anchor.diff:        find "$out" -name .git -print0 | xargs -0 rm -rf
       '';
     };
  -  vendorSha256 = "sha256-d6ZBWX4/lgh610fBLTE1EUqZmpctLfxi2PSRifH+1jg=";
  +  vendorSha256 = "sha256-nb7QcdmwAfYDTzCFNjs7uKwK/gng2iMD36ANaFSsftk=";
   
     nativeBuildInputs = [ installShellFiles ];
   
  -  subPackages = [ "." ];
  +  subPackages = [ "cmd/syft" ];
   
     ldflags = [
       "-s"
  
positive.code:       --zsh <($out/bin/syft completion zsh)
    '';
  
    meta = with lib; {
      homepage = "https://github.com/anchore/syft";
      changelog = "https://github.com/anchore/syft/releases/tag/v${version}";
  
negative.code: 
  buildGoModule rec {
    pname = "syft";
    version = "0.46.1";
  
    src = fetchFromGitHub {
      owner = "anchore";
      repo = pname;
      rev = "v${version}";
      sha256 = "sha256-ojjudnS0yJZ6YoHmq4m0YKyCqq9Ge+AFU7ejlPop71w=";
      # populate values that require us to use git. By doing this in postFetch we
      # can delete .git afterwards and maintain better reproducibility of the src.
      leaveDotGit = true;
  