# 1. scan an image that has packages that contain hardlinked files
$ syft scan registry.fedoraproject.org/fedora-minimal:43@sha256:d028a3d86b3b68081c6610d0e77fa08a0853bb9488f522d864192c84af5b1a44 \
    -o spdx-json@2.3 | jq >/tmp/fedora-minimal-image.json

# 2. scan the same image as a dir
# (if you don't have buildah, other ways to export the filesystem will work too)
$ buildah unshare -- bash -c '
set -x
container=$(buildah from registry.fedoraproject.org/fedora-minimal:43@sha256:d028a3d86b3b68081c6610d0e77fa08a0853bb9488f522d864192c84af5b1a44)
trap "buildah rm $container" EXIT
rootfs=$(buildah mount $container)
syft scan dir:$rootfs --override-default-catalogers=image -o spdx-json@2.3 | jq >/tmp/fedora-minimal-dir.json
'

# 3. see that the packageVerificationCode for e.g. glibc is different
$ jq -c < /tmp/fedora-minimal-image.json '.packages[] | select(.name == "glibc").packageVerificationCode'
{"packageVerificationCodeValue":"d601c6bf99eaa51af6783e6bd8706502c5390f0d"}

$ jq -c < /tmp/fedora-minimal-dir.json '.packages[] | select(.name == "glibc").packageVerificationCode'
{"packageVerificationCodeValue":"a3e94cf048079551f077c29a799c3522521a3acf"}

# 4. compare the files reported for glibc
$ get_glibc_files() {
    local sbom=$1
    jq -r '
        reduce .files[] as $f ({}; .[$f.SPDXID] = $f.fileName) as $files |
        (.packages[] | select(.name == "glibc")) as $glibc |
        .relationships[] |
        select(.spdxElementId == $glibc.SPDXID and .relationshipType == "CONTAINS") |
        $files[.relatedSpdxElement]
    ' "$sbom" | sort
}

$ diff -u2 <(get_glibc_files /tmp/fedora-minimal-image.json) <(get_glibc_files /tmp/fedora-minimal-dir.json)

--- /proc/self/fd/12	2026-06-25 10:49:51.706356089 +0200
+++ /proc/self/fd/13	2026-06-25 10:49:51.707356075 +0200
@@ -31,4 +31,6 @@
 usr/lib64/libutil.so.1
 usr/libexec/getconf/POSIX_V6_LP64_OFF64
+usr/libexec/getconf/POSIX_V7_LP64_OFF64
+usr/libexec/getconf/XBS5_LP64_OFF64
 usr/share/licenses/glibc/COPYING
 usr/share/licenses/glibc/COPYING.LIB

# 5. see that the files reported only for dir and not for image are hardlinks
$ podman run --rm -ti registry.fedoraproject.org/fedora-minimal:43@sha256:d028a3d86b3b68081c6610d0e77fa08a0853bb9488f522d864192c84af5b1a44 \
    bash -c 'stat /usr/libexec/getconf/* | grep -E "File:|Device:"'

  File: /usr/libexec/getconf/POSIX_V6_LP64_OFF64
Device: 0,111	Inode: 78554226    Links: 3
  File: /usr/libexec/getconf/POSIX_V7_LP64_OFF64
Device: 0,111	Inode: 78554226    Links: 3
  File: /usr/libexec/getconf/XBS5_LP64_OFF64
Device: 0,111	Inode: 78554226    Links: 3