https://github.com/anchore/syft 3cffa0b7fd276a35123c48e45407c4f402f2c58f