Conda ecosystem support (basic)

[SimeonStoykovQC]

Description

This PR introduces basic support for sbom generation of packages in conda environments.

Status Quo

Up until now, syft had limited capabilities in conda environments and relied on language-agnostic catalogers (e.g. python and go). This meant that it wouldn't detect packages such as zlib, even though the metadata needed is already accessible.

Scope

The scope of this PR is to provide a minimum-effort conda support with the metadata that is already available, until the syft/grype and conda ecosystems decide on a more comprehensive approach (see anchore#932 and conda/ceps#63).

The known shortcomings of this implementation are:

• PURLs are not included at all, since we cannot generate meaningful ones yet;
• The CPEs are best-effort, as we derive them from the conda package name, which could be arbitrary even in the case of repackaging (for example, the helm package in conda is named kubernetes-helm, which won't match any existing helm CVEs);
• Any statically linked transitive dependencies are not detected.

Partially addresses anchore#932

Implementation

Each installed package in a conda environment produces a JSON metadata file inside the conda-meta directory. It provides a name and a version, among other things, and we use that to construct a package list.

This basic implementation already enriches the vulnerability reports from grype (see comment below).

Type of change

• New feature (non-breaking change which adds functionality)

Checklist:

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections

[SimeonStoykovQC]

Running the modified syft and then grype (on the sboms), with the following pixi.toml:

[dependencies]
zlib = "1.2.11.*"
terraform = ">=1.12.2,<2"
pixi = ">=0.48.1,<0.49"
python = ">=3.10.4,<3.11"
numpy = ">=2.2.6,<3"
jupyterlab = ">=4.4.3,<5"
grype = ">=0.93.0,<0.94"
syft = ">=1.27.0,<2"

Gives us zlib vulnerabilities

NAME                         INSTALLED  FIXED-IN                                      TYPE       VULNERABILITY        SEVERITY  EPSS%  RISK  
zlib                         1.2.11                                                   conda      CVE-2022-37434       Critical  99.74   87.1  
python                       3.10.4     3.6.16, 3.8.17, 3.9.17, *3.10.12, ...         binary     CVE-2007-4559        Medium    99.77   61.9  
python                       3.10.4     3.6.16, 3.8.17, 3.9.17, *3.10.12, ...         conda      CVE-2007-4559        Medium    99.77   61.9  
sqlite                       3.38.5     3.39.2                                        conda      CVE-2022-35737       High      98.37   49.2  
python                       3.10.4     3.7.16, 3.8.16, 3.9.16, *3.10.9               binary     CVE-2022-37454       Critical  77.93    1.1  
python                       3.10.4     3.7.16, 3.8.16, 3.9.16, *3.10.9               conda      CVE-2022-37454       Critical  77.93    1.1  
python                       3.10.4     3.10.8                                        binary     CVE-2015-20107       High      78.06    0.9  
python                       3.10.4     3.10.8                                        conda      CVE-2015-20107       High      78.06    0.9  
python                       3.10.4     3.7.17, 3.8.17, 3.9.17, *3.10.12, ...         binary     CVE-2023-24329       High      76.48    0.8  
python                       3.10.4     3.7.17, 3.8.17, 3.9.17, *3.10.12, ...         conda      CVE-2023-24329       High      76.48    0.8  
python                       3.10.4     3.8.20, 3.9.20, *3.10.15, 3.11.10, ...        binary     CVE-2024-6232        High      73.48    0.6  
python                       3.10.4     3.8.20, 3.9.20, *3.10.15, 3.11.10, ...        conda      CVE-2024-6232        High      73.48    0.6  
python                       3.10.4     3.9.22, *3.10.17, 3.11.12, 3.12.9, ...        binary     CVE-2025-0938        Medium    76.35    0.6  
python                       3.10.4     3.9.22, *3.10.17, 3.11.12, 3.12.9, ...        conda      CVE-2025-0938        Medium    76.35    0.6  
sanitize-html                2.7.3      2.12.1                                        npm        GHSA-rm97-x556-q36h  Medium    75.79    0.5  
python                       3.10.4     3.8.20, 3.9.20, *3.10.15, 3.11.10, ...        binary     CVE-2024-4032        High      65.97    0.4  
python                       3.10.4     3.8.20, 3.9.20, *3.10.15, 3.11.10, ...        conda      CVE-2024-4032        High      65.97    0.4  
zlib                         1.2.11     1.3.1                                         conda      CVE-2023-45853       Critical  58.73    0.3  
python                       3.10.4     3.7.14, 3.8.14, 3.9.14, *3.10.6               binary     CVE-2021-28861       High      63.41    0.3  
python                       3.10.4     3.7.14, 3.8.14, 3.9.14, *3.10.6               conda      CVE-2021-28861       High      63.41    0.3  
ip                           2.0.1                                                    npm        GHSA-2p57-rm9w-gvfp  High      62.09    0.3  
python                       3.10.4     3.8.20, 3.9.20, *3.10.14, 3.11.9, ...         binary     CVE-2024-0397        High      59.40    0.3  
python                       3.10.4     3.8.20, 3.9.20, *3.10.14, 3.11.9, ...         conda      CVE-2024-0397        High      59.40    0.3  
ws                           8.16.0     8.17.1                                        npm        GHSA-3h5v-q93c-6h6q  High      54.43    0.2  
python                       3.10.4     3.7.14, 3.8.14, 3.9.14, *3.10.7               binary     CVE-2020-10735       High      54.05    0.2  
python                       3.10.4     3.7.14, 3.8.14, 3.9.14, *3.10.7               conda      CVE-2020-10735       High      54.05    0.2  
python                       3.10.4     3.8.20, 3.9.20, *3.10.15, 3.11.10, ...        binary     CVE-2024-7592        High      50.79    0.2  
python                       3.10.4     3.8.20, 3.9.20, *3.10.15, 3.11.10, ...        conda      CVE-2024-7592        High      50.79    0.2  
micromatch                   4.0.5      4.0.8                                         npm        GHSA-952p-6rrq-rcjv  Medium    57.83    0.2  
python                       3.10.4     3.8.18, 3.9.18, *3.10.13, 3.11.5              binary     CVE-2023-40217       Medium    51.50    0.1  
python                       3.10.4     3.8.18, 3.9.18, *3.10.13, 3.11.5              conda      CVE-2023-40217       Medium    51.50    0.1  
tar                          6.1.11     6.2.1                                         npm        GHSA-f5x3-32g6-xq36  Medium    43.13    0.1  
cross-spawn                  7.0.3      7.0.5                                         npm        GHSA-3xgq-45jj-v275  High      36.87    0.1  
python                       3.10.4     3.8.19, 3.9.19, *3.10.14, 3.11.8, ...         binary     CVE-2024-0450        Medium    39.46  < 0.1  
python                       3.10.4     3.8.19, 3.9.19, *3.10.14, 3.11.8, ...         conda      CVE-2024-0450        Medium    39.46  < 0.1  
python                       3.10.4     3.9.23, *3.10.18, 3.11.13, 3.12.11, ...       binary     CVE-2025-4138        High      31.99  < 0.1  
python                       3.10.4     3.9.23, *3.10.18, 3.11.13, 3.12.11, ...       conda      CVE-2025-4138        High      31.99  < 0.1  
python                       3.10.4     3.9.21, *3.10.16, 3.11.4, 3.12.0b1            binary     CVE-2024-11168       Medium    39.90  < 0.1  
python                       3.10.4     3.9.21, *3.10.16, 3.11.4, 3.12.0b1            conda      CVE-2024-11168       Medium    39.90  < 0.1  
python                       3.10.4     3.9.23, *3.10.18, 3.11.13, 3.12.11, ...       binary     CVE-2025-4517        Critical  27.75  < 0.1  
python                       3.10.4     3.9.23, *3.10.18, 3.11.13, 3.12.11, ...       conda      CVE-2025-4517        Critical  27.75  < 0.1  
sqlite                       3.38.5                                                   conda      CVE-2023-7104        High      30.37  < 0.1  
sqlite                       3.38.5     3.40.1                                        conda      CVE-2022-46908       High      26.52  < 0.1  
python                       3.10.4     3.8.20, 3.9.20, *3.10.15, 3.11.10, ...        binary     CVE-2024-8088        High      24.01  < 0.1  
python                       3.10.4     3.8.20, 3.9.20, *3.10.15, 3.11.10, ...        conda      CVE-2024-8088        High      24.01  < 0.1  
python                       3.10.4     3.7.14, 3.8.14, 3.9.13, *3.10.5               binary     CVE-2018-25032       High      26.23  < 0.1  
python                       3.10.4     3.7.14, 3.8.14, 3.9.13, *3.10.5               conda      CVE-2018-25032       High      26.23  < 0.1  
zlib                         1.2.11     1.2.12                                        conda      CVE-2018-25032       High      26.23  < 0.1  
python                       3.10.4     3.7.16, 3.8.16, 3.9.16, *3.10.9, 3.11.1, ...  binary     CVE-2022-45061       High      24.59  < 0.1  
python                       3.10.4     3.7.16, 3.8.16, 3.9.16, *3.10.9, 3.11.1, ...  conda      CVE-2022-45061       High      24.59  < 0.1  
python                       3.10.4                                                   binary     CVE-2023-36632       High      24.44  < 0.1  
python                       3.10.4                                                   conda      CVE-2023-36632       High      24.44  < 0.1  
python                       3.10.4     3.8.20, 3.9.20, *3.10.15, 3.11.10, ...        binary     CVE-2023-27043       Medium    31.25  < 0.1  
python                       3.10.4     3.8.20, 3.9.20, *3.10.15, 3.11.10, ...        conda      CVE-2023-27043       Medium    31.25  < 0.1  
python                       3.10.4     3.9.23, *3.10.18, 3.11.13, 3.12.11, ...       binary     CVE-2025-4330        High      24.25  < 0.1  
python                       3.10.4     3.9.23, *3.10.18, 3.11.13, 3.12.11, ...       conda      CVE-2025-4330        High      24.25  < 0.1  
python                       3.10.4     3.8.19, 3.9.19, *3.10.14, 3.11.8, ...         binary     CVE-2023-6597        High      23.07  < 0.1  
python                       3.10.4     3.8.19, 3.9.19, *3.10.14, 3.11.8, ...         conda      CVE-2023-6597        High      23.07  < 0.1  
sqlite                       3.38.5     3.49.1                                        conda      CVE-2025-3277        Medium    25.97  < 0.1  
python                       3.10.4     3.8.20, 3.9.20, *3.10.15, 3.11.10, ...        binary     CVE-2024-6923        Medium    26.63  < 0.1  
python                       3.10.4     3.8.20, 3.9.20, *3.10.15, 3.11.10, ...        conda      CVE-2024-6923        Medium    26.63  < 0.1  
python                       3.10.4     *3.11.9, 3.12.3, 3.13.0a5                     binary     CVE-2025-1795        Low       38.79  < 0.1  
python                       3.10.4     *3.11.9, 3.12.3, 3.13.0a5                     conda      CVE-2025-1795        Low       38.79  < 0.1  
python                       3.10.4     3.9.23, *3.10.18, 3.11.13, 3.12.11, ...       binary     CVE-2025-4435        High      18.63  < 0.1  
python                       3.10.4     3.9.23, *3.10.18, 3.11.13, 3.12.11, ...       conda      CVE-2025-4435        High      18.63  < 0.1  
python                       3.10.4     3.9.23, *3.10.18, 3.11.13, 3.12.11, ...       binary     CVE-2024-12718       Medium    19.91  < 0.1  
python                       3.10.4     3.9.23, *3.10.18, 3.11.13, 3.12.11, ...       conda      CVE-2024-12718       Medium    19.91  < 0.1  
path-to-regexp               0.1.10     0.1.12                                        npm        GHSA-rhx6-c78j-4q9w  High      11.89  < 0.1  
python                       3.10.4     3.8.20, 3.9.20, *3.10.15, 3.11.10, ...        binary     CVE-2024-3219        Medium    18.70  < 0.1  
python                       3.10.4     3.8.20, 3.9.20, *3.10.15, 3.11.10, ...        conda      CVE-2024-3219        Medium    18.70  < 0.1  
sqlite                       3.38.5     3.49.1                                        conda      CVE-2025-29087       High      12.60  < 0.1  
python                       3.10.4     3.9.21, *3.10.16, 3.11.11, 3.12.8, ...        binary     CVE-2024-9287        High      10.57  < 0.1  
python                       3.10.4     3.9.21, *3.10.16, 3.11.11, 3.12.8, ...        conda      CVE-2024-9287        High      10.57  < 0.1  
python                       3.10.4     3.14.0                                        binary     CVE-2024-3220        Low       26.48  < 0.1  
python                       3.10.4     3.14.0                                        conda      CVE-2024-3220        Low       26.48  < 0.1  
serialize-javascript         6.0.1      6.0.2                                         npm        GHSA-76p7-773f-r4q5  Medium    12.04  < 0.1  
python                       3.10.4     3.9.21, *3.10.16, 3.11.11, 3.12.8, ...        binary     CVE-2024-50602       Medium    10.05  < 0.1  
python                       3.10.4     3.9.21, *3.10.16, 3.11.11, 3.12.8, ...        conda      CVE-2024-50602       Medium    10.05  < 0.1  
python                       3.10.4     3.9.16, *3.10.9                               binary     CVE-2022-42919       High       4.24  < 0.1  
python                       3.10.4     3.9.16, *3.10.9                               conda      CVE-2022-42919       High       4.24  < 0.1  
openssl                      3.5.0      3.5.1                                         binary     CVE-2025-4575        Medium     5.73  < 0.1  
openssl                      3.5.0      3.5.1                                         conda      CVE-2025-4575        Medium     5.73  < 0.1  
cookie                       0.6.0      0.7.0                                         npm        GHSA-pxg6-pf52-xh8x  Low       12.64  < 0.1  
brace-expansion              2.0.1                                                    npm        GHSA-v6h2-p8h4-qcjw  Low       11.10  < 0.1  
python                       3.10.4     3.14.0b1                                      binary     CVE-2025-4516        Medium     3.16  < 0.1  
python                       3.10.4     3.14.0b1                                      conda      CVE-2025-4516        Medium     3.16  < 0.1  
python                       3.10.4     3.8.20, 3.9.20, *3.10.15, 3.11.10, ...        binary     CVE-2024-4030        High       1.46  < 0.1  
python                       3.10.4     3.8.20, 3.9.20, *3.10.15, 3.11.10, ...        conda      CVE-2024-4030        High       1.46  < 0.1  
github.com/cloudflare/circl  v1.4.0     1.6.1                                         go-module  GHSA-2x5j-vhc8-9cwm  Low         N/A    N/A

The diff with the old grype output is all conda packages: