fix: preserve POSIX info paths for dpkg packages when running on Windows - #5296

Description

Syft produces different SBOM results when run on Windows and Linux for the same Linux container image. Duplicate packages exist due to file ownership detection failing. This causes Windows scans to report additional CVEs and fail VEX/backport type supression/fixes.

For the pinned Debian image below, unpatched Windows Syft retains pkg:generic/bash@5.2.37 alongside the Debian bash package. Linux Syft reports only the Debian package.

Cause and fix

In syft/pkg/cataloger/debian/package.go, fetchMd5Contents and fetchConffileContents use filepath.Dir on image-internal paths such as /var/lib/dpkg/status. On Windows, this produces a directory containing backslashes. Passing that directory through path.Join leaves backslashes in the lookup path, so the image resolver cannot find the corresponding DPKG metadata files (since the Linux paths use forward slashes).

The fix is to replace both calls with path.Dir.

- searchPath := filepath.Dir(dbLocation.RealPath)
+ searchPath := path.Dir(dbLocation.RealPath)

- parentPath := filepath.Dir(dbLocation.RealPath)
+ parentPath := path.Dir(dbLocation.RealPath)

This keeps image paths slash-separated on Windows and aligns these lookups with findDpkgInfoFiles, which already uses path.Dir.

There are no new, changed, or removed CLI flags or configuration options.

Reproduce with Syft on Windows

Run native Windows Syft v1.51.1 in PowerShell with the default configuration (WSL and the Syft container do not reproduce this bug).

1. Scan the pinned Debian 13.1 slim image directly from the registry:

syft version
syft scan registry:docker.io/library/debian@sha256:a347fd7510ee31a84387619a492ad6c8eb0af2f2682b916ff3e643eb076f925a `
    --platform linux/amd64 `
    --output syft-table --output syft-json=windows-before.syft.json --quiet

The command prints the package table and saves the full SBOM.
Look for two bash rows near the top:

NAME  VERSION       TYPE
...
bash  5.2.37        binary
bash  5.2.37-2+b5   deb

2. Put the patched native Windows syft.exe on PATH, then run:

syft version
syft scan registry:docker.io/library/debian@sha256:a347fd7510ee31a84387619a492ad6c8eb0af2f2682b916ff3e643eb076f925a `
    --platform linux/amd64 `
    --output syft-table --output syft-json=windows-after.syft.json --quiet

Only the Debian package should remain:

NAME  VERSION       TYPE
...
bash  5.2.37-2+b5   deb

3. For comparison, the same scan with Linux Syft v1.51.1 gives the single Debian row:

syft version
syft scan registry:docker.io/library/debian@sha256:a347fd7510ee31a84387619a492ad6c8eb0af2f2682b916ff3e643eb076f925a \
    --platform linux/amd64 \
    --output syft-table --output syft-json=linux.syft.json --quiet

The saved JSON reports also show the ownership change. The Debian bash artifact's metadata.files lacks /usr/bin/bash before the fix and includes it afterward.

Validation

Compared Syft v1.51.1 on Windows and Linux with patched commit 8e117383e9e5140fe9d566848625535675291e48 on Windows.
The patched build used Windows 10.0.22631, Go 1.27.0, and CGO_ENABLED=0 on amd64 and passess all tests.

Using the pinned registry:docker.io/library/debian@sha256:a347fd7510ee31a84387619a492ad6c8eb0af2f2682b916ff3e643eb076f925a DHI image above:

The regression test passed on Windows with the patch (both standard and distroless cases) and fail when unpatched.

go test ./syft/pkg/cataloger/debian `
    -run '^Test_getAdditionalFileListing_usesPosixImagePaths$' -count=1 -v

Type of change

• Bug fix (non-breaking change which fixes an issue)

Checklist

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections

Issue references

Related to anchore/syft#4563. I believe this addresses (at least some of) the difference between Windows/Mac/Linux outputs.

AI Notice

This document includes content generated with the assistance of Codex. All AI-generated content has been reviewed and edited by Daniel Prohaska (dprohaska@mitre.org) to ensure accuracy and compliance with MITRE's generative AI use guidelines.

Copyright

   Copyright 2026 MITRE

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.