syft (1.54.1+ds-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1124819)
   * Do not ship upstream's .make build-tooling module.
   * Thanks to Rafael Passos for getting upstream to add a COPYRIGHT file
     (https://github.com/anchore/syft/issues/5394), which settled the
     copyright holder question for this package.

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: syft
Upstream-Contact: Anchore, Inc. <support@anchore.com>
Source: https://github.com/anchore/syft
Files-Excluded:
 internal/licenses/testdata/nvidia-software-and-cuda-supplement
 internal/licenses/testdata/Knuth-CTAN
 syft/pkg/cataloger/debian/testdata/copyright/cuda
 syft/pkg/cataloger/debian/testdata/copyright/dev-kit
 syft/pkg/cataloger/debian/testdata/copyright/microsoft
Comment: Files-Excluded removes non-DFSG license texts that upstream ships as
 test fixtures for its license detection engine. Dependencies are not vendored:
 they are Debian golang-*-dev packages listed in Build-Depends, resolved by
 dh-go through the generated Go workspace.

Files: *
Copyright: 2020-2026 Anchore, Inc.
License: Apache-2.0
Comment:
 Upstream names the holder itself, in a COPYRIGHT file that says
 "Copyright (c) Anchore, Inc.". It was added on 2026-10-12 in
 https://github.com/anchore/syft/commit/c2ea35ef328795647cfaabaf33e2ce74032f6e07,
 after https://github.com/anchore/syft/issues/5394 asked for one, and the
 LICENSE appendix was left as the Apache-2.0 boilerplate,
 "Copyright [yyyy] [name of copyright owner]".
 .
 That file is not in this release: it landed after 1.52.0 was tagged, so the
 tarball here does not contain it and this comment stands in for it. The first
 upstream release after 2026-10-12 ships the file and this comment can go.
 Upstream states no year, so the range above is this repository's history,
 from its first commit in 2020 to the current release.

Files: debian/*
Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Apache-2.0

Files: syft/pkg/cataloger/golang/testdata/xcoff/*
Copyright: 2018 The Go Authors. All rights reserved.
License: BSD-3-clause
Comment: AIX XCOFF executables used as fixtures by the Go binary cataloger
 tests, taken from the Go project's own debug/xcoff testdata. Upstream removed
 the accompanying xcoff reader source in 1.44.0 in favour of the standard
 library; only the fixtures remain.

Files: cmd/syft/internal/test/integration/testdata/npm-lock/node_modules/once/*
 cmd/syft/internal/test/integration/testdata/npm-lock/node_modules/wrappy/*
 cmd/syft/internal/test/integration/testdata/npm-lock/package.json
Copyright: Isaac Z. Schlueter and Contributors
License: ISC

Files: cmd/syft/internal/test/integration/testdata/npm-lock/node_modules/collapse-white-space/*
Copyright: 2015 Titus Wormer <tituswormer@gmail.com>
License: Expat

Files: cmd/syft/internal/test/integration/testdata/npm-lock/node_modules/end-of-stream/*
 cmd/syft/internal/test/integration/testdata/npm-lock/node_modules/pump/*
Copyright: 2014 Mathias Buus
License: Expat

Files: cmd/syft/internal/test/integration/testdata/npm-lock/node_modules/insert-css/*
Copyright: James Halliday <mail@substack.net>
License: Expat

Files: cmd/syft/internal/test/integration/testdata/yarn-lock/node_modules/async/*
 cmd/syft/internal/test/integration/testdata/yarn-lock/packages/nested-package/node_modules/async/*
Copyright: 2010-2018 Caolan McMahon
License: Expat

Files: cmd/syft/internal/test/integration/testdata/yarn-lock/node_modules/merge-objects/*
Copyright: 2015 Oleksii Shevchenko <shevaroller@gmail.com>
License: Expat

Files: cmd/syft/internal/test/integration/testdata/yarn-lock/node_modules/resize-observer-polyfill/*
Copyright: 2016 Denis Rul
License: Expat

Files: cmd/syft/internal/test/integration/testdata/yarn-lock/node_modules/should-type/*
Copyright: 2014 Denis Bardadym <bardadymchik@gmail.com>
License: Expat

Files: cmd/syft/internal/test/integration/testdata/yarn-lock/package.json
 cmd/syft/internal/test/integration/testdata/yarn-lock/packages/nested-package/package.json
Copyright: 2020-2025 Anchore, Inc.
License: Expat

Files: cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/wordpress/wp-content/plugins/akismet/akismet.php
 syft/pkg/cataloger/wordpress/testdata/glob-paths/wp-content/plugins/akismet/akismet.php
Copyright: Automattic
License: GPL-2+

Files: cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/opam/ocaml-base-compiler.4.14.0/opam
 syft/pkg/cataloger/ocaml/testdata/ocaml-base-compiler.4.14.0/opam
Copyright: Institut National de Recherche en Informatique et en Automatique
License: LGPL-2.1

Files: cmd/syft/internal/test/integration/testdata/image-sbom-cataloger/test.spdx.json
 syft/format/internal/testutil/testdata/snapshot/TestSPDXTagValueImageEncoder.golden
 syft/format/spdxjson/testdata/identify/*
 syft/format/spdxjson/testdata/snapshot/*
 syft/format/spdxjson/testdata/spdx/*
 syft/format/spdxtagvalue/testdata/identify/*
 syft/format/spdxtagvalue/testdata/snapshot/*
 syft/format/spdxtagvalue/testdata/tag-value.spdx
 syft/pkg/cataloger/bitnami/testdata/tag-value/opt/bitnami/redis/.spdx-apache.spdx
 syft/pkg/cataloger/bitnami/testdata/json/opt/bitnami/postgresql/.spdx-postgresql.spdx
 syft/pkg/cataloger/bitnami/testdata/mix/opt/bitnami/render-template/.spdx-render-template.spdx
 syft/pkg/cataloger/bitnami/testdata/no-rel/opt/bitnami/redis/.spdx-redis.spdx
Copyright: SPDX contributors
License: CC0-1.0

Files: syft/pkg/cataloger/golang/testdata/licenses-vendor/github.com/!cap!o!r!g/!cap!project/LICENSE.txt
 syft/pkg/cataloger/golang/testdata/licenses/pkg/mod/github.com/!cap!o!r!g/!cap!project@v4.111.5/LICENSE.txt
 syft/pkg/cataloger/internal/licenses/testdata/LICENSE
Comment: Test fixture LICENSE files containing MIT/Expat text,
 created by Anchore for testing the license detection engine.
Copyright: 2020-2025 Anchore, Inc.
License: Expat

Files: syft/pkg/cataloger/javascript/testdata/pkg-lock/node_modules/@actions/core/package.json
Comment: Real package.json from GitHub Actions toolkit.
Copyright: GitHub, Inc.
License: Expat

Files: syft/pkg/cataloger/javascript/testdata/pkg-lock/node_modules/cowsay/package.json
Comment: Real package.json from cowsay npm package.
Copyright: Fabio Crisci <piuccio@gmail.com>
License: Expat

Files: syft/pkg/cataloger/r/testdata/installed/stringr/DESCRIPTION
 syft/pkg/cataloger/r/testdata/DESCRIPTION
Comment: Real R CRAN DESCRIPTION files from the stringr package.
Copyright: Hadley Wickham
 RStudio
License: Expat

Files: cmd/syft/internal/test/integration/testdata/image-pkg-coverage/composer/composer.lock
 syft/pkg/cataloger/php/testdata/vendor/composer_1/installed.json
 syft/pkg/cataloger/php/testdata/vendor/composer_2/installed.json
 syft/pkg/cataloger/php/testdata/composer.lock
 syft/pkg/cataloger/javascript/testdata/pkg-json/package-repo-string.json
 syft/pkg/cataloger/javascript/testdata/pkg-lock/package-lock-2.json
 syft/pkg/cataloger/javascript/testdata/pnpm-remote/registry_response.json
 syft/pkg/cataloger/javascript/testdata/yarn-remote/registry_response.json
 syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithnestedlib/elfsrc/makefile
 syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/elfsrc1/makefile
 syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/elfsrc2/makefile
 syft/pkg/cataloger/r/testdata/map-parse/eof-multiline
 syft/pkg/cataloger/r/testdata/map-parse/multiline
Comment: Anchore-created test fixtures. JSON/lock files contain license
 identifiers as structured data values describing other packages.
 The fixture files themselves are Apache-2.0. licensecheck misreads
 license strings in JSON content as the file's own license.
Copyright: 2020-2025 Anchore, Inc.
License: Apache-2.0

Files: syft/pkg/cataloger/javascript/testdata/pkg-lock/array-license-package-lock.json
 syft/pkg/cataloger/javascript/testdata/pkg-lock/alias-package-lock-2.json
Comment: Anchore-created test fixtures for lockfile parsing. License
 identifiers in JSON content describe test packages, not the file itself.
Copyright: 2020-2025 Anchore, Inc.
License: Apache-2.0

Files: syft/pkg/cataloger/ocaml/testdata/alcotest.opam
Copyright: Thomas Gazagnaire
License: ISC

Files: cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/php/vendor/composer/installed.json
 syft/pkg/cataloger/conda/testdata/conda-meta-python-c-etc/conda-meta/jupyterlab-4.4.3-pyhd8ed1ab_0.json
Comment: Anchore test fixtures. License identifiers in JSON describe
 other packages, not these files.
Copyright: 2020-2025 Anchore, Inc.
License: Apache-2.0

Files: syft/pkg/cataloger/conda/testdata/conda-meta-python-c-etc/conda-meta/zlib-1.2.11-h90dfc92_1014.json
Comment: Conda metadata JSON describing zlib package. The "license" field
 in the JSON refers to the described package, not this file's own license.
Copyright: 2020-2025 Anchore, Inc.
License: Apache-2.0

Files: syft/pkg/cataloger/python/testdata/pypi-remote/registry_response.json
Comment: Cached PyPI registry response describing certifi package (MPL-2.0).
 The JSON data file itself is Apache-2.0.
Copyright: 2020-2025 Anchore, Inc.
License: Apache-2.0

Files: syft/pkg/cataloger/python/testdata/site-packages/license/with-license-file-declared.dist-info/LICENSE.txt
Copyright: 2010 Pallets
License: BSD-3-clause

Files: syft/pkg/cataloger/golang/testdata/repo/LICENSE
Copyright: 2020-2025 Anchore, Inc.
License: BSD-1-Clause

Files: syft/format/testdata/alpine-syft.json
 syft/pkg/cataloger/sbom/testdata/alpine/syft-json/sbom.syft.json
 test/compare/testdata/acceptance-centos-8.2.2004.json
Comment: These are syft SBOM JSON outputs that LIST packages with GPL-2
 license identifiers as data values. The JSON files themselves are
 Apache-2.0 (generated by syft). licensecheck misreads JSON string
 values like "licenses": ["GPL-2.0-only"] as the file's own license.
Copyright: 2020-2025 Anchore, Inc.
License: Apache-2.0

Files: syft/pkg/cataloger/debian/testdata/copyright/libaudit-common
Copyright: 2012-2016 Steve Grubb <sgrubb@redhat.com>
 2007-2011 Philipp Matthias Hahn <pmhahn@debian.org>
License: GPL-2 and LGPL-2.1

Files: syft/pkg/cataloger/debian/testdata/copyright/trilicense
Copyright: 1993 John Doe
 1993 Joe Average
License: GPL-2 and LGPL-2.1 and MPL-1.1

Files: syft/pkg/cataloger/debian/testdata/copyright/libc6
Copyright: 1991-2015 Free Software Foundation, Inc.
License: GPL-2+ and LGPL-2.1+

Files: syft/pkg/cataloger/debian/testdata/copyright/python
Copyright: Python Software Foundation
License: CNRI-Python

Files: syft/pkg/cataloger/python/testdata/site-packages/license/without-license-file-declared.dist-info/LICENSE.txt
 syft/pkg/cataloger/python/testdata/site-packages/nested/dist-name/dist-info/LICENSE.txt
Copyright: 2010 Pallets
License: BSD-3-clause

Files: internal/licenses/testdata/multi-license
Copyright: Emscripten contributors
 Joyent, Inc. and Node contributors
 Sam Lantinga
 Mihai Bazon
 WebGPU native developers
 David Schultz
License: Expat and Apache-2.0 and NCSA

Files: syft/pkg/apk_test.go
Comment: This test file contains GPL-2 license identifiers as string
 constants for testing APK package metadata parsing.
Copyright: 2020-2025 Anchore, Inc.
License: Apache-2.0

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
     https://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache License, Version 2.0
 can be found in "/usr/share/common-licenses/Apache-2.0".

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
 1. Redistributions of source code must retain the above copyright notice,
    this list of conditions and the following disclaimer.
 .
 2. Redistributions in binary form must reproduce the above copyright notice,
    this list of conditions and the following disclaimer in the documentation
    and/or other materials provided with the distribution.
 .
 3. Neither the name of the copyright holder nor the names of its contributors
    may be used to endorse or promote products derived from this software
    without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
 LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 POSSIBILITY OF SUCH DAMAGE.

License: ISC
 Permission to use, copy, modify, and/or distribute this software for any
 purpose with or without fee is hereby granted, provided that the above
 copyright notice and this permission notice appear in all copies.
 .
 THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

License: CC0-1.0
 The person who associated a work with this deed has dedicated the work to
 the public domain by waiving all of his or her rights to the work worldwide
 under copyright law, including all related and neighboring rights, to the
 extent allowed by law.
 .
 You can copy, modify, distribute and perform the work, even for commercial
 purposes, all without asking permission.
 .
 On Debian systems, the complete text of the CC0 1.0 Universal license can
 be found in "/usr/share/common-licenses/CC0-1.0".

License: LGPL-2.1+
 On Debian systems, the complete text of the GNU Lesser General Public
 License, version 2.1 can be found in "/usr/share/common-licenses/LGPL-2.1".

License: GPL-2
 On Debian systems, the complete text of the GNU General Public License,
 version 2 can be found in "/usr/share/common-licenses/GPL-2".

License: GPL-2+
 On Debian systems, the complete text of the GNU General Public License,
 version 2 can be found in "/usr/share/common-licenses/GPL-2".

License: MPL-1.1
 On Debian systems, the complete text of the Mozilla Public License,
 version 1.1 can be found at "/usr/share/common-licenses/MPL-1.1".

License: LGPL-2.1
 On Debian systems, the complete text of the GNU Lesser General Public
 License, version 2.1 can be found in "/usr/share/common-licenses/LGPL-2.1".

License: BSD-1-Clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
 1. Redistributions of source code must retain the above copyright notice,
    this list of conditions and the following disclaimer.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 ARE DISCLAIMED.

License: NCSA
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 with the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 Redistributions of source code must retain the above copyright notice, this
 list of conditions and the following disclaimers.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.

License: CNRI-Python
 CNRI hereby grants permission to use, copy, modify, and distribute the
 software for any purpose without fee, provided that the above copyright
 notice appear in all copies and that both that copyright notice and this
 permission notice appear in supporting documentation.