Merge pull request #334 from anchore/ignore-ownership

Ignore ownership for shared copyright resources

.bouncer.yaml

@@ -0,0 +1,9 @@
+permit:
+  - BSD.*
+  - MIT.*
+  - Apache.*
+  - MPL.*
+  - ISC
+ignore-packages:
+  # packageurl-go is released under the MIT license located in the root of the repo at /mit.LICENSE
+  - github.com/package-url/packageurl-go

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,20 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: bug
+assignees: ''
+
+---
+
+**What happened**:
+
+**What you expected to happen**:
+
+**How to reproduce it (as minimally and precisely as possible)**:
+
+**Anything else we need to know?**:
+
+**Environment**:
+- Output of `syft version`:
+- OS (e.g: `cat /etc/os-release` or similar):

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+contact_links:
+
+  - name: Help & Support Slack Channel ⛑️
+    # link to toolbox-help channel
+    url: https://anchorecommunity.slack.com/archives/C019BUXV7R6
+    about: Ask a questions and get answers
+
+  - name: Developer Slack Channel 💬
+    # link to toolbox-dev channel
+    url: https://anchorecommunity.slack.com/archives/C0190NF9TSM
+    about: Participate in design discussions and feature development

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,15 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: enhancement
+assignees: ''
+
+---
+
+**What would you like to be added**:
+
+**Why is this needed**:
+
+**Additional context**:
+<!-- Add any other context or screenshots about the feature request here. -->

.github/scripts/mac-prepare-for-signing.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+set -eu
+
+CI_HOME="/Users/runner"
+if [[ "${HOME}" != "${CI_HOME}" ]]; then
+  printf "WARNING! It looks like this isn't the CI environment. This script modifies the macOS Keychain setup in ways you probably wouldn't want for your own machine. It also requires an Apple Developer ID Certificate that you shouldn't have outside of the CI environment.\n\nExiting early to make sure nothing bad happens.\n"
+  exit 1
+fi
+
+# Install gon (see https://github.com/mitchellh/gon for details).
+brew tap mitchellh/gon
+brew install mitchellh/gon/gon
+
+# Write signing certificate to disk from environment variable.
+CERT_FILE="$HOME/developer_id_certificate.p12"
+echo -n "$APPLE_DEVELOPER_ID_CERT" | base64 --decode > "$CERT_FILE"
+
+# In order to have all keychain interactions avoid an interactive user prompt, we need to control the password for the keychain in question, which means we need to create a new keychain into which we'll import the signing certificate and from which we'll later access this certificate during code signing.
+EPHEMERAL_KEYCHAIN="ci-ephemeral-keychain"
+EPHEMERAL_KEYCHAIN_PASSWORD="$(openssl rand -base64 100)"
+security create-keychain -p "${EPHEMERAL_KEYCHAIN_PASSWORD}" "${EPHEMERAL_KEYCHAIN}"
+
+# Import signing certificate into the keychain. (This is a pre-requisite for gon, which is invoked via goreleaser.)
+EPHEMERAL_KEYCHAIN_FULL_PATH="$HOME/Library/Keychains/${EPHEMERAL_KEYCHAIN}-db"
+security import "${CERT_FILE}" -k "${EPHEMERAL_KEYCHAIN_FULL_PATH}" -P "${APPLE_DEVELOPER_ID_CERT_PASS}" -T "$(command -v codesign)"
+
+# Setting the partition list for this certificate's private key to include "apple-tool:" and "apple:" allows the codesign command to access this keychain item without an interactive user prompt. (codesign is invoked by gon.)
+security set-key-partition-list -S "apple-tool:,apple:" -s -k "${EPHEMERAL_KEYCHAIN_PASSWORD}" "${EPHEMERAL_KEYCHAIN_FULL_PATH}"
+
+# Make this new keychain the user's default keychain, so that codesign will be able to find this certificate when we specify it during signing.
+security default-keychain -d "user" -s "${EPHEMERAL_KEYCHAIN_FULL_PATH}"

.github/scripts/mac-sign-and-notarize.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -eu
+
+IS_SNAPSHOT="$1"                        # e.g. "true", "false"
+
+if [[ "${IS_SNAPSHOT}" == "true" ]]; then
+  # This is a snapshot build —— skipping signing and notarization...
+  exit 0
+fi
+
+GON_CONFIG="$2"                                       # e.g. "gon.hcl"
+NEW_NAME_WITHOUT_EXTENSION="$3"                       # e.g. "./dist/syft-0.1.0"
+ORIGINAL_NAME_WITHOUT_EXTENSION="./dist/output"       # This should match dmg and zip output_path in the gon config file, without the extension.
+
+gon "${GON_CONFIG}"
+
+# Rename outputs with specified desired name
+mv -v "${ORIGINAL_NAME_WITHOUT_EXTENSION}.dmg" "${NEW_NAME_WITHOUT_EXTENSION}.dmg"
+mv -v "${ORIGINAL_NAME_WITHOUT_EXTENSION}.zip" "${NEW_NAME_WITHOUT_EXTENSION}.zip"

.github/scripts/update-version-file.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -ue
+
+BIN="syft"
+DISTDIR=$1
+VERSION=$2
+
+# the source of truth as to whether we want to notify users of an update is if the release just created is NOT
+# flagged as a pre-release on github
+if [[ "$(curl -SsL https://api.github.com/repos/anchore/${BIN}/releases/tags/${VERSION} | jq .prerelease)" == "true" ]] ; then
+   echo "skipping publishing a version file (this is a pre-release: ${VERSION})"
+   exit 0
+fi
+
+echo "creating and publishing version file"
+
+# create a version file for version-update checks
+VERSION_FILE="${DISTDIR}/VERSION"
+echo "${VERSION}" | tee "${VERSION_FILE}"
+
+# upload the version file that supports the application version update check
+export AWS_DEFAULT_REGION=us-west-2
+aws s3 cp "${VERSION_FILE}" s3://toolbox-data.anchore.io/${BIN}/releases/latest/VERSION

.github/scripts/verify-signature.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -ue
+
+DISTDIR=$1
+
+export FINGERPRINT=$(gpg --verify ${DISTDIR}/*checksums.txt.sig ${DISTDIR}/*checksums.txt 2>&1 | grep 'using RSA key' | awk '{ print $NF }')
+
+if [[ "${FINGERPRINT}" == "${SIGNING_FINGERPRINT}" ]]; then
+    echo 'verified signature'
+else
+    echo "signed with unknown fingerprint: ${FINGERPRINT}"
+    echo "           expected fingerprint: ${SIGNING_FINGERPRINT}"
+    exit 1
+fi

.github/workflows/acceptance-test.yaml

@@ -0,0 +1,157 @@
+name: "Acceptance"
+on:
+  workflow_dispatch:
+  push:
+    # ... only act on pushes to main
+    branches:
+      - main
+    # ... do not act on release tags
+    tags-ignore:
+      - v*
+
+env:
+  GO_VERSION: "1.14.x"
+
+jobs:
+  Build-Snapshot-Artifacts:
+    runs-on: macos-latest # We're creating these snapshot builds on macOS to be consistent with our release workflow's build process, which also takes place on macOS (due to code signing requirements).
+    steps:
+      - uses: actions/setup-go@v2
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - uses: actions/checkout@v2
+
+      - name: Restore bootstrap cache
+        id: cache
+        uses: actions/cache@v2.1.3
+        with:
+          path: |
+            ~/go/pkg/mod
+            ${{ github.workspace }}/.tmp
+          key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum') }}-${{ hashFiles('Makefile') }}
+          restore-keys: |
+            ${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum') }}-
+            ${{ runner.os }}-go-${{ env.GO_VERSION }}-
+
+      - name: Bootstrap project dependencies
+        if: steps.bootstrap-cache.outputs.cache-hit != 'true'
+        run: make bootstrap
+
+      - name: Import GPG key
+        id: import_gpg
+        uses: crazy-max/ghaction-import-gpg@v2
+        env:
+          GPG_PRIVATE_KEY: ${{ secrets.SIGNING_GPG_PRIVATE_KEY }}
+          PASSPHRASE: ${{ secrets.SIGNING_GPG_PASSPHRASE }}
+
+      - name: GPG signing info
+        run: |
+          echo "fingerprint: ${{ steps.import_gpg.outputs.fingerprint }}"
+          echo "keyid:       ${{ steps.import_gpg.outputs.keyid }}"
+          echo "name:        ${{ steps.import_gpg.outputs.name }}"
+          echo "email:       ${{ steps.import_gpg.outputs.email }}"
+
+      - name: Build snapshot artifacts
+        run: make snapshot
+        env:
+          GPG_PRIVATE_KEY: ${{ secrets.SIGNING_GPG_PRIVATE_KEY }}
+          PASSPHRASE: ${{ secrets.SIGNING_GPG_PASSPHRASE }}
+
+      - uses: actions/upload-artifact@v2
+        with:
+          name: artifacts
+          path: snapshot/**/*
+
+      - uses: 8398a7/action-slack@v3
+        with:
+          status: ${{ job.status }}
+          fields: repo,workflow,job,commit,message,author
+          text: The syft acceptance tests have failed tragically!
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }}
+        if: ${{ failure() }}
+
+  # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
+  Acceptance-Linux:
+    needs: [Build-Snapshot-Artifacts]
+    # come Nov 30 2020 ubuntu-latest will be ubuntu-20.04, until then it needs to be explicitly referenced due to python 3.7 specific features being used
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/checkout@v2
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: artifacts
+          path: snapshot
+
+      - name: Run Acceptance Tests (Linux)
+        run: make acceptance-linux
+
+      - uses: 8398a7/action-slack@v3
+        with:
+          status: ${{ job.status }}
+          fields: repo,workflow,job,commit,message,author
+          text: The syft acceptance tests have failed tragically!
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }}
+        if: ${{ failure() }}
+
+  # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
+  Acceptance-Mac:
+    needs: [Build-Snapshot-Artifacts]
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v2
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: artifacts
+          path: snapshot
+
+      - name: Run Acceptance Tests (Mac)
+        run: make acceptance-mac
+
+      - uses: 8398a7/action-slack@v3
+        with:
+          status: ${{ job.status }}
+          fields: repo,workflow,job,commit,message,author
+          text: The syft acceptance tests have failed tragically!
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }}
+        if: ${{ failure() }}
+
+  # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
+  Inline-Compare:
+    needs: [Build-Snapshot-Artifacts]
+    # come Nov 30 2020 ubuntu-latest will be ubuntu-20.04, until then it needs to be explicitly referenced due to python 3.7 specific features being used
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/checkout@v2
+
+      - name: Fingerprint inline-compare sources
+        run: make compare-fingerprint
+
+      - name: Restore inline reports cache
+        id: cache
+        uses: actions/cache@v2.1.3
+        with:
+          path: ${{ github.workspace }}/test/inline-compare/inline-reports
+          key: inline-reports-${{ hashFiles('**/inline-compare.fingerprint') }}
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: artifacts
+          path: snapshot
+
+      - name: Compare Anchore inline-scan results against snapshot build output
+        run: make compare-snapshot
+
+      - uses: 8398a7/action-slack@v3
+        with:
+          status: ${{ job.status }}
+          fields: repo,workflow,job,commit,message,author
+          text: The syft acceptance tests have failed tragically!
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }}
+        if: ${{ failure() }}

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,71 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+name: "CodeQL Security Scan"
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [main]
+  schedule:
+    - cron: '0 0 * * 3'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # Override automatic language detection by changing the below list
+        # Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
+        language: ['go', 'python']
+        # Learn more...
+        # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v2
+      with:
+        # We must fetch at least the immediate parents so that if this is
+        # a pull request then we can checkout the head.
+        fetch-depth: 2
+
+    # If this run was triggered by a pull request event, then checkout
+    # the head of the pull request instead of the merge commit.
+    - run: git checkout HEAD^2
+      if: ${{ github.event_name == 'pull_request' }}
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v1
+      with:
+        languages: ${{ matrix.language }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file. 
+        # Prefix the list here with "+" to use these queries and those in the config file.
+        # queries: ./path/to/local/query, your-org/your-repo/queries@main
+
+    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v1
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 https://git.io/JvXDl
+
+    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+    #    and modify them (or add more) to build your code if your project
+    #    uses a compiled language
+
+    #- run: |
+    #   make bootstrap
+    #   make release
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v1

.github/workflows/release.yaml

@@ -0,0 +1,147 @@
+name: "Release"
+on:
+  push:
+    # take no actions on push to any branch...
+    branches-ignore:
+      - "**"
+    # ... only act on release tags
+    tags:
+      - "v*"
+
+env:
+  GO_VERSION: "1.14.x"
+
+jobs:
+  wait-for-checks:
+    runs-on: ubuntu-latest # This OS choice is arbitrary. None of the steps in this job are specific to either Linux or macOS.
+    steps:
+      - uses: actions/checkout@v2
+
+      # we don't want to release commits that have been pushed and tagged, but not necessarily merged onto main
+      - name: Ensure tagged commit is on main
+        run: |
+          echo "Tag: ${GITHUB_REF##*/}"
+          git fetch origin main
+          git merge-base --is-ancestor ${GITHUB_REF##*/} origin/main && echo "${GITHUB_REF##*/} is a commit on main!"
+
+      - name: Check static analysis results
+        uses: fountainhead/action-wait-for-check@v1.0.0
+        id: static-analysis
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          # This check name is defined as the circle-ci workflow name (in .circleci/config.yaml)
+          checkName: "Static-Analysis (1.x, ubuntu-latest)"
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - name: Check unit + integration results (latest go version)
+        uses: fountainhead/action-wait-for-check@v1.0.0
+        id: unit-integration
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          # This check name is defined as the circle-ci workflow name (in .circleci/config.yaml)
+          checkName: "Tests (1.x, ubuntu-latest)"
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - name: Check acceptance test results (linux)
+        uses: fountainhead/action-wait-for-check@v1.0.0
+        id: acceptance-linux
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          # This check name is defined as the github action job name (in .github/workflows/acceptance-test.yaml)
+          checkName: "Acceptance-Linux"
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - name: Check acceptance test results (mac)
+        uses: fountainhead/action-wait-for-check@v1.0.0
+        id: acceptance-mac
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          # This check name is defined as the github action job name (in .github/workflows/acceptance-test.yaml)
+          checkName: "Acceptance-Mac"
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - name: Check inline comparison test results
+        uses: fountainhead/action-wait-for-check@v1.0.0
+        id: inline-compare
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          # This check name is defined as the github action job name (in .github/workflows/acceptance-test.yaml)
+          checkName: "Inline-Compare"
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - name: Quality gate
+        if: steps.static-analysis.outputs.conclusion != 'success' || steps.unit-integration.outputs.conclusion != 'success' || steps.inline-compare.outputs.conclusion != 'success' || steps.acceptance-linux.outputs.conclusion != 'success' || steps.acceptance-mac.outputs.conclusion != 'success'
+        run: |
+          echo "Static Analysis Status: ${{ steps.static-analysis.conclusion }}"
+          echo "Unit & Integration Test Status: ${{ steps.unit-integration.outputs.conclusion }}"
+          echo "Acceptance Test (Linux) Status: ${{ steps.acceptance-linux.outputs.conclusion }}"
+          echo "Acceptance Test (Mac) Status: ${{ steps.acceptance-mac.outputs.conclusion }}"
+          echo "Inline Compare Status: ${{ steps.inline-compare.outputs.conclusion }}"
+          false
+
+  release:
+    needs: [wait-for-checks]
+    runs-on: macos-latest # Due to our code signing process, it's vital that we run our release steps on macOS.
+    steps:
+      - uses: actions/setup-go@v2
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      # We are expecting this cache to have been created during the "Build-Snapshot-Artifacts" job in the "Acceptance" workflow.
+      - name: Restore bootstrap cache
+        id: cache
+        uses: actions/cache@v2.1.3
+        with:
+          path: |
+            ~/go/pkg/mod
+            ${{ github.workspace }}/.tmp
+          key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum') }}-${{ hashFiles('Makefile') }}
+          restore-keys: |
+            ${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum') }}-
+            ${{ runner.os }}-go-${{ env.GO_VERSION }}-
+
+      - name: Import GPG key
+        id: import_gpg
+        uses: crazy-max/ghaction-import-gpg@v2
+        env:
+          GPG_PRIVATE_KEY: ${{ secrets.SIGNING_GPG_PRIVATE_KEY }}
+          PASSPHRASE: ${{ secrets.SIGNING_GPG_PASSPHRASE }}
+
+      - name: GPG signing info
+        run: |
+          echo "fingerprint: ${{ steps.import_gpg.outputs.fingerprint }}"
+          echo "keyid:       ${{ steps.import_gpg.outputs.keyid }}"
+          echo "name:        ${{ steps.import_gpg.outputs.name }}"
+          echo "email:       ${{ steps.import_gpg.outputs.email }}"
+
+      - name: Build & publish release artifacts
+        run: make release
+        env:
+          GITHUB_TOKEN: ${{ secrets.ANCHORE_GIT_READ_TOKEN }}
+          GPG_PRIVATE_KEY: ${{ secrets.SIGNING_GPG_PRIVATE_KEY }}
+          PASSPHRASE: ${{ secrets.SIGNING_GPG_PASSPHRASE }}
+          SIGNING_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.TOOLBOX_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLBOX_AWS_SECRET_ACCESS_KEY }}
+          APPLE_DEVELOPER_ID_CERT: ${{ secrets.APPLE_DEVELOPER_ID_CERT }} # Used during macOS code signing.
+          APPLE_DEVELOPER_ID_CERT_PASS: ${{ secrets.APPLE_DEVELOPER_ID_CERT_PASS }} # Used during macOS code signing.
+          AC_USERNAME: ${{ secrets.ENG_CI_APPLE_ID }} # Used during macOS notarization.
+          AC_PASSWORD: ${{ secrets.ENG_CI_APPLE_ID_PASS }} # Used during macOS notarization.
+
+      - uses: 8398a7/action-slack@v3
+        with:
+          status: ${{ job.status }}
+          fields: repo,workflow,action,eventName
+          text: "A new Syft release is ready to be manually published: https://github.com/anchore/syft/releases"
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }}
+        if: ${{ success() }}
+
+      - uses: actions/upload-artifact@v2
+        with:
+          name: artifacts
+          path: dist/**/*

.github/workflows/static-unit-integration.yaml

@@ -0,0 +1,101 @@
+name: "Static Analysis + Unit + Integration"
+on:
+  workflow_dispatch:
+  push:
+  pull_request:
+jobs:
+  Static-Analysis:
+    strategy:
+      matrix:
+        go-version: [1.x]
+        platform: [ubuntu-latest]
+    runs-on: ${{ matrix.platform }}
+    steps:
+      - uses: actions/setup-go@v2
+        with:
+          go-version: ${{ matrix.go-version }}
+
+      - uses: actions/checkout@v2
+
+      - name: Restore bootstrap cache
+        id: bootstrap-cache
+        uses: actions/cache@v2.1.3
+        with:
+          path: |
+            ~/go/pkg/mod
+            ${{ github.workspace }}/.tmp
+          key: ${{ runner.os }}-go-${{ matrix.go-version }}-${{ hashFiles('**/go.sum') }}-${{ hashFiles('Makefile') }}
+          restore-keys: |
+            ${{ runner.os }}-go-${{ matrix.go-version }}-${{ hashFiles('**/go.sum') }}-
+            ${{ runner.os }}-go-${{ matrix.go-version }}-
+
+      - name: Bootstrap project dependencies
+        if: steps.bootstrap-cache.outputs.cache-hit != 'true'
+        run: make bootstrap
+
+      - name: Bootstrap CI dependencies
+        run: make ci-bootstrap
+
+      - name: Run static analysis
+        run: make static-analysis
+
+  Tests:
+    strategy:
+      matrix:
+        # test the lower bounds of support, and the latest available
+        go-version: [1.13.x, 1.x]
+        platform: [ubuntu-latest]
+    runs-on: ${{ matrix.platform }}
+    steps:
+      - uses: actions/setup-go@v2
+        with:
+          go-version: ${{ matrix.go-version }}
+
+      - uses: actions/checkout@v2
+
+      - name: Restore bootstrap cache
+        id: bootstrap-cache
+        uses: actions/cache@v2.1.3
+        with:
+          path: |
+            ~/go/pkg/mod
+            ${{ github.workspace }}/.tmp
+          key: ${{ runner.os }}-go-${{ matrix.go-version }}-${{ hashFiles('**/go.sum') }}-${{ hashFiles('Makefile') }}
+          restore-keys: |
+            ${{ runner.os }}-go-${{ matrix.go-version }}-${{ hashFiles('**/go.sum') }}-
+            ${{ runner.os }}-go-${{ matrix.go-version }}-
+
+      - name: Bootstrap project dependencies
+        if: steps.bootstrap-cache.outputs.cache-hit != 'true'
+        run: make bootstrap
+
+      - name: Bootstrap CI dependencies
+        run: make ci-bootstrap
+
+      - name: Build cache key for java test-fixture blobs (for unit tests)
+        run: make java-packages-fingerprint
+
+      - name: Restore Java test-fixture cache
+        id: unit-java-cache
+        uses: actions/cache@v2.1.3
+        with:
+          path: syft/cataloger/java/test-fixtures/java-builds/packages
+          key: ${{ runner.os }}-unit-java-cache-${{ hashFiles( 'syft/cataloger/java/test-fixtures/java-builds/packages.fingerprint' ) }}
+
+      - name: Run unit tests
+        run: make unit
+
+      - name: Validate syft output against the CycloneDX schema
+        run: make validate-cyclonedx-schema
+
+      - name: Build key for tar cache
+        run: make integration-fingerprint
+
+      - name: Restore integration test cache
+        uses: actions/cache@v2.1.3
+        with:
+          path: ${{ github.workspace }}/integration/test-fixtures/cache
+          key: ${{ runner.os }}-integration-test-cache-${{ hashFiles('integration/test-fixtures/cache.fingerprint') }}
+
+      - name: Run integration tests
+        run: make integration

.gitignore

@@ -1,4 +1,17 @@
+CHANGELOG.md
+/dist
+/snapshot
+.server/
+.vscode/
+.history/
+*.fingerprint
 *.tar
+*.jar
+*.war
+*.ear
+*.jpi
+*.hpi
+*.zip
 .idea/
 *.log
 .images
@@ -16,4 +29,9 @@ coverage.txt
 *.test
 
 # Output of the go coverage tool, specifically when used with LiteIDE
-*.out
+*.out
+
+# macOS Finder metadata
+.DS_STORE
+
+*.profile

.golangci.yaml

@@ -1,4 +1,9 @@
-linter-settings:
+# TODO: enable this when we have coverage on docstring comments
+#issues:
+#  # The list of ids of default excludes to include or disable.
+#  include:
+#    - EXC0002 # disable excluding of issues about comments from golint
+
 linters:
   # inverted configuration with `enable-all` and `disable` is not scalable during updates of golangci-lint
   disable-all: true
@@ -23,11 +28,9 @@ linters:
     - gosimple
     - govet
     - ineffassign
-    - maligned
     - misspell
     - nakedret
     - nolintlint
-    - prealloc
     - rowserrcheck
     - scopelint
     - staticcheck
@@ -49,6 +52,8 @@ linters:
 #    - gomnd       # this is too aggressive
 #    - interfacer  # this is a good idea, but is no longer supported and is prone to false positives
 #    - lll         # without a way to specify per-line exception cases, this is not usable
+#    - maligned    # this is an excellent linter, but tricky to optimize and we are not sensitive to memory layout optimizations
 #    - nestif
+#    - prealloc    # following this rule isn't consistently a good idea, as it sometimes forces unnecessary allocations that result in less idiomatic code
 #    - testpackage
-#    - wsl
+#    - wsl

.goreleaser.yaml

@@ -0,0 +1,92 @@
+release:
+  # If set to auto, will mark the release as not ready for production in case there is an indicator for this in the
+  # tag e.g. v1.0.0-rc1 .If set to true, will mark the release as not ready for production.
+  prerelease: auto
+
+  # If set to true, will not auto-publish the release. This is done to allow us to review the changelog before publishing.
+  draft: true
+
+builds:
+  - binary: syft
+    id: syft
+    env:
+      - CGO_ENABLED=0
+    goos:
+      # windows not supported yet (due to jotframe)
+      # - windows
+      - linux
+    goarch:
+      - amd64
+    # Set the modified timestamp on the output binary to the git timestamp (to ensure a reproducible build)
+    mod_timestamp: '{{ .CommitTimestamp }}'
+    ldflags: |
+      -w
+      -s
+      -extldflags '-static'
+      -X github.com/anchore/syft/internal/version.version={{.Version}}
+      -X github.com/anchore/syft/internal/version.gitCommit={{.Commit}}
+      -X github.com/anchore/syft/internal/version.buildDate={{.Date}}
+      -X github.com/anchore/syft/internal/version.gitTreeState={{.Env.BUILD_GIT_TREE_STATE}}
+  # For more info on this macOS build, see: https://github.com/mitchellh/gon#usage-with-goreleaser
+  - binary: syft
+    id: syft-macos
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - darwin
+    goarch:
+      - amd64
+    # Set the modified timestamp on the output binary to the git timestamp (to ensure a reproducible build)
+    mod_timestamp: '{{ .CommitTimestamp }}'
+    ldflags: |
+      -w
+      -s
+      -extldflags '-static'
+      -X github.com/anchore/syft/internal/version.version={{.Version}}
+      -X github.com/anchore/syft/internal/version.gitCommit={{.Commit}}
+      -X github.com/anchore/syft/internal/version.buildDate={{.Date}}
+      -X github.com/anchore/syft/internal/version.gitTreeState={{.Env.BUILD_GIT_TREE_STATE}}
+
+archives:
+  - format: tar.gz
+    builds:
+      - syft # i.e. Linux only
+  - format: zip # This is a hack! We don't actually intend to use _this_ ZIP file, we just need goreleaser to consider the ZIP file produced by gon (which will have the same file name) to be an artifact so we can use it downstream in publishing (e.g. to a homebrew tap)
+    id: syft-zip
+    builds:
+      - syft-macos
+
+signs:
+  - artifacts: checksum
+    cmd: sh
+    args:
+      - '-c'
+      # we should not include the zip artifact, as the artifact is mutated throughout the next macOS notarization step
+      # note: sed -i is not portable
+      - 'sed "/.*\.zip/d" ${artifact} > tmpfile && mv tmpfile ${artifact} && gpg --output ${signature} --detach-sign ${artifact}'
+  - id: syft-macos-signing
+    ids:
+      - syft-macos
+    cmd: ./.github/scripts/mac-sign-and-notarize.sh
+    signature: "syft_${VERSION}_darwin_amd64.dmg" # This is somewhat unintuitive. This gets the DMG file recognized as an artifact. In fact, both a DMG and a ZIP file are being produced by this signing step.
+    args:
+      - "{{ .IsSnapshot }}"
+      - "gon.hcl"
+      - "./dist/syft_{{ .Version }}_darwin_amd64"
+    artifacts: all
+
+nfpms:
+  - license: "Apache 2.0"
+    maintainer: "Anchore, Inc"
+    homepage: &website "https://github.com/anchore/syft"
+    description: &description "A tool that generates a Software Bill Of Materials (SBOM) from container images and filesystems"
+    formats:
+      - rpm
+      - deb
+
+brews:
+  - tap:
+      owner: anchore
+      name: homebrew-syft
+    homepage: *website
+    description: *description

CONTRIBUTING.md

@@ -0,0 +1,103 @@
+# Contributing to `syft`
+
+If you are looking to contribute to this project and want to open a Github pull request ("PR"), there are a few guidelines of what we are looking for in patches. Make sure you go through this document and ensure that your code proposal is aligned.
+
+## Sign your work
+
+The `sign-off` is an added line at the end of the explanation for the commit, certifying that you wrote it or otherwise have the right to submit it as an open-source patch. By submitting a contribution, you agree to be bound by the terms of the DCO Version 1.1 and Apache License Version 2.0.
+
+Signing a commit certifies the below Developer's Certificate of Origin (DCO):
+
+```text
+Developer's Certificate of Origin 1.1
+
+By making a contribution to this project, I certify that:
+
+   (a) The contribution was created in whole or in part by me and I
+       have the right to submit it under the open source license
+       indicated in the file; or
+
+   (b) The contribution is based upon previous work that, to the best
+       of my knowledge, is covered under an appropriate open source
+       license and I have the right under that license to submit that
+       work with modifications, whether created in whole or in part
+       by me, under the same open source license (unless I am
+       permitted to submit under a different license), as indicated
+       in the file; or
+
+   (c) The contribution was provided directly to me by some other
+       person who certified (a), (b) or (c) and I have not modified
+       it.
+
+   (d) I understand and agree that this project and the contribution
+       are public and that a record of the contribution (including all
+       personal information I submit with it, including my sign-off) is
+       maintained indefinitely and may be redistributed consistent with
+       this project or the open source license(s) involved.
+```
+
+All contributions to this project are licensed under the [Apache License Version 2.0, January 2004](http://www.apache.org/licenses/).
+
+When committing your change, you can add the required line manually so that it looks like this:
+
+```text
+Signed-off-by: John Doe <john.doe@example.com>
+```
+
+Alternatively, configure your Git client with your name and email to use the `-s` flag when creating a commit:
+
+```text
+$ git config --global user.name "John Doe"
+$ git config --global user.email "john.doe@example.com"
+```
+
+Creating a signed commit is then possible with `-s`:
+
+```text
+$ git commit -s -m "this is a commit message"
+```
+
+To double check if the commit was signed, look at the log output:
+
+```text
+$ git log -1
+commit 37ceh170e4hb283bb73d958f2036ee5k07e7fde7 (HEAD -> issue-35, origin/main, main)
+Author: John Doe <john.doe@example.com>
+Date:   Mon Aug 1 11:27:13 2020 -0400
+
+    this is a commit message
+
+    Signed-off-by: John Doe <john.doe@example.com>
+```
+
+
+[//]: # (TODO: Commit guidelines, granular commits)
+
+
+[//]: # (TODO: Commit guidelines, descriptive messages)
+
+
+[//]: # (TODO: Commit guidelines, commit title, extra body description)
+
+
+[//]: # (TODO: PR title and description)
+
+
+## Test your changes
+
+This project has a `Makefile` which includes many helpers running both unit and integration tests. Although PRs will have automatic checks for these, it is useful to run them locally, ensuring they pass before submitting changes. Ensure you've bootstrapped once before running tests:
+
+```text
+$ make bootstrap
+```
+
+You only need to bootstrap once. After the bootstrap process, you can run the tests as many times as needed:
+
+```text
+$ make unit
+$ make integration
+```
+
+## Document your changes
+
+When proposed changes are modifying user-facing functionality or output, it is expected the PR will include updates to the documentation as well.

LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

Makefile

@@ -1,58 +1,297 @@
+BIN = syft
 TEMPDIR = ./.tmp
+RESULTSDIR = $(TEMPDIR)/results
+COVER_REPORT = $(RESULTSDIR)/cover.report
+COVER_TOTAL = $(RESULTSDIR)/cover.total
 LINTCMD = $(TEMPDIR)/golangci-lint run --tests=false --config .golangci.yaml
-BOLD := $(shell tput bold)
-PURPLE := $(shell tput setaf 5)
-GREEN := $(shell tput setaf 2)
-RESET := $(shell tput sgr0)
+ACC_TEST_IMAGE = centos:8.2.2004
+ACC_DIR = ./test/acceptance
+BOLD := $(shell tput -T linux bold)
+PURPLE := $(shell tput -T linux setaf 5)
+GREEN := $(shell tput -T linux setaf 2)
+CYAN := $(shell tput -T linux setaf 6)
+RED := $(shell tput -T linux setaf 1)
+RESET := $(shell tput -T linux sgr0)
 TITLE := $(BOLD)$(PURPLE)
 SUCCESS := $(BOLD)$(GREEN)
+# the quality gate lower threshold for unit test total % coverage (by function statements)
+COVERAGE_THRESHOLD := 68
+# CI cache busting values; change these if you want CI to not use previous stored cache
+COMPARE_CACHE_BUSTER="f7e689d76a9"
+INTEGRATION_CACHE_BUSTER="789bacdf"
+BOOTSTRAP_CACHE="789bacdf"
 
-ifndef TEMPDIR
-$(error TEMPDIR is not set)
+## Build variables
+DISTDIR=./dist
+SNAPSHOTDIR=./snapshot
+GITTREESTATE=$(if $(shell git status --porcelain),dirty,clean)
+SNAPSHOT_CMD=$(shell realpath $(shell pwd)/$(SNAPSHOTDIR)/syft_linux_amd64/syft)
+
+ifeq "$(strip $(VERSION))" ""
+ override VERSION = $(shell git describe --always --tags --dirty)
 endif
 
-.PHONY: all boostrap lint lint-fix unit coverage integration build-release
+# used to generate the changelog from the second to last tag to the current tag (used in the release pipeline when the release tag is in place)
+LAST_TAG := $(shell git describe --abbrev=0 --tags $(shell git rev-list --tags --max-count=1))
+SECOND_TO_LAST_TAG := $(shell git describe --abbrev=0 --tags $(shell git rev-list --tags --skip=1 --max-count=1))
 
-all: lint unit integration
+## Variable assertions
+
+ifndef TEMPDIR
+	$(error TEMPDIR is not set)
+endif
+
+ifndef RESULTSDIR
+	$(error RESULTSDIR is not set)
+endif
+
+ifndef ACC_DIR
+	$(error ACC_DIR is not set)
+endif
+
+ifndef DISTDIR
+	$(error DISTDIR is not set)
+endif
+
+ifndef SNAPSHOTDIR
+	$(error SNAPSHOTDIR is not set)
+endif
+
+define title
+    @printf '$(TITLE)$(1)$(RESET)\n'
+endef
+
+## Tasks
+
+.PHONY: all
+all: clean static-analysis test ## Run all linux-based checks (linting, license check, unit, integration, and linux acceptance tests)
 	@printf '$(SUCCESS)All checks pass!$(RESET)\n'
 
-bootstrap:
-	@printf '$(TITLE)Downloading dependencies$(RESET)\n'
-	# install project dependencies
-	go get ./...
-	mkdir -p $(TEMPDIR)
-	# install golangci-lint
-	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b .tmp/ v1.26.0
-	# install go-acc
-	GOPATH=$(shell realpath ${TEMPDIR}) GO111MODULE=off go get github.com/ory/go-acc
-	# cleanup
-	rm -rf $(TEMPDIR)/src
+.PHONY: test
+test: unit validate-cyclonedx-schema integration acceptance-linux ## Run all tests (currently unit, integration, and linux acceptance tests)
 
-lint:
-	@printf '$(TITLE)Running linters$(RESET)\n'
-	test -z "$(shell gofmt -l -s .)"
+.PHONY: help
+help:
+	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "$(BOLD)$(CYAN)%-25s$(RESET)%s\n", $$1, $$2}'
+
+.PHONY: ci-bootstrap
+ci-bootstrap:
+	DEBIAN_FRONTEND=noninteractive sudo apt update && sudo -E apt install -y bc jq libxml2-utils
+
+.PHONY:
+ci-bootstrap-mac:
+	github_changelog_generator --version || sudo gem install github_changelog_generator
+
+.PHONY: bootstrap
+bootstrap: ## Download and install all go dependencies (+ prep tooling in the ./tmp dir)
+	$(call title,Bootstrapping dependencies)
+	@pwd
+	# prep temp dirs
+	mkdir -p $(TEMPDIR)
+	mkdir -p $(RESULTSDIR)
+	# install go dependencies
+	go mod download
+	# install utilities
+	[ -f "$(TEMPDIR)/golangci" ] || curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(TEMPDIR)/ v1.26.0
+	[ -f "$(TEMPDIR)/bouncer" ] || curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMPDIR)/ v0.2.0
+	[ -f "$(TEMPDIR)/goreleaser" ] || curl -sfL https://install.goreleaser.com/github.com/goreleaser/goreleaser.sh | sh -s -- -b $(TEMPDIR)/ v0.140.0
+
+.PHONY: static-analysis
+static-analysis: lint check-licenses
+
+.PHONY: lint
+lint: ## Run gofmt + golangci lint checks
+	$(call title,Running linters)
+	# ensure there are no go fmt differences
+	@printf "files with gofmt issues: [$(shell gofmt -l -s .)]\n"
+	@test -z "$(shell gofmt -l -s .)"
+
+	# run all golangci-lint rules
 	$(LINTCMD)
 
-lint-fix:
-	@printf '$(TITLE)Running lint fixers$(RESET)\n'
+	# go tooling does not play well with certain filename characters, ensure the common cases don't result in future "go get" failures
+	$(eval MALFORMED_FILENAMES := $(shell find . | grep -e ':'))
+	@bash -c "[[ '$(MALFORMED_FILENAMES)' == '' ]] || (printf '\nfound unsupported filename characters:\n$(MALFORMED_FILENAMES)\n\n' && false)"
+
+.PHONY: lint-fix
+lint-fix: ## Auto-format all source code + run golangci lint fixers
+	$(call title,Running lint fixers)
 	gofmt -w -s .
 	$(LINTCMD) --fix
 
-unit:
-	@printf '$(TITLE)Running unit tests$(RESET)\n'
-	go test --race ./...
+.PHONY: check-licenses
+check-licenses:
+	$(TEMPDIR)/bouncer check
 
-coverage:
-	@printf '$(TITLE)Running unit tests + coverage$(RESET)\n'
-	$(TEMPDIR)/bin/go-acc -o $(TEMPDIR)/coverage.txt ./...
+.PHONY: validate-cyclonedx-schema
+validate-cyclonedx-schema:
+	cd schema/cyclonedx && make
 
-# TODO: add benchmarks
+.PHONY: unit
+unit: fixtures ## Run unit tests (with coverage)
+	$(call title,Running unit tests)
+	go test -coverprofile $(COVER_REPORT) $(shell go list ./... | grep -v anchore/syft/test)
+	@go tool cover -func $(COVER_REPORT) | grep total |  awk '{print substr($$3, 1, length($$3)-1)}' > $(COVER_TOTAL)
+	@echo "Coverage: $$(cat $(COVER_TOTAL))"
+	@if [ $$(echo "$$(cat $(COVER_TOTAL)) >= $(COVERAGE_THRESHOLD)" | bc -l) -ne 1 ]; then echo "$(RED)$(BOLD)Failed coverage quality gate (> $(COVERAGE_THRESHOLD)%)$(RESET)" && false; fi
 
-integration:
-	@printf '$(TITLE)Running integration tests...$(RESET)\n'
-	go test -tags=integration ./integration
+.PHONY: integration
+integration: ## Run integration tests
+	$(call title,Running integration tests)
 
-build-release:
-	go build -s -w -X main.version="$(git describe --tags --dirty --always)" \
-				   -X main.commit="$(git describe --dirty --always)" \
-				   -X main.buildTime="$(date --rfc-3339=seconds --utc)"
+	go test -v ./test/integration
+
+
+# note: this is used by CI to determine if the integration test fixture cache (docker image tars) should be busted
+integration-fingerprint:
+	find test/integration/test-fixtures/image-* -type f -exec md5sum {} + | awk '{print $1}' | sort | md5sum | tee test/integration/test-fixtures/cache.fingerprint && echo "$(INTEGRATION_CACHE_BUSTER)" >> test/integration/test-fixtures/cache.fingerprint
+
+.PHONY: java-packages-fingerprint
+java-packages-fingerprint:
+	@cd syft/cataloger/java/test-fixtures/java-builds && \
+	make packages.fingerprint
+
+.PHONY: fixtures
+fixtures:
+	$(call title,Generating test fixtures)
+	cd syft/cataloger/java/test-fixtures/java-builds && make
+
+.PHONY: generate-json-schema
+generate-json-schema:  ## Generate a new json schema
+	cd schema/json && go run generate.go
+
+.PHONY: clear-test-cache
+clear-test-cache: ## Delete all test cache (built docker image tars)
+	find . -type f -wholename "**/test-fixtures/cache/*.tar" -delete
+
+.PHONY: build
+build: $(SNAPSHOTDIR) ## Build release snapshot binaries and packages
+
+$(SNAPSHOTDIR): ## Build snapshot release binaries and packages
+	$(call title,Building snapshot artifacts)
+	# create a config with the dist dir overridden
+	echo "dist: $(SNAPSHOTDIR)" > $(TEMPDIR)/goreleaser.yaml
+	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml
+
+	# build release snapshots
+	BUILD_GIT_TREE_STATE=$(GITTREESTATE) \
+	$(TEMPDIR)/goreleaser release --skip-publish --rm-dist --snapshot --config $(TEMPDIR)/goreleaser.yaml
+
+# note: we cannot clean the snapshot directory since the pipeline builds the snapshot separately
+.PHONY: acceptance-mac
+acceptance-mac: $(SNAPSHOTDIR) ## Run acceptance tests on build snapshot binaries and packages (Mac)
+	$(call title,Running acceptance test: Run on Mac)
+	$(ACC_DIR)/mac.sh \
+			$(SNAPSHOTDIR) \
+			$(ACC_DIR) \
+			$(ACC_TEST_IMAGE) \
+			$(RESULTSDIR)
+
+# note: we cannot clean the snapshot directory since the pipeline builds the snapshot separately
+.PHONY: acceptance-linux
+acceptance-linux: acceptance-test-deb-package-install acceptance-test-rpm-package-install ## Run acceptance tests on build snapshot binaries and packages (Linux)
+
+# note: this is used by CI to determine if the inline-scan report cache should be busted for the inline-compare tests
+.PHONY: compare-fingerprint
+compare-fingerprint:
+	find test/inline-compare/* -type f -exec md5sum {} + | grep -v '\-reports' | grep -v 'fingerprint' | awk '{print $1}' | sort | md5sum | tee test/inline-compare/inline-compare.fingerprint && echo "$(COMPARE_CACHE_BUSTER)" >> test/inline-compare/inline-compare.fingerprint
+
+.PHONY: compare-snapshot
+compare-snapshot: $(SNAPSHOTDIR) ## Compare the reports of a run of a snapshot build of syft against inline-scan
+	chmod 755 $(SNAPSHOT_CMD)
+	@cd test/inline-compare && SYFT_CMD=$(SNAPSHOT_CMD) make
+
+.PHONY: compare
+compare:  ## Compare the reports of a run of a main-branch build of syft against inline-scan
+	@cd test/inline-compare && make
+
+.PHONY: acceptance-test-deb-package-install
+acceptance-test-deb-package-install: $(SNAPSHOTDIR)
+	$(call title,Running acceptance test: DEB install)
+	$(ACC_DIR)/deb.sh \
+			$(SNAPSHOTDIR) \
+			$(ACC_DIR) \
+			$(ACC_TEST_IMAGE) \
+			$(RESULTSDIR)
+
+.PHONY: acceptance-test-rpm-package-install
+acceptance-test-rpm-package-install: $(SNAPSHOTDIR)
+	$(call title,Running acceptance test: RPM install)
+	$(ACC_DIR)/rpm.sh \
+			$(SNAPSHOTDIR) \
+			$(ACC_DIR) \
+			$(ACC_TEST_IMAGE) \
+			$(RESULTSDIR)
+
+.PHONY: changlog-release
+changelog-release:
+	@echo "Last tag: $(SECOND_TO_LAST_TAG)"
+	@echo "Current tag: $(VERSION)"
+	@github_changelog_generator \
+		--user anchore \
+		--project $(BIN) \
+		-t ${GITHUB_TOKEN} \
+		--exclude-labels 'duplicate,question,invalid,wontfix,size:small,size:medium,size:large,size:x-large' \
+		--no-pr-wo-labels \
+		--no-issues-wo-labels \
+		--since-tag $(SECOND_TO_LAST_TAG)
+
+	@printf '\n$(BOLD)$(CYAN)Release $(VERSION) Changelog$(RESET)\n\n'
+	@cat CHANGELOG.md
+
+.PHONY: changelog-unreleased
+changelog-unreleased: ## show the current changelog that will be produced on the next release (note: requires GITHUB_TOKEN set)
+	@docker run -it --rm \
+		-v "$(shell pwd)":/usr/local/src/your-app \
+		ferrarimarco/github-changelog-generator \
+		--user anchore \
+		--project $(BIN) \
+		-t ${GITHUB_TOKEN} \
+		--exclude-labels 'duplicate,question,invalid,wontfix,size:small,size:medium,size:large,size:x-large' \
+		--since-tag $(LAST_TAG)
+
+	@printf '\n$(BOLD)$(CYAN)Unreleased Changes (closed PRs and issues will not be in the final changelog)$(RESET)\n'
+
+	@docker run -it --rm \
+		-v $(shell pwd)/CHANGELOG.md:/CHANGELOG.md \
+		rawkode/mdv \
+			-t 748.5989 \
+			/CHANGELOG.md
+
+.PHONY: release
+release: clean-dist ci-bootstrap-mac changelog-release ## Build and publish final binaries and packages. Intended to be run only on macOS.
+	$(call title,Publishing release artifacts)
+
+	# Prepare for macOS-specific signing process
+	.github/scripts/mac-prepare-for-signing.sh
+
+	# create a config with the dist dir overridden
+	echo "dist: $(DISTDIR)" > $(TEMPDIR)/goreleaser.yaml
+	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml
+
+	# release (note the version transformation from v0.7.0 --> 0.7.0)
+	bash -c "\
+		BUILD_GIT_TREE_STATE=$(GITTREESTATE) \
+		VERSION=$(VERSION:v%=%) \
+		$(TEMPDIR)/goreleaser \
+			--rm-dist \
+			--config $(TEMPDIR)/goreleaser.yaml \
+			--release-notes <(cat CHANGELOG.md)"
+
+	# verify checksum signatures
+	.github/scripts/verify-signature.sh "$(DISTDIR)"
+
+	# upload the version file that supports the application version update check (excluding pre-releases)
+	.github/scripts/update-version-file.sh "$(DISTDIR)" "$(VERSION)"
+
+.PHONY: clean
+clean: clean-dist clean-snapshot ## Remove previous builds and result reports
+	rm -rf $(RESULTSDIR)/*
+
+.PHONY: clean-snapshot
+clean-snapshot:
+	rm -rf $(SNAPSHOTDIR) $(TEMPDIR)/goreleaser.yaml
+
+.PHONY: clean-dist
+clean-dist:
+	rm -rf $(DISTDIR) $(TEMPDIR)/goreleaser.yaml

README.md

@@ -1 +1,138 @@
-# imgbom (TBD Name)
+# syft
+
+[![Static Analysis + Unit + Integration](https://github.com/anchore/syft/workflows/Static%20Analysis%20+%20Unit%20+%20Integration/badge.svg)](https://github.com/anchore/syft/actions?query=workflow%3A%22Static+Analysis+%2B+Unit+%2B+Integration%22)
+[![Acceptance](https://github.com/anchore/syft/workflows/Acceptance/badge.svg)](https://github.com/anchore/syft/actions?query=workflow%3AAcceptance)
+[![Go Report Card](https://goreportcard.com/badge/github.com/anchore/syft)](https://goreportcard.com/report/github.com/anchore/syft)
+[![GitHub release](https://img.shields.io/github/release/anchore/syft.svg)](https://github.com/anchore/syft/releases/latest)
+[![License: Apache-2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://github.com/anchore/syft/blob/main/LICENSE)
+
+A CLI tool and go library for generating a Software Bill of Materials (SBOM) from container images and filesystems.
+
+![syft-demo](https://user-images.githubusercontent.com/590471/90277200-2a253000-de33-11ea-893f-32c219eea11a.gif)
+
+**Features**
+- Catalog container images and filesystems to discover packages and libraries.
+- Supports packages and libraries from various ecosystems (APK, DEB, RPM, Ruby Bundles, Python Wheel/Egg/requirements.txt, JavaScript NPM/Yarn, Java JAR/EAR/WAR, Jenkins plugins JPI/HPI, Go modules)
+- Linux distribution identification (supports Alpine, BusyBox, CentOS/RedHat, Debian/Ubuntu flavored distributions)
+- Supports Docker and OCI image formats
+
+If you encounter an issue, please [let us know using the issue tracker](https://github.com/anchore/syft/issues).
+
+## Getting started
+
+To generate an SBOM for a Docker or OCI image:
+```
+syft <image>
+```
+
+The above output includes only software that is visible in the container (i.e., the squashed representation of the image).
+To include software from all image layers in the SBOM, regardless of its presence in the final image, provide `--scope all-layers`:
+
+```
+syft <image> --scope all-layers
+```
+
+Syft can generate a SBOM from a variety of sources:
+```
+# catalog a container image archive (from the result of `docker image save ...`, `podman save ...`, or `skopeo copy` commands)
+syft path/to/image.tar
+
+# catalog a directory
+syft path/to/dir
+```
+
+The output format for Syft is configurable as well:
+```
+syft <image> -o <format>
+```
+
+Where the `format`s available are:
+- `json`: Use this to get as much information out of Syft as possible!
+- `text`: A row-oriented, human-and-machine-friendly output.
+- `cyclonedx`: A XML report conforming to the [CycloneDX 1.2](https://cyclonedx.org/) specification.
+- `table`: A columnar summary (default).
+
+## Installation
+
+**Recommended (macOS and Linux)**
+```bash
+# install the latest version to /usr/local/bin
+curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
+
+# install a specific version into a specific dir
+curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b <SOME_BIN_PATH> <RELEASE_VERSION>
+```
+
+**Homebrew (macOS)**
+```bash
+brew tap anchore/syft
+brew install syft
+```
+
+## Configuration
+
+Configuration search paths:
+
+- `.syft.yaml`
+- `.syft/config.yaml`
+- `~/.syft.yaml`
+- `<XDG_CONFIG_HOME>/syft/config.yaml`
+
+Configuration options (example values are the default):
+
+```yaml
+# the output format of the SBOM report (options: table, text, json)
+# same as -o ; SYFT_OUTPUT env var
+output: "table"
+
+# the search space to look for packages (options: all-layers, squashed)
+# same as -s ; SYFT_SCOPE env var
+scope: "squashed"
+
+# suppress all output (except for the SBOM report)
+# same as -q ; SYFT_QUIET env var
+quiet: false
+
+# enable/disable checking for application updates on startup
+# same as SYFT_CHECK_FOR_APP_UPDATE env var
+check-for-app-update: true
+
+log:
+  # use structured logging
+  # same as SYFT_LOG_STRUCTURED env var
+  structured: false
+
+  # the log level; note: detailed logging suppress the ETUI
+  # same as SYFT_LOG_LEVEL env var
+  level: "error"
+
+  # location to write the log file (default is not to have a log file)
+  # same as SYFT_LOG_FILE env var
+  file: ""
+
+anchore:
+  # (feature-preview) enable uploading of results to Anchore Enterprise automatically (supported on Enterprise 3.0+)
+  # same as SYFT_ANCHORE_UPLOAD_ENABLED env var
+  upload-enabled: false
+
+  # (feature-preview) the Anchore Enterprise Host or URL to upload results to (supported on Enterprise 3.0+)
+  # same as -H ; SYFT_ANCHORE_HOST env var
+  host: ""
+
+  # (feature-preview) the path after the host to the Anchore External API (supported on Enterprise 3.0+)
+  # same as SYFT_ANCHORE_PATH env var
+  path: ""
+
+  # (feature-preview) the username to authenticate against Anchore Enterprise (supported on Enterprise 3.0+)
+  # same as -u ; SYFT_ANCHORE_USERNAME env var
+  username: ""
+
+  # (feature-preview) the password to authenticate against Anchore Enterprise (supported on Enterprise 3.0+)
+  # same as -p ; SYFT_ANCHORE_PASSWORD env var
+  password: ""
+
+  # (feature-preview) path to dockerfile to be uploaded with the syft results to Anchore Enterprise (supported on Enterprise 3.0+)
+  # same as -d ; SYFT_ANCHORE_DOCKERFILE env var
+  dockerfile: ""
+
+```

RELEASE.md

@@ -0,0 +1,99 @@
+# Release Process
+
+A good release process has the following qualities:
+
+1. There is a way to plan what should be in a release
+1. There is a way to see what is actually in a release
+1. Allow for different kinds of releases (major breaking vs backwards compatible
+   enhancements vs patch updates)
+1. Specify a repeatable way to build and publish software artifacts
+
+## Planning a release
+
+To indicate a set of features to be released together add each issue to an in-repository
+Milestone named with major-minor version to be released (e.g. `v0.1`). It is OK for other
+features to be in the release that were not originally planned, and these issues and PRs
+do not need to be added to the Milestone in question. Only the set of features that, when
+completed, would allow the release to be considered complete. A Milestone is only used to:
+
+- Plan what is desired to be in a release
+- Track progress to indicate when we may be ready to cut a new release
+
+Not all releases need to be planned. For instance, patch releases for fixes should be
+released when they are ready and when releasing would not interfere with another current
+release (where some partial or breaking features have already been merged). Beta releases
+and release candidates should not be independently planned from the non-beta release. That
+is, the features for a `v0.1-beta.1` release should be planned under the `v0.1` Milestone,
+not under a separate `v0.1-beta.1` Milestone.
+
+Unless necessary, feature releases should be small and frequent, which may obviate the
+need for regular release planning under a Milestone.
+
+## What is in a release
+
+Milestones are specifically for planning a release, not necessarily tracking all changes
+that a release may bring (and more importantly, not all releases are necessarily planned
+either).
+
+This is one of the (many) reasons for a Changelog. A good Changelog lists changes grouped
+by the type of change (new, enhancement, deprecation, breaking, bug fix, security fix), in
+chronological order (within groups), linking the PR where the change was made in the
+Changelog line. Furthermore, there should be a place to see all released versions, the
+release date for each release, the semantic version of the release, and the set of changes
+for each release.
+
+This project auto-generates the Changelog contents for each current release and posts the
+generated contents to the GitHub Release page. Leveraging the GitHub Releases feature
+allows GitHub to manage the Changelog on each release outside of the git repository while
+still being hosted with the released assets.
+
+The Changelog is generated from the metadata from in-repository issues and PRs, using
+labels to guide what kind of change each item is (e.g. breaking, new feature, bug fix,
+etx). Only issues/PRs with select labels are included in the Changelog, and only if the
+issue/PR was created after the last release. Additional labels are used to exclude items
+from the Changelog.
+
+The above suggestions imply that we should:
+
+- Ensure there is a sufficient title for each PR and issue title to be included in the
+  Changelog
+- The appropriate label is applied to PRs and/or issues to drive specific change type
+  sections (deprecated, breaking, security, bug, etc)
+
+With this approach as we cultivate good organization of PRs and issues we automatically
+get an equally good Changelog.
+
+## Major, minor, and patch releases
+
+The latest version of the tool is the only supported version, which implies that multiple
+parallel release branches will not be a regular process (if ever). Multiple releases can
+be planned in parallel, however, only one can be actively developed at a time. That is, if
+PRs attached to a release Milestone have been merged into the main branch, that release is
+now the "next" release. This implies that the source of truth for release lies with the
+git log and Changelog, not with the release Milestones (which are purely for planning and
+tracking).
+
+Semantic versioning should be used to indicate breaking changes, new features, and fixes.
+The exception to this is `< 1.0`, where the major version is not bumped for breaking changes,
+instead the minor version indicates both new features and breaking changes.
+
+## Cutting a release
+
+Ideally releasing should be done often with small increments when possible. Unless a
+breaking change is blocking the release, or no fixes/features have been merged, a good
+target release cadence is between every 2 or 4 weeks.
+
+This release process itself should be as automated as possible, and have only a few steps:
+
+1. Tag the main branch with a full semantic-version, prefixed with a `v`. If there is a
+   milestone with a partial version, the full version should be used for the git tag (e.g.
+   with a Milestone of `v0.1` the tag should be `v0.1.0`).
+
+1. Push the tag, the release pipeline will generate and publish all assets as well as a
+   draft GitHub Release.
+
+1. Promote the GitHub Release from draft to public. Note: since extra assets are made
+   available immediately from previous steps (i.e. the brew formula) the release should
+   only be in this state for a small amount of time (minutes).
+
+1. If there is a release Milestone, close it.

cmd/cli.go

@@ -1,50 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/anchore/imgbom/imgbom/presenter"
-	"github.com/anchore/imgbom/imgbom/scope"
-	"github.com/anchore/imgbom/internal/config"
-	"github.com/spf13/viper"
-)
-
-var cliOpts = config.CliOnlyOptions{}
-
-func setCliOptions() {
-	rootCmd.PersistentFlags().StringVarP(&cliOpts.ConfigPath, "config", "c", "", "application config file")
-
-	// scan options
-	flag := "scope"
-	rootCmd.Flags().StringP(
-		"scope", "s", scope.AllLayersScope.String(),
-		fmt.Sprintf("selection of layers to analyze, options=%v", scope.Options))
-	if err := viper.BindPFlag(flag, rootCmd.Flags().Lookup(flag)); err != nil {
-		fmt.Printf("unable to bind flag '%s': %+v", flag, err)
-		os.Exit(1)
-	}
-
-	// output & formatting options
-	flag = "output"
-	rootCmd.Flags().StringP(
-		flag, "o", presenter.JSONPresenter.String(),
-		fmt.Sprintf("report output formatter, options=%v", presenter.Options),
-	)
-	if err := viper.BindPFlag(flag, rootCmd.Flags().Lookup(flag)); err != nil {
-		fmt.Printf("unable to bind flag '%s': %+v", flag, err)
-		os.Exit(1)
-	}
-
-	flag = "quiet"
-	rootCmd.Flags().BoolP(
-		flag, "q", false,
-		"suppress all logging output",
-	)
-	if err := viper.BindPFlag(flag, rootCmd.Flags().Lookup(flag)); err != nil {
-		fmt.Printf("unable to bind flag '%s': %+v", flag, err)
-		os.Exit(1)
-	}
-
-	rootCmd.Flags().CountVarP(&cliOpts.Verbosity, "verbose", "v", "increase verbosity (-v = info, -vv = debug)")
-}

cmd/cmd.go

@@ -0,0 +1,175 @@
+package cmd
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/anchore/stereoscope"
+	"github.com/anchore/syft/internal/config"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/logger"
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/presenter"
+	"github.com/anchore/syft/syft/source"
+	"github.com/gookit/color"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+	"github.com/wagoodman/go-partybus"
+)
+
+var appConfig *config.Application
+var eventBus *partybus.Bus
+var eventSubscription *partybus.Subscription
+var cliOpts = config.CliOnlyOptions{}
+
+func init() {
+	setGlobalCliOptions()
+
+	cobra.OnInitialize(
+		initAppConfig,
+		initLogging,
+		logAppConfig,
+		initEventBus,
+	)
+}
+
+func Execute() {
+	if err := rootCmd.Execute(); err != nil {
+		fmt.Fprintln(os.Stderr, err.Error())
+		os.Exit(1)
+	}
+}
+
+func setGlobalCliOptions() {
+	rootCmd.PersistentFlags().StringVarP(&cliOpts.ConfigPath, "config", "c", "", "application config file")
+
+	// scan options
+	flag := "scope"
+	rootCmd.Flags().StringP(
+		"scope", "s", source.SquashedScope.String(),
+		fmt.Sprintf("selection of layers to catalog, options=%v", source.AllScopes))
+	if err := viper.BindPFlag(flag, rootCmd.Flags().Lookup(flag)); err != nil {
+		fmt.Printf("unable to bind flag '%s': %+v", flag, err)
+		os.Exit(1)
+	}
+
+	setGlobalFormatOptions()
+	setGlobalUploadOptions()
+}
+
+func setGlobalFormatOptions() {
+	// output & formatting options
+	flag := "output"
+	rootCmd.Flags().StringP(
+		flag, "o", string(presenter.TablePresenter),
+		fmt.Sprintf("report output formatter, options=%v", presenter.Options),
+	)
+	if err := viper.BindPFlag(flag, rootCmd.Flags().Lookup(flag)); err != nil {
+		fmt.Printf("unable to bind flag '%s': %+v", flag, err)
+		os.Exit(1)
+	}
+
+	flag = "quiet"
+	rootCmd.Flags().BoolP(
+		flag, "q", false,
+		"suppress all logging output",
+	)
+	if err := viper.BindPFlag(flag, rootCmd.Flags().Lookup(flag)); err != nil {
+		fmt.Printf("unable to bind flag '%s': %+v", flag, err)
+		os.Exit(1)
+	}
+
+	rootCmd.Flags().CountVarP(&cliOpts.Verbosity, "verbose", "v", "increase verbosity (-v = info, -vv = debug)")
+}
+
+func setGlobalUploadOptions() {
+	flag := "host"
+	rootCmd.Flags().StringP(
+		flag, "H", "",
+		"the hostname or URL of the Anchore Enterprise instance to upload to",
+	)
+	if err := viper.BindPFlag("anchore.host", rootCmd.Flags().Lookup(flag)); err != nil {
+		fmt.Printf("unable to bind flag '%s': %+v", flag, err)
+		os.Exit(1)
+	}
+
+	flag = "username"
+	rootCmd.Flags().StringP(
+		flag, "u", "",
+		"the username to authenticate against Anchore Enterprise",
+	)
+	if err := viper.BindPFlag("anchore.username", rootCmd.Flags().Lookup(flag)); err != nil {
+		fmt.Printf("unable to bind flag '%s': %+v", flag, err)
+		os.Exit(1)
+	}
+
+	flag = "password"
+	rootCmd.Flags().StringP(
+		flag, "p", "",
+		"the password to authenticate against Anchore Enterprise",
+	)
+	if err := viper.BindPFlag("anchore.password", rootCmd.Flags().Lookup(flag)); err != nil {
+		fmt.Printf("unable to bind flag '%s': %+v", flag, err)
+		os.Exit(1)
+	}
+
+	flag = "dockerfile"
+	rootCmd.Flags().StringP(
+		flag, "d", "",
+		"include dockerfile for upload to Anchore Enterprise",
+	)
+	if err := viper.BindPFlag("anchore.dockerfile", rootCmd.Flags().Lookup(flag)); err != nil {
+		fmt.Printf("unable to bind flag '#{flag}': #{err}")
+		os.Exit(1)
+	}
+
+	flag = "overwrite-existing-image"
+	rootCmd.Flags().Bool(
+		flag, false,
+		"overwrite an existing image during the upload to Anchore Enterprise",
+	)
+	if err := viper.BindPFlag("anchore.overwrite-existing-image", rootCmd.Flags().Lookup(flag)); err != nil {
+		fmt.Printf("unable to bind flag '#{flag}': #{err}")
+		os.Exit(1)
+	}
+}
+
+func initAppConfig() {
+	cfgVehicle := viper.GetViper()
+	wasHostnameSet := rootCmd.Flags().Changed("host")
+	cfg, err := config.LoadApplicationConfig(cfgVehicle, cliOpts, wasHostnameSet)
+	if err != nil {
+		fmt.Printf("failed to load application config: \n\t%+v\n", err)
+		os.Exit(1)
+	}
+
+	appConfig = cfg
+}
+
+func initLogging() {
+	cfg := logger.LogrusConfig{
+		EnableConsole: (appConfig.Log.FileLocation == "" || appConfig.CliOptions.Verbosity > 0) && !appConfig.Quiet,
+		EnableFile:    appConfig.Log.FileLocation != "",
+		Level:         appConfig.Log.LevelOpt,
+		Structured:    appConfig.Log.Structured,
+		FileLocation:  appConfig.Log.FileLocation,
+	}
+
+	logWrapper := logger.NewLogrusLogger(cfg)
+	syft.SetLogger(logWrapper)
+	stereoscope.SetLogger(&logger.LogrusNestedLogger{
+		Logger: logWrapper.Logger.WithField("from-lib", "stereoscope"),
+	})
+}
+
+func logAppConfig() {
+	log.Debugf("Application config:\n%+v", color.Magenta.Sprint(appConfig.String()))
+}
+
+func initEventBus() {
+	eventBus = partybus.NewBus()
+	eventSubscription = eventBus.Subscribe()
+
+	stereoscope.SetBus(eventBus)
+	syft.SetBus(eventBus)
+}

cmd/completion.go

@@ -0,0 +1,65 @@
+package cmd
+
+import (
+	"os"
+
+	"github.com/spf13/cobra"
+)
+
+// completionCmd represents the completion command
+var completionCmd = &cobra.Command{
+	Use:   "completion [bash|zsh|fish]",
+	Short: "Generate a shell completion for Syft (listing local docker images)",
+	Long: `To load completions (docker image list):
+
+Bash:
+
+$ source <(syft completion bash)
+
+# To load completions for each session, execute once:
+Linux:
+  $ syft completion bash > /etc/bash_completion.d/syft
+MacOS:
+  $ syft completion bash > /usr/local/etc/bash_completion.d/syft
+
+Zsh:
+
+# If shell completion is not already enabled in your environment you will need
+# to enable it.  You can execute the following once:
+
+$ echo "autoload -U compinit; compinit" >> ~/.zshrc
+
+# To load completions for each session, execute once:
+$ syft completion zsh > "${fpath[1]}/_syft"
+
+# You will need to start a new shell for this setup to take effect.
+
+Fish:
+
+$ syft completion fish | source
+
+# To load completions for each session, execute once:
+$ syft completion fish > ~/.config/fish/completions/syft.fish
+`,
+	DisableFlagsInUseLine: true,
+	ValidArgs:             []string{"bash", "zsh", "fish"},
+	Args:                  cobra.ExactValidArgs(1),
+	Run: func(cmd *cobra.Command, args []string) {
+		var err error
+		switch args[0] {
+		case "bash":
+			err = cmd.Root().GenBashCompletion(os.Stdout)
+		case "zsh":
+			err = cmd.Root().GenZshCompletion(os.Stdout)
+		case "fish":
+			err = cmd.Root().GenFishCompletion(os.Stdout, true)
+		}
+		if err != nil {
+			panic(err)
+		}
+	},
+}
+
+func init() {
+	rootCmd.AddCommand(completionCmd)
+}

cmd/init.go

@@ -1,52 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/anchore/imgbom/imgbom"
-	"github.com/anchore/imgbom/internal/config"
-	"github.com/anchore/imgbom/internal/format"
-	"github.com/anchore/imgbom/internal/logger"
-	"github.com/anchore/stereoscope"
-	"github.com/spf13/viper"
-	"go.uber.org/zap"
-	"gopkg.in/yaml.v2"
-)
-
-var appConfig *config.Application
-var log *zap.SugaredLogger
-
-func initAppConfig() {
-	cfg, err := config.LoadConfigFromFile(viper.GetViper(), &cliOpts)
-	if err != nil {
-		fmt.Printf("failed to load application config: \n\t%+v\n", err)
-		os.Exit(1)
-	}
-	appConfig = cfg
-}
-
-func initLogging() {
-	config := logger.LogConfig{
-		EnableConsole: (appConfig.Log.FileLocation == "" || appConfig.CliOptions.Verbosity > 0) && !appConfig.Quiet,
-		EnableFile:    appConfig.Log.FileLocation != "",
-		Level:         appConfig.Log.LevelOpt,
-		Structured:    appConfig.Log.Structured,
-		FileLocation:  appConfig.Log.FileLocation,
-	}
-
-	logWrapper := logger.NewZapLogger(config)
-	log = logWrapper.Logger
-	imgbom.SetLogger(logWrapper)
-	stereoscope.SetLogger(logWrapper)
-}
-
-func logAppConfig() {
-	appCfgStr, err := yaml.Marshal(&appConfig)
-
-	if err != nil {
-		log.Debugf("Could not display application config: %+v", err)
-	} else {
-		log.Debugf("Application config:\n%+v", format.Magenta.Format(string(appCfgStr)))
-	}
-}

cmd/root.go

@@ -1,99 +1,217 @@
 package cmd
 
 import (
+	"context"
 	"fmt"
+	"io/ioutil"
 	"os"
-	"strconv"
+	"strings"
 
-	"github.com/anchore/imgbom/imgbom"
-	"github.com/anchore/imgbom/imgbom/pkg"
-	"github.com/anchore/imgbom/internal"
-	"github.com/anchore/stereoscope"
+	"github.com/pkg/profile"
+
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/anchore"
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/ui"
+	"github.com/anchore/syft/internal/version"
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/presenter"
+	"github.com/anchore/syft/syft/source"
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/filters"
+	"github.com/docker/docker/client"
 	"github.com/spf13/cobra"
+	"github.com/wagoodman/go-partybus"
 )
 
 var rootCmd = &cobra.Command{
-	Use:   fmt.Sprintf("%s [IMAGE]", internal.ApplicationName),
-	Short: "A container image BOM tool", // TODO: add copy
-	Long: internal.Tprintf(`\
+	Use:   fmt.Sprintf("%s [SOURCE]", internal.ApplicationName),
+	Short: "A tool for generating a Software Bill Of Materials (PackageSBOM) from container images and filesystems",
+	Long: internal.Tprintf(`
 Supports the following image sources:
-    {{.appName}} yourrepo/yourimage:tag             defaults to using images from a docker daemon
-    {{.appName}} docker://yourrepo/yourimage:tag    explicitly use the docker daemon
-    {{.appName}} tar://path/to/yourimage.tar        use a tarball from disk
+    {{.appName}} yourrepo/yourimage:tag     defaults to using images from a Docker daemon
+    {{.appName}} path/to/yourproject        a Docker tar, OCI tar, OCI directory, or generic filesystem directory 
+
+You can also explicitly specify the scheme to use:
+    {{.appName}} docker:yourrepo/yourimage:tag          explicitly use the Docker daemon
+    {{.appName}} docker-archive:path/to/yourimage.tar   use a tarball from disk for archives created from "docker save"
+    {{.appName}} oci-archive:path/to/yourimage.tar      use a tarball from disk for OCI archives (from Podman or otherwise)
+    {{.appName}} oci-dir:path/to/yourimage              read directly from a path on disk for OCI layout directories (from Skopeo or otherwise)
+    {{.appName}} dir:path/to/yourproject                read directly from a path on disk (any directory)
 `, map[string]interface{}{
 		"appName": internal.ApplicationName,
 	}),
 	Args: cobra.MaximumNArgs(1),
-	Run:  runCmdWrapper,
-}
-
-func init() {
-	setCliOptions()
-
-	cobra.OnInitialize(initAppConfig)
-	cobra.OnInitialize(initLogging)
-	cobra.OnInitialize(logAppConfig)
-}
-
-func Execute() {
-	if err := rootCmd.Execute(); err != nil {
-		log.Errorf("could not start application: %w", err)
-		os.Exit(1)
-	}
-}
-
-func runCmdWrapper(cmd *cobra.Command, args []string) {
-	os.Exit(doRunCmd(cmd, args))
-}
-
-func doRunCmd(cmd *cobra.Command, args []string) int {
-	userImageStr := args[0]
-	log.Infof("Fetching image '%s'", userImageStr)
-	img, err := stereoscope.GetImage(userImageStr)
-	if err != nil {
-		log.Errorf("could not fetch image '%s': %w", userImageStr, err)
-		return 1
-	}
-	defer stereoscope.Cleanup()
-
-	log.Info("Cataloging image")
-	catalog, err := imgbom.CatalogImage(img, appConfig.ScopeOpt)
-	if err != nil {
-		log.Errorf("could not catalog image: %w", err)
-		return 1
-	}
-
-	log.Info("Complete!")
-	// err = presenter.GetPresenter(appConfig.PresenterOpt).Present(os.Stdout, img, catalog)
-	// if err != nil {
-	// 	log.Errorf("could not format catalog results: %w", err)
-	// 	return 1
-	// }
-	result := catalog.SearchName("libselinux")
-	fmt.Println(result)
-	if result != nil {
-		for _, hit := range result.Hits {
-			pkgId, err := strconv.Atoi(hit.ID)
+	Run: func(cmd *cobra.Command, args []string) {
+		if len(args) == 0 {
+			err := cmd.Help()
 			if err != nil {
-				// TODO: just no...
-				panic(err)
+				log.Errorf(err.Error())
+				os.Exit(1)
 			}
-			fmt.Println(pkgId, catalog.Package(pkg.ID(pkgId)), hit.Score)
+			os.Exit(1)
+		}
+
+		if appConfig.Dev.ProfileCPU && appConfig.Dev.ProfileMem {
+			log.Errorf("cannot profile CPU and memory simultaneously")
+			os.Exit(1)
+		}
+
+		if appConfig.Dev.ProfileCPU {
+			defer profile.Start(profile.CPUProfile).Stop()
+		} else if appConfig.Dev.ProfileMem {
+			defer profile.Start(profile.MemProfile).Stop()
+		}
+
+		err := doRunCmd(cmd, args)
+
+		if err != nil {
+			log.Errorf(err.Error())
+			os.Exit(1)
+		}
+	},
+	ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+		// Since we use ValidArgsFunction, Cobra will call this AFTER having parsed all flags and arguments provided
+		dockerImageRepoTags, err := ListLocalDockerImages(toComplete)
+		if err != nil {
+			// Indicates that an error occurred and completions should be ignored
+			return []string{"completion failed"}, cobra.ShellCompDirectiveError
+		}
+		if len(dockerImageRepoTags) == 0 {
+			return []string{"no docker images found"}, cobra.ShellCompDirectiveError
+		}
+		// ShellCompDirectiveDefault indicates that the shell will perform its default behavior after completions have
+		// been provided (without implying other possible directives)
+		return dockerImageRepoTags, cobra.ShellCompDirectiveDefault
+	},
+}
+
+func startWorker(userInput string) <-chan error {
+	errs := make(chan error)
+	go func() {
+		defer close(errs)
+
+		if appConfig.CheckForAppUpdate {
+			isAvailable, newVersion, err := version.IsUpdateAvailable()
+			if err != nil {
+				log.Errorf(err.Error())
+			}
+			if isAvailable {
+				log.Infof("new version of %s is available: %s", internal.ApplicationName, newVersion)
+
+				bus.Publish(partybus.Event{
+					Type:  event.AppUpdateAvailable,
+					Value: newVersion,
+				})
+			} else {
+				log.Debugf("no new %s update available", internal.ApplicationName)
+			}
+		}
+
+		src, catalog, distro, err := syft.Catalog(userInput, appConfig.ScopeOpt)
+		if err != nil {
+			errs <- fmt.Errorf("failed to catalog input: %+v", err)
+			return
+		}
+
+		if appConfig.Anchore.UploadEnabled {
+			if err := doImport(src, src.Metadata, catalog, distro); err != nil {
+				errs <- err
+				return
+			}
+		}
+
+		bus.Publish(partybus.Event{
+			Type:  event.CatalogerFinished,
+			Value: presenter.GetPresenter(appConfig.PresenterOpt, src.Metadata, catalog, distro),
+		})
+	}()
+	return errs
+}
+
+func doImport(src source.Source, s source.Metadata, catalog *pkg.Catalog, d *distro.Distro) error {
+	// TODO: ETUI element for this
+	log.Infof("uploading results to %s", appConfig.Anchore.Host)
+
+	if src.Metadata.Scheme != source.ImageScheme {
+		return fmt.Errorf("unable to upload results: only images are supported")
+	}
+
+	var dockerfileContents []byte
+	if appConfig.Anchore.Dockerfile != "" {
+		if _, err := os.Stat(appConfig.Anchore.Dockerfile); os.IsNotExist(err) {
+			return fmt.Errorf("unable to read dockerfile=%q: %w", appConfig.Anchore.Dockerfile, err)
+		}
+
+		fh, err := os.Open(appConfig.Anchore.Dockerfile)
+		if err != nil {
+			return fmt.Errorf("unable to open dockerfile=%q: %w", appConfig.Anchore.Dockerfile, err)
+		}
+
+		dockerfileContents, err = ioutil.ReadAll(fh)
+		if err != nil {
+			return fmt.Errorf("unable to read dockerfile=%q: %w", appConfig.Anchore.Dockerfile, err)
 		}
 	}
-	fmt.Println("------------------------------------------")
 
-	result = catalog.SearchMetadata("libselinux")
-	fmt.Println(result)
-	if result != nil {
-		for _, hit := range result.Hits {
-			pkgId, err := strconv.Atoi(hit.ID)
-			if err != nil {
-				// TODO: just no...
-				panic(err)
+	c, err := anchore.NewClient(anchore.Configuration{
+		BaseURL:  appConfig.Anchore.Host,
+		Username: appConfig.Anchore.Username,
+		Password: appConfig.Anchore.Password,
+	})
+	if err != nil {
+		return fmt.Errorf("unable to upload results: %w", err)
+	}
+
+	importCfg := anchore.ImportConfig{
+		ImageMetadata:           src.Image.Metadata,
+		SourceMetadata:          s,
+		Catalog:                 catalog,
+		Distro:                  d,
+		Dockerfile:              dockerfileContents,
+		OverwriteExistingUpload: appConfig.Anchore.OverwriteExistingImage,
+	}
+
+	if err := c.Import(context.Background(), importCfg); err != nil {
+		return fmt.Errorf("failed to upload results to host=%s: %+v", appConfig.Anchore.Host, err)
+	}
+	return nil
+}
+
+func doRunCmd(_ *cobra.Command, args []string) error {
+	userInput := args[0]
+	errs := startWorker(userInput)
+	ux := ui.Select(appConfig.CliOptions.Verbosity > 0, appConfig.Quiet)
+	return ux(errs, eventSubscription)
+}
+
+func ListLocalDockerImages(prefix string) ([]string, error) {
+	var repoTags = make([]string, 0)
+	ctx := context.Background()
+	cli, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
+	if err != nil {
+		return repoTags, err
+	}
+
+	// Only want to return tagged images
+	imageListArgs := filters.NewArgs()
+	imageListArgs.Add("dangling", "false")
+	images, err := cli.ImageList(ctx, types.ImageListOptions{All: false, Filters: imageListArgs})
+	if err != nil {
+		return repoTags, err
+	}
+
+	for _, image := range images {
+		// image may have multiple tags
+		for _, tag := range image.RepoTags {
+			if strings.HasPrefix(tag, prefix) {
+				repoTags = append(repoTags, tag)
 			}
-			fmt.Println(pkgId, catalog.Package(pkg.ID(pkgId)), hit.Score)
 		}
 	}
-	return 0
+	return repoTags, nil
 }

cmd/version.go

@@ -1,19 +1,18 @@
 package cmd
 
 import (
+	"encoding/json"
 	"fmt"
+	"os"
 
-	"github.com/anchore/imgbom/internal"
+	"github.com/anchore/syft/internal"
+
+	"github.com/anchore/syft/internal/version"
+	"github.com/anchore/syft/syft/presenter"
 	"github.com/spf13/cobra"
 )
 
-type Version struct {
-	Version   string
-	Commit    string
-	BuildTime string
-}
-
-var version *Version
+var outputFormat string
 
 var versionCmd = &cobra.Command{
 	Use:   "version",
@@ -22,13 +21,41 @@ var versionCmd = &cobra.Command{
 }
 
 func init() {
+	versionCmd.Flags().StringVarP(&outputFormat, "output", "o", string(presenter.TextPresenter), "format to show version information (available=[text, json])")
 	rootCmd.AddCommand(versionCmd)
 }
 
-func SetVersion(v *Version) {
-	version = v
-}
+func printVersion(_ *cobra.Command, _ []string) {
+	versionInfo := version.FromBuild()
 
-func printVersion(cmd *cobra.Command, args []string) {
-	fmt.Printf("%s %s\n", internal.ApplicationName, version.Version)
+	switch outputFormat {
+	case "text":
+		fmt.Println("Application:  ", internal.ApplicationName)
+		fmt.Println("Version:      ", versionInfo.Version)
+		fmt.Println("BuildDate:    ", versionInfo.BuildDate)
+		fmt.Println("GitCommit:    ", versionInfo.GitCommit)
+		fmt.Println("GitTreeState: ", versionInfo.GitTreeState)
+		fmt.Println("Platform:     ", versionInfo.Platform)
+		fmt.Println("GoVersion:    ", versionInfo.GoVersion)
+		fmt.Println("Compiler:     ", versionInfo.Compiler)
+
+	case "json":
+		enc := json.NewEncoder(os.Stdout)
+		enc.SetEscapeHTML(false)
+		enc.SetIndent("", " ")
+		err := enc.Encode(&struct {
+			version.Version
+			Application string `json:"application"`
+		}{
+			Version:     versionInfo,
+			Application: internal.ApplicationName,
+		})
+		if err != nil {
+			fmt.Printf("failed to show version information: %+v\n", err)
+			os.Exit(1)
+		}
+	default:
+		fmt.Printf("unsupported output format: %s\n", outputFormat)
+		os.Exit(1)
+	}
 }

go.mod

@@ -1,25 +1,43 @@
-module github.com/anchore/imgbom
+module github.com/anchore/syft
 
 go 1.14
 
 require (
-	github.com/RoaringBitmap/roaring v0.4.23 // indirect
 	github.com/adrg/xdg v0.2.1
-	github.com/anchore/go-testutils v0.0.0-20200520222037-edc2bf1864fe
-	github.com/anchore/stereoscope v0.0.0-20200523232006-be5f3c18958f
-	github.com/blevesearch/bleve v1.0.9
-	github.com/glycerine/go-unsnap-stream v0.0.0-20190901134440-81cf024a9e0a // indirect
-	github.com/go-test/deep v1.0.6
-	github.com/google/go-containerregistry v0.0.0-20200521151920-a873a21aff23 // indirect
+	github.com/alecthomas/jsonschema v0.0.0-20200530073317-71f438968921
+	github.com/anchore/client-go v0.0.0-20210222170800-9c70f9b80bcf
+	github.com/anchore/go-rpmdb v0.0.0-20201106153645-0043963c2e12
+	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
+	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
+	github.com/anchore/stereoscope v0.0.0-20210201165248-e94c52b4052d
+	github.com/antihax/optional v1.0.0
+	github.com/bmatcuk/doublestar/v2 v2.0.4
+	github.com/docker/docker v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible
+	github.com/dustin/go-humanize v1.0.0
+	github.com/facebookincubator/nvdtools v0.1.4
+	github.com/go-test/deep v1.0.7
+	github.com/google/uuid v1.1.1
+	github.com/gookit/color v1.2.7
 	github.com/hashicorp/go-multierror v1.1.0
+	github.com/hashicorp/go-version v1.2.0
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/mitchellh/mapstructure v1.3.1
+	github.com/olekukonko/tablewriter v0.0.4
+	github.com/package-url/packageurl-go v0.1.0
+	github.com/pelletier/go-toml v1.8.0
+	github.com/pkg/profile v1.5.0
+	github.com/scylladb/go-set v1.0.2
 	github.com/sergi/go-diff v1.1.0
-	github.com/spf13/cobra v1.0.0
+	github.com/sirupsen/logrus v1.6.0
+	github.com/spf13/afero v1.2.2
+	github.com/spf13/cobra v1.0.1-0.20200909172742-8a63648dd905
 	github.com/spf13/viper v1.7.0
-	github.com/tinylib/msgp v1.1.2 // indirect
-	go.uber.org/zap v1.15.0
-	golang.org/x/sys v0.0.0-20200523222454-059865788121 // indirect
-	google.golang.org/protobuf v1.24.0 // indirect
+	github.com/wagoodman/go-partybus v0.0.0-20200526224238-eb215533f07d
+	github.com/wagoodman/go-progress v0.0.0-20200731105512-1020f39e6240
+	github.com/wagoodman/jotframe v0.0.0-20200730190914-3517092dd163
+	github.com/x-cray/logrus-prefixed-formatter v0.5.2
+	github.com/xeipuuv/gojsonschema v1.2.0
+	golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9
+	golang.org/x/mod v0.3.0
 	gopkg.in/yaml.v2 v2.3.0
 )

gon.hcl

@@ -0,0 +1,15 @@
+source = ["./dist/syft-macos_darwin_amd64/syft"] # The 'dist' directory path should ideally reference an env var, where the source of truth is the Makefile. I wasn't able to figure out how to solve this.
+bundle_id = "com.anchore.toolbox.syft"
+
+sign {
+  application_identity = "Developer ID Application: ANCHORE, INC. (9MJHKYX5AT)"
+}
+
+dmg {
+  output_path = "./dist/output.dmg"
+  volume_name = "Syft"
+}
+
+zip {
+  output_path = "./dist/output.zip"
+}

imgbom/analyzer/analyzer.go

@@ -1,16 +0,0 @@
-package analyzer
-
-import (
-	"github.com/anchore/imgbom/imgbom/pkg"
-	"github.com/anchore/stereoscope/pkg/file"
-	"github.com/anchore/stereoscope/pkg/tree"
-)
-
-type Analyzer interface {
-	Name() string
-	// TODO: add ID / Name for analyze for uniquely identifying this analyzer type
-	SelectFiles([]*tree.FileTree) []file.Reference
-	// NOTE: one of the errors which is returned is "IterationNeeded", which indicates to the driver to
-	// continue with another Select/Analyze pass
-	Analyze(map[file.Reference]string) ([]pkg.Package, error)
-}

imgbom/analyzer/controller.go

@@ -1,72 +0,0 @@
-package analyzer
-
-import (
-	"github.com/anchore/imgbom/imgbom/analyzer/dpkg"
-	"github.com/anchore/imgbom/imgbom/pkg"
-	"github.com/anchore/imgbom/imgbom/scope"
-	"github.com/anchore/imgbom/internal/log"
-	"github.com/anchore/stereoscope/pkg/file"
-	"github.com/hashicorp/go-multierror"
-)
-
-var controllerInstance controller
-
-func init() {
-	controllerInstance = controller{
-		analyzers: make([]Analyzer, 0),
-	}
-	controllerInstance.add(dpkg.NewAnalyzer())
-}
-
-func Analyze(s scope.Scope) (pkg.Catalog, error) {
-	return controllerInstance.analyze(s)
-}
-
-type controller struct {
-	analyzers []Analyzer
-}
-
-func (c *controller) add(a Analyzer) {
-	log.Debugf("adding analyzer: %s", a.Name())
-	c.analyzers = append(c.analyzers, a)
-}
-
-func (c *controller) analyze(s scope.Scope) (pkg.Catalog, error) {
-	catalog := pkg.NewCatalog()
-	fileSelection := make([]file.Reference, 0)
-
-	// ask analyzers for files to extract from the image tar
-	for _, a := range c.analyzers {
-		fileSelection = append(fileSelection, a.SelectFiles(s.Trees)...)
-		log.Debugf("analyzer '%s' selected '%d' files", a.Name(), len(fileSelection))
-	}
-
-	// fetch contents for requested selection by analyzers
-	contents, err := s.Image.MultipleFileContentsByRef(fileSelection...)
-	if err != nil {
-		return pkg.Catalog{}, err
-	}
-
-	// perform analysis, accumulating errors for each failed analysis
-	var errs error
-	for _, a := range c.analyzers {
-		// TODO: check for multiple rounds of analyses by Iterate error
-		packages, err := a.Analyze(contents)
-		if err != nil {
-			errs = multierror.Append(errs, err)
-			continue
-		}
-
-		log.Debugf("analyzer '%s' discovered '%d' packages", a.Name(), len(packages))
-
-		for _, p := range packages {
-			catalog.Add(p)
-		}
-	}
-
-	if errs != nil {
-		return pkg.Catalog{}, errs
-	}
-
-	return catalog, nil
-}

imgbom/analyzer/dpkg/analyzer.go

@@ -1,69 +0,0 @@
-package dpkg
-
-import (
-	"strings"
-
-	"github.com/anchore/imgbom/imgbom/pkg"
-	"github.com/anchore/imgbom/internal/log"
-	"github.com/anchore/stereoscope/pkg/file"
-	"github.com/anchore/stereoscope/pkg/tree"
-)
-
-type Analyzer struct {
-	selectedFiles []file.Reference
-}
-
-func NewAnalyzer() *Analyzer {
-	return &Analyzer{}
-}
-
-func (a *Analyzer) Name() string {
-	return "dpkg-analyzer"
-}
-
-func (a *Analyzer) SelectFiles(trees []*tree.FileTree) []file.Reference {
-	files := make([]file.Reference, 0)
-	for _, tree := range trees {
-		// TODO: extract into function/slice/etc
-		file := tree.File("/var/lib/dpkg/status")
-		if file != nil {
-			files = append(files, *file)
-		}
-	}
-
-	a.selectedFiles = files
-
-	return files
-}
-
-func (a *Analyzer) Analyze(contents map[file.Reference]string) ([]pkg.Package, error) {
-	packages := make([]pkg.Package, 0)
-	for _, reference := range a.selectedFiles {
-		content, ok := contents[reference]
-		if !ok {
-			// TODO: test case
-			log.Errorf("analyzer '%s' file content missing: %+v", a.Name(), reference)
-
-			continue
-		}
-
-		entries, err := ParseEntries(strings.NewReader(content))
-		if err != nil {
-			// TODO: test case
-			log.Errorf("analyzer failed to parse entries (reference=%+v): %w", reference, err)
-
-			continue
-		}
-		for _, entry := range entries {
-			packages = append(packages, pkg.Package{
-				Name:     entry.Package,
-				Version:  entry.Version,
-				Type:     pkg.DebPkg,
-				Source:   []file.Reference{reference},
-				Metadata: entry,
-			})
-		}
-	}
-
-	return packages, nil
-}

imgbom/analyzer/dpkg/parser.go

@@ -1,94 +0,0 @@
-package dpkg
-
-import (
-	"bufio"
-	"fmt"
-	"io"
-	"strings"
-
-	"github.com/anchore/imgbom/imgbom/pkg"
-	"github.com/mitchellh/mapstructure"
-)
-
-var endOfPackages = fmt.Errorf("no more packages to read")
-
-func ParseEntries(reader io.Reader) ([]pkg.DpkgMetadata, error) {
-	buffedReader := bufio.NewReader(reader)
-	var entries = make([]pkg.DpkgMetadata, 0)
-
-	for {
-		entry, err := parseEntry(buffedReader)
-		if err != nil {
-			if err == endOfPackages {
-				break
-			}
-			return nil, err
-		}
-		entries = append(entries, entry)
-	}
-
-	return entries, nil
-}
-
-func parseEntry(reader *bufio.Reader) (entry pkg.DpkgMetadata, err error) {
-	dpkgFields := make(map[string]string)
-	var key string
-
-	for {
-		line, err := reader.ReadString('\n')
-		if err != nil {
-			if err == io.EOF {
-				return pkg.DpkgMetadata{}, endOfPackages
-			}
-			return pkg.DpkgMetadata{}, err
-		}
-
-		line = strings.TrimRight(line, "\n")
-
-		// empty line indicates end of entry
-		if len(line) == 0 {
-			// if the entry has not started, keep parsing lines
-			if len(dpkgFields) == 0 {
-				continue
-			}
-			break
-		}
-
-		switch {
-		case strings.HasPrefix(line, " "):
-			// a field-body continuation
-			if len(key) == 0 {
-				return pkg.DpkgMetadata{}, fmt.Errorf("no match for continuation: line: '%s'", line)
-			}
-
-			val, ok := dpkgFields[key]
-			if !ok {
-				return pkg.DpkgMetadata{}, fmt.Errorf("no previous key exists, expecting: %s", key)
-			}
-			// concatenate onto previous value
-			val = fmt.Sprintf("%s\n %s", val, strings.TrimSpace(line))
-			dpkgFields[key] = val
-		default:
-			// parse a new key
-			if i := strings.Index(line, ":"); i > 0 {
-				key = strings.TrimSpace(line[0:i])
-				val := strings.TrimSpace(line[i+1:])
-
-				if _, ok := dpkgFields[key]; ok {
-					return pkg.DpkgMetadata{}, fmt.Errorf("duplicate key discovered: %s", key)
-				}
-
-				dpkgFields[key] = val
-			} else {
-				return pkg.DpkgMetadata{}, fmt.Errorf("cannot parse field from line: '%s'", line)
-			}
-		}
-	}
-
-	err = mapstructure.Decode(dpkgFields, &entry)
-	if err != nil {
-		return pkg.DpkgMetadata{}, err
-	}
-
-	return entry, nil
-}

imgbom/analyzer/dpkg/parser_test.go

@@ -1,145 +0,0 @@
-package dpkg
-
-import (
-	"bufio"
-	"os"
-	"testing"
-
-	"github.com/anchore/imgbom/imgbom/pkg"
-	"github.com/go-test/deep"
-)
-
-func compareEntries(t *testing.T, left, right pkg.DpkgMetadata) {
-	t.Helper()
-	if diff := deep.Equal(left, right); diff != nil {
-		t.Error(diff)
-	}
-}
-
-func TestSinglePackage(t *testing.T) {
-	tests := []struct {
-		name     string
-		expected pkg.DpkgMetadata
-	}{
-		{
-			name: "Test Single Package",
-			expected: pkg.DpkgMetadata{
-				Package:        "apt",
-				Status:         "install ok installed",
-				Priority:       "required",
-				InstalledSize:  "4064",
-				Maintainer:     "APT Development Team <deity@lists.debian.org>",
-				Architecture:   "amd64",
-				Version:        "1.8.2",
-				ReplacesPkgs:   "apt-transport-https (<< 1.5~alpha4~), apt-utils (<< 1.3~exp2~)",
-				ProvidesPkgs:   "apt-transport-https (= 1.8.2)",
-				DependsPkgs:    "adduser, gpgv | gpgv2 | gpgv1, debian-archive-keyring, libapt-pkg5.0 (>= 1.7.0~alpha3~), libc6 (>= 2.15), libgcc1 (>= 1:3.0), libgnutls30 (>= 3.6.6), libseccomp2 (>= 1.0.1), libstdc++6 (>= 5.2)",
-				RecommendsPkgs: "ca-certificates",
-				SuggestsPkgs:   "apt-doc, aptitude | synaptic | wajig, dpkg-dev (>= 1.17.2), gnupg | gnupg2 | gnupg1, powermgmt-base",
-				ConfigFiles: `
- /etc/apt/apt.conf.d/01autoremove 76120d358bc9037bb6358e737b3050b5
- /etc/cron.daily/apt-compat 49e9b2cfa17849700d4db735d04244f3
- /etc/kernel/postinst.d/apt-auto-removal 4ad976a68f045517cf4696cec7b8aa3a
- /etc/logrotate.d/apt 179f2ed4f85cbaca12fa3d69c2a4a1c3`,
-			},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			file, err := os.Open("test-fixtures/single")
-			if err != nil {
-				t.Fatal("Unable to read test_fixtures/single: ", err)
-			}
-			defer func() {
-				err := file.Close()
-				if err != nil {
-					t.Fatal("closing file failed:", err)
-				}
-			}()
-
-			reader := bufio.NewReader(file)
-
-			entry, err := parseEntry(reader)
-			if err != nil {
-				t.Fatal("Unable to read file contents: ", err)
-			}
-
-			compareEntries(t, entry, test.expected)
-
-		})
-	}
-}
-
-func TestMultiplePackages(t *testing.T) {
-	tests := []struct {
-		name     string
-		expected []pkg.DpkgMetadata
-	}{
-		{
-			name: "Test Multiple Package",
-			expected: []pkg.DpkgMetadata{
-				{
-					Package:       "tzdata",
-					Status:        "install ok installed",
-					Priority:      "required",
-					InstalledSize: "3036",
-					Maintainer:    "GNU Libc Maintainers <debian-glibc@lists.debian.org>",
-					Architecture:  "all",
-					Version:       "2020a-0+deb10u1",
-					ReplacesPkgs:  "libc0.1, libc0.3, libc6, libc6.1",
-					ProvidesPkgs:  "tzdata-buster",
-					DependsPkgs:   "debconf (>= 0.5) | debconf-2.0",
-				},
-				{
-					Package:       "util-linux",
-					Status:        "install ok installed",
-					Priority:      "required",
-					InstalledSize: "4327",
-					Maintainer:    "LaMont Jones <lamont@debian.org>",
-					Architecture:  "amd64",
-					Version:       "2.33.1-0.1",
-					ReplacesPkgs:  "bash-completion (<< 1:2.8), initscripts (<< 2.88dsf-59.2~), login (<< 1:4.5-1.1~), mount (<< 2.29.2-3~), s390-tools (<< 2.2.0-1~), setpriv (<< 2.32.1-0.2~), sysvinit-utils (<< 2.88dsf-59.1~)",
-					DependsPkgs:   "fdisk, login (>= 1:4.5-1.1~)",
-					SuggestsPkgs:  "dosfstools, kbd | console-tools, util-linux-locales",
-					ConfigFiles: `
- /etc/default/hwclock 3916544450533eca69131f894db0ca12
- /etc/init.d/hwclock.sh 1ca5c0743fa797ffa364db95bb8d8d8e
- /etc/pam.d/runuser b8b44b045259525e0fae9e38fdb2aeeb
- /etc/pam.d/runuser-l 2106ea05877e8913f34b2c77fa02be45
- /etc/pam.d/su ce6dcfda3b190a27a455bb38a45ff34a
- /etc/pam.d/su-l 756fef5687fecc0d986e5951427b0c4f`,
-				},
-			},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			file, err := os.Open("test-fixtures/multiple")
-			if err != nil {
-				t.Fatal("Unable to read: ", err)
-			}
-			defer func() {
-				err := file.Close()
-				if err != nil {
-					t.Fatal("closing file failed:", err)
-				}
-			}()
-
-			entries, err := ParseEntries(file)
-			if err != nil {
-				t.Fatal("Unable to read file contents: ", err)
-			}
-
-			if len(entries) != 2 {
-				t.Fatalf("unexpected number of entries: %d", len(entries))
-			}
-
-			for idx, entry := range entries {
-				compareEntries(t, entry, test.expected[idx])
-			}
-
-		})
-	}
-}

imgbom/catalog_image.go

@@ -1,20 +0,0 @@
-package imgbom
-
-import (
-	"github.com/anchore/imgbom/imgbom/analyzer"
-	"github.com/anchore/imgbom/imgbom/pkg"
-	"github.com/anchore/imgbom/imgbom/scope"
-	"github.com/anchore/stereoscope/pkg/image"
-)
-
-// TODO: add os detection results as return value
-func CatalogImage(img *image.Image, o scope.Option) (pkg.Catalog, error) {
-	s, err := scope.NewScope(img, o)
-	if err != nil {
-		return pkg.Catalog{}, err
-	}
-
-	// TODO: add OS detection here...
-
-	return analyzer.Analyze(s)
-}

imgbom/constants.go

@@ -1,4 +0,0 @@
-package imgbom
-
-// note: must be a single word, all lowercase
-const LibraryName = "imgbom"

imgbom/log.go

@@ -1,10 +0,0 @@
-package imgbom
-
-import (
-	"github.com/anchore/imgbom/imgbom/logger"
-	"github.com/anchore/imgbom/internal/log"
-)
-
-func SetLogger(logger logger.Logger) {
-	log.Log = logger
-}

imgbom/logger/logger.go

@@ -1,9 +0,0 @@
-package logger
-
-type Logger interface {
-	Errorf(format string, args ...interface{})
-	Infof(format string, args ...interface{})
-	Info(args ...interface{})
-	Debugf(format string, args ...interface{})
-	Debug(args ...interface{})
-}

imgbom/pkg/catalog.go

@@ -1,144 +0,0 @@
-package pkg
-
-import (
-	"fmt"
-	"sync"
-
-	"github.com/anchore/imgbom/internal/log"
-	"github.com/anchore/stereoscope/pkg/file"
-	"github.com/blevesearch/bleve"
-	"github.com/blevesearch/bleve/mapping"
-)
-
-// TODO: add reader methods (by type, id, fuzzy search, etc)
-
-var nextPackageID int64
-
-type Catalog struct {
-	byID                map[ID]*Package
-	byType              map[Type][]*Package
-	byFile              map[file.Reference][]*Package
-	searchSpace         mapping.IndexMapping
-	nameSearchIndex     bleve.Index
-	metadataSearchIndex bleve.Index
-	lock                sync.RWMutex
-}
-
-func NewCatalog() Catalog {
-	searchMap := bleve.NewIndexMapping()
-	nameIndex, err := bleve.NewMemOnly(searchMap)
-	if err != nil {
-		// TODO: log
-		panic(err)
-	}
-	metadataIndex, err := bleve.NewMemOnly(searchMap)
-	if err != nil {
-		// TODO: log
-		panic(err)
-	}
-	return Catalog{
-		byID:                make(map[ID]*Package),
-		byType:              make(map[Type][]*Package),
-		byFile:              make(map[file.Reference][]*Package),
-		searchSpace:         searchMap,
-		nameSearchIndex:     nameIndex,
-		metadataSearchIndex: metadataIndex,
-	}
-}
-
-func (c *Catalog) Package(id ID) *Package {
-	return c.byID[id]
-}
-
-func (c *Catalog) PackagesByFile(ref file.Reference) []*Package {
-	return c.byFile[ref]
-}
-
-func (c *Catalog) Add(p Package) {
-	if p.id != 0 {
-		log.Errorf("package already added to catalog: %s", p)
-		return
-	}
-	c.lock.Lock()
-	defer c.lock.Unlock()
-
-	p.id = ID(nextPackageID)
-	nextPackageID++
-
-	// store by package ID
-	c.byID[p.id] = &p
-
-	// store by package type
-	_, ok := c.byType[p.Type]
-	if !ok {
-		c.byType[p.Type] = make([]*Package, 0)
-	}
-	c.byType[p.Type] = append(c.byType[p.Type], &p)
-
-	// store by file references
-	for _, s := range p.Source {
-		_, ok := c.byFile[s]
-		if !ok {
-			c.byFile[s] = make([]*Package, 0)
-		}
-		c.byFile[s] = append(c.byFile[s], &p)
-	}
-
-	// index the package findings
-	err := c.nameSearchIndex.Index(fmt.Sprintf("%d", p.id), p.Name)
-	if err != nil {
-		// TODO: just no...
-		panic(err)
-	}
-	err = c.metadataSearchIndex.Index(fmt.Sprintf("%d", p.id), p.Metadata)
-	if err != nil {
-		// TODO: just no...
-		panic(err)
-	}
-}
-
-func (c *Catalog) SearchMetadata(query string) *bleve.SearchResult {
-	request := bleve.NewSearchRequest(bleve.NewMatchQuery(query))
-	result, err := c.metadataSearchIndex.Search(request)
-	if err != nil {
-		// TODO: just no...
-		panic(err)
-	}
-	return result
-}
-
-func (c *Catalog) SearchName(query string) *bleve.SearchResult {
-	request := bleve.NewSearchRequest(bleve.NewMatchQuery(query))
-	result, err := c.nameSearchIndex.Search(request)
-	if err != nil {
-		// TODO: just no...
-		panic(err)
-	}
-	return result
-}
-
-func (c *Catalog) Enumerate(types ...Type) <-chan *Package {
-	channel := make(chan *Package)
-	go func() {
-		defer close(channel)
-		for ty, packages := range c.byType {
-			if len(types) != 0 {
-				found := false
-			typeCheck:
-				for _, t := range types {
-					if t == ty {
-						found = true
-						break typeCheck
-					}
-				}
-				if !found {
-					continue
-				}
-			}
-			for _, p := range packages {
-				channel <- p
-			}
-		}
-	}()
-	return channel
-}

imgbom/pkg/metadata.go

@@ -1,21 +0,0 @@
-package pkg
-
-// TODO: consider keeping the remaining values as an embedded map
-// Available fields are described at http://manpages.ubuntu.com/manpages/xenial/man1/dpkg-query.1.html
-// in the --showformat section
-type DpkgMetadata struct {
-	Package        string `mapstructure:"Package"`
-	Architecture   string `mapstructure:"Architecture"`
-	DependsPkgs    string `mapstructure:"Depends"`
-	InstalledSize  string `mapstructure:"Installed-Size"`
-	Maintainer     string `mapstructure:"Maintainer"`
-	Priority       string `mapstructure:"Priority"`
-	ProvidesPkgs   string `mapstructure:"Provides"`
-	RecommendsPkgs string `mapstructure:"Recommends"`
-	ReplacesPkgs   string `mapstructure:"Replaces"`
-	Status         string `mapstructure:"Status"`
-	SuggestsPkgs   string `mapstructure:"Suggests"`
-	Version        string `mapstructure:"Version"`
-	ConfigFiles    string `mapstructure:"Conffiles"`
-	Description    string `mapstructure:"Description"`
-}

imgbom/pkg/package.go

@@ -1,28 +0,0 @@
-package pkg
-
-import (
-	"fmt"
-
-	"github.com/anchore/stereoscope/pkg/file"
-)
-
-type ID int64
-
-// TODO: add field to trace which analyzer detected this
-type Package struct {
-	id       ID
-	Name     string
-	Version  string
-	Source   []file.Reference
-	Licenses []string
-	Type     Type
-	Metadata interface{}
-}
-
-func (p Package) ID() ID {
-	return p.id
-}
-
-func (p Package) String() string {
-	return fmt.Sprintf("Pkg(type=%s, name=%s, version=%s)", p.Type, p.Name, p.Version)
-}

imgbom/pkg/type.go

@@ -1,34 +0,0 @@
-package pkg
-
-const (
-	UnknownPkg Type = iota
-	ApkPkg
-	DebPkg
-	JavaPkg
-	JavaScriptPkg
-	PacmanPkg
-	PythonPkg
-	RpmPkg
-	RubyPkg
-)
-
-type Type uint
-
-var typeStr = []string{
-	"UnknownPackage",
-	"apk",
-	"deb",
-	"java",
-	"node",
-	"pacman",
-	"python",
-	"rpm",
-	"ruby",
-}
-
-func (t Type) String() string {
-	if int(t) >= len(typeStr) {
-		return typeStr[0]
-	}
-	return typeStr[t]
-}

imgbom/presenter/json/presenter.go

@@ -1,114 +0,0 @@
-package json
-
-import (
-	"encoding/json"
-	"io"
-
-	"github.com/anchore/imgbom/imgbom/pkg"
-	"github.com/anchore/imgbom/internal/log"
-	stereoscopeImg "github.com/anchore/stereoscope/pkg/image"
-)
-
-type Presenter struct{}
-
-func NewPresenter() *Presenter {
-	return &Presenter{}
-}
-
-type document struct {
-	Image     image      `json:"image"`
-	Artifacts []artifact `json:"artifacts"`
-}
-
-type image struct {
-	Layers    []layer  `json:"layers"`
-	Size      int64    `json:"size"`
-	Digest    string   `json:"digest"`
-	MediaType string   `json:"mediaType"`
-	Tags      []string `json:"tags"`
-}
-
-type layer struct {
-	MediaType string `json:"mediaType"`
-	Digest    string `json:"digest"`
-	Size      int64  `json:"size"`
-}
-
-type source struct {
-	Source  string   `json:"source"`
-	Layer   int      `json:"layer"`
-	Effects []string `json:"effects"`
-}
-
-type artifact struct {
-	Name     string      `json:"name"`
-	Version  string      `json:"version"`
-	Type     string      `json:"type"`
-	Analyzer string      `json:"analyzer"`
-	Sources  []source    `json:"sources"`
-	Metadata interface{} `json:"metadata"`
-}
-
-func (pres *Presenter) Present(output io.Writer, img *stereoscopeImg.Image, catalog pkg.Catalog) error {
-	tags := make([]string, len(img.Metadata.Tags))
-	for idx, tag := range img.Metadata.Tags {
-		tags[idx] = tag.String()
-	}
-
-	doc := document{
-		Image: image{
-			Digest:    img.Metadata.Digest,
-			Size:      img.Metadata.Size,
-			MediaType: string(img.Metadata.MediaType),
-			Tags:      tags,
-			Layers:    make([]layer, len(img.Layers)),
-		},
-		Artifacts: make([]artifact, 0),
-	}
-
-	// populate image...
-	for idx, l := range img.Layers {
-		doc.Image.Layers[idx] = layer{
-			MediaType: string(l.Metadata.MediaType),
-			Digest:    l.Metadata.Digest,
-			Size:      l.Metadata.Size,
-		}
-	}
-
-	// populate artifacts...
-	for p := range catalog.Enumerate() {
-		art := artifact{
-			Name:     p.Name,
-			Version:  p.Version,
-			Type:     p.Type.String(),
-			Analyzer: "TODO", // TODO
-			Sources:  make([]source, len(p.Source)),
-			Metadata: p.Metadata,
-		}
-
-		for idx, src := range p.Source {
-			fileMetadata, err := img.FileCatalog.Get(src)
-			if err != nil {
-				// TODO: test case
-				log.Errorf("could not get metadata from catalog (presenter=json): %+v", src)
-			}
-
-			srcObj := source{
-				Source:  "",
-				Layer:   int(fileMetadata.Source.Metadata.Index),
-				Effects: []string{}, // TODO
-			}
-			art.Sources[idx] = srcObj
-		}
-
-		doc.Artifacts = append(doc.Artifacts, art)
-	}
-
-	bytes, err := json.Marshal(&doc)
-	if err != nil {
-		log.Errorf("failed to marshal json (presenter=json): %w", err)
-	}
-
-	_, err = output.Write(bytes)
-	return err
-}

imgbom/presenter/json/presenter_test.go

@@ -1,90 +0,0 @@
-package json
-
-import (
-	"bytes"
-	"flag"
-	"testing"
-
-	"github.com/anchore/go-testutils"
-	"github.com/anchore/imgbom/imgbom/pkg"
-	"github.com/anchore/stereoscope/pkg/file"
-	"github.com/sergi/go-diff/diffmatchpatch"
-)
-
-var update = flag.Bool("update", false, "update the *.golden files for json presenters")
-
-// TODO: add a JSON schema and write a test that validates output against the schema
-// func validateAgainstV1Schema(t *testing.T, json string) {
-// 	fullSchemaPath, err := filepath.Abs("v1-schema.json")
-// 	if err != nil {
-// 		t.Fatal("could not get path to schema:", err)
-// 	}
-// 	schemaLoader := gojsonschema.NewReferenceLoader(fmt.Sprintf("file://%s", fullSchemaPath))
-// 	documentLoader := gojsonschema.NewStringLoader(json)
-
-// 	result, err := gojsonschema.Validate(schemaLoader, documentLoader)
-// 	if err != nil {
-// 		t.Fatal("unable to validate json schema:", err.Error())
-// 	}
-
-// 	if !result.Valid() {
-// 		t.Errorf("failed json schema validation:")
-// 		for _, desc := range result.Errors() {
-// 			t.Errorf("  - %s\n", desc)
-// 		}
-// 	}
-// }
-
-func TestJsonPresenter(t *testing.T) {
-	pres := NewPresenter()
-	var buffer bytes.Buffer
-
-	testImage := "image-simple"
-
-	if *update {
-		testutils.UpdateGoldenFixtureImage(t, testImage)
-	}
-
-	catalog := pkg.NewCatalog()
-	img := testutils.GetGoldenFixtureImage(t, testImage)
-
-	// populate catalog with test data
-	catalog.Add(pkg.Package{
-		Name:    "package-1",
-		Version: "1.0.1",
-		Source: []file.Reference{
-			*img.SquashedTree.File("/somefile-1.txt"),
-		},
-		Type: pkg.DebPkg,
-	})
-	catalog.Add(pkg.Package{
-		Name:    "package-2",
-		Version: "2.0.1",
-		Source: []file.Reference{
-			*img.SquashedTree.File("/somefile-2.txt"),
-		},
-		Type: pkg.DebPkg,
-	})
-
-	// run presenter
-	err := pres.Present(&buffer, img, catalog)
-	if err != nil {
-		t.Fatal(err)
-	}
-	actual := buffer.Bytes()
-
-	if *update {
-		testutils.UpdateGoldenFileContents(t, actual)
-	}
-
-	var expected = testutils.GetGoldenFileContents(t)
-
-	if !bytes.Equal(expected, actual) {
-		dmp := diffmatchpatch.New()
-		diffs := dmp.DiffMain(string(actual), string(expected), true)
-		t.Errorf("mismatched output:\n%s", dmp.DiffPrettyText(diffs))
-	}
-
-	// TODO: add me back in when there is a JSON schema
-	// validateAgainstV1Schema(t, string(actual))
-}

imgbom/presenter/json/test-fixtures/snapshot/TestJsonPresenter.golden

@@ -1 +0,0 @@
-{"image":{"layers":[{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:056c0789fa9ad629ceae6d09713fb035f84115af3c4a88a43aa60f13bc683053","size":22},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:b461c48116592c570a66fed71d5b09662a8172e168b7938cf317af47872cdc9b","size":16},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:00b80053e05c01da485015610d288ce3185fac00d251e2ada02b45a7a7c5f589","size":27}],"size":65,"digest":"sha256:3c53d2d891940f8d8e95acb77b58752f54dc5de9d91d19dd90ced2db76256cea","mediaType":"application/vnd.docker.distribution.manifest.v2+json","tags":["anchore-fixture-image-simple:04e16e44161c8888a1a963720fd0443cbf7eef8101434c431de8725cd98cc9f7"]},"artifacts":[{"name":"package-1","version":"1.0.1","type":"deb","analyzer":"TODO","sources":[{"source":"","layer":0,"effects":[]}],"metadata":null},{"name":"package-2","version":"2.0.1","type":"deb","analyzer":"TODO","sources":[{"source":"","layer":1,"effects":[]}],"metadata":null}]}

imgbom/presenter/option.go

@@ -1,36 +0,0 @@
-package presenter
-
-import "strings"
-
-const (
-	UnknownPresenter Option = iota
-	JSONPresenter
-)
-
-var optionStr = []string{
-	"UnknownPresenter",
-	"json",
-}
-
-var Options = []Option{
-	JSONPresenter,
-}
-
-type Option uint
-
-func ParseOption(userStr string) Option {
-	switch strings.ToLower(userStr) {
-	case strings.ToLower(JSONPresenter.String()):
-		return JSONPresenter
-	default:
-		return UnknownPresenter
-	}
-}
-
-func (o Option) String() string {
-	if int(o) >= len(optionStr) {
-		return optionStr[0]
-	}
-
-	return optionStr[o]
-}

imgbom/presenter/presenter.go

@@ -1,22 +0,0 @@
-package presenter
-
-import (
-	"io"
-
-	"github.com/anchore/imgbom/imgbom/pkg"
-	"github.com/anchore/imgbom/imgbom/presenter/json"
-	"github.com/anchore/stereoscope/pkg/image"
-)
-
-type Presenter interface {
-	Present(io.Writer, *image.Image, pkg.Catalog) error
-}
-
-func GetPresenter(option Option) Presenter {
-	switch option {
-	case JSONPresenter:
-		return json.NewPresenter()
-	default:
-		return nil
-	}
-}

imgbom/scope/option.go

@@ -1,40 +0,0 @@
-package scope
-
-import "strings"
-
-const (
-	UnknownScope Option = iota
-	SquashedScope
-	AllLayersScope
-)
-
-type Option uint
-
-var optionStr = []string{
-	"UnknownScope",
-	"Squashed",
-	"AllLayers",
-}
-
-var Options = []Option{
-	SquashedScope,
-	AllLayersScope,
-}
-
-func ParseOption(userStr string) Option {
-	switch strings.ToLower(userStr) {
-	case strings.ToLower(SquashedScope.String()):
-		return SquashedScope
-	case strings.ToLower(AllLayersScope.String()):
-		return AllLayersScope
-	}
-	return UnknownScope
-}
-
-func (o Option) String() string {
-	if int(o) >= len(optionStr) {
-		return optionStr[0]
-	}
-
-	return optionStr[o]
-}

imgbom/scope/option_test.go

@@ -1,17 +0,0 @@
-package scope
-
-import (
-	"fmt"
-	"testing"
-)
-
-func TestOptionStringerBoundary(t *testing.T) {
-	var _ fmt.Stringer = Option(0)
-
-	for _, c := range []int{-1, 0, 3} {
-		option := Option(c)
-		if option.String() != UnknownScope.String() {
-			t.Errorf("expected Option(%d) to be unknown, found '%+v'", c, option)
-		}
-	}
-}

imgbom/scope/scope.go

@@ -1,46 +0,0 @@
-package scope
-
-import (
-	"fmt"
-
-	"github.com/anchore/stereoscope/pkg/image"
-	"github.com/anchore/stereoscope/pkg/tree"
-)
-
-type Scope struct {
-	Option Option
-	Trees  []*tree.FileTree
-	Image  *image.Image
-}
-
-func NewScope(img *image.Image, option Option) (Scope, error) {
-	var trees = make([]*tree.FileTree, 0)
-
-	if img == nil {
-		return Scope{}, fmt.Errorf("no image given")
-	}
-
-	switch option {
-	case SquashedScope:
-		if img.SquashedTree == nil {
-			return Scope{}, fmt.Errorf("the image does not have have a squashed tree")
-		}
-		trees = append(trees, img.SquashedTree)
-
-	case AllLayersScope:
-		if len(img.Layers) == 0 {
-			return Scope{}, fmt.Errorf("the image does not contain any layers")
-		}
-		for _, layer := range img.Layers {
-			trees = append(trees, layer.Tree)
-		}
-	default:
-		return Scope{}, fmt.Errorf("bad option provided: %+v", option)
-	}
-
-	return Scope{
-		Option: option,
-		Trees:  trees,
-		Image:  img,
-	}, nil
-}

imgbom/scope/scope_test.go

@@ -1,91 +0,0 @@
-package scope
-
-import (
-	"testing"
-
-	"github.com/anchore/stereoscope/pkg/image"
-	"github.com/anchore/stereoscope/pkg/tree"
-)
-
-func testScopeImage(t *testing.T) *image.Image {
-	t.Helper()
-
-	one := image.NewLayer(nil)
-	one.Tree = tree.NewFileTree()
-	one.Tree.AddPath("/tree/first/path.txt")
-
-	two := image.NewLayer(nil)
-	two.Tree = tree.NewFileTree()
-	two.Tree.AddPath("/tree/second/path.txt")
-
-	i := image.NewImage(nil)
-	i.Layers = []image.Layer{one, two}
-	err := i.Squash()
-	if err != nil {
-		t.Fatal("could not squash test image trees")
-	}
-
-	return i
-}
-
-func TestScope(t *testing.T) {
-	refImg := testScopeImage(t)
-
-	cases := []struct {
-		name          string
-		img           *image.Image
-		option        Option
-		expectedTrees []*tree.FileTree
-		err           bool
-	}{
-		{
-			name:          "AllLayersGoCase",
-			option:        AllLayersScope,
-			img:           testScopeImage(t),
-			expectedTrees: []*tree.FileTree{refImg.Layers[0].Tree, refImg.Layers[1].Tree},
-		},
-		{
-			name:          "SquashedGoCase",
-			option:        SquashedScope,
-			img:           testScopeImage(t),
-			expectedTrees: []*tree.FileTree{refImg.SquashedTree},
-		},
-		{
-			name:   "MissingImage",
-			option: SquashedScope,
-			err:    true,
-		},
-		{
-			name:   "MissingSquashedTree",
-			option: SquashedScope,
-			img:    image.NewImage(nil),
-			err:    true,
-		},
-		{
-			name:   "NoLayers",
-			option: AllLayersScope,
-			img:    image.NewImage(nil),
-			err:    true,
-		},
-	}
-
-	for _, c := range cases {
-		actual, err := NewScope(c.img, c.option)
-		if err == nil && c.err {
-			t.Fatal("expected an error but did not find one")
-		} else if err != nil && !c.err {
-			t.Fatal("expected no error but found one:", err)
-		}
-
-		if len(actual.Trees) != len(c.expectedTrees) {
-			t.Fatalf("mismatched tree lengths: %d!=%d", len(actual.Trees), len(c.expectedTrees))
-		}
-
-		for idx, at := range actual.Trees {
-			if !at.Equal(c.expectedTrees[idx]) {
-				t.Error("mismatched tree @ idx", idx)
-			}
-		}
-	}
-
-}

install.sh

@@ -0,0 +1,389 @@
+#!/bin/sh
+set -e
+# Code generated by godownloader on 2020-08-10T20:55:46Z.
+#
+
+usage() {
+  this=$1
+  cat <<EOF
+$this: download go binaries for anchore/syft
+
+Usage: $this [-b] bindir [-d] [tag]
+  -b sets bindir or installation directory, Defaults to ./bin
+  -d turns on debug logging
+   [tag] is a tag from
+   https://github.com/anchore/syft/releases
+   If tag is missing, then the latest will be used.
+
+ Generated by godownloader
+  https://github.com/goreleaser/godownloader
+
+EOF
+  exit 2
+}
+
+parse_args() {
+  #BINDIR is ./bin unless set be ENV
+  # over-ridden by flag below
+
+  BINDIR=${BINDIR:-./bin}
+  while getopts "b:dh?x" arg; do
+    case "$arg" in
+      b) BINDIR="$OPTARG" ;;
+      d) log_set_priority 10 ;;
+      h | \?) usage "$0" ;;
+      x) set -x ;;
+    esac
+  done
+  shift $((OPTIND - 1))
+  TAG=$1
+}
+# this function wraps all the destructive operations
+# if a curl|bash cuts off the end of the script due to
+# network, either nothing will happen or will syntax error
+# out preventing half-done work
+execute() {
+  tmpdir=$(mktemp -d)
+  log_debug "downloading files into ${tmpdir}"
+  http_download "${tmpdir}/${ARCHIVE}" "${ARCHIVE_URL}"
+  http_download "${tmpdir}/${CHECKSUM}" "${CHECKSUM_URL}"
+
+  # macOS has its own secure verification mechanism, and checksums.txt is not used.
+  if [ "$OS" != "darwin" ]; then
+    hash_sha256_verify "${tmpdir}/${ARCHIVE}" "${tmpdir}/${CHECKSUM}"
+  fi
+
+  srcdir="${tmpdir}"
+  (cd "${tmpdir}" && unpack "${ARCHIVE}")
+  test ! -d "${BINDIR}" && install -d "${BINDIR}"
+  for binexe in $BINARIES; do
+    if [ "$OS" = "windows" ]; then
+      binexe="${binexe}.exe"
+    fi
+    install "${srcdir}/${binexe}" "${BINDIR}/"
+    log_info "installed ${BINDIR}/${binexe}"
+  done
+  rm -rf "${tmpdir}"
+}
+get_binaries() {
+  case "$PLATFORM" in
+    darwin/amd64) BINARIES="syft" ;;
+    linux/amd64) BINARIES="syft" ;;
+    windows/amd64) BINARIES="syft" ;;
+    *)
+      log_crit "platform $PLATFORM is not supported.  Make sure this script is up-to-date and file request at https://github.com/${PREFIX}/issues/new"
+      exit 1
+      ;;
+  esac
+}
+tag_to_version() {
+  if [ -z "${TAG}" ]; then
+    log_info "checking GitHub for latest tag"
+  else
+    log_info "checking GitHub for tag '${TAG}'"
+  fi
+  REALTAG=$(github_release "$OWNER/$REPO" "${TAG}") && true
+  if test -z "$REALTAG"; then
+    log_crit "unable to find '${TAG}' - use 'latest' or see https://github.com/${PREFIX}/releases for details"
+    exit 1
+  fi
+  # if version starts with 'v', remove it
+  TAG="$REALTAG"
+  VERSION=${TAG#v}
+}
+adjust_format() {
+  # change format (tar.gz or zip) based on OS
+  case ${OS} in
+    darwin) FORMAT=dmg ;;
+    windows) FORMAT=zip ;;
+  esac
+  true
+}
+adjust_os() {
+  # adjust archive name based on OS
+  true
+}
+adjust_arch() {
+  # adjust archive name based on ARCH
+  true
+}
+
+cat /dev/null <<EOF
+------------------------------------------------------------------------
+https://github.com/client9/shlib - portable posix shell functions
+Public domain - http://unlicense.org
+https://github.com/client9/shlib/blob/master/LICENSE.md
+but credit (and pull requests) appreciated.
+------------------------------------------------------------------------
+EOF
+is_command() {
+  command -v "$1" >/dev/null
+}
+echoerr() {
+  echo "$@" 1>&2
+}
+log_prefix() {
+  echo "$0"
+}
+_logp=6
+log_set_priority() {
+  _logp="$1"
+}
+log_priority() {
+  if test -z "$1"; then
+    echo "$_logp"
+    return
+  fi
+  [ "$1" -le "$_logp" ]
+}
+log_tag() {
+  case $1 in
+    0) echo "emerg" ;;
+    1) echo "alert" ;;
+    2) echo "crit" ;;
+    3) echo "err" ;;
+    4) echo "warning" ;;
+    5) echo "notice" ;;
+    6) echo "info" ;;
+    7) echo "debug" ;;
+    *) echo "$1" ;;
+  esac
+}
+log_debug() {
+  log_priority 7 || return 0
+  echoerr "$(log_prefix)" "$(log_tag 7)" "$@"
+}
+log_info() {
+  log_priority 6 || return 0
+  echoerr "$(log_prefix)" "$(log_tag 6)" "$@"
+}
+log_err() {
+  log_priority 3 || return 0
+  echoerr "$(log_prefix)" "$(log_tag 3)" "$@"
+}
+log_crit() {
+  log_priority 2 || return 0
+  echoerr "$(log_prefix)" "$(log_tag 2)" "$@"
+}
+uname_os() {
+  os=$(uname -s | tr '[:upper:]' '[:lower:]')
+  case "$os" in
+    cygwin_nt*) os="windows" ;;
+    mingw*) os="windows" ;;
+    msys_nt*) os="windows" ;;
+  esac
+  echo "$os"
+}
+uname_arch() {
+  arch=$(uname -m)
+  case $arch in
+    x86_64) arch="amd64" ;;
+    x86) arch="386" ;;
+    i686) arch="386" ;;
+    i386) arch="386" ;;
+    aarch64) arch="arm64" ;;
+    armv5*) arch="armv5" ;;
+    armv6*) arch="armv6" ;;
+    armv7*) arch="armv7" ;;
+  esac
+  echo ${arch}
+}
+uname_os_check() {
+  os=$(uname_os)
+  case "$os" in
+    darwin) return 0 ;;
+    dragonfly) return 0 ;;
+    freebsd) return 0 ;;
+    linux) return 0 ;;
+    android) return 0 ;;
+    nacl) return 0 ;;
+    netbsd) return 0 ;;
+    openbsd) return 0 ;;
+    plan9) return 0 ;;
+    solaris) return 0 ;;
+    windows) return 0 ;;
+  esac
+  log_crit "uname_os_check '$(uname -s)' got converted to '$os' which is not a GOOS value. Please file bug at https://github.com/client9/shlib"
+  return 1
+}
+uname_arch_check() {
+  arch=$(uname_arch)
+  case "$arch" in
+    386) return 0 ;;
+    amd64) return 0 ;;
+    arm64) return 0 ;;
+    armv5) return 0 ;;
+    armv6) return 0 ;;
+    armv7) return 0 ;;
+    ppc64) return 0 ;;
+    ppc64le) return 0 ;;
+    mips) return 0 ;;
+    mipsle) return 0 ;;
+    mips64) return 0 ;;
+    mips64le) return 0 ;;
+    s390x) return 0 ;;
+    amd64p32) return 0 ;;
+  esac
+  log_crit "uname_arch_check '$(uname -m)' got converted to '$arch' which is not a GOARCH value.  Please file bug report at https://github.com/client9/shlib"
+  return 1
+}
+unpack() {
+  archive=$1
+  case "${archive}" in
+    *.tar.gz | *.tgz) tar --no-same-owner -xzf "${archive}" ;;
+    *.tar) tar --no-same-owner -xf "${archive}" ;;
+    *.zip) unzip "${archive}" ;;
+    *.dmg) extract_from_dmg "${archive}" ;;
+    *)
+      log_err "unpack unknown archive format for ${archive}"
+      return 1
+      ;;
+  esac
+}
+extract_from_dmg() {
+  dmg_file=$1
+  mount_point="/Volumes/tmp-dmg"
+  hdiutil attach -quiet -nobrowse -mountpoint "${mount_point}" "${dmg_file}"
+  cp -fR "${mount_point}/" ./
+  hdiutil detach -quiet -force "${mount_point}"
+}
+http_download_curl() {
+  local_file=$1
+  source_url=$2
+  header=$3
+  if [ -z "$header" ]; then
+    code=$(curl -w '%{http_code}' -sL -o "$local_file" "$source_url")
+  else
+    code=$(curl -w '%{http_code}' -sL -H "$header" -o "$local_file" "$source_url")
+  fi
+  if [ "$code" != "200" ]; then
+    log_debug "http_download_curl received HTTP status $code"
+    return 1
+  fi
+  return 0
+}
+http_download_wget() {
+  local_file=$1
+  source_url=$2
+  header=$3
+  if [ -z "$header" ]; then
+    wget -q -O "$local_file" "$source_url"
+  else
+    wget -q --header "$header" -O "$local_file" "$source_url"
+  fi
+}
+http_download() {
+  log_debug "http_download $2"
+  if is_command curl; then
+    http_download_curl "$@"
+    return
+  elif is_command wget; then
+    http_download_wget "$@"
+    return
+  fi
+  log_crit "http_download unable to find wget or curl"
+  return 1
+}
+http_copy() {
+  tmp=$(mktemp)
+  http_download "${tmp}" "$1" "$2" || return 1
+  body=$(cat "$tmp")
+  rm -f "${tmp}"
+  echo "$body"
+}
+github_release() {
+  owner_repo=$1
+  version=$2
+  test -z "$version" && version="latest"
+  giturl="https://github.com/${owner_repo}/releases/${version}"
+  json=$(http_copy "$giturl" "Accept:application/json")
+  test -z "$json" && return 1
+  version=$(echo "$json" | tr -s '\n' ' ' | sed 's/.*"tag_name":"//' | sed 's/".*//')
+  test -z "$version" && return 1
+  echo "$version"
+}
+hash_sha256() {
+  TARGET=${1:-/dev/stdin}
+  if is_command gsha256sum; then
+    hash=$(gsha256sum "$TARGET") || return 1
+    echo "$hash" | cut -d ' ' -f 1
+  elif is_command sha256sum; then
+    hash=$(sha256sum "$TARGET") || return 1
+    echo "$hash" | cut -d ' ' -f 1
+  elif is_command shasum; then
+    hash=$(shasum -a 256 "$TARGET" 2>/dev/null) || return 1
+    echo "$hash" | cut -d ' ' -f 1
+  elif is_command openssl; then
+    hash=$(openssl -dst openssl dgst -sha256 "$TARGET") || return 1
+    echo "$hash" | cut -d ' ' -f a
+  else
+    log_crit "hash_sha256 unable to find command to compute sha-256 hash"
+    return 1
+  fi
+}
+hash_sha256_verify() {
+  TARGET=$1
+  checksums=$2
+  if [ -z "$checksums" ]; then
+    log_err "hash_sha256_verify checksum file not specified in arg2"
+    return 1
+  fi
+  BASENAME=${TARGET##*/}
+  want=$(grep "${BASENAME}" "${checksums}" 2>/dev/null | tr '\t' ' ' | cut -d ' ' -f 1)
+  if [ -z "$want" ]; then
+    log_err "hash_sha256_verify unable to find checksum for '${TARGET}' in '${checksums}'"
+    return 1
+  fi
+  got=$(hash_sha256 "$TARGET")
+  if [ "$want" != "$got" ]; then
+    log_err "hash_sha256_verify checksum for '$TARGET' did not verify ${want} vs $got"
+    return 1
+  fi
+}
+cat /dev/null <<EOF
+------------------------------------------------------------------------
+End of functions from https://github.com/client9/shlib
+------------------------------------------------------------------------
+EOF
+
+PROJECT_NAME="syft"
+OWNER=anchore
+REPO="syft"
+BINARY=syft
+FORMAT=tar.gz
+OS=$(uname_os)
+ARCH=$(uname_arch)
+PREFIX="$OWNER/$REPO"
+
+# use in logging routines
+log_prefix() {
+	echo "$PREFIX"
+}
+PLATFORM="${OS}/${ARCH}"
+GITHUB_DOWNLOAD=https://github.com/${OWNER}/${REPO}/releases/download
+
+uname_os_check "$OS"
+uname_arch_check "$ARCH"
+
+parse_args "$@"
+
+get_binaries
+
+tag_to_version
+
+adjust_format
+
+adjust_os
+
+adjust_arch
+
+log_info "found version: ${VERSION} for ${TAG}/${OS}/${ARCH}"
+
+NAME=${PROJECT_NAME}_${VERSION}_${OS}_${ARCH}
+ARCHIVE=${NAME}.${FORMAT}
+ARCHIVE_URL=${GITHUB_DOWNLOAD}/${TAG}/${ARCHIVE}
+CHECKSUM=${PROJECT_NAME}_${VERSION}_checksums.txt
+CHECKSUM_URL=${GITHUB_DOWNLOAD}/${TAG}/${CHECKSUM}
+
+
+execute

internal/anchore/client.go

@@ -0,0 +1,115 @@
+package anchore
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"path"
+	"strings"
+	"unicode"
+
+	"github.com/anchore/client-go/pkg/external"
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/version"
+)
+
+type Configuration struct {
+	BaseURL   string
+	Username  string
+	Password  string
+	UserAgent string
+}
+
+type Client struct {
+	config Configuration
+	client *external.APIClient
+}
+
+func NewClient(cfg Configuration) (*Client, error) {
+	if cfg.UserAgent == "" {
+		versionInfo := version.FromBuild()
+		// format: product / product-version comment
+		cfg.UserAgent = fmt.Sprintf("%s / %s %s", internal.ApplicationName, versionInfo.Version, versionInfo.Platform)
+	}
+
+	baseURL, err := prepareBaseURLForClient(cfg.BaseURL)
+	if err != nil {
+		return nil, fmt.Errorf("unable to create client: %w", err)
+	}
+
+	return &Client{
+		config: cfg,
+		client: external.NewAPIClient(&external.Configuration{
+			BasePath:  baseURL,
+			UserAgent: cfg.UserAgent,
+		}),
+	}, nil
+}
+
+func (c *Client) newRequestContext(parentContext context.Context) context.Context {
+	if parentContext == nil {
+		parentContext = context.Background()
+	}
+	return context.WithValue(
+		parentContext,
+		external.ContextBasicAuth,
+		external.BasicAuth{
+			UserName: c.config.Username,
+			Password: c.config.Password,
+		},
+	)
+}
+
+var ErrInvalidBaseURLInput = errors.New("invalid base URL input")
+
+func prepareBaseURLForClient(baseURL string) (string, error) {
+	if err := checkBaseURLInput(baseURL); err != nil {
+		return "", err
+	}
+
+	scheme, urlWithoutScheme := splitSchemeFromURL(baseURL)
+
+	if scheme == "" {
+		scheme = "http"
+	}
+
+	urlWithoutScheme = path.Clean(urlWithoutScheme)
+
+	const requiredSuffix = "v1"
+	if path.Base(urlWithoutScheme) != requiredSuffix {
+		urlWithoutScheme = path.Join(urlWithoutScheme, requiredSuffix)
+	}
+
+	preparedBaseURL := scheme + "://" + urlWithoutScheme
+	return preparedBaseURL, nil
+}
+
+func checkBaseURLInput(url string) error {
+	if url == "" {
+		return ErrInvalidBaseURLInput
+	}
+
+	firstCharacter := rune(url[0])
+	if !(unicode.IsLetter(firstCharacter)) {
+		return ErrInvalidBaseURLInput
+	}
+
+	return nil
+}
+
+func splitSchemeFromURL(url string) (scheme, urlWithoutScheme string) {
+	if hasScheme(url) {
+		urlParts := strings.SplitN(url, "://", 2)
+		scheme = urlParts[0]
+		urlWithoutScheme = urlParts[1]
+		return
+	}
+
+	return "", url
+}
+
+func hasScheme(url string) bool {
+	parts := strings.Split(url, "://")
+
+	return len(parts) > 1
+}

internal/anchore/client_test.go

@@ -0,0 +1,210 @@
+package anchore
+
+import "testing"
+
+func TestHasScheme(t *testing.T) {
+	cases := []struct {
+		url      string
+		expected bool
+	}{
+		{
+			url:      "http://localhost",
+			expected: true,
+		},
+		{
+			url:      "https://anchore.com:8443",
+			expected: true,
+		},
+		{
+			url:      "google.com",
+			expected: false,
+		},
+		{
+			url:      "",
+			expected: false,
+		},
+	}
+
+	for _, testCase := range cases {
+		t.Run(testCase.url, func(t *testing.T) {
+			result := hasScheme(testCase.url)
+
+			if testCase.expected != result {
+				t.Errorf("expected %t but got %t", testCase.expected, result)
+			}
+		})
+	}
+}
+
+func TestPrepareBaseURLForClient(t *testing.T) {
+	cases := []struct {
+		inputURL    string
+		expectedURL string
+		expectedErr error
+	}{
+		{
+			inputURL:    "",
+			expectedURL: "",
+			expectedErr: ErrInvalidBaseURLInput,
+		},
+		{
+			inputURL:    "localhost",
+			expectedURL: "http://localhost/v1",
+			expectedErr: nil,
+		},
+		{
+			inputURL:    "https://localhost",
+			expectedURL: "https://localhost/v1",
+			expectedErr: nil,
+		},
+		{
+			inputURL:    "https://localhost/",
+			expectedURL: "https://localhost/v1",
+			expectedErr: nil,
+		},
+		{
+			inputURL:    "https://localhost/v1/",
+			expectedURL: "https://localhost/v1",
+			expectedErr: nil,
+		},
+		{
+			inputURL:    "https://localhost/v1//",
+			expectedURL: "https://localhost/v1",
+			expectedErr: nil,
+		},
+		{
+			inputURL:    "http://something.com/platform/v1/services/anchore",
+			expectedURL: "http://something.com/platform/v1/services/anchore/v1",
+			expectedErr: nil,
+		},
+		{
+			inputURL:    "my-host:8228",
+			expectedURL: "http://my-host:8228/v1",
+			expectedErr: nil,
+		},
+		{
+			inputURL:    "v1/v1",
+			expectedURL: "http://v1/v1",
+			expectedErr: nil,
+		},
+		{
+			inputURL:    "/v1",
+			expectedURL: "",
+			expectedErr: ErrInvalidBaseURLInput,
+		},
+		{
+			inputURL:    "/imports/images",
+			expectedURL: "",
+			expectedErr: ErrInvalidBaseURLInput,
+		},
+	}
+
+	for _, testCase := range cases {
+		t.Run(testCase.inputURL, func(t *testing.T) {
+			resultURL, err := prepareBaseURLForClient(testCase.inputURL)
+			if err != testCase.expectedErr {
+				t.Errorf("expected err to be '%v' but got '%v'", testCase.expectedErr, err)
+			}
+
+			if resultURL != testCase.expectedURL {
+				t.Errorf("expected URL to be '%v' but got '%v'", testCase.expectedURL, resultURL)
+			}
+		})
+	}
+}
+
+func TestCheckBaseURLInput(t *testing.T) {
+	cases := []struct {
+		input    string
+		expected error
+	}{
+		{
+			input:    "",
+			expected: ErrInvalidBaseURLInput,
+		},
+		{
+			input:    "x",
+			expected: nil,
+		},
+		{
+			input:    "localhost:8000",
+			expected: nil,
+		},
+		{
+			input:    ":80",
+			expected: ErrInvalidBaseURLInput,
+		},
+		{
+			input:    "/v1",
+			expected: ErrInvalidBaseURLInput,
+		},
+	}
+
+	for _, testCase := range cases {
+		t.Run(testCase.input, func(t *testing.T) {
+			resultErr := checkBaseURLInput(testCase.input)
+
+			if testCase.expected != resultErr {
+				t.Errorf("expected err to be '%v' but got '%v'", testCase.expected, resultErr)
+			}
+		})
+	}
+}
+
+func TestSplitSchemeFromURL(t *testing.T) {
+	cases := []struct {
+		input                    string
+		expectedScheme           string
+		expectedURLWithoutScheme string
+	}{
+		{
+			input:                    "",
+			expectedScheme:           "",
+			expectedURLWithoutScheme: "",
+		},
+		{
+			input:                    "localhost",
+			expectedScheme:           "",
+			expectedURLWithoutScheme: "localhost",
+		},
+		{
+			input:                    "https://anchore.com/path",
+			expectedScheme:           "https",
+			expectedURLWithoutScheme: "anchore.com/path",
+		},
+		{
+			input:                    "tcp://host:1234",
+			expectedScheme:           "tcp",
+			expectedURLWithoutScheme: "host:1234",
+		},
+		{
+			input:                    "/hello",
+			expectedScheme:           "",
+			expectedURLWithoutScheme: "/hello",
+		},
+		{
+			input:                    "://host",
+			expectedScheme:           "",
+			expectedURLWithoutScheme: "host",
+		},
+		{
+			input:                    "http//localhost",
+			expectedScheme:           "",
+			expectedURLWithoutScheme: "http//localhost",
+		},
+	}
+
+	for _, testCase := range cases {
+		t.Run(testCase.input, func(t *testing.T) {
+			resultScheme, resultURLWithoutScheme := splitSchemeFromURL(testCase.input)
+
+			if testCase.expectedScheme != resultScheme {
+				t.Errorf("expected scheme to be '%s' but got '%s'", testCase.expectedScheme, resultScheme)
+			}
+
+			if testCase.expectedURLWithoutScheme != resultURLWithoutScheme {
+				t.Errorf("expected urlWithoutScheme to be '%s' but got '%s'", testCase.expectedURLWithoutScheme, resultURLWithoutScheme)
+			}
+		})
+	}
+}

internal/anchore/import.go

@@ -0,0 +1,143 @@
+package anchore
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/antihax/optional"
+
+	"github.com/anchore/client-go/pkg/external"
+	"github.com/anchore/stereoscope/pkg/image"
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+)
+
+type ImportConfig struct {
+	ImageMetadata           image.Metadata
+	SourceMetadata          source.Metadata
+	Catalog                 *pkg.Catalog
+	Distro                  *distro.Distro
+	Dockerfile              []byte
+	OverwriteExistingUpload bool
+}
+
+func importProgress(source string) (*progress.Stage, *progress.Manual) {
+	stage := &progress.Stage{}
+	prog := &progress.Manual{
+		// this is the number of stages to expect; start + individual endpoints + stop
+		Total: 6,
+	}
+	bus.Publish(partybus.Event{
+		Type:   event.ImportStarted,
+		Source: source,
+		Value: progress.StagedProgressable(&struct {
+			progress.Stager
+			progress.Progressable
+		}{
+			Stager:       progress.Stager(stage),
+			Progressable: prog,
+		}),
+	})
+
+	return stage, prog
+}
+
+// nolint:funlen
+func (c *Client) Import(ctx context.Context, cfg ImportConfig) error {
+	stage, prog := importProgress(c.config.BaseURL)
+
+	ctxWithTimeout, cancel := context.WithTimeout(ctx, time.Second*30)
+	defer cancel()
+
+	authedCtx := c.newRequestContext(ctxWithTimeout)
+
+	stage.Current = "starting session"
+	startOperation, _, err := c.client.ImportsApi.CreateOperation(authedCtx)
+	if err != nil {
+		var detail = "no details given"
+		var openAPIErr external.GenericOpenAPIError
+		if errors.As(err, &openAPIErr) {
+			detail = string(openAPIErr.Body())
+		}
+		return fmt.Errorf("unable to start import session: %w: %s", err, detail)
+	}
+	prog.N++
+	sessionID := startOperation.Uuid
+
+	packageDigest, err := importPackageSBOM(authedCtx, c.client.ImportsApi, sessionID, cfg.SourceMetadata, cfg.Catalog, cfg.Distro, stage)
+	if err != nil {
+		return fmt.Errorf("failed to import Package SBOM: %w", err)
+	}
+	prog.N++
+
+	manifestDigest, err := importManifest(authedCtx, c.client.ImportsApi, sessionID, cfg.ImageMetadata.RawManifest, stage)
+	if err != nil {
+		return fmt.Errorf("failed to import Manifest: %w", err)
+	}
+	prog.N++
+
+	configDigest, err := importConfig(authedCtx, c.client.ImportsApi, sessionID, cfg.ImageMetadata.RawConfig, stage)
+	if err != nil {
+		return fmt.Errorf("failed to import Config: %w", err)
+	}
+	prog.N++
+
+	dockerfileDigest, err := importDockerfile(authedCtx, c.client.ImportsApi, sessionID, cfg.Dockerfile, stage)
+	if err != nil {
+		return fmt.Errorf("failed to import Dockerfile: %w", err)
+	}
+	prog.N++
+
+	stage.Current = "finalizing"
+	imageModel := addImageModel(cfg.ImageMetadata, packageDigest, manifestDigest, dockerfileDigest, configDigest, sessionID)
+	opts := external.AddImageOpts{
+		Force: optional.NewBool(cfg.OverwriteExistingUpload),
+	}
+
+	_, _, err = c.client.ImagesApi.AddImage(authedCtx, imageModel, &opts)
+	if err != nil {
+		var detail = "no details given"
+		var openAPIErr external.GenericOpenAPIError
+		if errors.As(err, &openAPIErr) {
+			detail = string(openAPIErr.Body())
+		}
+		return fmt.Errorf("unable to complete import session=%q: %w: %s", sessionID, err, detail)
+	}
+	prog.N++
+
+	stage.Current = ""
+	prog.SetCompleted()
+
+	return nil
+}
+
+func addImageModel(imageMetadata image.Metadata, packageDigest, manifestDigest, dockerfileDigest, configDigest, sessionID string) external.ImageAnalysisRequest {
+	var tags = make([]string, len(imageMetadata.Tags))
+	for i, t := range imageMetadata.Tags {
+		tags[i] = t.String()
+	}
+
+	return external.ImageAnalysisRequest{
+		Source: external.ImageSource{
+			Import: &external.ImageImportManifest{
+				Contents: external.ImportContentDigests{
+					Packages:    packageDigest,
+					Manifest:    manifestDigest,
+					Dockerfile:  dockerfileDigest,
+					ImageConfig: configDigest,
+				},
+				Tags:          tags,
+				Digest:        imageMetadata.ManifestDigest,
+				LocalImageId:  imageMetadata.ID,
+				OperationUuid: sessionID,
+			},
+		},
+	}
+}

internal/anchore/import_config.go

@@ -0,0 +1,50 @@
+// nolint:dupl
+package anchore
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/client-go/pkg/external"
+	"github.com/anchore/syft/internal/log"
+)
+
+type configImportAPI interface {
+	ImportImageConfig(ctx context.Context, sessionID string, contents interface{}) (external.ImageImportContentResponse, *http.Response, error)
+}
+
+func importConfig(ctx context.Context, api configImportAPI, sessionID string, config []byte, stage *progress.Stage) (string, error) {
+	if len(config) > 0 {
+		log.Debug("importing image config")
+		stage.Current = "image config"
+
+		// API requires an object, but we do not verify the shape of this object locally
+		var sender map[string]interface{}
+		if err := json.Unmarshal(config, &sender); err != nil {
+			return "", err
+		}
+
+		response, httpResponse, err := api.ImportImageConfig(ctx, sessionID, sender)
+		if err != nil {
+			var openAPIErr external.GenericOpenAPIError
+			if errors.As(err, &openAPIErr) {
+				log.Errorf("api response: %+v", string(openAPIErr.Body()))
+			}
+			return "", fmt.Errorf("unable to import Config: %w", err)
+		}
+
+		defer httpResponse.Body.Close()
+
+		if httpResponse.StatusCode != 200 {
+			return "", fmt.Errorf("unable to import Config: %s", httpResponse.Status)
+		}
+
+		return response.Digest, nil
+	}
+	return "", nil
+}

internal/anchore/import_config_test.go

@@ -0,0 +1,129 @@
+package anchore
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/client-go/pkg/external"
+	"github.com/docker/docker/pkg/ioutils"
+	"github.com/go-test/deep"
+)
+
+type mockConfigImportAPI struct {
+	sessionID      string
+	model          interface{}
+	httpResponse   *http.Response
+	err            error
+	ctx            context.Context
+	responseDigest string
+	wasCalled      bool
+}
+
+func (m *mockConfigImportAPI) ImportImageConfig(ctx context.Context, sessionID string, contents interface{}) (external.ImageImportContentResponse, *http.Response, error) {
+	m.wasCalled = true
+	m.model = contents
+	m.sessionID = sessionID
+	m.ctx = ctx
+	if m.httpResponse == nil {
+		m.httpResponse = &http.Response{}
+	}
+	m.httpResponse.Body = ioutils.NewReadCloserWrapper(strings.NewReader(""), func() error { return nil })
+	return external.ImageImportContentResponse{Digest: m.responseDigest}, m.httpResponse, m.err
+}
+
+func TestConfigImport(t *testing.T) {
+
+	sessionID := "my-session"
+
+	tests := []struct {
+		name            string
+		manifestJSONStr string
+		api             *mockConfigImportAPI
+		expectsError    bool
+		expectsCall     bool
+	}{
+
+		{
+			name:            "Go case: import works",
+			manifestJSONStr: `{ "key": "the-manifest-contents!" }`,
+			api: &mockConfigImportAPI{
+				httpResponse:   &http.Response{StatusCode: 200},
+				responseDigest: "digest!",
+			},
+			expectsCall: true,
+		},
+		{
+			name:            "No manifest provided",
+			manifestJSONStr: "",
+			api:             &mockConfigImportAPI{},
+			expectsCall:     false,
+		},
+		{
+			name:            "API returns an error",
+			manifestJSONStr: `{ "key": "the-manifest-contents!" }`,
+			api: &mockConfigImportAPI{
+				err: fmt.Errorf("api error, something went wrong"),
+			},
+			expectsError: true,
+			expectsCall:  true,
+		},
+		{
+			name:            "API HTTP-level error",
+			manifestJSONStr: `{ "key": "the-manifest-contents!" }`,
+			api: &mockConfigImportAPI{
+				httpResponse: &http.Response{StatusCode: 404},
+			},
+			expectsError: true,
+			expectsCall:  true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+
+			digest, err := importConfig(context.TODO(), test.api, sessionID, []byte(test.manifestJSONStr), &progress.Stage{})
+
+			// validate error handling
+			if err != nil && !test.expectsError {
+				t.Fatalf("did not expect an error, but got: %+v", err)
+			} else if err == nil && test.expectsError {
+				t.Fatalf("did expect an error, but got none")
+			}
+
+			if !test.api.wasCalled && test.expectsCall {
+				t.Fatalf("was not called!")
+			} else if test.api.wasCalled && !test.expectsCall {
+				t.Fatalf("should not have been called")
+			}
+
+			if !test.expectsCall {
+				return
+			}
+
+			if digest != test.api.responseDigest {
+				t.Errorf("unexpected content digest: %q != %q", digest, test.api.responseDigest)
+			}
+
+			// validating that the mock got the right parameters
+			if test.api.sessionID != sessionID {
+				t.Errorf("different session ID: %s != %s", test.api.sessionID, sessionID)
+			}
+
+			var expected map[string]interface{}
+			if err := json.Unmarshal([]byte(test.manifestJSONStr), &expected); err != nil {
+				t.Fatalf("could not unmarshal expected results")
+			}
+
+			for _, d := range deep.Equal(test.api.model, expected) {
+				t.Errorf("model difference: %s", d)
+			}
+
+		})
+	}
+}

internal/anchore/import_dockerfile.go

@@ -0,0 +1,43 @@
+package anchore
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/syft/internal/log"
+
+	"github.com/anchore/client-go/pkg/external"
+)
+
+type dockerfileImportAPI interface {
+	ImportImageDockerfile(ctx context.Context, sessionID string, contents string) (external.ImageImportContentResponse, *http.Response, error)
+}
+
+func importDockerfile(ctx context.Context, api dockerfileImportAPI, sessionID string, dockerfile []byte, stage *progress.Stage) (string, error) {
+	if len(dockerfile) > 0 {
+		log.Debug("importing dockerfile")
+		stage.Current = "dockerfile"
+
+		response, httpResponse, err := api.ImportImageDockerfile(ctx, sessionID, string(dockerfile))
+		if err != nil {
+			var openAPIErr external.GenericOpenAPIError
+			if errors.As(err, &openAPIErr) {
+				log.Errorf("api response: %+v", string(openAPIErr.Body()))
+			}
+			return "", fmt.Errorf("unable to import Dockerfile: %w", err)
+		}
+
+		defer httpResponse.Body.Close()
+
+		if httpResponse.StatusCode != 200 {
+			return "", fmt.Errorf("unable to import Dockerfile: %s", httpResponse.Status)
+		}
+
+		return response.Digest, nil
+	}
+	return "", nil
+}

internal/anchore/import_dockerfile_test.go

@@ -0,0 +1,124 @@
+package anchore
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/wagoodman/go-progress"
+
+	"github.com/docker/docker/pkg/ioutils"
+
+	"github.com/anchore/client-go/pkg/external"
+	"github.com/go-test/deep"
+)
+
+type mockDockerfileImportAPI struct {
+	sessionID      string
+	model          string
+	httpResponse   *http.Response
+	err            error
+	ctx            context.Context
+	responseDigest string
+	wasCalled      bool
+}
+
+func (m *mockDockerfileImportAPI) ImportImageDockerfile(ctx context.Context, sessionID string, contents string) (external.ImageImportContentResponse, *http.Response, error) {
+	m.wasCalled = true
+	m.model = contents
+	m.sessionID = sessionID
+	m.ctx = ctx
+	if m.httpResponse == nil {
+		m.httpResponse = &http.Response{}
+	}
+	m.httpResponse.Body = ioutils.NewReadCloserWrapper(strings.NewReader(""), func() error { return nil })
+	return external.ImageImportContentResponse{Digest: m.responseDigest}, m.httpResponse, m.err
+}
+
+func TestDockerfileImport(t *testing.T) {
+
+	sessionID := "my-session"
+
+	tests := []struct {
+		name         string
+		dockerfile   string
+		api          *mockDockerfileImportAPI
+		expectsError bool
+		expectsCall  bool
+	}{
+
+		{
+			name:       "Go case: import works",
+			dockerfile: "the-manifest-contents!",
+			api: &mockDockerfileImportAPI{
+				httpResponse:   &http.Response{StatusCode: 200},
+				responseDigest: "digest!",
+			},
+			expectsCall: true,
+		},
+		{
+			name:        "No manifest provided",
+			dockerfile:  "",
+			api:         &mockDockerfileImportAPI{},
+			expectsCall: false,
+		},
+		{
+			name:       "API returns an error",
+			dockerfile: "the-manifest-contents!",
+			api: &mockDockerfileImportAPI{
+				err: fmt.Errorf("api error, something went wrong"),
+			},
+			expectsError: true,
+			expectsCall:  true,
+		},
+		{
+			name:       "API HTTP-level error",
+			dockerfile: "the-manifest-contents!",
+			api: &mockDockerfileImportAPI{
+				httpResponse: &http.Response{StatusCode: 404},
+			},
+			expectsError: true,
+			expectsCall:  true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+
+			digest, err := importDockerfile(context.TODO(), test.api, sessionID, []byte(test.dockerfile), &progress.Stage{})
+
+			// validate error handling
+			if err != nil && !test.expectsError {
+				t.Fatalf("did not expect an error, but got: %+v", err)
+			} else if err == nil && test.expectsError {
+				t.Fatalf("did expect an error, but got none")
+			}
+
+			if !test.api.wasCalled && test.expectsCall {
+				t.Fatalf("was not called!")
+			} else if test.api.wasCalled && !test.expectsCall {
+				t.Fatalf("should not have been called")
+			}
+
+			if !test.expectsCall {
+				return
+			}
+
+			if digest != test.api.responseDigest {
+				t.Errorf("unexpected content digest: %q != %q", digest, test.api.responseDigest)
+			}
+
+			// validating that the mock got the right parameters
+			if test.api.sessionID != sessionID {
+				t.Errorf("different session ID: %s != %s", test.api.sessionID, sessionID)
+			}
+
+			for _, d := range deep.Equal(test.api.model, test.dockerfile) {
+				t.Errorf("model difference: %s", d)
+			}
+
+		})
+	}
+}

internal/anchore/import_manifest.go

@@ -0,0 +1,50 @@
+// nolint: dupl
+package anchore
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/client-go/pkg/external"
+	"github.com/anchore/syft/internal/log"
+)
+
+type manifestImportAPI interface {
+	ImportImageManifest(ctx context.Context, sessionID string, contents interface{}) (external.ImageImportContentResponse, *http.Response, error)
+}
+
+func importManifest(ctx context.Context, api manifestImportAPI, sessionID string, manifest []byte, stage *progress.Stage) (string, error) {
+	if len(manifest) > 0 {
+		log.Debug("importing image manifest")
+		stage.Current = "image manifest"
+
+		// API requires an object, but we do not verify the shape of this object locally
+		var sender map[string]interface{}
+		if err := json.Unmarshal(manifest, &sender); err != nil {
+			return "", err
+		}
+
+		response, httpResponse, err := api.ImportImageManifest(ctx, sessionID, sender)
+		if err != nil {
+			var openAPIErr external.GenericOpenAPIError
+			if errors.As(err, &openAPIErr) {
+				log.Errorf("api response: %+v", string(openAPIErr.Body()))
+			}
+			return "", fmt.Errorf("unable to import Manifest: %w", err)
+		}
+
+		defer httpResponse.Body.Close()
+
+		if httpResponse.StatusCode != 200 {
+			return "", fmt.Errorf("unable to import Manifest: %s", httpResponse.Status)
+		}
+
+		return response.Digest, nil
+	}
+	return "", nil
+}

internal/anchore/import_manifest_test.go

@@ -0,0 +1,129 @@
+package anchore
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/client-go/pkg/external"
+	"github.com/docker/docker/pkg/ioutils"
+	"github.com/go-test/deep"
+)
+
+type mockManifestImportAPI struct {
+	sessionID      string
+	model          interface{}
+	httpResponse   *http.Response
+	err            error
+	ctx            context.Context
+	responseDigest string
+	wasCalled      bool
+}
+
+func (m *mockManifestImportAPI) ImportImageManifest(ctx context.Context, sessionID string, contents interface{}) (external.ImageImportContentResponse, *http.Response, error) {
+	m.wasCalled = true
+	m.model = contents
+	m.sessionID = sessionID
+	m.ctx = ctx
+	if m.httpResponse == nil {
+		m.httpResponse = &http.Response{}
+	}
+	m.httpResponse.Body = ioutils.NewReadCloserWrapper(strings.NewReader(""), func() error { return nil })
+	return external.ImageImportContentResponse{Digest: m.responseDigest}, m.httpResponse, m.err
+}
+
+func TestManifestImport(t *testing.T) {
+
+	sessionID := "my-session"
+
+	tests := []struct {
+		name         string
+		manifest     string
+		api          *mockManifestImportAPI
+		expectsError bool
+		expectsCall  bool
+	}{
+
+		{
+			name:     "Go case: import works",
+			manifest: `{ "key": "the-config-contents!" }`,
+			api: &mockManifestImportAPI{
+				httpResponse:   &http.Response{StatusCode: 200},
+				responseDigest: "digest!",
+			},
+			expectsCall: true,
+		},
+		{
+			name:        "No manifest provided",
+			manifest:    "",
+			api:         &mockManifestImportAPI{},
+			expectsCall: false,
+		},
+		{
+			name:     "API returns an error",
+			manifest: `{ "key": "the-config-contents!" }`,
+			api: &mockManifestImportAPI{
+				err: fmt.Errorf("api error, something went wrong"),
+			},
+			expectsError: true,
+			expectsCall:  true,
+		},
+		{
+			name:     "API HTTP-level error",
+			manifest: `{ "key": "the-config-contents!" }`,
+			api: &mockManifestImportAPI{
+				httpResponse: &http.Response{StatusCode: 404},
+			},
+			expectsError: true,
+			expectsCall:  true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+
+			digest, err := importManifest(context.TODO(), test.api, sessionID, []byte(test.manifest), &progress.Stage{})
+
+			// validate error handling
+			if err != nil && !test.expectsError {
+				t.Fatalf("did not expect an error, but got: %+v", err)
+			} else if err == nil && test.expectsError {
+				t.Fatalf("did expect an error, but got none")
+			}
+
+			if !test.api.wasCalled && test.expectsCall {
+				t.Fatalf("was not called!")
+			} else if test.api.wasCalled && !test.expectsCall {
+				t.Fatalf("should not have been called")
+			}
+
+			if !test.expectsCall {
+				return
+			}
+
+			if digest != test.api.responseDigest {
+				t.Errorf("unexpected content digest: %q != %q", digest, test.api.responseDigest)
+			}
+
+			// validating that the mock got the right parameters
+			if test.api.sessionID != sessionID {
+				t.Errorf("different session ID: %s != %s", test.api.sessionID, sessionID)
+			}
+
+			var expected map[string]interface{}
+			if err := json.Unmarshal([]byte(test.manifest), &expected); err != nil {
+				t.Fatalf("could not unmarshal expected results")
+			}
+
+			for _, d := range deep.Equal(test.api.model, expected) {
+				t.Errorf("model difference: %s", d)
+			}
+
+		})
+	}
+}

internal/anchore/import_package_sbom.go

@@ -0,0 +1,69 @@
+package anchore
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+
+	"github.com/wagoodman/go-progress"
+
+	jsonPresenter "github.com/anchore/syft/syft/presenter/json"
+
+	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/syft/source"
+
+	"github.com/anchore/client-go/pkg/external"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+type packageSBOMImportAPI interface {
+	ImportImagePackages(context.Context, string, external.ImagePackageManifest) (external.ImageImportContentResponse, *http.Response, error)
+}
+
+func packageSbomModel(s source.Metadata, catalog *pkg.Catalog, d *distro.Distro) (*external.ImagePackageManifest, error) {
+	var buf bytes.Buffer
+	pres := jsonPresenter.NewPresenter(catalog, s, d)
+	err := pres.Present(&buf)
+	if err != nil {
+		return nil, fmt.Errorf("unable to serialize results: %w", err)
+	}
+
+	// the model is 1:1 the JSON output of today. As the schema changes, this will need to be converted into individual mappings.
+	var model external.ImagePackageManifest
+	if err = json.Unmarshal(buf.Bytes(), &model); err != nil {
+		return nil, fmt.Errorf("unable to convert JSON presenter output to import model: %w", err)
+	}
+
+	return &model, nil
+}
+
+func importPackageSBOM(ctx context.Context, api packageSBOMImportAPI, sessionID string, s source.Metadata, catalog *pkg.Catalog, d *distro.Distro, stage *progress.Stage) (string, error) {
+	log.Debug("importing package SBOM")
+	stage.Current = "package SBOM"
+
+	model, err := packageSbomModel(s, catalog, d)
+	if err != nil {
+		return "", fmt.Errorf("unable to create PackageSBOM model: %w", err)
+	}
+
+	response, httpResponse, err := api.ImportImagePackages(ctx, sessionID, *model)
+	if err != nil {
+		var openAPIErr external.GenericOpenAPIError
+		if errors.As(err, &openAPIErr) {
+			log.Errorf("api response: %+v", string(openAPIErr.Body()))
+		}
+		return "", fmt.Errorf("unable to import PackageSBOM: %w", err)
+	}
+
+	defer httpResponse.Body.Close()
+
+	if httpResponse.StatusCode != 200 {
+		return "", fmt.Errorf("unable to import PackageSBOM: %s", httpResponse.Status)
+	}
+
+	return response.Digest, nil
+}

internal/anchore/import_package_sbom_test.go

@@ -0,0 +1,258 @@
+package anchore
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/wagoodman/go-progress"
+
+	jsonPresenter "github.com/anchore/syft/syft/presenter/json"
+
+	"github.com/anchore/syft/syft/distro"
+
+	"github.com/docker/docker/pkg/ioutils"
+
+	"github.com/anchore/client-go/pkg/external"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+	"github.com/go-test/deep"
+)
+
+func must(c pkg.CPE, e error) pkg.CPE {
+	if e != nil {
+		panic(e)
+	}
+	return c
+}
+
+// this test is tailored towards the assumption that the import doc shape and the syft json shape are the same.
+// TODO: replace this as the document shapes diverge.
+func TestPackageSbomToModel(t *testing.T) {
+
+	m := source.Metadata{
+		Scheme: source.ImageScheme,
+		ImageMetadata: source.ImageMetadata{
+			UserInput: "user-in",
+			Scope:     "scope!",
+			Layers: []source.LayerMetadata{
+				{
+					MediaType: "layer-metadata-type!",
+					Digest:    "layer-digest",
+					Size:      20,
+				},
+			},
+			Size:           10,
+			ManifestDigest: "sha256:digest!",
+			MediaType:      "mediatype!",
+			Tags:           nil,
+		},
+	}
+
+	d, _ := distro.NewDistro(distro.CentOS, "8.0", "")
+
+	p := pkg.Package{
+		Name:    "name",
+		Version: "version",
+		FoundBy: "foundBy",
+		Locations: []source.Location{
+			{
+				RealPath:     "path",
+				FileSystemID: "layerID",
+			},
+		},
+		Licenses: []string{"license"},
+		Language: pkg.Python,
+		Type:     pkg.PythonPkg,
+		CPEs: []pkg.CPE{
+			must(pkg.NewCPE("cpe:2.3:*:some:package:1:*:*:*:*:*:*:*")),
+		},
+		PURL: "purl",
+	}
+
+	c := pkg.NewCatalog(p)
+
+	model, err := packageSbomModel(m, c, &d)
+	if err != nil {
+		t.Fatalf("unable to generate model from source material: %+v", err)
+	}
+
+	var modelJSON []byte
+
+	modelJSON, err = json.Marshal(&model)
+	if err != nil {
+		t.Fatalf("unable to marshal model: %+v", err)
+	}
+
+	var buf bytes.Buffer
+	pres := jsonPresenter.NewPresenter(c, m, &d)
+	if err := pres.Present(&buf); err != nil {
+		t.Fatalf("unable to get expected json: %+v", err)
+	}
+
+	// unmarshal expected result
+	var expectedDoc jsonPresenter.Document
+	if err := json.Unmarshal(buf.Bytes(), &expectedDoc); err != nil {
+		t.Fatalf("unable to parse json doc: %+v", err)
+	}
+
+	// unmarshal actual result
+	var actualDoc jsonPresenter.Document
+	if err := json.Unmarshal(modelJSON, &actualDoc); err != nil {
+		t.Fatalf("unable to parse json doc: %+v", err)
+	}
+
+	for _, d := range deep.Equal(actualDoc, expectedDoc) {
+		if strings.HasSuffix(d, "<nil slice> != []") {
+			// do not consider nil vs empty collection semantics as a "difference"
+			continue
+		}
+		t.Errorf("diff: %+v", d)
+	}
+}
+
+type mockPackageSBOMImportAPI struct {
+	sessionID      string
+	model          external.ImagePackageManifest
+	httpResponse   *http.Response
+	err            error
+	ctx            context.Context
+	responseDigest string
+}
+
+func (m *mockPackageSBOMImportAPI) ImportImagePackages(ctx context.Context, sessionID string, model external.ImagePackageManifest) (external.ImageImportContentResponse, *http.Response, error) {
+	m.model = model
+	m.sessionID = sessionID
+	m.ctx = ctx
+	if m.httpResponse == nil {
+		m.httpResponse = &http.Response{}
+	}
+	m.httpResponse.Body = ioutils.NewReadCloserWrapper(strings.NewReader(""), func() error { return nil })
+	return external.ImageImportContentResponse{Digest: m.responseDigest}, m.httpResponse, m.err
+}
+
+func TestPackageSbomImport(t *testing.T) {
+
+	catalog := pkg.NewCatalog(pkg.Package{
+		Name:    "name",
+		Version: "version",
+		FoundBy: "foundBy",
+		Locations: []source.Location{
+			{
+				RealPath:     "path",
+				FileSystemID: "layerID",
+			},
+		},
+		Licenses: []string{"license"},
+		Language: pkg.Python,
+		Type:     pkg.PythonPkg,
+		CPEs: []pkg.CPE{
+			must(pkg.NewCPE("cpe:2.3:*:some:package:1:*:*:*:*:*:*:*")),
+		},
+		PURL:         "purl",
+		MetadataType: pkg.PythonPackageMetadataType,
+		Metadata: pkg.PythonPackageMetadata{
+			Name:        "p-name",
+			Version:     "p-version",
+			License:     "p-license",
+			Author:      "p-author",
+			AuthorEmail: "p-email",
+			Platform:    "p-platform",
+			Files: []pkg.PythonFileRecord{
+				{
+					Path: "p-path",
+					Digest: &pkg.PythonFileDigest{
+						Algorithm: "p-alg",
+						Value:     "p-digest",
+					},
+					Size: "p-size",
+				},
+			},
+			SitePackagesRootPath: "p-site-packages-root",
+			TopLevelPackages:     []string{"top-level"},
+		},
+	})
+
+	m := source.Metadata{
+		Scheme: "a-schema",
+		ImageMetadata: source.ImageMetadata{
+			UserInput:      "user-in",
+			Scope:          "scope!",
+			Layers:         nil,
+			Size:           10,
+			ManifestDigest: "sha256:digest!",
+			MediaType:      "mediatype!",
+			Tags:           nil,
+		},
+	}
+
+	d, _ := distro.NewDistro(distro.CentOS, "8.0", "")
+
+	theModel, err := packageSbomModel(m, catalog, &d)
+	if err != nil {
+		t.Fatalf("could not get sbom model: %+v", err)
+	}
+
+	sessionID := "my-session"
+
+	tests := []struct {
+		name         string
+		api          *mockPackageSBOMImportAPI
+		expectsError bool
+	}{
+
+		{
+			name: "Go case: import works",
+			api: &mockPackageSBOMImportAPI{
+				httpResponse:   &http.Response{StatusCode: 200},
+				responseDigest: "digest!",
+			},
+		},
+		{
+			name: "API returns an error",
+			api: &mockPackageSBOMImportAPI{
+				err: fmt.Errorf("API error, something went wrong."),
+			},
+			expectsError: true,
+		},
+		{
+			name: "API HTTP-level error",
+			api: &mockPackageSBOMImportAPI{
+				httpResponse: &http.Response{StatusCode: 404},
+			},
+			expectsError: true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+
+			digest, err := importPackageSBOM(context.TODO(), test.api, sessionID, m, catalog, &d, &progress.Stage{})
+
+			// validate error handling
+			if err != nil && !test.expectsError {
+				t.Fatalf("did not expect an error, but got: %+v", err)
+			} else if err == nil && test.expectsError {
+				t.Fatalf("did expect an error, but got none")
+			}
+
+			if digest != test.api.responseDigest {
+				t.Errorf("unexpected content digest: %q != %q", digest, test.api.responseDigest)
+			}
+
+			// validating that the mock got the right parameters (api.ImportImagePackages)
+			if test.api.sessionID != sessionID {
+				t.Errorf("different session ID: %s != %s", test.api.sessionID, sessionID)
+			}
+
+			for _, d := range deep.Equal(&test.api.model, theModel) {
+				t.Errorf("model difference: %s", d)
+			}
+
+		})
+	}
+}

internal/bus/bus.go

@@ -0,0 +1,35 @@
+/*
+Package bus provides access to a singleton instance of an event bus (provided by the calling application). The event bus
+is intended to allow for the syft library to publish events which library consumers can subscribe to. These events
+can provide static information, but also have an object as a payload for which the consumer can poll for updates.
+This is akin to a logger, except instead of only allowing strings to be logged, rich objects that can be interacted with.
+
+Note that the singleton instance is only allowed to publish events and not subscribe to them --this is intentional.
+Internal library interactions should continue to use traditional in-execution-path approaches for data sharing
+(e.g. function returns and channels) and not depend on bus subscriptions for critical interactions (e.g. one part of the
+lib publishes an event and another part of the lib subscribes and reacts to that event). The bus is provided only as a
+means for consumers to observe events emitted from the library (such as to provide a rich UI) and not to allow
+consumers to augment or otherwise change execution.
+*/
+package bus
+
+import "github.com/wagoodman/go-partybus"
+
+var publisher partybus.Publisher
+var active bool
+
+// SetPublisher sets the singleton event bus publisher. This is optional; if no bus is provided, the library will
+// behave no differently than if a bus had been provided.
+func SetPublisher(p partybus.Publisher) {
+	publisher = p
+	if p != nil {
+		active = true
+	}
+}
+
+// Publish an event onto the bus. If there is no bus set by the calling application, this does nothing.
+func Publish(event partybus.Event) {
+	if active {
+		publisher.Publish(event)
+	}
+}

internal/config/config.go

@@ -6,70 +6,84 @@ import (
 	"strings"
 
 	"github.com/adrg/xdg"
-	"github.com/anchore/imgbom/imgbom/presenter"
-	"github.com/anchore/imgbom/imgbom/scope"
-	"github.com/anchore/imgbom/internal"
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/syft/presenter"
+	"github.com/anchore/syft/syft/source"
 	"github.com/mitchellh/go-homedir"
+	"github.com/sirupsen/logrus"
 	"github.com/spf13/viper"
-	"go.uber.org/zap/zapcore"
+	"gopkg.in/yaml.v2"
 )
 
-type CliOnlyOptions struct {
-	ConfigPath string
-	Verbosity  int
-}
-
+// Application is the main syft application configuration.
 type Application struct {
-	ConfigPath   string
-	PresenterOpt presenter.Option
-	Output       string `mapstructure:"output"`
-	ScopeOpt     scope.Option
-	Scope        string  `mapstructure:"scope"`
-	Quiet        bool    `mapstructure:"quiet"`
-	Log          Logging `mapstructure:"log"`
-	CliOptions   CliOnlyOptions
+	ConfigPath        string           `yaml:",omitempty"`                   // the location where the application config was read from (either from -c or discovered while loading)
+	PresenterOpt      presenter.Option `yaml:"-"`                            // -o, the native Presenter.Option to use for report formatting
+	Output            string           `yaml:"output" mapstructure:"output"` // -o, the Presenter hint string to use for report formatting
+	ScopeOpt          source.Scope     `yaml:"-"`                            // -s, the native source.Scope option to use for how to catalog the container image
+	Scope             string           `yaml:"scope" mapstructure:"scope"`   // -s, the source.Scope string hint for how to catalog the container image
+	Quiet             bool             `yaml:"quiet" mapstructure:"quiet"`   // -q, indicates to not show any status output to stderr (ETUI or logging UI)
+	Log               logging          `yaml:"log"  mapstructure:"log"`      // all logging-related options
+	CliOptions        CliOnlyOptions   `yaml:"-"`                            // all options only available through the CLI (not via env vars or config)
+	Dev               Development      `mapstructure:"dev"`
+	CheckForAppUpdate bool             `yaml:"check-for-app-update" mapstructure:"check-for-app-update"` // whether to check for an application update on start up or not
+	Anchore           anchore          `yaml:"anchore" mapstructure:"anchore"`                           // options for interacting with Anchore Engine/Enterprise
 }
 
-type Logging struct {
-	Structured   bool `mapstructure:"structured"`
-	LevelOpt     zapcore.Level
-	Level        string `mapstructure:"level"`
-	FileLocation string `mapstructure:"file"`
+// CliOnlyOptions are options that are in the application config in memory, but are only exposed via CLI switches (not from unmarshaling a config file)
+type CliOnlyOptions struct {
+	ConfigPath string // -c. where the read config is on disk
+	Verbosity  int    // -v or -vv , controlling which UI (ETUI vs logging) and what the log level should be
 }
 
-func setNonCliDefaultValues(v *viper.Viper) {
-	v.SetDefault("log.level", "")
-	v.SetDefault("log.file", "")
-	v.SetDefault("log.structured", false)
+// logging contains all logging-related configuration options available to the user via the application config.
+type logging struct {
+	Structured   bool         `yaml:"structured" mapstructure:"structured"` // show all log entries as JSON formatted strings
+	LevelOpt     logrus.Level `yaml:"level"`                                // the native log level object used by the logger
+	Level        string       `yaml:"-" mapstructure:"level"`               // the log level string hint
+	FileLocation string       `yaml:"file" mapstructure:"file"`             // the file path to write logs to
 }
 
-func LoadConfigFromFile(v *viper.Viper, cliOpts *CliOnlyOptions) (*Application, error) {
+type anchore struct {
+	// upload options
+	UploadEnabled          bool   `yaml:"upload-enabled"  mapstructure:"upload-enabled"`                    // whether to upload results to Anchore Engine/Enterprise (defaults to "false" unless there is the presence of -h CLI option)
+	Host                   string `yaml:"host" mapstructure:"host"`                                         // -H , hostname of the engine/enterprise instance to upload to
+	Path                   string `yaml:"path" mapstructure:"path"`                                         // override the engine/enterprise API upload path
+	Username               string `yaml:"username" mapstructure:"username"`                                 // -u , username to authenticate upload
+	Password               string `yaml:"password" mapstructure:"password"`                                 // -p , password to authenticate upload
+	Dockerfile             string `yaml:"dockerfile" mapstructure:"dockerfile"`                             // -d , dockerfile to attach for upload
+	OverwriteExistingImage bool   `yaml:"overwrite-existing-image" mapstructure:"overwrite-existing-image"` // --overwrite-existing-image , if any of the SBOM components have already been uploaded this flag will ensure they are overwritten with the current upload
+}
+
+type Development struct {
+	ProfileCPU bool `mapstructure:"profile-cpu"`
+	ProfileMem bool `mapstructure:"profile-mem"`
+}
+
+// LoadApplicationConfig populates the given viper object with application configuration discovered on disk
+func LoadApplicationConfig(v *viper.Viper, cliOpts CliOnlyOptions, wasHostnameSet bool) (*Application, error) {
 	// the user may not have a config, and this is OK, we can use the default config + default cobra cli values instead
 	setNonCliDefaultValues(v)
-	if cliOpts != nil {
-		_ = readConfig(v, cliOpts.ConfigPath)
-	} else {
-		_ = readConfig(v, "")
-	}
+	_ = readConfig(v, cliOpts.ConfigPath)
 
 	config := &Application{
-		CliOptions: *cliOpts,
+		CliOptions: cliOpts,
 	}
-	err := v.Unmarshal(config)
-	if err != nil {
+
+	if err := v.Unmarshal(config); err != nil {
 		return nil, fmt.Errorf("unable to parse config: %w", err)
 	}
 	config.ConfigPath = v.ConfigFileUsed()
 
-	err = config.Build()
-	if err != nil {
+	if err := config.build(v, wasHostnameSet); err != nil {
 		return nil, fmt.Errorf("invalid config: %w", err)
 	}
 
 	return config, nil
 }
 
-func (cfg *Application) Build() error {
+// build inflates simple config values into syft native objects (or other complex objects) after the config is fully read in.
+func (cfg *Application) build(v *viper.Viper, wasHostnameSet bool) error {
 	// set the presenter
 	presenterOption := presenter.ParseOption(cfg.Output)
 	if presenterOption == presenter.UnknownPresenter {
@@ -77,51 +91,82 @@ func (cfg *Application) Build() error {
 	}
 	cfg.PresenterOpt = presenterOption
 
-	// set the scope
-	scopeOption := scope.ParseOption(cfg.Scope)
-	if scopeOption == scope.UnknownScope {
+	// set the source
+	scopeOption := source.ParseScope(cfg.Scope)
+	if scopeOption == source.UnknownScope {
 		return fmt.Errorf("bad --scope value '%s'", cfg.Scope)
 	}
 	cfg.ScopeOpt = scopeOption
 
 	if cfg.Quiet {
 		// TODO: this is bad: quiet option trumps all other logging options
-		// we should be able to quiet the consol logging and leave file logging alone...
+		// we should be able to quiet the console logging and leave file logging alone...
 		// ... this will be an enhancement for later
-		cfg.Log.LevelOpt = zapcore.PanicLevel
+		cfg.Log.LevelOpt = logrus.PanicLevel
 	} else {
 		if cfg.Log.Level != "" {
 			if cfg.CliOptions.Verbosity > 0 {
 				return fmt.Errorf("cannot explicitly set log level (cfg file or env var) and use -v flag together")
 			}
 
-			// set the log level explicitly
-			err := cfg.Log.LevelOpt.Set(cfg.Log.Level)
+			lvl, err := logrus.ParseLevel(strings.ToLower(cfg.Log.Level))
 			if err != nil {
-				return fmt.Errorf("bad log level value '%s': %+v", cfg.Log.Level, err)
+				return fmt.Errorf("bad log level configured (%q): %w", cfg.Log.Level, err)
 			}
+			// set the log level explicitly
+			cfg.Log.LevelOpt = lvl
 		} else {
 			// set the log level implicitly
 			switch v := cfg.CliOptions.Verbosity; {
 			case v == 1:
-				cfg.Log.LevelOpt = zapcore.InfoLevel
+				cfg.Log.LevelOpt = logrus.InfoLevel
 			case v >= 2:
-				cfg.Log.LevelOpt = zapcore.DebugLevel
+				cfg.Log.LevelOpt = logrus.DebugLevel
 			default:
-				cfg.Log.LevelOpt = zapcore.ErrorLevel
+				cfg.Log.LevelOpt = logrus.WarnLevel
 			}
 		}
 	}
+	// check if upload should be done relative to the CLI and config behavior
+	if !v.IsSet("anchore.upload-enabled") && wasHostnameSet {
+		// we know the user didn't specify to upload in the config file and a --hostname option was provided (so set upload)
+		cfg.Anchore.UploadEnabled = true
+	}
+
+	if !cfg.Anchore.UploadEnabled && cfg.Anchore.Dockerfile != "" {
+		return fmt.Errorf("cannot provide dockerfile option without enabling upload")
+	}
 
 	return nil
 }
 
+func (cfg Application) String() string {
+	// redact sensitive information
+	if cfg.Anchore.Username != "" {
+		cfg.Anchore.Username = "********"
+	}
+
+	if cfg.Anchore.Password != "" {
+		cfg.Anchore.Password = "********"
+	}
+
+	// yaml is pretty human friendly (at least when compared to json)
+	appCfgStr, err := yaml.Marshal(&cfg)
+
+	if err != nil {
+		return err.Error()
+	}
+
+	return string(appCfgStr)
+}
+
+// readConfig attempts to read the given config path from disk or discover an alternate store location
 func readConfig(v *viper.Viper, configPath string) error {
 	v.AutomaticEnv()
 	v.SetEnvPrefix(internal.ApplicationName)
 	// allow for nested options to be specified via environment variables
 	// e.g. pod.context = APPNAME_POD_CONTEXT
-	v.SetEnvKeyReplacer(strings.NewReplacer(".", "_"))
+	v.SetEnvKeyReplacer(strings.NewReplacer(".", "_", "-", "_"))
 
 	// use explicitly the given user config
 	if configPath != "" {
@@ -171,3 +216,13 @@ func readConfig(v *viper.Viper, configPath string) error {
 
 	return fmt.Errorf("application config not found")
 }
+
+// setNonCliDefaultValues ensures that there are sane defaults for values that do not have CLI equivalent options (where there would already be a default value)
+func setNonCliDefaultValues(v *viper.Viper) {
+	v.SetDefault("log.level", "")
+	v.SetDefault("log.file", "")
+	v.SetDefault("log.structured", false)
+	v.SetDefault("check-for-app-update", true)
+	v.SetDefault("dev.profile-cpu", false)
+	v.SetDefault("dev.profile-mem", false)
+}

internal/constants.go

@@ -1,4 +1,10 @@
 package internal
 
-// note: must be a single word, all lowercase
-const ApplicationName = "imgbom"
+const (
+	// ApplicationName is the non-capitalized name of the application (do not change this)
+	ApplicationName = "syft"
+
+	// JSONSchemaVersion is the current schema version output by the JSON presenter
+	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
+	JSONSchemaVersion = "1.0.2"
+)

internal/docs.go

@@ -0,0 +1,4 @@
+/*
+Package internal contains miscellaneous functions and objects useful within syft but should not be used externally.
+*/
+package internal

internal/file/glob_match.go

@@ -0,0 +1,46 @@
+package file
+
+// GlobMatch evaluates the given glob pattern against the given "name" string, indicating if there is a match or not.
+// Source: https://research.swtch.com/glob.go
+func GlobMatch(pattern, name string) bool {
+	px := 0
+	nx := 0
+	nextPx := 0
+	nextNx := 0
+	for px < len(pattern) || nx < len(name) {
+		if px < len(pattern) {
+			c := pattern[px]
+			switch c {
+			default: // ordinary character
+				if nx < len(name) && name[nx] == c {
+					px++
+					nx++
+					continue
+				}
+			case '?': // single-character wildcard
+				if nx < len(name) {
+					px++
+					nx++
+					continue
+				}
+			case '*': // zero-or-more-character wildcard
+				// Try to match at nx.
+				// If that doesn't work out,
+				// restart at nx+1 next.
+				nextPx = px
+				nextNx = nx + 1
+				px++
+				continue
+			}
+		}
+		// Mismatch. Maybe restart.
+		if 0 < nextNx && nextNx <= len(name) {
+			px = nextPx
+			nx = nextNx
+			continue
+		}
+		return false
+	}
+	// Matched all of pattern to all of name. Success.
+	return true
+}

internal/file/glob_match_test.go

@@ -0,0 +1,39 @@
+package file
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestGlobMatch(t *testing.T) {
+	var tests = []struct {
+		pattern string
+		data    string
+		ok      bool
+	}{
+		{"", "", true},
+		{"x", "", false},
+		{"", "x", false},
+		{"abc", "abc", true},
+		{"*", "abc", true},
+		{"*c", "abc", true},
+		{"*b", "abc", false},
+		{"a*", "abc", true},
+		{"b*", "abc", false},
+		{"a*", "a", true},
+		{"*a", "a", true},
+		{"a*b*c*d*e*", "axbxcxdxe", true},
+		{"a*b*c*d*e*", "axbxcxdxexxx", true},
+		{"a*b?c*x", "abxbbxdbxebxczzx", true},
+		{"a*b?c*x", "abxbbxdbxebxczzy", false},
+		{"a*a*a*a*b", strings.Repeat("a", 100), false},
+		{"*x", "xxx", true},
+		{"/home/place/**", "/home/place/a/thing", true},
+	}
+
+	for _, test := range tests {
+		if GlobMatch(test.pattern, test.data) != test.ok {
+			t.Errorf("failed glob='%s' data='%s'", test.pattern, test.data)
+		}
+	}
+}

internal/file/opener.go

@@ -0,0 +1,16 @@
+package file
+
+import (
+	"io"
+	"os"
+)
+
+// Opener is an object that stores a path to later be opened as a file.
+type Opener struct {
+	path string
+}
+
+// Open the stored path as a io.ReadCloser.
+func (o Opener) Open() (io.ReadCloser, error) {
+	return os.Open(o.path)
+}

internal/file/test-fixtures/generate-zip-fixture.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -eux
+
+# $1 —— absolute path to destination file, should end with .zip, ideally
+# $2 —— absolute path to directory from which to add entries to the archive
+
+pushd "$2" && find . -print | zip "$1" -@ && popd

internal/file/test-fixtures/zip-source/b-file.txt

@@ -0,0 +1 @@
+B file...

internal/file/test-fixtures/zip-source/some-dir/a-file.txt

@@ -0,0 +1 @@
+A file! nice!

internal/file/zip_file_helpers_test.go

@@ -0,0 +1,131 @@
+package file
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"os/exec"
+	"path"
+	"path/filepath"
+	"syscall"
+	"testing"
+)
+
+var expectedZipArchiveEntries = []string{
+	"some-dir" + string(os.PathSeparator),
+	filepath.Join("some-dir", "a-file.txt"),
+	"b-file.txt",
+	"nested.zip",
+}
+
+// fatalIfError calls the supplied function. If the function returns a non-nil error, t.Fatal(err) is called.
+func fatalIfError(t *testing.T, fn func() error) {
+	t.Helper()
+
+	if fn == nil {
+		return
+	}
+
+	err := fn()
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+// createZipArchive creates a new ZIP archive file at destinationArchivePath based on the directory found at
+// sourceDirPath.
+func createZipArchive(t *testing.T, sourceDirPath, destinationArchivePath string) error {
+	t.Helper()
+
+	cwd, err := os.Getwd()
+	if err != nil {
+		return fmt.Errorf("unable to get cwd: %+v", err)
+	}
+
+	cmd := exec.Command("./generate-zip-fixture.sh", destinationArchivePath, path.Base(sourceDirPath))
+	cmd.Dir = filepath.Join(cwd, "test-fixtures")
+
+	if err := cmd.Start(); err != nil {
+		return fmt.Errorf("unable to start generate zip fixture script: %+v", err)
+	}
+
+	if err := cmd.Wait(); err != nil {
+		if exiterr, ok := err.(*exec.ExitError); ok {
+			// The program has exited with an exit code != 0
+
+			// This works on both Unix and Windows. Although package
+			// syscall is generally platform dependent, WaitStatus is
+			// defined for both Unix and Windows and in both cases has
+			// an ExitStatus() method with the same signature.
+			if status, ok := exiterr.Sys().(syscall.WaitStatus); ok {
+				if status.ExitStatus() != 0 {
+					return fmt.Errorf("failed to generate fixture: rc=%d", status.ExitStatus())
+				}
+			}
+		} else {
+			return fmt.Errorf("unable to get generate fixture script result: %+v", err)
+		}
+	}
+
+	return nil
+}
+
+// setupZipFileTest encapsulates common test setup work for zip file tests. It returns a cleanup function,
+// which should be called (typically deferred) by the caller, the path of the created zip archive, and an error,
+// which should trigger a fatal test failure in the consuming test. The returned cleanup function will never be nil
+// (even if there's an error), and it should always be called.
+func setupZipFileTest(t *testing.T, sourceDirPath string) (func() error, string, error) {
+	t.Helper()
+
+	// Keep track of any needed cleanup work as we go
+	var cleanupFns []func() error
+	cleanup := func(fns []func() error) func() error {
+		return func() error {
+			for _, fn := range fns {
+				err := fn()
+				if err != nil {
+					return err
+				}
+			}
+
+			return nil
+		}
+	}
+
+	archivePrefix, err := ioutil.TempFile("", "syft-ziputil-archive-TEST-")
+	if err != nil {
+		return cleanup(cleanupFns), "", fmt.Errorf("unable to create tempfile: %+v", err)
+	}
+	cleanupFns = append(cleanupFns, func() error { return os.Remove(archivePrefix.Name()) })
+
+	destinationArchiveFilePath := archivePrefix.Name() + ".zip"
+	t.Logf("archive path: %s", destinationArchiveFilePath)
+	err = createZipArchive(t, sourceDirPath, destinationArchiveFilePath)
+	cleanupFns = append(cleanupFns, func() error { return os.Remove(destinationArchiveFilePath) })
+	if err != nil {
+		return cleanup(cleanupFns), "", err
+	}
+
+	cwd, err := os.Getwd()
+	if err != nil {
+		return cleanup(cleanupFns), "", fmt.Errorf("unable to get cwd: %+v", err)
+	}
+
+	t.Logf("running from: %s", cwd)
+
+	return cleanup(cleanupFns), destinationArchiveFilePath, nil
+}
+
+// TODO: Consider moving any non-git asset generation to a task (e.g. make) that's run ahead of running go tests.
+func ensureNestedZipExists(t *testing.T, sourceDirPath string) error {
+	t.Helper()
+
+	nestedArchiveFilePath := path.Join(sourceDirPath, "nested.zip")
+	err := createZipArchive(t, sourceDirPath, nestedArchiveFilePath)
+
+	if err != nil {
+		return fmt.Errorf("unable to create nested archive for test fixture: %+v", err)
+	}
+
+	return nil
+}

internal/file/zip_file_manifest.go

@@ -0,0 +1,77 @@
+package file
+
+import (
+	"archive/zip"
+	"fmt"
+	"os"
+	"sort"
+	"strings"
+
+	"github.com/anchore/syft/internal"
+
+	"github.com/anchore/syft/internal/log"
+)
+
+// ZipFileManifest is a collection of paths and their file metadata.
+type ZipFileManifest map[string]os.FileInfo
+
+// newZipManifest creates an empty ZipFileManifest.
+func newZipManifest() ZipFileManifest {
+	return make(ZipFileManifest)
+}
+
+// Add a new path and it's file metadata to the collection.
+func (z ZipFileManifest) Add(entry string, info os.FileInfo) {
+	z[entry] = info
+}
+
+// GlobMatch returns the path keys that match the given value(s).
+func (z ZipFileManifest) GlobMatch(patterns ...string) []string {
+	uniqueMatches := internal.NewStringSet()
+
+	for _, pattern := range patterns {
+		for entry := range z {
+			// We want to match globs as if entries begin with a leading slash (akin to an absolute path)
+			// so that glob logic is consistent inside and outside of ZIP archives
+			normalizedEntry := normalizeZipEntryName(entry)
+
+			if GlobMatch(pattern, normalizedEntry) {
+				uniqueMatches.Add(entry)
+			}
+		}
+	}
+
+	results := uniqueMatches.ToSlice()
+	sort.Strings(results)
+
+	return results
+}
+
+// NewZipFileManifest creates and returns a new ZipFileManifest populated with path and metadata from the given zip archive path.
+func NewZipFileManifest(archivePath string) (ZipFileManifest, error) {
+	zipReader, err := zip.OpenReader(archivePath)
+	manifest := newZipManifest()
+	if err != nil {
+		return manifest, fmt.Errorf("unable to open zip archive (%s): %w", archivePath, err)
+	}
+	defer func() {
+		err = zipReader.Close()
+		if err != nil {
+			log.Errorf("unable to close zip archive (%s): %+v", archivePath, err)
+		}
+	}()
+
+	for _, file := range zipReader.Reader.File {
+		manifest.Add(file.Name, file.FileInfo())
+	}
+	return manifest, nil
+}
+
+// normalizeZipEntryName takes the given path entry and ensures it is prefixed with "/".
+func normalizeZipEntryName(entry string) string {
+	if !strings.HasPrefix(entry, "/") {
+		return "/" + entry
+	}
+
+	return entry
+}

internal/file/zip_file_manifest_test.go

@@ -0,0 +1,109 @@
+package file
+
+import (
+	"encoding/json"
+	"os"
+	"path"
+	"testing"
+)
+
+func TestNewZipFileManifest(t *testing.T) {
+	cwd, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	sourceDirPath := path.Join(cwd, "test-fixtures", "zip-source")
+	err = ensureNestedZipExists(t, sourceDirPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	cleanup, archiveFilePath, err := setupZipFileTest(t, sourceDirPath)
+	defer fatalIfError(t, cleanup)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	actual, err := NewZipFileManifest(archiveFilePath)
+	if err != nil {
+		t.Fatalf("unable to extract from unzip archive: %+v", err)
+	}
+
+	if len(expectedZipArchiveEntries) != len(actual) {
+		t.Fatalf("mismatched manifest: %d != %d", len(actual), len(expectedZipArchiveEntries))
+	}
+
+	for _, e := range expectedZipArchiveEntries {
+		_, ok := actual[e]
+		if !ok {
+			t.Errorf("missing path: %s", e)
+		}
+	}
+
+	if t.Failed() {
+		b, err := json.MarshalIndent(actual, "", "  ")
+		if err != nil {
+			t.Fatalf("can't show results: %+v", err)
+		}
+
+		t.Errorf("full result: %s", string(b))
+	}
+}
+
+func TestZipFileManifest_GlobMatch(t *testing.T) {
+	cwd, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	sourceDirPath := path.Join(cwd, "test-fixtures", "zip-source")
+	err = ensureNestedZipExists(t, sourceDirPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	cleanup, archiveFilePath, err := setupZipFileTest(t, sourceDirPath)
+	//goland:noinspection GoNilness
+	defer fatalIfError(t, cleanup)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	z, err := NewZipFileManifest(archiveFilePath)
+	if err != nil {
+		t.Fatalf("unable to extract from unzip archive: %+v", err)
+	}
+
+	cases := []struct {
+		glob     string
+		expected string
+	}{
+		{
+			"/b*",
+			"b-file.txt",
+		},
+		{
+			"*/a-file.txt",
+			"some-dir/a-file.txt",
+		},
+		{
+			"**/*.zip",
+			"nested.zip",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.glob, func(t *testing.T) {
+			glob := tc.glob
+
+			results := z.GlobMatch(glob)
+
+			if len(results) == 1 && results[0] == tc.expected {
+				return
+			}
+
+			t.Errorf("unexpected results for glob '%s': %+v", glob, results)
+		})
+	}
+}

internal/file/zip_file_traversal.go

@@ -0,0 +1,233 @@
+package file
+
+import (
+	"archive/zip"
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/anchore/syft/internal/log"
+)
+
+const (
+	// represents the order of bytes
+	_  = iota
+	KB = 1 << (10 * iota)
+	MB
+	GB
+)
+
+const perFileReadLimit = 2 * GB
+
+type zipTraversalRequest map[string]struct{}
+
+func newZipTraverseRequest(paths ...string) zipTraversalRequest {
+	results := make(zipTraversalRequest)
+	for _, p := range paths {
+		results[p] = struct{}{}
+	}
+	return results
+}
+
+// TraverseFilesInZip enumerates all paths stored within a zip archive using the visitor pattern.
+func TraverseFilesInZip(archivePath string, visitor func(*zip.File) error, paths ...string) error {
+	request := newZipTraverseRequest(paths...)
+
+	zipReader, err := zip.OpenReader(archivePath)
+	if err != nil {
+		return fmt.Errorf("unable to open zip archive (%s): %w", archivePath, err)
+	}
+	defer func() {
+		err = zipReader.Close()
+		if err != nil {
+			log.Errorf("unable to close zip archive (%s): %+v", archivePath, err)
+		}
+	}()
+
+	for _, file := range zipReader.Reader.File {
+		// if no paths are given then assume that all files should be traversed
+		if len(paths) > 0 {
+			if _, ok := request[file.Name]; !ok {
+				// this file path is not of interest
+				continue
+			}
+		}
+
+		if err = visitor(file); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// ExtractFromZipToUniqueTempFile extracts select paths for the given archive to a temporary directory, returning file openers for each file extracted.
+func ExtractFromZipToUniqueTempFile(archivePath, dir string, paths ...string) (map[string]Opener, error) {
+	results := make(map[string]Opener)
+
+	// don't allow for full traversal, only select traversal from given paths
+	if len(paths) == 0 {
+		return results, nil
+	}
+
+	visitor := func(file *zip.File) error {
+		tempfilePrefix := filepath.Base(filepath.Clean(file.Name)) + "-"
+
+		tempFile, err := ioutil.TempFile(dir, tempfilePrefix)
+		if err != nil {
+			return fmt.Errorf("unable to create temp file: %w", err)
+		}
+		// we shouldn't try and keep the tempfile open as the returned result may have several files, which takes up
+		// resources (leading to "too many open files"). Instead we'll return a file opener to the caller which
+		// provides a ReadCloser. It is up to the caller to handle closing the file explicitly.
+		defer tempFile.Close()
+
+		zippedFile, err := file.Open()
+		if err != nil {
+			return fmt.Errorf("unable to read file=%q from zip=%q: %w", file.Name, archivePath, err)
+		}
+		defer func() {
+			err := zippedFile.Close()
+			if err != nil {
+				log.Errorf("unable to close source file=%q from zip=%q: %+v", file.Name, archivePath, err)
+			}
+		}()
+
+		if file.FileInfo().IsDir() {
+			return fmt.Errorf("unable to extract directories, only files: %s", file.Name)
+		}
+
+		// limit the zip reader on each file read to prevent decompression bomb attacks
+		numBytes, err := io.Copy(tempFile, io.LimitReader(zippedFile, perFileReadLimit))
+		if numBytes >= perFileReadLimit || errors.Is(err, io.EOF) {
+			return fmt.Errorf("zip read limit hit (potential decompression bomb attack)")
+		}
+		if err != nil {
+			return fmt.Errorf("unable to copy source=%q for zip=%q: %w", file.Name, archivePath, err)
+		}
+
+		// the file pointer is at the end due to the copy operation, reset back to the beginning
+		_, err = tempFile.Seek(0, io.SeekStart)
+		if err != nil {
+			return fmt.Errorf("unable to reset file pointer (%s): %w", tempFile.Name(), err)
+		}
+
+		results[file.Name] = Opener{path: tempFile.Name()}
+
+		return nil
+	}
+
+	return results, TraverseFilesInZip(archivePath, visitor, paths...)
+}
+
+// ContentsFromZip extracts select paths for the given archive and returns a set of string contents for each path.
+func ContentsFromZip(archivePath string, paths ...string) (map[string]string, error) {
+	results := make(map[string]string)
+
+	// don't allow for full traversal, only select traversal from given paths
+	if len(paths) == 0 {
+		return results, nil
+	}
+
+	visitor := func(file *zip.File) error {
+		zippedFile, err := file.Open()
+		if err != nil {
+			return fmt.Errorf("unable to read file=%q from zip=%q: %w", file.Name, archivePath, err)
+		}
+
+		if file.FileInfo().IsDir() {
+			return fmt.Errorf("unable to extract directories, only files: %s", file.Name)
+		}
+
+		var buffer bytes.Buffer
+
+		// limit the zip reader on each file read to prevent decompression bomb attacks
+		numBytes, err := io.Copy(&buffer, io.LimitReader(zippedFile, perFileReadLimit))
+		if numBytes >= perFileReadLimit || errors.Is(err, io.EOF) {
+			return fmt.Errorf("zip read limit hit (potential decompression bomb attack)")
+		}
+		if err != nil {
+			return fmt.Errorf("unable to copy source=%q for zip=%q: %w", file.Name, archivePath, err)
+		}
+
+		results[file.Name] = buffer.String()
+
+		err = zippedFile.Close()
+		if err != nil {
+			return fmt.Errorf("unable to close source file=%q from zip=%q: %w", file.Name, archivePath, err)
+		}
+		return nil
+	}
+
+	return results, TraverseFilesInZip(archivePath, visitor, paths...)
+}
+
+// UnzipToDir extracts a zip archive to a target directory.
+func UnzipToDir(archivePath, targetDir string) error {
+	visitor := func(file *zip.File) error {
+		// the zip-slip attack protection is still being erroneously detected
+		// nolint:gosec
+		expandedFilePath := filepath.Clean(filepath.Join(targetDir, file.Name))
+
+		// protect against zip slip attacks (traversing unintended parent paths from maliciously crafted relative-path entries)
+		if !strings.HasPrefix(expandedFilePath, filepath.Clean(targetDir)+string(os.PathSeparator)) {
+			return fmt.Errorf("potential zip slip attack: %q", expandedFilePath)
+		}
+
+		err := extractSingleFile(file, expandedFilePath, archivePath)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	return TraverseFilesInZip(archivePath, visitor)
+}
+
+func extractSingleFile(file *zip.File, expandedFilePath, archivePath string) error {
+	zippedFile, err := file.Open()
+	if err != nil {
+		return fmt.Errorf("unable to read file=%q from zip=%q: %w", file.Name, archivePath, err)
+	}
+
+	if file.FileInfo().IsDir() {
+		err = os.MkdirAll(expandedFilePath, file.Mode())
+		if err != nil {
+			return fmt.Errorf("unable to create dir=%q from zip=%q: %w", expandedFilePath, archivePath, err)
+		}
+	} else {
+		// Open an output file for writing
+		outputFile, err := os.OpenFile(
+			expandedFilePath,
+			os.O_WRONLY|os.O_CREATE|os.O_TRUNC,
+			file.Mode(),
+		)
+		if err != nil {
+			return fmt.Errorf("unable to create dest file=%q from zip=%q: %w", expandedFilePath, archivePath, err)
+		}
+
+		// limit the zip reader on each file read to prevent decompression bomb attacks
+		numBytes, err := io.Copy(outputFile, io.LimitReader(zippedFile, perFileReadLimit))
+		if numBytes >= perFileReadLimit || errors.Is(err, io.EOF) {
+			return fmt.Errorf("zip read limit hit (potential decompression bomb attack)")
+		}
+		if err != nil {
+			return fmt.Errorf("unable to copy source=%q to dest=%q for zip=%q: %w", file.Name, outputFile.Name(), archivePath, err)
+		}
+
+		err = outputFile.Close()
+		if err != nil {
+			return fmt.Errorf("unable to close dest file=%q from zip=%q: %w", outputFile.Name(), archivePath, err)
+		}
+	}
+
+	err = zippedFile.Close()
+	if err != nil {
+		return fmt.Errorf("unable to close source file=%q from zip=%q: %w", file.Name, archivePath, err)
+	}
+	return nil
+}

internal/file/zip_file_traversal_test.go

@@ -0,0 +1,175 @@
+package file
+
+import (
+	"crypto/sha256"
+	"encoding/json"
+	"io"
+	"io/ioutil"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/go-test/deep"
+)
+
+func equal(r1, r2 io.Reader) (bool, error) {
+	w1 := sha256.New()
+	w2 := sha256.New()
+	n1, err1 := io.Copy(w1, r1)
+	if err1 != nil {
+		return false, err1
+	}
+	n2, err2 := io.Copy(w2, r2)
+	if err2 != nil {
+		return false, err2
+	}
+
+	var b1, b2 [sha256.Size]byte
+	copy(b1[:], w1.Sum(nil))
+	copy(b2[:], w2.Sum(nil))
+
+	return n1 != n2 || b1 == b2, nil
+}
+
+func TestUnzipToDir(t *testing.T) {
+	cwd, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	goldenRootDir := filepath.Join(cwd, "test-fixtures")
+	sourceDirPath := path.Join(goldenRootDir, "zip-source")
+	cleanup, archiveFilePath, err := setupZipFileTest(t, sourceDirPath)
+	defer fatalIfError(t, cleanup)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	unzipDestinationDir, err := ioutil.TempDir("", "syft-ziputil-contents-TEST-")
+	defer os.RemoveAll(unzipDestinationDir)
+	if err != nil {
+		t.Fatalf("unable to create tempdir: %+v", err)
+	}
+
+	t.Logf("content path: %s", unzipDestinationDir)
+
+	expectedPaths := len(expectedZipArchiveEntries)
+	observedPaths := 0
+
+	err = UnzipToDir(archiveFilePath, unzipDestinationDir)
+	if err != nil {
+		t.Fatalf("unable to unzip archive: %+v", err)
+	}
+
+	// compare the source dir tree and the unzipped tree
+	err = filepath.Walk(unzipDestinationDir,
+		func(path string, info os.FileInfo, err error) error {
+			// We don't unzip the root archive dir, since there's no archive entry for it
+			if path != unzipDestinationDir {
+				t.Logf("unzipped path: %s", path)
+				observedPaths++
+			}
+
+			if err != nil {
+				t.Fatalf("this should not happen")
+				return err
+			}
+
+			goldenPath := filepath.Join(sourceDirPath, strings.TrimPrefix(path, unzipDestinationDir))
+
+			if info.IsDir() {
+				i, err := os.Stat(goldenPath)
+				if err != nil {
+					t.Fatalf("unable to stat golden path: %+v", err)
+				}
+				if !i.IsDir() {
+					t.Fatalf("mismatched file types: %s", goldenPath)
+				}
+				return nil
+			}
+
+			// this is a file, not a dir...
+
+			testFile, err := os.Open(path)
+			if err != nil {
+				t.Fatalf("unable to open test file=%s :%+v", path, err)
+			}
+
+			goldenFile, err := os.Open(goldenPath)
+			if err != nil {
+				t.Fatalf("unable to open golden file=%s :%+v", goldenPath, err)
+			}
+
+			same, err := equal(testFile, goldenFile)
+			if err != nil {
+				t.Fatalf("could not compare files (%s, %s): %+v", goldenPath, path, err)
+			}
+
+			if !same {
+				t.Errorf("paths are not the same (%s, %s)", goldenPath, path)
+			}
+
+			return nil
+		})
+
+	if err != nil {
+		t.Errorf("failed to walk dir: %+v", err)
+	}
+
+	if observedPaths != expectedPaths {
+		t.Errorf("missed test paths: %d != %d", observedPaths, expectedPaths)
+	}
+}
+
+func TestContentsFromZip(t *testing.T) {
+	archivePrefix, err := ioutil.TempFile("", "syft-ziputil-archive-TEST-")
+	if err != nil {
+		t.Fatalf("unable to create tempfile: %+v", err)
+	}
+	defer os.Remove(archivePrefix.Name())
+	// the zip utility will add ".zip" to the end of the given name
+	archivePath := archivePrefix.Name() + ".zip"
+	defer os.Remove(archivePath)
+	t.Logf("archive path: %s", archivePath)
+
+	err = createZipArchive(t, "zip-source", archivePrefix.Name())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	cwd, err := os.Getwd()
+	if err != nil {
+		t.Errorf("unable to get cwd: %+v", err)
+	}
+
+	t.Logf("running from: %s", cwd)
+
+	aFilePath := filepath.Join("some-dir", "a-file.txt")
+	bFilePath := filepath.Join("b-file.txt")
+
+	expected := map[string]string{
+		aFilePath: "A file! nice!",
+		bFilePath: "B file...",
+	}
+
+	actual, err := ContentsFromZip(archivePath, aFilePath, bFilePath)
+	if err != nil {
+		t.Fatalf("unable to extract from unzip archive: %+v", err)
+	}
+
+	diffs := deep.Equal(actual, expected)
+	if len(diffs) > 0 {
+		for _, d := range diffs {
+			t.Errorf("diff: %+v", d)
+		}
+
+		b, err := json.MarshalIndent(actual, "", "  ")
+		if err != nil {
+			t.Fatalf("can't show results: %+v", err)
+		}
+
+		t.Errorf("full result: %s", string(b))
+	}
+}

internal/format/color.go

@@ -1,21 +0,0 @@
-package format
-
-import "fmt"
-
-const (
-	DefaultColor Color = iota + 30
-	Red
-	Green
-	Yellow
-	Blue
-	Magenta
-	Cyan
-	White
-)
-
-type Color uint8
-
-// TODO: not cross platform (windows...)
-func (c Color) Format(s string) string {
-	return fmt.Sprintf("\x1b[%dm%s\x1b[0m", c, s)
-}

internal/log/log.go

@@ -1,25 +1,49 @@
+/*
+Package log contains the singleton object and helper functions for facilitating logging within the syft library.
+*/
 package log
 
-import "github.com/anchore/imgbom/imgbom/logger"
+import "github.com/anchore/syft/syft/logger"
 
+// Log is the singleton used to facilitate logging internally within syft
 var Log logger.Logger = &nopLogger{}
 
+// Errorf takes a formatted template string and template arguments for the error logging level.
 func Errorf(format string, args ...interface{}) {
 	Log.Errorf(format, args...)
 }
 
+// Error logs the given arguments at the error logging level.
+func Error(args ...interface{}) {
+	Log.Error(args...)
+}
+
+// Warnf takes a formatted template string and template arguments for the warning logging level.
+func Warnf(format string, args ...interface{}) {
+	Log.Warnf(format, args...)
+}
+
+// Warn logs the given arguments at the warning logging level.
+func Warn(args ...interface{}) {
+	Log.Warn(args...)
+}
+
+// Infof takes a formatted template string and template arguments for the info logging level.
 func Infof(format string, args ...interface{}) {
 	Log.Infof(format, args...)
 }
 
+// Info logs the given arguments at the info logging level.
 func Info(args ...interface{}) {
 	Log.Info(args...)
 }
 
+// Debugf takes a formatted template string and template arguments for the debug logging level.
 func Debugf(format string, args ...interface{}) {
 	Log.Debugf(format, args...)
 }
 
+// Debug logs the given arguments at the debug logging level.
 func Debug(args ...interface{}) {
 	Log.Debug(args...)
 }

internal/log/nop.go

@@ -3,6 +3,9 @@ package log
 type nopLogger struct{}
 
 func (l *nopLogger) Errorf(format string, args ...interface{}) {}
+func (l *nopLogger) Error(args ...interface{})                 {}
+func (l *nopLogger) Warnf(format string, args ...interface{})  {}
+func (l *nopLogger) Warn(args ...interface{})                  {}
 func (l *nopLogger) Infof(format string, args ...interface{})  {}
 func (l *nopLogger) Info(args ...interface{})                  {}
 func (l *nopLogger) Debugf(format string, args ...interface{}) {}

internal/logger/doc.go

@@ -0,0 +1,4 @@
+/*
+Package logger contains implementations for the syft.logger.Logger interface.
+*/
+package logger

internal/logger/logrus.go

@@ -0,0 +1,161 @@
+package logger
+
+import (
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+
+	"github.com/sirupsen/logrus"
+	prefixed "github.com/x-cray/logrus-prefixed-formatter"
+)
+
+// LogrusConfig contains all configurable values for the Logrus logger
+type LogrusConfig struct {
+	EnableConsole bool
+	EnableFile    bool
+	Structured    bool
+	Level         logrus.Level
+	FileLocation  string
+}
+
+// LogrusLogger contains all runtime values for using Logrus with the configured output target and input configuration values.
+type LogrusLogger struct {
+	Config LogrusConfig
+	Logger *logrus.Logger
+	Output io.Writer
+}
+
+// LogrusNestedLogger is a wrapper for Logrus to enable nested logging configuration (loggers that always attach key-value pairs to all log entries)
+type LogrusNestedLogger struct {
+	Logger *logrus.Entry
+}
+
+// NewLogrusLogger creates a new LogrusLogger with the given configuration
+func NewLogrusLogger(cfg LogrusConfig) *LogrusLogger {
+	appLogger := logrus.New()
+
+	var output io.Writer
+	switch {
+	case cfg.EnableConsole && cfg.EnableFile:
+		logFile, err := os.OpenFile(cfg.FileLocation, os.O_WRONLY|os.O_CREATE, 0755)
+		if err != nil {
+			panic(fmt.Errorf("unable to setup log file: %w", err))
+		}
+		output = io.MultiWriter(os.Stderr, logFile)
+	case cfg.EnableConsole:
+		output = os.Stderr
+	case cfg.EnableFile:
+		logFile, err := os.OpenFile(cfg.FileLocation, os.O_WRONLY|os.O_CREATE, 0755)
+		if err != nil {
+			panic(fmt.Errorf("unable to setup log file: %w", err))
+		}
+		output = logFile
+	default:
+		output = ioutil.Discard
+	}
+
+	appLogger.SetOutput(output)
+	appLogger.SetLevel(cfg.Level)
+
+	if cfg.Structured {
+		appLogger.SetFormatter(&logrus.JSONFormatter{
+			TimestampFormat:   "2006-01-02 15:04:05",
+			DisableTimestamp:  false,
+			DisableHTMLEscape: false,
+			PrettyPrint:       false,
+		})
+	} else {
+		appLogger.SetFormatter(&prefixed.TextFormatter{
+			TimestampFormat: "2006-01-02 15:04:05",
+			ForceColors:     true,
+			ForceFormatting: true,
+		})
+	}
+
+	return &LogrusLogger{
+		Config: cfg,
+		Logger: appLogger,
+		Output: output,
+	}
+}
+
+// Debugf takes a formatted template string and template arguments for the debug logging level.
+func (l *LogrusLogger) Debugf(format string, args ...interface{}) {
+	l.Logger.Debugf(format, args...)
+}
+
+// Infof takes a formatted template string and template arguments for the info logging level.
+func (l *LogrusLogger) Infof(format string, args ...interface{}) {
+	l.Logger.Infof(format, args...)
+}
+
+// Warnf takes a formatted template string and template arguments for the warning logging level.
+func (l *LogrusLogger) Warnf(format string, args ...interface{}) {
+	l.Logger.Warnf(format, args...)
+}
+
+// Errorf takes a formatted template string and template arguments for the error logging level.
+func (l *LogrusLogger) Errorf(format string, args ...interface{}) {
+	l.Logger.Errorf(format, args...)
+}
+
+// Debug logs the given arguments at the debug logging level.
+func (l *LogrusLogger) Debug(args ...interface{}) {
+	l.Logger.Debug(args...)
+}
+
+// Info logs the given arguments at the info logging level.
+func (l *LogrusLogger) Info(args ...interface{}) {
+	l.Logger.Info(args...)
+}
+
+// Warn logs the given arguments at the warning logging level.
+func (l *LogrusLogger) Warn(args ...interface{}) {
+	l.Logger.Warn(args...)
+}
+
+// Error logs the given arguments at the error logging level.
+func (l *LogrusLogger) Error(args ...interface{}) {
+	l.Logger.Error(args...)
+}
+
+// Debugf takes a formatted template string and template arguments for the debug logging level.
+func (l *LogrusNestedLogger) Debugf(format string, args ...interface{}) {
+	l.Logger.Debugf(format, args...)
+}
+
+// Infof takes a formatted template string and template arguments for the info logging level.
+func (l *LogrusNestedLogger) Infof(format string, args ...interface{}) {
+	l.Logger.Infof(format, args...)
+}
+
+// Warnf takes a formatted template string and template arguments for the warning logging level.
+func (l *LogrusNestedLogger) Warnf(format string, args ...interface{}) {
+	l.Logger.Warnf(format, args...)
+}
+
+// Errorf takes a formatted template string and template arguments for the error logging level.
+func (l *LogrusNestedLogger) Errorf(format string, args ...interface{}) {
+	l.Logger.Errorf(format, args...)
+}
+
+// Debug logs the given arguments at the debug logging level.
+func (l *LogrusNestedLogger) Debug(args ...interface{}) {
+	l.Logger.Debug(args...)
+}
+
+// Info logs the given arguments at the info logging level.
+func (l *LogrusNestedLogger) Info(args ...interface{}) {
+	l.Logger.Info(args...)
+}
+
+// Warn logs the given arguments at the warning logging level.
+func (l *LogrusNestedLogger) Warn(args ...interface{}) {
+	l.Logger.Warn(args...)
+}
+
+// Error logs the given arguments at the error logging level.
+func (l *LogrusNestedLogger) Error(args ...interface{}) {
+	l.Logger.Error(args...)
+}

internal/logger/zap.go

@@ -1,141 +0,0 @@
-package logger
-
-import (
-	"os"
-
-	"github.com/anchore/imgbom/internal/format"
-	"go.uber.org/zap"
-	"go.uber.org/zap/zapcore"
-)
-
-var levelToColor = map[zapcore.Level]format.Color{
-	zapcore.DebugLevel:  format.Magenta,
-	zapcore.InfoLevel:   format.Blue,
-	zapcore.WarnLevel:   format.Yellow,
-	zapcore.ErrorLevel:  format.Red,
-	zapcore.DPanicLevel: format.Red,
-	zapcore.PanicLevel:  format.Red,
-	zapcore.FatalLevel:  format.Red,
-}
-
-type LogConfig struct {
-	EnableConsole bool
-	EnableFile    bool
-	Structured    bool
-	Level         zapcore.Level
-	FileLocation  string
-}
-
-type ZapLogger struct {
-	Config LogConfig
-	Logger *zap.SugaredLogger
-}
-
-// TODO: Consider a human readable text encoder for better field handeling:
-// - https://github.com/uber-go/zap/issues/570
-// - https://github.com/uber-go/zap/pull/123
-// - TextEncoder w/ old interface: https://github.com/uber-go/zap/blob/6c2107996402d47d559199b78e1c44747fe732f9/text_encoder.go
-// - New interface example: https://github.com/uber-go/zap/blob/c2633d6de2d6e1170ad8f150660e3cf5310067c8/zapcore/json_encoder.go
-// - Register the encoder: https://github.com/uber-go/zap/blob/v1.15.0/encoder.go
-func NewZapLogger(config LogConfig) *ZapLogger {
-	appLogger := ZapLogger{
-		Config: config,
-	}
-	cores := []zapcore.Core{}
-
-	if config.EnableConsole {
-		// note: the report should go to stdout, all logs should go to stderr
-		writer := zapcore.Lock(os.Stderr)
-		core := zapcore.NewCore(appLogger.getConsoleEncoder(config), writer, config.Level)
-		cores = append(cores, core)
-	}
-
-	if config.EnableFile {
-		writer := zapcore.AddSync(appLogger.logFileWriter(config.FileLocation))
-		core := zapcore.NewCore(appLogger.fileEncoder(config), writer, config.Level)
-		cores = append(cores, core)
-	}
-
-	combinedCore := zapcore.NewTee(cores...)
-
-	// AddCallerSkip skips 2 number of callers, this is important else the file that gets
-	// logged will always be the wrapped file (In our case logger.go)
-	appLogger.Logger = zap.New(
-		combinedCore,
-		zap.AddCallerSkip(2),
-		zap.AddCaller(),
-	).Sugar()
-
-	return &appLogger
-}
-
-func (l *ZapLogger) GetNamedLogger(name string) *ZapLogger {
-	return &ZapLogger{
-		Logger: l.Logger.Named(name),
-	}
-}
-
-func (l *ZapLogger) getConsoleEncoder(config LogConfig) zapcore.Encoder {
-	encoderConfig := zap.NewProductionEncoderConfig()
-	if config.Structured {
-		encoderConfig.EncodeName = zapcore.FullNameEncoder
-		encoderConfig.EncodeCaller = zapcore.FullCallerEncoder
-		return zapcore.NewJSONEncoder(encoderConfig)
-	}
-	encoderConfig.EncodeTime = nil
-	encoderConfig.EncodeCaller = nil
-	encoderConfig.EncodeLevel = l.consoleLevelEncoder
-	encoderConfig.EncodeName = l.nameEncoder
-	return zapcore.NewConsoleEncoder(encoderConfig)
-}
-
-func (l *ZapLogger) nameEncoder(loggerName string, enc zapcore.PrimitiveArrayEncoder) {
-	enc.AppendString("[" + loggerName + "]")
-}
-
-func (l *ZapLogger) consoleLevelEncoder(level zapcore.Level, enc zapcore.PrimitiveArrayEncoder) {
-	if level != zapcore.InfoLevel || l.Config.Level == zapcore.DebugLevel {
-		color, ok := levelToColor[level]
-		if !ok {
-			enc.AppendString("[" + level.CapitalString() + "]")
-		} else {
-			enc.AppendString("[" + color.Format(level.CapitalString()) + "]")
-		}
-	}
-}
-
-func (l *ZapLogger) fileEncoder(config LogConfig) zapcore.Encoder {
-	encoderConfig := zap.NewProductionEncoderConfig()
-	encoderConfig.EncodeTime = zapcore.ISO8601TimeEncoder
-	encoderConfig.EncodeName = zapcore.FullNameEncoder
-	encoderConfig.EncodeCaller = zapcore.FullCallerEncoder
-	if config.Structured {
-		return zapcore.NewJSONEncoder(encoderConfig)
-	}
-	return zapcore.NewConsoleEncoder(encoderConfig)
-}
-
-func (l *ZapLogger) logFileWriter(location string) zapcore.WriteSyncer {
-	file, _ := os.Create(location)
-	return zapcore.AddSync(file)
-}
-
-func (l *ZapLogger) Debugf(format string, args ...interface{}) {
-	l.Logger.Debugf(format, args...)
-}
-
-func (l *ZapLogger) Infof(format string, args ...interface{}) {
-	l.Logger.Infof(format, args...)
-}
-
-func (l *ZapLogger) Debug(args ...interface{}) {
-	l.Logger.Debug(args...)
-}
-
-func (l *ZapLogger) Info(args ...interface{}) {
-	l.Logger.Info(args...)
-}
-
-func (l *ZapLogger) Errorf(format string, args ...interface{}) {
-	l.Logger.Errorf(format, args...)
-}

internal/parse.go

@@ -0,0 +1,15 @@
+package internal
+
+import "regexp"
+
+// MatchCaptureGroups takes a regular expression and string and returns all of the named capture group results in a map.
+func MatchCaptureGroups(regEx *regexp.Regexp, str string) map[string]string {
+	match := regEx.FindStringSubmatch(str)
+	results := make(map[string]string)
+	for i, name := range regEx.SubexpNames() {
+		if i > 0 && i <= len(match) {
+			results[name] = match[i]
+		}
+	}
+	return results
+}

internal/stringset.go

@@ -0,0 +1,48 @@
+package internal
+
+import "sort"
+
+// StringSet represents a set of string types.
+type StringSet map[string]struct{}
+
+// NewStringSet creates a new empty StringSet.
+func NewStringSet() StringSet {
+	return make(StringSet)
+}
+
+// NewStringSetFromSlice creates a StringSet populated with values from the given slice.
+func NewStringSetFromSlice(start []string) StringSet {
+	ret := make(StringSet)
+	for _, s := range start {
+		ret.Add(s)
+	}
+	return ret
+}
+
+// Add a string to the set.
+func (s StringSet) Add(i string) {
+	s[i] = struct{}{}
+}
+
+// Remove a string from the set.
+func (s StringSet) Remove(i string) {
+	delete(s, i)
+}
+
+// Contains indicates if the given string is contained within the set.
+func (s StringSet) Contains(i string) bool {
+	_, ok := s[i]
+	return ok
+}
+
+// ToSlice returns a sorted slice of strings that are contained within the set.
+func (s StringSet) ToSlice() []string {
+	ret := make([]string, len(s))
+	idx := 0
+	for v := range s {
+		ret[idx] = v
+		idx++
+	}
+	sort.Strings(ret)
+	return ret
+}

internal/ui/common/event_handlers.go

@@ -0,0 +1,24 @@
+package common
+
+import (
+	"fmt"
+	"os"
+
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+	"github.com/wagoodman/go-partybus"
+)
+
+// CatalogerFinishedHandler is a UI function for processing the CatalogerFinished bus event, displaying the catalog
+// via the given presenter to stdout.
+func CatalogerFinishedHandler(event partybus.Event) error {
+	// show the report to stdout
+	pres, err := syftEventParsers.ParseCatalogerFinished(event)
+	if err != nil {
+		return fmt.Errorf("bad CatalogerFinished event: %w", err)
+	}
+
+	if err := pres.Present(os.Stdout); err != nil {
+		return fmt.Errorf("unable to show package catalog report: %w", err)
+	}
+	return nil
+}

internal/ui/common/spinner.go

@@ -0,0 +1,72 @@
+package common
+
+import (
+	"strings"
+	"sync"
+)
+
+// TODO: move me to a common module (used in multiple repos)
+
+const (
+	SpinnerCircleOutlineSet = "◜◠◯◎◉●◉◎◯◡◞"
+	SpinnerCircleSet        = "◌◯◎◉●◉◎◯"
+	SpinnerDotSet           = "⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏"
+	SpinnerHorizontalBarSet = "▉▊▋▌▍▎▏▎▍▌▋▊▉"
+	SpinnerVerticalBarSet   = "▁▃▄▅▆▇█▇▆▅▄▃▁"
+	SpinnerDoubleBarSet     = "▁▂▃▄▅▆▇█▉▊▋▌▍▎▏▏▎▍▌▋▊▉█▇▆▅▄▃▂▁"
+	SpinnerArrowSet         = "←↖↑↗→↘↓↙"
+)
+
+var SpinnerCircleDotSet = []string{
+	"⠈⠁",
+	"⠈⠑",
+	"⠈⠱",
+	"⠈⡱",
+	"⢀⡱",
+	"⢄⡱",
+	"⢄⡱",
+	"⢆⡱",
+	"⢎⡱",
+	"⢎⡰",
+	"⢎⡠",
+	"⢎⡀",
+	"⢎⠁",
+	"⠎⠁",
+	"⠊⠁",
+}
+
+type Spinner struct {
+	index   int
+	charset []string
+	lock    sync.Mutex
+}
+
+func NewSpinner(charset string) Spinner {
+	return Spinner{
+		charset: strings.Split(charset, ""),
+	}
+}
+
+func NewSpinnerFromSlice(charset []string) Spinner {
+	return Spinner{
+		charset: charset,
+	}
+}
+
+func (s *Spinner) Current() string {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	return s.charset[s.index]
+}
+
+func (s *Spinner) Next() string {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+	c := s.charset[s.index]
+	s.index++
+	if s.index >= len(s.charset) {
+		s.index = 0
+	}
+	return c
+}

internal/ui/etui/ephemeral_tui.go

@@ -0,0 +1,180 @@
+/*
+Package etui provides an "ephemeral" terminal user interface to display the application state dynamically.
+The terminal is placed into raw mode and the cursor is manipulated to allow for a dynamic, multi-line
+UI (provided by the jotframe lib), for this reason all other application mechanisms that write to the screen
+must be suppressed before starting (such as logs); since bytes in the device and in application memory combine to make
+a shared state, bytes coming from elsewhere to the screen will disrupt this state.
+
+This UI is primarily driven off of events from the event bus, creating single-line terminal widgets to represent a
+published element on the event bus, typically polling the element for the latest state. This allows for the UI to
+control update frequency to the screen, provide "liveness" indications that are interpolated between bus events,
+and overall loosely couple the bus events from screen interactions.
+
+By convention, all elements published on the bus should be treated as read-only, and publishers on the bus should
+attempt to enforce this when possible by wrapping complex objects with interfaces to prescribe interactions. Also by
+convention, each new event that the UI should respond to should be added either in this package as a handler function,
+or in the shared ui package as a function on the main handler object. All handler functions should be completed
+processing an event before the ETUI exits (coordinated with a sync.WaitGroup)
+*/
+package etui
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"os"
+	"os/signal"
+	"sync"
+	"syscall"
+
+	"github.com/anchore/syft/internal/logger"
+
+	"github.com/anchore/syft/internal/ui/common"
+	"github.com/anchore/syft/ui"
+
+	"github.com/anchore/syft/internal/log"
+	syftEvent "github.com/anchore/syft/syft/event"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/jotframe/pkg/frame"
+)
+
+// TODO: specify per-platform implementations with build tags (needed when windows is supported by syft)
+
+// setupScreen creates a new jotframe object to manage specific screen lines dynamically, preparing the screen device
+// as needed (i.e. setting the terminal to raw mode).
+func setupScreen(output *os.File) *frame.Frame {
+	config := frame.Config{
+		PositionPolicy: frame.PolicyFloatForward,
+		// only report output to stderr, reserve report output for stdout
+		Output: output,
+	}
+
+	fr, err := frame.New(config)
+	if err != nil {
+		log.Errorf("failed to create screen object: %+v", err)
+		return nil
+	}
+	return fr
+}
+
+// nolint:funlen,gocognit
+// OutputToEphemeralTUI is a UI function that provides a terminal UI experience without a separate, in-application
+// screen buffer. All logging is suppressed, buffered to a string, and output after the ETUI has been torn down.
+func OutputToEphemeralTUI(workerErrs <-chan error, subscription *partybus.Subscription) error {
+	output := os.Stderr
+
+	// prep the logger to not clobber the screen from now on (logrus only)
+	logBuffer := bytes.NewBufferString("")
+	logWrapper, ok := log.Log.(*logger.LogrusLogger)
+	if ok {
+		logWrapper.Logger.SetOutput(logBuffer)
+	}
+
+	// hide cursor
+	_, _ = fmt.Fprint(output, "\x1b[?25l")
+	// show cursor
+	defer fmt.Fprint(output, "\x1b[?25h")
+
+	fr := setupScreen(output)
+	if fr == nil {
+		return fmt.Errorf("unable to setup screen")
+	}
+	var isClosed bool
+	defer func() {
+		if !isClosed {
+			fr.Close()
+			frame.Close()
+			// flush any errors to the screen before the report
+			logWrapper, ok := log.Log.(*logger.LogrusLogger)
+			if ok {
+				fmt.Fprint(logWrapper.Output, logBuffer.String())
+			} else {
+				fmt.Fprint(output, logBuffer.String())
+			}
+		}
+		logWrapper, ok := log.Log.(*logger.LogrusLogger)
+		if ok {
+			logWrapper.Logger.SetOutput(output)
+		}
+	}()
+
+	var err error
+	var wg = &sync.WaitGroup{}
+	events := subscription.Events()
+	ctx := context.Background()
+	syftUIHandler := ui.NewHandler()
+
+	signals := interruptingSignals()
+
+eventLoop:
+	for {
+		select {
+		case err := <-workerErrs:
+			// TODO: we should show errors more explicitly in the ETUI
+			if err != nil {
+				return err
+			}
+		case e, ok := <-events:
+			if !ok {
+				break eventLoop
+			}
+			switch {
+			case syftUIHandler.RespondsTo(e):
+				if err = syftUIHandler.Handle(ctx, fr, e, wg); err != nil {
+					log.Errorf("unable to show %s event: %+v", e.Type, err)
+				}
+
+			case e.Type == syftEvent.AppUpdateAvailable:
+				if err = appUpdateAvailableHandler(ctx, fr, e, wg); err != nil {
+					log.Errorf("unable to show %s event: %+v", e.Type, err)
+				}
+
+			case e.Type == syftEvent.CatalogerFinished:
+				// we may have other background processes still displaying progress, wait for them to
+				// finish before discontinuing dynamic content and showing the final report
+				wg.Wait()
+				fr.Close()
+				// TODO: there is a race condition within frame.Close() that sometimes leads to an extra blank line being output
+				frame.Close()
+				isClosed = true
+
+				// flush any errors to the screen before the report
+				logWrapper, ok := log.Log.(*logger.LogrusLogger)
+				if ok {
+					fmt.Fprint(logWrapper.Output, logBuffer.String())
+				} else {
+					fmt.Fprint(output, logBuffer.String())
+				}
+
+				if err := common.CatalogerFinishedHandler(e); err != nil {
+					log.Errorf("unable to show %s event: %+v", e.Type, err)
+				}
+
+				// this is the last expected event
+				break eventLoop
+			}
+		case <-ctx.Done():
+			if ctx.Err() != nil {
+				log.Errorf("cancelled (%+v)", err)
+			}
+			break eventLoop
+		case <-signals:
+			break eventLoop
+		}
+	}
+
+	return nil
+}
+
+func interruptingSignals() chan os.Signal {
+	c := make(chan os.Signal, 1) // Note: A buffered channel is recommended for this; see https://golang.org/pkg/os/signal/#Notify
+
+	interruptions := []os.Signal{
+		syscall.SIGINT,
+		syscall.SIGTERM,
+	}
+
+	signal.Notify(c, interruptions...)
+
+	return c
+}

internal/ui/etui/internal_event_handlers.go

@@ -0,0 +1,32 @@
+package etui
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"sync"
+
+	"github.com/anchore/syft/internal"
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+	"github.com/gookit/color"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/jotframe/pkg/frame"
+)
+
+// appUpdateAvailableHandler is a UI handler function to display a new application version to the top of the screen.
+func appUpdateAvailableHandler(_ context.Context, fr *frame.Frame, event partybus.Event, _ *sync.WaitGroup) error {
+	newVersion, err := syftEventParsers.ParseAppUpdateAvailable(event)
+	if err != nil {
+		return fmt.Errorf("bad AppUpdateAvailable event: %w", err)
+	}
+
+	line, err := fr.Prepend()
+	if err != nil {
+		return err
+	}
+
+	message := color.Magenta.Sprintf("New version of %s is available: %s", internal.ApplicationName, newVersion)
+	_, _ = io.WriteString(line, message)
+
+	return nil
+}

internal/ui/logger_output.go

@@ -0,0 +1,40 @@
+package ui
+
+import (
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/ui/common"
+	syftEvent "github.com/anchore/syft/syft/event"
+	"github.com/wagoodman/go-partybus"
+)
+
+// LoggerUI is a UI function that leverages the displays all application logs to the screen.
+func LoggerUI(workerErrs <-chan error, subscription *partybus.Subscription) error {
+	events := subscription.Events()
+eventLoop:
+	for {
+		select {
+		case err := <-workerErrs:
+			if err != nil {
+				return err
+			}
+		case e, ok := <-events:
+			if !ok {
+				// event bus closed...
+				break eventLoop
+			}
+
+			// ignore all events except for the final event
+			if e.Type == syftEvent.CatalogerFinished {
+				err := common.CatalogerFinishedHandler(e)
+				if err != nil {
+					log.Errorf("unable to show catalog image finished event: %+v", err)
+				}
+
+				// this is the last expected event
+				break eventLoop
+			}
+		}
+	}
+
+	return nil
+}

internal/ui/select.go

@@ -0,0 +1,30 @@
+package ui
+
+import (
+	"os"
+	"runtime"
+
+	"github.com/anchore/syft/internal/ui/etui"
+	"golang.org/x/crypto/ssh/terminal"
+)
+
+// TODO: build tags to exclude options from windows
+
+// Select is responsible for determining the specific UI function given select user option, the current platform
+// config values, and environment status (such as a TTY being present).
+func Select(verbose, quiet bool) UI {
+	var ui UI
+
+	isStdoutATty := terminal.IsTerminal(int(os.Stdout.Fd()))
+	isStderrATty := terminal.IsTerminal(int(os.Stderr.Fd()))
+	notATerminal := !isStderrATty && !isStdoutATty
+
+	switch {
+	case runtime.GOOS == "windows" || verbose || quiet || notATerminal || !isStderrATty:
+		ui = LoggerUI
+	default:
+		ui = etui.OutputToEphemeralTUI
+	}
+
+	return ui
+}

internal/ui/ui.go

@@ -0,0 +1,9 @@
+package ui
+
+import (
+	"github.com/wagoodman/go-partybus"
+)
+
+// UI is a function that takes a channel of errors from the main() worker and a event bus subscription and is
+// responsible for displaying pertinent events to the user, on the screen or otherwise.
+type UI func(<-chan error, *partybus.Subscription) error

internal/version/build.go

@@ -0,0 +1,42 @@
+/*
+Package version contains all build time metadata (version, build time, git commit, etc).
+*/
+package version
+
+import (
+	"fmt"
+	"runtime"
+)
+
+const valueNotProvided = "[not provided]"
+
+// all variables here are provided as build-time arguments, with clear default values
+var version = valueNotProvided
+var gitCommit = valueNotProvided
+var gitTreeState = valueNotProvided
+var buildDate = valueNotProvided
+var platform = fmt.Sprintf("%s/%s", runtime.GOOS, runtime.GOARCH)
+
+// Version defines the application version details (generally from build information)
+type Version struct {
+	Version      string `json:"version"`      // application semantic version
+	GitCommit    string `json:"gitCommit"`    // git SHA at build-time
+	GitTreeState string `json:"gitTreeState"` // indication of git tree (either "clean" or "dirty") at build-time
+	BuildDate    string `json:"buildDate"`    // date of the build
+	GoVersion    string `json:"goVersion"`    // go runtime version at build-time
+	Compiler     string `json:"compiler"`     // compiler used at build-time
+	Platform     string `json:"platform"`     // GOOS and GOARCH at build-time
+}
+
+// FromBuild provides all version details
+func FromBuild() Version {
+	return Version{
+		Version:      version,
+		GitCommit:    gitCommit,
+		GitTreeState: gitTreeState,
+		BuildDate:    buildDate,
+		GoVersion:    runtime.Version(),
+		Compiler:     runtime.Compiler,
+		Platform:     platform,
+	}
+}

internal/version/update.go

@@ -0,0 +1,73 @@
+package version
+
+import (
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"strings"
+
+	hashiVersion "github.com/anchore/go-version"
+	"github.com/anchore/syft/internal"
+)
+
+var latestAppVersionURL = struct {
+	host string
+	path string
+}{
+	host: "https://toolbox-data.anchore.io",
+	path: fmt.Sprintf("/%s/releases/latest/VERSION", internal.ApplicationName),
+}
+
+// IsUpdateAvailable indicates if there is a newer application version available, and if so, what the new version is.
+func IsUpdateAvailable() (bool, string, error) {
+	currentVersionStr := FromBuild().Version
+	currentVersion, err := hashiVersion.NewVersion(currentVersionStr)
+	if err != nil {
+		if currentVersionStr == valueNotProvided {
+			// this is the default build arg and should be ignored (this is not an error case)
+			return false, "", nil
+		}
+		return false, "", fmt.Errorf("failed to parse current application version: %w", err)
+	}
+
+	latestVersion, err := fetchLatestApplicationVersion()
+	if err != nil {
+		return false, "", err
+	}
+
+	if latestVersion.GreaterThan(currentVersion) {
+		return true, latestVersion.String(), nil
+	}
+
+	return false, "", nil
+}
+
+func fetchLatestApplicationVersion() (*hashiVersion.Version, error) {
+	req, err := http.NewRequest(http.MethodGet, latestAppVersionURL.host+latestAppVersionURL.path, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request for latest version: %w", err)
+	}
+
+	client := http.Client{}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to fetch latest version: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("HTTP %d on fetching latest version: %s", resp.StatusCode, resp.Status)
+	}
+
+	versionBytes, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read latest version: %w", err)
+	}
+
+	versionStr := strings.TrimSuffix(string(versionBytes), "\n")
+	if len(versionStr) > 50 {
+		return nil, fmt.Errorf("version too long: %q", versionStr[:50])
+	}
+
+	return hashiVersion.NewVersion(versionStr)
+}

internal/version/update_test.go

@@ -0,0 +1,209 @@
+package version
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	hashiVersion "github.com/anchore/go-version"
+)
+
+func TestIsUpdateAvailable(t *testing.T) {
+	tests := []struct {
+		name          string
+		buildVersion  string
+		latestVersion string
+		code          int
+		isAvailable   bool
+		newVersion    string
+		err           bool
+	}{
+		{
+			name:          "equal",
+			buildVersion:  "1.0.0",
+			latestVersion: "1.0.0",
+			code:          200,
+			isAvailable:   false,
+			newVersion:    "",
+			err:           false,
+		},
+		{
+			name:          "hasUpdate",
+			buildVersion:  "1.0.0",
+			latestVersion: "1.2.0",
+			code:          200,
+			isAvailable:   true,
+			newVersion:    "1.2.0",
+			err:           false,
+		},
+		{
+			name:          "aheadOfLatest",
+			buildVersion:  "1.2.0",
+			latestVersion: "1.0.0",
+			code:          200,
+			isAvailable:   false,
+			newVersion:    "",
+			err:           false,
+		},
+		{
+			name:          "EmptyUpdate",
+			buildVersion:  "1.0.0",
+			latestVersion: "",
+			code:          200,
+			isAvailable:   false,
+			newVersion:    "",
+			err:           true,
+		},
+		{
+			name:          "GarbageUpdate",
+			buildVersion:  "1.0.0",
+			latestVersion: "hdfjksdhfhkj",
+			code:          200,
+			isAvailable:   false,
+			newVersion:    "",
+			err:           true,
+		},
+		{
+			name:          "BadUpdate",
+			buildVersion:  "1.0.0",
+			latestVersion: "1.0.",
+			code:          500,
+			isAvailable:   false,
+			newVersion:    "",
+			err:           true,
+		},
+		{
+			name:          "NoBuildVersion",
+			buildVersion:  valueNotProvided,
+			latestVersion: "1.0.0",
+			code:          200,
+			isAvailable:   false,
+			newVersion:    "",
+			err:           false,
+		},
+		{
+			name:          "BadUpdateValidVersion",
+			buildVersion:  "1.0.0",
+			latestVersion: "2.0.0",
+			code:          404,
+			isAvailable:   false,
+			newVersion:    "",
+			err:           true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			// setup mocks
+			// local...
+			version = test.buildVersion
+			// remote...
+			handler := http.NewServeMux()
+			handler.HandleFunc(latestAppVersionURL.path, func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(test.code)
+				_, _ = w.Write([]byte(test.latestVersion))
+			})
+			mockSrv := httptest.NewServer(handler)
+			latestAppVersionURL.host = mockSrv.URL
+			defer mockSrv.Close()
+
+			isAvailable, newVersion, err := IsUpdateAvailable()
+			if err != nil && !test.err {
+				t.Fatalf("got error but expected none: %+v", err)
+			} else if err == nil && test.err {
+				t.Fatalf("expected error but got none")
+			}
+
+			if newVersion != test.newVersion {
+				t.Errorf("unexpected NEW version: %+v", newVersion)
+			}
+
+			if isAvailable != test.isAvailable {
+				t.Errorf("unexpected result: %+v", isAvailable)
+			}
+		})
+	}
+
+}
+
+func TestFetchLatestApplicationVersion(t *testing.T) {
+	tests := []struct {
+		name     string
+		response string
+		code     int
+		err      bool
+		expected *hashiVersion.Version
+	}{
+		{
+			name:     "gocase",
+			response: "1.0.0",
+			code:     200,
+			expected: hashiVersion.Must(hashiVersion.NewVersion("1.0.0")),
+		},
+		{
+			name:     "garbage",
+			response: "garbage",
+			code:     200,
+			expected: nil,
+			err:      true,
+		},
+		{
+			name:     "http 500",
+			response: "1.0.0",
+			code:     500,
+			expected: nil,
+			err:      true,
+		},
+		{
+			name:     "http 404",
+			response: "1.0.0",
+			code:     404,
+			expected: nil,
+			err:      true,
+		},
+		{
+			name:     "empty",
+			response: "",
+			code:     200,
+			expected: nil,
+			err:      true,
+		},
+		{
+			name:     "too long",
+			response: "this is really long this is really long this is really long this is really long this is really long this is really long this is really long this is really long ",
+			code:     200,
+			expected: nil,
+			err:      true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			// setup mock
+			handler := http.NewServeMux()
+			handler.HandleFunc(latestAppVersionURL.path, func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(test.code)
+				_, _ = w.Write([]byte(test.response))
+			})
+			mockSrv := httptest.NewServer(handler)
+			latestAppVersionURL.host = mockSrv.URL
+			defer mockSrv.Close()
+
+			actual, err := fetchLatestApplicationVersion()
+			if err != nil && !test.err {
+				t.Fatalf("got error but expected none: %+v", err)
+			} else if err == nil && test.err {
+				t.Fatalf("expected error but got none")
+			}
+
+			if err != nil {
+				return
+			}
+
+			if actual.String() != test.expected.String() {
+				t.Errorf("unexpected version: %+v", actual.String())
+			}
+		})
+	}
+
+}

main.go

@@ -1,21 +1,14 @@
+/*
+Syft is a CLI tool and go library for generating a Software Bill of Materials (SBOM) from container images and filesystems.
+
+Note that Syft is both a command line tool as well as a library. See the syft/ child package for library functionality.
+*/
 package main
 
 import (
-	"github.com/anchore/imgbom/cmd"
-)
-
-var (
-	version   = "No version provided"
-	commit    = "No commit provided"
-	buildTime = "No build timestamp provided"
+	"github.com/anchore/syft/cmd"
 )
 
 func main() {
-	cmd.SetVersion(&cmd.Version{
-		Version:   version,
-		Commit:    commit,
-		BuildTime: buildTime,
-	})
-
 	cmd.Execute()
 }

schema/cyclonedx/.gitignore

@@ -0,0 +1 @@
+bom.xml

schema/cyclonedx/Makefile

@@ -0,0 +1,5 @@
+.DEFAULT_GOAL := validate-schema
+.PHONY: validate-schema
+validate-schema:
+	go run ../../main.go ubuntu:latest -vv -o cyclonedx > bom.xml
+	xmllint --noout --schema ./cyclonedx.xsd bom.xml

schema/cyclonedx/README.md

@@ -0,0 +1,7 @@
+# CycloneDX Schemas
+
+`syft` generates a CycloneDX BOm output. We want to be able to validate the CycloneDX schemas
+(and dependent schemas) against generated syft output. The best way to do this is with `xmllint`,
+however, this tool does not know how to deal with references from HTTP, only the local filesystem.
+For this reason we've included a copy of all schemas needed to validate `syft` output, modified
+to reference local copies of dependent schemas.