component-detection/docs/update-syft.md

Updating Syft

For container detection we use Syft. Occasionally, as new versions of Syft are released, we need to update the version we use. To do this:

1. Ensure you're authenticated to Azure and our Azure Container Registry

   az login
   az acr login --name governancecontainerregistry
   

2. Find the latest version of Syft

3. Install Skopeo

4. Use skopeo to copy the manifest and images to our Azure Container Registry:

   skopeo copy --all docker://docker.io/anchore/syft:{LATEST} docker://governancecontainerregistry.azurecr.io/syft:{LATEST}
   

5. Update the container reference in LinuxScanner

6. Update the models that map the Syft output