anchore · spiffcs · Oct 14, 2025 · Oct 14, 2025 · Oct 14, 2025 · Oct 14, 2025
diff --git a/internal/constants.go b/internal/constants.go
@@ -8,5 +8,4 @@ const (
 	// Changelog
 	// 16.1.0 - reformulated the python pdm fields (added "URL" and removed the unused "path" field).
 	// 16.1.1 - correct elf package osCpe field according to the document of systemd (also add appCpe field)
-
 )
diff --git a/syft/create_sbom_config.go b/syft/create_sbom_config.go
@@ -15,6 +15,7 @@ import (
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
+	"github.com/anchore/syft/syft/source/ocimodelsource"
 )
 
 // CreateSBOMConfig specifies all parameters needed for creating an SBOM.
@@ -483,6 +484,9 @@ func findDefaultTags(src source.Description) ([]string, error) {
 		return []string{pkgcataloging.DirectoryTag, filecataloging.FileTag}, nil
 	case source.SnapMetadata:
 		return []string{pkgcataloging.InstalledTag, filecataloging.FileTag}, nil
+	case *ocimodelsource.OCIModelMetadata:
+		// OCI model artifacts should use image-like catalogers since they provide files to scan
+		return []string{pkgcataloging.ImageTag, filecataloging.FileTag}, nil
 	default:
 		return nil, fmt.Errorf("unable to determine default cataloger tag for source type=%T", m)
 	}

diff --git a/syft/format/internal/spdxutil/helpers/source_info.go b/syft/format/internal/spdxutil/helpers/source_info.go
@@ -83,7 +83,7 @@ func SourceInfo(p pkg.Package) string {
 	case pkg.TerraformPkg:
 		answer = "acquired package info from Terraform dependency lock file"
 	case pkg.ModelPkg:
-		answer = "acquired package info from AI artifact (e.g. GGUF File"
+		answer = "acquired package info from AI artifact (e.g. GGUF File)"
 	default:
 		answer = "acquired package info from the following paths"
 	}

diff --git a/syft/pkg/cataloger/ai/cataloger.go b/syft/pkg/cataloger/ai/cataloger.go
@@ -5,12 +5,165 @@ including support for GGUF (GPT-Generated Unified Format) model files.
 package ai
 
 import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+
+	gguf_parser "github.com/gpustack/gguf-parser-go"
+
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/generic"
+	"github.com/anchore/syft/syft/source/ocimodelsource"
+)
+
+const (
+	catalogerName = "gguf-cataloger"
 )
 
+// ggufCataloger implements pkg.Cataloger with support for both file-based and OCI layer-based discovery.
+type ggufCataloger struct {
+	genericCataloger pkg.Cataloger
+}
+
 // NewGGUFCataloger returns a new cataloger instance for GGUF model files.
+// It supports both traditional file-based discovery and OCI layer-aware discovery
+// when the resolver implements OCIResolver.
 func NewGGUFCataloger() pkg.Cataloger {
-	return generic.NewCataloger("gguf-cataloger").
-		WithParserByGlobs(parseGGUFModel, "**/*.gguf")
+	return &ggufCataloger{
+		genericCataloger: generic.NewCataloger(catalogerName).
+			WithParserByGlobs(parseGGUFModel, "**/*.gguf"),
+	}
+}
+
+// Name returns the cataloger name.
+func (c *ggufCataloger) Name() string {
+	return catalogerName
+}
+
+// Catalog discovers GGUF model packages from the given resolver.
+// If the resolver implements OCIResolver, it uses layer-aware discovery.
+// Otherwise, it falls back to glob-based file discovery.
+func (c *ggufCataloger) Catalog(ctx context.Context, resolver file.Resolver) ([]pkg.Package, []artifact.Relationship, error) {
+	// Check if the resolver supports OCI layer-aware access
+	if ociResolver, ok := resolver.(ocimodelsource.OCIResolver); ok {
+		log.Debug("using OCI layer-aware discovery for GGUF models")
+		return c.catalogFromOCILayers(ctx, ociResolver)
+	}
+
+	// Fall back to generic glob-based discovery
+	log.Debug("using glob-based discovery for GGUF models")
+	return c.genericCataloger.Catalog(ctx, resolver)
+}
+
+// catalogFromOCILayers discovers GGUF models by querying OCI layers by media type.
+func (c *ggufCataloger) catalogFromOCILayers(ctx context.Context, resolver ocimodelsource.OCIResolver) ([]pkg.Package, []artifact.Relationship, error) {
+	// Find all GGUF layers by media type
+	digests, err := resolver.LayerDigestsByMediaType(ocimodelsource.GGUFLayerMediaType)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to get GGUF layer digests: %w", err)
+	}
+
+	if len(digests) == 0 {
+		log.Debug("no GGUF layers found by media type")
+		return nil, nil, nil
+	}
+
+	var packages []pkg.Package
+
+	for idx, digest := range digests {
+		select {
+		case <-ctx.Done():
+			return packages, nil, ctx.Err()
+		default:
+		}
+
+		log.WithFields("digest", digest, "index", idx).Debug("processing GGUF layer")
+
+		p, err := c.parseGGUFLayer(resolver, digest, idx)
+		if err != nil {
+			log.WithFields("digest", digest, "error", err).Warn("failed to parse GGUF layer")
+			continue
+		}
+
+		if p != nil {
+			packages = append(packages, *p)
+		}
+	}
+
+	return packages, nil, nil
+}
+
+// parseGGUFLayer parses a single GGUF layer and returns the discovered package.
+func (c *ggufCataloger) parseGGUFLayer(resolver ocimodelsource.OCIResolver, digest string, layerIndex int) (*pkg.Package, error) {
+	// Fetch the layer content
+	reader, err := resolver.LayerContentsByDigest(digest)
+	if err != nil {
+		return nil, fmt.Errorf("failed to fetch layer content: %w", err)
+	}
+	defer internal.CloseAndLogError(reader, digest)
+
+	// Create a temporary file for the gguf-parser library
+	tempFile, err := os.CreateTemp("", "syft-gguf-layer-*.gguf")
+	if err != nil {
+		return nil, fmt.Errorf("failed to create temp file: %w", err)
+	}
+	tempPath := tempFile.Name()
+	defer os.Remove(tempPath)
+
+	// Copy and validate the GGUF header using LimitedReader to prevent OOM
+	limitedReader := &io.LimitedReader{R: reader, N: maxHeaderSize}
+	if err := copyHeader(tempFile, limitedReader); err != nil {
+		tempFile.Close()
+		return nil, fmt.Errorf("failed to copy GGUF header: %w", err)
+	}
+	tempFile.Close()
+
+	// Parse using gguf-parser-go
+	ggufFile, err := gguf_parser.ParseGGUFFile(tempPath,
+		gguf_parser.SkipLargeMetadata(),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse GGUF file: %w", err)
+	}
+
+	// Extract metadata
+	metadata := ggufFile.Metadata()
+	modelVersion := extractVersion(ggufFile.Header.MetadataKV)
+
+	// Convert to syft metadata structure
+	syftMetadata := &pkg.GGUFFileHeader{
+		Architecture:          metadata.Architecture,
+		Quantization:          metadata.FileTypeDescriptor,
+		Parameters:            uint64(metadata.Parameters),
+		GGUFVersion:           uint32(ggufFile.Header.Version),
+		TensorCount:           ggufFile.Header.TensorCount,
+		RemainingKeyValues:    convertGGUFMetadataKVs(ggufFile.Header.MetadataKV),
+		MetadataKeyValuesHash: computeKVMetadataHash(ggufFile.Header.MetadataKV),
+	}
+
+	// If model name is not in metadata, use a generated name
+	modelName := metadata.Name
+	if modelName == "" {
+		modelName = fmt.Sprintf("model-layer-%d", layerIndex)
+	}
+
+	// Create a virtual location for the layer
+	virtualPath := fmt.Sprintf("/layer-%d.gguf", layerIndex)
+	location := file.NewLocation(virtualPath).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation)
+
+	// Create package from metadata
+	p := newGGUFPackage(
+		syftMetadata,
+		modelName,
+		modelVersion,
+		metadata.License,
+		location,
+	)
+
+	return &p, nil
 }
diff --git a/syft/source/ocimodelsource/metadata.go b/syft/source/ocimodelsource/metadata.go
@@ -0,0 +1,39 @@
+package ocimodelsource
+
+import "github.com/anchore/syft/syft/source"
+
+// OCIModelMetadata represents all static metadata that defines what an OCI model artifact is.
+// This is similar to ImageMetadata but includes model-specific fields and OCI artifact annotations.
+type OCIModelMetadata struct {
+	// Core OCI artifact metadata (mirrors ImageMetadata)
+	UserInput      string                 `json:"userInput"`
+	ID             string                 `json:"artifactID"`
+	ManifestDigest string                 `json:"manifestDigest"`
+	MediaType      string                 `json:"mediaType"`
+	Tags           []string               `json:"tags"`
+	Size           int64                  `json:"artifactSize"`
+	Layers         []source.LayerMetadata `json:"layers"`
+	RawManifest    []byte                 `json:"manifest"`
+	RawConfig      []byte                 `json:"config"`
+	RepoDigests    []string               `json:"repoDigests"`
+	Architecture   string                 `json:"architecture"`
+	Variant        string                 `json:"architectureVariant,omitempty"`
+	OS             string                 `json:"os"`
+	Labels         map[string]string      `json:"labels,omitempty"`
+
+	// OCI-specific metadata
+	Annotations map[string]string `json:"annotations,omitempty"`
+
+	// Model-specific metadata
+	ModelFormat string          `json:"modelFormat,omitempty"` // e.g., "gguf"
+	GGUFLayers  []GGUFLayerInfo `json:"ggufLayers,omitempty"`
+}
-type OCIModelMetadata struct {
-	// Core OCI artifact metadata (mirrors ImageMetadata)
-	UserInput      string                 `json:"userInput"`
-	ID             string                 `json:"artifactID"`
-	ManifestDigest string                 `json:"manifestDigest"`
-	MediaType      string                 `json:"mediaType"`
-	Tags           []string               `json:"tags"`
-	Size           int64                  `json:"artifactSize"`
-	Layers         []source.LayerMetadata `json:"layers"`
-	RawManifest    []byte                 `json:"manifest"`
-	RawConfig      []byte                 `json:"config"`
-	RepoDigests    []string               `json:"repoDigests"`
-	Architecture   string                 `json:"architecture"`
-	Variant        string                 `json:"architectureVariant,omitempty"`
-	OS             string                 `json:"os"`
-	Labels         map[string]string      `json:"labels,omitempty"`
-
-	// OCI-specific metadata
-	Annotations map[string]string `json:"annotations,omitempty"`
-
-	// Model-specific metadata
-	ModelFormat string          `json:"modelFormat,omitempty"` // e.g., "gguf"
-	GGUFLayers  []GGUFLayerInfo `json:"ggufLayers,omitempty"`
-}
+type OCIModelMetadata{
+   ImageMetadata
+   Annotations map[string]string
+}
-type OCIModelMetadata struct {
-	// Core OCI artifact metadata (mirrors ImageMetadata)
-	UserInput      string                 `json:"userInput"`
-	ID             string                 `json:"artifactID"`
-	ManifestDigest string                 `json:"manifestDigest"`
-	MediaType      string                 `json:"mediaType"`
-	Tags           []string               `json:"tags"`
-	Size           int64                  `json:"artifactSize"`
-	Layers         []source.LayerMetadata `json:"layers"`
-	RawManifest    []byte                 `json:"manifest"`
-	RawConfig      []byte                 `json:"config"`
-	RepoDigests    []string               `json:"repoDigests"`
-	Architecture   string                 `json:"architecture"`
-	Variant        string                 `json:"architectureVariant,omitempty"`
-	OS             string                 `json:"os"`
-	Labels         map[string]string      `json:"labels,omitempty"`
-
-	// OCI-specific metadata
-	Annotations map[string]string `json:"annotations,omitempty"`
-
-	// Model-specific metadata
-	ModelFormat string          `json:"modelFormat,omitempty"` // e.g., "gguf"
-	GGUFLayers  []GGUFLayerInfo `json:"ggufLayers,omitempty"`
-}
+type OCIModelMetadata ImageMetadata
-type OCIModelMetadata struct {
-	// Core OCI artifact metadata (mirrors ImageMetadata)
-	UserInput      string                 `json:"userInput"`
-	ID             string                 `json:"artifactID"`
-	ManifestDigest string                 `json:"manifestDigest"`
-	MediaType      string                 `json:"mediaType"`
-	Tags           []string               `json:"tags"`
-	Size           int64                  `json:"artifactSize"`
-	Layers         []source.LayerMetadata `json:"layers"`
-	RawManifest    []byte                 `json:"manifest"`
-	RawConfig      []byte                 `json:"config"`
-	RepoDigests    []string               `json:"repoDigests"`
-	Architecture   string                 `json:"architecture"`
-	Variant        string                 `json:"architectureVariant,omitempty"`
-	OS             string                 `json:"os"`
-	Labels         map[string]string      `json:"labels,omitempty"`
-
-	// OCI-specific metadata
-	Annotations map[string]string `json:"annotations,omitempty"`
-
-	// Model-specific metadata
-	ModelFormat string          `json:"modelFormat,omitempty"` // e.g., "gguf"
-	GGUFLayers  []GGUFLayerInfo `json:"ggufLayers,omitempty"`
-}
+type OCIModelMetadata{
+   ImageMetadata
+   Annotations map[string]string
+}
-type OCIModelMetadata struct {
-	// Core OCI artifact metadata (mirrors ImageMetadata)
-	UserInput      string                 `json:"userInput"`
-	ID             string                 `json:"artifactID"`
-	ManifestDigest string                 `json:"manifestDigest"`
-	MediaType      string                 `json:"mediaType"`
-	Tags           []string               `json:"tags"`
-	Size           int64                  `json:"artifactSize"`
-	Layers         []source.LayerMetadata `json:"layers"`
-	RawManifest    []byte                 `json:"manifest"`
-	RawConfig      []byte                 `json:"config"`
-	RepoDigests    []string               `json:"repoDigests"`
-	Architecture   string                 `json:"architecture"`
-	Variant        string                 `json:"architectureVariant,omitempty"`
-	OS             string                 `json:"os"`
-	Labels         map[string]string      `json:"labels,omitempty"`
-
-	// OCI-specific metadata
-	Annotations map[string]string `json:"annotations,omitempty"`
-
-	// Model-specific metadata
-	ModelFormat string          `json:"modelFormat,omitempty"` // e.g., "gguf"
-	GGUFLayers  []GGUFLayerInfo `json:"ggufLayers,omitempty"`
-}
+type OCIModelMetadata ImageMetadata
+
+// GGUFLayerInfo represents metadata about a GGUF layer in the OCI artifact.
+type GGUFLayerInfo struct {
+	Digest       string            `json:"digest"`
+	Size         int64             `json:"size"`      // Full blob size in registry
+	MediaType    string            `json:"mediaType"` // Should be "application/vnd.docker.ai.gguf.v3"
+	Annotations  map[string]string `json:"annotations,omitempty"`
+	FetchedBytes int64             `json:"fetchedBytes"` // How many bytes we actually fetched via range-GET
+}