https://github.com/anchore/syft 0f1aed447751f92dcc0165b56aa474ec9706805e