update SPDX license list => 3.15 (#630)

* update SPDX license list 

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

Makefile

@@ -37,10 +37,6 @@ ifeq "$(strip $(VERSION))" ""
  override VERSION = $(shell git describe --always --tags --dirty)
 endif
 
-# used to generate the changelog from the second to last tag to the current tag (used in the release pipeline when the release tag is in place)
-LAST_TAG := $(shell git describe --abbrev=0 --tags $(shell git rev-list --tags --max-count=1))
-SECOND_TO_LAST_TAG := $(shell git describe --abbrev=0 --tags $(shell git rev-list --tags --skip=1 --max-count=1))
-
 ## Variable assertions
 
 ifndef TEMPDIR
@@ -103,7 +99,7 @@ bootstrap-tools: $(TEMPDIR)
 	GO111MODULE=off GOBIN=$(shell realpath $(TEMPDIR)) go get -u golang.org/x/perf/cmd/benchstat
 	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(TEMPDIR)/ v1.42.1
 	curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMPDIR)/ v0.2.0
-	curl -sSfL https://raw.githubusercontent.com/anchore/chronicle/main/install.sh | sh -s -- -b $(TEMPDIR)/ v0.2.0-beta
+	curl -sSfL https://raw.githubusercontent.com/anchore/chronicle/main/install.sh | sh -s -- -b $(TEMPDIR)/ v0.3.0
 	.github/scripts/goreleaser-install.sh -b $(TEMPDIR)/ v0.177.0
 
 .PHONY: bootstrap-go
@@ -194,6 +190,11 @@ fixtures:
 generate-json-schema:  ## Generate a new json schema
 	cd schema/json && go run generate.go
 
+.PHONY: generate-license-list
+generate-license-list: ## Generate an updated spdx license list
+	go generate ./internal/spdxlicense/...
+	gofmt -s -w ./internal/spdxlicense
+
 .PHONY: build
 build: $(SNAPSHOTDIR) ## Build release snapshot binaries and packages
 
@@ -252,27 +253,19 @@ cli: $(SNAPSHOTDIR) ## Run CLI tests
 	SYFT_BINARY_LOCATION='$(SNAPSHOT_CMD)' \
 		go test -count=1 -v ./test/cli
 
-.PHONY: changelog-release
-changelog-release:
-	$(TEMPDIR)/chronicle --since-tag $(SECOND_TO_LAST_TAG) --until-tag $(LAST_TAG) -vv > CHANGELOG.md
-
-	@printf '\n$(BOLD)$(CYAN)Release $(VERSION) Changelog$(RESET)\n\n'
-	@cat CHANGELOG.md
-
-.PHONY: changelog-unreleased
-changelog-unreleased: ## show the current changelog that will be produced on the next release (note: requires GITHUB_TOKEN set)
-	$(TEMPDIR)/chronicle --since-tag $(LAST_TAG) -vv > CHANGELOG.md
-
-	@printf '\n$(BOLD)$(CYAN)Unreleased Changes (closed PRs and issues will not be in the final changelog)$(RESET)\n'
-
+.PHONY: changelog
+changelog: clean-changelog CHANGELOG.md
 	@docker run -it --rm \
 		-v $(shell pwd)/CHANGELOG.md:/CHANGELOG.md \
 		rawkode/mdv \
 			-t 748.5989 \
 			/CHANGELOG.md
 
+CHANGELOG.md:
+	$(TEMPDIR)/chronicle -vv > CHANGELOG.md
+
 .PHONY: release
-release: clean-dist changelog-release ## Build and publish final binaries and packages. Intended to be run only on macOS.
+release: clean-dist CHANGELOG.md  ## Build and publish final binaries and packages. Intended to be run only on macOS.
 	$(call title,Publishing release artifacts)
 
 	# Prepare for macOS-specific signing process
@@ -313,9 +306,13 @@ clean-snapshot:
 	rm -rf $(SNAPSHOTDIR) $(TEMPDIR)/goreleaser.yaml
 
 .PHONY: clean-dist
-clean-dist:
+clean-dist: clean-changelog
 	rm -rf $(DISTDIR) $(TEMPDIR)/goreleaser.yaml
 
+.PHONY: clean-changelog
+clean-changelog:
+	rm -f CHANGELOG.md
+
 clean-test-image-cache: clean-test-image-tar-cache clean-test-image-docker-cache
 
 .PHONY: clear-test-image-tar-cache

cmd/packages.go

@@ -14,10 +14,8 @@ import (
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/ui"
 	"github.com/anchore/syft/syft"
-	"github.com/anchore/syft/syft/distro"
 	"github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/syft/format"
-	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 	"github.com/pkg/profile"
@@ -261,13 +259,6 @@ func packagesExecWorker(userInput string) <-chan error {
 			return
 		}
 
-		if appConfig.Anchore.Host != "" {
-			if err := runPackageSbomUpload(src, src.Metadata, catalog, d); err != nil {
-				errs <- err
-				return
-			}
-		}
-
 		sbomResult := sbom.SBOM{
 			Artifacts: sbom.Artifacts{
 				PackageCatalog: catalog,
@@ -276,6 +267,13 @@ func packagesExecWorker(userInput string) <-chan error {
 			Source: src.Metadata,
 		}
 
+		if appConfig.Anchore.Host != "" {
+			if err := runPackageSbomUpload(src, sbomResult); err != nil {
+				errs <- err
+				return
+			}
+		}
+
 		bus.Publish(partybus.Event{
 			Type:  event.PresenterReady,
 			Value: f.Presenter(sbomResult),
@@ -284,7 +282,7 @@ func packagesExecWorker(userInput string) <-chan error {
 	return errs
 }
 
-func runPackageSbomUpload(src *source.Source, s source.Metadata, catalog *pkg.Catalog, d *distro.Distro) error {
+func runPackageSbomUpload(src *source.Source, s sbom.SBOM) error {
 	log.Infof("uploading results to %s", appConfig.Anchore.Host)
 
 	if src.Metadata.Scheme != source.ImageScheme {
@@ -319,9 +317,7 @@ func runPackageSbomUpload(src *source.Source, s source.Metadata, catalog *pkg.Ca
 
 	importCfg := anchore.ImportConfig{
 		ImageMetadata:           src.Image.Metadata,
-		SourceMetadata:          s,
-		Catalog:                 catalog,
-		Distro:                  d,
+		SBOM:                    s,
 		Dockerfile:              dockerfileContents,
 		OverwriteExistingUpload: appConfig.Anchore.OverwriteExistingImage,
 		Timeout:                 appConfig.Anchore.ImportTimeout,

internal/anchore/import.go

@@ -6,24 +6,19 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/antihax/optional"
-
 	"github.com/anchore/client-go/pkg/external"
 	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/syft/distro"
 	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/antihax/optional"
 	"github.com/wagoodman/go-partybus"
 	"github.com/wagoodman/go-progress"
 )
 
 type ImportConfig struct {
 	ImageMetadata           image.Metadata
-	SourceMetadata          source.Metadata
-	Catalog                 *pkg.Catalog
-	Distro                  *distro.Distro
+	SBOM                    sbom.SBOM
 	Dockerfile              []byte
 	OverwriteExistingUpload bool
 	Timeout                 uint
@@ -73,19 +68,19 @@ func (c *Client) Import(ctx context.Context, cfg ImportConfig) error {
 	prog.N++
 	sessionID := startOperation.Uuid
 
-	packageDigest, err := importPackageSBOM(authedCtx, c.client.ImportsApi, sessionID, cfg.SourceMetadata, cfg.Catalog, cfg.Distro, stage)
+	packageDigest, err := importPackageSBOM(authedCtx, c.client.ImportsApi, sessionID, cfg.SBOM, stage)
 	if err != nil {
 		return fmt.Errorf("failed to import Package SBOM: %w", err)
 	}
 	prog.N++
 
-	manifestDigest, err := importManifest(authedCtx, c.client.ImportsApi, sessionID, cfg.ImageMetadata.RawManifest, stage)
+	manifestDigest, err := importManifest(authedCtx, c.client.ImportsApi, sessionID, cfg.SBOM.Source.ImageMetadata.RawManifest, stage)
 	if err != nil {
 		return fmt.Errorf("failed to import Manifest: %w", err)
 	}
 	prog.N++
 
-	configDigest, err := importConfig(authedCtx, c.client.ImportsApi, sessionID, cfg.ImageMetadata.RawConfig, stage)
+	configDigest, err := importConfig(authedCtx, c.client.ImportsApi, sessionID, cfg.SBOM.Source.ImageMetadata.RawConfig, stage)
 	if err != nil {
 		return fmt.Errorf("failed to import Config: %w", err)
 	}

internal/anchore/import_package_sbom.go

@@ -14,30 +14,17 @@ import (
 
 	"github.com/wagoodman/go-progress"
 
-	"github.com/anchore/syft/syft/distro"
-	"github.com/anchore/syft/syft/source"
-
 	"github.com/anchore/client-go/pkg/external"
 	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/pkg"
 )
 
 type packageSBOMImportAPI interface {
 	ImportImagePackages(context.Context, string, external.ImagePackageManifest) (external.ImageImportContentResponse, *http.Response, error)
 }
 
-func packageSbomModel(srcMetadata source.Metadata, catalog *pkg.Catalog, d *distro.Distro) (*external.ImagePackageManifest, error) {
+func packageSbomModel(s sbom.SBOM) (*external.ImagePackageManifest, error) {
 	var buf bytes.Buffer
 
-	// TODO: once the top-level API is refactored and SBOMs are the unit of work, then this function will be passed an SBOM and there would be no more need to create an SBOM object here.
-	s := sbom.SBOM{
-		Artifacts: sbom.Artifacts{
-			PackageCatalog: catalog,
-			Distro:         d,
-		},
-		Source: srcMetadata,
-	}
-
 	err := syftjson.Format().Presenter(s).Present(&buf)
 	if err != nil {
 		return nil, fmt.Errorf("unable to serialize results: %w", err)
@@ -52,11 +39,11 @@ func packageSbomModel(srcMetadata source.Metadata, catalog *pkg.Catalog, d *dist
 	return &model, nil
 }
 
-func importPackageSBOM(ctx context.Context, api packageSBOMImportAPI, sessionID string, s source.Metadata, catalog *pkg.Catalog, d *distro.Distro, stage *progress.Stage) (string, error) {
+func importPackageSBOM(ctx context.Context, api packageSBOMImportAPI, sessionID string, s sbom.SBOM, stage *progress.Stage) (string, error) {
 	log.Debug("importing package SBOM")
 	stage.Current = "package SBOM"
 
-	model, err := packageSbomModel(s, catalog, d)
+	model, err := packageSbomModel(s)
 	if err != nil {
 		return "", fmt.Errorf("unable to create PackageSBOM model: %w", err)
 	}

internal/anchore/import_package_sbom_test.go

@@ -74,7 +74,15 @@ func TestPackageSbomToModel(t *testing.T) {
 
 	c := pkg.NewCatalog(p)
 
-	model, err := packageSbomModel(m, c, &d)
+	sbomResult := sbom.SBOM{
+		Artifacts: sbom.Artifacts{
+			PackageCatalog: c,
+			Distro:         &d,
+		},
+		Source: m,
+	}
+
+	model, err := packageSbomModel(sbomResult)
 	if err != nil {
 		t.Fatalf("unable to generate model from source material: %+v", err)
 	}
@@ -197,7 +205,15 @@ func TestPackageSbomImport(t *testing.T) {
 
 	d, _ := distro.NewDistro(distro.CentOS, "8.0", "")
 
-	theModel, err := packageSbomModel(m, catalog, &d)
+	sbomResult := sbom.SBOM{
+		Artifacts: sbom.Artifacts{
+			PackageCatalog: catalog,
+			Distro:         &d,
+		},
+		Source: m,
+	}
+
+	theModel, err := packageSbomModel(sbomResult)
 	if err != nil {
 		t.Fatalf("could not get sbom model: %+v", err)
 	}
@@ -236,7 +252,7 @@ func TestPackageSbomImport(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 
-			digest, err := importPackageSBOM(context.TODO(), test.api, sessionID, m, catalog, &d, &progress.Stage{})
+			digest, err := importPackageSBOM(context.TODO(), test.api, sessionID, sbomResult, &progress.Stage{})
 
 			// validate error handling
 			if err != nil && !test.expectsError {

internal/formats/common/spdxhelpers/source_info.go

@@ -31,6 +31,8 @@ func SourceInfo(p *pkg.Package) string {
 		answer = "acquired package info from go module information"
 	case pkg.RustPkg:
 		answer = "acquired package info from rust cargo manifest"
+	case pkg.PhpComposerPkg:
+		answer = "acquired package info from PHP composer manifest"
 	default:
 		answer = "acquired package info from the following paths"
 	}

internal/formats/common/spdxhelpers/source_info_test.go

@@ -124,6 +124,14 @@ func Test_SourceInfo(t *testing.T) {
 				"from rust cargo manifest",
 			},
 		},
+		{
+			input: pkg.Package{
+				Type: pkg.PhpComposerPkg,
+			},
+			expected: []string{
+				"from PHP composer manifest",
+			},
+		},
 	}
 	var pkgTypes []pkg.Type
 	for _, test := range tests {

internal/spdxlicense/license_list.go

@@ -1,9 +1,9 @@
 // Code generated by go generate; DO NOT EDIT.
-// This file was generated by robots at 2021-09-29 23:42:29.616023 -0400 EDT m=+0.184689484
+// This file was generated by robots at 2021-11-15 14:32:22.081911 -0500 EST m=+0.159302107
 // using data from https://spdx.org/licenses/licenses.json
 package spdxlicense
 
-const Version = "3.14"
+const Version = "3.15"
 
 var licenseIDs = map[string]string{
 	"0bsd":                                   "0BSD",
@@ -367,6 +367,12 @@ var licenseIDs = map[string]string{
 	"cnri-jython":                              "CNRI-Jython",
 	"cnri-python":                              "CNRI-Python",
 	"cnri-python-gpl-compatible":               "CNRI-Python-GPL-Compatible",
+	"coil-1":                                   "COIL-1.0",
+	"coil-1.0":                                 "COIL-1.0",
+	"coil-1.0.0":                               "COIL-1.0",
+	"community-spec-1":                         "Community-Spec-1.0",
+	"community-spec-1.0":                       "Community-Spec-1.0",
+	"community-spec-1.0.0":                     "Community-Spec-1.0",
 	"condor-1":                                 "Condor-1.1",
 	"condor-1.1":                               "Condor-1.1",
 	"condor-1.1.0":                             "Condor-1.1",
@@ -440,6 +446,7 @@ var licenseIDs = map[string]string{
 	"eupl-1.2.0":                               "EUPL-1.2",
 	"eurosym":                                  "Eurosym",
 	"fair":                                     "Fair",
+	"fdk-aac":                                  "FDK-AAC",
 	"frameworx-1":                              "Frameworx-1.0",
 	"frameworx-1.0":                            "Frameworx-1.0",
 	"frameworx-1.0.0":                          "Frameworx-1.0",
@@ -651,6 +658,7 @@ var licenseIDs = map[string]string{
 	"liliq-rplus-1":                            "LiLiQ-Rplus-1.1",
 	"liliq-rplus-1.1":                          "LiLiQ-Rplus-1.1",
 	"liliq-rplus-1.1.0":                        "LiLiQ-Rplus-1.1",
+	"linux-man-pages-copyleft":                 "Linux-man-pages-copyleft",
 	"linux-openib":                             "Linux-OpenIB",
 	"lpl-1":                                    "LPL-1.0",
 	"lpl-1.0":                                  "LPL-1.0",

schema/json/vnd.syft+json

@@ -0,0 +1,70 @@
+(registered 2021-11-05, last updated 2021-11-05)
+
+Media type name: application
+Media subtype name: vnd.syft+json
+
+Required parameters: N/A
+
+Optional parameters:
+version
+
+The version parameter refers to the Syft specification version in use.
+
+version = 1*DIGIT "." 1*DIGIT "." 1*DIGIT
+
+Encoding considerations: binary
+This media type has all of the same encoding considerations of
+application/json as described in [RFC8259]
+
+
+Security considerations:
+This media type has all of the same security
+considerations of application/json as described in [RFC8259].
+
+Depending on the operational context of the device or software being described by the SBOM there may be additional security requirements. These may include but are not limited to, encryption at rest, encryption in transit, and restrictions on the transmission of the SBOM to 3rd parties. These additional requirements are considered out of scope for the specification. They will typically be enforced by contract or copyright terms.
+
+
+Interoperability considerations:
+This media type has the same interoperability considerations of application/json as described in [RFC8259].
+
+Published specification:
+The specification can be found on the main Syft GitHub repository under the schema directory https://github.com/anchore/syft/blob/main/schema/json
+
+Applications which use this media:
+This media type is used to specify a software bill of materials.
+It will be used by tools that produce SBOMs either during the software build process or as a result of software composition analysis.
+
+It will also be used by tools that consume SBOMs for software
+supply chain, component, supplier, license, and vulnerability
+analysis.
+
+Fragment identifier considerations:
+N/A
+
+Restrictions on usage:
+N/A
+
+Provisional registration? (standards tree only):
+N/A
+
+Additional information:
+
+1. Deprecated alias names for this type: N/A
+2. Magic number(s): N/A
+3. File extension(s): .syft.json
+4. Macintosh file type code: N/A
+5. Object Identifiers: N/A
+
+General Comments:
+
+
+Person to contact for further information:
+
+1. Name: Dan Luhring
+2. Email: dan.luhring@anchore.com
+
+Intended usage: Common
+The Syft SBOM format is an open-source software bill of materials specification. It is intended to be exchanged between different parties of the software supply chain.
+
+
+Author/Change controller: Dan Luhring, on behalf of Anchore

syft/distro/identify_test.go

@@ -123,6 +123,11 @@ func TestIdentifyDistro(t *testing.T) {
 			Type:    Mariner,
 			Version: "1.0.0",
 		},
+		{
+			fixture: "test-fixtures/os/rockylinux",
+			Type:    RockyLinux,
+			Version: "8.4.0",
+		},
 	}
 
 	observedDistros := internal.NewStringSet()

syft/distro/test-fixtures/os/rockylinux/etc/os-release

@@ -0,0 +1,13 @@
+NAME="Rocky Linux"
+VERSION="8.4 (Green Obsidian)"
+ID="rocky"
+ID_LIKE="rhel fedora"
+VERSION_ID="8.4"
+PLATFORM_ID="platform:el8"
+PRETTY_NAME="Rocky Linux 8.4 (Green Obsidian)"
+ANSI_COLOR="0;32"
+CPE_NAME="cpe:/o:rocky:rocky:8.4:GA"
+HOME_URL="https://rockylinux.org/"
+BUG_REPORT_URL="https://bugs.rockylinux.org/"
+ROCKY_SUPPORT_PRODUCT="Rocky Linux"
+ROCKY_SUPPORT_PRODUCT_VERSION="8"

syft/distro/type.go

@@ -21,6 +21,7 @@ const (
 	Photon            Type = "photon"
 	Windows           Type = "windows"
 	Mariner           Type = "mariner"
+	RockyLinux        Type = "rockylinux"
 )
 
 // All contains all Linux distribution options
@@ -40,6 +41,7 @@ var All = []Type{
 	Photon,
 	Windows,
 	Mariner,
+	RockyLinux,
 }
 
 // IDMapping connects a distro ID like "ubuntu" to a Distro type
@@ -59,6 +61,7 @@ var IDMapping = map[string]Type{
 	"photon":        Photon,
 	"windows":       Windows,
 	"mariner":       Mariner,
+	"rocky":         RockyLinux,
 }
 
 // String returns the string representation of the given Linux distribution.

syft/pkg/cataloger/cataloger.go

@@ -12,6 +12,7 @@ import (
 	"github.com/anchore/syft/syft/pkg/cataloger/golang"
 	"github.com/anchore/syft/syft/pkg/cataloger/java"
 	"github.com/anchore/syft/syft/pkg/cataloger/javascript"
+	"github.com/anchore/syft/syft/pkg/cataloger/php"
 	"github.com/anchore/syft/syft/pkg/cataloger/python"
 	"github.com/anchore/syft/syft/pkg/cataloger/rpmdb"
 	"github.com/anchore/syft/syft/pkg/cataloger/ruby"
@@ -49,6 +50,7 @@ func DirectoryCatalogers() []Cataloger {
 		ruby.NewGemFileLockCataloger(),
 		python.NewPythonIndexCataloger(),
 		python.NewPythonPackageCataloger(),
+		php.NewPHPIndexCataloger(),
 		javascript.NewJavascriptLockCataloger(),
 		deb.NewDpkgdbCataloger(),
 		rpmdb.NewRpmdbCataloger(),

syft/pkg/cataloger/php/index_cataloger.go

@@ -0,0 +1,17 @@
+/*
+Package python provides a concrete Cataloger implementation for Python ecosystem files (egg, wheel, requirements.txt).
+*/
+package php
+
+import (
+	"github.com/anchore/syft/syft/pkg/cataloger/common"
+)
+
+// NewPythonIndexCataloger returns a new cataloger for python packages referenced from poetry lock files, requirements.txt files, and setup.py files.
+func NewPHPIndexCataloger() *common.GenericCataloger {
+	globParsers := map[string]common.ParserFn{
+		"**/composer.lock": parseComposerLock,
+	}
+
+	return common.NewGenericCataloger(nil, globParsers, "php-index-cataloger")
+}

syft/pkg/cataloger/php/parse_composer_lock.go

@@ -0,0 +1,50 @@
+package php
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/common"
+)
+
+type ComposerLock struct {
+	Packages   []Dependency `json:"packages"`
+	PackageDev []Dependency `json:"packages-dev"`
+}
+
+type Dependency struct {
+	Name    string `json:"name"`
+	Version string `json:"version"`
+}
+
+// integrity check
+var _ common.ParserFn = parseComposerLock
+
+// parseComposerLock is a parser function for Composer.lock contents, returning "Default" php packages discovered.
+func parseComposerLock(_ string, reader io.Reader) ([]pkg.Package, error) {
+	packages := make([]pkg.Package, 0)
+	dec := json.NewDecoder(reader)
+
+	for {
+		var lock ComposerLock
+		if err := dec.Decode(&lock); err == io.EOF {
+			break
+		} else if err != nil {
+			return nil, fmt.Errorf("failed to parse composer.lock file: %w", err)
+		}
+		for _, pkgMeta := range lock.Packages {
+			version := pkgMeta.Version
+			name := pkgMeta.Name
+			packages = append(packages, pkg.Package{
+				Name:     name,
+				Version:  version,
+				Language: pkg.PHP,
+				Type:     pkg.PhpComposerPkg,
+			})
+		}
+	}
+
+	return packages, nil
+}

syft/pkg/cataloger/php/parse_composer_lock_test.go

@@ -0,0 +1,40 @@
+package php
+
+import (
+	"os"
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/go-test/deep"
+)
+
+func TestParseComposerFileLock(t *testing.T) {
+	expected := []pkg.Package{
+		{
+			Name:     "adoy/fastcgi-client",
+			Version:  "1.0.2",
+			Language: pkg.PHP,
+			Type:     pkg.PhpComposerPkg,
+		},
+		{
+			Name:     "alcaeus/mongo-php-adapter",
+			Version:  "1.1.11",
+			Language: pkg.PHP,
+			Type:     pkg.PhpComposerPkg,
+		},
+	}
+	fixture, err := os.Open("test-fixtures/composer.lock")
+	if err != nil {
+		t.Fatalf("failed to open fixture: %+v", err)
+	}
+
+	actual, err := parseComposerLock(fixture.Name(), fixture)
+	if err != nil {
+		t.Fatalf("failed to parse requirements: %+v", err)
+	}
+	differences := deep.Equal(expected, actual)
+	if differences != nil {
+		t.Errorf("returned package list differed from expectation: %+v", differences)
+	}
+
+}

syft/pkg/cataloger/php/test-fixtures/composer.lock

@@ -0,0 +1,298 @@
+{
+    "_readme": [
+        "This file locks the dependencies of your project to a known state",
+        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
+        "This file is @generated automatically"
+    ],
+    "content-hash": "746ba78c06aef0cf954135ea909f9eb9",
+    "packages": [
+        {
+            "name": "adoy/fastcgi-client",
+            "version": "1.0.2",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/adoy/PHP-FastCGI-Client.git",
+                "reference": "6d9a552f0206a1db7feb442824540aa6c55e5b27"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/adoy/PHP-FastCGI-Client/zipball/6d9a552f0206a1db7feb442824540aa6c55e5b27",
+                "reference": "6d9a552f0206a1db7feb442824540aa6c55e5b27",
+                "shasum": ""
+            },
+            "type": "library",
+            "autoload": {
+                "psr-0": {
+                    "Adoy\\FastCGI\\": "src"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Pierrick Charron",
+                    "email": "pierrick@adoy.net"
+                }
+            ],
+            "description": "Lightweight, single file FastCGI client for PHP.",
+            "keywords": [
+                "fastcgi",
+                "fcgi"
+            ],
+            "time": "2019-12-11T13:49:21+00:00"
+        },
+        {
+            "name": "alcaeus/mongo-php-adapter",
+            "version": "1.1.11",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/alcaeus/mongo-php-adapter.git",
+                "reference": "43b6add94c8b4cb9890d662cba4c0defde733dcf"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/alcaeus/mongo-php-adapter/zipball/43b6add94c8b4cb9890d662cba4c0defde733dcf",
+                "reference": "43b6add94c8b4cb9890d662cba4c0defde733dcf",
+                "shasum": ""
+            },
+            "require": {
+                "ext-ctype": "*",
+                "ext-hash": "*",
+                "ext-mongodb": "^1.2.0",
+                "mongodb/mongodb": "^1.0.1",
+                "php": "^5.6 || ^7.0"
+            },
+            "provide": {
+                "ext-mongo": "1.6.14"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^5.7.27 || ^6.0 || ^7.0",
+                "squizlabs/php_codesniffer": "^3.2"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "1.1.x-dev"
+                }
+            },
+            "autoload": {
+                "psr-0": {
+                    "Mongo": "lib/Mongo"
+                },
+                "psr-4": {
+                    "Alcaeus\\MongoDbAdapter\\": "lib/Alcaeus/MongoDbAdapter"
+                },
+                "files": [
+                    "lib/Mongo/functions.php"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "alcaeus",
+                    "email": "alcaeus@alcaeus.org"
+                },
+                {
+                    "name": "Olivier Lechevalier",
+                    "email": "olivier.lechevalier@gmail.com"
+                }
+            ],
+            "description": "Adapter to provide ext-mongo interface on top of mongo-php-libary",
+            "keywords": [
+                "database",
+                "mongodb"
+            ],
+            "time": "2019-11-11T20:47:32+00:00"
+        }
+    ],
+    "packages-dev": [
+        {
+            "name": "behat/gherkin",
+            "version": "v4.6.2",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/Behat/Gherkin.git",
+                "reference": "51ac4500c4dc30cbaaabcd2f25694299df666a31"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/Behat/Gherkin/zipball/51ac4500c4dc30cbaaabcd2f25694299df666a31",
+                "reference": "51ac4500c4dc30cbaaabcd2f25694299df666a31",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=5.3.1"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "~4.5|~5",
+                "symfony/phpunit-bridge": "~2.7|~3|~4",
+                "symfony/yaml": "~2.3|~3|~4"
+            },
+            "suggest": {
+                "symfony/yaml": "If you want to parse features, represented in YAML files"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "4.4-dev"
+                }
+            },
+            "autoload": {
+                "psr-0": {
+                    "Behat\\Gherkin": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Konstantin Kudryashov",
+                    "email": "ever.zet@gmail.com",
+                    "homepage": "http://everzet.com"
+                }
+            ],
+            "description": "Gherkin DSL parser for PHP 5.3",
+            "homepage": "http://behat.org/",
+            "keywords": [
+                "BDD",
+                "Behat",
+                "Cucumber",
+                "DSL",
+                "gherkin",
+                "parser"
+            ],
+            "time": "2020-03-17T14:03:26+00:00"
+        },
+        {
+            "name": "codeception/codeception",
+            "version": "4.1.6",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/Codeception/Codeception.git",
+                "reference": "5515b6a6c6f1e1c909aaff2e5f3a15c177dfd1a9"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/Codeception/Codeception/zipball/5515b6a6c6f1e1c909aaff2e5f3a15c177dfd1a9",
+                "reference": "5515b6a6c6f1e1c909aaff2e5f3a15c177dfd1a9",
+                "shasum": ""
+            },
+            "require": {
+                "behat/gherkin": "^4.4.0",
+                "codeception/lib-asserts": "^1.0",
+                "codeception/phpunit-wrapper": ">6.0.15 <6.1.0 | ^6.6.1 | ^7.7.1 | ^8.1.1 | ^9.0",
+                "codeception/stub": "^2.0 | ^3.0",
+                "ext-curl": "*",
+                "ext-json": "*",
+                "ext-mbstring": "*",
+                "guzzlehttp/psr7": "~1.4",
+                "php": ">=5.6.0 <8.0",
+                "symfony/console": ">=2.7 <6.0",
+                "symfony/css-selector": ">=2.7 <6.0",
+                "symfony/event-dispatcher": ">=2.7 <6.0",
+                "symfony/finder": ">=2.7 <6.0",
+                "symfony/yaml": ">=2.7 <6.0"
+            },
+            "require-dev": {
+                "codeception/module-asserts": "*@dev",
+                "codeception/module-cli": "*@dev",
+                "codeception/module-db": "*@dev",
+                "codeception/module-filesystem": "*@dev",
+                "codeception/module-phpbrowser": "*@dev",
+                "codeception/specify": "~0.3",
+                "codeception/util-universalframework": "*@dev",
+                "monolog/monolog": "~1.8",
+                "squizlabs/php_codesniffer": "~2.0",
+                "symfony/process": ">=2.7 <6.0",
+                "vlucas/phpdotenv": "^2.0 | ^3.0 | ^4.0"
+            },
+            "suggest": {
+                "codeception/specify": "BDD-style code blocks",
+                "codeception/verify": "BDD-style assertions",
+                "hoa/console": "For interactive console functionality",
+                "stecman/symfony-console-completion": "For BASH autocompletion",
+                "symfony/phpunit-bridge": "For phpunit-bridge support"
+            },
+            "bin": [
+                "codecept"
+            ],
+            "type": "library",
+            "extra": {
+                "branch-alias": []
+            },
+            "autoload": {
+                "psr-4": {
+                    "Codeception\\": "src/Codeception",
+                    "Codeception\\Extension\\": "ext"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Michael Bodnarchuk",
+                    "email": "davert@mail.ua",
+                    "homepage": "http://codegyre.com"
+                }
+            ],
+            "description": "BDD-style testing framework",
+            "homepage": "http://codeception.com/",
+            "keywords": [
+                "BDD",
+                "TDD",
+                "acceptance testing",
+                "functional testing",
+                "unit testing"
+            ],
+            "time": "2020-06-07T16:31:51+00:00"
+        }
+    ],
+    "aliases": [],
+    "minimum-stability": "stable",
+    "stability-flags": {
+        "intelligence/bt-base": 20,
+        "intelligence/bt-common": 20,
+        "intelligence/bt-lib-tools": 20,
+        "intelligence/ci-lib-cache": 20,
+        "intelligence/ci-lib-client": 20,
+        "intelligence/ci-lib-contributed": 20,
+        "intelligence/ci-lib-eav": 20,
+        "intelligence/ci-lib-report": 20,
+        "intelligence/git-leaks-elastic-client": 20,
+        "intelligence/phishing-elastic-client": 20,
+        "libs/gib-sso-client": 20,
+        "mozhin/phplib": 20
+    },
+    "prefer-stable": false,
+    "prefer-lowest": false,
+    "platform": {
+        "php": "^7.4.0",
+        "ext-amqp": "^1.9",
+        "ext-ctype": "*",
+        "ext-curl": "^7.4",
+        "ext-date": "^7.4",
+        "ext-fileinfo": "*",
+        "ext-geoip": "^1.1",
+        "ext-gettext": "*",
+        "ext-iconv": "*",
+        "ext-imagick": "^3.4",
+        "ext-imap": "^7.4",
+        "ext-intl": "^7.4",
+        "ext-json": "*",
+        "ext-mbstring": "^7.4",
+        "ext-mongodb": "^1.4",
+        "ext-mysqli": "^7.4",
+        "ext-pdo_mysql": "^7.4",
+        "ext-redis": ">=3.1"
+    },
+    "platform-dev": []
+}

syft/pkg/language.go

@@ -9,6 +9,7 @@ const (
 	Java            Language = "java"
 	JavaScript      Language = "javascript"
 	Python          Language = "python"
+	PHP             Language = "php"
 	Ruby            Language = "ruby"
 	Go              Language = "go"
 	Rust            Language = "rust"
@@ -19,6 +20,7 @@ var AllLanguages = []Language{
 	Java,
 	JavaScript,
 	Python,
+	PHP,
 	Ruby,
 	Go,
 	Rust,

syft/pkg/type.go

@@ -14,6 +14,7 @@ const (
 	RpmPkg           Type = "rpm"
 	NpmPkg           Type = "npm"
 	PythonPkg        Type = "python"
+	PhpComposerPkg   Type = "php-composer"
 	JavaPkg          Type = "java-archive"
 	JenkinsPluginPkg Type = "jenkins-plugin"
 	GoModulePkg      Type = "go-module"
@@ -29,6 +30,7 @@ var AllPkgs = []Type{
 	RpmPkg,
 	NpmPkg,
 	PythonPkg,
+	PhpComposerPkg,
 	JavaPkg,
 	JenkinsPluginPkg,
 	GoModulePkg,
@@ -47,6 +49,8 @@ func (t Type) PackageURLType() string {
 		return "deb"
 	case PythonPkg:
 		return packageurl.TypePyPi
+	case PhpComposerPkg:
+		return packageurl.TypeComposer
 	case NpmPkg:
 		return packageurl.TypeNPM
 	case JavaPkg, JenkinsPluginPkg:

syft/source/source.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/stereoscope/pkg/image"
+	"github.com/anchore/syft/internal/log"
 	"github.com/spf13/afero"
 )
 
@@ -35,55 +36,75 @@ func New(userInput string, registryOptions *image.RegistryOptions) (*Source, fun
 
 	switch parsedScheme {
 	case FileScheme:
-		fileMeta, err := fs.Stat(location)
-		if err != nil {
-			return &Source{}, func() {}, fmt.Errorf("unable to stat dir=%q: %w", location, err)
-		}
-
-		if fileMeta.IsDir() {
-			return &Source{}, func() {}, fmt.Errorf("given path is not a directory (path=%q): %w", location, err)
-		}
-
-		s, err := NewFromFile(location)
-		if err != nil {
-			return &Source{}, func() {}, fmt.Errorf("could not populate source from path=%q: %w", location, err)
-		}
-		return &s, func() {}, nil
-
+		return generateFileSource(fs, location)
 	case DirectoryScheme:
-		fileMeta, err := fs.Stat(location)
-		if err != nil {
-			return &Source{}, func() {}, fmt.Errorf("unable to stat dir=%q: %w", location, err)
-		}
-
-		if !fileMeta.IsDir() {
-			return &Source{}, func() {}, fmt.Errorf("given path is not a directory (path=%q): %w", location, err)
-		}
-
-		s, err := NewFromDirectory(location)
-		if err != nil {
-			return &Source{}, func() {}, fmt.Errorf("could not populate source from path=%q: %w", location, err)
-		}
-		return &s, func() {}, nil
-
+		return generateDirectorySource(fs, location)
 	case ImageScheme:
-		img, err := stereoscope.GetImageFromSource(location, imageSource, registryOptions)
-		cleanup := stereoscope.Cleanup
-
-		if err != nil || img == nil {
-			return &Source{}, cleanup, fmt.Errorf("could not fetch image '%s': %w", location, err)
-		}
-
-		s, err := NewFromImage(img, location)
-		if err != nil {
-			return &Source{}, cleanup, fmt.Errorf("could not populate source with image: %w", err)
-		}
-		return &s, cleanup, nil
+		return generateImageSource(location, userInput, imageSource, registryOptions)
 	}
 
 	return &Source{}, func() {}, fmt.Errorf("unable to process input for scanning: '%s'", userInput)
 }
 
+func generateImageSource(location, userInput string, imageSource image.Source, registryOptions *image.RegistryOptions) (*Source, func(), error) {
+	img, err := stereoscope.GetImageFromSource(location, imageSource, registryOptions)
+	if err != nil {
+		log.Debugf("error parsing location: %s after detecting scheme; pulling image: %s", location, userInput)
+		// we may have been to aggressive reading the source hint
+		// try the input as supplied by the user if our initial parse failed
+		img, err = stereoscope.GetImageFromSource(userInput, imageSource, registryOptions)
+	}
+
+	cleanup := stereoscope.Cleanup
+
+	if err != nil || img == nil {
+		return &Source{}, cleanup, fmt.Errorf("could not fetch image '%s': %w", location, err)
+	}
+
+	s, err := NewFromImage(img, location)
+	if err != nil {
+		return &Source{}, cleanup, fmt.Errorf("could not populate source with image: %w", err)
+	}
+
+	return &s, cleanup, nil
+}
+
+func generateDirectorySource(fs afero.Fs, location string) (*Source, func(), error) {
+	fileMeta, err := fs.Stat(location)
+	if err != nil {
+		return &Source{}, func() {}, fmt.Errorf("unable to stat dir=%q: %w", location, err)
+	}
+
+	if !fileMeta.IsDir() {
+		return &Source{}, func() {}, fmt.Errorf("given path is not a directory (path=%q): %w", location, err)
+	}
+
+	s, err := NewFromDirectory(location)
+	if err != nil {
+		return &Source{}, func() {}, fmt.Errorf("could not populate source from path=%q: %w", location, err)
+	}
+
+	return &s, func() {}, nil
+}
+
+func generateFileSource(fs afero.Fs, location string) (*Source, func(), error) {
+	fileMeta, err := fs.Stat(location)
+	if err != nil {
+		return &Source{}, func() {}, fmt.Errorf("unable to stat dir=%q: %w", location, err)
+	}
+
+	if fileMeta.IsDir() {
+		return &Source{}, func() {}, fmt.Errorf("given path is not a directory (path=%q): %w", location, err)
+	}
+
+	s, err := NewFromFile(location)
+	if err != nil {
+		return &Source{}, func() {}, fmt.Errorf("could not populate source from path=%q: %w", location, err)
+	}
+
+	return &s, func() {}, nil
+}
+
 // NewFromDirectory creates a new source object tailored to catalog a given filesystem directory recursively.
 func NewFromDirectory(path string) (Source, error) {
 	return Source{

test/integration/catalog_packages_cases_test.go

@@ -167,6 +167,15 @@ var dirOnlyTestCases = []testCase{
 			"libc-utils": "0.7.2-r0",
 		},
 	},
+	{
+		name:        "find php composer package",
+		pkgType:     pkg.PhpComposerPkg,
+		pkgLanguage: pkg.PHP,
+		pkgInfo: map[string]string{
+			"adoy/fastcgi-client":       "1.0.2",
+			"alcaeus/mongo-php-adapter": "1.1.11",
+		},
+	},
 }
 
 var commonTestCases = []testCase{

test/integration/catalog_packages_test.go

@@ -57,9 +57,10 @@ func TestPkgCoverageImage(t *testing.T) {
 		definedLanguages.Add(l.String())
 	}
 
-	// for image we remove the go mod and rust support by default
+	// for image scans we should not expect to see any of the following package types
 	definedLanguages.Remove(pkg.Go.String())
 	definedLanguages.Remove(pkg.Rust.String())
+	definedLanguages.Remove(pkg.PHP.String())
 
 	observedPkgs := internal.NewStringSet()
 	definedPkgs := internal.NewStringSet()
@@ -67,10 +68,11 @@ func TestPkgCoverageImage(t *testing.T) {
 		definedPkgs.Add(string(p))
 	}
 
-	// for image we remove the go-module and rust-crate support by default
+	// for image scans we should not expect to see any of the following package types
 	definedPkgs.Remove(string(pkg.KbPkg))
 	definedPkgs.Remove(string(pkg.GoModulePkg))
 	definedPkgs.Remove(string(pkg.RustPkg))
+	definedPkgs.Remove(string(pkg.PhpComposerPkg))
 
 	var cases []testCase
 	cases = append(cases, commonTestCases...)
@@ -195,6 +197,8 @@ func TestPkgCoverageDirectory(t *testing.T) {
 	definedLanguages.Remove(pkg.UnknownLanguage.String())
 	observedPkgs.Remove(string(pkg.UnknownPkg))
 	definedPkgs.Remove(string(pkg.UnknownPkg))
+
+	// for directory scans we should not expect to see any of the following package types
 	definedPkgs.Remove(string(pkg.KbPkg))
 
 	// ensure that integration test commonTestCases stay in sync with the available catalogers

test/integration/test-fixtures/image-pkg-coverage/composer/composer.lock

@@ -0,0 +1,298 @@
+{
+    "_readme": [
+        "This file locks the dependencies of your project to a known state",
+        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
+        "This file is @generated automatically"
+    ],
+    "content-hash": "746ba78c06aef0cf954135ea909f9eb9",
+    "packages": [
+        {
+            "name": "adoy/fastcgi-client",
+            "version": "1.0.2",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/adoy/PHP-FastCGI-Client.git",
+                "reference": "6d9a552f0206a1db7feb442824540aa6c55e5b27"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/adoy/PHP-FastCGI-Client/zipball/6d9a552f0206a1db7feb442824540aa6c55e5b27",
+                "reference": "6d9a552f0206a1db7feb442824540aa6c55e5b27",
+                "shasum": ""
+            },
+            "type": "library",
+            "autoload": {
+                "psr-0": {
+                    "Adoy\\FastCGI\\": "src"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Pierrick Charron",
+                    "email": "pierrick@adoy.net"
+                }
+            ],
+            "description": "Lightweight, single file FastCGI client for PHP.",
+            "keywords": [
+                "fastcgi",
+                "fcgi"
+            ],
+            "time": "2019-12-11T13:49:21+00:00"
+        },
+        {
+            "name": "alcaeus/mongo-php-adapter",
+            "version": "1.1.11",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/alcaeus/mongo-php-adapter.git",
+                "reference": "43b6add94c8b4cb9890d662cba4c0defde733dcf"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/alcaeus/mongo-php-adapter/zipball/43b6add94c8b4cb9890d662cba4c0defde733dcf",
+                "reference": "43b6add94c8b4cb9890d662cba4c0defde733dcf",
+                "shasum": ""
+            },
+            "require": {
+                "ext-ctype": "*",
+                "ext-hash": "*",
+                "ext-mongodb": "^1.2.0",
+                "mongodb/mongodb": "^1.0.1",
+                "php": "^5.6 || ^7.0"
+            },
+            "provide": {
+                "ext-mongo": "1.6.14"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^5.7.27 || ^6.0 || ^7.0",
+                "squizlabs/php_codesniffer": "^3.2"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "1.1.x-dev"
+                }
+            },
+            "autoload": {
+                "psr-0": {
+                    "Mongo": "lib/Mongo"
+                },
+                "psr-4": {
+                    "Alcaeus\\MongoDbAdapter\\": "lib/Alcaeus/MongoDbAdapter"
+                },
+                "files": [
+                    "lib/Mongo/functions.php"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "alcaeus",
+                    "email": "alcaeus@alcaeus.org"
+                },
+                {
+                    "name": "Olivier Lechevalier",
+                    "email": "olivier.lechevalier@gmail.com"
+                }
+            ],
+            "description": "Adapter to provide ext-mongo interface on top of mongo-php-libary",
+            "keywords": [
+                "database",
+                "mongodb"
+            ],
+            "time": "2019-11-11T20:47:32+00:00"
+        }
+    ],
+    "packages-dev": [
+        {
+            "name": "behat/gherkin",
+            "version": "v4.6.2",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/Behat/Gherkin.git",
+                "reference": "51ac4500c4dc30cbaaabcd2f25694299df666a31"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/Behat/Gherkin/zipball/51ac4500c4dc30cbaaabcd2f25694299df666a31",
+                "reference": "51ac4500c4dc30cbaaabcd2f25694299df666a31",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=5.3.1"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "~4.5|~5",
+                "symfony/phpunit-bridge": "~2.7|~3|~4",
+                "symfony/yaml": "~2.3|~3|~4"
+            },
+            "suggest": {
+                "symfony/yaml": "If you want to parse features, represented in YAML files"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "4.4-dev"
+                }
+            },
+            "autoload": {
+                "psr-0": {
+                    "Behat\\Gherkin": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Konstantin Kudryashov",
+                    "email": "ever.zet@gmail.com",
+                    "homepage": "http://everzet.com"
+                }
+            ],
+            "description": "Gherkin DSL parser for PHP 5.3",
+            "homepage": "http://behat.org/",
+            "keywords": [
+                "BDD",
+                "Behat",
+                "Cucumber",
+                "DSL",
+                "gherkin",
+                "parser"
+            ],
+            "time": "2020-03-17T14:03:26+00:00"
+        },
+        {
+            "name": "codeception/codeception",
+            "version": "4.1.6",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/Codeception/Codeception.git",
+                "reference": "5515b6a6c6f1e1c909aaff2e5f3a15c177dfd1a9"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/Codeception/Codeception/zipball/5515b6a6c6f1e1c909aaff2e5f3a15c177dfd1a9",
+                "reference": "5515b6a6c6f1e1c909aaff2e5f3a15c177dfd1a9",
+                "shasum": ""
+            },
+            "require": {
+                "behat/gherkin": "^4.4.0",
+                "codeception/lib-asserts": "^1.0",
+                "codeception/phpunit-wrapper": ">6.0.15 <6.1.0 | ^6.6.1 | ^7.7.1 | ^8.1.1 | ^9.0",
+                "codeception/stub": "^2.0 | ^3.0",
+                "ext-curl": "*",
+                "ext-json": "*",
+                "ext-mbstring": "*",
+                "guzzlehttp/psr7": "~1.4",
+                "php": ">=5.6.0 <8.0",
+                "symfony/console": ">=2.7 <6.0",
+                "symfony/css-selector": ">=2.7 <6.0",
+                "symfony/event-dispatcher": ">=2.7 <6.0",
+                "symfony/finder": ">=2.7 <6.0",
+                "symfony/yaml": ">=2.7 <6.0"
+            },
+            "require-dev": {
+                "codeception/module-asserts": "*@dev",
+                "codeception/module-cli": "*@dev",
+                "codeception/module-db": "*@dev",
+                "codeception/module-filesystem": "*@dev",
+                "codeception/module-phpbrowser": "*@dev",
+                "codeception/specify": "~0.3",
+                "codeception/util-universalframework": "*@dev",
+                "monolog/monolog": "~1.8",
+                "squizlabs/php_codesniffer": "~2.0",
+                "symfony/process": ">=2.7 <6.0",
+                "vlucas/phpdotenv": "^2.0 | ^3.0 | ^4.0"
+            },
+            "suggest": {
+                "codeception/specify": "BDD-style code blocks",
+                "codeception/verify": "BDD-style assertions",
+                "hoa/console": "For interactive console functionality",
+                "stecman/symfony-console-completion": "For BASH autocompletion",
+                "symfony/phpunit-bridge": "For phpunit-bridge support"
+            },
+            "bin": [
+                "codecept"
+            ],
+            "type": "library",
+            "extra": {
+                "branch-alias": []
+            },
+            "autoload": {
+                "psr-4": {
+                    "Codeception\\": "src/Codeception",
+                    "Codeception\\Extension\\": "ext"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Michael Bodnarchuk",
+                    "email": "davert@mail.ua",
+                    "homepage": "http://codegyre.com"
+                }
+            ],
+            "description": "BDD-style testing framework",
+            "homepage": "http://codeception.com/",
+            "keywords": [
+                "BDD",
+                "TDD",
+                "acceptance testing",
+                "functional testing",
+                "unit testing"
+            ],
+            "time": "2020-06-07T16:31:51+00:00"
+        }
+    ],
+    "aliases": [],
+    "minimum-stability": "stable",
+    "stability-flags": {
+        "intelligence/bt-base": 20,
+        "intelligence/bt-common": 20,
+        "intelligence/bt-lib-tools": 20,
+        "intelligence/ci-lib-cache": 20,
+        "intelligence/ci-lib-client": 20,
+        "intelligence/ci-lib-contributed": 20,
+        "intelligence/ci-lib-eav": 20,
+        "intelligence/ci-lib-report": 20,
+        "intelligence/git-leaks-elastic-client": 20,
+        "intelligence/phishing-elastic-client": 20,
+        "libs/gib-sso-client": 20,
+        "mozhin/phplib": 20
+    },
+    "prefer-stable": false,
+    "prefer-lowest": false,
+    "platform": {
+        "php": "^7.4.0",
+        "ext-amqp": "^1.9",
+        "ext-ctype": "*",
+        "ext-curl": "^7.4",
+        "ext-date": "^7.4",
+        "ext-fileinfo": "*",
+        "ext-geoip": "^1.1",
+        "ext-gettext": "*",
+        "ext-iconv": "*",
+        "ext-imagick": "^3.4",
+        "ext-imap": "^7.4",
+        "ext-intl": "^7.4",
+        "ext-json": "*",
+        "ext-mbstring": "^7.4",
+        "ext-mongodb": "^1.4",
+        "ext-mysqli": "^7.4",
+        "ext-pdo_mysql": "^7.4",
+        "ext-redis": ">=3.1"
+    },
+    "platform-dev": []
+}