feat: add relationships to ELF package discovery (#2715)

This PR adds DependencyOf relationships when ELF packages have been discovered by the binary cataloger. The discovered file.Executable type has a []ImportedLibraries that's read from the file when discovered by syft. By mapping these imported libraries back to the package collection, syft is able to create relationships showing which packages are dependencies of other packages by just reading metadata from the ELF executable.

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Brian Ebarb <ebarb.brian@sers.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>

.github/actions/bootstrap/action.yaml

@@ -27,7 +27,7 @@ runs:
   using: "composite"
   steps:
     # note: go mod and build is automatically cached on default with v4+
-    - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe #v4.1.0
+    - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 #v5.0.1
       if: inputs.go-version != ''
       with:
         go-version: ${{ inputs.go-version }}

.github/scripts/update-version-file.sh

@@ -2,8 +2,8 @@
 set -ue
 
 BIN="syft"
-DISTDIR=$1
-VERSION=$2
+VERSION_FILE="VERSION"
+VERSION=$1
 
 # the source of truth as to whether we want to notify users of an update is if the release just created is NOT
 # flagged as a pre-release on github
@@ -12,10 +12,9 @@ if [[ "$(curl -SsL https://api.github.com/repos/anchore/${BIN}/releases/tags/${V
    exit 0
 fi
 
-echo "creating and publishing version file"
+echo "creating and publishing version file (${VERSION})"
 
 # create a version file for version-update checks
-VERSION_FILE="${DISTDIR}/VERSION"
 echo "${VERSION}" | tee "${VERSION_FILE}"
 
 # upload the version file that supports the application version update check

.github/workflows/benchmark-testing.yaml

@@ -17,7 +17,7 @@ jobs:
     # the job by event.
     steps:
       - name: Checkout code
-        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+        uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap

.github/workflows/codeql-analysis.yml

@@ -36,7 +36,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
+      uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b #v4.1.5
 
     - name: Install Go
       uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 #v5.0.1
@@ -45,7 +45,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@d39d31e687223d841ef683f52467bd88e9b21c14 #v3.25.3
+      uses: github/codeql-action/init@ccf74c947955fd1cf117aef6a0e4e66191ef6f61 #v3.25.4
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -56,7 +56,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@d39d31e687223d841ef683f52467bd88e9b21c14 #v3.25.3
+      uses: github/codeql-action/autobuild@ccf74c947955fd1cf117aef6a0e4e66191ef6f61 #v3.25.4
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -70,4 +70,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@d39d31e687223d841ef683f52467bd88e9b21c14 #v3.25.3
+      uses: github/codeql-action/analyze@ccf74c947955fd1cf117aef6a0e4e66191ef6f61 #v3.25.4

.github/workflows/detect-schema-changes.yaml

@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
 
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b #v4.1.5
 
       - run: python .github/scripts/labeler.py
         env:

.github/workflows/release-homebrew.yaml

@@ -1,48 +0,0 @@
-name: "Release Homebrew"
-
-on:
-  workflow_dispatch:
-  release:
-    types:
-      - released
-
-jobs:
-  homebrew:
-    runs-on: ubuntu-20.04
-    steps:
-
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
-        with:
-          # we need to be able to get the commit for a tag
-          fetch-depth: 0
-
-      - name: Get release info
-        id: release_info
-        run: |
-          echo -n "tag_name=$(gh release view --json tagName --jq '.tagName')" | tee -a $GITHUB_OUTPUT
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Get commit info
-        id: git_info
-        run: |
-          git checkout ${{ steps.release_info.outputs.tag_name }}
-          echo -n "commit=$(git rev-parse HEAD)" | tee -a $GITHUB_OUTPUT
-
-      - name: Update Homebrew formula
-        uses: dawidd6/action-homebrew-bump-formula@baf2b60c51fc1f8453c884b0c61052668a71bd1d # v3.11.0
-        with:
-          token: ${{ secrets.HOMEBREW_TOKEN }}
-          org: anchore
-          formula: syft
-          tag: ${{ steps.release_info.outputs.tag_name }}
-          revision: ${{ steps.git_info.outputs.commit }}
-
-      - uses: 8398a7/action-slack@28ba43ae48961b90635b50953d216767a6bea486 #v3.16.2
-        if: ${{ failure() }}
-        with:
-          status: ${{ job.status }}
-          fields: repo,workflow,action,eventName
-          text: "Post-release homebrew publish workflow has failed: https://github.com/anchore/syft/actions/workflows/release-homebrew.yaml"
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }}

.github/workflows/release-version-file.yaml

@@ -0,0 +1,31 @@
+name: "Release"
+
+on:
+
+  workflow_dispatch:
+    inputs:
+      version:
+        description: release version to update the version file with (prefixed with v)
+        required: true
+
+  workflow_call:
+    inputs:
+      version:
+        type: string
+        description: release version to update the version file with (prefixed with v)
+        required: true
+
+jobs:
+
+  release:
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b #v4.1.5
+
+      - name: Update version file
+        run: make ci-release-version-file
+        env:
+          RELEASE_VERSION: ${{ github.event.inputs.version }}
+          # for updating the VERSION file in S3...
+          AWS_ACCESS_KEY_ID: ${{ secrets.TOOLBOX_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLBOX_AWS_SECRET_ACCESS_KEY }}

.github/workflows/release.yaml

@@ -15,7 +15,7 @@ jobs:
     environment: release
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b #v4.1.5
 
       - name: Check if tag already exists
         # note: this will fail if the tag already exists
@@ -97,7 +97,7 @@ jobs:
       # required for goreleaser signs section with cosign
       id-token: write
     steps:
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b #v4.1.5
         with:
           fetch-depth: 0
 
@@ -139,9 +139,6 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # for updating brew formula in anchore/homebrew-syft
           GITHUB_BREW_TOKEN: ${{ secrets.ANCHOREOPS_GITHUB_OSS_WRITE_TOKEN }}
-          # for updating the VERSION file in S3...
-          AWS_ACCESS_KEY_ID: ${{ secrets.TOOLBOX_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLBOX_AWS_SECRET_ACCESS_KEY }}
 
       - uses: anchore/sbom-action@7ccf588e3cf3cc2611714c2eeae48550fbc17552 #v0.15.11
         continue-on-error: true
@@ -157,3 +154,10 @@ jobs:
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }}
         if: ${{ success() }}
+
+  release-version-file:
+    needs: [release]
+    uses: ./.github/workflows/release-version-file.yaml
+    with:
+      version: ${{ github.event.inputs.version }}
+    secrets: inherit

.github/workflows/update-bootstrap-tools.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'anchore/syft' # only run for main repo
     steps:
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b #v4.1.5
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap

.github/workflows/update-cpe-dictionary-index.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'anchore/syft' # only run for main repo
     steps:
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b #v4.1.5
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap

.github/workflows/update-stereoscope-release.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'anchore/syft' # only run for main repo
     steps:
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b #v4.1.5
 
       - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 #v5.0.1
         with:

.github/workflows/validations.yaml

@@ -17,7 +17,7 @@ jobs:
     name: "Static analysis"
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b #v4.1.5
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -31,7 +31,7 @@ jobs:
     name: "Unit tests"
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b #v4.1.5
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -87,7 +87,7 @@ jobs:
     name: "Integration tests"
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b #v4.1.5
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -109,7 +109,7 @@ jobs:
     name: "Build snapshot artifacts"
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b #v4.1.5
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -139,7 +139,7 @@ jobs:
     needs: [Build-Snapshot-Artifacts]
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b #v4.1.5
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -187,7 +187,7 @@ jobs:
     needs: [Build-Snapshot-Artifacts]
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b #v4.1.5
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -232,7 +232,7 @@ jobs:
     needs: [Build-Snapshot-Artifacts]
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b #v4.1.5
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap

.golangci.yaml

@@ -52,10 +52,15 @@ linters-settings:
   gocritic:
     enabled-checks:
       - deferInLoop
+      - ruleguard
+    settings:
+      ruleguard:
+        rules: "test/rules/rules.go"
 output:
   uniq-by-line: false
 run:
   timeout: 10m
+  tests: false
 
 # do not enable...
 #    - deadcode          # The owner seems to have abandoned the linter. Replaced by "unused".

README.md

@@ -92,7 +92,7 @@ brew install syft
 
 ### Nix
 
-**Note**: Nix packaging of Syft is [community maintained](https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/admin/syft/default.nix). Syft is available in the [stable channel](https://nixos.wiki/wiki/Nix_channels#The_official_channels) since NixOS `22.05`.
+**Note**: Nix packaging of Syft is [community maintained](https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/admin/syft/default.nix). Syft is available in the [stable channel](https://wiki.nixos.org/wiki/Nix_channels#The_official_channels) since NixOS `22.05`.
 
 ```bash
 nix-env -i syft

Taskfile.yaml

@@ -470,6 +470,16 @@ tasks:
         silent: true
       - "{{ .RELEASE_CMD }}"
 
+  ci-release-version-file:
+    # desc: "[CI only] Update the version file"
+    deps: [tools]
+    cmds:
+      - task: ci-check
+      - ".github/scripts/update-version-file.sh {{ .RELEASE_VERSION }}"
+    requires:
+      vars:
+        - RELEASE_VERSION
+
 
   ## Cleanup targets #################################
 

cmd/syft/internal/test/integration/package_binary_elf_relationships_test.go

@@ -0,0 +1,65 @@
+package integration
+
+import (
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/source"
+	"github.com/stretchr/testify/require"
+	"testing"
+)
+
+func TestBinaryElfRelationships(t *testing.T) {
+	// node --> ["dependency of" nodes]
+	expectedGraph := map[string][]string{
+		"glibc": {
+			"libhello_world.so",
+			"syfttestfixture",
+		},
+		"libstdc++": {
+			"syfttestfixture",
+		},
+		"libhello_world.so": {
+			"syfttestfixture",
+		},
+	}
+
+	// run the test...
+	sbom, _ := catalogFixtureImage(t, "elf-test-fixtures", source.SquashedScope)
+
+	// get a mapping of package names to their IDs
+	nameToId := map[string]artifact.ID{}
+
+	recordPkgId := func(name string) {
+		pkgs := sbom.Artifacts.Packages.PackagesByName(name)
+		require.NotEmpty(t, pkgs, "expected package %q to be present in the SBOM", name)
+		for _, p := range pkgs {
+			nameToId[p.Name] = p.ID()
+		}
+	}
+	for name, depNames := range expectedGraph {
+		recordPkgId(name)
+		for _, depName := range depNames {
+			recordPkgId(depName)
+		}
+	}
+
+	for name, expectedDepNames := range expectedGraph {
+		pkgId := nameToId[name]
+		p := sbom.Artifacts.Packages.Package(pkgId)
+		require.NotNil(t, p, "expected package %q to be present in the SBOM", name)
+
+		rels := sbom.RelationshipsForPackage(*p, artifact.DependencyOfRelationship)
+		require.NotEmpty(t, rels, "expected package %q to have relationships", name)
+
+		toIds := map[artifact.ID]struct{}{}
+		for _, rel := range rels {
+			toIds[rel.To.ID()] = struct{}{}
+		}
+
+		for _, depName := range expectedDepNames {
+			depId := nameToId[depName]
+			_, exists := toIds[depId]
+			require.True(t, exists, "expected package %q to have a relationship to %q", name, depName)
+		}
+	}
+
+}

cmd/syft/internal/test/integration/test-fixtures/elf-test-fixtures

@@ -0,0 +1 @@
+../../../../../../syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures

cmd/syft/internal/test/integration/utils_test.go

@@ -32,7 +32,6 @@ func catalogFixtureImageWithConfig(t *testing.T, fixtureImageName string, cfg *s
 	cfg.CatalogerSelection = cfg.CatalogerSelection.WithDefaults(pkgcataloging.ImageTag)
 
 	// get the fixture image tar file
-	imagetest.GetFixtureImage(t, "docker-archive", fixtureImageName)
 	tarPath := imagetest.GetFixtureImageTarPath(t, fixtureImageName)
 
 	// get the source to build an SBOM against

go.mod

@@ -24,12 +24,12 @@ require (
 	github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46
 	github.com/bmatcuk/doublestar/v4 v4.6.1
 	github.com/charmbracelet/bubbles v0.18.0
-	github.com/charmbracelet/bubbletea v0.26.1
+	github.com/charmbracelet/bubbletea v0.26.2
 	github.com/charmbracelet/lipgloss v0.10.0
 	github.com/dave/jennifer v1.7.0
 	github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da
 	github.com/distribution/reference v0.6.0
-	github.com/docker/docker v26.1.1+incompatible
+	github.com/docker/docker v26.1.2+incompatible
 	github.com/dustin/go-humanize v1.0.1
 	github.com/elliotchance/phpserialize v1.4.0
 	github.com/facebookincubator/nvdtools v0.1.5
@@ -46,7 +46,7 @@ require (
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/iancoleman/strcase v0.3.0
 	github.com/invopop/jsonschema v0.7.0
-	github.com/jedib0t/go-pretty/v6 v6.5.8
+	github.com/jedib0t/go-pretty/v6 v6.5.9
 	github.com/jinzhu/copier v0.4.0
 	github.com/kastenhq/goversion v0.0.0-20230811215019-93b2f8823953
 	github.com/knqyf263/go-rpmdb v0.1.0
@@ -59,10 +59,11 @@ require (
 	github.com/olekukonko/tablewriter v0.0.5
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/pelletier/go-toml v1.9.5
+	github.com/quasilyte/go-ruleguard/dsl v0.3.22
 	github.com/saferwall/pe v1.5.2
 	github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d
 	github.com/sanity-io/litter v1.5.5
-	github.com/sassoftware/go-rpmutils v0.3.0
+	github.com/sassoftware/go-rpmutils v0.4.0
 	// pinned to pull in 386 arch fix: https://github.com/scylladb/go-set/commit/cc7b2070d91ebf40d233207b633e28f5bd8f03a5
 	github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e
 	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3
@@ -78,11 +79,15 @@ require (
 	github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1
 	go.uber.org/goleak v1.3.0
 	golang.org/x/mod v0.17.0
-	golang.org/x/net v0.24.0
+	golang.org/x/net v0.25.0
 	gopkg.in/yaml.v3 v3.0.1
-	modernc.org/sqlite v1.29.8
+	modernc.org/sqlite v1.29.9
 )
 
+require google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17 // indirect
+
+require github.com/magiconair/properties v1.8.7
+
 require (
 	dario.cat/mergo v1.0.0 // indirect
 	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
@@ -101,7 +106,7 @@ require (
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/becheran/wildmatch-go v1.0.0 // indirect
 	github.com/charmbracelet/harmonica v0.2.0 // indirect
-	github.com/cloudflare/circl v1.3.7 // indirect
+	github.com/cloudflare/circl v1.3.8 // indirect
 	github.com/containerd/cgroups v1.1.0 // indirect
 	github.com/containerd/containerd v1.7.11 // indirect
 	github.com/containerd/continuity v0.4.2 // indirect
@@ -146,13 +151,12 @@ require (
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
-	github.com/klauspost/compress v1.17.4 // indirect
+	github.com/klauspost/compress v1.17.8 // indirect
 	github.com/klauspost/pgzip v1.2.5 // indirect
 	github.com/kr/pretty v0.3.1 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/logrusorgru/aurora v0.0.0-20200102142835-e9ef32dff381 // indirect
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
-	github.com/magiconair/properties v1.8.7 // indirect
 	github.com/maruel/natural v1.1.1 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
@@ -203,7 +207,7 @@ require (
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/tidwall/sjson v1.2.5 // indirect
-	github.com/ulikunitz/xz v0.5.11 // indirect
+	github.com/ulikunitz/xz v0.5.12 // indirect
 	github.com/vbatts/tar-split v0.11.3 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
@@ -218,15 +222,14 @@ require (
 	go.opentelemetry.io/otel/trace v1.19.0 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
 	go.uber.org/multierr v1.9.0 // indirect
-	golang.org/x/crypto v0.22.0 // indirect
+	golang.org/x/crypto v0.23.0 // indirect
 	golang.org/x/exp v0.0.0-20231108232855-2478ac86f678 // indirect
 	golang.org/x/sync v0.7.0 // indirect
-	golang.org/x/sys v0.19.0 // indirect
-	golang.org/x/term v0.19.0 // indirect
-	golang.org/x/text v0.14.0 // indirect
+	golang.org/x/sys v0.20.0 // indirect
+	golang.org/x/term v0.20.0 // indirect
+	golang.org/x/text v0.15.0 // indirect
 	golang.org/x/tools v0.19.0 // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
-	google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20231120223509-83a465c0220f // indirect
 	google.golang.org/grpc v1.59.0 // indirect
 	google.golang.org/protobuf v1.33.0 // indirect

go.sum

@@ -155,8 +155,8 @@ github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL
 github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/charmbracelet/bubbles v0.18.0 h1:PYv1A036luoBGroX6VWjQIE9Syf2Wby2oOl/39KLfy0=
 github.com/charmbracelet/bubbles v0.18.0/go.mod h1:08qhZhtIwzgrtBjAcJnij1t1H0ZRjwHyGsy6AL11PSw=
-github.com/charmbracelet/bubbletea v0.26.1 h1:xujcQeF73rh4jwu3+zhfQsvV18x+7zIjlw7/CYbzGJ0=
-github.com/charmbracelet/bubbletea v0.26.1/go.mod h1:FzKr7sKoO8iFVcdIBM9J0sJOcQv5nDQaYwsee3kpbgo=
+github.com/charmbracelet/bubbletea v0.26.2 h1:Eeb+n75Om9gQ+I6YpbCXQRKHt5Pn4vMwusQpwLiEgJQ=
+github.com/charmbracelet/bubbletea v0.26.2/go.mod h1:6I0nZ3YHUrQj7YHIHlM8RySX4ZIthTliMY+W8X8b+Gs=
 github.com/charmbracelet/harmonica v0.2.0 h1:8NxJWRWg/bzKqqEaaeFNipOu77YR5t8aSwG4pgaUBiQ=
 github.com/charmbracelet/harmonica v0.2.0/go.mod h1:KSri/1RMQOZLbw7AHqgcBycp8pgJnQMYYT8QZRqZ1Ao=
 github.com/charmbracelet/lipgloss v0.10.0 h1:KWeXFSexGcfahHX+54URiZGkBFazf70JNMtwg/AFW3s=
@@ -168,8 +168,8 @@ github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6D
 github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
-github.com/cloudflare/circl v1.3.7 h1:qlCDlTPz2n9fu58M0Nh1J/JzcFpfgkFHHX3O35r5vcU=
-github.com/cloudflare/circl v1.3.7/go.mod h1:sRTcRWXGLrKw6yIGJ+l7amYJFfAXbZG0kBSc8r4zxgA=
+github.com/cloudflare/circl v1.3.8 h1:j+V8jJt09PoeMFIu2uh5JUyEaIHTXVOHslFoLNAKqwI=
+github.com/cloudflare/circl v1.3.8/go.mod h1:PDRU+oXvdD7KCtgKxW95M5Z8BpSCJXQORiZFnBQS5QU=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
@@ -221,8 +221,8 @@ github.com/docker/cli v24.0.0+incompatible h1:0+1VshNwBQzQAx9lOl+OYCTCEAD8fKs/qe
 github.com/docker/cli v24.0.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v26.1.1+incompatible h1:oI+4kkAgIwwb54b9OC7Xc3hSgu1RlJA/Lln/DF72djQ=
-github.com/docker/docker v26.1.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v26.1.2+incompatible h1:UVX5ZOrrfTGZZYEP+ZDq3Xn9PdHNXaSYMFPDumMqG2k=
+github.com/docker/docker v26.1.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.7.0 h1:xtCHsjxogADNZcdv1pKUHXryefjlVRqWqIhk/uXJp0A=
 github.com/docker/docker-credential-helpers v0.7.0/go.mod h1:rETQfLdHNT3foU5kuNkFR1R1V12OJRRO5lzt2D1b5X0=
 github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
@@ -473,8 +473,8 @@ github.com/invopop/jsonschema v0.7.0 h1:2vgQcBz1n256N+FpX3Jq7Y17AjYt46Ig3zIWyy77
 github.com/invopop/jsonschema v0.7.0/go.mod h1:O9uiLokuu0+MGFlyiaqtWxwqJm41/+8Nj0lD7A36YH0=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
-github.com/jedib0t/go-pretty/v6 v6.5.8 h1:8BCzJdSvUbaDuRba4YVh+SKMGcAAKdkcF3SVFbrHAtQ=
-github.com/jedib0t/go-pretty/v6 v6.5.8/go.mod h1:zbn98qrYlh95FIhwwsbIip0LYpwSG8SUOScs+v9/t0E=
+github.com/jedib0t/go-pretty/v6 v6.5.9 h1:ACteMBRrrmm1gMsXe9PSTOClQ63IXDUt03H5U+UV8OU=
+github.com/jedib0t/go-pretty/v6 v6.5.9/go.mod h1:zbn98qrYlh95FIhwwsbIip0LYpwSG8SUOScs+v9/t0E=
 github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8=
 github.com/jinzhu/copier v0.4.0/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
@@ -492,8 +492,8 @@ github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
 github.com/klauspost/compress v1.11.4/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
-github.com/klauspost/compress v1.17.4 h1:Ej5ixsIri7BrIjBkRZLTo6ghwrEtHFk7ijlczPW4fZ4=
-github.com/klauspost/compress v1.17.4/go.mod h1:/dCuZOvVtNoHsyb+cuJD3itjs3NbnF6KH9zAO4BDxPM=
+github.com/klauspost/compress v1.17.8 h1:YcnTYrq7MikUT7k0Yb5eceMmALQPYBW/Xltxn0NAMnU=
+github.com/klauspost/compress v1.17.8/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/pgzip v1.2.5 h1:qnWYvvKqedOF2ulHpMG72XQol4ILEJ8k2wwRl/Km8oE=
 github.com/klauspost/pgzip v1.2.5/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
@@ -544,8 +544,6 @@ github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m
 github.com/mattn/go-runewidth v0.0.12/go.mod h1:RAqKPSqVFrSLVXbA8x7dzmKdmGzieGRCM46jaSJTDAk=
 github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZgg3U=
 github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
-github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU=
-github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
@@ -660,6 +658,8 @@ github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+Gx
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
 github.com/prometheus/procfs v0.8.0 h1:ODq8ZFEaYeCaZOJlZZdJA2AbQR98dSHSM1KW/You5mo=
 github.com/prometheus/procfs v0.8.0/go.mod h1:z7EfXMXOkbkqb9IINtpCn86r/to3BnA0uaxHdg830/4=
+github.com/quasilyte/go-ruleguard/dsl v0.3.22 h1:wd8zkOhSNr+I+8Qeciml08ivDt1pSXe60+5DqOpCjPE=
+github.com/quasilyte/go-ruleguard/dsl v0.3.22/go.mod h1:KeCP03KrjuSO0H1kTuZQCWlQPulDV6YMIXmpQss17rU=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
@@ -687,8 +687,8 @@ github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d h1:hrujxIzL1woJ7
 github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d/go.mod h1:uugorj2VCxiV1x+LzaIdVa9b4S4qGAcH6cbhh4qVxOU=
 github.com/sanity-io/litter v1.5.5 h1:iE+sBxPBzoK6uaEP5Lt3fHNgpKcHXc/A2HGETy0uJQo=
 github.com/sanity-io/litter v1.5.5/go.mod h1:9gzJgR2i4ZpjZHsKvUXIRQVk7P+yM3e+jAF7bU2UI5U=
-github.com/sassoftware/go-rpmutils v0.3.0 h1:tE4TZ8KcOXay5iIP64P291s6Qxd9MQCYhI7DU+f3gFA=
-github.com/sassoftware/go-rpmutils v0.3.0/go.mod h1:hM9wdxFsjUFR/tJ6SMsLrJuChcucCa0DsCzE9RMfwMo=
+github.com/sassoftware/go-rpmutils v0.4.0 h1:ojND82NYBxgwrV+mX1CWsd5QJvvEZTKddtCdFLPWhpg=
+github.com/sassoftware/go-rpmutils v0.4.0/go.mod h1:3goNWi7PGAT3/dlql2lv3+MSN5jNYPjT5mVcQcIsYzI=
 github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e h1:7q6NSFZDeGfvvtIRwBrU/aegEYJYmvev0cHAwo17zZQ=
 github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e/go.mod h1:DkpGd78rljTxKAnTDPFqXSGxvETQnJyuSOQwsHycqfs=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
@@ -777,8 +777,8 @@ github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6
 github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=
 github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/ulikunitz/xz v0.5.9/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
-github.com/ulikunitz/xz v0.5.11 h1:kpFauv27b6ynzBNT/Xy+1k+fK4WswhN/6PN5WhFAGw8=
-github.com/ulikunitz/xz v0.5.11/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
+github.com/ulikunitz/xz v0.5.12 h1:37Nm15o69RwBkXM0J6A5OlE67RZTfzUxTj8fB3dfcsc=
+github.com/ulikunitz/xz v0.5.12/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/urfave/cli v1.22.12/go.mod h1:sSBEIC79qR6OvcmsD4U3KABeOTxDqQtdDnaFuUN30b8=
 github.com/urfave/cli/v2 v2.3.0/go.mod h1:LJmUH05zAU44vOAcrfzZQKsZbVcdbOG8rtL3/XcUArI=
 github.com/vbatts/go-mtree v0.5.3 h1:S/jYlfG8rZ+a0bhZd+RANXejy7M4Js8fq9U+XoWTd5w=
@@ -867,8 +867,8 @@ golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0
 golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
-golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
+golang.org/x/crypto v0.23.0 h1:dIJU/v2J8Mdglj/8rJ6UUOM3Zc9zLZxVZwwxMooUSAI=
+golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -958,8 +958,8 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.24.0 h1:1PcaxkF854Fu3+lvBIx5SYn9wRlBzzcnHZSiaFFAb0w=
-golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
+golang.org/x/net v0.25.0 h1:d/OCCoBEUq33pjydKrGQhw7IlUPI2Oylr+8qLx49kac=
+golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1072,15 +1072,15 @@ golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.19.0 h1:q5f1RH2jigJ1MoAWp2KTp3gm5zAGFUTarQZ5U386+4o=
-golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y=
+golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.19.0 h1:+ThwsDv+tYfnJFhF4L8jITxu1tdTWRTZpdsWgEgjL6Q=
-golang.org/x/term v0.19.0/go.mod h1:2CuTdWZ7KHSQwUzKva0cbMg6q2DMI3Mmxp+gKJbskEk=
+golang.org/x/term v0.20.0 h1:VnkxpohqXaOBYJtBmEppKUG6mXpi+4O6purfc2+sMhw=
+golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1093,8 +1093,8 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.15.0 h1:h1V/4gjBv8v9cjcR6+AR5+/cIYK5N/WAgiv4xlsEtAk=
+golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1370,8 +1370,8 @@ modernc.org/opt v0.1.3 h1:3XOZf2yznlhC+ibLltsDGzABUGVx8J6pnFMS3E4dcq4=
 modernc.org/opt v0.1.3/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
 modernc.org/sortutil v1.2.0 h1:jQiD3PfS2REGJNzNCMMaLSp/wdMNieTbKX920Cqdgqc=
 modernc.org/sortutil v1.2.0/go.mod h1:TKU2s7kJMf1AE84OoiGppNHJwvB753OYfNl2WRb++Ss=
-modernc.org/sqlite v1.29.8 h1:nGKglNx9K5v0As+zF0/Gcl1kMkmaU1XynYyq92PbsC8=
-modernc.org/sqlite v1.29.8/go.mod h1:lQPm27iqa4UNZpmr4Aor0MH0HkCLbt1huYDfWylLZFk=
+modernc.org/sqlite v1.29.9 h1:9RhNMklxJs+1596GNuAX+O/6040bvOwacTxuFcRuQow=
+modernc.org/sqlite v1.29.9/go.mod h1:ItX2a1OVGgNsFh6Dv60JQvGfJfTPHPVpV6DF59akYOA=
 modernc.org/strutil v1.2.0 h1:agBi9dp1I+eOnxXeiZawM8F4LawKv4NzGWSaLfyeNZA=
 modernc.org/strutil v1.2.0/go.mod h1:/mdcBmfOibveCTBxUl5B5l6W+TTH1FXPLHZE6bTosX0=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=

internal/constants.go

@@ -3,5 +3,5 @@ package internal
 const (
 	// JSONSchemaVersion is the current schema version output by the JSON encoder
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "16.0.7"
+	JSONSchemaVersion = "16.0.8"
 )

internal/relationship/binary/binary_dependencies.go

@@ -0,0 +1,171 @@
+package binary
+
+import (
+	"path"
+
+	"github.com/anchore/syft/internal/log"
+
+	"github.com/anchore/syft/internal/sbomsync"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/sbom"
+)
+
+func NewDependencyRelationships(resolver file.Resolver, accessor sbomsync.Accessor) []artifact.Relationship {
+	// TODO: consider library format (e.g. ELF, Mach-O, PE) for the meantime assume all binaries are homogeneous format
+	// start with building new package-to-package relationships for executables-to-executables
+	// each relationship must be unique, store in a map[id]map[id]relationship to avoid duplicates
+	// 1 & 2... build an index of all shared libraries and their owning packages to search against
+	index := newShareLibIndex(resolver, accessor)
+
+	// 3. craft package-to-package relationships for each binary that represent shared library dependencies
+	//note: we only care about package-to-package relationships
+	var relIndex *relationshipIndex
+	accessor.ReadFromSBOM(func(s *sbom.SBOM) {
+		relIndex = newRelationshipIndex(s.Relationships...)
+	})
+
+	return generateRelationships(resolver, accessor, index, relIndex)
+}
+
+func generateRelationships(resolver file.Resolver, accessor sbomsync.Accessor, index *sharedLibraryIndex, relIndex *relationshipIndex) []artifact.Relationship {
+	// read all existing dependencyOf relationships
+	accessor.ReadFromSBOM(func(s *sbom.SBOM) {
+		for _, r := range s.Relationships {
+			if r.Type != artifact.DependencyOfRelationship {
+				continue
+			}
+			relIndex.track(r)
+		}
+	})
+
+	// find all package-to-package relationships for shared library dependencies
+	accessor.ReadFromSBOM(func(s *sbom.SBOM) {
+		for _, parentPkg := range s.Artifacts.Packages.Sorted(pkg.BinaryPkg) {
+			for _, evidentLocation := range parentPkg.Locations.ToSlice() {
+				if evidentLocation.Annotations[pkg.EvidenceAnnotationKey] != pkg.PrimaryEvidenceAnnotation {
+					continue
+				}
+
+				// find all libraries that this package depends on
+				exec, ok := s.Artifacts.Executables[evidentLocation.Coordinates]
+				if !ok {
+					continue
+				}
+
+				populateRelationships(exec, parentPkg, resolver, relIndex, index)
+			}
+		}
+	})
+
+	return relIndex.newRelationships()
+}
+
+// PackagesToRemove returns a list of binary packages (resolved by the ELF cataloger) that should be removed from the SBOM
+// These packages are removed because they are already represented by a higher order packages in the SBOM.
+func PackagesToRemove(resolver file.Resolver, accessor sbomsync.Accessor) []artifact.ID {
+	pkgsToDelete := make([]artifact.ID, 0)
+	accessor.ReadFromSBOM(func(s *sbom.SBOM) {
+		// OTHER > ELF > Binary
+		pkgsToDelete = append(pkgsToDelete, getBinaryPackagesToDelete(resolver, s)...)
+		pkgsToDelete = append(pkgsToDelete, compareElfBinaryPackages(resolver, s)...)
+	})
+	return pkgsToDelete
+}
+
+func compareElfBinaryPackages(resolver file.Resolver, s *sbom.SBOM) []artifact.ID {
+	pkgsToDelete := make([]artifact.ID, 0)
+	for _, p := range s.Artifacts.Packages.Sorted(pkg.BinaryPkg) {
+		for _, loc := range p.Locations.ToSlice() {
+			if loc.Annotations[pkg.EvidenceAnnotationKey] != pkg.PrimaryEvidenceAnnotation {
+				continue
+			}
+			locations, err := resolver.FilesByPath(loc.RealPath)
+			if err != nil {
+				log.WithFields("error", err).Trace("unable to find path for owned file")
+				continue
+			}
+			for _, ownedL := range locations {
+				for _, pathPkg := range s.Artifacts.Packages.PackagesByPath(ownedL.RealPath) {
+					// we only care about comparing binary packages to each other (not other types)
+					if pathPkg.Type != pkg.BinaryPkg {
+						continue
+					}
+					if _, ok := pathPkg.Metadata.(pkg.ELFBinaryPackageNoteJSONPayload); !ok {
+						pkgsToDelete = append(pkgsToDelete, pathPkg.ID())
+					}
+				}
+			}
+		}
+	}
+	return pkgsToDelete
+}
+
+func getBinaryPackagesToDelete(resolver file.Resolver, s *sbom.SBOM) []artifact.ID {
+	pkgsToDelete := make([]artifact.ID, 0)
+	for p := range s.Artifacts.Packages.Enumerate() {
+		if p.Type == pkg.BinaryPkg {
+			continue
+		}
+		fileOwner, ok := p.Metadata.(pkg.FileOwner)
+		if !ok {
+			continue
+		}
+		ownedFiles := fileOwner.OwnedFiles()
+		locations, err := resolver.FilesByPath(ownedFiles...)
+		if err != nil {
+			log.WithFields("error", err).Trace("unable to find path for owned file")
+			continue
+		}
+		for _, loc := range locations {
+			for _, pathPkg := range s.Artifacts.Packages.PackagesByPath(loc.RealPath) {
+				if pathPkg.Type == pkg.BinaryPkg {
+					pkgsToDelete = append(pkgsToDelete, pathPkg.ID())
+				}
+			}
+		}
+	}
+	return pkgsToDelete
+}
+
+func populateRelationships(exec file.Executable, parentPkg pkg.Package, resolver file.Resolver, relIndex *relationshipIndex, index *sharedLibraryIndex) {
+	for _, libReference := range exec.ImportedLibraries {
+		// for each library reference, check s.Artifacts.Packages.Sorted(pkg.BinaryPkg) for a binary package that represents that library
+		// if found, create a relationship between the parent package and the library package
+		// if not found do nothing.
+		// note: we only care about package-to-package relationships
+
+		// find the basename of the library
+		libBasename := path.Base(libReference)
+		libLocations, err := resolver.FilesByGlob("**/" + libBasename)
+		if err != nil {
+			log.WithFields("lib", libReference, "error", err).Trace("unable to resolve library basename")
+			continue
+		}
+
+		for _, loc := range libLocations {
+			// are you in our index?
+			realBaseName := path.Base(loc.RealPath)
+			pkgCollection := index.owningLibraryPackage(realBaseName)
+			if pkgCollection.PackageCount() < 1 {
+				relIndex.add(
+					artifact.Relationship{
+						From: loc.Coordinates,
+						To:   parentPkg,
+						Type: artifact.DependencyOfRelationship,
+					},
+				)
+			}
+			for _, p := range pkgCollection.Sorted() {
+				relIndex.add(
+					artifact.Relationship{
+						From: p,
+						To:   parentPkg,
+						Type: artifact.DependencyOfRelationship,
+					},
+				)
+			}
+		}
+	}
+}

internal/relationship/binary/binary_dependencies_test.go

@@ -0,0 +1,337 @@
+package binary
+
+import (
+	"path"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+
+	"github.com/anchore/syft/internal/sbomsync"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/sbom"
+)
+
+func TestPackagesToRemove(t *testing.T) {
+	glibcCoordinate := file.NewCoordinates("/usr/lib64/libc.so.6", "")
+	glibCPackage := pkg.Package{
+		Name:    "glibc",
+		Version: "2.28-236.el8_9.12",
+		Locations: file.NewLocationSet(
+			file.NewLocation(glibcCoordinate.RealPath),
+		),
+		Type: pkg.RpmPkg,
+		Metadata: pkg.RpmDBEntry{
+			Files: []pkg.RpmFileRecord{
+				{
+					Path: glibcCoordinate.RealPath,
+				},
+			},
+		},
+	}
+	glibCPackage.SetID()
+
+	glibCBinaryELFPackage := pkg.Package{
+		Name:    "glibc",
+		Version: "",
+		Locations: file.NewLocationSet(
+			file.NewLocation(glibcCoordinate.RealPath).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
+		),
+		Language: "",
+		Type:     pkg.BinaryPkg,
+		Metadata: pkg.ELFBinaryPackageNoteJSONPayload{
+			Type:       "testfixture",
+			Vendor:     "syft",
+			System:     "syftsys",
+			SourceRepo: "https://github.com/someone/somewhere.git",
+			Commit:     "5534c38d0ffef9a3f83154f0b7a7fb6ab0ab6dbb",
+		},
+	}
+	glibCBinaryELFPackage.SetID()
+
+	glibCBinaryClassifierPackage := pkg.Package{
+		Name:    "glibc",
+		Version: "",
+		Locations: file.NewLocationSet(
+			file.NewLocation(glibcCoordinate.RealPath).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.SupportingEvidenceAnnotation),
+		),
+		Language: "",
+		Type:     pkg.BinaryPkg,
+		Metadata: pkg.BinarySignature{},
+	}
+	glibCBinaryClassifierPackage.SetID()
+
+	tests := []struct {
+		name     string
+		resolver file.Resolver
+		accessor sbomsync.Accessor
+		want     []artifact.ID
+	}{
+		{
+			name:     "remove packages that are overlapping rpm --> binary",
+			resolver: file.NewMockResolverForPaths(glibcCoordinate.RealPath),
+			accessor: newAccesor([]pkg.Package{glibCPackage, glibCBinaryELFPackage}, map[file.Coordinates]file.Executable{}, nil),
+			want:     []artifact.ID{glibCBinaryELFPackage.ID()},
+		},
+		{
+			name:     "remove no packages when there is a single binary package",
+			resolver: file.NewMockResolverForPaths(glibcCoordinate.RealPath),
+			accessor: newAccesor([]pkg.Package{glibCBinaryELFPackage}, map[file.Coordinates]file.Executable{}, nil),
+			want:     []artifact.ID{},
+		},
+		{
+			name:     "remove packages when there is a single binary package and a classifier package",
+			resolver: file.NewMockResolverForPaths(glibcCoordinate.RealPath),
+			accessor: newAccesor([]pkg.Package{glibCBinaryELFPackage, glibCBinaryClassifierPackage}, map[file.Coordinates]file.Executable{}, nil),
+			want:     []artifact.ID{glibCBinaryClassifierPackage.ID()},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			pkgsToDelete := PackagesToRemove(tt.resolver, tt.accessor)
+			if diff := cmp.Diff(tt.want, pkgsToDelete); diff != "" {
+				t.Errorf("unexpected packages to delete (-want, +got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestNewDependencyRelationships(t *testing.T) {
+	// coordinates for the files under test
+	glibcCoordinate := file.NewCoordinates("/usr/lib64/libc.so.6", "")
+	secondGlibcCoordinate := file.NewCoordinates("/usr/local/lib64/libc.so.6", "")
+	nestedLibCoordinate := file.NewCoordinates("/usr/local/bin/elftests/elfbinwithnestedlib/bin/elfbinwithnestedlib", "")
+	parrallelLibCoordinate := file.NewCoordinates("/usr/local/bin/elftests/elfbinwithsisterlib/bin/elfwithparallellibbin1", "")
+
+	// rpm package that was discovered in linked section of the ELF binary package
+	glibCPackage := pkg.Package{
+		Name:    "glibc",
+		Version: "2.28-236.el8_9.12",
+		Locations: file.NewLocationSet(
+			file.NewLocation(glibcCoordinate.RealPath),
+			file.NewLocation("some/other/path"),
+		),
+		Type: pkg.RpmPkg,
+		Metadata: pkg.RpmDBEntry{
+			Files: []pkg.RpmFileRecord{
+				{
+					Path: glibcCoordinate.RealPath,
+				},
+				{
+					Path: "some/other/path",
+				},
+			},
+		},
+	}
+	glibCPackage.SetID()
+
+	// second rpm package that could be discovered in linked section of the ELF binary package (same base path as above)
+	glibCustomPackage := pkg.Package{
+		Name:      "glibc",
+		Version:   "2.28-236.el8_9.12",
+		Locations: file.NewLocationSet(file.NewLocation(secondGlibcCoordinate.RealPath)),
+		Type:      pkg.RpmPkg,
+		Metadata: pkg.RpmDBEntry{
+			Files: []pkg.RpmFileRecord{
+				{
+					Path: secondGlibcCoordinate.RealPath,
+				},
+			},
+		},
+	}
+	glibCustomPackage.SetID()
+
+	// binary package that is an executable that can link against above rpm packages
+	syftTestFixturePackage := pkg.Package{
+		Name:    "syfttestfixture",
+		Version: "0.01",
+		PURL:    "pkg:generic/syftsys/syfttestfixture@0.01",
+		FoundBy: "",
+		Locations: file.NewLocationSet(
+			file.NewLocation(nestedLibCoordinate.RealPath).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
+			file.NewLocation(parrallelLibCoordinate.RealPath).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.SupportingEvidenceAnnotation),
+		),
+		Language: "",
+		Type:     pkg.BinaryPkg,
+		Metadata: pkg.ELFBinaryPackageNoteJSONPayload{
+			Type:       "testfixture",
+			Vendor:     "syft",
+			System:     "syftsys",
+			SourceRepo: "https://github.com/someone/somewhere.git",
+			Commit:     "5534c38d0ffef9a3f83154f0b7a7fb6ab0ab6dbb",
+		},
+	}
+	syftTestFixturePackage.SetID()
+
+	// dummy executable representation of glibc
+	glibcExecutable := file.Executable{
+		Format:            "elf",
+		HasExports:        true,
+		HasEntrypoint:     true,
+		ImportedLibraries: []string{},
+	}
+
+	// executable representation of the syftTestFixturePackage
+	syftTestFixtureExecutable := file.Executable{
+		Format:        "elf",
+		HasExports:    true,
+		HasEntrypoint: true,
+		ImportedLibraries: []string{
+			path.Base(glibcCoordinate.RealPath),
+		},
+	}
+
+	// second executable representation that has no parent package
+	syftTestFixtureExecutable2 := file.Executable{
+		Format:        "elf",
+		HasExports:    true,
+		HasEntrypoint: true,
+		ImportedLibraries: []string{
+			// this should not be a relationship because it is not a coordinate
+			"foo.so.6",
+		},
+	}
+
+	tests := []struct {
+		name                    string
+		resolver                file.Resolver
+		coordinateIndex         map[file.Coordinates]file.Executable
+		packages                []pkg.Package
+		prexistingRelationships []artifact.Relationship
+		want                    []artifact.Relationship
+	}{
+		{
+			name:            "blank sbom and accessor returns empty relationships",
+			resolver:        nil,
+			coordinateIndex: map[file.Coordinates]file.Executable{},
+			packages:        []pkg.Package{},
+			want:            make([]artifact.Relationship, 0),
+		},
+		{
+			name: "given a package that imports glibc, expect a relationship between the two packages when the package is an executable",
+			resolver: file.NewMockResolverForPaths(
+				glibcCoordinate.RealPath,
+				nestedLibCoordinate.RealPath,
+				parrallelLibCoordinate.RealPath,
+			),
+			// path -> executable (above mock resolver needs to be able to resolve to paths in this map)
+			coordinateIndex: map[file.Coordinates]file.Executable{
+				glibcCoordinate:        glibcExecutable,
+				nestedLibCoordinate:    syftTestFixtureExecutable,
+				parrallelLibCoordinate: syftTestFixtureExecutable2,
+			},
+			packages: []pkg.Package{glibCPackage, syftTestFixturePackage},
+			want: []artifact.Relationship{
+				{
+					From: glibCPackage,
+					To:   syftTestFixturePackage,
+					Type: artifact.DependencyOfRelationship,
+				},
+			},
+		},
+		{
+			name: "given an executable maps to one base path represented by two RPM we make two relationships",
+			resolver: file.NewMockResolverForPaths(
+				glibcCoordinate.RealPath,
+				secondGlibcCoordinate.RealPath,
+				nestedLibCoordinate.RealPath,
+				parrallelLibCoordinate.RealPath,
+			),
+			coordinateIndex: map[file.Coordinates]file.Executable{
+				glibcCoordinate:        glibcExecutable,
+				secondGlibcCoordinate:  glibcExecutable,
+				nestedLibCoordinate:    syftTestFixtureExecutable,
+				parrallelLibCoordinate: syftTestFixtureExecutable2,
+			},
+			packages: []pkg.Package{glibCPackage, glibCustomPackage, syftTestFixturePackage},
+			want: []artifact.Relationship{
+				{
+					From: glibCPackage,
+					To:   syftTestFixturePackage,
+					Type: artifact.DependencyOfRelationship,
+				},
+				{
+					From: glibCustomPackage,
+					To:   syftTestFixturePackage,
+					Type: artifact.DependencyOfRelationship,
+				},
+			},
+		},
+		{
+			name: "given some dependency relationships already exist, expect no duplicate relationships to be created",
+			resolver: file.NewMockResolverForPaths(
+				glibcCoordinate.RealPath,
+				nestedLibCoordinate.RealPath,
+				parrallelLibCoordinate.RealPath,
+			),
+			coordinateIndex: map[file.Coordinates]file.Executable{
+				glibcCoordinate:        glibcExecutable,
+				nestedLibCoordinate:    syftTestFixtureExecutable,
+				parrallelLibCoordinate: syftTestFixtureExecutable2,
+			},
+			packages: []pkg.Package{glibCPackage, glibCustomPackage, syftTestFixturePackage},
+			prexistingRelationships: []artifact.Relationship{
+				{
+					From: glibCPackage,
+					To:   syftTestFixturePackage,
+					Type: artifact.DependencyOfRelationship,
+				},
+			},
+			want: []artifact.Relationship{},
+		},
+		{
+			name:     "given a package that imports a library that is not tracked by the resolver, expect no relationships to be created",
+			resolver: file.NewMockResolverForPaths(),
+			coordinateIndex: map[file.Coordinates]file.Executable{
+				glibcCoordinate:        glibcExecutable,
+				nestedLibCoordinate:    syftTestFixtureExecutable,
+				parrallelLibCoordinate: syftTestFixtureExecutable2,
+			},
+			packages: []pkg.Package{glibCPackage, syftTestFixturePackage},
+			want:     []artifact.Relationship{},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			accessor := newAccesor(tt.packages, tt.coordinateIndex, tt.prexistingRelationships)
+			// given a resolver that knows about the paths of the packages and executables,
+			// and given an SBOM accessor that knows about the packages and executables,
+			// we should be able to create a set of relationships between the packages and executables
+			relationships := NewDependencyRelationships(tt.resolver, accessor)
+			if diff := relationshipComparer(tt.want, relationships); diff != "" {
+				t.Errorf("unexpected relationships (-want, +got): %s", diff)
+			}
+		})
+	}
+}
+
+func relationshipComparer(x, y []artifact.Relationship) string {
+	return cmp.Diff(x, y, cmpopts.IgnoreUnexported(
+		pkg.Package{},
+		artifact.Relationship{},
+		file.LocationSet{},
+		pkg.LicenseSet{},
+	))
+}
+
+func newAccesor(pkgs []pkg.Package, coordinateIndex map[file.Coordinates]file.Executable, prexistingRelationships []artifact.Relationship) sbomsync.Accessor {
+	sb := sbom.SBOM{
+		Artifacts: sbom.Artifacts{
+			Packages: pkg.NewCollection(),
+		},
+	}
+
+	builder := sbomsync.NewBuilder(&sb)
+	builder.AddPackages(pkgs...)
+
+	accessor := builder.(sbomsync.Accessor)
+	accessor.WriteToSBOM(func(s *sbom.SBOM) {
+		s.Artifacts.Executables = coordinateIndex
+		if prexistingRelationships != nil {
+			s.Relationships = prexistingRelationships
+		}
+	})
+	return accessor
+}

internal/relationship/binary/relationship_index.go

@@ -0,0 +1,59 @@
+package binary
+
+import (
+	"github.com/scylladb/go-set/strset"
+
+	"github.com/anchore/syft/syft/artifact"
+)
+
+type relationshipIndex struct {
+	typesByFromTo map[artifact.ID]map[artifact.ID]*strset.Set
+	additional    []artifact.Relationship
+}
+
+func newRelationshipIndex(existing ...artifact.Relationship) *relationshipIndex {
+	r := &relationshipIndex{
+		typesByFromTo: make(map[artifact.ID]map[artifact.ID]*strset.Set),
+		additional:    make([]artifact.Relationship, 0),
+	}
+	for _, rel := range existing {
+		r.track(rel)
+	}
+	return r
+}
+
+// track this relationship as "exists" in the index (this is used to prevent duplicate relationships from being added).
+// returns true if the relationship is new to the index, false otherwise.
+func (i *relationshipIndex) track(r artifact.Relationship) bool {
+	fromID := r.From.ID()
+	if _, ok := i.typesByFromTo[fromID]; !ok {
+		i.typesByFromTo[fromID] = make(map[artifact.ID]*strset.Set)
+	}
+
+	toID := r.To.ID()
+	if _, ok := i.typesByFromTo[fromID][toID]; !ok {
+		i.typesByFromTo[fromID][toID] = strset.New()
+	}
+
+	var exists bool
+	if i.typesByFromTo[fromID][toID].Has(string(r.Type)) {
+		exists = true
+	}
+
+	i.typesByFromTo[fromID][toID].Add(string(r.Type))
+	return !exists
+}
+
+// add a new relationship to the index, returning true if the relationship is new to the index, false otherwise (thus is a duplicate).
+// nolint:unparam
+func (i *relationshipIndex) add(r artifact.Relationship) bool {
+	if i.track(r) {
+		i.additional = append(i.additional, r)
+		return true
+	}
+	return false
+}
+
+func (i *relationshipIndex) newRelationships() []artifact.Relationship {
+	return i.additional
+}

internal/relationship/binary/relationship_index_test.go

@@ -0,0 +1,128 @@
+package binary
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/scylladb/go-set/strset"
+
+	"github.com/anchore/syft/syft/artifact"
+)
+
+func Test_newRelationshipIndex(t *testing.T) {
+	from := fakeIdentifiable{id: "from"}
+	to := fakeIdentifiable{id: "to"}
+	tests := []struct {
+		name  string
+		given []artifact.Relationship
+		want  *relationshipIndex
+	}{
+		{
+			name: "newRelationshipIndex returns an empty index with no existing relationships",
+			want: &relationshipIndex{
+				typesByFromTo: make(map[artifact.ID]map[artifact.ID]*strset.Set),
+				additional:    make([]artifact.Relationship, 0),
+			},
+		},
+		{
+			name: "newRelationshipIndex returns an index which tracks existing relationships",
+			given: []artifact.Relationship{
+				{
+					From: from,
+					To:   to,
+					Type: artifact.EvidentByRelationship,
+				},
+			},
+			want: &relationshipIndex{
+				typesByFromTo: map[artifact.ID]map[artifact.ID]*strset.Set{
+					"from": {
+						"to": strset.New("evident-by"),
+					},
+				},
+				additional: make([]artifact.Relationship, 0),
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := newRelationshipIndex(tt.given...); !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("newRelationshipIndex() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func Test_relationshipIndex_track(t *testing.T) {
+	from := fakeIdentifiable{id: "from"}
+	to := fakeIdentifiable{id: "to"}
+	relationship := artifact.Relationship{From: from, To: to, Type: artifact.EvidentByRelationship}
+	tests := []struct {
+		name     string
+		existing []artifact.Relationship
+		given    artifact.Relationship
+		want     bool
+	}{
+		{
+			name:     "track returns true for a new relationship",
+			existing: []artifact.Relationship{},
+			given:    relationship,
+			want:     true,
+		},
+		{
+			name:     "track returns false for an existing relationship",
+			existing: []artifact.Relationship{relationship},
+			given:    relationship,
+			want:     false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			i := newRelationshipIndex(tt.existing...)
+			if got := i.track(tt.given); got != tt.want {
+				t.Errorf("track() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func Test_relationshipIndex_add(t *testing.T) {
+	from := fakeIdentifiable{id: "from"}
+	to := fakeIdentifiable{id: "to"}
+	relationship := artifact.Relationship{From: from, To: to, Type: artifact.EvidentByRelationship}
+	tests := []struct {
+		name     string
+		existing []artifact.Relationship
+		given    artifact.Relationship
+		want     bool
+	}{
+		{
+			name:     "add returns true for a new relationship",
+			existing: []artifact.Relationship{},
+			given:    relationship,
+			want:     true,
+		},
+		{
+			name:     "add returns false for an existing relationship",
+			existing: []artifact.Relationship{relationship},
+			given:    relationship,
+			want:     false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			i := newRelationshipIndex(tt.existing...)
+			if got := i.add(tt.given); got != tt.want {
+				t.Errorf("add() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+
+}
+
+type fakeIdentifiable struct {
+	id string
+}
+
+func (f fakeIdentifiable) ID() artifact.ID {
+	return artifact.ID(f.id)
+}

internal/relationship/binary/shared_library_index.go

@@ -0,0 +1,131 @@
+package binary
+
+import (
+	"path"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/sbomsync"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/sbom"
+)
+
+type sharedLibraryIndex struct {
+	libLocationsByBasename map[string]file.CoordinateSet
+	allLibLocations        file.CoordinateSet
+	packagesByLibraryPath  map[file.Coordinates]*pkg.Collection
+}
+
+func newShareLibIndex(resolver file.Resolver, accessor sbomsync.Accessor) *sharedLibraryIndex {
+	s := &sharedLibraryIndex{
+		libLocationsByBasename: make(map[string]file.CoordinateSet),
+		allLibLocations:        file.NewCoordinateSet(),
+		packagesByLibraryPath:  make(map[file.Coordinates]*pkg.Collection),
+	}
+
+	s.build(resolver, accessor)
+
+	return s
+}
+
+func (i *sharedLibraryIndex) build(resolver file.Resolver, accessor sbomsync.Accessor) {
+	// 1. map out all locations that provide libraries (indexed by the basename)
+	i.libLocationsByBasename, i.allLibLocations = locationsThatProvideLibraries(accessor)
+
+	// 2. for each library path, find all packages that claim ownership of the library
+	i.packagesByLibraryPath = packagesWithLibraryOwnership(resolver, accessor, i.allLibLocations)
+}
+
+func (i *sharedLibraryIndex) owningLibraryPackage(libraryBasename string) *pkg.Collection {
+	// find all packages that own a library by its basename
+	collection := pkg.NewCollection()
+	if set, ok := i.libLocationsByBasename[libraryBasename]; ok {
+		for _, coord := range set.ToSlice() {
+			if pkgSet, ok := i.packagesByLibraryPath[coord]; ok {
+				toAdd := pkgSet.Sorted()
+				collection.Add(toAdd...)
+			}
+		}
+	}
+
+	return collection
+}
+
+func locationsThatProvideLibraries(accessor sbomsync.Accessor) (map[string]file.CoordinateSet, file.CoordinateSet) {
+	// map out all locations that provide libraries (indexed by the basename)
+	libLocationsByBasename := make(map[string]file.CoordinateSet)
+	allLibLocations := file.NewCoordinateSet()
+
+	accessor.ReadFromSBOM(func(s *sbom.SBOM) {
+		// PROBLEM: this does not consider all symlinks to real paths that are libraries
+		for coord, f := range s.Artifacts.Executables {
+			if !f.HasExports {
+				continue
+			}
+
+			basename := path.Base(coord.RealPath)
+			set := libLocationsByBasename[basename]
+			set.Add(coord)
+			allLibLocations.Add(coord)
+			libLocationsByBasename[basename] = set
+		}
+	})
+
+	return libLocationsByBasename, allLibLocations
+}
+func packagesWithLibraryOwnership(resolver file.Resolver, accessor sbomsync.Accessor, allLibLocations file.CoordinateSet) map[file.Coordinates]*pkg.Collection {
+	// map out all packages that claim ownership of a library at a specific path
+	packagesByLibraryPath := make(map[file.Coordinates]*pkg.Collection)
+
+	accessor.ReadFromSBOM(func(s *sbom.SBOM) {
+		for _, p := range s.Artifacts.Packages.Sorted() {
+			var ownedFilePaths []string
+			if p.Type == pkg.BinaryPkg {
+				for _, loc := range p.Locations.ToSlice() {
+					ownedFilePaths = append(ownedFilePaths, loc.Path())
+				}
+			} else {
+				fileOwner, ok := p.Metadata.(pkg.FileOwner)
+				if !ok {
+					continue
+				}
+				ownedFilePaths = fileOwner.OwnedFiles()
+			}
+
+			packagesByLibraryPath = populatePackagesByLibraryPath(resolver, allLibLocations, packagesByLibraryPath, p, ownedFilePaths)
+		}
+	})
+
+	return packagesByLibraryPath
+}
+
+func populatePackagesByLibraryPath(
+	resolver file.Resolver,
+	allLibLocations file.CoordinateSet,
+	packagesByLibraryPath map[file.Coordinates]*pkg.Collection,
+	p pkg.Package,
+	ownedFilePaths []string,
+) map[file.Coordinates]*pkg.Collection {
+	for _, pth := range ownedFilePaths {
+		ownedLocation, err := resolver.FilesByPath(pth)
+		if err != nil {
+			log.WithFields("error", err, "path", pth).Trace("unable to find path for owned file")
+			continue
+		}
+
+		for _, loc := range ownedLocation {
+			// if the location is a library, add the package to the set of packages that own the library
+			if !allLibLocations.Contains(loc.Coordinates) {
+				continue
+			}
+
+			if _, ok := packagesByLibraryPath[loc.Coordinates]; !ok {
+				packagesByLibraryPath[loc.Coordinates] = pkg.NewCollection()
+			}
+
+			// we have a library path, add the package to the set of packages that own the library
+			packagesByLibraryPath[loc.Coordinates].Add(p)
+		}
+	}
+	return packagesByLibraryPath
+}

internal/relationship/binary/shared_library_index_test.go

@@ -0,0 +1,105 @@
+package binary
+
+import (
+	"path"
+	"testing"
+
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func Test_newShareLibIndex(t *testing.T) {
+	tests := []struct {
+		name                    string
+		resolver                file.Resolver
+		coordinateIndex         map[file.Coordinates]file.Executable
+		packages                []pkg.Package
+		prexistingRelationships []artifact.Relationship
+	}{
+		{
+			name:                    "constructor",
+			resolver:                file.NewMockResolverForPaths(),
+			coordinateIndex:         map[file.Coordinates]file.Executable{},
+			packages:                []pkg.Package{},
+			prexistingRelationships: []artifact.Relationship{},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			accessor := newAccesor(tt.packages, tt.coordinateIndex, tt.prexistingRelationships)
+			sharedLibraryIndex := newShareLibIndex(tt.resolver, accessor)
+			if sharedLibraryIndex == nil {
+				t.Errorf("newShareLibIndex() = %v, want non-nil", sharedLibraryIndex)
+			}
+		})
+	}
+}
+
+func Test_sharedLibraryIndex_build(t *testing.T) {
+	glibcCoordinate := file.NewCoordinates("/usr/lib64/libc.so.6", "")
+	secondGlibcCoordinate := file.NewCoordinates("/usr/local/lib64/libc.so.6", "")
+	glibcExecutable := file.Executable{
+		Format:        "elf",
+		HasExports:    true,
+		HasEntrypoint: true,
+		ImportedLibraries: []string{
+			path.Base(glibcCoordinate.RealPath),
+			path.Base(secondGlibcCoordinate.RealPath),
+		},
+	}
+	glibCPackage := pkg.Package{
+		Name:    "glibc",
+		Version: "2.28-236.el8_9.12",
+		Locations: file.NewLocationSet(
+			file.NewLocation(glibcCoordinate.RealPath),
+			file.NewLocation("some/other/path"),
+		),
+		Type: pkg.RpmPkg,
+		Metadata: pkg.RpmDBEntry{
+			Files: []pkg.RpmFileRecord{
+				{
+					Path: glibcCoordinate.RealPath,
+				},
+				{
+					Path: "some/other/path",
+				},
+			},
+		},
+	}
+
+	tests := []struct {
+		name                    string
+		resolver                file.Resolver
+		coordinateIndex         map[file.Coordinates]file.Executable
+		packages                []pkg.Package
+		prexistingRelationships []artifact.Relationship
+	}{
+		{
+			name: "build with locations and packages",
+			resolver: file.NewMockResolverForPaths([]string{
+				glibcCoordinate.RealPath,
+				secondGlibcCoordinate.RealPath,
+			}...),
+			coordinateIndex: map[file.Coordinates]file.Executable{
+				glibcCoordinate:       glibcExecutable,
+				secondGlibcCoordinate: glibcExecutable,
+			},
+			packages: []pkg.Package{
+				glibCPackage,
+			},
+			prexistingRelationships: []artifact.Relationship{},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			accessor := newAccesor(tt.packages, tt.coordinateIndex, tt.prexistingRelationships)
+			sharedLibraryIndex := newShareLibIndex(tt.resolver, accessor)
+			sharedLibraryIndex.build(tt.resolver, accessor)
+			pkgs := sharedLibraryIndex.owningLibraryPackage(path.Base(glibcCoordinate.RealPath))
+			if pkgs.PackageCount() < 1 {
+				t.Errorf("owningLibraryPackage() = %v, want non-empty", pkgs)
+			}
+		})
+	}
+}

internal/relationship/binary/test-fixtures/elf-test-fixtures

@@ -0,0 +1 @@
+../../../../syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures

internal/relationship/finalize.go

@@ -1,15 +1,21 @@
 package relationship
 
 import (
+	"github.com/anchore/syft/internal/relationship/binary"
 	"github.com/anchore/syft/internal/sbomsync"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/cataloging"
+	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/sbom"
 )
 
-func Finalize(builder sbomsync.Builder, cfg cataloging.RelationshipsConfig, src artifact.Identifiable) {
+func Finalize(resolver file.Resolver, builder sbomsync.Builder, cfg cataloging.RelationshipsConfig, src artifact.Identifiable) {
 	accessor := builder.(sbomsync.Accessor)
 
+	// remove ELF packages and Binary packages that are already
+	// represented by a source package (e.g. a package that is evident by some package manager)
+	builder.DeletePackages(binary.PackagesToRemove(resolver, accessor)...)
+
 	// add relationships showing packages that are evident by a file which is owned by another package (package-to-package)
 	if cfg.PackageFileOwnershipOverlap {
 		byFileOwnershipOverlapWorker(accessor)
@@ -21,6 +27,12 @@ func Finalize(builder sbomsync.Builder, cfg cataloging.RelationshipsConfig, src
 		excludeBinariesByFileOwnershipOverlap(accessor)
 	}
 
+	// add the new relationships for executables to the SBOM
+	newBinaryRelationships := binary.NewDependencyRelationships(resolver, accessor)
+	accessor.WriteToSBOM(func(s *sbom.SBOM) {
+		s.Relationships = append(s.Relationships, newBinaryRelationships...)
+	})
+	builder.AddRelationships(newBinaryRelationships...)
 	// add source "contains package" relationship (source-to-package)
 	var sourceRelationships []artifact.Relationship
 	accessor.ReadFromSBOM(func(s *sbom.SBOM) {
@@ -33,5 +45,6 @@ func Finalize(builder sbomsync.Builder, cfg cataloging.RelationshipsConfig, src
 	accessor.ReadFromSBOM(func(s *sbom.SBOM) {
 		evidentByRelationships = evidentBy(s.Artifacts.Packages)
 	})
+
 	builder.AddRelationships(evidentByRelationships...)
 }

internal/sbomsync/builder.go

@@ -20,6 +20,8 @@ type Builder interface {
 
 	AddPackages(...pkg.Package)
 
+	DeletePackages(...artifact.ID)
+
 	// edges
 
 	AddRelationships(...artifact.Relationship)
@@ -36,14 +38,22 @@ type Accessor interface {
 }
 
 type sbomBuilder struct {
-	sbom *sbom.SBOM
-	lock *sync.RWMutex
+	sbom    *sbom.SBOM
+	lock    *sync.RWMutex
+	onWrite []func(*sbom.SBOM)
 }
 
-func NewBuilder(s *sbom.SBOM) Builder {
+func NewBuilder(s *sbom.SBOM, onWrite ...func(*sbom.SBOM)) Builder {
 	return &sbomBuilder{
-		sbom: s,
-		lock: &sync.RWMutex{},
+		sbom:    s,
+		lock:    &sync.RWMutex{},
+		onWrite: onWrite,
+	}
+}
+
+func (b sbomBuilder) onWriteEvent() {
+	for _, fn := range b.onWrite {
+		fn(b.sbom)
 	}
 }
 
@@ -52,6 +62,7 @@ func (b sbomBuilder) WriteToSBOM(fn func(*sbom.SBOM)) {
 	defer b.lock.Unlock()
 
 	fn(b.sbom)
+	b.onWriteEvent()
 }
 
 func (b sbomBuilder) ReadFromSBOM(fn func(*sbom.SBOM)) {
@@ -66,6 +77,35 @@ func (b sbomBuilder) AddPackages(p ...pkg.Package) {
 	defer b.lock.Unlock()
 
 	b.sbom.Artifacts.Packages.Add(p...)
+	b.onWriteEvent()
+}
+
+func (b sbomBuilder) DeletePackages(ids ...artifact.ID) {
+	b.lock.Lock()
+	defer b.lock.Unlock()
+
+	deleted := make(map[artifact.ID]struct{})
+	for _, id := range ids {
+		b.sbom.Artifacts.Packages.Delete(id)
+		deleted[id] = struct{}{}
+	}
+
+	// remove any relationships that reference the deleted packages
+	var relationships []artifact.Relationship
+	for _, rel := range b.sbom.Relationships {
+		if _, ok := deleted[rel.From.ID()]; ok {
+			continue
+		}
+		if _, ok := deleted[rel.To.ID()]; ok {
+			continue
+		}
+
+		// only keep relationships that don't reference the deleted packages
+		relationships = append(relationships, rel)
+	}
+
+	b.sbom.Relationships = relationships
+	b.onWriteEvent()
 }
 
 func (b sbomBuilder) AddRelationships(relationship ...artifact.Relationship) {
@@ -73,6 +113,7 @@ func (b sbomBuilder) AddRelationships(relationship ...artifact.Relationship) {
 	defer b.lock.Unlock()
 
 	b.sbom.Relationships = append(b.sbom.Relationships, relationship...)
+	b.onWriteEvent()
 }
 
 func (b sbomBuilder) SetLinuxDistribution(release linux.Release) {
@@ -80,4 +121,5 @@ func (b sbomBuilder) SetLinuxDistribution(release linux.Release) {
 	defer b.lock.Unlock()
 
 	b.sbom.Artifacts.LinuxDistribution = &release
+	b.onWriteEvent()
 }

internal/sbomsync/builder_test.go

@@ -0,0 +1,98 @@
+package sbomsync
+
+import (
+	"testing"
+
+	"github.com/magiconair/properties/assert"
+
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/sbom"
+)
+
+func TestNewBuilder(t *testing.T) {
+	tests := []struct {
+		name string
+		sbom sbom.SBOM
+	}{
+		{
+			"TestNewBuilder with empty sbom",
+			sbom.SBOM{
+				Artifacts: sbom.Artifacts{
+					Packages: pkg.NewCollection(),
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			builder := NewBuilder(&tt.sbom)
+			builder.AddPackages(pkg.Package{})
+			accessor := builder.(Accessor)
+			accessor.ReadFromSBOM(func(s *sbom.SBOM) {
+				packageCount := s.Artifacts.Packages.PackageCount()
+				assert.Equal(t, packageCount, 1, "expected 1 package in sbom")
+			})
+		})
+	}
+}
+
+func Test_sbomBuilder_DeletePackages(t *testing.T) {
+	testPackage := pkg.Package{
+		Name:    "test",
+		Version: "1.0.0",
+		Type:    pkg.DebPkg,
+	}
+	testPackage.SetID()
+
+	keepMe := pkg.Package{
+		Name:    "keepMe",
+		Version: "1.0.0",
+		Type:    pkg.DebPkg,
+	}
+
+	prexistingRelationships := []artifact.Relationship{
+		{
+			From: testPackage,
+			To:   testPackage,
+			Type: artifact.DependencyOfRelationship,
+		},
+	}
+
+	tests := []struct {
+		name string
+		sbom sbom.SBOM
+	}{
+		{
+			"Test_sbomBuilder_DeletePackages deletes a given package",
+			sbom.SBOM{
+				Artifacts: sbom.Artifacts{
+					Packages: pkg.NewCollection(),
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			builder := NewBuilder(&tt.sbom)
+			builder.AddPackages(testPackage, keepMe)
+			accessor := builder.(Accessor)
+			accessor.WriteToSBOM(func(s *sbom.SBOM) {
+				s.Relationships = prexistingRelationships
+			})
+
+			builder.DeletePackages(testPackage.ID())
+			newAccess := builder.(Accessor)
+			newAccess.ReadFromSBOM(func(s *sbom.SBOM) {
+				packageCount := s.Artifacts.Packages.PackageCount()
+
+				// deleted target package
+				assert.Equal(t, packageCount, 1, "expected 1 packages in sbom")
+				relationshipCount := len(s.Relationships)
+
+				// deleted relationships that reference the deleted package
+				assert.Equal(t, relationshipCount, 0, "expected 0 relationships in sbom")
+			})
+		})
+	}
+}

internal/task/relationship_tasks.go

@@ -22,8 +22,9 @@ func (s sourceIdentifierAdapter) ID() artifact.ID {
 }
 
 func NewRelationshipsTask(cfg cataloging.RelationshipsConfig, src source.Description) Task {
-	fn := func(_ context.Context, _ file.Resolver, builder sbomsync.Builder) error {
+	fn := func(_ context.Context, resolver file.Resolver, builder sbomsync.Builder) error {
 		relationship.Finalize(
+			resolver,
 			builder,
 			cfg,
 			&sourceIdentifierAdapter{desc: src})

schema/json/schema-latest.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "anchore.io/schema/syft/json/16.0.7/document",
+  "$id": "anchore.io/schema/syft/json/16.0.8/document",
   "$ref": "#/$defs/Document",
   "$defs": {
     "AlpmDbEntry": {
@@ -46,6 +46,18 @@
             "$ref": "#/$defs/AlpmFileRecord"
           },
           "type": "array"
+        },
+        "provides": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "depends": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
         }
       },
       "type": "object",

syft/create_sbom.go

@@ -4,11 +4,9 @@ import (
 	"context"
 	"fmt"
 	"sort"
-	"time"
 
 	"github.com/dustin/go-humanize"
 	"github.com/scylladb/go-set/strset"
-	"github.com/wagoodman/go-progress"
 
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/sbomsync"
@@ -63,9 +61,9 @@ func CreateSBOM(ctx context.Context, src source.Source, cfg *CreateSBOMConfig) (
 	}
 
 	catalogingProgress := monitorCatalogingTask(src.ID(), taskGroups)
-	packageCatalogingProgress := monitorPackageCatalogingTask(s.Artifacts.Packages)
+	packageCatalogingProgress := monitorPackageCatalogingTask()
 
-	builder := sbomsync.NewBuilder(&s)
+	builder := sbomsync.NewBuilder(&s, monitorPackageCount(packageCatalogingProgress))
 	for i := range taskGroups {
 		err := task.NewTaskExecutor(taskGroups[i], cfg.Parallelism).Execute(ctx, resolver, builder, catalogingProgress)
 		if err != nil {
@@ -80,7 +78,14 @@ func CreateSBOM(ctx context.Context, src source.Source, cfg *CreateSBOMConfig) (
 	return &s, nil
 }
 
-func monitorPackageCatalogingTask(pkgs *pkg.Collection) *monitor.CatalogerTaskProgress {
+func monitorPackageCount(prog *monitor.CatalogerTaskProgress) func(s *sbom.SBOM) {
+	return func(s *sbom.SBOM) {
+		count := humanize.Comma(int64(s.Artifacts.Packages.PackageCount()))
+		prog.AtomicStage.Set(fmt.Sprintf("%s packages", count))
+	}
+}
+
+func monitorPackageCatalogingTask() *monitor.CatalogerTaskProgress {
 	info := monitor.GenericTask{
 		Title: monitor.Title{
 			Default: "Packages",
@@ -90,25 +95,7 @@ func monitorPackageCatalogingTask(pkgs *pkg.Collection) *monitor.CatalogerTaskPr
 		ParentID:      monitor.TopLevelCatalogingTaskID,
 	}
 
-	prog := bus.StartCatalogerTask(info, -1, "")
-
-	go func() {
-		ticker := time.NewTicker(200 * time.Millisecond)
-		defer ticker.Stop()
-
-		for {
-			<-ticker.C
-
-			count := humanize.Comma(int64(pkgs.PackageCount()))
-			prog.AtomicStage.Set(fmt.Sprintf("%s packages", count))
-
-			if progress.IsCompleted(prog) {
-				break
-			}
-		}
-	}()
-
-	return prog
+	return bus.StartCatalogerTask(info, -1, "")
 }
 
 func monitorCatalogingTask(srcID artifact.ID, tasks [][]task.Task) *monitor.CatalogerTaskProgress {

syft/file/cataloger/executable/cataloger.go

@@ -11,6 +11,7 @@ import (
 	"github.com/bmatcuk/doublestar/v4"
 	"github.com/dustin/go-humanize"
 
+	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/mimetype"
@@ -60,24 +61,8 @@ func (i *Cataloger) Catalog(resolver file.Resolver) (map[file.Coordinates]file.E
 	for _, loc := range locs {
 		prog.AtomicStage.Set(loc.Path())
 
-		reader, err := resolver.FileContentsByLocation(loc)
-		if err != nil {
-			// TODO: known-unknowns
-			log.WithFields("error", err).Warnf("unable to get file contents for %q", loc.RealPath)
-			continue
-		}
+		exec := processExecutableLocation(loc, resolver)
 
-		uReader, err := unionreader.GetUnionReader(reader)
-		if err != nil {
-			// TODO: known-unknowns
-			log.WithFields("error", err).Warnf("unable to get union reader for %q", loc.RealPath)
-			continue
-		}
-
-		exec, err := processExecutable(loc, uReader)
-		if err != nil {
-			log.WithFields("error", err).Warnf("unable to process executable %q", loc.RealPath)
-		}
 		if exec != nil {
 			prog.Increment()
 			results[loc.Coordinates] = *exec
@@ -92,6 +77,29 @@ func (i *Cataloger) Catalog(resolver file.Resolver) (map[file.Coordinates]file.E
 	return results, nil
 }
 
+func processExecutableLocation(loc file.Location, resolver file.Resolver) *file.Executable {
+	reader, err := resolver.FileContentsByLocation(loc)
+	if err != nil {
+		// TODO: known-unknowns
+		log.WithFields("error", err).Warnf("unable to get file contents for %q", loc.RealPath)
+		return nil
+	}
+	defer internal.CloseAndLogError(reader, loc.RealPath)
+
+	uReader, err := unionreader.GetUnionReader(reader)
+	if err != nil {
+		// TODO: known-unknowns
+		log.WithFields("error", err).Warnf("unable to get union reader for %q", loc.RealPath)
+		return nil
+	}
+
+	exec, err := processExecutable(loc, uReader)
+	if err != nil {
+		log.WithFields("error", err).Warnf("unable to process executable %q", loc.RealPath)
+	}
+	return exec
+}
+
 func catalogingProgress(locations int64) *monitor.CatalogerTaskProgress {
 	info := monitor.GenericTask{
 		Title: monitor.Title{

syft/file/coordinates.go

@@ -13,6 +13,13 @@ type Coordinates struct {
 	FileSystemID string `json:"layerID,omitempty" cyclonedx:"layerID"` // An ID representing the filesystem. For container images, this is a layer digest. For directories or a root filesystem, this is blank.
 }
 
+func NewCoordinates(realPath, fsID string) Coordinates {
+	return Coordinates{
+		RealPath:     realPath,
+		FileSystemID: fsID,
+	}
+}
+
 func (c Coordinates) ID() artifact.ID {
 	f, err := artifact.IDByHash(c)
 	if err != nil {

syft/format/spdxjson/encoder_test.go

@@ -3,14 +3,14 @@ package spdxjson
 import (
 	"bytes"
 	"flag"
-	"github.com/anchore/syft/syft/artifact"
-	"github.com/anchore/syft/syft/file"
 	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/format/internal/spdxutil"
 	"github.com/anchore/syft/syft/format/internal/testutil"
 	"github.com/anchore/syft/syft/pkg"

syft/internal/fileresolver/unindexed_directory.go

@@ -8,6 +8,7 @@ import (
 	"io/fs"
 	"os"
 	"path"
+	"path/filepath"
 	"slices"
 	"sort"
 	"strings"
@@ -61,11 +62,11 @@ func NewFromUnindexedDirectoryFS(fs afero.Fs, dir string, base string) file.Writ
 	}
 	wd, err := os.Getwd()
 	if err == nil {
-		if !path.IsAbs(dir) {
-			dir = path.Clean(path.Join(wd, dir))
+		if !filepath.IsAbs(dir) {
+			dir = filepath.Clean(filepath.Join(wd, dir))
 		}
-		if base != "" && !path.IsAbs(base) {
-			base = path.Clean(path.Join(wd, base))
+		if base != "" && !filepath.IsAbs(base) {
+			base = filepath.Clean(filepath.Join(wd, base))
 		}
 	}
 	return UnindexedDirectory{

syft/linux/identify_release.go

@@ -9,6 +9,7 @@ import (
 	"github.com/acobaugh/osrelease"
 	"github.com/google/go-cmp/cmp"
 
+	"github.com/anchore/go-logger"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/file"
@@ -64,25 +65,7 @@ func IdentifyRelease(resolver file.Resolver) *Release {
 		}
 
 		for _, location := range locations {
-			contentReader, err := resolver.FileContentsByLocation(location)
-			if err != nil {
-				logger.WithFields("error", err, "path", location.RealPath).Trace("unable to get contents")
-				continue
-			}
-
-			content, err := io.ReadAll(contentReader)
-			internal.CloseAndLogError(contentReader, location.AccessPath)
-			if err != nil {
-				logger.WithFields("error", err, "path", location.RealPath).Trace("unable to read contents")
-				continue
-			}
-
-			release, err := entry.fn(string(content))
-			if err != nil {
-				logger.WithFields("error", err, "path", location.RealPath).Trace("unable to parse contents")
-				continue
-			}
-
+			release := tryParseReleaseInfo(resolver, location, logger, entry)
 			if release != nil {
 				return release
 			}
@@ -92,6 +75,29 @@ func IdentifyRelease(resolver file.Resolver) *Release {
 	return nil
 }
 
+func tryParseReleaseInfo(resolver file.Resolver, location file.Location, logger logger.Logger, entry parseEntry) *Release {
+	contentReader, err := resolver.FileContentsByLocation(location)
+	if err != nil {
+		logger.WithFields("error", err, "path", location.RealPath).Trace("unable to get contents")
+		return nil
+	}
+	defer internal.CloseAndLogError(contentReader, location.AccessPath)
+
+	content, err := io.ReadAll(contentReader)
+	if err != nil {
+		logger.WithFields("error", err, "path", location.RealPath).Trace("unable to read contents")
+		return nil
+	}
+
+	release, err := entry.fn(string(content))
+	if err != nil {
+		logger.WithFields("error", err, "path", location.RealPath).Trace("unable to parse contents")
+		return nil
+	}
+
+	return release
+}
+
 func parseOsRelease(contents string) (*Release, error) {
 	values, err := osrelease.ReadString(contents)
 	if err != nil {

syft/pkg/alpm.go

@@ -27,6 +27,8 @@ type AlpmDBEntry struct {
 	Reason       int              `mapstructure:"reason" json:"reason"`
 	Files        []AlpmFileRecord `mapstructure:"files" json:"files"`
 	Backup       []AlpmFileRecord `mapstructure:"backup" json:"backup"`
+	Provides     []string         `mapstructure:"provides" json:"provides,omitempty"`
+	Depends      []string         `mapstructure:"depends" json:"depends,omitempty"`
 }
 
 type AlpmFileRecord struct {

syft/pkg/cataloger/alpine/parse_apk_db.go

@@ -156,6 +156,7 @@ func findReleases(resolver file.Resolver, dbPath string) []linux.Release {
 		log.Tracef("unable to fetch contents for APK repositories file %q: %+v", reposLocation, err)
 		return nil
 	}
+	defer internal.CloseAndLogError(reposReader, location.RealPath)
 
 	return parseReleasesFromAPKRepository(file.LocationReadCloser{
 		Location:   location,

syft/pkg/cataloger/arch/cataloger.go

@@ -4,12 +4,96 @@ Package arch provides a concrete Cataloger implementations for packages relating
 package arch
 
 import (
+	"context"
+	"strings"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/generic"
 )
 
+type cataloger struct {
+	*generic.Cataloger
+}
+
 // NewDBCataloger returns a new cataloger object initialized for arch linux pacman database flat-file stores.
 func NewDBCataloger() pkg.Cataloger {
-	return generic.NewCataloger("alpm-db-cataloger").
-		WithParserByGlobs(parseAlpmDB, pkg.AlpmDBGlob)
+	return cataloger{
+		Cataloger: generic.NewCataloger("alpm-db-cataloger").
+			WithParserByGlobs(parseAlpmDB, pkg.AlpmDBGlob),
+	}
+}
+
+func (c cataloger) Catalog(ctx context.Context, resolver file.Resolver) ([]pkg.Package, []artifact.Relationship, error) {
+	pkgs, rels, err := c.Cataloger.Catalog(ctx, resolver)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	rels = append(rels, associateRelationships(pkgs)...)
+
+	return pkgs, rels, nil
+}
+
+// associateRelationships will create relationships between packages based on the "Depends" and "Provides"
+// fields for installed packages. If there is an installed package that has a dependency that is (somehow) not installed,
+// then that relationship (between the installed and uninstalled package) will NOT be created.
+func associateRelationships(pkgs []pkg.Package) (relationships []artifact.Relationship) {
+	// map["provides" + "package"] -> packages that provide that package
+	lookup := make(map[string][]pkg.Package)
+
+	// read providers and add lookup keys as needed
+	for _, p := range pkgs {
+		meta, ok := p.Metadata.(pkg.AlpmDBEntry)
+		if !ok {
+			log.Warnf("cataloger failed to extract alpm 'provides' metadata for package %+v", p.Name)
+			continue
+		}
+		// allow for lookup by package name
+		lookup[p.Name] = append(lookup[p.Name], p)
+
+		for _, provides := range meta.Provides {
+			// allow for lookup by exact specification
+			lookup[provides] = append(lookup[provides], p)
+
+			// allow for lookup by library name only
+			k := stripVersionSpecifier(provides)
+			lookup[k] = append(lookup[k], p)
+		}
+	}
+
+	// read "Depends" and match with provider keys
+	for _, p := range pkgs {
+		meta, ok := p.Metadata.(pkg.AlpmDBEntry)
+		if !ok {
+			log.Warnf("cataloger failed to extract alpm 'dependency' metadata for package %+v", p.Name)
+			continue
+		}
+
+		for _, dep := range meta.Depends {
+			for _, depPkg := range lookup[dep] {
+				relationships = append(relationships, artifact.Relationship{
+					From: depPkg,
+					To:   p,
+					Type: artifact.DependencyOfRelationship,
+				})
+			}
+		}
+	}
+	return relationships
+}
+
+func stripVersionSpecifier(s string) string {
+	// examples:
+	// gcc-libs                  -->  gcc-libs
+	// libtree-sitter.so=0-64    -->  libtree-sitter.so
+
+	items := strings.Split(s, "=")
+	if len(items) == 0 {
+		return s
+	}
+
+	return strings.TrimSpace(items[0])
 }

syft/pkg/cataloger/arch/cataloger_test.go

@@ -12,169 +12,289 @@ import (
 )
 
 func TestAlpmCataloger(t *testing.T) {
-	dbLocation := file.NewLocation("var/lib/pacman/local/gmp-6.2.1-2/desc")
-	expectedPkgs := []pkg.Package{
-		{
-			Name:    "gmp",
-			Version: "6.2.1-2",
-			Type:    pkg.AlpmPkg,
-			FoundBy: "alpm-db-cataloger",
-			Licenses: pkg.NewLicenseSet(
-				pkg.NewLicenseFromLocations("LGPL3", dbLocation),
-				pkg.NewLicenseFromLocations("GPL", dbLocation),
-			),
-			Locations: file.NewLocationSet(dbLocation),
-			CPEs:      nil,
-			PURL:      "",
-			Metadata: pkg.AlpmDBEntry{
-				BasePackage:  "gmp",
-				Package:      "gmp",
-				Version:      "6.2.1-2",
-				Description:  "A free library for arbitrary precision arithmetic",
-				Architecture: "x86_64",
-				Size:         1044438,
-				Packager:     "Antonio Rojas <arojas@archlinux.org>",
-				URL:          "https://gmplib.org/",
-				Validation:   "pgp",
-				Reason:       1,
-				Files: []pkg.AlpmFileRecord{
-					{
-						Path:    "/usr",
-						Type:    "dir",
-						Digests: []file.Digest{},
-					},
-					{
-						Path:    "/usr/include",
-						Type:    "dir",
-						Digests: []file.Digest{},
-					},
-					{
-						Path: "/usr/include/gmp.h",
-						Size: "84140",
-						Digests: []file.Digest{
-							{Algorithm: "md5", Value: "76595f70565c72550eb520809bf86856"},
-							{Algorithm: "sha256", Value: "91a614b9202453153fe3b7512d15e89659108b93ce8841c8e13789eb85da9e3a"},
-						},
-					},
-					{
-						Path: "/usr/include/gmpxx.h",
-						Size: "129113",
-						Digests: []file.Digest{
-							{Algorithm: "md5", Value: "ea3d21de4bcf7c696799c5c55dd3655b"},
-							{Algorithm: "sha256", Value: "0011ae411a0bc1030e07d968b32fdc1343f5ac2a17b7d28f493e7976dde2ac82"},
-						},
-					},
-					{
-						Path:    "/usr/lib",
-						Type:    "dir",
-						Digests: []file.Digest{},
-					},
-					{
-						Path:    "/usr/lib/libgmp.so",
-						Type:    "link",
-						Link:    "libgmp.so.10.4.1",
-						Digests: []file.Digest{},
-					},
-					{
-						Path:    "/usr/lib/libgmp.so.10",
-						Type:    "link",
-						Link:    "libgmp.so.10.4.1",
-						Digests: []file.Digest{},
-					},
-					{
-						Path: "/usr/lib/libgmp.so.10.4.1",
-						Size: "663224",
-						Digests: []file.Digest{
-							{Algorithm: "md5", Value: "d6d03eadacdd9048d5b2adf577e9d722"},
-							{Algorithm: "sha256", Value: "39898bd3d8d6785222432fa8b8aef7ce3b7e5bbfc66a52b7c0da09bed4adbe6a"},
-						},
-					},
-					{
-						Path:    "/usr/lib/libgmpxx.so",
-						Type:    "link",
-						Link:    "libgmpxx.so.4.6.1",
-						Digests: []file.Digest{},
-					},
-					{
-						Path:    "/usr/lib/libgmpxx.so.4",
-						Type:    "link",
-						Link:    "libgmpxx.so.4.6.1",
-						Digests: []file.Digest{},
-					},
-					{
-						Path: "/usr/lib/libgmpxx.so.4.6.1",
-						Size: "30680",
-						Digests: []file.Digest{
-							{Algorithm: "md5", Value: "dd5f0c4d635fa599fa7f4339c0e8814d"},
-							{Algorithm: "sha256", Value: "0ef67cbde4841f58d2e4b41f59425eb87c9eeaf4e649c060b326342c53bedbec"},
-						},
-					},
-					{
-						Path:    "/usr/lib/pkgconfig",
-						Type:    "dir",
-						Digests: []file.Digest{},
-					},
-					{
-						Path: "/usr/lib/pkgconfig/gmp.pc",
-						Size: "245",
-						Digests: []file.Digest{
-							{Algorithm: "md5", Value: "a91a9f1b66218cb77b9cd2cdf341756d"},
-							{Algorithm: "sha256", Value: "4e9de547a48c4e443781e9fa702a1ec5a23ee28b4bc520306cff2541a855be37"},
-						},
-					},
-					{
-						Path: "/usr/lib/pkgconfig/gmpxx.pc",
-						Size: "280",
-						Digests: []file.Digest{
-							{Algorithm: "md5", Value: "8c0f54e987934352177a6a30a811b001"},
-							{Algorithm: "sha256", Value: "fc5dbfbe75977057ba50953d94b9daecf696c9fdfe5b94692b832b44ecca871b"},
-						},
-					},
-					{
-						Path:    "/usr/share",
-						Type:    "dir",
-						Digests: []file.Digest{},
-					},
-					{
-						Path:    "/usr/share/info",
-						Type:    "dir",
-						Digests: []file.Digest{},
-					},
-					{
-						Path: "/usr/share/info/gmp.info-1.gz",
-						Size: "85892",
-						Digests: []file.Digest{
-							{Algorithm: "md5", Value: "63304d4d2f0247fb8a999fae66a81c19"},
-							{Algorithm: "sha256", Value: "86288c1531a2789db5da8b9838b5cde4db07bda230ae11eba23a1f33698bd14e"},
-						},
-					},
-					{
-						Path: "/usr/share/info/gmp.info-2.gz",
-						Size: "48484",
-						Digests: []file.Digest{
-							{Algorithm: "md5", Value: "4bb0dadec416d305232cac6eae712ff7"},
-							{Algorithm: "sha256", Value: "b7443c1b529588d98a074266087f79b595657ac7274191c34b10a9ceedfa950e"},
-						},
-					},
-					{
-						Path: "/usr/share/info/gmp.info.gz",
-						Size: "2380",
-						Digests: []file.Digest{
-							{Algorithm: "md5", Value: "cf6880fb0d862ee1da0d13c3831b5720"},
-							{Algorithm: "sha256", Value: "a13c8eecda3f3e5ad1e09773e47a9686f07d9d494eaddf326f3696bbef1548fd"},
-						},
-					},
-				},
-				Backup: []pkg.AlpmFileRecord{},
-			},
+	gmpDbLocation := file.NewLocation("var/lib/pacman/local/gmp-6.2.1-2/desc")
+	treeSitterDbLocation := file.NewLocation("var/lib/pacman/local/tree-sitter-0.22.6-1/desc")
+	emacsDbLocation := file.NewLocation("var/lib/pacman/local/emacs-29.3-3/desc")
+	fuzzyDbLocation := file.NewLocation("var/lib/pacman/local/fuzzy-1.2-3/desc")
+	madeupDbLocation := file.NewLocation("var/lib/pacman/local/madeup-20.30-4/desc")
+
+	treeSitterPkg := pkg.Package{
+		Name:    "tree-sitter",
+		Version: "0.22.6-1",
+		Type:    pkg.AlpmPkg,
+		FoundBy: "alpm-db-cataloger",
+		Licenses: pkg.NewLicenseSet(
+			pkg.NewLicenseFromLocations("MIT", treeSitterDbLocation),
+		),
+		Locations: file.NewLocationSet(treeSitterDbLocation),
+		Metadata: pkg.AlpmDBEntry{
+			BasePackage:  "tree-sitter",
+			Package:      "tree-sitter",
+			Version:      "0.22.6-1",
+			Description:  "Incremental parsing library",
+			Architecture: "x86_64",
+			Size:         223539,
+			Packager:     "Daniel M. Capella <polyzen@archlinux.org>",
+			URL:          "https://github.com/tree-sitter/tree-sitter",
+			Validation:   "pgp",
+			Reason:       1,
+			Files:        []pkg.AlpmFileRecord{},
+			Backup:       []pkg.AlpmFileRecord{},
+			Provides:     []string{"libtree-sitter.so=0-64"},
 		},
 	}
 
-	// TODO: relationships are not under test yet
-	var expectedRelationships []artifact.Relationship
+	emacsPkg := pkg.Package{
+		Name:    "emacs",
+		Version: "29.3-3",
+		Type:    pkg.AlpmPkg,
+		FoundBy: "alpm-db-cataloger",
+		Licenses: pkg.NewLicenseSet(
+			pkg.NewLicenseFromLocations("GPL3", emacsDbLocation),
+		),
+		Locations: file.NewLocationSet(emacsDbLocation),
+		Metadata: pkg.AlpmDBEntry{
+			BasePackage:  "emacs",
+			Package:      "emacs",
+			Version:      "29.3-3",
+			Description:  "The extensible, customizable, self-documenting real-time display editor",
+			Architecture: "x86_64",
+			Size:         126427862,
+			Packager:     "Frederik Schwan <freswa@archlinux.org>",
+			URL:          "https://www.gnu.org/software/emacs/emacs.html",
+			Validation:   "pgp",
+			Files:        []pkg.AlpmFileRecord{},
+			Backup:       []pkg.AlpmFileRecord{},
+			Depends:      []string{"libtree-sitter.so=0-64"},
+		},
+	}
+
+	fuzzyPkg := pkg.Package{
+		Name:    "fuzzy",
+		Version: "1.2-3",
+		Type:    pkg.AlpmPkg,
+		FoundBy: "alpm-db-cataloger",
+		Locations: file.NewLocationSet(
+			fuzzyDbLocation,
+			file.NewLocation("var/lib/pacman/local/fuzzy-1.2-3/files"),
+		),
+		Metadata: pkg.AlpmDBEntry{
+			Package: "fuzzy",
+			Version: "1.2-3",
+			Files:   []pkg.AlpmFileRecord{},
+			Backup: []pkg.AlpmFileRecord{
+				{
+					Path: "/etc/fuzzy.conf",
+					Digests: []file.Digest{
+						{Algorithm: "md5", Value: "79fce043df7dfc676ae5ecb903762d8b"},
+					},
+				},
+			},
+			Depends: []string{"tree-sitter"},
+		},
+	}
+
+	madeupPkg := pkg.Package{
+		Name:      "madeup",
+		Version:   "20.30-4",
+		Type:      pkg.AlpmPkg,
+		FoundBy:   "alpm-db-cataloger",
+		Locations: file.NewLocationSet(madeupDbLocation),
+		Metadata: pkg.AlpmDBEntry{
+			Package: "madeup",
+			Version: "20.30-4",
+			Files:   []pkg.AlpmFileRecord{},
+			Backup:  []pkg.AlpmFileRecord{},
+			Depends: []string{"libtree-sitter.so"},
+		},
+	}
+
+	gmpPkg := pkg.Package{
+		Name:    "gmp",
+		Version: "6.2.1-2",
+		Type:    pkg.AlpmPkg,
+		FoundBy: "alpm-db-cataloger",
+		Licenses: pkg.NewLicenseSet(
+			pkg.NewLicenseFromLocations("LGPL3", gmpDbLocation),
+			pkg.NewLicenseFromLocations("GPL", gmpDbLocation),
+		),
+		Locations: file.NewLocationSet(
+			gmpDbLocation,
+			file.NewLocation("var/lib/pacman/local/gmp-6.2.1-2/files"),
+			file.NewLocation("var/lib/pacman/local/gmp-6.2.1-2/mtree"),
+		),
+		Metadata: pkg.AlpmDBEntry{
+			BasePackage:  "gmp",
+			Package:      "gmp",
+			Version:      "6.2.1-2",
+			Description:  "A free library for arbitrary precision arithmetic",
+			Architecture: "x86_64",
+			Size:         1044438,
+			Packager:     "Antonio Rojas <arojas@archlinux.org>",
+			URL:          "https://gmplib.org/",
+			Validation:   "pgp",
+			Reason:       1,
+			Depends:      []string{"gcc-libs", "sh", "libtree-sitter.so=1-64"},
+			Files: []pkg.AlpmFileRecord{
+				{
+					Path:    "/usr",
+					Type:    "dir",
+					Digests: []file.Digest{},
+				},
+				{
+					Path:    "/usr/include",
+					Type:    "dir",
+					Digests: []file.Digest{},
+				},
+				{
+					Path: "/usr/include/gmp.h",
+					Size: "84140",
+					Digests: []file.Digest{
+						{Algorithm: "md5", Value: "76595f70565c72550eb520809bf86856"},
+						{Algorithm: "sha256", Value: "91a614b9202453153fe3b7512d15e89659108b93ce8841c8e13789eb85da9e3a"},
+					},
+				},
+				{
+					Path: "/usr/include/gmpxx.h",
+					Size: "129113",
+					Digests: []file.Digest{
+						{Algorithm: "md5", Value: "ea3d21de4bcf7c696799c5c55dd3655b"},
+						{Algorithm: "sha256", Value: "0011ae411a0bc1030e07d968b32fdc1343f5ac2a17b7d28f493e7976dde2ac82"},
+					},
+				},
+				{
+					Path:    "/usr/lib",
+					Type:    "dir",
+					Digests: []file.Digest{},
+				},
+				{
+					Path:    "/usr/lib/libgmp.so",
+					Type:    "link",
+					Link:    "libgmp.so.10.4.1",
+					Digests: []file.Digest{},
+				},
+				{
+					Path:    "/usr/lib/libgmp.so.10",
+					Type:    "link",
+					Link:    "libgmp.so.10.4.1",
+					Digests: []file.Digest{},
+				},
+				{
+					Path: "/usr/lib/libgmp.so.10.4.1",
+					Size: "663224",
+					Digests: []file.Digest{
+						{Algorithm: "md5", Value: "d6d03eadacdd9048d5b2adf577e9d722"},
+						{Algorithm: "sha256", Value: "39898bd3d8d6785222432fa8b8aef7ce3b7e5bbfc66a52b7c0da09bed4adbe6a"},
+					},
+				},
+				{
+					Path:    "/usr/lib/libgmpxx.so",
+					Type:    "link",
+					Link:    "libgmpxx.so.4.6.1",
+					Digests: []file.Digest{},
+				},
+				{
+					Path:    "/usr/lib/libgmpxx.so.4",
+					Type:    "link",
+					Link:    "libgmpxx.so.4.6.1",
+					Digests: []file.Digest{},
+				},
+				{
+					Path: "/usr/lib/libgmpxx.so.4.6.1",
+					Size: "30680",
+					Digests: []file.Digest{
+						{Algorithm: "md5", Value: "dd5f0c4d635fa599fa7f4339c0e8814d"},
+						{Algorithm: "sha256", Value: "0ef67cbde4841f58d2e4b41f59425eb87c9eeaf4e649c060b326342c53bedbec"},
+					},
+				},
+				{
+					Path:    "/usr/lib/pkgconfig",
+					Type:    "dir",
+					Digests: []file.Digest{},
+				},
+				{
+					Path: "/usr/lib/pkgconfig/gmp.pc",
+					Size: "245",
+					Digests: []file.Digest{
+						{Algorithm: "md5", Value: "a91a9f1b66218cb77b9cd2cdf341756d"},
+						{Algorithm: "sha256", Value: "4e9de547a48c4e443781e9fa702a1ec5a23ee28b4bc520306cff2541a855be37"},
+					},
+				},
+				{
+					Path: "/usr/lib/pkgconfig/gmpxx.pc",
+					Size: "280",
+					Digests: []file.Digest{
+						{Algorithm: "md5", Value: "8c0f54e987934352177a6a30a811b001"},
+						{Algorithm: "sha256", Value: "fc5dbfbe75977057ba50953d94b9daecf696c9fdfe5b94692b832b44ecca871b"},
+					},
+				},
+				{
+					Path:    "/usr/share",
+					Type:    "dir",
+					Digests: []file.Digest{},
+				},
+				{
+					Path:    "/usr/share/info",
+					Type:    "dir",
+					Digests: []file.Digest{},
+				},
+				{
+					Path: "/usr/share/info/gmp.info-1.gz",
+					Size: "85892",
+					Digests: []file.Digest{
+						{Algorithm: "md5", Value: "63304d4d2f0247fb8a999fae66a81c19"},
+						{Algorithm: "sha256", Value: "86288c1531a2789db5da8b9838b5cde4db07bda230ae11eba23a1f33698bd14e"},
+					},
+				},
+				{
+					Path: "/usr/share/info/gmp.info-2.gz",
+					Size: "48484",
+					Digests: []file.Digest{
+						{Algorithm: "md5", Value: "4bb0dadec416d305232cac6eae712ff7"},
+						{Algorithm: "sha256", Value: "b7443c1b529588d98a074266087f79b595657ac7274191c34b10a9ceedfa950e"},
+					},
+				},
+				{
+					Path: "/usr/share/info/gmp.info.gz",
+					Size: "2380",
+					Digests: []file.Digest{
+						{Algorithm: "md5", Value: "cf6880fb0d862ee1da0d13c3831b5720"},
+						{Algorithm: "sha256", Value: "a13c8eecda3f3e5ad1e09773e47a9686f07d9d494eaddf326f3696bbef1548fd"},
+					},
+				},
+			},
+			Backup: []pkg.AlpmFileRecord{},
+		},
+	}
+
+	expectedPkgs := []pkg.Package{
+		treeSitterPkg,
+		emacsPkg,
+		fuzzyPkg,
+		madeupPkg,
+		gmpPkg,
+	}
+
+	expectedRelationships := []artifact.Relationship{
+		{ // exact spec lookup
+			From: treeSitterPkg,
+			To:   emacsPkg,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{ // package name lookup
+			From: treeSitterPkg,
+			To:   fuzzyPkg,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{ // library name lookup
+			From: treeSitterPkg,
+			To:   madeupPkg,
+			Type: artifact.DependencyOfRelationship,
+		},
+	}
 
 	pkgtest.NewCatalogTester().
-		FromDirectory(t, "test-fixtures/gmp-fixture").
+		FromDirectory(t, "test-fixtures/installed").
 		WithCompareOptions(cmpopts.IgnoreFields(pkg.AlpmFileRecord{}, "Time")).
 		Expects(expectedPkgs, expectedRelationships).
 		TestCataloger(t, NewDBCataloger())

syft/pkg/cataloger/arch/package.go

@@ -9,13 +9,16 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 )
 
-func newPackage(m *parsedData, release *linux.Release, dbLocation file.Location) pkg.Package {
+func newPackage(m *parsedData, release *linux.Release, dbLocation file.Location, otherLocations ...file.Location) pkg.Package {
 	licenseCandidates := strings.Split(m.Licenses, "\n")
 
+	locs := file.NewLocationSet(dbLocation)
+	locs.Add(otherLocations...)
+
 	p := pkg.Package{
 		Name:      m.Package,
 		Version:   m.Version,
-		Locations: file.NewLocationSet(dbLocation),
+		Locations: locs,
 		Licenses:  pkg.NewLicenseSet(pkg.NewLicensesFromLocation(dbLocation.WithoutAnnotations(), licenseCandidates...)...),
 		Type:      pkg.AlpmPkg,
 		PURL:      packageURL(m, release),

syft/pkg/cataloger/arch/parse_alpm_db.go

@@ -6,6 +6,7 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"path"
 	"path/filepath"
 	"strconv"
 	"strings"
@@ -14,6 +15,8 @@ import (
 	"github.com/mitchellh/mapstructure"
 	"github.com/vbatts/go-mtree"
 
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
@@ -43,33 +46,26 @@ func parseAlpmDB(_ context.Context, resolver file.Resolver, env *generic.Environ
 		return nil, nil, err
 	}
 
-	base := filepath.Dir(reader.RealPath)
-	r, err := getFileReader(filepath.Join(base, "mtree"), resolver)
-	if err != nil {
-		return nil, nil, err
+	if data == nil {
+		return nil, nil, nil
 	}
 
-	pkgFiles, err := parseMtree(r)
-	if err != nil {
-		return nil, nil, err
-	}
+	base := path.Dir(reader.RealPath)
 
 	// replace the files found the pacman database with the files from the mtree These contain more metadata and
 	// thus more useful.
-	// TODO: probably want to use MTREE and PKGINFO here
-	data.Files = pkgFiles
+	files, fileLoc := fetchPkgFiles(base, resolver)
+	backups, backupLoc := fetchBackupFiles(base, resolver)
 
-	// We only really do this to get any backup database entries from the files database
-	files := filepath.Join(base, "files")
-	_, err = getFileReader(files, resolver)
-	if err != nil {
-		return nil, nil, err
+	var locs []file.Location
+	if fileLoc != nil {
+		locs = append(locs, fileLoc.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.SupportingEvidenceAnnotation))
+		data.Files = files
 	}
-	filesMetadata, err := parseAlpmDBEntry(reader)
-	if err != nil {
-		return nil, nil, err
-	} else if filesMetadata != nil {
-		data.Backup = filesMetadata.Backup
+
+	if backupLoc != nil {
+		locs = append(locs, backupLoc.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.SupportingEvidenceAnnotation))
+		data.Backup = backups
 	}
 
 	if data.Package == "" {
@@ -81,10 +77,67 @@ func parseAlpmDB(_ context.Context, resolver file.Resolver, env *generic.Environ
 			data,
 			env.LinuxRelease,
 			reader.Location.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
+			locs...,
 		),
 	}, nil, nil
 }
 
+func fetchPkgFiles(base string, resolver file.Resolver) ([]pkg.AlpmFileRecord, *file.Location) {
+	// TODO: probably want to use MTREE and PKGINFO here
+	target := path.Join(base, "mtree")
+
+	loc, err := getLocation(target, resolver)
+	if err != nil {
+		log.WithFields("error", err, "path", target).Trace("failed to find mtree file")
+		return []pkg.AlpmFileRecord{}, nil
+	}
+	if loc == nil {
+		return []pkg.AlpmFileRecord{}, nil
+	}
+
+	reader, err := resolver.FileContentsByLocation(*loc)
+	if err != nil {
+		return []pkg.AlpmFileRecord{}, nil
+	}
+	defer internal.CloseAndLogError(reader, loc.RealPath)
+
+	pkgFiles, err := parseMtree(reader)
+	if err != nil {
+		log.WithFields("error", err, "path", target).Trace("failed to parse mtree file")
+		return []pkg.AlpmFileRecord{}, nil
+	}
+	return pkgFiles, loc
+}
+
+func fetchBackupFiles(base string, resolver file.Resolver) ([]pkg.AlpmFileRecord, *file.Location) {
+	// We only really do this to get any backup database entries from the files database
+	target := filepath.Join(base, "files")
+
+	loc, err := getLocation(target, resolver)
+	if err != nil {
+		log.WithFields("error", err, "path", target).Trace("failed to find alpm files")
+		return []pkg.AlpmFileRecord{}, nil
+	}
+	if loc == nil {
+		return []pkg.AlpmFileRecord{}, nil
+	}
+
+	reader, err := resolver.FileContentsByLocation(*loc)
+	if err != nil {
+		return []pkg.AlpmFileRecord{}, nil
+	}
+	defer internal.CloseAndLogError(reader, loc.RealPath)
+
+	filesMetadata, err := parseAlpmDBEntry(reader)
+	if err != nil {
+		return []pkg.AlpmFileRecord{}, nil
+	}
+	if filesMetadata != nil {
+		return filesMetadata.Backup, loc
+	}
+	return []pkg.AlpmFileRecord{}, loc
+}
+
 func parseAlpmDBEntry(reader io.Reader) (*parsedData, error) {
 	scanner := newScanner(reader)
 	metadata, err := parseDatabase(scanner)
@@ -118,7 +171,7 @@ func newScanner(reader io.Reader) *bufio.Scanner {
 	return scanner
 }
 
-func getFileReader(path string, resolver file.Resolver) (io.Reader, error) {
+func getLocation(path string, resolver file.Resolver) (*file.Location, error) {
 	locs, err := resolver.FilesByPath(path)
 	if err != nil {
 		return nil, err
@@ -127,12 +180,11 @@ func getFileReader(path string, resolver file.Resolver) (io.Reader, error) {
 	if len(locs) == 0 {
 		return nil, fmt.Errorf("could not find file: %s", path)
 	}
-	// TODO: Should we maybe check if we found the file
-	dbContentReader, err := resolver.FileContentsByLocation(locs[0])
-	if err != nil {
-		return nil, err
+
+	if len(locs) > 1 {
+		log.WithFields("path", path).Trace("multiple files found for path, using first path")
 	}
-	return dbContentReader, nil
+	return &locs[0], nil
 }
 
 func parseDatabase(b *bufio.Scanner) (*parsedData, error) {
@@ -155,9 +207,9 @@ func parseDatabase(b *bufio.Scanner) (*parsedData, error) {
 		case "files":
 			var files []map[string]string
 			for _, f := range strings.Split(value, "\n") {
-				path := fmt.Sprintf("/%s", f)
-				if ok := ignoredFiles[path]; !ok {
-					files = append(files, map[string]string{"path": path})
+				p := fmt.Sprintf("/%s", f)
+				if ok := ignoredFiles[p]; !ok {
+					files = append(files, map[string]string{"path": p})
 				}
 			}
 			pkgFields[key] = files
@@ -165,10 +217,10 @@ func parseDatabase(b *bufio.Scanner) (*parsedData, error) {
 			var backup []map[string]interface{}
 			for _, f := range strings.Split(value, "\n") {
 				fields := strings.SplitN(f, "\t", 2)
-				path := fmt.Sprintf("/%s", fields[0])
-				if ok := ignoredFiles[path]; !ok {
+				p := fmt.Sprintf("/%s", fields[0])
+				if ok := ignoredFiles[p]; !ok {
 					backup = append(backup, map[string]interface{}{
-						"path": path,
+						"path": p,
 						"digests": []file.Digest{{
 							Algorithm: "md5",
 							Value:     fields[1],
@@ -176,6 +228,8 @@ func parseDatabase(b *bufio.Scanner) (*parsedData, error) {
 				}
 			}
 			pkgFields[key] = backup
+		case "depends", "provides":
+			pkgFields[key] = processLibrarySpecs(value)
 		case "reason":
 			fallthrough
 		case "size":
@@ -191,6 +245,19 @@ func parseDatabase(b *bufio.Scanner) (*parsedData, error) {
 	return parsePkgFiles(pkgFields)
 }
 
+func processLibrarySpecs(value string) []string {
+	lines := strings.Split(value, "\n")
+	librarySpecs := make([]string, 0)
+	for _, line := range lines {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		librarySpecs = append(librarySpecs, line)
+	}
+	return librarySpecs
+}
+
 func parsePkgFiles(pkgFields map[string]interface{}) (*parsedData, error) {
 	var entry parsedData
 	if err := mapstructure.Decode(pkgFields, &entry); err != nil {
@@ -201,6 +268,10 @@ func parsePkgFiles(pkgFields map[string]interface{}) (*parsedData, error) {
 		entry.Backup = make([]pkg.AlpmFileRecord, 0)
 	}
 
+	if entry.Files == nil {
+		entry.Files = make([]pkg.AlpmFileRecord, 0)
+	}
+
 	if entry.Package == "" && len(entry.Files) == 0 && len(entry.Backup) == 0 {
 		return nil, nil
 	}

syft/pkg/cataloger/arch/parse_alpm_db_test.go

@@ -17,74 +17,120 @@ func TestDatabaseParser(t *testing.T) {
 	tests := []struct {
 		name     string
 		fixture  string
-		expected pkg.AlpmDBEntry
+		expected *parsedData
 	}{
 		{
-			name:    "test alpm database parsing",
+			name:    "simple desc parsing",
 			fixture: "test-fixtures/files",
-			expected: pkg.AlpmDBEntry{
-				Backup: []pkg.AlpmFileRecord{
-					{
-						Path: "/etc/pacman.conf",
-						Digests: []file.Digest{{
-							Algorithm: "md5",
-							Value:     "de541390e52468165b96511c4665bff4",
-						}},
+			expected: &parsedData{
+				AlpmDBEntry: pkg.AlpmDBEntry{
+					Backup: []pkg.AlpmFileRecord{
+						{
+							Path: "/etc/pacman.conf",
+							Digests: []file.Digest{{
+								Algorithm: "md5",
+								Value:     "de541390e52468165b96511c4665bff4",
+							}},
+						},
+						{
+							Path: "/etc/makepkg.conf",
+							Digests: []file.Digest{{
+								Algorithm: "md5",
+								Value:     "79fce043df7dfc676ae5ecb903762d8b",
+							}},
+						},
 					},
-					{
-						Path: "/etc/makepkg.conf",
-						Digests: []file.Digest{{
-							Algorithm: "md5",
-							Value:     "79fce043df7dfc676ae5ecb903762d8b",
-						}},
+					Files: []pkg.AlpmFileRecord{
+						{
+							Path: "/etc/",
+						},
+						{
+							Path: "/etc/makepkg.conf",
+						},
+						{
+							Path: "/etc/pacman.conf",
+						},
+						{
+							Path: "/usr/",
+						},
+						{
+							Path: "/usr/bin/",
+						},
+						{
+							Path: "/usr/bin/makepkg",
+						},
+						{
+							Path: "/usr/bin/makepkg-template",
+						},
+						{
+							Path: "/usr/bin/pacman",
+						},
+						{
+							Path: "/usr/bin/pacman-conf",
+						},
+						{
+							Path: "/var/",
+						},
+						{
+							Path: "/var/cache/",
+						},
+						{
+							Path: "/var/cache/pacman/",
+						},
+						{
+							Path: "/var/cache/pacman/pkg/",
+						},
+						{
+							Path: "/var/lib/",
+						},
+						{
+							Path: "/var/lib/pacman/",
+						},
 					},
 				},
-				Files: []pkg.AlpmFileRecord{
-					{
-						Path: "/etc/",
-					},
-					{
-						Path: "/etc/makepkg.conf",
-					},
-					{
-						Path: "/etc/pacman.conf",
-					},
-					{
-						Path: "/usr/",
-					},
-					{
-						Path: "/usr/bin/",
-					},
-					{
-						Path: "/usr/bin/makepkg",
-					},
-					{
-						Path: "/usr/bin/makepkg-template",
-					},
-					{
-						Path: "/usr/bin/pacman",
-					},
-					{
-						Path: "/usr/bin/pacman-conf",
-					},
-					{
-						Path: "/var/",
-					},
-					{
-						Path: "/var/cache/",
-					},
-					{
-						Path: "/var/cache/pacman/",
-					},
-					{
-						Path: "/var/cache/pacman/pkg/",
-					},
-					{
-						Path: "/var/lib/",
-					},
-					{
-						Path: "/var/lib/pacman/",
-					},
+			},
+		},
+		{
+			name:    "with dependencies",
+			fixture: "test-fixtures/installed/var/lib/pacman/local/gmp-6.2.1-2/desc",
+			expected: &parsedData{
+				Licenses: "LGPL3\nGPL",
+				AlpmDBEntry: pkg.AlpmDBEntry{
+					BasePackage:  "gmp",
+					Package:      "gmp",
+					Version:      "6.2.1-2",
+					Description:  "A free library for arbitrary precision arithmetic",
+					Architecture: "x86_64",
+					Size:         1044438,
+					Packager:     "Antonio Rojas <arojas@archlinux.org>",
+					URL:          "https://gmplib.org/",
+					Validation:   "pgp",
+					Reason:       1,
+					Files:        []pkg.AlpmFileRecord{},
+					Backup:       []pkg.AlpmFileRecord{},
+					Depends:      []string{"gcc-libs", "sh", "libtree-sitter.so=1-64"},
+				},
+			},
+		},
+		{
+			name:    "with provides",
+			fixture: "test-fixtures/installed/var/lib/pacman/local/tree-sitter-0.22.6-1/desc",
+			expected: &parsedData{
+				Licenses: "MIT",
+				AlpmDBEntry: pkg.AlpmDBEntry{
+					BasePackage:  "tree-sitter",
+					Package:      "tree-sitter",
+					Version:      "0.22.6-1",
+					Description:  "Incremental parsing library",
+					Architecture: "x86_64",
+					Size:         223539,
+					Packager:     "Daniel M. Capella <polyzen@archlinux.org>",
+					URL:          "https://github.com/tree-sitter/tree-sitter",
+					Validation:   "pgp",
+					Reason:       1,
+					Files:        []pkg.AlpmFileRecord{},
+					Backup:       []pkg.AlpmFileRecord{},
+					Provides:     []string{"libtree-sitter.so=0-64"},
 				},
 			},
 		},
@@ -101,13 +147,10 @@ func TestDatabaseParser(t *testing.T) {
 			entry, err := parseAlpmDBEntry(reader)
 			require.NoError(t, err)
 
-			if diff := cmp.Diff(entry.Files, test.expected.Files); diff != "" {
-				t.Errorf("Files mismatch (-want +got):\n%s", diff)
+			if diff := cmp.Diff(test.expected, entry); diff != "" {
+				t.Errorf("parsed data mismatch (-want +got):\n%s", diff)
 			}
 
-			if diff := cmp.Diff(entry.Backup, test.expected.Backup); diff != "" {
-				t.Errorf("Backup mismatch (-want +got):\n%s", diff)
-			}
 		})
 	}
 }

syft/pkg/cataloger/arch/test-fixtures/installed/var/lib/pacman/local/emacs-29.3-3/desc

@@ -0,0 +1,38 @@
+%NAME%
+emacs
+
+%VERSION%
+29.3-3
+
+%BASE%
+emacs
+
+%DESC%
+The extensible, customizable, self-documenting real-time display editor
+
+%URL%
+https://www.gnu.org/software/emacs/emacs.html
+
+%ARCH%
+x86_64
+
+%BUILDDATE%
+1714249917
+
+%INSTALLDATE%
+1715026363
+
+%PACKAGER%
+Frederik Schwan <freswa@archlinux.org>
+
+%SIZE%
+126427862
+
+%LICENSE%
+GPL3
+
+%VALIDATION%
+pgp
+
+%DEPENDS%
+libtree-sitter.so=0-64

syft/pkg/cataloger/arch/test-fixtures/installed/var/lib/pacman/local/fuzzy-1.2-3/desc

@@ -0,0 +1,8 @@
+%NAME%
+fuzzy
+
+%VERSION%
+1.2-3
+
+%DEPENDS%
+tree-sitter

syft/pkg/cataloger/arch/test-fixtures/installed/var/lib/pacman/local/fuzzy-1.2-3/files

@@ -0,0 +1,6 @@
+%FILES%
+etc/
+etc/fuzzy.conf
+
+%BACKUP%
+etc/fuzzy.conf	79fce043df7dfc676ae5ecb903762d8b

syft/pkg/cataloger/arch/test-fixtures/installed/var/lib/pacman/local/gmp-6.2.1-2/desc

@@ -41,4 +41,4 @@ pgp
 %DEPENDS%
 gcc-libs
 sh
-
+libtree-sitter.so=1-64

syft/pkg/cataloger/arch/test-fixtures/installed/var/lib/pacman/local/madeup-20.30-4/desc

@@ -0,0 +1,8 @@
+%NAME%
+madeup
+
+%VERSION%
+20.30-4
+
+%DEPENDS%
+libtree-sitter.so

syft/pkg/cataloger/arch/test-fixtures/installed/var/lib/pacman/local/tree-sitter-0.22.6-1/desc

@@ -0,0 +1,41 @@
+%NAME%
+tree-sitter
+
+%VERSION%
+0.22.6-1
+
+%BASE%
+tree-sitter
+
+%DESC%
+Incremental parsing library
+
+%URL%
+https://github.com/tree-sitter/tree-sitter
+
+%ARCH%
+x86_64
+
+%BUILDDATE%
+1714945746
+
+%INSTALLDATE%
+1715026360
+
+%PACKAGER%
+Daniel M. Capella <polyzen@archlinux.org>
+
+%SIZE%
+223539
+
+%REASON%
+1
+
+%LICENSE%
+MIT
+
+%VALIDATION%
+pgp
+
+%PROVIDES%
+libtree-sitter.so=0-64

syft/pkg/cataloger/binary/classifier.go

@@ -17,7 +17,6 @@ import (
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/cpe"
 	"github.com/anchore/syft/syft/file"
-	"github.com/anchore/syft/syft/internal/unionreader"
 	"github.com/anchore/syft/syft/pkg"
 )
 
@@ -231,14 +230,10 @@ func getContents(resolver file.Resolver, location file.Location) ([]byte, error)
 	if err != nil {
 		return nil, err
 	}
-
-	unionReader, err := unionreader.GetUnionReader(reader)
-	if err != nil {
-		return nil, fmt.Errorf("unable to get union reader for file: %w", err)
-	}
+	defer internal.CloseAndLogError(reader, location.AccessPath)
 
 	// TODO: there may be room for improvement here, as this may use an excessive amount of memory. Alternate approach is to leverage a RuneReader.
-	contents, err := io.ReadAll(unionReader)
+	contents, err := io.ReadAll(reader)
 	if err != nil {
 		return nil, fmt.Errorf("unable to get contents for file: %w", err)
 	}

syft/pkg/cataloger/binary/classifier_cataloger_test.go

@@ -37,6 +37,17 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 		logicalFixture string
 		expected       pkg.Package
 	}{
+		{
+			logicalFixture: "arangodb/3.11.8/linux-amd64",
+			expected: pkg.Package{
+				Name:      "arangodb",
+				Version:   "3.11.8",
+				Type:      "binary",
+				PURL:      "pkg:generic/arangodb@3.11.8",
+				Locations: locations("arangosh"),
+				Metadata:  metadata("arangodb-binary"),
+			},
+		},
 		{
 			logicalFixture: "postgres/15beta4/linux-amd64",
 			expected: pkg.Package{
@@ -843,7 +854,7 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 			},
 		},
 		{
-			logicalFixture: "erlexec/25.3.2.6/linux-amd64",
+			logicalFixture: "erlang/25.3.2.6/linux-amd64",
 			expected: pkg.Package{
 				Name:      "erlang",
 				Version:   "25.3.2.6",
@@ -854,7 +865,7 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 			},
 		},
 		{
-			logicalFixture: "erlexec/26.2.0.0/linux-amd64",
+			logicalFixture: "erlang/26.2.0.0/linux-amd64",
 			expected: pkg.Package{
 				Name:      "erlang",
 				Version:   "26.2",
@@ -864,6 +875,17 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 				Metadata:  metadata("erlang-binary"),
 			},
 		},
+		{
+			logicalFixture: "erlang/26.2.4/linux-amd64",
+			expected: pkg.Package{
+				Name:      "erlang",
+				Version:   "26.2.4",
+				Type:      "binary",
+				PURL:      "pkg:generic/erlang@26.2.4",
+				Locations: locations("liberts_internal.a"),
+				Metadata:  metadata("erlang-library"),
+			},
+		},
 		{
 			logicalFixture: "nginx/1.25.1/linux-amd64",
 			expected: pkg.Package{

syft/pkg/cataloger/binary/classifiers.go

@@ -246,6 +246,7 @@ func DefaultClassifiers() []Classifier {
 				`(?m)memcached\s(?P<version>[0-9]+\.[0-9]+\.[0-9]+)`),
 			Package: "memcached",
 			PURL:    mustPURL("pkg:generic/memcached@version"),
+			CPEs:    singleCPE("cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:*"),
 		},
 		{
 			Class:    "traefik-binary",
@@ -256,6 +257,16 @@ func DefaultClassifiers() []Classifier {
 				`(?m)(\x00|\x{FFFD})v?(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha[0-9]|-beta[0-9]|-rc[0-9])?)\x00`),
 			Package: "traefik",
 			PURL:    mustPURL("pkg:generic/traefik@version"),
+			CPEs:    singleCPE("cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*"),
+		},
+		{
+			Class:    "arangodb-binary",
+			FileGlob: "**/arangosh",
+			EvidenceMatcher: FileContentsVersionMatcher(
+				`(?m)ArangoDB\s\x00*(?P<version>[0-9]+\.[0-9]+\.[0-9]+)\s\[linux\]`),
+			Package: "arangodb",
+			PURL:    mustPURL("pkg:generic/arangodb@version"),
+			CPEs:    singleCPE("cpe:2.3:a:arangodb:arangodb:*:*:*:*:*:*:*:*"),
 		},
 		{
 			Class:    "postgresql-binary",
@@ -268,6 +279,7 @@ func DefaultClassifiers() []Classifier {
 				`(?m)(\x00|\?)PostgreSQL (?P<version>[0-9]+(\.[0-9]+)?(\.[0-9]+)?(alpha[0-9]|beta[0-9]|rc[0-9])?)`),
 			Package: "postgresql",
 			PURL:    mustPURL("pkg:generic/postgresql@version"),
+			CPEs:    singleCPE("cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*"),
 		},
 		{
 			Class:    "mysql-binary",
@@ -361,11 +373,28 @@ func DefaultClassifiers() []Classifier {
 			EvidenceMatcher: evidenceMatchers(
 				FileContentsVersionMatcher(
 					// <artificial>[NUL]/usr/src/otp_src_25.3.2.6/erts/
-					`(?m)/src/otp_src_(?P<version>[0-9]+\.[0-9]+(\.[0-9]+\.[0-9]+)?)/erts/`,
+					`(?m)/src/otp_src_(?P<version>[0-9]+\.[0-9]+(\.[0-9]+){0,2}(-rc[0-9])?)/erts/`,
 				),
 				FileContentsVersionMatcher(
 					// <artificial>[NUL]/usr/local/src/otp-25.3.2.7/erts/
-					`(?m)/usr/local/src/otp-(?P<version>[0-9]+\.[0-9]+(\.[0-9]+\.[0-9]+)?)/erts/`,
+					`(?m)/usr/local/src/otp-(?P<version>[0-9]+\.[0-9]+(\.[0-9]+){0,2}(-rc[0-9])?)/erts/`,
+				),
+			),
+			Package: "erlang",
+			PURL:    mustPURL("pkg:generic/erlang@version"),
+			CPEs:    singleCPE("cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"),
+		},
+		{
+			Class:    "erlang-library",
+			FileGlob: "**/liberts_internal.a",
+			EvidenceMatcher: evidenceMatchers(
+				FileContentsVersionMatcher(
+					// <artificial>[NUL]/usr/src/otp_src_25.3.2.6/erts/
+					`(?m)/src/otp_src_(?P<version>[0-9]+\.[0-9]+(\.[0-9]+){0,2}(-rc[0-9])?)/erts/`,
+				),
+				FileContentsVersionMatcher(
+					// <artificial>[NUL]/usr/local/src/otp-25.3.2.7/erts/
+					`(?m)/usr/local/src/otp-(?P<version>[0-9]+\.[0-9]+(\.[0-9]+){0,2}(-rc[0-9])?)/erts/`,
 				),
 			),
 			Package: "erlang",

syft/pkg/cataloger/binary/test-fixtures/config.yaml

@@ -31,20 +31,30 @@ from-images:
     paths:
       - /usr/local/bin/gcc
 
-  - version: 25.3.2.6
+  - name: erlang
+    version: 25.3.2.6
     images:
       - ref: erlang:25.3.2.6@sha256:0d1e530ec0e8047094f0a1d841754515bad9b0554260a3147fb34df31b3064fe
         platform: linux/amd64
     paths:
       - /usr/local/lib/erlang/erts-13.2.2.3/bin/erlexec
 
-  - version: 26.2.0.0
+  - name: erlang
+    version: 26.2.0.0
     images:
       - ref: erlang:26.2.0.0@sha256:31c3aa505fbe7526ca83c57b64e56ba505e62733e7e6518f4c06219de6e7396e
         platform: linux/amd64
     paths:
       - /usr/local/lib/erlang/erts-14.2/bin/erlexec
 
+  - name: erlang
+    version: 26.2.4
+    images:
+      - ref: erlang:26.2.4.0@sha256:bdb5bac0612856ec85982171dcd4a11de2e08e7f7469c86f3eb936bdfd1ec204
+        platform: linux/amd64
+    paths:
+      - /usr/local/lib/erlang/erts-14.2.4/lib/internal/liberts_internal.a
+
   - version: 1.21.3
     images:
       - ref: golang:1.21.3@sha256:3ce8313c3513515040870c55e0c041a2b94f3576a58cfd3948633604214aa811
@@ -260,6 +270,13 @@ from-images:
 #    paths:
 #      - /usr/bin/perl
 
+  - name: arangodb
+    version: 3.11.8
+    images:
+      - ref: arangodb:3.11.8@sha256:16893e767f47d28e3297839637741e5c4023e815adf860dfc674e1a36c7c7db0
+        platform: linux/amd64
+    paths:
+      - /usr/bin/arangosh
   - version: 15.1
     images:
       - ref: postgres:15.1@sha256:b4140dd3a62f364f16a82c1bd88d28b9887ecb47f07dbe2941237d073574d428

syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/README.md

@@ -0,0 +1,135 @@
+## Summary
+This image illustrates a few examples of how ELF executables can be assembled and illustrated in an SBOM.
+
+### Example 1: elf-test-fixtures/elfbinwithsisterlib
+This example builds two binaries with srcs found in elfsrc1 and elfsrc2.
+
+
+
+- 3 separate libs, two with the same name, 1 different, all different locations, but same output when:
+
+
+
+```
+objdump -s -j .note.package  /usr/local/bin/elftests/elfbinwithnestedlib/bin/lib/libhello_world.so
+
+/usr/local/bin/elftests/elfbinwithnestedlib/bin/lib/libhello_world.so:     file format elf64-littleaarch64
+
+Contents of section .note.package:
+ 0000 7b227479 7065223a 20227465 73746669  {"type": "testfi
+ 0010 78747572 65222c22 6c696365 6e736522  xture","license"
+ 0020 3a224d49 54222c22 636f6d6d 6974223a  :"MIT","commit":
+ 0030 22353533 34633338 64306666 65663961  "5534c38d0ffef9a
+ 0040 33663833 31353466 30623761 37666236  3f83154f0b7a7fb6
+ 0050 61623061 62366462 62222c22 736f7572  ab0ab6dbb","sour
+ 0060 63655265 706f223a 22687474 70733a2f  ceRepo":"https:/
+ 0070 2f676974 6875622e 636f6d2f 736f6d65  /github.com/some
+ 0080 6f6e652f 736f6d65 77686572 652e6769  one/somewhere.gi
+ 0090 74222c22 76656e64 6f72223a 20227379  t","vendor": "sy
+ 00a0 6674222c 22737973 74656d22 3a202273  ft","system": "s
+ 00b0 79667473 7973222c 226e616d 65223a20  yftsys","name":
+ 00c0 226c6962 68656c6c 6f5f776f 726c642e  "libhello_world.
+ 00d0 736f222c 22766572 73696f6e 223a2022  so","version": "
+ 00e0 302e3031 222c2270 75726c22 3a202270  0.01","purl": "p
+ 00f0 6b673a67 656e6572 69632f73 79667473  kg:generic/syfts
+ 0100 79732f73 79667474 65737466 69787475  ys/syfttestfixtu
+ 0110 72654030 2e303122 2c226370 65223a20  re@0.01","cpe":
+ 0120 22637065 3a2f6f3a 73796674 3a737966  "cpe:/o:syft:syf
+ 0130 74737973 5f746573 74666978 74757265  tsys_testfixture
+ 0140 5f737966 74746573 74666978 74757265  _syfttestfixture
+ 0150 3a302e30 31227d0a                    :0.01"}.
+```
+
+### Binaries
+```
+/usr/local/bin/elftests/elfbinwithnestedlib/bin/elfbinwithnestedlib
+/usr/local/bin/elftests/elfbinwithsisterlib/bin/elfwithparallellibbin2
+/usr/local/bin/elftests/elfbinwithsisterlib/bin/elfwithparallellibbin1
+```
+
+#### Libraries
+```
+/usr/local/bin/elftests/elfbinwithnestedlib/bin/lib/libhello_world.so
+/usr/local/bin/elftests/elfbinwithsisterlib/lib/libhello_world.so
+/usr/local/bin/elftests/elfbinwithsisterlib/lib/libhello_world2.so
+```
+
+#### Binaries related to Libraries
+The resulting SBOM shoult show the following relationships:
+```
+elfbinwithnestedlib -> libhello_world.so
+elfwithparallellibbin2 -> libhello_world.so
+elfwithparallellibbin1 -> libhello_world2.so
+```
+#### Desired State
+We want to drop the package to file relationships and instead do package to package
+
+Single relationship
+ElfPackage `libhellp_world.so` -> ElfPackage `syfttestfixture` library
+
+Also relationship between the binaries and the rpm packages transitive dependencies that come from the library
+
+#### Actual state
+```mermaid
+flowchart
+    nested(.../bin/elfbinwithnestedlib)
+    parallel1(.../bin/elfwithparallellibbin1)
+    parallel2(.../bin/elfwithparallellibbin2)
+    
+    nestedLib(.../nested/bin/lib/libhello_world.so)
+    sisterLib1(.../sister/lib/libhello_world.so)
+    sisterLib2(.../sister/lib/libhello_world2.so)
+    
+    libc(libc.so.6)
+    libstdc(libstdc++.so.6)
+
+    nested --> |imports ../bin/lib/libhello_world.so| nestedLib
+    nested --> |imports libhello_world.so| sisterLib1
+    nested --> |imports libstdc++.so.6| libstdc
+    nested --> |imports libc.so.6| libc
+
+    nestedLib --> |imports libc.so.6| libc
+    sisterLib1 --> |imports libc.so.6| libc
+
+    parallel1 --> nestedLib
+    parallel1 --> sisterLib1
+    parallel1 --> libstdc
+    parallel1 --> libc
+
+    parallel2 --> |imports ../lib/libhello_world2.so| sisterLib2
+    parallel2 --> |imports libhello_world2.so| sisterLib2
+    parallel2 --> libstdc
+    parallel2 --> libc
+
+
+    sisterLib2 --> libc
+```
+
+#### Desired relationships
+```mermaid
+flowchart LR
+    %% Data sync workflow...
+
+    subgraph logicalAppPackage [ELF Package - 'syfttestfixture']
+        nested(.../bin/elfbinwithnestedlib)
+        parallel1(.../bin/elfwithparallellibbin1)
+        parallel2(.../bin/elfwithparallellibbin2)
+    end
+
+
+    subgraph logicalLibPackage [ELF Package - 'libhello_world.so']
+        nestedLib(.../nested/bin/lib/libhello_world.so)
+        sisterLib1(.../sister/lib/libhello_world.so)
+        sisterLib2(.../sister/lib/libhello_world2.so)
+    end
+
+
+    logicalLibPackage --> |dependency-of| logicalAppPackage
+
+  
+    %% RPM packages
+
+    libstdc(libstdc++) --> |dependency-of| logicalAppPackage
+    glibc(glibc) --> |dependency-of| logicalAppPackage
+    glibc(glibc) --> |dependency-of| logicalLibPackage
+```

syft/pkg/cataloger/debian/package.go

@@ -265,8 +265,9 @@ func fetchCopyrightContents(resolver file.Resolver, dbLocation file.Location, m
 
 	reader, err := resolver.FileContentsByLocation(*location)
 	if err != nil {
-		log.Warnf("failed to fetch deb copyright contents (package=%s): %w", m.Package, err)
+		log.Warnf("failed to fetch deb copyright contents (package=%s): %s", m.Package, err)
 	}
+	defer internal.CloseAndLogError(reader, location.RealPath)
 
 	l := location.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.SupportingEvidenceAnnotation)
 

syft/pkg/cataloger/dotnet/parse_dotnet_portable_executable.go

@@ -69,16 +69,13 @@ func buildDotNetPackage(versionResources map[string]string, f file.LocationReadC
 	}
 
 	metadata := pkg.DotnetPortableExecutableEntry{
-		AssemblyVersion:  versionResources["Assembly Version"],
-		LegalCopyright:   versionResources["LegalCopyright"],
-		Comments:         versionResources["Comments"],
-		InternalName:     versionResources["InternalName"],
-		CompanyName:      versionResources["CompanyName"],
-		ProductName:      versionResources["ProductName"],
-		ProductVersion:   versionResources["ProductVersion"],
-		FileDescription:  versionResources["FileDescription"],
-		FileVersion:      versionResources["FileVersion"],
-		OriginalFilename: versionResources["OriginalFilename"],
+		AssemblyVersion: versionResources["Assembly Version"],
+		LegalCopyright:  versionResources["LegalCopyright"],
+		Comments:        versionResources["Comments"],
+		InternalName:    versionResources["InternalName"],
+		CompanyName:     versionResources["CompanyName"],
+		ProductName:     versionResources["ProductName"],
+		ProductVersion:  versionResources["ProductVersion"],
 	}
 
 	dnpkg = pkg.Package{
@@ -218,7 +215,7 @@ func findName(versionResources map[string]string) string {
 	}
 
 	for _, field := range nameFields {
-		value := resolveValue(versionResources[field], versionResources, nil)
+		value := spaceNormalize(versionResources[field])
 		if value == "" {
 			continue
 		}
@@ -228,40 +225,6 @@ func findName(versionResources map[string]string) string {
 	return ""
 }
 
-func resolveValue(value string, collection map[string]string, visited map[string]bool) string {
-	value = spaceNormalize(value)
-
-	if value == "" {
-		return ""
-	}
-
-	if visited == nil {
-		visited = make(map[string]bool)
-	}
-
-	if visited[value] {
-		return value
-	}
-	visited[value] = true
-
-	hasIndirect, nextKey := hasIndirectFieldPrefix(value)
-	if !hasIndirect {
-		return value
-	}
-
-	return resolveValue(collection[nextKey], collection, visited)
-}
-
-func hasIndirectFieldPrefix(value string) (bool, string) {
-	for _, prefix := range []string{"f#", "p("} {
-		cleanValue := strings.TrimPrefix(value, prefix)
-		if cleanValue != value {
-			return true, cleanValue
-		}
-	}
-	return false, value
-}
-
 // normalizes a string to a trimmed version with all contigous whitespace collapsed to a single space character
 func spaceNormalize(value string) string {
 	value = strings.TrimSpace(value)

syft/pkg/cataloger/dotnet/parse_dotnet_portable_executable_test.go

@@ -346,126 +346,3 @@ func Test_spaceNormalize(t *testing.T) {
 		})
 	}
 }
-
-func Test_resolveValue(t *testing.T) {
-
-	tests := []struct {
-		name       string
-		value      string
-		collection map[string]string
-		want       string
-	}{
-		{
-			name:  "simple value",
-			value: "value",
-			collection: map[string]string{
-				"key": "value",
-			},
-			want: "value",
-		},
-		{
-			name:  "simple value with spaces",
-			value: " value ",
-			collection: map[string]string{
-				"key": "value",
-			},
-			want: "value",
-		},
-		{
-			name:  "indirect value - f#",
-			value: "f#other",
-			collection: map[string]string{
-				"key":   "f#other",
-				"other": "value",
-			},
-			want: "value",
-		},
-		{
-			name:  "indirect value - p(",
-			value: "f#other",
-			collection: map[string]string{
-				"key":   "p(other",
-				"other": "value",
-			},
-			want: "value",
-		},
-		{
-			name:  "indirect value with cycles",
-			value: "f#other",
-			collection: map[string]string{
-				"key":   "f#other",
-				"other": "f#key",
-			},
-			want: "f#other", // this is NOT ideal, but there is no "good" answer here
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, resolveValue(tt.value, tt.collection, nil))
-		})
-	}
-}
-
-func Test_findVersion(t *testing.T) {
-
-	tests := []struct {
-		name             string
-		versionResources map[string]string
-		want             string
-	}{
-		{
-			name: "prefer file version over product version (when both semver)",
-			versionResources: map[string]string{
-				"FileVersion":    "1.2.3",
-				"ProductVersion": "4.5.6",
-			},
-			want: "4.5.6",
-		},
-		{
-			name: "prefer file version over product version (when both semver)",
-			versionResources: map[string]string{
-				"FileVersion":    "1.2.3",
-				"ProductVersion": "4.5.6.7",
-			},
-			want: "1.2.3",
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, findVersion(tt.versionResources))
-		})
-	}
-}
-
-func Test_keepGreaterSemanticVersion(t *testing.T) {
-	tests := []struct {
-		name           string
-		productVersion string
-		fileVersion    string
-		want           string
-	}{
-		{
-			name:           "product semver is greater",
-			productVersion: "3.0.0",
-			fileVersion:    "2.0.0",
-			want:           "3.0.0",
-		},
-		{
-			name:           "file semver is greater",
-			productVersion: "2.0.0",
-			fileVersion:    "3.0.0",
-			want:           "3.0.0",
-		},
-		{
-			name:           "semver preferred over non-semver",
-			productVersion: "3.0.0.2",
-			fileVersion:    "3.0.0",
-			want:           "3.0.0",
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, keepGreaterSemanticVersion(tt.productVersion, tt.fileVersion))
-		})
-	}
-}

syft/pkg/cataloger/gentoo/parse_portage_contents.go

@@ -12,6 +12,7 @@ import (
 
 	"github.com/scylladb/go-set/strset"
 
+	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
@@ -65,6 +66,7 @@ func addFiles(resolver file.Resolver, dbLocation file.Location, p *pkg.Package)
 		log.WithFields("path", dbLocation.RealPath).Warnf("failed to fetch portage contents (package=%s): %+v", p.Name, err)
 		return
 	}
+	defer internal.CloseAndLogError(contentsReader, dbLocation.RealPath)
 
 	entry, ok := p.Metadata.(pkg.PortageEntry)
 	if !ok {
@@ -106,6 +108,7 @@ func addLicenses(resolver file.Resolver, dbLocation file.Location, p *pkg.Packag
 		log.WithFields("path", dbLocation.RealPath).Warnf("failed to fetch portage LICENSE: %+v", err)
 		return
 	}
+	defer internal.CloseAndLogError(licenseReader, location.RealPath)
 
 	findings := strset.New()
 	scanner := bufio.NewScanner(licenseReader)
@@ -141,6 +144,7 @@ func addSize(resolver file.Resolver, dbLocation file.Location, p *pkg.Package) {
 		log.WithFields("name", p.Name).Warnf("failed to fetch portage SIZE: %+v", err)
 		return
 	}
+	defer internal.CloseAndLogError(sizeReader, location.RealPath)
 
 	scanner := bufio.NewScanner(sizeReader)
 	for scanner.Scan() {

syft/pkg/cataloger/golang/config.go

@@ -2,7 +2,7 @@ package golang
 
 import (
 	"os"
-	"path"
+	"path/filepath"
 	"strings"
 
 	"github.com/mitchellh/go-homedir"
@@ -75,11 +75,11 @@ func DefaultCatalogerConfig() CatalogerConfig {
 			if err != nil {
 				log.Debug("unable to determine user home dir: %v", err)
 			} else {
-				goPath = path.Join(homeDir, "go")
+				goPath = filepath.Join(homeDir, "go")
 			}
 		}
 		if goPath != "" {
-			g.LocalModCacheDir = path.Join(goPath, "pkg", "mod")
+			g.LocalModCacheDir = filepath.Join(goPath, "pkg", "mod")
 		}
 	}
 	return g

syft/pkg/cataloger/golang/licenses.go

@@ -20,6 +20,7 @@ import (
 	"github.com/go-git/go-git/v5/storage/memory"
 	"github.com/scylladb/go-set/strset"
 
+	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/licenses"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/file"
@@ -160,24 +161,35 @@ func (c *goLicenses) findLicenses(resolver file.Resolver, globMatch string) (out
 	}
 
 	for _, l := range locations {
-		fileName := path.Base(l.RealPath)
-		if c.lowerLicenseFileNames.Has(strings.ToLower(fileName)) {
-			contents, err := resolver.FileContentsByLocation(l)
-			if err != nil {
-				return nil, err
-			}
-			parsed, err := licenses.Parse(contents, l)
-			if err != nil {
-				return nil, err
-			}
-
-			out = append(out, parsed...)
+		parsed, err := c.parseLicenseFromLocation(l, resolver)
+		if err != nil {
+			return nil, err
 		}
+		out = append(out, parsed...)
 	}
 
 	return
 }
 
+func (c *goLicenses) parseLicenseFromLocation(l file.Location, resolver file.Resolver) ([]pkg.License, error) {
+	var out []pkg.License
+	fileName := path.Base(l.RealPath)
+	if c.lowerLicenseFileNames.Has(strings.ToLower(fileName)) {
+		contents, err := resolver.FileContentsByLocation(l)
+		if err != nil {
+			return nil, err
+		}
+		defer internal.CloseAndLogError(contents, l.RealPath)
+		parsed, err := licenses.Parse(contents, l)
+		if err != nil {
+			return nil, err
+		}
+
+		out = append(out, parsed...)
+	}
+	return out, nil
+}
+
 func moduleDir(moduleName, moduleVersion string) string {
 	return fmt.Sprintf("%s@%s", processCaps(moduleName), moduleVersion)
 }

syft/pkg/cataloger/golang/parse_go_mod.go

@@ -10,6 +10,7 @@ import (
 
 	"golang.org/x/mod/modfile"
 
+	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
@@ -119,6 +120,7 @@ func parseGoSumFile(resolver file.Resolver, reader file.LocationReadCloser) (map
 	if err != nil {
 		return nil, err
 	}
+	defer internal.CloseAndLogError(contents, goSumLocation.AccessPath)
 
 	// go.sum has the format like:
 	// github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=

syft/pkg/cataloger/internal/cpegenerate/dictionary/data/cpe-index.json

@@ -2870,6 +2870,9 @@
       "earlybird": [
         "cpe:2.3:a:earlybird_project:earlybird:*:*:*:*:*:node.js:*:*"
       ],
+      "easy-email-editor": [
+        "cpe:2.3:a:zalify:easy_email:*:*:*:*:*:node.js:*:*"
+      ],
       "easy-static-server": [
         "cpe:2.3:a:easy-static-server_project:easy-static-server:*:*:*:*:*:node.js:*:*"
       ],

syft/pkg/cataloger/java/graalvm_native_image_cataloger.go

@@ -580,20 +580,27 @@ func (c *nativeImageCataloger) Catalog(_ context.Context, resolver file.Resolver
 	}
 
 	for _, location := range fileMatches {
-		readerCloser, err := resolver.FileContentsByLocation(location)
-		if err != nil {
-			log.Debugf("error opening file: %v", err)
-			continue
-		}
-
-		reader, err := unionreader.GetUnionReader(readerCloser)
+		newPkgs, err := processLocation(location, resolver)
 		if err != nil {
 			return nil, nil, err
 		}
-		newPkgs := fetchPkgs(reader, location.RealPath)
 		pkgs = append(pkgs, newPkgs...)
-		internal.CloseAndLogError(readerCloser, location.RealPath)
 	}
 
 	return pkgs, nil, nil
 }
+
+func processLocation(location file.Location, resolver file.Resolver) ([]pkg.Package, error) {
+	readerCloser, err := resolver.FileContentsByLocation(location)
+	if err != nil {
+		log.Debugf("error opening file: %v", err)
+		return nil, nil
+	}
+	defer internal.CloseAndLogError(readerCloser, location.RealPath)
+
+	reader, err := unionreader.GetUnionReader(readerCloser)
+	if err != nil {
+		return nil, err
+	}
+	return fetchPkgs(reader, location.RealPath), nil
+}

syft/pkg/cataloger/javascript/package.go

@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
@@ -253,37 +254,45 @@ func addLicenses(name string, resolver file.Resolver, location file.Location) (a
 	}
 
 	for _, l := range locations {
-		contentReader, err := resolver.FileContentsByLocation(l)
+		licenses, err := parseLicensesFromLocation(l, resolver, pkgFile)
 		if err != nil {
-			log.Debugf("error getting file content reader for %s: %v", pkgFile, err)
 			return allLicenses
 		}
-
-		contents, err := io.ReadAll(contentReader)
-		if err != nil {
-			log.Debugf("error reading file contents for %s: %v", pkgFile, err)
-			return allLicenses
-		}
-
-		var pkgJSON packageJSON
-		err = json.Unmarshal(contents, &pkgJSON)
-		if err != nil {
-			log.Debugf("error parsing %s: %v", pkgFile, err)
-			return allLicenses
-		}
-
-		licenses, err := pkgJSON.licensesFromJSON()
-		if err != nil {
-			log.Debugf("error getting licenses from %s: %v", pkgFile, err)
-			return allLicenses
-		}
-
 		allLicenses = append(allLicenses, licenses...)
 	}
 
 	return allLicenses
 }
 
+func parseLicensesFromLocation(l file.Location, resolver file.Resolver, pkgFile string) ([]string, error) {
+	contentReader, err := resolver.FileContentsByLocation(l)
+	if err != nil {
+		log.Debugf("error getting file content reader for %s: %v", pkgFile, err)
+		return nil, err
+	}
+	defer internal.CloseAndLogError(contentReader, l.RealPath)
+
+	contents, err := io.ReadAll(contentReader)
+	if err != nil {
+		log.Debugf("error reading file contents for %s: %v", pkgFile, err)
+		return nil, err
+	}
+
+	var pkgJSON packageJSON
+	err = json.Unmarshal(contents, &pkgJSON)
+	if err != nil {
+		log.Debugf("error parsing %s: %v", pkgFile, err)
+		return nil, err
+	}
+
+	licenses, err := pkgJSON.licensesFromJSON()
+	if err != nil {
+		log.Debugf("error getting licenses from %s: %v", pkgFile, err)
+		return nil, err
+	}
+	return licenses, nil
+}
+
 // packageURL returns the PURL for the specific NPM package (see https://github.com/package-url/purl-spec)
 func packageURL(name, version string) string {
 	var namespace string

syft/pkg/dotnet.go

@@ -11,14 +11,11 @@ type DotnetDepsEntry struct {
 
 // DotnetPortableExecutableEntry is a struct that represents a single entry found within "VersionResources" section of a .NET Portable Executable binary file.
 type DotnetPortableExecutableEntry struct {
-	AssemblyVersion  string `json:"assemblyVersion"`
-	LegalCopyright   string `json:"legalCopyright"`
-	Comments         string `json:"comments,omitempty"`
-	InternalName     string `json:"internalName,omitempty"`
-	CompanyName      string `json:"companyName"`
-	ProductName      string `json:"productName"`
-	ProductVersion   string `json:"productVersion"`
-	FileVersion      string `json:"fileVersion,omitempty"`
-	FileDescription  string `json:"fileDescription,omitempty"`
-	OriginalFilename string `json:"originalFilename,omitempty"`
+	AssemblyVersion string `json:"assemblyVersion"`
+	LegalCopyright  string `json:"legalCopyright"`
+	Comments        string `json:"comments,omitempty"`
+	InternalName    string `json:"internalName,omitempty"`
+	CompanyName     string `json:"companyName"`
+	ProductName     string `json:"productName"`
+	ProductVersion  string `json:"productVersion"`
 }

syft/sbom/sbom.go

@@ -75,15 +75,22 @@ func (s SBOM) RelationshipsForPackage(p pkg.Package, rt ...artifact.Relationship
 		rt = artifact.AllRelationshipTypes()
 	}
 
+	pID := p.ID()
+
 	var relationships []artifact.Relationship
 	for _, relationship := range s.Relationships {
 		if relationship.From == nil || relationship.To == nil {
 			log.Debugf("relationship has nil edge, skipping: %#v", relationship)
 			continue
 		}
-		if relationship.From.ID() != p.ID() {
+		fromID := relationship.From.ID()
+		toID := relationship.To.ID()
+		hasPkgID := fromID == pID || toID == pID
+
+		if !hasPkgID {
 			continue
 		}
+
 		// check if the relationship is one we're searching for; rt is inclusive
 		if !slices.ContainsFunc(rt, func(r artifact.RelationshipType) bool { return relationship.Type == r }) {
 			continue

test/rules/rules.go

@@ -0,0 +1,15 @@
+//go:build gorules
+
+package rules
+
+import "github.com/quasilyte/go-ruleguard/dsl"
+
+// nolint:unused
+func resourceCleanup(m dsl.Matcher) {
+	m.Match(`$res, $err := $resolver.FileContentsByLocation($loc); if $*_ { $*_ }; $next`).
+		Where(m["res"].Type.Implements(`io.Closer`) &&
+			m["res"].Type.Implements(`io.Reader`) &&
+			m["err"].Type.Implements(`error`) &&
+			!m["next"].Text.Matches(`defer internal.CloseAndLogError`)).
+		Report(`please call "defer internal.CloseAndLogError($res, $loc.RealPath)" right after checking the error returned from $resolver.FileContentsByLocation.`)
+}