syft (1.54.1+ds1-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1124819)
   * Do not ship upstream's .make build-tooling module.
   * Thanks to Rafael Passos for getting upstream to add a COPYRIGHT file
     (https://github.com/anchore/syft/issues/5394), which settled the
     copyright holder question for this package.

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: syft
Upstream-Contact: Anchore, Inc. <support@anchore.com>
Source: https://github.com/anchore/syft
Files-Excluded:
 internal/licenses/testdata/nvidia-software-and-cuda-supplement
 internal/licenses/testdata/Knuth-CTAN
 syft/pkg/cataloger/debian/testdata/copyright/cuda
 syft/pkg/cataloger/debian/testdata/copyright/dev-kit
 syft/pkg/cataloger/debian/testdata/copyright/libc6
 syft/pkg/cataloger/debian/testdata/copyright/microsoft
Comment: Files-Excluded removes non-DFSG license texts that upstream ships as
 test fixtures for its license detection engine. Dependencies are not vendored:
 they are Debian golang-*-dev packages listed in Build-Depends, resolved by
 dh-go through the generated Go workspace.

Files: *
Copyright: 2020-2026 Anchore, Inc.
License: Apache-2.0
Comment:
 Upstream names the holder itself, in a COPYRIGHT file that says
 "Copyright (c) Anchore, Inc.". It was added on 2026-10-12 in
 https://github.com/anchore/syft/commit/c2ea35ef328795647cfaabaf33e2ce74032f6e07,
 after https://github.com/anchore/syft/issues/5394 asked for one, and the
 LICENSE appendix was left as the Apache-2.0 boilerplate,
 "Copyright [yyyy] [name of copyright owner]".
 .
 That file is not in this release: it landed after 1.52.0 was tagged, so the
 tarball here does not contain it and this comment stands in for it. The first
 upstream release after 2026-10-12 ships the file and this comment can go.
 Upstream states no year, so the range above is this repository's history,
 from its first commit in 2020 to the current release.

Files: debian/*
Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Apache-2.0

Files: syft/pkg/cataloger/golang/testdata/xcoff/*
Copyright: 2018 The Go Authors. All rights reserved.
License: BSD-3-clause
Comment: AIX XCOFF executables used as fixtures by the Go binary cataloger
 tests, taken from the Go project's own debug/xcoff testdata. Upstream removed
 the accompanying xcoff reader source in 1.44.0 in favour of the standard
 library; only the fixtures remain.

Files: cmd/syft/internal/test/integration/testdata/npm-lock/node_modules/once/*
 cmd/syft/internal/test/integration/testdata/npm-lock/node_modules/wrappy/*
 cmd/syft/internal/test/integration/testdata/npm-lock/package.json
Copyright: Isaac Z. Schlueter and Contributors
License: ISC

Files: cmd/syft/internal/test/integration/testdata/npm-lock/node_modules/collapse-white-space/*
Copyright: 2015 Titus Wormer <tituswormer@gmail.com>
License: Expat

Files: cmd/syft/internal/test/integration/testdata/npm-lock/node_modules/end-of-stream/*
 cmd/syft/internal/test/integration/testdata/npm-lock/node_modules/pump/*
Copyright: 2014 Mathias Buus
License: Expat

Files: cmd/syft/internal/test/integration/testdata/npm-lock/node_modules/insert-css/*
Copyright: James Halliday <mail@substack.net>
License: Expat

Files: cmd/syft/internal/test/integration/testdata/yarn-lock/node_modules/async/*
 cmd/syft/internal/test/integration/testdata/yarn-lock/packages/nested-package/node_modules/async/*
Copyright: 2010-2018 Caolan McMahon
License: Expat

Files: cmd/syft/internal/test/integration/testdata/yarn-lock/node_modules/merge-objects/*
Copyright: 2015 Oleksii Shevchenko <shevaroller@gmail.com>
License: Expat

Files: cmd/syft/internal/test/integration/testdata/yarn-lock/node_modules/resize-observer-polyfill/*
Copyright: 2016 Denis Rul
License: Expat

Files: cmd/syft/internal/test/integration/testdata/yarn-lock/node_modules/should-type/*
Copyright: 2014 Denis Bardadym <bardadymchik@gmail.com>
License: Expat

Files: cmd/syft/internal/test/integration/testdata/yarn-lock/package.json
 cmd/syft/internal/test/integration/testdata/yarn-lock/packages/nested-package/package.json
Copyright: 2020-2025 Anchore, Inc.
License: Expat

Files: cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/wordpress/wp-content/plugins/akismet/akismet.php
 syft/pkg/cataloger/wordpress/testdata/glob-paths/wp-content/plugins/akismet/akismet.php
Copyright: Automattic
License: GPL-2+

Files: cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/opam/ocaml-base-compiler.4.14.0/opam
 syft/pkg/cataloger/ocaml/testdata/ocaml-base-compiler.4.14.0/opam
Copyright: Institut National de Recherche en Informatique et en Automatique
License: LGPL-2.1

Files: cmd/syft/internal/test/integration/testdata/image-sbom-cataloger/test.spdx.json
 syft/format/internal/testutil/testdata/snapshot/TestSPDXTagValueImageEncoder.golden
 syft/format/spdxjson/testdata/identify/*
 syft/format/spdxjson/testdata/snapshot/*
 syft/format/spdxjson/testdata/spdx/*
 syft/format/spdxtagvalue/testdata/identify/*
 syft/format/spdxtagvalue/testdata/snapshot/*
 syft/format/spdxtagvalue/testdata/tag-value.spdx
 syft/pkg/cataloger/bitnami/testdata/tag-value/opt/bitnami/redis/.spdx-apache.spdx
 syft/pkg/cataloger/bitnami/testdata/json/opt/bitnami/postgresql/.spdx-postgresql.spdx
 syft/pkg/cataloger/bitnami/testdata/mix/opt/bitnami/render-template/.spdx-render-template.spdx
 syft/pkg/cataloger/bitnami/testdata/no-rel/opt/bitnami/redis/.spdx-redis.spdx
Copyright: SPDX contributors
License: CC0-1.0

Files: syft/pkg/cataloger/golang/testdata/licenses-vendor/github.com/!cap!o!r!g/!cap!project/LICENSE.txt
 syft/pkg/cataloger/golang/testdata/licenses/pkg/mod/github.com/!cap!o!r!g/!cap!project@v4.111.5/LICENSE.txt
 syft/pkg/cataloger/internal/licenses/testdata/LICENSE
Comment: Test fixture LICENSE files containing MIT/Expat text,
 created by Anchore for testing the license detection engine.
Copyright: 2020-2025 Anchore, Inc.
License: Expat

Files: syft/pkg/cataloger/javascript/testdata/pkg-lock/node_modules/@actions/core/package.json
Comment: Real package.json from GitHub Actions toolkit.
Copyright: GitHub, Inc.
License: Expat

Files: syft/pkg/cataloger/javascript/testdata/pkg-lock/node_modules/cowsay/package.json
Comment: Real package.json from cowsay npm package.
Copyright: Fabio Crisci <piuccio@gmail.com>
License: Expat

Files: syft/pkg/cataloger/r/testdata/installed/stringr/DESCRIPTION
 syft/pkg/cataloger/r/testdata/DESCRIPTION
Comment: Real R CRAN DESCRIPTION files from the stringr package.
Copyright: Hadley Wickham
 RStudio
License: Expat

Files: cmd/syft/internal/test/integration/testdata/image-pkg-coverage/composer/composer.lock
 syft/pkg/cataloger/php/testdata/vendor/composer_1/installed.json
 syft/pkg/cataloger/php/testdata/vendor/composer_2/installed.json
 syft/pkg/cataloger/php/testdata/composer.lock
 syft/pkg/cataloger/javascript/testdata/pkg-json/package-repo-string.json
 syft/pkg/cataloger/javascript/testdata/pkg-lock/package-lock-2.json
 syft/pkg/cataloger/javascript/testdata/pnpm-remote/registry_response.json
 syft/pkg/cataloger/javascript/testdata/yarn-remote/registry_response.json
 syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithnestedlib/elfsrc/makefile
 syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/elfsrc1/makefile
 syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/elfsrc2/makefile
 syft/pkg/cataloger/r/testdata/map-parse/eof-multiline
 syft/pkg/cataloger/r/testdata/map-parse/multiline
Comment: Anchore-created test fixtures. JSON/lock files contain license
 identifiers as structured data values describing other packages.
 The fixture files themselves are Apache-2.0. licensecheck misreads
 license strings in JSON content as the file's own license.
Copyright: 2020-2025 Anchore, Inc.
License: Apache-2.0

Files: syft/pkg/cataloger/javascript/testdata/pkg-lock/array-license-package-lock.json
 syft/pkg/cataloger/javascript/testdata/pkg-lock/alias-package-lock-2.json
Comment: Anchore-created test fixtures for lockfile parsing. License
 identifiers in JSON content describe test packages, not the file itself.
Copyright: 2020-2025 Anchore, Inc.
License: Apache-2.0

Files: syft/pkg/cataloger/ocaml/testdata/alcotest.opam
Copyright: Thomas Gazagnaire
License: ISC

Files: cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/php/vendor/composer/installed.json
 syft/pkg/cataloger/conda/testdata/conda-meta-python-c-etc/conda-meta/jupyterlab-4.4.3-pyhd8ed1ab_0.json
Comment: Anchore test fixtures. License identifiers in JSON describe
 other packages, not these files.
Copyright: 2020-2025 Anchore, Inc.
License: Apache-2.0

Files: syft/pkg/cataloger/conda/testdata/conda-meta-python-c-etc/conda-meta/zlib-1.2.11-h90dfc92_1014.json
Comment: Conda metadata JSON describing zlib package. The "license" field
 in the JSON refers to the described package, not this file's own license.
Copyright: 2020-2025 Anchore, Inc.
License: Apache-2.0

Files: syft/pkg/cataloger/python/testdata/pypi-remote/registry_response.json
Comment: Cached PyPI registry response describing certifi package (MPL-2.0).
 The JSON data file itself is Apache-2.0.
Copyright: 2020-2025 Anchore, Inc.
License: Apache-2.0

Files: syft/pkg/cataloger/python/testdata/site-packages/license/with-license-file-declared.dist-info/LICENSE.txt
Copyright: 2010 Pallets
License: BSD-3-clause

Files: syft/pkg/cataloger/golang/testdata/repo/LICENSE
Copyright: 2020-2025 Anchore, Inc.
License: BSD-1-Clause

Files: syft/format/testdata/alpine-syft.json
 syft/pkg/cataloger/sbom/testdata/alpine/syft-json/sbom.syft.json
 test/compare/testdata/acceptance-centos-8.2.2004.json
Comment: These are syft SBOM JSON outputs that LIST packages with GPL-2
 license identifiers as data values. The JSON files themselves are
 Apache-2.0 (generated by syft). licensecheck misreads JSON string
 values like "licenses": ["GPL-2.0-only"] as the file's own license.
Copyright: 2020-2025 Anchore, Inc.
License: Apache-2.0

Files: syft/pkg/cataloger/debian/testdata/copyright/libaudit-common
 syft/pkg/cataloger/debian/testdata/glob-paths/usr/share/doc/libpam-runtime/copyright
 syft/pkg/cataloger/debian/testdata/image-dpkg/usr/share/doc/libpam-runtime/copyright
Copyright: 2012-2016 Steve Grubb <sgrubb@redhat.com>
 2007-2011 Philipp Matthias Hahn <pmhahn@debian.org>
License: GPL-2 and LGPL-2.1
Comment: Copies of the Debian copyright file of libaudit-common, used as
 fixtures for the dpkg copyright parser. The two libpam-runtime files are
 byte for byte identical to the libaudit-common one, so they carry the same
 holders and licences despite their path.

Files: syft/pkg/cataloger/debian/testdata/copyright/liblzma5
Copyright: 2006-2012 Lasse Collin
 1999-2008 Igor Pavlov
 2006 Ville Koskinen
 1998 Steve Reid
License: public-domain and LGPL-2.1+ and GPL-2+ and GPL-3+
Comment: A copy of the Debian copyright file of liblzma5 (XZ Utils), used as a
 fixture for the dpkg copyright parser. Its own summary states that liblzma is
 in the public domain, that the getopt_long code is LGPL-2.1+, that the
 gzip-derived scripts are GPL-2+, and that parts of the build system are GPL-2+
 or GPL-3+.

Files: syft/pkg/cataloger/debian/testdata/image-distroless-deb/usr/share/doc/libsqlite3-0/copyright
Copyright: D. Richard Hipp <drh@hwaci.com>
 2006-2026 Laszlo Boszormenyi (GCS) <gcs@debian.org>
 2005-2006 Tomas Fasth <tomfa@debian.org>
 2001-2005 Andreas Rottmann <rotty@debian.org>
License: public-domain and GPL-2+
Comment: A copy of the Debian copyright file of libsqlite3-0, used as a fixture
 for the dpkg copyright parser. It declares sqlite3 itself public domain and
 its Debian packaging GPL-2+.

Files: syft/pkg/cataloger/debian/testdata/copyright/trilicense
Copyright: 1993 John Doe
 1993 Joe Average
License: GPL-2 and LGPL-2.1 and MPL-1.1

Files: syft/pkg/cataloger/debian/testdata/copyright/python
Copyright: 2001-2026 Python Software Foundation
 2000 BeOpen.com
 1995-2001 Corporation for National Research Initiatives
 1991-1995 Stichting Mathematisch Centrum
License: PSF-2 and BeOpen and CNRI-Python and CWI and Apache-2.0 and Expat and Zlib and GPL-2+
Comment: A copy of the Debian copyright file of python, used as a fixture for
 the dpkg copyright parser. It reproduces the four Python history agreements in
 full, and a section headed "Files with other licenses than the Python License"
 with Apache-2.0, Expat and zlib notices. Its GNU Readline and OpenSSL entries
 are pointers to /usr/share/doc, not licence texts, and the GPL-2+ above is the
 Readline grant the file quotes.

Files: syft/pkg/cataloger/python/testdata/site-packages/license/without-license-file-declared.dist-info/LICENSE.txt
 syft/pkg/cataloger/python/testdata/site-packages/nested/dist-name/dist-info/LICENSE.txt
Copyright: 2010 Pallets
License: BSD-3-clause

Files: internal/licenses/testdata/multi-license
Copyright: Emscripten contributors
 Joyent, Inc. and Node contributors
 Sam Lantinga
 Mihai Bazon
 WebGPU native developers
 David Schultz
License: Expat and NCSA and Apache-2.0 and Zlib and BSD-2-clause and BSD-3-clause and public-domain

Files: syft/pkg/apk_test.go
Comment: This test file contains GPL-2 license identifiers as string
 constants for testing APK package metadata parsing.
Copyright: 2020-2025 Anchore, Inc.
License: Apache-2.0

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
     https://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache License, Version 2.0
 can be found in "/usr/share/common-licenses/Apache-2.0".

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
 1. Redistributions of source code must retain the above copyright notice,
    this list of conditions and the following disclaimer.
 .
 2. Redistributions in binary form must reproduce the above copyright notice,
    this list of conditions and the following disclaimer in the documentation
    and/or other materials provided with the distribution.
 .
 3. Neither the name of the copyright holder nor the names of its contributors
    may be used to endorse or promote products derived from this software
    without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
 LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 POSSIBILITY OF SUCH DAMAGE.

License: ISC
 Permission to use, copy, modify, and/or distribute this software for any
 purpose with or without fee is hereby granted, provided that the above
 copyright notice and this permission notice appear in all copies.
 .
 THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

License: CC0-1.0
 The person who associated a work with this deed has dedicated the work to
 the public domain by waiving all of his or her rights to the work worldwide
 under copyright law, including all related and neighboring rights, to the
 extent allowed by law.
 .
 You can copy, modify, distribute and perform the work, even for commercial
 purposes, all without asking permission.
 .
 On Debian systems, the complete text of the CC0 1.0 Universal license can
 be found in "/usr/share/common-licenses/CC0-1.0".

License: LGPL-2.1+
 On Debian systems, the complete text of the GNU Lesser General Public
 License, version 2.1 can be found in "/usr/share/common-licenses/LGPL-2.1".

License: GPL-2
 On Debian systems, the complete text of the GNU General Public License,
 version 2 can be found in "/usr/share/common-licenses/GPL-2".

License: GPL-2+
 On Debian systems, the complete text of the GNU General Public License,
 version 2 can be found in "/usr/share/common-licenses/GPL-2".

License: MPL-1.1
 On Debian systems, the complete text of the Mozilla Public License,
 version 1.1 can be found at "/usr/share/common-licenses/MPL-1.1".

License: LGPL-2.1
 On Debian systems, the complete text of the GNU Lesser General Public
 License, version 2.1 can be found in "/usr/share/common-licenses/LGPL-2.1".

License: BSD-1-Clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
 1. Redistributions of source code must retain the above copyright notice,
    this list of conditions and the following disclaimer.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 ARE DISCLAIMED.

License: NCSA
 Permission is hereby granted, free of charge, to any person obtaining a
 copy of this software and associated documentation files (the
 "Software"), to deal with the Software without restriction, including
 without limitation the rights to use, copy, modify, merge, publish,
 distribute, sublicense, and/or sell copies of the Software, and to
 permit persons to whom the Software is furnished to do so, subject to
 the following conditions:
 .
     Redistributions of source code must retain the above copyright
     notice, this list of conditions and the following disclaimers.
 .
     Redistributions in binary form must reproduce the above
     copyright notice, this list of conditions and the following disclaimers
     in the documentation and/or other materials provided with the
     distribution.
 .
     Neither the names of Mozilla,
     nor the names of its contributors may be used to endorse
     or promote products derived from this Software without specific prior
     written permission.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
 IN NO EVENT SHALL THE CONTRIBUTORS OR COPYRIGHT HOLDERS BE LIABLE FOR
 ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
 TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS WITH THE SOFTWARE.

License: CNRI-Python
 1. This LICENSE AGREEMENT is between the Corporation for National
 Research Initiatives, having an office at 1895 Preston White Drive,
 Reston, VA 20191 ("CNRI"), and the Individual or Organization
 ("Licensee") accessing and otherwise using Python 1.6.1 software in
 source or binary form and its associated documentation.
 .
 2. Subject to the terms and conditions of this License Agreement, CNRI
 hereby grants Licensee a nonexclusive, royalty-free, world-wide
 license to reproduce, analyze, test, perform and/or display publicly,
 prepare derivative works, distribute, and otherwise use Python 1.6.1
 alone or in any derivative version, provided, however, that CNRI's
 License Agreement and CNRI's notice of copyright, i.e., "Copyright (c)
 1995-2001 Corporation for National Research Initiatives; All Rights
 Reserved" are retained in Python 1.6.1 alone or in any derivative
 version prepared by Licensee.  Alternately, in lieu of CNRI's License
 Agreement, Licensee may substitute the following text (omitting the
 quotes): "Python 1.6.1 is made available subject to the terms and
 conditions in CNRI's License Agreement.  This Agreement together with
 Python 1.6.1 may be located on the Internet using the following
 unique, persistent identifier (known as a handle): 1895.22/1013.  This
 Agreement may also be obtained from a proxy server on the Internet
 using the following URL: http://hdl.handle.net/1895.22/1013".
 .
 3. In the event Licensee prepares a derivative work that is based on
 or incorporates Python 1.6.1 or any part thereof, and wants to make
 the derivative work available to others as provided herein, then
 Licensee hereby agrees to include in any such work a brief summary of
 the changes made to Python 1.6.1.
 .
 4. CNRI is making Python 1.6.1 available to Licensee on an "AS IS"
 basis.  CNRI MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR
 IMPLIED.  BY WAY OF EXAMPLE, BUT NOT LIMITATION, CNRI MAKES NO AND
 DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS
 FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF PYTHON 1.6.1 WILL NOT
 INFRINGE ANY THIRD PARTY RIGHTS.
 .
 5. CNRI SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF PYTHON
 1.6.1 FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS
 A RESULT OF MODIFYING, DISTRIBUTING, OR OTHERWISE USING PYTHON 1.6.1,
 OR ANY DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF.
 .
 6. This License Agreement will automatically terminate upon a material
 breach of its terms and conditions.
 .
 7. This License Agreement shall be governed by the federal
 intellectual property law of the United States, including without
 limitation the federal copyright law, and, to the extent such
 U.S. federal law does not apply, by the law of the Commonwealth of
 Virginia, excluding Virginia's conflict of law provisions.
 Notwithstanding the foregoing, with regard to derivative works based
 on Python 1.6.1 that incorporate non-separable material that was
 previously distributed under the GNU General Public License (GPL), the
 law of the Commonwealth of Virginia shall govern this License
 Agreement only as to issues arising under or with respect to
 Paragraphs 4, 5, and 7 of this License Agreement.  Nothing in this
 License Agreement shall be deemed to create any relationship of
 agency, partnership, or joint venture between CNRI and Licensee.  This
 License Agreement does not grant permission to use CNRI trademarks or
 trade name in a trademark sense to endorse or promote products or
 services of Licensee, or any third party.
 .
 8. By clicking on the "ACCEPT" button where indicated, or by copying,
 installing or otherwise using Python 1.6.1, Licensee agrees to be
 bound by the terms and conditions of this License Agreement.
 .
         ACCEPT

Files: syft/pkg/cataloger/golang/testdata/licenses/pkg/mod/github.com/someorg/somename@v0.3.2/LICENSE
 syft/pkg/cataloger/golang/testdata/licenses/pkg/mod/github.com/someorg/strangelicense@v1.2.3/LiCeNsE.tXt
 syft/pkg/cataloger/golang/testdata/licenses-vendor/github.com/someorg/somename/LICENSE
 syft/pkg/cataloger/golang/testdata/licenses-vendor/github.com/someorg/strangelicense/LiCeNsE.tXt
Copyright: 2009-present Alibaba Cloud
License: Apache-2.0
Comment: Apache-2.0 texts carrying Alibaba Cloud's notice, used as fixtures for
 the Go module licence classifier. The paths are made up by upstream; the files
 are real.

Files: test/cli/testdata/attestation/config/dex/docker-compose-config.yaml
 test/cli/testdata/attestation/config/logid.sh
 test/cli/testdata/attestation/docker-compose-config.yaml
Copyright: 2021 The Sigstore Authors
License: Apache-2.0

License: Zlib
   This software is provided 'as-is', without any express or implied
   warranty.  In no event will the authors be held liable for any damages
   arising from the use of this software.
 .
   Permission is granted to anyone to use this software for any purpose,
   including commercial applications, and to alter it and redistribute it
   freely, subject to the following restrictions:
 .
   1. The origin of this software must not be misrepresented; you must not
      claim that you wrote the original software. If you use this software
      in a product, an acknowledgment in the product documentation would be
      appreciated but is not required.
   2. Altered source versions must be plainly marked as such, and must not be
      misrepresented as being the original software.
   3. This notice may not be removed or altered from any source distribution.

License: BSD-2-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions
 are met:
 1. Redistributions of source code must retain the above copyright
    notice, this list of conditions and the following disclaimer.
 2. Redistributions in binary form must reproduce the above copyright
    notice, this list of conditions and the following disclaimer in the
    documentation and/or other materials provided with the distribution.
 .
 THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 SUCH DAMAGE.

License: PSF-2
 1. This LICENSE AGREEMENT is between the Python Software Foundation
 ("PSF"), and the Individual or Organization ("Licensee") accessing and
 otherwise using this software ("Python") in source or binary form and
 its associated documentation.
 .
 2. Subject to the terms and conditions of this License Agreement, PSF
 hereby grants Licensee a nonexclusive, royalty-free, world-wide
 license to reproduce, analyze, test, perform and/or display publicly,
 prepare derivative works, distribute, and otherwise use Python
 alone or in any derivative version, provided, however, that PSF's
 License Agreement and PSF's notice of copyright, i.e., "Copyright (c)
 2001, 2002, 2003, 2004, 2005, 2006, 2007 Python Software Foundation;
 All Rights Reserved" are retained in Python alone or in any derivative
 version prepared by Licensee.
 .
 3. In the event Licensee prepares a derivative work that is based on
 or incorporates Python or any part thereof, and wants to make
 the derivative work available to others as provided herein, then
 Licensee hereby agrees to include in any such work a brief summary of
 the changes made to Python.
 .
 4. PSF is making Python available to Licensee on an "AS IS"
 basis.  PSF MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR
 IMPLIED.  BY WAY OF EXAMPLE, BUT NOT LIMITATION, PSF MAKES NO AND
 DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS
 FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF PYTHON WILL NOT
 INFRINGE ANY THIRD PARTY RIGHTS.
 .
 5. PSF SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF PYTHON
 FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS
 A RESULT OF MODIFYING, DISTRIBUTING, OR OTHERWISE USING PYTHON,
 OR ANY DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF.
 .
 6. This License Agreement will automatically terminate upon a material
 breach of its terms and conditions.
 .
 7. Nothing in this License Agreement shall be deemed to create any
 relationship of agency, partnership, or joint venture between PSF and
 Licensee.  This License Agreement does not grant permission to use PSF
 trademarks or trade name in a trademark sense to endorse or promote
 products or services of Licensee, or any third party.
 .
 8. By copying, installing or otherwise using Python, Licensee
 agrees to be bound by the terms and conditions of this License
 Agreement.

License: BeOpen
 BEOPEN PYTHON OPEN SOURCE LICENSE AGREEMENT VERSION 1
 .
 1. This LICENSE AGREEMENT is between BeOpen.com ("BeOpen"), having an
 office at 160 Saratoga Avenue, Santa Clara, CA 95051, and the
 Individual or Organization ("Licensee") accessing and otherwise using
 this software in source or binary form and its associated
 documentation ("the Software").
 .
 2. Subject to the terms and conditions of this BeOpen Python License
 Agreement, BeOpen hereby grants Licensee a non-exclusive,
 royalty-free, world-wide license to reproduce, analyze, test, perform
 and/or display publicly, prepare derivative works, distribute, and
 otherwise use the Software alone or in any derivative version,
 provided, however, that the BeOpen Python License is retained in the
 Software, alone or in any derivative version prepared by Licensee.
 .
 3. BeOpen is making the Software available to Licensee on an "AS IS"
 basis.  BEOPEN MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR
 IMPLIED.  BY WAY OF EXAMPLE, BUT NOT LIMITATION, BEOPEN MAKES NO AND
 DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS
 FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF THE SOFTWARE WILL NOT
 INFRINGE ANY THIRD PARTY RIGHTS.
 .
 4. BEOPEN SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF THE
 SOFTWARE FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS
 AS A RESULT OF USING, MODIFYING OR DISTRIBUTING THE SOFTWARE, OR ANY
 DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF.
 .
 5. This License Agreement will automatically terminate upon a material
 breach of its terms and conditions.
 .
 6. This License Agreement shall be governed by and interpreted in all
 respects by the law of the State of California, excluding conflict of
 law provisions.  Nothing in this License Agreement shall be deemed to
 create any relationship of agency, partnership, or joint venture
 between BeOpen and Licensee.  This License Agreement does not grant
 permission to use BeOpen trademarks or trade names in a trademark
 sense to endorse or promote products or services of Licensee, or any
 third party.  As an exception, the "BeOpen Python" logos available at
 http://www.pythonlabs.com/logos.html may be used according to the
 permissions granted on that web page.
 .
 7. By copying, installing or otherwise using the software, Licensee
 agrees to be bound by the terms and conditions of this License
 Agreement.

License: CWI
 Copyright (c) 1991 - 1995, Stichting Mathematisch Centrum Amsterdam,
 The Netherlands.  All rights reserved.
 .
 Permission to use, copy, modify, and distribute this software and its
 documentation for any purpose and without fee is hereby granted,
 provided that the above copyright notice appear in all copies and that
 both that copyright notice and this permission notice appear in
 supporting documentation, and that the name of Stichting Mathematisch
 Centrum or CWI not be used in advertising or publicity pertaining to
 distribution of the software without specific, written prior
 permission.
 .
 STICHTING MATHEMATISCH CENTRUM DISCLAIMS ALL WARRANTIES WITH REGARD TO
 THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
 FITNESS, IN NO EVENT SHALL STICHTING MATHEMATISCH CENTRUM BE LIABLE
 FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
 OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

License: GPL-3+
 On Debian systems, the complete text of the GNU General Public License,
 version 3 can be found in "/usr/share/common-licenses/GPL-3".

License: public-domain
 The files declared public domain carry no copyright claim. The liblzma5
 fixture states that liblzma itself is in the public domain, the libsqlite3-0
 fixture that the sqlite3 contributors placed their files there, and the
 multi-license fixture includes the Unlicense dedication for tools/filelock.py.