persist artifact ID as supplemental package data

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

.binny.yaml

@@ -26,7 +26,7 @@ tools:
   # used for linting
   - name: golangci-lint
     version:
-      want: v2.4.0
+      want: v2.1.6
     method: github-release
     with:
       repo: golangci/golangci-lint
@@ -34,7 +34,7 @@ tools:
   # used for showing the changelog at release
   - name: glow
     version:
-      want: v2.1.1
+      want: v2.1.0
     method: github-release
     with:
       repo: charmbracelet/glow
@@ -42,7 +42,7 @@ tools:
   # used for signing the checksums file at release
   - name: cosign
     version:
-      want: v2.5.3
+      want: v2.5.0
     method: github-release
     with:
       repo: sigstore/cosign
@@ -58,7 +58,7 @@ tools:
   # used to release all artifacts
   - name: goreleaser
     version:
-      want: v2.11.2
+      want: v2.9.0
     method: github-release
     with:
       repo: goreleaser/goreleaser
@@ -87,10 +87,23 @@ tools:
     with:
       repo: wagoodman/go-bouncer
 
+  # used for showing benchmark testing
+  - name: benchstat
+    version:
+      want: latest
+      method: go-proxy
+      with:
+        module: golang.org/x/perf
+        allow-unresolved-version: true
+    method: go-install
+    with:
+      entrypoint: cmd/benchstat
+      module: golang.org/x/perf
+
   # used for running all local and CI tasks
   - name: task
     version:
-      want: v3.44.1
+      want: v3.43.3
     method: github-release
     with:
       repo: go-task/task
@@ -98,7 +111,7 @@ tools:
   # used for triggering a release
   - name: gh
     version:
-      want: v2.78.0
+      want: v2.72.0
     method: github-release
     with:
       repo: cli/cli
@@ -114,7 +127,7 @@ tools:
   # used to upload test fixture cache
   - name: yq
     version:
-      want: v4.47.1
+      want: v4.45.2
     method: github-release
     with:
       repo: mikefarah/yq

.github/actions/bootstrap/action.yaml

@@ -29,7 +29,7 @@ runs:
   using: "composite"
   steps:
     # note: go mod and build is automatically cached on default with v4+
-    - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+    - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
       if: inputs.go-version != ''
       with:
         go-version: ${{ inputs.go-version }}
@@ -37,7 +37,7 @@ runs:
     - name: Restore tool cache
       if: inputs.tools == 'true'
       id: tool-cache
-      uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
       with:
         path: ${{ github.workspace }}/.tool
         key: ${{ inputs.cache-key-prefix }}-${{ runner.os }}-tool-${{ hashFiles('.binny.yaml') }}
@@ -55,15 +55,12 @@ runs:
     - name: Install apt packages
       if: inputs.bootstrap-apt-packages != ''
       shell: bash
-      env:
-        APT_PACKAGES: ${{ inputs.bootstrap-apt-packages }}
       run: |
-        IFS=' ' read -ra packages <<< "$APT_PACKAGES"
-        DEBIAN_FRONTEND=noninteractive sudo apt update && sudo -E apt install -y "${packages[@]}"
+        DEBIAN_FRONTEND=noninteractive sudo apt update && sudo -E apt install -y ${{ inputs.bootstrap-apt-packages }}
 
     - name: Restore ORAS cache from github actions
       if: inputs.download-test-fixture-cache == 'true'
-      uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
       with:
         path: ${{ github.workspace }}/.tmp/oras-cache
         key: ${{ inputs.cache-key-prefix }}-oras-cache

.github/scripts/update-version-file.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -ue
+
+BIN="syft"
+VERSION_FILE="VERSION"
+VERSION=$1
+
+# the source of truth as to whether we want to notify users of an update is if the release just created is NOT
+# flagged as a pre-release on github
+if [[ "$(curl -SsL https://api.github.com/repos/anchore/${BIN}/releases/tags/${VERSION} | jq .prerelease)" == "true" ]] ; then
+   echo "skipping publishing a version file (this is a pre-release: ${VERSION})"
+   exit 0
+fi
+
+echo "creating and publishing version file (${VERSION})"
+
+# create a version file for version-update checks
+echo "${VERSION}" | tee "${VERSION_FILE}"
+
+# upload the version file that supports the application version update check
+export AWS_DEFAULT_REGION=us-west-2
+aws s3 cp "${VERSION_FILE}" s3://toolbox-data.anchore.io/${BIN}/releases/latest/VERSION

.github/workflows/benchmark-testing.yaml

@@ -0,0 +1,62 @@
+name: "Benchmark testing"
+
+on:
+  workflow_dispatch:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+
+  Benchmark-Test:
+    name: "Benchmark tests"
+    runs-on: ubuntu-24.04
+    # note: we want benchmarks to run on pull_request events in order to publish results to a sticky comment, and
+    # we also want to run on push such that merges to main are recorded to the cache. For this reason we don't filter
+    # the job by event.
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Bootstrap environment
+        uses: ./.github/actions/bootstrap
+
+      - name: Restore base benchmark result
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 #v4.2.3
+        with:
+          path: test/results/benchmark-main.txt
+          # use base sha for PR or new commit hash for main push in benchmark result key
+          key: ${{ runner.os }}-bench-${{ (github.event.pull_request.base.sha != github.event.after) && github.event.pull_request.base.sha || github.event.after }}
+
+      - name: Run benchmark tests
+        id: benchmark
+        run: |
+          REF_NAME=${GITHUB_REF##*/} make benchmark
+          OUTPUT=$(make show-benchstat)
+          OUTPUT="${OUTPUT//'%'/'%25'}"   # URL encode all '%' characters
+          OUTPUT="${OUTPUT//$'\n'/'%0A'}" # URL encode all '\n' characters
+          OUTPUT="${OUTPUT//$'\r'/'%0D'}" # URL encode all '\r' characters
+          echo "result=$OUTPUT" >> $GITHUB_OUTPUT
+
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: benchmark-test-results
+          path: test/results/**/*
+
+      - name: Update PR benchmark results comment
+        uses: marocchino/sticky-pull-request-comment@67d0dec7b07ed060a405f9b2a64b8ab319fdd7db #v2.9.2
+        continue-on-error: true
+        with:
+          header: benchmark
+          message: |
+            ### Benchmark Test Results
+
+            <details>
+              <summary>Benchmark results from the latest changes vs base branch</summary>
+
+            ```
+            ${{ steps.benchmark.outputs.result }}
+            ```
+
+            </details>

.github/workflows/codeql-analysis.yml

@@ -36,18 +36,16 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
-      with:
-        persist-credentials: false
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
 
     - name: Install Go
-      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 #v5.5.0
+      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b #v5.4.0
       with:
         go-version-file: go.mod
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@3c3833e0f8c1c83d449a7478aa59c036a9165498 #v3.29.5
+      uses: github/codeql-action/init@60168efe1c415ce0f5521ea06d5c2062adbeed1b #v3.28.17
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -58,7 +56,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@3c3833e0f8c1c83d449a7478aa59c036a9165498 #v3.29.5
+      uses: github/codeql-action/autobuild@60168efe1c415ce0f5521ea06d5c2062adbeed1b #v3.28.17
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -72,4 +70,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@3c3833e0f8c1c83d449a7478aa59c036a9165498 #v3.29.5
+      uses: github/codeql-action/analyze@60168efe1c415ce0f5521ea06d5c2062adbeed1b #v3.28.17

.github/workflows/detect-schema-changes.yaml

@@ -28,15 +28,9 @@ jobs:
   label:
     name: "Label changes"
     runs-on: ubuntu-22.04
-    permissions:
-      contents: read
-      pull-requests: write
-      issues: write
     steps:
 
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
 
       - run: python .github/scripts/labeler.py
         env:
@@ -46,7 +40,7 @@ jobs:
 
       - name: Delete existing comment
         if: ${{ hashFiles( env.CI_COMMENT_FILE ) == '' }}
-        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 #v2.9.4
+        uses: marocchino/sticky-pull-request-comment@67d0dec7b07ed060a405f9b2a64b8ab319fdd7db #v2.9.2
         with:
           header: ${{ env.COMMENT_HEADER }}
           hide: true
@@ -54,7 +48,7 @@ jobs:
 
       - name: Add comment
         if: ${{ hashFiles( env.CI_COMMENT_FILE ) != '' }}
-        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 #v2.9.4
+        uses: marocchino/sticky-pull-request-comment@67d0dec7b07ed060a405f9b2a64b8ab319fdd7db #v2.9.2
         with:
           header: ${{ env.COMMENT_HEADER }}
           path: ${{ env.CI_COMMENT_FILE }}

.github/workflows/release-version-file.yaml

@@ -0,0 +1,31 @@
+name: "Release: version file"
+
+on:
+
+  workflow_dispatch:
+    inputs:
+      version:
+        description: release version to update the version file with (prefixed with v)
+        required: true
+
+  workflow_call:
+    inputs:
+      version:
+        type: string
+        description: release version to update the version file with (prefixed with v)
+        required: true
+
+jobs:
+
+  release:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
+
+      - name: Update version file
+        run: make ci-release-version-file
+        env:
+          RELEASE_VERSION: ${{ github.event.inputs.version }}
+          # for updating the VERSION file in S3...
+          AWS_ACCESS_KEY_ID: ${{ secrets.TOOLBOX_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLBOX_AWS_SECRET_ACCESS_KEY }}

.github/workflows/release.yaml

@@ -15,9 +15,7 @@ jobs:
     environment: release
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
 
       - name: Check if running on main
         if: github.ref != 'refs/heads/main'
@@ -30,10 +28,8 @@ jobs:
       - name: Check if tag already exists
         # note: this will fail if the tag already exists
         run: |
-          [[ "$VERSION" == v* ]] || (echo "version '$VERSION' does not have a 'v' prefix" && exit 1)
-          git tag "$VERSION"
-        env:
-          VERSION: ${{ github.event.inputs.version }}
+          [[ "${{ github.event.inputs.version }}" == v* ]] || (echo "version '${{ github.event.inputs.version }}' does not have a 'v' prefix" && exit 1)
+          git tag ${{ github.event.inputs.version }}
 
       - name: Check static analysis results
         uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be # v1.2.0
@@ -91,20 +87,13 @@ jobs:
 
       - name: Quality gate
         if: steps.static-analysis.outputs.conclusion != 'success' || steps.unit.outputs.conclusion != 'success' || steps.integration.outputs.conclusion != 'success' || steps.cli-linux.outputs.conclusion != 'success' || steps.acceptance-linux.outputs.conclusion != 'success' || steps.acceptance-mac.outputs.conclusion != 'success'
-        env:
-          STATIC_ANALYSIS_STATUS: ${{ steps.static-analysis.conclusion }}
-          UNIT_TEST_STATUS: ${{ steps.unit.outputs.conclusion }}
-          INTEGRATION_TEST_STATUS: ${{ steps.integration.outputs.conclusion }}
-          ACCEPTANCE_LINUX_STATUS: ${{ steps.acceptance-linux.outputs.conclusion }}
-          ACCEPTANCE_MAC_STATUS: ${{ steps.acceptance-mac.outputs.conclusion }}
-          CLI_LINUX_STATUS: ${{ steps.cli-linux.outputs.conclusion }}
         run: |
-          echo "Static Analysis Status: $STATIC_ANALYSIS_STATUS"
-          echo "Unit Test Status: $UNIT_TEST_STATUS"
-          echo "Integration Test Status: $INTEGRATION_TEST_STATUS"
-          echo "Acceptance Test (Linux) Status: $ACCEPTANCE_LINUX_STATUS"
-          echo "Acceptance Test (Mac) Status: $ACCEPTANCE_MAC_STATUS"
-          echo "CLI Test (Linux) Status: $CLI_LINUX_STATUS"
+          echo "Static Analysis Status: ${{ steps.static-analysis.conclusion }}"
+          echo "Unit Test Status: ${{ steps.unit.outputs.conclusion }}"
+          echo "Integration Test Status: ${{ steps.integration.outputs.conclusion }}"
+          echo "Acceptance Test (Linux) Status: ${{ steps.acceptance-linux.outputs.conclusion }}"
+          echo "Acceptance Test (Mac) Status: ${{ steps.acceptance-mac.outputs.conclusion }}"
+          echo "CLI Test (Linux) Status: ${{ steps.cli-linux.outputs.conclusion }}"
           false
 
   release:
@@ -116,22 +105,21 @@ jobs:
       # required for goreleaser signs section with cosign
       id-token: write
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
         with:
           fetch-depth: 0
-          persist-credentials: true
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
 
       - name: Login to Docker Hub
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1  #v3.5.0
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772  #v3.4.0
         with:
           username: ${{ secrets.ANCHOREOSSWRITE_DH_USERNAME }}
           password: ${{ secrets.ANCHOREOSSWRITE_DH_PAT }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1  #v3.5.0
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772  #v3.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -141,11 +129,10 @@ jobs:
         run: |
           git config --global user.name "anchoreci"
           git config --global user.email "anchoreci@users.noreply.github.com"
-          git tag -a "$VERSION" -m "Release $VERSION"
+          git tag -a ${{ github.event.inputs.version }} -m "Release ${{ github.event.inputs.version }}"
           git push origin --tags
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          VERSION: ${{ github.event.inputs.version }}
 
       - name: Build & publish release artifacts
         run: make ci-release
@@ -161,7 +148,7 @@ jobs:
           # for updating brew formula in anchore/homebrew-syft
           GITHUB_BREW_TOKEN: ${{ secrets.ANCHOREOPS_GITHUB_OSS_WRITE_TOKEN }}
 
-      - uses: anchore/sbom-action@da167eac915b4e86f08b264dbdbc867b61be6f0c #v0.20.5
+      - uses: anchore/sbom-action@9f7302141466aa6482940f15371237e9d9f4c34a #v0.19.0
         continue-on-error: true
         with:
           file: go.mod
@@ -177,17 +164,9 @@ jobs:
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }}
         if: ${{ success() }}
 
-  release-install-script:
+  release-version-file:
     needs: [release]
-    if: ${{ needs.release.result == 'success' }}
-    uses: "anchore/workflows/.github/workflows/release-install-script.yaml@main"
+    uses: ./.github/workflows/release-version-file.yaml
     with:
-      tag: ${{ github.event.inputs.version }}
-    secrets:
-      # needed for r2...
-      R2_INSTALL_ACCESS_KEY_ID: ${{ secrets.OSS_R2_INSTALL_ACCESS_KEY_ID }}
-      R2_INSTALL_SECRET_ACCESS_KEY: ${{ secrets.OSS_R2_INSTALL_SECRET_ACCESS_KEY }}
-      R2_ENDPOINT: ${{ secrets.TOOLBOX_CLOUDFLARE_R2_ENDPOINT }}
-      # needed for s3...
-      S3_INSTALL_AWS_ACCESS_KEY_ID: ${{ secrets.TOOLBOX_AWS_ACCESS_KEY_ID }}
-      S3_INSTALL_AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLBOX_AWS_SECRET_ACCESS_KEY }}
+      version: ${{ github.event.inputs.version }}
+    secrets: inherit

.github/workflows/remove-awaiting-response-label.yaml

@@ -6,10 +6,6 @@ on:
 
 jobs:
   run:
-    permissions:
-      contents: read
-      issues: write
-      pull-requests: write
     uses: "anchore/workflows/.github/workflows/remove-awaiting-response-label.yaml@main"
     secrets:
       token: ${{ secrets.OSS_PROJECT_GH_TOKEN }}

.github/workflows/test-fixture-cache-publish.yaml

@@ -19,9 +19,7 @@ jobs:
     permissions:
       packages: write
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -36,9 +34,7 @@ jobs:
           DOWNLOAD_TEST_FIXTURE_CACHE: "false"
 
       - name: Login to GitHub Container Registry (ORAS)
-        run: echo "${{ secrets.GITHUB_TOKEN }}" | .tool/oras login ghcr.io -u "$ACTOR" --password-stdin
-        env:
-          ACTOR: ${{ github.actor }}
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | .tool/oras login ghcr.io -u ${{ github.actor }} --password-stdin
 
       - name: Publish test fixture cache
         run: make upload-test-fixture-cache

.github/workflows/update-anchore-dependencies.yml

@@ -15,9 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'anchore' # only run for main repo (not forks)
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap

.github/workflows/update-bootstrap-tools.yml

@@ -13,9 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'anchore/syft' # only run for main repo
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap

.github/workflows/update-cpe-dictionary-index.yml

@@ -16,9 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'anchore/syft' # only run for main repo
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap

.github/workflows/validate-github-actions.yaml

@@ -1,35 +0,0 @@
-name: "Validate GitHub Actions"
-
-on:
-  pull_request:
-    paths:
-      - '.github/workflows/**'
-      - '.github/actions/**'
-  push:
-    branches:
-      - main
-    paths:
-      - '.github/workflows/**'
-      - '.github/actions/**'
-
-permissions:
-  contents: read
-
-jobs:
-  zizmor:
-    name: "Lint"
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      security-events: write  # for uploading SARIF results
-    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          persist-credentials: false
-
-      - name: "Run zizmor"
-        uses: zizmorcore/zizmor-action@5ca5fc7a4779c5263a3ffa0e1f693009994446d1 # v0.1.2
-        with:
-          config-file: .github/zizmor.yml
-          sarif-upload: true
-          inputs: .github

.github/workflows/validations.yaml

@@ -17,9 +17,7 @@ jobs:
     name: "Static analysis"
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -34,9 +32,7 @@ jobs:
     # we need more storage than what's on the default runner
     runs-on: ubuntu-22.04-4core-16gb
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -52,9 +48,7 @@ jobs:
     name: "Integration tests"
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -72,9 +66,7 @@ jobs:
     name: "Build snapshot artifacts"
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -84,13 +76,10 @@ jobs:
       - name: Build snapshot artifacts
         run: make snapshot
 
-      - name: Smoke test snapshot build
-        run: make snapshot-smoke-test
-
       # why not use actions/upload-artifact? It is very slow (3 minutes to upload ~600MB of data, vs 10 seconds with this approach).
       # see https://github.com/actions/upload-artifact/issues/199 for more info
       - name: Upload snapshot artifacts
-        uses: actions/cache/save@0400d5f644dc74513175e3cd8d07132dd4860809 #v4.2.4
+        uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 #v4.2.3
         with:
           # we need to preserve the snapshot data itself as well as the task data that confirms if the
           # snapshot build is stale or not. Otherwise the downstream jobs will attempt to rebuild the snapshot
@@ -107,9 +96,7 @@ jobs:
     needs: [Build-Snapshot-Artifacts]
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -118,7 +105,7 @@ jobs:
 
       - name: Download snapshot build
         id: snapshot-cache
-        uses: actions/cache/restore@0400d5f644dc74513175e3cd8d07132dd4860809 #v4.2.4
+        uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 #v4.2.3
         with:
           path: |
             snapshot
@@ -164,9 +151,7 @@ jobs:
     needs: [Build-Snapshot-Artifacts]
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -175,7 +160,7 @@ jobs:
 
       - name: Download snapshot build
         id: snapshot-cache
-        uses: actions/cache/restore@0400d5f644dc74513175e3cd8d07132dd4860809 #v4.2.4
+        uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 #v4.2.3
         with:
           path: |
             snapshot
@@ -210,11 +195,9 @@ jobs:
     runs-on: macos-latest
     steps:
       - name: Install Cosign
-        uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
+        uses: sigstore/cosign-installer@v3.8.2
 
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -225,7 +208,7 @@ jobs:
 
       - name: Download snapshot build
         id: snapshot-cache
-        uses: actions/cache/restore@0400d5f644dc74513175e3cd8d07132dd4860809 #v4.2.4
+        uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 #v4.2.3
         with:
           path: |
             snapshot
@@ -251,9 +234,7 @@ jobs:
     needs: [Build-Snapshot-Artifacts]
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -262,7 +243,7 @@ jobs:
 
       - name: Download snapshot build
         id: snapshot-cache
-        uses: actions/cache/restore@0400d5f644dc74513175e3cd8d07132dd4860809 #v4.2.4
+        uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 #v4.2.3
         with:
           path: |
             snapshot
@@ -291,9 +272,7 @@ jobs:
       - Cli-Linux
       - Upload-Snapshot-Artifacts
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
 
       - name: Delete snapshot cache
         run: gh cache delete "snapshot-build-${{ github.run_id }}"

.github/zizmor.yml

@@ -1,11 +0,0 @@
-rules:
-  unpinned-uses:
-    ignore:
-      # Allow unpinned uses of trusted internal anchore/workflows actions
-      - update-anchore-dependencies.yml
-
-  dangerous-triggers:
-    ignore:
-      # Safe use of pull_request_target - only runs trusted scripts from base repo,
-      # never checks out PR code, needs secrets for labeling PRs from forks
-      - detect-schema-changes.yaml

.goreleaser.yaml

@@ -1,11 +1,11 @@
 version: 2
-project_name: syft
 
 release:
   prerelease: auto
   draft: false
 
 env:
+  # required to support multi architecture docker builds
   - DOCKER_CLI_EXPERIMENTAL=enabled
   - CGO_ENABLED=0
 
@@ -13,8 +13,14 @@ builds:
   - id: linux-build
     dir: ./cmd/syft
     binary: syft
-    goos: [linux]
-    goarch: [amd64, arm64, ppc64le, s390x]
+    goos:
+      - linux
+    goarch:
+      - amd64
+      - arm64
+      - ppc64le
+      - s390x
+    # set the modified timestamp on the output binary to the git timestamp to ensure a reproducible build
     mod_timestamp: &build-timestamp '{{ .CommitTimestamp }}'
     ldflags: &build-ldflags |
       -w
@@ -28,8 +34,11 @@ builds:
   - id: darwin-build
     dir: ./cmd/syft
     binary: syft
-    goos: [darwin]
-    goarch: [amd64, arm64]
+    goos:
+      - darwin
+    goarch:
+      - amd64
+      - arm64
     mod_timestamp: *build-timestamp
     ldflags: *build-ldflags
     hooks:
@@ -41,43 +50,115 @@ builds:
   - id: windows-build
     dir: ./cmd/syft
     binary: syft
-    goos: [windows]
-    goarch: [amd64]
+    goos:
+      - windows
+    goarch:
+      - amd64
     mod_timestamp: *build-timestamp
     ldflags: *build-ldflags
 
 archives:
   - id: linux-archives
-    ids: [linux-build]
+    builds:
+      - linux-build
+
+  # note: the signing process is depending on tar.gz archives. If this format changes then .github/scripts/apple-signing/*.sh will need to be adjusted
   - id: darwin-archives
-    ids: [darwin-build]
+    builds:
+      - darwin-build
+
   - id: windows-archives
-    formats:
-      - zip
-    ids: [windows-build]
+    format: zip
+    builds:
+      - windows-build
 
 nfpms:
   - license: "Apache 2.0"
     maintainer: "Anchore, Inc"
     homepage: &website "https://github.com/anchore/syft"
     description: &description "A tool that generates a Software Bill Of Materials (SBOM) from container images and filesystems"
-    formats: [rpm, deb]
+    formats:
+      - rpm
+      - deb
 
 brews:
   - repository:
       owner: anchore
       name: homebrew-syft
       token: "{{.Env.GITHUB_BREW_TOKEN}}"
-    ids: [darwin-archives, linux-archives]
+    ids:
+      - darwin-archives
+      - linux-archives
     homepage: *website
     description: *description
     license: "Apache License 2.0"
 
 dockers:
-  # production images...
   - image_templates:
-      - anchore/syft:{{.Tag}}-amd64
-      - ghcr.io/anchore/syft:{{.Tag}}-amd64
+      - anchore/syft:debug
+      - anchore/syft:{{.Tag}}-debug
+      - ghcr.io/anchore/syft:debug
+      - ghcr.io/anchore/syft:{{.Tag}}-debug
+    goarch: amd64
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/amd64"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:debug-arm64v8
+      - anchore/syft:{{.Tag}}-debug-arm64v8
+      - ghcr.io/anchore/syft:debug-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
+    goarch: arm64
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/arm64/v8"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:debug-ppc64le
+      - anchore/syft:{{.Tag}}-debug-ppc64le
+      - ghcr.io/anchore/syft:debug-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
+    goarch: ppc64le
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/ppc64le"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:debug-s390x
+      - anchore/syft:{{.Tag}}-debug-s390x
+      - ghcr.io/anchore/syft:debug-s390x
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
+    goarch: s390x
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/s390x"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:latest
+      - anchore/syft:{{.Tag}}
+      - ghcr.io/anchore/syft:latest
+      - ghcr.io/anchore/syft:{{.Tag}}
     goarch: amd64
     dockerfile: Dockerfile
     use: buildx
@@ -127,201 +208,51 @@ dockers:
       - "--build-arg=VCS_REF={{.FullCommit}}"
       - "--build-arg=VCS_URL={{.GitURL}}"
 
-  # nonroot images...
-  - image_templates:
-      - anchore/syft:{{.Tag}}-nonroot-amd64
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-amd64
-    goarch: amd64
-    dockerfile: Dockerfile.nonroot
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/amd64"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-nonroot-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-arm64v8
-    goarch: arm64
-    dockerfile: Dockerfile.nonroot
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/arm64/v8"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-nonroot-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-ppc64le
-    goarch: ppc64le
-    dockerfile: Dockerfile.nonroot
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/ppc64le"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-nonroot-s390x
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-s390x
-    goarch: s390x
-    dockerfile: Dockerfile.nonroot
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/s390x"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  # debug images...
-  - image_templates:
-      - anchore/syft:{{.Tag}}-debug-amd64
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-amd64
-    goarch: amd64
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/amd64"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-debug-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
-    goarch: arm64
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/arm64/v8"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-debug-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
-    goarch: ppc64le
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/ppc64le"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-debug-s390x
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
-    goarch: s390x
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/s390x"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
 docker_manifests:
   - name_template: anchore/syft:latest
     image_templates:
-      - anchore/syft:{{.Tag}}-amd64
+      - anchore/syft:{{.Tag}}
+      - anchore/syft:{{.Tag}}-arm64v8
+      - anchore/syft:{{.Tag}}-ppc64le
+      - anchore/syft:{{.Tag}}-s390x
+
+  - name_template: anchore/syft:debug
+      - anchore/syft:{{.Tag}}-debug
+      - anchore/syft:{{.Tag}}-debug-arm64v8
+      - anchore/syft:{{.Tag}}-debug-ppc64le
+      - anchore/syft:{{.Tag}}-debug-s390x
+
+  - name_template: anchore/syft:{{.Tag}}
+    image_templates:
+      - anchore/syft:{{.Tag}}
       - anchore/syft:{{.Tag}}-arm64v8
       - anchore/syft:{{.Tag}}-ppc64le
       - anchore/syft:{{.Tag}}-s390x
 
   - name_template: ghcr.io/anchore/syft:latest
     image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}-amd64
+      - ghcr.io/anchore/syft:{{.Tag}}
       - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
       - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
       - ghcr.io/anchore/syft:{{.Tag}}-s390x
 
-  - name_template: anchore/syft:{{.Tag}}
-    image_templates:
-      - anchore/syft:{{.Tag}}-amd64
-      - anchore/syft:{{.Tag}}-arm64v8
-      - anchore/syft:{{.Tag}}-ppc64le
-      - anchore/syft:{{.Tag}}-s390x
-
-  - name_template: ghcr.io/anchore/syft:{{.Tag}}
-    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}-amd64
-      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-s390x
-
-  # nonroot images...
-  - name_template: anchore/syft:nonroot
-    image_templates:
-      - anchore/syft:{{.Tag}}-nonroot-amd64
-      - anchore/syft:{{.Tag}}-nonroot-arm64v8
-      - anchore/syft:{{.Tag}}-nonroot-ppc64le
-      - anchore/syft:{{.Tag}}-nonroot-s390x
-
-  - name_template: ghcr.io/anchore/syft:nonroot
-    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-amd64
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-s390x
-
-  - name_template: anchore/syft:{{.Tag}}-nonroot
-    image_templates:
-      - anchore/syft:{{.Tag}}-nonroot-amd64
-      - anchore/syft:{{.Tag}}-nonroot-arm64v8
-      - anchore/syft:{{.Tag}}-nonroot-ppc64le
-      - anchore/syft:{{.Tag}}-nonroot-s390x
-
-  - name_template: ghcr.io/anchore/syft:{{.Tag}}-nonroot
-    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-amd64
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-s390x
-
-  # debug images...
-  - name_template: anchore/syft:debug
-    image_templates:
-      - anchore/syft:{{.Tag}}-debug-amd64
-      - anchore/syft:{{.Tag}}-debug-arm64v8
-      - anchore/syft:{{.Tag}}-debug-ppc64le
-      - anchore/syft:{{.Tag}}-debug-s390x
-
   - name_template: ghcr.io/anchore/syft:debug
     image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-amd64
+      - ghcr.io/anchore/syft:{{.Tag}}-debug
       - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
       - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
       - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
 
-  - name_template: anchore/syft:{{.Tag}}-debug
+  - name_template: ghcr.io/anchore/syft:{{.Tag}}
     image_templates:
-      - anchore/syft:{{.Tag}}-debug-amd64
-      - anchore/syft:{{.Tag}}-debug-arm64v8
-      - anchore/syft:{{.Tag}}-debug-ppc64le
-      - anchore/syft:{{.Tag}}-debug-s390x
-
-  - name_template: ghcr.io/anchore/syft:{{.Tag}}-debug
-    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-amd64
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
+      - ghcr.io/anchore/syft:{{.Tag}}
+      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-s390x
 
 sboms:
   - artifacts: archive
+    # this is relative to the snapshot/dist directory, not the root of the repo
     cmd: ../.tool/syft
     documents:
       - "{{ .Binary }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}.sbom"

Dockerfile

@@ -1,4 +1,4 @@
-FROM gcr.io/distroless/static-debian12:latest AS build
+FROM gcr.io/distroless/static-debian11:debug@sha256:a0a404776dec98be120089ae42bbdfbe48c177921d856937d124d48eb8c0b951 AS build
 
 FROM scratch
 # needed for version check HTTPS request

Dockerfile.debug

@@ -1,12 +1,10 @@
-FROM gcr.io/distroless/static-debian12:debug-nonroot
+FROM gcr.io/distroless/static-debian11:debug@sha256:a0a404776dec98be120089ae42bbdfbe48c177921d856937d124d48eb8c0b951
 
 # create the /tmp dir, which is needed for image content cache
 WORKDIR /tmp
 
 COPY syft /
 
-USER nonroot
-
 ARG BUILD_DATE
 ARG BUILD_VERSION
 ARG VCS_REF

Dockerfile.nonroot

@@ -1,27 +0,0 @@
-FROM gcr.io/distroless/static-debian12:nonroot
-
-# create the /tmp dir, which is needed for image content cache
-WORKDIR /tmp
-
-COPY syft /
-
-USER nonroot
-
-ARG BUILD_DATE
-ARG BUILD_VERSION
-ARG VCS_REF
-ARG VCS_URL
-
-LABEL org.opencontainers.image.created=$BUILD_DATE
-LABEL org.opencontainers.image.title="syft"
-LABEL org.opencontainers.image.description="CLI tool and library for generating a Software Bill of Materials from container images and filesystems"
-LABEL org.opencontainers.image.source=$VCS_URL
-LABEL org.opencontainers.image.revision=$VCS_REF
-LABEL org.opencontainers.image.vendor="Anchore, Inc."
-LABEL org.opencontainers.image.version=$BUILD_VERSION
-LABEL org.opencontainers.image.licenses="Apache-2.0"
-LABEL io.artifacthub.package.readme-url="https://raw.githubusercontent.com/anchore/syft/main/README.md"
-LABEL io.artifacthub.package.logo-url="https://user-images.githubusercontent.com/5199289/136844524-1527b09f-c5cb-4aa9-be54-5aa92a6086c1.png"
-LABEL io.artifacthub.package.license="Apache-2.0"
-
-ENTRYPOINT ["/syft"]

Makefile

@@ -12,7 +12,7 @@ TASK = $(TOOL_DIR)/task
 # note: we need to assume that binny and task have not already been installed
 $(BINNY):
 	@mkdir -p $(TOOL_DIR)
-	@curl -sSfL https://get.anchore.io/binny | sh -s -- -b $(TOOL_DIR)
+	@curl -sSfL https://raw.githubusercontent.com/$(OWNER)/binny/main/install.sh | sh -s -- -b $(TOOL_DIR)
 
 # note: we need to assume that binny and task have not already been installed
 .PHONY: task

README.md

@@ -37,8 +37,8 @@ Syft development is sponsored by [Anchore](https://anchore.com/), and is release
 Syft binaries are provided for Linux, macOS and Windows.
 
 ### Recommended
-> ```bash
-> curl -sSfL https://get.anchore.io/syft | sudo sh -s -- -b /usr/local/bin
+> ```bash 
+> curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
 > ```
 
 Install script options:
@@ -141,7 +141,7 @@ Note that flags using the @<version> can be used for earlier versions of each sp
 - Linux kernel modules (ko)
 - Nix (outputs in /nix/store)
 - PHP (composer, PECL, Pear)
-- Python (wheel, egg, poetry, requirements.txt, uv)
+- Python (wheel, egg, poetry, requirements.txt)
 - Red Hat (rpm)
 - Ruby (gem)
 - Rust (cargo.lock, auditable binary)
@@ -157,7 +157,7 @@ Our [wiki](https://github.com/anchore/syft/wiki) contains further details on the
 * [File Selection](https://github.com/anchore/syft/wiki/file-selection)
 * [Excluding file paths](https://github.com/anchore/syft/wiki/excluding-file-paths)
 * [Output formats](https://github.com/anchore/syft/wiki/output-formats)
-* [Package Cataloger Selection](https://github.com/anchore/syft/wiki/package-cataloger-selection)
+* [Package Cataloger Selection](https://github.com/anchore/syft/wiki/package-cataloger-selection) 
   * [Concepts](https://github.com/anchore/syft/wiki/package-cataloger-selection#concepts)
   * [Examples](https://github.com/anchore/syft/wiki/package-cataloger-selection#examples)
 * [Using templates](https://github.com/anchore/syft/wiki/using-templates)
@@ -177,8 +177,8 @@ Check out our [contributing](/CONTRIBUTING.md) guide and [developer](/DEVELOPING
 
 ## Syft Team Meetings
 
-The Syft Team hold regular community meetings online. All are welcome to join to bring topics for discussion.
-- Check the [calendar](https://calendar.google.com/calendar/u/0/r?cid=Y182OTM4dGt0MjRtajI0NnNzOThiaGtnM29qNEBncm91cC5jYWxlbmRhci5nb29nbGUuY29t) for the next meeting date.
+The Syft Team hold regular community meetings online. All are welcome to join to bring topics for discussion. 
+- Check the [calendar](https://calendar.google.com/calendar/u/0/r?cid=Y182OTM4dGt0MjRtajI0NnNzOThiaGtnM29qNEBncm91cC5jYWxlbmRhci5nb29nbGUuY29t) for the next meeting date. 
 - Add items to the [agenda](https://docs.google.com/document/d/1ZtSAa6fj2a6KRWviTn3WoJm09edvrNUp4Iz_dOjjyY8/edit?usp=sharing) (join [this group](https://groups.google.com/g/anchore-oss-community) for write access to the [agenda](https://docs.google.com/document/d/1ZtSAa6fj2a6KRWviTn3WoJm09edvrNUp4Iz_dOjjyY8/edit?usp=sharing))
 - See you there!
 

Taskfile.yaml

@@ -27,12 +27,10 @@ vars:
     sh: uname -s | tr '[:upper:]' '[:lower:]'
   ARCH:
     sh: |
-      [ "$(uname -m)" = "x86_64" ] && echo "amd64_v1" || { [ "$(uname -m)" = "aarch64" ] && echo "arm64_v8.0" || [ "$(uname -m)" = "arm64" ] && echo "arm64_v8.0" || echo $(uname -m); }
+      [ "$(uname -m)" = "x86_64" ] && echo "amd64_v1" || { [ "$(uname -m)" = "aarch64" ] && echo "arm64_v8.0" || echo $(uname -m); }
   PROJECT_ROOT:
     sh: echo $PWD
-
   # note: the snapshot dir must be a relative path starting with ./
-  # e.g. when installing snapshot debs from a local path, ./ forces the deb to be installed in the current working directory instead of referencing a package name
   SNAPSHOT_DIR: ./snapshot
   SNAPSHOT_BIN: "{{ .PROJECT_ROOT }}/{{ .SNAPSHOT_DIR }}/{{ .OS }}-build_{{ .OS }}_{{ .ARCH }}/{{ .PROJECT }}"
   SNAPSHOT_CMD: "{{ .TOOL_DIR }}/goreleaser release --config {{ .TMP_DIR }}/goreleaser.yaml --clean --snapshot --skip=publish --skip=sign"
@@ -77,8 +75,8 @@ tasks:
       - task: unit
       - task: integration
       - task: validate-cyclonedx-schema
+      - task: benchmark
       - task: test-utils
-      - task: snapshot
       - task: cli
       - task: check-docker-cache
 
@@ -91,7 +89,7 @@ tasks:
       - "{{ .TOOL_DIR }}/binny"
     status:
       - "test -f {{ .TOOL_DIR }}/binny"
-    cmd: "curl -sSfL https://get.anchore.io/binny | sh -s -- -b .tool"
+    cmd: "curl -sSfL https://raw.githubusercontent.com/anchore/binny/main/install.sh | sh -s -- -b .tool"
     silent: true
 
   tools:
@@ -223,8 +221,7 @@ tasks:
     cmds:
       - "go test -v ./cmd/syft/internal/test/integration"
       # exercise most of the CLI with the data race detector
-      # we use a larger image to ensure we're using multiple catalogers at a time
-      - "go run -race cmd/syft/main.go anchore/test_images:grype-quality-dotnet-69f15d2"
+      - "go run -race cmd/syft/main.go alpine:latest"
 
   validate-cyclonedx-schema:
     desc: Validate that Syft produces valid CycloneDX documents
@@ -233,7 +230,10 @@ tasks:
 
   cli:
     desc: Run CLI tests
-    deps: [tools]
+    # note: we don't want to regenerate the snapshot unless we have to. In CI it's probable
+    # that the cache being restored with the correct binary will be rebuilt since the timestamps
+    # and local checksums will not line up.
+    deps: [tools, snapshot]
     cmds:
       - cmd: "echo 'testing binary: {{ .SNAPSHOT_BIN }}'"
         silent: true
@@ -250,6 +250,27 @@ tasks:
       - cmd: .github/scripts/labeler_test.py
 
 
+  ## Benchmark test targets #################################
+
+  benchmark:
+    deps: [tmpdir]
+    generates:
+      - "{{ .TMP_DIR }}/benchmark-main.txt"
+    cmds:
+      - "go test -p 1 -run=^Benchmark -bench=. -count=7 -benchmem ./... | tee {{ .TMP_DIR }}/benchmark-{{ .VERSION }}.txt"
+      - |
+        bash -c "(test -s {{ .TMP_DIR }}/benchmark-main.txt && \
+        {{ .TOOL_DIR }}/benchstat {{ .TMP_DIR }}/benchmark-main.txt {{ .TMP_DIR }}/benchmark-{{ .VERSION }}.txt || \
+        {{ .TOOL_DIR }}/benchstat {{ .TMP_DIR }}/benchmark-{{ .VERSION }}.txt) \
+        | tee {{ .TMP_DIR }}/benchstat.txt"
+
+  show-benchstat:
+    deps: [benchmark, tmpdir]
+    cmds:
+      - cmd: "cat {{ .TMP_DIR }}/benchstat.txt"
+        silent: true
+
+
   ## Test-fixture-related targets #################################
 
   fingerprints:
@@ -265,12 +286,12 @@ tasks:
         YELLOW='\033[0;33m'
         RESET='\033[0m'
 
-        echo -e "${YELLOW}creating fingerprint files for non-docker fixtures...${RESET}"
+        echo -e "${YELLOW}creating fingerprint files for non-docker fixtures...${RESET}"        
         for dir in $(find . -type d -name 'test-fixtures'); do
           if [ -f "$dir/Makefile" ]; then
             # for debugging...
             #echo -e "${YELLOW}• calculating fingerprints in $dir... ${RESET}"
-
+            
             (make -C "$dir" fingerprint)
           fi
         done
@@ -299,18 +320,18 @@ tasks:
         BOLD='\033[1m'
         PURPLE='\033[0;35m'
         RESET='\033[0m'
-
+        
         # if DOWNLOAD_TEST_FIXTURE_CACHE is set to 'false', then skip the cache download and always build
         if [ "$DOWNLOAD_TEST_FIXTURE_CACHE" = "false" ]; then
             echo -e "${BOLD}${PURPLE}skipping cache download, rebuilding cache...${RESET}"
             {{ .TASK }} build-fixtures
             exit 0
         fi
-
+        
         LATEST_FINGERPRINT=$(docker manifest inspect {{ .CACHE_IMAGE }} | {{ .YQ }} -r '.annotations.fingerprint')
 
         echo "latest cache:      $LATEST_FINGERPRINT"
-
+        
         if [ -f {{ .LAST_CACHE_PULL_FILE }} ]; then
           LAST_PULL_FINGERPRINT=$(cat {{ .LAST_CACHE_PULL_FILE }} | {{ .YQ }} -r '.digest')
         else
@@ -318,41 +339,41 @@ tasks:
           {{ .TASK }} download-test-fixture-cache
           exit 0
         fi
-
+        
         {{ .TASK }} fingerprints
 
-        WANT_FINGERPRINT=$(cat {{ .CACHE_PATHS_FILE }} | {{ .YQ }} -r '.digest')
+        WANT_FINGERPRINT=$(cat {{ .CACHE_PATHS_FILE }} | {{ .YQ }} -r '.digest')        
 
         echo "desired cache:     $WANT_FINGERPRINT"
         echo "last pulled cache: $LAST_PULL_FINGERPRINT"
-
+  
         # if we already have the latest cache, skip the refresh
         if [ "$LAST_PULL_FINGERPRINT" = "$WANT_FINGERPRINT" ]; then
             echo -e "${BOLD}${PURPLE}already have the latest cache (skipping cache download)${RESET}"
             exit 0
         fi
-
+  
         # at this point we only refresh the cache if we want the same cache that is currently available.
         # we don't by default refresh the cache if the cache if it is simply different from what we have,
         # because we may be working on a code change that doesn't require a cache refresh (but could trigger one,
         # which would be annoying to deal with in a development workflow).
-
+  
         if [ "$LATEST_FINGERPRINT" = "$WANT_FINGERPRINT" ]; then
           echo -e "${BOLD}${PURPLE}found newer cache! downloading cache...${RESET}"
           {{ .TASK }} download-test-fixture-cache
         else
           echo -e "${BOLD}${PURPLE}found different cache, but isn't clear if it's newer (skipping cache download and manually building)${RESET}"
-
+        
           {{ .YQ }} eval '.paths[] | "\(.digest) \(.path)"' {{ .LAST_CACHE_PULL_FILE }} > .tmp/last_cache_lines
           {{ .YQ }} eval '.paths[] | "\(.digest) \(.path)"' {{ .CACHE_PATHS_FILE }} > .tmp/cache_lines
           diff .tmp/last_cache_lines .tmp/cache_lines || true
-
+        
           echo -e "${BOLD}${PURPLE}diff with more context...${RESET}"
-
+        
           diff -U10000 {{ .LAST_CACHE_PULL_FILE }} {{ .CACHE_PATHS_FILE }} || true
-
+        
           echo -e "${BOLD}${PURPLE}detected changes to input material, manually building fixtures...${RESET}"
-
+        
           {{ .TASK }} build-fixtures
         fi
 
@@ -365,7 +386,7 @@ tasks:
         BOLD='\033[1m'
         YELLOW='\033[0;33m'
         RESET='\033[0m'
-
+        
         # Use a for loop with command substitution to avoid subshell issues
         for dir in $(find . -type d -name 'test-fixtures'); do
           if [ -f "$dir/Makefile" ]; then
@@ -403,15 +424,15 @@ tasks:
       set -eu
       oras_command="{{ .ORAS }} push {{ .CACHE_IMAGE }}"
 
-      paths=$(cat {{ .CACHE_PATHS_FILE }} | {{ .YQ }} -r '.paths[].path')
+      paths=$(cat {{ .CACHE_PATHS_FILE }} | {{ .YQ }} -r '.paths[].path')      
       for path in $paths; do
         oras_command+=" $path"
       done
       oras_command+=" {{ .CACHE_PATHS_FILE }}"
-
+      
       oras_command+=" --annotation org.opencontainers.image.source=https://github.com/{{ .OWNER }}/{{ .PROJECT }}"
       oras_command+=" --annotation fingerprint=$(cat {{ .CACHE_PATHS_FILE }} | {{ .YQ }} -r '.digest')"
-
+    
       echo "Executing: $oras_command"
       eval $oras_command
 
@@ -431,8 +452,8 @@ tasks:
       find . | grep cache | grep tar | xargs du
       echo "total $total_size KB"
 
-      if [ "$total_size" -gt 5242880  ]; then
-        echo 'docker cache is larger than 5GB'
+      if [ "$total_size" -gt 1048576 ]; then
+        echo 'docker cache is larger than 1GB'
         exit 1
       fi
 
@@ -552,18 +573,6 @@ tasks:
 
       - "{{ .SNAPSHOT_CMD }}"
 
-  snapshot-smoke-test:
-    desc: Run a smoke test on the snapshot builds + docker images
-    cmds:
-      - cmd: "echo 'testing snapshot binary: {{ .SNAPSHOT_BIN }}'"
-        silent: true
-      - cmd: "test -f {{ .SNAPSHOT_BIN }} || (find {{ .SNAPSHOT_DIR }} && echo '\nno snapshot found for {{ .SNAPSHOT_BIN }}' && false)"
-        silent: true
-      - "{{ .SNAPSHOT_BIN }} version"
-      - "{{ .SNAPSHOT_BIN }} scan alpine:latest"
-      - docker run --rm anchore/syft:latest version
-      - docker run --rm anchore/syft:latest scan alpine:latest
-
   changelog:
     desc: Generate a changelog
     deps: [tools]
@@ -604,6 +613,16 @@ tasks:
         silent: true
       - "{{ .RELEASE_CMD }}"
 
+  ci-release-version-file:
+    # desc: "[CI only] Update the version file"
+    deps: [tools]
+    cmds:
+      - task: ci-check
+      - ".github/scripts/update-version-file.sh {{ .RELEASE_VERSION }}"
+    requires:
+      vars:
+        - RELEASE_VERSION
+
 
   ## Cleanup targets #################################
 
@@ -631,7 +650,7 @@ tasks:
         BOLD='\033[1m'
         YELLOW='\033[0;33m'
         RESET='\033[0m'
-
+        
         # Use a for loop with command substitution to avoid subshell issues
         for dir in $(find . -type d -name 'test-fixtures'); do
         if [ -f "$dir/Makefile" ]; then

cmd/syft/cli/cli.go

@@ -10,7 +10,6 @@ import (
 	"github.com/anchore/clio"
 	"github.com/anchore/syft/cmd/syft/internal"
 	"github.com/anchore/syft/cmd/syft/internal/commands"
-	constants "github.com/anchore/syft/internal"
 )
 
 // Application constructs the `syft packages` command and aliases the root command to `syft packages`.
@@ -48,7 +47,7 @@ func create(id clio.Identification, out io.Writer) (clio.Application, *cobra.Com
 		commands.Cataloger(app),
 		commands.Attest(app),
 		commands.Convert(app),
-		clio.VersionCommand(id, schemaVersion),
+		clio.VersionCommand(id),
 		clio.ConfigCommand(app, nil),
 		cranecmd.NewCmdAuthLogin(id.Name), // syft login uses the same command as crane
 	)
@@ -60,7 +59,3 @@ func create(id clio.Identification, out io.Writer) (clio.Application, *cobra.Com
 
 	return app, rootCmd
 }
-
-func schemaVersion() (string, any) {
-	return "SchemaVersion", constants.JSONSchemaVersion
-}

cmd/syft/cli/ui/__snapshots__/handle_pull_source_test.snap

@@ -1,8 +0,0 @@
-
-[TestHandler_handlePullSourceStarted/snap_download_in_progress - 1]
- ⠋ Downloading snap file...        ━━━━━━━━━━━━━━━━━━━━                example-app_1.0_amd64.snap 
----
-
-[TestHandler_handlePullSourceStarted/snap_download_complete - 1]
- ✔ Snap downloaded successfully                                        example-app_1.0_amd64.snap 
----

cmd/syft/cli/ui/handle_cataloger_task_test.go

@@ -26,7 +26,7 @@ func TestHandler_handleCatalogerTaskStarted(t *testing.T) {
 		{
 			name: "cataloging task in progress",
 			eventFn: func(t *testing.T) partybus.Event {
-				value := &monitor.TaskProgress{
+				value := &monitor.CatalogerTaskProgress{
 					AtomicStage: progress.NewAtomicStage("some stage"),
 					Manual:      progress.NewManual(100),
 				}
@@ -48,7 +48,7 @@ func TestHandler_handleCatalogerTaskStarted(t *testing.T) {
 		{
 			name: "cataloging sub task in progress",
 			eventFn: func(t *testing.T) partybus.Event {
-				value := &monitor.TaskProgress{
+				value := &monitor.CatalogerTaskProgress{
 					AtomicStage: progress.NewAtomicStage("some stage"),
 					Manual:      progress.NewManual(100),
 				}
@@ -71,7 +71,7 @@ func TestHandler_handleCatalogerTaskStarted(t *testing.T) {
 		{
 			name: "cataloging sub task complete",
 			eventFn: func(t *testing.T) partybus.Event {
-				value := &monitor.TaskProgress{
+				value := &monitor.CatalogerTaskProgress{
 					AtomicStage: progress.NewAtomicStage("some stage"),
 					Manual:      progress.NewManual(100),
 				}
@@ -94,7 +94,7 @@ func TestHandler_handleCatalogerTaskStarted(t *testing.T) {
 		{
 			name: "cataloging sub task complete -- hide stage",
 			eventFn: func(t *testing.T) partybus.Event {
-				value := &monitor.TaskProgress{
+				value := &monitor.CatalogerTaskProgress{
 					AtomicStage: progress.NewAtomicStage("some stage"),
 					Manual:      progress.NewManual(100),
 				}
@@ -117,7 +117,7 @@ func TestHandler_handleCatalogerTaskStarted(t *testing.T) {
 		{
 			name: "cataloging sub task complete with removal",
 			eventFn: func(t *testing.T) partybus.Event {
-				value := &monitor.TaskProgress{
+				value := &monitor.CatalogerTaskProgress{
 					AtomicStage: progress.NewAtomicStage("some stage"),
 					Manual:      progress.NewManual(100),
 				}
@@ -162,7 +162,7 @@ func TestHandler_handleCatalogerTaskStarted(t *testing.T) {
 			}
 
 			// note: this line / event is not under test, only needed to show a sub status
-			kickoffEvent := &monitor.TaskProgress{
+			kickoffEvent := &monitor.CatalogerTaskProgress{
 				AtomicStage: progress.NewAtomicStage(""),
 				Manual:      progress.NewManual(-1),
 			}

cmd/syft/cli/ui/handle_pull_source.go

@@ -1,37 +0,0 @@
-package ui
-
-import (
-	tea "github.com/charmbracelet/bubbletea"
-	"github.com/wagoodman/go-partybus"
-
-	"github.com/anchore/bubbly/bubbles/taskprogress"
-	"github.com/anchore/syft/internal/log"
-	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
-)
-
-func (m *Handler) handlePullSourceStarted(e partybus.Event) []tea.Model {
-	prog, info, err := syftEventParsers.ParsePullSourceStarted(e)
-	if err != nil {
-		log.WithFields("error", err).Debug("unable to parse event")
-		return nil
-	}
-
-	tsk := m.newTaskProgress(
-		taskprogress.Title{
-			Default: info.Title.Default,
-			Running: info.Title.WhileRunning,
-			Success: info.Title.OnSuccess,
-		},
-		taskprogress.WithStagedProgressable(prog),
-	)
-
-	tsk.HideOnSuccess = info.HideOnSuccess
-	tsk.HideStageOnSuccess = info.HideStageOnSuccess
-	tsk.HideProgressOnSuccess = true
-
-	if info.Context != "" {
-		tsk.Context = []string{info.Context}
-	}
-
-	return []tea.Model{tsk}
-}

cmd/syft/cli/ui/handle_pull_source_test.go

@@ -1,121 +0,0 @@
-package ui
-
-import (
-	"testing"
-	"time"
-
-	tea "github.com/charmbracelet/bubbletea"
-	"github.com/gkampitakis/go-snaps/snaps"
-	"github.com/stretchr/testify/require"
-	"github.com/wagoodman/go-partybus"
-	"github.com/wagoodman/go-progress"
-
-	"github.com/anchore/bubbly/bubbles/taskprogress"
-	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/event/monitor"
-)
-
-func TestHandler_handlePullSourceStarted(t *testing.T) {
-
-	tests := []struct {
-		name       string
-		eventFn    func(*testing.T) partybus.Event
-		iterations int
-	}{
-		{
-			name: "snap download in progress",
-			eventFn: func(t *testing.T) partybus.Event {
-				stage := progress.NewAtomicStage("")
-				manual := progress.NewManual(0)
-				manual.SetTotal(1000000) // 1MB file
-				manual.Set(250000)       // 25% downloaded
-
-				taskProg := &monitor.TaskProgress{
-					AtomicStage: stage,
-					Manual:      manual,
-				}
-
-				genericTask := monitor.GenericTask{
-					Title: monitor.Title{
-						Default:      "Downloading snap",
-						WhileRunning: "Downloading snap file...",
-						OnSuccess:    "Snap downloaded",
-					},
-					Context:            "example-app_1.0_amd64.snap",
-					HideOnSuccess:      false,
-					HideStageOnSuccess: true,
-					ID:                 "snap-download-123",
-				}
-
-				return partybus.Event{
-					Type:   event.PullSourceStarted,
-					Source: genericTask,
-					Value:  taskProg,
-				}
-			},
-			iterations: 5,
-		},
-		{
-			name: "snap download complete",
-			eventFn: func(t *testing.T) partybus.Event {
-				stage := progress.NewAtomicStage("")
-				manual := progress.NewManual(0)
-				manual.SetTotal(1000000) // 1MB file
-				manual.Set(1000000)      // 100% downloaded
-				manual.SetCompleted()
-
-				taskProg := &monitor.TaskProgress{
-					AtomicStage: stage,
-					Manual:      manual,
-				}
-
-				genericTask := monitor.GenericTask{
-					Title: monitor.Title{
-						Default:      "Downloading snap",
-						WhileRunning: "Downloading snap file...",
-						OnSuccess:    "Snap downloaded successfully",
-					},
-					Context:            "example-app_1.0_amd64.snap",
-					HideOnSuccess:      false,
-					HideStageOnSuccess: true,
-					ID:                 "snap-download-123",
-				}
-
-				return partybus.Event{
-					Type:   event.PullSourceStarted,
-					Source: genericTask,
-					Value:  taskProg,
-				}
-			},
-			iterations: 3,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			event := tt.eventFn(t)
-			handler := New(DefaultHandlerConfig())
-			handler.WindowSize = tea.WindowSizeMsg{
-				Width:  100,
-				Height: 80,
-			}
-
-			models := handler.handlePullSourceStarted(event)
-			require.Len(t, models, 1)
-			model := models[0]
-
-			tsk, ok := model.(taskprogress.Model)
-			require.True(t, ok)
-
-			gotModel := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
-				Time:     time.Now(),
-				Sequence: tsk.Sequence(),
-				ID:       tsk.ID(),
-			})
-
-			got := gotModel.View()
-
-			t.Log(got)
-			snaps.MatchSnapshot(t, got)
-		})
-	}
-}

cmd/syft/cli/ui/handler.go

@@ -57,7 +57,6 @@ func New(cfg HandlerConfig) *Handler {
 		stereoscopeEvent.FetchImage:          simpleHandler(h.handleFetchImage),
 		syftEvent.FileIndexingStarted:        simpleHandler(h.handleFileIndexingStarted),
 		syftEvent.AttestationStarted:         simpleHandler(h.handleAttestationStarted),
-		syftEvent.PullSourceStarted:          simpleHandler(h.handlePullSourceStarted),
 		syftEvent.CatalogerTaskStarted:       h.handleCatalogerTaskStarted,
 	})
 

cmd/syft/internal/clio_setup_config.go

@@ -44,7 +44,7 @@ func AppClioSetupConfig(id clio.Identification, out io.Writer) *clio.SetupConfig
 				redact.Set(state.RedactStore)
 
 				log.Set(state.Logger)
-				stereoscope.SetLogger(state.Logger.Nested("from", "stereoscope"))
+				stereoscope.SetLogger(state.Logger)
 				return nil
 			},
 		).

cmd/syft/internal/commands/scan.go

@@ -10,7 +10,7 @@ import (
 
 	"github.com/hashicorp/go-multierror"
 	"github.com/spf13/cobra"
-	"go.yaml.in/yaml/v3"
+	"gopkg.in/yaml.v3"
 
 	"github.com/anchore/clio"
 	"github.com/anchore/fangs"
@@ -218,9 +218,8 @@ func getSource(ctx context.Context, opts *options.Catalog, userInput string, sou
 	cfg := syft.DefaultGetSourceConfig().
 		WithRegistryOptions(opts.Registry.ToOptions()).
 		WithAlias(source.Alias{
-			Name:     opts.Source.Name,
-			Version:  opts.Source.Version,
-			Supplier: opts.Source.Supplier,
+			Name:    opts.Source.Name,
+			Version: opts.Source.Version,
 		}).
 		WithExcludeConfig(source.ExcludeConfig{
 			Paths: opts.Exclusions,

cmd/syft/internal/options/catalog.go

@@ -158,8 +158,8 @@ func (cfg Catalog) ToFilesConfig() filecataloging.Config {
 
 func (cfg Catalog) ToLicenseConfig() cataloging.LicenseConfig {
 	return cataloging.LicenseConfig{
-		IncludeContent: cfg.License.Content,
-		Coverage:       cfg.License.Coverage,
+		IncludeUnkownLicenseContent: cfg.License.IncludeUnknownLicenseContent,
+		Coverage:                    cfg.License.LicenseCoverage,
 	}
 }
 
@@ -259,9 +259,6 @@ func (cfg *Catalog) AddFlags(flags clio.FlagSet) {
 
 	flags.StringVarP(&cfg.Source.BasePath, "base-path", "",
 		"base directory for scanning, no links will be followed above this directory, and all paths will be reported relative to this directory")
-
-	flags.StringVarP(&cfg.Source.Supplier, "source-supplier", "",
-		"the organization that supplied the component, which often may be the manufacturer, distributor, or repackager")
 }
 
 func (cfg *Catalog) DescribeFields(descriptions fangs.FieldDescriptionSet) {

cmd/syft/internal/options/format.go

@@ -43,9 +43,9 @@ over to the final syft 1.0 json output this option can be used to ease the trans
 
 Note: long term support for this option is not guaranteed (it may change or break at any time)`)
 
-	descriptions.Add(&o.Template.Path, `path to the template file to use when rendering the output with the template output format.
+	descriptions.Add(&o.Template.Path, `path to the template file to use when rendering the output with the template output format. 
 Note that all template paths are based on the current syft-json schema`)
-	descriptions.Add(&o.Template.Legacy, `if true, uses the go structs for the syft-json format for templating.
+	descriptions.Add(&o.Template.Legacy, `if true, uses the go structs for the syft-json format for templating. 
 if false, uses the syft-json output for templating (which follows the syft JSON schema exactly).
 
 Note: long term support for this option is not guaranteed (it may change or break at any time)`)

cmd/syft/internal/options/license.go

@@ -1,17 +1,12 @@
 package options
 
 import (
-	"fmt"
-
 	"github.com/anchore/clio"
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/syft/cataloging"
 )
 
 type licenseConfig struct {
-	Content                 cataloging.LicenseContent   `yaml:"content" json:"content" mapstructure:"content"`
-	Coverage                float64                     `yaml:"coverage" json:"coverage" mapstructure:"coverage"`
-	AvailableLicenseContent []cataloging.LicenseContent `yaml:"-" json:"-" mapstructure:"-"`
+	IncludeUnknownLicenseContent bool    `yaml:"include-unknown-license-content" json:"include-unknown-license-content" mapstructure:"include-unknown-license-content"`
+	LicenseCoverage              float64 `yaml:"license-coverage" json:"license-coverage" mapstructure:"license-coverage"`
 }
 
 var _ interface {
@@ -19,29 +14,15 @@ var _ interface {
 } = (*licenseConfig)(nil)
 
 func (o *licenseConfig) DescribeFields(descriptions clio.FieldDescriptionSet) {
-	descriptions.Add(&o.Content, fmt.Sprintf("include the content of licenses in the SBOM for a given syft scan; valid values are: %s", o.AvailableLicenseContent))
-
-	descriptions.Add(&o.Coverage, `adjust the percent as a fraction of the total text, in normalized words, that
+	descriptions.Add(&o.IncludeUnknownLicenseContent, `include the content of a license in the SBOM when syft
+cannot determine a valid SPDX ID for the given license`)
+	descriptions.Add(&o.LicenseCoverage, `adjust the percent as a fraction of the total text, in normalized words, that
 matches any valid license for the given inputs, expressed as a percentage across all of the licenses matched.`)
 }
 
-func (o *licenseConfig) PostLoad() error {
-	validContent := internal.NewSet(o.AvailableLicenseContent...)
-	if !validContent.Contains(o.Content) {
-		return fmt.Errorf("could not use %q as license content option; valid values are: %v", o.Content, validContent.ToSlice())
-	}
-	return nil
-}
-
 func defaultLicenseConfig() licenseConfig {
-	cfg := cataloging.DefaultLicenseConfig()
 	return licenseConfig{
-		Content:  cfg.IncludeContent,
-		Coverage: cfg.Coverage,
-		AvailableLicenseContent: []cataloging.LicenseContent{
-			cataloging.LicenseContentIncludeAll,
-			cataloging.LicenseContentIncludeUnknown,
-			cataloging.LicenseContentExcludeAll,
-		},
+		IncludeUnknownLicenseContent: false,
+		LicenseCoverage:              75,
 	}
 }

cmd/syft/internal/options/output.go

@@ -12,7 +12,6 @@ import (
 	"github.com/anchore/syft/syft/format/cyclonedxjson"
 	"github.com/anchore/syft/syft/format/cyclonedxxml"
 	"github.com/anchore/syft/syft/format/github"
-	"github.com/anchore/syft/syft/format/purls"
 	"github.com/anchore/syft/syft/format/spdxjson"
 	"github.com/anchore/syft/syft/format/spdxtagvalue"
 	"github.com/anchore/syft/syft/format/syftjson"
@@ -128,7 +127,6 @@ func supportedIDs() []sbom.FormatID {
 		table.ID,
 		text.ID,
 		template.ID,
-		purls.ID,
 
 		// encoders that support multiple versions
 		cyclonedxxml.ID,

cmd/syft/internal/options/source.go

@@ -16,8 +16,6 @@ import (
 type sourceConfig struct {
 	Name     string      `json:"name" yaml:"name" mapstructure:"name"`
 	Version  string      `json:"version" yaml:"version" mapstructure:"version"`
-	Supplier string      `json:"supplier" yaml:"supplier" mapstructure:"supplier"`
-	Source   string      `json:"source" yaml:"source" mapstructure:"source"`
 	BasePath string      `yaml:"base-path" json:"base-path" mapstructure:"base-path"` // specify base path for all file paths
 	File     fileSource  `json:"file" yaml:"file" mapstructure:"file"`
 	Image    imageSource `json:"image" yaml:"image" mapstructure:"image"`

cmd/syft/internal/test/integration/catalog_packages_cases_test.go

@@ -501,13 +501,6 @@ var commonTestCases = []testCase{
 			"Akismet Anti-spam: Spam Protection": "5.3",
 		},
 	},
-	{
-		name:    "find homebrew",
-		pkgType: pkg.HomebrewPkg,
-		pkgInfo: map[string]string{
-			"afflib": "1.2.3",
-		},
-	},
 	{
 		name:        "find php pear/pecl package",
 		pkgType:     pkg.PhpPearPkg,

cmd/syft/internal/test/integration/catalog_packages_test.go

@@ -87,7 +87,6 @@ func TestPkgCoverageImage(t *testing.T) {
 	definedPkgs.Remove(string(pkg.GithubActionWorkflowPkg))
 	definedPkgs.Remove(string(pkg.TerraformPkg))
 	definedPkgs.Remove(string(pkg.PhpPeclPkg)) // we have coverage for pear instead
-	definedPkgs.Remove(string(pkg.CondaPkg))
 
 	var cases []testCase
 	cases = append(cases, commonTestCases...)
@@ -160,7 +159,6 @@ func TestPkgCoverageDirectory(t *testing.T) {
 	definedPkgs.Remove(string(pkg.LinuxKernelModulePkg))
 	definedPkgs.Remove(string(pkg.Rpkg))
 	definedPkgs.Remove(string(pkg.UnknownPkg))
-	definedPkgs.Remove(string(pkg.CondaPkg))
 	definedPkgs.Remove(string(pkg.PhpPeclPkg)) // this is covered as pear packages
 
 	// for directory scans we should not expect to see any of the following package types

cmd/syft/internal/test/integration/encode_decode_cycle_test.go

@@ -78,10 +78,7 @@ func TestEncodeDecodeEncodeCycleComparison(t *testing.T) {
 		t.Run(test.name, func(t *testing.T) {
 			for _, image := range images {
 				originalSBOM, _ := catalogFixtureImage(t, image, source.SquashedScope)
-				// we need a way to inject supplier into this test
-				// supplier is not available as part of the SBOM Config API since the flag
-				// is used in conjunction with the SourceConfig which is injected into generateSBOM during scan
-				originalSBOM.Source.Supplier = "anchore"
+
 				f := encoders.GetByString(test.name)
 				require.NotNil(t, f)
 

cmd/syft/internal/test/integration/package_deduplication_test.go

@@ -19,7 +19,7 @@ func TestPackageDeduplication(t *testing.T) {
 	}{
 		{
 			scope:        source.AllLayersScope,
-			packageCount: 175, // without deduplication this would be ~600
+			packageCount: 178, // without deduplication this would be ~600
 			instanceCount: map[string]int{
 				"basesystem":   1,
 				"wget":         1,
@@ -30,15 +30,15 @@ func TestPackageDeduplication(t *testing.T) {
 			locationCount: map[string]int{
 				"basesystem-11-13.el9":               5, // in all layers
 				"curl-minimal-7.76.1-26.el9_3.2.0.1": 2, // base + wget layer
-				"curl-minimal-7.76.1-31.el9":         3, // curl upgrade layer + all above layers
+				"curl-minimal-7.76.1-29.el9_4.1":     3, // curl upgrade layer + all above layers
 				"wget-1.21.1-8.el9_4":                4, // wget + all above layers
-				"vsftpd-3.0.5-6.el9":                 2, // vsftpd + all above layers
-				"httpd-2.4.62-4.el9":                 1, // last layer
+				"vsftpd-3.0.5-5.el9":                 2, // vsftpd + all above layers
+				"httpd-2.4.57-11.el9_4.1":            1, // last layer
 			},
 		},
 		{
 			scope:        source.SquashedScope,
-			packageCount: 169,
+			packageCount: 172,
 			instanceCount: map[string]int{
 				"basesystem":   1,
 				"wget":         1,
@@ -47,11 +47,11 @@ func TestPackageDeduplication(t *testing.T) {
 				"httpd":        1, // rpm, binary is now excluded by overlap
 			},
 			locationCount: map[string]int{
-				"basesystem-11-13.el9":       1,
-				"curl-minimal-7.76.1-31.el9": 1, // upgrade
-				"wget-1.21.1-8.el9_4":        1,
-				"vsftpd-3.0.5-6.el9":         1,
-				"httpd-2.4.62-4.el9":         1,
+				"basesystem-11-13.el9":           1,
+				"curl-minimal-7.76.1-29.el9_4.1": 1, // upgrade
+				"wget-1.21.1-8.el9_4":            1,
+				"vsftpd-3.0.5-5.el9":             1,
+				"httpd-2.4.57-11.el9_4.1":        1,
 			},
 		},
 	}

cmd/syft/internal/test/integration/regression_photon_package_test.go

@@ -3,18 +3,18 @@ package integration
 import (
 	"testing"
 
-	"github.com/stretchr/testify/assert"
-
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
 )
 
 func TestPhotonPackageRegression(t *testing.T) { // Regression: https://github.com/anchore/syft/pull/1997
 	sbom, _ := catalogFixtureImage(t, "image-photon-all-layers", source.AllLayersScope)
-	var count int
-	for range sbom.Artifacts.Packages.Enumerate(pkg.RpmPkg) {
-		count++
+	var packages []pkg.Package
+	for p := range sbom.Artifacts.Packages.Enumerate() {
+		packages = append(packages, p)
 	}
 
-	assert.Greater(t, count, 0, "expected to find RPM packages in the SBOM (but did not)")
+	if len(packages) < 1 {
+		t.Errorf("failed to find packages for photon distro; wanted > 0 got 0")
+	}
 }

cmd/syft/internal/test/integration/test-fixtures/image-pkg-coverage/pkgs/homebrew/Cellar/afflib/1.2.3/.brew/afflib.rb

@@ -1,2 +0,0 @@
-desc "Advanced Forensic Format"
-homepage "https://github.com/sshock/AFFLIBv3"

examples/create_custom_sbom/main.go

@@ -6,8 +6,7 @@ import (
 	"fmt"
 	"os"
 
-	"go.yaml.in/yaml/v3"
-	_ "modernc.org/sqlite" // required for rpmdb and other features
+	"gopkg.in/yaml.v3"
 
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/cataloging"

examples/create_simple_sbom/main.go

@@ -5,8 +5,6 @@ import (
 	"fmt"
 	"os"
 
-	_ "modernc.org/sqlite" // required for rpmdb and other features
-
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/format"
 	"github.com/anchore/syft/syft/format/syftjson"

examples/select_catalogers/main.go

@@ -5,8 +5,6 @@ import (
 	"encoding/json"
 	"os"
 
-	_ "modernc.org/sqlite" // required for rpmdb and other features
-
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/cataloging"
 	"github.com/anchore/syft/syft/cataloging/pkgcataloging"

examples/source_from_registry/main.go

@@ -4,8 +4,6 @@ import (
 	"context"
 	"os"
 
-	_ "modernc.org/sqlite" // required for rpmdb and other features
-
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/format/syftjson"
 )

go.mod

@@ -5,7 +5,7 @@ go 1.24.1
 require (
 	github.com/BurntSushi/toml v1.5.0
 	github.com/CycloneDX/cyclonedx-go v0.9.2
-	github.com/Masterminds/semver/v3 v3.4.0
+	github.com/Masterminds/semver/v3 v3.3.1
 	github.com/Masterminds/sprig/v3 v3.3.0
 	github.com/OneOfOne/xxhash v1.2.8
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
@@ -19,53 +19,50 @@ require (
 	github.com/anchore/go-homedir v0.0.0-20250319154043-c29668562e4d
 	github.com/anchore/go-logger v0.0.0-20250318195838-07ae343dd722
 	github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb
-	github.com/anchore/go-rpmdb v0.0.0-20250516171929-f77691e1faec
 	github.com/anchore/go-sync v0.0.0-20250326131806-4eda43a485b6
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115
-	github.com/anchore/stereoscope v0.1.9-0.20250826202322-ef061ea78385
+	github.com/anchore/stereoscope v0.1.4
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
 	github.com/aquasecurity/go-pep440-version v0.0.1
 	github.com/bitnami/go-version v0.0.0-20250131085805-b1f57a8634ef
 	github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
-	github.com/bmatcuk/doublestar/v4 v4.9.1
+	github.com/bmatcuk/doublestar/v4 v4.8.1
 	github.com/charmbracelet/bubbles v0.21.0
-	github.com/charmbracelet/bubbletea v1.3.6
+	github.com/charmbracelet/bubbletea v1.3.5
 	github.com/charmbracelet/lipgloss v1.1.0
 	github.com/dave/jennifer v1.7.1
 	github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da
-	github.com/diskfs/go-diskfs v1.7.0
 	github.com/distribution/reference v0.6.0
 	github.com/dustin/go-humanize v1.0.1
 	github.com/elliotchance/phpserialize v1.4.0
 	github.com/facebookincubator/nvdtools v0.1.5
 	github.com/github/go-spdx/v2 v2.3.3
-	github.com/gkampitakis/go-snaps v0.5.14
+	github.com/gkampitakis/go-snaps v0.5.11
 	github.com/go-git/go-billy/v5 v5.6.2
-	github.com/go-git/go-git/v5 v5.16.2
+	github.com/go-git/go-git/v5 v5.16.0
 	github.com/go-test/deep v1.1.1
-	github.com/go-viper/mapstructure/v2 v2.4.0
+	github.com/go-viper/mapstructure/v2 v2.2.1
 	github.com/gohugoio/hashstructure v0.5.0
 	github.com/google/go-cmp v0.7.0
-	github.com/google/go-containerregistry v0.20.6
+	github.com/google/go-containerregistry v0.20.3
 	github.com/google/licensecheck v0.3.1
 	github.com/google/uuid v1.6.0
 	github.com/gookit/color v1.5.4
-	github.com/hashicorp/go-cleanhttp v0.5.2
-	github.com/hashicorp/go-getter v1.7.9
 	github.com/hashicorp/go-multierror v1.1.1
-	github.com/hashicorp/hcl/v2 v2.24.0
+	github.com/hashicorp/hcl/v2 v2.23.0
 	github.com/iancoleman/strcase v0.3.0
 	github.com/invopop/jsonschema v0.7.0
-	github.com/jedib0t/go-pretty/v6 v6.6.8
+	github.com/jedib0t/go-pretty/v6 v6.6.7
 	github.com/jinzhu/copier v0.4.0
 	github.com/kastenhq/goversion v0.0.0-20230811215019-93b2f8823953
+	github.com/knqyf263/go-rpmdb v0.1.1
 	github.com/magiconair/properties v1.8.10
-	github.com/mholt/archives v0.1.3
+	github.com/mholt/archives v0.1.1
 	github.com/moby/sys/mountinfo v0.7.2
 	github.com/nix-community/go-nix v0.0.0-20250101154619-4bdde671e0a1
-	github.com/olekukonko/tablewriter v1.0.9
+	github.com/olekukonko/tablewriter v0.0.5
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/pelletier/go-toml v1.9.5
 	github.com/quasilyte/go-ruleguard/dsl v0.3.22
@@ -75,12 +72,12 @@ require (
 	github.com/sassoftware/go-rpmutils v0.4.0
 	// pinned to pull in 386 arch fix: https://github.com/scylladb/go-set/commit/cc7b2070d91ebf40d233207b633e28f5bd8f03a5
 	github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e
-	github.com/sergi/go-diff v1.4.0
+	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3
 	github.com/spdx/gordf v0.0.0-20201111095634-7098f93598fb
 	github.com/spdx/tools-golang v0.5.5
 	github.com/spf13/afero v1.14.0
 	github.com/spf13/cobra v1.9.1
-	github.com/stretchr/testify v1.11.0
+	github.com/stretchr/testify v1.10.0
 	github.com/vbatts/go-mtree v0.5.4
 	github.com/vifraa/gopom v1.0.0
 	github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651
@@ -88,20 +85,14 @@ require (
 	github.com/xeipuuv/gojsonschema v1.2.0
 	github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1
 	go.uber.org/goleak v1.3.0
-	go.yaml.in/yaml/v3 v3.0.4
-	golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b
-	golang.org/x/mod v0.27.0
-	golang.org/x/net v0.43.0
-	modernc.org/sqlite v1.38.2
+	golang.org/x/exp v0.0.0-20250305212735-054e65f0b394
+	golang.org/x/mod v0.24.0
+	golang.org/x/net v0.40.0
+	gopkg.in/yaml.v3 v3.0.1
+	modernc.org/sqlite v1.37.0
 )
 
 require (
-	cloud.google.com/go v0.116.0 // indirect
-	cloud.google.com/go/auth v0.9.9 // indirect
-	cloud.google.com/go/auth/oauth2adapt v0.2.4 // indirect
-	cloud.google.com/go/compute/metadata v0.7.0 // indirect
-	cloud.google.com/go/iam v1.2.2 // indirect
-	cloud.google.com/go/storage v1.43.0 // indirect
 	dario.cat/mergo v1.0.1 // indirect
 	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
 	github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0 // indirect
@@ -109,80 +100,70 @@ require (
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/Microsoft/hcsshim v0.11.7 // indirect
-	github.com/ProtonMail/go-crypto v1.2.0 // indirect
+	github.com/ProtonMail/go-crypto v1.1.6 // indirect
 	github.com/STARRY-S/zip v0.2.1 // indirect
 	github.com/agext/levenshtein v1.2.1 // indirect; indirectt
-	github.com/anchore/go-lzo v0.1.0 // indirect
 	github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092 // indirect
-	github.com/andybalholm/brotli v1.1.2-0.20250424173009-453214e765f3 // indirect
+	github.com/andybalholm/brotli v1.1.1 // indirect
+	github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/aquasecurity/go-version v0.0.1 // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
-	github.com/aws/aws-sdk-go v1.44.122 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/becheran/wildmatch-go v1.0.0 // indirect
-	github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
 	github.com/bodgit/plumbing v1.3.0 // indirect
 	github.com/bodgit/sevenzip v1.6.0 // indirect
 	github.com/bodgit/windows v1.0.1 // indirect
 	github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc // indirect
 	github.com/charmbracelet/harmonica v0.2.0 // indirect
-	github.com/charmbracelet/x/ansi v0.9.3 // indirect
+	github.com/charmbracelet/x/ansi v0.8.0 // indirect
 	github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd // indirect
 	github.com/charmbracelet/x/term v0.2.1 // indirect
 	github.com/cloudflare/circl v1.6.1 // indirect
 	github.com/containerd/cgroups v1.1.0 // indirect
-	github.com/containerd/containerd v1.7.28 // indirect
+	github.com/containerd/containerd v1.7.27 // indirect
 	github.com/containerd/containerd/api v1.8.0 // indirect
 	github.com/containerd/continuity v0.4.4 // indirect
-	github.com/containerd/errdefs v1.0.0 // indirect
-	github.com/containerd/errdefs/pkg v0.3.0 // indirect
+	github.com/containerd/errdefs v0.3.0 // indirect
 	github.com/containerd/fifo v1.1.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/platforms v0.2.1 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect
 	github.com/containerd/ttrpc v1.2.7 // indirect
-	github.com/containerd/typeurl/v2 v2.2.0 // indirect
+	github.com/containerd/typeurl/v2 v2.1.1 // indirect
 	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/docker/cli v28.3.2+incompatible // indirect
+	github.com/docker/cli v28.1.1+incompatible // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
-	github.com/docker/docker v28.3.3+incompatible // indirect
-	github.com/docker/docker-credential-helpers v0.9.3 // indirect
-	github.com/docker/go-connections v0.6.0 // indirect
+	github.com/docker/docker v28.1.1+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.8.2 // indirect
+	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
-	github.com/fatih/color v1.17.0 // indirect
 	github.com/felixge/fgprof v0.9.5 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.8.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.9 // indirect
-	github.com/gkampitakis/ciinfo v0.3.2 // indirect
+	github.com/gkampitakis/ciinfo v0.3.1 // indirect
 	github.com/gkampitakis/go-diff v1.3.2 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-restruct/restruct v1.2.0-alpha // indirect
-	github.com/goccy/go-yaml v1.18.0
+	github.com/goccy/go-yaml v1.15.13 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
 	github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e // indirect
-	github.com/google/s2a-go v0.1.8 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.4 // indirect
-	github.com/googleapis/gax-go/v2 v2.13.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
-	github.com/hashicorp/go-safetemp v1.0.0 // indirect
-	github.com/hashicorp/go-version v1.6.0 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
 	github.com/iancoleman/orderedmap v0.0.0-20190318233801-ac98e3ecb4b0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
-	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
 	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
@@ -196,7 +177,6 @@ require (
 	github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
-	github.com/mikelolasagasti/xz v1.0.1 // indirect
 	github.com/minio/minlz v1.0.0 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
@@ -214,8 +194,6 @@ require (
 	github.com/ncruces/go-strftime v0.1.9 // indirect
 	github.com/nwaples/rardecode v1.1.3 // indirect
 	github.com/nwaples/rardecode/v2 v2.1.0 // indirect
-	github.com/olekukonko/errors v1.1.0 // indirect
-	github.com/olekukonko/ll v0.0.9 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/opencontainers/runtime-spec v1.1.0 // indirect
 	github.com/opencontainers/selinux v1.11.0 // indirect
@@ -225,7 +203,6 @@ require (
 	github.com/pjbgf/sha1cd v0.3.2 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/profile v1.7.0 // indirect
-	github.com/pkg/xattr v0.4.9 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
@@ -233,14 +210,13 @@ require (
 	github.com/sagikazarmark/locafero v0.7.0 // indirect
 	github.com/sahilm/fuzzy v0.1.1 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
-	github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/skeema/knownhosts v1.3.1 // indirect
 	github.com/sorairolake/lzip-go v0.3.5 // indirect
 	github.com/sourcegraph/conc v0.3.0 // indirect
 	github.com/spf13/cast v1.7.1 // indirect
 	github.com/spf13/pflag v1.0.6 // indirect
 	github.com/spf13/viper v1.20.0 // indirect
-	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/sylabs/sif/v2 v2.21.1 // indirect
 	github.com/sylabs/squashfs v1.0.6 // indirect
@@ -250,47 +226,40 @@ require (
 	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/tidwall/sjson v1.2.5 // indirect
 	github.com/ulikunitz/xz v0.5.12 // indirect
-	github.com/vbatts/tar-split v0.12.1 // indirect
+	github.com/vbatts/tar-split v0.11.6 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	github.com/zclconf/go-cty v1.16.3 // indirect
+	github.com/zclconf/go-cty v1.13.0 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.54.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
-	go.opentelemetry.io/otel v1.36.0 // indirect
-	go.opentelemetry.io/otel/metric v1.36.0 // indirect
-	go.opentelemetry.io/otel/trace v1.36.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
+	go.opentelemetry.io/otel v1.33.0 // indirect
+	go.opentelemetry.io/otel/metric v1.33.0 // indirect
+	go.opentelemetry.io/otel/trace v1.33.0 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
 	go.uber.org/multierr v1.9.0 // indirect
 	go4.org v0.0.0-20230225012048-214862532bf5 // indirect
-	golang.org/x/crypto v0.41.0 // indirect
-	golang.org/x/oauth2 v0.30.0 // indirect
-	golang.org/x/sync v0.16.0 // indirect
-	golang.org/x/sys v0.35.0 // indirect
-	golang.org/x/term v0.34.0 // indirect
-	golang.org/x/text v0.28.0 // indirect
-	golang.org/x/time v0.12.0 // indirect
-	golang.org/x/tools v0.35.0
+	golang.org/x/crypto v0.38.0 // indirect
+	golang.org/x/sync v0.14.0 // indirect
+	golang.org/x/sys v0.33.0 // indirect
+	golang.org/x/term v0.32.0 // indirect
+	golang.org/x/text v0.25.0 // indirect
+	golang.org/x/tools v0.31.0 // indirect
 	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
-	google.golang.org/api v0.203.0 // indirect
 	google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20241113202542-65e8d215514f // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20241223144023-3abc09e42ca8 // indirect
 	google.golang.org/grpc v1.67.3 // indirect
 	google.golang.org/protobuf v1.36.4 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
-	modernc.org/libc v1.66.3 // indirect
+	modernc.org/libc v1.62.1 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
-	modernc.org/memory v1.11.0 // indirect
+	modernc.org/memory v1.9.1 // indirect
 )
 
 retract (
-	v1.25.0 // published with a replace directive (confusing for API users)
 	v0.53.2
-	v0.53.1 // published accidentally with incorrect license in depdencies
+	v0.53.1 // Published accidentally with incorrect license in depdencies
 )

install.sh

@@ -6,8 +6,7 @@ PROJECT_NAME=syft
 OWNER=anchore
 REPO="${PROJECT_NAME}"
 GITHUB_DOWNLOAD_PREFIX=https://github.com/${OWNER}/${REPO}/releases/download
-INSTALL_SH_BASE_URL=https://get.anchore.io/${PROJECT_NAME}
-LEGACY_INSTALL_SH_BASE_URL=https://raw.githubusercontent.com/${OWNER}/${PROJECT_NAME}
+INSTALL_SH_BASE_URL=https://raw.githubusercontent.com/${OWNER}/${PROJECT_NAME}
 PROGRAM_ARGS=$@
 
 # signature verification options
@@ -837,11 +836,7 @@ EOF
   if [ "${DOWNLOAD_TAG_INSTALL_SCRIPT}" = "true" ]; then
       export DOWNLOAD_TAG_INSTALL_SCRIPT=false
       log_info "fetching release script for tag='${tag}'"
-      if ! install_script=$(http_copy "${INSTALL_SH_BASE_URL}/${tag}/install.sh" ""); then
-          log_warn "failed to fetch from ${INSTALL_SH_BASE_URL}, trying fallback URL"
-          install_script=$(http_copy "${LEGACY_INSTALL_SH_BASE_URL}/${tag}/install.sh" "")
-      fi
-      echo "${install_script}" | sh -s -- ${PROGRAM_ARGS}
+      http_copy "${INSTALL_SH_BASE_URL}/${tag}/install.sh" "" | sh -s -- ${PROGRAM_ARGS}
       exit $?
   fi
 

internal/bus/helpers.go

@@ -36,8 +36,8 @@ func Notify(message string) {
 	})
 }
 
-func StartCatalogerTask(info monitor.GenericTask, size int64, initialStage string) *monitor.TaskProgress {
-	t := &monitor.TaskProgress{
+func StartCatalogerTask(info monitor.GenericTask, size int64, initialStage string) *monitor.CatalogerTaskProgress {
+	t := &monitor.CatalogerTaskProgress{
 		AtomicStage: progress.NewAtomicStage(initialStage),
 		Manual:      progress.NewManual(size),
 	}
@@ -50,33 +50,3 @@ func StartCatalogerTask(info monitor.GenericTask, size int64, initialStage strin
 
 	return t
 }
-
-func StartPullSourceTask(info monitor.GenericTask, size int64, initialStage string) *monitor.TaskProgress {
-	t := &monitor.TaskProgress{
-		AtomicStage: progress.NewAtomicStage(initialStage),
-		Manual:      progress.NewManual(size),
-	}
-
-	Publish(partybus.Event{
-		Type:   event.PullSourceStarted,
-		Source: info,
-		Value:  progress.StagedProgressable(t),
-	})
-
-	return t
-}
-
-func StartIndexingFiles(path string) *monitor.TaskProgress {
-	t := &monitor.TaskProgress{
-		AtomicStage: progress.NewAtomicStage(""),
-		Manual:      progress.NewManual(-1),
-	}
-
-	Publish(partybus.Event{
-		Type:   event.FileIndexingStarted,
-		Source: path,
-		Value:  progress.StagedProgressable(t),
-	})
-
-	return t
-}

internal/cmptest/common_options.go

@@ -1,12 +1,9 @@
 package cmptest
 
 import (
-	"strings"
-
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 
-	"github.com/anchore/syft/internal/evidence"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
 )
@@ -32,41 +29,9 @@ func BuildOptions(licenseCmp LicenseComparer, locationCmp LocationComparer) []cm
 		cmpopts.IgnoreFields(pkg.Package{}, "id"), // note: ID is not deterministic for test purposes
 		cmpopts.SortSlices(pkg.Less),
 		cmpopts.SortSlices(DefaultRelationshipComparer),
-		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](locationCmp, locationSorter)),
+		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](locationCmp)),
 		cmp.Comparer(buildSetComparer[pkg.License, pkg.LicenseSet](licenseCmp)),
 		cmp.Comparer(locationCmp),
 		cmp.Comparer(licenseCmp),
 	}
 }
-
-// LocationSorter always sorts by evidence annotations first, then by access path, then by real path.
-// This intentionally does not consider layer details since some test fixtures have no layer information
-// on the left side of the comparison (expected) and does on the right side (actual).
-func locationSorter(a, b file.Location) int {
-	// compare by evidence annotations first...
-	aEvidence := a.Annotations[evidence.AnnotationKey]
-	bEvidence := b.Annotations[evidence.AnnotationKey]
-
-	if aEvidence != bEvidence {
-		if aEvidence == evidence.PrimaryAnnotation {
-			return -1
-		}
-		if bEvidence == evidence.PrimaryAnnotation {
-			return 1
-		}
-
-		if aEvidence > bEvidence {
-			return -1
-		}
-		if bEvidence > aEvidence {
-			return 1
-		}
-	}
-
-	// ...then by paths
-	if a.AccessPath != b.AccessPath {
-		return strings.Compare(a.AccessPath, b.AccessPath)
-	}
-
-	return strings.Compare(a.RealPath, b.RealPath)
-}

internal/cmptest/license.go

@@ -13,7 +13,7 @@ func DefaultLicenseComparer(x, y pkg.License) bool {
 	return cmp.Equal(
 		x, y,
 		cmp.Comparer(DefaultLocationComparer),
-		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](DefaultLocationComparer, locationSorter)),
+		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](DefaultLocationComparer)),
 	)
 }
 
@@ -21,6 +21,6 @@ func LicenseComparerWithoutLocationLayer(x, y pkg.License) bool {
 	return cmp.Equal(
 		x, y,
 		cmp.Comparer(LocationComparerWithoutLayer),
-		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](LocationComparerWithoutLayer, locationSorter)),
+		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](LocationComparerWithoutLayer)),
 	)
 }

internal/cmptest/location.go

@@ -2,7 +2,6 @@ package cmptest
 
 import (
 	"github.com/google/go-cmp/cmp"
-	"github.com/google/go-cmp/cmp/cmpopts"
 
 	"github.com/anchore/syft/syft/file"
 )
@@ -10,7 +9,7 @@ import (
 type LocationComparer func(x, y file.Location) bool
 
 func DefaultLocationComparer(x, y file.Location) bool {
-	return cmp.Equal(x.Coordinates, y.Coordinates, cmpopts.IgnoreUnexported(file.Coordinates{})) && cmp.Equal(x.AccessPath, y.AccessPath)
+	return cmp.Equal(x.Coordinates, y.Coordinates) && cmp.Equal(x.AccessPath, y.AccessPath)
 }
 
 func LocationComparerWithoutLayer(x, y file.Location) bool {

internal/cmptest/set.go

@@ -1,13 +1,13 @@
 package cmptest
 
 type slicer[T any] interface {
-	ToSlice(sorter ...func(a, b T) int) []T
+	ToSlice() []T
 }
 
-func buildSetComparer[T any, S slicer[T]](l func(x, y T) bool, sorters ...func(a, b T) int) func(x, y S) bool {
+func buildSetComparer[T any, S slicer[T]](l func(x, y T) bool) func(x, y S) bool {
 	return func(x, y S) bool {
-		xs := x.ToSlice(sorters...)
-		ys := y.ToSlice(sorters...)
+		xs := x.ToSlice()
+		ys := y.ToSlice()
 
 		if len(xs) != len(ys) {
 			return false

internal/constants.go

@@ -3,5 +3,5 @@ package internal
 const (
 	// JSONSchemaVersion is the current schema version output by the JSON encoder
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "16.0.39"
+	JSONSchemaVersion = "16.0.28"
 )

internal/file/getter.go

@@ -1,154 +0,0 @@
-package file
-
-import (
-	"fmt"
-	"io"
-	"net/http"
-
-	"github.com/hashicorp/go-getter"
-	"github.com/hashicorp/go-getter/helper/url"
-	"github.com/wagoodman/go-progress"
-
-	"github.com/anchore/clio"
-	"github.com/anchore/stereoscope/pkg/file"
-	"github.com/anchore/syft/internal"
-)
-
-var (
-	archiveExtensions   = getterDecompressorNames()
-	ErrNonArchiveSource = fmt.Errorf("non-archive sources are not supported for directory destinations")
-)
-
-type Getter interface {
-	// GetFile downloads the give URL into the given path. The URL must reference a single file.
-	GetFile(dst, src string, monitor ...*progress.Manual) error
-
-	// GetToDir downloads the resource found at the `src` URL into the given `dst` directory.
-	// The directory must already exist, and the remote resource MUST BE AN ARCHIVE (e.g. `.tar.gz`).
-	GetToDir(dst, src string, monitor ...*progress.Manual) error
-}
-
-type HashiGoGetter struct {
-	httpGetter getter.HttpGetter
-}
-
-// NewGetter creates and returns a new Getter. Providing an http.Client is optional. If one is provided,
-// it will be used for all HTTP(S) getting; otherwise, go-getter's default getters will be used.
-func NewGetter(id clio.Identification, httpClient *http.Client) *HashiGoGetter {
-	return &HashiGoGetter{
-		httpGetter: getter.HttpGetter{
-			Client: httpClient,
-			Header: http.Header{
-				"User-Agent": []string{fmt.Sprintf("%v %v", id.Name, id.Version)},
-			},
-		},
-	}
-}
-
-func (g HashiGoGetter) GetFile(dst, src string, monitors ...*progress.Manual) error {
-	if len(monitors) > 1 {
-		return fmt.Errorf("multiple monitors provided, which is not allowed")
-	}
-
-	return getterClient(dst, src, false, g.httpGetter, monitors).Get()
-}
-
-func (g HashiGoGetter) GetToDir(dst, src string, monitors ...*progress.Manual) error {
-	// though there are multiple getters, only the http/https getter requires extra validation
-	if err := validateHTTPSource(src); err != nil {
-		return err
-	}
-	if len(monitors) > 1 {
-		return fmt.Errorf("multiple monitors provided, which is not allowed")
-	}
-
-	return getterClient(dst, src, true, g.httpGetter, monitors).Get()
-}
-
-func validateHTTPSource(src string) error {
-	// we are ignoring any sources that are not destined to use the http getter object
-	if !internal.HasAnyOfPrefixes(src, "http://", "https://") {
-		return nil
-	}
-
-	u, err := url.Parse(src)
-	if err != nil {
-		return fmt.Errorf("bad URL provided %q: %w", src, err)
-	}
-	// only allow for sources with archive extensions
-	if !internal.HasAnyOfSuffixes(u.Path, archiveExtensions...) {
-		return ErrNonArchiveSource
-	}
-	return nil
-}
-
-func getterClient(dst, src string, dir bool, httpGetter getter.HttpGetter, monitors []*progress.Manual) *getter.Client {
-	client := &getter.Client{
-		Src: src,
-		Dst: dst,
-		Dir: dir,
-		Getters: map[string]getter.Getter{
-			"http":  &httpGetter,
-			"https": &httpGetter,
-			// note: these are the default getters from https://github.com/hashicorp/go-getter/blob/v1.5.9/get.go#L68-L74
-			// it is possible that other implementations need to account for custom httpclient injection, however,
-			// that has not been accounted for at this time.
-			"file": new(getter.FileGetter),
-			"git":  new(getter.GitGetter),
-			"gcs":  new(getter.GCSGetter),
-			"hg":   new(getter.HgGetter),
-			"s3":   new(getter.S3Getter),
-		},
-		Options: mapToGetterClientOptions(monitors),
-	}
-
-	return client
-}
-
-func withProgress(monitor *progress.Manual) func(client *getter.Client) error {
-	return getter.WithProgress(
-		&progressAdapter{monitor: monitor},
-	)
-}
-
-func mapToGetterClientOptions(monitors []*progress.Manual) []getter.ClientOption {
-	var result []getter.ClientOption
-
-	for _, monitor := range monitors {
-		result = append(result, withProgress(monitor))
-	}
-
-	// derived from https://github.com/hashicorp/go-getter/blob/v2.2.3/decompress.go#L23-L63
-	fileSizeLimit := int64(5 * file.GB)
-
-	dec := getter.LimitedDecompressors(0, fileSizeLimit)
-
-	result = append(result, getter.WithDecompressors(dec))
-
-	return result
-}
-
-type readCloser struct {
-	progress.Reader
-}
-
-func (c *readCloser) Close() error { return nil }
-
-type progressAdapter struct {
-	monitor *progress.Manual
-}
-
-func (a *progressAdapter) TrackProgress(_ string, currentSize, totalSize int64, stream io.ReadCloser) io.ReadCloser {
-	a.monitor.Set(currentSize)
-	a.monitor.SetTotal(totalSize)
-	return &readCloser{
-		Reader: *progress.NewProxyReader(stream, a.monitor),
-	}
-}
-
-func getterDecompressorNames() (names []string) {
-	for name := range getter.Decompressors {
-		names = append(names, name)
-	}
-	return names
-}

internal/file/getter_test.go

@@ -1,268 +0,0 @@
-package file
-
-import (
-	"archive/tar"
-	"bytes"
-	"context"
-	"crypto/x509"
-	"fmt"
-	"net"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"path"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-
-	"github.com/anchore/clio"
-)
-
-func TestGetter_GetFile(t *testing.T) {
-	testCases := []struct {
-		name          string
-		prepareClient func(*http.Client)
-		assert        assert.ErrorAssertionFunc
-	}{
-		{
-			name:   "client trusts server's CA",
-			assert: assert.NoError,
-		},
-		{
-			name:          "client doesn't trust server's CA",
-			prepareClient: removeTrustedCAs,
-			assert:        assertUnknownAuthorityError,
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			requestPath := "/foo"
-
-			server := newTestServer(t, withResponseForPath(t, requestPath, testFileContent))
-			t.Cleanup(server.Close)
-
-			httpClient := getClient(t, server)
-			if tc.prepareClient != nil {
-				tc.prepareClient(httpClient)
-			}
-
-			getter := NewGetter(testID, httpClient)
-			requestURL := createRequestURL(t, server, requestPath)
-
-			tempDir := t.TempDir()
-			tempFile := path.Join(tempDir, "some-destination-file")
-
-			err := getter.GetFile(tempFile, requestURL)
-			tc.assert(t, err)
-		})
-	}
-}
-
-func TestGetter_GetToDir_FilterNonArchivesWired(t *testing.T) {
-	testCases := []struct {
-		name   string
-		source string
-		assert assert.ErrorAssertionFunc
-	}{
-		{
-			name:   "error out on non-archive sources",
-			source: "http://localhost/something.txt",
-			assert: assertErrNonArchiveSource,
-		},
-	}
-
-	for _, test := range testCases {
-		t.Run(test.name, func(t *testing.T) {
-			test.assert(t, NewGetter(testID, nil).GetToDir(t.TempDir(), test.source))
-		})
-	}
-}
-
-func TestGetter_validateHttpSource(t *testing.T) {
-	testCases := []struct {
-		name   string
-		source string
-		assert assert.ErrorAssertionFunc
-	}{
-		{
-			name:   "error out on non-archive sources",
-			source: "http://localhost/something.txt",
-			assert: assertErrNonArchiveSource,
-		},
-		{
-			name:   "filter out non-archive sources with get param",
-			source: "https://localhost/vulnerability-db_v3_2021-11-21T08:15:44Z.txt?checksum=sha256%3Ac402d01fa909a3fa85a5c6733ef27a3a51a9105b6c62b9152adbd24c08358911",
-			assert: assertErrNonArchiveSource,
-		},
-		{
-			name:   "ignore non http-https input",
-			source: "s3://bucket/something.txt",
-			assert: assert.NoError,
-		},
-	}
-
-	for _, test := range testCases {
-		t.Run(test.name, func(t *testing.T) {
-			test.assert(t, validateHTTPSource(test.source))
-		})
-	}
-}
-
-func TestGetter_GetToDir_CertConcerns(t *testing.T) {
-	testCases := []struct {
-		name          string
-		prepareClient func(*http.Client)
-		assert        assert.ErrorAssertionFunc
-	}{
-
-		{
-			name:   "client trusts server's CA",
-			assert: assert.NoError,
-		},
-		{
-			name:          "client doesn't trust server's CA",
-			prepareClient: removeTrustedCAs,
-			assert:        assertUnknownAuthorityError,
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			requestPath := "/foo.tar"
-			tarball := createTarball("foo", testFileContent)
-
-			server := newTestServer(t, withResponseForPath(t, requestPath, tarball))
-			t.Cleanup(server.Close)
-
-			httpClient := getClient(t, server)
-			if tc.prepareClient != nil {
-				tc.prepareClient(httpClient)
-			}
-
-			getter := NewGetter(testID, httpClient)
-			requestURL := createRequestURL(t, server, requestPath)
-
-			tempDir := t.TempDir()
-
-			err := getter.GetToDir(tempDir, requestURL)
-			tc.assert(t, err)
-		})
-	}
-}
-
-func assertUnknownAuthorityError(t assert.TestingT, err error, _ ...interface{}) bool {
-	return assert.ErrorAs(t, err, &x509.UnknownAuthorityError{})
-}
-
-func assertErrNonArchiveSource(t assert.TestingT, err error, _ ...interface{}) bool {
-	return assert.ErrorIs(t, err, ErrNonArchiveSource)
-}
-
-func removeTrustedCAs(client *http.Client) {
-	client.Transport.(*http.Transport).TLSClientConfig.RootCAs = x509.NewCertPool()
-}
-
-// createTarball makes a single-file tarball and returns it as a byte slice.
-func createTarball(filename string, content []byte) []byte {
-	tarBuffer := new(bytes.Buffer)
-	tarWriter := tar.NewWriter(tarBuffer)
-	tarWriter.WriteHeader(&tar.Header{
-		Name: filename,
-		Size: int64(len(content)),
-		Mode: 0600,
-	})
-	tarWriter.Write(content)
-	tarWriter.Close()
-
-	return tarBuffer.Bytes()
-}
-
-type muxOption func(mux *http.ServeMux)
-
-func withResponseForPath(t *testing.T, path string, response []byte) muxOption {
-	t.Helper()
-
-	return func(mux *http.ServeMux) {
-		mux.HandleFunc(path, func(w http.ResponseWriter, req *http.Request) {
-			t.Logf("server handling request: %s %s", req.Method, req.URL)
-
-			_, err := w.Write(response)
-			if err != nil {
-				t.Fatal(err)
-			}
-		})
-	}
-}
-
-var testID = clio.Identification{
-	Name:    "test-app",
-	Version: "v0.5.3",
-}
-
-func newTestServer(t *testing.T, muxOptions ...muxOption) *httptest.Server {
-	t.Helper()
-
-	mux := http.NewServeMux()
-	for _, option := range muxOptions {
-		option(mux)
-	}
-
-	server := httptest.NewTLSServer(mux)
-	t.Logf("new TLS server listening at %s", getHost(t, server))
-
-	return server
-}
-
-func createRequestURL(t *testing.T, server *httptest.Server, path string) string {
-	t.Helper()
-
-	// TODO: Figure out how to get this value from the server without hardcoding it here
-	const testServerCertificateName = "example.com"
-
-	serverURL, err := url.Parse(server.URL)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// Set URL hostname to value from TLS certificate
-	serverURL.Host = fmt.Sprintf("%s:%s", testServerCertificateName, serverURL.Port())
-
-	serverURL.Path = path
-
-	return serverURL.String()
-}
-
-// getClient returns an http.Client that can be used to contact the test TLS server.
-func getClient(t *testing.T, server *httptest.Server) *http.Client {
-	t.Helper()
-
-	httpClient := server.Client()
-	transport := httpClient.Transport.(*http.Transport)
-
-	serverHost := getHost(t, server)
-
-	transport.DialContext = func(_ context.Context, _, addr string) (net.Conn, error) {
-		t.Logf("client dialing %q for host %q", serverHost, addr)
-
-		// Ensure the client dials our test server
-		return net.Dial("tcp", serverHost)
-	}
-
-	return httpClient
-}
-
-// getHost extracts the host value from a server URL string.
-// e.g. given a server with URL "http://1.2.3.4:5000/foo", getHost returns "1.2.3.4:5000"
-func getHost(t *testing.T, server *httptest.Server) string {
-	t.Helper()
-
-	u, err := url.Parse(server.URL)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	return u.Hostname() + ":" + u.Port()
-}
-
-var testFileContent = []byte("This is the content of a test file!\n")

internal/file/squashfs.go

@@ -1,89 +0,0 @@
-package file
-
-import (
-	"errors"
-	"io/fs"
-	"os"
-	"path/filepath"
-
-	"github.com/diskfs/go-diskfs/filesystem"
-)
-
-type WalkDiskDirFunc func(fsys filesystem.FileSystem, path string, d os.FileInfo, err error) error
-
-// WalkDiskDir walks the file tree within the go-diskfs filesystem at root, calling fn for each file or directory in the tree, including root.
-// This is meant to mimic the behavior of fs.WalkDir in the standard library.
-func WalkDiskDir(fsys filesystem.FileSystem, root string, fn WalkDiskDirFunc) error {
-	infos, err := fsys.ReadDir(root)
-
-	if err != nil {
-		return err
-	}
-
-	if len(infos) == 0 {
-		return nil
-	}
-
-	for _, info := range infos {
-		p := filepath.Join(root, info.Name())
-		err = walkDiskDir(fsys, p, info, fn)
-		if err != nil {
-			if errors.Is(err, fs.SkipDir) {
-				continue
-			}
-			if errors.Is(err, fs.SkipAll) {
-				return nil
-			}
-			return err
-		}
-	}
-
-	return err
-}
-
-func walkDiskDir(fsys filesystem.FileSystem, name string, d os.FileInfo, walkDirFn WalkDiskDirFunc) error {
-	if err := walkDirFn(fsys, name, d, nil); err != nil {
-		if errors.Is(err, fs.SkipDir) && (d == nil || d.IsDir()) {
-			return nil
-		}
-		return err
-	}
-
-	isDir := d != nil && d.IsDir()
-	if d == nil {
-		_, err := fsys.ReadDir(name)
-		if err != nil {
-			return nil
-		}
-		isDir = true
-	}
-
-	if !isDir {
-		return nil
-	}
-
-	dirs, err := fsys.ReadDir(name)
-	if err != nil {
-		err = walkDirFn(fsys, name, d, err)
-		if err != nil {
-			if errors.Is(err, fs.SkipDir) {
-				return nil
-			}
-			return err
-		}
-	}
-
-	for _, d1 := range dirs {
-		name1 := filepath.Join(name, d1.Name())
-		if err := walkDiskDir(fsys, name1, d1, walkDirFn); err != nil {
-			if errors.Is(err, fs.SkipDir) {
-				break
-			}
-			if errors.Is(err, fs.SkipAll) {
-				return err
-			}
-			return err
-		}
-	}
-	return nil
-}

internal/file/squashfs_test.go

@@ -1,250 +0,0 @@
-package file
-
-import (
-	"io/fs"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/diskfs/go-diskfs/backend/file"
-	"github.com/diskfs/go-diskfs/filesystem"
-	"github.com/diskfs/go-diskfs/filesystem/squashfs"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func createTestFS(t *testing.T) filesystem.FileSystem {
-	dir := t.TempDir()
-
-	filename := "test.squashfs"
-	f, err := os.Create(filepath.Join(dir, filename))
-	require.NoError(t, err)
-
-	b := file.New(f, false)
-	fsys, err := squashfs.Create(b, 0, 0, 4096)
-	require.NoError(t, err)
-
-	testFiles := []struct {
-		path    string
-		content string
-		isDir   bool
-	}{
-		{"/file1.txt", "content of file1", false},
-		{"/file2.txt", "content of file2", false},
-		{"/dir1", "", true},
-		{"/dir1/subfile1.txt", "content of subfile1", false},
-		{"/dir1/subfile2.txt", "content of subfile2", false},
-		{"/dir1/subdir1", "", true},
-		{"/dir1/subdir1/deepfile.txt", "deep content", false},
-		{"/dir2", "", true},
-		{"/dir2/anotherfile.txt", "another content", false},
-		{"/emptydir", "", true},
-	}
-
-	for _, tf := range testFiles {
-		if tf.isDir {
-			err := fsys.Mkdir(tf.path)
-			require.NoError(t, err)
-		} else {
-			f, err := fsys.OpenFile(tf.path, os.O_CREATE|os.O_RDWR)
-			require.NoError(t, err)
-			_, err = f.Write([]byte(tf.content))
-			require.NoError(t, err)
-			f.Close()
-		}
-	}
-
-	return fsys
-}
-
-func TestWalkDiskDir_CompleteTraversal(t *testing.T) {
-	fsys := createTestFS(t)
-
-	var visitedPaths []string
-	err := WalkDiskDir(fsys, "/", func(fsys filesystem.FileSystem, path string, d os.FileInfo, err error) error {
-		require.NoError(t, err)
-		visitedPaths = append(visitedPaths, path)
-		return nil
-	})
-
-	require.NoError(t, err)
-
-	expectedPaths := []string{
-		"/file1.txt",
-		"/file2.txt",
-		"/dir1",
-		"/dir1/subfile1.txt",
-		"/dir1/subfile2.txt",
-		"/dir1/subdir1",
-		"/dir1/subdir1/deepfile.txt",
-		"/dir2",
-		"/dir2/anotherfile.txt",
-		"/emptydir",
-	}
-
-	assert.ElementsMatch(t, expectedPaths, visitedPaths)
-}
-
-func TestWalkDiskDir_FileInfoCorrect(t *testing.T) {
-	fsys := createTestFS(t)
-
-	var fileInfos []struct {
-		path  string
-		isDir bool
-		name  string
-	}
-
-	err := WalkDiskDir(fsys, "/", func(fsys filesystem.FileSystem, path string, d os.FileInfo, err error) error {
-		require.NoError(t, err)
-		require.NotNil(t, d)
-		fileInfos = append(fileInfos, struct {
-			path  string
-			isDir bool
-			name  string
-		}{
-			path:  path,
-			isDir: d.IsDir(),
-			name:  d.Name(),
-		})
-		return nil
-	})
-
-	require.NoError(t, err)
-
-	for _, fi := range fileInfos {
-		expectedName := filepath.Base(fi.path)
-		assert.Equal(t, expectedName, fi.name)
-
-		if fi.path == "/dir1" || fi.path == "/dir2" || fi.path == "/emptydir" || fi.path == "/dir1/subdir1" {
-			assert.True(t, fi.isDir, "Expected %s to be directory", fi.path)
-		} else {
-			assert.False(t, fi.isDir, "Expected %s to be file", fi.path)
-		}
-	}
-}
-
-func TestWalkDiskDir_SkipDir(t *testing.T) {
-	fsys := createTestFS(t)
-
-	var visitedPaths []string
-	err := WalkDiskDir(fsys, "/", func(fsys filesystem.FileSystem, path string, d os.FileInfo, err error) error {
-		require.NoError(t, err)
-		visitedPaths = append(visitedPaths, path)
-		if path == "/dir1" {
-			return fs.SkipDir
-		}
-		return nil
-	})
-
-	require.NoError(t, err)
-
-	assert.Contains(t, visitedPaths, "/dir1")
-	assert.NotContains(t, visitedPaths, "/dir1/subfile1.txt")
-	assert.NotContains(t, visitedPaths, "/dir1/subfile2.txt")
-	assert.NotContains(t, visitedPaths, "/dir1/subdir1")
-	assert.NotContains(t, visitedPaths, "/dir1/subdir1/deepfile.txt")
-
-	assert.Contains(t, visitedPaths, "/dir2")
-	assert.Contains(t, visitedPaths, "/dir2/anotherfile.txt")
-}
-
-func TestWalkDiskDir_SkipAll(t *testing.T) {
-	fsys := createTestFS(t)
-
-	var visitedPaths []string
-	err := WalkDiskDir(fsys, "/", func(fsys filesystem.FileSystem, path string, d os.FileInfo, err error) error {
-		require.NoError(t, err)
-		visitedPaths = append(visitedPaths, path)
-		if path == "/dir1" {
-			return fs.SkipAll
-		}
-		return nil
-	})
-
-	require.NoError(t, err)
-
-	assert.Contains(t, visitedPaths, "/dir1")
-
-	assert.NotContains(t, visitedPaths, "/file1.txt")
-	assert.NotContains(t, visitedPaths, "/file2.txt")
-	assert.NotContains(t, visitedPaths, "/dir1/subfile1.txt")
-	assert.NotContains(t, visitedPaths, "/dir2")
-	assert.NotContains(t, visitedPaths, "/dir2/anotherfile.txt")
-	assert.NotContains(t, visitedPaths, "/emptydir")
-}
-
-func TestWalkDiskDir_EmptyDirectory(t *testing.T) {
-	fs := createTestFS(t)
-
-	var visitedPaths []string
-	err := WalkDiskDir(fs, "/emptydir", func(fsys filesystem.FileSystem, path string, d os.FileInfo, err error) error {
-		require.NoError(t, err)
-		visitedPaths = append(visitedPaths, path)
-		return nil
-	})
-
-	require.NoError(t, err)
-	assert.Empty(t, visitedPaths)
-}
-
-func TestWalkDiskDir_NonexistentPath(t *testing.T) {
-	fs := createTestFS(t)
-
-	err := WalkDiskDir(fs, "/nonexistent", func(fsys filesystem.FileSystem, path string, d os.FileInfo, err error) error {
-		return nil
-	})
-
-	assert.Error(t, err)
-}
-
-func TestWalkDiskDir_WalkFunctionError(t *testing.T) {
-	fs := createTestFS(t)
-
-	customErr := assert.AnError
-	err := WalkDiskDir(fs, "/", func(fsys filesystem.FileSystem, path string, d os.FileInfo, err error) error {
-		if path == "/file1.txt" {
-			return customErr
-		}
-		return nil
-	})
-
-	assert.Error(t, err)
-	assert.Equal(t, customErr, err)
-}
-
-func TestWalkDiskDir_SubdirectoryTraversal(t *testing.T) {
-	fs := createTestFS(t)
-
-	var visitedPaths []string
-	err := WalkDiskDir(fs, "/dir1", func(fsys filesystem.FileSystem, path string, d os.FileInfo, err error) error {
-		require.NoError(t, err)
-		visitedPaths = append(visitedPaths, path)
-		return nil
-	})
-
-	require.NoError(t, err)
-
-	expectedPaths := []string{
-		"/dir1/subfile1.txt",
-		"/dir1/subfile2.txt",
-		"/dir1/subdir1",
-		"/dir1/subdir1/deepfile.txt",
-	}
-
-	assert.ElementsMatch(t, expectedPaths, visitedPaths)
-}
-
-func TestWalkDiskDir_SingleFile(t *testing.T) {
-	fs := createTestFS(t)
-
-	var visitedPaths []string
-	err := WalkDiskDir(fs, "/file1.txt", func(fsys filesystem.FileSystem, path string, d os.FileInfo, err error) error {
-		require.NoError(t, err)
-		visitedPaths = append(visitedPaths, path)
-		return nil
-	})
-
-	// we are providing a file path, not a directory
-	require.Error(t, err)
-	assert.Empty(t, visitedPaths)
-}

internal/licenses/context_test.go

@@ -8,7 +8,7 @@ import (
 )
 
 func TestSetContextLicenseScanner(t *testing.T) {
-	scanner := testScanner()
+	scanner := testScanner(true)
 	ctx := context.Background()
 	ctx = SetContextLicenseScanner(ctx, scanner)
 
@@ -20,7 +20,7 @@ func TestSetContextLicenseScanner(t *testing.T) {
 }
 
 func TestIsContextLicenseScannerSet(t *testing.T) {
-	scanner := testScanner()
+	scanner := testScanner(true)
 	ctx := context.Background()
 	require.False(t, IsContextLicenseScannerSet(ctx))
 
@@ -30,7 +30,7 @@ func TestIsContextLicenseScannerSet(t *testing.T) {
 
 func TestContextLicenseScanner(t *testing.T) {
 	t.Run("with scanner", func(t *testing.T) {
-		scanner := testScanner()
+		scanner := testScanner(true)
 		ctx := SetContextLicenseScanner(context.Background(), scanner)
 		s, err := ContextLicenseScanner(ctx)
 		if err != nil || s != scanner {

internal/licenses/find_evidence.go

@@ -1,36 +0,0 @@
-package licenses
-
-import (
-	"context"
-	"io"
-)
-
-func (s *scanner) FindEvidence(_ context.Context, reader io.Reader) (evidence []Evidence, content []byte, err error) {
-	if s.scanner == nil {
-		return nil, nil, nil
-	}
-
-	content, err = io.ReadAll(reader)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	cov := s.scanner(content)
-	if cov.Percent < s.coverageThreshold {
-		// unknown or no licenses here
-		// => check return content to Search to process
-		return nil, content, nil
-	}
-
-	evidence = make([]Evidence, 0)
-	for _, m := range cov.Match {
-		evidence = append(evidence, Evidence{
-			ID:    m.ID,
-			Type:  m.Type,
-			Start: m.Start,
-			End:   m.End,
-			IsURL: m.IsURL,
-		})
-	}
-	return evidence, content, nil
-}

internal/licenses/find_evidence_test.go

@@ -1,81 +0,0 @@
-package licenses
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/google/licensecheck"
-	"github.com/stretchr/testify/require"
-)
-
-func TestDefaultScanner_FindEvidence(t *testing.T) {
-	testCases := []struct {
-		name     string
-		fixture  string
-		wantIDs  []string // expected license IDs
-		minMatch int      // minimum # of matches required
-	}{
-		{
-			name:     "Single licenses are able to be recognized and returned Apache 2.0",
-			fixture:  "test-fixtures/apache-license-2.0",
-			wantIDs:  []string{"Apache-2.0"},
-			minMatch: 1,
-		},
-		{
-			name:    "Multiple Licenses are returned as evidence with duplicates at different offset",
-			fixture: "test-fixtures/multi-license",
-			wantIDs: []string{
-				"MIT",
-				"MIT",
-				"NCSA",
-				"Apache-2.0",
-				"Zlib",
-				"Unlicense",
-				"BSD-2-Clause",
-				"BSD-2-Clause",
-				"BSD-3-Clause",
-			},
-			minMatch: 2,
-		},
-	}
-
-	scanner := testScanner()
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			filePath := filepath.Clean(tc.fixture)
-			f, err := os.Open(filePath)
-			require.NoError(t, err)
-			defer f.Close()
-
-			evidence, content, err := scanner.FindEvidence(context.Background(), f)
-			require.NoError(t, err)
-			require.NotEmpty(t, content)
-			require.GreaterOrEqual(t, len(evidence), tc.minMatch, "expected at least %d matches", tc.minMatch)
-
-			var foundIDs []string
-			for _, ev := range evidence {
-				foundIDs = append(foundIDs, ev.ID)
-			}
-
-			require.ElementsMatch(t, tc.wantIDs, foundIDs, "expected license IDs %v, but got %v", tc.wantIDs, foundIDs)
-		})
-	}
-}
-
-func testScanner() Scanner {
-	return &scanner{
-		coverageThreshold: DefaultCoverageThreshold,
-		scanner:           licensecheck.Scan,
-	}
-}
-
-func mustOpen(fixture string) []byte {
-	content, err := os.ReadFile(fixture)
-	if err != nil {
-		panic(err)
-	}
-
-	return content
-}

internal/licenses/scanner.go

@@ -8,37 +8,33 @@ import (
 	"github.com/google/licensecheck"
 
 	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
 )
 
 const (
-	UnknownLicensePrefix     = unknownLicenseType + "_"
-	DefaultCoverageThreshold = 75 // determined by experimentation
-
-	unknownLicenseType = "UNKNOWN"
+	DefaultCoverageThreshold     = 75 // determined by experimentation
+	DefaultIncludeLicenseContent = false
 )
 
-type Evidence struct {
-	ID    string            // License identifier. (See licenses/README.md.)
-	Type  licensecheck.Type // The type of the license: BSD, MIT, etc.
-	Start int               // Start offset of match in text; match is at text[Start:End].
-	End   int               // End offset of match in text.
-	IsURL bool              // Whether match is a URL.
-}
-
 type Scanner interface {
-	FindEvidence(context.Context, io.Reader) ([]Evidence, []byte, error)
+	IdentifyLicenseIDs(context.Context, io.Reader) ([]string, []byte, error)
+	FileSearch(context.Context, file.LocationReadCloser) ([]file.License, error)
+	PkgSearch(context.Context, file.LocationReadCloser) ([]pkg.License, error)
 }
 
 var _ Scanner = (*scanner)(nil)
 
 type scanner struct {
-	coverageThreshold float64 // between 0 and 100
-	scanner           func([]byte) licensecheck.Coverage
+	coverageThreshold     float64 // between 0 and 100
+	includeLicenseContent bool
+	scanner               func([]byte) licensecheck.Coverage
 }
 
 type ScannerConfig struct {
-	CoverageThreshold float64
-	Scanner           func([]byte) licensecheck.Coverage
+	CoverageThreshold     float64
+	IncludeLicenseContent bool
+	Scanner               func([]byte) licensecheck.Coverage
 }
 
 type Option func(*scanner)
@@ -49,6 +45,12 @@ func WithCoverage(coverage float64) Option {
 	}
 }
 
+func WithIncludeLicenseContent(includeLicenseContent bool) Option {
+	return func(s *scanner) {
+		s.includeLicenseContent = includeLicenseContent
+	}
+}
+
 // NewDefaultScanner returns a scanner that uses a new instance of the default licensecheck package scanner.
 func NewDefaultScanner(o ...Option) (Scanner, error) {
 	s, err := licensecheck.NewScanner(licensecheck.BuiltinLicenses())
@@ -56,10 +58,10 @@ func NewDefaultScanner(o ...Option) (Scanner, error) {
 		log.WithFields("error", err).Trace("unable to create default license scanner")
 		return nil, fmt.Errorf("unable to create default license scanner: %w", err)
 	}
-
 	newScanner := &scanner{
-		coverageThreshold: DefaultCoverageThreshold,
-		scanner:           s.Scan,
+		coverageThreshold:     DefaultCoverageThreshold,
+		includeLicenseContent: DefaultIncludeLicenseContent,
+		scanner:               s.Scan,
 	}
 
 	for _, opt := range o {
@@ -76,7 +78,8 @@ func NewScanner(c *ScannerConfig) (Scanner, error) {
 	}
 
 	return &scanner{
-		coverageThreshold: c.CoverageThreshold,
-		scanner:           c.Scanner,
+		coverageThreshold:     c.CoverageThreshold,
+		includeLicenseContent: c.IncludeLicenseContent,
+		scanner:               c.Scanner,
 	}, nil
 }

internal/licenses/scanner_test.go

@@ -0,0 +1,84 @@
+package licenses
+
+import (
+	"bytes"
+	"context"
+	"os"
+	"testing"
+
+	"github.com/google/licensecheck"
+	"github.com/stretchr/testify/require"
+)
+
+func TestIdentifyLicenseIDs(t *testing.T) {
+	type expectation struct {
+		yieldError bool
+		ids        []string
+		content    []byte
+	}
+	tests := []struct {
+		name     string
+		in       string
+		expected expectation
+	}{
+		{
+			name: "apache license 2.0",
+			in:   `test-fixtures/apache-license-2.0`,
+			expected: expectation{
+				yieldError: false,
+				ids:        []string{"Apache-2.0"},
+				content:    nil,
+			},
+		},
+		{
+			name: "custom license includes content for IdentifyLicenseIDs",
+			in:   "test-fixtures/nvidia-software-and-cuda-supplement",
+			expected: expectation{
+				yieldError: false,
+				ids:        []string{},
+				content:    mustOpen("test-fixtures/nvidia-software-and-cuda-supplement"),
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			content, err := os.ReadFile(test.in)
+			require.NoError(t, err)
+			ids, content, err := testScanner(false).IdentifyLicenseIDs(context.TODO(), bytes.NewReader(content))
+			if test.expected.yieldError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+
+				require.Len(t, ids, len(test.expected.ids))
+				require.Len(t, content, len(test.expected.content))
+
+				if len(test.expected.ids) > 0 {
+					require.Equal(t, ids, test.expected.ids)
+				}
+
+				if len(test.expected.content) > 0 {
+					require.Equal(t, content, test.expected.content)
+				}
+			}
+		})
+	}
+}
+
+func testScanner(includeLicenseContent bool) Scanner {
+	return &scanner{
+		coverageThreshold:     DefaultCoverageThreshold,
+		includeLicenseContent: includeLicenseContent,
+		scanner:               licensecheck.Scan,
+	}
+}
+
+func mustOpen(fixture string) []byte {
+	content, err := os.ReadFile(fixture)
+	if err != nil {
+		panic(err)
+	}
+
+	return content
+}

internal/licenses/search.go

@@ -0,0 +1,123 @@
+package licenses
+
+import (
+	"context"
+	"crypto/sha256"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/license"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+const (
+	unknownLicenseType   = "UNKNOWN"
+	UnknownLicensePrefix = unknownLicenseType + "_"
+)
+
+func getCustomLicenseContentHash(contents []byte) string {
+	hash := sha256.Sum256(contents)
+	return fmt.Sprintf("%x", hash[:])
+}
+
+func (s *scanner) IdentifyLicenseIDs(_ context.Context, reader io.Reader) ([]string, []byte, error) {
+	if s.scanner == nil {
+		return nil, nil, nil
+	}
+
+	content, err := io.ReadAll(reader)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	cov := s.scanner(content)
+	if cov.Percent < s.coverageThreshold {
+		// unknown or no licenses here
+		// => check return content to Search to process
+		return nil, content, nil
+	}
+
+	var ids []string
+	for _, m := range cov.Match {
+		ids = append(ids, m.ID)
+	}
+	return ids, nil, nil
+}
+
+// PkgSearch scans the contents of a license file to attempt to determine the type of license it is
+func (s *scanner) PkgSearch(ctx context.Context, reader file.LocationReadCloser) (licenses []pkg.License, err error) {
+	licenses = make([]pkg.License, 0)
+
+	ids, content, err := s.IdentifyLicenseIDs(ctx, reader)
+	if err != nil {
+		return nil, err
+	}
+
+	// IdentifyLicenseIDs can only return a list of ID or content
+	// These return values are mutually exclusive.
+	// If the scanner threshold for matching scores < 75% then we return the license full content
+	if len(ids) > 0 {
+		for _, id := range ids {
+			lic := pkg.NewLicenseFromLocations(id, reader.Location)
+			lic.Type = license.Concluded
+
+			licenses = append(licenses, lic)
+		}
+	} else if len(content) > 0 {
+		// harmonize line endings to unix compatible first:
+		// 1. \r\n => \n   (Windows   => UNIX)
+		// 2. \r   => \n   (Macintosh => UNIX)
+		content = []byte(strings.ReplaceAll(strings.ReplaceAll(string(content), "\r\n", "\n"), "\r", "\n"))
+
+		lic := pkg.NewLicenseFromLocations(unknownLicenseType, reader.Location)
+		lic.SPDXExpression = UnknownLicensePrefix + getCustomLicenseContentHash(content)
+		if s.includeLicenseContent {
+			lic.Contents = string(content)
+		}
+		lic.Type = license.Declared
+
+		licenses = append(licenses, lic)
+	}
+
+	return licenses, nil
+}
+
+// FileSearch scans the contents of a license file to attempt to determine the type of license it is
+func (s *scanner) FileSearch(ctx context.Context, reader file.LocationReadCloser) (licenses []file.License, err error) {
+	licenses = make([]file.License, 0)
+
+	ids, content, err := s.IdentifyLicenseIDs(ctx, reader)
+	if err != nil {
+		return nil, err
+	}
+
+	// IdentifyLicenseIDs can only return a list of ID or content
+	// These return values are mutually exclusive.
+	// If the scanner threshold for matching scores < 75% then we return the license full content
+	if len(ids) > 0 {
+		for _, id := range ids {
+			lic := file.NewLicense(id)
+			lic.Type = license.Concluded
+
+			licenses = append(licenses, lic)
+		}
+	} else if len(content) > 0 {
+		// harmonize line endings to unix compatible first:
+		// 1. \r\n => \n   (Windows   => UNIX)
+		// 2. \r   => \n   (Macintosh => UNIX)
+		content = []byte(strings.ReplaceAll(strings.ReplaceAll(string(content), "\r\n", "\n"), "\r", "\n"))
+
+		lic := file.NewLicense(unknownLicenseType)
+		lic.SPDXExpression = UnknownLicensePrefix + getCustomLicenseContentHash(content)
+		if s.includeLicenseContent {
+			lic.Contents = string(content)
+		}
+		lic.Type = license.Declared
+
+		licenses = append(licenses, lic)
+	}
+
+	return licenses, nil
+}

internal/licenses/search_test.go

@@ -0,0 +1,166 @@
+package licenses
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+type bytesReadCloser struct {
+	bytes.Buffer
+}
+
+func (brc *bytesReadCloser) Close() error {
+	return nil
+}
+
+func newBytesReadCloser(data []byte) *bytesReadCloser {
+	return &bytesReadCloser{
+		Buffer: *bytes.NewBuffer(data),
+	}
+}
+
+func TestSearchFileLicenses(t *testing.T) {
+	type expectation struct {
+		yieldError bool
+		licenses   []file.License
+	}
+
+	tests := []struct {
+		name                        string
+		in                          string
+		includeUnkownLicenseContent bool
+		expected                    expectation
+	}{
+		{
+			name: "apache license 2.0",
+			in:   "test-fixtures/apache-license-2.0",
+			expected: expectation{
+				yieldError: false,
+				licenses: []file.License{
+					{
+						Value:          "Apache-2.0",
+						SPDXExpression: "Apache-2.0",
+						Type:           "concluded",
+					},
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			ctx := context.TODO()
+			content, err := os.ReadFile(test.in)
+			require.NoError(t, err)
+			s := testScanner(false)
+			result, err := s.FileSearch(ctx, file.NewLocationReadCloser(file.NewLocation("LICENSE"), io.NopCloser(bytes.NewReader(content))))
+			if test.expected.yieldError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+
+				require.Len(t, result, len(test.expected.licenses))
+
+				if len(test.expected.licenses) > 0 {
+					require.Equal(t, test.expected.licenses, result)
+				}
+			}
+		})
+	}
+}
+
+func TestSearchPkgLicenses(t *testing.T) {
+	type expectation struct {
+		wantErr  require.ErrorAssertionFunc
+		licenses []pkg.License
+	}
+
+	testLocation := file.NewLocation("LICENSE")
+	tests := []struct {
+		name                        string
+		in                          string
+		includeUnkownLicenseContent bool
+		expected                    expectation
+	}{
+		{
+			name: "apache license 2.0",
+			in:   "test-fixtures/apache-license-2.0",
+			expected: expectation{
+				licenses: []pkg.License{
+					{
+						Value:          "Apache-2.0",
+						SPDXExpression: "Apache-2.0",
+						Type:           "concluded",
+						URLs:           nil,
+						Locations:      file.NewLocationSet(testLocation),
+						Contents:       "",
+					},
+				},
+				wantErr: nil,
+			},
+		},
+		{
+			name: "custom license no content by default",
+			in:   "test-fixtures/nvidia-software-and-cuda-supplement",
+			expected: expectation{
+				licenses: []pkg.License{
+					{
+						Value:          "UNKNOWN",
+						SPDXExpression: "UNKNOWN_eebcea3ab1d1a28e671de90119ffcfb35fe86951e4af1b17af52b7a82fcf7d0a",
+						Type:           "declared",
+						URLs:           nil,
+						Locations:      file.NewLocationSet(testLocation),
+						Contents:       "",
+					},
+				},
+				wantErr: nil,
+			},
+		},
+		{
+			name:                        "custom license with content when scanner has content config",
+			in:                          "test-fixtures/nvidia-software-and-cuda-supplement",
+			includeUnkownLicenseContent: true,
+			expected: expectation{
+				licenses: []pkg.License{
+					{
+						Value:          "UNKNOWN",
+						SPDXExpression: "UNKNOWN_eebcea3ab1d1a28e671de90119ffcfb35fe86951e4af1b17af52b7a82fcf7d0a",
+						Type:           "declared",
+						URLs:           nil,
+						Locations:      file.NewLocationSet(testLocation),
+						Contents:       string(mustOpen("test-fixtures/nvidia-software-and-cuda-supplement")),
+					},
+				},
+				wantErr: nil,
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			ctx := context.TODO()
+			content, err := os.ReadFile(test.in)
+			require.NoError(t, err)
+			s := testScanner(test.includeUnkownLicenseContent)
+			result, err := s.PkgSearch(ctx, file.NewLocationReadCloser(file.NewLocation("LICENSE"), io.NopCloser(bytes.NewReader(content))))
+			if test.expected.wantErr != nil {
+				test.expected.wantErr(t, err)
+			}
+			require.NoError(t, err)
+
+			require.Len(t, result, len(test.expected.licenses))
+
+			if len(test.expected.licenses) > 0 {
+				require.Equal(t, test.expected.licenses, result)
+			}
+		})
+	}
+}

internal/licenses/test-fixtures/multi-license

@@ -1,445 +0,0 @@
-Emscripten is available under 2 licenses, the MIT license and the
-University of Illinois/NCSA Open Source License.
-
-Both are permissive open source licenses, with little if any
-practical difference between them.
-
-The reason for offering both is that (1) the MIT license is
-well-known, while (2) the University of Illinois/NCSA Open Source
-License allows Emscripten's code to be integrated upstream into
-LLVM, which uses that license, should the opportunity arise.
-
-Additionally, the binaryen project is available under the Apache License
-Version 2.0.
-
-The full text of all three licenses follows.
-
-==============================================================================
-
-Copyright (c) 2010-2014 Emscripten authors, see AUTHORS file.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
-
-==============================================================================
-
-Copyright (c) 2010-2014 Emscripten authors, see AUTHORS file.
-All rights reserved.
-
-Permission is hereby granted, free of charge, to any person obtaining a
-copy of this software and associated documentation files (the
-"Software"), to deal with the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-    Redistributions of source code must retain the above copyright
-    notice, this list of conditions and the following disclaimers.
-
-    Redistributions in binary form must reproduce the above
-    copyright notice, this list of conditions and the following disclaimers
-    in the documentation and/or other materials provided with the
-    distribution.
-
-    Neither the names of Mozilla,
-    nor the names of its contributors may be used to endorse
-    or promote products derived from this Software without specific prior
-    written permission.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE CONTRIBUTORS OR COPYRIGHT HOLDERS BE LIABLE FOR
-ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS WITH THE SOFTWARE.
-
-==============================================================================
-
-This program uses portions of Node.js source code located in src/library_path.js,
-in accordance with the terms of the MIT license. Node's license follows:
-
-    """
-        Copyright Joyent, Inc. and other Node contributors. All rights reserved.
-        Permission is hereby granted, free of charge, to any person obtaining a copy
-        of this software and associated documentation files (the "Software"), to
-        deal in the Software without restriction, including without limitation the
-        rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
-        sell copies of the Software, and to permit persons to whom the Software is
-        furnished to do so, subject to the following conditions:
-
-        The above copyright notice and this permission notice shall be included in
-        all copies or substantial portions of the Software.
-
-        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
-        FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
-        IN THE SOFTWARE.
-    """
-
-==============================================================================
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "{}"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright {yyyy} {name of copyright owner}
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-
-==============================================================================
-
-Simple DirectMedia Layer
-  Copyright (C) 1997-2014 Sam Lantinga <slouken@libsdl.org>
-
-  This software is provided 'as-is', without any express or implied
-  warranty.  In no event will the authors be held liable for any damages
-  arising from the use of this software.
-
-  Permission is granted to anyone to use this software for any purpose,
-  including commercial applications, and to alter it and redistribute it
-  freely, subject to the following restrictions:
-
-  1. The origin of this software must not be misrepresented; you must not
-     claim that you wrote the original software. If you use this software
-     in a product, an acknowledgment in the product documentation would be
-     appreciated but is not required.
-  2. Altered source versions must be plainly marked as such, and must not be
-     misrepresented as being the original software.
-  3. This notice may not be removed or altered from any source distribution.
-
-==============================================================================
-
-Files: tools/filelock.py
-
-This is free and unencumbered software released into the public domain.
-
-Anyone is free to copy, modify, publish, use, compile, sell, or
-distribute this software, either in source code form or as a compiled
-binary, for any purpose, commercial or non-commercial, and by any
-means.
-
-In jurisdictions that recognize copyright laws, the author or authors
-of this software dedicate any and all copyright interest in the
-software to the public domain. We make this dedication for the benefit
-of the public at large and to the detriment of our heirs and
-successors. We intend this dedication to be an overt act of
-relinquishment in perpetuity of all present and future rights to this
-software under copyright law.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
-OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
-ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
-OTHER DEALINGS IN THE SOFTWARE.
-
-For more information, please refer to <http://unlicense.org>
-
-==============================================================================
-
-Files: tools/eliminator/node_modules/uglify-js/... tools/node_modules/terser/...
-
-  Distributed under the BSD license:
-
-    Copyright 2012 (c) Mihai Bazon <mihai.bazon@gmail.com>
-
-    Redistribution and use in source and binary forms, with or without
-    modification, are permitted provided that the following conditions
-    are met:
-
-        * Redistributions of source code must retain the above
-          copyright notice, this list of conditions and the following
-          disclaimer.
-
-        * Redistributions in binary form must reproduce the above
-          copyright notice, this list of conditions and the following
-          disclaimer in the documentation and/or other materials
-          provided with the distribution.
-
-    THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER “AS IS” AND ANY
-    EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-    IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-    PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
-    LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
-    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-    PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-    PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-    THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
-    TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
-    THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-    SUCH DAMAGE.
-
-==============================================================================
-
-Files: system/include/webgpu/webgpu.h
-
-BSD 3-Clause License
-
-Copyright (c) 2019, "WebGPU native" developers
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-1. Redistributions of source code must retain the above copyright notice, this
-   list of conditions and the following disclaimer.
-
-2. Redistributions in binary form must reproduce the above copyright notice,
-   this list of conditions and the following disclaimer in the documentation
-   and/or other materials provided with the distribution.
-
-3. Neither the name of the copyright holder nor the names of its
-   contributors may be used to endorse or promote products derived from
-   this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-==============================================================================
-
-Copyright (c) 2005-2011 David Schultz <das@FreeBSD.ORG>
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:
-1. Redistributions of source code must retain the above copyright
-   notice, this list of conditions and the following disclaimer.
-2. Redistributions in binary form must reproduce the above copyright
-   notice, this list of conditions and the following disclaimer in the
-   documentation and/or other materials provided with the distribution.
-
-THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGE.

internal/os/feature_detection.go

@@ -1,61 +0,0 @@
-package os
-
-import (
-	"context"
-	"fmt"
-	"regexp"
-
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/sbomsync"
-	"github.com/anchore/syft/syft/file"
-	"github.com/anchore/syft/syft/linux"
-	"github.com/anchore/syft/syft/sbom"
-)
-
-func DetectFeatures(_ context.Context, resolver file.Resolver, builder sbomsync.Builder) error {
-	builder.(sbomsync.Accessor).WriteToSBOM(func(s *sbom.SBOM) {
-		if s.Artifacts.LinuxDistribution == nil {
-			return
-		}
-
-		err := findRhelFeatures(resolver, s.Artifacts.LinuxDistribution)
-		if err != nil {
-			log.WithFields("error", err, "release", s.Artifacts.LinuxDistribution).Trace("error searching for extended support")
-		}
-	})
-
-	return nil
-}
-
-func findRhelFeatures(resolver file.Resolver, release *linux.Release) error {
-	if release == nil || release.ID != "rhel" {
-		return nil
-	}
-	contentManifestFiles, err := resolver.FilesByGlob("/root/buildinfo/content_manifests/*.json")
-	if err != nil {
-		return fmt.Errorf("unable to find content manifests: %w", err)
-	}
-	for _, contentManifestFile := range contentManifestFiles {
-		found, err := hasRhelExtendedSupportInContentManifest(resolver, contentManifestFile)
-		if err != nil {
-			return fmt.Errorf("unable to read content manifest from %s: %w", contentManifestFile.String(), err)
-		}
-		if found {
-			release.ExtendedSupport = true
-			break
-		}
-	}
-	return nil
-}
-
-func hasRhelExtendedSupportInContentManifest(resolver file.Resolver, contentManifestFile file.Location) (bool, error) {
-	contents, err := resolver.FileContentsByLocation(contentManifestFile)
-	if err != nil {
-		return false, fmt.Errorf("unable to read content manifest from %s: %w", contentManifestFile.String(), err)
-	}
-	defer internal.CloseAndLogError(contents, "content-manifest")
-
-	patterns := []*regexp.Regexp{regexp.MustCompile(`baseos-eus`), regexp.MustCompile(`baseos-eus|appstream-eus`)}
-	return internal.MatchAnyFromReader(contents, patterns...)
-}

internal/os/feature_detection_test.go

@@ -1,97 +0,0 @@
-package os_test
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/anchore/stereoscope/pkg/imagetest"
-	"github.com/anchore/syft/internal/os"
-	"github.com/anchore/syft/internal/sbomsync"
-	"github.com/anchore/syft/internal/task"
-	"github.com/anchore/syft/syft"
-	"github.com/anchore/syft/syft/linux"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/anchore/syft/syft/source"
-)
-
-func Test_EnvironmentTask(t *testing.T) {
-	tests := []struct {
-		name     string
-		expected linux.Release
-	}{
-		{
-			name: "not_rhel",
-			expected: linux.Release{
-				PrettyName: "Red Hat Enterprise Linux 9.4 (Plow)",
-				Name:       "Red Hat Enterprise Linux",
-				ID:         "not-rhel",
-				IDLike: []string{
-					"fedora",
-				},
-				Version:         "9.4 (Plow)",
-				VersionID:       "9.4",
-				HomeURL:         "https://www.redhat.com/",
-				BugReportURL:    "https://issues.redhat.com/",
-				CPEName:         "cpe:/o:redhat:enterprise_linux:9::baseos",
-				ExtendedSupport: false, // important
-			},
-		},
-		{
-			name: "rhel_content_manifests",
-			expected: linux.Release{
-				PrettyName: "Red Hat Enterprise Linux 9.4 (Plow)",
-				Name:       "Red Hat Enterprise Linux",
-				ID:         "rhel",
-				IDLike: []string{
-					"fedora",
-				},
-				Version:         "9.4 (Plow)",
-				VersionID:       "9.4",
-				HomeURL:         "https://www.redhat.com/",
-				BugReportURL:    "https://issues.redhat.com/",
-				CPEName:         "cpe:/o:redhat:enterprise_linux:9::baseos",
-				ExtendedSupport: true, // important
-			},
-		},
-		{
-			name: "rhel_no_manifests",
-			expected: linux.Release{
-				PrettyName: "Red Hat Enterprise Linux 9.4 (Plow)",
-				Name:       "Red Hat Enterprise Linux",
-				ID:         "rhel",
-				IDLike: []string{
-					"fedora",
-				},
-				Version:         "9.4 (Plow)",
-				VersionID:       "9.4",
-				HomeURL:         "https://www.redhat.com/",
-				BugReportURL:    "https://issues.redhat.com/",
-				CPEName:         "cpe:/o:redhat:enterprise_linux:9::baseos",
-				ExtendedSupport: false, // important
-			},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			tarPath := imagetest.GetFixtureImageTarPath(t, test.name)
-
-			// get the source
-			theSource, err := syft.GetSource(context.Background(), tarPath, syft.DefaultGetSourceConfig().WithSources("docker-archive"))
-			require.NoError(t, err)
-			resolver, err := theSource.FileResolver(source.SquashedScope)
-			require.NoError(t, err)
-
-			s := sbom.SBOM{}
-			err = task.NewEnvironmentTask().Execute(context.Background(), resolver, sbomsync.NewBuilder(&s))
-			require.NoError(t, err)
-
-			err = os.DetectFeatures(context.Background(), resolver, sbomsync.NewBuilder(&s))
-			require.NoError(t, err)
-
-			require.Equal(t, &test.expected, s.Artifacts.LinuxDistribution)
-		})
-	}
-}

internal/os/test-fixtures/not_rhel/Dockerfile

@@ -1,4 +0,0 @@
-FROM scratch
-
-COPY etc/os-release /etc/
-COPY root/buildinfo/content_manifests/*.json /root/buildinfo/content_manifests/

internal/os/test-fixtures/not_rhel/etc/os-release

@@ -1,18 +0,0 @@
-NAME="Red Hat Enterprise Linux"
-VERSION="9.4 (Plow)"
-ID="not-rhel"
-ID_LIKE="fedora"
-VERSION_ID="9.4"
-PLATFORM_ID="platform:el9"
-PRETTY_NAME="Red Hat Enterprise Linux 9.4 (Plow)"
-ANSI_COLOR="0;31"
-LOGO="fedora-logo-icon"
-CPE_NAME="cpe:/o:redhat:enterprise_linux:9::baseos"
-HOME_URL="https://www.redhat.com/"
-DOCUMENTATION_URL="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9"
-BUG_REPORT_URL="https://issues.redhat.com/"
-
-REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 9"
-REDHAT_BUGZILLA_PRODUCT_VERSION=9.4
-REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
-REDHAT_SUPPORT_PRODUCT_VERSION="9.4"

internal/os/test-fixtures/not_rhel/root/buildinfo/content_manifests/driver-toolkit-container-v4.16.0-202411210647.p0.g1d5732f.assembly.stream.el9.json

@@ -1,14 +0,0 @@
-{
-  "image_contents": [],
-  "metadata": {
-    "icm_spec": "https://raw.githubusercontent.com/containerbuildsystem/atomic-reactor/f4abcfdaf8247a6b074f94fa84f3846f82d781c6/atomic_reactor/schemas/content_manifest.json",
-    "icm_version": 1,
-    "image_layer_index": 3
-  },
-  "content_sets": [
-    "rhel-9-for-x86_64-appstream-eus-rpms__9_DOT_4",
-    "rhel-9-for-x86_64-baseos-eus-rpms__9_DOT_4",
-    "rhel-9-for-x86_64-rt-rpms__9_DOT_4",
-    "rhocp-4.16-for-rhel-9-x86_64-rpms"
-  ]
-}

internal/os/test-fixtures/rhel_content_manifests/Dockerfile

@@ -1,4 +0,0 @@
-FROM scratch
-
-COPY etc/os-release /etc/
-COPY root/buildinfo/content_manifests/*.json /root/buildinfo/content_manifests/

internal/os/test-fixtures/rhel_content_manifests/etc/os-release

@@ -1,18 +0,0 @@
-NAME="Red Hat Enterprise Linux"
-VERSION="9.4 (Plow)"
-ID="rhel"
-ID_LIKE="fedora"
-VERSION_ID="9.4"
-PLATFORM_ID="platform:el9"
-PRETTY_NAME="Red Hat Enterprise Linux 9.4 (Plow)"
-ANSI_COLOR="0;31"
-LOGO="fedora-logo-icon"
-CPE_NAME="cpe:/o:redhat:enterprise_linux:9::baseos"
-HOME_URL="https://www.redhat.com/"
-DOCUMENTATION_URL="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9"
-BUG_REPORT_URL="https://issues.redhat.com/"
-
-REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 9"
-REDHAT_BUGZILLA_PRODUCT_VERSION=9.4
-REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
-REDHAT_SUPPORT_PRODUCT_VERSION="9.4"

internal/os/test-fixtures/rhel_content_manifests/root/buildinfo/content_manifests/driver-toolkit-container-v4.16.0-202411210647.p0.g1d5732f.assembly.stream.el9.json

@@ -1,14 +0,0 @@
-{
-  "image_contents": [],
-  "metadata": {
-    "icm_spec": "https://raw.githubusercontent.com/containerbuildsystem/atomic-reactor/f4abcfdaf8247a6b074f94fa84f3846f82d781c6/atomic_reactor/schemas/content_manifest.json",
-    "icm_version": 1,
-    "image_layer_index": 3
-  },
-  "content_sets": [
-    "rhel-9-for-x86_64-appstream-eus-rpms__9_DOT_4",
-    "rhel-9-for-x86_64-baseos-eus-rpms__9_DOT_4",
-    "rhel-9-for-x86_64-rt-rpms__9_DOT_4",
-    "rhocp-4.16-for-rhel-9-x86_64-rpms"
-  ]
-}

internal/os/test-fixtures/rhel_content_manifests/root/buildinfo/content_manifests/openshift-base-rhel9-container-v4.16.0-202411190033.p0.gb45ea65.assembly.stream.el9.json

@@ -1,13 +0,0 @@
-{
-  "image_contents": [],
-  "metadata": {
-    "icm_spec": "https://raw.githubusercontent.com/containerbuildsystem/atomic-reactor/f4abcfdaf8247a6b074f94fa84f3846f82d781c6/atomic_reactor/schemas/content_manifest.json",
-    "icm_version": 1,
-    "image_layer_index": 1
-  },
-  "content_sets": [
-    "rhel-9-for-x86_64-appstream-eus-rpms__9_DOT_4",
-    "rhel-9-for-x86_64-baseos-eus-rpms__9_DOT_4",
-    "rhocp-4.16-for-rhel-9-x86_64-rpms"
-  ]
-}

internal/os/test-fixtures/rhel_no_manifests/Dockerfile

@@ -1,3 +0,0 @@
-FROM scratch
-
-COPY ./etc/os-release /etc/

internal/os/test-fixtures/rhel_no_manifests/etc/os-release

@@ -1,18 +0,0 @@
-NAME="Red Hat Enterprise Linux"
-VERSION="9.4 (Plow)"
-ID="rhel"
-ID_LIKE="fedora"
-VERSION_ID="9.4"
-PLATFORM_ID="platform:el9"
-PRETTY_NAME="Red Hat Enterprise Linux 9.4 (Plow)"
-ANSI_COLOR="0;31"
-LOGO="fedora-logo-icon"
-CPE_NAME="cpe:/o:redhat:enterprise_linux:9::baseos"
-HOME_URL="https://www.redhat.com/"
-DOCUMENTATION_URL="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9"
-BUG_REPORT_URL="https://issues.redhat.com/"
-
-REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 9"
-REDHAT_BUGZILLA_PRODUCT_VERSION=9.4
-REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
-REDHAT_SUPPORT_PRODUCT_VERSION="9.4"

internal/regex_helpers.go

@@ -41,11 +41,11 @@ func MatchNamedCaptureGroups(regEx *regexp.Regexp, content string) map[string]st
 // 1.5x the reader chunk size (1MB * 1.5).
 func MatchNamedCaptureGroupsFromReader(re *regexp.Regexp, r io.Reader) (map[string]string, error) {
 	results := make(map[string]string)
-	matches, err := processReaderInChunks(r, readerChunkSize, matchNamedCaptureGroupsHandler(re, results))
+	_, err := processReaderInChunks(r, readerChunkSize, matchNamedCaptureGroupsHandler(re, results))
 	if err != nil {
 		return nil, err
 	}
-	if !matches {
+	if len(results) == 0 {
 		return nil, nil
 	}
 	return results, nil

internal/relationship/by_file_ownership.go

@@ -92,12 +92,6 @@ func findOwnershipByFilesRelationships(resolver file.Resolver, catalog *pkg.Coll
 		return relationships
 	}
 
-	// Build a map of real paths to packages that directly own them. We'll use this
-	// to check if a file is already owned by the same type of package when we're
-	// determining ownership via symlink.
-	directOwnership := directOwnersByPath(catalog)
-
-	// Now establish relationships, considering symlinks
 	for _, candidateOwnerPkg := range catalog.Sorted() {
 		id := candidateOwnerPkg.ID()
 		if candidateOwnerPkg.Metadata == nil {
@@ -111,34 +105,16 @@ func findOwnershipByFilesRelationships(resolver file.Resolver, catalog *pkg.Coll
 		}
 
 		for _, ownedFilePath := range pkgFileOwner.OwnedFiles() {
-			if ownedFilePath == "" {
-				continue
-			}
-
-			// find paths that result in a hit (includes resolving symlinks)
-			resolvedPaths := resolvePaths(ownedFilePath, resolver)
-
-			for _, resolvedPath := range resolvedPaths {
-				if matchesAny(resolvedPath, globsForbiddenFromBeingOwned) {
+			// find the first path that results in a hit
+			for _, ownedPath := range allPaths(ownedFilePath, resolver) {
+				if matchesAny(ownedPath, globsForbiddenFromBeingOwned) {
 					// we skip over known exceptions to file ownership, such as the RPM package owning
 					// the RPM DB path, otherwise the RPM package would "own" all RPMs, which is not intended
 					continue
 				}
 
-				// Skip claiming ownership via symlink if another package of the same type
-				// directly owns this real path. This is the specific fix for the issue where a
-				// symlink shouldn't allow a package to claim ownership when another package of
-				// the same type directly owns the real file.
-				if resolvedPath != ownedFilePath { // This is a resolved symlink path
-					// Check if another package of the same type directly owns this path
-					if paths := directOwnership[candidateOwnerPkg.Type]; paths != nil && paths.Has(resolvedPath) {
-						// Skip this path - a package of the same type directly owns it
-						continue
-					}
-				}
-
 				// look for package(s) in the catalog that may be owned by this package and mark the relationship
-				for _, subPackage := range catalog.PackagesByPath(resolvedPath) {
+				for _, subPackage := range catalog.PackagesByPath(ownedPath) {
 					subID := subPackage.ID()
 					if subID == id {
 						continue
@@ -150,7 +126,7 @@ func findOwnershipByFilesRelationships(resolver file.Resolver, catalog *pkg.Coll
 					if _, exists := relationships[id][subID]; !exists {
 						relationships[id][subID] = strset.New()
 					}
-					relationships[id][subID].Add(resolvedPath)
+					relationships[id][subID].Add(ownedPath)
 				}
 			}
 		}
@@ -159,40 +135,7 @@ func findOwnershipByFilesRelationships(resolver file.Resolver, catalog *pkg.Coll
 	return relationships
 }
 
-func directOwnersByPath(catalog *pkg.Collection) map[pkg.Type]*strset.Set {
-	directOwnership := map[pkg.Type]*strset.Set{}
-
-	// First, identify direct ownership of all files
-	for _, p := range catalog.Sorted() {
-		if p.Metadata == nil {
-			continue
-		}
-
-		// check to see if this is a file owner
-		pkgFileOwner, ok := p.Metadata.(pkg.FileOwner)
-		if !ok {
-			continue
-		}
-
-		for _, ownedFilePath := range pkgFileOwner.OwnedFiles() {
-			if ownedFilePath == "" {
-				continue
-			}
-
-			// Register direct ownership
-			paths := directOwnership[p.Type]
-			if paths == nil {
-				paths = strset.New()
-				directOwnership[p.Type] = paths
-			}
-			paths.Add(ownedFilePath)
-		}
-	}
-
-	return directOwnership
-}
-
-func resolvePaths(ownedFilePath string, resolver file.Resolver) []string {
+func allPaths(ownedFilePath string, resolver file.Resolver) []string {
 	// though we have a string path, we need to resolve symlinks and other filesystem oddities since we cannot assume this is a real path
 	var locs []file.Location
 	var err error

internal/relationship/by_file_ownership_test.go

@@ -78,64 +78,6 @@ func TestOwnershipByFilesRelationship(t *testing.T) {
 				return []pkg.Package{parent, child}, []artifact.Relationship{relationship}
 			},
 		},
-		{
-			name: "only-real-file-owner-gets-ownership-relationship-not-symlink-owner",
-			resolver: mockFR{
-				translate: map[string]string{
-					"/usr/bin/jenkins.war-symlink": "/usr/share/jenkins/jenkins.war", // symlink to the real file
-				},
-			},
-			setup: func(t testing.TB) ([]pkg.Package, []artifact.Relationship) {
-				// Package that owns the symlink
-				symlinkOwner := pkg.Package{
-					Type: pkg.ApkPkg,
-					Metadata: pkg.ApkDBEntry{
-						Package: "jenkins-symlink-pkg",
-						Files: []pkg.ApkFileRecord{
-							{Path: "/usr/bin/jenkins.war-symlink"}, // this symlinks to the real file
-						},
-					},
-				}
-				symlinkOwner.SetID()
-
-				// Package that owns the real file
-				realFileOwner := pkg.Package{
-					Type: pkg.ApkPkg,
-					Metadata: pkg.ApkDBEntry{
-						Package: "jenkins-real-pkg",
-						Files: []pkg.ApkFileRecord{
-							{Path: "/usr/share/jenkins/jenkins.war"}, // the real file
-						},
-					},
-				}
-				realFileOwner.SetID()
-
-				// A third package that is "located at" the real file path
-				// This simulates a package being discovered at the jenkins.war location
-				consumerPackage := pkg.Package{
-					Type: pkg.JavaPkg,
-					Locations: file.NewLocationSet(
-						file.NewVirtualLocation("/usr/share/jenkins/jenkins.war", "/usr/share/jenkins/jenkins.war"),
-					),
-				}
-				consumerPackage.SetID()
-
-				// Only the real file owner should have an ownership relationship with the consumer package
-				// The symlink owner should NOT have a relationship with the consumer
-				relationship := artifact.Relationship{
-					From: realFileOwner,
-					To:   consumerPackage,
-					Type: artifact.OwnershipByFileOverlapRelationship,
-					Data: ownershipByFilesMetadata{
-						Files: []string{
-							"/usr/share/jenkins/jenkins.war",
-						},
-					},
-				}
-
-				return []pkg.Package{symlinkOwner, realFileOwner, consumerPackage}, []artifact.Relationship{relationship}
-			},
-		},
 		{
 			name: "misses-by-dead-symlink",
 			resolver: mockFR{

internal/spdxlicense/generate/generate_license_list.go

@@ -31,13 +31,6 @@ var licenseIDs = map[string]string{
 	{{ printf "%q" $k }}: {{ printf "%q" $v }},
 {{- end }}
 }
-
-// urlToLicense maps license URLs from the seeAlso field to license IDs
-var urlToLicense = map[string]string{
-{{- range $url, $id := .URLToLicense }}
-	{{ printf "%q" $url }}: {{ printf "%q" $id }},
-{{- end }}
-}
 `))
 
 var versionMatch = regexp.MustCompile(`([0-9]+)\.?([0-9]+)?\.?([0-9]+)?\.?`)
@@ -75,20 +68,17 @@ func run() error {
 	}()
 
 	licenseIDs := processSPDXLicense(result)
-	urlToLicense := buildURLToLicenseMap(result)
 
 	err = tmp.Execute(f, struct {
-		Timestamp    time.Time
-		URL          string
-		Version      string
-		LicenseIDs   map[string]string
-		URLToLicense map[string]string
+		Timestamp  time.Time
+		URL        string
+		Version    string
+		LicenseIDs map[string]string
 	}{
-		Timestamp:    time.Now(),
-		URL:          url,
-		Version:      result.Version,
-		LicenseIDs:   licenseIDs,
-		URLToLicense: urlToLicense,
+		Timestamp:  time.Now(),
+		URL:        url,
+		Version:    result.Version,
+		LicenseIDs: licenseIDs,
 	})
 
 	if err != nil {
@@ -166,30 +156,3 @@ func cleanLicenseID(id string) string {
 	cleanID := strings.ToLower(id)
 	return strings.ReplaceAll(cleanID, "-", "")
 }
-
-// buildURLToLicenseMap creates a mapping from license URLs (from seeAlso fields) to license IDs
-func buildURLToLicenseMap(result LicenseList) map[string]string {
-	urlMap := make(map[string]string)
-
-	for _, l := range result.Licenses {
-		// Skip deprecated licenses
-		if l.Deprecated {
-			// Find replacement license if available
-			replacement := result.findReplacementLicense(l)
-			if replacement != nil {
-				// Map deprecated license URLs to the replacement license
-				for _, url := range l.SeeAlso {
-					urlMap[url] = replacement.ID
-				}
-			}
-			continue
-		}
-
-		// Add URLs from non-deprecated licenses
-		for _, url := range l.SeeAlso {
-			urlMap[url] = l.ID
-		}
-	}
-
-	return urlMap
-}

internal/spdxlicense/license.go

@@ -35,20 +35,3 @@ func cleanLicenseID(id string) string {
 	id = strings.ToLower(id)
 	return strings.ReplaceAll(id, "-", "")
 }
-
-// LicenseInfo contains license ID and name
-type LicenseInfo struct {
-	ID string
-}
-
-// LicenseByURL returns the license ID and name for a given URL from the SPDX license list
-// The URL should match one of the URLs in the seeAlso field of an SPDX license
-func LicenseByURL(url string) (LicenseInfo, bool) {
-	url = strings.TrimSpace(url)
-	if id, exists := urlToLicense[url]; exists {
-		return LicenseInfo{
-			ID: id,
-		}, true
-	}
-	return LicenseInfo{}, false
-}

internal/spdxlicense/license_url_test.go

@@ -1,97 +0,0 @@
-package spdxlicense
-
-import (
-	"testing"
-)
-
-func TestLicenseByURL(t *testing.T) {
-	tests := []struct {
-		name      string
-		url       string
-		wantID    string
-		wantFound bool
-	}{
-		{
-			name:      "MIT license URL (https)",
-			url:       "https://opensource.org/license/mit/",
-			wantID:    "MIT",
-			wantFound: true,
-		},
-		{
-			name:      "MIT license URL (http)",
-			url:       "http://opensource.org/licenses/MIT",
-			wantID:    "MIT",
-			wantFound: true,
-		},
-		{
-			name:      "Apache 2.0 license URL",
-			url:       "https://www.apache.org/licenses/LICENSE-2.0",
-			wantID:    "Apache-2.0",
-			wantFound: true,
-		},
-		{
-			name:      "GPL 3.0 or later URL",
-			url:       "https://www.gnu.org/licenses/gpl-3.0-standalone.html",
-			wantID:    "GPL-3.0-or-later",
-			wantFound: true,
-		},
-		{
-			name:      "BSD 3-Clause URL",
-			url:       "https://opensource.org/licenses/BSD-3-Clause",
-			wantID:    "BSD-3-Clause",
-			wantFound: true,
-		},
-		{
-			name:      "URL with trailing whitespace",
-			url:       "  http://opensource.org/licenses/MIT  ",
-			wantID:    "MIT",
-			wantFound: true,
-		},
-		{
-			name:      "Unknown URL",
-			url:       "https://example.com/unknown-license",
-			wantID:    "",
-			wantFound: false,
-		},
-		{
-			name:      "Empty URL",
-			url:       "",
-			wantID:    "",
-			wantFound: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			info, found := LicenseByURL(tt.url)
-			if found != tt.wantFound {
-				t.Errorf("LicenseByURL() found = %v, want %v", found, tt.wantFound)
-			}
-			if found {
-				if info.ID != tt.wantID {
-					t.Errorf("LicenseByURL() ID = %v, want %v", info.ID, tt.wantID)
-				}
-			}
-		})
-	}
-}
-
-func TestLicenseByURL_DeprecatedLicenses(t *testing.T) {
-	// Test that deprecated license URLs map to their replacement licenses
-	// For example, GPL-2.0+ should map to GPL-2.0-or-later
-
-	// This test needs actual URLs from deprecated licenses
-	// We can verify by checking if a deprecated license URL maps to a non-deprecated ID
-	url := "https://www.gnu.org/licenses/old-licenses/gpl-2.0-standalone.html"
-	info, found := LicenseByURL(url)
-
-	if found {
-		// Check that we got a valid non-deprecated license ID
-		if info.ID == "" {
-			t.Error("Got empty license ID for deprecated license URL")
-		}
-		// The ID should be the replacement (GPL-2.0-only or GPL-2.0-or-later)
-		// depending on the URL
-		t.Logf("Deprecated license URL mapped to: ID=%s", info.ID)
-	}
-}

internal/string_helpers.go

@@ -13,17 +13,6 @@ func HasAnyOfPrefixes(input string, prefixes ...string) bool {
 	return false
 }
 
-// HasAnyOfSuffixes returns an indication if the given string has any of the given suffixes.
-func HasAnyOfSuffixes(input string, suffixes ...string) bool {
-	for _, suffix := range suffixes {
-		if strings.HasSuffix(input, suffix) {
-			return true
-		}
-	}
-
-	return false
-}
-
 func TruncateMiddleEllipsis(input string, maxLen int) string {
 	if len(input) <= maxLen {
 		return input

internal/string_helpers_test.go

@@ -7,63 +7,6 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func TestHasAnyOfSuffixes(t *testing.T) {
-	tests := []struct {
-		name     string
-		input    string
-		suffixes []string
-		expected bool
-	}{
-		{
-			name:  "go case",
-			input: "this has something",
-			suffixes: []string{
-				"has something",
-				"has NOT something",
-			},
-			expected: true,
-		},
-		{
-			name:  "no match",
-			input: "this has something",
-			suffixes: []string{
-				"has NOT something",
-			},
-			expected: false,
-		},
-		{
-			name:     "empty",
-			input:    "this has something",
-			suffixes: []string{},
-			expected: false,
-		},
-		{
-			name:  "positive match last",
-			input: "this has something",
-			suffixes: []string{
-				"that does not have",
-				"something",
-			},
-			expected: true,
-		},
-		{
-			name:  "empty input",
-			input: "",
-			suffixes: []string{
-				"that does not have",
-				"this has",
-			},
-			expected: false,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, HasAnyOfSuffixes(test.input, test.suffixes...))
-		})
-	}
-}
-
 func TestHasAnyOfPrefixes(t *testing.T) {
 	tests := []struct {
 		name     string

internal/task/executor.go

@@ -15,7 +15,7 @@ import (
 	"github.com/anchore/syft/syft/sbom"
 )
 
-func RunTask(ctx context.Context, tsk Task, resolver file.Resolver, s sbomsync.Builder, prog *monitor.TaskProgress) error {
+func RunTask(ctx context.Context, tsk Task, resolver file.Resolver, s sbomsync.Builder, prog *monitor.CatalogerTaskProgress) error {
 	err := runTaskSafely(ctx, tsk, resolver, s)
 	unknowns, remainingErrors := unknown.ExtractCoordinateErrors(err)
 	if len(unknowns) > 0 {

internal/task/executor_test.go

@@ -17,7 +17,7 @@ func Test_TaskExecutor_PanicHandling(t *testing.T) {
 		panic("something bad happened")
 	})
 
-	err := RunTask(context.Background(), tsk, nil, nil, &monitor.TaskProgress{
+	err := RunTask(context.Background(), tsk, nil, nil, &monitor.CatalogerTaskProgress{
 		Manual: progress.NewManual(-1),
 	})
 

internal/task/feature_detection.go

@@ -1,7 +0,0 @@
-package task
-
-import "github.com/anchore/syft/internal/os"
-
-func NewOSFeatureDetectionTask() Task {
-	return NewTask("os-feature-detection", os.DetectFeatures)
-}

internal/task/package_task_factory.go

@@ -107,11 +107,6 @@ func finalizePkgCatalogerResults(cfg CatalogingFactoryConfig, resolver file.Path
 			}
 		}
 
-		// we want to know if the user wants to preserve license content or not in the final SBOM
-		// note: this looks incorrect, but pkg.License.Content is NOT used to compute the Package ID
-		// this does NOT change the reproducibility of the Package ID
-		applyLicenseContentRules(&p, cfg.LicenseConfig)
-
 		pkgs[i] = p
 	}
 	return pkgs, relationships
@@ -267,29 +262,3 @@ func packageFileOwnershipRelationships(p pkg.Package, resolver file.PathResolver
 	}
 	return relationships, nil
 }
-
-func applyLicenseContentRules(p *pkg.Package, cfg cataloging.LicenseConfig) {
-	if p.Licenses.Empty() {
-		return
-	}
-
-	licenses := p.Licenses.ToSlice()
-	for i := range licenses {
-		l := &licenses[i]
-		switch cfg.IncludeContent {
-		case cataloging.LicenseContentIncludeUnknown:
-			// we have an SPDX expression, which means this is NOT an unknown license
-			// remove the content, we are only including content for unknown licenses by default
-			if l.SPDXExpression != "" {
-				licenses[i].Contents = ""
-			}
-		case cataloging.LicenseContentIncludeAll:
-			// always include the content
-		default:
-			// clear it all out
-			licenses[i].Contents = ""
-		}
-	}
-
-	p.Licenses = pkg.NewLicenseSet(licenses...)
-}

internal/task/package_task_factory_test.go

@@ -117,149 +117,6 @@ func TestFilterNonCompliantPackages(t *testing.T) {
 	assert.Equal(t, p2, droppedPkgs[0])
 }
 
-func TestApplyLicenseContentRules(t *testing.T) {
-	licenseWithSPDX := pkg.License{
-		SPDXExpression: "MIT",
-		Contents:       "MIT license content",
-	}
-	licenseWithoutSPDX := pkg.License{
-		Value:    "License-Not-A-SPDX-Expression",
-		Contents: "Non-SPDX license content",
-	}
-
-	tests := []struct {
-		name             string
-		inputLicenses    []pkg.License
-		cfg              cataloging.LicenseConfig
-		expectedLicenses []pkg.License
-	}{
-		{
-			name: "LicenseContentIncludeUnknown",
-			inputLicenses: []pkg.License{
-				licenseWithSPDX,
-				licenseWithoutSPDX,
-			},
-			cfg: cataloging.LicenseConfig{
-				IncludeContent: cataloging.LicenseContentIncludeUnknown,
-			},
-			expectedLicenses: []pkg.License{
-				{
-					SPDXExpression: "MIT",
-					Contents:       "", // content cleared for SPDX license
-				},
-				{
-					Value:    "License-Not-A-SPDX-Expression",
-					Contents: "Non-SPDX license content", // content preserved for non-SPDX
-				},
-			},
-		},
-		{
-			name: "LicenseContentExcludeAll",
-			inputLicenses: []pkg.License{
-				licenseWithSPDX,
-				licenseWithoutSPDX,
-			},
-			cfg: cataloging.LicenseConfig{
-				IncludeContent: cataloging.LicenseContentExcludeAll,
-			},
-			expectedLicenses: []pkg.License{
-				{
-					SPDXExpression: "MIT",
-					Contents:       "", // content cleared
-				},
-				{
-					Value:    "License-Not-A-SPDX-Expression",
-					Contents: "", // content cleared
-				},
-			},
-		},
-		{
-			name: "LicenseContentIncludeAll",
-			inputLicenses: []pkg.License{
-				licenseWithSPDX,
-				licenseWithoutSPDX,
-			},
-			cfg: cataloging.LicenseConfig{
-				IncludeContent: cataloging.LicenseContentIncludeAll,
-			},
-			expectedLicenses: []pkg.License{
-				{
-					SPDXExpression: "MIT",
-					Contents:       "MIT license content", // content preserved
-				},
-				{
-					Value:    "License-Not-A-SPDX-Expression",
-					Contents: "Non-SPDX license content", // content preserved
-				},
-			},
-		},
-		{
-			name: "default license config should be LicenseContentExcludeAll",
-			inputLicenses: []pkg.License{
-				licenseWithSPDX,
-				licenseWithoutSPDX,
-			},
-			cfg: cataloging.DefaultLicenseConfig(),
-			expectedLicenses: []pkg.License{
-				{
-					SPDXExpression: "MIT",
-				},
-				{
-					Value: "License-Not-A-SPDX-Expression",
-				},
-			},
-		},
-		{
-			name: "invalid license content cataloging config results in the default case",
-			inputLicenses: []pkg.License{
-				licenseWithSPDX,
-				licenseWithoutSPDX,
-			},
-			cfg: cataloging.LicenseConfig{
-				IncludeContent: cataloging.LicenseContent("invalid"),
-			},
-			expectedLicenses: []pkg.License{
-				{
-					SPDXExpression: "MIT",
-				},
-				{
-					Value:    "License-Not-A-SPDX-Expression",
-					Contents: "", // content all removed
-				},
-			},
-		},
-		{
-			name:          "Empty licenses",
-			inputLicenses: []pkg.License{},
-			cfg: cataloging.LicenseConfig{
-				IncludeContent: cataloging.LicenseContentIncludeAll,
-			},
-			expectedLicenses: []pkg.License{},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			inputPkg := &pkg.Package{
-				Licenses: pkg.NewLicenseSet(tt.inputLicenses...),
-			}
-
-			inputPkg.SetID()
-			originalID := inputPkg.ID()
-
-			applyLicenseContentRules(inputPkg, tt.cfg)
-
-			assert.Equal(t, originalID, inputPkg.ID(), "package ID changed unexpectedly")
-
-			actualLicenses := inputPkg.Licenses.ToSlice()
-			expectedLicenses := pkg.NewLicenseSet(tt.expectedLicenses...).ToSlice()
-
-			assert.Equal(t, expectedLicenses, actualLicenses, "license contents do not match expected values")
-
-		})
-	}
-}
-
 func TestApplyComplianceRules_DropAndStub(t *testing.T) {
 	p := pkg.Package{Name: "", Version: ""}
 	p.SetID()

internal/task/package_tasks.go

@@ -7,7 +7,6 @@ import (
 	"github.com/anchore/syft/syft/pkg/cataloger/arch"
 	"github.com/anchore/syft/syft/pkg/cataloger/binary"
 	bitnamiSbomCataloger "github.com/anchore/syft/syft/pkg/cataloger/bitnami"
-	"github.com/anchore/syft/syft/pkg/cataloger/conda"
 	"github.com/anchore/syft/syft/pkg/cataloger/cpp"
 	"github.com/anchore/syft/syft/pkg/cataloger/dart"
 	"github.com/anchore/syft/syft/pkg/cataloger/debian"
@@ -18,7 +17,6 @@ import (
 	"github.com/anchore/syft/syft/pkg/cataloger/githubactions"
 	"github.com/anchore/syft/syft/pkg/cataloger/golang"
 	"github.com/anchore/syft/syft/pkg/cataloger/haskell"
-	"github.com/anchore/syft/syft/pkg/cataloger/homebrew"
 	"github.com/anchore/syft/syft/pkg/cataloger/java"
 	"github.com/anchore/syft/syft/pkg/cataloger/javascript"
 	"github.com/anchore/syft/syft/pkg/cataloger/kernel"
@@ -78,7 +76,6 @@ func DefaultPackageTaskFactories() Factories {
 		// language-specific package declared catalogers ///////////////////////////////////////////////////////////////////////////
 		newSimplePackageTaskFactory(cpp.NewConanCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "cpp", "conan"),
 		newSimplePackageTaskFactory(dart.NewPubspecLockCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "dart"),
-		newSimplePackageTaskFactory(dart.NewPubspecCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "dart"),
 		newSimplePackageTaskFactory(elixir.NewMixLockCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "elixir"),
 		newSimplePackageTaskFactory(erlang.NewRebarLockCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "erlang"),
 		newSimplePackageTaskFactory(erlang.NewOTPCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "erlang", "otp"),
@@ -155,8 +152,7 @@ func DefaultPackageTaskFactories() Factories {
 			},
 			pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "binary",
 		),
-		newSimplePackageTaskFactory(binary.NewELFPackageCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "binary", "elf-package", "elf"),
-		newSimplePackageTaskFactory(binary.NewPEPackageCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "binary", "pe-package", "pe", "dll", "exe"),
+		newSimplePackageTaskFactory(binary.NewELFPackageCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "binary", "elf-package"),
 		newSimplePackageTaskFactory(githubactions.NewActionUsageCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, "github", "github-actions"),
 		newSimplePackageTaskFactory(githubactions.NewWorkflowUsageCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, "github", "github-actions"),
 		newSimplePackageTaskFactory(java.NewJvmDistributionCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "java", "jvm", "jdk", "jre"),
@@ -166,13 +162,10 @@ func DefaultPackageTaskFactories() Factories {
 			},
 			pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "linux", "kernel",
 		),
-		newSimplePackageTaskFactory(php.NewInterpreterCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "binary", "php"),
 		newSimplePackageTaskFactory(sbomCataloger.NewCataloger, "sbom"), // note: not evidence of installed packages
 		newSimplePackageTaskFactory(bitnamiSbomCataloger.NewCataloger, "bitnami", pkgcataloging.InstalledTag, pkgcataloging.ImageTag),
 		newSimplePackageTaskFactory(wordpress.NewWordpressPluginCataloger, pkgcataloging.DirectoryTag, pkgcataloging.ImageTag, "wordpress"),
 		newSimplePackageTaskFactory(terraform.NewLockCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, "terraform"),
-		newSimplePackageTaskFactory(homebrew.NewCataloger, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "homebrew"),
-		newSimplePackageTaskFactory(conda.NewCondaMetaCataloger, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.PackageTag, "conda"),
 
 		// deprecated catalogers ////////////////////////////////////////
 		// these are catalogers that should not be selectable other than specific inclusion via name or "deprecated" tag (to remain backwards compatible)
@@ -180,5 +173,6 @@ func DefaultPackageTaskFactories() Factories {
 		newSimplePackageTaskFactory(dotnet.NewDotnetPortableExecutableCataloger, pkgcataloging.DeprecatedTag), // TODO: remove in syft v2.0
 		newSimplePackageTaskFactory(php.NewPeclCataloger, pkgcataloging.DeprecatedTag),                        // TODO: remove in syft v2.0
 		newSimplePackageTaskFactory(nix.NewStoreCataloger, pkgcataloging.DeprecatedTag),                       // TODO: remove in syft v2.0
+
 	}
 }

schema/cyclonedx/spdx.xsd

@@ -2,7 +2,7 @@
 <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
            elementFormDefault="qualified"
            targetNamespace="http://cyclonedx.org/schema/spdx"
-           version="1.0-3.26.0">
+           version="1.0-3.24.0">
 
     <xs:simpleType name="licenseId">
         <xs:restriction base="xs:string">
@@ -162,11 +162,6 @@
                     <xs:documentation>Any OSI License</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
-            <xs:enumeration value="any-OSI-perl-modules">
-                <xs:annotation>
-                    <xs:documentation>Any OSI License - Perl Modules</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
             <xs:enumeration value="Apache-1.0">
                 <xs:annotation>
                     <xs:documentation>Apache License 1.0</xs:documentation>
@@ -312,11 +307,6 @@
                     <xs:documentation>Boehm-Demers-Weiser GC License</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
-            <xs:enumeration value="Boehm-GC-without-fee">
-                <xs:annotation>
-                    <xs:documentation>Boehm-Demers-Weiser GC License (without fee)</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
             <xs:enumeration value="Borceux">
                 <xs:annotation>
                     <xs:documentation>Borceux license</xs:documentation>
@@ -822,16 +812,6 @@
                     <xs:documentation>Creative Commons Public Domain Dedication and Certification</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
-            <xs:enumeration value="CC-PDM-1.0">
-                <xs:annotation>
-                    <xs:documentation>Creative    Commons Public Domain Mark 1.0 Universal</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
-            <xs:enumeration value="CC-SA-1.0">
-                <xs:annotation>
-                    <xs:documentation>Creative Commons Share Alike 1.0 Generic</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
             <xs:enumeration value="CC0-1.0">
                 <xs:annotation>
                     <xs:documentation>Creative Commons Zero v1.0 Universal</xs:documentation>
@@ -1082,21 +1062,6 @@
                     <xs:documentation>DOC License</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
-            <xs:enumeration value="DocBook-Schema">
-                <xs:annotation>
-                    <xs:documentation>DocBook Schema License</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
-            <xs:enumeration value="DocBook-Stylesheet">
-                <xs:annotation>
-                    <xs:documentation>DocBook Stylesheet License</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
-            <xs:enumeration value="DocBook-XML">
-                <xs:annotation>
-                    <xs:documentation>DocBook XML License</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
             <xs:enumeration value="Dotseqn">
                 <xs:annotation>
                     <xs:documentation>Dotseqn License</xs:documentation>
@@ -1302,11 +1267,6 @@
                     <xs:documentation>GD License</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
-            <xs:enumeration value="generic-xts">
-                <xs:annotation>
-                    <xs:documentation>Generic XTS License</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
             <xs:enumeration value="GFDL-1.1">
                 <xs:annotation>
                     <xs:documentation>GNU Free Documentation License v1.1</xs:documentation>
@@ -1567,11 +1527,6 @@
                     <xs:documentation>hdparm License</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
-            <xs:enumeration value="HIDAPI">
-                <xs:annotation>
-                    <xs:documentation>HIDAPI License</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
             <xs:enumeration value="Hippocratic-2.1">
                 <xs:annotation>
                     <xs:documentation>Hippocratic License 2.1</xs:documentation>
@@ -1662,11 +1617,6 @@
                     <xs:documentation>Historical Permission Notice and Disclaimer with MIT disclaimer</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
-            <xs:enumeration value="HPND-Netrek">
-                <xs:annotation>
-                    <xs:documentation>Historical Permission Notice and Disclaimer - Netrek variant</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
             <xs:enumeration value="HPND-Pbmplus">
                 <xs:annotation>
                     <xs:documentation>Historical Permission Notice and Disclaimer - Pbmplus variant</xs:documentation>
@@ -1762,11 +1712,6 @@
                     <xs:documentation>Inner Net License v2.0</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
-            <xs:enumeration value="InnoSetup">
-                <xs:annotation>
-                    <xs:documentation>Inno Setup License</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
             <xs:enumeration value="Intel">
                 <xs:annotation>
                     <xs:documentation>Intel Open Source License</xs:documentation>
@@ -2107,11 +2052,6 @@
                     <xs:documentation>Minpack License</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
-            <xs:enumeration value="MIPS">
-                <xs:annotation>
-                    <xs:documentation>MIPS License</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
             <xs:enumeration value="MirOS">
                 <xs:annotation>
                     <xs:documentation>The MirOS Licence</xs:documentation>
@@ -2132,11 +2072,6 @@
                     <xs:documentation>Enlightenment License (e16)</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
-            <xs:enumeration value="MIT-Click">
-                <xs:annotation>
-                    <xs:documentation>MIT Click License</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
             <xs:enumeration value="MIT-CMU">
                 <xs:annotation>
                     <xs:documentation>CMU License</xs:documentation>
@@ -2837,11 +2772,6 @@
                     <xs:documentation>Ruby License</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
-            <xs:enumeration value="Ruby-pty">
-                <xs:annotation>
-                    <xs:documentation>Ruby pty extension license</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
             <xs:enumeration value="SAX-PD">
                 <xs:annotation>
                     <xs:documentation>Sax Public Domain Notice</xs:documentation>
@@ -2877,11 +2807,6 @@
                     <xs:documentation>Sendmail License 8.23</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
-            <xs:enumeration value="Sendmail-Open-Source-1.1">
-                <xs:annotation>
-                    <xs:documentation>Sendmail Open Source License v1.1</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
             <xs:enumeration value="SGI-B-1.0">
                 <xs:annotation>
                     <xs:documentation>SGI Free Software License B v1.0</xs:documentation>
@@ -2942,11 +2867,6 @@
                     <xs:documentation>Sleepycat License</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
-            <xs:enumeration value="SMAIL-GPL">
-                <xs:annotation>
-                    <xs:documentation>SMAIL General Public License</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
             <xs:enumeration value="SMLNJ">
                 <xs:annotation>
                     <xs:documentation>Standard ML of New Jersey License</xs:documentation>
@@ -3087,11 +3007,6 @@
                     <xs:documentation>Transitive Grace Period Public Licence 1.0</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
-            <xs:enumeration value="ThirdEye">
-                <xs:annotation>
-                    <xs:documentation>ThirdEye License</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
             <xs:enumeration value="threeparttable">
                 <xs:annotation>
                     <xs:documentation>threeparttable License</xs:documentation>
@@ -3122,11 +3037,6 @@
                     <xs:documentation>THOR Public License 1.0</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
-            <xs:enumeration value="TrustedQSL">
-                <xs:annotation>
-                    <xs:documentation>TrustedQSL License</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
             <xs:enumeration value="TTWL">
                 <xs:annotation>
                     <xs:documentation>Text-Tabs+Wrap License</xs:documentation>
@@ -3147,11 +3057,6 @@
                     <xs:documentation>Technische Universitaet Berlin License 2.0</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
-            <xs:enumeration value="Ubuntu-font-1.0">
-                <xs:annotation>
-                    <xs:documentation>Ubuntu Font Licence v1.0</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
             <xs:enumeration value="UCAR">
                 <xs:annotation>
                     <xs:documentation>UCAR License</xs:documentation>
@@ -3267,11 +3172,6 @@
                     <xs:documentation>Do What The F*ck You Want To Public License</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
-            <xs:enumeration value="wwl">
-                <xs:annotation>
-                    <xs:documentation>WWL License</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
             <xs:enumeration value="wxWindows">
                 <xs:annotation>
                     <xs:documentation>wxWindows Library License</xs:documentation>
@@ -3287,11 +3187,6 @@
                     <xs:documentation>X11 License Distribution Modification Variant</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
-            <xs:enumeration value="X11-swapped">
-                <xs:annotation>
-                    <xs:documentation>X11 swapped final paragraphs</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
             <xs:enumeration value="Xdebug-1.03">
                 <xs:annotation>
                     <xs:documentation>Xdebug License v 1.03</xs:documentation>
@@ -3463,11 +3358,6 @@
                     <xs:documentation>Bootloader Distribution Exception</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
-            <xs:enumeration value="CGAL-linking-exception">
-                <xs:annotation>
-                    <xs:documentation>CGAL Linking Exception</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
             <xs:enumeration value="Classpath-exception-2.0">
                 <xs:annotation>
                     <xs:documentation>Classpath exception 2.0</xs:documentation>
@@ -3493,11 +3383,6 @@
                     <xs:documentation>eCos exception 2.0</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
-            <xs:enumeration value="erlang-otp-linking-exception">
-                <xs:annotation>
-                    <xs:documentation>Erlang/OTP Linking Exception</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
             <xs:enumeration value="Fawkes-Runtime-exception">
                 <xs:annotation>
                     <xs:documentation>Fawkes Runtime Exception</xs:documentation>
@@ -3540,7 +3425,7 @@
             </xs:enumeration>
             <xs:enumeration value="Gmsh-exception">
                 <xs:annotation>
-                    <xs:documentation>Gmsh exception</xs:documentation>
+                    <xs:documentation>Gmsh exception&gt;</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
             <xs:enumeration value="GNAT-exception">
@@ -3563,11 +3448,6 @@
                     <xs:documentation>GNU JavaMail exception</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
-            <xs:enumeration value="GPL-3.0-389-ds-base-exception">
-                <xs:annotation>
-                    <xs:documentation>GPL-3.0 389 DS Base Exception</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
             <xs:enumeration value="GPL-3.0-interface-exception">
                 <xs:annotation>
                     <xs:documentation>GPL-3.0 Interface Exception</xs:documentation>
@@ -3598,21 +3478,11 @@
                     <xs:documentation>GStreamer Exception (2008)</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
-            <xs:enumeration value="harbour-exception">
-                <xs:annotation>
-                    <xs:documentation>harbour exception</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
             <xs:enumeration value="i2p-gpl-java-exception">
                 <xs:annotation>
                     <xs:documentation>i2p GPL+Java Exception</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
-            <xs:enumeration value="Independent-modules-exception">
-                <xs:annotation>
-                    <xs:documentation>Independent Module Linking exception</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
             <xs:enumeration value="KiCad-libraries-exception">
                 <xs:annotation>
                     <xs:documentation>KiCad Libraries Exception</xs:documentation>
@@ -3658,11 +3528,6 @@
                     <xs:documentation>Macros and Inline Functions Exception</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
-            <xs:enumeration value="mxml-exception">
-                <xs:annotation>
-                    <xs:documentation>mxml Exception</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
             <xs:enumeration value="Nokia-Qt-exception-1.1">
                 <xs:annotation>
                     <xs:documentation>Nokia Qt LGPL exception 1.1</xs:documentation>
@@ -3718,11 +3583,6 @@
                     <xs:documentation>Qwt exception 1.0</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
-            <xs:enumeration value="romic-exception">
-                <xs:annotation>
-                    <xs:documentation>Romic Exception</xs:documentation>
-                </xs:annotation>
-            </xs:enumeration>
             <xs:enumeration value="RRDtool-FLOSS-exception-2.0">
                 <xs:annotation>
                     <xs:documentation>RRDtool FLOSS exception 2.0</xs:documentation>