AnchoreCTL Release Notes - Version 6.3.0

Note: AnchoreCTL v6.3.x versions are compatible with Enterprise v6.3.x deployments.

AnchoreCTL v6.3.0

Requirements

  • AnchoreCTL now requires Docker Engine v19.03 (API version 1.40) or later for operations that use a local container daemon: STIG evaluation and the --from docker and --from podman image sources. Analyzing images from a registry is unaffected.

New Features

Faster Image Analysis

This release focuses on image analysis performance. Analysis is faster and uses less CPU, with the same results, for every command that analyzes an image and for the centralized analysis that Anchore Enterprise runs. This release upgrades Syft to v1.55.0 and Stereoscope to v0.3.4.

Artifact Lifecycle Policies for Application Versions

New anchorectl system artifact-lifecycle-policy app-versions and anchorectl system artifact-lifecycle-policy images commands (add, update, get, list, and delete) manage the Anchore Enterprise v6.3.0 lifecycle rules for Application Versions and images. The existing anchorectl system artifact-lifecycle-policy commands still work. See Artifact Lifecycle Policies.

Export Application Versions Affected by a Vulnerability

anchorectl app export apps-by-vulnerability <VULNERABILITY_ID> produces a CSV of every Application Version affected by a vulnerability. Flags filter the list, --ui-base-url links each row to the UI, and -f writes the file.

Exclude Paths When Analyzing a Filesystem

anchorectl app version asset add filesystem and anchorectl generate analysis-bundle filesystem accept --exclude to leave paths, such as build output or caches, out of the SBOM. Patterns follow Syft’s --exclude rules and can also be set with the exclude configuration key or ANCHORECTL_EXCLUDE.

Organization Name

anchorectl account add and anchorectl account update accept --organization-name, and anchorectl app add and anchorectl app update accept --contact-organization, to set the Organization Name used as the author of generated SBOM, VEX, and VDR documents.

Improvements

  • The app version asset add commands that take --wait accept --timeout (ANCHORECTL_TIMEOUT), in seconds. The default is still 30 minutes; a negative value waits until the job finishes.
  • Two new settings, image-read.layer-fetch-concurrency and image-read.layer-index-concurrency, limit how many image layers are downloaded and indexed at once, to reduce peak memory on images with many large layers. Both default to 0, which keeps the existing behavior.
  • anchorectl app version vex list accepts --source-type and --source-name to filter VEX annotations by source.
  • The help for anchorectl image add and anchorectl app version asset add container-image now explains how to analyze images from Podman.
  • The --extended-support flag help now covers Ubuntu Expanded Security Maintenance (ESM) as well as Red Hat EUS.

Fixes

  • Addresses the compromise of the eMudhra intermediate certificate authorities. AnchoreCTL is now built with Go 1.26.10 and rejects TLS certificates issued by them.
  • Fixes an issue where analysis of some Ubuntu images, containing an ESM package and a package with no version, could hang indefinitely. This also affected centralized analysis by Anchore Enterprise.
  • Fixes an issue where the secret search reported only the first of two matches on the same line. Expect more secret findings on some images: the added findings were always present but went unreported.
  • Fixes an issue where anchorectl app version asset add analysis-bundle failed with entry exceeds the 2147483648 byte limit for bundles whose SBOM is larger than 2 GB. This fix was also delivered in v6.2.3.
  • Fixes an issue where anchorectl image check and anchorectl source check never returned control to the shell when a policy evaluation came back as failed. This fix was also delivered in v6.2.2.
  • Fixes an issue where anchorectl image check --fail-based-on-results ended with an empty failed policies: error that did not name the policy that failed.
  • Fixes an issue where running anchorectl with no command left stray characters at the shell prompt in iTerm2 and GNOME Terminal.
  • Fixes an issue where anchorectl generate analysis-bundle filesystem printed a Syft warning, no explicit name and version provided for directory source, on every run.
  • Fixes an issue where anchorectl stig docker image execute on an arm64 host could not pull a multi-architecture image referenced by its index digest. Use --platform (for example linux/arm64) to select the image for the host.
Last modified October 26, 2026