[wip] remove sqlite import

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

.binny.yaml

@@ -26,7 +26,7 @@ tools:
   # used for linting
   - name: golangci-lint
     version:
-      want: v2.0.2
+      want: v2.1.6
     method: github-release
     with:
       repo: golangci/golangci-lint
@@ -42,7 +42,7 @@ tools:
   # used for signing the checksums file at release
   - name: cosign
     version:
-      want: v2.4.3
+      want: v2.5.0
     method: github-release
     with:
       repo: sigstore/cosign
@@ -58,7 +58,7 @@ tools:
   # used to release all artifacts
   - name: goreleaser
     version:
-      want: v2.8.2
+      want: v2.9.0
     method: github-release
     with:
       repo: goreleaser/goreleaser
@@ -103,7 +103,7 @@ tools:
   # used for running all local and CI tasks
   - name: task
     version:
-      want: v3.42.1
+      want: v3.43.3
     method: github-release
     with:
       repo: go-task/task
@@ -111,7 +111,7 @@ tools:
   # used for triggering a release
   - name: gh
     version:
-      want: v2.69.0
+      want: v2.72.0
     method: github-release
     with:
       repo: cli/cli
@@ -119,7 +119,7 @@ tools:
   # used to upload test fixture cache
   - name: oras
     version:
-      want: v1.2.2
+      want: v1.2.3
     method: github-release
     with:
       repo: oras-project/oras
@@ -127,7 +127,7 @@ tools:
   # used to upload test fixture cache
   - name: yq
     version:
-      want: v4.45.1
+      want: v4.45.4
     method: github-release
     with:
       repo: mikefarah/yq

.github/actions/bootstrap/action.yaml

@@ -29,7 +29,7 @@ runs:
   using: "composite"
   steps:
     # note: go mod and build is automatically cached on default with v4+
-    - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+    - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
       if: inputs.go-version != ''
       with:
         go-version: ${{ inputs.go-version }}

.github/workflows/benchmark-testing.yaml

@@ -1,62 +0,0 @@
-name: "Benchmark testing"
-
-on:
-  workflow_dispatch:
-  pull_request:
-
-permissions:
-  contents: read
-
-jobs:
-
-  Benchmark-Test:
-    name: "Benchmark tests"
-    runs-on: ubuntu-24.04
-    # note: we want benchmarks to run on pull_request events in order to publish results to a sticky comment, and
-    # we also want to run on push such that merges to main are recorded to the cache. For this reason we don't filter
-    # the job by event.
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      - name: Bootstrap environment
-        uses: ./.github/actions/bootstrap
-
-      - name: Restore base benchmark result
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 #v4.2.3
-        with:
-          path: test/results/benchmark-main.txt
-          # use base sha for PR or new commit hash for main push in benchmark result key
-          key: ${{ runner.os }}-bench-${{ (github.event.pull_request.base.sha != github.event.after) && github.event.pull_request.base.sha || github.event.after }}
-
-      - name: Run benchmark tests
-        id: benchmark
-        run: |
-          REF_NAME=${GITHUB_REF##*/} make benchmark
-          OUTPUT=$(make show-benchstat)
-          OUTPUT="${OUTPUT//'%'/'%25'}"   # URL encode all '%' characters
-          OUTPUT="${OUTPUT//$'\n'/'%0A'}" # URL encode all '\n' characters
-          OUTPUT="${OUTPUT//$'\r'/'%0D'}" # URL encode all '\r' characters
-          echo "result=$OUTPUT" >> $GITHUB_OUTPUT
-
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: benchmark-test-results
-          path: test/results/**/*
-
-      - name: Update PR benchmark results comment
-        uses: marocchino/sticky-pull-request-comment@52423e01640425a022ef5fd42c6fb5f633a02728 #v2.9.1
-        continue-on-error: true
-        with:
-          header: benchmark
-          message: |
-            ### Benchmark Test Results
-
-            <details>
-              <summary>Benchmark results from the latest changes vs base branch</summary>
-
-            ```
-            ${{ steps.benchmark.outputs.result }}
-            ```
-
-            </details>

.github/workflows/codeql-analysis.yml

@@ -39,13 +39,13 @@ jobs:
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
 
     - name: Install Go
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b #v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 #v5.5.0
       with:
         go-version-file: go.mod
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@1b549b9259bda1cb5ddde3b41741a82a2d15a841 #v3.28.13
+      uses: github/codeql-action/init@ff0a06e83cb2de871e5a09832bc6a81e7276941f #v3.28.18
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -56,7 +56,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@1b549b9259bda1cb5ddde3b41741a82a2d15a841 #v3.28.13
+      uses: github/codeql-action/autobuild@ff0a06e83cb2de871e5a09832bc6a81e7276941f #v3.28.18
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -70,4 +70,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@1b549b9259bda1cb5ddde3b41741a82a2d15a841 #v3.28.13
+      uses: github/codeql-action/analyze@ff0a06e83cb2de871e5a09832bc6a81e7276941f #v3.28.18

.github/workflows/detect-schema-changes.yaml

@@ -40,7 +40,7 @@ jobs:
 
       - name: Delete existing comment
         if: ${{ hashFiles( env.CI_COMMENT_FILE ) == '' }}
-        uses: marocchino/sticky-pull-request-comment@52423e01640425a022ef5fd42c6fb5f633a02728 #v2.9.1
+        uses: marocchino/sticky-pull-request-comment@67d0dec7b07ed060a405f9b2a64b8ab319fdd7db #v2.9.2
         with:
           header: ${{ env.COMMENT_HEADER }}
           hide: true
@@ -48,7 +48,7 @@ jobs:
 
       - name: Add comment
         if: ${{ hashFiles( env.CI_COMMENT_FILE ) != '' }}
-        uses: marocchino/sticky-pull-request-comment@52423e01640425a022ef5fd42c6fb5f633a02728 #v2.9.1
+        uses: marocchino/sticky-pull-request-comment@67d0dec7b07ed060a405f9b2a64b8ab319fdd7db #v2.9.2
         with:
           header: ${{ env.COMMENT_HEADER }}
           path: ${{ env.CI_COMMENT_FILE }}

.github/workflows/release.yaml

@@ -148,7 +148,7 @@ jobs:
           # for updating brew formula in anchore/homebrew-syft
           GITHUB_BREW_TOKEN: ${{ secrets.ANCHOREOPS_GITHUB_OSS_WRITE_TOKEN }}
 
-      - uses: anchore/sbom-action@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 #v0.18.0
+      - uses: anchore/sbom-action@e11c554f704a0b820cbf8c51673f6945e0731532 #v0.20.0
         continue-on-error: true
         with:
           file: go.mod

.github/workflows/validations.yaml

@@ -29,7 +29,8 @@ jobs:
   Unit-Test:
     # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
     name: "Unit tests"
-    runs-on: ubuntu-24.04
+    # we need more storage than what's on the default runner
+    runs-on: ubuntu-22.04-4core-16gb
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
 
@@ -194,7 +195,7 @@ jobs:
     runs-on: macos-latest
     steps:
       - name: Install Cosign
-        uses: sigstore/cosign-installer@v3.8.1
+        uses: sigstore/cosign-installer@v3.8.2
 
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
 

.goreleaser.yaml

@@ -14,12 +14,9 @@ builds:
     dir: ./cmd/syft
     binary: syft
     goos:
-      - linux
+      - windows
     goarch:
       - amd64
-      - arm64
-      - ppc64le
-      - s390x
     # set the modified timestamp on the output binary to the git timestamp to ensure a reproducible build
     mod_timestamp: &build-timestamp '{{ .CommitTimestamp }}'
     ldflags: &build-ldflags |
@@ -31,246 +28,246 @@ builds:
       -X main.buildDate={{.Date}}
       -X main.gitDescription={{.Summary}}
 
-  - id: darwin-build
-    dir: ./cmd/syft
-    binary: syft
-    goos:
-      - darwin
-    goarch:
-      - amd64
-      - arm64
-    mod_timestamp: *build-timestamp
-    ldflags: *build-ldflags
-    hooks:
-      post:
-        - cmd: .tool/quill sign-and-notarize "{{ .Path }}" --dry-run={{ .IsSnapshot }} --ad-hoc={{ .IsSnapshot }} -vv
-          env:
-            - QUILL_LOG_FILE=/tmp/quill-{{ .Target }}.log
+#  - id: darwin-build
+#    dir: ./cmd/syft
+#    binary: syft
+#    goos:
+#      - darwin
+#    goarch:
+#      - amd64
+#      - arm64
+#    mod_timestamp: *build-timestamp
+#    ldflags: *build-ldflags
+#    hooks:
+#      post:
+#        - cmd: .tool/quill sign-and-notarize "{{ .Path }}" --dry-run={{ .IsSnapshot }} --ad-hoc={{ .IsSnapshot }} -vv
+#          env:
+#            - QUILL_LOG_FILE=/tmp/quill-{{ .Target }}.log
+#
+#  - id: windows-build
+#    dir: ./cmd/syft
+#    binary: syft
+#    goos:
+#      - windows
+#    goarch:
+#      - amd64
+#    mod_timestamp: *build-timestamp
+#    ldflags: *build-ldflags
 
-  - id: windows-build
-    dir: ./cmd/syft
-    binary: syft
-    goos:
-      - windows
-    goarch:
-      - amd64
-    mod_timestamp: *build-timestamp
-    ldflags: *build-ldflags
-
-archives:
-  - id: linux-archives
-    builds:
-      - linux-build
-
-  # note: the signing process is depending on tar.gz archives. If this format changes then .github/scripts/apple-signing/*.sh will need to be adjusted
-  - id: darwin-archives
-    builds:
-      - darwin-build
-
-  - id: windows-archives
-    format: zip
-    builds:
-      - windows-build
-
-nfpms:
-  - license: "Apache 2.0"
-    maintainer: "Anchore, Inc"
-    homepage: &website "https://github.com/anchore/syft"
-    description: &description "A tool that generates a Software Bill Of Materials (SBOM) from container images and filesystems"
-    formats:
-      - rpm
-      - deb
-
-brews:
-  - repository:
-      owner: anchore
-      name: homebrew-syft
-      token: "{{.Env.GITHUB_BREW_TOKEN}}"
-    ids:
-      - darwin-archives
-      - linux-archives
-    homepage: *website
-    description: *description
-    license: "Apache License 2.0"
-
-dockers:
-  - image_templates:
-      - anchore/syft:debug
-      - anchore/syft:{{.Tag}}-debug
-      - ghcr.io/anchore/syft:debug
-      - ghcr.io/anchore/syft:{{.Tag}}-debug
-    goarch: amd64
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/amd64"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:debug-arm64v8
-      - anchore/syft:{{.Tag}}-debug-arm64v8
-      - ghcr.io/anchore/syft:debug-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
-    goarch: arm64
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/arm64/v8"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:debug-ppc64le
-      - anchore/syft:{{.Tag}}-debug-ppc64le
-      - ghcr.io/anchore/syft:debug-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
-    goarch: ppc64le
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/ppc64le"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:debug-s390x
-      - anchore/syft:{{.Tag}}-debug-s390x
-      - ghcr.io/anchore/syft:debug-s390x
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
-    goarch: s390x
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/s390x"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:latest
-      - anchore/syft:{{.Tag}}
-      - ghcr.io/anchore/syft:latest
-      - ghcr.io/anchore/syft:{{.Tag}}
-    goarch: amd64
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/amd64"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
-    goarch: arm64
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/arm64/v8"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
-    goarch: ppc64le
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/ppc64le"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-s390x
-      - ghcr.io/anchore/syft:{{.Tag}}-s390x
-    goarch: s390x
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/s390x"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-docker_manifests:
-  - name_template: anchore/syft:latest
-    image_templates:
-      - anchore/syft:{{.Tag}}
-      - anchore/syft:{{.Tag}}-arm64v8
-      - anchore/syft:{{.Tag}}-ppc64le
-      - anchore/syft:{{.Tag}}-s390x
-
-  - name_template: anchore/syft:debug
-      - anchore/syft:{{.Tag}}-debug
-      - anchore/syft:{{.Tag}}-debug-arm64v8
-      - anchore/syft:{{.Tag}}-debug-ppc64le
-      - anchore/syft:{{.Tag}}-debug-s390x
-
-  - name_template: anchore/syft:{{.Tag}}
-    image_templates:
-      - anchore/syft:{{.Tag}}
-      - anchore/syft:{{.Tag}}-arm64v8
-      - anchore/syft:{{.Tag}}-ppc64le
-      - anchore/syft:{{.Tag}}-s390x
-
-  - name_template: ghcr.io/anchore/syft:latest
-    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}
-      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-s390x
-
-  - name_template: ghcr.io/anchore/syft:debug
-    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}-debug
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
-
-  - name_template: ghcr.io/anchore/syft:{{.Tag}}
-    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}
-      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-s390x
-
-sboms:
-  - artifacts: archive
-    # this is relative to the snapshot/dist directory, not the root of the repo
-    cmd: ../.tool/syft
-    documents:
-      - "{{ .Binary }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}.sbom"
-    args:
-      - "scan"
-      - "$artifact"
-      - "--output"
-      - "json=$document"
-
-signs:
-  - cmd: .tool/cosign
-    signature: "${artifact}.sig"
-    certificate: "${artifact}.pem"
-    args:
-      - "sign-blob"
-      - "--oidc-issuer=https://token.actions.githubusercontent.com"
-      - "--output-certificate=${certificate}"
-      - "--output-signature=${signature}"
-      - "${artifact}"
-      - "--yes"
-    artifacts: checksum
+#archives:
+#  - id: linux-archives
+#    builds:
+#      - linux-build
+#
+#  # note: the signing process is depending on tar.gz archives. If this format changes then .github/scripts/apple-signing/*.sh will need to be adjusted
+#  - id: darwin-archives
+#    builds:
+#      - darwin-build
+#
+#  - id: windows-archives
+#    format: zip
+#    builds:
+#      - windows-build
+#
+#nfpms:
+#  - license: "Apache 2.0"
+#    maintainer: "Anchore, Inc"
+#    homepage: &website "https://github.com/anchore/syft"
+#    description: &description "A tool that generates a Software Bill Of Materials (SBOM) from container images and filesystems"
+#    formats:
+#      - rpm
+#      - deb
+#
+#brews:
+#  - repository:
+#      owner: anchore
+#      name: homebrew-syft
+#      token: "{{.Env.GITHUB_BREW_TOKEN}}"
+#    ids:
+#      - darwin-archives
+#      - linux-archives
+#    homepage: *website
+#    description: *description
+#    license: "Apache License 2.0"
+#
+#dockers:
+#  - image_templates:
+#      - anchore/syft:debug
+#      - anchore/syft:{{.Tag}}-debug
+#      - ghcr.io/anchore/syft:debug
+#      - ghcr.io/anchore/syft:{{.Tag}}-debug
+#    goarch: amd64
+#    dockerfile: Dockerfile.debug
+#    use: buildx
+#    build_flag_templates:
+#      - "--platform=linux/amd64"
+#      - "--build-arg=BUILD_DATE={{.Date}}"
+#      - "--build-arg=BUILD_VERSION={{.Version}}"
+#      - "--build-arg=VCS_REF={{.FullCommit}}"
+#      - "--build-arg=VCS_URL={{.GitURL}}"
+#
+#  - image_templates:
+#      - anchore/syft:debug-arm64v8
+#      - anchore/syft:{{.Tag}}-debug-arm64v8
+#      - ghcr.io/anchore/syft:debug-arm64v8
+#      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
+#    goarch: arm64
+#    dockerfile: Dockerfile.debug
+#    use: buildx
+#    build_flag_templates:
+#      - "--platform=linux/arm64/v8"
+#      - "--build-arg=BUILD_DATE={{.Date}}"
+#      - "--build-arg=BUILD_VERSION={{.Version}}"
+#      - "--build-arg=VCS_REF={{.FullCommit}}"
+#      - "--build-arg=VCS_URL={{.GitURL}}"
+#
+#  - image_templates:
+#      - anchore/syft:debug-ppc64le
+#      - anchore/syft:{{.Tag}}-debug-ppc64le
+#      - ghcr.io/anchore/syft:debug-ppc64le
+#      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
+#    goarch: ppc64le
+#    dockerfile: Dockerfile.debug
+#    use: buildx
+#    build_flag_templates:
+#      - "--platform=linux/ppc64le"
+#      - "--build-arg=BUILD_DATE={{.Date}}"
+#      - "--build-arg=BUILD_VERSION={{.Version}}"
+#      - "--build-arg=VCS_REF={{.FullCommit}}"
+#      - "--build-arg=VCS_URL={{.GitURL}}"
+#
+#  - image_templates:
+#      - anchore/syft:debug-s390x
+#      - anchore/syft:{{.Tag}}-debug-s390x
+#      - ghcr.io/anchore/syft:debug-s390x
+#      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
+#    goarch: s390x
+#    dockerfile: Dockerfile.debug
+#    use: buildx
+#    build_flag_templates:
+#      - "--platform=linux/s390x"
+#      - "--build-arg=BUILD_DATE={{.Date}}"
+#      - "--build-arg=BUILD_VERSION={{.Version}}"
+#      - "--build-arg=VCS_REF={{.FullCommit}}"
+#      - "--build-arg=VCS_URL={{.GitURL}}"
+#
+#  - image_templates:
+#      - anchore/syft:latest
+#      - anchore/syft:{{.Tag}}
+#      - ghcr.io/anchore/syft:latest
+#      - ghcr.io/anchore/syft:{{.Tag}}
+#    goarch: amd64
+#    dockerfile: Dockerfile
+#    use: buildx
+#    build_flag_templates:
+#      - "--platform=linux/amd64"
+#      - "--build-arg=BUILD_DATE={{.Date}}"
+#      - "--build-arg=BUILD_VERSION={{.Version}}"
+#      - "--build-arg=VCS_REF={{.FullCommit}}"
+#      - "--build-arg=VCS_URL={{.GitURL}}"
+#
+#  - image_templates:
+#      - anchore/syft:{{.Tag}}-arm64v8
+#      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
+#    goarch: arm64
+#    dockerfile: Dockerfile
+#    use: buildx
+#    build_flag_templates:
+#      - "--platform=linux/arm64/v8"
+#      - "--build-arg=BUILD_DATE={{.Date}}"
+#      - "--build-arg=BUILD_VERSION={{.Version}}"
+#      - "--build-arg=VCS_REF={{.FullCommit}}"
+#      - "--build-arg=VCS_URL={{.GitURL}}"
+#
+#  - image_templates:
+#      - anchore/syft:{{.Tag}}-ppc64le
+#      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
+#    goarch: ppc64le
+#    dockerfile: Dockerfile
+#    use: buildx
+#    build_flag_templates:
+#      - "--platform=linux/ppc64le"
+#      - "--build-arg=BUILD_DATE={{.Date}}"
+#      - "--build-arg=BUILD_VERSION={{.Version}}"
+#      - "--build-arg=VCS_REF={{.FullCommit}}"
+#      - "--build-arg=VCS_URL={{.GitURL}}"
+#
+#  - image_templates:
+#      - anchore/syft:{{.Tag}}-s390x
+#      - ghcr.io/anchore/syft:{{.Tag}}-s390x
+#    goarch: s390x
+#    dockerfile: Dockerfile
+#    use: buildx
+#    build_flag_templates:
+#      - "--platform=linux/s390x"
+#      - "--build-arg=BUILD_DATE={{.Date}}"
+#      - "--build-arg=BUILD_VERSION={{.Version}}"
+#      - "--build-arg=VCS_REF={{.FullCommit}}"
+#      - "--build-arg=VCS_URL={{.GitURL}}"
+#
+#docker_manifests:
+#  - name_template: anchore/syft:latest
+#    image_templates:
+#      - anchore/syft:{{.Tag}}
+#      - anchore/syft:{{.Tag}}-arm64v8
+#      - anchore/syft:{{.Tag}}-ppc64le
+#      - anchore/syft:{{.Tag}}-s390x
+#
+#  - name_template: anchore/syft:debug
+#      - anchore/syft:{{.Tag}}-debug
+#      - anchore/syft:{{.Tag}}-debug-arm64v8
+#      - anchore/syft:{{.Tag}}-debug-ppc64le
+#      - anchore/syft:{{.Tag}}-debug-s390x
+#
+#  - name_template: anchore/syft:{{.Tag}}
+#    image_templates:
+#      - anchore/syft:{{.Tag}}
+#      - anchore/syft:{{.Tag}}-arm64v8
+#      - anchore/syft:{{.Tag}}-ppc64le
+#      - anchore/syft:{{.Tag}}-s390x
+#
+#  - name_template: ghcr.io/anchore/syft:latest
+#    image_templates:
+#      - ghcr.io/anchore/syft:{{.Tag}}
+#      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
+#      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
+#      - ghcr.io/anchore/syft:{{.Tag}}-s390x
+#
+#  - name_template: ghcr.io/anchore/syft:debug
+#    image_templates:
+#      - ghcr.io/anchore/syft:{{.Tag}}-debug
+#      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
+#      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
+#      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
+#
+#  - name_template: ghcr.io/anchore/syft:{{.Tag}}
+#    image_templates:
+#      - ghcr.io/anchore/syft:{{.Tag}}
+#      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
+#      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
+#      - ghcr.io/anchore/syft:{{.Tag}}-s390x
+#
+#sboms:
+#  - artifacts: archive
+#    # this is relative to the snapshot/dist directory, not the root of the repo
+#    cmd: ../.tool/syft
+#    documents:
+#      - "{{ .Binary }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}.sbom"
+#    args:
+#      - "scan"
+#      - "$artifact"
+#      - "--output"
+#      - "json=$document"
+#
+#signs:
+#  - cmd: .tool/cosign
+#    signature: "${artifact}.sig"
+#    certificate: "${artifact}.pem"
+#    args:
+#      - "sign-blob"
+#      - "--oidc-issuer=https://token.actions.githubusercontent.com"
+#      - "--output-certificate=${certificate}"
+#      - "--output-signature=${signature}"
+#      - "${artifact}"
+#      - "--yes"
+#    artifacts: checksum

DEVELOPING.md

@@ -227,6 +227,16 @@ rough outline how that works:
 
 ## Testing
 
+### Testing commands
+
+* `make help` shows a list of available commands
+* `make unit`, `make integration`, `make cli`, and `make acceptance` run those test suites (see below)
+* `make test` runs all those tests (and is therefore pretty slow)
+* `make fixtures` clears and re-fetches all test fixtures.
+* `go test ./syft/pkg/` for example can test particular packages, assuming fixtures are already made
+* `make clean-cache` cleans all test cache. Note that subsequent test runs will be slower after this
+
+
 ### Levels of testing
 
 - `unit`: The default level of test which is distributed throughout the repo are unit tests. Any `_test.go` file that 

Dockerfile

@@ -1,4 +1,4 @@
-FROM gcr.io/distroless/static-debian11:debug@sha256:a0a404776dec98be120089ae42bbdfbe48c177921d856937d124d48eb8c0b951 AS build
+FROM gcr.io/distroless/static-debian12:latest AS build
 
 FROM scratch
 # needed for version check HTTPS request

Dockerfile.debug

@@ -1,4 +1,4 @@
-FROM gcr.io/distroless/static-debian11:debug@sha256:a0a404776dec98be120089ae42bbdfbe48c177921d856937d124d48eb8c0b951
+FROM gcr.io/distroless/static-debian12:debug
 
 # create the /tmp dir, which is needed for image content cache
 WORKDIR /tmp

README.md

@@ -140,11 +140,11 @@ Note that flags using the @<version> can be used for earlier versions of each sp
 - Linux kernel archives (vmlinz)
 - Linux kernel modules (ko)
 - Nix (outputs in /nix/store)
-- PHP (composer)
+- PHP (composer, PECL, Pear)
 - Python (wheel, egg, poetry, requirements.txt)
 - Red Hat (rpm)
 - Ruby (gem)
-- Rust (cargo.lock)
+- Rust (cargo.lock, auditable binary)
 - Swift (cocoapods, swift-package-manager)
 - Wordpress plugins
 - Terraform providers (.terraform.lock.hcl)

Taskfile.yaml

@@ -75,7 +75,6 @@ tasks:
       - task: unit
       - task: integration
       - task: validate-cyclonedx-schema
-      - task: benchmark
       - task: test-utils
       - task: cli
       - task: check-docker-cache
@@ -221,10 +220,11 @@ tasks:
     cmds:
       - "go test -v ./cmd/syft/internal/test/integration"
       # exercise most of the CLI with the data race detector
-      - "go run -race cmd/syft/main.go alpine:latest"
+      # we use a larger image to ensure we're using multiple catalogers at a time
+      - "go run -race cmd/syft/main.go anchore/test_images:grype-quality-dotnet-69f15d2"
 
   validate-cyclonedx-schema:
-    desc: Run integration tests
+    desc: Validate that Syft produces valid CycloneDX documents
     cmds:
       - "cd schema/cyclonedx && make"
 
@@ -452,8 +452,8 @@ tasks:
       find . | grep cache | grep tar | xargs du
       echo "total $total_size KB"
 
-      if [ "$total_size" -gt 1048576 ]; then
-        echo 'docker cache is larger than 1GB'
+      if [ "$total_size" -gt 5242880  ]; then
+        echo 'docker cache is larger than 5GB'
         exit 1
       fi
 

cmd/syft/internal/commands/cataloger_list.go

@@ -13,6 +13,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/anchore/clio"
+	"github.com/anchore/syft/cmd/syft/internal/options"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/task"
 	"github.com/anchore/syft/syft/cataloging"
@@ -86,11 +87,13 @@ func runCatalogerList(opts *catalogerListOptions) error {
 }
 
 func catalogerListReport(opts *catalogerListOptions, allTaskGroups [][]task.Task) (string, error) {
+	defaultCatalogers := options.Flatten(opts.DefaultCatalogers)
+	selectCatalogers := options.Flatten(opts.SelectCatalogers)
 	selectedTaskGroups, selectionEvidence, err := task.SelectInGroups(
 		allTaskGroups,
 		cataloging.NewSelectionRequest().
-			WithDefaults(opts.DefaultCatalogers...).
-			WithExpression(opts.SelectCatalogers...),
+			WithDefaults(defaultCatalogers...).
+			WithExpression(selectCatalogers...),
 	)
 	if err != nil {
 		return "", fmt.Errorf("unable to select catalogers: %w", err)
@@ -99,7 +102,7 @@ func catalogerListReport(opts *catalogerListOptions, allTaskGroups [][]task.Task
 
 	switch opts.Output {
 	case "json":
-		report, err = renderCatalogerListJSON(flattenTaskGroups(selectedTaskGroups), selectionEvidence, opts.DefaultCatalogers, opts.SelectCatalogers)
+		report, err = renderCatalogerListJSON(flattenTaskGroups(selectedTaskGroups), selectionEvidence, defaultCatalogers, selectCatalogers)
 	case "table", "":
 		if opts.ShowHidden {
 			report = renderCatalogerListTables(allTaskGroups, selectionEvidence)

cmd/syft/internal/commands/cataloger_list_test.go

@@ -184,11 +184,11 @@ Default selections: 1
   • 'image'
 Selection expressions: 6
   • 'b' (intersect)
-  • '-directory' (remove)
   • '-c' (remove)
+  • '-directory' (remove)
   • '-file' (remove)
-  • '+task3' (add)
   • '+file-task1' (add)
+  • '+task3' (add)
 ┌────────────────┬──────────────────┐
 │ FILE CATALOGER │ TAGS             │
 ├────────────────┼──────────────────┤
@@ -200,6 +200,43 @@ Selection expressions: 6
 │ task1             │ 1, a, b, image     │
 │ task3             │ 3, c, d, directory │
 └───────────────────┴────────────────────┘
+`,
+		},
+		{
+			name: "with comma separated expressions, table",
+			options: func() *catalogerListOptions {
+				c := defaultCatalogerListOptions()
+				c.Output = "table"
+				c.DefaultCatalogers = []string{
+					"image,task3,file-task1",
+				}
+				c.SelectCatalogers = []string{
+					"-task2,c,b",
+				}
+				return c
+			}(),
+			want: `
+Default selections: 4
+  • 'file-task1'
+  • 'image'
+  • 'task3'
+  • 'file'
+Selection expressions: 3
+  • 'b' (intersect)
+  • 'c' (intersect)
+  • '-task2' (remove)
+┌────────────────┬──────────────────┐
+│ FILE CATALOGER │ TAGS             │
+├────────────────┼──────────────────┤
+│ file-task1     │ file, ft, ft-1-b │
+│ file-task2     │ file, ft, ft-2-b │
+└────────────────┴──────────────────┘
+┌───────────────────┬────────────────────┐
+│ PACKAGE CATALOGER │ TAGS               │
+├───────────────────┼────────────────────┤
+│ task1             │ 1, a, b, image     │
+│ task3             │ 3, c, d, directory │
+└───────────────────┴────────────────────┘
 `,
 		},
 		{
@@ -219,7 +256,7 @@ Selection expressions: 6
 				return c
 			}(),
 			want: `
-{"default":["image"],"selection":["-directory","+task3","-c","b"],"catalogers":[{"name":"file-task1","tags":["file"]},{"name":"file-task2","tags":["file"]},{"name":"task1","tags":["b","image"]},{"name":"task3","tags":["task3"]}]}
+{"default":["image"],"selection":["+task3","-c","-directory","b"],"catalogers":[{"name":"file-task1","tags":["file"]},{"name":"file-task2","tags":["file"]},{"name":"task1","tags":["b","image"]},{"name":"task3","tags":["task3"]}]}
 `,
 		},
 	}

cmd/syft/internal/options/catalog.go

@@ -24,6 +24,7 @@ import (
 	"github.com/anchore/syft/syft/pkg/cataloger/java"
 	"github.com/anchore/syft/syft/pkg/cataloger/javascript"
 	"github.com/anchore/syft/syft/pkg/cataloger/kernel"
+	"github.com/anchore/syft/syft/pkg/cataloger/nix"
 	"github.com/anchore/syft/syft/pkg/cataloger/python"
 	"github.com/anchore/syft/syft/source"
 )
@@ -48,6 +49,7 @@ type Catalog struct {
 	Java        javaConfig        `yaml:"java" json:"java" mapstructure:"java"`
 	JavaScript  javaScriptConfig  `yaml:"javascript" json:"javascript" mapstructure:"javascript"`
 	LinuxKernel linuxKernelConfig `yaml:"linux-kernel" json:"linux-kernel" mapstructure:"linux-kernel"`
+	Nix         nixConfig         `yaml:"nix" json:"nix" mapstructure:"nix"`
 	Python      pythonConfig      `yaml:"python" json:"python" mapstructure:"python"`
 
 	// configuration for the source (the subject being analyzed)
@@ -75,6 +77,7 @@ func DefaultCatalog() Catalog {
 		Package:       defaultPackageConfig(),
 		License:       defaultLicenseConfig(),
 		LinuxKernel:   defaultLinuxKernelConfig(),
+		Nix:           defaultNixConfig(),
 		Dotnet:        defaultDotnetConfig(),
 		Golang:        defaultGolangConfig(),
 		Java:          defaultJavaConfig(),
@@ -155,8 +158,8 @@ func (cfg Catalog) ToFilesConfig() filecataloging.Config {
 
 func (cfg Catalog) ToLicenseConfig() cataloging.LicenseConfig {
 	return cataloging.LicenseConfig{
-		IncludeUnkownLicenseContent: cfg.License.IncludeUnknownLicenseContent,
-		Coverage:                    cfg.License.LicenseCoverage,
+		IncludeContent: cfg.License.Content,
+		Coverage:       cfg.License.Coverage,
 	}
 }
 
@@ -170,6 +173,7 @@ func (cfg Catalog) ToPackagesConfig() pkgcataloging.Config {
 		Dotnet: dotnet.DefaultCatalogerConfig().
 			WithDepPackagesMustHaveDLL(cfg.Dotnet.DepPackagesMustHaveDLL).
 			WithDepPackagesMustClaimDLL(cfg.Dotnet.DepPackagesMustClaimDLL).
+			WithPropagateDLLClaimsToParents(cfg.Dotnet.PropagateDLLClaimsToParents).
 			WithRelaxDLLClaimsWhenBundlingDetected(cfg.Dotnet.RelaxDLLClaimsWhenBundlingDetected),
 		Golang: golang.DefaultCatalogerConfig().
 			WithSearchLocalModCacheLicenses(*multiLevelOption(false, enrichmentEnabled(cfg.Enrich, task.Go, task.Golang), cfg.Golang.SearchLocalModCacheLicenses)).
@@ -192,6 +196,8 @@ func (cfg Catalog) ToPackagesConfig() pkgcataloging.Config {
 		LinuxKernel: kernel.LinuxKernelCatalogerConfig{
 			CatalogModules: cfg.LinuxKernel.CatalogModules,
 		},
+		Nix: nix.DefaultConfig().
+			WithCaptureOwnedFiles(cfg.Nix.CaptureOwnedFiles),
 		Python: python.CatalogerConfig{
 			GuessUnpinnedRequirements: cfg.Python.GuessUnpinnedRequirements,
 		},
@@ -272,12 +278,12 @@ func (cfg *Catalog) PostLoad() error {
 		return fmt.Errorf("cannot use both 'catalogers' and 'select-catalogers'/'default-catalogers' flags")
 	}
 
-	cfg.From = flatten(cfg.From)
+	cfg.From = Flatten(cfg.From)
 
-	cfg.Catalogers = flatten(cfg.Catalogers)
-	cfg.DefaultCatalogers = flatten(cfg.DefaultCatalogers)
-	cfg.SelectCatalogers = flatten(cfg.SelectCatalogers)
-	cfg.Enrich = flatten(cfg.Enrich)
+	cfg.Catalogers = Flatten(cfg.Catalogers)
+	cfg.DefaultCatalogers = Flatten(cfg.DefaultCatalogers)
+	cfg.SelectCatalogers = Flatten(cfg.SelectCatalogers)
+	cfg.Enrich = Flatten(cfg.Enrich)
 
 	// for backwards compatibility
 	cfg.DefaultCatalogers = append(cfg.DefaultCatalogers, cfg.Catalogers...)
@@ -295,7 +301,7 @@ func (cfg *Catalog) PostLoad() error {
 	return nil
 }
 
-func flatten(commaSeparatedEntries []string) []string {
+func Flatten(commaSeparatedEntries []string) []string {
 	var out []string
 	for _, v := range commaSeparatedEntries {
 		for _, s := range strings.Split(v, ",") {

cmd/syft/internal/options/catalog_test.go

@@ -139,7 +139,7 @@ func Test_enrichmentEnabled(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.directives, func(t *testing.T) {
-			got := enrichmentEnabled(flatten([]string{test.directives}), test.test)
+			got := enrichmentEnabled(Flatten([]string{test.directives}), test.test)
 			assert.Equal(t, test.expected, got)
 		})
 	}

cmd/syft/internal/options/dotnet.go

@@ -10,6 +10,8 @@ type dotnetConfig struct {
 
 	DepPackagesMustClaimDLL bool `mapstructure:"dep-packages-must-claim-dll" json:"dep-packages-must-claim-dll" yaml:"dep-packages-must-claim-dll"`
 
+	PropagateDLLClaimsToParents bool `mapstructure:"propagate-dll-claims-to-parents" json:"propagate-dll-claims-to-parents" yaml:"propagate-dll-claims-to-parents"`
+
 	RelaxDLLClaimsWhenBundlingDetected bool `mapstructure:"relax-dll-claims-when-bundling-detected" json:"relax-dll-claims-when-bundling-detected" yaml:"relax-dll-claims-when-bundling-detected"`
 }
 
@@ -18,8 +20,9 @@ var _ interface {
 } = (*dotnetConfig)(nil)
 
 func (o *dotnetConfig) DescribeFields(descriptions clio.FieldDescriptionSet) {
-	descriptions.Add(&o.DepPackagesMustHaveDLL, `only keep dep.json packages which an executable on disk can be found for`)
-	descriptions.Add(&o.DepPackagesMustClaimDLL, `only keep dep.json packages which have a runtime/resource DLL claimed in the deps.json targets section (but not necessarily found on disk)`)
+	descriptions.Add(&o.DepPackagesMustHaveDLL, `only keep dep.json packages which an executable on disk is found. The package is also included if a DLL is found for any child package, even if the package itself does not have a DLL.`)
+	descriptions.Add(&o.DepPackagesMustClaimDLL, `only keep dep.json packages which have a runtime/resource DLL claimed in the deps.json targets section (but not necessarily found on disk). The package is also included if any child package claims a DLL, even if the package itself does not claim a DLL.`)
+	descriptions.Add(&o.PropagateDLLClaimsToParents, `treat DLL claims or on-disk evidence for child packages as DLL claims or on-disk evidence for any parent package`)
 	descriptions.Add(&o.RelaxDLLClaimsWhenBundlingDetected, `show all packages from the deps.json if bundling tooling is present as a dependency (e.g. ILRepack)`)
 }
 
@@ -28,6 +31,7 @@ func defaultDotnetConfig() dotnetConfig {
 	return dotnetConfig{
 		DepPackagesMustHaveDLL:             def.DepPackagesMustHaveDLL,
 		DepPackagesMustClaimDLL:            def.DepPackagesMustClaimDLL,
+		PropagateDLLClaimsToParents:        def.PropagateDLLClaimsToParents,
 		RelaxDLLClaimsWhenBundlingDetected: def.RelaxDLLClaimsWhenBundlingDetected,
 	}
 }

cmd/syft/internal/options/license.go

@@ -1,12 +1,17 @@
 package options
 
 import (
+	"fmt"
+
 	"github.com/anchore/clio"
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/syft/cataloging"
 )
 
 type licenseConfig struct {
-	IncludeUnknownLicenseContent bool    `yaml:"include-unknown-license-content" json:"include-unknown-license-content" mapstructure:"include-unknown-license-content"`
-	LicenseCoverage              float64 `yaml:"license-coverage" json:"license-coverage" mapstructure:"license-coverage"`
+	Content                 cataloging.LicenseContent   `yaml:"content" json:"content" mapstructure:"content"`
+	Coverage                float64                     `yaml:"coverage" json:"coverage" mapstructure:"coverage"`
+	AvailableLicenseContent []cataloging.LicenseContent `yaml:"-" json:"-" mapstructure:"-"`
 }
 
 var _ interface {
@@ -14,15 +19,29 @@ var _ interface {
 } = (*licenseConfig)(nil)
 
 func (o *licenseConfig) DescribeFields(descriptions clio.FieldDescriptionSet) {
-	descriptions.Add(&o.IncludeUnknownLicenseContent, `include the content of a license in the SBOM when syft
-cannot determine a valid SPDX ID for the given license`)
-	descriptions.Add(&o.LicenseCoverage, `adjust the percent as a fraction of the total text, in normalized words, that
+	descriptions.Add(&o.Content, fmt.Sprintf("include the content of licenses in the SBOM for a given syft scan; valid values are: %s", o.AvailableLicenseContent))
+
+	descriptions.Add(&o.Coverage, `adjust the percent as a fraction of the total text, in normalized words, that
 matches any valid license for the given inputs, expressed as a percentage across all of the licenses matched.`)
 }
 
+func (o *licenseConfig) PostLoad() error {
+	validContent := internal.NewSet(o.AvailableLicenseContent...)
+	if !validContent.Contains(o.Content) {
+		return fmt.Errorf("could not use %q as license content option; valid values are: %v", o.Content, validContent.ToSlice())
+	}
+	return nil
+}
+
 func defaultLicenseConfig() licenseConfig {
+	cfg := cataloging.DefaultLicenseConfig()
 	return licenseConfig{
-		IncludeUnknownLicenseContent: false,
-		LicenseCoverage:              75,
+		Content:  cfg.IncludeContent,
+		Coverage: cfg.Coverage,
+		AvailableLicenseContent: []cataloging.LicenseContent{
+			cataloging.LicenseContentIncludeAll,
+			cataloging.LicenseContentIncludeUnknown,
+			cataloging.LicenseContentExcludeAll,
+		},
 	}
 }

cmd/syft/internal/options/nix.go

@@ -0,0 +1,25 @@
+package options
+
+import (
+	"github.com/anchore/clio"
+	"github.com/anchore/syft/syft/pkg/cataloger/nix"
+)
+
+type nixConfig struct {
+	CaptureOwnedFiles bool `json:"capture-owned-files" yaml:"capture-owned-files" mapstructure:"capture-owned-files"`
+}
+
+func defaultNixConfig() nixConfig {
+	def := nix.DefaultConfig()
+	return nixConfig{
+		def.CaptureOwnedFiles,
+	}
+}
+
+var _ interface {
+	clio.FieldDescriber
+} = (*nixConfig)(nil)
+
+func (o *nixConfig) DescribeFields(descriptions clio.FieldDescriptionSet) {
+	descriptions.Add(&o.CaptureOwnedFiles, `enumerate all files owned by packages found within Nix store paths`)
+}

cmd/syft/internal/options/output.go

@@ -12,6 +12,7 @@ import (
 	"github.com/anchore/syft/syft/format/cyclonedxjson"
 	"github.com/anchore/syft/syft/format/cyclonedxxml"
 	"github.com/anchore/syft/syft/format/github"
+	"github.com/anchore/syft/syft/format/purls"
 	"github.com/anchore/syft/syft/format/spdxjson"
 	"github.com/anchore/syft/syft/format/spdxtagvalue"
 	"github.com/anchore/syft/syft/format/syftjson"
@@ -127,6 +128,7 @@ func supportedIDs() []sbom.FormatID {
 		table.ID,
 		text.ID,
 		template.ID,
+		purls.ID,
 
 		// encoders that support multiple versions
 		cyclonedxxml.ID,

cmd/syft/internal/test/integration/catalog_packages_cases_test.go

@@ -502,8 +502,15 @@ var commonTestCases = []testCase{
 		},
 	},
 	{
-		name:        "find php pecl package",
-		pkgType:     pkg.PhpPeclPkg,
+		name:    "find homebrew",
+		pkgType: pkg.HomebrewPkg,
+		pkgInfo: map[string]string{
+			"afflib": "1.2.3",
+		},
+	},
+	{
+		name:        "find php pear/pecl package",
+		pkgType:     pkg.PhpPearPkg,
 		pkgLanguage: pkg.PHP,
 		pkgInfo: map[string]string{
 			"memcached": "3.2.0",

cmd/syft/internal/test/integration/catalog_packages_test.go

@@ -12,6 +12,7 @@ import (
 	"github.com/anchore/stereoscope/pkg/imagetest"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 )
 
@@ -85,6 +86,7 @@ func TestPkgCoverageImage(t *testing.T) {
 	definedPkgs.Remove(string(pkg.GithubActionPkg))
 	definedPkgs.Remove(string(pkg.GithubActionWorkflowPkg))
 	definedPkgs.Remove(string(pkg.TerraformPkg))
+	definedPkgs.Remove(string(pkg.PhpPeclPkg)) // we have coverage for pear instead
 
 	var cases []testCase
 	cases = append(cases, commonTestCases...)
@@ -92,40 +94,7 @@ func TestPkgCoverageImage(t *testing.T) {
 
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
-			pkgCount := 0
-
-			for a := range sbom.Artifacts.Packages.Enumerate(c.pkgType) {
-				if a.Language.String() != "" {
-					observedLanguages.Add(a.Language.String())
-				}
-
-				observedPkgs.Add(string(a.Type))
-				expectedVersion, ok := c.pkgInfo[a.Name]
-				if !ok {
-					t.Errorf("unexpected package found: %s", a.Name)
-				}
-
-				if expectedVersion != a.Version {
-					t.Errorf("unexpected package version (pkg=%s): %s, expected: %s", a.Name, a.Version, expectedVersion)
-				}
-
-				if a.Language != c.pkgLanguage {
-					t.Errorf("bad language (pkg=%+v): %+v", a.Name, a.Language)
-				}
-
-				if a.Type != c.pkgType {
-					t.Errorf("bad package type (pkg=%+v): %+v", a.Name, a.Type)
-				}
-				pkgCount++
-			}
-
-			if pkgCount != len(c.pkgInfo)+c.duplicates {
-				t.Logf("Discovered packages of type %+v", c.pkgType)
-				for a := range sbom.Artifacts.Packages.Enumerate(c.pkgType) {
-					t.Log("   ", a)
-				}
-				t.Fatalf("unexpected package count: %d!=%d", pkgCount, len(c.pkgInfo))
-			}
+			assertPackages(t, sbom, c, observedLanguages, observedPkgs)
 		})
 	}
 
@@ -175,44 +144,7 @@ func TestPkgCoverageDirectory(t *testing.T) {
 
 	for _, test := range cases {
 		t.Run(test.name, func(t *testing.T) {
-			actualPkgCount := 0
-
-			for actualPkg := range sbom.Artifacts.Packages.Enumerate(test.pkgType) {
-				observedLanguages.Add(actualPkg.Language.String())
-				observedPkgs.Add(string(actualPkg.Type))
-
-				expectedVersion, ok := test.pkgInfo[actualPkg.Name]
-				if !ok {
-					t.Errorf("unexpected package found: %s", actualPkg.Name)
-				}
-
-				if expectedVersion != actualPkg.Version {
-					t.Errorf("unexpected package version (pkg=%s): %s", actualPkg.Name, actualPkg.Version)
-				}
-
-				var foundLang bool
-				for _, lang := range strings.Split(test.pkgLanguage.String(), ",") {
-					if actualPkg.Language.String() == lang {
-						foundLang = true
-						break
-					}
-				}
-				if !foundLang {
-					t.Errorf("bad language (pkg=%+v): %+v", actualPkg.Name, actualPkg.Language)
-				}
-
-				if actualPkg.Type != test.pkgType {
-					t.Errorf("bad package type (pkg=%+v): %+v", actualPkg.Name, actualPkg.Type)
-				}
-				actualPkgCount++
-			}
-
-			if actualPkgCount != len(test.pkgInfo)+test.duplicates {
-				for actualPkg := range sbom.Artifacts.Packages.Enumerate(test.pkgType) {
-					t.Log("   ", actualPkg)
-				}
-				t.Fatalf("unexpected package count: %d!=%d", actualPkgCount, len(test.pkgInfo))
-			}
+			assertPackages(t, sbom, test, observedLanguages, observedPkgs)
 		})
 	}
 
@@ -227,6 +159,7 @@ func TestPkgCoverageDirectory(t *testing.T) {
 	definedPkgs.Remove(string(pkg.LinuxKernelModulePkg))
 	definedPkgs.Remove(string(pkg.Rpkg))
 	definedPkgs.Remove(string(pkg.UnknownPkg))
+	definedPkgs.Remove(string(pkg.PhpPeclPkg)) // this is covered as pear packages
 
 	// for directory scans we should not expect to see any of the following package types
 	definedPkgs.Remove(string(pkg.KbPkg))
@@ -241,6 +174,61 @@ func TestPkgCoverageDirectory(t *testing.T) {
 	}
 }
 
+func assertPackages(t *testing.T, sbom sbom.SBOM, test testCase, observedLanguages *strset.Set, observedPkgs *strset.Set) {
+	actualPkgCount := 0
+
+	for actualPkg := range sbom.Artifacts.Packages.Enumerate(test.pkgType) {
+		observedLanguages.Add(actualPkg.Language.String())
+		observedPkgs.Add(string(actualPkg.Type))
+
+		expectedVersion, ok := test.pkgInfo[actualPkg.Name]
+		if !ok {
+			t.Errorf("unexpected package found: %s", actualPkg.Name)
+		}
+
+		if expectedVersion != actualPkg.Version {
+			t.Errorf("unexpected package version (pkg=%s): %s", actualPkg.Name, actualPkg.Version)
+		}
+
+		var foundLang bool
+		for _, lang := range strings.Split(test.pkgLanguage.String(), ",") {
+			if actualPkg.Language.String() == lang {
+				foundLang = true
+				break
+			}
+		}
+		if !foundLang {
+			t.Errorf("bad language (pkg=%+v): %+v", actualPkg.Name, actualPkg.Language)
+		}
+
+		if actualPkg.Type != test.pkgType {
+			t.Errorf("bad package type (pkg=%+v): %+v", actualPkg.Name, actualPkg.Type)
+		}
+		actualPkgCount++
+
+		// all packages should have at least one location associated with it, and of those locations at least one should be primary evidence
+		locs := actualPkg.Locations.ToSlice()
+		assert.NotEmpty(t, locs, "package %q has no locations (type=%q)", actualPkg.Name, actualPkg.Type)
+		var primaryEvidenceFound bool
+		for _, l := range locs {
+			if _, exists := l.Annotations[pkg.EvidenceAnnotationKey]; !exists {
+				t.Errorf("missing evidence annotation (pkg=%s type=%s)", actualPkg.Name, actualPkg.Type)
+			}
+			if l.Annotations[pkg.EvidenceAnnotationKey] == pkg.PrimaryEvidenceAnnotation {
+				primaryEvidenceFound = true
+			}
+		}
+		assert.True(t, primaryEvidenceFound, "no primary evidence found for package %q", actualPkg.Name)
+	}
+
+	if actualPkgCount != len(test.pkgInfo)+test.duplicates {
+		for actualPkg := range sbom.Artifacts.Packages.Enumerate(test.pkgType) {
+			t.Log("   ", actualPkg)
+		}
+		t.Fatalf("unexpected package count: %d!=%d", actualPkgCount, len(test.pkgInfo))
+	}
+}
+
 func TestPkgCoverageImage_HasEvidence(t *testing.T) {
 	sbom, _ := catalogFixtureImage(t, "image-pkg-coverage", source.SquashedScope)
 

cmd/syft/internal/test/integration/package_catalogers_represented_test.go

@@ -56,6 +56,8 @@ func TestAllPackageCatalogersReachableInTasks(t *testing.T) {
 		// not reachable since they are deprecated
 		"dotnet-portable-executable-cataloger",
 		"dotnet-deps-cataloger",
+		"nix-store-cataloger",
+		"php-pecl-serialized-cataloger",
 		// not reachable by design
 		"sbom-cataloger",
 	)

cmd/syft/internal/test/integration/package_deduplication_test.go

@@ -19,7 +19,7 @@ func TestPackageDeduplication(t *testing.T) {
 	}{
 		{
 			scope:        source.AllLayersScope,
-			packageCount: 178, // without deduplication this would be ~600
+			packageCount: 175, // without deduplication this would be ~600
 			instanceCount: map[string]int{
 				"basesystem":   1,
 				"wget":         1,
@@ -30,15 +30,15 @@ func TestPackageDeduplication(t *testing.T) {
 			locationCount: map[string]int{
 				"basesystem-11-13.el9":               5, // in all layers
 				"curl-minimal-7.76.1-26.el9_3.2.0.1": 2, // base + wget layer
-				"curl-minimal-7.76.1-29.el9_4.1":     3, // curl upgrade layer + all above layers
+				"curl-minimal-7.76.1-31.el9":         3, // curl upgrade layer + all above layers
 				"wget-1.21.1-8.el9_4":                4, // wget + all above layers
-				"vsftpd-3.0.5-5.el9":                 2, // vsftpd + all above layers
-				"httpd-2.4.57-11.el9_4.1":            1, // last layer
+				"vsftpd-3.0.5-6.el9":                 2, // vsftpd + all above layers
+				"httpd-2.4.62-1.el9_5.2":             1, // last layer
 			},
 		},
 		{
 			scope:        source.SquashedScope,
-			packageCount: 172,
+			packageCount: 169,
 			instanceCount: map[string]int{
 				"basesystem":   1,
 				"wget":         1,
@@ -47,11 +47,11 @@ func TestPackageDeduplication(t *testing.T) {
 				"httpd":        1, // rpm, binary is now excluded by overlap
 			},
 			locationCount: map[string]int{
-				"basesystem-11-13.el9":           1,
-				"curl-minimal-7.76.1-29.el9_4.1": 1, // upgrade
-				"wget-1.21.1-8.el9_4":            1,
-				"vsftpd-3.0.5-5.el9":             1,
-				"httpd-2.4.57-11.el9_4.1":        1,
+				"basesystem-11-13.el9":       1,
+				"curl-minimal-7.76.1-31.el9": 1, // upgrade
+				"wget-1.21.1-8.el9_4":        1,
+				"vsftpd-3.0.5-6.el9":         1,
+				"httpd-2.4.62-1.el9_5.2":     1,
 			},
 		},
 	}

cmd/syft/internal/test/integration/regression_photon_package_test.go

@@ -3,18 +3,18 @@ package integration
 import (
 	"testing"
 
+	"github.com/stretchr/testify/assert"
+
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
 )
 
 func TestPhotonPackageRegression(t *testing.T) { // Regression: https://github.com/anchore/syft/pull/1997
 	sbom, _ := catalogFixtureImage(t, "image-photon-all-layers", source.AllLayersScope)
-	var packages []pkg.Package
-	for p := range sbom.Artifacts.Packages.Enumerate() {
-		packages = append(packages, p)
+	var count int
+	for range sbom.Artifacts.Packages.Enumerate(pkg.RpmPkg) {
+		count++
 	}
 
-	if len(packages) < 1 {
-		t.Errorf("failed to find packages for photon distro; wanted > 0 got 0")
-	}
+	assert.Greater(t, count, 0, "expected to find RPM packages in the SBOM (but did not)")
 }

cmd/syft/internal/test/integration/sqlite_rpmdb_test.go

@@ -3,8 +3,6 @@ package integration
 import (
 	"testing"
 
-	_ "modernc.org/sqlite"
-
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
 )

cmd/syft/internal/test/integration/test-fixtures/image-pkg-coverage/pkgs/homebrew/Cellar/afflib/1.2.3/.brew/afflib.rb

@@ -0,0 +1,2 @@
+desc "Advanced Forensic Format"
+homepage "https://github.com/sshock/AFFLIBv3"

cmd/syft/internal/test/integration/test-fixtures/image-pkg-coverage/pkgs/php/.registry/.channel.pecl.php.net/memcached.reg

@@ -1 +1 @@
-a:5:{s:4:"name";s:9:"memcached";s:4:"date";s:10:"2022-01-11";s:4:"time";s:8:"15:23:47";s:7:"version";a:2:{s:7:"release";s:5:"3.2.0";s:3:"api";s:5:"3.2.0";}s:7:"license";a:2:{s:7:"attribs";a:1:{s:3:"uri";s:26:"http://www.php.net/license";}s:8:"_content";s:11:"PHP License";}}
+a:6:{s:4:"name";s:9:"memcached";s:7:"channel";s:12:"pecl.php.net";s:4:"date";s:10:"2022-01-11";s:4:"time";s:8:"15:23:47";s:7:"version";a:2:{s:7:"release";s:5:"3.2.0";s:3:"api";s:5:"3.2.0";}s:7:"license";a:2:{s:7:"attribs";a:1:{s:3:"uri";s:26:"http://www.php.net/license";}s:8:"_content";s:11:"PHP License";}}

cmd/syft/main.go

@@ -1,8 +1,6 @@
 package main
 
 import (
-	_ "modernc.org/sqlite"
-
 	"github.com/anchore/clio"
 	"github.com/anchore/syft/cmd/syft/cli"
 	"github.com/anchore/syft/cmd/syft/internal"

go.mod

@@ -5,7 +5,7 @@ go 1.24.1
 require (
 	github.com/BurntSushi/toml v1.5.0
 	github.com/CycloneDX/cyclonedx-go v0.9.2
-	github.com/Masterminds/semver v1.5.0
+	github.com/Masterminds/semver/v3 v3.3.1
 	github.com/Masterminds/sprig/v3 v3.3.0
 	github.com/OneOfOne/xxhash v1.2.8
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
@@ -19,17 +19,19 @@ require (
 	github.com/anchore/go-homedir v0.0.0-20250319154043-c29668562e4d
 	github.com/anchore/go-logger v0.0.0-20250318195838-07ae343dd722
 	github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb
+	github.com/anchore/go-rpmdb v0.0.0-20250516171929-f77691e1faec
+	github.com/anchore/go-sync v0.0.0-20250326131806-4eda43a485b6
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115
-	github.com/anchore/stereoscope v0.1.2
+	github.com/anchore/stereoscope v0.1.4
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
 	github.com/aquasecurity/go-pep440-version v0.0.1
 	github.com/bitnami/go-version v0.0.0-20250131085805-b1f57a8634ef
 	github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
 	github.com/bmatcuk/doublestar/v4 v4.8.1
-	github.com/charmbracelet/bubbles v0.20.0
-	github.com/charmbracelet/bubbletea v1.3.4
+	github.com/charmbracelet/bubbles v0.21.0
+	github.com/charmbracelet/bubbletea v1.3.5
 	github.com/charmbracelet/lipgloss v1.1.0
 	github.com/dave/jennifer v1.7.1
 	github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da
@@ -37,10 +39,10 @@ require (
 	github.com/dustin/go-humanize v1.0.1
 	github.com/elliotchance/phpserialize v1.4.0
 	github.com/facebookincubator/nvdtools v0.1.5
-	github.com/github/go-spdx/v2 v2.3.2
+	github.com/github/go-spdx/v2 v2.3.3
 	github.com/gkampitakis/go-snaps v0.5.11
 	github.com/go-git/go-billy/v5 v5.6.2
-	github.com/go-git/go-git/v5 v5.14.0
+	github.com/go-git/go-git/v5 v5.16.0
 	github.com/go-test/deep v1.1.1
 	github.com/go-viper/mapstructure/v2 v2.2.1
 	github.com/gohugoio/hashstructure v0.5.0
@@ -56,10 +58,10 @@ require (
 	github.com/jedib0t/go-pretty/v6 v6.6.7
 	github.com/jinzhu/copier v0.4.0
 	github.com/kastenhq/goversion v0.0.0-20230811215019-93b2f8823953
-	github.com/knqyf263/go-rpmdb v0.1.1
-	github.com/magiconair/properties v1.8.9
-	github.com/mholt/archives v0.1.0
+	github.com/magiconair/properties v1.8.10
+	github.com/mholt/archives v0.1.2
 	github.com/moby/sys/mountinfo v0.7.2
+	github.com/nix-community/go-nix v0.0.0-20250101154619-4bdde671e0a1
 	github.com/olekukonko/tablewriter v0.0.5
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/pelletier/go-toml v1.9.5
@@ -85,9 +87,9 @@ require (
 	go.uber.org/goleak v1.3.0
 	golang.org/x/exp v0.0.0-20250305212735-054e65f0b394
 	golang.org/x/mod v0.24.0
-	golang.org/x/net v0.38.0
+	golang.org/x/net v0.40.0
 	gopkg.in/yaml.v3 v3.0.1
-	modernc.org/sqlite v1.37.0
+	modernc.org/sqlite v1.37.0 // indirect
 )
 
 require (
@@ -96,14 +98,13 @@ require (
 	github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0 // indirect
 	github.com/DataDog/zstd v1.5.5 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.3.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/Microsoft/hcsshim v0.11.7 // indirect
-	github.com/ProtonMail/go-crypto v1.1.6 // indirect
+	github.com/ProtonMail/go-crypto v1.2.0 // indirect
 	github.com/STARRY-S/zip v0.2.1 // indirect
 	github.com/agext/levenshtein v1.2.1 // indirect; indirectt
 	github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092 // indirect
-	github.com/andybalholm/brotli v1.1.1 // indirect
+	github.com/andybalholm/brotli v1.1.2-0.20250424173009-453214e765f3 // indirect
 	github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/aquasecurity/go-version v0.0.1 // indirect
@@ -118,7 +119,7 @@ require (
 	github.com/charmbracelet/x/ansi v0.8.0 // indirect
 	github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd // indirect
 	github.com/charmbracelet/x/term v0.2.1 // indirect
-	github.com/cloudflare/circl v1.6.0 // indirect
+	github.com/cloudflare/circl v1.6.1 // indirect
 	github.com/containerd/cgroups v1.1.0 // indirect
 	github.com/containerd/containerd v1.7.27 // indirect
 	github.com/containerd/containerd/api v1.8.0 // indirect
@@ -132,9 +133,9 @@ require (
 	github.com/containerd/typeurl/v2 v2.1.1 // indirect
 	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/docker/cli v28.0.4+incompatible // indirect
+	github.com/docker/cli v28.1.1+incompatible // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
-	github.com/docker/docker v28.0.4+incompatible // indirect
+	github.com/docker/docker v28.1.1+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.8.2 // indirect
 	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
@@ -145,7 +146,7 @@ require (
 	github.com/felixge/fgprof v0.9.5 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.8.0 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.8 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.9 // indirect
 	github.com/gkampitakis/ciinfo v0.3.1 // indirect
 	github.com/gkampitakis/go-diff v1.3.2 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
@@ -176,22 +177,22 @@ require (
 	github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
+	github.com/minio/minlz v1.0.0 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/locker v1.0.1 // indirect
-	github.com/moby/sys/sequential v0.5.0 // indirect
+	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/moby/sys/signal v0.7.0 // indirect
 	github.com/moby/sys/user v0.3.0 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/muesli/termenv v0.16.0 // indirect
-	github.com/ncruces/go-strftime v0.1.9 // indirect
 	github.com/nwaples/rardecode v1.1.3 // indirect
-	github.com/nwaples/rardecode/v2 v2.0.0-beta.4.0.20241112120701-034e449c6e78 // indirect
+	github.com/nwaples/rardecode/v2 v2.1.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/opencontainers/runtime-spec v1.1.0 // indirect
 	github.com/opencontainers/selinux v1.11.0 // indirect
@@ -202,7 +203,6 @@ require (
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/profile v1.7.0 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/sagikazarmark/locafero v0.7.0 // indirect
@@ -240,11 +240,11 @@ require (
 	go.uber.org/atomic v1.9.0 // indirect
 	go.uber.org/multierr v1.9.0 // indirect
 	go4.org v0.0.0-20230225012048-214862532bf5 // indirect
-	golang.org/x/crypto v0.36.0 // indirect
-	golang.org/x/sync v0.12.0 // indirect
-	golang.org/x/sys v0.31.0 // indirect
-	golang.org/x/term v0.30.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
+	golang.org/x/crypto v0.38.0 // indirect
+	golang.org/x/sync v0.14.0 // indirect
+	golang.org/x/sys v0.33.0 // indirect
+	golang.org/x/term v0.32.0 // indirect
+	golang.org/x/text v0.25.0 // indirect
 	golang.org/x/tools v0.31.0 // indirect
 	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
 	google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 // indirect
@@ -253,13 +253,10 @@ require (
 	google.golang.org/protobuf v1.36.4 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	modernc.org/libc v1.62.1 // indirect
-	modernc.org/mathutil v1.7.1 // indirect
-	modernc.org/memory v1.9.1 // indirect
 )
 
-require github.com/anchore/go-sync v0.0.0-20250326131806-4eda43a485b6
-
 retract (
+	v1.25.0 // published with a replace directive (confusing for API users)
 	v0.53.2
-	v0.53.1 // Published accidentally with incorrect license in depdencies
+	v0.53.1 // published accidentally with incorrect license in depdencies
 )

go.sum

@@ -66,10 +66,8 @@ github.com/DataDog/zstd v1.5.5 h1:oWf5W7GtOLgp6bciQYDmhHHjdhYkALu6S/5Ni9ZgSvQ=
 github.com/DataDog/zstd v1.5.5/go.mod h1:g4AWEaM3yOg3HYfnJ3YIawPnVdXJh9QME85blwSAmyw=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
-github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
-github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
-github.com/Masterminds/semver/v3 v3.3.0 h1:B8LGeaivUe71a5qox1ICM/JLl0NqZSW5CHyL+hmvYS0=
-github.com/Masterminds/semver/v3 v3.3.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/Masterminds/semver/v3 v3.3.1 h1:QtNSWtVZ3nBfk8mAOu/B6v7FMJ+NHTIgUPi7rj+4nv4=
+github.com/Masterminds/semver/v3 v3.3.1/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=
 github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0=
 github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
@@ -80,8 +78,8 @@ github.com/Microsoft/hcsshim v0.11.7/go.mod h1:MV8xMfmECjl5HdO7U/3/hFVnkmSBjAjmA
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/OneOfOne/xxhash v1.2.8 h1:31czK/TI9sNkxIKfaUfGlU47BAxQ0ztGgd9vPyqimf8=
 github.com/OneOfOne/xxhash v1.2.8/go.mod h1:eZbhyaAYD41SGSSsnmcpxVoRiQ/MPUTjUdIIOT9Um7Q=
-github.com/ProtonMail/go-crypto v1.1.6 h1:ZcV+Ropw6Qn0AX9brlQLAUXfqLBc7Bl+f/DmNxpLfdw=
-github.com/ProtonMail/go-crypto v1.1.6/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
+github.com/ProtonMail/go-crypto v1.2.0 h1:+PhXXn4SPGd+qk76TlEePBfOfivE0zkWFenhGhFLzWs=
+github.com/ProtonMail/go-crypto v1.2.0/go.mod h1:9whxjD8Rbs29b4XWbB8irEcE8KHMqaR2e7GWU1R+/PE=
 github.com/STARRY-S/zip v0.2.1 h1:pWBd4tuSGm3wtpoqRZZ2EAwOmcHK6XFf7bU9qcJXyFg=
 github.com/STARRY-S/zip v0.2.1/go.mod h1:xNvshLODWtC4EJ702g7cTYn13G53o1+X9BWnPFpcWV4=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=
@@ -112,6 +110,8 @@ github.com/anchore/go-logger v0.0.0-20250318195838-07ae343dd722 h1:2SqmFgE7h+Ql4
 github.com/anchore/go-logger v0.0.0-20250318195838-07ae343dd722/go.mod h1:oFuE8YuTCM+spgMXhePGzk3asS94yO9biUfDzVTFqNw=
 github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb h1:iDMnx6LIjtjZ46C0akqveX83WFzhpTD3eqOthawb5vU=
 github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb/go.mod h1:DmTY2Mfcv38hsHbG78xMiTDdxFtkHpgYNVDPsF2TgHk=
+github.com/anchore/go-rpmdb v0.0.0-20250516171929-f77691e1faec h1:SjjPMOXTzpuU1ZME4XeoHyek+dry3/C7I8gzaCo02eg=
+github.com/anchore/go-rpmdb v0.0.0-20250516171929-f77691e1faec/go.mod h1:eQVa6QFGzKy0qMcnW2pez0XBczvgwSjw9vA23qifEyU=
 github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092 h1:aM1rlcoLz8y5B2r4tTLMiVTrMtpfY0O8EScKJxaSaEc=
 github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092/go.mod h1:rYqSE9HbjzpHTI74vwPvae4ZVYZd1lue2ta6xHPdblA=
 github.com/anchore/go-sync v0.0.0-20250326131806-4eda43a485b6 h1:Ha+LSCVuXYSYGi7wIkJK6G8g6jI3LH7y6LbyEVyp4Io=
@@ -122,11 +122,11 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZV
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115 h1:ZyRCmiEjnoGJZ1+Ah0ZZ/mKKqNhGcUZBl0s7PTTDzvY=
 github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115/go.mod h1:KoYIv7tdP5+CC9VGkeZV4/vGCKsY55VvoG+5dadg4YI=
-github.com/anchore/stereoscope v0.1.2 h1:0+Jcf7hoImYKfrH2XzN6vvbmbpm68A/woabC43gZ4eU=
-github.com/anchore/stereoscope v0.1.2/go.mod h1:kU4LkiocOimxuSnlmJgilHCfDMCR5t/UroKIpzI8jNw=
+github.com/anchore/stereoscope v0.1.4 h1:e+iT9UdUzLBabWGe84hn5sTHDRioY+4IHsVzJXuJlek=
+github.com/anchore/stereoscope v0.1.4/go.mod h1:omWgXDEp/XfqCJlZXIByEo1c3ArZg/qTJ5LBKVLAIdw=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
-github.com/andybalholm/brotli v1.1.1 h1:PR2pgnyFznKEugtsUo0xLdDop5SKXd5Qf5ysW+7XdTA=
-github.com/andybalholm/brotli v1.1.1/go.mod h1:05ib4cKhjx3OQYUY22hTVd34Bc8upXjOLL2rKwwZBoA=
+github.com/andybalholm/brotli v1.1.2-0.20250424173009-453214e765f3 h1:8PmGpDEZl9yDpcdEr6Odf23feCxK3LNUNMxjXg41pZQ=
+github.com/andybalholm/brotli v1.1.2-0.20250424173009-453214e765f3/go.mod h1:05ib4cKhjx3OQYUY22hTVd34Bc8upXjOLL2rKwwZBoA=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
@@ -149,6 +149,8 @@ github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z
 github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
+github.com/aymanbagabas/go-udiff v0.2.0 h1:TK0fH4MteXUDspT88n8CKzvK0X9O2xu9yQjWpi6yML8=
+github.com/aymanbagabas/go-udiff v0.2.0/go.mod h1:RE4Ex0qsGkTAJoQdQQCA0uG+nAzJO/pI/QwceO5fgrA=
 github.com/becheran/wildmatch-go v1.0.0 h1:mE3dGGkTmpKtT4Z+88t8RStG40yN9T+kFEGj2PZFSzA=
 github.com/becheran/wildmatch-go v1.0.0/go.mod h1:gbMvj0NtVdJ15Mg/mH9uxk2R1QCistMyU7d9KFzroX4=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
@@ -179,10 +181,10 @@ github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL
 github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/charmbracelet/bubbles v0.20.0 h1:jSZu6qD8cRQ6k9OMfR1WlM+ruM8fkPWkHvQWD9LIutE=
-github.com/charmbracelet/bubbles v0.20.0/go.mod h1:39slydyswPy+uVOHZ5x/GjwVAFkCsV8IIVy+4MhzwwU=
-github.com/charmbracelet/bubbletea v1.3.4 h1:kCg7B+jSCFPLYRA52SDZjr51kG/fMUEoPoZrkaDHyoI=
-github.com/charmbracelet/bubbletea v1.3.4/go.mod h1:dtcUCyCGEX3g9tosuYiut3MXgY/Jsv9nKVdibKKRRXo=
+github.com/charmbracelet/bubbles v0.21.0 h1:9TdC97SdRVg/1aaXNVWfFH3nnLAwOXr8Fn6u6mfQdFs=
+github.com/charmbracelet/bubbles v0.21.0/go.mod h1:HF+v6QUR4HkEpz62dx7ym2xc71/KBHg+zKwJtMw+qtg=
+github.com/charmbracelet/bubbletea v1.3.5 h1:JAMNLTbqMOhSwoELIr0qyP4VidFq72/6E9j7HHmRKQc=
+github.com/charmbracelet/bubbletea v1.3.5/go.mod h1:TkCnmH+aBd4LrXhXcqrKiYwRs7qyQx5rBgH5fVY3v54=
 github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc h1:4pZI35227imm7yK2bGPcfpFEmuY1gc2YSTShr4iJBfs=
 github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc/go.mod h1:X4/0JoqgTIPSFcRA/P6INZzIuyqdFY5rm8tb41s9okk=
 github.com/charmbracelet/harmonica v0.2.0 h1:8NxJWRWg/bzKqqEaaeFNipOu77YR5t8aSwG4pgaUBiQ=
@@ -193,6 +195,8 @@ github.com/charmbracelet/x/ansi v0.8.0 h1:9GTq3xq9caJW8ZrBTe0LIe2fvfLR/bYXKTx2ll
 github.com/charmbracelet/x/ansi v0.8.0/go.mod h1:wdYl/ONOLHLIVmQaxbIYEC/cRKOQyjTkowiI4blgS9Q=
 github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd h1:vy0GVL4jeHEwG5YOXDmi86oYw2yuYUGqz6a8sLwg0X8=
 github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd/go.mod h1:xe0nKWGd3eJgtqZRaN9RjMtK7xUYchjzPr7q6kcvCCs=
+github.com/charmbracelet/x/exp/golden v0.0.0-20241011142426-46044092ad91 h1:payRxjMjKgx2PaCWLZ4p3ro9y97+TVLZNaRZgJwSVDQ=
+github.com/charmbracelet/x/exp/golden v0.0.0-20241011142426-46044092ad91/go.mod h1:wDlXFlCrmJ8J+swcL/MnGUuYnqgQdW9rhSD61oNMb6U=
 github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ=
 github.com/charmbracelet/x/term v0.2.1/go.mod h1:oQ4enTYFV7QN4m0i9mzHrViD7TQKvNEEkHUMCmsxdUg=
 github.com/chromedp/cdproto v0.0.0-20230802225258-3cf4e6d46a89/go.mod h1:GKljq0VrfU4D5yc+2qA6OVr8pmO/MBbPEWqWQ/oqGEs=
@@ -207,8 +211,8 @@ github.com/chzyer/test v1.0.0/go.mod h1:2JlltgoNkt4TW/z9V/IzDdFaMTM2JPIi26O1pF38
 github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6Dob7S7YxXgwXpfOuvO54S+tGdZdw9fuRZt25Ag=
 github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cloudflare/circl v1.6.0 h1:cr5JKic4HI+LkINy2lg3W2jF8sHCVTBncJr5gIIq7qk=
-github.com/cloudflare/circl v1.6.0/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
+github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0=
+github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
@@ -260,12 +264,12 @@ github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da/go.mod h1:B3tI9iGHi4i
 github.com/dgrijalva/jwt-go/v4 v4.0.0-preview1/go.mod h1:+hnT3ywWDTAFrW5aE+u2Sa/wT555ZqwoCS+pk3p6ry4=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/cli v28.0.4+incompatible h1:pBJSJeNd9QeIWPjRcV91RVJihd/TXB77q1ef64XEu4A=
-github.com/docker/cli v28.0.4+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v28.1.1+incompatible h1:eyUemzeI45DY7eDPuwUcmDyDj1pM98oD5MdSpiItp8k=
+github.com/docker/cli v28.1.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v28.0.4+incompatible h1:JNNkBctYKurkw6FrHfKqY0nKIDf5nrbxjVBtS+cdcok=
-github.com/docker/docker v28.0.4+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v28.1.1+incompatible h1:49M11BFLsVO1gxY9UX9p/zwkE/rswggs8AdFmXQw51I=
+github.com/docker/docker v28.1.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
 github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
@@ -316,11 +320,11 @@ github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7z
 github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5Ai1i3InKU=
 github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M=
 github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/gabriel-vasile/mimetype v1.4.8 h1:FfZ3gj38NjllZIeJAmMhr+qKL8Wu+nOoI3GqacKw1NM=
-github.com/gabriel-vasile/mimetype v1.4.8/go.mod h1:ByKUIKGjh1ODkGM1asKUbQZOLGrPjydw3hYPU2YU9t8=
+github.com/gabriel-vasile/mimetype v1.4.9 h1:5k+WDwEsD9eTLL8Tz3L0VnmVh9QxGjRmjBvAG7U/oYY=
+github.com/gabriel-vasile/mimetype v1.4.9/go.mod h1:WnSQhFKJuBlRyLiKohA/2DtIlPFAbguNaG7QCHcyGok=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/github/go-spdx/v2 v2.3.2 h1:IfdyNHTqzs4zAJjXdVQfRnxt1XMfycXoHBE2Vsm1bjs=
-github.com/github/go-spdx/v2 v2.3.2/go.mod h1:2ZxKsOhvBp+OYBDlsGnUMcchLeo2mrpEBn2L1C+U3IQ=
+github.com/github/go-spdx/v2 v2.3.3 h1:QI7evnHWEfWkT54eJwkoV/f3a0xD3gLlnVmT5wQG6LE=
+github.com/github/go-spdx/v2 v2.3.3/go.mod h1:2ZxKsOhvBp+OYBDlsGnUMcchLeo2mrpEBn2L1C+U3IQ=
 github.com/gkampitakis/ciinfo v0.3.1 h1:lzjbemlGI4Q+XimPg64ss89x8Mf3xihJqy/0Mgagapo=
 github.com/gkampitakis/ciinfo v0.3.1/go.mod h1:1NIwaOcFChN4fa/B0hEBdAb6npDlFL8Bwx4dfRLRqAo=
 github.com/gkampitakis/go-diff v1.3.2 h1:Qyn0J9XJSDTgnsgHRdz9Zp24RaJeKMUHg2+PDZZdC4M=
@@ -337,8 +341,8 @@ github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UN
 github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.14.0 h1:/MD3lCrGjCen5WfEAzKg00MJJffKhC8gzS80ycmCi60=
-github.com/go-git/go-git/v5 v5.14.0/go.mod h1:Z5Xhoia5PcWA3NF8vRLURn9E5FRhSl7dGj9ItW3Wk5k=
+github.com/go-git/go-git/v5 v5.16.0 h1:k3kuOEpkc0DeY7xlL6NaaNg39xdgQbtH5mwCafHO9AQ=
+github.com/go-git/go-git/v5 v5.16.0/go.mod h1:4Ge4alE/5gPs30F2H1esi2gPd69R0C39lolkucHBOp8=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -546,8 +550,6 @@ github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYW
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
 github.com/klauspost/pgzip v1.2.6/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
-github.com/knqyf263/go-rpmdb v0.1.1 h1:oh68mTCvp1XzxdU7EfafcWzzfstUZAEa3MW0IJye584=
-github.com/knqyf263/go-rpmdb v0.1.1/go.mod h1:9LQcoMCMQ9vrF7HcDtXfvqGO4+ddxFQ8+YF/0CVGDww=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
@@ -569,8 +571,8 @@ github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69
 github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/lyft/protoc-gen-star v0.5.3/go.mod h1:V0xaHgaf5oCCqmcxYcWiDfTiKsZsRc87/1qhoTACD8w=
 github.com/magiconair/properties v1.8.5/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
-github.com/magiconair/properties v1.8.9 h1:nWcCbLq1N2v/cpNsy5WvQ37Fb+YElfq20WJ/a8RkpQM=
-github.com/magiconair/properties v1.8.9/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
+github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE=
+github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/maruel/natural v1.1.1 h1:Hja7XhhmvEFhcByqDoHz9QZbkWey+COd9xWfCfn1ioo=
 github.com/maruel/natural v1.1.1/go.mod h1:v+Rfd79xlw1AgVBjbO0BEQmptqb5HvL/k9GRHB7ZKEg=
@@ -598,11 +600,13 @@ github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
-github.com/mholt/archives v0.1.0 h1:FacgJyrjiuyomTuNA92X5GyRBRZjE43Y/lrzKIlF35Q=
-github.com/mholt/archives v0.1.0/go.mod h1:j/Ire/jm42GN7h90F5kzj6hf6ZFzEH66de+hmjEKu+I=
+github.com/mholt/archives v0.1.2 h1:UBSe5NfYKHI1sy+S5dJsEsG9jsKKk8NJA4HCC+xTI4A=
+github.com/mholt/archives v0.1.2/go.mod h1:D7QzTHgw3ctfS6wgOO9dN+MFgdZpbksGCxprUOwZWDs=
 github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
 github.com/miekg/dns v1.1.26/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
 github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
+github.com/minio/minlz v1.0.0 h1:Kj7aJZ1//LlTP1DM8Jm7lNKvvJS2m74gyyXXn3+uJWQ=
+github.com/minio/minlz v1.0.0/go.mod h1:qT0aEB35q79LLornSzeDH75LBf3aH1MV+jB5w9Wasec=
 github.com/mitchellh/cli v1.1.0/go.mod h1:xcISNoH86gajksDmfB23e/pu+B+GeFRMYmoHXxx3xhI=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
@@ -620,10 +624,12 @@ github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3N
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
+github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
+github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
 github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
 github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
-github.com/moby/sys/sequential v0.5.0 h1:OPvI35Lzn9K04PBbCLW0g4LcFAJgHsvXsRyewg5lXtc=
-github.com/moby/sys/sequential v0.5.0/go.mod h1:tH2cOOs5V9MlPiXcQzRC+eEyab644PWKGRYaaV5ZZlo=
+github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
+github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
 github.com/moby/sys/signal v0.7.0 h1:25RW3d5TnQEoKvRbEKUGay6DCQ46IxAVTT9CUMgmsSI=
 github.com/moby/sys/signal v0.7.0/go.mod h1:GQ6ObYZfqacOwTtlXvcmh9A26dVRul/hbOZn88Kg8Tg=
 github.com/moby/sys/user v0.3.0 h1:9ni5DlcW5an3SvRSx4MouotOygvzaXbaSrc/wGDFWPo=
@@ -648,10 +654,14 @@ github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
 github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
+github.com/nix-community/go-nix v0.0.0-20250101154619-4bdde671e0a1 h1:kpt9ZfKcm+EDG4s40hMwE//d5SBgDjUOrITReV2u4aA=
+github.com/nix-community/go-nix v0.0.0-20250101154619-4bdde671e0a1/go.mod h1:qgCw4bBKZX8qMgGeEZzGFVT3notl42dBjNqO2jut0M0=
+github.com/nsf/jsondiff v0.0.0-20210926074059-1e845ec5d249 h1:NHrXEjTNQY7P0Zfx1aMrNhpgxHmow66XQtm0aQLY0AE=
+github.com/nsf/jsondiff v0.0.0-20210926074059-1e845ec5d249/go.mod h1:mpRZBD8SJ55OIICQ3iWH0Yz3cjzA61JdqMLoWXeB2+8=
 github.com/nwaples/rardecode v1.1.3 h1:cWCaZwfM5H7nAD6PyEdcVnczzV8i/JtotnyW/dD9lEc=
 github.com/nwaples/rardecode v1.1.3/go.mod h1:5DzqNKiOdpKKBH87u8VlvAnPZMXcGRhxWkRpHbbfGS0=
-github.com/nwaples/rardecode/v2 v2.0.0-beta.4.0.20241112120701-034e449c6e78 h1:MYzLheyVx1tJVDqfu3YnN4jtnyALNzLvwl+f58TcvQY=
-github.com/nwaples/rardecode/v2 v2.0.0-beta.4.0.20241112120701-034e449c6e78/go.mod h1:yntwv/HfMc/Hbvtq9I19D1n58te3h6KsqCf3GxyfBGY=
+github.com/nwaples/rardecode/v2 v2.1.0 h1:JQl9ZoBPDy+nIZGb1mx8+anfHp/LV3NE2MjMiv0ct/U=
+github.com/nwaples/rardecode/v2 v2.1.0/go.mod h1:7uz379lSxPe6j9nvzxUZ+n7mnJNgjsRNb6IbvGVHRmw=
 github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
 github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
 github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
@@ -915,8 +925,8 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
-golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
+golang.org/x/crypto v0.38.0 h1:jt+WWG8IZlBnVbomuhg2Mdq0+BBQaHbtqHEFEigjUV8=
+golang.org/x/crypto v0.38.0/go.mod h1:MvrbAqul58NNYPKnOra203SB9vpuZW0e+RRZV+Ggqjw=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -1002,8 +1012,8 @@ golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
-golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
+golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY=
+golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1033,8 +1043,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
-golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.14.0 h1:woo0S4Yywslg6hp4eUFjTVOyKt0RookbpAHG4c1HmhQ=
+golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1110,13 +1120,13 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
-golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
+golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
-golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
+golang.org/x/term v0.32.0 h1:DR4lr0TjUs3epypdhTOkMmuF5CDFJ/8pOnbzMZPQ7bg=
+golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1127,8 +1137,8 @@ golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
-golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4=
+golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1380,30 +1390,14 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-modernc.org/cc/v4 v4.25.2 h1:T2oH7sZdGvTaie0BRNFbIYsabzCxUQg8nLqCdQ2i0ic=
-modernc.org/cc/v4 v4.25.2/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
-modernc.org/ccgo/v4 v4.25.1 h1:TFSzPrAGmDsdnhT9X2UrcPMI3N/mJ9/X9ykKXwLhDsU=
-modernc.org/ccgo/v4 v4.25.1/go.mod h1:njjuAYiPflywOOrm3B7kCB444ONP5pAVr8PIEoE0uDw=
-modernc.org/fileutil v1.3.0 h1:gQ5SIzK3H9kdfai/5x41oQiKValumqNTDXMvKo62HvE=
-modernc.org/fileutil v1.3.0/go.mod h1:XatxS8fZi3pS8/hKG2GH/ArUogfxjpEKs3Ku3aK4JyQ=
-modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
-modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
 modernc.org/libc v1.62.1 h1:s0+fv5E3FymN8eJVmnk0llBe6rOxCu/DEU+XygRbS8s=
 modernc.org/libc v1.62.1/go.mod h1:iXhATfJQLjG3NWy56a6WVU73lWOcdYVxsvwCgoPljuo=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
 modernc.org/memory v1.9.1 h1:V/Z1solwAVmMW1yttq3nDdZPJqV1rM05Ccq6KMSZ34g=
 modernc.org/memory v1.9.1/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
-modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
-modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
-modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
-modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
 modernc.org/sqlite v1.37.0 h1:s1TMe7T3Q3ovQiK2Ouz4Jwh7dw4ZDqbebSDTlSJdfjI=
 modernc.org/sqlite v1.37.0/go.mod h1:5YiWv+YviqGMuGw4V+PNplcyaJ5v+vQd7TQOgkACoJM=
-modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
-modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
-modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
-modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=

internal/cmptest/common_options.go

@@ -1,9 +1,12 @@
 package cmptest
 
 import (
+	"strings"
+
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 
+	"github.com/anchore/syft/internal/evidence"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
 )
@@ -29,9 +32,41 @@ func BuildOptions(licenseCmp LicenseComparer, locationCmp LocationComparer) []cm
 		cmpopts.IgnoreFields(pkg.Package{}, "id"), // note: ID is not deterministic for test purposes
 		cmpopts.SortSlices(pkg.Less),
 		cmpopts.SortSlices(DefaultRelationshipComparer),
-		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](locationCmp)),
+		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](locationCmp, locationSorter)),
 		cmp.Comparer(buildSetComparer[pkg.License, pkg.LicenseSet](licenseCmp)),
 		cmp.Comparer(locationCmp),
 		cmp.Comparer(licenseCmp),
 	}
 }
+
+// LocationSorter always sorts by evidence annotations first, then by access path, then by real path.
+// This intentionally does not consider layer details since some test fixtures have no layer information
+// on the left side of the comparison (expected) and does on the right side (actual).
+func locationSorter(a, b file.Location) int {
+	// compare by evidence annotations first...
+	aEvidence := a.Annotations[evidence.AnnotationKey]
+	bEvidence := b.Annotations[evidence.AnnotationKey]
+
+	if aEvidence != bEvidence {
+		if aEvidence == evidence.PrimaryAnnotation {
+			return -1
+		}
+		if bEvidence == evidence.PrimaryAnnotation {
+			return 1
+		}
+
+		if aEvidence > bEvidence {
+			return -1
+		}
+		if bEvidence > aEvidence {
+			return 1
+		}
+	}
+
+	// ...then by paths
+	if a.AccessPath != b.AccessPath {
+		return strings.Compare(a.AccessPath, b.AccessPath)
+	}
+
+	return strings.Compare(a.RealPath, b.RealPath)
+}

internal/cmptest/license.go

@@ -13,7 +13,7 @@ func DefaultLicenseComparer(x, y pkg.License) bool {
 	return cmp.Equal(
 		x, y,
 		cmp.Comparer(DefaultLocationComparer),
-		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](DefaultLocationComparer)),
+		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](DefaultLocationComparer, locationSorter)),
 	)
 }
 
@@ -21,6 +21,6 @@ func LicenseComparerWithoutLocationLayer(x, y pkg.License) bool {
 	return cmp.Equal(
 		x, y,
 		cmp.Comparer(LocationComparerWithoutLayer),
-		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](LocationComparerWithoutLayer)),
+		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](LocationComparerWithoutLayer, locationSorter)),
 	)
 }

internal/cmptest/location.go

@@ -2,6 +2,7 @@ package cmptest
 
 import (
 	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
 
 	"github.com/anchore/syft/syft/file"
 )
@@ -9,7 +10,7 @@ import (
 type LocationComparer func(x, y file.Location) bool
 
 func DefaultLocationComparer(x, y file.Location) bool {
-	return cmp.Equal(x.Coordinates, y.Coordinates) && cmp.Equal(x.AccessPath, y.AccessPath)
+	return cmp.Equal(x.Coordinates, y.Coordinates, cmpopts.IgnoreUnexported(file.Coordinates{})) && cmp.Equal(x.AccessPath, y.AccessPath)
 }
 
 func LocationComparerWithoutLayer(x, y file.Location) bool {

internal/cmptest/set.go

@@ -1,13 +1,13 @@
 package cmptest
 
 type slicer[T any] interface {
-	ToSlice() []T
+	ToSlice(sorter ...func(a, b T) int) []T
 }
 
-func buildSetComparer[T any, S slicer[T]](l func(x, y T) bool) func(x, y S) bool {
+func buildSetComparer[T any, S slicer[T]](l func(x, y T) bool, sorters ...func(a, b T) int) func(x, y S) bool {
 	return func(x, y S) bool {
-		xs := x.ToSlice()
-		ys := y.ToSlice()
+		xs := x.ToSlice(sorters...)
+		ys := y.ToSlice(sorters...)
 
 		if len(xs) != len(ys) {
 			return false

internal/constants.go

@@ -3,5 +3,5 @@ package internal
 const (
 	// JSONSchemaVersion is the current schema version output by the JSON encoder
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "16.0.25"
+	JSONSchemaVersion = "16.0.33"
 )

internal/licenses/context.go

@@ -6,12 +6,19 @@ import (
 
 type licenseScannerKey struct{}
 
+var ctxKey = licenseScannerKey{}
+
 func SetContextLicenseScanner(ctx context.Context, s Scanner) context.Context {
-	return context.WithValue(ctx, licenseScannerKey{}, s)
+	return context.WithValue(ctx, ctxKey, s)
+}
+
+func IsContextLicenseScannerSet(ctx context.Context) bool {
+	_, ok := ctx.Value(ctxKey).(Scanner)
+	return ok
 }
 
 func ContextLicenseScanner(ctx context.Context) (Scanner, error) {
-	if s, ok := ctx.Value(licenseScannerKey{}).(Scanner); ok {
+	if s, ok := ctx.Value(ctxKey).(Scanner); ok {
 		return s, nil
 	}
 	return NewDefaultScanner()

internal/licenses/context_test.go

@@ -0,0 +1,48 @@
+package licenses
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestSetContextLicenseScanner(t *testing.T) {
+	scanner := testScanner()
+	ctx := context.Background()
+	ctx = SetContextLicenseScanner(ctx, scanner)
+
+	val := ctx.Value(ctxKey)
+	require.NotNil(t, val)
+	s, ok := val.(Scanner)
+	require.True(t, ok)
+	require.Equal(t, scanner, s)
+}
+
+func TestIsContextLicenseScannerSet(t *testing.T) {
+	scanner := testScanner()
+	ctx := context.Background()
+	require.False(t, IsContextLicenseScannerSet(ctx))
+
+	ctx = SetContextLicenseScanner(ctx, scanner)
+	require.True(t, IsContextLicenseScannerSet(ctx))
+}
+
+func TestContextLicenseScanner(t *testing.T) {
+	t.Run("with scanner", func(t *testing.T) {
+		scanner := testScanner()
+		ctx := SetContextLicenseScanner(context.Background(), scanner)
+		s, err := ContextLicenseScanner(ctx)
+		if err != nil || s != scanner {
+			t.Fatal("expected scanner from context")
+		}
+	})
+
+	t.Run("without scanner", func(t *testing.T) {
+		ctx := context.Background()
+		s, err := ContextLicenseScanner(ctx)
+		if err != nil || s == nil {
+			t.Fatal("expected default scanner")
+		}
+	})
+}

internal/licenses/find_evidence.go

@@ -0,0 +1,36 @@
+package licenses
+
+import (
+	"context"
+	"io"
+)
+
+func (s *scanner) FindEvidence(_ context.Context, reader io.Reader) (evidence []Evidence, content []byte, err error) {
+	if s.scanner == nil {
+		return nil, nil, nil
+	}
+
+	content, err = io.ReadAll(reader)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	cov := s.scanner(content)
+	if cov.Percent < s.coverageThreshold {
+		// unknown or no licenses here
+		// => check return content to Search to process
+		return nil, content, nil
+	}
+
+	evidence = make([]Evidence, 0)
+	for _, m := range cov.Match {
+		evidence = append(evidence, Evidence{
+			ID:    m.ID,
+			Type:  m.Type,
+			Start: m.Start,
+			End:   m.End,
+			IsURL: m.IsURL,
+		})
+	}
+	return evidence, content, nil
+}

internal/licenses/find_evidence_test.go

@@ -0,0 +1,81 @@
+package licenses
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/google/licensecheck"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDefaultScanner_FindEvidence(t *testing.T) {
+	testCases := []struct {
+		name     string
+		fixture  string
+		wantIDs  []string // expected license IDs
+		minMatch int      // minimum # of matches required
+	}{
+		{
+			name:     "Single licenses are able to be recognized and returned Apache 2.0",
+			fixture:  "test-fixtures/apache-license-2.0",
+			wantIDs:  []string{"Apache-2.0"},
+			minMatch: 1,
+		},
+		{
+			name:    "Multiple Licenses are returned as evidence with duplicates at different offset",
+			fixture: "test-fixtures/multi-license",
+			wantIDs: []string{
+				"MIT",
+				"MIT",
+				"NCSA",
+				"Apache-2.0",
+				"Zlib",
+				"Unlicense",
+				"BSD-2-Clause",
+				"BSD-2-Clause",
+				"BSD-3-Clause",
+			},
+			minMatch: 2,
+		},
+	}
+
+	scanner := testScanner()
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			filePath := filepath.Clean(tc.fixture)
+			f, err := os.Open(filePath)
+			require.NoError(t, err)
+			defer f.Close()
+
+			evidence, content, err := scanner.FindEvidence(context.Background(), f)
+			require.NoError(t, err)
+			require.NotEmpty(t, content)
+			require.GreaterOrEqual(t, len(evidence), tc.minMatch, "expected at least %d matches", tc.minMatch)
+
+			var foundIDs []string
+			for _, ev := range evidence {
+				foundIDs = append(foundIDs, ev.ID)
+			}
+
+			require.ElementsMatch(t, tc.wantIDs, foundIDs, "expected license IDs %v, but got %v", tc.wantIDs, foundIDs)
+		})
+	}
+}
+
+func testScanner() Scanner {
+	return &scanner{
+		coverageThreshold: DefaultCoverageThreshold,
+		scanner:           licensecheck.Scan,
+	}
+}
+
+func mustOpen(fixture string) []byte {
+	content, err := os.ReadFile(fixture)
+	if err != nil {
+		panic(err)
+	}
+
+	return content
+}

internal/licenses/scanner.go

@@ -8,33 +8,37 @@ import (
 	"github.com/google/licensecheck"
 
 	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/file"
-	"github.com/anchore/syft/syft/pkg"
 )
 
 const (
-	DefaultCoverageThreshold     = 75 // determined by experimentation
-	DefaultIncludeLicenseContent = false
+	UnknownLicensePrefix     = unknownLicenseType + "_"
+	DefaultCoverageThreshold = 75 // determined by experimentation
+
+	unknownLicenseType = "UNKNOWN"
 )
 
+type Evidence struct {
+	ID    string            // License identifier. (See licenses/README.md.)
+	Type  licensecheck.Type // The type of the license: BSD, MIT, etc.
+	Start int               // Start offset of match in text; match is at text[Start:End].
+	End   int               // End offset of match in text.
+	IsURL bool              // Whether match is a URL.
+}
+
 type Scanner interface {
-	IdentifyLicenseIDs(context.Context, io.Reader) ([]string, []byte, error)
-	FileSearch(context.Context, file.LocationReadCloser) ([]file.License, error)
-	PkgSearch(context.Context, file.LocationReadCloser) ([]pkg.License, error)
+	FindEvidence(context.Context, io.Reader) ([]Evidence, []byte, error)
 }
 
 var _ Scanner = (*scanner)(nil)
 
 type scanner struct {
-	coverageThreshold     float64 // between 0 and 100
-	includeLicenseContent bool
-	scanner               func([]byte) licensecheck.Coverage
+	coverageThreshold float64 // between 0 and 100
+	scanner           func([]byte) licensecheck.Coverage
 }
 
 type ScannerConfig struct {
-	CoverageThreshold     float64
-	IncludeLicenseContent bool
-	Scanner               func([]byte) licensecheck.Coverage
+	CoverageThreshold float64
+	Scanner           func([]byte) licensecheck.Coverage
 }
 
 type Option func(*scanner)
@@ -45,12 +49,6 @@ func WithCoverage(coverage float64) Option {
 	}
 }
 
-func WithIncludeLicenseContent(includeLicenseContent bool) Option {
-	return func(s *scanner) {
-		s.includeLicenseContent = includeLicenseContent
-	}
-}
-
 // NewDefaultScanner returns a scanner that uses a new instance of the default licensecheck package scanner.
 func NewDefaultScanner(o ...Option) (Scanner, error) {
 	s, err := licensecheck.NewScanner(licensecheck.BuiltinLicenses())
@@ -58,10 +56,10 @@ func NewDefaultScanner(o ...Option) (Scanner, error) {
 		log.WithFields("error", err).Trace("unable to create default license scanner")
 		return nil, fmt.Errorf("unable to create default license scanner: %w", err)
 	}
+
 	newScanner := &scanner{
-		coverageThreshold:     DefaultCoverageThreshold,
-		includeLicenseContent: DefaultIncludeLicenseContent,
-		scanner:               s.Scan,
+		coverageThreshold: DefaultCoverageThreshold,
+		scanner:           s.Scan,
 	}
 
 	for _, opt := range o {
@@ -78,8 +76,7 @@ func NewScanner(c *ScannerConfig) (Scanner, error) {
 	}
 
 	return &scanner{
-		coverageThreshold:     c.CoverageThreshold,
-		includeLicenseContent: c.IncludeLicenseContent,
-		scanner:               c.Scanner,
+		coverageThreshold: c.CoverageThreshold,
+		scanner:           c.Scanner,
 	}, nil
 }

internal/licenses/scanner_test.go

@@ -1,84 +0,0 @@
-package licenses
-
-import (
-	"bytes"
-	"context"
-	"os"
-	"testing"
-
-	"github.com/google/licensecheck"
-	"github.com/stretchr/testify/require"
-)
-
-func TestIdentifyLicenseIDs(t *testing.T) {
-	type expectation struct {
-		yieldError bool
-		ids        []string
-		content    []byte
-	}
-	tests := []struct {
-		name     string
-		in       string
-		expected expectation
-	}{
-		{
-			name: "apache license 2.0",
-			in:   `test-fixtures/apache-license-2.0`,
-			expected: expectation{
-				yieldError: false,
-				ids:        []string{"Apache-2.0"},
-				content:    nil,
-			},
-		},
-		{
-			name: "custom license includes content for IdentifyLicenseIDs",
-			in:   "test-fixtures/nvidia-software-and-cuda-supplement",
-			expected: expectation{
-				yieldError: false,
-				ids:        []string{},
-				content:    mustOpen("test-fixtures/nvidia-software-and-cuda-supplement"),
-			},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			content, err := os.ReadFile(test.in)
-			require.NoError(t, err)
-			ids, content, err := testScanner(false).IdentifyLicenseIDs(context.TODO(), bytes.NewReader(content))
-			if test.expected.yieldError {
-				require.Error(t, err)
-			} else {
-				require.NoError(t, err)
-
-				require.Len(t, ids, len(test.expected.ids))
-				require.Len(t, content, len(test.expected.content))
-
-				if len(test.expected.ids) > 0 {
-					require.Equal(t, ids, test.expected.ids)
-				}
-
-				if len(test.expected.content) > 0 {
-					require.Equal(t, content, test.expected.content)
-				}
-			}
-		})
-	}
-}
-
-func testScanner(includeLicenseContent bool) Scanner {
-	return &scanner{
-		coverageThreshold:     DefaultCoverageThreshold,
-		includeLicenseContent: includeLicenseContent,
-		scanner:               licensecheck.Scan,
-	}
-}
-
-func mustOpen(fixture string) []byte {
-	content, err := os.ReadFile(fixture)
-	if err != nil {
-		panic(err)
-	}
-
-	return content
-}

internal/licenses/search.go

@@ -1,123 +0,0 @@
-package licenses
-
-import (
-	"context"
-	"crypto/sha256"
-	"fmt"
-	"io"
-	"strings"
-
-	"github.com/anchore/syft/syft/file"
-	"github.com/anchore/syft/syft/license"
-	"github.com/anchore/syft/syft/pkg"
-)
-
-const (
-	unknownLicenseType   = "UNKNOWN"
-	UnknownLicensePrefix = unknownLicenseType + "_"
-)
-
-func getCustomLicenseContentHash(contents []byte) string {
-	hash := sha256.Sum256(contents)
-	return fmt.Sprintf("%x", hash[:])
-}
-
-func (s *scanner) IdentifyLicenseIDs(_ context.Context, reader io.Reader) ([]string, []byte, error) {
-	if s.scanner == nil {
-		return nil, nil, nil
-	}
-
-	content, err := io.ReadAll(reader)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	cov := s.scanner(content)
-	if cov.Percent < s.coverageThreshold {
-		// unknown or no licenses here
-		// => check return content to Search to process
-		return nil, content, nil
-	}
-
-	var ids []string
-	for _, m := range cov.Match {
-		ids = append(ids, m.ID)
-	}
-	return ids, nil, nil
-}
-
-// PkgSearch scans the contents of a license file to attempt to determine the type of license it is
-func (s *scanner) PkgSearch(ctx context.Context, reader file.LocationReadCloser) (licenses []pkg.License, err error) {
-	licenses = make([]pkg.License, 0)
-
-	ids, content, err := s.IdentifyLicenseIDs(ctx, reader)
-	if err != nil {
-		return nil, err
-	}
-
-	// IdentifyLicenseIDs can only return a list of ID or content
-	// These return values are mutually exclusive.
-	// If the scanner threshold for matching scores < 75% then we return the license full content
-	if len(ids) > 0 {
-		for _, id := range ids {
-			lic := pkg.NewLicenseFromLocations(id, reader.Location)
-			lic.Type = license.Concluded
-
-			licenses = append(licenses, lic)
-		}
-	} else if len(content) > 0 {
-		// harmonize line endings to unix compatible first:
-		// 1. \r\n => \n   (Windows   => UNIX)
-		// 2. \r   => \n   (Macintosh => UNIX)
-		content = []byte(strings.ReplaceAll(strings.ReplaceAll(string(content), "\r\n", "\n"), "\r", "\n"))
-
-		lic := pkg.NewLicenseFromLocations(unknownLicenseType, reader.Location)
-		lic.SPDXExpression = UnknownLicensePrefix + getCustomLicenseContentHash(content)
-		if s.includeLicenseContent {
-			lic.Contents = string(content)
-		}
-		lic.Type = license.Declared
-
-		licenses = append(licenses, lic)
-	}
-
-	return licenses, nil
-}
-
-// FileSearch scans the contents of a license file to attempt to determine the type of license it is
-func (s *scanner) FileSearch(ctx context.Context, reader file.LocationReadCloser) (licenses []file.License, err error) {
-	licenses = make([]file.License, 0)
-
-	ids, content, err := s.IdentifyLicenseIDs(ctx, reader)
-	if err != nil {
-		return nil, err
-	}
-
-	// IdentifyLicenseIDs can only return a list of ID or content
-	// These return values are mutually exclusive.
-	// If the scanner threshold for matching scores < 75% then we return the license full content
-	if len(ids) > 0 {
-		for _, id := range ids {
-			lic := file.NewLicense(id)
-			lic.Type = license.Concluded
-
-			licenses = append(licenses, lic)
-		}
-	} else if len(content) > 0 {
-		// harmonize line endings to unix compatible first:
-		// 1. \r\n => \n   (Windows   => UNIX)
-		// 2. \r   => \n   (Macintosh => UNIX)
-		content = []byte(strings.ReplaceAll(strings.ReplaceAll(string(content), "\r\n", "\n"), "\r", "\n"))
-
-		lic := file.NewLicense(unknownLicenseType)
-		lic.SPDXExpression = UnknownLicensePrefix + getCustomLicenseContentHash(content)
-		if s.includeLicenseContent {
-			lic.Contents = string(content)
-		}
-		lic.Type = license.Declared
-
-		licenses = append(licenses, lic)
-	}
-
-	return licenses, nil
-}

internal/licenses/search_test.go

@@ -1,166 +0,0 @@
-package licenses
-
-import (
-	"bytes"
-	"context"
-	"io"
-	"os"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/anchore/syft/syft/file"
-	"github.com/anchore/syft/syft/pkg"
-)
-
-type bytesReadCloser struct {
-	bytes.Buffer
-}
-
-func (brc *bytesReadCloser) Close() error {
-	return nil
-}
-
-func newBytesReadCloser(data []byte) *bytesReadCloser {
-	return &bytesReadCloser{
-		Buffer: *bytes.NewBuffer(data),
-	}
-}
-
-func TestSearchFileLicenses(t *testing.T) {
-	type expectation struct {
-		yieldError bool
-		licenses   []file.License
-	}
-
-	tests := []struct {
-		name                        string
-		in                          string
-		includeUnkownLicenseContent bool
-		expected                    expectation
-	}{
-		{
-			name: "apache license 2.0",
-			in:   "test-fixtures/apache-license-2.0",
-			expected: expectation{
-				yieldError: false,
-				licenses: []file.License{
-					{
-						Value:          "Apache-2.0",
-						SPDXExpression: "Apache-2.0",
-						Type:           "concluded",
-					},
-				},
-			},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			ctx := context.TODO()
-			content, err := os.ReadFile(test.in)
-			require.NoError(t, err)
-			s := testScanner(false)
-			result, err := s.FileSearch(ctx, file.NewLocationReadCloser(file.NewLocation("LICENSE"), io.NopCloser(bytes.NewReader(content))))
-			if test.expected.yieldError {
-				require.Error(t, err)
-			} else {
-				require.NoError(t, err)
-
-				require.Len(t, result, len(test.expected.licenses))
-
-				if len(test.expected.licenses) > 0 {
-					require.Equal(t, test.expected.licenses, result)
-				}
-			}
-		})
-	}
-}
-
-func TestSearchPkgLicenses(t *testing.T) {
-	type expectation struct {
-		wantErr  require.ErrorAssertionFunc
-		licenses []pkg.License
-	}
-
-	testLocation := file.NewLocation("LICENSE")
-	tests := []struct {
-		name                        string
-		in                          string
-		includeUnkownLicenseContent bool
-		expected                    expectation
-	}{
-		{
-			name: "apache license 2.0",
-			in:   "test-fixtures/apache-license-2.0",
-			expected: expectation{
-				licenses: []pkg.License{
-					{
-						Value:          "Apache-2.0",
-						SPDXExpression: "Apache-2.0",
-						Type:           "concluded",
-						URLs:           nil,
-						Locations:      file.NewLocationSet(testLocation),
-						Contents:       "",
-					},
-				},
-				wantErr: nil,
-			},
-		},
-		{
-			name: "custom license no content by default",
-			in:   "test-fixtures/nvidia-software-and-cuda-supplement",
-			expected: expectation{
-				licenses: []pkg.License{
-					{
-						Value:          "UNKNOWN",
-						SPDXExpression: "UNKNOWN_eebcea3ab1d1a28e671de90119ffcfb35fe86951e4af1b17af52b7a82fcf7d0a",
-						Type:           "declared",
-						URLs:           nil,
-						Locations:      file.NewLocationSet(testLocation),
-						Contents:       "",
-					},
-				},
-				wantErr: nil,
-			},
-		},
-		{
-			name:                        "custom license with content when scanner has content config",
-			in:                          "test-fixtures/nvidia-software-and-cuda-supplement",
-			includeUnkownLicenseContent: true,
-			expected: expectation{
-				licenses: []pkg.License{
-					{
-						Value:          "UNKNOWN",
-						SPDXExpression: "UNKNOWN_eebcea3ab1d1a28e671de90119ffcfb35fe86951e4af1b17af52b7a82fcf7d0a",
-						Type:           "declared",
-						URLs:           nil,
-						Locations:      file.NewLocationSet(testLocation),
-						Contents:       string(mustOpen("test-fixtures/nvidia-software-and-cuda-supplement")),
-					},
-				},
-				wantErr: nil,
-			},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			ctx := context.TODO()
-			content, err := os.ReadFile(test.in)
-			require.NoError(t, err)
-			s := testScanner(test.includeUnkownLicenseContent)
-			result, err := s.PkgSearch(ctx, file.NewLocationReadCloser(file.NewLocation("LICENSE"), io.NopCloser(bytes.NewReader(content))))
-			if test.expected.wantErr != nil {
-				test.expected.wantErr(t, err)
-			}
-			require.NoError(t, err)
-
-			require.Len(t, result, len(test.expected.licenses))
-
-			if len(test.expected.licenses) > 0 {
-				require.Equal(t, test.expected.licenses, result)
-			}
-		})
-	}
-}

internal/licenses/test-fixtures/Knuth-CTAN

@@ -0,0 +1,5 @@
+Knuth CTAN License
+Full name
+Knuth CTAN License
+
+This software is copyrighted. Unlimited copying and redistribution of this package and/or its individual files are permitted as long as there are no modifications. Modifications, and redistribution of modifications, are also permitted, but only if the resulting package and/or files are renamed.

internal/licenses/test-fixtures/multi-license

@@ -0,0 +1,445 @@
+Emscripten is available under 2 licenses, the MIT license and the
+University of Illinois/NCSA Open Source License.
+
+Both are permissive open source licenses, with little if any
+practical difference between them.
+
+The reason for offering both is that (1) the MIT license is
+well-known, while (2) the University of Illinois/NCSA Open Source
+License allows Emscripten's code to be integrated upstream into
+LLVM, which uses that license, should the opportunity arise.
+
+Additionally, the binaryen project is available under the Apache License
+Version 2.0.
+
+The full text of all three licenses follows.
+
+==============================================================================
+
+Copyright (c) 2010-2014 Emscripten authors, see AUTHORS file.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+==============================================================================
+
+Copyright (c) 2010-2014 Emscripten authors, see AUTHORS file.
+All rights reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of this software and associated documentation files (the
+"Software"), to deal with the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+    Redistributions of source code must retain the above copyright
+    notice, this list of conditions and the following disclaimers.
+
+    Redistributions in binary form must reproduce the above
+    copyright notice, this list of conditions and the following disclaimers
+    in the documentation and/or other materials provided with the
+    distribution.
+
+    Neither the names of Mozilla,
+    nor the names of its contributors may be used to endorse
+    or promote products derived from this Software without specific prior
+    written permission.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE CONTRIBUTORS OR COPYRIGHT HOLDERS BE LIABLE FOR
+ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS WITH THE SOFTWARE.
+
+==============================================================================
+
+This program uses portions of Node.js source code located in src/library_path.js,
+in accordance with the terms of the MIT license. Node's license follows:
+
+    """
+        Copyright Joyent, Inc. and other Node contributors. All rights reserved.
+        Permission is hereby granted, free of charge, to any person obtaining a copy
+        of this software and associated documentation files (the "Software"), to
+        deal in the Software without restriction, including without limitation the
+        rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+        sell copies of the Software, and to permit persons to whom the Software is
+        furnished to do so, subject to the following conditions:
+
+        The above copyright notice and this permission notice shall be included in
+        all copies or substantial portions of the Software.
+
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+        FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+        IN THE SOFTWARE.
+    """
+
+==============================================================================
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+==============================================================================
+
+Simple DirectMedia Layer
+  Copyright (C) 1997-2014 Sam Lantinga <slouken@libsdl.org>
+
+  This software is provided 'as-is', without any express or implied
+  warranty.  In no event will the authors be held liable for any damages
+  arising from the use of this software.
+
+  Permission is granted to anyone to use this software for any purpose,
+  including commercial applications, and to alter it and redistribute it
+  freely, subject to the following restrictions:
+
+  1. The origin of this software must not be misrepresented; you must not
+     claim that you wrote the original software. If you use this software
+     in a product, an acknowledgment in the product documentation would be
+     appreciated but is not required.
+  2. Altered source versions must be plainly marked as such, and must not be
+     misrepresented as being the original software.
+  3. This notice may not be removed or altered from any source distribution.
+
+==============================================================================
+
+Files: tools/filelock.py
+
+This is free and unencumbered software released into the public domain.
+
+Anyone is free to copy, modify, publish, use, compile, sell, or
+distribute this software, either in source code form or as a compiled
+binary, for any purpose, commercial or non-commercial, and by any
+means.
+
+In jurisdictions that recognize copyright laws, the author or authors
+of this software dedicate any and all copyright interest in the
+software to the public domain. We make this dedication for the benefit
+of the public at large and to the detriment of our heirs and
+successors. We intend this dedication to be an overt act of
+relinquishment in perpetuity of all present and future rights to this
+software under copyright law.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+For more information, please refer to <http://unlicense.org>
+
+==============================================================================
+
+Files: tools/eliminator/node_modules/uglify-js/... tools/node_modules/terser/...
+
+  Distributed under the BSD license:
+
+    Copyright 2012 (c) Mihai Bazon <mihai.bazon@gmail.com>
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions
+    are met:
+
+        * Redistributions of source code must retain the above
+          copyright notice, this list of conditions and the following
+          disclaimer.
+
+        * Redistributions in binary form must reproduce the above
+          copyright notice, this list of conditions and the following
+          disclaimer in the documentation and/or other materials
+          provided with the distribution.
+
+    THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER “AS IS” AND ANY
+    EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+    IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+    PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
+    LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+    PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+    PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+    THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+    TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+    THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+    SUCH DAMAGE.
+
+==============================================================================
+
+Files: system/include/webgpu/webgpu.h
+
+BSD 3-Clause License
+
+Copyright (c) 2019, "WebGPU native" developers
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+==============================================================================
+
+Copyright (c) 2005-2011 David Schultz <das@FreeBSD.ORG>
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.

internal/relationship/by_file_ownership.go

@@ -9,6 +9,7 @@ import (
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/sbomsync"
 	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
 )
@@ -32,11 +33,11 @@ type ownershipByFilesMetadata struct {
 	Files []string `json:"files"`
 }
 
-func ByFileOwnershipOverlapWorker(accessor sbomsync.Accessor) {
+func ByFileOwnershipOverlapWorker(resolver file.Resolver, accessor sbomsync.Accessor) {
 	var relationships []artifact.Relationship
 
 	accessor.ReadFromSBOM(func(s *sbom.SBOM) {
-		relationships = byFileOwnershipOverlap(s.Artifacts.Packages)
+		relationships = byFileOwnershipOverlap(resolver, s.Artifacts.Packages)
 	})
 
 	accessor.WriteToSBOM(func(s *sbom.SBOM) {
@@ -46,8 +47,8 @@ func ByFileOwnershipOverlapWorker(accessor sbomsync.Accessor) {
 
 // byFileOwnershipOverlap creates a package-to-package relationship based on discovering which packages have
 // evidence locations that overlap with ownership claim from another package's package manager metadata.
-func byFileOwnershipOverlap(catalog *pkg.Collection) []artifact.Relationship {
-	var relationships = findOwnershipByFilesRelationships(catalog)
+func byFileOwnershipOverlap(resolver file.Resolver, catalog *pkg.Collection) []artifact.Relationship {
+	var relationships = findOwnershipByFilesRelationships(resolver, catalog)
 
 	var edges []artifact.Relationship
 	for parentID, children := range relationships {
@@ -84,7 +85,7 @@ func byFileOwnershipOverlap(catalog *pkg.Collection) []artifact.Relationship {
 
 // findOwnershipByFilesRelationships find overlaps in file ownership with a file that defines another package. Specifically, a .Location.Path of
 // a package is found to be owned by another (from the owner's .Metadata.Files[]).
-func findOwnershipByFilesRelationships(catalog *pkg.Collection) map[artifact.ID]map[artifact.ID]*strset.Set {
+func findOwnershipByFilesRelationships(resolver file.Resolver, catalog *pkg.Collection) map[artifact.ID]map[artifact.ID]*strset.Set { //nolint:gocognit
 	var relationships = make(map[artifact.ID]map[artifact.ID]*strset.Set)
 
 	if catalog == nil {
@@ -102,27 +103,31 @@ func findOwnershipByFilesRelationships(catalog *pkg.Collection) map[artifact.ID]
 		if !ok {
 			continue
 		}
-		for _, ownedFilePath := range pkgFileOwner.OwnedFiles() {
-			if matchesAny(ownedFilePath, globsForbiddenFromBeingOwned) {
-				// we skip over known exceptions to file ownership, such as the RPM package owning
-				// the RPM DB path, otherwise the RPM package would "own" all RPMs, which is not intended
-				continue
-			}
 
-			// look for package(s) in the catalog that may be owned by this package and mark the relationship
-			for _, subPackage := range catalog.PackagesByPath(ownedFilePath) {
-				subID := subPackage.ID()
-				if subID == id {
+		for _, ownedFilePath := range pkgFileOwner.OwnedFiles() {
+			// find the first path that results in a hit
+			for _, ownedPath := range allPaths(ownedFilePath, resolver) {
+				if matchesAny(ownedPath, globsForbiddenFromBeingOwned) {
+					// we skip over known exceptions to file ownership, such as the RPM package owning
+					// the RPM DB path, otherwise the RPM package would "own" all RPMs, which is not intended
 					continue
 				}
-				if _, exists := relationships[id]; !exists {
-					relationships[id] = make(map[artifact.ID]*strset.Set)
-				}
 
-				if _, exists := relationships[id][subID]; !exists {
-					relationships[id][subID] = strset.New()
+				// look for package(s) in the catalog that may be owned by this package and mark the relationship
+				for _, subPackage := range catalog.PackagesByPath(ownedPath) {
+					subID := subPackage.ID()
+					if subID == id {
+						continue
+					}
+					if _, exists := relationships[id]; !exists {
+						relationships[id] = make(map[artifact.ID]*strset.Set)
+					}
+
+					if _, exists := relationships[id][subID]; !exists {
+						relationships[id][subID] = strset.New()
+					}
+					relationships[id][subID].Add(ownedPath)
 				}
-				relationships[id][subID].Add(ownedFilePath)
 			}
 		}
 	}
@@ -130,6 +135,25 @@ func findOwnershipByFilesRelationships(catalog *pkg.Collection) map[artifact.ID]
 	return relationships
 }
 
+func allPaths(ownedFilePath string, resolver file.Resolver) []string {
+	// though we have a string path, we need to resolve symlinks and other filesystem oddities since we cannot assume this is a real path
+	var locs []file.Location
+	var err error
+	if resolver != nil {
+		locs, err = resolver.FilesByPath(ownedFilePath)
+		if err != nil {
+			log.WithFields("error", err, "path", ownedFilePath).Trace("unable to find path for owned file")
+			locs = nil
+		}
+	}
+
+	ownedFilePaths := strset.New(ownedFilePath)
+	for _, loc := range locs {
+		ownedFilePaths.Add(loc.RealPath)
+	}
+	return ownedFilePaths.List()
+}
+
 func matchesAny(s string, globs []string) bool {
 	for _, g := range globs {
 		matches, err := doublestar.Match(g, s)

internal/relationship/by_file_ownership_test.go

@@ -4,7 +4,7 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
-	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"github.com/anchore/syft/internal/cmptest"
 	"github.com/anchore/syft/syft/artifact"
@@ -12,11 +12,29 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 )
 
+type mockFR struct {
+	file.Resolver
+	translate map[string]string
+}
+
+func (m mockFR) FilesByPath(paths ...string) ([]file.Location, error) {
+	var results []file.Location
+	for _, p := range paths {
+		tPath, ok := m.translate[p]
+		if !ok {
+			tPath = p
+		}
+		results = append(results, file.NewLocation(tPath))
+	}
+	return results, nil
+}
+
 func TestOwnershipByFilesRelationship(t *testing.T) {
 
 	tests := []struct {
-		name  string
-		setup func(t testing.TB) ([]pkg.Package, []artifact.Relationship)
+		name     string
+		resolver file.Resolver
+		setup    func(t testing.TB) ([]pkg.Package, []artifact.Relationship)
 	}{
 		{
 			name: "owns-by-real-path",
@@ -60,6 +78,75 @@ func TestOwnershipByFilesRelationship(t *testing.T) {
 				return []pkg.Package{parent, child}, []artifact.Relationship{relationship}
 			},
 		},
+		{
+			name: "misses-by-dead-symlink",
+			resolver: mockFR{
+				translate: map[string]string{
+					"/bin/gzip": "", // treat this as a dead symlink
+				},
+			},
+			setup: func(t testing.TB) ([]pkg.Package, []artifact.Relationship) {
+				parent := pkg.Package{
+					Type: pkg.DebPkg,
+					Metadata: pkg.DpkgDBEntry{
+						Files: []pkg.DpkgFileRecord{
+							{Path: "/bin/gzip"}, // this symlinks to gzip via /bin -> /usr/bin
+						},
+					},
+				}
+				parent.SetID()
+
+				child := pkg.Package{
+					Locations: file.NewLocationSet(
+						file.NewVirtualLocation("/usr/bin/gzip", "/usr/bin/gzip"),
+					),
+					Type: pkg.BinaryPkg,
+				}
+				child.SetID()
+
+				return []pkg.Package{parent, child}, nil // importantly, no relationship is expected
+			},
+		},
+		{
+			name: "owns-by-symlink",
+			resolver: mockFR{
+				translate: map[string]string{
+					"/bin/gzip": "/usr/bin/gzip", // if there is a string path of /bin/gzip then return the real path of /usr/bin/gzip
+				},
+			},
+			setup: func(t testing.TB) ([]pkg.Package, []artifact.Relationship) {
+				parent := pkg.Package{
+					Type: pkg.DebPkg,
+					Metadata: pkg.DpkgDBEntry{
+						Files: []pkg.DpkgFileRecord{
+							{Path: "/bin/gzip"}, // this symlinks to gzip via /bin -> /usr/bin
+						},
+					},
+				}
+				parent.SetID()
+
+				child := pkg.Package{
+					Locations: file.NewLocationSet(
+						file.NewVirtualLocation("/usr/bin/gzip", "/usr/bin/gzip"),
+					),
+					Type: pkg.BinaryPkg,
+				}
+				child.SetID()
+
+				relationship := artifact.Relationship{
+					From: parent,
+					To:   child,
+					Type: artifact.OwnershipByFileOverlapRelationship,
+					Data: ownershipByFilesMetadata{
+						Files: []string{
+							"/usr/bin/gzip",
+						},
+					},
+				}
+
+				return []pkg.Package{parent, child}, []artifact.Relationship{relationship}
+			},
+		},
 		{
 			name: "owns-by-virtual-path",
 			setup: func(t testing.TB) ([]pkg.Package, []artifact.Relationship) {
@@ -140,9 +227,9 @@ func TestOwnershipByFilesRelationship(t *testing.T) {
 		t.Run(test.name, func(t *testing.T) {
 			pkgs, expectedRelations := test.setup(t)
 			c := pkg.NewCollection(pkgs...)
-			relationships := byFileOwnershipOverlap(c)
+			relationships := byFileOwnershipOverlap(test.resolver, c)
 
-			assert.Len(t, relationships, len(expectedRelations))
+			require.Len(t, relationships, len(expectedRelations))
 			for idx, expectedRelationship := range expectedRelations {
 				actualRelationship := relationships[idx]
 				if d := cmp.Diff(expectedRelationship, actualRelationship, cmptest.DefaultOptions()...); d != "" {

internal/task/package_task_factory.go

@@ -107,6 +107,11 @@ func finalizePkgCatalogerResults(cfg CatalogingFactoryConfig, resolver file.Path
 			}
 		}
 
+		// we want to know if the user wants to preserve license content or not in the final SBOM
+		// note: this looks incorrect, but pkg.License.Content is NOT used to compute the Package ID
+		// this does NOT change the reproducibility of the Package ID
+		applyLicenseContentRules(&p, cfg.LicenseConfig)
+
 		pkgs[i] = p
 	}
 	return pkgs, relationships
@@ -262,3 +267,29 @@ func packageFileOwnershipRelationships(p pkg.Package, resolver file.PathResolver
 	}
 	return relationships, nil
 }
+
+func applyLicenseContentRules(p *pkg.Package, cfg cataloging.LicenseConfig) {
+	if p.Licenses.Empty() {
+		return
+	}
+
+	licenses := p.Licenses.ToSlice()
+	for i := range licenses {
+		l := &licenses[i]
+		switch cfg.IncludeContent {
+		case cataloging.LicenseContentIncludeUnknown:
+			// we have an SPDX expression, which means this is NOT an unknown license
+			// remove the content, we are only including content for unknown licenses by default
+			if l.SPDXExpression != "" {
+				licenses[i].Contents = ""
+			}
+		case cataloging.LicenseContentIncludeAll:
+			// always include the content
+		default:
+			// clear it all out
+			licenses[i].Contents = ""
+		}
+	}
+
+	p.Licenses = pkg.NewLicenseSet(licenses...)
+}

internal/task/package_task_factory_test.go

@@ -117,6 +117,149 @@ func TestFilterNonCompliantPackages(t *testing.T) {
 	assert.Equal(t, p2, droppedPkgs[0])
 }
 
+func TestApplyLicenseContentRules(t *testing.T) {
+	licenseWithSPDX := pkg.License{
+		SPDXExpression: "MIT",
+		Contents:       "MIT license content",
+	}
+	licenseWithoutSPDX := pkg.License{
+		Value:    "License-Not-A-SPDX-Expression",
+		Contents: "Non-SPDX license content",
+	}
+
+	tests := []struct {
+		name             string
+		inputLicenses    []pkg.License
+		cfg              cataloging.LicenseConfig
+		expectedLicenses []pkg.License
+	}{
+		{
+			name: "LicenseContentIncludeUnknown",
+			inputLicenses: []pkg.License{
+				licenseWithSPDX,
+				licenseWithoutSPDX,
+			},
+			cfg: cataloging.LicenseConfig{
+				IncludeContent: cataloging.LicenseContentIncludeUnknown,
+			},
+			expectedLicenses: []pkg.License{
+				{
+					SPDXExpression: "MIT",
+					Contents:       "", // content cleared for SPDX license
+				},
+				{
+					Value:    "License-Not-A-SPDX-Expression",
+					Contents: "Non-SPDX license content", // content preserved for non-SPDX
+				},
+			},
+		},
+		{
+			name: "LicenseContentExcludeAll",
+			inputLicenses: []pkg.License{
+				licenseWithSPDX,
+				licenseWithoutSPDX,
+			},
+			cfg: cataloging.LicenseConfig{
+				IncludeContent: cataloging.LicenseContentExcludeAll,
+			},
+			expectedLicenses: []pkg.License{
+				{
+					SPDXExpression: "MIT",
+					Contents:       "", // content cleared
+				},
+				{
+					Value:    "License-Not-A-SPDX-Expression",
+					Contents: "", // content cleared
+				},
+			},
+		},
+		{
+			name: "LicenseContentIncludeAll",
+			inputLicenses: []pkg.License{
+				licenseWithSPDX,
+				licenseWithoutSPDX,
+			},
+			cfg: cataloging.LicenseConfig{
+				IncludeContent: cataloging.LicenseContentIncludeAll,
+			},
+			expectedLicenses: []pkg.License{
+				{
+					SPDXExpression: "MIT",
+					Contents:       "MIT license content", // content preserved
+				},
+				{
+					Value:    "License-Not-A-SPDX-Expression",
+					Contents: "Non-SPDX license content", // content preserved
+				},
+			},
+		},
+		{
+			name: "default license config should be LicenseContentExcludeAll",
+			inputLicenses: []pkg.License{
+				licenseWithSPDX,
+				licenseWithoutSPDX,
+			},
+			cfg: cataloging.DefaultLicenseConfig(),
+			expectedLicenses: []pkg.License{
+				{
+					SPDXExpression: "MIT",
+				},
+				{
+					Value: "License-Not-A-SPDX-Expression",
+				},
+			},
+		},
+		{
+			name: "invalid license content cataloging config results in the default case",
+			inputLicenses: []pkg.License{
+				licenseWithSPDX,
+				licenseWithoutSPDX,
+			},
+			cfg: cataloging.LicenseConfig{
+				IncludeContent: cataloging.LicenseContent("invalid"),
+			},
+			expectedLicenses: []pkg.License{
+				{
+					SPDXExpression: "MIT",
+				},
+				{
+					Value:    "License-Not-A-SPDX-Expression",
+					Contents: "", // content all removed
+				},
+			},
+		},
+		{
+			name:          "Empty licenses",
+			inputLicenses: []pkg.License{},
+			cfg: cataloging.LicenseConfig{
+				IncludeContent: cataloging.LicenseContentIncludeAll,
+			},
+			expectedLicenses: []pkg.License{},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			inputPkg := &pkg.Package{
+				Licenses: pkg.NewLicenseSet(tt.inputLicenses...),
+			}
+
+			inputPkg.SetID()
+			originalID := inputPkg.ID()
+
+			applyLicenseContentRules(inputPkg, tt.cfg)
+
+			assert.Equal(t, originalID, inputPkg.ID(), "package ID changed unexpectedly")
+
+			actualLicenses := inputPkg.Licenses.ToSlice()
+			expectedLicenses := pkg.NewLicenseSet(tt.expectedLicenses...).ToSlice()
+
+			assert.Equal(t, expectedLicenses, actualLicenses, "license contents do not match expected values")
+
+		})
+	}
+}
+
 func TestApplyComplianceRules_DropAndStub(t *testing.T) {
 	p := pkg.Package{Name: "", Version: ""}
 	p.SetID()

internal/task/package_tasks.go

@@ -17,6 +17,7 @@ import (
 	"github.com/anchore/syft/syft/pkg/cataloger/githubactions"
 	"github.com/anchore/syft/syft/pkg/cataloger/golang"
 	"github.com/anchore/syft/syft/pkg/cataloger/haskell"
+	"github.com/anchore/syft/syft/pkg/cataloger/homebrew"
 	"github.com/anchore/syft/syft/pkg/cataloger/java"
 	"github.com/anchore/syft/syft/pkg/cataloger/javascript"
 	"github.com/anchore/syft/syft/pkg/cataloger/kernel"
@@ -76,6 +77,7 @@ func DefaultPackageTaskFactories() Factories {
 		// language-specific package declared catalogers ///////////////////////////////////////////////////////////////////////////
 		newSimplePackageTaskFactory(cpp.NewConanCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "cpp", "conan"),
 		newSimplePackageTaskFactory(dart.NewPubspecLockCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "dart"),
+		newSimplePackageTaskFactory(dart.NewPubspecCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "dart"),
 		newSimplePackageTaskFactory(elixir.NewMixLockCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "elixir"),
 		newSimplePackageTaskFactory(erlang.NewRebarLockCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "erlang"),
 		newSimplePackageTaskFactory(erlang.NewOTPCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "erlang", "otp"),
@@ -100,7 +102,7 @@ func DefaultPackageTaskFactories() Factories {
 			pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, JavaScript, Node, NPM,
 		),
 		newSimplePackageTaskFactory(php.NewComposerLockCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "php", "composer"),
-		newSimplePackageTaskFactory(php.NewPeclCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, pkgcataloging.ImageTag, "php", "pecl"),
+		newSimplePackageTaskFactory(php.NewPearCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, pkgcataloging.ImageTag, "php", "pear"),
 		newPackageTaskFactory(
 			func(cfg CatalogingFactoryConfig) pkg.Cataloger {
 				return python.NewPackageCataloger(cfg.PackagesConfig.Python)
@@ -137,7 +139,12 @@ func DefaultPackageTaskFactories() Factories {
 			pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, pkgcataloging.LanguageTag, Java, Maven,
 		),
 		newSimplePackageTaskFactory(java.NewNativeImageCataloger, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, pkgcataloging.LanguageTag, Java),
-		newSimplePackageTaskFactory(nix.NewStoreCataloger, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, pkgcataloging.LanguageTag, "nix"),
+		newPackageTaskFactory(
+			func(cfg CatalogingFactoryConfig) pkg.Cataloger {
+				return nix.NewCataloger(cfg.PackagesConfig.Nix)
+			},
+			pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, pkgcataloging.LanguageTag, "nix",
+		),
 		newSimplePackageTaskFactory(lua.NewPackageCataloger, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, pkgcataloging.LanguageTag, "lua"),
 
 		// other package catalogers ///////////////////////////////////////////////////////////////////////////
@@ -157,14 +164,18 @@ func DefaultPackageTaskFactories() Factories {
 			},
 			pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "linux", "kernel",
 		),
+		newSimplePackageTaskFactory(php.NewInterpreterCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "binary", "php"),
 		newSimplePackageTaskFactory(sbomCataloger.NewCataloger, "sbom"), // note: not evidence of installed packages
 		newSimplePackageTaskFactory(bitnamiSbomCataloger.NewCataloger, "bitnami", pkgcataloging.InstalledTag, pkgcataloging.ImageTag),
 		newSimplePackageTaskFactory(wordpress.NewWordpressPluginCataloger, pkgcataloging.DirectoryTag, pkgcataloging.ImageTag, "wordpress"),
 		newSimplePackageTaskFactory(terraform.NewLockCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, "terraform"),
+		newSimplePackageTaskFactory(homebrew.NewCataloger, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "homebrew"),
 
 		// deprecated catalogers ////////////////////////////////////////
 		// these are catalogers that should not be selectable other than specific inclusion via name or "deprecated" tag (to remain backwards compatible)
 		newSimplePackageTaskFactory(dotnet.NewDotnetDepsCataloger, pkgcataloging.DeprecatedTag),               // TODO: remove in syft v2.0
 		newSimplePackageTaskFactory(dotnet.NewDotnetPortableExecutableCataloger, pkgcataloging.DeprecatedTag), // TODO: remove in syft v2.0
+		newSimplePackageTaskFactory(php.NewPeclCataloger, pkgcataloging.DeprecatedTag),                        // TODO: remove in syft v2.0
+		newSimplePackageTaskFactory(nix.NewStoreCataloger, pkgcataloging.DeprecatedTag),                       // TODO: remove in syft v2.0
 	}
 }

internal/task/relationship_tasks.go

@@ -46,7 +46,7 @@ func finalizeRelationships(resolver file.Resolver, builder sbomsync.Builder, cfg
 
 	// add relationships showing packages that are evident by a file which is owned by another package (package-to-package)
 	if cfg.PackageFileOwnershipOverlap {
-		relationship.ByFileOwnershipOverlapWorker(accessor)
+		relationship.ByFileOwnershipOverlapWorker(resolver, accessor)
 	}
 
 	// conditionally remove binary packages based on file ownership overlap relationships found

internal/task/scope_tasks.go

@@ -0,0 +1,63 @@
+package task
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/anchore/syft/internal/sbomsync"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/sbom"
+)
+
+func NewDeepSquashedScopeCleanupTask() Task {
+	fn := func(_ context.Context, _ file.Resolver, builder sbomsync.Builder) error {
+		accessor := builder.(sbomsync.Accessor)
+
+		// remove all packages that doesn't exist in the final state of the image
+		builder.DeletePackages(packagesToRemove(accessor)...)
+		return nil
+	}
+
+	return NewTask("deep-squashed-cleaner", fn)
+}
+
+func packagesToRemove(accessor sbomsync.Accessor) []artifact.ID {
+	pkgsToDelete := make([]artifact.ID, 0)
+	accessor.ReadFromSBOM(func(s *sbom.SBOM) {
+		filterDuplicates := make(map[string]bool)
+		for p := range s.Artifacts.Packages.Enumerate() {
+			noSquashed := true
+			noPrimary := true
+			for _, l := range p.Locations.ToSlice() {
+				isPrimaryEvidence := l.Annotations[pkg.EvidenceAnnotationKey] == pkg.PrimaryEvidenceAnnotation
+				switch l.Annotations[file.VisibleAnnotationKey] {
+				case file.VisibleAnnotation:
+					if isPrimaryEvidence || p.Type == pkg.BinaryPkg {
+						noSquashed = false
+						break
+					}
+				case "":
+					if isPrimaryEvidence {
+						if exists := filterDuplicates[getKey(p, l)]; exists {
+							break
+						}
+						filterDuplicates[getKey(p, l)] = true
+						noPrimary = false
+						break
+					}
+				}
+			}
+
+			if noSquashed && noPrimary {
+				pkgsToDelete = append(pkgsToDelete, p.ID())
+			}
+		}
+	})
+	return pkgsToDelete
+}
+
+func getKey(pkg pkg.Package, loc file.Location) string {
+	return fmt.Sprintf("%s-%s-%s-%s", pkg.Name, pkg.Version, loc.RealPath, loc.AccessPath)
+}

schema/json/schema-latest.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "anchore.io/schema/syft/json/16.0.25/document",
+  "$id": "anchore.io/schema/syft/json/16.0.33/document",
   "$ref": "#/$defs/Document",
   "$defs": {
     "AlpmDbEntry": {
@@ -408,6 +408,49 @@
         "path"
       ]
     },
+    "DartPubspec": {
+      "properties": {
+        "homepage": {
+          "type": "string"
+        },
+        "repository": {
+          "type": "string"
+        },
+        "documentation": {
+          "type": "string"
+        },
+        "publish_to": {
+          "type": "string"
+        },
+        "environment": {
+          "$ref": "#/$defs/DartPubspecEnvironment"
+        },
+        "platforms": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "ignored_advisories": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "DartPubspecEnvironment": {
+      "properties": {
+        "sdk": {
+          "type": "string"
+        },
+        "flutter": {
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "DartPubspecLockEntry": {
       "properties": {
         "name": {
@@ -1072,6 +1115,20 @@
       },
       "type": "object"
     },
+    "HomebrewFormula": {
+      "properties": {
+        "tap": {
+          "type": "string"
+        },
+        "homepage": {
+          "type": "string"
+        },
+        "description": {
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "IDLikes": {
       "items": {
         "type": "string"
@@ -1656,14 +1713,57 @@
         "kb"
       ]
     },
+    "NixDerivation": {
+      "properties": {
+        "path": {
+          "type": "string"
+        },
+        "system": {
+          "type": "string"
+        },
+        "inputDerivations": {
+          "items": {
+            "$ref": "#/$defs/NixDerivationReference"
+          },
+          "type": "array"
+        },
+        "inputSources": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "NixDerivationReference": {
+      "properties": {
+        "path": {
+          "type": "string"
+        },
+        "outputs": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
     "NixStoreEntry": {
       "properties": {
-        "outputHash": {
+        "path": {
           "type": "string"
         },
         "output": {
           "type": "string"
         },
+        "outputHash": {
+          "type": "string"
+        },
+        "derivation": {
+          "$ref": "#/$defs/NixDerivation"
+        },
         "files": {
           "items": {
             "type": "string"
@@ -1673,8 +1773,7 @@
       },
       "type": "object",
       "required": [
-        "outputHash",
-        "files"
+        "outputHash"
       ]
     },
     "OpamPackage": {
@@ -1791,6 +1890,9 @@
             {
               "$ref": "#/$defs/CocoaPodfileLockEntry"
             },
+            {
+              "$ref": "#/$defs/DartPubspec"
+            },
             {
               "$ref": "#/$defs/DartPubspecLockEntry"
             },
@@ -1833,6 +1935,9 @@
             {
               "$ref": "#/$defs/HaskellHackageStackLockEntry"
             },
+            {
+              "$ref": "#/$defs/HomebrewFormula"
+            },
             {
               "$ref": "#/$defs/JavaArchive"
             },
@@ -1872,6 +1977,9 @@
             {
               "$ref": "#/$defs/PhpComposerLockEntry"
             },
+            {
+              "$ref": "#/$defs/PhpPearEntry"
+            },
             {
               "$ref": "#/$defs/PhpPeclEntry"
             },
@@ -2164,11 +2272,38 @@
         "dist"
       ]
     },
+    "PhpPearEntry": {
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "channel": {
+          "type": "string"
+        },
+        "version": {
+          "type": "string"
+        },
+        "license": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object",
+      "required": [
+        "name",
+        "version"
+      ]
+    },
     "PhpPeclEntry": {
       "properties": {
         "name": {
           "type": "string"
         },
+        "channel": {
+          "type": "string"
+        },
         "version": {
           "type": "string"
         },
@@ -2190,6 +2325,9 @@
         "installedSize": {
           "type": "integer"
         },
+        "licenses": {
+          "type": "string"
+        },
         "files": {
           "items": {
             "$ref": "#/$defs/PortageFileRecord"
@@ -2539,6 +2677,12 @@
         "sourceRpm": {
           "type": "string"
         },
+        "signatures": {
+          "items": {
+            "$ref": "#/$defs/RpmSignature"
+          },
+          "type": "array"
+        },
         "size": {
           "type": "integer"
         },
@@ -2607,6 +2751,12 @@
         "sourceRpm": {
           "type": "string"
         },
+        "signatures": {
+          "items": {
+            "$ref": "#/$defs/RpmSignature"
+          },
+          "type": "array"
+        },
         "size": {
           "type": "integer"
         },
@@ -2683,6 +2833,29 @@
         "flags"
       ]
     },
+    "RpmSignature": {
+      "properties": {
+        "algo": {
+          "type": "string"
+        },
+        "hash": {
+          "type": "string"
+        },
+        "created": {
+          "type": "string"
+        },
+        "issuer": {
+          "type": "string"
+        }
+      },
+      "type": "object",
+      "required": [
+        "algo",
+        "hash",
+        "created",
+        "issuer"
+      ]
+    },
     "RubyGemspec": {
       "properties": {
         "name": {

schema/json/vnd.syft+json

@@ -1,4 +1,4 @@
-(registered 2021-11-05, last updated 2021-11-05)
+(registered 2021-11-05, last updated 2025-13-05)
 
 Media type name: application
 Media subtype name: vnd.syft+json
@@ -60,11 +60,11 @@ General Comments:
 
 Person to contact for further information:
 
-1. Name: Dan Luhring
-2. Email: dan.luhring@anchore.com
+1. Name: Dan Nurmi
+2. Email: opensource@anchore.com
 
 Intended usage: Common
 The Syft SBOM format is an open-source software bill of materials specification. It is intended to be exchanged between different parties of the software supply chain.
 
 
-Author/Change controller: Dan Luhring, on behalf of Anchore
+Author/Change controller: Dan Nurmi, on behalf of Anchore

syft/cataloging/license.go

@@ -1,15 +1,29 @@
 package cataloging
 
-import "github.com/anchore/syft/internal/licenses"
+import (
+	"github.com/anchore/syft/internal/licenses"
+)
+
+// LicenseContent controls when license content should be included in the SBOM.
+type LicenseContent string
+
+const (
+	LicenseContentIncludeAll     LicenseContent = "all"
+	LicenseContentIncludeUnknown LicenseContent = "unknown"
+	LicenseContentExcludeAll     LicenseContent = "none"
+)
 
 type LicenseConfig struct {
-	IncludeUnkownLicenseContent bool    `json:"include-unknown-license-content" yaml:"include-unknown-license-content" mapstructure:"include-unknown-license-content"`
-	Coverage                    float64 `json:"coverage" yaml:"coverage" mapstructure:"coverage"`
+	// IncludeContent controls whether license copy discovered should be included in the SBOM.
+	IncludeContent LicenseContent `json:"include-content" yaml:"include-content" mapstructure:"include-content"`
+
+	// Coverage is the percentage of text that must match a license for it to be considered a match.
+	Coverage float64 `json:"coverage" yaml:"coverage" mapstructure:"coverage"`
 }
 
 func DefaultLicenseConfig() LicenseConfig {
 	return LicenseConfig{
-		IncludeUnkownLicenseContent: licenses.DefaultIncludeLicenseContent,
-		Coverage:                    licenses.DefaultCoverageThreshold,
+		IncludeContent: LicenseContentExcludeAll,
+		Coverage:       licenses.DefaultCoverageThreshold,
 	}
 }

syft/cataloging/pkgcataloging/config.go

@@ -7,6 +7,7 @@ import (
 	"github.com/anchore/syft/syft/pkg/cataloger/java"
 	"github.com/anchore/syft/syft/pkg/cataloger/javascript"
 	"github.com/anchore/syft/syft/pkg/cataloger/kernel"
+	"github.com/anchore/syft/syft/pkg/cataloger/nix"
 	"github.com/anchore/syft/syft/pkg/cataloger/python"
 )
 
@@ -17,6 +18,7 @@ type Config struct {
 	JavaArchive java.ArchiveCatalogerConfig       `yaml:"java-archive" json:"java-archive" mapstructure:"java-archive"`
 	JavaScript  javascript.CatalogerConfig        `yaml:"javascript" json:"javascript" mapstructure:"javascript"`
 	LinuxKernel kernel.LinuxKernelCatalogerConfig `yaml:"linux-kernel" json:"linux-kernel" mapstructure:"linux-kernel"`
+	Nix         nix.Config                        `yaml:"nix" json:"nix" mapstructure:"nix"`
 	Python      python.CatalogerConfig            `yaml:"python" json:"python" mapstructure:"python"`
 }
 
@@ -25,12 +27,18 @@ func DefaultConfig() Config {
 		Binary:      binary.DefaultClassifierCatalogerConfig(),
 		Dotnet:      dotnet.DefaultCatalogerConfig(),
 		Golang:      golang.DefaultCatalogerConfig(),
-		LinuxKernel: kernel.DefaultLinuxKernelCatalogerConfig(),
-		Python:      python.DefaultCatalogerConfig(),
 		JavaArchive: java.DefaultArchiveCatalogerConfig(),
+		LinuxKernel: kernel.DefaultLinuxKernelCatalogerConfig(),
+		Nix:         nix.DefaultConfig(),
+		Python:      python.DefaultCatalogerConfig(),
 	}
 }
 
+func (c Config) WithNixConfig(cfg nix.Config) Config {
+	c.Nix = cfg
+	return c
+}
+
 func (c Config) WithBinaryConfig(cfg binary.ClassifierCatalogerConfig) Config {
 	c.Binary = cfg
 	return c

syft/create_sbom.go

@@ -96,14 +96,20 @@ func setupContext(ctx context.Context, cfg *CreateSBOMConfig) (context.Context,
 	ctx = setContextExecutors(ctx, cfg)
 
 	// configure license scanner
-	return setContextLicenseScanner(ctx, cfg)
+	// skip injecting a license scanner if one already set on context
+	if licenses.IsContextLicenseScannerSet(ctx) {
+		return ctx, nil
+	}
+
+	return SetContextLicenseScanner(ctx, cfg.Licenses)
 }
 
-func setContextLicenseScanner(ctx context.Context, cfg *CreateSBOMConfig) (context.Context, error) {
+// SetContextLicenseScanner creates and sets a license scanner
+// on the provided context using the provided license config.
+func SetContextLicenseScanner(ctx context.Context, cfg cataloging.LicenseConfig) (context.Context, error) {
 	// inject a single license scanner and content config for all package cataloging tasks into context
 	licenseScanner, err := licenses.NewDefaultScanner(
-		licenses.WithIncludeLicenseContent(cfg.Licenses.IncludeUnkownLicenseContent),
-		licenses.WithCoverage(cfg.Licenses.Coverage),
+		licenses.WithCoverage(cfg.Coverage),
 	)
 	if err != nil {
 		return nil, fmt.Errorf("could not build licenseScanner for cataloging: %w", err)

syft/create_sbom_config.go

@@ -188,6 +188,7 @@ func (c *CreateSBOMConfig) makeTaskGroups(src source.Description) ([][]task.Task
 
 	// generate package and file tasks based on the configuration
 	environmentTasks := c.environmentTasks()
+	scopeTasks := c.scopeTasks()
 	relationshipsTasks := c.relationshipTasks(src)
 	unknownTasks := c.unknownsTasks()
 
@@ -204,6 +205,11 @@ func (c *CreateSBOMConfig) makeTaskGroups(src source.Description) ([][]task.Task
 		taskGroups = append(taskGroups, append(pkgTasks, fileTasks...))
 	}
 
+	// all scope work must be done after all nodes (files and packages) have been cataloged and before the relationship
+	if len(scopeTasks) > 0 {
+		taskGroups = append(taskGroups, scopeTasks)
+	}
+
 	// all relationship work must be done after all nodes (files and packages) have been cataloged
 	if len(relationshipsTasks) > 0 {
 		taskGroups = append(taskGroups, relationshipsTasks)
@@ -249,6 +255,7 @@ func (c *CreateSBOMConfig) selectTasks(src source.Description) ([]task.Task, []t
 		RelationshipsConfig:  c.Relationships,
 		DataGenerationConfig: c.DataGeneration,
 		PackagesConfig:       c.Packages,
+		LicenseConfig:        c.Licenses,
 		ComplianceConfig:     c.Compliance,
 		FilesConfig:          c.Files,
 	}
@@ -391,6 +398,17 @@ func (c *CreateSBOMConfig) userPackageTasks(cfg task.CatalogingFactoryConfig) ([
 	return persistentPackageTasks, selectablePackageTasks, nil
 }
 
+// scopeTasks returns the set of tasks that should be run to generate additional scope information
+func (c *CreateSBOMConfig) scopeTasks() []task.Task {
+	var tsks []task.Task
+	if c.Search.Scope == source.DeepSquashedScope {
+		if t := task.NewDeepSquashedScopeCleanupTask(); t != nil {
+			tsks = append(tsks, t)
+		}
+	}
+	return tsks
+}
+
 // relationshipTasks returns the set of tasks that should be run to generate additional relationships as well as
 // prune existing relationships.
 func (c *CreateSBOMConfig) relationshipTasks(src source.Description) []task.Task {

syft/file/coordinate_set.go

@@ -59,7 +59,34 @@ func (s CoordinateSet) Paths() []string {
 	return pathSlice
 }
 
-func (s CoordinateSet) ToSlice() []Coordinates {
+func (s CoordinateSet) ToSlice(sorters ...func(a, b Coordinates) int) []Coordinates {
+	coordinates := s.ToUnorderedSlice()
+
+	var sorted bool
+	for _, sorter := range sorters {
+		if sorter == nil {
+			continue
+		}
+		sort.Slice(coordinates, func(i, j int) bool {
+			return sorter(coordinates[i], coordinates[j]) < 0
+		})
+		sorted = true
+		break
+	}
+
+	if !sorted {
+		sort.SliceStable(coordinates, func(i, j int) bool {
+			if coordinates[i].FileSystemID == coordinates[j].FileSystemID {
+				return coordinates[i].RealPath < coordinates[j].RealPath
+			}
+			return coordinates[i].FileSystemID < coordinates[j].FileSystemID
+		})
+	}
+
+	return coordinates
+}
+
+func (s CoordinateSet) ToUnorderedSlice() []Coordinates {
 	if s.set == nil {
 		return nil
 	}
@@ -69,12 +96,6 @@ func (s CoordinateSet) ToSlice() []Coordinates {
 		coordinates[idx] = v
 		idx++
 	}
-	sort.SliceStable(coordinates, func(i, j int) bool {
-		if coordinates[i].RealPath == coordinates[j].RealPath {
-			return coordinates[i].FileSystemID < coordinates[j].FileSystemID
-		}
-		return coordinates[i].RealPath < coordinates[j].RealPath
-	})
 	return coordinates
 }
 

syft/file/location.go

@@ -9,6 +9,17 @@ import (
 	"github.com/anchore/stereoscope/pkg/image"
 )
 
+const (
+	// VisibleAnnotationKey is the key used to indicate if the location is visible or not at runtime
+	VisibleAnnotationKey = "visible"
+
+	// HiddenAnnotation is the value used to indicate that the location is not visible at runtime because it was deleted
+	HiddenAnnotation = "false"
+
+	// VisibleAnnotation is the value used to indicate that the location is visible at runtime
+	VisibleAnnotation = "true"
+)
+
 // Location represents a path relative to a particular filesystem resolved to a specific file.Reference. This struct is used as a key
 // in content fetching to uniquely identify a file relative to a request (the AccessPath).
 type Location struct {
@@ -48,6 +59,9 @@ func (m *LocationMetadata) merge(other LocationMetadata) error {
 }
 
 func (l Location) WithAnnotation(key, value string) Location {
+	if key == "" || value == "" {
+		return l
+	}
 	if l.Annotations == nil {
 		l.Annotations = map[string]string{}
 	}

syft/file/location_set.go

@@ -1,6 +1,7 @@
 package file
 
 import (
+	"slices"
 	"sort"
 
 	"github.com/gohugoio/hashstructure"
@@ -54,7 +55,28 @@ func (s LocationSet) Contains(l Location) bool {
 	return ok
 }
 
-func (s LocationSet) ToSlice() []Location {
+func (s LocationSet) ToSlice(sorters ...func(a, b Location) int) []Location {
+	locations := s.ToUnorderedSlice()
+
+	var sorted bool
+	for _, sorter := range sorters {
+		if sorter == nil {
+			continue
+		}
+		slices.SortFunc(locations, sorter)
+		sorted = true
+		break
+	}
+
+	if !sorted {
+		// though no sorter was passed, we need to guarantee a stable ordering between calls
+		sort.Sort(Locations(locations))
+	}
+
+	return locations
+}
+
+func (s LocationSet) ToUnorderedSlice() []Location {
 	if s.set == nil {
 		return nil
 	}
@@ -67,7 +89,6 @@ func (s LocationSet) ToSlice() []Location {
 		}
 		idx++
 	}
-	sort.Sort(Locations(locations))
 	return locations
 }
 

syft/file/location_set_test.go

@@ -89,8 +89,8 @@ func TestLocationSet_SortPaths(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			set := NewLocationSet(test.input...)
-			assert.Equal(t, test.expected, set.ToSlice())
+			actual := NewLocationSet(test.input...).ToSlice()
+			assert.Equal(t, test.expected, actual)
 		})
 	}
 }

syft/file/locations.go

@@ -1,6 +1,12 @@
 package file
 
-import "github.com/anchore/syft/internal/evidence"
+import (
+	"strings"
+
+	"github.com/anchore/syft/internal/evidence"
+)
+
+var locationSorterWithoutLayers = LocationSorter(nil)
 
 type Locations []Location
 
@@ -9,27 +15,108 @@ func (l Locations) Len() int {
 }
 
 func (l Locations) Less(i, j int) bool {
-	liEvidence := l[i].Annotations[evidence.AnnotationKey]
-	ljEvidence := l[j].Annotations[evidence.AnnotationKey]
-	if liEvidence == ljEvidence {
-		if l[i].RealPath == l[j].RealPath {
-			if l[i].AccessPath == l[j].AccessPath {
-				return l[i].FileSystemID < l[j].FileSystemID
-			}
-			return l[i].AccessPath < l[j].AccessPath
-		}
-		return l[i].RealPath < l[j].RealPath
-	}
-	if liEvidence == evidence.PrimaryAnnotation {
-		return true
-	}
-	if ljEvidence == evidence.PrimaryAnnotation {
-		return false
-	}
-
-	return liEvidence > ljEvidence
+	return locationSorterWithoutLayers(l[i], l[j]) < 0
 }
 
 func (l Locations) Swap(i, j int) {
 	l[i], l[j] = l[j], l[i]
 }
+
+// LocationSorter creates a comparison function (slices.SortFunc) for Location objects based on layer order
+func LocationSorter(layers []string) func(a, b Location) int { //nolint:gocognit
+	var layerOrderByDigest map[string]int
+	if len(layers) > 0 {
+		layerOrderByDigest = make(map[string]int)
+		for i, digest := range layers {
+			layerOrderByDigest[digest] = i
+		}
+	}
+
+	return func(a, b Location) int {
+		// compare by evidence annotations first...
+		aEvidence := a.Annotations[evidence.AnnotationKey]
+		bEvidence := b.Annotations[evidence.AnnotationKey]
+
+		if aEvidence != bEvidence {
+			if aEvidence == evidence.PrimaryAnnotation {
+				return -1
+			}
+			if bEvidence == evidence.PrimaryAnnotation {
+				return 1
+			}
+
+			if aEvidence > bEvidence {
+				return -1
+			}
+			if bEvidence > aEvidence {
+				return 1
+			}
+		}
+
+		// ...then by layer order
+		if layerOrderByDigest != nil {
+			// we're given layer order details
+			aLayerIdx, aExists := layerOrderByDigest[a.FileSystemID]
+			bLayerIdx, bExists := layerOrderByDigest[b.FileSystemID]
+
+			if aLayerIdx != bLayerIdx {
+				if !aExists && !bExists {
+					return strings.Compare(a.FileSystemID, b.FileSystemID)
+				}
+				if !aExists {
+					return 1
+				}
+				if !bExists {
+					return -1
+				}
+
+				return aLayerIdx - bLayerIdx
+			}
+		} else if a.FileSystemID != b.FileSystemID {
+			// no layer info given, legacy behavior is to sort lexicographically
+			return strings.Compare(a.FileSystemID, b.FileSystemID)
+		}
+
+		// ...then by paths
+		if a.AccessPath != b.AccessPath {
+			return strings.Compare(a.AccessPath, b.AccessPath)
+		}
+
+		return strings.Compare(a.RealPath, b.RealPath)
+	}
+}
+
+// CoordinatesSorter creates a comparison function (slices.SortFunc) for Coordinate objects based on layer order
+func CoordinatesSorter(layers []string) func(a, b Coordinates) int {
+	var layerOrderByDigest map[string]int
+	if len(layers) > 0 {
+		layerOrderByDigest = make(map[string]int)
+		for i, digest := range layers {
+			layerOrderByDigest[digest] = i
+		}
+	}
+
+	return func(a, b Coordinates) int {
+		// ...then by layer order
+		if layerOrderByDigest != nil {
+			aLayerIdx, aExists := layerOrderByDigest[a.FileSystemID]
+			bLayerIdx, bExists := layerOrderByDigest[b.FileSystemID]
+
+			if aLayerIdx != bLayerIdx {
+				if !aExists && !bExists {
+					return strings.Compare(a.FileSystemID, b.FileSystemID)
+				}
+				if !aExists {
+					return 1
+				}
+				if !bExists {
+					return -1
+				}
+
+				return aLayerIdx - bLayerIdx
+			}
+		}
+
+		return strings.Compare(a.RealPath, b.RealPath)
+	}
+}

syft/file/locations_test.go

@@ -0,0 +1,557 @@
+package file
+
+import (
+	"fmt"
+	"slices"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+
+	"github.com/anchore/syft/internal/evidence"
+)
+
+func TestLocationAndCoordinatesSorters(t *testing.T) {
+	tests := []struct {
+		name       string
+		layers     []string
+		locs       []Location
+		coords     []Coordinates
+		wantLocs   []string
+		wantCoords []string
+	}{
+		{
+			name:       "empty location slice",
+			layers:     []string{"fsid-1"},
+			locs:       []Location{},
+			coords:     []Coordinates{},
+			wantLocs:   []string{},
+			wantCoords: []string{},
+		},
+		{
+			name:   "nil layer list",
+			layers: nil,
+			locs: []Location{
+				{
+					LocationData: LocationData{
+						Coordinates: Coordinates{
+							RealPath:     "/a",
+							FileSystemID: "fsid-1",
+						},
+						AccessPath: "/a",
+					},
+					LocationMetadata: LocationMetadata{
+						Annotations: map[string]string{},
+					},
+				},
+				{
+					LocationData: LocationData{
+						Coordinates: Coordinates{
+							RealPath:     "/b",
+							FileSystemID: "fsid-2",
+						},
+						AccessPath: "/b",
+					},
+					LocationMetadata: LocationMetadata{
+						Annotations: map[string]string{},
+					},
+				},
+			},
+			coords: []Coordinates{
+				{
+					RealPath:     "/a",
+					FileSystemID: "fsid-1",
+				},
+				{
+					RealPath:     "/b",
+					FileSystemID: "fsid-2",
+				},
+			},
+			wantLocs: []string{
+				"/a (/a) @ fsid-1 map[]",
+				"/b (/b) @ fsid-2 map[]",
+			},
+			wantCoords: []string{
+				"/a @ fsid-1",
+				"/b @ fsid-2",
+			},
+		},
+		{
+			name:   "sort by evidence type only",
+			layers: []string{"fsid-1"},
+			locs: []Location{
+				{
+					LocationData: LocationData{
+						Coordinates: Coordinates{
+							RealPath:     "/a",
+							FileSystemID: "fsid-1",
+						},
+						AccessPath: "/a",
+					},
+					LocationMetadata: LocationMetadata{
+						Annotations: map[string]string{
+							evidence.AnnotationKey: "",
+						},
+					},
+				},
+				{
+					LocationData: LocationData{
+						Coordinates: Coordinates{
+							RealPath:     "/b",
+							FileSystemID: "fsid-1",
+						},
+						AccessPath: "/b",
+					},
+					LocationMetadata: LocationMetadata{
+						Annotations: map[string]string{
+							evidence.AnnotationKey: evidence.SupportingAnnotation,
+						},
+					},
+				},
+				{
+					LocationData: LocationData{
+						Coordinates: Coordinates{
+							RealPath:     "/c",
+							FileSystemID: "fsid-1",
+						},
+						AccessPath: "/c",
+					},
+					LocationMetadata: LocationMetadata{
+						Annotations: map[string]string{
+							evidence.AnnotationKey: evidence.PrimaryAnnotation,
+						},
+					},
+				},
+			},
+			coords: []Coordinates{
+				{
+					RealPath:     "/a",
+					FileSystemID: "fsid-1",
+				},
+				{
+					RealPath:     "/b",
+					FileSystemID: "fsid-1",
+				},
+				{
+					RealPath:     "/c",
+					FileSystemID: "fsid-1",
+				},
+			},
+			wantLocs: []string{
+				"/c (/c) @ fsid-1 map[evidence:primary]",
+				"/b (/b) @ fsid-1 map[evidence:supporting]",
+				"/a (/a) @ fsid-1 map[evidence:]",
+			},
+			wantCoords: []string{
+				"/a @ fsid-1",
+				"/b @ fsid-1",
+				"/c @ fsid-1",
+			},
+		},
+		{
+			name:   "same evidence type, sort by layer",
+			layers: []string{"fsid-1", "fsid-2", "fsid-3"},
+			locs: []Location{
+				{
+					LocationData: LocationData{
+						Coordinates: Coordinates{
+							RealPath:     "/a",
+							FileSystemID: "fsid-3",
+						},
+						AccessPath: "/a",
+					},
+					LocationMetadata: LocationMetadata{
+						Annotations: map[string]string{
+							evidence.AnnotationKey: evidence.PrimaryAnnotation,
+						},
+					},
+				},
+				{
+					LocationData: LocationData{
+						Coordinates: Coordinates{
+							RealPath:     "/b",
+							FileSystemID: "fsid-1",
+						},
+						AccessPath: "/b",
+					},
+					LocationMetadata: LocationMetadata{
+						Annotations: map[string]string{
+							evidence.AnnotationKey: evidence.PrimaryAnnotation,
+						},
+					},
+				},
+				{
+					LocationData: LocationData{
+						Coordinates: Coordinates{
+							RealPath:     "/c",
+							FileSystemID: "fsid-2",
+						},
+						AccessPath: "/c",
+					},
+					LocationMetadata: LocationMetadata{
+						Annotations: map[string]string{
+							evidence.AnnotationKey: evidence.PrimaryAnnotation,
+						},
+					},
+				},
+			},
+			coords: []Coordinates{
+				{
+					RealPath:     "/a",
+					FileSystemID: "fsid-3",
+				},
+				{
+					RealPath:     "/b",
+					FileSystemID: "fsid-1",
+				},
+				{
+					RealPath:     "/c",
+					FileSystemID: "fsid-2",
+				},
+			},
+			wantLocs: []string{
+				"/b (/b) @ fsid-1 map[evidence:primary]",
+				"/c (/c) @ fsid-2 map[evidence:primary]",
+				"/a (/a) @ fsid-3 map[evidence:primary]",
+			},
+			wantCoords: []string{
+				"/b @ fsid-1",
+				"/c @ fsid-2",
+				"/a @ fsid-3",
+			},
+		},
+		{
+			name:   "same evidence and layer, sort by access path",
+			layers: []string{"fsid-1"},
+			locs: []Location{
+				{
+					LocationData: LocationData{
+						Coordinates: Coordinates{
+							RealPath:     "/x",
+							FileSystemID: "fsid-1",
+						},
+						AccessPath: "/c",
+					},
+					LocationMetadata: LocationMetadata{
+						Annotations: map[string]string{
+							evidence.AnnotationKey: evidence.PrimaryAnnotation,
+						},
+					},
+				},
+				{
+					LocationData: LocationData{
+						Coordinates: Coordinates{
+							RealPath:     "/y",
+							FileSystemID: "fsid-1",
+						},
+						AccessPath: "/a",
+					},
+					LocationMetadata: LocationMetadata{
+						Annotations: map[string]string{
+							evidence.AnnotationKey: evidence.PrimaryAnnotation,
+						},
+					},
+				},
+				{
+					LocationData: LocationData{
+						Coordinates: Coordinates{
+							RealPath:     "/z",
+							FileSystemID: "fsid-1",
+						},
+						AccessPath: "/b",
+					},
+					LocationMetadata: LocationMetadata{
+						Annotations: map[string]string{
+							evidence.AnnotationKey: evidence.PrimaryAnnotation,
+						},
+					},
+				},
+			},
+			coords: []Coordinates{
+				{
+					RealPath:     "/x",
+					FileSystemID: "fsid-1",
+				},
+				{
+					RealPath:     "/y",
+					FileSystemID: "fsid-1",
+				},
+				{
+					RealPath:     "/z",
+					FileSystemID: "fsid-1",
+				},
+			},
+			wantLocs: []string{
+				"/y (/a) @ fsid-1 map[evidence:primary]",
+				"/z (/b) @ fsid-1 map[evidence:primary]",
+				"/x (/c) @ fsid-1 map[evidence:primary]",
+			},
+			wantCoords: []string{
+				"/x @ fsid-1",
+				"/y @ fsid-1",
+				"/z @ fsid-1",
+			},
+		},
+		{
+			name:   "same evidence, layer, and access path - sort by real path",
+			layers: []string{"fsid-1"},
+			locs: []Location{
+				{
+					LocationData: LocationData{
+						Coordinates: Coordinates{
+							RealPath:     "/c",
+							FileSystemID: "fsid-1",
+						},
+						AccessPath: "/same",
+					},
+					LocationMetadata: LocationMetadata{
+						Annotations: map[string]string{
+							evidence.AnnotationKey: evidence.PrimaryAnnotation,
+						},
+					},
+				},
+				{
+					LocationData: LocationData{
+						Coordinates: Coordinates{
+							RealPath:     "/a",
+							FileSystemID: "fsid-1",
+						},
+						AccessPath: "/same",
+					},
+					LocationMetadata: LocationMetadata{
+						Annotations: map[string]string{
+							evidence.AnnotationKey: evidence.PrimaryAnnotation,
+						},
+					},
+				},
+				{
+					LocationData: LocationData{
+						Coordinates: Coordinates{
+							RealPath:     "/b",
+							FileSystemID: "fsid-1",
+						},
+						AccessPath: "/same",
+					},
+					LocationMetadata: LocationMetadata{
+						Annotations: map[string]string{
+							evidence.AnnotationKey: evidence.PrimaryAnnotation,
+						},
+					},
+				},
+			},
+			coords: []Coordinates{
+				{
+					RealPath:     "/c",
+					FileSystemID: "fsid-1",
+				},
+				{
+					RealPath:     "/a",
+					FileSystemID: "fsid-1",
+				},
+				{
+					RealPath:     "/b",
+					FileSystemID: "fsid-1",
+				},
+			},
+			wantLocs: []string{
+				"/a (/same) @ fsid-1 map[evidence:primary]",
+				"/b (/same) @ fsid-1 map[evidence:primary]",
+				"/c (/same) @ fsid-1 map[evidence:primary]",
+			},
+			wantCoords: []string{
+				"/a @ fsid-1",
+				"/b @ fsid-1",
+				"/c @ fsid-1",
+			},
+		},
+		{
+			name:   "unknown layers",
+			layers: []string{"fsid-1", "fsid-2"},
+			locs: []Location{
+				{
+					LocationData: LocationData{
+						Coordinates: Coordinates{
+							RealPath:     "/a",
+							FileSystemID: "unknown-1",
+						},
+						AccessPath: "/a",
+					},
+					LocationMetadata: LocationMetadata{
+						Annotations: map[string]string{},
+					},
+				},
+				{
+					LocationData: LocationData{
+						Coordinates: Coordinates{
+							RealPath:     "/b",
+							FileSystemID: "unknown-2",
+						},
+						AccessPath: "/b",
+					},
+					LocationMetadata: LocationMetadata{
+						Annotations: map[string]string{},
+					},
+				},
+			},
+			coords: []Coordinates{
+				{
+					RealPath:     "/a",
+					FileSystemID: "unknown-1",
+				},
+				{
+					RealPath:     "/b",
+					FileSystemID: "unknown-2",
+				},
+			},
+			wantLocs: []string{
+				"/a (/a) @ unknown-1 map[]",
+				"/b (/b) @ unknown-2 map[]",
+			},
+			wantCoords: []string{
+				"/a @ unknown-1",
+				"/b @ unknown-2",
+			},
+		},
+		{
+			name:   "mixed known and unknown layers",
+			layers: []string{"fsid-1", "fsid-2"},
+			locs: []Location{
+				{
+					LocationData: LocationData{
+						Coordinates: Coordinates{
+							RealPath:     "/a",
+							FileSystemID: "fsid-1",
+						},
+						AccessPath: "/a",
+					},
+					LocationMetadata: LocationMetadata{
+						Annotations: map[string]string{},
+					},
+				},
+				{
+					LocationData: LocationData{
+						Coordinates: Coordinates{
+							RealPath:     "/b",
+							FileSystemID: "unknown",
+						},
+						AccessPath: "/b",
+					},
+					LocationMetadata: LocationMetadata{
+						Annotations: map[string]string{},
+					},
+				},
+			},
+			coords: []Coordinates{
+				{
+					RealPath:     "/a",
+					FileSystemID: "fsid-1",
+				},
+				{
+					RealPath:     "/b",
+					FileSystemID: "unknown",
+				},
+			},
+			wantLocs: []string{
+				"/a (/a) @ fsid-1 map[]",
+				"/b (/b) @ unknown map[]",
+			},
+			wantCoords: []string{
+				"/a @ fsid-1",
+				"/b @ unknown",
+			},
+		},
+		{
+			name:   "evidence comparison when one has none",
+			layers: []string{"fsid-1"},
+			locs: []Location{
+				{
+					LocationData: LocationData{
+						Coordinates: Coordinates{
+							RealPath:     "/a",
+							FileSystemID: "fsid-1",
+						},
+						AccessPath: "/a",
+					},
+					LocationMetadata: LocationMetadata{
+						Annotations: map[string]string{
+							// No evidence.AnnotationKey
+						},
+					},
+				},
+				{
+					LocationData: LocationData{
+						Coordinates: Coordinates{
+							RealPath:     "/b",
+							FileSystemID: "fsid-1",
+						},
+						AccessPath: "/b",
+					},
+					LocationMetadata: LocationMetadata{
+						Annotations: map[string]string{
+							evidence.AnnotationKey: evidence.PrimaryAnnotation,
+						},
+					},
+				},
+			},
+			coords: []Coordinates{
+				{
+					RealPath:     "/a",
+					FileSystemID: "fsid-1",
+				},
+				{
+					RealPath:     "/b",
+					FileSystemID: "fsid-1",
+				},
+			},
+			wantLocs: []string{
+				"/b (/b) @ fsid-1 map[evidence:primary]",
+				"/a (/a) @ fsid-1 map[]",
+			},
+			wantCoords: []string{
+				"/a @ fsid-1",
+				"/b @ fsid-1",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Run("Location", func(t *testing.T) {
+				locs := make([]Location, len(tt.locs))
+				copy(locs, tt.locs)
+
+				slices.SortFunc(locs, LocationSorter(tt.layers))
+
+				got := make([]string, len(locs))
+				for i, loc := range locs {
+					got[i] = fmt.Sprintf("%s (%s) @ %s %s",
+						loc.RealPath,
+						loc.AccessPath,
+						loc.FileSystemID,
+						loc.LocationMetadata.Annotations)
+				}
+
+				if d := cmp.Diff(tt.wantLocs, got); d != "" {
+					t.Errorf("LocationSorter() mismatch (-want +got):\n%s", d)
+				}
+			})
+
+			t.Run("Coordinates", func(t *testing.T) {
+				coords := make([]Coordinates, len(tt.coords))
+				copy(coords, tt.coords)
+
+				slices.SortFunc(coords, CoordinatesSorter(tt.layers))
+
+				got := make([]string, len(coords))
+				for i, coord := range coords {
+					got[i] = fmt.Sprintf("%s @ %s",
+						coord.RealPath,
+						coord.FileSystemID)
+				}
+
+				if d := cmp.Diff(tt.wantCoords, got); d != "" {
+					t.Errorf("CoordinatesSorter() mismatch (-want +got):\n%s", d)
+				}
+			})
+		})
+	}
+}

syft/format/common/cyclonedxhelpers/to_format_model.go

@@ -42,17 +42,18 @@ func ToFormatModel(s sbom.SBOM) *cyclonedx.BOM {
 	cdxBOM.SerialNumber = uuid.New().URN()
 	cdxBOM.Metadata = toBomDescriptor(s.Descriptor.Name, s.Descriptor.Version, s.Source)
 
+	coordinates, locationSorter := getCoordinates(s)
+
 	// Packages
 	packages := s.Artifacts.Packages.Sorted()
 	components := make([]cyclonedx.Component, len(packages))
 	for i, p := range packages {
-		components[i] = helpers.EncodeComponent(p)
+		components[i] = helpers.EncodeComponent(p, locationSorter)
 	}
 	components = append(components, toOSComponent(s.Artifacts.LinuxDistribution)...)
 
-	// Files
 	artifacts := s.Artifacts
-	coordinates := s.AllCoordinates()
+
 	for _, coordinate := range coordinates {
 		var metadata *file.Metadata
 		// File Info
@@ -95,6 +96,21 @@ func ToFormatModel(s sbom.SBOM) *cyclonedx.BOM {
 	return cdxBOM
 }
 
+func getCoordinates(s sbom.SBOM) ([]file.Coordinates, func(a, b file.Location) int) {
+	var layers []string
+	if m, ok := s.Source.Metadata.(source.ImageMetadata); ok {
+		for _, l := range m.Layers {
+			layers = append(layers, l.Digest)
+		}
+	}
+
+	coordSorter := file.CoordinatesSorter(layers)
+	coordinates := s.AllCoordinates()
+
+	slices.SortFunc(coordinates, coordSorter)
+	return coordinates, file.LocationSorter(layers)
+}
+
 func digestsToHashes(digests []file.Digest) []cyclonedx.Hash {
 	var hashes []cyclonedx.Hash
 	for _, digest := range digests {

syft/format/common/spdxhelpers/to_format_model.go

@@ -5,7 +5,6 @@ import (
 	"crypto/sha1"
 	"fmt"
 	"path"
-	"regexp"
 	"slices"
 	"sort"
 	"strings"
@@ -15,13 +14,13 @@ import (
 	"github.com/spdx/tools-golang/spdx"
 
 	"github.com/anchore/packageurl-go"
-	internallicenses "github.com/anchore/syft/internal/licenses"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/mimetype"
 	"github.com/anchore/syft/internal/relationship"
 	"github.com/anchore/syft/internal/spdxlicense"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
+	formatInternal "github.com/anchore/syft/syft/format/internal"
 	"github.com/anchore/syft/syft/format/internal/spdxutil/helpers"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
@@ -49,7 +48,7 @@ func ToFormatModel(s sbom.SBOM) *spdx.Document {
 	name, namespace := helpers.DocumentNameAndNamespace(s.Source, s.Descriptor)
 
 	rels := relationship.NewIndex(s.Relationships...)
-	packages := toPackages(rels, s.Artifacts.Packages, s)
+	packages, otherLicenses := toPackages(rels, s.Artifacts.Packages, s)
 
 	allRelationships := toRelationships(rels.All())
 
@@ -155,7 +154,7 @@ func ToFormatModel(s sbom.SBOM) *spdx.Document {
 		Packages:      packages,
 		Files:         toFiles(s),
 		Relationships: allRelationships,
-		OtherLicenses: toOtherLicenses(s.Artifacts.Packages),
+		OtherLicenses: convertOtherLicense(otherLicenses),
 	}
 }
 
@@ -268,21 +267,34 @@ func toRootPackage(s source.Description) *spdx.Package {
 }
 
 func toSPDXID(identifiable artifact.Identifiable) spdx.ElementID {
+	id := string(identifiable.ID())
+	if strings.HasPrefix(id, "SPDXRef-") {
+		// this is already an SPDX ID, no need to change it (except for the prefix)
+		return spdx.ElementID(helpers.SanitizeElementID(strings.TrimPrefix(id, "SPDXRef-")))
+	}
 	maxLen := 40
-	id := ""
 	switch it := identifiable.(type) {
 	case pkg.Package:
+		if strings.HasPrefix(id, "Package-") {
+			// this is already an SPDX ID, no need to change it
+			return spdx.ElementID(helpers.SanitizeElementID(id))
+		}
 		switch {
 		case it.Type != "" && it.Name != "":
-			id = fmt.Sprintf("Package-%s-%s-%s", it.Type, it.Name, it.ID())
+			id = fmt.Sprintf("Package-%s-%s-%s", it.Type, it.Name, id)
 		case it.Name != "":
-			id = fmt.Sprintf("Package-%s-%s", it.Name, it.ID())
+			id = fmt.Sprintf("Package-%s-%s", it.Name, id)
 		case it.Type != "":
-			id = fmt.Sprintf("Package-%s-%s", it.Type, it.ID())
+			id = fmt.Sprintf("Package-%s-%s", it.Type, id)
 		default:
-			id = fmt.Sprintf("Package-%s", it.ID())
+			id = fmt.Sprintf("Package-%s", id)
 		}
 	case file.Coordinates:
+		if strings.HasPrefix(id, "File-") {
+			// this is already an SPDX ID, no need to change it. Note: there is no way to reach this case today
+			// from within syft, however, this covers future cases where the ID can be overridden
+			return spdx.ElementID(helpers.SanitizeElementID(id))
+		}
 		p := ""
 		parts := strings.Split(it.RealPath, "/")
 		for i := len(parts); i > 0; i-- {
@@ -296,9 +308,7 @@ func toSPDXID(identifiable artifact.Identifiable) spdx.ElementID {
 			}
 			p = path.Join(part, p)
 		}
-		id = fmt.Sprintf("File-%s-%s", p, it.ID())
-	default:
-		id = string(identifiable.ID())
+		id = fmt.Sprintf("File-%s-%s", p, id)
 	}
 	// NOTE: the spdx library prepend SPDXRef-, so we don't do it here
 	return spdx.ElementID(helpers.SanitizeElementID(id))
@@ -307,16 +317,18 @@ func toSPDXID(identifiable artifact.Identifiable) spdx.ElementID {
 // packages populates all Package Information from the package Collection (see https://spdx.github.io/spdx-spec/3-package-information/)
 //
 //nolint:funlen
-func toPackages(rels *relationship.Index, catalog *pkg.Collection, sbom sbom.SBOM) (results []*spdx.Package) {
+func toPackages(rels *relationship.Index, catalog *pkg.Collection, sbom sbom.SBOM) (results []*spdx.Package, otherLicenses []spdx.OtherLicense) {
+	otherLicenseSet := helpers.NewSPDXOtherLicenseSet()
 	for _, p := range catalog.Sorted() {
-		// name should be guaranteed to be unique, but semantically useful and stable
+		// name should be guaranteed to be unique but semantically useful and stable
 		id := toSPDXID(p)
 
 		// If the Concluded License is not the same as the Declared License, a written explanation should be provided
 		// in the Comments on License field (section 7.16). With respect to NOASSERTION, a written explanation in
 		// the Comments on License field (section 7.16) is preferred.
 		// extract these correctly to the spdx license format
-		concluded, declared := helpers.License(p)
+		concluded, declared, ol := helpers.License(p)
+		otherLicenseSet.Add(ol...)
 
 		// two ways to get filesAnalyzed == true:
 		// 1. syft has generated a sha1 digest for the package itself - usually in the java cataloger
@@ -475,7 +487,7 @@ func toPackages(rels *relationship.Index, catalog *pkg.Collection, sbom sbom.SBO
 			PackageAttributionTexts: nil,
 		})
 	}
-	return results
+	return results, otherLicenseSet.ToSlice()
 }
 
 func toPackageChecksums(p pkg.Package) ([]spdx.Checksum, bool) {
@@ -602,14 +614,19 @@ func lookupRelationship(ty artifact.RelationshipType) (bool, helpers.Relationshi
 func toFiles(s sbom.SBOM) (results []*spdx.File) {
 	artifacts := s.Artifacts
 
-	for _, coordinates := range s.AllCoordinates() {
+	_, coordinateSorter := formatInternal.GetLocationSorters(s)
+
+	coordinates := s.AllCoordinates()
+	slices.SortFunc(coordinates, coordinateSorter)
+
+	for _, c := range coordinates {
 		var metadata *file.Metadata
-		if metadataForLocation, exists := artifacts.FileMetadata[coordinates]; exists {
+		if metadataForLocation, exists := artifacts.FileMetadata[c]; exists {
 			metadata = &metadataForLocation
 		}
 
 		var digests []file.Digest
-		if digestsForLocation, exists := artifacts.FileDigests[coordinates]; exists {
+		if digestsForLocation, exists := artifacts.FileDigests[c]; exists {
 			digests = digestsForLocation
 		}
 
@@ -625,18 +642,18 @@ func toFiles(s sbom.SBOM) (results []*spdx.File) {
 		// TODO: add file classifications (?) and content as a snippet
 
 		var comment string
-		if coordinates.FileSystemID != "" {
-			comment = fmt.Sprintf("layerID: %s", coordinates.FileSystemID)
+		if c.FileSystemID != "" {
+			comment = fmt.Sprintf("layerID: %s", c.FileSystemID)
 		}
 
-		relativePath, err := convertAbsoluteToRelative(coordinates.RealPath)
+		relativePath, err := convertAbsoluteToRelative(c.RealPath)
 		if err != nil {
-			log.Debugf("unable to convert relative path '%s' to absolute path: %s", coordinates.RealPath, err)
-			relativePath = coordinates.RealPath
+			log.Debugf("unable to convert relative path '%s' to absolute path: %s", c.RealPath, err)
+			relativePath = c.RealPath
 		}
 
 		results = append(results, &spdx.File{
-			FileSPDXIdentifier: toSPDXID(coordinates),
+			FileSPDXIdentifier: toSPDXID(c),
 			FileComment:        comment,
 			// required, no attempt made to determine license information
 			LicenseConcluded:  noAssertion,
@@ -723,76 +740,14 @@ func toFileTypes(metadata *file.Metadata) (ty []string) {
 	return ty
 }
 
-// other licenses are for licenses from the pkg.Package that do not have a valid SPDX Expression
-// OR are an expression that is a single `License-Ref-*`
-func toOtherLicenses(catalog *pkg.Collection) []*spdx.OtherLicense {
-	licenses := map[string]helpers.SPDXLicense{}
-
-	for p := range catalog.Enumerate() {
-		declaredLicenses, concludedLicenses := helpers.ParseLicenses(p.Licenses.ToSlice())
-		for _, l := range declaredLicenses {
-			if l.Value != "" {
-				licenses[l.ID] = l
-			}
-			if l.ID != "" && isLicenseRef(l.ID) {
-				licenses[l.ID] = l
-			}
-		}
-		for _, l := range concludedLicenses {
-			if l.Value != "" {
-				licenses[l.ID] = l
-			}
-			if l.ID != "" && isLicenseRef(l.ID) {
-				licenses[l.ID] = l
-			}
-		}
-	}
-
-	var result []*spdx.OtherLicense
-
-	var ids []string
-	for licenseID := range licenses {
-		ids = append(ids, licenseID)
-	}
-
-	slices.Sort(ids)
-	for _, id := range ids {
-		license := licenses[id]
-		value := license.Value
-		// handle cases where LicenseRef needs to be included in hasExtractedLicensingInfos
-		if license.Value == "" {
-			value, _ = strings.CutPrefix(license.ID, "LicenseRef-")
-		}
-		other := &spdx.OtherLicense{
-			LicenseIdentifier: license.ID,
-			ExtractedText:     value,
-		}
-		customPrefix := spdxlicense.LicenseRefPrefix + helpers.SanitizeElementID(internallicenses.UnknownLicensePrefix)
-		if strings.HasPrefix(license.ID, customPrefix) {
-			other.LicenseName = strings.TrimPrefix(license.ID, customPrefix)
-			other.LicenseComment = strings.Trim(internallicenses.UnknownLicensePrefix, "-_")
-		}
-		result = append(result, other)
-	}
-	return result
-}
-
-var licenseRefRegEx = regexp.MustCompile(`^LicenseRef-[A-Za-z0-9_-]+$`)
-
-// isSingularLicenseRef checks if the string is a singular LicenseRef-* identifier
-func isLicenseRef(s string) bool {
-	// Match the input string against the regex
-	return licenseRefRegEx.MatchString(s)
-}
-
 // TODO: handle SPDX excludes file case
 // f file is an "excludes" file, skip it /* exclude SPDX analysis file(s) */
 // see: https://spdx.github.io/spdx-spec/v2.3/package-information/#79-package-verification-code-field
 // the above link contains the SPDX algorithm for a package verification code
 func newPackageVerificationCode(rels *relationship.Index, p pkg.Package, sbom sbom.SBOM) *spdx.PackageVerificationCode {
-	// key off of the contains relationship;
-	// spdx validator will fail if a package claims to contain a file but no sha1 provided
-	// if a sha1 for a file is provided then the validator will fail if the package does not have
+	// key off of the spdx contains relationship;
+	// spdx validator will fail if a package claims to contain a file, but no sha1 provided
+	// if a sha1 for a file is provided, then the validator will fail if the package does not have
 	// a package verification code
 	coordinates := rels.Coordinates(p, artifact.ContainsRelationship)
 	var digests []file.Digest
@@ -865,3 +820,15 @@ func convertAbsoluteToRelative(absPath string) (string, error) {
 
 	return relPath, nil
 }
+
+func convertOtherLicense(otherLicenses []spdx.OtherLicense) []*spdx.OtherLicense {
+	if len(otherLicenses) == 0 {
+		return nil
+	}
+
+	result := make([]*spdx.OtherLicense, 0, len(otherLicenses))
+	for i := range otherLicenses {
+		result = append(result, &otherLicenses[i])
+	}
+	return result
+}

syft/format/common/spdxhelpers/to_format_model_test.go

@@ -1,8 +1,10 @@
 package spdxhelpers
 
 import (
+	"context"
 	"fmt"
 	"regexp"
+	"strings"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
@@ -736,7 +738,7 @@ func Test_H1Digest(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			catalog := pkg.NewCollection(test.pkg)
-			pkgs := toPackages(relationship.NewIndex(), catalog, s)
+			pkgs, _ := toPackages(relationship.NewIndex(), catalog, s)
 			require.Len(t, pkgs, 1)
 			for _, p := range pkgs {
 				if test.expectedDigest == "" {
@@ -753,29 +755,31 @@ func Test_H1Digest(t *testing.T) {
 }
 
 func Test_OtherLicenses(t *testing.T) {
+	ctx := context.Background()
 	tests := []struct {
 		name     string
 		pkg      pkg.Package
-		expected []*spdx.OtherLicense
+		expected []spdx.OtherLicense
 	}{
 		{
 			name: "no licenseRef",
 			pkg: pkg.Package{
 				Licenses: pkg.NewLicenseSet(),
 			},
-			expected: nil,
+			expected: []spdx.OtherLicense{},
 		},
 		{
 			name: "single licenseRef",
 			pkg: pkg.Package{
 				Licenses: pkg.NewLicenseSet(
-					pkg.NewLicense("foobar"),
+					pkg.NewLicenseWithContext(ctx, "foobar"),
 				),
 			},
-			expected: []*spdx.OtherLicense{
+			expected: []spdx.OtherLicense{
 				{
 					LicenseIdentifier: "LicenseRef-foobar",
-					ExtractedText:     "foobar",
+					LicenseName:       "foobar",
+					ExtractedText:     "NOASSERTION",
 				},
 			},
 		},
@@ -783,18 +787,20 @@ func Test_OtherLicenses(t *testing.T) {
 			name: "multiple licenseRef",
 			pkg: pkg.Package{
 				Licenses: pkg.NewLicenseSet(
-					pkg.NewLicense("internal made up license name"),
-					pkg.NewLicense("new apple license 2.0"),
+					pkg.NewLicenseWithContext(ctx, "internal made up license name"),
+					pkg.NewLicenseWithContext(ctx, "new apple license 2.0"),
 				),
 			},
-			expected: []*spdx.OtherLicense{
+			expected: []spdx.OtherLicense{
 				{
 					LicenseIdentifier: "LicenseRef-internal-made-up-license-name",
-					ExtractedText:     "internal made up license name",
+					ExtractedText:     "NOASSERTION",
+					LicenseName:       "internal made up license name",
 				},
 				{
 					LicenseIdentifier: "LicenseRef-new-apple-license-2.0",
-					ExtractedText:     "new apple license 2.0",
+					ExtractedText:     "NOASSERTION",
+					LicenseName:       "new apple license 2.0",
 				},
 			},
 		},
@@ -802,31 +808,27 @@ func Test_OtherLicenses(t *testing.T) {
 			name: "LicenseRef as a valid spdx expression",
 			pkg: pkg.Package{
 				Licenses: pkg.NewLicenseSet(
-					pkg.NewLicense("LicenseRef-Fedora-Public-Domain"),
+					pkg.NewLicenseWithContext(ctx, "LicenseRef-Fedora-Public-Domain"),
 				),
 			},
-			expected: []*spdx.OtherLicense{
-				{
-					LicenseIdentifier: "LicenseRef-Fedora-Public-Domain",
-					ExtractedText:     "Fedora-Public-Domain",
-				},
-			},
+			expected: []spdx.OtherLicense{},
 		},
 		{
 			name: "LicenseRef as a valid spdx expression does not otherize compound spdx expressions",
 			pkg: pkg.Package{
 				Licenses: pkg.NewLicenseSet(
-					pkg.NewLicense("(MIT AND LicenseRef-Fedora-Public-Domain)"),
+					pkg.NewLicenseWithContext(ctx, "(MIT AND LicenseRef-Fedora-Public-Domain)"),
 				),
 			},
-			expected: nil,
+			expected: []spdx.OtherLicense{},
 		},
 	}
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			catalog := pkg.NewCollection(test.pkg)
-			otherLicenses := toOtherLicenses(catalog)
+			rels := relationship.NewIndex()
+			_, otherLicenses := toPackages(rels, catalog, sbom.SBOM{})
 			require.Len(t, otherLicenses, len(test.expected))
 			require.Equal(t, test.expected, otherLicenses)
 		})
@@ -861,6 +863,34 @@ func Test_toSPDXID(t *testing.T) {
 			},
 			expected: "Package-npm-some-package",
 		},
+		{
+			name: "package with existing SPDX ID",
+			it: func() pkg.Package {
+				p := pkg.Package{
+					Type: pkg.NpmPkg,
+					Name: "some-package",
+				}
+				// SPDXRef- prefix is removed on decode (when everything is working as it should)
+				p.OverrideID("Package-npm-some-package-extra!")
+				return p
+			}(),
+			// note: we still sanitize out the "!" which is not allowed in SPDX IDs
+			expected: "Package-npm-some-package-extra",
+		},
+		{
+			name: "package with existing SPDX Ref",
+			it: func() pkg.Package {
+				p := pkg.Package{
+					Type: pkg.NpmPkg,
+					Name: "some-package",
+				}
+				// someone incorrectly added SPDXRef- prefix
+				p.OverrideID("SPDXRef-Package-npm-some-package-extra!")
+				return p
+			}(),
+			// note: we still sanitize out the "!" which is not allowed in SPDX IDs
+			expected: "Package-npm-some-package-extra",
+		},
 	}
 
 	for _, test := range tests {
@@ -874,18 +904,19 @@ func Test_toSPDXID(t *testing.T) {
 }
 
 func Test_otherLicenses(t *testing.T) {
+	ctx := context.TODO()
 	pkg1 := pkg.Package{
 		Name:    "first-pkg",
 		Version: "1.1",
 		Licenses: pkg.NewLicenseSet(
-			pkg.NewLicense("MIT"),
+			pkg.NewLicenseWithContext(ctx, "MIT"),
 		),
 	}
 	pkg2 := pkg.Package{
 		Name:    "second-pkg",
 		Version: "2.2",
 		Licenses: pkg.NewLicenseSet(
-			pkg.NewLicense("non spdx license"),
+			pkg.NewLicenseWithContext(ctx, "non spdx license"),
 		),
 	}
 	bigText := `
@@ -895,7 +926,7 @@ func Test_otherLicenses(t *testing.T) {
 		Name:    "third-pkg",
 		Version: "3.3",
 		Licenses: pkg.NewLicenseSet(
-			pkg.NewLicense(bigText),
+			pkg.NewLicenseWithContext(ctx, bigText),
 		),
 	}
 
@@ -910,22 +941,25 @@ func Test_otherLicenses(t *testing.T) {
 			expected: nil,
 		},
 		{
-			name:     "other licenses includes original text",
+			name:     "other licenses must include some original text",
 			packages: []pkg.Package{pkg2},
 			expected: []*spdx.OtherLicense{
 				{
 					LicenseIdentifier: "LicenseRef-non-spdx-license",
-					ExtractedText:     "non spdx license",
+					LicenseName:       "non spdx license",
+					ExtractedText:     "NOASSERTION",
 				},
 			},
 		},
 		{
-			name:     "big licenses get hashed",
+			name:     "big licenses get hashed and space is trimmed",
 			packages: []pkg.Package{pkg3},
 			expected: []*spdx.OtherLicense{
 				{
-					LicenseIdentifier: "LicenseRef-e9a1e42833d3e456f147052f4d312101bd171a0798893169fe596ca6b55c049e",
-					ExtractedText:     bigText,
+					LicenseIdentifier: "LicenseRef-3f17782eef51ae86f18fdd6832f5918e2b40f688b52c9adc07ba6ec1024ef408",
+					// Carries through the syft-json license value when we shasum large texts
+					LicenseName:   "sha256:3f17782eef51ae86f18fdd6832f5918e2b40f688b52c9adc07ba6ec1024ef408",
+					ExtractedText: strings.TrimSpace(bigText),
 				},
 			},
 		},

syft/format/common/spdxhelpers/to_syft_model.go

@@ -1,6 +1,7 @@
 package spdxhelpers
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"net/url"
@@ -18,6 +19,7 @@ import (
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/cpe"
 	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/format/internal"
 	"github.com/anchore/syft/syft/format/internal/spdxutil/helpers"
 	"github.com/anchore/syft/syft/license"
 	"github.com/anchore/syft/syft/linux"
@@ -509,7 +511,14 @@ func toSyftPackage(p *spdx.Package) pkg.Package {
 		Metadata: extractMetadata(p, info),
 	}
 
-	sP.SetID()
+	internal.Backfill(sP)
+
+	if p.PackageSPDXIdentifier != "" {
+		// always prefer the IDs from the SBOM over derived IDs
+		sP.OverrideID(artifact.ID(p.PackageSPDXIdentifier))
+	} else {
+		sP.SetID()
+	}
 
 	return *sP
 }
@@ -527,14 +536,14 @@ func parseSPDXLicenses(p *spdx.Package) []pkg.License {
 
 	// concluded
 	if p.PackageLicenseConcluded != helpers.NOASSERTION && p.PackageLicenseConcluded != helpers.NONE && p.PackageLicenseConcluded != "" {
-		l := pkg.NewLicense(cleanSPDXID(p.PackageLicenseConcluded))
+		l := pkg.NewLicenseWithContext(context.TODO(), cleanSPDXID(p.PackageLicenseConcluded))
 		l.Type = license.Concluded
 		licenses = append(licenses, l)
 	}
 
 	// declared
 	if p.PackageLicenseDeclared != helpers.NOASSERTION && p.PackageLicenseDeclared != helpers.NONE && p.PackageLicenseDeclared != "" {
-		l := pkg.NewLicense(cleanSPDXID(p.PackageLicenseDeclared))
+		l := pkg.NewLicenseWithContext(context.TODO(), cleanSPDXID(p.PackageLicenseDeclared))
 		l.Type = license.Declared
 		licenses = append(licenses, l)
 	}

syft/format/common/spdxhelpers/to_syft_model_test.go

@@ -664,7 +664,7 @@ func Test_directPackageFiles(t *testing.T) {
 		Packages: []*spdx.Package{
 			{
 				PackageName:           "some-package",
-				PackageSPDXIdentifier: "1",
+				PackageSPDXIdentifier: "1", // important!
 				PackageVersion:        "1.0.5",
 				Files: []*spdx.File{
 					{
@@ -689,7 +689,7 @@ func Test_directPackageFiles(t *testing.T) {
 		Name:    "some-package",
 		Version: "1.0.5",
 	}
-	p.SetID()
+	p.OverrideID("1") // the same as the spdxID on the package element
 	f := file.Location{
 		LocationData: file.LocationData{
 			Coordinates: file.Coordinates{
@@ -730,3 +730,32 @@ func Test_directPackageFiles(t *testing.T) {
 
 	require.Equal(t, s, got)
 }
+
+func Test_useSPDXIdentifierOverDerivedSyftArtifactID(t *testing.T) {
+	doc := &spdx.Document{
+		SPDXVersion: "SPDX-2.3",
+		Packages: []*spdx.Package{
+			{
+				PackageName:           "some-package",
+				PackageSPDXIdentifier: "1", // important!
+				PackageVersion:        "1.0.5",
+				Files: []*spdx.File{
+					{
+						FileName:           "some-file",
+						FileSPDXIdentifier: "2",
+						Checksums: []spdx.Checksum{
+							{
+								Algorithm: "SHA1",
+								Value:     "a8d733c64f9123",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	s, err := ToSyftModel(doc)
+
+	assert.Nil(t, err)
+	assert.NotNil(t, s.Artifacts.Packages.Package("1"))
+}

syft/format/cyclonedxjson/decoder.go

@@ -40,6 +40,10 @@ func (d decoder) Decode(r io.Reader) (*sbom.SBOM, sbom.FormatID, string, error)
 		return nil, "", "", fmt.Errorf("unsupported cyclonedx json document version")
 	}
 
+	_, err = reader.Seek(0, io.SeekStart)
+	if err != nil {
+		return nil, id, version, fmt.Errorf("unable to seek to start of CycloneDX JSON SBOM: %+v", err)
+	}
 	doc, err := d.decoder.Decode(reader)
 	if err != nil {
 		return nil, id, version, fmt.Errorf("unable to decode cyclonedx json document: %w", err)

syft/format/cyclonedxjson/decoder_test.go

@@ -2,6 +2,7 @@ package cyclonedxjson
 
 import (
 	"fmt"
+	"io"
 	"os"
 	"path/filepath"
 	"strings"
@@ -43,6 +44,7 @@ func TestDecoder_Decode(t *testing.T) {
 		t.Run(test.file, func(t *testing.T) {
 			reader, err := os.Open(filepath.Join("test-fixtures", test.file))
 			require.NoError(t, err)
+			reset := func() { _, err = reader.Seek(0, io.SeekStart); require.NoError(t, err) }
 
 			dec := NewFormatDecoder()
 
@@ -51,6 +53,7 @@ func TestDecoder_Decode(t *testing.T) {
 				assert.Equal(t, sbom.FormatID(""), formatID)
 				assert.Equal(t, "", formatVersion)
 
+				reset()
 				_, decodeID, decodeVersion, err := dec.Decode(reader)
 				require.Error(t, err)
 				assert.Equal(t, sbom.FormatID(""), decodeID)
@@ -61,6 +64,7 @@ func TestDecoder_Decode(t *testing.T) {
 			assert.Equal(t, ID, formatID)
 			assert.NotEmpty(t, formatVersion)
 
+			reset()
 			bom, decodeID, decodeVersion, err := dec.Decode(reader)
 			require.NotNil(t, bom)
 			require.NoError(t, err)

syft/format/cyclonedxjson/encoder_test.go

@@ -3,6 +3,7 @@ package cyclonedxjson
 import (
 	"bytes"
 	"flag"
+	"regexp"
 	"strings"
 	"testing"
 
@@ -116,6 +117,14 @@ func TestCycloneDxImageEncoder(t *testing.T) {
 func redactor(values ...string) testutil.Redactor {
 	return testutil.NewRedactions().
 		WithValuesRedacted(values...).
+		WithPatternRedactorSpec(
+			testutil.PatternReplacement{
+				// only the source component bom-ref (not package or other component bom-refs)
+				Search:  regexp.MustCompile(`"component": \{[^}]*"bom-ref":\s*"(?P<redact>.+)"[^}]*}`),
+				Groups:  []string{"redact"}, // use the regex to anchore the search, but only replace bytes within the capture group
+				Replace: "redacted",
+			},
+		).
 		WithPatternRedactors(
 			map[string]string{
 				// UUIDs
@@ -126,9 +135,6 @@ func redactor(values ...string) testutil.Redactor {
 
 				// image hashes
 				`sha256:[A-Fa-f0-9]{64}`: `sha256:redacted`,
-
-				// BOM refs
-				`"bom-ref":\s*"[^"]+"`: `"bom-ref":"redacted"`,
 			},
 		)
 }

syft/format/cyclonedxjson/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden

@@ -17,14 +17,14 @@
       ]
     },
     "component": {
-      "bom-ref":"redacted",
+      "bom-ref": "redacted",
       "type": "file",
       "name": "some/path"
     }
   },
   "components": [
     {
-      "bom-ref":"redacted",
+      "bom-ref": "f04d218ff5ff50db",
       "type": "library",
       "name": "package-1",
       "version": "1.0.1",
@@ -61,7 +61,7 @@
       ]
     },
     {
-      "bom-ref":"redacted",
+      "bom-ref": "pkg:deb/debian/package-2@2.0.1?package-id=39392bb5e270f669",
       "type": "library",
       "name": "package-2",
       "version": "2.0.1",
@@ -91,7 +91,7 @@
       ]
     },
     {
-      "bom-ref":"redacted",
+      "bom-ref": "os:debian@1.2.3",
       "type": "operating-system",
       "name": "debian",
       "version": "1.2.3",

syft/format/cyclonedxjson/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden

@@ -17,7 +17,7 @@
       ]
     },
     "component": {
-      "bom-ref":"redacted",
+      "bom-ref": "redacted",
       "type": "container",
       "name": "user-image-input",
       "version": "sha256:redacted"
@@ -25,7 +25,7 @@
   },
   "components": [
     {
-      "bom-ref":"redacted",
+      "bom-ref": "2f52f617f1548337",
       "type": "library",
       "name": "package-1",
       "version": "1.0.1",
@@ -66,7 +66,7 @@
       ]
     },
     {
-      "bom-ref":"redacted",
+      "bom-ref": "pkg:deb/debian/package-2@2.0.1?package-id=4b756c6f6fb127a3",
       "type": "library",
       "name": "package-2",
       "version": "2.0.1",
@@ -100,7 +100,7 @@
       ]
     },
     {
-      "bom-ref":"redacted",
+      "bom-ref": "os:debian@1.2.3",
       "type": "operating-system",
       "name": "debian",
       "version": "1.2.3",

syft/format/cyclonedxxml/decoder.go

@@ -41,6 +41,10 @@ func (d decoder) Decode(r io.Reader) (*sbom.SBOM, sbom.FormatID, string, error)
 		return nil, "", "", fmt.Errorf("unsupported cyclonedx xml document version")
 	}
 
+	_, err = reader.Seek(0, io.SeekStart)
+	if err != nil {
+		return nil, id, version, fmt.Errorf("unable to seek to start of CycloneDX XML SBOM: %w", err)
+	}
 	doc, err := d.decoder.Decode(reader)
 	if err != nil {
 		return nil, id, version, fmt.Errorf("unable to decode cyclonedx xml document: %w", err)

syft/format/cyclonedxxml/decoder_test.go

@@ -2,6 +2,7 @@ package cyclonedxxml
 
 import (
 	"fmt"
+	"io"
 	"os"
 	"path/filepath"
 	"strings"
@@ -44,6 +45,8 @@ func TestDecoder_Decode(t *testing.T) {
 			reader, err := os.Open(filepath.Join("test-fixtures", test.file))
 			require.NoError(t, err)
 
+			reset := func() { _, err = reader.Seek(0, io.SeekStart); require.NoError(t, err) }
+
 			dec := NewFormatDecoder()
 
 			formatID, formatVersion := dec.Identify(reader)
@@ -51,6 +54,7 @@ func TestDecoder_Decode(t *testing.T) {
 				assert.Equal(t, sbom.FormatID(""), formatID)
 				assert.Equal(t, "", formatVersion)
 
+				reset()
 				_, decodeID, decodeVersion, err := dec.Decode(reader)
 				require.Error(t, err)
 				assert.Equal(t, sbom.FormatID(""), decodeID)
@@ -61,6 +65,7 @@ func TestDecoder_Decode(t *testing.T) {
 			assert.Equal(t, ID, formatID)
 			assert.NotEmpty(t, formatVersion)
 
+			reset()
 			bom, decodeID, decodeVersion, err := dec.Decode(reader)
 			require.NotNil(t, bom)
 			require.NoError(t, err)

syft/format/cyclonedxxml/encoder_test.go

@@ -90,16 +90,32 @@ func TestCycloneDxImageEncoder(t *testing.T) {
 func redactor(values ...string) testutil.Redactor {
 	return testutil.NewRedactions().
 		WithValuesRedacted(values...).
+		WithPatternRedactorSpec(
+			testutil.PatternReplacement{
+				// only the source component bom-ref (not package or other component bom-refs)
+				Search:  regexp.MustCompile(`<component bom-ref="(?P<redact>[^"]*)" type="file">`),
+				Groups:  []string{"redact"}, // use the regex to anchor the search, but only replace bytes within the capture group
+				Replace: "redacted",
+			},
+		).
+		WithPatternRedactorSpec(
+			testutil.PatternReplacement{
+				// only the source component bom-ref (not package or other component bom-refs)
+				Search:  regexp.MustCompile(`<component bom-ref="(?P<redact>[^"]*)" type="container">`),
+				Groups:  []string{"redact"}, // use the regex to anchor the search, but only replace bytes within the capture group
+				Replace: "redacted",
+			},
+		).
 		WithPatternRedactors(
 			map[string]string{
 				// dates
 				`([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\.[0-9]+)?(([Zz])|([+|\-]([01][0-9]|2[0-3]):[0-5][0-9]))`: `redacted`,
 
-				// image hashes and BOM refs
+				// image hashes
 				`sha256:[A-Za-z0-9]{64}`: `sha256:redacted`,
 
-				// serial numbers and BOM refs
-				`(serialNumber|bom-ref)="[^"]+"`: `$1="redacted"`,
+				// serial numbers
+				`(serialNumber)="[^"]+"`: `$1="redacted"`,
 			},
 		)
 }

syft/format/cyclonedxxml/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden

@@ -16,7 +16,7 @@
     </component>
   </metadata>
   <components>
-    <component bom-ref="redacted" type="library">
+    <component bom-ref="f04d218ff5ff50db" type="library">
       <name>package-1</name>
       <version>1.0.1</version>
       <licenses>
@@ -34,7 +34,7 @@
         <property name="syft:location:0:path">/some/path/pkg1</property>
       </properties>
     </component>
-    <component bom-ref="redacted" type="library">
+    <component bom-ref="pkg:deb/debian/package-2@2.0.1?package-id=39392bb5e270f669" type="library">
       <name>package-2</name>
       <version>2.0.1</version>
       <cpe>cpe:2.3:*:some:package:2:*:*:*:*:*:*:*</cpe>
@@ -47,7 +47,7 @@
         <property name="syft:metadata:installedSize">0</property>
       </properties>
     </component>
-    <component bom-ref="redacted" type="operating-system">
+    <component bom-ref="os:debian@1.2.3" type="operating-system">
       <name>debian</name>
       <version>1.2.3</version>
       <description>debian</description>

syft/format/cyclonedxxml/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden

@@ -11,13 +11,13 @@
         </component>
       </components>
     </tools>
-    <component bom-ref="redacted" type="container">
+    <component bom-ref="f28a4ba3ddfdddad" type="container">
       <name>user-image-input</name>
       <version>sha256:redacted</version>
     </component>
   </metadata>
   <components>
-    <component bom-ref="redacted" type="library">
+    <component bom-ref="2f52f617f1548337" type="library">
       <name>package-1</name>
       <version>1.0.1</version>
       <licenses>
@@ -36,7 +36,7 @@
         <property name="syft:location:0:path">/somefile-1.txt</property>
       </properties>
     </component>
-    <component bom-ref="redacted" type="library">
+    <component bom-ref="pkg:deb/debian/package-2@2.0.1?package-id=4b756c6f6fb127a3" type="library">
       <name>package-2</name>
       <version>2.0.1</version>
       <cpe>cpe:2.3:*:some:package:2:*:*:*:*:*:*:*</cpe>
@@ -50,7 +50,7 @@
         <property name="syft:metadata:installedSize">0</property>
       </properties>
     </component>
-    <component bom-ref="redacted" type="operating-system">
+    <component bom-ref="os:debian@1.2.3" type="operating-system">
       <name>debian</name>
       <version>1.2.3</version>
       <description>debian</description>

syft/format/decoders.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/anchore/syft/syft/format/cyclonedxjson"
 	"github.com/anchore/syft/syft/format/cyclonedxxml"
+	"github.com/anchore/syft/syft/format/purls"
 	"github.com/anchore/syft/syft/format/spdxjson"
 	"github.com/anchore/syft/syft/format/spdxtagvalue"
 	"github.com/anchore/syft/syft/format/syftjson"
@@ -24,6 +25,7 @@ func Decoders() []sbom.FormatDecoder {
 		cyclonedxjson.NewFormatDecoder(),
 		spdxtagvalue.NewFormatDecoder(),
 		spdxjson.NewFormatDecoder(),
+		purls.NewFormatDecoder(),
 	}
 }
 

syft/format/decoders_collection.go

@@ -34,6 +34,10 @@ func (c *DecoderCollection) Decode(r io.Reader) (*sbom.SBOM, sbom.FormatID, stri
 
 	var bestID sbom.FormatID
 	for _, d := range c.decoders {
+		_, err = reader.Seek(0, io.SeekStart)
+		if err != nil {
+			return nil, "", "", fmt.Errorf("unable to seek to start of SBOM: %w", err)
+		}
 		id, version := d.Identify(reader)
 		if id == "" || version == "" {
 			if id != "" {
@@ -42,6 +46,10 @@ func (c *DecoderCollection) Decode(r io.Reader) (*sbom.SBOM, sbom.FormatID, stri
 			continue
 		}
 
+		_, err = reader.Seek(0, io.SeekStart)
+		if err != nil {
+			return nil, "", "", fmt.Errorf("unable to seek to start of SBOM: %w", err)
+		}
 		return d.Decode(reader)
 	}
 
@@ -65,6 +73,10 @@ func (c *DecoderCollection) Identify(r io.Reader) (sbom.FormatID, string) {
 	}
 
 	for _, d := range c.decoders {
+		_, err = reader.Seek(0, io.SeekStart)
+		if err != nil {
+			log.Debugf("unable to seek to start of SBOM: %v", err)
+		}
 		id, version := d.Identify(reader)
 		if id != "" && version != "" {
 			return id, version

syft/format/encoders.go

@@ -8,6 +8,7 @@ import (
 	"github.com/anchore/syft/syft/format/cyclonedxjson"
 	"github.com/anchore/syft/syft/format/cyclonedxxml"
 	"github.com/anchore/syft/syft/format/github"
+	"github.com/anchore/syft/syft/format/purls"
 	"github.com/anchore/syft/syft/format/spdxjson"
 	"github.com/anchore/syft/syft/format/spdxtagvalue"
 	"github.com/anchore/syft/syft/format/syftjson"
@@ -62,6 +63,7 @@ func (o EncodersConfig) Encoders() ([]sbom.FormatEncoder, error) {
 	l.addWithErr(syftjson.ID)(o.syftJSONEncoders())
 	l.add(table.ID)(table.NewFormatEncoder())
 	l.add(text.ID)(text.NewFormatEncoder())
+	l.add(purls.ID)(purls.NewFormatEncoder())
 	l.add(github.ID)(github.NewFormatEncoder())
 	l.addWithErr(cyclonedxxml.ID)(o.cyclonedxXMLEncoders())
 	l.addWithErr(cyclonedxjson.ID)(o.cyclonedxJSONEncoders())

syft/format/encoders_test.go

@@ -37,6 +37,7 @@ func expectedDefaultEncoders() *strset.Set {
 	expected.Add("syft-table@")                             // no version
 	expected.Add("syft-text@")                              // no version
 	expected.Add("github-json@")                            // no version
+	expected.Add("purls@")                                  // no version
 	for _, v := range spdxjson.SupportedVersions() {
 		expected.Add("spdx-json@" + v)
 	}
@@ -108,6 +109,7 @@ func TestEncodersConfig_Encoders(t *testing.T) {
 				expected.Add("syft-table@")                             // no version
 				expected.Add("syft-text@")                              // no version
 				expected.Add("github-json@")                            // no version
+				expected.Add("purls@")                                  // no version
 				expected.Add("spdx-json@" + spdxutil.DefaultVersion)
 				expected.Add("spdx-tag-value@" + spdxutil.DefaultVersion)
 				expected.Add("cyclonedx-json@" + cyclonedxutil.DefaultVersion)

syft/format/internal/backfill.go

@@ -0,0 +1,137 @@
+package internal
+
+import (
+	"fmt"
+	"regexp"
+	"slices"
+	"strings"
+
+	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/cpe"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+// Backfill takes all information present in the package and attempts to fill in any missing information
+// from any available sources, such as the Metadata and PURL.
+//
+// Backfill does not call p.SetID(), but this needs to be called later to ensure it's up to date
+func Backfill(p *pkg.Package) {
+	if p.PURL == "" {
+		return
+	}
+
+	purl, err := packageurl.FromString(p.PURL)
+	if err != nil {
+		log.Debugf("unable to parse purl: %s: %w", p.PURL, err)
+		return
+	}
+
+	var cpes []cpe.CPE
+	epoch := ""
+
+	for _, qualifier := range purl.Qualifiers {
+		switch qualifier.Key {
+		case pkg.PURLQualifierCPES:
+			rawCpes := strings.Split(qualifier.Value, ",")
+			for _, rawCpe := range rawCpes {
+				c, err := cpe.New(rawCpe, cpe.DeclaredSource)
+				if err != nil {
+					log.Debugf("unable to decode cpe %s in purl %s: %w", rawCpe, p.PURL, err)
+					continue
+				}
+				cpes = append(cpes, c)
+			}
+		case pkg.PURLQualifierEpoch:
+			epoch = qualifier.Value
+		}
+	}
+
+	if p.Type == "" {
+		p.Type = pkg.TypeFromPURL(p.PURL)
+	}
+	if p.Language == "" {
+		p.Language = pkg.LanguageFromPURL(p.PURL)
+	}
+	if p.Name == "" {
+		p.Name = nameFromPurl(purl)
+	}
+
+	setVersionFromPurl(p, purl, epoch)
+
+	if p.Language == pkg.Java {
+		setJavaMetadataFromPurl(p, purl)
+	}
+
+	for _, c := range cpes {
+		if slices.Contains(p.CPEs, c) {
+			continue
+		}
+		p.CPEs = append(p.CPEs, c)
+	}
+}
+
+func setJavaMetadataFromPurl(p *pkg.Package, purl packageurl.PackageURL) {
+	if p.Type != pkg.JavaPkg {
+		return
+	}
+	if purl.Namespace != "" {
+		if p.Metadata == nil {
+			p.Metadata = pkg.JavaArchive{}
+		}
+		meta, got := p.Metadata.(pkg.JavaArchive)
+		if got && meta.PomProperties == nil {
+			meta.PomProperties = &pkg.JavaPomProperties{}
+			p.Metadata = meta
+		}
+		if meta.PomProperties != nil {
+			// capture the group id from the purl if it is not already set
+			if meta.PomProperties.ArtifactID == "" {
+				meta.PomProperties.ArtifactID = purl.Name
+			}
+			if meta.PomProperties.GroupID == "" {
+				meta.PomProperties.GroupID = purl.Namespace
+			}
+			if meta.PomProperties.Version == "" {
+				meta.PomProperties.Version = purl.Version
+			}
+		}
+	}
+}
+
+func setVersionFromPurl(p *pkg.Package, purl packageurl.PackageURL, epoch string) {
+	if p.Version == "" {
+		p.Version = purl.Version
+	}
+
+	if epoch != "" && p.Type == pkg.RpmPkg && !epochPrefix.MatchString(p.Version) {
+		p.Version = fmt.Sprintf("%s:%s", epoch, p.Version)
+	}
+}
+
+var epochPrefix = regexp.MustCompile(`^\d+:`)
+
+// nameFromPurl returns the syft package name of the package from the purl. If the purl includes a namespace,
+// the name is prefixed as appropriate based on the PURL type
+func nameFromPurl(purl packageurl.PackageURL) string {
+	if !nameExcludesPurlNamespace(purl.Type) && purl.Namespace != "" {
+		return fmt.Sprintf("%s/%s", purl.Namespace, purl.Name)
+	}
+	return purl.Name
+}
+
+func nameExcludesPurlNamespace(purlType string) bool {
+	switch purlType {
+	case packageurl.TypeAlpine,
+		packageurl.TypeAlpm,
+		packageurl.TypeConan,
+		packageurl.TypeCpan,
+		packageurl.TypeDebian,
+		packageurl.TypeMaven,
+		packageurl.TypeQpkg,
+		packageurl.TypeRPM,
+		packageurl.TypeSWID:
+		return true
+	}
+	return false
+}

syft/format/internal/backfill_test.go

@@ -0,0 +1,177 @@
+package internal
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/syft/cpe"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func Test_Backfill(t *testing.T) {
+	tests := []struct {
+		name     string
+		in       pkg.Package
+		expected pkg.Package
+	}{
+		{
+			name: "npm type",
+			in: pkg.Package{
+				PURL: "pkg:npm/test@3.0.0",
+			},
+			expected: pkg.Package{
+				PURL:     "pkg:npm/test@3.0.0",
+				Type:     pkg.NpmPkg,
+				Language: pkg.JavaScript,
+				Name:     "test",
+				Version:  "3.0.0",
+			},
+		},
+		{
+			name: "rpm no epoch",
+			in: pkg.Package{
+				PURL: "pkg:rpm/redhat/dbus-common@1.12.8-26.el8?arch=noarch&distro=rhel-8.10&upstream=dbus-1.12.8-26.el8.src.rpm",
+			},
+			expected: pkg.Package{
+				PURL:    "pkg:rpm/redhat/dbus-common@1.12.8-26.el8?arch=noarch&distro=rhel-8.10&upstream=dbus-1.12.8-26.el8.src.rpm",
+				Type:    pkg.RpmPkg,
+				Name:    "dbus-common",
+				Version: "1.12.8-26.el8",
+			},
+		},
+		{
+			name: "rpm epoch",
+			in: pkg.Package{
+				PURL: "pkg:rpm/redhat/dbus-common@1.12.8-26.el8?arch=noarch&distro=rhel-8.10&epoch=1&upstream=dbus-1.12.8-26.el8.src.rpm",
+			},
+			expected: pkg.Package{
+				PURL:    "pkg:rpm/redhat/dbus-common@1.12.8-26.el8?arch=noarch&distro=rhel-8.10&epoch=1&upstream=dbus-1.12.8-26.el8.src.rpm",
+				Type:    pkg.RpmPkg,
+				Name:    "dbus-common",
+				Version: "1:1.12.8-26.el8",
+			},
+		},
+		{
+			name: "bad cpe",
+			in: pkg.Package{
+				PURL: "pkg:npm/testp@3.0.0?cpes=cpe:2.3a:testv:testp:3.0.0:*:*:*:*:*:*:*",
+			},
+			expected: pkg.Package{
+				PURL:     "pkg:npm/testp@3.0.0?cpes=cpe:2.3a:testv:testp:3.0.0:*:*:*:*:*:*:*",
+				Type:     pkg.NpmPkg,
+				Language: pkg.JavaScript,
+				Name:     "testp",
+				Version:  "3.0.0",
+			},
+		},
+		{
+			name: "good cpe",
+			in: pkg.Package{
+				PURL: "pkg:npm/testp@3.0.0?cpes=cpe:2.3:a:testv:testp:3.0.0:*:*:*:*:*:*:*",
+			},
+			expected: pkg.Package{
+				PURL:     "pkg:npm/testp@3.0.0?cpes=cpe:2.3:a:testv:testp:3.0.0:*:*:*:*:*:*:*",
+				Type:     pkg.NpmPkg,
+				Language: pkg.JavaScript,
+				Name:     "testp",
+				Version:  "3.0.0",
+				CPEs: []cpe.CPE{
+					{
+						Attributes: cpe.Attributes{
+							Part:    "a",
+							Vendor:  "testv",
+							Product: "testp",
+							Version: "3.0.0",
+						},
+						Source: cpe.DeclaredSource,
+					},
+				},
+			},
+		},
+		{
+			name: "java type",
+			in: pkg.Package{
+				PURL: "pkg:maven/org.apache/some-thing@1.2.3",
+			},
+			expected: pkg.Package{
+				PURL:     "pkg:maven/org.apache/some-thing@1.2.3",
+				Type:     pkg.JavaPkg,
+				Language: pkg.Java,
+				Name:     "some-thing",
+				Version:  "1.2.3",
+				Metadata: pkg.JavaArchive{
+					PomProperties: &pkg.JavaPomProperties{
+						GroupID:    "org.apache",
+						ArtifactID: "some-thing",
+						Version:    "1.2.3",
+					},
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			Backfill(&tt.in)
+			tt.in.OverrideID("")
+			require.Equal(t, tt.expected, tt.in)
+		})
+	}
+}
+
+func Test_nameFromPurl(t *testing.T) {
+	tests := []struct {
+		in       string
+		expected string
+	}{
+		{
+			in:       "pkg:npm/some-name@3.0.0",
+			expected: "some-name",
+		},
+		{
+			in:       "pkg:maven/org.apache/some-name@1.2.3",
+			expected: "some-name",
+		},
+		{
+			in:       "pkg:deb/debian/some-name@3.0.0",
+			expected: "some-name",
+		},
+		{
+			in:       "pkg:rpm/redhat/some-name@3.0.0",
+			expected: "some-name",
+		},
+		{
+			in:       "pkg:gem/some-name@3.0.0",
+			expected: "some-name",
+		},
+		{
+			in:       "pkg:apk/alpine/some-name@3.0.0",
+			expected: "some-name",
+		},
+		{
+			in:       "pkg:docker/some-org/some-name@3.0.0",
+			expected: "some-org/some-name",
+		},
+		{
+			in:       "pkg:npm/some-name@3.0.0",
+			expected: "some-name",
+		},
+		{
+			in:       "pkg:npm/some-org/some-name@3.0.0",
+			expected: "some-org/some-name",
+		},
+		{
+			in:       "pkg:oci/library/mysql@8.1.0",
+			expected: "library/mysql",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.in, func(t *testing.T) {
+			p, err := packageurl.FromString(tt.in)
+			require.NoError(t, err)
+			got := nameFromPurl(p)
+			require.Equal(t, tt.expected, got)
+		})
+	}
+}

syft/format/internal/cyclonedxutil/decoder.go

@@ -1,12 +1,9 @@
 package cyclonedxutil
 
 import (
-	"fmt"
 	"io"
 
 	"github.com/CycloneDX/cyclonedx-go"
-
-	"github.com/anchore/syft/syft/format/internal/stream"
 )
 
 type Decoder struct {
@@ -20,19 +17,10 @@ func NewDecoder(format cyclonedx.BOMFileFormat) Decoder {
 }
 
 func (d Decoder) Decode(r io.Reader) (*cyclonedx.BOM, error) {
-	reader, err := stream.SeekableReader(r)
-	if err != nil {
-		return nil, err
-	}
-
 	doc := &cyclonedx.BOM{
 		Components: &[]cyclonedx.Component{},
 	}
-	if _, err := reader.Seek(0, io.SeekStart); err != nil {
-		return nil, fmt.Errorf("unable to seek to start of CycloneDX SBOM: %w", err)
-	}
-
-	err = cyclonedx.NewBOMDecoder(reader, d.format).Decode(doc)
+	err := cyclonedx.NewBOMDecoder(r, d.format).Decode(doc)
 	if err != nil {
 		return nil, err
 	}

syft/format/internal/cyclonedxutil/helpers/component.go

@@ -1,17 +1,19 @@
 package helpers
 
 import (
+	"fmt"
 	"reflect"
 
 	"github.com/CycloneDX/cyclonedx-go"
 
 	"github.com/anchore/packageurl-go"
 	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/format/internal"
 	"github.com/anchore/syft/syft/internal/packagemetadata"
 	"github.com/anchore/syft/syft/pkg"
 )
 
-func EncodeComponent(p pkg.Package) cyclonedx.Component {
+func EncodeComponent(p pkg.Package, locationSorter func(a, b file.Location) int) cyclonedx.Component {
 	props := EncodeProperties(p, "syft:package")
 
 	if p.Metadata != nil {
@@ -23,7 +25,7 @@ func EncodeComponent(p pkg.Package) cyclonedx.Component {
 	}
 
 	props = append(props, encodeCPEs(p)...)
-	locations := p.Locations.ToSlice()
+	locations := p.Locations.ToSlice(locationSorter)
 	if len(locations) > 0 {
 		props = append(props, EncodeProperties(locations, "syft:location")...)
 	}
@@ -84,7 +86,6 @@ func decodeComponent(c *cyclonedx.Component) *pkg.Package {
 	}
 
 	p := &pkg.Package{
-		Name:      c.Name,
 		Version:   c.Version,
 		Locations: decodeLocations(values),
 		Licenses:  pkg.NewLicenseSet(decodeLicenses(c)...),
@@ -102,13 +103,50 @@ func decodeComponent(c *cyclonedx.Component) *pkg.Package {
 		p.Type = pkg.TypeFromPURL(p.PURL)
 	}
 
-	if p.Language == "" {
-		p.Language = pkg.LanguageFromPURL(p.PURL)
-	}
+	setPackageName(p, c)
+
+	internal.Backfill(p)
+	p.SetID()
 
 	return p
 }
 
+func setPackageName(p *pkg.Package, c *cyclonedx.Component) {
+	name := c.Name
+	if c.Group != "" {
+		switch p.Type {
+		case pkg.JavaPkg:
+			if p.Metadata == nil {
+				p.Metadata = pkg.JavaArchive{}
+			}
+			var pomProperties *pkg.JavaPomProperties
+			javaMetadata, ok := p.Metadata.(pkg.JavaArchive)
+			if ok {
+				pomProperties = javaMetadata.PomProperties
+				if pomProperties == nil {
+					pomProperties = &pkg.JavaPomProperties{}
+					javaMetadata.PomProperties = pomProperties
+					p.Metadata = javaMetadata
+				}
+			}
+			if pomProperties != nil {
+				if pomProperties.ArtifactID == "" {
+					pomProperties.ArtifactID = c.Name
+				}
+				if pomProperties.GroupID == "" {
+					pomProperties.GroupID = c.Group
+				}
+				if pomProperties.Version == "" {
+					pomProperties.Version = p.Version
+				}
+			}
+		default:
+			name = fmt.Sprintf("%s/%s", c.Group, name)
+		}
+	}
+	p.Name = name
+}
+
 func decodeLocations(vals map[string]string) file.LocationSet {
 	v := Decode(reflect.TypeOf([]file.Location{}), vals, "syft:location", CycloneDXFields)
 	out, ok := v.([]file.Location)

syft/format/internal/cyclonedxutil/helpers/component_test.go

@@ -152,7 +152,7 @@ func Test_encodeComponentProperties(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			c := EncodeComponent(test.input)
+			c := EncodeComponent(test.input, file.LocationSorter(nil))
 			if test.expected == nil {
 				if c.Properties != nil {
 					t.Fatalf("expected no properties, got: %+v", *c.Properties)
@@ -212,7 +212,7 @@ func Test_encodeCompomentType(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			tt.pkg.ID()
-			p := EncodeComponent(tt.pkg)
+			p := EncodeComponent(tt.pkg, file.LocationSorter(nil))
 			assert.Equal(t, tt.want, p)
 		})
 	}

syft/format/internal/cyclonedxutil/helpers/decoder.go

@@ -5,7 +5,6 @@ import (
 
 	"github.com/CycloneDX/cyclonedx-go"
 
-	"github.com/anchore/packageurl-go"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/pkg"
@@ -66,12 +65,16 @@ func collectPackages(component *cyclonedx.Component, s *sbom.SBOM, idMap map[str
 	case cyclonedx.ComponentTypeApplication, cyclonedx.ComponentTypeFramework, cyclonedx.ComponentTypeLibrary:
 		p := decodeComponent(component)
 		idMap[component.BOMRef] = p
-		syftID := extractSyftPacakgeID(component.BOMRef)
+		if component.BOMRef != "" {
+			// always prefer the IDs from the SBOM over derived IDs
+			p.OverrideID(artifact.ID(component.BOMRef))
+		} else {
+			p.SetID()
+		}
+		syftID := p.ID()
 		if syftID != "" {
-			idMap[syftID] = p
+			idMap[string(syftID)] = p
 		}
-		// TODO there must be a better way than needing to call this manually:
-		p.SetID()
 		s.Artifacts.Packages.Add(*p)
 	}
 
@@ -82,19 +85,6 @@ func collectPackages(component *cyclonedx.Component, s *sbom.SBOM, idMap map[str
 	}
 }
 
-func extractSyftPacakgeID(i string) string {
-	instance, err := packageurl.FromString(i)
-	if err != nil {
-		return ""
-	}
-	for _, q := range instance.Qualifiers {
-		if q.Key == "package-id" {
-			return q.Value
-		}
-	}
-	return ""
-}
-
 func linuxReleaseFromComponents(components []cyclonedx.Component) *linux.Release {
 	for i := range components {
 		component := &components[i]

syft/format/internal/cyclonedxutil/helpers/decoder_test.go

@@ -421,3 +421,39 @@ func Test_decodeDependencies(t *testing.T) {
 		})
 	}
 }
+
+func Test_useBomRefOverDerivedSyftArtifactID(t *testing.T) {
+
+	packageWithId := cyclonedx.Component{
+		BOMRef:     "pkg:maven/org.springframework.boot/spring-boot-starter-test?package-id=646a5a71a4abeee0",
+		Type:       cyclonedx.ComponentTypeLibrary,
+		Name:       "spring-boot-starter-test",
+		Version:    "",
+		PackageURL: "pkg:maven/org.springframework.boot/spring-boot-starter-test",
+	}
+
+	packageWithoutId := cyclonedx.Component{
+		BOMRef:     "pkg:maven/org.springframework.boot/spring-boot-starter-webflux",
+		Type:       cyclonedx.ComponentTypeLibrary,
+		Name:       "spring-boot-starter-webflux",
+		Version:    "",
+		PackageURL: "pkg:maven/org.springframework.boot/spring-boot-starter-webflux",
+	}
+
+	bom := cyclonedx.BOM{Metadata: nil,
+		Components: &[]cyclonedx.Component{
+			packageWithId,
+			packageWithoutId,
+		}}
+
+	s, err := ToSyftModel(&bom)
+
+	assert.Nil(t, err)
+	assert.NotNil(t, s.Artifacts.Packages.Package("pkg:maven/org.springframework.boot/spring-boot-starter-test?package-id=646a5a71a4abeee0"))
+
+	pkgsWithoutID := s.Artifacts.Packages.PackagesByName(packageWithoutId.Name)
+
+	assert.Len(t, pkgsWithoutID, 1)
+	assert.NotEqual(t, "", pkgsWithoutID[0].ID())
+
+}