https://github.com/anchore/syft 4ac8fdf6df0da4cd6f76820dbec9f490ee56bcba