Merge remote-tracking branch 'origin/main' into add-go-symbol-extract

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

.binny.yaml

@@ -1,13 +1,8 @@
-# only pull in version updates that were released more than a week ago (low-pass filter for quickly-retracted releases)
-cooldown: 7d
-
 tools:
-  ## internal tools ############################################################################
-
   # we want to use a pinned version of binny to manage the toolchain (so binny manages itself!)
   - name: binny
     version:
-      want: v0.13.0
+      want: v0.11.0
     method: github-release
     with:
       repo: anchore/binny
@@ -15,7 +10,7 @@ tools:
   # used to produce SBOMs during release
   - name: syft
     version:
-      want: v1.42.3
+      want: latest
     method: github-release
     with:
       repo: anchore/syft
@@ -23,25 +18,15 @@ tools:
   # used to sign mac binaries at release
   - name: quill
     version:
-      want: v0.7.1
+      want: v0.5.1
     method: github-release
     with:
       repo: anchore/quill
 
-  # used at release to generate the changelog
-  - name: chronicle
-    version:
-      want: v0.8.0
-    method: github-release
-    with:
-      repo: anchore/chronicle
-
-  ## external tools ############################################################################
-
   # used for linting
   - name: golangci-lint
     version:
-      want: v2.11.4
+      want: v2.7.2
     method: github-release
     with:
       repo: golangci/golangci-lint
@@ -57,7 +42,7 @@ tools:
   # used for signing the checksums file at release
   - name: cosign
     version:
-      want: v3.0.5
+      want: v3.0.3
     method: github-release
     with:
       repo: sigstore/cosign
@@ -73,7 +58,7 @@ tools:
   # used to release all artifacts
   - name: goreleaser
     version:
-      want: v2.15.2
+      want: v2.13.1
     method: github-release
     with:
       repo: goreleaser/goreleaser
@@ -86,6 +71,14 @@ tools:
     with:
       repo: rinchsan/gosimports
 
+  # used at release to generate the changelog
+  - name: chronicle
+    version:
+      want: v0.8.0
+    method: github-release
+    with:
+      repo: anchore/chronicle
+
   # used during static analysis for license compliance
   - name: bouncer
     version:
@@ -97,7 +90,7 @@ tools:
   # used for running all local and CI tasks
   - name: task
     version:
-      want: v3.49.1
+      want: v3.45.5
     method: github-release
     with:
       repo: go-task/task
@@ -105,7 +98,7 @@ tools:
   # used for triggering a release
   - name: gh
     version:
-      want: v2.89.0
+      want: v2.83.2
     method: github-release
     with:
       repo: cli/cli
@@ -113,7 +106,7 @@ tools:
   # used to upload test fixture cache
   - name: oras
     version:
-      want: v1.3.1
+      want: v1.3.0
     method: github-release
     with:
       repo: oras-project/oras
@@ -121,7 +114,7 @@ tools:
   # used to upload test fixture cache
   - name: yq
     version:
-      want: v4.52.5
+      want: v4.50.1
     method: github-release
     with:
       repo: mikefarah/yq

.github/actions/bootstrap/action.yaml

@@ -1,10 +1,11 @@
 name: "Bootstrap"
+
 description: "Bootstrap all tools and dependencies"
 inputs:
   go-version:
     description: "Go version to install"
     required: true
-    default: "1.26.2"
+    default: ">= 1.24"
   go-dependencies:
     description: "Download go dependencies"
     required: true
@@ -12,7 +13,7 @@ inputs:
   cache-key-prefix:
     description: "Prefix all cache keys with this value"
     required: true
-    default: "53ac821810"
+    default: "181053ac82"
   download-test-fixture-cache:
     description: "Download test fixture cache from OCI and github actions"
     required: true
@@ -23,33 +24,34 @@ inputs:
   bootstrap-apt-packages:
     description: "Space delimited list of tools to install via apt"
     default: "libxml2-utils"
+
 runs:
   using: "composite"
   steps:
     # note: go mod and build is automatically cached on default with v4+
-    - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+    - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
       if: inputs.go-version != ''
       with:
         go-version: ${{ inputs.go-version }}
-        check-latest: true
+
     - name: Restore tool cache
       if: inputs.tools == 'true'
       id: tool-cache
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       with:
         path: ${{ github.workspace }}/.tool
         key: ${{ inputs.cache-key-prefix }}-${{ runner.os }}-tool-${{ hashFiles('.binny.yaml') }}
+
     - name: Install project tools
       shell: bash
       if: inputs.tools == 'true'
-      run: |
-        make tools
-        .tool/binny list
-        .tool/binny check
+      run: make tools
+
     - name: Install go dependencies
       if: inputs.go-dependencies == 'true'
       shell: bash
       run: make ci-bootstrap-go
+
     - name: Install apt packages
       if: inputs.bootstrap-apt-packages != ''
       shell: bash
@@ -58,12 +60,14 @@ runs:
       run: |
         IFS=' ' read -ra packages <<< "$APT_PACKAGES"
         DEBIAN_FRONTEND=noninteractive sudo apt update && sudo -E apt install -y "${packages[@]}"
+
     - name: Restore ORAS cache from github actions
       if: inputs.download-test-fixture-cache == 'true'
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       with:
         path: ${{ github.workspace }}/.tmp/oras-cache
         key: ${{ inputs.cache-key-prefix }}-oras-cache
+
     - name: Download test fixture cache
       if: inputs.download-test-fixture-cache == 'true'
       shell: bash

.github/dependabot.yml

@@ -1,59 +1,27 @@
-# Dependabot configuration
-#
-# Grouping behavior (see inline comments for details):
-#   - Minor + patch updates: grouped into a single PR per ecosystem
-#   - Major version bumps: individual PR per dependency
-#   - Security updates: individual PR per dependency
-#
-# Note: "patch" refers to semver version bumps (1.2.3 -> 1.2.4), not security fixes.
-# Security updates are identified separately via GitHub's Advisory Database and
-# can be any version bump (patch, minor, or major) that fixes a known CVE.
-
 version: 2
 
 updates:
 
   - package-ecosystem: gomod
     directory: "/"
-    cooldown:
-      default-days: 7
     schedule:
-      interval: "weekly"
-      day: "friday"
+      interval: "daily"
     open-pull-requests-limit: 10
     labels:
       - "dependencies"
-    ignore:
-      - dependency-name: "github.com/aquasecurity/go-pep440-version"
-      - dependency-name: "github.com/aquasecurity/go-version"
-      - dependency-name: "github.com/knqyf263/go-apk-version"
-      - dependency-name: "github.com/knqyf263/go-deb-version"
-    groups:
-      go-minor-patch:
-        applies-to: version-updates  # security updates get individual PRs
-        patterns:
-          - "*"
-        update-types:  # major omitted, gets individual PRs
-          - "minor"
-          - "patch"
 
   - package-ecosystem: "github-actions"
-    directories:
-      - "/"
-      - "/.github/actions/*"
-    cooldown:
-      default-days: 7
+    directory: "/"
     schedule:
-      interval: "weekly"
-      day: "friday"
+      interval: "daily"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+
+  - package-ecosystem: "github-actions"
+    directory: "/.github/actions/bootstrap"
+    schedule:
+      interval: "daily"
     open-pull-requests-limit: 10
     labels:
       - "dependencies"
-    groups:
-      actions-minor-patch:
-        applies-to: version-updates  # security updates get individual PRs
-        patterns:
-          - "*"
-        update-types:  # major omitted, gets individual PRs
-          - "minor"
-          - "patch"

.github/scripts/capability-drift-check.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-set -u
-
-if [ "$(git status --porcelain | wc -l)" -ne "0" ]; then
-  echo "  🔴 there are uncommitted changes, please commit them before running this check"
-  exit 1
-fi
-
-if ! make generate-capabilities REFRESH=false; then
-  echo "Generating capability descriptions failed"
-  exit 1
-fi
-
-if [ "$(git status --porcelain | wc -l)" -ne "0" ]; then
-  echo "  🔴 there is drift in capability descriptions! Please run 'make generate-capabilities' and commit the changes."
-  exit 1
-fi

.github/scripts/fingerprint_docker_fixtures.py

@@ -33,9 +33,9 @@ def is_git_tracked_or_untracked(directory):
 
 
 def find_test_fixture_dirs_with_images(base_dir):
-    """Find directories that contain 'testdata' and at least one 'image-*' directory."""
+    """Find directories that contain 'test-fixtures' and at least one 'image-*' directory."""
     for root, dirs, files in os.walk(base_dir):
-        if 'testdata' in root:
+        if 'test-fixtures' in root:
             image_dirs = [d for d in dirs if d.startswith('image-')]
             if image_dirs:
                 yield os.path.realpath(root)

.github/scripts/json-schema-drift-check.sh

@@ -12,6 +12,6 @@ if ! make generate-json-schema; then
 fi
 
 if [ "$(git status --porcelain | wc -l)" -ne "0" ]; then
-  echo "  🔴 there is drift in json schema! Please run 'make generate-json-schema' and commit the changes."
+  echo "  🔴 there are uncommitted changes, please commit them before running this check"
   exit 1
 fi

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,75 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+name: "CodeQL Security Scan"
+
+on:
+  push:
+    branches:
+      # only run when there are pushes to the main branch (not on PRs)
+      - main
+
+  schedule:
+    - cron: '0 0 * * 3'
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-22.04-4core-16gb
+    if: github.repository == 'anchore/syft' # only run for main repo
+    permissions:
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # Override automatic language detection by changing the below list
+        # Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
+        language: ['go', 'python']
+        # Learn more...
+        # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+      with:
+        persist-credentials: false
+
+    - name: Install Go
+      uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c #v6.1.0
+      with:
+        go-version-file: go.mod
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 #v3.29.5
+      with:
+        languages: ${{ matrix.language }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file. 
+        # Prefix the list here with "+" to use these queries and those in the config file.
+        # queries: ./path/to/local/query, your-org/your-repo/queries@main
+
+    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 #v3.29.5
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 https://git.io/JvXDl
+
+    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+    #    and modify them (or add more) to build your code if your project
+    #    uses a compiled language
+
+    #- run: |
+    #   make bootstrap
+    #   make release
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 #v3.29.5

.github/workflows/codeql.yaml

@@ -1,21 +0,0 @@
-name: "CodeQL"
-
-on:
-  push:
-    branches: [ "main" ]
-  pull_request:
-    branches: [ "main" ]
-  schedule:
-    - cron: '38 11 * * 3'
-
-permissions: {}
-
-jobs:
-  analyze:
-    name: Analyze
-    uses: anchore/workflows/.github/workflows/codeql.yaml@e8cee3a5916cebb68cda68b54c180f43394c1910 # v0.5.0
-    permissions:
-      security-events: write
-      packages: read
-      actions: read
-      contents: read

.github/workflows/dependabot-automation.yaml

@@ -0,0 +1,10 @@
+name: Dependabot Automation
+on:
+  pull_request:
+
+permissions:
+  pull-requests: write
+
+jobs:
+  run:
+    uses: anchore/workflows/.github/workflows/dependabot-automation.yaml@main

.github/workflows/detect-schema-changes.yaml

@@ -0,0 +1,60 @@
+name: "Detect schema changes"
+
+on:
+  # IMPORTANT! This workflow is triggered by the `pull_request_target` event
+  # which means that forked PRs will run with access secrets from the repo
+  # it's forked from (the "target" repo).
+  #
+  # For this reason we only NEVER checkout the code from the pull request
+  # (e.g. "ref: ${{ github.event.pull_request.head.sha }}") to prevent
+  # accidentally running potentially untrusted code.
+  #
+  # By default the checkout will be:
+  #   - GITHUB_SHA: Last commit on the PR base branch
+  #   - GITHUB_REF: PR base branch
+  #
+  # ...unlike a typical PR where:
+  #   - GITHUB_SHA: Last merge commit on the GITHUB_REF branch
+  #   - GITHUB_REF: PR merge branch refs/pull/:prNumber/merge
+  pull_request_target:
+
+env:
+  # note: this is used within hashFiles() so must be within the GITHUB_WORKSPACE path (or will silently fail)
+  CI_COMMENT_FILE: .tmp/labeler-comment.txt
+  # needs to be any string to uniquely identify the comment on a PR across multiple runs
+  COMMENT_HEADER: "label-commentary"
+
+jobs:
+  label:
+    name: "Label changes"
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
+    steps:
+
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+        with:
+          persist-credentials: false
+
+      - run: python .github/scripts/labeler.py
+        env:
+          # note: this token has write access to the repo
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_PR_NUMBER: ${{ github.event.number }}
+
+      - name: Delete existing comment
+        if: ${{ hashFiles( env.CI_COMMENT_FILE ) == '' }}
+        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 #v2.9.4
+        with:
+          header: ${{ env.COMMENT_HEADER }}
+          hide: true
+          hide_classify: "OUTDATED"
+
+      - name: Add comment
+        if: ${{ hashFiles( env.CI_COMMENT_FILE ) != '' }}
+        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 #v2.9.4
+        with:
+          header: ${{ env.COMMENT_HEADER }}
+          path: ${{ env.CI_COMMENT_FILE }}

.github/workflows/oss-project-board-add.yaml

@@ -0,0 +1,18 @@
+name: Add to OSS board
+
+permissions:
+  contents: read
+
+on:
+  issues:
+    types:
+      - opened
+      - reopened
+      - transferred
+      - labeled
+
+jobs:
+  run:
+    uses: "anchore/workflows/.github/workflows/oss-project-board-add.yaml@main"
+    secrets:
+      token: ${{ secrets.OSS_PROJECT_GH_TOKEN }}

.github/workflows/release.yaml

@@ -1,11 +1,7 @@
 name: "Release"
 
-permissions: {}
-
-# there should never be two releases in progress at the same time
-concurrency:
-  group: release
-  cancel-in-progress: false
+permissions:
+  contents: read
 
 on:
   workflow_dispatch:
@@ -23,40 +19,124 @@ on:
           - "install-script-only"
 
 jobs:
-
-  version-available:
+  quality-gate:
+    environment: release
+    runs-on: ubuntu-24.04
     if: ${{ github.event.inputs.phase == 'all' }}
-    uses: anchore/workflows/.github/workflows/check-version-available.yaml@8b2b1caf40e03933c6807e03b99e883e2ceb5ac8 # v0.4.0
-    with:
-      version: ${{ github.event.inputs.version }}
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+        with:
+          persist-credentials: false
 
-  check-gate:
-    if: ${{ github.event.inputs.phase == 'all' }}
-    permissions:
-      checks: read   # required for getting the status of specific check names
-    uses: anchore/workflows/.github/workflows/check-gate.yaml@8b2b1caf40e03933c6807e03b99e883e2ceb5ac8 # v0.4.0
-    with:
-      # these are checks that should be run on pull-request and merges to main.
-      # we do NOT want to kick off a release if these have not been verified on main.
-      # Please see the validations.yaml workflow for the names that should be used here.
-      checks: '["Acceptance tests (Linux)", "Acceptance tests (Mac)", "Build snapshot artifacts", "CLI tests (Linux)", "Integration tests", "Static analysis", "Unit tests"]'
+      - name: Bootstrap environment
+        uses: ./.github/actions/bootstrap
+
+      - name: Validate Apple notarization credentials
+        run: .tool/quill submission list
+        env:
+          QUILL_NOTARY_ISSUER: ${{ secrets.APPLE_NOTARY_ISSUER }}
+          QUILL_NOTARY_KEY_ID: ${{ secrets.APPLE_NOTARY_KEY_ID }}
+          QUILL_NOTARY_KEY: ${{ secrets.APPLE_NOTARY_KEY }}
+
+      - name: Check if running on main
+        if: github.ref != 'refs/heads/main'
+        # we are using the following flag when running `cosign blob-verify` for checksum signature verification:
+        #   --certificate-identity-regexp "https://github.com/anchore/.github/workflows/release.yaml@refs/heads/main"
+        # if we are not on the main branch, the signature will not be verifiable since the suffix requires the main branch
+        # at the time of when the OIDC token was issued on the Github Actions runner.
+        run: echo "This can only be run on the main branch otherwise releases produced will not be verifiable with cosign" && exit 1
+
+      - name: Check if tag already exists
+        # note: this will fail if the tag already exists
+        run: |
+          [[ "$VERSION" == v* ]] || (echo "version '$VERSION' does not have a 'v' prefix" && exit 1)
+          git tag "$VERSION"
+        env:
+          VERSION: ${{ github.event.inputs.version }}
+
+      - name: Check static analysis results
+        uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be # v1.2.0
+        id: static-analysis
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          # This check name is defined as the github action job name (in .github/workflows/testing.yaml)
+          checkName: "Static analysis"
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - name: Check unit test results
+        uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be # v1.2.0
+        id: unit
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          # This check name is defined as the github action job name (in .github/workflows/testing.yaml)
+          checkName: "Unit tests"
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - name: Check integration test results
+        uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be # v1.2.0
+        id: integration
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          # This check name is defined as the github action job name (in .github/workflows/testing.yaml)
+          checkName: "Integration tests"
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - name: Check acceptance test results (linux)
+        uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be # v1.2.0
+        id: acceptance-linux
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          # This check name is defined as the github action job name (in .github/workflows/testing.yaml)
+          checkName: "Acceptance tests (Linux)"
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - name: Check acceptance test results (mac)
+        uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be # v1.2.0
+        id: acceptance-mac
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          # This check name is defined as the github action job name (in .github/workflows/testing.yaml)
+          checkName: "Acceptance tests (Mac)"
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - name: Check cli test results (linux)
+        uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be # v1.2.0
+        id: cli-linux
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          # This check name is defined as the github action job name (in .github/workflows/testing.yaml)
+          checkName: "CLI tests (Linux)"
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - name: Quality gate
+        if: steps.static-analysis.outputs.conclusion != 'success' || steps.unit.outputs.conclusion != 'success' || steps.integration.outputs.conclusion != 'success' || steps.cli-linux.outputs.conclusion != 'success' || steps.acceptance-linux.outputs.conclusion != 'success' || steps.acceptance-mac.outputs.conclusion != 'success'
+        env:
+          STATIC_ANALYSIS_STATUS: ${{ steps.static-analysis.conclusion }}
+          UNIT_TEST_STATUS: ${{ steps.unit.outputs.conclusion }}
+          INTEGRATION_TEST_STATUS: ${{ steps.integration.outputs.conclusion }}
+          ACCEPTANCE_LINUX_STATUS: ${{ steps.acceptance-linux.outputs.conclusion }}
+          ACCEPTANCE_MAC_STATUS: ${{ steps.acceptance-mac.outputs.conclusion }}
+          CLI_LINUX_STATUS: ${{ steps.cli-linux.outputs.conclusion }}
+        run: |
+          echo "Static Analysis Status: $STATIC_ANALYSIS_STATUS"
+          echo "Unit Test Status: $UNIT_TEST_STATUS"
+          echo "Integration Test Status: $INTEGRATION_TEST_STATUS"
+          echo "Acceptance Test (Linux) Status: $ACCEPTANCE_LINUX_STATUS"
+          echo "Acceptance Test (Mac) Status: $ACCEPTANCE_MAC_STATUS"
+          echo "CLI Test (Linux) Status: $CLI_LINUX_STATUS"
+          false
 
   release:
-    needs: [ check-gate, version-available ]
+    needs: [quality-gate]
+    runs-on: ubuntu-24.04
     if: ${{ github.event.inputs.phase == 'all' }}
-    # runs-on.com: compute instances for parallel builds
-    #   spot disabled: reliability for build workflows (used for releases too)
-    #   goreleaser uses parallelism of 12, so we need more CPUs
-    #   s3-cache: faster actions cache
-    #   tmpfs: faster io-intensive workflows
-    runs-on: runs-on=${{ github.run_id }}/cpu=16+32/ram=32+128/family=c5+c6+c7+c8/spot=false/extras=s3-cache+tmpfs
     permissions:
       contents: write
       packages: write
       # required for goreleaser signs section with cosign
       id-token: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
         with:
           fetch-depth: 0
           persist-credentials: true
@@ -65,13 +145,13 @@ jobs:
         uses: ./.github/actions/bootstrap
 
       - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  #v4.1.0
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1  #v3.5.0
         with:
           username: ${{ secrets.ANCHOREOSSWRITE_DH_USERNAME }}
           password: ${{ secrets.ANCHOREOSSWRITE_DH_PAT }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  #v4.1.0
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1  #v3.5.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -101,34 +181,24 @@ jobs:
           # for updating brew formula in anchore/homebrew-syft
           GITHUB_BREW_TOKEN: ${{ secrets.ANCHOREOPS_GITHUB_OSS_WRITE_TOKEN }}
 
-      - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 #v0.24.0
+      - uses: anchore/sbom-action@43a17d6e7add2b5535efe4dcae9952337c479a93 #v0.20.11
         continue-on-error: true
         with:
           file: go.mod
           artifact-name: sbom.spdx.json
 
-      - name: Notify Slack of new release
-        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c #v3.0.3
+      - uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e #v3.19.0
         continue-on-error: true
         with:
-          webhook: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }}
-          webhook-type: incoming-webhook
-          payload: |
-            text: "A new Syft release has been published: https://github.com/anchore/syft/releases/tag/${{ github.event.inputs.version }}"
-            blocks:
-              - type: section
-                text:
-                  type: mrkdwn
-                  text: |
-                    *A new Syft release has been published* :rocket:
-                    • Release: <https://github.com/anchore/syft/releases/tag/${{ github.event.inputs.version }}|${{ github.event.inputs.version }}>
-                    • Repo: `${{ github.repository }}`
-                    • Workflow: `${{ github.workflow }}`
-                    • Event: `${{ github.event_name }}`
+          status: ${{ job.status }}
+          fields: repo,workflow,action,eventName
+          text: "A new Syft release has been published: https://github.com/anchore/syft/releases/tag/${{ github.event.inputs.version }}"
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }}
         if: ${{ success() }}
 
   release-install-script:
-    needs: [ release ]
+    needs: [release]
     if: ${{ always() && (needs.release.result == 'success' || github.event.inputs.phase == 'install-script-only') }}
     uses: "anchore/workflows/.github/workflows/release-install-script.yaml@main"
     with:

.github/workflows/remove-awaiting-response-label.yaml

@@ -0,0 +1,15 @@
+name: "Manage Awaiting Response Label"
+
+on:
+  issue_comment:
+    types: [created]
+
+jobs:
+  run:
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
+    uses: "anchore/workflows/.github/workflows/remove-awaiting-response-label.yaml@main"
+    secrets:
+      token: ${{ secrets.OSS_PROJECT_GH_TOKEN }}

.github/workflows/test-fixture-cache-publish.yaml

@@ -0,0 +1,44 @@
+name: "Test fixture cache: publish"
+
+on:
+  workflow_dispatch:
+  schedule:
+    # run nightly at 4AM UTC
+    - cron: "0 4 * * *"
+
+permissions:
+  contents: read
+
+jobs:
+
+  Publish:
+    name: "Publish test fixture image cache"
+    # we use this runner to get enough storage space for docker images and fixture cache
+    runs-on: ubuntu-22.04-4core-16gb
+    if: github.repository == 'anchore/syft' # only run for main repo
+    permissions:
+      packages: write
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+        with:
+          persist-credentials: false
+
+      - name: Bootstrap environment
+        uses: ./.github/actions/bootstrap
+        with:
+          # we want to rebuild the cache with no previous state
+          download-test-fixture-cache: false
+
+      - name: Run all tests
+        run: make test
+        env:
+          # we want to rebuild the cache with no previous state
+          DOWNLOAD_TEST_FIXTURE_CACHE: "false"
+
+      - name: Login to GitHub Container Registry (ORAS)
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | .tool/oras login ghcr.io -u "$ACTOR" --password-stdin
+        env:
+          ACTOR: ${{ github.actor }}
+
+      - name: Publish test fixture cache
+        run: make upload-test-fixture-cache

.github/workflows/update-anchore-dependencies.yml

@@ -0,0 +1,51 @@
+name: PR to update Anchore dependencies
+on:
+  workflow_dispatch:
+    inputs:
+      repos:
+        description: "List of dependencies to update"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'anchore' # only run for main repo (not forks)
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+        with:
+          persist-credentials: false
+
+      - name: Bootstrap environment
+        uses: ./.github/actions/bootstrap
+        with:
+          tools: false
+          bootstrap-apt-packages: ""
+
+      - name: Update dependencies
+        id: update
+        uses: anchore/workflows/.github/actions/update-go-dependencies@main
+        with:
+          repos: ${{ github.event.inputs.repos }}
+
+      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf #v2.2.1
+        id: generate-token
+        with:
+          app-id: ${{ secrets.TOKEN_APP_ID }}
+          private-key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}
+
+      - uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 #v8.0.0
+        with:
+          signoff: true
+          delete-branch: true
+          draft: ${{ steps.update.outputs.draft }}
+          # do not change this branch, as other workflows depend on it
+          branch: auto/integration
+          labels: dependencies,pre-release
+          commit-message: "chore(deps): update anchore dependencies"
+          title: "chore(deps): update anchore dependencies"
+          body: ${{ steps.update.outputs.summary }}
+          token: ${{ steps.generate-token.outputs.token }}

.github/workflows/update-bootstrap-tools.yml

@@ -0,0 +1,67 @@
+name: PR for latest versions of tools
+on:
+  schedule:
+    - cron: "0 8 * * *" # 3 AM EST
+
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  update-bootstrap-tools:
+    runs-on: ubuntu-latest
+    if: github.repository == 'anchore/syft' # only run for main repo
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+        with:
+          persist-credentials: false
+
+      - name: Bootstrap environment
+        uses: ./.github/actions/bootstrap
+        with:
+          bootstrap-apt-packages: ""
+          go-dependencies: false
+
+      - name: "Update tool versions"
+        id: latest-versions
+        run: |
+          make update-tools
+          make list-tools
+          
+          export NO_COLOR=1
+          delimiter="$(openssl rand -hex 8)"
+          
+          {
+            echo "status<<${delimiter}"
+            make list-tool-updates
+            echo "${delimiter}"
+          } >> $GITHUB_OUTPUT
+          
+          {
+            echo "### Tool version status"
+            echo "\`\`\`"
+            make list-tool-updates
+            echo "\`\`\`"
+          } >> $GITHUB_STEP_SUMMARY
+
+      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf #v2.2.1
+        id: generate-token
+        with:
+          app-id: ${{ secrets.TOKEN_APP_ID }}
+          private-key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}
+
+      - uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 #v8.0.0
+        with:
+          signoff: true
+          delete-branch: true
+          branch: auto/latest-tools
+          labels: dependencies
+          commit-message: 'chore(deps): update tools to latest versions'
+          title: 'chore(deps): update tools to latest versions'
+          body: |
+            ```
+            ${{ steps.latest-versions.outputs.status }}
+            ```
+            This is an auto-generated pull request to update all of the tools to the latest versions.
+          token: ${{ steps.generate-token.outputs.token }}

.github/workflows/update-cpe-dictionary-index.yml

@@ -0,0 +1,74 @@
+name: PR to update CPE dictionary index
+on:
+  schedule:
+    - cron: "0 1 * * 1" # every monday at 1 AM
+
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  SLACK_NOTIFICATIONS: true
+
+jobs:
+  upgrade-cpe-dictionary-index:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    if: github.repository == 'anchore/syft' # only run for main repo
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+        with:
+          persist-credentials: false
+
+      - name: Bootstrap environment
+        uses: ./.github/actions/bootstrap
+        id: bootstrap
+
+      - name: Login to GitHub Container Registry
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | .tool/oras login ghcr.io -u "$ACTOR" --password-stdin
+        env:
+          ACTOR: ${{ github.actor }}
+
+      - name: Pull CPE cache from registry
+        run: make generate:cpe-index:cache:pull
+
+      - name: Update CPE cache from NVD API
+        run: make generate:cpe-index:cache:update
+        env:
+          NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
+
+      - name: Generate CPE dictionary index
+        run: make generate:cpe-index:build
+
+      - name: Push updated CPE cache to registry
+        run: make generate:cpe-index:cache:push
+
+      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf #v2.2.1
+        id: generate-token
+        with:
+          app-id: ${{ secrets.TOKEN_APP_ID }}
+          private-key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}
+
+      - uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 #v8.0.0
+        with:
+          signoff: true
+          delete-branch: true
+          branch: auto/latest-cpe-dictionary-index
+          labels: dependencies
+          commit-message: "chore(deps): update CPE dictionary index"
+          title: "chore(deps): update CPE dictionary index"
+          body: |
+            Update CPE dictionary index based on the latest available CPE dictionary
+          token: ${{ steps.generate-token.outputs.token }}
+
+      - uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e #v3.19.0
+        with:
+          status: ${{ job.status }}
+          fields: workflow,eventName,job
+          text: Syft CPE dictionary index update failed
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }}
+        if: ${{ failure() && env.SLACK_NOTIFICATIONS == 'true' }}

.github/workflows/update-spdx-license-list.yaml

@@ -0,0 +1,54 @@
+name: PR to update SPDX license list
+on:
+  schedule:
+    - cron: "0 6 * * 1" # every monday at 6 AM UTC
+
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  SLACK_NOTIFICATIONS: true
+
+jobs:
+  upgrade-spdx-license-list:
+    runs-on: ubuntu-latest
+    if: github.repository == 'anchore/syft' # only run for main repo
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+        with:
+          persist-credentials: false
+
+      - name: Bootstrap environment
+        uses: ./.github/actions/bootstrap
+
+      - run: |
+          make generate-license-list
+
+      - uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a #v2.1.0
+        id: generate-token
+        with:
+          app_id: ${{ secrets.TOKEN_APP_ID }}
+          private_key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}
+
+      - uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 #v8.0.0
+        with:
+          signoff: true
+          delete-branch: true
+          branch: auto/latest-spdx-license-list
+          labels: dependencies
+          commit-message: "chore(deps): update SPDX license list"
+          title: "chore(deps): update SPDX license list"
+          body: |
+            Update SPDX license list based on the latest available list from spdx.org
+          token: ${{ steps.generate-token.outputs.token }}
+
+      - uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e #v3.19.0
+        with:
+          status: ${{ job.status }}
+          fields: workflow,eventName,job
+          text: Syft SPDX license list update failed
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }}
+        if: ${{ failure() && env.SLACK_NOTIFICATIONS == 'true' }}

.github/workflows/validate-github-actions.yaml

@@ -1,8 +1,10 @@
 name: "Validate GitHub Actions"
 
 on:
-  workflow_dispatch:
   pull_request:
+    paths:
+      - '.github/workflows/**'
+      - '.github/actions/**'
   push:
     branches:
       - main
@@ -10,7 +12,8 @@ on:
       - '.github/workflows/**'
       - '.github/actions/**'
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   zizmor:
@@ -20,13 +23,13 @@ jobs:
       contents: read
       security-events: write  # for uploading SARIF results
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
 
       - name: "Run zizmor"
-        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+        uses: zizmorcore/zizmor-action@e673c3917a1aef3c65c972347ed84ccd013ecda4 # v0.2.0
         with:
-          # there is a pass/fail gate as a repo ruleset (if there is no ruleset configured then the action will pass by default)
-          advanced-security: true
+          config-file: .github/zizmor.yml
+          sarif-upload: true
           inputs: .github

.github/workflows/validations.yaml

@@ -1,7 +1,5 @@
 name: "Validations"
 
-# we should cancel any in-progress runs for the same workflow + PR/ref
-# so that we can avoid redundant work / save on CI minutes
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
@@ -13,43 +11,34 @@ on:
     branches:
       - main
 
-permissions: {}
+permissions:
+    contents: read
 
 jobs:
+
   Static-Analysis:
     # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
     name: "Static analysis"
-    # runs-on.com: memory & general purpose instances for testing
-    #   spot enabled: ok to interrupt non-production workloads
-    #   s3-cache: faster actions cache
-    #   tmpfs: faster io-intensive workflows
-    runs-on: &test-runner "runs-on=${{ github.run_id }}/cpu=4+8/ram=32+128/family=r5+r6+r7+r8+m4+m5+m6+m7+m8/spot=price-capacity-optimized/extras=s3-cache+tmpfs"
-    permissions:
-      contents: read
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
         with:
           persist-credentials: false
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
-        with:
-          # the self-consistency tests for the output of the capabilities code generation depends on unit test
-          # output from  ./syft/pkg/... packages. Therefore we need to download the test fixture cache here
-          # so that running the few unit tests as part of static analysis works correctly.
-          download-test-fixture-cache: true
 
       - name: Run static analysis
         run: make static-analysis
 
+
   Unit-Test:
     # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
     name: "Unit tests"
-    runs-on: *test-runner
-    permissions:
-      contents: read
+    # we need more storage than what's on the default runner
+    runs-on: ubuntu-22.04-4core-16gb
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
         with:
           persist-credentials: false
 
@@ -61,17 +50,13 @@ jobs:
       - name: Run unit tests
         run: make unit
 
-      - name: Check for capability drift
-        run: make check-capability-drift
 
   Integration-Test:
     # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
     name: "Integration tests"
-    runs-on: *test-runner
-    permissions:
-      contents: read
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
         with:
           persist-credentials: false
 
@@ -86,21 +71,12 @@ jobs:
       - name: Run integration tests
         run: make integration
 
+
   Build-Snapshot-Artifacts:
     name: "Build snapshot artifacts"
-    # runs-on.com: compute instances for parallel builds
-    #   spot disabled: reliability for build workflows (used for releases too)
-    #   goreleaser uses parallelism of 12, so we need more CPUs
-    #   s3-cache: faster actions cache
-    #   tmpfs: faster io-intensive workflows
-    runs-on: "runs-on=${{ github.run_id }}/cpu=16+32/ram=32+128/family=c5+c6+c7+c8/spot=false/extras=s3-cache+tmpfs"
-    permissions:
-      contents: read
+    runs-on: ubuntu-24.04
     steps:
-      # required for magic-cache from runs-on to function with artifact upload/download (see https://runs-on.com/caching/magic-cache/#actionsupload-artifact-compatibility)
-      - uses: runs-on/action@742bf56072eb4845a0f94b3394673e4903c90ff0  # v2.1.0
-
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
         with:
           persist-credentials: false
 
@@ -115,25 +91,27 @@ jobs:
       - name: Smoke test snapshot build
         run: make snapshot-smoke-test
 
+      # why not use actions/upload-artifact? It is very slow (3 minutes to upload ~600MB of data, vs 10 seconds with this approach).
+      # see https://github.com/actions/upload-artifact/issues/199 for more info
       - name: Upload snapshot artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
+        uses: actions/cache/save@9255dc7a253b0ccc959486e2bca901246202afeb #v5.0.1
         with:
-          name: snapshot
-          path: snapshot/
-          retention-days: 30
+          # we need to preserve the snapshot data itself as well as the task data that confirms if the
+          # snapshot build is stale or not. Otherwise the downstream jobs will attempt to rebuild the snapshot
+          # even though it already exists.
+          path: |
+            snapshot
+            .task
+          key: snapshot-build-${{ github.run_id }}
 
-  Acceptance-Linux:
+
+  Upload-Snapshot-Artifacts:
     # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
-    name: "Acceptance tests (Linux)"
+    name: "Upload snapshot artifacts"
     needs: [Build-Snapshot-Artifacts]
-    runs-on: *test-runner
-    permissions:
-      contents: read
+    runs-on: ubuntu-24.04
     steps:
-      # required for magic-cache from runs-on to function with artifact upload/download (see https://runs-on.com/caching/magic-cache/#actionsupload-artifact-compatibility)
-      - uses: runs-on/action@742bf56072eb4845a0f94b3394673e4903c90ff0  # v2.1.0
-
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
         with:
           persist-credentials: false
 
@@ -142,14 +120,77 @@ jobs:
         with:
           download-test-fixture-cache: true
 
-      - name: Download snapshot artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
+      - name: Download snapshot build
+        id: snapshot-cache
+        uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb #v5.0.1
         with:
-          name: snapshot
-          path: snapshot
+          path: |
+            snapshot
+            .task
+          fail-on-cache-miss: true
+          key: snapshot-build-${{ github.run_id }}
 
-      - name: Restore binary permissions
-        run: chmod +x snapshot/*/syft snapshot/*/*.exe 2>/dev/null || true
+      # workaround for https://github.com/actions/cache/issues/1265
+      - name: (cache-miss) Snapshot build missing
+        if: steps.snapshot-cache.outputs.cache-hit != 'true'
+        run: echo "unable to download snapshots from previous job" && false
+
+      - run: npm install @actions/artifact@2.2.2
+
+      - uses: actions/github-script@v8
+        with:
+          script: |
+            const { readdirSync } = require('fs')
+            const { DefaultArtifactClient } = require('@actions/artifact')
+            const artifact = new DefaultArtifactClient()
+            const ls = d => readdirSync(d, { withFileTypes: true })
+            const baseDir = "./snapshot"
+            const dirs = ls(baseDir).filter(f => f.isDirectory()).map(f => f.name)
+            const uploads = []
+            for (const dir of dirs) {
+              // uploadArtifact returns Promise<{id, size}>
+              uploads.push(artifact.uploadArtifact(
+                // name of the archive:
+                `${dir}`,
+                // array of all files to include:
+                ls(`${baseDir}/${dir}`).map(f => `${baseDir}/${dir}/${f.name}`),
+                // base directory to trim from entries:
+                `${baseDir}/${dir}`,
+                { retentionDays: 30 }
+              ))
+            }
+            // wait for all uploads to finish
+            Promise.all(uploads)
+
+  Acceptance-Linux:
+    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
+    name: "Acceptance tests (Linux)"
+    needs: [Build-Snapshot-Artifacts]
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+        with:
+          persist-credentials: false
+
+      - name: Bootstrap environment
+        uses: ./.github/actions/bootstrap
+        with:
+          download-test-fixture-cache: true
+
+      - name: Download snapshot build
+        id: snapshot-cache
+        uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb #v5.0.1
+        with:
+          path: |
+            snapshot
+            .task
+          fail-on-cache-miss: true
+          key: snapshot-build-${{ github.run_id }}
+
+      # workaround for https://github.com/actions/cache/issues/1265
+      - name: (cache-miss) Snapshot build missing
+        if: steps.snapshot-cache.outputs.cache-hit != 'true'
+        run: echo "unable to download snapshots from previous job" && false
 
       - name: Run comparison tests (Linux)
         run: make compare-linux
@@ -165,19 +206,17 @@ jobs:
         if: steps.install-test-image-cache.outputs.cache-hit != 'true'
         run: make install-test-cache-save
 
+
   Acceptance-Mac:
     # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
     name: "Acceptance tests (Mac)"
     needs: [Build-Snapshot-Artifacts]
-    # note: macos runners aren't supported yet for runs-on managed runners.
     runs-on: macos-latest
-    permissions:
-      contents: read
     steps:
       - name: Install Cosign
-        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
         with:
           persist-credentials: false
 
@@ -188,14 +227,20 @@ jobs:
           go-dependencies: false
           download-test-fixture-cache: true
 
-      - name: Download snapshot artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
+      - name: Download snapshot build
+        id: snapshot-cache
+        uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb #v5.0.1
         with:
-          name: snapshot
-          path: snapshot
+          path: |
+            snapshot
+            .task
+          fail-on-cache-miss: true
+          key: snapshot-build-${{ github.run_id }}
 
-      - name: Restore binary permissions
-        run: chmod +x snapshot/*/syft 2>/dev/null || true
+      # workaround for https://github.com/actions/cache/issues/1265
+      - name: (cache-miss) Snapshot build missing
+        if: steps.snapshot-cache.outputs.cache-hit != 'true'
+        run: echo "unable to download snapshots from previous job" && false
 
       - name: Run comparison tests (Mac)
         run: make compare-mac
@@ -203,18 +248,14 @@ jobs:
       - name: Run install.sh tests (Mac)
         run: make install-test-ci-mac
 
+
   Cli-Linux:
     # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
     name: "CLI tests (Linux)"
     needs: [Build-Snapshot-Artifacts]
-    runs-on: *test-runner
-    permissions:
-      contents: read
+    runs-on: ubuntu-24.04
     steps:
-      # required for magic-cache from runs-on to function with artifact upload/download (see https://runs-on.com/caching/magic-cache/#actionsupload-artifact-compatibility)
-      - uses: runs-on/action@742bf56072eb4845a0f94b3394673e4903c90ff0  # v2.1.0
-
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
         with:
           persist-credentials: false
 
@@ -223,14 +264,42 @@ jobs:
         with:
           download-test-fixture-cache: true
 
-      - name: Download snapshot artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
+      - name: Download snapshot build
+        id: snapshot-cache
+        uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb #v5.0.1
         with:
-          name: snapshot
-          path: snapshot
+          path: |
+            snapshot
+            .task
+          fail-on-cache-miss: true
+          key: snapshot-build-${{ github.run_id }}
 
-      - name: Restore binary permissions
-        run: chmod +x snapshot/*/syft snapshot/*/*.exe 2>/dev/null || true
+      # workaround for https://github.com/actions/cache/issues/1265
+      - name: (cache-miss) Snapshot build missing
+        if: steps.snapshot-cache.outputs.cache-hit != 'true'
+        run: echo "unable to download snapshots from previous job" && false
 
       - name: Run CLI Tests (Linux)
         run: make cli
+
+
+  Cleanup-Cache:
+    name: "Cleanup snapshot cache"
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-24.04
+    permissions:
+      actions: write
+    needs:
+      - Acceptance-Linux
+      - Acceptance-Mac
+      - Cli-Linux
+      - Upload-Snapshot-Artifacts
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+        with:
+          persist-credentials: false
+
+      - name: Delete snapshot cache
+        run: gh cache delete "snapshot-build-${{ github.run_id }}"
+        env:
+          GH_TOKEN: ${{ github.token }}

.github/zizmor.yml

@@ -1,9 +1,9 @@
 rules:
   unpinned-uses:
-    config:
-      policies:
-        # anchore/workflows is an internal repository; using @main is acceptable
-        anchore/*: any
+    ignore:
+      # Allow unpinned uses of trusted internal anchore/workflows actions
+      - update-anchore-dependencies.yml
+
   dangerous-triggers:
     ignore:
       # Safe use of pull_request_target - only runs trusted scripts from base repo,

.gitignore

@@ -19,7 +19,6 @@ bin/
 /.task
 /generate
 /specs
-mise.toml
 
 # changelog generation
 CHANGELOG.md
@@ -36,8 +35,6 @@ VERSION
 /test/results
 coverage.txt
 *.log
-**/test-fixtures/test-observations.json
-**/testdata/test-observations.json
 
 # probable archives
 .images

.golangci.yaml

@@ -50,9 +50,10 @@ linters:
       - legacy
       - std-error-handling
     rules:
-      # we have multiple packages in syft that might overlap with the stblib; their names reflect their purpose
+      # internal/os contains OS feature detection logic; the name reflects its purpose
       - linters:
           - revive
+        path: internal/os/
         text: "var-naming: avoid package names that conflict"
     paths:
       - third_party$

.goreleaser.yaml

@@ -14,7 +14,7 @@ builds:
     dir: ./cmd/syft
     binary: syft
     goos: [linux]
-    goarch: [amd64, arm64, ppc64le, riscv64, s390x]
+    goarch: [amd64, arm64, ppc64le, s390x]
     mod_timestamp: &build-timestamp '{{ .CommitTimestamp }}'
     ldflags: &build-ldflags |
       -w
@@ -114,20 +114,6 @@ dockers:
       - "--build-arg=VCS_REF={{.FullCommit}}"
       - "--build-arg=VCS_URL={{.GitURL}}"
 
-  - image_templates:
-      - anchore/syft:{{.Tag}}-riscv64
-      - ghcr.io/anchore/syft:{{.Tag}}-riscv64
-    goarch: riscv64
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/riscv64"
-      - "--build-arg=DEBIAN_VERSION=13"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
   - image_templates:
       - anchore/syft:{{.Tag}}-s390x
       - ghcr.io/anchore/syft:{{.Tag}}-s390x
@@ -181,20 +167,6 @@ dockers:
       - "--build-arg=VCS_REF={{.FullCommit}}"
       - "--build-arg=VCS_URL={{.GitURL}}"
 
-  - image_templates:
-      - anchore/syft:{{.Tag}}-nonroot-riscv64
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-riscv64
-    goarch: riscv64
-    dockerfile: Dockerfile.nonroot
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/riscv64"
-      - "--build-arg=DEBIAN_VERSION=13"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
   - image_templates:
       - anchore/syft:{{.Tag}}-nonroot-s390x
       - ghcr.io/anchore/syft:{{.Tag}}-nonroot-s390x
@@ -248,20 +220,6 @@ dockers:
       - "--build-arg=VCS_REF={{.FullCommit}}"
       - "--build-arg=VCS_URL={{.GitURL}}"
 
-  - image_templates:
-      - anchore/syft:{{.Tag}}-debug-riscv64
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-riscv64
-    goarch: riscv64
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/riscv64"
-      - "--build-arg=DEBIAN_VERSION=13"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
   - image_templates:
       - anchore/syft:{{.Tag}}-debug-s390x
       - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
@@ -281,7 +239,6 @@ docker_manifests:
       - anchore/syft:{{.Tag}}-amd64
       - anchore/syft:{{.Tag}}-arm64v8
       - anchore/syft:{{.Tag}}-ppc64le
-      - anchore/syft:{{.Tag}}-riscv64
       - anchore/syft:{{.Tag}}-s390x
 
   - name_template: ghcr.io/anchore/syft:latest
@@ -289,7 +246,6 @@ docker_manifests:
       - ghcr.io/anchore/syft:{{.Tag}}-amd64
       - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
       - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-riscv64
       - ghcr.io/anchore/syft:{{.Tag}}-s390x
 
   - name_template: anchore/syft:{{.Tag}}
@@ -297,7 +253,6 @@ docker_manifests:
       - anchore/syft:{{.Tag}}-amd64
       - anchore/syft:{{.Tag}}-arm64v8
       - anchore/syft:{{.Tag}}-ppc64le
-      - anchore/syft:{{.Tag}}-riscv64
       - anchore/syft:{{.Tag}}-s390x
 
   - name_template: ghcr.io/anchore/syft:{{.Tag}}
@@ -305,7 +260,6 @@ docker_manifests:
       - ghcr.io/anchore/syft:{{.Tag}}-amd64
       - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
       - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-riscv64
       - ghcr.io/anchore/syft:{{.Tag}}-s390x
 
   # nonroot images...
@@ -314,7 +268,6 @@ docker_manifests:
       - anchore/syft:{{.Tag}}-nonroot-amd64
       - anchore/syft:{{.Tag}}-nonroot-arm64v8
       - anchore/syft:{{.Tag}}-nonroot-ppc64le
-      - anchore/syft:{{.Tag}}-nonroot-riscv64
       - anchore/syft:{{.Tag}}-nonroot-s390x
 
   - name_template: ghcr.io/anchore/syft:nonroot
@@ -322,7 +275,6 @@ docker_manifests:
       - ghcr.io/anchore/syft:{{.Tag}}-nonroot-amd64
       - ghcr.io/anchore/syft:{{.Tag}}-nonroot-arm64v8
       - ghcr.io/anchore/syft:{{.Tag}}-nonroot-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-riscv64
       - ghcr.io/anchore/syft:{{.Tag}}-nonroot-s390x
 
   - name_template: anchore/syft:{{.Tag}}-nonroot
@@ -330,7 +282,6 @@ docker_manifests:
       - anchore/syft:{{.Tag}}-nonroot-amd64
       - anchore/syft:{{.Tag}}-nonroot-arm64v8
       - anchore/syft:{{.Tag}}-nonroot-ppc64le
-      - anchore/syft:{{.Tag}}-nonroot-riscv64
       - anchore/syft:{{.Tag}}-nonroot-s390x
 
   - name_template: ghcr.io/anchore/syft:{{.Tag}}-nonroot
@@ -338,7 +289,6 @@ docker_manifests:
       - ghcr.io/anchore/syft:{{.Tag}}-nonroot-amd64
       - ghcr.io/anchore/syft:{{.Tag}}-nonroot-arm64v8
       - ghcr.io/anchore/syft:{{.Tag}}-nonroot-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-riscv64
       - ghcr.io/anchore/syft:{{.Tag}}-nonroot-s390x
 
   # debug images...
@@ -347,7 +297,6 @@ docker_manifests:
       - anchore/syft:{{.Tag}}-debug-amd64
       - anchore/syft:{{.Tag}}-debug-arm64v8
       - anchore/syft:{{.Tag}}-debug-ppc64le
-      - anchore/syft:{{.Tag}}-debug-riscv64
       - anchore/syft:{{.Tag}}-debug-s390x
 
   - name_template: ghcr.io/anchore/syft:debug
@@ -355,7 +304,6 @@ docker_manifests:
       - ghcr.io/anchore/syft:{{.Tag}}-debug-amd64
       - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
       - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-riscv64
       - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
 
   - name_template: anchore/syft:{{.Tag}}-debug
@@ -363,7 +311,6 @@ docker_manifests:
       - anchore/syft:{{.Tag}}-debug-amd64
       - anchore/syft:{{.Tag}}-debug-arm64v8
       - anchore/syft:{{.Tag}}-debug-ppc64le
-      - anchore/syft:{{.Tag}}-debug-riscv64
       - anchore/syft:{{.Tag}}-debug-s390x
 
   - name_template: ghcr.io/anchore/syft:{{.Tag}}-debug
@@ -371,7 +318,6 @@ docker_manifests:
       - ghcr.io/anchore/syft:{{.Tag}}-debug-amd64
       - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
       - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-riscv64
       - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
 
 sboms:

Dockerfile

@@ -1,5 +1,4 @@
-ARG DEBIAN_VERSION=12
-FROM gcr.io/distroless/static-debian${DEBIAN_VERSION}:latest AS build
+FROM gcr.io/distroless/static-debian12:latest AS build
 
 FROM scratch
 # needed for version check HTTPS request

Dockerfile.debug

@@ -1,5 +1,4 @@
-ARG DEBIAN_VERSION=12
-FROM gcr.io/distroless/static-debian${DEBIAN_VERSION}:debug-nonroot
+FROM gcr.io/distroless/static-debian12:debug-nonroot
 
 # create the /tmp dir, which is needed for image content cache
 WORKDIR /tmp

Dockerfile.nonroot

@@ -1,5 +1,4 @@
-ARG DEBIAN_VERSION=12
-FROM gcr.io/distroless/static-debian${DEBIAN_VERSION}:nonroot
+FROM gcr.io/distroless/static-debian12:nonroot
 
 # create the /tmp dir, which is needed for image content cache
 WORKDIR /tmp

Makefile

@@ -36,7 +36,7 @@ make-default: $(TASK)
 	@$(TASK)
 
 # for those of us that can't seem to kick the habit of typing `make ...` lets wrap the superior `task` tool
-TASKS := $(shell bash -c "test -f $(TASK) && NO_COLOR=1 $(TASK) -l | grep '^\* ' | cut -d' ' -f2 | tr -d ':' | tr '\n' ' '" ) $(shell bash -c "test -f $(TASK) && NO_COLOR=1 $(TASK) -l | grep 'aliases:' | cut -d ':' -f 3 | tr '\n' ' ' | tr -d ','")
+TASKS := $(shell bash -c "test -f $(TASK) && $(TASK) -l | grep '^\* ' | cut -d' ' -f2 | tr -d ':' | tr '\n' ' '" ) $(shell bash -c "test -f $(TASK) && $(TASK) -l | grep 'aliases:' | cut -d ':' -f 3 | tr '\n' ' ' | tr -d ','")
 
 .PHONY: $(TASKS)
 $(TASKS): $(TASK)

SECURITY.md

@@ -14,23 +14,3 @@ affected versions, and, if known, mitigations for the issue.
 All support will be made on a best effort basis, so please indicate the "urgency level" of the vulnerability as Critical, High, Medium or Low.
 
 For more details, see our [security policy documentation](https://oss.anchore.com/docs/contributing/security/).
-
-## Trust Boundary
-
-Syft is a tool to scan content and product an SBOM. Syft is not a tool designed to scan malicious content. Detecting and properly reporting on purposely malicious artifacts is outside the scope of Syft's expected operating environment.
-
-There are many possible ways for malicious content to cause Syft to become confused or fail to include results in an SBOM. We do not consider this to be a security vulnerability.
-
-**Examples**
-- Removing or altering a package lock file
-- Removing or altering an RPM or DEB database
-- A malicious archive that Syft will skip but the runtime may not
-- Self modifying systems that change state when running
-
-We consider the security trust boundary for Syft to be anything that causes problems for the overall system running Syft, or Syft operating in a way that is dangerous to itself, the system, or the operator.
-
-**Examples**
-- Filling up temp space permanently
-- Syft executing arbitrary code when scanning an artifact
-- Syft leaking secrets from the environment or configuration files into logs or SBOMs
-- Syft operating outside of the expected artifact or directory (directory traversal)

Taskfile.yaml

@@ -8,10 +8,7 @@ vars:
   OWNER: anchore
   PROJECT: syft
 
-  # v1: when fixtures were located at test-fixtures dirs
-  # v2: migration to testdata dirs
-  CACHE_REPO: oss-cache
-  CACHE_IMAGE: ghcr.io/{{ .OWNER }}/{{ .CACHE_REPO }}/syft-test-fixture-cache:v2
+  CACHE_IMAGE: ghcr.io/{{ .OWNER }}/{{ .PROJECT }}/test-fixture-cache:latest
 
   # static file dirs
   TOOL_DIR: .tool
@@ -193,15 +190,10 @@ tasks:
     cmds:
       - .github/scripts/json-schema-drift-check.sh
 
-  check-capability-drift:
-    desc: Ensure there is no drift between the capabilities data and the code
-    cmds:
-      - .github/scripts/capability-drift-check.sh
-
   check-binary-fixture-size:
     desc: Ensure that the binary test fixtures are not too large
     cmds:
-      - .github/scripts/check_binary_fixture_size.sh syft/pkg/cataloger/binary/testdata/classifiers/snippets
+      - .github/scripts/check_binary_fixture_size.sh syft/pkg/cataloger/binary/test-fixtures/classifiers/snippets
 
 
   ## Testing tasks #################################
@@ -226,7 +218,6 @@ tasks:
       # unit test coverage threshold (in % coverage)
       COVERAGE_THRESHOLD: 62
     cmds:
-      - task: clean-test-observations
       - "go test -coverprofile {{ .TMP_DIR }}/unit-coverage-details.txt {{ .TEST_PKGS }}"
       - cmd: ".github/scripts/coverage.py {{ .COVERAGE_THRESHOLD }} {{ .TMP_DIR }}/unit-coverage-details.txt"
         silent: true
@@ -268,9 +259,9 @@ tasks:
   fingerprints:
     desc: Generate fingerprints for all non-docker test fixture
     silent: true
-    # this will look for `testdata/Makefile` and invoke the `fingerprint` target to calculate all cache input fingerprint files
+    # this will look for `test-fixtures/Makefile` and invoke the `fingerprint` target to calculate all cache input fingerprint files
     generates:
-      - '**/testdata/**/*.fingerprint'
+      - '**/test-fixtures/**/*.fingerprint'
       - test/install/cache.fingerprint
     cmds:
       - |
@@ -279,7 +270,7 @@ tasks:
         RESET='\033[0m'
 
         echo -e "${YELLOW}creating fingerprint files for non-docker fixtures...${RESET}"
-        for dir in $(find . -type d -name 'testdata'); do
+        for dir in $(find . -type d -name 'test-fixtures'); do
           if [ -f "$dir/Makefile" ]; then
             # for debugging...
             #echo -e "${YELLOW}• calculating fingerprints in $dir... ${RESET}"
@@ -372,21 +363,18 @@ tasks:
   build-fixtures:
     desc: Generate all non-docker test fixtures
     silent: true
-    # this will look for `testdata/Makefile` and invoke the `fixtures` target to generate any and all test fixtures
+    # this will look for `test-fixtures/Makefile` and invoke the `fixtures` target to generate any and all test fixtures
     cmds:
       - |
-        # we want to stop on the first build error
-        set -e
-
         BOLD='\033[1m'
         YELLOW='\033[0;33m'
         RESET='\033[0m'
 
         # Use a for loop with command substitution to avoid subshell issues
-        for dir in $(find . -type d -name 'testdata'); do
+        for dir in $(find . -type d -name 'test-fixtures'); do
           if [ -f "$dir/Makefile" ]; then
             echo -e "${YELLOW}${BOLD}generating fixtures in $dir${RESET}"
-            make -C "$dir" fixtures
+            (make -C "$dir" fixtures)
           fi
         done
         echo -e "${BOLD}generated all fixtures${RESET}"
@@ -425,7 +413,7 @@ tasks:
       done
       oras_command+=" {{ .CACHE_PATHS_FILE }}"
 
-      oras_command+=" --annotation org.opencontainers.image.source=https://github.com/{{ .OWNER }}/{{ .CACHE_REPO }}"
+      oras_command+=" --annotation org.opencontainers.image.source=https://github.com/{{ .OWNER }}/{{ .PROJECT }}"
       oras_command+=" --annotation fingerprint=$(cat {{ .CACHE_PATHS_FILE }} | {{ .YQ }} -r '.digest')"
 
       echo "Executing: $oras_command"
@@ -437,7 +425,7 @@ tasks:
       - "echo 'Docker daemon cache:'"
       - "docker images --format '{{`{{.ID}}`}} {{`{{.Repository}}`}}:{{`{{.Tag}}`}}' | grep stereoscope-fixture- | sort"
       - "echo '\nTar cache:'"
-      - 'find . -type f -wholename "**/testdata/cache/stereoscope-fixture-*.tar" | sort'
+      - 'find . -type f -wholename "**/test-fixtures/cache/stereoscope-fixture-*.tar" | sort'
 
   check-docker-cache:
     desc: Ensure docker caches aren't using too much disk space
@@ -471,7 +459,7 @@ tasks:
       - "cd test/install && make ci-test-mac"
 
   generate-compare-file:
-    cmd: "go run ./cmd/syft {{ .COMPARE_TEST_IMAGE }} -o json > {{ .COMPARE_DIR }}/testdata/acceptance-{{ .COMPARE_TEST_IMAGE }}.json"
+    cmd: "go run ./cmd/syft {{ .COMPARE_TEST_IMAGE }} -o json > {{ .COMPARE_DIR }}/test-fixtures/acceptance-{{ .COMPARE_TEST_IMAGE }}.json"
 
   compare-mac:
     deps: [tmpdir]
@@ -512,7 +500,6 @@ tasks:
     desc: Add data generation tasks
     cmds:
       - task: generate-json-schema
-      - task: generate-capabilities
       - task: generate-license-list
       - task: generate-cpe-dictionary-index
 
@@ -534,27 +521,6 @@ tasks:
       - task: generate:cpe-index:cache:update
       - task: generate:cpe-index:build
 
-  generate-capabilities:
-    desc: Generate the capabilities data file
-    deps:
-      - tmpdir
-      - fixtures
-    vars:
-      # set REFRESH=true to run package tests first and refresh test observations (default: true)
-      REFRESH: '{{ .REFRESH | default "true" }}'
-    cmds:
-      # remove all test observations prior to regenerating
-      - task: clean-test-observations
-        if: '{{ eq .REFRESH "true" }}'
-      # this is required to update test observations; such evidence is used to update the packages/*.yaml
-      - cmd: "go test ./syft/pkg/... -count=1"
-        if: '{{ eq .REFRESH "true" }}'
-      - "go generate ./internal/capabilities/..."
-      - "gofmt -s -w ./internal/capabilities"
-      # now that we have the latest capabilities, run completeness tests to ensure this is self-consistent
-      # note: -p 1 forces sequential package execution to avoid race between generate (writes) and internal (reads)
-      - "SYFT_ENABLE_COMPLETENESS_TESTS=true go test -p 1 ./internal/capabilities/... -count=1"
-
 
   ## Build-related targets #################################
 
@@ -646,15 +612,6 @@ tasks:
 
   ## Cleanup targets #################################
 
-  clean:
-    desc: Remove all cache files and old builds
-    cmds:
-      - task: clean-snapshot
-      - task: clean-cache
-      - task: clean-test-observations
-      - task: clean-docker-cache
-      - task: clean-oras-cache
-
   clean-snapshot:
     desc: Remove any snapshot builds
     cmds:
@@ -664,7 +621,7 @@ tasks:
   clean-docker-cache:
     desc: Remove all docker cache tars and images from the daemon
     cmds:
-      - find . -type d -wholename "**/testdata/cache" | xargs rm -rf
+      - find . -type d -wholename "**/test-fixtures/cache" | xargs rm -rf
       - docker images --format '{{`{{.ID}}`}} {{`{{.Repository}}`}}' | grep stereoscope-fixture- | awk '{print $1}' | uniq | xargs -r docker rmi --force
 
   clean-oras-cache:
@@ -681,7 +638,7 @@ tasks:
         RESET='\033[0m'
 
         # Use a for loop with command substitution to avoid subshell issues
-        for dir in $(find . -type d -name 'testdata'); do
+        for dir in $(find . -type d -name 'test-fixtures'); do
         if [ -f "$dir/Makefile" ]; then
           echo -e "${YELLOW}${BOLD}deleting ephemeral test fixtures in $dir${RESET}"
           (make -C "$dir" clean)
@@ -689,8 +646,3 @@ tasks:
         done
         echo -e "${BOLD}Deleted all ephemeral test fixtures${RESET}"
       - rm -f {{ .LAST_CACHE_PULL_FILE }} {{ .CACHE_PATHS_FILE }}
-
-  clean-test-observations:
-    desc: Remove all test observations (i.e. testdata/test-observations.json)
-    cmds:
-      - find . -type f -wholename "**/testdata/test-observations.json" | xargs rm -f

cmd/syft/cli/ui/handle_attestation.go

@@ -219,7 +219,7 @@ func (l attestLogFrame) View() string {
 	sb := strings.Builder{}
 
 	for _, line := range l.lines {
-		fmt.Fprintf(&sb, "     %s %s\n", l.borderStype.Render("░░"), line)
+		sb.WriteString(fmt.Sprintf("     %s %s\n", l.borderStype.Render("░░"), line))
 	}
 
 	return sb.String()

cmd/syft/internal/clio_setup_config.go

@@ -49,7 +49,7 @@ func AppClioSetupConfig(id clio.Identification, out io.Writer) *clio.SetupConfig
 			},
 		).
 		WithPostRuns(func(_ *clio.State, _ error) {
-			stereoscope.Cleanup() //nolint:staticcheck // we don't have access to the image object here
+			stereoscope.Cleanup()
 		})
 	return clioCfg
 }

cmd/syft/internal/commands/attest.go

@@ -35,7 +35,6 @@ const (
 	attestSchemeHelp = "\n  " + schemeHelpHeader + "\n" + imageSchemeHelp
 	attestHelp       = attestExample + attestSchemeHelp
 	cosignBinName    = "cosign"
-	jsonFormat       = "json"
 )
 
 type attestOptions struct {
@@ -59,7 +58,7 @@ func Attest(app clio.Application) *cobra.Command {
 		Use:   "attest --output [FORMAT] <IMAGE>",
 		Short: "Generate an SBOM as an attestation for the given [SOURCE] container image",
 		Long:  "Generate a packaged-based Software Bill Of Materials (SBOM) from a container image as the predicate of an in-toto attestation that will be uploaded to the image registry",
-		Example: internal.Tprintf(attestHelp, map[string]any{
+		Example: internal.Tprintf(attestHelp, map[string]interface{}{
 			"appName": id.Name,
 			"command": "attest",
 		}),
@@ -94,7 +93,9 @@ func defaultAttestOutputOptions() options.Output {
 			string(spdxtagvalue.ID),
 		},
 		Outputs: []string{syftjson.ID.String()},
-		// OutputFile is omitted (defaults to Enabled: false, explicitly not allowed for attestation)
+		OutputFile: options.OutputFile{ //nolint:staticcheck
+			Enabled: false, // explicitly not allowed
+		},
 		Format: options.DefaultFormat(),
 	}
 }
@@ -239,7 +240,7 @@ func predicateType(outputName string) string {
 		return "cyclonedx"
 	case "spdx-tag-value", "spdx-tv":
 		return "spdx"
-	case "spdx-json", jsonFormat:
+	case "spdx-json", "json":
 		return "spdxjson"
 	default:
 		return "custom"

cmd/syft/internal/commands/cataloger.go

@@ -1,8 +1,6 @@
 package commands
 
 import (
-	"os"
-
 	"github.com/spf13/cobra"
 
 	"github.com/anchore/clio"
@@ -18,14 +16,5 @@ func Cataloger(app clio.Application) *cobra.Command {
 		CatalogerList(app),
 	)
 
-	// only add cataloger info command if experimental capabilities feature is enabled
-	if isCapabilitiesExperimentEnabled() {
-		cmd.AddCommand(CatalogerCaps(app))
-	}
-
 	return cmd
 }
-
-func isCapabilitiesExperimentEnabled() bool {
-	return os.Getenv("SYFT_EXP_CAPABILITIES") == "true"
-}

cmd/syft/internal/commands/cataloger_info.go

@@ -1,585 +0,0 @@
-package commands
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"os"
-	"slices"
-	"sort"
-	"strings"
-
-	"github.com/charmbracelet/lipgloss"
-	"github.com/olekukonko/tablewriter"
-	"github.com/olekukonko/tablewriter/renderer"
-	"github.com/olekukonko/tablewriter/tw"
-	"github.com/scylladb/go-set/strset"
-	"github.com/spf13/cobra"
-
-	"github.com/anchore/clio"
-	"github.com/anchore/syft/cmd/syft/internal/options"
-	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/internal/capabilities"
-	"github.com/anchore/syft/internal/task"
-	"github.com/anchore/syft/syft/cataloging"
-	_ "github.com/anchore/syft/syft/pkg/cataloger" // register all cataloger capabilities, otherwise the info command will not function
-)
-
-var (
-	yesStyle       = lipgloss.NewStyle().Foreground(lipgloss.Color("10")) // hi green
-	noStyle        = lipgloss.NewStyle().Foreground(lipgloss.Color("8"))  // dark grey
-	criteriaWidth  = 60
-	criteriaMargin = 10
-)
-
-// types for JSON cataloger info output
-type (
-	configFieldInfo struct {
-		Key         string `json:"key"`
-		Description string `json:"description"`
-		AppKey      string `json:"app_key,omitempty"`
-	}
-
-	configInfo struct {
-		Type   string            `json:"type"`
-		Fields []configFieldInfo `json:"fields,omitempty"`
-	}
-
-	detectorPackageInfo struct {
-		Class string   `json:"class"`
-		Name  string   `json:"name"`
-		PURL  string   `json:"purl"`
-		CPEs  []string `json:"cpes"`
-		Type  string   `json:"type"`
-	}
-
-	patternInfo struct {
-		Method          string                           `json:"method"`
-		Criteria        []string                         `json:"criteria"`
-		Conditions      []capabilities.DetectorCondition `json:"conditions,omitempty"`
-		Packages        []detectorPackageInfo            `json:"packages,omitempty"`
-		Comment         string                           `json:"comment,omitempty"`
-		PackageTypes    []string                         `json:"package_types,omitempty"`
-		JSONSchemaTypes []string                         `json:"json_schema_types,omitempty"`
-		Capabilities    capabilities.CapabilitySet       `json:"capabilities,omitempty"`
-	}
-
-	catalogerInfo struct {
-		Ecosystem    string                     `json:"ecosystem,omitempty"`
-		Name         string                     `json:"name"`
-		Type         string                     `json:"type"`
-		Selectors    []string                   `json:"selectors,omitempty"`
-		Deprecated   bool                       `json:"deprecated,omitempty"`
-		Patterns     []patternInfo              `json:"patterns,omitempty"`
-		Capabilities capabilities.CapabilitySet `json:"capabilities,omitempty"`
-		Config       *configInfo                `json:"config,omitempty"`
-	}
-)
-
-type catalogerInfoOptions struct {
-	Output                     string `yaml:"output" json:"output" mapstructure:"output"`
-	options.CatalogerSelection `yaml:",inline" json:",inline" mapstructure:",squash"`
-	Names                      []string // cataloger names from args
-}
-
-func (o *catalogerInfoOptions) setNames(args []string) error {
-	o.Names = args
-
-	usingLegacyCatalogers := len(o.Catalogers) > 0
-	usingNewCatalogers := len(o.DefaultCatalogers) > 0 || len(o.SelectCatalogers) > 0
-	usingSelection := usingNewCatalogers || usingLegacyCatalogers
-
-	if usingSelection && len(o.Names) > 0 {
-		return fmt.Errorf("cannot use both cataloger name arguments and '--catalogers'/'--select-catalogers'/'--default-catalogers' flags")
-	}
-
-	if usingSelection {
-		// get all available package cataloger tasks
-		pkgTaskFactories := task.DefaultPackageTaskFactories()
-		allPkgTasks, err := pkgTaskFactories.Tasks(task.DefaultCatalogingFactoryConfig())
-		if err != nil {
-			return fmt.Errorf("unable to create pkg cataloger tasks: %w", err)
-		}
-
-		// make the selection based on user input
-		defaultCatalogers := options.FlattenAndSort(o.DefaultCatalogers)
-		selectCatalogers := options.FlattenAndSort(o.SelectCatalogers)
-		selectedTaskGroups, _, err := task.SelectInGroups(
-			[][]task.Task{allPkgTasks},
-			cataloging.NewSelectionRequest().
-				WithDefaults(defaultCatalogers...).
-				WithExpression(selectCatalogers...),
-		)
-
-		if err != nil {
-			return fmt.Errorf("unable to select catalogers: %w", err)
-		}
-
-		// build the list of cataloger names based on the selection
-		for _, g := range selectedTaskGroups {
-			for _, t := range g {
-				o.Names = append(o.Names, t.Name())
-			}
-		}
-	}
-	return nil
-}
-
-func (o *catalogerInfoOptions) AddFlags(flags clio.FlagSet) {
-	flags.StringVarP(&o.Output, "output", "o", "format to output the cataloger info (available: table, json)")
-}
-
-func defaultCatalogerCapsOptions() *catalogerInfoOptions {
-	return &catalogerInfoOptions{
-		CatalogerSelection: options.CatalogerSelection{
-			// this is different than the default behavior where a scan will automatically detect the default set
-			DefaultCatalogers: []string{"all"},
-		},
-	}
-}
-
-func CatalogerCaps(app clio.Application) *cobra.Command {
-	opts := defaultCatalogerCapsOptions()
-
-	return app.SetupCommand(&cobra.Command{
-		Use:     "info [OPTIONS] [CATALOGER_NAMES...]",
-		Short:   "Show detailed capabilities of catalogers",
-		Args:    cobra.ArbitraryArgs,
-		PreRunE: disableUI(app, os.Stdout),
-		RunE: func(_ *cobra.Command, args []string) error {
-			if err := opts.setNames(args); err != nil {
-				return err
-			}
-
-			return runCatalogerInfo(opts)
-		},
-	}, opts)
-}
-
-func runCatalogerInfo(opts *catalogerInfoOptions) error {
-	doc, err := capabilities.LoadDocument()
-	if err != nil {
-		return fmt.Errorf("unable to load cataloger capabilities: %w", err)
-	}
-
-	// filter by cataloger names if provided
-	catalogers := doc.Catalogers
-	if len(opts.Names) > 0 {
-		catalogers = filterCatalogersByName(catalogers, opts.Names)
-	}
-
-	report, err := catalogerInfoReport(opts, doc, catalogers)
-	if err != nil {
-		return fmt.Errorf("unable to generate cataloger info report: %w", err)
-	}
-
-	bus.Report(report)
-	bus.Notify("Note: the `cataloger info` command is experimental and may change or be removed without notice. Do not depend on its output in production systems.")
-
-	return nil
-}
-
-func filterCatalogersByName(catalogers []capabilities.CatalogerEntry, names []string) []capabilities.CatalogerEntry {
-	nameSet := make(map[string]bool)
-	for _, name := range names {
-		nameSet[name] = true
-	}
-
-	var filtered []capabilities.CatalogerEntry
-	for _, cat := range catalogers {
-		if nameSet[cat.Name] {
-			filtered = append(filtered, cat)
-		}
-	}
-	return filtered
-}
-
-func catalogerInfoReport(opts *catalogerInfoOptions, doc *capabilities.Document, catalogers []capabilities.CatalogerEntry) (string, error) {
-	switch opts.Output {
-	case jsonFormat:
-		return renderCatalogerInfoJSON(doc, catalogers)
-	case "table", "":
-		return renderCatalogerInfoTable(doc, catalogers), nil
-	default:
-		return "", fmt.Errorf("invalid output format %q, must be one of: table, json", opts.Output)
-	}
-}
-
-func renderCatalogerInfoJSON(doc *capabilities.Document, catalogers []capabilities.CatalogerEntry) (string, error) {
-	type document struct {
-		Catalogers []catalogerInfo `json:"catalogers"`
-	}
-
-	docOut := document{}
-
-	// sort catalogers by ecosystem then name
-	sort.Slice(catalogers, func(i, j int) bool {
-		if catalogers[i].Ecosystem != catalogers[j].Ecosystem {
-			return catalogers[i].Ecosystem < catalogers[j].Ecosystem
-		}
-		return catalogers[i].Name < catalogers[j].Name
-	})
-
-	for _, cat := range catalogers {
-		info := catalogerInfo{
-			Ecosystem:  cat.Ecosystem,
-			Name:       cat.Name,
-			Type:       cat.Type,
-			Selectors:  cat.Selectors,
-			Deprecated: isDeprecatedCataloger(cat.Selectors),
-		}
-
-		// convert parsers to patterns if available
-		info.Patterns = convertParsersToPatterns(cat.Parsers)
-
-		// if no parsers, use detectors instead
-		if len(info.Patterns) == 0 {
-			info.Capabilities = cat.Capabilities
-			info.Patterns = convertDetectorsToPatterns(cat.Detectors, cat.PackageTypes, cat.JSONSchemaTypes)
-		}
-
-		info.Config = getConfigInfoFromDocument(doc, cat.Config)
-
-		docOut.Catalogers = append(docOut.Catalogers, info)
-	}
-
-	by, err := json.Marshal(docOut)
-	return string(by), err
-}
-
-// isDeprecatedCataloger checks if a cataloger is deprecated based on its selectors
-func isDeprecatedCataloger(selectors []string) bool {
-	return slices.Contains(selectors, "deprecated")
-}
-
-// convertDetectorPackages converts detector package info to the JSON output format
-func convertDetectorPackages(pkgs []capabilities.DetectorPackageInfo) []detectorPackageInfo {
-	var result []detectorPackageInfo
-	for _, pkg := range pkgs {
-		result = append(result, detectorPackageInfo{
-			Class: pkg.Class,
-			Name:  pkg.Name,
-			PURL:  pkg.PURL,
-			CPEs:  pkg.CPEs,
-			Type:  pkg.Type,
-		})
-	}
-	return result
-}
-
-// convertParsersToPatterns converts parser entries to pattern info for JSON output
-func convertParsersToPatterns(parsers []capabilities.Parser) []patternInfo {
-	var patterns []patternInfo
-	for _, parser := range parsers {
-		patterns = append(patterns, patternInfo{
-			Method:          string(parser.Detector.Method),
-			Criteria:        parser.Detector.Criteria,
-			Conditions:      parser.Detector.Conditions,
-			Packages:        convertDetectorPackages(parser.Detector.Packages),
-			Comment:         parser.Detector.Comment,
-			PackageTypes:    parser.PackageTypes,
-			JSONSchemaTypes: parser.JSONSchemaTypes,
-			Capabilities:    parser.Capabilities,
-		})
-	}
-	return patterns
-}
-
-// convertDetectorsToPatterns converts detector entries to pattern info for JSON output (for non-parser catalogers)
-func convertDetectorsToPatterns(detectors []capabilities.Detector, packageTypes, jsonSchemaTypes []string) []patternInfo {
-	var patterns []patternInfo
-	for _, det := range detectors {
-		patterns = append(patterns, patternInfo{
-			Method:          string(det.Method),
-			Criteria:        det.Criteria,
-			Conditions:      det.Conditions,
-			Packages:        convertDetectorPackages(det.Packages),
-			Comment:         det.Comment,
-			PackageTypes:    packageTypes,
-			JSONSchemaTypes: jsonSchemaTypes,
-		})
-	}
-	return patterns
-}
-
-// getConfigInfoFromDocument retrieves config info from the capabilities document
-func getConfigInfoFromDocument(doc *capabilities.Document, configType string) *configInfo {
-	if configType == "" {
-		return nil
-	}
-	configEntry, ok := doc.Configs[configType]
-	if !ok {
-		return nil
-	}
-	cfg := &configInfo{
-		Type: configType,
-	}
-	for _, field := range configEntry.Fields {
-		cfg.Fields = append(cfg.Fields, configFieldInfo{
-			Key:         field.Key,
-			Description: field.Description,
-			AppKey:      field.AppKey,
-		})
-	}
-	return cfg
-}
-
-func renderCatalogerInfoTable(_ *capabilities.Document, catalogers []capabilities.CatalogerEntry) string {
-	if len(catalogers) == 0 {
-		return noStyle.Render("No catalogers found")
-	}
-
-	// sort catalogers by ecosystem then name
-	sort.Slice(catalogers, func(i, j int) bool {
-		if catalogers[i].Ecosystem != catalogers[j].Ecosystem {
-			return catalogers[i].Ecosystem < catalogers[j].Ecosystem
-		}
-		return catalogers[i].Name < catalogers[j].Name
-	})
-
-	var buf bytes.Buffer
-
-	// create table with hierarchical merging
-	table := tablewriter.NewTable(&buf,
-		tablewriter.WithRenderer(renderer.NewBlueprint(tw.Rendition{
-			Settings: tw.Settings{Separators: tw.Separators{BetweenRows: tw.On}},
-		})),
-		tablewriter.WithConfig(tablewriter.Config{
-			Row: tw.CellConfig{
-				Formatting: tw.CellFormatting{MergeMode: tw.MergeHierarchical},
-				Alignment:  tw.CellAlignment{Global: tw.AlignLeft},
-			},
-		}),
-	)
-
-	// set headers
-	table.Header("ECOSYSTEM", "CATALOGER", "CRITERIA", "LICENSE", "NODES", "EDGES", "KINDS", "LISTING", "DIGESTS", "HASH")
-
-	// build rows for each cataloger
-	var data [][]string
-	for _, cat := range catalogers {
-		ecosystem := cat.Ecosystem
-		if ecosystem == "" {
-			ecosystem = "other"
-		}
-
-		if cat.Type == "generic" {
-			// generic catalogers: one row per parser
-			for _, parser := range cat.Parsers {
-				criteria := formatCriteria([]capabilities.Detector{parser.Detector})
-				row := buildTableRowFromCapabilities(ecosystem, cat.Name, criteria, parser.Capabilities)
-				data = append(data, row)
-			}
-		} else {
-			// custom catalogers: one row with all detectors
-			criteria := formatCriteria(cat.Detectors)
-			row := buildTableRowFromCapabilities(ecosystem, cat.Name, criteria, cat.Capabilities)
-			data = append(data, row)
-		}
-	}
-
-	// add all rows at once for better merging
-	_ = table.Bulk(data)
-	_ = table.Render()
-	return buf.String()
-}
-
-// buildTableRowFromCapabilities builds a table row from capability values
-func buildTableRowFromCapabilities(ecosystem, name, criteria string, caps capabilities.CapabilitySet) []string {
-	// extract capability default values
-	license := extractBoolCapability(caps, "license")
-	nodes := extractNodesCapability(caps)
-	edges := extractStringCapability(caps, "dependency.edges")
-	kinds := extractArrayCapability(caps, "dependency.kinds")
-	listing := extractBoolCapability(caps, "package_manager.files.listing")
-	digests := extractBoolCapability(caps, "package_manager.files.digests")
-	hash := extractBoolCapability(caps, "package_manager.package_integrity_hash")
-
-	return []string{
-		ecosystem,
-		name,
-		criteria,
-		license,
-		nodes,
-		edges,
-		kinds,
-		listing,
-		digests,
-		hash,
-	}
-}
-
-// extractBoolCapability extracts a boolean capability value and formats it
-func extractBoolCapability(caps capabilities.CapabilitySet, name string) string {
-	for _, cap := range caps {
-		if cap.Name == name {
-			if b, ok := cap.Default.(bool); ok {
-				if b {
-					return yesStyle.Render("✔")
-				}
-				return noStyle.Render("·")
-			}
-			return noStyle.Render("·")
-		}
-	}
-	return noStyle.Render("·")
-}
-
-// extractStringCapability extracts a string capability value
-func extractStringCapability(caps capabilities.CapabilitySet, name string) string {
-	for _, cap := range caps {
-		if cap.Name == name {
-			if s, ok := cap.Default.(string); ok && s != "" {
-				return s
-			}
-			return noStyle.Render("·")
-		}
-	}
-	return noStyle.Render("·")
-}
-
-// extractArrayCapability extracts an array capability value and formats it as comma-separated
-func extractArrayCapability(caps capabilities.CapabilitySet, name string) string {
-	for _, cap := range caps {
-		if cap.Name == name {
-			// handle various array types
-			switch v := cap.Default.(type) {
-			case []string:
-				if len(v) > 0 {
-					return strings.Join(v, ", ")
-				}
-			case []any:
-				if len(v) > 0 {
-					strs := make([]string, 0, len(v))
-					for _, item := range v {
-						strs = append(strs, fmt.Sprintf("%v", item))
-					}
-					return strings.Join(strs, ", ")
-				}
-			}
-			return noStyle.Render("·")
-		}
-	}
-	return noStyle.Render("·")
-}
-
-// extractNodesCapability extracts dependency.depth and formats it
-// maps ["direct", "indirect"] to "transitive"
-func extractNodesCapability(caps capabilities.CapabilitySet) string {
-	for _, cap := range caps {
-		if cap.Name == "dependency.depth" {
-			switch v := cap.Default.(type) {
-			case []string:
-				return formatDepthStringArray(v)
-			case []any:
-				return formatDepthInterfaceArray(v)
-			}
-			return noStyle.Render("·")
-		}
-	}
-	return noStyle.Render("·")
-}
-
-// formatDepthStringArray formats a []string dependency depth value
-func formatDepthStringArray(v []string) string {
-	if len(v) == 0 {
-		return noStyle.Render("·")
-	}
-	if hasBothDirectAndIndirect(v) {
-		return "transitive"
-	}
-	return strings.Join(v, ", ")
-}
-
-// formatDepthInterfaceArray formats a []interface{} dependency depth value
-func formatDepthInterfaceArray(v []any) string {
-	if len(v) == 0 {
-		return noStyle.Render("·")
-	}
-	strs := make([]string, 0, len(v))
-	for _, item := range v {
-		strs = append(strs, fmt.Sprintf("%v", item))
-	}
-	if hasBothDirectAndIndirect(strs) {
-		return "transitive"
-	}
-	return strings.Join(strs, ", ")
-}
-
-// hasBothDirectAndIndirect checks if a slice contains both "direct" and "indirect" strings
-func hasBothDirectAndIndirect(items []string) bool {
-	hasDirect := false
-	hasIndirect := false
-	for _, item := range items {
-		if item == "direct" {
-			hasDirect = true
-		}
-		if item == "indirect" {
-			hasIndirect = true
-		}
-	}
-	return hasDirect && hasIndirect
-}
-
-func formatCriteria(detectors []capabilities.Detector) string {
-	var allCriteria []string
-	methods := strset.New()
-
-	for _, det := range detectors {
-		allCriteria = append(allCriteria, det.Criteria...)
-		methods.Add(string(det.Method))
-	}
-
-	// smart word wrapping: wrap by word (criterion) up to criteriaWidth,
-	// allow up to criteriaWidth+criteriaMargin before forcing a new line
-	var lines []string
-	var currentLine []string
-	currentLength := 0
-
-	for _, criterion := range allCriteria {
-		// calculate length including the criterion plus ", " separator (except for first item)
-		itemLength := len(criterion)
-		if len(currentLine) > 0 {
-			itemLength += 2 // for ", "
-		}
-
-		newLength := currentLength + itemLength
-
-		if len(currentLine) > 0 && newLength > criteriaWidth {
-			// check if it's within margin
-			if newLength <= criteriaWidth+criteriaMargin {
-				// close enough, add it anyway
-				currentLine = append(currentLine, criterion)
-				currentLength = newLength
-			} else {
-				// too long, finalize current line and start new one
-				lines = append(lines, strings.Join(currentLine, ", "))
-				currentLine = []string{criterion}
-				currentLength = len(criterion)
-			}
-		} else {
-			// fits within width or first item
-			currentLine = append(currentLine, criterion)
-			currentLength = newLength
-		}
-	}
-
-	// add final line
-	if len(currentLine) > 0 {
-		lines = append(lines, strings.Join(currentLine, ", "))
-	}
-
-	methodsList := methods.List()
-	sort.Strings(methodsList)
-	method := strings.Join(methodsList, ", ")
-
-	if len(lines) == 0 {
-		return ""
-	}
-
-	joined := strings.Join(lines, "\n")
-	if method != string(capabilities.GlobDetection) {
-		return fmt.Sprintf("%s (%s)", joined, method)
-	}
-	return joined
-}

cmd/syft/internal/commands/cataloger_info_test.go

@@ -1,373 +0,0 @@
-package commands
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/google/go-cmp/cmp"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/anchore/syft/internal/capabilities"
-)
-
-func Test_isDeprecatedCataloger(t *testing.T) {
-	tests := []struct {
-		name      string
-		selectors []string
-		want      bool
-	}{
-		{
-			name:      "empty selectors",
-			selectors: nil,
-			want:      false,
-		},
-		{
-			name:      "no deprecated selector",
-			selectors: []string{"python", "pip", "package"},
-			want:      false,
-		},
-		{
-			name:      "has deprecated selector",
-			selectors: []string{"python", "deprecated", "package"},
-			want:      true,
-		},
-		{
-			name:      "only deprecated selector",
-			selectors: []string{"deprecated"},
-			want:      true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := isDeprecatedCataloger(tt.selectors)
-			assert.Equal(t, tt.want, got)
-		})
-	}
-}
-
-func Test_hasBothDirectAndIndirect(t *testing.T) {
-	tests := []struct {
-		name  string
-		items []string
-		want  bool
-	}{
-		{
-			name:  "empty slice",
-			items: nil,
-			want:  false,
-		},
-		{
-			name:  "only direct",
-			items: []string{"direct"},
-			want:  false,
-		},
-		{
-			name:  "only indirect",
-			items: []string{"indirect"},
-			want:  false,
-		},
-		{
-			name:  "both direct and indirect",
-			items: []string{"direct", "indirect"},
-			want:  true,
-		},
-		{
-			name:  "both with other items",
-			items: []string{"other", "direct", "more", "indirect", "stuff"},
-			want:  true,
-		},
-		{
-			name:  "unrelated items",
-			items: []string{"foo", "bar", "baz"},
-			want:  false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := hasBothDirectAndIndirect(tt.items)
-			assert.Equal(t, tt.want, got)
-		})
-	}
-}
-
-func Test_filterCatalogersByName(t *testing.T) {
-	catalogers := []capabilities.CatalogerEntry{
-		{Name: "python-cataloger", Ecosystem: "python"},
-		{Name: "java-cataloger", Ecosystem: "java"},
-		{Name: "go-cataloger", Ecosystem: "golang"},
-		{Name: "npm-cataloger", Ecosystem: "javascript"},
-	}
-
-	tests := []struct {
-		name       string
-		catalogers []capabilities.CatalogerEntry
-		names      []string
-		want       []capabilities.CatalogerEntry
-	}{
-		{
-			name:       "empty names returns empty",
-			catalogers: catalogers,
-			names:      nil,
-			want:       nil,
-		},
-		{
-			name:       "single match",
-			catalogers: catalogers,
-			names:      []string{"python-cataloger"},
-			want: []capabilities.CatalogerEntry{
-				{Name: "python-cataloger", Ecosystem: "python"},
-			},
-		},
-		{
-			name:       "multiple matches",
-			catalogers: catalogers,
-			names:      []string{"python-cataloger", "java-cataloger"},
-			want: []capabilities.CatalogerEntry{
-				{Name: "python-cataloger", Ecosystem: "python"},
-				{Name: "java-cataloger", Ecosystem: "java"},
-			},
-		},
-		{
-			name:       "no matches",
-			catalogers: catalogers,
-			names:      []string{"nonexistent"},
-			want:       nil,
-		},
-		{
-			name:       "partial matches",
-			catalogers: catalogers,
-			names:      []string{"python-cataloger", "nonexistent"},
-			want: []capabilities.CatalogerEntry{
-				{Name: "python-cataloger", Ecosystem: "python"},
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := filterCatalogersByName(tt.catalogers, tt.names)
-			if diff := cmp.Diff(tt.want, got); diff != "" {
-				t.Errorf("filterCatalogersByName() mismatch (-want +got):\n%s", diff)
-			}
-		})
-	}
-}
-
-func Test_formatCriteria(t *testing.T) {
-	tests := []struct {
-		name      string
-		detectors []capabilities.Detector
-		want      string
-	}{
-		{
-			name:      "empty detectors",
-			detectors: nil,
-			want:      "",
-		},
-		{
-			name: "single glob detector",
-			detectors: []capabilities.Detector{
-				{
-					Method:   capabilities.GlobDetection,
-					Criteria: []string{"**/*.py"},
-				},
-			},
-			want: "**/*.py",
-		},
-		{
-			name: "multiple criteria single detector",
-			detectors: []capabilities.Detector{
-				{
-					Method:   capabilities.GlobDetection,
-					Criteria: []string{"**/*.py", "**/*.pyc", "**/requirements.txt"},
-				},
-			},
-			want: "**/*.py, **/*.pyc, **/requirements.txt",
-		},
-		{
-			name: "path detection shows method",
-			detectors: []capabilities.Detector{
-				{
-					Method:   capabilities.PathDetection,
-					Criteria: []string{"/usr/bin/python"},
-				},
-			},
-			want: "/usr/bin/python (path)",
-		},
-		{
-			name: "mimetype detection shows method",
-			detectors: []capabilities.Detector{
-				{
-					Method:   capabilities.MIMETypeDetection,
-					Criteria: []string{"application/x-python"},
-				},
-			},
-			want: "application/x-python (mimetype)",
-		},
-		{
-			name: "multiple detectors combine criteria",
-			detectors: []capabilities.Detector{
-				{
-					Method:   capabilities.GlobDetection,
-					Criteria: []string{"**/*.py"},
-				},
-				{
-					Method:   capabilities.GlobDetection,
-					Criteria: []string{"**/*.pyc"},
-				},
-			},
-			want: "**/*.py, **/*.pyc",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := formatCriteria(tt.detectors)
-			assert.Equal(t, tt.want, got)
-		})
-	}
-}
-
-func testDocument() *capabilities.Document {
-	return &capabilities.Document{
-		Configs: map[string]capabilities.CatalogerConfigEntry{
-			"test-config": {
-				Fields: []capabilities.CatalogerConfigFieldEntry{
-					{Key: "field1", Description: "test field"},
-				},
-			},
-		},
-	}
-}
-
-func Test_catalogerInfoReport(t *testing.T) {
-	tests := []struct {
-		name       string
-		opts       *catalogerInfoOptions
-		doc        *capabilities.Document
-		catalogers []capabilities.CatalogerEntry
-		wantErr    require.ErrorAssertionFunc
-		assertions func(t *testing.T, got string)
-	}{
-		{
-			name: "empty catalogers table",
-			opts: &catalogerInfoOptions{Output: "table"},
-			doc:  testDocument(),
-			assertions: func(t *testing.T, got string) {
-				assert.Contains(t, got, "No catalogers found")
-			},
-		},
-		{
-			name: "empty catalogers json",
-			opts: &catalogerInfoOptions{Output: "json"},
-			doc:  testDocument(),
-			assertions: func(t *testing.T, got string) {
-				assert.Contains(t, got, `"catalogers":null`)
-			},
-		},
-		{
-			name: "single cataloger table output",
-			opts: &catalogerInfoOptions{Output: "table"},
-			doc:  testDocument(),
-			catalogers: []capabilities.CatalogerEntry{
-				{
-					Name:      "test-cataloger",
-					Ecosystem: "test",
-					Type:      "custom",
-					Detectors: []capabilities.Detector{
-						{Method: capabilities.GlobDetection, Criteria: []string{"**/*.test"}},
-					},
-				},
-			},
-			assertions: func(t *testing.T, got string) {
-				assert.Contains(t, got, "test-cataloger")
-				assert.Contains(t, got, "ECOSYSTEM")
-				assert.Contains(t, got, "CATALOGER")
-			},
-		},
-		{
-			name: "single cataloger json output",
-			opts: &catalogerInfoOptions{Output: "json"},
-			doc:  testDocument(),
-			catalogers: []capabilities.CatalogerEntry{
-				{
-					Name:      "test-cataloger",
-					Ecosystem: "test",
-					Type:      "custom",
-					Selectors: []string{"test", "custom"},
-				},
-			},
-			assertions: func(t *testing.T, got string) {
-				assert.Contains(t, got, `"name":"test-cataloger"`)
-				assert.Contains(t, got, `"ecosystem":"test"`)
-				assert.Contains(t, got, `"type":"custom"`)
-			},
-		},
-		{
-			name: "deprecated cataloger json output",
-			opts: &catalogerInfoOptions{Output: "json"},
-			doc:  testDocument(),
-			catalogers: []capabilities.CatalogerEntry{
-				{
-					Name:      "old-cataloger",
-					Ecosystem: "legacy",
-					Type:      "custom",
-					Selectors: []string{"legacy", "deprecated"},
-				},
-			},
-			assertions: func(t *testing.T, got string) {
-				assert.Contains(t, got, `"deprecated":true`)
-			},
-		},
-		{
-			name:    "invalid output format",
-			opts:    &catalogerInfoOptions{Output: "invalid"},
-			doc:     testDocument(),
-			wantErr: require.Error,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if tt.wantErr == nil {
-				tt.wantErr = require.NoError
-			}
-
-			got, err := catalogerInfoReport(tt.opts, tt.doc, tt.catalogers)
-			tt.wantErr(t, err)
-
-			if err != nil {
-				return
-			}
-
-			if tt.assertions != nil {
-				tt.assertions(t, got)
-			}
-		})
-	}
-}
-
-func Test_formatCriteria_wordWrapping(t *testing.T) {
-	// test word wrapping behavior with long criteria lists
-	longCriteria := make([]string, 20)
-	for i := range longCriteria {
-		longCriteria[i] = "**/file" + strings.Repeat("x", 10)
-	}
-
-	detector := capabilities.Detector{
-		Method:   capabilities.GlobDetection,
-		Criteria: longCriteria,
-	}
-
-	got := formatCriteria([]capabilities.Detector{detector})
-
-	// should contain newlines for wrapping
-	assert.Contains(t, got, "\n")
-	// should contain all criteria (joined with ", " and possibly split across lines)
-	for _, c := range longCriteria {
-		assert.Contains(t, got, c)
-	}
-}

cmd/syft/internal/commands/cataloger_list.go

@@ -15,7 +15,6 @@ import (
 	"github.com/anchore/clio"
 	"github.com/anchore/syft/cmd/syft/internal/options"
 	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/internal/capabilities"
 	"github.com/anchore/syft/internal/task"
 	"github.com/anchore/syft/syft/cataloging"
 )
@@ -29,23 +28,25 @@ var (
 )
 
 type catalogerListOptions struct {
-	Output                     string `yaml:"output" json:"output" mapstructure:"output"`
-	options.CatalogerSelection `yaml:",inline" json:",inline" mapstructure:",squash"`
-	ShowHidden                 bool `yaml:"show-hidden" json:"show-hidden" mapstructure:"show-hidden"`
+	Output            string   `yaml:"output" json:"output" mapstructure:"output"`
+	DefaultCatalogers []string `yaml:"default-catalogers" json:"default-catalogers" mapstructure:"default-catalogers"`
+	SelectCatalogers  []string `yaml:"select-catalogers" json:"select-catalogers" mapstructure:"select-catalogers"`
+	ShowHidden        bool     `yaml:"show-hidden" json:"show-hidden" mapstructure:"show-hidden"`
 }
 
 func (o *catalogerListOptions) AddFlags(flags clio.FlagSet) {
 	flags.StringVarP(&o.Output, "output", "o", "format to output the cataloger list (available: table, json)")
 
+	flags.StringArrayVarP(&o.DefaultCatalogers, "override-default-catalogers", "", "override the default catalogers with an expression")
+
+	flags.StringArrayVarP(&o.SelectCatalogers, "select-catalogers", "", "select catalogers with an expression")
+
 	flags.BoolVarP(&o.ShowHidden, "show-hidden", "s", "show catalogers that have been de-selected")
 }
 
 func defaultCatalogerListOptions() *catalogerListOptions {
 	return &catalogerListOptions{
-		CatalogerSelection: options.CatalogerSelection{
-			// this is different than the default behavior where a scan will automatically detect the default set
-			DefaultCatalogers: []string{"all"},
-		},
+		DefaultCatalogers: []string{"all"},
 	}
 }
 
@@ -100,7 +101,7 @@ func catalogerListReport(opts *catalogerListOptions, allTaskGroups [][]task.Task
 	var report string
 
 	switch opts.Output {
-	case jsonFormat:
+	case "json":
 		report, err = renderCatalogerListJSON(flattenTaskGroups(selectedTaskGroups), selectionEvidence, defaultCatalogers, selectCatalogers)
 	case "table", "":
 		if opts.ShowHidden {
@@ -305,14 +306,22 @@ func formatToken(token string, selection *task.TokenSelection, included bool, de
 }
 
 func extractTaskInfo(tasks []task.Task) ([]string, map[string][]string) {
-	infos := capabilities.ExtractCatalogerInfo(tasks)
-
 	tagsByName := make(map[string][]string)
 	var names []string
 
-	for _, info := range infos {
-		tagsByName[info.Name] = info.Selectors
-		names = append(names, info.Name)
+	for _, tsk := range tasks {
+		var tags []string
+		name := tsk.Name()
+
+		if s, ok := tsk.(task.Selector); ok {
+			set := strset.New(s.Selectors()...)
+			set.Remove(name)
+			tags = set.List()
+			sort.Strings(tags)
+		}
+
+		tagsByName[name] = tags
+		names = append(names, name)
 	}
 
 	sort.Strings(names)

cmd/syft/internal/commands/convert.go

@@ -40,7 +40,7 @@ func Convert(app clio.Application) *cobra.Command {
 		Use:   "convert [SOURCE-SBOM] -o [FORMAT]",
 		Short: "Convert between SBOM formats",
 		Long:  "[Experimental] Convert SBOM files to, and from, SPDX, CycloneDX and Syft's format. For more info about data loss between formats see https://github.com/anchore/syft/wiki/format-conversion",
-		Example: internal.Tprintf(convertExample, map[string]any{
+		Example: internal.Tprintf(convertExample, map[string]interface{}{
 			"appName": id.Name,
 			"command": "convert",
 		}),

cmd/syft/internal/commands/packages.go

@@ -18,7 +18,7 @@ func Packages(app clio.Application, scanCmd *cobra.Command) *cobra.Command {
 		Short: scanCmd.Short,
 		Long:  scanCmd.Long,
 		Args:  scanCmd.Args,
-		Example: internal.Tprintf(scanHelp, map[string]any{
+		Example: internal.Tprintf(scanHelp, map[string]interface{}{
 			"appName": id.Name,
 			"command": "packages",
 		}),

cmd/syft/internal/commands/packages_test.go

@@ -29,7 +29,7 @@ func Test_filterExpressionErrors_expressionErrorsHelp(t *testing.T) {
 		{
 			name: "single non-expression error is retained",
 			err:  errors.New("foo"),
-			wantErr: func(t assert.TestingT, err error, i ...any) bool {
+			wantErr: func(t assert.TestingT, err error, i ...interface{}) bool {
 				return assert.Equal(t, "foo", err.Error())
 			},
 			wantHelp: "",
@@ -42,7 +42,7 @@ func Test_filterExpressionErrors_expressionErrorsHelp(t *testing.T) {
 				err = multierror.Append(err, errors.New("bar"))
 				return err
 			}(),
-			wantErr: func(t assert.TestingT, err error, i ...any) bool {
+			wantErr: func(t assert.TestingT, err error, i ...interface{}) bool {
 				// note: this is the default formatting from the hashicorp multierror object
 				expected := `2 errors occurred:
 	* foo
@@ -64,7 +64,7 @@ func Test_filterExpressionErrors_expressionErrorsHelp(t *testing.T) {
 				err = multierror.Append(err, errors.New("last"))
 				return err
 			}(),
-			wantErr: func(t assert.TestingT, err error, i ...any) bool {
+			wantErr: func(t assert.TestingT, err error, i ...interface{}) bool {
 				expected := `5 errors occurred:
 	* foo
 	* invalid expression: "foo": tags are not allowed with this operation (must use exact names)
@@ -103,7 +103,7 @@ func Test_filterExpressionErrors_expressionErrorsHelp(t *testing.T) {
 
 				return fmt.Errorf("top: %w", fmt.Errorf("middle: %w", err))
 			}(),
-			wantErr: func(t assert.TestingT, err error, i ...any) bool {
+			wantErr: func(t assert.TestingT, err error, i ...interface{}) bool {
 				expected := `top: middle: 4 errors occurred:
 	* foo: bar: last
 	* invalid expression: "foo": tags are not allowed with this operation (must use exact names)
@@ -142,7 +142,7 @@ func Test_filterExpressionErrors_expressionErrorsHelp(t *testing.T) {
 				// note we wrap the top error in a chain
 				return fmt.Errorf("top: %w", fmt.Errorf("middle: %w", err))
 			}(),
-			wantErr: func(t assert.TestingT, err error, i ...any) bool {
+			wantErr: func(t assert.TestingT, err error, i ...interface{}) bool {
 				expected := `top: middle: 4 errors occurred:
 	* foo: bar: last
 	* invalid expression: "foo": tags are not allowed with this operation (must use exact names)
@@ -178,7 +178,7 @@ func Test_filterExpressionErrors_expressionErrorsHelp(t *testing.T) {
 
 				return err
 			}(),
-			wantErr: func(t assert.TestingT, err error, i ...any) bool {
+			wantErr: func(t assert.TestingT, err error, i ...interface{}) bool {
 				// note: the errors are removed and the help text shows the enriched error help
 				expected := `2 errors occurred:
 	* invalid expression: "foo": tags are not allowed with this operation (must use exact names)

cmd/syft/internal/commands/scan.go

@@ -59,9 +59,7 @@ const (
 	nonImageSchemeHelp = `    {{.appName}} {{.command}} dir:path/to/yourproject                  read directly from a path on disk (any directory)
     {{.appName}} {{.command}} file:path/to/yourproject/file            read directly from a path on disk (any single file)
 `
-	modelSchemeHelp = `    {{.appName}} {{.command}} oci-model-registry:ai/llama3.2           scan an OCI model artifact from a registry (e.g. Docker Hub AI models)
-`
-	scanSchemeHelp = "\n  " + schemeHelpHeader + "\n" + imageSchemeHelp + modelSchemeHelp + nonImageSchemeHelp
+	scanSchemeHelp = "\n  " + schemeHelpHeader + "\n" + imageSchemeHelp + nonImageSchemeHelp
 
 	scanHelp = scanExample + scanSchemeHelp
 )
@@ -92,7 +90,7 @@ func Scan(app clio.Application) *cobra.Command {
 		Use:   "scan [SOURCE]",
 		Short: "Generate an SBOM",
 		Long:  "Generate a packaged-based Software Bill Of Materials (SBOM) from container images and filesystems",
-		Example: internal.Tprintf(scanHelp, map[string]any{
+		Example: internal.Tprintf(scanHelp, map[string]interface{}{
 			"appName": id.Name,
 			"command": "scan",
 		}),

cmd/syft/internal/commands/scan_test.go

@@ -19,30 +19,30 @@ func Test_scanOptions_validateLegacyOptionsNotUsed(t *testing.T) {
 		},
 		{
 			name: "config file with no legacy options",
-			cfg:  "testdata/scan-configs/no-legacy-options.yaml",
+			cfg:  "test-fixtures/scan-configs/no-legacy-options.yaml",
 		},
 		{
 			name:    "config file with default image pull source legacy option",
-			cfg:     "testdata/scan-configs/with-default-pull-source.yaml",
+			cfg:     "test-fixtures/scan-configs/with-default-pull-source.yaml",
 			wantErr: assertErrorContains("source.image.default-pull-source"),
 		},
 		{
 			name:    "config file with exclude-binary-overlap-by-ownership legacy option",
-			cfg:     "testdata/scan-configs/with-exclude-binary-overlap-by-ownership.yaml",
+			cfg:     "test-fixtures/scan-configs/with-exclude-binary-overlap-by-ownership.yaml",
 			wantErr: assertErrorContains("package.exclude-binary-overlap-by-ownership"),
 		},
 		{
 			name:    "config file with file string legacy option",
-			cfg:     "testdata/scan-configs/with-file-string.yaml",
+			cfg:     "test-fixtures/scan-configs/with-file-string.yaml",
 			wantErr: assertErrorContains("outputs"),
 		},
 		{
 			name: "config file with file section",
-			cfg:  "testdata/scan-configs/with-file-section.yaml",
+			cfg:  "test-fixtures/scan-configs/with-file-section.yaml",
 		},
 		{
 			name:    "config file with base-path legacy option",
-			cfg:     "testdata/scan-configs/with-base-path.yaml",
+			cfg:     "test-fixtures/scan-configs/with-base-path.yaml",
 			wantErr: assertErrorContains("source.base-path"),
 		},
 	}
@@ -60,7 +60,7 @@ func Test_scanOptions_validateLegacyOptionsNotUsed(t *testing.T) {
 }
 
 func assertErrorContains(contains string) assert.ErrorAssertionFunc {
-	return func(t assert.TestingT, err error, i ...any) bool {
+	return func(t assert.TestingT, err error, i ...interface{}) bool {
 		return assert.ErrorContains(t, err, contains, i...)
 	}
 }

cmd/syft/internal/commands/update.go

@@ -107,7 +107,7 @@ func fetchLatestApplicationVersion(id clio.Identification) (*hashiVersion.Versio
 		return nil, fmt.Errorf("HTTP %d on fetching latest version: %s", resp.StatusCode, resp.Status)
 	}
 
-	versionBytes, err := io.ReadAll(io.LimitReader(resp.Body, 500))
+	versionBytes, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return nil, fmt.Errorf("failed to read latest version: %w", err)
 	}

cmd/syft/internal/options/catalog.go

@@ -2,7 +2,6 @@ package options
 
 import (
 	"fmt"
-	"slices"
 	"sort"
 	"strings"
 
@@ -17,8 +16,6 @@ import (
 	"github.com/anchore/syft/syft/cataloging"
 	"github.com/anchore/syft/syft/cataloging/filecataloging"
 	"github.com/anchore/syft/syft/cataloging/pkgcataloging"
-	"github.com/anchore/syft/syft/file/cataloger/executable"
-	"github.com/anchore/syft/syft/file/cataloger/filecontent"
 	"github.com/anchore/syft/syft/pkg/cataloger/binary"
 	"github.com/anchore/syft/syft/pkg/cataloger/dotnet"
 	"github.com/anchore/syft/syft/pkg/cataloger/golang"
@@ -32,16 +29,17 @@ import (
 
 type Catalog struct {
 	// high-level cataloger configuration
-	CatalogerSelection `yaml:",inline" json:",inline" mapstructure:",squash"`
-
-	Package       packageConfig       `yaml:"package" json:"package" mapstructure:"package"`
-	License       licenseConfig       `yaml:"license" json:"license" mapstructure:"license"`
-	File          fileConfig          `yaml:"file" json:"file" mapstructure:"file"`
-	Scope         string              `yaml:"scope" json:"scope" mapstructure:"scope"`
-	Parallelism   int                 `yaml:"parallelism" json:"parallelism" mapstructure:"parallelism"` // the number of catalog workers to run in parallel
-	Relationships relationshipsConfig `yaml:"relationships" json:"relationships" mapstructure:"relationships"`
-	Compliance    complianceConfig    `yaml:"compliance" json:"compliance" mapstructure:"compliance"`
-	Enrich        []string            `yaml:"enrich" json:"enrich" mapstructure:"enrich"`
+	Catalogers        []string            `yaml:"-" json:"catalogers" mapstructure:"catalogers"` // deprecated and not shown in yaml output
+	DefaultCatalogers []string            `yaml:"default-catalogers" json:"default-catalogers" mapstructure:"default-catalogers"`
+	SelectCatalogers  []string            `yaml:"select-catalogers" json:"select-catalogers" mapstructure:"select-catalogers"`
+	Package           packageConfig       `yaml:"package" json:"package" mapstructure:"package"`
+	License           licenseConfig       `yaml:"license" json:"license" mapstructure:"license"`
+	File              fileConfig          `yaml:"file" json:"file" mapstructure:"file"`
+	Scope             string              `yaml:"scope" json:"scope" mapstructure:"scope"`
+	Parallelism       int                 `yaml:"parallelism" json:"parallelism" mapstructure:"parallelism"` // the number of catalog workers to run in parallel
+	Relationships     relationshipsConfig `yaml:"relationships" json:"relationships" mapstructure:"relationships"`
+	Compliance        complianceConfig    `yaml:"compliance" json:"compliance" mapstructure:"compliance"`
+	Enrich            []string            `yaml:"enrich" json:"enrich" mapstructure:"enrich"`
 
 	// ecosystem-specific cataloger configuration
 	Dotnet      dotnetConfig      `yaml:"dotnet" json:"dotnet" mapstructure:"dotnet"`
@@ -77,8 +75,6 @@ func DefaultCatalog() Catalog {
 		Package:       defaultPackageConfig(),
 		License:       defaultLicenseConfig(),
 		LinuxKernel:   defaultLinuxKernelConfig(),
-		JavaScript:    defaultJavaScriptConfig(),
-		Python:        defaultPythonConfig(),
 		Nix:           defaultNixConfig(),
 		Dotnet:        defaultDotnetConfig(),
 		Golang:        defaultGolangConfig(),
@@ -144,18 +140,21 @@ func (cfg Catalog) ToFilesConfig() filecataloging.Config {
 		log.WithFields("error", err).Warn("unable to configure file hashers")
 	}
 
-	return filecataloging.Config{
-		Selection: cfg.File.Metadata.Selection,
-		Hashers:   hashers,
-		Content: filecontent.Config{
-			Globs:              cfg.File.Content.Globs,
-			SkipFilesAboveSize: cfg.File.Content.SkipFilesAboveSize,
-		},
-		Executable: executable.Config{
-			MIMETypes: executable.DefaultConfig().MIMETypes,
-			Globs:     cfg.File.Executable.Globs,
-		},
-	}
+	c := filecataloging.DefaultConfig()
+	c.Selection = cfg.File.Metadata.Selection
+	c.Hashers = hashers
+	c.Content.Globs = cfg.File.Content.Globs
+	c.Content.SkipFilesAboveSize = cfg.File.Content.SkipFilesAboveSize
+	c.Executable.Globs = cfg.File.Executable.Globs
+
+	// symbol capture configuration
+	c.Executable.Symbols.CaptureScope = cfg.File.Executable.Symbols.CaptureScope
+	c.Executable.Symbols.Types = cfg.File.Executable.Symbols.Types
+	c.Executable.Symbols.Go.StandardLibrary = cfg.File.Executable.Symbols.Go.StandardLibrary
+	c.Executable.Symbols.Go.ExtendedStandardLibrary = cfg.File.Executable.Symbols.Go.ExtendedStandardLibrary
+	c.Executable.Symbols.Go.ThirdPartyModules = cfg.File.Executable.Symbols.Go.ThirdPartyModules
+
+	return c
 }
 
 func (cfg Catalog) ToLicenseConfig() cataloging.LicenseConfig {
@@ -232,9 +231,26 @@ func (cfg *Catalog) AddFlags(flags clio.FlagSet) {
 	flags.StringArrayVarP(&cfg.Exclusions, "exclude", "",
 		"exclude paths from being scanned using a glob expression")
 
+	flags.StringArrayVarP(&cfg.Catalogers, "catalogers", "",
+		"enable one or more package catalogers")
+
 	flags.IntVarP(&cfg.Parallelism, "parallelism", "",
 		"number of cataloger workers to run in parallel")
 
+	if pfp, ok := flags.(fangs.PFlagSetProvider); ok {
+		if err := pfp.PFlagSet().MarkDeprecated("catalogers", "use: override-default-catalogers and select-catalogers"); err != nil {
+			panic(err)
+		}
+	} else {
+		panic("unable to mark flags as deprecated")
+	}
+
+	flags.StringArrayVarP(&cfg.DefaultCatalogers, "override-default-catalogers", "",
+		"set the base set of catalogers to use (defaults to 'image' or 'directory' depending on the scan source)")
+
+	flags.StringArrayVarP(&cfg.SelectCatalogers, "select-catalogers", "",
+		"add, remove, and filter the catalogers to be used")
+
 	flags.StringArrayVarP(&cfg.Enrich, "enrich", "",
 		fmt.Sprintf("enable package data enrichment from local and online sources (options: %s)", strings.Join(publicisedEnrichmentOptions, ", ")))
 
@@ -261,9 +277,23 @@ Available options are: %s`, strings.Join(publicisedEnrichmentOptions, ", ")))
 }
 
 func (cfg *Catalog) PostLoad() error {
+	usingLegacyCatalogers := len(cfg.Catalogers) > 0
+	usingNewCatalogers := len(cfg.DefaultCatalogers) > 0 || len(cfg.SelectCatalogers) > 0
+
+	if usingLegacyCatalogers && usingNewCatalogers {
+		return fmt.Errorf("cannot use both 'catalogers' and 'select-catalogers'/'default-catalogers' flags")
+	}
+
 	cfg.From = Flatten(cfg.From)
+
+	cfg.Catalogers = FlattenAndSort(cfg.Catalogers)
+	cfg.DefaultCatalogers = FlattenAndSort(cfg.DefaultCatalogers)
+	cfg.SelectCatalogers = FlattenAndSort(cfg.SelectCatalogers)
 	cfg.Enrich = FlattenAndSort(cfg.Enrich)
 
+	// for backwards compatibility
+	cfg.DefaultCatalogers = append(cfg.DefaultCatalogers, cfg.Catalogers...)
+
 	s := source.ParseScope(cfg.Scope)
 	if s == source.UnknownScope {
 		return fmt.Errorf("bad scope value %q", cfg.Scope)
@@ -274,6 +304,11 @@ func (cfg *Catalog) PostLoad() error {
 		return fmt.Errorf("cannot enable exclude-binary-overlap-by-ownership without enabling package-file-ownership-overlap")
 	}
 
+	// validate file executable options
+	if err := cfg.ToFilesConfig().Executable.Validate(); err != nil {
+		return fmt.Errorf("invalid file executable configuration: %w", err)
+	}
+
 	return nil
 }
 
@@ -314,8 +349,10 @@ func enrichmentEnabled(enrichDirectives []string, features ...string) *bool {
 				directive = directive[1:]
 				enable = false
 			}
-			if slices.Contains(features, directive) {
-				return &enable
+			for _, feature := range features {
+				if directive == feature {
+					return &enable
+				}
 			}
 		}
 		return nil

cmd/syft/internal/options/catalog_test.go

@@ -8,12 +8,55 @@ import (
 )
 
 func TestCatalog_PostLoad(t *testing.T) {
+
 	tests := []struct {
 		name    string
 		options Catalog
 		assert  func(t *testing.T, options Catalog)
 		wantErr assert.ErrorAssertionFunc
 	}{
+		{
+			name: "mutually exclusive cataloger flags (cat / def-cat)",
+			options: Catalog{
+				Catalogers:        []string{"foo,bar", "42"},
+				DefaultCatalogers: []string{"some,thing"},
+				Scope:             "squashed",
+			},
+			wantErr: assert.Error,
+		},
+		{
+			name: "mutually exclusive cataloger flags (cat / sel-cat)",
+			options: Catalog{
+				Catalogers:       []string{"foo,bar", "42"},
+				SelectCatalogers: []string{"some,thing"},
+				Scope:            "squashed",
+			},
+			wantErr: assert.Error,
+		},
+		{
+			name: "allow old cataloger flags",
+			options: Catalog{
+				Catalogers: []string{"foo,bar"},
+				Scope:      "squashed",
+			},
+			assert: func(t *testing.T, options Catalog) {
+				assert.Equal(t, []string{"bar", "foo"}, options.DefaultCatalogers) // note: sorted order
+				assert.Equal(t, []string{"bar", "foo"}, options.Catalogers)        // note: sorted order
+			},
+		},
+		{
+			name: "allow new cataloger flags",
+			options: Catalog{
+				SelectCatalogers:  []string{"foo,bar", "42"},
+				DefaultCatalogers: []string{"some,thing"},
+				Scope:             "squashed",
+			},
+			assert: func(t *testing.T, options Catalog) {
+				assert.Equal(t, []string{"42", "bar", "foo"}, options.SelectCatalogers) // note: sorted order
+				assert.Equal(t, []string{"some", "thing"}, options.DefaultCatalogers)   // note: sorted order
+				assert.Empty(t, options.Catalogers)
+			},
+		},
 		{
 			name: "must have package overlap flag when pruning binaries by overlap",
 			options: Catalog{

cmd/syft/internal/options/cataloger_selection.go

@@ -1,57 +0,0 @@
-package options
-
-import (
-	"fmt"
-
-	"github.com/anchore/clio"
-	"github.com/anchore/fangs"
-)
-
-type CatalogerSelection struct {
-	// high-level cataloger configuration
-	Catalogers        []string `yaml:"-" json:"catalogers" mapstructure:"catalogers"` // deprecated and not shown in yaml output
-	DefaultCatalogers []string `yaml:"default-catalogers" json:"default-catalogers" mapstructure:"default-catalogers"`
-	SelectCatalogers  []string `yaml:"select-catalogers" json:"select-catalogers" mapstructure:"select-catalogers"`
-}
-
-var _ interface {
-	clio.FlagAdder
-	clio.PostLoader
-} = (*CatalogerSelection)(nil)
-
-func (cfg *CatalogerSelection) AddFlags(flags clio.FlagSet) {
-	flags.StringArrayVarP(&cfg.Catalogers, "catalogers", "",
-		"enable one or more package catalogers")
-
-	if pfp, ok := flags.(fangs.PFlagSetProvider); ok {
-		if err := pfp.PFlagSet().MarkDeprecated("catalogers", "use: override-default-catalogers and select-catalogers"); err != nil {
-			panic(err)
-		}
-	} else {
-		panic("unable to mark flags as deprecated")
-	}
-
-	flags.StringArrayVarP(&cfg.DefaultCatalogers, "override-default-catalogers", "",
-		"set the base set of catalogers to use (defaults to 'image' or 'directory' depending on the scan source)")
-
-	flags.StringArrayVarP(&cfg.SelectCatalogers, "select-catalogers", "",
-		"add, remove, and filter the catalogers to be used")
-}
-
-func (cfg *CatalogerSelection) PostLoad() error {
-	usingLegacyCatalogers := len(cfg.Catalogers) > 0
-	usingNewCatalogers := len(cfg.DefaultCatalogers) > 0 || len(cfg.SelectCatalogers) > 0
-
-	if usingLegacyCatalogers && usingNewCatalogers {
-		return fmt.Errorf("cannot use both 'catalogers' and 'select-catalogers'/'default-catalogers' flags %q | %q %q", cfg.Catalogers, cfg.SelectCatalogers, cfg.DefaultCatalogers)
-	}
-
-	cfg.Catalogers = FlattenAndSort(cfg.Catalogers)
-	cfg.DefaultCatalogers = FlattenAndSort(cfg.DefaultCatalogers)
-	cfg.SelectCatalogers = FlattenAndSort(cfg.SelectCatalogers)
-
-	// for backwards compatibility
-	cfg.DefaultCatalogers = append(cfg.DefaultCatalogers, cfg.Catalogers...)
-
-	return nil
-}

cmd/syft/internal/options/cataloger_selection_test.go

@@ -1,68 +0,0 @@
-package options
-
-import (
-	"fmt"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestCatalogerSelection_PostLoad(t *testing.T) {
-
-	tests := []struct {
-		name    string
-		options CatalogerSelection
-		assert  func(t *testing.T, options CatalogerSelection)
-		wantErr assert.ErrorAssertionFunc
-	}{
-		{
-			name: "mutually exclusive cataloger flags (cat / def-cat)",
-			options: CatalogerSelection{
-				Catalogers:        []string{"foo,bar", "42"},
-				DefaultCatalogers: []string{"some,thing"},
-			},
-			wantErr: assert.Error,
-		},
-		{
-			name: "mutually exclusive cataloger flags (cat / sel-cat)",
-			options: CatalogerSelection{
-				Catalogers:       []string{"foo,bar", "42"},
-				SelectCatalogers: []string{"some,thing"},
-			},
-			wantErr: assert.Error,
-		},
-		{
-			name: "allow old cataloger flags",
-			options: CatalogerSelection{
-				Catalogers: []string{"foo,bar"},
-			},
-			assert: func(t *testing.T, options CatalogerSelection) {
-				assert.Equal(t, []string{"bar", "foo"}, options.DefaultCatalogers) // note: sorted order
-				assert.Equal(t, []string{"bar", "foo"}, options.Catalogers)        // note: sorted order
-			},
-		},
-		{
-			name: "allow new cataloger flags",
-			options: CatalogerSelection{
-				SelectCatalogers:  []string{"foo,bar", "42"},
-				DefaultCatalogers: []string{"some,thing"},
-			},
-			assert: func(t *testing.T, options CatalogerSelection) {
-				assert.Equal(t, []string{"42", "bar", "foo"}, options.SelectCatalogers) // note: sorted order
-				assert.Equal(t, []string{"some", "thing"}, options.DefaultCatalogers)   // note: sorted order
-				assert.Empty(t, options.Catalogers)
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if tt.wantErr == nil {
-				tt.wantErr = assert.NoError
-			}
-			tt.wantErr(t, tt.options.PostLoad(), fmt.Sprintf("PostLoad()"))
-			if tt.assert != nil {
-				tt.assert(t, tt.options)
-			}
-		})
-	}
-}

cmd/syft/internal/options/file.go

@@ -9,6 +9,7 @@ import (
 	"github.com/anchore/clio"
 	intFile "github.com/anchore/syft/internal/file"
 	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/file/cataloger/executable"
 )
 
 type fileConfig struct {
@@ -28,11 +29,27 @@ type fileContent struct {
 }
 
 type fileExecutable struct {
-	Globs []string `yaml:"globs" json:"globs" mapstructure:"globs"`
+	Globs   []string         `yaml:"globs" json:"globs" mapstructure:"globs"`
+	Symbols fileSymbolConfig `yaml:"symbols" json:"symbols" mapstructure:"symbols"`
+}
+
+type fileSymbolConfig struct {
+	CaptureScope []executable.SymbolCaptureScope `yaml:"capture" json:"capture" mapstructure:"capture"`
+	Types        []string                        `yaml:"types" json:"types" mapstructure:"types"`
+	Go           fileGoSymbolConfig              `yaml:"go" json:"go" mapstructure:"go"`
+}
+
+type fileGoSymbolConfig struct {
+	StandardLibrary         bool `yaml:"standard-library" json:"standard-library" mapstructure:"standard-library"`
+	ExtendedStandardLibrary bool `yaml:"extended-standard-library" json:"extended-standard-library" mapstructure:"extended-standard-library"`
+	ThirdPartyModules       bool `yaml:"third-party-modules" json:"third-party-modules" mapstructure:"third-party-modules"`
 }
 
 func defaultFileConfig() fileConfig {
-	return fileConfig{
+	api := executable.DefaultConfig()
+
+	// start with API defaults and override CLI-specific values
+	cfg := fileConfig{
 		Metadata: fileMetadata{
 			Selection: file.FilesOwnedByPackageSelection,
 			Digests:   []string{"sha1", "sha256"},
@@ -41,9 +58,19 @@ func defaultFileConfig() fileConfig {
 			SkipFilesAboveSize: 250 * intFile.KB,
 		},
 		Executable: fileExecutable{
-			Globs: nil,
+			Globs: api.Globs,
+			Symbols: fileSymbolConfig{
+				CaptureScope: api.Symbols.CaptureScope,
+				Types:        api.Symbols.Types,
+				Go: fileGoSymbolConfig{
+					StandardLibrary:         api.Symbols.Go.StandardLibrary,
+					ExtendedStandardLibrary: api.Symbols.Go.ExtendedStandardLibrary,
+					ThirdPartyModules:       api.Symbols.Go.ThirdPartyModules,
+				},
+			},
 		},
 	}
+	return cfg
 }
 
 var _ interface {
@@ -64,7 +91,7 @@ func (c *fileConfig) PostLoad() error {
 }
 
 func (c *fileConfig) DescribeFields(descriptions clio.FieldDescriptionSet) {
-	descriptions.Add(&c.Metadata.Selection, `select which files should be captured by the file-metadata cataloger and included in the SBOM. 
+	descriptions.Add(&c.Metadata.Selection, `select which files should be captured by the file-metadata cataloger and included in the SBOM.
 Options include:
  - "all": capture all files from the search space
  - "owned-by-package": capture only files owned by packages
@@ -75,4 +102,13 @@ Options include:
 	descriptions.Add(&c.Content.Globs, `file globs for the cataloger to match on`)
 
 	descriptions.Add(&c.Executable.Globs, `file globs for the cataloger to match on`)
+
+	// symbol capture configuration
+	descriptions.Add(&c.Executable.Symbols.CaptureScope, `the scope of symbols to capture from executables (options: "golang")`)
+	descriptions.Add(&c.Executable.Symbols.Types, `the types of symbols to capture, relative to "go tool nm" output (options: "T", "t", "R", "r", "D", "d", "B", "b", "C", "U")`)
+
+	// go symbol configuration
+	descriptions.Add(&c.Executable.Symbols.Go.StandardLibrary, `capture Go standard library symbols (e.g. "fmt", "net/http")`)
+	descriptions.Add(&c.Executable.Symbols.Go.ExtendedStandardLibrary, `capture extended Go standard library symbols (e.g. "golang.org/x/net")`)
+	descriptions.Add(&c.Executable.Symbols.Go.ThirdPartyModules, `capture third-party module symbols (e.g. "github.com/spf13/cobra")`)
 }

cmd/syft/internal/options/javascript.go

@@ -1,9 +1,6 @@
 package options
 
-import (
-	"github.com/anchore/clio"
-	"github.com/anchore/syft/syft/pkg/cataloger/javascript"
-)
+import "github.com/anchore/clio"
 
 type javaScriptConfig struct {
 	SearchRemoteLicenses   *bool  `json:"search-remote-licenses" yaml:"search-remote-licenses" mapstructure:"search-remote-licenses"`
@@ -15,24 +12,6 @@ var _ interface {
 	clio.FieldDescriber
 } = (*javaScriptConfig)(nil)
 
-func defaultJavaScriptConfig() javaScriptConfig {
-	def := javascript.DefaultCatalogerConfig()
-	var includeDevDependencies *bool
-	if def.IncludeDevDependencies {
-		includeDevDependencies = &def.IncludeDevDependencies
-	}
-
-	var searchRemoteLicenses *bool
-	if def.SearchRemoteLicenses {
-		searchRemoteLicenses = &def.SearchRemoteLicenses
-	}
-	return javaScriptConfig{
-		NpmBaseURL:             def.NPMBaseURL,
-		SearchRemoteLicenses:   searchRemoteLicenses,
-		IncludeDevDependencies: includeDevDependencies,
-	}
-}
-
 func (o *javaScriptConfig) DescribeFields(descriptions clio.FieldDescriptionSet) {
 	descriptions.Add(&o.SearchRemoteLicenses, `enables Syft to use the network to fill in more detailed license information`)
 	descriptions.Add(&o.NpmBaseURL, `base NPM url to use`)

cmd/syft/internal/options/linux_kernel.go

@@ -1,18 +1,14 @@
 package options
 
-import (
-	"github.com/anchore/clio"
-	"github.com/anchore/syft/syft/pkg/cataloger/kernel"
-)
+import "github.com/anchore/clio"
 
 type linuxKernelConfig struct {
 	CatalogModules bool `json:"catalog-modules" yaml:"catalog-modules" mapstructure:"catalog-modules"`
 }
 
 func defaultLinuxKernelConfig() linuxKernelConfig {
-	def := kernel.DefaultLinuxKernelCatalogerConfig()
 	return linuxKernelConfig{
-		CatalogModules: def.CatalogModules,
+		CatalogModules: true,
 	}
 }
 

cmd/syft/internal/options/python.go

@@ -1,9 +1,6 @@
 package options
 
-import (
-	"github.com/anchore/clio"
-	"github.com/anchore/syft/syft/pkg/cataloger/python"
-)
+import "github.com/anchore/clio"
 
 type pythonConfig struct {
 	SearchRemoteLicenses      *bool  `json:"search-remote-licenses" yaml:"search-remote-licenses" mapstructure:"search-remote-licenses"`
@@ -15,13 +12,6 @@ var _ interface {
 	clio.FieldDescriber
 } = (*pythonConfig)(nil)
 
-func defaultPythonConfig() pythonConfig {
-	def := python.DefaultCatalogerConfig()
-	return pythonConfig{
-		GuessUnpinnedRequirements: &def.GuessUnpinnedRequirements,
-	}
-}
-
 func (o *pythonConfig) DescribeFields(descriptions clio.FieldDescriptionSet) {
 	descriptions.Add(&o.SearchRemoteLicenses, `enables Syft to use the network to fill in more detailed license information`)
 	descriptions.Add(&o.PypiBaseURL, `base Pypi url to use`)

cmd/syft/internal/options/writer.go

@@ -122,7 +122,7 @@ func formatVersionOptions(nameVersionPairs []string) string {
 	for _, name := range sortedAvailableFormats {
 		s.WriteString("\n")
 
-		fmt.Fprintf(&s, "   - %s", name)
+		s.WriteString(fmt.Sprintf("   - %s", name))
 
 		if len(availableVersions[name]) > 0 {
 			s.WriteString(" @ ")

cmd/syft/internal/options/writer_test.go

@@ -32,7 +32,7 @@ func Test_MakeSBOMWriter(t *testing.T) {
 		{
 			name:    "unknown format",
 			outputs: []string{"unknown"},
-			wantErr: func(t assert.TestingT, err error, bla ...any) bool {
+			wantErr: func(t assert.TestingT, err error, bla ...interface{}) bool {
 				return assert.ErrorContains(t, err, `unsupported output format "unknown", supported formats are:`)
 			},
 		},

cmd/syft/internal/test/integration/catalog_packages_test.go

@@ -2,7 +2,6 @@ package integration
 
 import (
 	"context"
-	"slices"
 	"strings"
 	"testing"
 
@@ -126,7 +125,7 @@ func TestPkgCoverageImage(t *testing.T) {
 }
 
 func TestPkgCoverageDirectory(t *testing.T) {
-	sbom, _ := catalogDirectory(t, "testdata/image-pkg-coverage")
+	sbom, _ := catalogDirectory(t, "test-fixtures/image-pkg-coverage")
 
 	observedLanguages := strset.New()
 	definedLanguages := strset.New()
@@ -195,8 +194,11 @@ func assertPackages(t *testing.T, sbom sbom.SBOM, test testCase, observedLanguag
 		}
 
 		var foundLang bool
-		if slices.Contains(strings.Split(test.pkgLanguage.String(), ","), actualPkg.Language.String()) {
-			foundLang = true
+		for _, lang := range strings.Split(test.pkgLanguage.String(), ",") {
+			if actualPkg.Language.String() == lang {
+				foundLang = true
+				break
+			}
 		}
 		if !foundLang {
 			t.Errorf("bad language (pkg=%+v): %+v", actualPkg.Name, actualPkg.Language)
@@ -259,7 +261,7 @@ func TestPkgCoverageImage_HasEvidence(t *testing.T) {
 }
 
 func TestPkgCoverageDirectory_HasEvidence(t *testing.T) {
-	sbom, _ := catalogDirectory(t, "testdata/image-pkg-coverage")
+	sbom, _ := catalogDirectory(t, "test-fixtures/image-pkg-coverage")
 
 	var cases []testCase
 	cases = append(cases, commonTestCases...)

cmd/syft/internal/test/integration/files_test.go

@@ -22,7 +22,7 @@ import (
 func TestFileCataloging_Default(t *testing.T) {
 	cfg := options.DefaultCatalog().ToSBOMConfig(clio.Identification{})
 	cfg = cfg.WithFilesConfig(filecataloging.DefaultConfig())
-	sbom, _ := catalogDirectoryWithConfig(t, "testdata/files", cfg)
+	sbom, _ := catalogDirectoryWithConfig(t, "test-fixtures/files", cfg)
 
 	var metadata map[file.Coordinates]file.Metadata
 
@@ -48,13 +48,13 @@ func TestFileCataloging_AllFiles(t *testing.T) {
 			SkipFilesAboveSize: 30,
 		},
 	})
-	sbom, _ := catalogDirectoryWithConfig(t, "testdata/files", cfg)
+	sbom, _ := catalogDirectoryWithConfig(t, "test-fixtures/files", cfg)
 
 	pwd, err := os.Getwd()
 	require.NoError(t, err)
 
 	testPath := func(path string) string {
-		return filepath.Join(pwd, "testdata/files", path)
+		return filepath.Join(pwd, "test-fixtures/files", path)
 	}
 
 	metadata := map[file.Coordinates]file.Metadata{

cmd/syft/internal/test/integration/node_packages_test.go

@@ -11,7 +11,7 @@ import (
 )
 
 func TestNpmPackageLockDirectory(t *testing.T) {
-	sbom, _ := catalogDirectory(t, "testdata/npm-lock")
+	sbom, _ := catalogDirectory(t, "test-fixtures/npm-lock")
 
 	foundPackages := strset.New()
 
@@ -32,11 +32,10 @@ func TestNpmPackageLockDirectory(t *testing.T) {
 }
 
 func TestYarnPackageLockDirectory(t *testing.T) {
-	sbom, _ := catalogDirectory(t, "testdata/yarn-lock")
+	sbom, _ := catalogDirectory(t, "test-fixtures/yarn-lock")
 
 	foundPackages := strset.New()
-	// merge-objects and should-type are devDependencies in package.json and are excluded by default
-	expectedPackages := strset.New("async@0.9.2", "async@3.2.3", "@4lolo/resize-observer-polyfill@1.5.2")
+	expectedPackages := strset.New("async@0.9.2", "async@3.2.3", "merge-objects@1.0.5", "should-type@1.3.0", "@4lolo/resize-observer-polyfill@1.5.2")
 
 	for actualPkg := range sbom.Artifacts.Packages.Enumerate(pkg.NpmPkg) {
 		for _, actualLocation := range actualPkg.Locations.ToSlice() {

cmd/syft/internal/test/integration/package_binary_elf_relationships_test.go

@@ -26,7 +26,7 @@ func TestBinaryElfRelationships(t *testing.T) {
 	}
 
 	// run the test...
-	sbom, _ := catalogFixtureImage(t, "elf-testdata", source.SquashedScope)
+	sbom, _ := catalogFixtureImage(t, "elf-test-fixtures", source.SquashedScope)
 
 	// get a mapping of package names to their IDs
 	nameToId := map[string]artifact.ID{}

cmd/syft/internal/test/integration/package_cataloger_convention_test.go

@@ -278,7 +278,7 @@ func packageCatalogerExports(t *testing.T) map[string]exportTokenSet {
 		if info.IsDir() ||
 			!strings.HasSuffix(info.Name(), ".go") ||
 			strings.HasSuffix(info.Name(), "_test.go") ||
-			strings.Contains(path, "testdata") ||
+			strings.Contains(path, "test-fixtures") ||
 			strings.Contains(path, "internal") {
 			return nil
 		}
@@ -329,7 +329,7 @@ func packageCatalogerExports(t *testing.T) map[string]exportTokenSet {
 					}
 					exportsPerPackage[pkg].Add(exportToken{
 						Name:            decl.Name.Name,
-						Type:            reflect.TypeFor[*ast.FuncType]().String(),
+						Type:            reflect.TypeOf(decl.Type).String(),
 						SignatureSize:   len(decl.Type.Params.List),
 						ReturnTypeNames: returnTypes,
 					})

cmd/syft/internal/test/integration/package_deduplication_test.go

@@ -1,6 +1,7 @@
 package integration
 
 import (
+	"fmt"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -10,52 +11,47 @@ import (
 )
 
 func TestPackageDeduplication(t *testing.T) {
-	// this test verifies that package deduplication works correctly across layers.
-	// The test fixture installs/upgrades packages in multiple stages, creating
-	// duplicate RPM DB entries across layers. Without deduplication, we'd see ~600 packages.
-	//
-	// Note: we index by package name (not name-version) to be resilient to Rocky Linux
-	// repo updates. Location counts are summed across all versions of each package.
 	tests := []struct {
 		scope         source.Scope
 		packageCount  int
-		instanceCount map[string]int // how many distinct package instances (by name)
-		locationCount map[string]int // total locations across ALL versions of each package
+		instanceCount map[string]int
+		locationCount map[string]int
 	}{
 		{
 			scope:        source.AllLayersScope,
-			packageCount: 176, // without deduplication this would be ~600
+			packageCount: 175, // without deduplication this would be ~600
 			instanceCount: map[string]int{
 				"basesystem":   1,
 				"wget":         1,
-				"curl-minimal": 2, // base + upgraded (2 different versions)
+				"curl-minimal": 2, // upgraded in the image
 				"vsftpd":       1,
-				"httpd":        1,
+				"httpd":        1, // rpm, - we exclude binary
 			},
 			locationCount: map[string]int{
-				"basesystem":   5, // in all layers
-				"curl-minimal": 5, // total across both versions (2 + 3)
-				"wget":         4, // wget + all above layers
-				"vsftpd":       2, // vsftpd + all above layers
-				"httpd":        1, // last layer
+				"basesystem-11-13.el9":               5, // in all layers
+				"curl-minimal-7.76.1-26.el9_3.2.0.1": 2, // base + wget layer
+				"curl-minimal-7.76.1-31.el9_6.1":     3, // curl upgrade layer + all above layers
+				"wget-1.21.1-8.el9_4":                4, // wget + all above layers
+				"vsftpd-3.0.5-6.el9":                 2, // vsftpd + all above layers
+				"httpd-2.4.62-4.el9_6.4":             1, // last layer
 			},
 		},
 		{
 			scope:        source.SquashedScope,
-			packageCount: 170,
+			packageCount: 169,
 			instanceCount: map[string]int{
 				"basesystem":   1,
 				"wget":         1,
-				"curl-minimal": 1, // deduped to latest
+				"curl-minimal": 1, // upgraded, but the most recent
 				"vsftpd":       1,
-				"httpd":        1,
+				"httpd":        1, // rpm, binary is now excluded by overlap
 			},
 			locationCount: map[string]int{
-				"basesystem":   1,
-				"curl-minimal": 1,
-				"wget":         1,
-				"vsftpd":       1,
-				"httpd":        1,
+				"basesystem-11-13.el9":           1,
+				"curl-minimal-7.76.1-31.el9_6.1": 1, // upgrade
+				"wget-1.21.1-8.el9_4":            1,
+				"vsftpd-3.0.5-6.el9":             1,
+				"httpd-2.4.62-4.el9_6.4":         1,
 			},
 		},
 	}
@@ -63,32 +59,35 @@ func TestPackageDeduplication(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(string(tt.scope), func(t *testing.T) {
 			sbom, _ := catalogFixtureImage(t, "image-vertical-package-dups", tt.scope)
-
-			// verify binary packages have names
 			for _, p := range sbom.Artifacts.Packages.Sorted() {
 				if p.Type == pkg.BinaryPkg {
 					assert.NotEmpty(t, p.Name)
 				}
 			}
 
-			// verify exact package count
 			assert.Equal(t, tt.packageCount, sbom.Artifacts.Packages.PackageCount())
-
-			// verify instance count by package name
-			for name, expectedCount := range tt.instanceCount {
+			for name, expectedInstanceCount := range tt.instanceCount {
 				pkgs := sbom.Artifacts.Packages.PackagesByName(name)
-				assert.Len(t, pkgs, expectedCount, "unexpected instance count for %s", name)
-			}
 
-			// verify total location count across all versions of each package
-			for name, expectedLocCount := range tt.locationCount {
-				pkgs := sbom.Artifacts.Packages.PackagesByName(name)
-				totalLocations := 0
-				for _, p := range pkgs {
-					totalLocations += len(p.Locations.ToSlice())
+				// with multiple packages with the same name, something is wrong (or this is the wrong fixture)
+				if assert.Len(t, pkgs, expectedInstanceCount, "unexpected package count for %s", name) {
+					for _, p := range pkgs {
+						nameVersion := fmt.Sprintf("%s-%s", name, p.Version)
+						expectedLocationCount, ok := tt.locationCount[nameVersion]
+						if !ok {
+							t.Errorf("missing name-version: %s", nameVersion)
+							continue
+						}
+
+						// we should see merged locations (assumption, there was 1 location for each package)
+						assert.Len(t, p.Locations.ToSlice(), expectedLocationCount, "unexpected location count for %s", nameVersion)
+
+						// all paths should match
+						assert.Len(t, p.Locations.CoordinateSet().Paths(), 1, "unexpected location count for %s", nameVersion)
+					}
 				}
-				assert.Equal(t, expectedLocCount, totalLocations, "unexpected total location count for %s", name)
 			}
+
 		})
 	}
 }

cmd/syft/internal/test/integration/test-fixtures/.gitignore

@@ -1,5 +1,5 @@
 # we should strive to not commit blobs to the repo and strive to keep the build process of how blobs are acquired in-repo.
-# this blob is generated from syft/syft/catalogers/java/testdata/java-builds , however, preserving the build process
+# this blob is generated from syft/syft/catalogers/java/test-fixtures/java-builds , however, preserving the build process
 # twice in the repo seems redundant (even via symlink). Given that the fixture is a few kilobytes in size, the build process is already
 # captured, and integration tests should only be testing if jars can be discovered (not necessarily depth in java detection
 # functionality), committing it seems like an acceptable exception.

cmd/syft/internal/test/integration/test-fixtures/elf-test-fixtures

@@ -0,0 +1 @@
+../../../../../../syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures