AnchoreCTL Release Notes - Version 6.2.0

Note: AnchoreCTL v6.2.x versions are compatible with Enterprise v6.2.x deployments.

AnchoreCTL v6.2.0

Requirements

  • AnchoreCTL now requires Docker Engine v20.10 or later for any operation that talks to a local container daemon. That covers STIG evaluation and the --from docker and --from podman image sources — --from podman reaches Podman through its Docker-compatible API, so the same minimum applies. Analyzing images from a registry does not use a local daemon and is unaffected. Docker Engine releases earlier than v20.10 are no longer supported.

New Features

Generate an Analysis Bundle from an Image

anchorectl generate analysis-bundle now accepts images in addition to filesystems, sourced from Docker, a registry, or Podman. The command always writes a tar archive containing the analysis output, with no absolute paths inside it. You can move or unpack and edit that archive and then upload it with anchorectl app version asset add analysis, which accepts either an archive path or a directory path. Standard output carries only the metadata about the files gathered and the success or failure result, so the command is safe to script.

Podman as an Image Source

anchorectl image add and anchorectl image one-time-scan now support --from podman, alongside the existing Docker and registry sources. Podman is documented in the source list for both commands.

Improvements

  • Upgrades Syft to v1.51.0, bringing in the go-binary cataloger. It records the symbols a Go binary actually uses so that Grype can filter out standard library vulnerabilities the binary cannot reach, removing those false positives from Go findings. The new golang.capture-symbols key (environment variable ANCHORECTL_GOLANG_CAPTURE_SYMBOLS) sets how many symbols are captured: extended-stdlib (the default - the standard library plus every module under golang.org/x/), stdlib, all, or none to disable symbol capture entirely.
  • anchorectl image content now shows the model content type, so AI models cataloged from GGUF files in an image are listed alongside the other package types.
  • Analysis errors are now reported at the command line. When analysis fails for a known reason, that reason is printed rather than a bare analysis_failed status, for both centralized and distributed analysis and for image asset adds.
  • anchorectl image add now gives a specific error when an image is supplied by digest with no tag, instead of surfacing the raw API validation message about source.import.tags.
  • The feed upload incompatibility message now names the deployed Anchore Enterprise version and the AnchoreCTL version it requires, rather than a fixed reference to Enterprise 5.20.
  • Removes the unused GetDistributedAnalysisImportSBOMData function from the image command internals.

Fixes

  • Fixes an issue where image analysis failed with a false cycle during symlink resolution error for images that hardlink files into a content-addressed package cache, as produced by uv and pip, and then replace the original filename with a symlink to the cached name in a later layer. No cycle existed on disk; the squashed tree only appeared to form one, and the affected images could not be analyzed at all.
Last modified September 9, 2026