feat: add go symbol matching qualifier for better go vuln matching

govulndb's per-symbol reachability information
used as a go-imports package qualifier

called at match time to reduce false positives for Go binaries.

When a Go binary is cataloged with symbol capture enabled, the qualifier
only matches a vulnerability if at least one of the vulnerable symbols is
actually present in the binary. Packages without symbol evidence continue
to match at module granularity, preserving existing behavior.

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

Author: spiffcs

go.mod

@@ -18,7 +18,7 @@ require (
 	github.com/anchore/go-version v1.2.2-0.20210903204242-51efa5b487c4
 	github.com/anchore/packageurl-go v0.2.0
 	github.com/anchore/stereoscope v0.2.2
-	github.com/anchore/syft v1.46.0
+	github.com/anchore/syft v1.46.1-0.20260701033749-a1831ce3b499
 	github.com/aquasecurity/go-pep440-version v0.0.1
 	github.com/araddon/dateparse v0.0.0-20210429162001-6b43995a97de
 	github.com/bitnami/go-version v0.0.0-20250505154626-452e8c5ee607
@@ -339,6 +339,7 @@ require (
 	google.golang.org/grpc v1.80.0 // indirect
 	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
+	howett.net/plist v1.0.1 // indirect
 	modernc.org/libc v1.72.3 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect

go.sum

@@ -154,8 +154,8 @@ github.com/anchore/packageurl-go v0.2.0 h1:CkrM4RMUwrEGAiE1OVlxaZNzWj0TuHRey7o4T
 github.com/anchore/packageurl-go v0.2.0/go.mod h1:2JCgOQMIsqZ7TmliXG4PnUthPJAKE3mWQbsW2XHjAOE=
 github.com/anchore/stereoscope v0.2.2 h1:SGTLGoF6GHmKEn9Bb6LYpzzgz9nhvMZgN/c4fTSQjYY=
 github.com/anchore/stereoscope v0.2.2/go.mod h1:ylJXJKebLctP7u9ewguB1d0zUETJxvAA7r2DiuljDTM=
-github.com/anchore/syft v1.46.0 h1:qIXMOJMlznWsWgzOT6xzK8aDhpOG7wnkbA0BS2UKF0c=
-github.com/anchore/syft v1.46.0/go.mod h1:LwBimjMV20nC1zAsN5jzpGTg/6f0X4Acvvx1WymA53g=
+github.com/anchore/syft v1.46.1-0.20260701033749-a1831ce3b499 h1:gxKUd0qvSHyHe9/nW8oaG78tFwF7kHStmcQwYf99Kkc=
+github.com/anchore/syft v1.46.1-0.20260701033749-a1831ce3b499/go.mod h1:D2EesMQiokuYW5w5y7tVM4pNYGsaYxqNIImffSSgGnY=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ=
 github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
@@ -651,6 +651,7 @@ github.com/invopop/jsonschema v0.14.0 h1:MHQqLhvpNUZfw+hM3AZDYK7jxO8FZoQeQM77g8i
 github.com/invopop/jsonschema v0.14.0/go.mod h1:ygm6C2EaVNMBDPpaPlnOA2pFAxBnxGjFlMZABxm9n2I=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
+github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
 github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8=
 github.com/jinzhu/copier v0.4.0/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg=
 github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
@@ -1558,6 +1559,7 @@ gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/ini.v1 v1.66.2/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
 gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
+gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0/go.mod h1:WDnlLJ4WF5VGsH/HVa3CI79GS0ol3YnhVnKP89i0kNg=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
@@ -1580,6 +1582,8 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
+howett.net/plist v1.0.1 h1:37GdZ8tP09Q35o9ych3ehygcsL+HqKSwzctveSlarvM=
+howett.net/plist v1.0.1/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
 modernc.org/cc/v4 v4.28.2 h1:3tQ0lf2ADtoby2EtSP+J7IE2SHwEJdP8ioR59wx7XpY=
 modernc.org/cc/v4 v4.28.2/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
 modernc.org/ccgo/v4 v4.34.0 h1:yRLPFZieg532OT4rp4JFNIVcquwalMX26G95WQDqwCQ=

grype/db/v6/blobs.go

@@ -159,6 +159,21 @@ type PackageQualifiers struct {
 	// RootIO indicates that the vulnerability applies only to Root IO packages (packages with Root IO fixes).
 	// When true, standard packages will not match this vulnerability (NAK pattern).
 	RootIO *bool `json:"rootio,omitempty"`
+
+	// GoImports lists the packages and symbols within an affected Go module that contain the vulnerability
+	// (from govulndb's ecosystem_specific.imports). When set, packages carrying binary symbol evidence only
+	// match if at least one of the listed symbols is present in the binary.
+	GoImports []GoImport `json:"go_imports,omitempty"`
+}
+
+// GoImport describes a single package within an affected Go module and the vulnerable symbols it contains.
+type GoImport struct {
+	// Path is the import path of the package within the affected module (e.g. "golang.org/x/net/html").
+	Path string `json:"path"`
+
+	// Symbols lists the vulnerable function/method names within the package (e.g. "Parse" or "Decoder.Decode").
+	// An empty list means the entire package is considered vulnerable.
+	Symbols []string `json:"symbols,omitempty"`
 }
 
 // Range defines a specific range of package versions pertaining to a vulnerability.

grype/db/v6/build/transformers/osv/transform_go_vuln_db.go

@@ -1,6 +1,7 @@
 package osv
 
 import (
+	"encoding/json"
 	"fmt"
 	"sort"
 	"strings"
@@ -20,16 +21,16 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 )
 
-// govulndbStrategy handles GO-* records from the Go vulnerability database
 // (vuln.go.dev): affected version ranges for Go modules, plus the "stdlib" and
 // "toolchain" pseudo-modules. Govulndb specifics:
 //   - aliases hold CVEs/GHSAs directly; the schema has no `related` field.
 //   - ecosystem is always "Go" → syft go-module type, found by the matcher's
 //     ecosystem-name search.
 //   - range type is always SEMVER → "go" format, which parses pseudo-versions
 //     (v0.0.0-<timestamp>-<commit>).
-//   - ecosystem_specific.imports (per-symbol reachability) is dropped; grype
-//     matches at module granularity.
+//   - ecosystem_specific.imports (per-symbol reachability) is carried into the
+//     package blob as a go-imports qualifier, so packages cataloged with binary
+//     symbol evidence only match when at least one vulnerable symbol is present.
 //   - references pass through, OSV type as tag, refID empty (canonical advisory
 //     page is in database_specific.url, not refs).
 type govulndbStrategy struct{}
@@ -124,11 +125,16 @@ func govulndbAffectedPackages(vuln unmarshal.OSVVulnerability) []db.AffectedPack
 		if !govulndbEmits(affected.Package.Name) {
 			continue
 		}
+		var qualifiers *db.PackageQualifiers
+		if imports := govulndbImports(affected); len(imports) > 0 {
+			qualifiers = &db.PackageQualifiers{GoImports: imports}
+		}
 		aphs = append(aphs, db.AffectedPackageHandle{
 			Package: govulndbPackage(affected.Package),
 			BlobValue: &db.PackageBlob{
-				CVEs:   vuln.Aliases,
-				Ranges: govulndbRanges(affected.Ranges, govulndbCustomRanges(affected, vuln.ID)),
+				CVEs:       vuln.Aliases,
+				Qualifiers: qualifiers,
+				Ranges:     govulndbRanges(affected.Ranges, govulndbCustomRanges(affected, vuln.ID)),
 			},
 		})
 	}
@@ -312,6 +318,27 @@ func govulndbCustomRanges(affected osvmodel.Affected, id string) []osvmodel.Rang
 	return ranges
 }
 
+// govulndbImports extracts the affected package import paths and vulnerable symbols from the
+// OSV `ecosystem_specific.imports` field (see https://go.dev/security/vuln/database#schema).
+func govulndbImports(affected osvmodel.Affected) []db.GoImport {
+	raw, ok := affected.EcosystemSpecific["imports"]
+	if !ok {
+		return nil
+	}
+
+	// the ecosystem_specific field is unmarshalled as a generic map, so round-trip through JSON
+	// to get the typed shape
+	encoded, err := json.Marshal(raw)
+	if err != nil {
+		return nil
+	}
+	var imports []db.GoImport
+	if err := json.Unmarshal(encoded, &imports); err != nil {
+		return nil
+	}
+	return imports
+}
+
 func govulndbPackage(p osvmodel.Package) *db.Package {
 	return &db.Package{
 		Ecosystem: string(pkg.GoModulePkg),

grype/db/v6/build/transformers/osv/transform_go_vuln_db_test.go

@@ -59,6 +59,12 @@ func TestGoVulnDBTransform(t *testing.T) {
 						},
 						BlobValue: &db.PackageBlob{
 							CVEs: []string{"CVE-2022-27664", "GHSA-69cg-p879-7622"},
+							Qualifiers: &db.PackageQualifiers{
+								GoImports: []db.GoImport{{
+									Path:    "golang.org/x/net/http2",
+									Symbols: []string{"Server.ServeConn", "serverConn.goAway"},
+								}},
+							},
 							Ranges: []db.Range{{
 								Version: db.Version{
 									Type:       "go",
@@ -78,6 +84,16 @@ func TestGoVulnDBTransform(t *testing.T) {
 						},
 						BlobValue: &db.PackageBlob{
 							CVEs: []string{"CVE-2022-27664", "GHSA-69cg-p879-7622"},
+							Qualifiers: &db.PackageQualifiers{
+								GoImports: []db.GoImport{{
+									Path: "net/http",
+									Symbols: []string{
+										"ListenAndServe", "ListenAndServeTLS", "Serve", "ServeTLS",
+										"Server.ListenAndServe", "Server.ListenAndServeTLS", "Server.Serve", "Server.ServeTLS",
+										"http2Server.ServeConn", "http2serverConn.goAway",
+									},
+								}},
+							},
 							Ranges: []db.Range{{
 								Version: db.Version{
 									Type:       "go",

grype/db/v6/vulnerability.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/anchore/grype/grype/pkg/qualifier"
 	"github.com/anchore/grype/grype/pkg/qualifier/architecture"
+	"github.com/anchore/grype/grype/pkg/qualifier/gosymbols"
 	"github.com/anchore/grype/grype/pkg/qualifier/platformcpe"
 	"github.com/anchore/grype/grype/pkg/qualifier/rootio"
 	"github.com/anchore/grype/grype/pkg/qualifier/rpmmodularity"
@@ -317,6 +318,13 @@ func toPackageQualifiers(qualifiers *PackageQualifiers) []qualifier.Qualifier {
 	if qualifiers.RootIO != nil && *qualifiers.RootIO {
 		out = append(out, rootio.New())
 	}
+	if len(qualifiers.GoImports) > 0 {
+		var imports []gosymbols.Import
+		for _, i := range qualifiers.GoImports {
+			imports = append(imports, gosymbols.Import{Path: i.Path, Symbols: i.Symbols})
+		}
+		out = append(out, gosymbols.New(imports))
+	}
 	return out
 }
 

grype/pkg/golang_metadata.go

@@ -9,6 +9,7 @@ type GolangBinMetadata struct {
 	H1Digest          string        `json:"h1Digest,omitempty" cyclonedx:"h1Digest"`
 	MainModule        string        `json:"mainModule,omitempty" cyclonedx:"mainModule"`
 	GoCryptoSettings  []string      `json:"goCryptoSettings,omitempty" cyclonedx:"goCryptoSettings"`
+	Symbols           []string      `json:"symbols,omitempty"`
 }
 
 type GolangModMetadata struct {

grype/pkg/package.go

@@ -408,6 +408,7 @@ func golangMetadataFromPkg(p syftPkg.Package) any {
 		metadata.Architecture = value.Architecture
 		metadata.H1Digest = value.H1Digest
 		metadata.MainModule = value.MainModule
+		metadata.Symbols = value.Symbols
 		return metadata
 	case syftPkg.GolangModuleEntry:
 		metadata := GolangModMetadata{}

grype/pkg/package_test.go

@@ -977,6 +977,16 @@ func TestNew(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "apple-app-bundle",
+			syftPkg: syftPkg.Package{
+				Metadata: syftPkg.AppleAppBundleEntry{
+					BundleIdentifier: "com.apple.Safari",
+					Name:             "Safari",
+					ShortVersion:     "17.0",
+				},
+			},
+		},
 	}
 
 	// capture each observed metadata type, we should see all of them relate to what syft provides by the end of testing

grype/pkg/qualifier/gosymbols/qualifier.go

@@ -0,0 +1,84 @@
+package gosymbols
+
+import (
+	"regexp"
+	"strings"
+
+	"github.com/anchore/grype/grype/pkg"
+	"github.com/anchore/grype/grype/pkg/qualifier"
+)
+
+// Import describes a single package within an affected Go module along with the vulnerable
+// symbols it contains (mirroring govulndb's `ecosystem_specific.imports` entries).
+type Import struct {
+	// Path is the import path of the package within the affected module (e.g. "golang.org/x/net/html").
+	Path string
+
+	// Symbols lists the vulnerable function/method names within the package (e.g. "Parse" or
+	// "Decoder.Decode"). An empty list means the entire package is considered vulnerable.
+	Symbols []string
+}
+
+type gosymbolsQualifier struct {
+	imports []Import
+}
+
+func New(imports []Import) qualifier.Qualifier {
+	return &gosymbolsQualifier{imports: imports}
+}
+
+// Satisfied reports whether the package plausibly uses any of the vulnerable symbols. The check
+// only applies when the scanned package carries binary symbol evidence (go binaries cataloged with
+// symbol capture enabled); packages without symbol evidence always satisfy the qualifier so that
+// module-granularity matching behavior is preserved.
+func (q gosymbolsQualifier) Satisfied(p pkg.Package) (bool, error) {
+	if len(q.imports) == 0 {
+		return true, nil
+	}
+
+	m, ok := p.Metadata.(pkg.GolangBinMetadata)
+	if !ok || len(m.Symbols) == 0 {
+		return true, nil
+	}
+
+	present := make(map[string]struct{}, len(m.Symbols))
+	for _, sym := range m.Symbols {
+		present[normalizeSymbol(sym)] = struct{}{}
+	}
+
+	for _, imp := range q.imports {
+		if len(imp.Symbols) == 0 {
+			// the entire package is vulnerable: any symbol from the package counts
+			prefix := imp.Path + "."
+			for sym := range present {
+				if strings.HasPrefix(sym, prefix) {
+					return true, nil
+				}
+			}
+			continue
+		}
+		for _, vulnSym := range imp.Symbols {
+			if _, found := present[imp.Path+"."+vulnSym]; found {
+				return true, nil
+			}
+		}
+	}
+
+	return false, nil
+}
+
+var typeParamPattern = regexp.MustCompile(`\[[^]]*]`)
+
+// normalizeSymbol converts a symbol name as found in a binary symbol table into govulndb's symbol
+// naming convention so the two can be compared:
+//   - pointer-receiver decoration is removed: "pkg.(*T).M" -> "pkg.T.M"
+//   - generic instantiations lose their type parameters: "pkg.(*T[go.shape.int]).M" -> "pkg.T.M"
+//   - the compiler's "-fm" method-value-wrapper suffix is removed: "pkg.(*T).M-fm" -> "pkg.T.M".
+//     A method-value wrapper is emitted when a method is referenced as a value (e.g. passed as a
+//     callback), so its presence means the underlying method is used.
+func normalizeSymbol(symbol string) string {
+	symbol = strings.ReplaceAll(symbol, "(*", "")
+	symbol = strings.ReplaceAll(symbol, ")", "")
+	symbol = strings.TrimSuffix(symbol, "-fm")
+	return typeParamPattern.ReplaceAllString(symbol, "")
+}