chore(deps): update anchore dependencies (#3525)

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>

.binny.yaml

@@ -26,7 +26,7 @@ tools:
   # used for linting
   - name: golangci-lint
     version:
-      want: v1.62.0
+      want: v1.62.2
     method: github-release
     with:
       repo: golangci/golangci-lint
@@ -58,7 +58,7 @@ tools:
   # used to release all artifacts
   - name: goreleaser
     version:
-      want: v2.4.5
+      want: v2.4.8
     method: github-release
     with:
       repo: goreleaser/goreleaser
@@ -103,7 +103,7 @@ tools:
   # used for running all local and CI tasks
   - name: task
     version:
-      want: v3.40.0
+      want: v3.40.1
     method: github-release
     with:
       repo: go-task/task
@@ -111,7 +111,7 @@ tools:
   # used for triggering a release
   - name: gh
     version:
-      want: v2.62.0
+      want: v2.63.2
     method: github-release
     with:
       repo: cli/cli
@@ -119,7 +119,7 @@ tools:
   # used to upload test fixture cache
   - name: oras
     version:
-      want: v1.2.0
+      want: v1.2.1
     method: github-release
     with:
       repo: oras-project/oras
@@ -127,7 +127,7 @@ tools:
   # used to upload test fixture cache
   - name: yq
     version:
-      want: v4.44.3
+      want: v4.44.6
     method: github-release
     with:
       repo: mikefarah/yq

.github/actions/bootstrap/action.yaml

@@ -5,7 +5,7 @@ inputs:
   go-version:
     description: "Go version to install"
     required: true
-    default: "1.22.x"
+    default: "1.23.x"
   go-dependencies:
     description: "Download go dependencies"
     required: true
@@ -18,6 +18,9 @@ inputs:
     description: "Download test fixture cache from OCI and github actions"
     required: true
     default: "false"
+  tools:
+    description: "whether to install tools"
+    default: "true"
   bootstrap-apt-packages:
     description: "Space delimited list of tools to install via apt"
     default: "libxml2-utils"
@@ -32,6 +35,7 @@ runs:
         go-version: ${{ inputs.go-version }}
 
     - name: Restore tool cache
+      if: inputs.tools == 'true'
       id: tool-cache
       uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
       with:
@@ -40,6 +44,7 @@ runs:
 
     - name: Install project tools
       shell: bash
+      if: inputs.tools == 'true'
       run: make tools
 
     - name: Install go dependencies

.github/pull_request_template.md

@@ -5,7 +5,7 @@ or link to an issue where this is explained.
 
 <!-- If this completes an issue, please include: -->
 
-- Fixes #
+- Fixes
 
 ## Type of change
 

.github/workflows/benchmark-testing.yaml

@@ -23,7 +23,7 @@ jobs:
         uses: ./.github/actions/bootstrap
 
       - name: Restore base benchmark result
-        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a #v4.1.2
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 #v4.2.0
         with:
           path: test/results/benchmark-main.txt
           # use base sha for PR or new commit hash for main push in benchmark result key

.github/workflows/codeql-analysis.yml

@@ -39,13 +39,13 @@ jobs:
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
 
     - name: Install Go
-      uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed #v5.1.0
+      uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a #v5.2.0
       with:
         go-version-file: go.mod
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f #v3.27.4
+      uses: github/codeql-action/init@df409f7d9260372bd5f19e5b04e83cb3c43714ae #v3.27.9
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -56,7 +56,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f #v3.27.4
+      uses: github/codeql-action/autobuild@df409f7d9260372bd5f19e5b04e83cb3c43714ae #v3.27.9
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -70,4 +70,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f #v3.27.4
+      uses: github/codeql-action/analyze@df409f7d9260372bd5f19e5b04e83cb3c43714ae #v3.27.9

.github/workflows/release.yaml

@@ -148,7 +148,7 @@ jobs:
           # for updating brew formula in anchore/homebrew-syft
           GITHUB_BREW_TOKEN: ${{ secrets.ANCHOREOPS_GITHUB_OSS_WRITE_TOKEN }}
 
-      - uses: anchore/sbom-action@fc46e51fd3cb168ffb36c6d1915723c47db58abb #v0.17.7
+      - uses: anchore/sbom-action@55dc4ee22412511ee8c3142cbea40418e6cec693 #v0.17.8
         continue-on-error: true
         with:
           file: go.mod

.github/workflows/update-anchore-dependencies.yml

@@ -0,0 +1,49 @@
+name: PR to update Anchore dependencies
+on:
+  workflow_dispatch:
+    inputs:
+      repos:
+        description: "List of dependencies to update"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'anchore' # only run for main repo (not forks)
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
+
+      - name: Bootstrap environment
+        uses: ./.github/actions/bootstrap
+        with:
+          tools: false
+          bootstrap-apt-packages: ""
+
+      - name: Update dependencies
+        id: update
+        uses: anchore/workflows/.github/actions/update-go-dependencies@main
+        with:
+          repos: ${{ github.event.inputs.repos }}
+
+      - uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a #v2.1.0
+        id: generate-token
+        with:
+          app_id: ${{ secrets.TOKEN_APP_ID }}
+          private_key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}
+
+      - uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f #v7.0.5
+        with:
+          signoff: true
+          delete-branch: true
+          draft: ${{ steps.update.outputs.draft }}
+          # do not change this branch, as other workflows depend on it
+          branch: auto/integration
+          labels: dependencies,pre-release
+          commit-message: "chore(deps): update anchore dependencies"
+          title: "chore(deps): update anchore dependencies"
+          body: ${{ steps.update.outputs.summary }}
+          token: ${{ steps.generate-token.outputs.token }}

.github/workflows/update-stereoscope-release.yml

@@ -1,57 +0,0 @@
-name: PR for latest Stereoscope release
-on:
-  schedule:
-    - cron: "0 8 * * *" # 3 AM EST
-
-  workflow_dispatch:
-
-env:
-  GO_VERSION: "1.21.x"
-  GO_STABLE_VERSION: true
-
-permissions:
-  contents: read
-
-jobs:
-  upgrade-stereoscope:
-    runs-on: ubuntu-latest
-    if: github.repository == 'anchore/syft' # only run for main repo
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
-
-      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed #v5.1.0
-        with:
-          go-version: ${{ env.GO_VERSION }}
-          stable: ${{ env.GO_STABLE_VERSION }}
-
-      - name: Bootstrap environment
-        uses: ./.github/actions/bootstrap
-
-      - run: |
-          LATEST_VERSION=$(git ls-remote https://github.com/anchore/stereoscope main | head -n1 | awk '{print $1;}')
-
-          # update go.mod
-          go get github.com/anchore/stereoscope@$LATEST_VERSION
-          go mod tidy
-
-          # export the version for use with create-pull-request
-          echo "LATEST_VERSION=$LATEST_VERSION" >> $GITHUB_OUTPUT
-        id: latest-version
-
-      - uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a #v2.1.0
-        id: generate-token
-        with:
-          app_id: ${{ secrets.TOKEN_APP_ID }}
-          private_key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}
-
-      - uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f #v7.0.5
-        with:
-          signoff: true
-          delete-branch: true
-          branch: auto/latest-stereoscope
-          labels: dependencies
-          commit-message: "chore(deps): update stereoscope to ${{ steps.latest-version.outputs.LATEST_VERSION }}"
-          title: "chore(deps): update stereoscope to ${{ steps.latest-version.outputs.LATEST_VERSION }}"
-          body: |
-            Update Stereoscope to ${{ steps.latest-version.outputs.LATEST_VERSION }}
-          token: ${{ steps.generate-token.outputs.token }}

.github/workflows/validations.yaml

@@ -78,7 +78,7 @@ jobs:
       # why not use actions/upload-artifact? It is very slow (3 minutes to upload ~600MB of data, vs 10 seconds with this approach).
       # see https://github.com/actions/upload-artifact/issues/199 for more info
       - name: Upload snapshot artifacts
-        uses: actions/cache/save@6849a6489940f00c2f30c0fb92c6274307ccb58a #v4.1.2
+        uses: actions/cache/save@1bd1e32a3bdc45362d1e726936510720a7c30a57 #v4.2.0
         with:
           # we need to preserve the snapshot data itself as well as the task data that confirms if the
           # snapshot build is stale or not. Otherwise the downstream jobs will attempt to rebuild the snapshot
@@ -104,7 +104,7 @@ jobs:
 
       - name: Download snapshot build
         id: snapshot-cache
-        uses: actions/cache/restore@6849a6489940f00c2f30c0fb92c6274307ccb58a #v4.1.2
+        uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 #v4.2.0
         with:
           path: |
             snapshot
@@ -152,7 +152,7 @@ jobs:
 
       - name: Download snapshot build
         id: snapshot-cache
-        uses: actions/cache/restore@6849a6489940f00c2f30c0fb92c6274307ccb58a #v4.1.2
+        uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 #v4.2.0
         with:
           path: |
             snapshot
@@ -187,7 +187,7 @@ jobs:
 
       - name: Download snapshot build
         id: snapshot-cache
-        uses: actions/cache/restore@6849a6489940f00c2f30c0fb92c6274307ccb58a #v4.1.2
+        uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 #v4.2.0
         with:
           path: |
             snapshot

DEVELOPING.md

@@ -367,11 +367,11 @@ package under test and should always be updated by invoking `go test` on the spe
 update flag provided.
 
 Many of the `Format` tests make use of this approach, where the raw SBOM report is saved in the repo and the test 
-compares that SBOM with what is generated from the latest presenter code. For instance, at the time of this writing 
-the CycloneDX presenter snapshots can be updated by running:
+compares that SBOM with what is generated from the latest presenter code. The following command can be used to
+update the golden files for the various snapshot tests:
 
 ```bash
-go test ./internal/formats -update-cyclonedx
+make update-format-golden-files
 ```
 
 These flags are defined at the top of the test files that have tests that use the snapshot files.

Taskfile.yaml

@@ -191,6 +191,14 @@ tasks:
 
 
   ## Testing tasks #################################
+  update-format-golden-files:
+    desc: "Update golden (i.e. snapshot) files used by unit tests"
+    cmds:
+      - go test ./syft/format/spdxjson -update-spdx-json
+      - go test ./syft/format/spdxtagvalue -update-spdx-tv
+      - go test ./syft/format/cyclonedxxml -update-cyclonedx-xml
+      - go test ./syft/format/cyclonedxjson -update-cyclonedx-json
+      - go test ./syft/format/syftjson -update-json
 
   unit:
     desc: Run unit tests

cmd/syft/internal/options/source.go

@@ -5,9 +5,11 @@ import (
 	"sort"
 	"strings"
 
+	"github.com/dustin/go-humanize"
 	"github.com/scylladb/go-set/strset"
 
 	"github.com/anchore/clio"
+	stereoscopeFile "github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/syft/syft/source/sourceproviders"
 )
 
@@ -27,6 +29,8 @@ var _ interface {
 	clio.FieldDescriber
 } = (*sourceConfig)(nil)
 
+var _ clio.PostLoader = (*imageSource)(nil)
+
 func (o *sourceConfig) DescribeFields(descriptions clio.FieldDescriptionSet) {
 	descriptions.Add(&o.File.Digests, `the file digest algorithms to use on the scanned file (options: "md5", "sha1", "sha224", "sha256", "sha384", "sha512")`)
 	descriptions.Add(&o.Image.DefaultPullSource, `allows users to specify which image source should be used to generate the sbom
@@ -35,6 +39,7 @@ valid values are: registry, docker, podman`)
 
 type imageSource struct {
 	DefaultPullSource string `json:"default-pull-source" yaml:"default-pull-source" mapstructure:"default-pull-source"`
+	MaxLayerSize      string `json:"max-layer-size" yaml:"max-layer-size" mapstructure:"max-layer-size"`
 }
 
 func defaultSourceConfig() sourceConfig {
@@ -56,7 +61,14 @@ func (c *fileSource) PostLoad() error {
 	return nil
 }
 
-func (c imageSource) PostLoad() error {
+func (c *imageSource) PostLoad() error {
+	if c.MaxLayerSize != "" {
+		perFileReadLimit, err := humanize.ParseBytes(c.MaxLayerSize)
+		if err != nil {
+			return err
+		}
+		stereoscopeFile.SetPerFileReadLimit(int64(perFileReadLimit))
+	}
 	return checkDefaultSourceValues(c.DefaultPullSource)
 }
 

go.mod

@@ -1,6 +1,6 @@
 module github.com/anchore/syft
 
-go 1.22.9
+go 1.23.2
 
 require (
 	github.com/CycloneDX/cyclonedx-go v0.9.1
@@ -9,7 +9,7 @@ require (
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
 	github.com/acobaugh/osrelease v0.1.0
 	github.com/anchore/bubbly v0.0.0-20231115134915-def0aba654a9
-	github.com/anchore/clio v0.0.0-20241015191535-f538a9016e10
+	github.com/anchore/clio v0.0.0-20241115144204-29e89f9fa837
 	github.com/anchore/fangs v0.0.0-20241014201141-b6e4b3469f10
 	github.com/anchore/go-collections v0.0.0-20240216171411-9321230ce537
 	github.com/anchore/go-logger v0.0.0-20230725134548-c21dafa1ec5a
@@ -17,19 +17,19 @@ require (
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.1.1-0.20241018175412-5c22e6360c4f
-	github.com/anchore/stereoscope v0.0.9-0.20241113211114-aa3a3ef4efe8
+	github.com/anchore/stereoscope v0.0.11
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
 	// we are hinting brotli to latest due to warning when installing archiver v3:
 	// go: warning: github.com/andybalholm/brotli@v1.0.1: retracted by module author: occasional panics and data corruption
 	github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46
 	github.com/bmatcuk/doublestar/v4 v4.7.1
 	github.com/charmbracelet/bubbles v0.20.0
-	github.com/charmbracelet/bubbletea v1.2.2
+	github.com/charmbracelet/bubbletea v1.2.4
 	github.com/charmbracelet/lipgloss v1.0.0
 	github.com/dave/jennifer v1.7.1
 	github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da
 	github.com/distribution/reference v0.6.0
-	github.com/docker/docker v27.3.1+incompatible
+	github.com/docker/docker v27.4.0+incompatible
 	github.com/dustin/go-humanize v1.0.1
 	github.com/elliotchance/phpserialize v1.4.0
 	github.com/facebookincubator/nvdtools v0.1.5
@@ -46,11 +46,10 @@ require (
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/iancoleman/strcase v0.3.0
 	github.com/invopop/jsonschema v0.7.0
-	github.com/jedib0t/go-pretty/v6 v6.6.1
+	github.com/jedib0t/go-pretty/v6 v6.6.4
 	github.com/jinzhu/copier v0.4.0
 	github.com/kastenhq/goversion v0.0.0-20230811215019-93b2f8823953
 	github.com/knqyf263/go-rpmdb v0.1.1
-	github.com/mholt/archiver/v3 v3.5.1
 	github.com/microsoft/go-rustaudit v0.0.0-20220730194248-4b17361d90a5
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/mitchellh/hashstructure/v2 v2.0.2
@@ -60,7 +59,7 @@ require (
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/pelletier/go-toml v1.9.5
 	github.com/quasilyte/go-ruleguard/dsl v0.3.22
-	github.com/saferwall/pe v1.5.5
+	github.com/saferwall/pe v1.5.6
 	github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d
 	github.com/sanity-io/litter v1.5.5
 	github.com/sassoftware/go-rpmutils v0.4.0
@@ -70,7 +69,7 @@ require (
 	github.com/spdx/tools-golang v0.5.5
 	github.com/spf13/afero v1.11.0
 	github.com/spf13/cobra v1.8.1
-	github.com/stretchr/testify v1.9.0
+	github.com/stretchr/testify v1.10.0
 	github.com/vbatts/go-mtree v0.5.4
 	github.com/vifraa/gopom v1.0.0
 	github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651
@@ -79,9 +78,9 @@ require (
 	github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1
 	go.uber.org/goleak v1.3.0
 	golang.org/x/mod v0.22.0
-	golang.org/x/net v0.31.0
+	golang.org/x/net v0.32.0
 	gopkg.in/yaml.v3 v3.0.1
-	modernc.org/sqlite v1.33.1
+	modernc.org/sqlite v1.34.2
 )
 
 require google.golang.org/genproto v0.0.0-20240213162025-012b6fc9bca9 // indirect
@@ -90,7 +89,8 @@ require (
 	github.com/BurntSushi/toml v1.4.0
 	github.com/OneOfOne/xxhash v1.2.8
 	github.com/adrg/xdg v0.5.3
-	github.com/magiconair/properties v1.8.7
+	github.com/anchore/archiver/v3 v3.5.3-0.20241210171143-5b1d8d1c7c51
+	github.com/magiconair/properties v1.8.9
 	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
 )
 
@@ -103,9 +103,9 @@ require (
 	github.com/Masterminds/semver/v3 v3.3.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/Microsoft/hcsshim v0.11.7 // indirect
-	github.com/ProtonMail/go-crypto v1.1.2 // indirect
+	github.com/ProtonMail/go-crypto v1.1.3 // indirect
 	github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092 // indirect
-	github.com/andybalholm/brotli v1.0.4 // indirect
+	github.com/andybalholm/brotli v1.1.1 // indirect
 	github.com/aquasecurity/go-version v0.0.0-20210121072130-637058cfe492 // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
@@ -115,7 +115,7 @@ require (
 	github.com/charmbracelet/x/term v0.2.1 // indirect
 	github.com/cloudflare/circl v1.3.8 // indirect
 	github.com/containerd/cgroups v1.1.0 // indirect
-	github.com/containerd/containerd v1.7.23 // indirect
+	github.com/containerd/containerd v1.7.24 // indirect
 	github.com/containerd/containerd/api v1.7.19 // indirect
 	github.com/containerd/continuity v0.4.2 // indirect
 	github.com/containerd/errdefs v0.3.0 // indirect
@@ -127,7 +127,7 @@ require (
 	github.com/containerd/typeurl/v2 v2.1.1 // indirect
 	github.com/cyphar/filepath-securejoin v0.2.5 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/docker/cli v27.3.1+incompatible // indirect
+	github.com/docker/cli v27.4.0+incompatible // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.7.0 // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
@@ -140,7 +140,7 @@ require (
 	github.com/felixge/fgprof v0.9.3 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.7.0 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.6 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.7 // indirect
 	github.com/gkampitakis/ciinfo v0.3.0 // indirect
 	github.com/gkampitakis/go-diff v1.3.2 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
@@ -160,8 +160,8 @@ require (
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
-	github.com/klauspost/compress v1.17.8 // indirect
-	github.com/klauspost/pgzip v1.2.5 // indirect
+	github.com/klauspost/compress v1.17.11 // indirect
+	github.com/klauspost/pgzip v1.2.6 // indirect
 	github.com/kr/pretty v0.3.1 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/logrusorgru/aurora v2.0.3+incompatible // indirect
@@ -184,13 +184,13 @@ require (
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/muesli/termenv v0.15.2 // indirect
 	github.com/ncruces/go-strftime v0.1.9 // indirect
-	github.com/nwaples/rardecode v1.1.0 // indirect
+	github.com/nwaples/rardecode v1.1.3 // indirect
 	github.com/opencontainers/image-spec v1.1.0 // indirect
 	github.com/opencontainers/runtime-spec v1.1.0 // indirect
 	github.com/opencontainers/selinux v1.11.0 // indirect
 	github.com/pborman/indent v1.2.1 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.2 // indirect
-	github.com/pierrec/lz4/v4 v4.1.19 // indirect
+	github.com/pierrec/lz4/v4 v4.1.21 // indirect
 	github.com/pjbgf/sha1cd v0.3.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/profile v1.7.0 // indirect
@@ -210,8 +210,8 @@ require (
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/spf13/viper v1.19.0 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/sylabs/sif/v2 v2.20.0 // indirect
-	github.com/sylabs/squashfs v1.0.0 // indirect
+	github.com/sylabs/sif/v2 v2.20.1 // indirect
+	github.com/sylabs/squashfs v1.0.4 // indirect
 	github.com/therootcompany/xz v1.0.1 // indirect
 	github.com/tidwall/gjson v1.17.0 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
@@ -231,11 +231,11 @@ require (
 	go.opentelemetry.io/otel/trace v1.24.0 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
 	go.uber.org/multierr v1.9.0 // indirect
-	golang.org/x/crypto v0.29.0 // indirect
-	golang.org/x/sync v0.9.0 // indirect
-	golang.org/x/sys v0.27.0 // indirect
-	golang.org/x/term v0.26.0 // indirect
-	golang.org/x/text v0.20.0 // indirect
+	golang.org/x/crypto v0.31.0 // indirect
+	golang.org/x/sync v0.10.0 // indirect
+	golang.org/x/sys v0.28.0 // indirect
+	golang.org/x/term v0.27.0 // indirect
+	golang.org/x/text v0.21.0 // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240314234333-6e1732d8331c // indirect
 	google.golang.org/grpc v1.62.1 // indirect
@@ -254,5 +254,3 @@ retract (
 	v0.53.2
 	v0.53.1 // Published accidentally with incorrect license in depdencies
 )
-
-replace github.com/mholt/archiver/v3 v3.5.1 => github.com/anchore/archiver/v3 v3.5.2

go.sum

@@ -81,8 +81,8 @@ github.com/Microsoft/hcsshim v0.11.7/go.mod h1:MV8xMfmECjl5HdO7U/3/hFVnkmSBjAjmA
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/OneOfOne/xxhash v1.2.8 h1:31czK/TI9sNkxIKfaUfGlU47BAxQ0ztGgd9vPyqimf8=
 github.com/OneOfOne/xxhash v1.2.8/go.mod h1:eZbhyaAYD41SGSSsnmcpxVoRiQ/MPUTjUdIIOT9Um7Q=
-github.com/ProtonMail/go-crypto v1.1.2 h1:A7JbD57ThNqh7XjmHE+PXpQ3Dqt3BrSAC0AL0Go3KS0=
-github.com/ProtonMail/go-crypto v1.1.2/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
+github.com/ProtonMail/go-crypto v1.1.3 h1:nRBOetoydLeUb4nHajyO2bKqMLfWQ/ZPwkXqXxPxCFk=
+github.com/ProtonMail/go-crypto v1.1.3/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d/go.mod h1:asat636LX7Bqt5lYEZ27JNDcqxfjdBQuJ/MM4CN/Lzo=
 github.com/acobaugh/osrelease v0.1.0 h1:Yb59HQDGGNhCj4suHaFQQfBps5wyoKLSSX/J/+UifRE=
@@ -93,12 +93,12 @@ github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuy
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
-github.com/anchore/archiver/v3 v3.5.2 h1:Bjemm2NzuRhmHy3m0lRe5tNoClB9A4zYyDV58PaB6aA=
-github.com/anchore/archiver/v3 v3.5.2/go.mod h1:e3dqJ7H78uzsRSEACH1joayhuSyhnonssnDhppzS1L4=
+github.com/anchore/archiver/v3 v3.5.3-0.20241210171143-5b1d8d1c7c51 h1:yhk+P8lF3ZiROjmaVRao9WGTRo4b/wYjoKEiAHWrKwc=
+github.com/anchore/archiver/v3 v3.5.3-0.20241210171143-5b1d8d1c7c51/go.mod h1:nwuGSd7aZp0rtYt79YggCGafz1RYsclE7pi3fhLwvuw=
 github.com/anchore/bubbly v0.0.0-20231115134915-def0aba654a9 h1:p0ZIe0htYOX284Y4axJaGBvXHU0VCCzLN5Wf5XbKStU=
 github.com/anchore/bubbly v0.0.0-20231115134915-def0aba654a9/go.mod h1:3ZsFB9tzW3vl4gEiUeuSOMDnwroWxIxJelOOHUp8dSw=
-github.com/anchore/clio v0.0.0-20241015191535-f538a9016e10 h1:3xmanFdoQEH0REvPA+gLm3Km0/981F4z2a/7ADTlv8k=
-github.com/anchore/clio v0.0.0-20241015191535-f538a9016e10/go.mod h1:h6Ly2hlKjQoPtI3rA8oB5afSmB/XimhcY55xbuW4Dwo=
+github.com/anchore/clio v0.0.0-20241115144204-29e89f9fa837 h1:bIG3WsfosZsJ5LMC7PB9J/ekFM3a0j0ZEDvN3ID6GTI=
+github.com/anchore/clio v0.0.0-20241115144204-29e89f9fa837/go.mod h1:tRQVKkjYeejrh9AdM0s1esbwtMU7rdHAHSQWkv4qskE=
 github.com/anchore/fangs v0.0.0-20241014201141-b6e4b3469f10 h1:w+HibE+e/heP6ysADh7sWxg5LhYdVqrpB1A4Hmgjyx8=
 github.com/anchore/fangs v0.0.0-20241014201141-b6e4b3469f10/go.mod h1:s0L1//Sxn6Rq0Dcxx+dmT/RRmD9HhsaJjJkPUJHLJLM=
 github.com/anchore/go-collections v0.0.0-20240216171411-9321230ce537 h1:GjNGuwK5jWjJMyVppBjYS54eOiiSNv4Ba869k4wh72Q=
@@ -115,12 +115,11 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZV
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/packageurl-go v0.1.1-0.20241018175412-5c22e6360c4f h1:dAQPIrQ3a5PBqZeZ+B9NGZsGmodk4NO9OjDIsQmQyQM=
 github.com/anchore/packageurl-go v0.1.1-0.20241018175412-5c22e6360c4f/go.mod h1:KoYIv7tdP5+CC9VGkeZV4/vGCKsY55VvoG+5dadg4YI=
-github.com/anchore/stereoscope v0.0.9-0.20241113211114-aa3a3ef4efe8 h1:gYed/fx5OeW+isRay2q60JGt8+ED/odEPiJ/SWlbw8s=
-github.com/anchore/stereoscope v0.0.9-0.20241113211114-aa3a3ef4efe8/go.mod h1:c2oGDU0R+llJObsatBSenjYPV1raKhMq9GEqe8J56EI=
+github.com/anchore/stereoscope v0.0.11 h1:d+dePyWyQzoQehnWOnx/aISW5HW1zLAQKzvaFIpydsU=
+github.com/anchore/stereoscope v0.0.11/go.mod h1:dxQyMHSdvgOCscQd/lInPHeP5xCJsZYxpzvzy8Y804Y=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
-github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
-github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY3JY=
-github.com/andybalholm/brotli v1.0.4/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
+github.com/andybalholm/brotli v1.1.1 h1:PR2pgnyFznKEugtsUo0xLdDop5SKXd5Qf5ysW+7XdTA=
+github.com/andybalholm/brotli v1.1.1/go.mod h1:05ib4cKhjx3OQYUY22hTVd34Bc8upXjOLL2rKwwZBoA=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
@@ -158,8 +157,8 @@ github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL
 github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/charmbracelet/bubbles v0.20.0 h1:jSZu6qD8cRQ6k9OMfR1WlM+ruM8fkPWkHvQWD9LIutE=
 github.com/charmbracelet/bubbles v0.20.0/go.mod h1:39slydyswPy+uVOHZ5x/GjwVAFkCsV8IIVy+4MhzwwU=
-github.com/charmbracelet/bubbletea v1.2.2 h1:EMz//Ky/aFS2uLcKqpCst5UOE6z5CFDGRsUpyXz0chs=
-github.com/charmbracelet/bubbletea v1.2.2/go.mod h1:Qr6fVQw+wX7JkWWkVyXYk/ZUQ92a6XNekLXa3rR18MM=
+github.com/charmbracelet/bubbletea v1.2.4 h1:KN8aCViA0eps9SCOThb2/XPIlea3ANJLUkv3KnQRNCE=
+github.com/charmbracelet/bubbletea v1.2.4/go.mod h1:Qr6fVQw+wX7JkWWkVyXYk/ZUQ92a6XNekLXa3rR18MM=
 github.com/charmbracelet/harmonica v0.2.0 h1:8NxJWRWg/bzKqqEaaeFNipOu77YR5t8aSwG4pgaUBiQ=
 github.com/charmbracelet/harmonica v0.2.0/go.mod h1:KSri/1RMQOZLbw7AHqgcBycp8pgJnQMYYT8QZRqZ1Ao=
 github.com/charmbracelet/lipgloss v1.0.0 h1:O7VkGDvqEdGi93X+DeqsQ7PKHDgtQfF8j8/O2qFMQNg=
@@ -188,8 +187,8 @@ github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20211130200136-a8f946100490/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/containerd/cgroups v1.1.0 h1:v8rEWFl6EoqHB+swVNjVoCJE8o3jX7e8nqBGPLaDFBM=
 github.com/containerd/cgroups v1.1.0/go.mod h1:6ppBcbh/NOOUU+dMKrykgaBnK9lCIBxHqJDGwsa1mIw=
-github.com/containerd/containerd v1.7.23 h1:H2CClyUkmpKAGlhQp95g2WXHfLYc7whAuvZGBNYOOwQ=
-github.com/containerd/containerd v1.7.23/go.mod h1:7QUzfURqZWCZV7RLNEn1XjUCQLEf0bkaK4GjUaZehxw=
+github.com/containerd/containerd v1.7.24 h1:zxszGrGjrra1yYJW/6rhm9cJ1ZQ8rkKBR48brqsa7nA=
+github.com/containerd/containerd v1.7.24/go.mod h1:7QUzfURqZWCZV7RLNEn1XjUCQLEf0bkaK4GjUaZehxw=
 github.com/containerd/containerd/api v1.7.19 h1:VWbJL+8Ap4Ju2mx9c9qS1uFSB1OVYr5JJrW2yT5vFoA=
 github.com/containerd/containerd/api v1.7.19/go.mod h1:fwGavl3LNwAV5ilJ0sbrABL44AQxmNjDRcwheXDb6Ig=
 github.com/containerd/continuity v0.4.2 h1:v3y/4Yz5jwnvqPKJJ+7Wf93fyWoCB3F5EclWG023MDM=
@@ -229,12 +228,12 @@ github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da/go.mod h1:B3tI9iGHi4i
 github.com/dgrijalva/jwt-go/v4 v4.0.0-preview1/go.mod h1:+hnT3ywWDTAFrW5aE+u2Sa/wT555ZqwoCS+pk3p6ry4=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/cli v27.3.1+incompatible h1:qEGdFBF3Xu6SCvCYhc7CzaQTlBmqDuzxPDpigSyeKQQ=
-github.com/docker/cli v27.3.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v27.4.0+incompatible h1:/nJzWkcI1MDMN+U+px/YXnQWJqnu4J+QKGTfD6ptiTc=
+github.com/docker/cli v27.4.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v27.3.1+incompatible h1:KttF0XoteNTicmUtBO0L2tP+J7FGRFTjaEF4k6WdhfI=
-github.com/docker/docker v27.3.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v27.4.0+incompatible h1:I9z7sQ5qyzO0BfAb9IMOawRkAGxhYsidKiTMcm0DU+A=
+github.com/docker/docker v27.4.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.7.0 h1:xtCHsjxogADNZcdv1pKUHXryefjlVRqWqIhk/uXJp0A=
 github.com/docker/docker-credential-helpers v0.7.0/go.mod h1:rETQfLdHNT3foU5kuNkFR1R1V12OJRRO5lzt2D1b5X0=
 github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
@@ -286,8 +285,8 @@ github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7z
 github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5Ai1i3InKU=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
-github.com/gabriel-vasile/mimetype v1.4.6 h1:3+PzJTKLkvgjeTbts6msPJt4DixhT4YtFNf1gtGe3zc=
-github.com/gabriel-vasile/mimetype v1.4.6/go.mod h1:JX1qVKqZd40hUPpAfiNTe0Sne7hdfKSbOqqmkq8GCXc=
+github.com/gabriel-vasile/mimetype v1.4.7 h1:SKFKl7kD0RiPdbht0s7hFtjl489WcQ1VyPW8ZzUMYCA=
+github.com/gabriel-vasile/mimetype v1.4.7/go.mod h1:GDlAgAyIRT27BhFl53XNAFtfjzOkLaF35JdEG0P7LtU=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/github/go-spdx/v2 v2.3.2 h1:IfdyNHTqzs4zAJjXdVQfRnxt1XMfycXoHBE2Vsm1bjs=
 github.com/github/go-spdx/v2 v2.3.2/go.mod h1:2ZxKsOhvBp+OYBDlsGnUMcchLeo2mrpEBn2L1C+U3IQ=
@@ -365,7 +364,6 @@ github.com/golang/protobuf v1.5.1/go.mod h1:DopwsBzvsk0Fs44TXzsVbJyPhcCPeIwnvohx
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/golang/snappy v0.0.2/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
 github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
@@ -481,8 +479,8 @@ github.com/invopop/jsonschema v0.7.0 h1:2vgQcBz1n256N+FpX3Jq7Y17AjYt46Ig3zIWyy77
 github.com/invopop/jsonschema v0.7.0/go.mod h1:O9uiLokuu0+MGFlyiaqtWxwqJm41/+8Nj0lD7A36YH0=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
-github.com/jedib0t/go-pretty/v6 v6.6.1 h1:iJ65Xjb680rHcikRj6DSIbzCex2huitmc7bDtxYVWyc=
-github.com/jedib0t/go-pretty/v6 v6.6.1/go.mod h1:zbn98qrYlh95FIhwwsbIip0LYpwSG8SUOScs+v9/t0E=
+github.com/jedib0t/go-pretty/v6 v6.6.4 h1:B51RjA+Sytv0C0Je7PHGDXZBF2JpS5dZEWWRueBLP6U=
+github.com/jedib0t/go-pretty/v6 v6.6.4/go.mod h1:zbn98qrYlh95FIhwwsbIip0LYpwSG8SUOScs+v9/t0E=
 github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8=
 github.com/jinzhu/copier v0.4.0/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
@@ -499,12 +497,11 @@ github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
-github.com/klauspost/compress v1.11.4/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
-github.com/klauspost/compress v1.17.8 h1:YcnTYrq7MikUT7k0Yb5eceMmALQPYBW/Xltxn0NAMnU=
-github.com/klauspost/compress v1.17.8/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
+github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
+github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
-github.com/klauspost/pgzip v1.2.5 h1:qnWYvvKqedOF2ulHpMG72XQol4ILEJ8k2wwRl/Km8oE=
-github.com/klauspost/pgzip v1.2.5/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
+github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
+github.com/klauspost/pgzip v1.2.6/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
 github.com/knqyf263/go-rpmdb v0.1.1 h1:oh68mTCvp1XzxdU7EfafcWzzfstUZAEa3MW0IJye584=
 github.com/knqyf263/go-rpmdb v0.1.1/go.mod h1:9LQcoMCMQ9vrF7HcDtXfvqGO4+ddxFQ8+YF/0CVGDww=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
@@ -527,8 +524,8 @@ github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69
 github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/lyft/protoc-gen-star v0.5.3/go.mod h1:V0xaHgaf5oCCqmcxYcWiDfTiKsZsRc87/1qhoTACD8w=
 github.com/magiconair/properties v1.8.5/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
-github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
-github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
+github.com/magiconair/properties v1.8.9 h1:nWcCbLq1N2v/cpNsy5WvQ37Fb+YElfq20WJ/a8RkpQM=
+github.com/magiconair/properties v1.8.9/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
 github.com/maruel/natural v1.1.1 h1:Hja7XhhmvEFhcByqDoHz9QZbkWey+COd9xWfCfn1ioo=
 github.com/maruel/natural v1.1.1/go.mod h1:v+Rfd79xlw1AgVBjbO0BEQmptqb5HvL/k9GRHB7ZKEg=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
@@ -607,8 +604,8 @@ github.com/muesli/termenv v0.15.2/go.mod h1:Epx+iuz8sNs7mNKhxzH4fWXGNpZwUaJKRS1n
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
 github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
-github.com/nwaples/rardecode v1.1.0 h1:vSxaY8vQhOcVr4mm5e8XllHWTiM4JF507A0Katqw7MQ=
-github.com/nwaples/rardecode v1.1.0/go.mod h1:5DzqNKiOdpKKBH87u8VlvAnPZMXcGRhxWkRpHbbfGS0=
+github.com/nwaples/rardecode v1.1.3 h1:cWCaZwfM5H7nAD6PyEdcVnczzV8i/JtotnyW/dD9lEc=
+github.com/nwaples/rardecode v1.1.3/go.mod h1:5DzqNKiOdpKKBH87u8VlvAnPZMXcGRhxWkRpHbbfGS0=
 github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
 github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
 github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
@@ -630,9 +627,8 @@ github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3v
 github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/pelletier/go-toml/v2 v2.2.2 h1:aYUidT7k73Pcl9nb2gScu7NSrKCSHIDE89b3+6Wq+LM=
 github.com/pelletier/go-toml/v2 v2.2.2/go.mod h1:1t835xjRzz80PqgE6HHgN2JOsmgYu/h4qDAS4n929Rs=
-github.com/pierrec/lz4/v4 v4.1.2/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
-github.com/pierrec/lz4/v4 v4.1.19 h1:tYLzDnjDXh9qIxSTKHwXwOYmm9d887Y7Y1ZkyXYHAN4=
-github.com/pierrec/lz4/v4 v4.1.19/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
+github.com/pierrec/lz4/v4 v4.1.21 h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ=
+github.com/pierrec/lz4/v4 v4.1.21/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pjbgf/sha1cd v0.3.0 h1:4D5XXmUUBUl/xQ6IjCkEAbqXskkq/4O7LmGn0AqMDs4=
 github.com/pjbgf/sha1cd v0.3.0/go.mod h1:nZ1rrWOcGJ5uZgEEVL1VUM9iRQiZvWdbZjkKyFzPPsI=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
@@ -678,8 +674,8 @@ github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/saferwall/pe v1.5.5 h1:GGbzKjXDm7i+1K6riOgtgblyTdRmTbr3r11IzjovAK8=
-github.com/saferwall/pe v1.5.5/go.mod h1:mJx+PuptmNpoPFBNhWs/uDMFL/kTHVZIkg0d4OUJFbQ=
+github.com/saferwall/pe v1.5.6 h1:DrRLnoQFxHWJ5lJUmrH7X2L0xeUu6SUS95Dc61eW2Yc=
+github.com/saferwall/pe v1.5.6/go.mod h1:mJx+PuptmNpoPFBNhWs/uDMFL/kTHVZIkg0d4OUJFbQ=
 github.com/sagikazarmark/crypt v0.3.0/go.mod h1:uD/D+6UF4SrIR1uGEv7bBNkNqLGqUr43MRiaGWX1Nig=
 github.com/sagikazarmark/locafero v0.4.0 h1:HApY1R9zGo4DBgr7dqsTH/JJxLTTsOt7u6keLGt6kNQ=
 github.com/sagikazarmark/locafero v0.4.0/go.mod h1:Pe1W6UlPYUk/+wc/6KFhbORCfqzgYEpgQ3O5fPuL3H4=
@@ -755,15 +751,16 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
-github.com/sylabs/sif/v2 v2.20.0 h1:RfDHEltUrchZbp/XGcWaw3nRSbufoNWqvwmf91/Q2gI=
-github.com/sylabs/sif/v2 v2.20.0/go.mod h1:z6dq3B7QXK0pD71n15kAapven+gE+PZAIPOewBTNDpU=
-github.com/sylabs/squashfs v1.0.0 h1:xAyMS21ogglkuR5HaY55PCfqY3H32ma9GkasTYo28Zg=
-github.com/sylabs/squashfs v1.0.0/go.mod h1:rhWzvgefq1X+R+LZdts10hfMsTg3g74OfGunW8tvg/4=
+github.com/sylabs/sif/v2 v2.20.1 h1:vzCj6ID8kwQV1OME+bTjEC8J2l/0NQsJVH1PehRg7p4=
+github.com/sylabs/sif/v2 v2.20.1/go.mod h1:l3o3KPnvqvmXEPX4EC457HnxJXEGztdjWQVJKHt0u7w=
+github.com/sylabs/squashfs v1.0.4 h1:uFSw7WXv7zjutPvU+JzY0nY494Vw8s4FAf4+7DhoMdI=
+github.com/sylabs/squashfs v1.0.4/go.mod h1:PDgf8YmCntvN4d9Y8hBUBDCZL6qZOzOQwRGxnIdbERk=
 github.com/terminalstatic/go-xsd-validate v0.1.5 h1:RqpJnf6HGE2CB/lZB1A8BYguk8uRtcvYAPLCF15qguo=
 github.com/terminalstatic/go-xsd-validate v0.1.5/go.mod h1:18lsvYFofBflqCrvo1umpABZ99+GneNTw2kEEc8UPJw=
 github.com/therootcompany/xz v1.0.1 h1:CmOtsn1CbtmyYiusbfmhmkpAAETj0wBIH6kCYaX+xzw=
@@ -780,7 +777,6 @@ github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
 github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
 github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=
 github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
-github.com/ulikunitz/xz v0.5.9/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/ulikunitz/xz v0.5.12 h1:37Nm15o69RwBkXM0J6A5OlE67RZTfzUxTj8fB3dfcsc=
 github.com/ulikunitz/xz v0.5.12/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/urfave/cli v1.22.12/go.mod h1:sSBEIC79qR6OvcmsD4U3KABeOTxDqQtdDnaFuUN30b8=
@@ -808,6 +804,8 @@ github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 h1:nIPpBwaJSVYIxUFsDv3M8ofm
 github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8/go.mod h1:HUYIGzjTL3rfEspMxjDjgmT5uz5wzYJKVo23qUhYTos=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
+github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
+github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
 github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -866,8 +864,8 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.29.0 h1:L5SG1JTTXupVV3n6sUqMTeWbjAyfPwoda2DLX8J8FrQ=
-golang.org/x/crypto v0.29.0/go.mod h1:+F4F4N5hv6v38hfeYwTdx20oUvLLc+QfrE9Ax9HtgRg=
+golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
+golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -952,8 +950,8 @@ golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.31.0 h1:68CPQngjLL0r2AlUKiSxtQFKvzRVbnzLwMUn5SzcLHo=
-golang.org/x/net v0.31.0/go.mod h1:P4fl1q7dY2hnZFxEk4pPSkDHF+QqjitcnDjUQyMM+pM=
+golang.org/x/net v0.32.0 h1:ZqPmj8Kzc+Y6e0+skZsuACbx+wzMgo5MQsJh9Qd6aYI=
+golang.org/x/net v0.32.0/go.mod h1:CwU0IoeOlnQQWJ6ioyFrfRuomB8GKF6KbYXZVyeXNfs=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -983,8 +981,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.9.0 h1:fEo0HyrW1GIgZdpbhCRO0PkJajUS5H9IFUztCgEo2jQ=
-golang.org/x/sync v0.9.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
+golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1060,12 +1058,12 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220906165534-d0df966e6959/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.27.0 h1:wBqf8DvsY9Y/2P8gAfPDEYNuS30J4lPHJxXSb/nJZ+s=
-golang.org/x/sys v0.27.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
+golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.26.0 h1:WEQa6V3Gja/BhNxg540hBip/kkaYtRg3cxg4oXSw4AU=
-golang.org/x/term v0.26.0/go.mod h1:Si5m1o57C5nBNQo5z1iq+XDijt21BDBDp2bK0QI8e3E=
+golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
+golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1076,8 +1074,8 @@ golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.20.0 h1:gK/Kv2otX8gz+wn7Rmb3vT96ZwuoxnQlY+HlJVj7Qug=
-golang.org/x/text v0.20.0/go.mod h1:D4IsuqiFMhST5bX19pQ9ikHC2GsaKyk/oF+pn3ducp4=
+golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
+golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1351,8 +1349,8 @@ modernc.org/opt v0.1.3 h1:3XOZf2yznlhC+ibLltsDGzABUGVx8J6pnFMS3E4dcq4=
 modernc.org/opt v0.1.3/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
 modernc.org/sortutil v1.2.0 h1:jQiD3PfS2REGJNzNCMMaLSp/wdMNieTbKX920Cqdgqc=
 modernc.org/sortutil v1.2.0/go.mod h1:TKU2s7kJMf1AE84OoiGppNHJwvB753OYfNl2WRb++Ss=
-modernc.org/sqlite v1.33.1 h1:trb6Z3YYoeM9eDL1O8do81kP+0ejv+YzgyFo+Gwy0nM=
-modernc.org/sqlite v1.33.1/go.mod h1:pXV2xHxhzXZsgT/RtTFAPY6JJDEvOTcTdwADQCCWD4k=
+modernc.org/sqlite v1.34.2 h1:J9n76TPsfYYkFkZ9Uy1QphILYifiVEwwOT7yP5b++2Y=
+modernc.org/sqlite v1.34.2/go.mod h1:dnR723UrTtjKpoHCAMN0Q/gZ9MT4r+iRvIBb9umWFkU=
 modernc.org/strutil v1.2.0 h1:agBi9dp1I+eOnxXeiZawM8F4LawKv4NzGWSaLfyeNZA=
 modernc.org/strutil v1.2.0/go.mod h1:/mdcBmfOibveCTBxUl5B5l6W+TTH1FXPLHZE6bTosX0=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=

internal/file/tar_file_traversal.go

@@ -6,7 +6,8 @@ import (
 	"path/filepath"
 
 	"github.com/bmatcuk/doublestar/v4"
-	"github.com/mholt/archiver/v3"
+
+	"github.com/anchore/archiver/v3"
 )
 
 // ExtractGlobsFromTarToUniqueTempFile extracts paths matching the given globs within the given archive to a temporary directory, returning file openers for each file extracted.

internal/task/unknowns_tasks.go

@@ -4,8 +4,7 @@ import (
 	"context"
 	"strings"
 
-	"github.com/mholt/archiver/v3"
-
+	"github.com/anchore/archiver/v3"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/sbomsync"
 	"github.com/anchore/syft/syft/cataloging"

syft/format/common/spdxhelpers/to_format_model.go

@@ -5,6 +5,7 @@ import (
 	"crypto/sha1"
 	"fmt"
 	"path"
+	"regexp"
 	"slices"
 	"sort"
 	"strings"
@@ -246,6 +247,7 @@ func toRootPackage(s source.Description) *spdx.Package {
 		PackageSupplier: &spdx.Supplier{
 			Supplier: helpers.NOASSERTION,
 		},
+		PackageCopyrightText:    helpers.NOASSERTION,
 		PackageDownloadLocation: helpers.NOASSERTION,
 		PackageLicenseConcluded: helpers.NOASSERTION,
 		PackageLicenseDeclared:  helpers.NOASSERTION,
@@ -626,14 +628,21 @@ func toFiles(s sbom.SBOM) (results []*spdx.File) {
 			comment = fmt.Sprintf("layerID: %s", coordinates.FileSystemID)
 		}
 
+		relativePath, err := convertAbsoluteToRelative(coordinates.RealPath)
+		if err != nil {
+			log.Debugf("unable to convert relative path '%s' to absolute path: %s", coordinates.RealPath, err)
+			relativePath = coordinates.RealPath
+		}
+
 		results = append(results, &spdx.File{
 			FileSPDXIdentifier: toSPDXID(coordinates),
 			FileComment:        comment,
 			// required, no attempt made to determine license information
-			LicenseConcluded: noAssertion,
-			Checksums:        toFileChecksums(digests),
-			FileName:         coordinates.RealPath,
-			FileTypes:        toFileTypes(metadata),
+			LicenseConcluded:  noAssertion,
+			FileCopyrightText: noAssertion,
+			Checksums:         toFileChecksums(digests),
+			FileName:          relativePath,
+			FileTypes:         toFileTypes(metadata),
 			LicenseInfoInFiles: []string{ // required in SPDX 2.2
 				helpers.NOASSERTION,
 			},
@@ -713,8 +722,8 @@ func toFileTypes(metadata *file.Metadata) (ty []string) {
 	return ty
 }
 
-// other licenses are for licenses from the pkg.Package that do not have an SPDXExpression
-// field. The spdxexpression field is only filled given a validated Value field.
+// other licenses are for licenses from the pkg.Package that do not have a valid SPDX Expression
+// OR are an expression that is a single `License-Ref-*`
 func toOtherLicenses(catalog *pkg.Collection) []*spdx.OtherLicense {
 	licenses := map[string]helpers.SPDXLicense{}
 
@@ -724,11 +733,17 @@ func toOtherLicenses(catalog *pkg.Collection) []*spdx.OtherLicense {
 			if l.Value != "" {
 				licenses[l.ID] = l
 			}
+			if l.ID != "" && isLicenseRef(l.ID) {
+				licenses[l.ID] = l
+			}
 		}
 		for _, l := range concludedLicenses {
 			if l.Value != "" {
 				licenses[l.ID] = l
 			}
+			if l.ID != "" && isLicenseRef(l.ID) {
+				licenses[l.ID] = l
+			}
 		}
 	}
 
@@ -742,14 +757,27 @@ func toOtherLicenses(catalog *pkg.Collection) []*spdx.OtherLicense {
 	slices.Sort(ids)
 	for _, id := range ids {
 		license := licenses[id]
+		value := license.Value
+		// handle cases where LicenseRef needs to be included in hasExtractedLicensingInfos
+		if license.Value == "" {
+			value, _ = strings.CutPrefix(license.ID, "LicenseRef-")
+		}
 		result = append(result, &spdx.OtherLicense{
 			LicenseIdentifier: license.ID,
-			ExtractedText:     license.Value,
+			ExtractedText:     value,
 		})
 	}
 	return result
 }
 
+var licenseRefRegEx = regexp.MustCompile(`^LicenseRef-[A-Za-z0-9_-]+$`)
+
+// isSingularLicenseRef checks if the string is a singular LicenseRef-* identifier
+func isLicenseRef(s string) bool {
+	// Match the input string against the regex
+	return licenseRefRegEx.MatchString(s)
+}
+
 // TODO: handle SPDX excludes file case
 // f file is an "excludes" file, skip it /* exclude SPDX analysis file(s) */
 // see: https://spdx.github.io/spdx-spec/v2.3/package-information/#79-package-verification-code-field
@@ -811,3 +839,22 @@ func trimPatchVersion(semver string) string {
 	}
 	return semver
 }
+
+// spdx requires that the file name field is a relative filename
+// with the root of the package archive or directory
+func convertAbsoluteToRelative(absPath string) (string, error) {
+	// Ensure the absolute path is absolute (although it should already be)
+	if !path.IsAbs(absPath) {
+		// already relative
+		log.Debugf("%s is already relative", absPath)
+		return absPath, nil
+	}
+
+	// we use "/" here given that we're converting absolute paths from root to relative
+	relPath, found := strings.CutPrefix(absPath, "/")
+	if !found {
+		return "", fmt.Errorf("error calculating relative path: %s", absPath)
+	}
+
+	return relPath, nil
+}

syft/format/common/spdxhelpers/to_format_model_test.go

@@ -382,6 +382,51 @@ func Test_toPackageChecksums(t *testing.T) {
 	}
 }
 
+func Test_toFiles(t *testing.T) {
+	tests := []struct {
+		name string
+		in   sbom.SBOM
+		want spdx.File
+	}{
+		{
+			name: "File paths are converted to relative in final SPDX collection",
+			in: sbom.SBOM{
+				Source: source.Description{
+					Name:    "alpine",
+					Version: "sha256:d34db33f",
+					Metadata: source.ImageMetadata{
+						UserInput:      "alpine:latest",
+						ManifestDigest: "sha256:d34db33f",
+					},
+				},
+				Artifacts: sbom.Artifacts{
+					Packages: pkg.NewCollection(pkg.Package{
+						Name:    "pkg-1",
+						Version: "version-1",
+					}),
+					FileMetadata: map[file.Coordinates]file.Metadata{
+						{
+							RealPath:     "/some/path",
+							FileSystemID: "",
+						}: {
+							Path: "/some/path",
+						},
+					},
+				},
+			},
+			want: spdx.File{
+				FileName: "some/path",
+			},
+		},
+	}
+
+	for _, test := range tests {
+		files := toFiles(test.in)
+		got := files[0]
+		assert.Equal(t, test.want.FileName, got.FileName)
+	}
+}
+
 func Test_toFileTypes(t *testing.T) {
 
 	tests := []struct {
@@ -753,6 +798,29 @@ func Test_OtherLicenses(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "LicenseRef as a valid spdx expression",
+			pkg: pkg.Package{
+				Licenses: pkg.NewLicenseSet(
+					pkg.NewLicense("LicenseRef-Fedora-Public-Domain"),
+				),
+			},
+			expected: []*spdx.OtherLicense{
+				{
+					LicenseIdentifier: "LicenseRef-Fedora-Public-Domain",
+					ExtractedText:     "Fedora-Public-Domain",
+				},
+			},
+		},
+		{
+			name: "LicenseRef as a valid spdx expression does not otherize compound spdx expressions",
+			pkg: pkg.Package{
+				Licenses: pkg.NewLicenseSet(
+					pkg.NewLicense("(MIT AND LicenseRef-Fedora-Public-Domain)"),
+				),
+			},
+			expected: nil,
+		},
 	}
 
 	for _, test := range tests {

syft/format/github/internal/model/model.go

@@ -5,8 +5,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/mholt/archiver/v3"
-
+	"github.com/anchore/archiver/v3"
 	"github.com/anchore/packageurl-go"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/pkg"

syft/format/internal/cyclonedxutil/helpers/licenses.go

@@ -1,7 +1,6 @@
 package helpers
 
 import (
-	"fmt"
 	"strings"
 
 	"github.com/CycloneDX/cyclonedx-go"
@@ -158,40 +157,42 @@ func mergeSPDX(ex []string) string {
 		// if the expression does not have balanced parens add them
 		if !strings.HasPrefix(e, "(") && !strings.HasSuffix(e, ")") {
 			e = "(" + e + ")"
-			candidate = append(candidate, e)
 		}
+		candidate = append(candidate, e)
 	}
 
 	if len(candidate) == 1 {
-		return reduceOuter(strings.Join(candidate, " AND "))
+		return reduceOuter(candidate[0])
 	}
 
-	return strings.Join(candidate, " AND ")
+	return reduceOuter(strings.Join(candidate, " AND "))
 }
 
 func reduceOuter(expression string) string {
-	var (
-		sb        strings.Builder
-		openCount int
-	)
+	expression = strings.TrimSpace(expression)
 
-	for _, c := range expression {
-		if string(c) == "(" && openCount > 0 {
-			_, _ = fmt.Fprintf(&sb, "%c", c)
+	// If the entire expression is wrapped in parentheses, check if they are redundant.
+	if strings.HasPrefix(expression, "(") && strings.HasSuffix(expression, ")") {
+		trimmed := expression[1 : len(expression)-1]
+		if isBalanced(trimmed) {
+			return reduceOuter(trimmed) // Recursively reduce the trimmed expression.
 		}
-		if string(c) == "(" {
-			openCount++
-			continue
-		}
-		if string(c) == ")" && openCount > 1 {
-			_, _ = fmt.Fprintf(&sb, "%c", c)
-		}
-		if string(c) == ")" {
-			openCount--
-			continue
-		}
-		_, _ = fmt.Fprintf(&sb, "%c", c)
 	}
 
-	return sb.String()
+	return expression
+}
+
+func isBalanced(expression string) bool {
+	count := 0
+	for _, c := range expression {
+		if c == '(' {
+			count++
+		} else if c == ')' {
+			count--
+			if count < 0 {
+				return false
+			}
+		}
+	}
+	return count == 0
 }

syft/format/internal/cyclonedxutil/helpers/licenses_test.go

@@ -164,6 +164,29 @@ func Test_encodeLicense(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "single parenthesized SPDX expression",
+			input: pkg.Package{
+				Licenses: pkg.NewLicenseSet(pkg.NewLicensesFromValues("(MIT OR Apache-2.0)")...),
+			},
+			expected: &cyclonedx.Licenses{
+				{
+					Expression: "MIT OR Apache-2.0",
+				},
+			},
+		},
+		{
+			name: "single license AND to parenthesized SPDX expression",
+			// (LGPL-3.0-or-later OR GPL-2.0-or-later OR (LGPL-3.0-or-later AND GPL-2.0-or-later)) AND GFDL-1.3-invariants-or-later
+			input: pkg.Package{
+				Licenses: pkg.NewLicenseSet(pkg.NewLicensesFromValues("(LGPL-3.0-or-later OR GPL-2.0-or-later OR (LGPL-3.0-or-later AND GPL-2.0-or-later)) AND GFDL-1.3-invariants-or-later")...),
+			},
+			expected: &cyclonedx.Licenses{
+				{
+					Expression: "(LGPL-3.0-or-later OR GPL-2.0-or-later OR (LGPL-3.0-or-later AND GPL-2.0-or-later)) AND GFDL-1.3-invariants-or-later",
+				},
+			},
+		},
 		// TODO: do we drop the non SPDX ID license and do a single expression
 		// OR do we keep the non SPDX ID license and do multiple licenses where the complex
 		// expressions are set as the NAME field?

syft/format/internal/testutil/test-fixtures/snapshot/TestSPDXJSONImageEncoder.golden

@@ -0,0 +1,106 @@
+{
+ "spdxVersion": "SPDX-2.3",
+ "dataLicense": "CC0-1.0",
+ "SPDXID": "SPDXRef-DOCUMENT",
+ "name": "user-image-input",
+ "documentNamespace":"redacted",
+ "creationInfo": {
+  "licenseListVersion":"redacted",
+  "creators": [
+   "Organization: Anchore, Inc",
+   "Tool: syft-v0.42.0-bogus"
+  ],
+  "created":"redacted"
+ },
+ "packages": [
+  {
+   "name": "package-1",
+   "SPDXID": "SPDXRef-Package-python-package-1-c5cf7ac34cbca450",
+   "versionInfo": "1.0.1",
+   "supplier": "NOASSERTION",
+   "downloadLocation": "NOASSERTION",
+   "filesAnalyzed": false,
+   "sourceInfo": "acquired package info from installed python package manifest file: /somefile-1.txt",
+   "licenseConcluded": "NOASSERTION",
+   "licenseDeclared": "MIT",
+   "copyrightText": "NOASSERTION",
+   "externalRefs": [
+    {
+     "referenceCategory": "SECURITY",
+     "referenceType": "cpe23Type",
+     "referenceLocator": "cpe:2.3:*:some:package:1:*:*:*:*:*:*:*"
+    },
+    {
+     "referenceCategory": "PACKAGE-MANAGER",
+     "referenceType": "purl",
+     "referenceLocator": "a-purl-1"
+    }
+   ]
+  },
+  {
+   "name": "package-2",
+   "SPDXID": "SPDXRef-Package-deb-package-2-4b756c6f6fb127a3",
+   "versionInfo": "2.0.1",
+   "supplier": "NOASSERTION",
+   "downloadLocation": "NOASSERTION",
+   "filesAnalyzed": false,
+   "sourceInfo": "acquired package info from DPKG DB: /somefile-2.txt",
+   "licenseConcluded": "NOASSERTION",
+   "licenseDeclared": "NOASSERTION",
+   "copyrightText": "NOASSERTION",
+   "externalRefs": [
+    {
+     "referenceCategory": "SECURITY",
+     "referenceType": "cpe23Type",
+     "referenceLocator": "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"
+    },
+    {
+     "referenceCategory": "PACKAGE-MANAGER",
+     "referenceType": "purl",
+     "referenceLocator": "pkg:deb/debian/package-2@2.0.1"
+    }
+   ]
+  },
+  {
+   "name": "user-image-input",
+   "SPDXID": "SPDXRef-DocumentRoot-Image-user-image-input",
+   "versionInfo": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368",
+   "supplier": "NOASSERTION",
+   "downloadLocation": "NOASSERTION",
+   "filesAnalyzed": false,
+   "checksums": [
+    {
+     "algorithm": "SHA256",
+     "checksumValue": "2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368"
+    }
+   ],
+   "licenseConcluded": "NOASSERTION",
+   "licenseDeclared": "NOASSERTION",
+   "externalRefs": [
+    {
+     "referenceCategory": "PACKAGE-MANAGER",
+     "referenceType": "purl",
+     "referenceLocator": "pkg:oci/user-image-input@sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368?arch="
+    }
+   ],
+   "primaryPackagePurpose": "CONTAINER"
+  }
+ ],
+ "relationships": [
+  {
+   "spdxElementId": "SPDXRef-DocumentRoot-Image-user-image-input",
+   "relatedSpdxElement": "SPDXRef-Package-python-package-1-c5cf7ac34cbca450",
+   "relationshipType": "CONTAINS"
+  },
+  {
+   "spdxElementId": "SPDXRef-DocumentRoot-Image-user-image-input",
+   "relatedSpdxElement": "SPDXRef-Package-deb-package-2-4b756c6f6fb127a3",
+   "relationshipType": "CONTAINS"
+  },
+  {
+   "spdxElementId": "SPDXRef-DOCUMENT",
+   "relatedSpdxElement": "SPDXRef-DocumentRoot-Image-user-image-input",
+   "relationshipType": "DESCRIBES"
+  }
+ ]
+}

syft/format/internal/testutil/test-fixtures/snapshot/TestSPDXRelationshipOrder.golden

@@ -0,0 +1,246 @@
+{
+ "spdxVersion": "SPDX-2.3",
+ "dataLicense": "CC0-1.0",
+ "SPDXID": "SPDXRef-DOCUMENT",
+ "name": "user-image-input",
+ "documentNamespace":"redacted",
+ "creationInfo": {
+  "licenseListVersion":"redacted",
+  "creators": [
+   "Organization: Anchore, Inc",
+   "Tool: syft-v0.42.0-bogus"
+  ],
+  "created":"redacted"
+ },
+ "packages": [
+  {
+   "name": "package-1",
+   "SPDXID": "SPDXRef-Package-python-package-1-c5cf7ac34cbca450",
+   "versionInfo": "1.0.1",
+   "supplier": "NOASSERTION",
+   "downloadLocation": "NOASSERTION",
+   "filesAnalyzed": false,
+   "sourceInfo": "acquired package info from installed python package manifest file: /somefile-1.txt",
+   "licenseConcluded": "NOASSERTION",
+   "licenseDeclared": "MIT",
+   "copyrightText": "NOASSERTION",
+   "externalRefs": [
+    {
+     "referenceCategory": "SECURITY",
+     "referenceType": "cpe23Type",
+     "referenceLocator": "cpe:2.3:*:some:package:1:*:*:*:*:*:*:*"
+    },
+    {
+     "referenceCategory": "PACKAGE-MANAGER",
+     "referenceType": "purl",
+     "referenceLocator": "a-purl-1"
+    }
+   ]
+  },
+  {
+   "name": "package-2",
+   "SPDXID": "SPDXRef-Package-deb-package-2-4b756c6f6fb127a3",
+   "versionInfo": "2.0.1",
+   "supplier": "NOASSERTION",
+   "downloadLocation": "NOASSERTION",
+   "filesAnalyzed": false,
+   "sourceInfo": "acquired package info from DPKG DB: /somefile-2.txt",
+   "licenseConcluded": "NOASSERTION",
+   "licenseDeclared": "NOASSERTION",
+   "copyrightText": "NOASSERTION",
+   "externalRefs": [
+    {
+     "referenceCategory": "SECURITY",
+     "referenceType": "cpe23Type",
+     "referenceLocator": "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"
+    },
+    {
+     "referenceCategory": "PACKAGE-MANAGER",
+     "referenceType": "purl",
+     "referenceLocator": "pkg:deb/debian/package-2@2.0.1"
+    }
+   ]
+  },
+  {
+   "name": "user-image-input",
+   "SPDXID": "SPDXRef-DocumentRoot-Image-user-image-input",
+   "versionInfo": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368",
+   "supplier": "NOASSERTION",
+   "downloadLocation": "NOASSERTION",
+   "filesAnalyzed": false,
+   "checksums": [
+    {
+     "algorithm": "SHA256",
+     "checksumValue": "2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368"
+    }
+   ],
+   "licenseConcluded": "NOASSERTION",
+   "licenseDeclared": "NOASSERTION",
+   "externalRefs": [
+    {
+     "referenceCategory": "PACKAGE-MANAGER",
+     "referenceType": "purl",
+     "referenceLocator": "pkg:oci/user-image-input@sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368?arch="
+    }
+   ],
+   "primaryPackagePurpose": "CONTAINER"
+  }
+ ],
+ "files": [
+  {
+   "fileName": "/a1/f6",
+   "SPDXID": "SPDXRef-File-a1-f6-9c2f7510199b17f6",
+   "fileTypes": [
+    "OTHER"
+   ],
+   "checksums": [
+    {
+     "algorithm": "SHA1",
+     "checksumValue": "0000000000000000000000000000000000000000"
+    }
+   ],
+   "licenseConcluded": "NOASSERTION",
+   "licenseInfoInFiles": [
+    "NOASSERTION"
+   ],
+   "copyrightText": "NOASSERTION"
+  },
+  {
+   "fileName": "/d1/f3",
+   "SPDXID": "SPDXRef-File-d1-f3-c6f5b29dca12661f",
+   "fileTypes": [
+    "OTHER"
+   ],
+   "checksums": [
+    {
+     "algorithm": "SHA1",
+     "checksumValue": "0000000000000000000000000000000000000000"
+    }
+   ],
+   "licenseConcluded": "NOASSERTION",
+   "licenseInfoInFiles": [
+    "NOASSERTION"
+   ],
+   "copyrightText": "NOASSERTION"
+  },
+  {
+   "fileName": "/d2/f4",
+   "SPDXID": "SPDXRef-File-d2-f4-c641caa71518099f",
+   "fileTypes": [
+    "OTHER"
+   ],
+   "checksums": [
+    {
+     "algorithm": "SHA1",
+     "checksumValue": "0000000000000000000000000000000000000000"
+    }
+   ],
+   "licenseConcluded": "NOASSERTION",
+   "licenseInfoInFiles": [
+    "NOASSERTION"
+   ],
+   "copyrightText": "NOASSERTION"
+  },
+  {
+   "fileName": "/f1",
+   "SPDXID": "SPDXRef-File-f1-5265a4dde3edbf7c",
+   "fileTypes": [
+    "OTHER"
+   ],
+   "checksums": [
+    {
+     "algorithm": "SHA1",
+     "checksumValue": "0000000000000000000000000000000000000000"
+    }
+   ],
+   "licenseConcluded": "NOASSERTION",
+   "licenseInfoInFiles": [
+    "NOASSERTION"
+   ],
+   "copyrightText": "NOASSERTION"
+  },
+  {
+   "fileName": "/f2",
+   "SPDXID": "SPDXRef-File-f2-f9e49132a4b96ccd",
+   "fileTypes": [
+    "OTHER"
+   ],
+   "checksums": [
+    {
+     "algorithm": "SHA1",
+     "checksumValue": "0000000000000000000000000000000000000000"
+    }
+   ],
+   "licenseConcluded": "NOASSERTION",
+   "licenseInfoInFiles": [
+    "NOASSERTION"
+   ],
+   "copyrightText": "NOASSERTION"
+  },
+  {
+   "fileName": "/z1/f5",
+   "SPDXID": "SPDXRef-File-z1-f5-839d99ee67d9d174",
+   "fileTypes": [
+    "OTHER"
+   ],
+   "checksums": [
+    {
+     "algorithm": "SHA1",
+     "checksumValue": "0000000000000000000000000000000000000000"
+    }
+   ],
+   "licenseConcluded": "NOASSERTION",
+   "licenseInfoInFiles": [
+    "NOASSERTION"
+   ],
+   "copyrightText": "NOASSERTION"
+  }
+ ],
+ "relationships": [
+  {
+   "spdxElementId": "SPDXRef-Package-python-package-1-c5cf7ac34cbca450",
+   "relatedSpdxElement": "SPDXRef-File-f1-5265a4dde3edbf7c",
+   "relationshipType": "CONTAINS"
+  },
+  {
+   "spdxElementId": "SPDXRef-Package-python-package-1-c5cf7ac34cbca450",
+   "relatedSpdxElement": "SPDXRef-File-z1-f5-839d99ee67d9d174",
+   "relationshipType": "CONTAINS"
+  },
+  {
+   "spdxElementId": "SPDXRef-Package-python-package-1-c5cf7ac34cbca450",
+   "relatedSpdxElement": "SPDXRef-File-a1-f6-9c2f7510199b17f6",
+   "relationshipType": "CONTAINS"
+  },
+  {
+   "spdxElementId": "SPDXRef-Package-python-package-1-c5cf7ac34cbca450",
+   "relatedSpdxElement": "SPDXRef-File-d2-f4-c641caa71518099f",
+   "relationshipType": "CONTAINS"
+  },
+  {
+   "spdxElementId": "SPDXRef-Package-python-package-1-c5cf7ac34cbca450",
+   "relatedSpdxElement": "SPDXRef-File-d1-f3-c6f5b29dca12661f",
+   "relationshipType": "CONTAINS"
+  },
+  {
+   "spdxElementId": "SPDXRef-Package-python-package-1-c5cf7ac34cbca450",
+   "relatedSpdxElement": "SPDXRef-File-f2-f9e49132a4b96ccd",
+   "relationshipType": "CONTAINS"
+  },
+  {
+   "spdxElementId": "SPDXRef-DocumentRoot-Image-user-image-input",
+   "relatedSpdxElement": "SPDXRef-Package-python-package-1-c5cf7ac34cbca450",
+   "relationshipType": "CONTAINS"
+  },
+  {
+   "spdxElementId": "SPDXRef-DocumentRoot-Image-user-image-input",
+   "relatedSpdxElement": "SPDXRef-Package-deb-package-2-4b756c6f6fb127a3",
+   "relationshipType": "CONTAINS"
+  },
+  {
+   "spdxElementId": "SPDXRef-DOCUMENT",
+   "relatedSpdxElement": "SPDXRef-DocumentRoot-Image-user-image-input",
+   "relationshipType": "DESCRIBES"
+  }
+ ]
+}

syft/format/spdxjson/test-fixtures/snapshot/TestSPDX22JSONRequredProperties.golden

@@ -48,7 +48,7 @@
   },
   {
    "SPDXID": "SPDXRef-DocumentRoot-Unknown-",
-   "copyrightText": "",
+   "copyrightText": "NOASSERTION",
    "downloadLocation": "NOASSERTION",
    "filesAnalyzed": false,
    "licenseConcluded": "NOASSERTION",
@@ -59,7 +59,7 @@
  ],
  "files": [
   {
-   "fileName": "/some/file",
+   "fileName": "some/file",
    "SPDXID": "SPDXRef-File-some-file-2c5bc344430decac",
    "checksums": [
     {
@@ -71,7 +71,7 @@
    "licenseInfoInFiles": [
     "NOASSERTION"
    ],
-   "copyrightText": "",
+   "copyrightText": "NOASSERTION",
    "comment": "layerID: ac897d978b6c38749a1"
   }
  ],

syft/format/spdxjson/test-fixtures/snapshot/TestSPDXJSONDirectoryEncoder.golden

@@ -69,6 +69,7 @@
    "filesAnalyzed": false,
    "licenseConcluded": "NOASSERTION",
    "licenseDeclared": "NOASSERTION",
+   "copyrightText": "NOASSERTION",
    "primaryPackagePurpose": "FILE"
   }
  ],

syft/format/spdxjson/test-fixtures/snapshot/TestSPDXJSONImageEncoder.golden

@@ -76,6 +76,7 @@
    ],
    "licenseConcluded": "NOASSERTION",
    "licenseDeclared": "NOASSERTION",
+   "copyrightText": "NOASSERTION",
    "externalRefs": [
     {
      "referenceCategory": "PACKAGE-MANAGER",

syft/format/spdxjson/test-fixtures/snapshot/TestSPDXRelationshipOrder.golden

@@ -76,6 +76,7 @@
    ],
    "licenseConcluded": "NOASSERTION",
    "licenseDeclared": "NOASSERTION",
+   "copyrightText": "NOASSERTION",
    "externalRefs": [
     {
      "referenceCategory": "PACKAGE-MANAGER",
@@ -88,7 +89,7 @@
  ],
  "files": [
   {
-   "fileName": "/a1/f6",
+   "fileName": "a1/f6",
    "SPDXID": "SPDXRef-File-a1-f6-9c2f7510199b17f6",
    "fileTypes": [
     "OTHER"
@@ -103,10 +104,10 @@
    "licenseInfoInFiles": [
     "NOASSERTION"
    ],
-   "copyrightText": ""
+   "copyrightText": "NOASSERTION"
   },
   {
-   "fileName": "/d1/f3",
+   "fileName": "d1/f3",
    "SPDXID": "SPDXRef-File-d1-f3-c6f5b29dca12661f",
    "fileTypes": [
     "OTHER"
@@ -121,10 +122,10 @@
    "licenseInfoInFiles": [
     "NOASSERTION"
    ],
-   "copyrightText": ""
+   "copyrightText": "NOASSERTION"
   },
   {
-   "fileName": "/d2/f4",
+   "fileName": "d2/f4",
    "SPDXID": "SPDXRef-File-d2-f4-c641caa71518099f",
    "fileTypes": [
     "OTHER"
@@ -139,10 +140,10 @@
    "licenseInfoInFiles": [
     "NOASSERTION"
    ],
-   "copyrightText": ""
+   "copyrightText": "NOASSERTION"
   },
   {
-   "fileName": "/f1",
+   "fileName": "f1",
    "SPDXID": "SPDXRef-File-f1-5265a4dde3edbf7c",
    "fileTypes": [
     "OTHER"
@@ -157,10 +158,10 @@
    "licenseInfoInFiles": [
     "NOASSERTION"
    ],
-   "copyrightText": ""
+   "copyrightText": "NOASSERTION"
   },
   {
-   "fileName": "/f2",
+   "fileName": "f2",
    "SPDXID": "SPDXRef-File-f2-f9e49132a4b96ccd",
    "fileTypes": [
     "OTHER"
@@ -175,10 +176,10 @@
    "licenseInfoInFiles": [
     "NOASSERTION"
    ],
-   "copyrightText": ""
+   "copyrightText": "NOASSERTION"
   },
   {
-   "fileName": "/z1/f5",
+   "fileName": "z1/f5",
    "SPDXID": "SPDXRef-File-z1-f5-839d99ee67d9d174",
    "fileTypes": [
     "OTHER"
@@ -193,7 +194,7 @@
    "licenseInfoInFiles": [
     "NOASSERTION"
    ],
-   "copyrightText": ""
+   "copyrightText": "NOASSERTION"
   }
  ],
  "relationships": [

syft/format/spdxtagvalue/test-fixtures/snapshot/TestSPDXJSONSPDXIDs.golden

@@ -18,6 +18,7 @@ PrimaryPackagePurpose: FILE
 FilesAnalyzed: false
 PackageLicenseConcluded: NOASSERTION
 PackageLicenseDeclared: NOASSERTION
+PackageCopyrightText: NOASSERTION
 
 ##### Package: @at-sign
 

syft/format/spdxtagvalue/test-fixtures/snapshot/TestSPDXRelationshipOrder.golden

@@ -10,47 +10,53 @@ Created: redacted
 
 ##### Unpackaged files
 
-FileName: /a1/f6
+FileName: a1/f6
 SPDXID: SPDXRef-File-a1-f6-9c2f7510199b17f6
 FileType: OTHER
 FileChecksum: SHA1: 0000000000000000000000000000000000000000
 LicenseConcluded: NOASSERTION
 LicenseInfoInFile: NOASSERTION
+FileCopyrightText: NOASSERTION
 
-FileName: /d1/f3
+FileName: d1/f3
 SPDXID: SPDXRef-File-d1-f3-c6f5b29dca12661f
 FileType: OTHER
 FileChecksum: SHA1: 0000000000000000000000000000000000000000
 LicenseConcluded: NOASSERTION
 LicenseInfoInFile: NOASSERTION
+FileCopyrightText: NOASSERTION
 
-FileName: /d2/f4
+FileName: d2/f4
 SPDXID: SPDXRef-File-d2-f4-c641caa71518099f
 FileType: OTHER
 FileChecksum: SHA1: 0000000000000000000000000000000000000000
 LicenseConcluded: NOASSERTION
 LicenseInfoInFile: NOASSERTION
+FileCopyrightText: NOASSERTION
 
-FileName: /f1
+FileName: f1
 SPDXID: SPDXRef-File-f1-5265a4dde3edbf7c
 FileType: OTHER
 FileChecksum: SHA1: 0000000000000000000000000000000000000000
 LicenseConcluded: NOASSERTION
 LicenseInfoInFile: NOASSERTION
+FileCopyrightText: NOASSERTION
 
-FileName: /f2
+FileName: f2
 SPDXID: SPDXRef-File-f2-f9e49132a4b96ccd
 FileType: OTHER
 FileChecksum: SHA1: 0000000000000000000000000000000000000000
 LicenseConcluded: NOASSERTION
 LicenseInfoInFile: NOASSERTION
+FileCopyrightText: NOASSERTION
 
-FileName: /z1/f5
+FileName: z1/f5
 SPDXID: SPDXRef-File-z1-f5-839d99ee67d9d174
 FileType: OTHER
 FileChecksum: SHA1: 0000000000000000000000000000000000000000
 LicenseConcluded: NOASSERTION
 LicenseInfoInFile: NOASSERTION
+FileCopyrightText: NOASSERTION
 
 ##### Package: user-image-input
 
@@ -64,6 +70,7 @@ FilesAnalyzed: false
 PackageChecksum: SHA256: 2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368
 PackageLicenseConcluded: NOASSERTION
 PackageLicenseDeclared: NOASSERTION
+PackageCopyrightText: NOASSERTION
 ExternalRef: PACKAGE-MANAGER purl pkg:oci/user-image-input@sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368?arch=
 
 ##### Package: package-2

syft/format/spdxtagvalue/test-fixtures/snapshot/TestSPDXTagValueDirectoryEncoder.golden

@@ -18,6 +18,7 @@ PrimaryPackagePurpose: FILE
 FilesAnalyzed: false
 PackageLicenseConcluded: NOASSERTION
 PackageLicenseDeclared: NOASSERTION
+PackageCopyrightText: NOASSERTION
 
 ##### Package: package-2
 

syft/format/spdxtagvalue/test-fixtures/snapshot/TestSPDXTagValueImageEncoder.golden

@@ -20,6 +20,7 @@ FilesAnalyzed: false
 PackageChecksum: SHA256: 2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368
 PackageLicenseConcluded: NOASSERTION
 PackageLicenseDeclared: NOASSERTION
+PackageCopyrightText: NOASSERTION
 ExternalRef: PACKAGE-MANAGER purl pkg:oci/user-image-input@sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368?arch=
 
 ##### Package: package-2

syft/format/syftjson/test-fixtures/snapshot/TestImageEncoder.golden

@@ -9,7 +9,7 @@
    "locations": [
     {
      "path": "/somefile-1.txt",
-     "layerID": "sha256:100d5a55f9032faead28b7427fa3e650e4f0158f86ea89d06e1489df00cb8c6f",
+     "layerID": "sha256:dfefe618c89b08fef0f9c7f1a2682521dddbe03d6678f4a9fb9b078381d8eb45",
      "accessPath": "/somefile-1.txt"
     }
    ],
@@ -49,7 +49,7 @@
    "locations": [
     {
      "path": "/somefile-2.txt",
-     "layerID": "sha256:000fb9200890d3a19138478b20023023c0dce1c54352007c2863716780f049eb",
+     "layerID": "sha256:38ddc2847fb6bcafd7401b4bf27c10014b5d60e2400bc188890c7cb7cdd7cd6c",
      "accessPath": "/somefile-2.txt"
     }
    ],
@@ -77,13 +77,13 @@
  ],
  "artifactRelationships": [],
  "source": {
-  "id": "34d40fdc6ca13e9a3fa18415db216b50bff047716fae7d95a225c09732fe83fb",
+  "id": "62d3f24eca2930d1ebfe6ee78ef47964fd8dc624b2e22886275facf322d1720a",
   "name": "user-image-input",
   "version": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368",
   "type": "image",
   "metadata": {
    "userInput": "user-image-input",
-   "imageID": "sha256:bf783ea304a3f02b5c7d2ece521800f5e2182e65ed5bb5116f578e17d6e82be4",
+   "imageID": "sha256:35a6658e24fab92eae9ec6fc252dec58986c4c007891758d4d37c7e43fbbe0c5",
    "manifestDigest": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368",
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
    "tags": [
@@ -93,17 +93,17 @@
    "layers": [
     {
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:100d5a55f9032faead28b7427fa3e650e4f0158f86ea89d06e1489df00cb8c6f",
+     "digest": "sha256:dfefe618c89b08fef0f9c7f1a2682521dddbe03d6678f4a9fb9b078381d8eb45",
      "size": 22
     },
     {
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:000fb9200890d3a19138478b20023023c0dce1c54352007c2863716780f049eb",
+     "digest": "sha256:38ddc2847fb6bcafd7401b4bf27c10014b5d60e2400bc188890c7cb7cdd7cd6c",
      "size": 16
     }
    ],
-   "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NzIsImRpZ2VzdCI6InNoYTI1NjpiZjc4M2VhMzA0YTNmMDJiNWM3ZDJlY2U1MjE4MDBmNWUyMTgyZTY1ZWQ1YmI1MTE2ZjU3OGUxN2Q2ZTgyYmU0In0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1NjoxMDBkNWE1NWY5MDMyZmFlYWQyOGI3NDI3ZmEzZTY1MGU0ZjAxNThmODZlYTg5ZDA2ZTE0ODlkZjAwY2I4YzZmIn0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2OjAwMGZiOTIwMDg5MGQzYTE5MTM4NDc4YjIwMDIzMDIzYzBkY2UxYzU0MzUyMDA3YzI4NjM3MTY3ODBmMDQ5ZWIifV19",
-   "config": "eyJhcmNoaXRlY3R1cmUiOiJhcm02NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8iLCJPbkJ1aWxkIjpudWxsfSwiY3JlYXRlZCI6IjIwMjMtMDktMjhUMTI6MjM6MzUuNDAwNjcyODg1WiIsImhpc3RvcnkiOlt7ImNyZWF0ZWQiOiIyMDIzLTA5LTI4VDEyOjIzOjM1LjM5Mzk4NjUxWiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0xLnR4dCAvc29tZWZpbGUtMS50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn0seyJjcmVhdGVkIjoiMjAyMy0wOS0yOFQxMjoyMzozNS40MDA2NzI4ODVaIiwiY3JlYXRlZF9ieSI6IkFERCBmaWxlLTIudHh0IC9zb21lZmlsZS0yLnR4dCAjIGJ1aWxka2l0IiwiY29tbWVudCI6ImJ1aWxka2l0LmRvY2tlcmZpbGUudjAifV0sIm9zIjoibGludXgiLCJyb290ZnMiOnsidHlwZSI6ImxheWVycyIsImRpZmZfaWRzIjpbInNoYTI1NjoxMDBkNWE1NWY5MDMyZmFlYWQyOGI3NDI3ZmEzZTY1MGU0ZjAxNThmODZlYTg5ZDA2ZTE0ODlkZjAwY2I4YzZmIiwic2hhMjU2OjAwMGZiOTIwMDg5MGQzYTE5MTM4NDc4YjIwMDIzMDIzYzBkY2UxYzU0MzUyMDA3YzI4NjM3MTY3ODBmMDQ5ZWIiXX19",
+   "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NTgsImRpZ2VzdCI6InNoYTI1NjozNWE2NjU4ZTI0ZmFiOTJlYWU5ZWM2ZmMyNTJkZWM1ODk4NmM0YzAwNzg5MTc1OGQ0ZDM3YzdlNDNmYmJlMGM1In0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1NjpkZmVmZTYxOGM4OWIwOGZlZjBmOWM3ZjFhMjY4MjUyMWRkZGJlMDNkNjY3OGY0YTlmYjliMDc4MzgxZDhlYjQ1In0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2OjM4ZGRjMjg0N2ZiNmJjYWZkNzQwMWI0YmYyN2MxMDAxNGI1ZDYwZTI0MDBiYzE4ODg5MGM3Y2I3Y2RkN2NkNmMifV19",
+   "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8ifSwiY3JlYXRlZCI6IjIwMjQtMTEtMDRUMDQ6MTM6NDMuMzQwNTA3MTc1WiIsImhpc3RvcnkiOlt7ImNyZWF0ZWQiOiIyMDI0LTExLTA0VDA0OjEzOjQzLjMyMDg2OTk2OFoiLCJjcmVhdGVkX2J5IjoiQUREIGZpbGUtMS50eHQgL3NvbWVmaWxlLTEudHh0ICMgYnVpbGRraXQiLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCJ9LHsiY3JlYXRlZCI6IjIwMjQtMTEtMDRUMDQ6MTM6NDMuMzQwNTA3MTc1WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0yLnR4dCAvc29tZWZpbGUtMi50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6ZGZlZmU2MThjODliMDhmZWYwZjljN2YxYTI2ODI1MjFkZGRiZTAzZDY2NzhmNGE5ZmI5YjA3ODM4MWQ4ZWI0NSIsInNoYTI1NjozOGRkYzI4NDdmYjZiY2FmZDc0MDFiNGJmMjdjMTAwMTRiNWQ2MGUyNDAwYmMxODg4OTBjN2NiN2NkZDdjZDZjIl19fQ==",
    "repoDigests": [],
    "architecture": "",
    "os": ""

syft/format/text/test-fixtures/snapshot/TestTextImageEncoder.golden

@@ -1,11 +1,11 @@
 [Image]
  Layer:		 0
- Digest:	 sha256:100d5a55f9032faead28b7427fa3e650e4f0158f86ea89d06e1489df00cb8c6f
+ Digest:	 sha256:dfefe618c89b08fef0f9c7f1a2682521dddbe03d6678f4a9fb9b078381d8eb45
  Size:		 22
  MediaType:	 application/vnd.docker.image.rootfs.diff.tar.gzip
 
  Layer:		 1
- Digest:	 sha256:000fb9200890d3a19138478b20023023c0dce1c54352007c2863716780f049eb
+ Digest:	 sha256:38ddc2847fb6bcafd7401b4bf27c10014b5d60e2400bc188890c7cb7cdd7cd6c
  Size:		 16
  MediaType:	 application/vnd.docker.image.rootfs.diff.tar.gzip
 

syft/internal/fileresolver/directory.go

@@ -1,17 +1,11 @@
 package fileresolver
 
 import (
-	"context"
 	"errors"
 	"fmt"
-	"io"
-	"os"
 
-	stereoscopeFile "github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/stereoscope/pkg/filetree"
-	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/file"
-	"github.com/anchore/syft/syft/internal/windows"
 )
 
 var ErrSkipPath = errors.New("skip path")
@@ -20,12 +14,9 @@ var _ file.Resolver = (*Directory)(nil)
 
 // Directory implements path and content access for the directory data source.
 type Directory struct {
-	path          string
-	chroot        ChrootContext
-	tree          filetree.Reader
-	index         filetree.IndexReader
-	searchContext filetree.Searcher
-	indexer       *directoryIndexer
+	filetreeResolver
+	path    string
+	indexer *directoryIndexer
 }
 
 func NewFromDirectory(root string, base string, pathFilters ...PathIndexVisitor) (*Directory, error) {
@@ -47,10 +38,12 @@ func newFromDirectoryWithoutIndex(root string, base string, pathFilters ...PathI
 	cleanBase := chroot.Base()
 
 	return &Directory{
-		path:    cleanRoot,
-		chroot:  *chroot,
-		tree:    filetree.New(),
-		index:   filetree.NewIndex(),
+		path: cleanRoot,
+		filetreeResolver: filetreeResolver{
+			chroot: *chroot,
+			tree:   filetree.New(),
+			index:  filetree.NewIndex(),
+		},
 		indexer: newDirectoryIndexer(cleanRoot, cleanBase, pathFilters...),
 	}, nil
 }
@@ -66,220 +59,12 @@ func (r *Directory) buildIndex() error {
 
 	r.tree = tree
 	r.index = index
-	r.searchContext = filetree.NewSearchContext(tree, index)
+	r.filetreeResolver.searchContext = filetree.NewSearchContext(tree, index)
 
 	return nil
 }
 
-func (r Directory) requestPath(userPath string) (string, error) {
-	return r.chroot.ToNativePath(userPath)
-}
-
-// responsePath takes a path from the underlying fs domain and converts it to a path that is relative to the root of the directory resolver.
-func (r Directory) responsePath(path string) string {
-	return r.chroot.ToChrootPath(path)
-}
-
-// HasPath indicates if the given path exists in the underlying source.
-func (r *Directory) HasPath(userPath string) bool {
-	requestPath, err := r.requestPath(userPath)
-	if err != nil {
-		return false
-	}
-	return r.tree.HasPath(stereoscopeFile.Path(requestPath))
-}
-
 // Stringer to represent a directory path data source
 func (r Directory) String() string {
 	return fmt.Sprintf("dir:%s", r.path)
 }
-
-// FilesByPath returns all file.References that match the given paths from the directory.
-func (r Directory) FilesByPath(userPaths ...string) ([]file.Location, error) {
-	var references = make([]file.Location, 0)
-
-	for _, userPath := range userPaths {
-		userStrPath, err := r.requestPath(userPath)
-		if err != nil {
-			log.Warnf("unable to get file by path=%q : %+v", userPath, err)
-			continue
-		}
-
-		// we should be resolving symlinks and preserving this information as a AccessPath to the real file
-		ref, err := r.searchContext.SearchByPath(userStrPath, filetree.FollowBasenameLinks)
-		if err != nil {
-			log.Tracef("unable to evaluate symlink for path=%q : %+v", userPath, err)
-			continue
-		}
-
-		if !ref.HasReference() {
-			continue
-		}
-
-		entry, err := r.index.Get(*ref.Reference)
-		if err != nil {
-			log.Warnf("unable to get file by path=%q : %+v", userPath, err)
-			continue
-		}
-
-		// don't consider directories
-		if entry.Metadata.IsDir() {
-			continue
-		}
-
-		if windows.HostRunningOnWindows() {
-			userStrPath = windows.ToPosix(userStrPath)
-		}
-
-		if ref.HasReference() {
-			references = append(references,
-				file.NewVirtualLocationFromDirectory(
-					r.responsePath(string(ref.RealPath)), // the actual path relative to the resolver root
-					r.responsePath(userStrPath),          // the path used to access this file, relative to the resolver root
-					*ref.Reference,
-				),
-			)
-		}
-	}
-
-	return references, nil
-}
-
-func (r Directory) requestGlob(pattern string) (string, error) {
-	return r.chroot.ToNativeGlob(pattern)
-}
-
-// FilesByGlob returns all file.References that match the given path glob pattern from any layer in the image.
-func (r Directory) FilesByGlob(patterns ...string) ([]file.Location, error) {
-	uniqueFileIDs := stereoscopeFile.NewFileReferenceSet()
-	uniqueLocations := make([]file.Location, 0)
-
-	for _, pattern := range patterns {
-		requestGlob, err := r.requestGlob(pattern)
-		if err != nil {
-			return nil, err
-		}
-		refVias, err := r.searchContext.SearchByGlob(requestGlob, filetree.FollowBasenameLinks)
-		if err != nil {
-			return nil, err
-		}
-		for _, refVia := range refVias {
-			if !refVia.HasReference() || uniqueFileIDs.Contains(*refVia.Reference) {
-				continue
-			}
-			entry, err := r.index.Get(*refVia.Reference)
-			if err != nil {
-				return nil, fmt.Errorf("unable to get file metadata for reference %s: %w", refVia.Reference.RealPath, err)
-			}
-
-			// don't consider directories
-			if entry.Metadata.IsDir() {
-				continue
-			}
-
-			loc := file.NewVirtualLocationFromDirectory(
-				r.responsePath(string(refVia.Reference.RealPath)), // the actual path relative to the resolver root
-				r.responsePath(string(refVia.RequestPath)),        // the path used to access this file, relative to the resolver root
-				*refVia.Reference,
-			)
-			uniqueFileIDs.Add(*refVia.Reference)
-			uniqueLocations = append(uniqueLocations, loc)
-		}
-	}
-
-	return uniqueLocations, nil
-}
-
-// RelativeFileByPath fetches a single file at the given path relative to the layer squash of the given reference.
-// This is helpful when attempting to find a file that is in the same layer or lower as another file. For the
-// Directory, this is a simple path lookup.
-func (r *Directory) RelativeFileByPath(_ file.Location, path string) *file.Location {
-	paths, err := r.FilesByPath(path)
-	if err != nil {
-		return nil
-	}
-	if len(paths) == 0 {
-		return nil
-	}
-
-	return &paths[0]
-}
-
-// FileContentsByLocation fetches file contents for a single file reference relative to a directory.
-// If the path does not exist an error is returned.
-func (r Directory) FileContentsByLocation(location file.Location) (io.ReadCloser, error) {
-	if location.RealPath == "" {
-		return nil, errors.New("empty path given")
-	}
-
-	entry, err := r.index.Get(location.Reference())
-	if err != nil {
-		return nil, err
-	}
-
-	// don't consider directories
-	if entry.Type == stereoscopeFile.TypeDirectory {
-		return nil, fmt.Errorf("cannot read contents of non-file %q", location.Reference().RealPath)
-	}
-
-	// RealPath is posix so for windows directory resolver we need to translate
-	// to its true on disk path.
-	filePath := string(location.Reference().RealPath)
-	if windows.HostRunningOnWindows() {
-		filePath = windows.FromPosix(filePath)
-	}
-
-	return stereoscopeFile.NewLazyReadCloser(filePath), nil
-}
-
-func (r *Directory) AllLocations(ctx context.Context) <-chan file.Location {
-	results := make(chan file.Location)
-	go func() {
-		defer close(results)
-		for _, ref := range r.tree.AllFiles(stereoscopeFile.AllTypes()...) {
-			select {
-			case <-ctx.Done():
-				return
-			case results <- file.NewLocationFromDirectory(r.responsePath(string(ref.RealPath)), ref):
-				continue
-			}
-		}
-	}()
-	return results
-}
-
-func (r *Directory) FileMetadataByLocation(location file.Location) (file.Metadata, error) {
-	entry, err := r.index.Get(location.Reference())
-	if err != nil {
-		return file.Metadata{}, fmt.Errorf("location: %+v : %w", location, os.ErrNotExist)
-	}
-
-	return entry.Metadata, nil
-}
-
-func (r *Directory) FilesByMIMEType(types ...string) ([]file.Location, error) {
-	uniqueFileIDs := stereoscopeFile.NewFileReferenceSet()
-	uniqueLocations := make([]file.Location, 0)
-
-	refVias, err := r.searchContext.SearchByMIMEType(types...)
-	if err != nil {
-		return nil, err
-	}
-	for _, refVia := range refVias {
-		if !refVia.HasReference() {
-			continue
-		}
-		if uniqueFileIDs.Contains(*refVia.Reference) {
-			continue
-		}
-		location := file.NewVirtualLocationFromDirectory(
-			r.responsePath(string(refVia.Reference.RealPath)),
-			r.responsePath(string(refVia.RequestPath)),
-			*refVia.Reference,
-		)
-		uniqueFileIDs.Add(*refVia.Reference)
-		uniqueLocations = append(uniqueLocations, location)
-	}
-
-	return uniqueLocations, nil
-}

syft/internal/fileresolver/file.go

@@ -0,0 +1,62 @@
+package fileresolver
+
+import (
+	"fmt"
+
+	"github.com/anchore/stereoscope/pkg/filetree"
+	"github.com/anchore/syft/syft/file"
+)
+
+// Compile time assurance that we meet the Resolver interface.
+var _ file.Resolver = (*File)(nil)
+
+// File implements path and content access for the file data source.
+type File struct {
+	filetreeResolver
+	path    string
+	indexer *fileIndexer
+}
+
+// parent should be the symlink free absolute path to the parent directory
+// path is the filepath of the file we're creating content access for
+func NewFromFile(parent, path string, pathFilters ...PathIndexVisitor) (*File, error) {
+	chroot, err := NewChrootContextFromCWD(parent, parent)
+	if err != nil {
+		return nil, fmt.Errorf("unable to interpret chroot context: %w", err)
+	}
+
+	cleanBase := chroot.Base()
+
+	file := &File{
+		path: path,
+		filetreeResolver: filetreeResolver{
+			chroot: *chroot,
+			tree:   filetree.New(),
+			index:  filetree.NewIndex(),
+		},
+		indexer: newFileIndexer(path, cleanBase, pathFilters...),
+	}
+
+	return file, file.buildIndex()
+}
+
+func (r *File) buildIndex() error {
+	if r.indexer == nil {
+		return fmt.Errorf("no file indexer configured")
+	}
+	tree, index, err := r.indexer.build()
+	if err != nil {
+		return err
+	}
+
+	r.tree = tree
+	r.index = index
+	r.filetreeResolver.searchContext = filetree.NewSearchContext(tree, index)
+
+	return nil
+}
+
+// Stringer to represent a file path data source
+func (r File) String() string {
+	return fmt.Sprintf("file:%s", r.path)
+}

syft/internal/fileresolver/file_indexer.go

@@ -0,0 +1,224 @@
+package fileresolver
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/stereoscope/pkg/file"
+	"github.com/anchore/stereoscope/pkg/filetree"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/internal/windows"
+)
+
+type fileIndexer struct {
+	path              string
+	base              string
+	pathIndexVisitors []PathIndexVisitor
+	errPaths          map[string]error
+	tree              filetree.ReadWriter
+	index             filetree.Index
+}
+
+func newFileIndexer(path, base string, visitors ...PathIndexVisitor) *fileIndexer {
+	i := &fileIndexer{
+		path:  path,
+		base:  base,
+		tree:  filetree.New(),
+		index: filetree.NewIndex(),
+		pathIndexVisitors: append(
+			[]PathIndexVisitor{
+				requireFileInfo,
+				disallowByFileType,
+				skipPathsByMountTypeAndName(path),
+			},
+			visitors...,
+		),
+		errPaths: make(map[string]error),
+	}
+
+	return i
+}
+
+// Build the indexer
+func (r *fileIndexer) build() (filetree.Reader, filetree.IndexReader, error) {
+	return r.tree, r.index, index(r.path, r.indexPath)
+}
+
+// Index file at the given path
+// A file indexer simply indexes the file and its directory.
+func index(path string, indexer func(string, *progress.Stage) error) error {
+	// We want to index the file at the provided path and its parent directory.
+	// We need to probably check that we have file access
+	// We also need to determine what to do when the file itself is a symlink.
+	stager, prog := indexingProgress(path)
+	defer prog.SetCompleted()
+
+	err := indexer(path, stager)
+	if err != nil {
+		return fmt.Errorf("unable to index filesystem path=%q: %w", path, err)
+	}
+
+	return nil
+}
+
+// indexPath will index the file at the provided path as well as its parent directory.
+// It expects path to be a file, not a directory.
+// If a directory is provided then an error will be returned. Additionally, any IO or
+// permissions errors on the file at path or its parent directory will return an error.
+// Filter functions provided to the indexer are honoured, so if the path provided (or its parent
+// directory) is filtered by a filter function, an error is returned.
+func (r *fileIndexer) indexPath(path string, stager *progress.Stage) error {
+	log.WithFields("path", path).Trace("indexing file path")
+
+	absPath, err := filepath.Abs(path)
+	if err != nil {
+		return err
+	}
+
+	// Protect against callers trying to call file_indexer with directories
+	fi, err := os.Stat(absPath)
+	// The directory indexer ignores stat errors, however this file indexer won't ignore them
+	if err != nil {
+		return fmt.Errorf("unable to stat path=%q: %w", path, err)
+	}
+	if fi.IsDir() {
+		return fmt.Errorf("unable to index file, given path was a directory=%q", path)
+	}
+
+	absSymlinkFreeFilePath, err := absoluteSymlinkFreePathToFile(path)
+	if err != nil {
+		return err
+	}
+
+	// Now index the file and its parent directory
+	// We try to index the parent directory first, because if the parent directory
+	// is ignored by any filter function, then we must ensure we also ignore the file.
+	absSymlinkFreeParent, err := absoluteSymlinkFreePathToParent(absSymlinkFreeFilePath)
+	if err != nil {
+		return err
+	}
+	parentFi, err := os.Stat(absSymlinkFreeParent)
+	if err != nil {
+		return fmt.Errorf("unable to stat parent of file=%q: %w", absSymlinkFreeParent, err)
+	}
+
+	stager.Current = absSymlinkFreeParent
+	indexParentErr := r.filterAndIndex(absSymlinkFreeParent, parentFi)
+	if indexParentErr != nil {
+		return indexParentErr
+	}
+
+	// We have indexed the parent successfully, now attempt to index the file.
+	stager.Current = absSymlinkFreeFilePath
+	indexFileErr := r.filterAndIndex(absSymlinkFreeFilePath, fi)
+	if indexFileErr != nil {
+		return indexFileErr
+	}
+
+	return nil
+}
+
+func (r *fileIndexer) filterAndIndex(path string, info os.FileInfo) error {
+	// check if any of the filters want us to ignore this path
+	for _, filterFn := range r.pathIndexVisitors {
+		if filterFn == nil {
+			continue
+		}
+
+		if filterErr := filterFn(r.base, path, info, nil); filterErr != nil {
+			// A filter function wants us to ignore this path, honour it
+			return filterErr
+		}
+	}
+
+	// here we check to see if we need to normalize paths to posix on the way in coming from windows
+	if windows.HostRunningOnWindows() {
+		path = windows.ToPosix(path)
+	}
+
+	err := r.addPathToIndex(path, info)
+	// If we hit file access errors, isFileAccessErr will handle logging & adding
+	// the path to the errPaths map.
+	// While the directory_indexer does not let these cause the indexer to throw
+	// we will here, as not having access to the file we index for a file source
+	// probably makes the file source creation useless? I need to check with Syft maintainers.
+	// This also poses the question, is errPaths worthwhile for file_indexer?
+	if r.isFileAccessErr(path, err) {
+		return err
+	}
+
+	return nil
+}
+
+// Add path to index. File indexer doesn't need to support symlink, as we should have abs symlink free path.
+// If we somehow get a symlink here, report as an error.
+func (r *fileIndexer) addPathToIndex(path string, info os.FileInfo) error {
+	switch t := file.TypeFromMode(info.Mode()); t {
+	case file.TypeDirectory:
+		return r.addDirectoryToIndex(path, info)
+	case file.TypeRegular:
+		return r.addFileToIndex(path, info)
+	default:
+		return fmt.Errorf("unsupported file type: %s", t)
+	}
+}
+
+func (r *fileIndexer) addDirectoryToIndex(path string, info os.FileInfo) error {
+	ref, err := r.tree.AddDir(file.Path(path))
+	if err != nil {
+		return err
+	}
+
+	metadata := file.NewMetadataFromPath(path, info)
+	r.index.Add(*ref, metadata)
+
+	return nil
+}
+
+func (r *fileIndexer) addFileToIndex(path string, info os.FileInfo) error {
+	ref, err := r.tree.AddFile(file.Path(path))
+	if err != nil {
+		return err
+	}
+
+	metadata := file.NewMetadataFromPath(path, info)
+	r.index.Add(*ref, metadata)
+
+	return nil
+}
+
+// Get absolute symlink free path to parent of the file
+func absoluteSymlinkFreePathToParent(path string) (string, error) {
+	absFilePath, err := absoluteSymlinkFreePathToFile(path)
+	if err != nil {
+		return "", err
+	}
+
+	return filepath.Dir(absFilePath), nil
+}
+
+// Get absolute symlink free path to the file
+func absoluteSymlinkFreePathToFile(path string) (string, error) {
+	absAnalysisPath, err := filepath.Abs(path)
+	if err != nil {
+		return "", fmt.Errorf("unable to get absolute path for analysis path=%q: %w", path, err)
+	}
+	dereferencedAbsAnalysisPath, err := filepath.EvalSymlinks(absAnalysisPath)
+	if err != nil {
+		return "", fmt.Errorf("unable to get absolute path for analysis path=%q: %w", path, err)
+	}
+	return dereferencedAbsAnalysisPath, nil
+}
+
+func (r *fileIndexer) isFileAccessErr(path string, err error) bool {
+	// don't allow for errors to stop indexing, keep track of the paths and continue.
+	if err != nil {
+		log.Warnf("unable to access path=%q: %+v", path, err)
+		r.errPaths[path] = err
+		return true
+	}
+	return false
+}

syft/internal/fileresolver/file_indexer_test.go

@@ -0,0 +1,105 @@
+package fileresolver
+
+import (
+	"io/fs"
+	"os"
+	"path"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/stereoscope/pkg/file"
+)
+
+// - Verify that both the parent and the path are indexed
+func Test_index(t *testing.T) {
+	testPath := "test-fixtures/system_paths/target/home/place"
+	indexer := newFileIndexer(testPath, "", make([]PathIndexVisitor, 0)...)
+	tree, index, err := indexer.build()
+	require.NoError(t, err)
+
+	tests := []struct {
+		name string
+		path string
+	}{
+		{
+			name: "has path",
+			path: "test-fixtures/system_paths/target/home/place",
+		},
+		{
+			name: "has parent dir",
+			path: "test-fixtures/system_paths/target/home",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			info, err := os.Stat(test.path)
+			assert.NoError(t, err)
+
+			// note: the index uses absolute paths, so assertions MUST keep this in mind
+			cwd, err := os.Getwd()
+			require.NoError(t, err)
+
+			p := file.Path(path.Join(cwd, test.path))
+			assert.Equal(t, true, tree.HasPath(p))
+			exists, ref, err := tree.File(p)
+			assert.Equal(t, true, exists)
+			if assert.NoError(t, err) {
+				return
+			}
+
+			entry, err := index.Get(*ref.Reference)
+			require.NoError(t, err)
+			assert.Equal(t, info.Mode(), entry.Mode)
+		})
+	}
+
+}
+
+// - Verify that directories are rejected
+func Test_indexRejectsDirectory(t *testing.T) {
+	dirPath := "test-fixtures/system_paths/target/home"
+	indexer := newFileIndexer(dirPath, "", make([]PathIndexVisitor, 0)...)
+	_, _, err := indexer.build()
+	require.Error(t, err)
+}
+
+// - Verify ignores if filterAndIndex sets up a filter for the filepath
+func Test_ignoresPathIfFiltered(t *testing.T) {
+	testPath := "test-fixtures/system_paths/target/home/place"
+	cwd, cwdErr := os.Getwd()
+	require.NoError(t, cwdErr)
+	ignorePath := path.Join(cwd, testPath)
+	filterFn := func(_, path string, _ os.FileInfo, _ error) error {
+		if path == ignorePath {
+			return ErrSkipPath
+		}
+
+		return nil
+	}
+	indexer := newFileIndexer(testPath, "", filterFn)
+	_, _, err := indexer.build()
+	require.Error(t, err)
+}
+
+// - Verify ignores if filterAndIndex sets up a filter for the directory
+func Test_ignoresPathIfParentFiltered(t *testing.T) {
+	testPath := "test-fixtures/system_paths/target/home/place"
+	parentPath := "test-fixtures/system_paths/target/home"
+
+	cwd, cwdErr := os.Getwd()
+	require.NoError(t, cwdErr)
+	ignorePath := path.Join(cwd, parentPath)
+	filterFn := func(_, path string, _ os.FileInfo, _ error) error {
+		if path == ignorePath {
+			return fs.SkipDir
+		}
+
+		return nil
+	}
+	indexer := newFileIndexer(testPath, "", filterFn)
+	_, _, err := indexer.build()
+	require.Error(t, err)
+}

syft/internal/fileresolver/filetree_resolver.go

@@ -0,0 +1,229 @@
+package fileresolver
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+
+	stereoscopeFile "github.com/anchore/stereoscope/pkg/file"
+	"github.com/anchore/stereoscope/pkg/filetree"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/internal/windows"
+)
+
+type filetreeResolver struct {
+	chroot        ChrootContext
+	tree          filetree.Reader
+	index         filetree.IndexReader
+	searchContext filetree.Searcher
+}
+
+func (r *filetreeResolver) requestPath(userPath string) (string, error) {
+	return r.chroot.ToNativePath(userPath)
+}
+
+// responsePath takes a path from the underlying fs domain and converts it to a path that is relative to the root of the file resolver.
+func (r filetreeResolver) responsePath(path string) string {
+	return r.chroot.ToChrootPath(path)
+}
+
+// HasPath indicates if the given path exists in the underlying source.
+func (r *filetreeResolver) HasPath(userPath string) bool {
+	requestPath, err := r.requestPath(userPath)
+	if err != nil {
+		return false
+	}
+	return r.tree.HasPath(stereoscopeFile.Path(requestPath))
+}
+
+// FilesByPath returns all file.References that match the given paths from the file index.
+func (r filetreeResolver) FilesByPath(userPaths ...string) ([]file.Location, error) {
+	var references = make([]file.Location, 0)
+
+	for _, userPath := range userPaths {
+		userStrPath, err := r.requestPath(userPath)
+		if err != nil {
+			log.Warnf("unable to get file by path=%q : %+v", userPath, err)
+			continue
+		}
+
+		// we should be resolving symlinks and preserving this information as a AccessPath to the real file
+		ref, err := r.searchContext.SearchByPath(userStrPath, filetree.FollowBasenameLinks)
+		if err != nil {
+			log.Tracef("unable to evaluate symlink for path=%q : %+v", userPath, err)
+			continue
+		}
+
+		if !ref.HasReference() {
+			continue
+		}
+
+		entry, err := r.index.Get(*ref.Reference)
+		if err != nil {
+			log.Warnf("unable to get file by path=%q : %+v", userPath, err)
+			continue
+		}
+
+		// don't consider directories
+		if entry.Metadata.IsDir() {
+			continue
+		}
+
+		if windows.HostRunningOnWindows() {
+			userStrPath = windows.ToPosix(userStrPath)
+		}
+
+		if ref.HasReference() {
+			references = append(references,
+				file.NewVirtualLocationFromDirectory(
+					r.responsePath(string(ref.RealPath)), // the actual path relative to the resolver root
+					r.responsePath(userStrPath),          // the path used to access this file, relative to the resolver root
+					*ref.Reference,
+				),
+			)
+		}
+	}
+
+	return references, nil
+}
+
+func (r filetreeResolver) requestGlob(pattern string) (string, error) {
+	return r.chroot.ToNativeGlob(pattern)
+}
+
+// FilesByGlob returns all file.References that match the given path glob pattern from any layer in the image.
+func (r filetreeResolver) FilesByGlob(patterns ...string) ([]file.Location, error) {
+	uniqueFileIDs := stereoscopeFile.NewFileReferenceSet()
+	uniqueLocations := make([]file.Location, 0)
+
+	for _, pattern := range patterns {
+		requestGlob, err := r.requestGlob(pattern)
+		if err != nil {
+			return nil, err
+		}
+		refVias, err := r.searchContext.SearchByGlob(requestGlob, filetree.FollowBasenameLinks)
+		if err != nil {
+			return nil, err
+		}
+		for _, refVia := range refVias {
+			if !refVia.HasReference() || uniqueFileIDs.Contains(*refVia.Reference) {
+				continue
+			}
+			entry, err := r.index.Get(*refVia.Reference)
+			if err != nil {
+				return nil, fmt.Errorf("unable to get file metadata for reference %s: %w", refVia.Reference.RealPath, err)
+			}
+
+			// don't consider directories
+			if entry.Metadata.IsDir() {
+				continue
+			}
+
+			loc := file.NewVirtualLocationFromDirectory(
+				r.responsePath(string(refVia.Reference.RealPath)), // the actual path relative to the resolver root
+				r.responsePath(string(refVia.RequestPath)),        // the path used to access this file, relative to the resolver root
+				*refVia.Reference,
+			)
+			uniqueFileIDs.Add(*refVia.Reference)
+			uniqueLocations = append(uniqueLocations, loc)
+		}
+	}
+
+	return uniqueLocations, nil
+}
+
+// RelativeFileByPath fetches a single file at the given path relative to the layer squash of the given reference.
+// This is helpful when attempting to find a file that is in the same layer or lower as another file.
+func (r *filetreeResolver) RelativeFileByPath(_ file.Location, path string) *file.Location {
+	paths, err := r.FilesByPath(path)
+	if err != nil {
+		return nil
+	}
+	if len(paths) == 0 {
+		return nil
+	}
+
+	return &paths[0]
+}
+
+// FileContentsByLocation fetches file contents for a single file reference relative to a directory.
+// If the path does not exist an error is returned.
+func (r filetreeResolver) FileContentsByLocation(location file.Location) (io.ReadCloser, error) {
+	if location.RealPath == "" {
+		return nil, errors.New("empty path given")
+	}
+
+	entry, err := r.index.Get(location.Reference())
+	if err != nil {
+		return nil, err
+	}
+
+	// don't consider directories
+	if entry.Type == stereoscopeFile.TypeDirectory {
+		return nil, fmt.Errorf("cannot read contents of non-file %q", location.Reference().RealPath)
+	}
+
+	// RealPath is posix so for windows file resolver we need to translate
+	// to its true on disk path.
+	filePath := string(location.Reference().RealPath)
+	if windows.HostRunningOnWindows() {
+		filePath = windows.FromPosix(filePath)
+	}
+
+	return stereoscopeFile.NewLazyReadCloser(filePath), nil
+}
+
+func (r *filetreeResolver) AllLocations(ctx context.Context) <-chan file.Location {
+	results := make(chan file.Location)
+	go func() {
+		defer close(results)
+		for _, ref := range r.tree.AllFiles(stereoscopeFile.AllTypes()...) {
+			select {
+			case <-ctx.Done():
+				return
+			case results <- file.NewLocationFromDirectory(r.responsePath(string(ref.RealPath)), ref):
+				continue
+			}
+		}
+	}()
+	return results
+}
+
+func (r *filetreeResolver) FileMetadataByLocation(location file.Location) (file.Metadata, error) {
+	entry, err := r.index.Get(location.Reference())
+	if err != nil {
+		return file.Metadata{}, fmt.Errorf("location: %+v : %w", location, os.ErrNotExist)
+	}
+
+	return entry.Metadata, nil
+}
+
+func (r *filetreeResolver) FilesByMIMEType(types ...string) ([]file.Location, error) {
+	uniqueFileIDs := stereoscopeFile.NewFileReferenceSet()
+	uniqueLocations := make([]file.Location, 0)
+
+	refVias, err := r.searchContext.SearchByMIMEType(types...)
+	if err != nil {
+		return nil, err
+	}
+	for _, refVia := range refVias {
+		if !refVia.HasReference() {
+			continue
+		}
+		if uniqueFileIDs.Contains(*refVia.Reference) {
+			continue
+		}
+		location := file.NewVirtualLocationFromDirectory(
+			r.responsePath(string(refVia.Reference.RealPath)),
+			r.responsePath(string(refVia.RequestPath)),
+			*refVia.Reference,
+		)
+		uniqueFileIDs.Add(*refVia.Reference)
+		uniqueLocations = append(uniqueLocations, location)
+	}
+
+	return uniqueLocations, nil
+}

syft/license/license_test.go

@@ -20,6 +20,11 @@ func TestParseExpression(t *testing.T) {
 			expression: "MIT OR Apache-2.0",
 			want:       "MIT OR Apache-2.0",
 		},
+		{
+			name:       "accept redundant parentheses",
+			expression: "(MIT OR Apache-2.0)",
+			want:       "(MIT OR Apache-2.0)",
+		},
 		{
 			name:       "Invalid SPDX expression returns error",
 			expression: "MIT OR Apache-2.0 OR invalid",

syft/pkg/cataloger/binary/classifier_cataloger_test.go

@@ -1067,6 +1067,28 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 				Metadata:  metadata("swipl-binary"),
 			},
 		},
+		{
+			logicalFixture: "dart/2.12.4/linux-amd64",
+			expected: pkg.Package{
+				Name:      "dart",
+				Version:   "2.12.4",
+				Type:      "binary",
+				PURL:      "pkg:generic/dart@2.12.4",
+				Locations: locations("dart"),
+				Metadata:  metadata("dart-binary"),
+			},
+		},
+		{
+			logicalFixture: "dart/3.0.0/linux-arm",
+			expected: pkg.Package{
+				Name:      "dart",
+				Version:   "3.0.0",
+				Type:      "binary",
+				PURL:      "pkg:generic/dart@3.0.0",
+				Locations: locations("dart"),
+				Metadata:  metadata("dart-binary"),
+			},
+		},
 		{
 			logicalFixture: "dart/3.5.2/linux-amd64",
 			expected: pkg.Package{

syft/pkg/cataloger/binary/classifiers.go

@@ -458,7 +458,11 @@ func DefaultClassifiers() []Classifier {
 			Class:    "dart-binary",
 			FileGlob: "**/dart",
 			EvidenceMatcher: FileContentsVersionMatcher(
-				`(?m)Dart,GC"\x00(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-[0-9]+(\.[0-9]+)?\.beta)?) `,
+				// MathAtan[NUL]2.12.4 (stable)
+				// "%s"[NUL]3.0.0 (stable)
+				// Dart,GC"[NUL]3.5.2 (stable)
+				// Dart,GC"[NUL]3.6.0-216.1.beta (beta)
+				`(?m)\x00(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-[0-9]+(\.[0-9]+)?\.beta)?) `,
 			),
 			Package: "dart",
 			PURL:    mustPURL("pkg:generic/dart@version"),

syft/pkg/cataloger/binary/test-fixtures/config.yaml

@@ -78,6 +78,21 @@ from-images:
     paths:
       - /usr/lib/swipl/bin/x86_64-linux/swipl
 
+  - version: 2.12.4
+    images:
+      - ref: dart:2.12.4-sdk@sha256:0da5d8c9727f5b90e585bcc55a078d981029f4e13044f206299e00f23993a4a8
+        platform: linux/amd64
+
+    paths:
+      - /usr/lib/dart/bin/dart
+
+  - version: 3.0.0
+    images:
+      - ref: dart:3.0.0-sdk@sha256:67708c6011199d59336bf6cd0f9e618e55dd3632c79a43375f5a082795f0b724
+        platform: linux/arm
+    paths:
+      - /usr/lib/dart/bin/dart
+
   - version: 3.5.2
     images:
       - ref: dart:3.5.2@sha256:1fd62cb5036bdc42de89bdae747683277986639be9b0b0a0751d2c50bbd9441f

syft/pkg/cataloger/golang/cataloger_test.go

@@ -21,30 +21,30 @@ func Test_PackageCataloger_Binary(t *testing.T) {
 			fixture: "image-small",
 			expectedPkgs: []string{
 				"anchore.io/not/real @ v1.0.0 (/run-me)",
-				"github.com/andybalholm/brotli @ v1.0.1 (/run-me)",
+				"github.com/andybalholm/brotli @ v1.1.1 (/run-me)",
 				"github.com/dsnet/compress @ v0.0.2-0.20210315054119-f66993602bf5 (/run-me)",
-				"github.com/golang/snappy @ v0.0.2 (/run-me)",
-				"github.com/klauspost/compress @ v1.11.4 (/run-me)",
-				"github.com/klauspost/pgzip @ v1.2.5 (/run-me)",
-				"github.com/mholt/archiver/v3 @ v3.5.1 (/run-me)",
-				"github.com/nwaples/rardecode @ v1.1.0 (/run-me)",
-				"github.com/pierrec/lz4/v4 @ v4.1.2 (/run-me)",
-				"github.com/ulikunitz/xz @ v0.5.9 (/run-me)",
+				"github.com/golang/snappy @ v0.0.4 (/run-me)",
+				"github.com/klauspost/compress @ v1.17.11 (/run-me)",
+				"github.com/klauspost/pgzip @ v1.2.6 (/run-me)",
+				"github.com/nwaples/rardecode @ v1.1.3 (/run-me)",
+				"github.com/pierrec/lz4/v4 @ v4.1.21 (/run-me)",
+				"github.com/ulikunitz/xz @ v0.5.12 (/run-me)",
 				"github.com/xi2/xz @ v0.0.0-20171230120015-48954b6210f8 (/run-me)",
-				"stdlib @ go1.22.4 (/run-me)",
+				"stdlib @ go1.23.2 (/run-me)",
+				"github.com/anchore/archiver/v3 @ v3.5.3-0.20241210171143-5b1d8d1c7c51 (/run-me)",
 			},
 			expectedRels: []string{
-				"github.com/andybalholm/brotli @ v1.0.1 (/run-me) [dependency-of] anchore.io/not/real @ v1.0.0 (/run-me)",
+				"github.com/andybalholm/brotli @ v1.1.1 (/run-me) [dependency-of] anchore.io/not/real @ v1.0.0 (/run-me)",
 				"github.com/dsnet/compress @ v0.0.2-0.20210315054119-f66993602bf5 (/run-me) [dependency-of] anchore.io/not/real @ v1.0.0 (/run-me)",
-				"github.com/golang/snappy @ v0.0.2 (/run-me) [dependency-of] anchore.io/not/real @ v1.0.0 (/run-me)",
-				"github.com/klauspost/compress @ v1.11.4 (/run-me) [dependency-of] anchore.io/not/real @ v1.0.0 (/run-me)",
-				"github.com/klauspost/pgzip @ v1.2.5 (/run-me) [dependency-of] anchore.io/not/real @ v1.0.0 (/run-me)",
-				"github.com/mholt/archiver/v3 @ v3.5.1 (/run-me) [dependency-of] anchore.io/not/real @ v1.0.0 (/run-me)",
-				"github.com/nwaples/rardecode @ v1.1.0 (/run-me) [dependency-of] anchore.io/not/real @ v1.0.0 (/run-me)",
-				"github.com/pierrec/lz4/v4 @ v4.1.2 (/run-me) [dependency-of] anchore.io/not/real @ v1.0.0 (/run-me)",
-				"github.com/ulikunitz/xz @ v0.5.9 (/run-me) [dependency-of] anchore.io/not/real @ v1.0.0 (/run-me)",
+				"github.com/golang/snappy @ v0.0.4 (/run-me) [dependency-of] anchore.io/not/real @ v1.0.0 (/run-me)",
+				"github.com/klauspost/compress @ v1.17.11 (/run-me) [dependency-of] anchore.io/not/real @ v1.0.0 (/run-me)",
+				"github.com/klauspost/pgzip @ v1.2.6 (/run-me) [dependency-of] anchore.io/not/real @ v1.0.0 (/run-me)",
+				"github.com/anchore/archiver/v3 @ v3.5.3-0.20241210171143-5b1d8d1c7c51 (/run-me) [dependency-of] anchore.io/not/real @ v1.0.0 (/run-me)",
+				"github.com/nwaples/rardecode @ v1.1.3 (/run-me) [dependency-of] anchore.io/not/real @ v1.0.0 (/run-me)",
+				"github.com/pierrec/lz4/v4 @ v4.1.21 (/run-me) [dependency-of] anchore.io/not/real @ v1.0.0 (/run-me)",
+				"github.com/ulikunitz/xz @ v0.5.12 (/run-me) [dependency-of] anchore.io/not/real @ v1.0.0 (/run-me)",
 				"github.com/xi2/xz @ v0.0.0-20171230120015-48954b6210f8 (/run-me) [dependency-of] anchore.io/not/real @ v1.0.0 (/run-me)",
-				"stdlib @ go1.22.4 (/run-me) [dependency-of] anchore.io/not/real @ v1.0.0 (/run-me)",
+				"stdlib @ go1.23.2 (/run-me) [dependency-of] anchore.io/not/real @ v1.0.0 (/run-me)",
 			},
 		},
 		{
@@ -54,30 +54,30 @@ func Test_PackageCataloger_Binary(t *testing.T) {
 			fixture: "image-not-a-module",
 			expectedPkgs: []string{
 				"command-line-arguments @ (devel) (/run-me)", // this is the difference!
-				"github.com/andybalholm/brotli @ v1.0.1 (/run-me)",
+				"github.com/andybalholm/brotli @ v1.1.1 (/run-me)",
 				"github.com/dsnet/compress @ v0.0.2-0.20210315054119-f66993602bf5 (/run-me)",
-				"github.com/golang/snappy @ v0.0.2 (/run-me)",
-				"github.com/klauspost/compress @ v1.11.4 (/run-me)",
-				"github.com/klauspost/pgzip @ v1.2.5 (/run-me)",
-				"github.com/mholt/archiver/v3 @ v3.5.1 (/run-me)",
-				"github.com/nwaples/rardecode @ v1.1.0 (/run-me)",
-				"github.com/pierrec/lz4/v4 @ v4.1.2 (/run-me)",
-				"github.com/ulikunitz/xz @ v0.5.9 (/run-me)",
+				"github.com/golang/snappy @ v0.0.4 (/run-me)",
+				"github.com/anchore/archiver/v3 @ v3.5.3-0.20241210171143-5b1d8d1c7c51 (/run-me)",
+				"github.com/klauspost/compress @ v1.17.11 (/run-me)",
+				"github.com/klauspost/pgzip @ v1.2.6 (/run-me)",
+				"github.com/nwaples/rardecode @ v1.1.3 (/run-me)",
+				"github.com/pierrec/lz4/v4 @ v4.1.21 (/run-me)",
+				"github.com/ulikunitz/xz @ v0.5.12 (/run-me)",
 				"github.com/xi2/xz @ v0.0.0-20171230120015-48954b6210f8 (/run-me)",
-				"stdlib @ go1.22.4 (/run-me)",
+				"stdlib @ go1.23.2 (/run-me)",
 			},
 			expectedRels: []string{
-				"github.com/andybalholm/brotli @ v1.0.1 (/run-me) [dependency-of] command-line-arguments @ (devel) (/run-me)",
+				"github.com/anchore/archiver/v3 @ v3.5.3-0.20241210171143-5b1d8d1c7c51 (/run-me) [dependency-of] command-line-arguments @ (devel) (/run-me)",
+				"github.com/andybalholm/brotli @ v1.1.1 (/run-me) [dependency-of] command-line-arguments @ (devel) (/run-me)",
 				"github.com/dsnet/compress @ v0.0.2-0.20210315054119-f66993602bf5 (/run-me) [dependency-of] command-line-arguments @ (devel) (/run-me)",
-				"github.com/golang/snappy @ v0.0.2 (/run-me) [dependency-of] command-line-arguments @ (devel) (/run-me)",
-				"github.com/klauspost/compress @ v1.11.4 (/run-me) [dependency-of] command-line-arguments @ (devel) (/run-me)",
-				"github.com/klauspost/pgzip @ v1.2.5 (/run-me) [dependency-of] command-line-arguments @ (devel) (/run-me)",
-				"github.com/mholt/archiver/v3 @ v3.5.1 (/run-me) [dependency-of] command-line-arguments @ (devel) (/run-me)",
-				"github.com/nwaples/rardecode @ v1.1.0 (/run-me) [dependency-of] command-line-arguments @ (devel) (/run-me)",
-				"github.com/pierrec/lz4/v4 @ v4.1.2 (/run-me) [dependency-of] command-line-arguments @ (devel) (/run-me)",
-				"github.com/ulikunitz/xz @ v0.5.9 (/run-me) [dependency-of] command-line-arguments @ (devel) (/run-me)",
+				"github.com/golang/snappy @ v0.0.4 (/run-me) [dependency-of] command-line-arguments @ (devel) (/run-me)",
+				"github.com/klauspost/compress @ v1.17.11 (/run-me) [dependency-of] command-line-arguments @ (devel) (/run-me)",
+				"github.com/klauspost/pgzip @ v1.2.6 (/run-me) [dependency-of] command-line-arguments @ (devel) (/run-me)",
+				"github.com/nwaples/rardecode @ v1.1.3 (/run-me) [dependency-of] command-line-arguments @ (devel) (/run-me)",
+				"github.com/pierrec/lz4/v4 @ v4.1.21 (/run-me) [dependency-of] command-line-arguments @ (devel) (/run-me)",
+				"github.com/ulikunitz/xz @ v0.5.12 (/run-me) [dependency-of] command-line-arguments @ (devel) (/run-me)",
 				"github.com/xi2/xz @ v0.0.0-20171230120015-48954b6210f8 (/run-me) [dependency-of] command-line-arguments @ (devel) (/run-me)",
-				"stdlib @ go1.22.4 (/run-me) [dependency-of] command-line-arguments @ (devel) (/run-me)",
+				"stdlib @ go1.23.2 (/run-me) [dependency-of] command-line-arguments @ (devel) (/run-me)",
 			},
 		},
 	}

syft/pkg/cataloger/golang/test-fixtures/image-not-a-module/Dockerfile

@@ -1,4 +1,4 @@
-FROM --platform=linux/amd64 golang:1.22.4 AS builder
+FROM --platform=linux/amd64 golang:1.23.2 AS builder
 
 RUN mkdir /app
 WORKDIR /app

syft/pkg/cataloger/golang/test-fixtures/image-not-a-module/go.mod

@@ -1,17 +1,19 @@
 module anchore.io/not/real
 
-go 1.22.1
+go 1.23
 
-require github.com/mholt/archiver/v3 v3.5.1
+toolchain go1.23.2
+
+require github.com/anchore/archiver/v3 v3.5.3-0.20241210171143-5b1d8d1c7c51
 
 require (
-	github.com/andybalholm/brotli v1.0.1 // indirect
+	github.com/andybalholm/brotli v1.1.1 // indirect
 	github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 // indirect
-	github.com/golang/snappy v0.0.2 // indirect
-	github.com/klauspost/compress v1.11.4 // indirect
-	github.com/klauspost/pgzip v1.2.5 // indirect
-	github.com/nwaples/rardecode v1.1.0 // indirect
-	github.com/pierrec/lz4/v4 v4.1.2 // indirect
-	github.com/ulikunitz/xz v0.5.9 // indirect
+	github.com/golang/snappy v0.0.4 // indirect
+	github.com/klauspost/compress v1.17.11 // indirect
+	github.com/klauspost/pgzip v1.2.6 // indirect
+	github.com/nwaples/rardecode v1.1.3 // indirect
+	github.com/pierrec/lz4/v4 v4.1.21 // indirect
+	github.com/ulikunitz/xz v0.5.12 // indirect
 	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
 )

syft/pkg/cataloger/golang/test-fixtures/image-not-a-module/go.sum

@@ -1,26 +1,28 @@
-github.com/andybalholm/brotli v1.0.1 h1:KqhlKozYbRtJvsPrrEeXcO+N2l6NYT5A2QAFmSULpEc=
-github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
+github.com/anchore/archiver/v3 v3.5.3-0.20241210171143-5b1d8d1c7c51 h1:yhk+P8lF3ZiROjmaVRao9WGTRo4b/wYjoKEiAHWrKwc=
+github.com/anchore/archiver/v3 v3.5.3-0.20241210171143-5b1d8d1c7c51/go.mod h1:nwuGSd7aZp0rtYt79YggCGafz1RYsclE7pi3fhLwvuw=
+github.com/andybalholm/brotli v1.1.1 h1:PR2pgnyFznKEugtsUo0xLdDop5SKXd5Qf5ysW+7XdTA=
+github.com/andybalholm/brotli v1.1.1/go.mod h1:05ib4cKhjx3OQYUY22hTVd34Bc8upXjOLL2rKwwZBoA=
 github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 h1:iFaUwBSo5Svw6L7HYpRu/0lE3e0BaElwnNO1qkNQxBY=
 github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5/go.mod h1:qssHWj60/X5sZFNxpG4HBPDHVqxNm4DfnCKgrbZOT+s=
 github.com/dsnet/golib v0.0.0-20171103203638-1ea166775780/go.mod h1:Lj+Z9rebOhdfkVLjJ8T6VcRQv3SXugXy999NBtR9aFY=
-github.com/golang/snappy v0.0.2 h1:aeE13tS0IiQgFjYdoL8qN3K1N2bXXtI6Vi51/y7BpMw=
-github.com/golang/snappy v0.0.2/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
+github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
-github.com/klauspost/compress v1.11.4 h1:kz40R/YWls3iqT9zX9AHN3WoVsrAWVyui5sxuLqiXqU=
-github.com/klauspost/compress v1.11.4/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
+github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
+github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
-github.com/klauspost/pgzip v1.2.5 h1:qnWYvvKqedOF2ulHpMG72XQol4ILEJ8k2wwRl/Km8oE=
-github.com/klauspost/pgzip v1.2.5/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
-github.com/mholt/archiver/v3 v3.5.1 h1:rDjOBX9JSF5BvoJGvjqK479aL70qh9DIpZCl+k7Clwo=
-github.com/mholt/archiver/v3 v3.5.1/go.mod h1:e3dqJ7H78uzsRSEACH1joayhuSyhnonssnDhppzS1L4=
-github.com/nwaples/rardecode v1.1.0 h1:vSxaY8vQhOcVr4mm5e8XllHWTiM4JF507A0Katqw7MQ=
-github.com/nwaples/rardecode v1.1.0/go.mod h1:5DzqNKiOdpKKBH87u8VlvAnPZMXcGRhxWkRpHbbfGS0=
-github.com/pierrec/lz4/v4 v4.1.2 h1:qvY3YFXRQE/XB8MlLzJH7mSzBs74eA2gg52YTk6jUPM=
-github.com/pierrec/lz4/v4 v4.1.2/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
+github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
+github.com/klauspost/pgzip v1.2.6/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
+github.com/nwaples/rardecode v1.1.3 h1:cWCaZwfM5H7nAD6PyEdcVnczzV8i/JtotnyW/dD9lEc=
+github.com/nwaples/rardecode v1.1.3/go.mod h1:5DzqNKiOdpKKBH87u8VlvAnPZMXcGRhxWkRpHbbfGS0=
+github.com/pierrec/lz4/v4 v4.1.21 h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ=
+github.com/pierrec/lz4/v4 v4.1.21/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
-github.com/ulikunitz/xz v0.5.9 h1:RsKRIA2MO8x56wkkcd3LbtcE/uMszhb6DpRf+3uwa3I=
-github.com/ulikunitz/xz v0.5.9/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
+github.com/ulikunitz/xz v0.5.12 h1:37Nm15o69RwBkXM0J6A5OlE67RZTfzUxTj8fB3dfcsc=
+github.com/ulikunitz/xz v0.5.12/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 h1:nIPpBwaJSVYIxUFsDv3M8ofmx9yWTog9BfvIu0q41lo=
 github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8/go.mod h1:HUYIGzjTL3rfEspMxjDjgmT5uz5wzYJKVo23qUhYTos=
+github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
+github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

syft/pkg/cataloger/golang/test-fixtures/image-not-a-module/main.go

@@ -1,6 +1,6 @@
 package main
 
-import "github.com/mholt/archiver/v3"
+import "github.com/anchore/archiver/v3"
 
 func main() {
 

syft/pkg/cataloger/golang/test-fixtures/image-small/Dockerfile

@@ -1,4 +1,4 @@
-FROM --platform=linux/amd64 golang:1.22.4 AS builder
+FROM --platform=linux/amd64 golang:1.23.2 AS builder
 
 RUN mkdir /app
 WORKDIR /app

syft/pkg/cataloger/golang/test-fixtures/image-small/go.mod

@@ -1,17 +1,19 @@
 module anchore.io/not/real
 
-go 1.22.1
+go 1.23
 
-require github.com/mholt/archiver/v3 v3.5.1
+toolchain go1.23.2
+
+require github.com/anchore/archiver/v3 v3.5.3-0.20241210171143-5b1d8d1c7c51
 
 require (
-	github.com/andybalholm/brotli v1.0.1 // indirect
+	github.com/andybalholm/brotli v1.1.1 // indirect
 	github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 // indirect
-	github.com/golang/snappy v0.0.2 // indirect
-	github.com/klauspost/compress v1.11.4 // indirect
-	github.com/klauspost/pgzip v1.2.5 // indirect
-	github.com/nwaples/rardecode v1.1.0 // indirect
-	github.com/pierrec/lz4/v4 v4.1.2 // indirect
-	github.com/ulikunitz/xz v0.5.9 // indirect
+	github.com/golang/snappy v0.0.4 // indirect
+	github.com/klauspost/compress v1.17.11 // indirect
+	github.com/klauspost/pgzip v1.2.6 // indirect
+	github.com/nwaples/rardecode v1.1.3 // indirect
+	github.com/pierrec/lz4/v4 v4.1.21 // indirect
+	github.com/ulikunitz/xz v0.5.12 // indirect
 	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
 )

syft/pkg/cataloger/golang/test-fixtures/image-small/go.sum

@@ -1,26 +1,28 @@
-github.com/andybalholm/brotli v1.0.1 h1:KqhlKozYbRtJvsPrrEeXcO+N2l6NYT5A2QAFmSULpEc=
-github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
+github.com/anchore/archiver/v3 v3.5.3-0.20241210171143-5b1d8d1c7c51 h1:yhk+P8lF3ZiROjmaVRao9WGTRo4b/wYjoKEiAHWrKwc=
+github.com/anchore/archiver/v3 v3.5.3-0.20241210171143-5b1d8d1c7c51/go.mod h1:nwuGSd7aZp0rtYt79YggCGafz1RYsclE7pi3fhLwvuw=
+github.com/andybalholm/brotli v1.1.1 h1:PR2pgnyFznKEugtsUo0xLdDop5SKXd5Qf5ysW+7XdTA=
+github.com/andybalholm/brotli v1.1.1/go.mod h1:05ib4cKhjx3OQYUY22hTVd34Bc8upXjOLL2rKwwZBoA=
 github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 h1:iFaUwBSo5Svw6L7HYpRu/0lE3e0BaElwnNO1qkNQxBY=
 github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5/go.mod h1:qssHWj60/X5sZFNxpG4HBPDHVqxNm4DfnCKgrbZOT+s=
 github.com/dsnet/golib v0.0.0-20171103203638-1ea166775780/go.mod h1:Lj+Z9rebOhdfkVLjJ8T6VcRQv3SXugXy999NBtR9aFY=
-github.com/golang/snappy v0.0.2 h1:aeE13tS0IiQgFjYdoL8qN3K1N2bXXtI6Vi51/y7BpMw=
-github.com/golang/snappy v0.0.2/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
+github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
-github.com/klauspost/compress v1.11.4 h1:kz40R/YWls3iqT9zX9AHN3WoVsrAWVyui5sxuLqiXqU=
-github.com/klauspost/compress v1.11.4/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
+github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
+github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
-github.com/klauspost/pgzip v1.2.5 h1:qnWYvvKqedOF2ulHpMG72XQol4ILEJ8k2wwRl/Km8oE=
-github.com/klauspost/pgzip v1.2.5/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
-github.com/mholt/archiver/v3 v3.5.1 h1:rDjOBX9JSF5BvoJGvjqK479aL70qh9DIpZCl+k7Clwo=
-github.com/mholt/archiver/v3 v3.5.1/go.mod h1:e3dqJ7H78uzsRSEACH1joayhuSyhnonssnDhppzS1L4=
-github.com/nwaples/rardecode v1.1.0 h1:vSxaY8vQhOcVr4mm5e8XllHWTiM4JF507A0Katqw7MQ=
-github.com/nwaples/rardecode v1.1.0/go.mod h1:5DzqNKiOdpKKBH87u8VlvAnPZMXcGRhxWkRpHbbfGS0=
-github.com/pierrec/lz4/v4 v4.1.2 h1:qvY3YFXRQE/XB8MlLzJH7mSzBs74eA2gg52YTk6jUPM=
-github.com/pierrec/lz4/v4 v4.1.2/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
+github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
+github.com/klauspost/pgzip v1.2.6/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
+github.com/nwaples/rardecode v1.1.3 h1:cWCaZwfM5H7nAD6PyEdcVnczzV8i/JtotnyW/dD9lEc=
+github.com/nwaples/rardecode v1.1.3/go.mod h1:5DzqNKiOdpKKBH87u8VlvAnPZMXcGRhxWkRpHbbfGS0=
+github.com/pierrec/lz4/v4 v4.1.21 h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ=
+github.com/pierrec/lz4/v4 v4.1.21/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
-github.com/ulikunitz/xz v0.5.9 h1:RsKRIA2MO8x56wkkcd3LbtcE/uMszhb6DpRf+3uwa3I=
-github.com/ulikunitz/xz v0.5.9/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
+github.com/ulikunitz/xz v0.5.12 h1:37Nm15o69RwBkXM0J6A5OlE67RZTfzUxTj8fB3dfcsc=
+github.com/ulikunitz/xz v0.5.12/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 h1:nIPpBwaJSVYIxUFsDv3M8ofmx9yWTog9BfvIu0q41lo=
 github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8/go.mod h1:HUYIGzjTL3rfEspMxjDjgmT5uz5wzYJKVo23qUhYTos=
+github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
+github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

syft/pkg/cataloger/golang/test-fixtures/image-small/main.go

@@ -1,6 +1,6 @@
 package main
 
-import "github.com/mholt/archiver/v3"
+import "github.com/anchore/archiver/v3"
 
 func main() {
 

syft/pkg/cataloger/golang/test-fixtures/many-packages

@@ -11,7 +11,7 @@ require (
 	github.com/anchore/go-testutils v0.0.0-20200624184116-66aa578126db // github.com/bogus/package v10.10.10
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/stereoscope v0.0.0-20200706164556-7cf39d7f4639
-	github.com/mholt/archiver/v3 v3.5.1
+	github.com/anchore/archiver/v3 v3.5.1
 	//github.com/ignore/this v9.9.9  // indirect
 	github.com/bmatcuk/doublestar v1.3.1  // indirect
 	github.com/go-test/deep v1.0.6  // a comment
@@ -19,6 +19,6 @@ require (
 
 replace github.com/bmatcuk/doublestar => github.com/bmatcuk/doublestar v8.8.8
 
-replace github.com/mholt/archiver/v3 v3.5.1 => github.com/anchore/archiver/v3 v3.5.2
+replace github.com/anchore/archiver/v3 v3.5.1 => github.com/anchore/archiver/v3 v3.5.2
 
 exclude github.com/adrg/xdg v0.2.1

syft/pkg/cataloger/rust/cataloger.go

@@ -9,6 +9,8 @@ import (
 	"github.com/anchore/syft/syft/pkg/cataloger/generic"
 )
 
+const cargoAuditBinaryCatalogerName = "cargo-auditable-binary-cataloger"
+
 // NewCargoLockCataloger returns a new Rust Cargo lock file cataloger object.
 func NewCargoLockCataloger() pkg.Cataloger {
 	return generic.NewCataloger("rust-cargo-lock-cataloger").
@@ -18,6 +20,6 @@ func NewCargoLockCataloger() pkg.Cataloger {
 // NewAuditBinaryCataloger returns a new Rust auditable binary cataloger object that can detect dependencies
 // in binaries produced with https://github.com/Shnatsel/rust-audit
 func NewAuditBinaryCataloger() pkg.Cataloger {
-	return generic.NewCataloger("cargo-auditable-binary-cataloger").
+	return generic.NewCataloger(cargoAuditBinaryCatalogerName).
 		WithParserByMimeTypes(parseAuditBinary, mimetype.ExecutableMIMETypeSet.List()...)
 }

syft/pkg/cataloger/rust/cataloger_test.go

@@ -3,48 +3,270 @@ package rust
 import (
 	"testing"
 
+	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/internal/pkgtest"
 )
 
 func TestNewAuditBinaryCataloger(t *testing.T) {
+	locations := file.NewLocationSet(file.NewVirtualLocation("/usr/local/bin/hello_world", "/usr/local/bin/hello_world"))
+
+	argh := pkg.Package{
+		Name:      "argh",
+		Version:   "0.1.12",
+		PURL:      "pkg:cargo/argh@0.1.12",
+		FoundBy:   "cargo-auditable-binary-cataloger",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Metadata: pkg.RustBinaryAuditEntry{
+			Name:    "argh",
+			Version: "0.1.12",
+			Source:  "crates.io",
+		},
+	}
+
+	arghDerive := pkg.Package{
+		Name:      "argh_derive",
+		Version:   "0.1.12",
+		PURL:      "pkg:cargo/argh_derive@0.1.12",
+		FoundBy:   "cargo-auditable-binary-cataloger",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Metadata: pkg.RustBinaryAuditEntry{
+			Name:    "argh_derive",
+			Version: "0.1.12",
+			Source:  "crates.io",
+		},
+	}
+
+	arghShared := pkg.Package{
+		Name:      "argh_shared",
+		Version:   "0.1.12",
+		PURL:      "pkg:cargo/argh_shared@0.1.12",
+		FoundBy:   "cargo-auditable-binary-cataloger",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Metadata: pkg.RustBinaryAuditEntry{
+			Name:    "argh_shared",
+			Version: "0.1.12",
+			Source:  "crates.io",
+		},
+	}
+
+	helloWorld := pkg.Package{
+		Name:      "hello_world",
+		Version:   "0.1.0",
+		PURL:      "pkg:cargo/hello_world@0.1.0",
+		FoundBy:   "cargo-auditable-binary-cataloger",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Metadata: pkg.RustBinaryAuditEntry{
+			Name:    "hello_world",
+			Version: "0.1.0",
+			Source:  "local",
+		},
+	}
+
+	procMacro2 := pkg.Package{
+		Name:      "proc-macro2",
+		Version:   "1.0.92",
+		PURL:      "pkg:cargo/proc-macro2@1.0.92",
+		FoundBy:   "cargo-auditable-binary-cataloger",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Metadata: pkg.RustBinaryAuditEntry{
+			Name:    "proc-macro2",
+			Version: "1.0.92",
+			Source:  "crates.io",
+		},
+	}
+
+	quote := pkg.Package{
+		Name:      "quote",
+		Version:   "1.0.37",
+		PURL:      "pkg:cargo/quote@1.0.37",
+		FoundBy:   "cargo-auditable-binary-cataloger",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Metadata: pkg.RustBinaryAuditEntry{
+			Name:    "quote",
+			Version: "1.0.37",
+			Source:  "crates.io",
+		},
+	}
+
+	serde := pkg.Package{
+		Name:      "serde",
+		Version:   "1.0.215",
+		PURL:      "pkg:cargo/serde@1.0.215",
+		FoundBy:   "cargo-auditable-binary-cataloger",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Metadata: pkg.RustBinaryAuditEntry{
+			Name:    "serde",
+			Version: "1.0.215",
+			Source:  "crates.io",
+		},
+	}
+
+	serdeDerive := pkg.Package{
+		Name:      "serde_derive",
+		Version:   "1.0.215",
+		PURL:      "pkg:cargo/serde_derive@1.0.215",
+		FoundBy:   "cargo-auditable-binary-cataloger",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Metadata: pkg.RustBinaryAuditEntry{
+			Name:    "serde_derive",
+			Version: "1.0.215",
+			Source:  "crates.io",
+		},
+	}
+
+	syn := pkg.Package{
+		Name:      "syn",
+		Version:   "2.0.90",
+		PURL:      "pkg:cargo/syn@2.0.90",
+		FoundBy:   "cargo-auditable-binary-cataloger",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Metadata: pkg.RustBinaryAuditEntry{
+			Name:    "syn",
+			Version: "2.0.90",
+			Source:  "crates.io",
+		},
+	}
+
+	unicodeIdent := pkg.Package{
+		Name:      "unicode-ident",
+		Version:   "1.0.14",
+		PURL:      "pkg:cargo/unicode-ident@1.0.14",
+		FoundBy:   "cargo-auditable-binary-cataloger",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Metadata: pkg.RustBinaryAuditEntry{
+			Name:    "unicode-ident",
+			Version: "1.0.14",
+			Source:  "crates.io",
+		},
+	}
 
 	expectedPkgs := []pkg.Package{
+		argh,
+		arghDerive,
+		arghShared,
+		helloWorld,
+		procMacro2,
+		quote,
+		serde,
+		serdeDerive,
+		syn,
+		unicodeIdent,
+	}
+
+	expectedRelationships := []artifact.Relationship{
 		{
-			Name:      "auditable",
-			Version:   "0.1.0",
-			PURL:      "pkg:cargo/auditable@0.1.0",
-			FoundBy:   "cargo-auditable-binary-cataloger",
-			Locations: file.NewLocationSet(file.NewVirtualLocation("/hello-auditable", "/hello-auditable")),
-			Language:  pkg.Rust,
-			Type:      pkg.RustPkg,
-			Metadata: pkg.RustBinaryAuditEntry{
-				Name:    "auditable",
-				Version: "0.1.0",
-				Source:  "local",
-			},
+			From: argh,
+			To:   helloWorld,
+			Type: artifact.DependencyOfRelationship,
 		},
 		{
-			Name:      "hello-auditable",
-			Version:   "0.1.0",
-			PURL:      "pkg:cargo/hello-auditable@0.1.0",
-			FoundBy:   "cargo-auditable-binary-cataloger",
-			Locations: file.NewLocationSet(file.NewVirtualLocation("/hello-auditable", "/hello-auditable")),
-			Language:  pkg.Rust,
-			Type:      pkg.RustPkg,
-			Metadata: pkg.RustBinaryAuditEntry{
-				Name:    "hello-auditable",
-				Version: "0.1.0",
-				Source:  "local",
-			},
+			From: arghDerive,
+			To:   argh,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: arghShared,
+			To:   argh,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: arghShared,
+			To:   arghDerive,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: procMacro2,
+			To:   arghDerive,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: procMacro2,
+			To:   quote,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: procMacro2,
+			To:   serdeDerive,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: procMacro2,
+			To:   syn,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: quote,
+			To:   arghDerive,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: quote,
+			To:   serdeDerive,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: quote,
+			To:   syn,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: serde,
+			To:   arghShared,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: serdeDerive,
+			To:   serde,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: syn,
+			To:   arghDerive,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: syn,
+			To:   serdeDerive,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: unicodeIdent,
+			To:   procMacro2,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: unicodeIdent,
+			To:   syn,
+			Type: artifact.DependencyOfRelationship,
 		},
 	}
 
 	pkgtest.NewCatalogTester().
 		WithImageResolver(t, "image-audit").
 		IgnoreLocationLayer(). // this fixture can be rebuilt, thus the layer ID will change
-		Expects(expectedPkgs, nil).
+		Expects(expectedPkgs, expectedRelationships).
 		TestCataloger(t, NewAuditBinaryCataloger())
 }
 

syft/pkg/cataloger/rust/package.go

@@ -25,19 +25,6 @@ func newPackageFromCargoMetadata(m pkg.RustCargoLockEntry, locations ...file.Loc
 	return p
 }
 
-func newPackagesFromAudit(location file.Location, versionInfo rustaudit.VersionInfo) []pkg.Package {
-	var pkgs []pkg.Package
-
-	for _, dep := range versionInfo.Packages {
-		p := newPackageFromAudit(&dep, location.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation))
-		if pkg.IsValid(&p) && dep.Kind == rustaudit.Runtime {
-			pkgs = append(pkgs, p)
-		}
-	}
-
-	return pkgs
-}
-
 func newPackageFromAudit(dep *rustaudit.Package, locations ...file.Location) pkg.Package {
 	p := pkg.Package{
 		Name:      dep.Name,
@@ -46,6 +33,7 @@ func newPackageFromAudit(dep *rustaudit.Package, locations ...file.Location) pkg
 		Language:  pkg.Rust,
 		Type:      pkg.RustPkg,
 		Locations: file.NewLocationSet(locations...),
+		FoundBy:   cargoAuditBinaryCatalogerName,
 		Metadata: pkg.RustBinaryAuditEntry{
 			Name:    dep.Name,
 			Version: dep.Version,

syft/pkg/cataloger/rust/parse_audit_binary.go

@@ -5,9 +5,10 @@ import (
 	"errors"
 	"fmt"
 
-	rustaudit "github.com/microsoft/go-rustaudit"
+	"github.com/microsoft/go-rustaudit"
 
 	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/relationship"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/internal/unionreader"
@@ -18,6 +19,7 @@ import (
 // Catalog identifies executables then attempts to read Rust dependency information from them
 func parseAuditBinary(_ context.Context, _ file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
 	var pkgs []pkg.Package
+	var relationships []artifact.Relationship
 
 	unionReader, err := unionreader.GetUnionReader(reader.ReadCloser)
 	if err != nil {
@@ -26,10 +28,12 @@ func parseAuditBinary(_ context.Context, _ file.Resolver, _ *generic.Environment
 
 	infos, err := parseAuditBinaryEntry(unionReader, reader.RealPath)
 	for _, versionInfo := range infos {
-		pkgs = append(pkgs, newPackagesFromAudit(reader.Location, versionInfo)...)
+		auditPkgs, auditRelationships := processAuditVersionInfo(reader.Location, versionInfo)
+		pkgs = append(pkgs, auditPkgs...)
+		relationships = append(relationships, auditRelationships...)
 	}
 
-	return pkgs, nil, err
+	return pkgs, relationships, err
 }
 
 // scanFile scans file to try to report the Rust crate dependencies
@@ -61,3 +65,64 @@ func parseAuditBinaryEntry(reader unionreader.UnionReader, filename string) ([]r
 
 	return versionInfos, nil
 }
+
+// auditPkgPair is a helper struct to track the original index of the package in the original audit report + the syft package created for it
+type auditPkgPair struct {
+	pkg     *pkg.Package
+	rustPkg rustaudit.Package
+	index   int
+}
+
+func processAuditVersionInfo(location file.Location, versionInfo rustaudit.VersionInfo) ([]pkg.Package, []artifact.Relationship) {
+	var pkgs []pkg.Package
+
+	// first pass: create packages for all runtime dependencies (skip dev and invalid dependencies)
+	pairsByOgIndex := make(map[int]auditPkgPair)
+	for idx, dep := range versionInfo.Packages {
+		p := newPackageFromAudit(&dep, location.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation))
+		pair := auditPkgPair{
+			rustPkg: dep,
+			index:   idx,
+		}
+		if pkg.IsValid(&p) && dep.Kind == rustaudit.Runtime {
+			pkgs = append(pkgs, p)
+			pair.pkg = &pkgs[len(pkgs)-1]
+		}
+		pairsByOgIndex[idx] = pair
+	}
+
+	// second pass: create relationships between any packages created
+	// we have all the original audit package indices + info, but not all audit packages will have syft packages.
+	// we need to be careful to not create relationships for packages that were not created.
+	var rels []artifact.Relationship
+	for _, parentPair := range pairsByOgIndex {
+		// the rust-audit report lists dependencies by index from the original version info object. We need to find
+		// the syft packages created for each listed dependency from that original object.
+		for _, ogPkgIndex := range parentPair.rustPkg.Dependencies {
+			if ogPkgIndex >= uint(len(versionInfo.Packages)) {
+				log.WithFields("pkg", parentPair.pkg).Trace("cargo audit dependency index out of range: %d", ogPkgIndex)
+				continue
+			}
+			depPair, ok := pairsByOgIndex[int(ogPkgIndex)]
+			if !ok {
+				log.WithFields("pkg", parentPair.pkg).Trace("cargo audit dependency not found: %d", ogPkgIndex)
+				continue
+			}
+
+			if depPair.pkg == nil || parentPair.pkg == nil {
+				// skip relationships for syft packages that were not created from the original report (no matter the reason)
+				continue
+			}
+
+			rels = append(rels, artifact.Relationship{
+				From: *depPair.pkg,
+				To:   *parentPair.pkg,
+				Type: artifact.DependencyOfRelationship,
+			})
+		}
+	}
+
+	relationship.Sort(rels)
+
+	return pkgs, rels
+}

syft/pkg/cataloger/rust/parse_cargo_lock.go

@@ -3,14 +3,17 @@ package rust
 import (
 	"context"
 	"fmt"
+	"strings"
 
 	"github.com/pelletier/go-toml"
 
+	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/unknown"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/generic"
+	"github.com/anchore/syft/syft/pkg/cataloger/internal/dependency"
 )
 
 var _ generic.Parser = parseCargoLock
@@ -33,7 +36,6 @@ func parseCargoLock(_ context.Context, _ file.Resolver, _ *generic.Environment,
 	}
 
 	var pkgs []pkg.Package
-	pkgIndex := make(map[string]int)
 
 	for _, p := range m.Packages {
 		if p.Dependencies == nil {
@@ -47,36 +49,42 @@ func parseCargoLock(_ context.Context, _ file.Resolver, _ *generic.Environment,
 			pkgs,
 			newPkg,
 		)
-		newIx := len(pkgs) - 1
-		// Cargo.lock dependencies are strings that are the name of a package, if that
-		// is unambiguous, or a string like "name version" if the name alone is not
-		// ambiguous. Set both keys in the map, since we don't know which key is
-		// going to be used until we're trying to resolve dependencies. If the
-		// first key is overwritten, that means the package name was an ambiguous dependency
-		// and "name version" will be used as the key anyway.
-		keys := []string{
-			newPkg.Name,
-			fmt.Sprintf("%s %s", newPkg.Name, newPkg.Version),
-		}
-		for _, k := range keys {
-			pkgIndex[k] = newIx
-		}
-	}
-	var relationships []artifact.Relationship
-	for _, p := range pkgs {
-		meta := p.Metadata.(pkg.RustCargoLockEntry)
-		for _, d := range meta.Dependencies {
-			i, ok := pkgIndex[d]
-			if !ok {
-				continue
-			}
-			relationships = append(relationships, artifact.Relationship{
-				From: p,
-				To:   pkgs[i],
-				Type: artifact.DependencyOfRelationship,
-			})
-		}
 	}
 
-	return pkgs, relationships, unknown.IfEmptyf(pkgs, "unable to determine packages")
+	return pkgs, dependency.Resolve(dependencySpecification, pkgs), unknown.IfEmptyf(pkgs, "unable to determine packages")
+}
+
+func dependencySpecification(p pkg.Package) dependency.Specification {
+	rustMeta, ok := p.Metadata.(pkg.RustCargoLockEntry)
+	if !ok {
+		log.Tracef("cataloger failed to extract rust Cargo.lock metadata for package %+v", p.Name)
+		return dependency.Specification{}
+	}
+
+	// Cargo.lock dependencies are strings that are the name of a package, if that
+	// is unambiguous, or a string like "name version" if the name alone is not
+	// ambiguous, or strings like "name version (source)" if "name version" is ambiguous.
+	// Provide all the strings, since we don't know which string will be used.
+	// In other words, each package "provides" 3 entries, one for each name format,
+	// and each package "requires" whatever it actually requires based on the Cargo.lock.
+	provides := []string{
+		p.Name,
+		fmt.Sprintf("%s %s", p.Name, p.Version),
+	}
+
+	if rustMeta.Source != "" {
+		src := rustMeta.Source
+		if strings.HasPrefix(src, "git") && strings.Contains(src, "#") {
+			src = strings.Split(src, "#")[0]
+		}
+
+		provides = append(provides, fmt.Sprintf("%s %s (%s)", p.Name, p.Version, src))
+	}
+
+	return dependency.Specification{
+		ProvidesRequires: dependency.ProvidesRequires{
+			Provides: provides,
+			Requires: rustMeta.Dependencies,
+		},
+	}
 }

syft/pkg/cataloger/rust/parse_cargo_lock_test.go

@@ -3,6 +3,8 @@ package rust
 import (
 	"testing"
 
+	"github.com/stretchr/testify/assert"
+
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
@@ -279,43 +281,43 @@ func TestParseCargoLock(t *testing.T) {
 
 	expectedRelationships := []artifact.Relationship{
 		{
-			From: ansiTerm,
+			To:   ansiTerm,
+			From: winapi,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			To:   errno,
+			From: windowsSys52,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			To:   nom,
+			From: memchr,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			To:   nom,
+			From: versionCheck,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			To:   schannel,
+			From: windowsSys59,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			To:   unicodeBidi,
+			From: matches,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
 			To:   winapi,
+			From: winAPIi686PCWindowsGNU,
 			Type: artifact.DependencyOfRelationship,
 		},
 		{
-			From: errno,
-			To:   windowsSys52,
-			Type: artifact.DependencyOfRelationship,
-		},
-		{
-			From: nom,
-			To:   memchr,
-			Type: artifact.DependencyOfRelationship,
-		},
-		{
-			From: nom,
-			To:   versionCheck,
-			Type: artifact.DependencyOfRelationship,
-		},
-		{
-			From: schannel,
-			To:   windowsSys59,
-			Type: artifact.DependencyOfRelationship,
-		},
-		{
-			From: unicodeBidi,
-			To:   matches,
-			Type: artifact.DependencyOfRelationship,
-		},
-		{
-			From: winapi,
-			To:   winAPIi686PCWindowsGNU,
-			Type: artifact.DependencyOfRelationship,
-		},
-		{
-			From: winapi,
-			To:   winAPIx8664PCWindowsGNU,
+			To:   winapi,
+			From: winAPIx8664PCWindowsGNU,
 			Type: artifact.DependencyOfRelationship,
 		},
 	}
@@ -323,6 +325,513 @@ func TestParseCargoLock(t *testing.T) {
 	pkgtest.TestFileParser(t, fixture, parseCargoLock, expectedPkgs, expectedRelationships)
 }
 
+func TestCargoLockWithGitDependencies(t *testing.T) {
+	fixture := "test-fixtures/Cargo.lock-with-git-deps"
+	locations := file.NewLocationSet(file.NewLocation(fixture))
+
+	ahoCorasick := pkg.Package{
+		Name:      "aho-corasick",
+		Version:   "1.1.3",
+		PURL:      "pkg:cargo/aho-corasick@1.1.3",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Licenses:  pkg.NewLicenseSet(),
+		Metadata: pkg.RustCargoLockEntry{
+			Name:     "aho-corasick",
+			Version:  "1.1.3",
+			Source:   "registry+https://github.com/rust-lang/crates.io-index",
+			Checksum: "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916",
+			Dependencies: []string{
+				"memchr",
+			},
+		},
+	}
+
+	helloWorld := pkg.Package{
+		Name:      "hello_world",
+		Version:   "0.1.0",
+		PURL:      "pkg:cargo/hello_world@0.1.0",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Licenses:  pkg.NewLicenseSet(),
+		Metadata: pkg.RustCargoLockEntry{
+			Name:    "hello_world",
+			Version: "0.1.0",
+			Dependencies: []string{
+				"nom-regex",
+				"regex 1.11.1 (git+https://github.com/rust-lang/regex.git)",
+			},
+		},
+	}
+
+	memchr := pkg.Package{
+		Name:      "memchr",
+		Version:   "2.7.4",
+		PURL:      "pkg:cargo/memchr@2.7.4",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Licenses:  pkg.NewLicenseSet(),
+		Metadata: pkg.RustCargoLockEntry{
+			Name:         "memchr",
+			Version:      "2.7.4",
+			Source:       "registry+https://github.com/rust-lang/crates.io-index",
+			Checksum:     "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3",
+			Dependencies: []string{},
+		},
+	}
+
+	minimalLexical := pkg.Package{
+		Name:      "minimal-lexical",
+		Version:   "0.2.1",
+		PURL:      "pkg:cargo/minimal-lexical@0.2.1",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Licenses:  pkg.NewLicenseSet(),
+		Metadata: pkg.RustCargoLockEntry{
+			Name:         "minimal-lexical",
+			Version:      "0.2.1",
+			Source:       "registry+https://github.com/rust-lang/crates.io-index",
+			Checksum:     "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a",
+			Dependencies: []string{},
+		},
+	}
+
+	nom := pkg.Package{
+		Name:      "nom",
+		Version:   "7.1.3",
+		PURL:      "pkg:cargo/nom@7.1.3",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Licenses:  pkg.NewLicenseSet(),
+		Metadata: pkg.RustCargoLockEntry{
+			Name:     "nom",
+			Version:  "7.1.3",
+			Source:   "registry+https://github.com/rust-lang/crates.io-index",
+			Checksum: "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a",
+			Dependencies: []string{
+				"memchr",
+				"minimal-lexical",
+			},
+		},
+	}
+
+	nomRegex := pkg.Package{
+		Name:      "nom-regex",
+		Version:   "0.2.0",
+		PURL:      "pkg:cargo/nom-regex@0.2.0",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Licenses:  pkg.NewLicenseSet(),
+		Metadata: pkg.RustCargoLockEntry{
+			Name:     "nom-regex",
+			Version:  "0.2.0",
+			Source:   "registry+https://github.com/rust-lang/crates.io-index",
+			Checksum: "72e5c7731c4c1370b61604ed52a2475e861aac9e08dec9f23903d4ddfdc91c18",
+			Dependencies: []string{
+				"nom",
+				"regex 1.11.1 (registry+https://github.com/rust-lang/crates.io-index)",
+			},
+		},
+	}
+
+	regexCrates := pkg.Package{
+		Name:      "regex",
+		Version:   "1.11.1",
+		PURL:      "pkg:cargo/regex@1.11.1",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Licenses:  pkg.NewLicenseSet(),
+		Metadata: pkg.RustCargoLockEntry{
+			Name:     "regex",
+			Version:  "1.11.1",
+			Source:   "registry+https://github.com/rust-lang/crates.io-index",
+			Checksum: "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191",
+			Dependencies: []string{
+				"aho-corasick",
+				"memchr",
+				"regex-automata 0.4.9 (registry+https://github.com/rust-lang/crates.io-index)",
+				"regex-syntax 0.8.5 (registry+https://github.com/rust-lang/crates.io-index)",
+			},
+		},
+	}
+
+	regexGit := pkg.Package{
+		Name:      "regex",
+		Version:   "1.11.1",
+		PURL:      "pkg:cargo/regex@1.11.1",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Licenses:  pkg.NewLicenseSet(),
+		Metadata: pkg.RustCargoLockEntry{
+			Name:    "regex",
+			Version: "1.11.1",
+			Source:  "git+https://github.com/rust-lang/regex.git#1a069b9232c607b34c4937122361aa075ef573fa",
+			Dependencies: []string{
+				"aho-corasick",
+				"memchr",
+				"regex-automata 0.4.9 (git+https://github.com/rust-lang/regex.git)",
+				"regex-syntax 0.8.5 (git+https://github.com/rust-lang/regex.git)",
+			},
+		},
+	}
+
+	regexAutomataCrates := pkg.Package{
+		Name:      "regex-automata",
+		Version:   "0.4.9",
+		PURL:      "pkg:cargo/regex-automata@0.4.9",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Licenses:  pkg.NewLicenseSet(),
+		Metadata: pkg.RustCargoLockEntry{
+			Name:     "regex-automata",
+			Version:  "0.4.9",
+			Source:   "registry+https://github.com/rust-lang/crates.io-index",
+			Checksum: "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908",
+			Dependencies: []string{
+				"aho-corasick",
+				"memchr",
+				"regex-syntax 0.8.5 (registry+https://github.com/rust-lang/crates.io-index)",
+			},
+		},
+	}
+
+	regexAutomataGit := pkg.Package{
+		Name:      "regex-automata",
+		Version:   "0.4.9",
+		PURL:      "pkg:cargo/regex-automata@0.4.9",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Licenses:  pkg.NewLicenseSet(),
+		Metadata: pkg.RustCargoLockEntry{
+			Name:    "regex-automata",
+			Version: "0.4.9",
+			Source:  "git+https://github.com/rust-lang/regex.git#1a069b9232c607b34c4937122361aa075ef573fa",
+			Dependencies: []string{
+				"aho-corasick",
+				"memchr",
+				"regex-syntax 0.8.5 (git+https://github.com/rust-lang/regex.git)",
+			},
+		},
+	}
+
+	regexSyntaxCrates := pkg.Package{
+		Name:      "regex-syntax",
+		Version:   "0.8.5",
+		PURL:      "pkg:cargo/regex-syntax@0.8.5",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Licenses:  pkg.NewLicenseSet(),
+		Metadata: pkg.RustCargoLockEntry{
+			Name:         "regex-syntax",
+			Version:      "0.8.5",
+			Source:       "registry+https://github.com/rust-lang/crates.io-index",
+			Checksum:     "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c",
+			Dependencies: []string{},
+		},
+	}
+
+	regexSyntaxGit := pkg.Package{
+		Name:      "regex-syntax",
+		Version:   "0.8.5",
+		PURL:      "pkg:cargo/regex-syntax@0.8.5",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Licenses:  pkg.NewLicenseSet(),
+		Metadata: pkg.RustCargoLockEntry{
+			Name:         "regex-syntax",
+			Version:      "0.8.5",
+			Source:       "git+https://github.com/rust-lang/regex.git#1a069b9232c607b34c4937122361aa075ef573fa",
+			Dependencies: []string{},
+		},
+	}
+
+	expectedPkgs := []pkg.Package{
+		ahoCorasick, helloWorld, memchr, minimalLexical, nom, nomRegex, regexCrates, regexGit,
+		regexAutomataCrates, regexAutomataGit, regexSyntaxCrates, regexSyntaxGit,
+	}
+	expectedRelationships := []artifact.Relationship{
+		{
+			From: memchr,
+			To:   ahoCorasick,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: nomRegex,
+			To:   helloWorld,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: regexGit,
+			To:   helloWorld,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: memchr,
+			To:   nom,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: minimalLexical,
+			To:   nom,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: nom,
+			To:   nomRegex,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: regexCrates,
+			To:   nomRegex,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: ahoCorasick,
+			To:   regexCrates,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: memchr,
+			To:   regexCrates,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: regexAutomataCrates,
+			To:   regexCrates,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: regexSyntaxCrates,
+			To:   regexCrates,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: regexSyntaxCrates,
+			To:   regexAutomataCrates,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: ahoCorasick,
+			To:   regexGit,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: memchr,
+			To:   regexGit,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: regexAutomataGit,
+			To:   regexGit,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: regexSyntaxGit,
+			To:   regexAutomataGit,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: regexSyntaxGit,
+			To:   regexGit,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: ahoCorasick,
+			To:   regexAutomataCrates,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: memchr,
+			To:   regexAutomataCrates,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: ahoCorasick,
+			To:   regexAutomataGit,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: memchr,
+			To:   regexAutomataGit,
+			Type: artifact.DependencyOfRelationship,
+		},
+	}
+	// what I know so far - it's not sorting, it's not
+
+	pkgtest.TestFileParser(t, fixture, parseCargoLock, expectedPkgs, expectedRelationships)
+}
+
+func TestCargoLockDependencySpecification(t *testing.T) {
+	tests := []struct {
+		name     string
+		p        pkg.Package
+		provides []string
+		requires []string
+	}{
+		{
+			name: "requires git source",
+			p: pkg.Package{
+				Name:      "hello_world",
+				Version:   "0.1.0",
+				PURL:      "pkg:cargo/hello_world@0.1.0",
+				Locations: file.NewLocationSet(),
+				Language:  pkg.Rust,
+				Type:      pkg.RustPkg,
+				Licenses:  pkg.NewLicenseSet(),
+				Metadata: pkg.RustCargoLockEntry{
+					Name:    "hello_world",
+					Version: "0.1.0",
+					Dependencies: []string{
+						"nom-regex",
+						"regex 1.11.1 (git+https://github.com/rust-lang/regex.git)",
+					},
+				},
+			},
+			provides: []string{
+				"hello_world",
+				"hello_world 0.1.0",
+			},
+			requires: []string{
+				"nom-regex",
+				"regex 1.11.1 (git+https://github.com/rust-lang/regex.git)",
+			},
+		},
+		{
+			name: "provides git source",
+			p: pkg.Package{
+				Name:      "regex-automata",
+				Version:   "0.4.9",
+				PURL:      "pkg:cargo/regex-automata@0.4.9",
+				Locations: file.NewLocationSet(),
+				Language:  pkg.Rust,
+				Type:      pkg.RustPkg,
+				Licenses:  pkg.NewLicenseSet(),
+				Metadata: pkg.RustCargoLockEntry{
+					Name:    "regex-automata",
+					Version: "0.4.9",
+					Source:  "git+https://github.com/rust-lang/regex.git#1a069b9232c607b34c4937122361aa075ef573fa",
+					Dependencies: []string{
+						"aho-corasick",
+						"memchr",
+						"regex-syntax 0.8.5 (git+https://github.com/rust-lang/regex.git)",
+					},
+				},
+			},
+			provides: []string{
+				"regex-automata",
+				"regex-automata 0.4.9",
+				"regex-automata 0.4.9 (git+https://github.com/rust-lang/regex.git)",
+			},
+			requires: []string{
+				"aho-corasick",
+				"memchr",
+				"regex-syntax 0.8.5 (git+https://github.com/rust-lang/regex.git)",
+			},
+		},
+		{
+			name: "regex-automata git",
+			p: pkg.Package{
+				Name:      "regex-automata",
+				Version:   "0.4.9",
+				PURL:      "pkg:cargo/regex-automata@0.4.9",
+				Locations: file.NewLocationSet(),
+				Language:  pkg.Rust,
+				Type:      pkg.RustPkg,
+				Licenses:  pkg.NewLicenseSet(),
+				Metadata: pkg.RustCargoLockEntry{
+					Name:    "regex-automata",
+					Version: "0.4.9",
+					Source:  "git+https://github.com/rust-lang/regex.git#1a069b9232c607b34c4937122361aa075ef573fa",
+					Dependencies: []string{
+						"aho-corasick",
+						"memchr",
+						"regex-syntax 0.8.5 (git+https://github.com/rust-lang/regex.git)",
+					},
+				},
+			},
+			provides: []string{
+				"regex-automata",
+				"regex-automata 0.4.9",
+				"regex-automata 0.4.9 (git+https://github.com/rust-lang/regex.git)",
+			},
+			requires: []string{
+				"aho-corasick",
+				"memchr",
+				"regex-syntax 0.8.5 (git+https://github.com/rust-lang/regex.git)",
+			},
+		},
+		{
+			name: "regex-syntax git",
+			p: pkg.Package{
+				Name:      "regex-syntax",
+				Version:   "0.8.5",
+				PURL:      "pkg:cargo/regex-syntax@0.8.5",
+				Locations: file.NewLocationSet(),
+				Language:  pkg.Rust,
+				Type:      pkg.RustPkg,
+				Licenses:  pkg.NewLicenseSet(),
+				Metadata: pkg.RustCargoLockEntry{
+					Name:         "regex-syntax",
+					Version:      "0.8.5",
+					Source:       "git+https://github.com/rust-lang/regex.git#1a069b9232c607b34c4937122361aa075ef573fa",
+					Dependencies: []string{},
+				},
+			},
+			provides: []string{
+				"regex-syntax",
+				"regex-syntax 0.8.5",
+				"regex-syntax 0.8.5 (git+https://github.com/rust-lang/regex.git)",
+			},
+			requires: []string{},
+		},
+		{
+			name: "regex-syntax crates",
+			p: pkg.Package{
+				Name:      "regex-syntax",
+				Version:   "0.8.5",
+				PURL:      "pkg:cargo/regex-syntax@0.8.5",
+				Locations: file.NewLocationSet(),
+				Language:  pkg.Rust,
+				Type:      pkg.RustPkg,
+				Licenses:  pkg.NewLicenseSet(),
+				Metadata: pkg.RustCargoLockEntry{
+					Name:         "regex-syntax",
+					Version:      "0.8.5",
+					Source:       "registry+https://github.com/rust-lang/crates.io-index",
+					Checksum:     "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c",
+					Dependencies: []string{},
+				},
+			},
+			provides: []string{
+				"regex-syntax",
+				"regex-syntax 0.8.5",
+				"regex-syntax 0.8.5 (registry+https://github.com/rust-lang/crates.io-index)",
+			},
+			requires: []string{},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			spec := dependencySpecification(test.p)
+			assert.Equal(t, test.provides, spec.Provides)
+			assert.Equal(t, test.requires, spec.Requires)
+		})
+	}
+}
+
 func Test_corruptCargoLock(t *testing.T) {
 	pkgtest.NewCatalogTester().
 		FromFile(t, "test-fixtures/glob-paths/src/Cargo.lock").

syft/pkg/cataloger/rust/test-fixtures/Cargo.lock-with-git-deps

@@ -0,0 +1,107 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "hello_world"
+version = "0.1.0"
+dependencies = [
+ "nom-regex",
+ "regex 1.11.1 (git+https://github.com/rust-lang/regex.git)",
+]
+
+[[package]]
+name = "memchr"
+version = "2.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "nom-regex"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72e5c7731c4c1370b61604ed52a2475e861aac9e08dec9f23903d4ddfdc91c18"
+dependencies = [
+ "nom",
+ "regex 1.11.1 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "regex"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata 0.4.9 (registry+https://github.com/rust-lang/crates.io-index)",
+ "regex-syntax 0.8.5 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "regex"
+version = "1.11.1"
+source = "git+https://github.com/rust-lang/regex.git#1a069b9232c607b34c4937122361aa075ef573fa"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata 0.4.9 (git+https://github.com/rust-lang/regex.git)",
+ "regex-syntax 0.8.5 (git+https://github.com/rust-lang/regex.git)",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax 0.8.5 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.9"
+source = "git+https://github.com/rust-lang/regex.git#1a069b9232c607b34c4937122361aa075ef573fa"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax 0.8.5 (git+https://github.com/rust-lang/regex.git)",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.5"
+source = "git+https://github.com/rust-lang/regex.git#1a069b9232c607b34c4937122361aa075ef573fa"

syft/pkg/cataloger/rust/test-fixtures/image-audit/Cargo.lock

@@ -0,0 +1,96 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "argh"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7af5ba06967ff7214ce4c7419c7d185be7ecd6cc4965a8f6e1d8ce0398aad219"
+dependencies = [
+    "argh_derive",
+    "argh_shared",
+]
+
+[[package]]
+name = "argh_derive"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56df0aeedf6b7a2fc67d06db35b09684c3e8da0c95f8f27685cb17e08413d87a"
+dependencies = [
+    "argh_shared",
+    "proc-macro2",
+    "quote",
+    "syn",
+]
+
+[[package]]
+name = "argh_shared"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5693f39141bda5760ecc4111ab08da40565d1771038c4a0250f03457ec707531"
+dependencies = [
+    "serde",
+]
+
+[[package]]
+name = "hello_world"
+version = "0.1.0"
+dependencies = [
+    "argh",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37d3544b3f2748c54e147655edb5025752e2303145b5aefb3c3ea2c78b973bb0"
+dependencies = [
+    "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5b9d34b8991d19d98081b46eacdd8eb58c6f2b201139f7c5f643cc155a633af"
+dependencies = [
+    "proc-macro2",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.215"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6513c1ad0b11a9376da888e3e0baa0077f1aed55c17f50e7b2397136129fb88f"
+dependencies = [
+    "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.215"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad1e866f866923f252f05c889987993144fb74e722403468a4ebd70c3cd756c0"
+dependencies = [
+    "proc-macro2",
+    "quote",
+    "syn",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.90"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "919d3b74a5dd0ccd15aeb8f93e7006bd9e14c295087c9896a110f490752bcf31"
+dependencies = [
+    "proc-macro2",
+    "quote",
+    "unicode-ident",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "adb9e6ca4f869e1180728b7950e35922a7fc6397f7b641499e8f3ef06e50dc83"

syft/pkg/cataloger/rust/test-fixtures/image-audit/Cargo.toml

@@ -0,0 +1,7 @@
+[package]
+name = "hello_world"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+argh = "0.1"

syft/pkg/cataloger/rust/test-fixtures/image-audit/Dockerfile

@@ -1 +1,14 @@
-FROM docker.io/tofay/hello-rust-auditable:latest@sha256:1d35d1e007180b3f7500aae5e27560697909132ca9a6d480c4c825534c1c47a9
+FROM rust:1.74.0 AS builder
+
+WORKDIR /app
+
+RUN cargo install cargo-auditable --locked
+COPY Cargo.toml Cargo.lock ./
+COPY src ./src
+RUN cargo fetch
+RUN cargo auditable build --release
+
+FROM scratch
+
+COPY --from=builder /app/target/release/hello_world /usr/local/bin/hello_world
+

syft/pkg/cataloger/rust/test-fixtures/image-audit/src/main.rs

@@ -0,0 +1,13 @@
+use argh::FromArgs;
+
+#[derive(FromArgs)]
+#[argh(description = "A simple Hello World CLI application.")]
+struct Args {
+    #[argh(option, description = "name to greet")]
+    name: String,
+}
+
+fn main() {
+    let args: Args = argh::from_env();
+    println!("Hello, {}!", args.name);
+}

syft/pkg/license.go

@@ -2,7 +2,9 @@ package pkg
 
 import (
 	"fmt"
+	"net/url"
 	"sort"
+	"strings"
 
 	"github.com/scylladb/go-set/strset"
 
@@ -112,7 +114,12 @@ func NewLicenseFromURLs(value string, urls ...string) License {
 	s := strset.New()
 	for _, url := range urls {
 		if url != "" {
-			s.Add(url)
+			sanitizedURL, err := stripUnwantedCharacters(url)
+			if err != nil {
+				log.Tracef("unable to sanitize url=%q: %s", url, err)
+				continue
+			}
+			s.Add(sanitizedURL)
 		}
 	}
 
@@ -122,13 +129,28 @@ func NewLicenseFromURLs(value string, urls ...string) License {
 	return l
 }
 
+func stripUnwantedCharacters(rawURL string) (string, error) {
+	cleanedURL := strings.TrimSpace(rawURL)
+	_, err := url.ParseRequestURI(cleanedURL)
+	if err != nil {
+		return "", fmt.Errorf("invalid URL: %w", err)
+	}
+
+	return cleanedURL, nil
+}
+
 func NewLicenseFromFields(value, url string, location *file.Location) License {
 	l := NewLicense(value)
 	if location != nil {
 		l.Locations.Add(*location)
 	}
 	if url != "" {
-		l.URLs = append(l.URLs, url)
+		sanitizedURL, err := stripUnwantedCharacters(url)
+		if err != nil {
+			log.Tracef("unable to sanitize url=%q: %s", url, err)
+		} else {
+			l.URLs = append(l.URLs, sanitizedURL)
+		}
 	}
 
 	return l

syft/pkg/license_test.go

@@ -226,3 +226,39 @@ func TestLicense_Merge(t *testing.T) {
 		})
 	}
 }
+
+func TestLicenseConstructors(t *testing.T) {
+	type input struct {
+		value string
+		urls  []string
+	}
+	tests := []struct {
+		name     string
+		input    input
+		expected License
+	}{
+		{
+			name: "License URLs are stripped of newlines and tabs",
+			input: input{
+				value: "New BSD License",
+				urls: []string{
+					`
+						http://user-agent-utils.googlecode.com/svn/trunk/UserAgentUtils/LICENSE.txt
+									
+					`},
+			},
+			expected: License{
+				Value: "New BSD License",
+				Type:  license.Declared,
+				URLs:  []string{"http://user-agent-utils.googlecode.com/svn/trunk/UserAgentUtils/LICENSE.txt"},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			got := NewLicenseFromURLs(test.input.value, test.input.urls...)
+			assert.Equal(t, test.expected, got)
+		})
+	}
+}

syft/source/filesource/file_source.go

@@ -3,15 +3,14 @@ package filesource
 import (
 	"crypto"
 	"fmt"
-	"io/fs"
 	"os"
 	"path"
 	"path/filepath"
 	"sync"
 
-	"github.com/mholt/archiver/v3"
 	"github.com/opencontainers/go-digest"
 
+	"github.com/anchore/archiver/v3"
 	stereoFile "github.com/anchore/stereoscope/pkg/file"
 	intFile "github.com/anchore/syft/internal/file"
 	"github.com/anchore/syft/internal/log"
@@ -36,7 +35,7 @@ type fileSource struct {
 	id               artifact.ID
 	digestForVersion string
 	config           Config
-	resolver         *fileresolver.Directory
+	resolver         file.Resolver
 	mutex            *sync.Mutex
 	closer           func() error
 	digests          []file.Digest
@@ -165,48 +164,22 @@ func (s fileSource) FileResolver(_ source.Scope) (file.Resolver, error) {
 		return nil, err
 	}
 
-	var res *fileresolver.Directory
 	if isArchiveAnalysis {
 		// this is an analysis of an archive file... we should scan the directory where the archive contents
-		res, err = fileresolver.NewFromDirectory(s.analysisPath, "", exclusionFunctions...)
-		if err != nil {
-			return nil, fmt.Errorf("unable to create directory resolver: %w", err)
-		}
-	} else {
-		// this is an analysis of a single file. We want to ultimately scan the directory that the file is in, but we
-		// don't want to include any other files except this the given file.
-		exclusionFunctions = append([]fileresolver.PathIndexVisitor{
-
-			// note: we should exclude these kinds of paths first before considering any other user-provided exclusions
-			func(_, p string, _ os.FileInfo, _ error) error {
-				if p == absParentDir {
-					// this is the root directory... always include it
-					return nil
-				}
-
-				if filepath.Dir(p) != absParentDir {
-					// we are no longer in the root directory containing the single file we want to scan...
-					// we should skip the directory this path resides in entirely!
-					return fs.SkipDir
-				}
-
-				if filepath.Base(p) != filepath.Base(s.config.Path) {
-					// we're in the root directory, but this is not the file we want to scan...
-					// we should selectively skip this file (not the directory we're in).
-					return fileresolver.ErrSkipPath
-				}
-				return nil
-			},
-		}, exclusionFunctions...)
-
-		res, err = fileresolver.NewFromDirectory(absParentDir, absParentDir, exclusionFunctions...)
+		res, err := fileresolver.NewFromDirectory(s.analysisPath, "", exclusionFunctions...)
 		if err != nil {
 			return nil, fmt.Errorf("unable to create directory resolver: %w", err)
 		}
+		s.resolver = res
+		return s.resolver, nil
 	}
 
+	// This is analysis of a single file. Use file indexer.
+	res, err := fileresolver.NewFromFile(absParentDir, s.analysisPath, exclusionFunctions...)
+	if err != nil {
+		return nil, fmt.Errorf("unable to create file resolver: %w", err)
+	}
 	s.resolver = res
-
 	return s.resolver, nil
 }
 

test/cli/spdx_tooling_validation_test.go

@@ -50,6 +50,18 @@ func TestSpdxValidationTooling(t *testing.T) {
 			images:   images,
 			env:      env,
 		},
+		{
+			name:     "spdx validation tooling tag value",
+			syftArgs: []string{"scan", "-o", "spdx@2.2"},
+			images:   images,
+			env:      env,
+		},
+		{
+			name:     "spdx validation tooling json",
+			syftArgs: []string{"scan", "-o", "spdx-json@2.2"},
+			images:   images,
+			env:      env,
+		},
 	}
 
 	for _, test := range tests {