https://github.com/anchore/syft 95b4a88256bddebb91831250f28f602f8c36552a