feat: capture golang binary lib symbols by spiffcs · Pull Request #4988 · anchore/syft

spiffcs · 2026-06-17T14:17:33Z

Summary

Adds optional extraction of function symbols from Go binaries cataloging. Symbol extraction attributes them to the module that owns them which come out in the SBOM as syft packages. When enabled, syft reads the binary's pclntab and records the function symbols compiled into the binary.

Symbols are attributed to their owning module and on that package's metadata. Standard-library symbols are attached to the synthetic stdlib package. Inlined functions are also recovered from the pclntab funcname table so a vulnerable but inlined function can still be reported.

Changes

New symbols.go:parsing for ELF and Mach-O, symbol→module attribution, stdlib detection
GolangBinaryBuildinfoEntry.Symbols (syft/pkg/golang.go): new symbols JSON field (omitempty).
the cataloger accumulates stdlib symbols per binary location
Schema bump: 16.1.8 → 16.1.9.

Configuration: default off

capture-symbols is a three-value scope enum. Disabled by default, so upgrading does not change existing Go SBOM output or increase its size unless explicitly enabled.

┌──────────────────────┬──────────────────────────────────────────────────────────────────────────────┐
│       Surface        │                                   Setting                                    │
├──────────────────────┼──────────────────────────────────────────────────────────────────────────────┤
│ Environment variable │ SYFT_GOLANG_CAPTURE_SYMBOLS=stdlib                                                           │
├──────────────────────┼──────────────────────────────────────────────────────────────────────────────┤
│ Config file          │ golang.capture-symbols: none                                               │
├──────────────────────┼──────────────────────────────────────────────────────────────────────────────┤
│ Library              │ golang.DefaultCatalogerConfig().WithCaptureSymbols(golang.SymbolScopeStdlib) │
└──────────────────────┴──────────────────────────────────────────────────────────────────────────────┘

┌────────────────┬──────────────────────────────────────────────┐
│     Value      │                   Behavior                   │
├────────────────┼──────────────────────────────────────────────┤
│ none (default) │ no symbols captured                          │
├────────────────┼──────────────────────────────────────────────┤
│ stdlib         │ symbols only on the synthetic stdlib package │
├────────────────┼──────────────────────────────────────────────┤
│ all            │ symbols on all module packages plus stdlib   │
└────────────────┴──────────────────────────────────────────────┘

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

wagoodman · 2026-07-01T18:37:51Z

I was getting warnings when regenerating the json schema, so I went ahead and added descriptions for these.

wagoodman · 2026-07-01T18:57:08Z

+	case string(SymbolScopeNone), "":
+		return SymbolScopeNone
+	}
+	return ""


see the compliance parsing for an example; we tend to fail towards defaults instead of require checking and error by the caller. So when we use it in syft/pkg/cataloger/golang/parse_go_binary, we should trust the value at that point (not call Parse() again)

Ahh nice call I totally missed that compliance pattern. The options layer's PostLoad just assigns the parsed value (no error path anymore). I think this is the same shape as complianceConfig.PostLoad() now.

wagoodman · 2026-07-01T18:57:20Z

 	return &goBinaryCataloger{
 		licenseResolver:   newGoLicenseResolver(binaryCatalogerName, opts),
 		mainModuleVersion: opts.MainModuleVersion,
+		symbolScope:       opts.CaptureSymbols.Parse(),


no need to call Parse() again

I updated this so the cataloger now takes opts.CaptureSymbols as-is and trusts that normalization happened at the options layer.

wagoodman · 2026-07-01T18:58:26Z

+	defer func() {
+		if r := recover(); r != nil {
+			// the gosym package can panic on malformed pclntab data
+			err = fmt.Errorf("recovered from panic while reading pclntab: %v", r)


we should clear syms at this point too

👍 I updated this so the recover block now sets syms = nil before setting the error. A panic mid-parse can't return partial results alongside the error.

wagoodman · 2026-07-01T19:01:35Z

+// belong to no package and are dropped rather than mis-attributed (e.g. bucketed under a bogus "type"
+// stdlib package).
+func isCompilerGeneratedName(name string) bool {
+	return strings.Contains(name, ":") || strings.Contains(name, "..")


I think this isn't accounting for the go.type case that I think older compiler versions have

Yea I confirmed pre-1.20 toolchains used . where newer ones use :

I added prefix matches to account for the above. Real module paths like go.uber.org/zap and go.opentelemetry.io/otel also start with go. and shouldn't be dropped. I added test cases to cover this.

wagoodman · 2026-07-01T19:05:55Z

+	if isCompilerGeneratedName(name) {
+		return ""
+	}
+	slash := strings.LastIndex(name, "/")


I think this doesn't account for cases when there are type arguments like foo/bar.Do[net/url.Values] ... we'd find that the package is foo/bar.Do[net

Right, I found that the last "/" search was landing inside the type arguments

foo/bar.Do[net/url.Values] derived foo/bar.Do[net.

I fixed this by stripping the [...] portion before deriving the package path.
New test cases have been added to symbols_test

wagoodman · 2026-07-01T19:07:36Z

I realize this is outside of review, but noticed it in the review locally... I think this is swapped

Suggested change

after, _, found := strings.Cut(version, "+")

Nice catch! Fixed this apologies for the oversight.

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

This comment was marked as outdated.

Sign in to view

spiffcs marked this pull request as draft June 17, 2026 14:17

wagoodman mentioned this pull request Jun 17, 2026

Add symbol extraction for binaries #4454

Closed

spiffcs added 4 commits June 30, 2026 22:30

feat: POC capture lib symbols

a08457c

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

wip: stdlib

e495756

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

chore: move schema forward

16ac0f0

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

config: default false

7050c09

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

spiffcs force-pushed the go-binary-symbols branch from 8028f3f to 7050c09 Compare July 1, 2026 02:49

spiffcs marked this pull request as ready for review July 1, 2026 02:50

spiffcs requested a review from wagoodman July 1, 2026 02:50

spiffcs added 3 commits June 30, 2026 23:15

fix: lintfix

27f33d0

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

feat: enum feature for SYFT_GOLANG_CAPTURE_SYMBOLS

a1831ce

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

config: move symbol enum to cataloging pkg

46f9974

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

spiffcs changed the title ~~feat: POC capture lib symbols~~ feat: capture golang binary lib symbols Jul 1, 2026

spiffcs and others added 2 commits July 1, 2026 02:26

ci: ci

9b6fc99

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

Merge remote-tracking branch 'origin/main' into go-binary-symbols

83d3abf

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

wagoodman reviewed Jul 1, 2026

View reviewed changes

pr: feedback

22c9ab1

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

Uh oh!

Conversation

spiffcs commented Jun 17, 2026 • edited by wagoodman Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Configuration: default off

Uh oh!

This comment was marked as outdated.

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wagoodman Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

spiffcs Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

spiffcs commented Jun 17, 2026 •

edited by wagoodman

Loading

wagoodman Jul 1, 2026 •

edited

Loading

spiffcs Jul 2, 2026 •

edited

Loading