanager/v1/sbom_manager.go -A2 -B2

Repository: kubescape/node-agent

Length of output: 419

🏁 Script executed:

# Check if there's any version-gating logic that uses the packageVersion result
rg -n 'packageVersion' --type go

Repository: kubescape/node-agent

Length of output: 410

🌐 Web query:

Go debug.ReadBuildInfo Replace field module replacement version information

💡 Result:

In Go, runtime/debug.ReadBuildInfo returns a *debug.BuildInfo struct containing module information from the binary. The Main field and each entry in Deps are *debug.Module structs, which have a Replace *Module field. This field is populated if the module was replaced by a replace directive in go.mod during the build. When a replacement is active, the replaced module's Replace field points to the replacement module details (path, version, sum). In the BuildInfo.String output (used by go version -m), replacements appear as: mod example.com/mod v1.2.3 => example.com/replacement v1.3.0 or for deps similarly. Historically, issue #37392 (opened 2020) noted that BuildInfo did not honor replace directives for the main module containing package main, showing the original instead of replacement. Changes like CL 220645 aimed to fix this by recording replacements in cmd/go/internal/modload.PackageBuildInfo, but some reverts occurred. Current Go documentation and source code (as of go1.26) define and parse the Replace field, indicating support exists today. To access replacement info in code: import "runtime/debug" info, ok := debug.ReadBuildInfo if ok && info.Main.Replace != nil { fmt.Printf("Main replaced by: %s@%s\n", info.Main.Replace.Path, info.Main.Replace.Version) } for _, dep := range info.Deps { if dep.Replace != nil { fmt.Printf("Dep %s replaced by: %s@%s\n", dep.Path, dep.Replace.Path, dep.Replace.Version) } } If replacements are not appearing, verify: - Build with modules enabled (go build in module mode). - Use go build . or specify package path (not file args like main.go) to populate Main properly (Go 1.18+ behavior). - Check go version -m binary output confirms replacements. - No build flags stripping debug info. This provides complete visibility into module replacement version information at runtime.

Citations:

🏁 Script executed:

# Check how the version field is used in sbom_manager
rg -n '\.version|version.*==' pkg/sbommanager/v1/sbom_manager.go -A3 -B3

Repository: kubescape/node-agent

Length of output: 1994

🏁 Script executed:

# Check how the version field is used in sbom_scanner
rg -n '\.version|version.*==' pkg/sbomscanner/v1/server.go -A3 -B3

Repository: kubescape/node-agent

Length of output: 536

🏁 Script executed:

# Check if packageVersion is defined twice or just called in both places
rg -n 'func packageVersion' --type go

Repository: kubescape/node-agent

Length of output: 220

syft fork version does not propagate to runtime metadata and version-gating logic.

At Line 472, the module is replaced with github.com/kubescape/syft v1.32.0-ks.2, but packageVersion() currently returns only dep.Version without checking dep.Replace. This causes the metadata to use the original version (v1.32.0) instead of the replacement version. Since this version is used in version-gating logic at line 312 of sbom_manager.go and recorded in SBOM metadata, the incorrect version can break conditional processing and produce inaccurate tool metadata.

The packageVersion function is defined in two locations (pkg/sbommanager/v1/sbom_manager.go:715 and pkg/sbomscanner/v1/server.go:102) and both need the same fix:

Proposed fix 
 func packageVersion(name string) string {
 	bi, ok := debug.ReadBuildInfo()
 	if ok {
 		for _, dep := range bi.Deps {
 			if dep.Path == name {
+				if dep.Replace != nil && dep.Replace.Version != "" {
+					return dep.Replace.Version
+				}
 				return dep.Version
 			}
 		}
 	}
 	return "unknown"
 }
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@go.mod` at line 472, Update the packageVersion() implementations (used in
sbom_manager.go and server.go) to prefer the module replacement version when
present: if dep.Replace is non-nil and dep.Replace.Version is non-empty return
dep.Replace.Version, otherwise fall back to dep.Version; use the same logic for
both packageVersion functions so the go.mod "replace" (e.g.,
github.com/kubescape/syft v1.32.0-ks.2) is propagated into runtime metadata and
version-gating logic instead of the original dep.Version.

4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,8 +179,6 @@ github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115 h1:ZyRCmiE
github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115/go.mod h1:KoYIv7tdP5+CC9VGkeZV4/vGCKsY55VvoG+5dadg4YI=
github.com/anchore/stereoscope v0.1.9 h1:Nhvk8g6PRx9ubaJU4asAhD3fGcY5HKXZCDGkxI2e0sI=
github.com/anchore/stereoscope v0.1.9/go.mod h1:YkrCtDgz7A+w6Ggd0yxU9q58CerqQFwYARS+F2RvLQQ=
github.com/anchore/syft v1.32.0 h1:JcX9W+P/Xjv5DNg3TNBtwiEyZommuTaP16/NC9r0Yfo=
github.com/anchore/syft v1.32.0/go.mod h1:E6Kd4iBM2ljUOUQvSt7hVK6vBwaHkMXwcvBZmGMSY5o=
github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ=
github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
Expand Down Expand Up @@ -889,6 +887,8 @@ github.com/kubescape/k8s-interface v0.0.207 h1:jX+EqZLjSArw4xa+XMvjnnoK0Q8IxdD2t
github.com/kubescape/k8s-interface v0.0.207/go.mod h1:WNYUG93aZ5kDmuaRKFLtVhp18Yc6EfaHdD1gLYtVTN4=
github.com/kubescape/storage v0.0.258 h1:0mL0z3dAmtP1qup7VgoEgwLgbBSROu5oOusBAPeMmus=
github.com/kubescape/storage v0.0.258/go.mod h1:VHs+xQzvZKE2lJDN8rR1sFmTa43N6XJAcatZ249gviU=
github.com/kubescape/syft v1.32.0-ks.2 h1:xdUksUmKEyyVKsTfJDYW8Z5HawVJtelsUolPOsWtDx0=
github.com/kubescape/syft v1.32.0-ks.2/go.mod h1:E6Kd4iBM2ljUOUQvSt7hVK6vBwaHkMXwcvBZmGMSY5o=
github.com/kubescape/workerpool v0.0.0-20250526074519-0e4a4e7f44cf h1:hI0jVwrB6fT4GJWvuUjzObfci1CUknrZdRHfnRVtKM0=
github.com/kubescape/workerpool v0.0.0-20250526074519-0e4a4e7f44cf/go.mod h1:Il5baM40PV9cTt4OGdLMeTRRAai3TMfvImu31itIeCM=
github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
Expand Down
8 changes: 8 additions & 0 deletions pkg/sbommanager/v1/sbom_manager.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ import (

"github.com/DmitriyVTitov/size"
"github.com/anchore/syft/syft"
"github.com/anchore/syft/syft/cataloging"
"github.com/anchore/syft/syft/cataloging/pkgcataloging"
sbomcataloger "github.com/anchore/syft/syft/pkg/cataloger/sbom"
"github.com/aquilax/truncate"
Expand Down Expand Up @@ -471,6 +472,13 @@ func (s *SbomManager) processContainerWithMetadata(notif containercollection.Pub
sbomCfg := syft.DefaultCreateSBOMConfig()
sbomCfg.ToolName = "syft"
sbomCfg.ToolVersion = s.version
sbomCfg = sbomCfg.WithCatalogerSelection(
cataloging.NewSelectionRequest().WithRemovals(
"file-digest-cataloger",
"file-metadata-cataloger",
"file-executable-cataloger",
),
)
Comment thread
coderabbitai[bot] marked this conversation as resolved.
if s.cfg.EnableEmbeddedSboms {
sbomCfg.WithCatalogers(pkgcataloging.NewCatalogerReference(sbomcataloger.NewCataloger(), []string{pkgcataloging.ImageTag}))
}
Expand Down
8 changes: 8 additions & 0 deletions pkg/sbomscanner/v1/server.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ import (
"time"

"github.com/anchore/syft/syft"
"github.com/anchore/syft/syft/cataloging"
"github.com/anchore/syft/syft/cataloging/pkgcataloging"
sbomcataloger "github.com/anchore/syft/syft/pkg/cataloger/sbom"
"github.com/kubescape/go-logger"
Expand Down Expand Up @@ -59,6 +60,13 @@ func (s *scannerServer) CreateSBOM(ctx context.Context, req *pb.CreateSBOMReques
cfg := syft.DefaultCreateSBOMConfig()
cfg.ToolName = "syft"
cfg.ToolVersion = s.version
cfg = cfg.WithCatalogerSelection(
cataloging.NewSelectionRequest().WithRemovals(
"file-digest-cataloger",
"file-metadata-cataloger",
"file-executable-cataloger",
),
)
if req.EnableEmbeddedSboms {
cfg.WithCatalogers(pkgcataloging.NewCatalogerReference(sbomcataloger.NewCataloger(), []string{pkgcataloging.ImageTag}))
}
Expand Down
Loading