https://github.com/anchore/syft 4c0aef09b8d7fb78200b04416f474b90b79370de