syft - Debian Package Tracker

general

source: syft (main)
version: 1.54.1-1
maintainer: Debian Go Packaging Team (DMD)
uploaders: Juan Manuel Méndez Rey (DMD) (DM)
arch: all any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

unstable: 1.54.1-1

versioned links

1.54.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

golang-github-anchore-syft-dev
syft

action needed

A new upstream version is available: 1.57.0 high

A new upstream version 1.57.0 is available, you should consider packaging it.

Created: 2026-11-09 Last update: 2026-11-10 22:30

debian/patches: 1 patch with invalid metadata high

Among the 2 debian patches available in version 1.54.1-1 of the package, we noticed the following issues:

1 patch with invalid metadata that ought to be fixed.

Created: 2026-11-09 Last update: 2026-11-09 09:31

Depends on packages which need a new maintainer normal

The packages that syft depends on which need a new maintainer are:

golang-github-oneofone-xxhash (#940404)
- Depends: golang-github-oneofone-xxhash-dev
- Build-Depends: golang-github-oneofone-xxhash-dev

Created: 2026-11-09 Last update: 2026-11-11 01:01

2 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit d29ba7529d28b121b630096ca748da7cd66b4bd2
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Fri Nov 6 09:59:08 2026 +0100

    Say which terms the licence-corpus files are distributed under
    
    The paragraph described the files without stating a licence, which the
    DFSG review read as no licence at all for golang-github-google-licenseclassifier.

commit 01ce22b39c395bd877ee25c36d12229916d7f822
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Thu Nov 5 06:44:35 2026 +0100

    Require tools-golang 0.6.0~rc4 in the -dev Depends too
    
    The shipped sources import spdx/v3/v3_0, which older tools-golang lacks.

Created: 2026-11-09 Last update: 2026-11-09 04:03

testing migrations

excuses:
- Migrates after: golang-github-anchore-bubbly, golang-github-anchore-clio, golang-github-anchore-fangs, golang-github-anchore-go-logger, golang-github-anchore-stereoscope, golang-github-diskfs-go-diskfs, golang-github-scylladb-go-set
- Migration status for syft (- to 1.54.1-1): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Autopkgtest for syft/1.54.1-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Failed ♻, loong64: Pass, ppc64el: Pass, s390x: Pass
- ∙ ∙ Too young, only 2 of 5 days old
- ∙ ∙ Build-Depends(-Arch): syft golang-github-anchore-bubbly (not considered)
- ∙ ∙ Build-Depends(-Arch): syft golang-github-anchore-clio (not considered)
- ∙ ∙ Build-Depends(-Arch): syft golang-github-anchore-fangs
- ∙ ∙ Build-Depends(-Arch): syft golang-github-anchore-go-logger (not considered)
- ∙ ∙ Build-Depends(-Arch): syft golang-github-anchore-stereoscope (not considered)
- ∙ ∙ Build-Depends(-Arch): syft golang-github-diskfs-go-diskfs (not considered)
- ∙ ∙ Build-Depends(-Arch): syft golang-github-scylladb-go-set (not considered)
- ∙ ∙ Depends: syft golang-github-anchore-bubbly (not considered)
- ∙ ∙ Depends: syft golang-github-anchore-clio (not considered)
- ∙ ∙ Depends: syft golang-github-anchore-fangs
- ∙ ∙ Depends: syft golang-github-anchore-go-logger (not considered)
- ∙ ∙ Depends: syft golang-github-anchore-stereoscope (not considered)
- ∙ ∙ Depends: syft golang-github-diskfs-go-diskfs (not considered)
- ∙ ∙ Depends: syft golang-github-scylladb-go-set (not considered)
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/s/syft.html
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- Not considered

news

[rss feed]

[2026-11-09] Accepted syft 1.54.1-1 (source all amd64) into unstable (Debian FTP Masters) (signed by: Simon Quigley)

bugs [bug history graph]

all: 0

links

homepage
lintian
buildd: logs, cross
popcon
browse source code
other distros
security tracker
debian patches