update to point at new script for new release (#551)

* update to point at local script release

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

.github/scripts/goreleaser-install.sh

@@ -0,0 +1,405 @@
+#!/bin/sh
+set -e
+# Code generated by godownloader on 2019-12-25T12:47:14Z. DO NOT EDIT.
+#
+
+usage() {
+	this=$1
+	cat <<EOF
+$this: download go binaries for goreleaser/goreleaser
+
+Usage: $this [-b] bindir [-d] [tag]
+  -b sets bindir or installation directory, Defaults to ./bin
+  -d turns on debug logging
+   [tag] is a tag from
+   https://github.com/goreleaser/goreleaser/releases
+   If tag is missing, then the latest will be used.
+
+ Generated by godownloader
+  https://github.com/goreleaser/godownloader
+
+EOF
+	exit 2
+}
+
+parse_args() {
+	#BINDIR is ./bin unless set be ENV
+	# over-ridden by flag below
+
+	BINDIR=${BINDIR:-./bin}
+	while getopts "b:dh?x" arg; do
+		case "$arg" in
+		b) BINDIR="$OPTARG" ;;
+		d) log_set_priority 10 ;;
+		h | \?) usage "$0" ;;
+		x) set -x ;;
+		esac
+	done
+	shift $((OPTIND - 1))
+	TAG=$1
+}
+# this function wraps all the destructive operations
+# if a curl|bash cuts off the end of the script due to
+# network, either nothing will happen or will syntax error
+# out preventing half-done work
+execute() {
+	tmpdir=$(mktemp -d)
+	log_debug "downloading files into ${tmpdir}"
+	http_download "${tmpdir}/${TARBALL}" "${TARBALL_URL}"
+	http_download "${tmpdir}/${CHECKSUM}" "${CHECKSUM_URL}"
+	hash_sha256_verify "${tmpdir}/${TARBALL}" "${tmpdir}/${CHECKSUM}"
+	srcdir="${tmpdir}"
+	(cd "${tmpdir}" && untar "${TARBALL}")
+	test ! -d "${BINDIR}" && install -d "${BINDIR}"
+	for binexe in $BINARIES; do
+		if [ "$OS" = "windows" ]; then
+			binexe="${binexe}.exe"
+		fi
+		install "${srcdir}/${binexe}" "${BINDIR}/"
+		log_info "installed ${BINDIR}/${binexe}"
+	done
+	rm -rf "${tmpdir}"
+}
+get_binaries() {
+	case "$PLATFORM" in
+	darwin/all) BINARIES="goreleaser" ;;
+	darwin/386) BINARIES="goreleaser" ;;
+	darwin/amd64) BINARIES="goreleaser" ;;
+	darwin/arm64) BINARIES="goreleaser" ;;
+	darwin/armv6) BINARIES="goreleaser" ;;
+	linux/386) BINARIES="goreleaser" ;;
+	linux/amd64) BINARIES="goreleaser" ;;
+	linux/arm64) BINARIES="goreleaser" ;;
+	linux/armv6) BINARIES="goreleaser" ;;
+	windows/386) BINARIES="goreleaser" ;;
+	windows/amd64) BINARIES="goreleaser" ;;
+	windows/arm64) BINARIES="goreleaser" ;;
+	windows/armv6) BINARIES="goreleaser" ;;
+	*)
+		log_crit "platform $PLATFORM is not supported.  Make sure this script is up-to-date and file request at https://github.com/${PREFIX}/issues/new"
+		exit 1
+		;;
+	esac
+}
+tag_to_version() {
+	if [ -z "${TAG}" ]; then
+		log_info "checking GitHub for latest tag"
+	else
+		log_info "checking GitHub for tag '${TAG}'"
+	fi
+	REALTAG=$(github_release "$OWNER/$REPO" "${TAG}") && true
+	if test -z "$REALTAG"; then
+		log_crit "unable to find '${TAG}' - use 'latest' or see https://github.com/${PREFIX}/releases for details"
+		exit 1
+	fi
+	# if version starts with 'v', remove it
+	TAG="$REALTAG"
+	VERSION=${TAG#v}
+}
+adjust_format() {
+	# change format (tar.gz or zip) based on OS
+	case ${OS} in
+	windows) FORMAT=zip ;;
+	esac
+	true
+}
+adjust_os() {
+	# adjust archive name based on OS
+	case ${OS} in
+	386) OS=i386 ;;
+	amd64) OS=x86_64 ;;
+	darwin) OS=Darwin ;;
+	linux) OS=Linux ;;
+	windows) OS=Windows ;;
+	esac
+	true
+}
+adjust_arch() {
+	# adjust archive name based on ARCH
+	case ${ARCH} in
+	386) ARCH=i386 ;;
+	amd64) ARCH=x86_64 ;;
+	darwin) ARCH=Darwin ;;
+	linux) ARCH=Linux ;;
+	windows) ARCH=Windows ;;
+	esac
+	true
+}
+
+cat /dev/null <<EOF
+------------------------------------------------------------------------
+https://github.com/client9/shlib - portable posix shell functions
+Public domain - http://unlicense.org
+https://github.com/client9/shlib/blob/master/LICENSE.md
+but credit (and pull requests) appreciated.
+------------------------------------------------------------------------
+EOF
+is_command() {
+	command -v "$1" >/dev/null
+}
+echoerr() {
+	echo "$@" 1>&2
+}
+log_prefix() {
+	echo "$0"
+}
+_logp=6
+log_set_priority() {
+	_logp="$1"
+}
+log_priority() {
+	if test -z "$1"; then
+		echo "$_logp"
+		return
+	fi
+	[ "$1" -le "$_logp" ]
+}
+log_tag() {
+	case $1 in
+	0) echo "emerg" ;;
+	1) echo "alert" ;;
+	2) echo "crit" ;;
+	3) echo "err" ;;
+	4) echo "warning" ;;
+	5) echo "notice" ;;
+	6) echo "info" ;;
+	7) echo "debug" ;;
+	*) echo "$1" ;;
+	esac
+}
+log_debug() {
+	log_priority 7 || return 0
+	echoerr "$(log_prefix)" "$(log_tag 7)" "$@"
+}
+log_info() {
+	log_priority 6 || return 0
+	echoerr "$(log_prefix)" "$(log_tag 6)" "$@"
+}
+log_err() {
+	log_priority 3 || return 0
+	echoerr "$(log_prefix)" "$(log_tag 3)" "$@"
+}
+log_crit() {
+	log_priority 2 || return 0
+	echoerr "$(log_prefix)" "$(log_tag 2)" "$@"
+}
+uname_os() {
+	os=$(uname -s | tr '[:upper:]' '[:lower:]')
+	case "$os" in
+	cygwin_nt*) os="windows" ;;
+	mingw*) os="windows" ;;
+	msys_nt*) os="windows" ;;
+	esac
+	echo "$os"
+}
+uname_arch() {
+	arch=$(uname -m)
+	case $arch in
+	x86_64) arch="amd64" ;;
+	x86) arch="386" ;;
+	i686) arch="386" ;;
+	i386) arch="386" ;;
+	aarch64) arch="arm64" ;;
+	armv5*) arch="armv5" ;;
+	armv6*) arch="armv6" ;;
+	armv7*) arch="armv7" ;;
+	esac
+	os=$(uname_os)
+	case "$os" in
+	darwin) arch="all" ;;
+	esac
+	echo ${arch}
+}
+uname_os_check() {
+	os=$(uname_os)
+	case "$os" in
+	darwin) return 0 ;;
+	dragonfly) return 0 ;;
+	freebsd) return 0 ;;
+	linux) return 0 ;;
+	android) return 0 ;;
+	nacl) return 0 ;;
+	netbsd) return 0 ;;
+	openbsd) return 0 ;;
+	plan9) return 0 ;;
+	solaris) return 0 ;;
+	windows) return 0 ;;
+	all) return 0 ;;
+	esac
+	log_crit "uname_os_check '$(uname -s)' got converted to '$os' which is not a GOOS value. Please file bug at https://github.com/client9/shlib"
+	return 1
+}
+uname_arch_check() {
+	arch=$(uname_arch)
+	case "$arch" in
+	386) return 0 ;;
+	all) return 0 ;;
+	amd64) return 0 ;;
+	arm64) return 0 ;;
+	armv5) return 0 ;;
+	armv6) return 0 ;;
+	armv7) return 0 ;;
+	ppc64) return 0 ;;
+	ppc64le) return 0 ;;
+	mips) return 0 ;;
+	mipsle) return 0 ;;
+	mips64) return 0 ;;
+	mips64le) return 0 ;;
+	s390x) return 0 ;;
+	amd64p32) return 0 ;;
+	esac
+	log_crit "uname_arch_check '$(uname -m)' got converted to '$arch' which is not a GOARCH value.  Please file bug report at https://github.com/client9/shlib"
+	return 1
+}
+untar() {
+	tarball=$1
+	case "${tarball}" in
+	*.tar.gz | *.tgz) tar --no-same-owner -xzf "${tarball}" ;;
+	*.tar) tar --no-same-owner -xf "${tarball}" ;;
+	*.zip) unzip "${tarball}" ;;
+	*)
+		log_err "untar unknown archive format for ${tarball}"
+		return 1
+		;;
+	esac
+}
+http_download_curl() {
+	local_file=$1
+	source_url=$2
+	header=$3
+	if [ -z "$header" ]; then
+		code=$(curl -w '%{http_code}' -sL -o "$local_file" "$source_url")
+	else
+		code=$(curl -w '%{http_code}' -sL -H "$header" -o "$local_file" "$source_url")
+	fi
+	if [ "$code" != "200" ]; then
+		log_debug "http_download_curl received HTTP status $code"
+		return 1
+	fi
+	return 0
+}
+http_download_wget() {
+	local_file=$1
+	source_url=$2
+	header=$3
+	if [ -z "$header" ]; then
+		wget -q -O "$local_file" "$source_url"
+	else
+		wget -q --header "$header" -O "$local_file" "$source_url"
+	fi
+}
+http_download() {
+	log_debug "http_download $2"
+	if is_command curl; then
+		http_download_curl "$@"
+		return
+	elif is_command wget; then
+		http_download_wget "$@"
+		return
+	fi
+	log_crit "http_download unable to find wget or curl"
+	return 1
+}
+http_copy() {
+	tmp=$(mktemp)
+	http_download "${tmp}" "$1" "$2" || return 1
+	body=$(cat "$tmp")
+	rm -f "${tmp}"
+	echo "$body"
+}
+github_release() {
+	owner_repo=$1
+	version=$2
+	test -z "$version" && version="latest"
+	giturl="https://github.com/${owner_repo}/releases/${version}"
+	json=$(http_copy "$giturl" "Accept:application/json")
+	test -z "$json" && return 1
+	version=$(echo "$json" | tr -s '\n' ' ' | sed 's/.*"tag_name":"//' | sed 's/".*//')
+	test -z "$version" && return 1
+	echo "$version"
+}
+hash_sha256() {
+	TARGET=${1:-/dev/stdin}
+	if is_command gsha256sum; then
+		hash=$(gsha256sum "$TARGET") || return 1
+		echo "$hash" | cut -d ' ' -f 1
+	elif is_command sha256sum; then
+		hash=$(sha256sum "$TARGET") || return 1
+		echo "$hash" | cut -d ' ' -f 1
+	elif is_command shasum; then
+		hash=$(shasum -a 256 "$TARGET" 2>/dev/null) || return 1
+		echo "$hash" | cut -d ' ' -f 1
+	elif is_command openssl; then
+		hash=$(openssl -dst openssl dgst -sha256 "$TARGET") || return 1
+		echo "$hash" | cut -d ' ' -f a
+	else
+		log_crit "hash_sha256 unable to find command to compute sha-256 hash"
+		return 1
+	fi
+}
+hash_sha256_verify() {
+	TARGET=$1
+	checksums=$2
+	if [ -z "$checksums" ]; then
+		log_err "hash_sha256_verify checksum file not specified in arg2"
+		return 1
+	fi
+	BASENAME=${TARGET##*/}
+	want=$(grep "${BASENAME}" "${checksums}" 2>/dev/null | tr '\t' ' ' | cut -d ' ' -f 1)
+	if [ -z "$want" ]; then
+		log_err "hash_sha256_verify unable to find checksum for '${TARGET}' in '${checksums}'"
+		return 1
+	fi
+	got=$(hash_sha256 "$TARGET")
+	if [ "$want" != "$got" ]; then
+		log_err "hash_sha256_verify checksum for '$TARGET' did not verify ${want} vs $got"
+		return 1
+	fi
+}
+cat /dev/null <<EOF
+------------------------------------------------------------------------
+End of functions from https://github.com/client9/shlib
+------------------------------------------------------------------------
+EOF
+
+PROJECT_NAME="goreleaser"
+OWNER=goreleaser
+REPO="goreleaser"
+BINARY=goreleaser
+FORMAT=tar.gz
+OS=$(uname_os)
+ARCH=$(uname_arch)
+PREFIX="$OWNER/$REPO"
+
+# use in logging routines
+log_prefix() {
+	echo "$PREFIX"
+}
+PLATFORM="${OS}/${ARCH}"
+GITHUB_DOWNLOAD=https://github.com/${OWNER}/${REPO}/releases/download
+
+uname_os_check "$OS"
+uname_arch_check "$ARCH"
+
+parse_args "$@"
+
+get_binaries
+
+tag_to_version
+
+adjust_format
+
+adjust_os
+
+adjust_arch
+
+log_info "found version: ${VERSION} for ${TAG}/${OS}/${ARCH}"
+
+NAME=${PROJECT_NAME}_${OS}_${ARCH}
+TARBALL=${NAME}.${FORMAT}
+TARBALL_URL=${GITHUB_DOWNLOAD}/${TAG}/${TARBALL}
+CHECKSUM=checksums.txt
+CHECKSUM_URL=${GITHUB_DOWNLOAD}/${TAG}/${CHECKSUM}
+
+execute
+log_err "this script is deprecated, please do not use it anymore. check https://github.com/goreleaser/godownloader/issues/207"

.golangci.yaml

@@ -15,6 +15,7 @@ linters:
     - dogsled
     - dupl
     - errcheck
+    - exportloopref
     - funlen
     - gocognit
     - goconst
@@ -22,7 +23,6 @@ linters:
     - gocyclo
     - gofmt
     - goimports
-    - golint
     - goprintffuncname
     - gosec
     - gosimple
@@ -31,8 +31,8 @@ linters:
     - misspell
     - nakedret
     - nolintlint
+    - revive
     - rowserrcheck
-    - scopelint
     - staticcheck
     - structcheck
     - stylecheck
@@ -49,11 +49,13 @@ linters:
 #    - godot
 #    - godox
 #    - goerr113
+#    - golint      # deprecated
 #    - gomnd       # this is too aggressive
 #    - interfacer  # this is a good idea, but is no longer supported and is prone to false positives
 #    - lll         # without a way to specify per-line exception cases, this is not usable
 #    - maligned    # this is an excellent linter, but tricky to optimize and we are not sensitive to memory layout optimizations
 #    - nestif
 #    - prealloc    # following this rule isn't consistently a good idea, as it sometimes forces unnecessary allocations that result in less idiomatic code
+#    - scopelint   # deprecated
 #    - testpackage
-#    - wsl
+#    - wsl         # this doens't have an auto-fixer yet and is pretty noisy (https://github.com/bombsimon/wsl/issues/90)

Makefile

@@ -101,9 +101,9 @@ $(TEMPDIR):
 .PHONY: bootstrap-tools
 bootstrap-tools: $(TEMPDIR)
 	GO111MODULE=off GOBIN=$(shell realpath $(TEMPDIR)) go get -u golang.org/x/perf/cmd/benchstat
-	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(TEMPDIR)/ v1.26.0
+	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(TEMPDIR)/ v1.42.1
 	curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMPDIR)/ v0.2.0
-	curl -sfL https://install.goreleaser.com/github.com/goreleaser/goreleaser.sh | sh -s -- -b $(TEMPDIR)/ v0.177.0
+	.github/scripts/goreleaser-install.sh -b $(TEMPDIR)/ v0.182.1
 
 .PHONY: bootstrap-go
 bootstrap-go:

README.md

@@ -1,4 +1,6 @@
-# syft
+<p align="center">
+    <img src="https://user-images.githubusercontent.com/5199289/136844524-1527b09f-c5cb-4aa9-be54-5aa92a6086c1.png" width="271">
+</p>
 
 [![Validations](https://github.com/anchore/syft/actions/workflows/validations.yaml/badge.svg)](https://github.com/anchore/syft/actions/workflows/validations.yaml)
 [![Go Report Card](https://goreportcard.com/badge/github.com/anchore/syft)](https://goreportcard.com/report/github.com/anchore/syft)
@@ -9,17 +11,13 @@
 
 A CLI tool and go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Exceptional for vulnerability detection when used with a scanner tool like [Grype](https://github.com/anchore/grype).
 
-## We'll be at KubeCon 2021!
-
-Attending KubeCon 2021 in person? Join us for a meetup on **Tuesday, October 12th**.
-
-We’ll have free swag, giveaways, snacks, and sips. Space will be limited, so make sure to [save your seat](https://get.anchore.com/2021-kubecon-na-opensource-happy-hour/)!
+**Announcement:** Join us on October 20, 11am-noon PT for a webinar where we’ll discuss Anchore’s open source and enterprise solutions. [Save your seat!](https://get.anchore.com/anchore-open-source-vs-enterprise/)
 
 ---
 
 ![syft-demo](https://user-images.githubusercontent.com/590471/90277200-2a253000-de33-11ea-893f-32c219eea11a.gif)
 
-**Features**
+## Features
 - Catalog container images and filesystems to discover packages and libraries.
 - Supports packages and libraries from various ecosystems (APK, DEB, RPM, Ruby Bundles, Python Wheel/Egg/requirements.txt, JavaScript NPM/Yarn, Java JAR/EAR/WAR, Jenkins plugins JPI/HPI, Go modules)
 - Linux distribution identification (supports Alpine, BusyBox, CentOS/RedHat, Debian/Ubuntu flavored distributions)

cmd/packages.go

@@ -6,8 +6,6 @@ import (
 	"io/ioutil"
 	"os"
 
-	"github.com/anchore/syft/syft/format"
-
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/anchore"
@@ -50,7 +48,7 @@ const (
 )
 
 var (
-	packagesPresenterOpt format.Option
+	packagesPresenterOpt packages.PresenterOption
 	packagesArgs         = cobra.MaximumNArgs(1)
 	packagesCmd          = &cobra.Command{
 		Use:   "packages [SOURCE]",
@@ -73,8 +71,8 @@ var (
 			}
 
 			// set the presenter
-			presenterOption := format.ParseOption(appConfig.Output)
-			if presenterOption == format.UnknownOption {
+			presenterOption := packages.ParsePresenterOption(appConfig.Output)
+			if presenterOption == packages.UnknownPresenterOption {
 				return fmt.Errorf("bad --output value '%s'", appConfig.Output)
 			}
 			packagesPresenterOpt = presenterOption
@@ -104,15 +102,15 @@ func init() {
 }
 
 func setPackageFlags(flags *pflag.FlagSet) {
-	///////// Formatting & Input options //////////////////////////////////////////////
+	// Formatting & Input options //////////////////////////////////////////////
 
 	flags.StringP(
 		"scope", "s", source.SquashedScope.String(),
 		fmt.Sprintf("selection of layers to catalog, options=%v", source.AllScopes))
 
 	flags.StringP(
-		"output", "o", string(format.TableOption),
-		fmt.Sprintf("report output formatter, options=%v", format.AllOptions),
+		"output", "o", string(packages.TablePresenterOption),
+		fmt.Sprintf("report output formatter, options=%v", packages.AllPresenters),
 	)
 
 	flags.StringP(
@@ -120,7 +118,7 @@ func setPackageFlags(flags *pflag.FlagSet) {
 		"file to write the report output to (default is STDOUT)",
 	)
 
-	///////// Upload options //////////////////////////////////////////////////////////
+	// Upload options //////////////////////////////////////////////////////////
 	flags.StringP(
 		"host", "H", "",
 		"the hostname or URL of the Anchore Enterprise instance to upload to",
@@ -153,7 +151,7 @@ func setPackageFlags(flags *pflag.FlagSet) {
 }
 
 func bindPackagesConfigOptions(flags *pflag.FlagSet) error {
-	///////// Formatting & Input options //////////////////////////////////////////////
+	// Formatting & Input options //////////////////////////////////////////////
 
 	if err := viper.BindPFlag("package.cataloger.scope", flags.Lookup("scope")); err != nil {
 		return err
@@ -167,7 +165,7 @@ func bindPackagesConfigOptions(flags *pflag.FlagSet) error {
 		return err
 	}
 
-	///////// Upload options //////////////////////////////////////////////////////////
+	// Upload options //////////////////////////////////////////////////////////
 
 	if err := viper.BindPFlag("anchore.host", flags.Lookup("host")); err != nil {
 		return err
@@ -249,7 +247,7 @@ func packagesExecWorker(userInput string) <-chan error {
 
 		bus.Publish(partybus.Event{
 			Type: event.PresenterReady,
-			Value: packages.Presenter(packagesPresenterOpt, packages.Config{
+			Value: packages.Presenter(packagesPresenterOpt, packages.PresenterConfig{
 				SourceMetadata: src.Metadata,
 				Catalog:        catalog,
 				Distro:         d,

cmd/report_writer.go

@@ -11,18 +11,22 @@ import (
 
 func reportWriter() (io.Writer, func() error, error) {
 	nop := func() error { return nil }
-
 	path := strings.TrimSpace(appConfig.File)
+
 	switch len(path) {
 	case 0:
 		return os.Stdout, nop, nil
+
 	default:
 		reportFile, err := os.OpenFile(path, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0644)
+
 		if err != nil {
 			return nil, nop, fmt.Errorf("unable to create report file: %w", err)
 		}
+
 		return reportFile, func() error {
 			log.Infof("report written to file=%q", path)
+
 			return reportFile.Close()
 		}, nil
 	}

go.mod

@@ -18,18 +18,19 @@ require (
 	github.com/dustin/go-humanize v1.0.0
 	github.com/facebookincubator/nvdtools v0.1.4
 	github.com/go-test/deep v1.0.7
-	github.com/google/uuid v1.1.1
+	github.com/google/go-cmp v0.4.1
+	github.com/google/uuid v1.2.0
 	github.com/gookit/color v1.2.7
 	github.com/hashicorp/go-multierror v1.1.0
 	github.com/hashicorp/go-version v1.2.0
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/mitchellh/mapstructure v1.3.1
 	github.com/olekukonko/tablewriter v0.0.4
-	github.com/pelletier/go-toml v1.8.0
+	github.com/pelletier/go-toml v1.8.1
 	github.com/pkg/profile v1.5.0
 	github.com/scylladb/go-set v1.0.2
 	github.com/sergi/go-diff v1.1.0
-	github.com/sirupsen/logrus v1.6.0
+	github.com/sirupsen/logrus v1.8.1
 	github.com/spdx/tools-golang v0.1.0
 	github.com/spf13/afero v1.2.2
 	github.com/spf13/cobra v1.0.1-0.20200909172742-8a63648dd905
@@ -42,8 +43,8 @@ require (
 	github.com/wagoodman/jotframe v0.0.0-20200730190914-3517092dd163
 	github.com/x-cray/logrus-prefixed-formatter v0.5.2
 	github.com/xeipuuv/gojsonschema v1.2.0
-	golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9
 	golang.org/x/mod v0.3.0
 	golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d
-	gopkg.in/yaml.v2 v2.3.0
+	golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1
+	gopkg.in/yaml.v2 v2.4.0
 )

go.sum

@@ -73,7 +73,6 @@ github.com/Azure/go-autorest/autorest/validation v0.1.0/go.mod h1:Ha3z/SqBeaalWQ
 github.com/Azure/go-autorest/autorest/validation v0.2.0/go.mod h1:3EEqHnBxQGHXRYq3HT1WyXAvT7LLY3tl70hw6tQIbjI=
 github.com/Azure/go-autorest/logger v0.1.0/go.mod h1:oExouG+K6PryycPJfVSxi/koC6LSNgds39diKLz7Vrc=
 github.com/Azure/go-autorest/tracing v0.5.0/go.mod h1:r/s2XiOKccPW3HrqB+W0TQzfbtp2fGCgRFtBroKn4Dk=
-github.com/BurntSushi/toml v0.3.1 h1:WXkYYl6Yr3qBf1K79EBnL4mak0OimBfB0XUf9Vl28OQ=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/Djarvur/go-err113 v0.0.0-20200410182137-af658d038157/go.mod h1:4UJr5HIiMZrwgkSPdsjy2uOQExX/WEILpIrO9UPGuXs=
@@ -374,8 +373,9 @@ github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm4
 github.com/google/rpmpack v0.0.0-20191226140753-aa36bfddb3a0/go.mod h1:RaTPr0KUf2K7fnZYLNDrr8rxAamWs3iNywJLtQ2AzBg=
 github.com/google/subcommands v1.0.1/go.mod h1:ZjhPrFU+Olkh9WazFPsl27BQ4UPiG37m3yTrtFlrHVk=
 github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.1.1 h1:Gkbcsh/GbpXz7lPftLA3P6TYMwjCLYm83jiFQZF/3gY=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.2.0 h1:qJYtXnJRWmpe7m/3XlyhrsLrEURqHRM2kxzoxXqyUDs=
+github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/wire v0.3.0/go.mod h1:i1DMg/Lu8Sz5yYl25iOdmc5CT5qusaa+zmRWs16741s=
 github.com/google/wire v0.4.0/go.mod h1:ngWDr9Qvq3yZA10YrxfyGELY/AFWGVpy9c1LTRi1EoU=
 github.com/googleapis/gax-go v2.0.2+incompatible/go.mod h1:SFVmujtThgffbyetf+mdk2eWhX2bMyUtNHzFKcPA9HY=
@@ -479,7 +479,6 @@ github.com/klauspost/cpuid v0.0.0-20180405133222-e7e905edc00e/go.mod h1:Pj4uuM52
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/konsorten/go-windows-terminal-sequences v1.0.3 h1:CE8S1cTafDpPvMhIxNJKvHsGVBgn1xWYf1NbHQhywc8=
 github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
@@ -595,8 +594,9 @@ github.com/opencontainers/runtime-spec v1.0.2/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
-github.com/pelletier/go-toml v1.8.0 h1:Keo9qb7iRJs2voHvunFtuuYFsbWeOBh8/P9v/kVMFtw=
 github.com/pelletier/go-toml v1.8.0/go.mod h1:D6yutnOGMveHEPV7VQOuvI/gXY61bv+9bAOTRnLElKs=
+github.com/pelletier/go-toml v1.8.1 h1:1Nf83orprkJyknT6h7zbuEGUEjcyVlCxSUGTENmNCRM=
+github.com/pelletier/go-toml v1.8.1/go.mod h1:T2/BmBdy8dvIRq1a/8aqjN41wvWlN4lrapLU/GW4pbc=
 github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
 github.com/phayes/checkstyle v0.0.0-20170904204023-bfd46e6a821d/go.mod h1:3OzsM7FXDQlpCiw2j81fOmAwQLnZnLGXVKUzeKQXIAw=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -660,8 +660,9 @@ github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPx
 github.com/sirupsen/logrus v1.3.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
-github.com/sirupsen/logrus v1.6.0 h1:UBcNElsrwanuuMsnGSlYmtmgbb23qDR5dG+6X6Oo89I=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
+github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
+github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
 github.com/smartystreets/assertions v1.0.0 h1:UVQPSSmc3qtTi+zPPkCXvZX9VvW/xT/NsRvKfwY81a8=
 github.com/smartystreets/assertions v1.0.0/go.mod h1:kHHU4qYBaI3q23Pp3VPrmWhuIUrLW/7eUrw0BU5VaoM=
@@ -800,9 +801,8 @@ golang.org/x/crypto v0.0.0-20191002192127-34f69633bfdc/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191206172530-e9b2fee46413/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20200510223506-06a226fb4e37 h1:cg5LA/zNPRzIXIWSCxQW10Rvpy94aQh3LT/ShoCpkHw=
 golang.org/x/crypto v0.0.0-20200510223506-06a226fb4e37/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 h1:psW17arqaxU48Z5kZ0CQnkZWQJsqcURM6tKiBApRjXI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190125153040-c74c464bbbf2/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -944,6 +944,7 @@ golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da h1:b3NXsE2LusjYGGjL5bxEVZZORm/YEFFrWFjR8eFrw/c=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1 h1:v+OssWQX+hTHEmOBgwxdZxK4zHq3yOs8F9J7mk0PY8E=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1138,8 +1139,9 @@ gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=

internal/anchore/import_package_sbom.go

@@ -8,8 +8,7 @@ import (
 	"fmt"
 	"net/http"
 
-	"github.com/anchore/syft/internal/formats"
-	"github.com/anchore/syft/syft/format"
+	"github.com/anchore/syft/internal/presenter/packages"
 
 	"github.com/wagoodman/go-progress"
 
@@ -25,9 +24,9 @@ type packageSBOMImportAPI interface {
 	ImportImagePackages(context.Context, string, external.ImagePackageManifest) (external.ImageImportContentResponse, *http.Response, error)
 }
 
-func packageSbomModel(s source.Metadata, catalog *pkg.Catalog, d *distro.Distro, _ source.Scope) (*external.ImagePackageManifest, error) {
+func packageSbomModel(s source.Metadata, catalog *pkg.Catalog, d *distro.Distro, scope source.Scope) (*external.ImagePackageManifest, error) {
 	var buf bytes.Buffer
-	pres := formats.ByOption(format.JSONOption).Presenter(catalog, &s, d)
+	pres := packages.NewJSONPresenter(catalog, s, d, scope)
 	err := pres.Present(&buf)
 	if err != nil {
 		return nil, fmt.Errorf("unable to serialize results: %w", err)

internal/anchore/import_package_sbom_test.go

@@ -1,6 +1,7 @@
 package anchore
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"fmt"
@@ -8,16 +9,18 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/anchore/client-go/pkg/external"
-	syftjsonModel "github.com/anchore/syft/internal/formats/syftjson/model"
-	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/internal/presenter/packages"
+
+	"github.com/wagoodman/go-progress"
+
 	"github.com/anchore/syft/syft/distro"
-	"github.com/anchore/syft/syft/format"
+
+	"github.com/docker/docker/pkg/ioutils"
+
+	"github.com/anchore/client-go/pkg/external"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
-	"github.com/docker/docker/pkg/ioutils"
 	"github.com/go-test/deep"
-	"github.com/wagoodman/go-progress"
 )
 
 func must(c pkg.CPE, e error) pkg.CPE {
@@ -84,19 +87,20 @@ func TestPackageSbomToModel(t *testing.T) {
 		t.Fatalf("unable to marshal model: %+v", err)
 	}
 
-	by, err := syft.Encode(c, &m, &d, format.JSONOption)
-	if err != nil {
+	var buf bytes.Buffer
+	pres := packages.NewJSONPresenter(c, m, &d, source.AllLayersScope)
+	if err := pres.Present(&buf); err != nil {
 		t.Fatalf("unable to get expected json: %+v", err)
 	}
 
 	// unmarshal expected result
-	var expectedDoc syftjsonModel.Document
-	if err := json.Unmarshal(by, &expectedDoc); err != nil {
+	var expectedDoc packages.JSONDocument
+	if err := json.Unmarshal(buf.Bytes(), &expectedDoc); err != nil {
 		t.Fatalf("unable to parse json doc: %+v", err)
 	}
 
 	// unmarshal actual result
-	var actualDoc syftjsonModel.Document
+	var actualDoc packages.JSONDocument
 	if err := json.Unmarshal(modelJSON, &actualDoc); err != nil {
 		t.Fatalf("unable to parse json doc: %+v", err)
 	}

internal/config/application.go

@@ -89,10 +89,43 @@ func (cfg Application) loadDefaultValues(v *viper.Viper) {
 	}
 }
 
-// build inflates simple config values into syft native objects (or other complex objects) after the config is fully read in.
 func (cfg *Application) parseConfigValues() error {
+	// parse application config options
+	for _, optionFn := range []func() error{
+		cfg.parseUploadOptions,
+		cfg.parseLogLevelOption,
+	} {
+		if err := optionFn(); err != nil {
+			return err
+		}
+	}
+
+	// parse nested config options
+	// for each field in the configuration struct, see if the field implements the parser interface
+	// note: the app config is a pointer, so we need to grab the elements explicitly (to traverse the address)
+	value := reflect.ValueOf(cfg).Elem()
+	for i := 0; i < value.NumField(); i++ {
+		// note: since the interface method of parser is a pointer receiver we need to get the value of the field as a pointer.
+		if parsable, ok := value.Field(i).Addr().Interface().(parser); ok {
+			// the field implements parser, call it
+			if err := parsable.parseConfigValues(); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func (cfg *Application) parseUploadOptions() error {
+	if cfg.Anchore.Host == "" && cfg.Anchore.Dockerfile != "" {
+		return fmt.Errorf("cannot provide dockerfile option without enabling upload")
+	}
+	return nil
+}
+
+func (cfg *Application) parseLogLevelOption() error {
 	if cfg.Quiet {
-		// TODO: this is bad: quiet option trumps all other logging options
+		// TODO: this is bad: quiet option trumps all other logging options (such as to a file on disk)
 		// we should be able to quiet the console logging and leave file logging alone...
 		// ... this will be an enhancement for later
 		cfg.Log.LevelOpt = logrus.PanicLevel
@@ -116,28 +149,10 @@ func (cfg *Application) parseConfigValues() error {
 			case v >= 2:
 				cfg.Log.LevelOpt = logrus.DebugLevel
 			default:
-				cfg.Log.LevelOpt = logrus.WarnLevel
+				cfg.Log.LevelOpt = logrus.ErrorLevel
 			}
 		}
 	}
-
-	if cfg.Anchore.Host == "" && cfg.Anchore.Dockerfile != "" {
-		return fmt.Errorf("cannot provide dockerfile option without enabling upload")
-	}
-
-	// for each field in the configuration struct, see if the field implements the parser interface
-	// note: the app config is a pointer, so we need to grab the elements explicitly (to traverse the address)
-	value := reflect.ValueOf(cfg).Elem()
-	for i := 0; i < value.NumField(); i++ {
-		// note: since the interface method of parser is a pointer receiver we need to get the value of the field as a pointer.
-		if parsable, ok := value.Field(i).Addr().Interface().(parser); ok {
-			// the field implements parser, call it
-			if err := parsable.parseConfigValues(); err != nil {
-				return err
-			}
-		}
-	}
-
 	return nil
 }
 

internal/formats/common/spdxhelpers/description.go

@@ -1,14 +0,0 @@
-package spdxhelpers
-
-import "github.com/anchore/syft/syft/pkg"
-
-func Description(p *pkg.Package) string {
-	switch metadata := p.Metadata.(type) {
-	case pkg.ApkMetadata:
-		return metadata.Description
-	case pkg.NpmPackageJSONMetadata:
-		return metadata.Description
-	default:
-		return ""
-	}
-}

internal/formats/common/spdxhelpers/description_test.go

@@ -1,56 +0,0 @@
-package spdxhelpers
-
-import (
-	"testing"
-
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/stretchr/testify/assert"
-)
-
-func Test_Description(t *testing.T) {
-	tests := []struct {
-		name     string
-		input    pkg.Package
-		expected string
-	}{
-		{
-			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
-			name:     "no metadata",
-			input:    pkg.Package{},
-			expected: "",
-		},
-		{
-			name: "from apk",
-			input: pkg.Package{
-				Metadata: pkg.ApkMetadata{
-					Description: "a description!",
-				},
-			},
-			expected: "a description!",
-		},
-		{
-			name: "from npm",
-			input: pkg.Package{
-				Metadata: pkg.NpmPackageJSONMetadata{
-					Description: "a description!",
-				},
-			},
-			expected: "a description!",
-		},
-		{
-			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
-			name: "empty",
-			input: pkg.Package{
-				Metadata: pkg.NpmPackageJSONMetadata{
-					Homepage: "",
-				},
-			},
-			expected: "",
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, Description(&test.input))
-		})
-	}
-}

internal/formats/common/spdxhelpers/download_location.go

@@ -1,22 +0,0 @@
-package spdxhelpers
-
-import "github.com/anchore/syft/syft/pkg"
-
-func DownloadLocation(p *pkg.Package) string {
-	// 3.7: Package Download Location
-	// Cardinality: mandatory, one
-	// NONE if there is no download location whatsoever.
-	// NOASSERTION if:
-	//   (i) the SPDX file creator has attempted to but cannot reach a reasonable objective determination;
-	//   (ii) the SPDX file creator has made no attempt to determine this field; or
-	//   (iii) the SPDX file creator has intentionally provided no information (no meaning should be implied by doing so).
-
-	switch metadata := p.Metadata.(type) {
-	case pkg.ApkMetadata:
-		return NoneIfEmpty(metadata.URL)
-	case pkg.NpmPackageJSONMetadata:
-		return NoneIfEmpty(metadata.URL)
-	default:
-		return "NOASSERTION"
-	}
-}

internal/formats/common/spdxhelpers/download_location_test.go

@@ -1,54 +0,0 @@
-package spdxhelpers
-
-import (
-	"testing"
-
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/stretchr/testify/assert"
-)
-
-func Test_DownloadLocation(t *testing.T) {
-	tests := []struct {
-		name     string
-		input    pkg.Package
-		expected string
-	}{
-		{
-			name:     "no metadata",
-			input:    pkg.Package{},
-			expected: "NOASSERTION",
-		},
-		{
-			name: "from apk",
-			input: pkg.Package{
-				Metadata: pkg.ApkMetadata{
-					URL: "http://a-place.gov",
-				},
-			},
-			expected: "http://a-place.gov",
-		},
-		{
-			name: "from npm",
-			input: pkg.Package{
-				Metadata: pkg.NpmPackageJSONMetadata{
-					URL: "http://a-place.gov",
-				},
-			},
-			expected: "http://a-place.gov",
-		},
-		{
-			name: "empty",
-			input: pkg.Package{
-				Metadata: pkg.NpmPackageJSONMetadata{
-					URL: "",
-				},
-			},
-			expected: "NONE",
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, DownloadLocation(&test.input))
-		})
-	}
-}

internal/formats/common/spdxhelpers/external_refs.go

@@ -1,50 +0,0 @@
-package spdxhelpers
-
-import (
-	"github.com/anchore/syft/internal/formats/spdx22json/model"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/pkg"
-)
-
-func ExternalRefs(p *pkg.Package) (externalRefs []model.ExternalRef) {
-	externalRefs = make([]model.ExternalRef, 0)
-	for _, c := range p.CPEs {
-		externalRefs = append(externalRefs, model.ExternalRef{
-			ReferenceCategory: model.SecurityReferenceCategory,
-			ReferenceLocator:  c.BindToFmtString(),
-			ReferenceType:     model.Cpe23ExternalRefType,
-		})
-	}
-
-	if p.PURL != "" {
-		externalRefs = append(externalRefs, model.ExternalRef{
-			ReferenceCategory: model.PackageManagerReferenceCategory,
-			ReferenceLocator:  p.PURL,
-			ReferenceType:     model.PurlExternalRefType,
-		})
-	}
-	return externalRefs
-}
-
-func ExtractPURL(refs []model.ExternalRef) string {
-	for _, r := range refs {
-		if r.ReferenceType == model.PurlExternalRefType {
-			return r.ReferenceLocator
-		}
-	}
-	return ""
-}
-
-func ExtractCPEs(refs []model.ExternalRef) (cpes []pkg.CPE) {
-	for _, r := range refs {
-		if r.ReferenceType == model.Cpe23ExternalRefType {
-			cpe, err := pkg.NewCPE(r.ReferenceLocator)
-			if err != nil {
-				log.Warnf("unable to extract SPDX CPE=%q: %+v", r.ReferenceLocator, err)
-				continue
-			}
-			cpes = append(cpes, cpe)
-		}
-	}
-	return cpes
-}

internal/formats/common/spdxhelpers/external_refs_test.go

@@ -1,46 +0,0 @@
-package spdxhelpers
-
-import (
-	"testing"
-
-	"github.com/anchore/syft/internal/formats/common/testutils"
-	"github.com/anchore/syft/internal/formats/spdx22json/model"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/stretchr/testify/assert"
-)
-
-func Test_ExternalRefs(t *testing.T) {
-	testCPE := testutils.MustCPE(pkg.NewCPE("cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*"))
-	tests := []struct {
-		name     string
-		input    pkg.Package
-		expected []model.ExternalRef
-	}{
-		{
-			name: "cpe + purl",
-			input: pkg.Package{
-				CPEs: []pkg.CPE{
-					testCPE,
-				},
-				PURL: "a-purl",
-			},
-			expected: []model.ExternalRef{
-				{
-					ReferenceCategory: model.SecurityReferenceCategory,
-					ReferenceLocator:  testCPE.BindToFmtString(),
-					ReferenceType:     model.Cpe23ExternalRefType,
-				},
-				{
-					ReferenceCategory: model.PackageManagerReferenceCategory,
-					ReferenceLocator:  "a-purl",
-					ReferenceType:     model.PurlExternalRefType,
-				},
-			},
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			assert.ElementsMatch(t, test.expected, ExternalRefs(&test.input))
-		})
-	}
-}

internal/formats/common/spdxhelpers/files.go

@@ -1,47 +0,0 @@
-package spdxhelpers
-
-import (
-	"crypto/sha256"
-	"fmt"
-	"path/filepath"
-
-	"github.com/anchore/syft/internal/formats/spdx22json/model"
-	"github.com/anchore/syft/syft/pkg"
-)
-
-func Files(packageSpdxID string, p *pkg.Package) (files []model.File, fileIDs []string, relationships []model.Relationship) {
-	files = make([]model.File, 0)
-	fileIDs = make([]string, 0)
-	relationships = make([]model.Relationship, 0)
-
-	pkgFileOwner, ok := p.Metadata.(pkg.FileOwner)
-	if !ok {
-		return files, fileIDs, relationships
-	}
-
-	for _, ownedFilePath := range pkgFileOwner.OwnedFiles() {
-		baseFileName := filepath.Base(ownedFilePath)
-		pathHash := sha256.Sum256([]byte(ownedFilePath))
-		fileSpdxID := model.ElementID(fmt.Sprintf("File-%s-%x", p.Name, pathHash)).String()
-
-		fileIDs = append(fileIDs, fileSpdxID)
-
-		files = append(files, model.File{
-			FileName: ownedFilePath,
-			Item: model.Item{
-				Element: model.Element{
-					SPDXID: fileSpdxID,
-					Name:   baseFileName,
-				},
-			},
-		})
-
-		relationships = append(relationships, model.Relationship{
-			SpdxElementID:      packageSpdxID,
-			RelationshipType:   model.ContainsRelationship,
-			RelatedSpdxElement: fileSpdxID,
-		})
-	}
-
-	return files, fileIDs, relationships
-}

internal/formats/common/spdxhelpers/homepage.go

@@ -1,14 +0,0 @@
-package spdxhelpers
-
-import "github.com/anchore/syft/syft/pkg"
-
-func Homepage(p *pkg.Package) string {
-	switch metadata := p.Metadata.(type) {
-	case pkg.GemMetadata:
-		return metadata.Homepage
-	case pkg.NpmPackageJSONMetadata:
-		return metadata.Homepage
-	default:
-		return ""
-	}
-}

internal/formats/common/spdxhelpers/homepage_test.go

@@ -1,56 +0,0 @@
-package spdxhelpers
-
-import (
-	"testing"
-
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/stretchr/testify/assert"
-)
-
-func Test_Homepage(t *testing.T) {
-	tests := []struct {
-		name     string
-		input    pkg.Package
-		expected string
-	}{
-		{
-			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
-			name:     "no metadata",
-			input:    pkg.Package{},
-			expected: "",
-		},
-		{
-			name: "from gem",
-			input: pkg.Package{
-				Metadata: pkg.GemMetadata{
-					Homepage: "http://a-place.gov",
-				},
-			},
-			expected: "http://a-place.gov",
-		},
-		{
-			name: "from npm",
-			input: pkg.Package{
-				Metadata: pkg.NpmPackageJSONMetadata{
-					Homepage: "http://a-place.gov",
-				},
-			},
-			expected: "http://a-place.gov",
-		},
-		{
-			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
-			name: "empty",
-			input: pkg.Package{
-				Metadata: pkg.NpmPackageJSONMetadata{
-					Homepage: "",
-				},
-			},
-			expected: "",
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, Homepage(&test.input))
-		})
-	}
-}

internal/formats/common/spdxhelpers/license.go

@@ -1,37 +0,0 @@
-package spdxhelpers
-
-import (
-	"strings"
-
-	"github.com/anchore/syft/internal/spdxlicense"
-	"github.com/anchore/syft/syft/pkg"
-)
-
-func License(p *pkg.Package) string {
-	// source: https://spdx.github.io/spdx-spec/3-package-information/#313-concluded-license
-	// The options to populate this field are limited to:
-	// A valid SPDX License Expression as defined in Appendix IV;
-	// NONE, if the SPDX file creator concludes there is no license available for this package; or
-	// NOASSERTION if:
-	//   (i) the SPDX file creator has attempted to but cannot reach a reasonable objective determination;
-	//   (ii) the SPDX file creator has made no attempt to determine this field; or
-	//   (iii) the SPDX file creator has intentionally provided no information (no meaning should be implied by doing so).
-
-	if len(p.Licenses) == 0 {
-		return "NONE"
-	}
-
-	// take all licenses and assume an AND expression; for information about license expressions see https://spdx.github.io/spdx-spec/appendix-IV-SPDX-license-expressions/
-	var parsedLicenses []string
-	for _, l := range p.Licenses {
-		if value, exists := spdxlicense.ID(l); exists {
-			parsedLicenses = append(parsedLicenses, value)
-		}
-	}
-
-	if len(parsedLicenses) == 0 {
-		return "NOASSERTION"
-	}
-
-	return strings.Join(parsedLicenses, " AND ")
-}

internal/formats/common/spdxhelpers/license_test.go

@@ -1,73 +0,0 @@
-package spdxhelpers
-
-import (
-	"testing"
-
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/stretchr/testify/assert"
-)
-
-func Test_License(t *testing.T) {
-	tests := []struct {
-		name     string
-		input    pkg.Package
-		expected string
-	}{
-		{
-			name:     "no licenses",
-			input:    pkg.Package{},
-			expected: "NONE",
-		},
-		{
-			name: "no SPDX licenses",
-			input: pkg.Package{
-				Licenses: []string{
-					"made-up",
-				},
-			},
-			expected: "NOASSERTION",
-		},
-		{
-			name: "with SPDX license",
-			input: pkg.Package{
-				Licenses: []string{
-					"MIT",
-				},
-			},
-			expected: "MIT",
-		},
-		{
-			name: "with SPDX license expression",
-			input: pkg.Package{
-				Licenses: []string{
-					"MIT",
-					"GPL-3.0",
-				},
-			},
-			expected: "MIT AND GPL-3.0",
-		},
-		{
-			name: "cap insensitive",
-			input: pkg.Package{
-				Licenses: []string{
-					"gpl-3.0",
-				},
-			},
-			expected: "GPL-3.0",
-		},
-		{
-			name: "debian to spdx conversion",
-			input: pkg.Package{
-				Licenses: []string{
-					"GPL-2",
-				},
-			},
-			expected: "GPL-2.0",
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, License(&test.input))
-		})
-	}
-}

internal/formats/common/spdxhelpers/none_if_empty.go

@@ -1,12 +0,0 @@
-package spdxhelpers
-
-import (
-	"strings"
-)
-
-func NoneIfEmpty(value string) string {
-	if strings.TrimSpace(value) == "" {
-		return "NONE"
-	}
-	return value
-}

internal/formats/common/spdxhelpers/none_if_empty_test.go

@@ -1,41 +0,0 @@
-package spdxhelpers
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func Test_noneIfEmpty(t *testing.T) {
-	tests := []struct {
-		name     string
-		value    string
-		expected string
-	}{
-		{
-			name:     "non-zero value",
-			value:    "something",
-			expected: "something",
-		},
-		{
-			name:     "empty",
-			value:    "",
-			expected: "NONE",
-		},
-		{
-			name:     "space",
-			value:    " ",
-			expected: "NONE",
-		},
-		{
-			name:     "tab",
-			value:    "\t",
-			expected: "NONE",
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, NoneIfEmpty(test.value))
-		})
-	}
-}

internal/formats/common/spdxhelpers/originator_test.go

@@ -1,114 +0,0 @@
-package spdxhelpers
-
-import (
-	"testing"
-
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/stretchr/testify/assert"
-)
-
-func Test_Originator(t *testing.T) {
-	tests := []struct {
-		name     string
-		input    pkg.Package
-		expected string
-	}{
-		{
-			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
-			name:     "no metadata",
-			input:    pkg.Package{},
-			expected: "",
-		},
-		{
-			name: "from gem",
-			input: pkg.Package{
-				Metadata: pkg.GemMetadata{
-					Authors: []string{
-						"auth1",
-						"auth2",
-					},
-				},
-			},
-			expected: "auth1",
-		},
-		{
-			name: "from npm",
-			input: pkg.Package{
-				Metadata: pkg.NpmPackageJSONMetadata{
-					Author: "auth",
-				},
-			},
-			expected: "auth",
-		},
-		{
-			name: "from apk",
-			input: pkg.Package{
-				Metadata: pkg.ApkMetadata{
-					Maintainer: "auth",
-				},
-			},
-			expected: "auth",
-		},
-		{
-			name: "from python - just name",
-			input: pkg.Package{
-				Metadata: pkg.PythonPackageMetadata{
-					Author: "auth",
-				},
-			},
-			expected: "auth",
-		},
-		{
-			name: "from python - just email",
-			input: pkg.Package{
-				Metadata: pkg.PythonPackageMetadata{
-					AuthorEmail: "auth@auth.gov",
-				},
-			},
-			expected: "auth@auth.gov",
-		},
-		{
-			name: "from python - both name and email",
-			input: pkg.Package{
-				Metadata: pkg.PythonPackageMetadata{
-					Author:      "auth",
-					AuthorEmail: "auth@auth.gov",
-				},
-			},
-			expected: "auth <auth@auth.gov>",
-		},
-		{
-			name: "from rpm",
-			input: pkg.Package{
-				Metadata: pkg.RpmdbMetadata{
-					Vendor: "auth",
-				},
-			},
-			expected: "auth",
-		},
-		{
-			name: "from dpkg",
-			input: pkg.Package{
-				Metadata: pkg.DpkgMetadata{
-					Maintainer: "auth",
-				},
-			},
-			expected: "auth",
-		},
-		{
-			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
-			name: "empty",
-			input: pkg.Package{
-				Metadata: pkg.NpmPackageJSONMetadata{
-					Author: "",
-				},
-			},
-			expected: "",
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, Originator(&test.input))
-		})
-	}
-}

internal/formats/common/spdxhelpers/origintor.go

@@ -1,36 +0,0 @@
-package spdxhelpers
-
-import (
-	"fmt"
-
-	"github.com/anchore/syft/syft/pkg"
-)
-
-func Originator(p *pkg.Package) string {
-	switch metadata := p.Metadata.(type) {
-	case pkg.ApkMetadata:
-		return metadata.Maintainer
-	case pkg.NpmPackageJSONMetadata:
-		return metadata.Author
-	case pkg.PythonPackageMetadata:
-		author := metadata.Author
-		if author == "" {
-			return metadata.AuthorEmail
-		}
-		if metadata.AuthorEmail != "" {
-			author += fmt.Sprintf(" <%s>", metadata.AuthorEmail)
-		}
-		return author
-	case pkg.GemMetadata:
-		if len(metadata.Authors) > 0 {
-			return metadata.Authors[0]
-		}
-		return ""
-	case pkg.RpmdbMetadata:
-		return metadata.Vendor
-	case pkg.DpkgMetadata:
-		return metadata.Maintainer
-	default:
-		return ""
-	}
-}

internal/formats/common/spdxhelpers/source_info.go

@@ -1,39 +0,0 @@
-package spdxhelpers
-
-import (
-	"strings"
-
-	"github.com/anchore/syft/syft/pkg"
-)
-
-func SourceInfo(p *pkg.Package) string {
-	answer := ""
-	switch p.Type {
-	case pkg.RpmPkg:
-		answer = "acquired package info from RPM DB"
-	case pkg.ApkPkg:
-		answer = "acquired package info from APK DB"
-	case pkg.DebPkg:
-		answer = "acquired package info from DPKG DB"
-	case pkg.NpmPkg:
-		answer = "acquired package info from installed node module manifest file"
-	case pkg.PythonPkg:
-		answer = "acquired package info from installed python package manifest file"
-	case pkg.JavaPkg, pkg.JenkinsPluginPkg:
-		answer = "acquired package info from installed java archive"
-	case pkg.GemPkg:
-		answer = "acquired package info from installed gem metadata file"
-	case pkg.GoModulePkg:
-		answer = "acquired package info from go module information"
-	case pkg.RustPkg:
-		answer = "acquired package info from rust cargo manifest"
-	default:
-		answer = "acquired package info from the following paths"
-	}
-	var paths []string
-	for _, l := range p.Locations {
-		paths = append(paths, l.RealPath)
-	}
-
-	return answer + ": " + strings.Join(paths, ", ")
-}

internal/formats/common/spdxhelpers/source_info_test.go

@@ -1,141 +0,0 @@
-package spdxhelpers
-
-import (
-	"testing"
-
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
-	"github.com/stretchr/testify/assert"
-)
-
-func Test_SourceInfo(t *testing.T) {
-	tests := []struct {
-		name     string
-		input    pkg.Package
-		expected []string
-	}{
-		{
-			name: "locations are captured",
-			input: pkg.Package{
-				// note: no type given
-				Locations: []source.Location{
-					{
-						RealPath:    "/a-place",
-						VirtualPath: "/b-place",
-					},
-					{
-						RealPath:    "/c-place",
-						VirtualPath: "/d-place",
-					},
-				},
-			},
-			expected: []string{
-				"from the following paths",
-				"/a-place",
-				"/c-place",
-			},
-		},
-		{
-			// note: no specific support for this
-			input: pkg.Package{
-				Type: pkg.KbPkg,
-			},
-			expected: []string{
-				"from the following paths",
-			},
-		},
-		{
-			input: pkg.Package{
-				Type: pkg.RpmPkg,
-			},
-			expected: []string{
-				"from RPM DB",
-			},
-		},
-		{
-			input: pkg.Package{
-				Type: pkg.ApkPkg,
-			},
-			expected: []string{
-				"from APK DB",
-			},
-		},
-		{
-			input: pkg.Package{
-				Type: pkg.DebPkg,
-			},
-			expected: []string{
-				"from DPKG DB",
-			},
-		},
-		{
-			input: pkg.Package{
-				Type: pkg.NpmPkg,
-			},
-			expected: []string{
-				"from installed node module manifest file",
-			},
-		},
-		{
-			input: pkg.Package{
-				Type: pkg.PythonPkg,
-			},
-			expected: []string{
-				"from installed python package manifest file",
-			},
-		},
-		{
-			input: pkg.Package{
-				Type: pkg.JavaPkg,
-			},
-			expected: []string{
-				"from installed java archive",
-			},
-		},
-		{
-			input: pkg.Package{
-				Type: pkg.JenkinsPluginPkg,
-			},
-			expected: []string{
-				"from installed java archive",
-			},
-		},
-		{
-			input: pkg.Package{
-				Type: pkg.GemPkg,
-			},
-			expected: []string{
-				"from installed gem metadata file",
-			},
-		},
-		{
-			input: pkg.Package{
-				Type: pkg.GoModulePkg,
-			},
-			expected: []string{
-				"from go module information",
-			},
-		},
-		{
-			input: pkg.Package{
-				Type: pkg.RustPkg,
-			},
-			expected: []string{
-				"from rust cargo manifest",
-			},
-		},
-	}
-	var pkgTypes []pkg.Type
-	for _, test := range tests {
-		t.Run(test.name+" "+string(test.input.Type), func(t *testing.T) {
-			if test.input.Type != "" {
-				pkgTypes = append(pkgTypes, test.input.Type)
-			}
-			actual := SourceInfo(&test.input)
-			for _, expected := range test.expected {
-				assert.Contains(t, actual, expected)
-			}
-		})
-	}
-	assert.ElementsMatch(t, pkg.AllPkgs, pkgTypes, "missing one or more package types to test against (maybe a package type was added?)")
-}

internal/formats/formats.go

@@ -1,33 +0,0 @@
-package formats
-
-import (
-	"github.com/anchore/syft/internal/formats/spdx22json"
-	"github.com/anchore/syft/internal/formats/syftjson"
-	"github.com/anchore/syft/syft/format"
-)
-
-// TODO: eventually this is the source of truth for all formatters
-func All() []format.Format {
-	return []format.Format{
-		spdx22json.Format(),
-		syftjson.Format(),
-	}
-}
-
-func Identify(by []byte) (*format.Format, error) {
-	for _, f := range All() {
-		if f.Detect(by) {
-			return &f, nil
-		}
-	}
-	return nil, nil
-}
-
-func ByOption(option format.Option) *format.Format {
-	for _, f := range All() {
-		if f.Option == option {
-			return &f
-		}
-	}
-	return nil
-}

internal/formats/formats_test.go

@@ -1,39 +0,0 @@
-package formats
-
-import (
-	"io"
-	"os"
-	"testing"
-
-	"github.com/anchore/syft/syft/format"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestIdentify(t *testing.T) {
-
-	tests := []struct {
-		fixture  string
-		expected format.Option
-	}{
-		{
-			fixture:  "test-fixtures/alpine-syft.json",
-			expected: format.JSONOption,
-		},
-		{
-			fixture:  "test-fixtures/alpine-syft-spdx.json",
-			expected: format.SPDXJSONOption,
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.fixture, func(t *testing.T) {
-			f, err := os.Open(test.fixture)
-			assert.NoError(t, err)
-			by, err := io.ReadAll(f)
-			assert.NoError(t, err)
-			frmt, err := Identify(by)
-			assert.NoError(t, err)
-			assert.NotNil(t, frmt)
-			assert.Equal(t, test.expected, frmt.Option)
-		})
-	}
-}

internal/formats/spdx22json/decoder.go

@@ -1,24 +0,0 @@
-package spdx22json
-
-import (
-	"encoding/json"
-	"fmt"
-	"io"
-
-	"github.com/anchore/syft/internal/formats/spdx22json/model"
-	"github.com/anchore/syft/syft/distro"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
-)
-
-func decoder(reader io.Reader) (*pkg.Catalog, *source.Metadata, *distro.Distro, error) {
-	dec := json.NewDecoder(reader)
-
-	var doc model.Document
-	err := dec.Decode(&doc)
-	if err != nil {
-		return nil, nil, nil, fmt.Errorf("unable to decode spdx-json: %w", err)
-	}
-
-	return toSyftModel(doc)
-}

internal/formats/spdx22json/decoder_test.go

@@ -1,50 +0,0 @@
-package spdx22json
-
-import (
-	"bytes"
-	"strings"
-	"testing"
-
-	"github.com/anchore/syft/internal/formats/common/testutils"
-	"github.com/go-test/deep"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestEncodeDecodeCycle(t *testing.T) {
-	testImage := "image-simple"
-	originalCatalog, originalMetadata, _ := testutils.ImageInput(t, testImage)
-
-	var buf bytes.Buffer
-	assert.NoError(t, encoder(&buf, originalCatalog, &originalMetadata, nil))
-
-	actualCatalog, actualMetadata, _, err := decoder(bytes.NewReader(buf.Bytes()))
-	assert.NoError(t, err)
-
-	for _, d := range deep.Equal(originalMetadata, *actualMetadata) {
-		t.Errorf("metadata difference: %+v", d)
-	}
-
-	actualPackages := actualCatalog.Sorted()
-	for idx, p := range originalCatalog.Sorted() {
-		if !assert.Equal(t, p.Name, actualPackages[idx].Name) {
-			t.Errorf("different package at idx=%d: %s vs %s", idx, p.Name, actualPackages[idx].Name)
-			continue
-		}
-
-		// ids will never be equal
-		p.ID = ""
-		actualPackages[idx].ID = ""
-
-		for _, d := range deep.Equal(*p, *actualPackages[idx]) {
-			if strings.Contains(d, ".VirtualPath: ") {
-				// location.Virtual path is not exposed in the json output
-				continue
-			}
-			if strings.HasSuffix(d, "<nil slice> != []") {
-				// semantically the same
-				continue
-			}
-			t.Errorf("package difference (%s): %+v", p.Name, d)
-		}
-	}
-}

internal/formats/spdx22json/encoder.go

@@ -1,24 +0,0 @@
-package spdx22json
-
-import (
-	"encoding/json"
-	"io"
-
-	"github.com/anchore/syft/syft/distro"
-
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
-)
-
-const anchoreNamespace = "https://anchore.com/syft"
-
-func encoder(output io.Writer, catalog *pkg.Catalog, srcMetadata *source.Metadata, d *distro.Distro) error {
-	doc := toFormatModel(catalog, srcMetadata, d)
-
-	enc := json.NewEncoder(output)
-	// prevent > and < from being escaped in the payload
-	enc.SetEscapeHTML(false)
-	enc.SetIndent("", " ")
-
-	return enc.Encode(&doc)
-}

internal/formats/spdx22json/format.go

@@ -1,12 +0,0 @@
-package spdx22json
-
-import "github.com/anchore/syft/syft/format"
-
-func Format() format.Format {
-	return format.NewFormat(
-		format.SPDXJSONOption,
-		encoder,
-		decoder,
-		validator,
-	)
-}

internal/formats/spdx22json/model/syft_distro_data.go

@@ -1,7 +0,0 @@
-package model
-
-type SyftDistroData struct {
-	Name    string `json:"name"`    // Name of the Linux distribution
-	Version string `json:"version"` // Version of the Linux distribution (major or major.minor version)
-	IDLike  string `json:"idLike"`  // the ID_LIKE field found within the /etc/os-release file
-}

internal/formats/spdx22json/model/syft_package_data.go

@@ -1,115 +0,0 @@
-package model
-
-import (
-	"encoding/json"
-	"fmt"
-
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
-)
-
-type SyftPackageData struct {
-	SyftPackageBasicData
-	SyftPackageCustomData
-}
-
-type SyftPackageCustomData struct {
-	MetadataType pkg.MetadataType `json:"metadataType,omitempty"`
-	Metadata     interface{}      `json:"metadata,omitempty"`
-}
-
-type SyftPackageBasicData struct {
-	PackageType pkg.Type          `json:"type,omitempty"`
-	FoundBy     string            `json:"foundBy,omitempty"`
-	Locations   []source.Location `json:"locations,omitempty"`
-	Licenses    []string          `json:"licenses,omitempty"`
-	Language    pkg.Language      `json:"language,omitempty"`
-}
-
-// syftPackageMetadataUnpacker is all values needed from Package to disambiguate ambiguous fields during json unmarshaling.
-type syftPackageMetadataUnpacker struct {
-	MetadataType pkg.MetadataType `json:"metadataType"`
-	Metadata     json.RawMessage  `json:"metadata"`
-}
-
-func (p *syftPackageMetadataUnpacker) String() string {
-	return fmt.Sprintf("metadataType: %s, metadata: %s", p.MetadataType, string(p.Metadata))
-}
-
-// UnmarshalJSON is a custom unmarshaller for handling basic values and values with ambiguous types.
-// nolint:funlen
-func (p *SyftPackageData) UnmarshalJSON(b []byte) error {
-	var basic SyftPackageBasicData
-	if err := json.Unmarshal(b, &basic); err != nil {
-		return err
-	}
-	p.SyftPackageBasicData = basic
-
-	var unpacker syftPackageMetadataUnpacker
-	if err := json.Unmarshal(b, &unpacker); err != nil {
-		log.Warnf("failed to unmarshall into syftPackageMetadataUnpacker: %v", err)
-		return err
-	}
-
-	p.MetadataType = unpacker.MetadataType
-
-	switch p.MetadataType {
-	case pkg.ApkMetadataType:
-		var payload pkg.ApkMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.RpmdbMetadataType:
-		var payload pkg.RpmdbMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.DpkgMetadataType:
-		var payload pkg.DpkgMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.JavaMetadataType:
-		var payload pkg.JavaMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.RustCargoPackageMetadataType:
-		var payload pkg.CargoPackageMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.GemMetadataType:
-		var payload pkg.GemMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.KbPackageMetadataType:
-		var payload pkg.KbPackageMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.PythonPackageMetadataType:
-		var payload pkg.PythonPackageMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.NpmPackageJSONMetadataType:
-		var payload pkg.NpmPackageJSONMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	}
-
-	return nil
-}

internal/formats/spdx22json/test-fixtures/image-simple/Dockerfile

@@ -1,4 +0,0 @@
-# Note: changes to this file will result in updating several test values. Consider making a new image fixture instead of editing this one.
-FROM scratch
-ADD file-1.txt /somefile-1.txt
-ADD file-2.txt /somefile-2.txt

internal/formats/spdx22json/test-fixtures/image-simple/file-1.txt

@@ -1 +0,0 @@
-this file has contents

internal/formats/spdx22json/test-fixtures/image-simple/file-2.txt

@@ -1 +0,0 @@
-file-2 contents!

internal/formats/spdx22json/test-fixtures/snapshot/TestSPDXJSONImagePresenter.golden

@@ -1,140 +0,0 @@
-{
- "SPDXID": "SPDXRef-DOCUMENT",
- "name": "user-image-input",
- "spdxVersion": "SPDX-2.2",
- "creationInfo": {
-  "created": "2021-10-11T01:54:40.61361Z",
-  "creators": [
-   "Organization: Anchore, Inc",
-   "Tool: syft-[not provided]"
-  ],
-  "licenseListVersion": "3.14"
- },
- "syftSourceData": {
-  "Scheme": "ImageScheme",
-  "ImageMetadata": {
-   "userInput": "user-image-input",
-   "imageID": "sha256:2480160b55bec40c44d3b145c7b2c1c47160db8575c3dcae086d76b9370ae7ca",
-   "manifestDigest": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368",
-   "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
-   "tags": [
-    "stereoscope-fixture-image-simple:85066c51088bdd274f7a89e99e00490f666c49e72ffc955707cd6e18f0e22c5b"
-   ],
-   "imageSize": 38,
-   "layers": [
-    {
-     "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59",
-     "size": 22
-    },
-    {
-     "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec",
-     "size": 16
-    }
-   ],
-   "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NjcsImRpZ2VzdCI6InNoYTI1NjoyNDgwMTYwYjU1YmVjNDBjNDRkM2IxNDVjN2IyYzFjNDcxNjBkYjg1NzVjM2RjYWUwODZkNzZiOTM3MGFlN2NhIn0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1NjpmYjZiZWVjYjc1YjM5ZjRiYjgxM2RiZjE3N2U1MDFlZGQ1ZGRiM2U2OWJiNDVjZWRlYjc4YzY3NmVlMWI3YTU5In0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2OjMxOWI1ODhjZTY0MjUzYTg3YjUzM2M4ZWQwMWNmMDAyNWUwZWFjOThlN2I1MTZlMTI1MzI5NTdlMTI0NGZkZWMifV19",
-   "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8iLCJPbkJ1aWxkIjpudWxsfSwiY3JlYXRlZCI6IjIwMjEtMTAtMDRUMTE6NDA6MDAuNjM4Mzk0NVoiLCJoaXN0b3J5IjpbeyJjcmVhdGVkIjoiMjAyMS0xMC0wNFQxMTo0MDowMC41OTA3MzE2WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0xLnR4dCAvc29tZWZpbGUtMS50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn0seyJjcmVhdGVkIjoiMjAyMS0xMC0wNFQxMTo0MDowMC42MzgzOTQ1WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0yLnR4dCAvc29tZWZpbGUtMi50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6ZmI2YmVlY2I3NWIzOWY0YmI4MTNkYmYxNzdlNTAxZWRkNWRkYjNlNjliYjQ1Y2VkZWI3OGM2NzZlZTFiN2E1OSIsInNoYTI1NjozMTliNTg4Y2U2NDI1M2E4N2I1MzNjOGVkMDFjZjAwMjVlMGVhYzk4ZTdiNTE2ZTEyNTMyOTU3ZTEyNDRmZGVjIl19fQ==",
-   "repoDigests": []
-  },
-  "Path": ""
- },
- "syftDistroData": {
-  "name": "debian",
-  "version": "1.2.3",
-  "idLike": "like!"
- },
- "dataLicense": "CC0-1.0",
- "documentNamespace": "https:/anchore.com/syft/image/user-image-input-9badd1fb-a067-4207-addf-243c5b7705fe",
- "packages": [
-  {
-   "SPDXID": "SPDXRef-Package-python-package-1-1.0.1",
-   "name": "package-1",
-   "licenseConcluded": "MIT",
-   "downloadLocation": "NOASSERTION",
-   "externalRefs": [
-    {
-     "referenceCategory": "SECURITY",
-     "referenceLocator": "cpe:2.3:*:some:package:1:*:*:*:*:*:*:*",
-     "referenceType": "cpe23Type"
-    },
-    {
-     "referenceCategory": "PACKAGE_MANAGER",
-     "referenceLocator": "a-purl-1",
-     "referenceType": "purl"
-    }
-   ],
-   "filesAnalyzed": false,
-   "licenseDeclared": "MIT",
-   "sourceInfo": "acquired package info from installed python package manifest file: /somefile-1.txt",
-   "versionInfo": "1.0.1",
-   "syftPackageData": {
-    "type": "python",
-    "foundBy": "the-cataloger-1",
-    "locations": [
-     {
-      "path": "/somefile-1.txt",
-      "layerID": "sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59"
-     }
-    ],
-    "licenses": [
-     "MIT"
-    ],
-    "language": "python",
-    "metadataType": "PythonPackageMetadata",
-    "metadata": {
-     "name": "package-1",
-     "version": "1.0.1",
-     "license": "",
-     "author": "",
-     "authorEmail": "",
-     "platform": "",
-     "sitePackagesRootPath": ""
-    }
-   }
-  },
-  {
-   "SPDXID": "SPDXRef-Package-deb-package-2-2.0.1",
-   "name": "package-2",
-   "licenseConcluded": "NONE",
-   "downloadLocation": "NOASSERTION",
-   "externalRefs": [
-    {
-     "referenceCategory": "SECURITY",
-     "referenceLocator": "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*",
-     "referenceType": "cpe23Type"
-    },
-    {
-     "referenceCategory": "PACKAGE_MANAGER",
-     "referenceLocator": "a-purl-2",
-     "referenceType": "purl"
-    }
-   ],
-   "filesAnalyzed": false,
-   "licenseDeclared": "NONE",
-   "sourceInfo": "acquired package info from DPKG DB: /somefile-2.txt",
-   "versionInfo": "2.0.1",
-   "syftPackageData": {
-    "type": "deb",
-    "foundBy": "the-cataloger-2",
-    "locations": [
-     {
-      "path": "/somefile-2.txt",
-      "layerID": "sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec"
-     }
-    ],
-    "metadataType": "DpkgMetadata",
-    "metadata": {
-     "package": "package-2",
-     "source": "",
-     "version": "2.0.1",
-     "sourceVersion": "",
-     "architecture": "",
-     "maintainer": "",
-     "installedSize": 0,
-     "files": null
-    }
-   }
-  }
- ]
-}

internal/formats/spdx22json/to_format_model.go

@@ -1,164 +0,0 @@
-package spdx22json
-
-import (
-	"fmt"
-	"path"
-	"strings"
-	"time"
-
-	"github.com/anchore/syft/syft/distro"
-
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/formats/common/spdxhelpers"
-	"github.com/anchore/syft/internal/formats/spdx22json/model"
-	"github.com/anchore/syft/internal/spdxlicense"
-	"github.com/anchore/syft/internal/version"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
-	"github.com/google/uuid"
-)
-
-// toFormatModel creates and populates a new JSON document struct that follows the SPDX 2.2 spec from the given cataloging results.
-func toFormatModel(catalog *pkg.Catalog, srcMetadata *source.Metadata, d *distro.Distro) model.Document {
-	name := documentName(srcMetadata)
-	packages, files, relationships := extractFromCatalog(catalog)
-
-	return model.Document{
-		Element: model.Element{
-			SPDXID: model.ElementID("DOCUMENT").String(),
-			Name:   name,
-		},
-		SPDXVersion: model.Version,
-		CreationInfo: model.CreationInfo{
-			Created: time.Now().UTC(),
-			Creators: []string{
-				// note: key-value format derived from the JSON example document examples: https://github.com/spdx/spdx-spec/blob/v2.2/examples/SPDXJSONExample-v2.2.spdx.json
-				"Organization: Anchore, Inc",
-				"Tool: " + internal.ApplicationName + "-" + version.FromBuild().Version,
-			},
-			LicenseListVersion: spdxlicense.Version,
-		},
-		DataLicense:       "CC0-1.0",
-		DocumentNamespace: documentNamespace(name, srcMetadata),
-		Packages:          packages,
-		Files:             files,
-		Relationships:     relationships,
-		SyftSourceData:    srcMetadata,
-		SyftDistroData:    toSyftDistroData(d),
-	}
-}
-
-func toSyftDistroData(d *distro.Distro) *model.SyftDistroData {
-	if d == nil {
-		return nil
-	}
-	return &model.SyftDistroData{
-		Name:    d.Name(),
-		Version: d.FullVersion(),
-		IDLike:  d.IDLike,
-	}
-}
-
-func documentName(srcMetadata *source.Metadata) string {
-	if srcMetadata != nil {
-		switch srcMetadata.Scheme {
-		case source.ImageScheme:
-			return cleanSPDXName(srcMetadata.ImageMetadata.UserInput)
-		case source.DirectoryScheme:
-			return cleanSPDXName(srcMetadata.Path)
-		}
-	}
-	// TODO: is this alright?
-	return uuid.Must(uuid.NewRandom()).String()
-}
-
-func documentNamespace(name string, srcMetadata *source.Metadata) string {
-	input := "unknown-source-type"
-	if srcMetadata != nil {
-		switch srcMetadata.Scheme {
-		case source.ImageScheme:
-			input = "image"
-		case source.DirectoryScheme:
-			input = "dir"
-		}
-	}
-
-	uniqueID := uuid.Must(uuid.NewRandom())
-	identifier := path.Join(input, uniqueID.String())
-	if name != "." {
-		identifier = path.Join(input, fmt.Sprintf("%s-%s", name, uniqueID.String()))
-	}
-
-	return path.Join(anchoreNamespace, identifier)
-}
-
-func extractFromCatalog(catalog *pkg.Catalog) ([]model.Package, []model.File, []model.Relationship) {
-	packages := make([]model.Package, 0)
-	relationships := make([]model.Relationship, 0)
-	files := make([]model.File, 0)
-
-	for _, p := range catalog.Sorted() {
-		license := spdxhelpers.License(p)
-		packageSpdxID := model.ElementID(fmt.Sprintf("Package-%+v-%s-%s", p.Type, p.Name, p.Version)).String()
-
-		packageFiles, fileIDs, packageFileRelationships := spdxhelpers.Files(packageSpdxID, p)
-		files = append(files, packageFiles...)
-
-		relationships = append(relationships, packageFileRelationships...)
-
-		// note: the license concluded and declared should be the same since we are collecting license information
-		// from the project data itself (the installed package files).
-		packages = append(packages, model.Package{
-			Description:      spdxhelpers.Description(p),
-			DownloadLocation: spdxhelpers.DownloadLocation(p),
-			ExternalRefs:     spdxhelpers.ExternalRefs(p),
-			FilesAnalyzed:    false,
-			HasFiles:         fileIDs,
-			Homepage:         spdxhelpers.Homepage(p),
-			LicenseDeclared:  license, // The Declared License is what the authors of a project believe govern the package
-			Originator:       spdxhelpers.Originator(p),
-			SourceInfo:       spdxhelpers.SourceInfo(p),
-			VersionInfo:      p.Version,
-			Item: model.Item{
-				LicenseConcluded: license, // The Concluded License field is the license the SPDX file creator believes governs the package
-				Element: model.Element{
-					SPDXID: packageSpdxID,
-					Name:   p.Name,
-				},
-			},
-			SyftPackageData: toSyftPackageData(p),
-		})
-	}
-
-	return packages, files, relationships
-}
-
-func toSyftPackageData(p *pkg.Package) *model.SyftPackageData {
-	if p == nil {
-		return nil
-	}
-	return &model.SyftPackageData{
-		SyftPackageBasicData: model.SyftPackageBasicData{
-			PackageType: p.Type,
-			FoundBy:     p.FoundBy,
-			Locations:   p.Locations,
-			Language:    p.Language,
-			Licenses:    p.Licenses,
-		},
-		SyftPackageCustomData: model.SyftPackageCustomData{
-			MetadataType: p.MetadataType,
-			Metadata:     p.Metadata,
-		},
-	}
-}
-
-func cleanSPDXName(name string) string {
-	// remove # according to specification
-	name = strings.ReplaceAll(name, "#", "-")
-
-	// remove : for url construction
-	name = strings.ReplaceAll(name, ":", "-")
-
-	// clean relative pathing
-	return path.Clean(name)
-}

internal/formats/spdx22json/to_syft_model.go

@@ -1,64 +0,0 @@
-package spdx22json
-
-import (
-	"github.com/anchore/syft/internal/formats/common/spdxhelpers"
-	"github.com/anchore/syft/internal/formats/spdx22json/model"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/distro"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
-)
-
-func toSyftModel(doc model.Document) (*pkg.Catalog, *source.Metadata, *distro.Distro, error) {
-	d, err := toSyftDistro(doc.SyftDistroData)
-	if err != nil {
-		log.Warnf("unable to parse distro info=%+v: %+v", d, err)
-		d = nil
-	}
-
-	return toSyftCatalog(doc.Packages), doc.SyftSourceData, d, nil
-}
-
-func toSyftCatalog(pkgs []model.Package) *pkg.Catalog {
-	catalog := pkg.NewCatalog()
-	for _, p := range pkgs {
-		catalog.Add(toSyftPackage(p))
-	}
-	return catalog
-}
-
-func toSyftPackage(p model.Package) pkg.Package {
-	syftPkg := pkg.Package{
-		Name:    p.Name,
-		Version: p.VersionInfo,
-		CPEs:    spdxhelpers.ExtractCPEs(p.ExternalRefs),
-		PURL:    spdxhelpers.ExtractPURL(p.ExternalRefs),
-	}
-
-	if extra := p.SyftPackageData; extra != nil {
-		syftPkg.Type = extra.PackageType
-		syftPkg.FoundBy = extra.FoundBy
-		syftPkg.Locations = extra.Locations
-		syftPkg.Language = extra.Language
-		syftPkg.Licenses = extra.Licenses
-		syftPkg.MetadataType = extra.MetadataType
-		syftPkg.Metadata = extra.Metadata
-	}
-
-	//if syftPkg.Type == "" && syftPkg.PURL != "" {
-	//	// TODO: extract package type from purl --this is useful for ingesting from tools other than syft and is important for grype
-	//}
-
-	return syftPkg
-}
-
-func toSyftDistro(d *model.SyftDistroData) (*distro.Distro, error) {
-	if d == nil {
-		return nil, nil
-	}
-	newDistro, err := distro.NewDistro(distro.Type(d.Name), d.Version, d.IDLike)
-	if err != nil {
-		return nil, err
-	}
-	return &newDistro, nil
-}

internal/formats/spdx22json/validator.go

@@ -1,26 +0,0 @@
-package spdx22json
-
-import (
-	"encoding/json"
-	"fmt"
-	"io"
-)
-
-func validator(reader io.Reader) error {
-	type Document struct {
-		SPDXID string `json:"SPDXID"`
-	}
-
-	dec := json.NewDecoder(reader)
-
-	var doc Document
-	err := dec.Decode(&doc)
-	if err != nil {
-		return fmt.Errorf("unable to decode: %w", err)
-	}
-
-	if doc.SPDXID != "" {
-		return nil
-	}
-	return fmt.Errorf("could not extract document SPDXID")
-}

internal/formats/syftjson/decoder.go

@@ -1,24 +0,0 @@
-package syftjson
-
-import (
-	"encoding/json"
-	"fmt"
-	"io"
-
-	"github.com/anchore/syft/internal/formats/syftjson/model"
-	"github.com/anchore/syft/syft/distro"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
-)
-
-func decoder(reader io.Reader) (*pkg.Catalog, *source.Metadata, *distro.Distro, error) {
-	dec := json.NewDecoder(reader)
-
-	var doc model.Document
-	err := dec.Decode(&doc)
-	if err != nil {
-		return nil, nil, nil, fmt.Errorf("unable to decode syft-json: %w", err)
-	}
-
-	return toSyftModel(doc)
-}

internal/formats/syftjson/decoder_test.go

@@ -1,50 +0,0 @@
-package syftjson
-
-import (
-	"bytes"
-	"strings"
-	"testing"
-
-	"github.com/anchore/syft/internal/formats/common/testutils"
-	"github.com/go-test/deep"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestEncodeDecodeCycle(t *testing.T) {
-	testImage := "image-simple"
-	originalCatalog, originalMetadata, _ := testutils.ImageInput(t, testImage)
-
-	var buf bytes.Buffer
-	assert.NoError(t, encoder(&buf, originalCatalog, &originalMetadata, nil))
-
-	actualCatalog, actualMetadata, _, err := decoder(bytes.NewReader(buf.Bytes()))
-	assert.NoError(t, err)
-
-	for _, d := range deep.Equal(originalMetadata, *actualMetadata) {
-		t.Errorf("metadata difference: %+v", d)
-	}
-
-	actualPackages := actualCatalog.Sorted()
-	for idx, p := range originalCatalog.Sorted() {
-		if !assert.Equal(t, p.Name, actualPackages[idx].Name) {
-			t.Errorf("different package at idx=%d: %s vs %s", idx, p.Name, actualPackages[idx].Name)
-			continue
-		}
-
-		// ids will never be equal
-		p.ID = ""
-		actualPackages[idx].ID = ""
-
-		for _, d := range deep.Equal(*p, *actualPackages[idx]) {
-			if strings.Contains(d, ".VirtualPath: ") {
-				// location.Virtual path is not exposed in the json output
-				continue
-			}
-			if strings.HasSuffix(d, "<nil slice> != []") {
-				// semantically the same
-				continue
-			}
-			t.Errorf("package difference (%s): %+v", p.Name, d)
-		}
-	}
-}

internal/formats/syftjson/encoder.go

@@ -1,23 +0,0 @@
-package syftjson
-
-import (
-	"encoding/json"
-	"io"
-
-	"github.com/anchore/syft/syft/distro"
-
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
-)
-
-func encoder(output io.Writer, catalog *pkg.Catalog, srcMetadata *source.Metadata, d *distro.Distro) error {
-	// TODO: application config not available yet
-	doc := ToFormatModel(catalog, srcMetadata, d, nil)
-
-	enc := json.NewEncoder(output)
-	// prevent > and < from being escaped in the payload
-	enc.SetEscapeHTML(false)
-	enc.SetIndent("", " ")
-
-	return enc.Encode(&doc)
-}

internal/formats/syftjson/encoder_test.go

@@ -1,29 +0,0 @@
-package syftjson
-
-import (
-	"flag"
-	"testing"
-
-	"github.com/anchore/syft/internal/formats/common/testutils"
-	"github.com/anchore/syft/syft/format"
-)
-
-var updateJson = flag.Bool("update-json", false, "update the *.golden files for json presenters")
-
-func TestJSONDirectoryPresenter(t *testing.T) {
-	catalog, metadata, distro := testutils.DirectoryInput(t)
-	testutils.AssertPresenterAgainstGoldenSnapshot(t,
-		format.NewPresenter(encoder, catalog, &metadata, distro),
-		*updateJson,
-	)
-}
-
-func TestJSONImagePresenter(t *testing.T) {
-	testImage := "image-simple"
-	catalog, metadata, distro := testutils.ImageInput(t, testImage)
-	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
-		format.NewPresenter(encoder, catalog, &metadata, distro),
-		testImage,
-		*updateJson,
-	)
-}

internal/formats/syftjson/format.go

@@ -1,12 +0,0 @@
-package syftjson
-
-import "github.com/anchore/syft/syft/format"
-
-func Format() format.Format {
-	return format.NewFormat(
-		format.JSONOption,
-		encoder,
-		decoder,
-		validator,
-	)
-}

internal/formats/syftjson/model/distro.go

@@ -1,8 +0,0 @@
-package model
-
-// Distro provides information about a detected Linux Distro.
-type Distro struct {
-	Name    string `json:"name"`    // Name of the Linux distribution
-	Version string `json:"version"` // Version of the Linux distribution (major or major.minor version)
-	IDLike  string `json:"idLike"`  // the ID_LIKE field found within the /etc/os-release file
-}

internal/formats/syftjson/model/document.go

@@ -1,23 +0,0 @@
-package model
-
-// Document represents the syft cataloging findings as a JSON document
-type Document struct {
-	Artifacts             []Package      `json:"artifacts"` // Artifacts is the list of packages discovered and placed into the catalog
-	ArtifactRelationships []Relationship `json:"artifactRelationships"`
-	Source                Source         `json:"source"`     // Source represents the original object that was cataloged
-	Distro                Distro         `json:"distro"`     // Distro represents the Linux distribution that was detected from the source
-	Descriptor            Descriptor     `json:"descriptor"` // Descriptor is a block containing self-describing information about syft
-	Schema                Schema         `json:"schema"`     // Schema is a block reserved for defining the version for the shape of this JSON document and where to find the schema document to validate the shape
-}
-
-// Descriptor describes what created the document as well as surrounding metadata
-type Descriptor struct {
-	Name          string      `json:"name"`
-	Version       string      `json:"version"`
-	Configuration interface{} `json:"configuration,omitempty"`
-}
-
-type Schema struct {
-	Version string `json:"version"`
-	URL     string `json:"url"`
-}

internal/formats/syftjson/model/package.go

@@ -1,123 +0,0 @@
-package model
-
-import (
-	"encoding/json"
-	"fmt"
-
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
-)
-
-// Package represents a pkg.Package object specialized for JSON marshaling and unmarshaling.
-type Package struct {
-	PackageBasicData
-	PackageCustomData
-}
-
-// PackageBasicData contains non-ambiguous values (type-wise) from pkg.Package.
-type PackageBasicData struct {
-	ID        string            `json:"id"`
-	Name      string            `json:"name"`
-	Version   string            `json:"version"`
-	Type      pkg.Type          `json:"type"`
-	FoundBy   string            `json:"foundBy"`
-	Locations []source.Location `json:"locations"`
-	Licenses  []string          `json:"licenses"`
-	Language  pkg.Language      `json:"language"`
-	CPEs      []string          `json:"cpes"`
-	PURL      string            `json:"purl"`
-}
-
-// PackageCustomData contains ambiguous values (type-wise) from pkg.Package.
-type PackageCustomData struct {
-	MetadataType pkg.MetadataType `json:"metadataType"`
-	Metadata     interface{}      `json:"metadata"`
-}
-
-// packageMetadataUnpacker is all values needed from Package to disambiguate ambiguous fields during json unmarshaling.
-type packageMetadataUnpacker struct {
-	MetadataType pkg.MetadataType `json:"metadataType"`
-	Metadata     json.RawMessage  `json:"metadata"`
-}
-
-func (p *packageMetadataUnpacker) String() string {
-	return fmt.Sprintf("metadataType: %s, metadata: %s", p.MetadataType, string(p.Metadata))
-}
-
-// UnmarshalJSON is a custom unmarshaller for handling basic values and values with ambiguous types.
-// nolint:funlen
-func (p *Package) UnmarshalJSON(b []byte) error {
-	var basic PackageBasicData
-	if err := json.Unmarshal(b, &basic); err != nil {
-		return err
-	}
-	p.PackageBasicData = basic
-
-	var unpacker packageMetadataUnpacker
-	if err := json.Unmarshal(b, &unpacker); err != nil {
-		log.Warnf("failed to unmarshall into packageMetadataUnpacker: %v", err)
-		return err
-	}
-
-	p.MetadataType = unpacker.MetadataType
-
-	switch p.MetadataType {
-	case pkg.ApkMetadataType:
-		var payload pkg.ApkMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.RpmdbMetadataType:
-		var payload pkg.RpmdbMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.DpkgMetadataType:
-		var payload pkg.DpkgMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.JavaMetadataType:
-		var payload pkg.JavaMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.RustCargoPackageMetadataType:
-		var payload pkg.CargoPackageMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.GemMetadataType:
-		var payload pkg.GemMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.KbPackageMetadataType:
-		var payload pkg.KbPackageMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.PythonPackageMetadataType:
-		var payload pkg.PythonPackageMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.NpmPackageJSONMetadataType:
-		var payload pkg.NpmPackageJSONMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	}
-
-	return nil
-}

internal/formats/syftjson/model/relationship.go

@@ -1,8 +0,0 @@
-package model
-
-type Relationship struct {
-	Parent   string      `json:"parent"`
-	Child    string      `json:"child"`
-	Type     string      `json:"type"`
-	Metadata interface{} `json:"metadata"`
-}

internal/formats/syftjson/model/source.go

@@ -1,45 +0,0 @@
-package model
-
-import (
-	"encoding/json"
-	"fmt"
-
-	"github.com/anchore/syft/syft/source"
-)
-
-// Source object represents the thing that was cataloged
-type Source struct {
-	Type   string      `json:"type"`
-	Target interface{} `json:"target"`
-}
-
-// sourceUnpacker is used to unmarshal Source objects
-type sourceUnpacker struct {
-	Type   string          `json:"type"`
-	Target json.RawMessage `json:"target"`
-}
-
-// UnmarshalJSON populates a source object from JSON bytes.
-func (s *Source) UnmarshalJSON(b []byte) error {
-	var unpacker sourceUnpacker
-	if err := json.Unmarshal(b, &unpacker); err != nil {
-		return err
-	}
-
-	s.Type = unpacker.Type
-
-	switch s.Type {
-	case "directory":
-		s.Target = string(unpacker.Target[:])
-	case "image":
-		var payload source.ImageMetadata
-		if err := json.Unmarshal(unpacker.Target, &payload); err != nil {
-			return err
-		}
-		s.Target = payload
-	default:
-		return fmt.Errorf("unsupported package metadata type: %+v", s.Type)
-	}
-
-	return nil
-}

internal/formats/syftjson/test-fixtures/image-simple/Dockerfile

@@ -1,4 +0,0 @@
-# Note: changes to this file will result in updating several test values. Consider making a new image fixture instead of editing this one.
-FROM scratch
-ADD file-1.txt /somefile-1.txt
-ADD file-2.txt /somefile-2.txt

internal/formats/syftjson/test-fixtures/image-simple/file-1.txt

@@ -1 +0,0 @@
-this file has contents

internal/formats/syftjson/test-fixtures/image-simple/file-2.txt

@@ -1 +0,0 @@
-file-2 contents!

internal/formats/syftjson/test-fixtures/snapshot/TestJSONDirectoryPresenter.golden

@@ -1,86 +0,0 @@
-{
- "artifacts": [
-  {
-   "id": "package-1-id",
-   "name": "package-1",
-   "version": "1.0.1",
-   "type": "python",
-   "foundBy": "the-cataloger-1",
-   "locations": [
-    {
-     "path": "/some/path/pkg1"
-    }
-   ],
-   "licenses": [
-    "MIT"
-   ],
-   "language": "python",
-   "cpes": [
-    "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"
-   ],
-   "purl": "a-purl-2",
-   "metadataType": "PythonPackageMetadata",
-   "metadata": {
-    "name": "package-1",
-    "version": "1.0.1",
-    "license": "",
-    "author": "",
-    "authorEmail": "",
-    "platform": "",
-    "files": [
-     {
-      "path": "/some/path/pkg1/depedencies/foo"
-     }
-    ],
-    "sitePackagesRootPath": ""
-   }
-  },
-  {
-   "id": "package-2-id",
-   "name": "package-2",
-   "version": "2.0.1",
-   "type": "deb",
-   "foundBy": "the-cataloger-2",
-   "locations": [
-    {
-     "path": "/some/path/pkg1"
-    }
-   ],
-   "licenses": [],
-   "language": "",
-   "cpes": [
-    "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"
-   ],
-   "purl": "a-purl-2",
-   "metadataType": "DpkgMetadata",
-   "metadata": {
-    "package": "package-2",
-    "source": "",
-    "version": "2.0.1",
-    "sourceVersion": "",
-    "architecture": "",
-    "maintainer": "",
-    "installedSize": 0,
-    "files": null
-   }
-  }
- ],
- "artifactRelationships": [],
- "source": {
-  "type": "directory",
-  "target": "/some/path"
- },
- "distro": {
-  "name": "debian",
-  "version": "1.2.3",
-  "idLike": "like!"
- },
- "descriptor": {
-  "name": "syft",
-  "version": "[not provided]"
- },
- "schema": {
-  "version": "1.1.0",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-1.1.0.json"
- }
-}

internal/formats/syftjson/test-fixtures/snapshot/TestJSONImagePresenter.golden

@@ -1,108 +0,0 @@
-{
- "artifacts": [
-  {
-   "id": "package-1-id",
-   "name": "package-1",
-   "version": "1.0.1",
-   "type": "python",
-   "foundBy": "the-cataloger-1",
-   "locations": [
-    {
-     "path": "/somefile-1.txt",
-     "layerID": "sha256:ffb5e9eaa453a002110719d12c294960117ca2903953d1faa40f01dc3f77045c"
-    }
-   ],
-   "licenses": [
-    "MIT"
-   ],
-   "language": "python",
-   "cpes": [
-    "cpe:2.3:*:some:package:1:*:*:*:*:*:*:*"
-   ],
-   "purl": "a-purl-1",
-   "metadataType": "PythonPackageMetadata",
-   "metadata": {
-    "name": "package-1",
-    "version": "1.0.1",
-    "license": "",
-    "author": "",
-    "authorEmail": "",
-    "platform": "",
-    "sitePackagesRootPath": ""
-   }
-  },
-  {
-   "id": "package-2-id",
-   "name": "package-2",
-   "version": "2.0.1",
-   "type": "deb",
-   "foundBy": "the-cataloger-2",
-   "locations": [
-    {
-     "path": "/somefile-2.txt",
-     "layerID": "sha256:8463854829fc53d47b9dcdf7ee79fe7eb4ca7933c910f67f8521412f7a2f5c21"
-    }
-   ],
-   "licenses": [],
-   "language": "",
-   "cpes": [
-    "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"
-   ],
-   "purl": "a-purl-2",
-   "metadataType": "DpkgMetadata",
-   "metadata": {
-    "package": "package-2",
-    "source": "",
-    "version": "2.0.1",
-    "sourceVersion": "",
-    "architecture": "",
-    "maintainer": "",
-    "installedSize": 0,
-    "files": null
-   }
-  }
- ],
- "artifactRelationships": [],
- "source": {
-  "type": "image",
-  "target": {
-   "userInput": "user-image-input",
-   "imageID": "sha256:112851310e48e604f7379e2a3acddab50e91ce926edacb598a532e60ff6b776a",
-   "manifestDigest": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368",
-   "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
-   "tags": [
-    "stereoscope-fixture-image-simple:85066c51088bdd274f7a89e99e00490f666c49e72ffc955707cd6e18f0e22c5b"
-   ],
-   "imageSize": 38,
-   "layers": [
-    {
-     "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:ffb5e9eaa453a002110719d12c294960117ca2903953d1faa40f01dc3f77045c",
-     "size": 22
-    },
-    {
-     "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:8463854829fc53d47b9dcdf7ee79fe7eb4ca7933c910f67f8521412f7a2f5c21",
-     "size": 16
-    }
-   ],
-   "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NzMsImRpZ2VzdCI6InNoYTI1NjoxMTI4NTEzMTBlNDhlNjA0ZjczNzllMmEzYWNkZGFiNTBlOTFjZTkyNmVkYWNiNTk4YTUzMmU2MGZmNmI3NzZhIn0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1NjpmZmI1ZTllYWE0NTNhMDAyMTEwNzE5ZDEyYzI5NDk2MDExN2NhMjkwMzk1M2QxZmFhNDBmMDFkYzNmNzcwNDVjIn0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2Ojg0NjM4NTQ4MjlmYzUzZDQ3YjlkY2RmN2VlNzlmZTdlYjRjYTc5MzNjOTEwZjY3Zjg1MjE0MTJmN2EyZjVjMjEifV19",
-   "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8iLCJPbkJ1aWxkIjpudWxsfSwiY3JlYXRlZCI6IjIwMjEtMDktMDhUMTc6MjE6NTguODk2NTI5MTkyWiIsImhpc3RvcnkiOlt7ImNyZWF0ZWQiOiIyMDIxLTA5LTA4VDE3OjIxOjU4Ljg3OTY5MDgyNFoiLCJjcmVhdGVkX2J5IjoiQUREIGZpbGUtMS50eHQgL3NvbWVmaWxlLTEudHh0ICMgYnVpbGRraXQiLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCJ9LHsiY3JlYXRlZCI6IjIwMjEtMDktMDhUMTc6MjE6NTguODk2NTI5MTkyWiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0yLnR4dCAvc29tZWZpbGUtMi50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6ZmZiNWU5ZWFhNDUzYTAwMjExMDcxOWQxMmMyOTQ5NjAxMTdjYTI5MDM5NTNkMWZhYTQwZjAxZGMzZjc3MDQ1YyIsInNoYTI1Njo4NDYzODU0ODI5ZmM1M2Q0N2I5ZGNkZjdlZTc5ZmU3ZWI0Y2E3OTMzYzkxMGY2N2Y4NTIxNDEyZjdhMmY1YzIxIl19fQ==",
-   "repoDigests": [],
-   "scope": "Squashed"
-  }
- },
- "distro": {
-  "name": "debian",
-  "version": "1.2.3",
-  "idLike": "like!"
- },
- "descriptor": {
-  "name": "syft",
-  "version": "[not provided]"
- },
- "schema": {
-  "version": "1.1.0",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-1.1.0.json"
- }
-}

internal/formats/syftjson/to_format_model.go

@@ -1,135 +0,0 @@
-package syftjson
-
-import (
-	"fmt"
-
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/formats/syftjson/model"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/version"
-	"github.com/anchore/syft/syft/distro"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
-)
-
-//// NewJSONDocument creates and populates a new JSON document struct from the given cataloging results.
-//func NewJSONDocument(catalog *pkg.Catalog, srcMetadata source.Metadata, d *distro.Distro, scope source.Scope, configuration interface{}) (Document, error) {
-//
-//}
-
-// TODO: this is export4ed for the use of the power-user command (temp)
-func ToFormatModel(catalog *pkg.Catalog, srcMetadata *source.Metadata, d *distro.Distro, applicationConfig interface{}) model.Document {
-	src, err := toSourceModel(srcMetadata)
-	if err != nil {
-		log.Warnf("unable to create syft-json source object: %+v", err)
-	}
-
-	return model.Document{
-		Artifacts:             toPackageModels(catalog),
-		ArtifactRelationships: toRelationshipModel(pkg.NewRelationships(catalog)),
-		Source:                src,
-		Distro:                toDistroModel(d),
-		Descriptor: model.Descriptor{
-			Name:          internal.ApplicationName,
-			Version:       version.FromBuild().Version,
-			Configuration: applicationConfig,
-		},
-		Schema: model.Schema{
-			Version: internal.JSONSchemaVersion,
-			URL:     fmt.Sprintf("https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-%s.json", internal.JSONSchemaVersion),
-		},
-	}
-}
-
-func toPackageModels(catalog *pkg.Catalog) []model.Package {
-	artifacts := make([]model.Package, 0)
-	if catalog == nil {
-		return artifacts
-	}
-	for _, p := range catalog.Sorted() {
-		artifacts = append(artifacts, toPackageModel(p))
-	}
-	return artifacts
-}
-
-// toPackageModel crates a new Package from the given pkg.Package.
-func toPackageModel(p *pkg.Package) model.Package {
-	var cpes = make([]string, len(p.CPEs))
-	for i, c := range p.CPEs {
-		cpes[i] = c.BindToFmtString()
-	}
-
-	// ensure collections are never nil for presentation reasons
-	var locations = make([]source.Location, 0)
-	if p.Locations != nil {
-		locations = p.Locations
-	}
-
-	var licenses = make([]string, 0)
-	if p.Licenses != nil {
-		licenses = p.Licenses
-	}
-
-	return model.Package{
-		PackageBasicData: model.PackageBasicData{
-			ID:        string(p.ID),
-			Name:      p.Name,
-			Version:   p.Version,
-			Type:      p.Type,
-			FoundBy:   p.FoundBy,
-			Locations: locations,
-			Licenses:  licenses,
-			Language:  p.Language,
-			CPEs:      cpes,
-			PURL:      p.PURL,
-		},
-		PackageCustomData: model.PackageCustomData{
-			MetadataType: p.MetadataType,
-			Metadata:     p.Metadata,
-		},
-	}
-}
-
-func toRelationshipModel(relationships []pkg.Relationship) []model.Relationship {
-	result := make([]model.Relationship, len(relationships))
-	for i, r := range relationships {
-		result[i] = model.Relationship{
-			Parent:   string(r.Parent),
-			Child:    string(r.Child),
-			Type:     string(r.Type),
-			Metadata: r.Metadata,
-		}
-	}
-	return result
-}
-
-// toSourceModel creates a new source object to be represented into JSON.
-func toSourceModel(src *source.Metadata) (model.Source, error) {
-	switch src.Scheme {
-	case source.ImageScheme:
-		return model.Source{
-			Type:   "image",
-			Target: src.ImageMetadata,
-		}, nil
-	case source.DirectoryScheme:
-		return model.Source{
-			Type:   "directory",
-			Target: src.Path,
-		}, nil
-	default:
-		return model.Source{}, fmt.Errorf("unsupported source: %q", src.Scheme)
-	}
-}
-
-// toDistroModel creates a struct with the Linux distribution to be represented in JSON.
-func toDistroModel(d *distro.Distro) model.Distro {
-	if d == nil {
-		return model.Distro{}
-	}
-
-	return model.Distro{
-		Name:    d.Name(),
-		Version: d.FullVersion(),
-		IDLike:  d.IDLike,
-	}
-}

internal/formats/syftjson/to_syft_model.go

@@ -1,70 +0,0 @@
-package syftjson
-
-import (
-	"github.com/anchore/syft/internal/formats/syftjson/model"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/distro"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
-)
-
-func toSyftModel(doc model.Document) (*pkg.Catalog, *source.Metadata, *distro.Distro, error) {
-	dist, err := distro.NewDistro(distro.Type(doc.Distro.Name), doc.Distro.Version, doc.Distro.IDLike)
-	if err != nil {
-		return nil, nil, nil, err
-	}
-
-	return toSyftCatalog(doc.Artifacts), toSyftSourceMetadata(doc.Source), &dist, nil
-}
-
-func toSyftSourceMetadata(s model.Source) *source.Metadata {
-	switch s.Type {
-	case "directory":
-		return &source.Metadata{
-			Scheme: source.DirectoryScheme,
-			Path:   s.Target.(string),
-		}
-	case "image":
-		return &source.Metadata{
-			Scheme:        source.ImageScheme,
-			ImageMetadata: s.Target.(source.ImageMetadata),
-		}
-	}
-	return nil
-}
-
-func toSyftCatalog(pkgs []model.Package) *pkg.Catalog {
-	catalog := pkg.NewCatalog()
-	for _, p := range pkgs {
-		catalog.Add(toSyftPackage(p))
-	}
-	return catalog
-}
-
-func toSyftPackage(p model.Package) pkg.Package {
-	var cpes []pkg.CPE
-	for _, c := range p.CPEs {
-		value, err := pkg.NewCPE(c)
-		if err != nil {
-			log.Warnf("excluding invalid CPE %q: %v", c, err)
-			continue
-		}
-
-		cpes = append(cpes, value)
-	}
-
-	return pkg.Package{
-		ID:           pkg.ID(p.ID),
-		Name:         p.Name,
-		Version:      p.Version,
-		FoundBy:      p.FoundBy,
-		Locations:    p.Locations,
-		Licenses:     p.Licenses,
-		Language:     p.Language,
-		Type:         p.Type,
-		CPEs:         cpes,
-		PURL:         p.PURL,
-		MetadataType: p.MetadataType,
-		Metadata:     p.Metadata,
-	}
-}

internal/formats/syftjson/validator.go

@@ -1,31 +0,0 @@
-package syftjson
-
-import (
-	"encoding/json"
-	"fmt"
-	"io"
-	"strings"
-
-	"github.com/anchore/syft/internal/formats/syftjson/model"
-)
-
-func validator(reader io.Reader) error {
-	type Document struct {
-		Schema model.Schema `json:"schema"`
-	}
-
-	dec := json.NewDecoder(reader)
-
-	var doc Document
-	err := dec.Decode(&doc)
-	if err != nil {
-		return fmt.Errorf("unable to decode: %w", err)
-	}
-
-	// note: we accept al schema versions
-	// TODO: add per-schema version parsing
-	if strings.Contains(doc.Schema.URL, "anchore/syft") {
-		return nil
-	}
-	return fmt.Errorf("could not extract syft schema")
-}

internal/presenter/packages/cyclonedx_presenter_test.go

@@ -4,15 +4,13 @@ import (
 	"flag"
 	"regexp"
 	"testing"
-
-	"github.com/anchore/syft/internal/formats/common/testutils"
 )
 
 var updateCycloneDx = flag.Bool("update-cyclonedx", false, "update the *.golden files for cyclone-dx presenters")
 
 func TestCycloneDxDirectoryPresenter(t *testing.T) {
-	catalog, metadata, _ := testutils.DirectoryInput(t)
-	testutils.AssertPresenterAgainstGoldenSnapshot(t,
+	catalog, metadata, _ := presenterDirectoryInput(t)
+	assertPresenterAgainstGoldenSnapshot(t,
 		NewCycloneDxPresenter(catalog, metadata),
 		*updateCycloneDx,
 		cycloneDxRedactor,
@@ -21,8 +19,8 @@ func TestCycloneDxDirectoryPresenter(t *testing.T) {
 
 func TestCycloneDxImagePresenter(t *testing.T) {
 	testImage := "image-simple"
-	catalog, metadata, _ := testutils.ImageInput(t, testImage)
-	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
+	catalog, metadata, _ := presenterImageInput(t, testImage)
+	assertPresenterAgainstGoldenImageSnapshot(t,
 		NewCycloneDxPresenter(catalog, metadata),
 		testImage,
 		*updateCycloneDx,

internal/presenter/packages/json_distribution.go

@@ -0,0 +1,23 @@
+package packages
+
+import "github.com/anchore/syft/syft/distro"
+
+// JSONDistribution provides information about a detected Linux JSONDistribution.
+type JSONDistribution struct {
+	Name    string `json:"name"`    // Name of the Linux distribution
+	Version string `json:"version"` // Version of the Linux distribution (major or major.minor version)
+	IDLike  string `json:"idLike"`  // the ID_LIKE field found within the /etc/os-release file
+}
+
+// NewJSONDistribution creates a struct with the Linux distribution to be represented in JSON.
+func NewJSONDistribution(d *distro.Distro) JSONDistribution {
+	if d == nil {
+		return JSONDistribution{}
+	}
+
+	return JSONDistribution{
+		Name:    d.Name(),
+		Version: d.FullVersion(),
+		IDLike:  d.IDLike,
+	}
+}

internal/presenter/packages/json_document.go

@@ -0,0 +1,62 @@
+package packages
+
+import (
+	"fmt"
+
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/version"
+	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+// JSONDocument represents the syft cataloging findings as a JSON document
+type JSONDocument struct {
+	Artifacts             []JSONPackage      `json:"artifacts"` // Artifacts is the list of packages discovered and placed into the catalog
+	ArtifactRelationships []JSONRelationship `json:"artifactRelationships"`
+	Source                JSONSource         `json:"source"`     // Source represents the original object that was cataloged
+	Distro                JSONDistribution   `json:"distro"`     // Distro represents the Linux distribution that was detected from the source
+	Descriptor            JSONDescriptor     `json:"descriptor"` // Descriptor is a block containing self-describing information about syft
+	Schema                JSONSchema         `json:"schema"`     // Schema is a block reserved for defining the version for the shape of this JSON document and where to find the schema document to validate the shape
+}
+
+// NewJSONDocument creates and populates a new JSON document struct from the given cataloging results.
+func NewJSONDocument(catalog *pkg.Catalog, srcMetadata source.Metadata, d *distro.Distro, scope source.Scope, configuration interface{}) (JSONDocument, error) {
+	src, err := NewJSONSource(srcMetadata, scope)
+	if err != nil {
+		return JSONDocument{}, err
+	}
+
+	artifacts, err := NewJSONPackages(catalog)
+	if err != nil {
+		return JSONDocument{}, err
+	}
+
+	return JSONDocument{
+		Artifacts:             artifacts,
+		ArtifactRelationships: newJSONRelationships(pkg.NewRelationships(catalog)),
+		Source:                src,
+		Distro:                NewJSONDistribution(d),
+		Descriptor: JSONDescriptor{
+			Name:          internal.ApplicationName,
+			Version:       version.FromBuild().Version,
+			Configuration: configuration,
+		},
+		Schema: JSONSchema{
+			Version: internal.JSONSchemaVersion,
+			URL:     fmt.Sprintf("https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-%s.json", internal.JSONSchemaVersion),
+		},
+	}, nil
+}
+
+// JSONDescriptor describes what created the document as well as surrounding metadata
+type JSONDescriptor struct {
+	Name          string      `json:"name"`
+	Version       string      `json:"version"`
+	Configuration interface{} `json:"configuration,omitempty"`
+}
+
+type JSONSchema struct {
+	Version string `json:"version"`
+	URL     string `json:"url"`
+}

internal/presenter/packages/json_package.go

@@ -0,0 +1,71 @@
+package packages
+
+import (
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+// JSONPackage represents a pkg.Package object specialized for JSON marshaling and unmarshaling.
+type JSONPackage struct {
+	ID           string            `json:"id"`
+	Name         string            `json:"name"`
+	Version      string            `json:"version"`
+	Type         string            `json:"type"`
+	FoundBy      string            `json:"foundBy"`
+	Locations    []source.Location `json:"locations"`
+	Licenses     []string          `json:"licenses"`
+	Language     string            `json:"language"`
+	CPEs         []string          `json:"cpes"`
+	PURL         string            `json:"purl"`
+	MetadataType string            `json:"metadataType"`
+	Metadata     interface{}       `json:"metadata"`
+}
+
+func NewJSONPackages(catalog *pkg.Catalog) ([]JSONPackage, error) {
+	artifacts := make([]JSONPackage, 0)
+	if catalog == nil {
+		return artifacts, nil
+	}
+	for _, p := range catalog.Sorted() {
+		art, err := NewJSONPackage(p)
+		if err != nil {
+			return nil, err
+		}
+		artifacts = append(artifacts, art)
+	}
+	return artifacts, nil
+}
+
+// NewJSONPackage crates a new JSONPackage from the given pkg.Package.
+func NewJSONPackage(p *pkg.Package) (JSONPackage, error) {
+	var cpes = make([]string, len(p.CPEs))
+	for i, c := range p.CPEs {
+		cpes[i] = c.BindToFmtString()
+	}
+
+	// ensure collections are never nil for presentation reasons
+	var locations = make([]source.Location, 0)
+	if p.Locations != nil {
+		locations = p.Locations
+	}
+
+	var licenses = make([]string, 0)
+	if p.Licenses != nil {
+		licenses = p.Licenses
+	}
+
+	return JSONPackage{
+		ID:           string(p.ID),
+		Name:         p.Name,
+		Version:      p.Version,
+		Type:         string(p.Type),
+		FoundBy:      p.FoundBy,
+		Locations:    locations,
+		Licenses:     licenses,
+		Language:     string(p.Language),
+		CPEs:         cpes,
+		PURL:         p.PURL,
+		MetadataType: string(p.MetadataType),
+		Metadata:     p.Metadata,
+	}, nil
+}

internal/presenter/packages/json_presenter.go

@@ -0,0 +1,43 @@
+package packages
+
+import (
+	"encoding/json"
+	"io"
+
+	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+// JSONPresenter is a JSON presentation object for the syft results
+type JSONPresenter struct {
+	catalog     *pkg.Catalog
+	srcMetadata source.Metadata
+	distro      *distro.Distro
+	scope       source.Scope
+}
+
+// NewJSONPresenter creates a new JSON presenter object for the given cataloging results.
+func NewJSONPresenter(catalog *pkg.Catalog, s source.Metadata, d *distro.Distro, scope source.Scope) *JSONPresenter {
+	return &JSONPresenter{
+		catalog:     catalog,
+		srcMetadata: s,
+		distro:      d,
+		scope:       scope,
+	}
+}
+
+// Present the catalog results to the given writer.
+func (pres *JSONPresenter) Present(output io.Writer) error {
+	// we do not pass in configuration for backwards compatibility
+	doc, err := NewJSONDocument(pres.catalog, pres.srcMetadata, pres.distro, pres.scope, nil)
+	if err != nil {
+		return err
+	}
+
+	enc := json.NewEncoder(output)
+	// prevent > and < from being escaped in the payload
+	enc.SetEscapeHTML(false)
+	enc.SetIndent("", " ")
+	return enc.Encode(&doc)
+}

internal/presenter/packages/json_presenter_test.go

@@ -0,0 +1,37 @@
+package packages
+
+import (
+	"flag"
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+var updateJSONGoldenFiles = flag.Bool("update-json", false, "update the *.golden files for json presenters")
+
+func must(c pkg.CPE, e error) pkg.CPE {
+	if e != nil {
+		panic(e)
+	}
+	return c
+}
+
+func TestJSONDirectoryPresenter(t *testing.T) {
+	catalog, metadata, dist := presenterDirectoryInput(t)
+	assertPresenterAgainstGoldenSnapshot(t,
+		NewJSONPresenter(catalog, metadata, dist, source.SquashedScope),
+		*updateJSONGoldenFiles,
+	)
+
+}
+
+func TestJSONImagePresenter(t *testing.T) {
+	testImage := "image-simple"
+	catalog, metadata, dist := presenterImageInput(t, testImage)
+	assertPresenterAgainstGoldenImageSnapshot(t,
+		NewJSONPresenter(catalog, metadata, dist, source.SquashedScope),
+		testImage,
+		*updateJSONGoldenFiles,
+	)
+}

internal/presenter/packages/json_relationship.go

@@ -0,0 +1,23 @@
+package packages
+
+import "github.com/anchore/syft/syft/pkg"
+
+type JSONRelationship struct {
+	Parent   string      `json:"parent"`
+	Child    string      `json:"child"`
+	Type     string      `json:"type"`
+	Metadata interface{} `json:"metadata"`
+}
+
+func newJSONRelationships(relationships []pkg.Relationship) []JSONRelationship {
+	result := make([]JSONRelationship, len(relationships))
+	for i, r := range relationships {
+		result[i] = JSONRelationship{
+			Parent:   string(r.Parent),
+			Child:    string(r.Child),
+			Type:     string(r.Type),
+			Metadata: r.Metadata,
+		}
+	}
+	return result
+}

internal/presenter/packages/json_source.go

@@ -0,0 +1,39 @@
+package packages
+
+import (
+	"fmt"
+
+	"github.com/anchore/syft/syft/source"
+)
+
+// JSONSource object represents the thing that was cataloged
+type JSONSource struct {
+	Type   string      `json:"type"`
+	Target interface{} `json:"target"`
+}
+
+type JSONImageSource struct {
+	source.ImageMetadata
+	Scope source.Scope `json:"scope"`
+}
+
+// NewJSONSource creates a new source object to be represented into JSON.
+func NewJSONSource(src source.Metadata, scope source.Scope) (JSONSource, error) {
+	switch src.Scheme {
+	case source.ImageScheme:
+		return JSONSource{
+			Type: "image",
+			Target: JSONImageSource{
+				Scope:         scope,
+				ImageMetadata: src.ImageMetadata,
+			},
+		}, nil
+	case source.DirectoryScheme:
+		return JSONSource{
+			Type:   "directory",
+			Target: src.Path,
+		}, nil
+	default:
+		return JSONSource{}, fmt.Errorf("unsupported source: %q", src.Scheme)
+	}
+}

internal/presenter/packages/model/spdx22/annotation.go

@@ -1,4 +1,4 @@
-package model
+package spdx22
 
 import "time"
 

internal/presenter/packages/model/spdx22/checksum.go

@@ -1,4 +1,4 @@
-package model
+package spdx22
 
 type Checksum struct {
 	// Identifies the algorithm used to produce the subject Checksum. One of: "SHA256", "SHA1", "SHA384", "MD2", "MD4", "SHA512", "MD6", "MD5", "SHA224"

internal/presenter/packages/model/spdx22/creation_info.go

@@ -1,4 +1,4 @@
-package model
+package spdx22
 
 import "time"
 
@@ -10,7 +10,7 @@ type CreationInfo struct {
 	Created time.Time `json:"created"`
 	// Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an
 	// individual, indicate the person's name. If the SPDX file was created on behalf of a company or organization,
-	//indicate the entity name. If the SPDX file was created using a software tool, indicate the name and version
+	// indicate the entity name. If the SPDX file was created using a software tool, indicate the name and version
 	// for that tool. If multiple participants or tools were involved, use multiple instances of this field. Person
 	// name or organization name may be designated as “anonymous” if appropriate.
 	Creators []string `json:"creators"`

internal/presenter/packages/model/spdx22/document.go

@@ -1,6 +1,4 @@
-package model
-
-import "github.com/anchore/syft/syft/source"
+package spdx22
 
 // derived from:
 // - https://spdx.github.io/spdx-spec/appendix-III-RDF-data-model-implementation-and-identifier-syntax/
@@ -13,10 +11,6 @@ type Document struct {
 	// One instance is required for each SPDX file produced. It provides the necessary information for forward
 	// and backward compatibility for processing tools.
 	CreationInfo CreationInfo `json:"creationInfo"`
-	// SyftSourceData contains information about what is being described in this SPDX document (e.g. a container image, a directory, etc)
-	SyftSourceData *source.Metadata `json:"syftSourceData,omitempty"`
-	// SyftDistroData contains information about the linux distribution discovered
-	SyftDistroData *SyftDistroData `json:"syftDistroData,omitempty"`
 	// 2.2: Data License; should be "CC0-1.0"
 	// Cardinality: mandatory, one
 	// License expression for dataLicense.  Compliance with the SPDX specification includes populating the SPDX

internal/presenter/packages/model/spdx22/element.go

@@ -1,4 +1,4 @@
-package model
+package spdx22
 
 type Element struct {
 	SPDXID string `json:"SPDXID"`

internal/presenter/packages/model/spdx22/element_id.go

@@ -1,4 +1,4 @@
-package model
+package spdx22
 
 // ElementID represents the identifier string portion of an SPDX element
 // identifier. DocElementID should be used for any attributes which can

internal/presenter/packages/model/spdx22/external_document_ref.go

@@ -1,4 +1,4 @@
-package model
+package spdx22
 
 type ExternalDocumentRef struct {
 	// externalDocumentId is a string containing letters, numbers, ., - and/or + which uniquely identifies an external document within this document.

internal/presenter/packages/model/spdx22/external_ref.go

@@ -1,4 +1,4 @@
-package model
+package spdx22
 
 type ReferenceCategory string
 

internal/presenter/packages/model/spdx22/file.go

@@ -1,4 +1,4 @@
-package model
+package spdx22
 
 type FileType string
 

internal/presenter/packages/model/spdx22/has_extracted_licensing_info.go

@@ -1,4 +1,4 @@
-package model
+package spdx22
 
 type HasExtractedLicensingInfo struct {
 	// Verbatim license or licensing notice text that was discovered.

internal/presenter/packages/model/spdx22/item.go

@@ -1,4 +1,4 @@
-package model
+package spdx22
 
 type Item struct {
 	Element

internal/presenter/packages/model/spdx22/package.go

@@ -1,4 +1,4 @@
-package model
+package spdx22
 
 type Package struct {
 	Item
@@ -47,7 +47,4 @@ type Package struct {
 	Supplier string `json:"supplier,omitempty"`
 	// Provides an indication of the version of the package that is described by this SpdxDocument.
 	VersionInfo string `json:"versionInfo,omitempty"`
-	// SyftPackageData provides a spot to add syft-specific data that is not available in-spec or is not easily decodable from
-	// other SPDX fields.
-	SyftPackageData *SyftPackageData `json:"syftPackageData,omitempty"`
 }

internal/presenter/packages/model/spdx22/package_verification_code.go

@@ -1,4 +1,4 @@
-package model
+package spdx22
 
 // Why are there two package identifier fields Package Checksum and Package Verification?
 // Although the values of the two fields Package Checksum and Package Verification are similar, they each serve a

internal/presenter/packages/model/spdx22/relationship.go

@@ -1,4 +1,4 @@
-package model
+package spdx22
 
 type Relationship struct {
 	// Id to which the SPDX element is related

internal/presenter/packages/model/spdx22/snippet.go

@@ -1,4 +1,4 @@
-package model
+package spdx22
 
 type StartPointer struct {
 	Offset     int `json:"offset,omitempty"`

internal/presenter/packages/model/spdx22/version.go

@@ -1,3 +1,3 @@
-package model
+package spdx22
 
 const Version = "SPDX-2.2"

internal/presenter/packages/spdx_helpers.go

@@ -0,0 +1,207 @@
+package packages
+
+import (
+	"crypto/sha256"
+	"fmt"
+	"path/filepath"
+	"strings"
+
+	"github.com/anchore/syft/internal/presenter/packages/model/spdx22"
+	"github.com/anchore/syft/internal/spdxlicense"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func getSPDXExternalRefs(p *pkg.Package) (externalRefs []spdx22.ExternalRef) {
+	externalRefs = make([]spdx22.ExternalRef, 0)
+	for _, c := range p.CPEs {
+		externalRefs = append(externalRefs, spdx22.ExternalRef{
+			ReferenceCategory: spdx22.SecurityReferenceCategory,
+			ReferenceLocator:  c.BindToFmtString(),
+			ReferenceType:     spdx22.Cpe23ExternalRefType,
+		})
+	}
+
+	if p.PURL != "" {
+		externalRefs = append(externalRefs, spdx22.ExternalRef{
+			ReferenceCategory: spdx22.PackageManagerReferenceCategory,
+			ReferenceLocator:  p.PURL,
+			ReferenceType:     spdx22.PurlExternalRefType,
+		})
+	}
+	return externalRefs
+}
+
+func getSPDXFiles(packageSpdxID string, p *pkg.Package) (files []spdx22.File, fileIDs []string, relationships []spdx22.Relationship) {
+	files = make([]spdx22.File, 0)
+	fileIDs = make([]string, 0)
+	relationships = make([]spdx22.Relationship, 0)
+
+	pkgFileOwner, ok := p.Metadata.(pkg.FileOwner)
+	if !ok {
+		return files, fileIDs, relationships
+	}
+
+	for _, ownedFilePath := range pkgFileOwner.OwnedFiles() {
+		baseFileName := filepath.Base(ownedFilePath)
+		pathHash := sha256.Sum256([]byte(ownedFilePath))
+		fileSpdxID := spdx22.ElementID(fmt.Sprintf("File-%s-%x", p.Name, pathHash)).String()
+
+		fileIDs = append(fileIDs, fileSpdxID)
+
+		files = append(files, spdx22.File{
+			FileName: ownedFilePath,
+			Item: spdx22.Item{
+				Element: spdx22.Element{
+					SPDXID: fileSpdxID,
+					Name:   baseFileName,
+				},
+			},
+		})
+
+		relationships = append(relationships, spdx22.Relationship{
+			SpdxElementID:      packageSpdxID,
+			RelationshipType:   spdx22.ContainsRelationship,
+			RelatedSpdxElement: fileSpdxID,
+		})
+	}
+
+	return files, fileIDs, relationships
+}
+
+func getSPDXLicense(p *pkg.Package) string {
+	// source: https://spdx.github.io/spdx-spec/3-package-information/#313-concluded-license
+	// The options to populate this field are limited to:
+	// A valid SPDX License Expression as defined in Appendix IV;
+	// NONE, if the SPDX file creator concludes there is no license available for this package; or
+	// NOASSERTION if:
+	//   (i) the SPDX file creator has attempted to but cannot reach a reasonable objective determination;
+	//   (ii) the SPDX file creator has made no attempt to determine this field; or
+	//   (iii) the SPDX file creator has intentionally provided no information (no meaning should be implied by doing so).
+
+	if len(p.Licenses) == 0 {
+		return "NONE"
+	}
+
+	// take all licenses and assume an AND expression; for information about license expressions see https://spdx.github.io/spdx-spec/appendix-IV-SPDX-license-expressions/
+	var parsedLicenses []string
+	for _, l := range p.Licenses {
+		if value, exists := spdxlicense.ID(l); exists {
+			parsedLicenses = append(parsedLicenses, value)
+		}
+	}
+
+	if len(parsedLicenses) == 0 {
+		return "NOASSERTION"
+	}
+
+	return strings.Join(parsedLicenses, " AND ")
+}
+
+func noneIfEmpty(value string) string {
+	if strings.TrimSpace(value) == "" {
+		return "NONE"
+	}
+	return value
+}
+
+func getSPDXDownloadLocation(p *pkg.Package) string {
+	// 3.7: Package Download Location
+	// Cardinality: mandatory, one
+	// NONE if there is no download location whatsoever.
+	// NOASSERTION if:
+	//   (i) the SPDX file creator has attempted to but cannot reach a reasonable objective determination;
+	//   (ii) the SPDX file creator has made no attempt to determine this field; or
+	//   (iii) the SPDX file creator has intentionally provided no information (no meaning should be implied by doing so).
+
+	switch metadata := p.Metadata.(type) {
+	case pkg.ApkMetadata:
+		return noneIfEmpty(metadata.URL)
+	case pkg.NpmPackageJSONMetadata:
+		return noneIfEmpty(metadata.URL)
+	default:
+		return "NOASSERTION"
+	}
+}
+
+func getSPDXHomepage(p *pkg.Package) string {
+	switch metadata := p.Metadata.(type) {
+	case pkg.GemMetadata:
+		return metadata.Homepage
+	case pkg.NpmPackageJSONMetadata:
+		return metadata.Homepage
+	default:
+		return ""
+	}
+}
+
+func getSPDXSourceInfo(p *pkg.Package) string {
+	answer := ""
+	switch p.Type {
+	case pkg.RpmPkg:
+		answer = "acquired package info from RPM DB"
+	case pkg.ApkPkg:
+		answer = "acquired package info from APK DB"
+	case pkg.DebPkg:
+		answer = "acquired package info from DPKG DB"
+	case pkg.NpmPkg:
+		answer = "acquired package info from installed node module manifest file"
+	case pkg.PythonPkg:
+		answer = "acquired package info from installed python package manifest file"
+	case pkg.JavaPkg, pkg.JenkinsPluginPkg:
+		answer = "acquired package info from installed java archive"
+	case pkg.GemPkg:
+		answer = "acquired package info from installed gem metadata file"
+	case pkg.GoModulePkg:
+		answer = "acquired package info from go module information"
+	case pkg.RustPkg:
+		answer = "acquired package info from rust cargo manifest"
+	default:
+		answer = "acquired package info from the following paths"
+	}
+	var paths []string
+	for _, l := range p.Locations {
+		paths = append(paths, l.RealPath)
+	}
+
+	return answer + ": " + strings.Join(paths, ", ")
+}
+
+func getSPDXOriginator(p *pkg.Package) string {
+	switch metadata := p.Metadata.(type) {
+	case pkg.ApkMetadata:
+		return metadata.Maintainer
+	case pkg.NpmPackageJSONMetadata:
+		return metadata.Author
+	case pkg.PythonPackageMetadata:
+		author := metadata.Author
+		if author == "" {
+			return metadata.AuthorEmail
+		}
+		if metadata.AuthorEmail != "" {
+			author += fmt.Sprintf(" <%s>", metadata.AuthorEmail)
+		}
+		return author
+	case pkg.GemMetadata:
+		if len(metadata.Authors) > 0 {
+			return metadata.Authors[0]
+		}
+		return ""
+	case pkg.RpmdbMetadata:
+		return metadata.Vendor
+	case pkg.DpkgMetadata:
+		return metadata.Maintainer
+	default:
+		return ""
+	}
+}
+
+func getSPDXDescription(p *pkg.Package) string {
+	switch metadata := p.Metadata.(type) {
+	case pkg.ApkMetadata:
+		return metadata.Description
+	case pkg.NpmPackageJSONMetadata:
+		return metadata.Description
+	default:
+		return ""
+	}
+}

internal/presenter/packages/spdx_helpers_test.go

@@ -0,0 +1,527 @@
+package packages
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/source"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/syft/internal/presenter/packages/model/spdx22"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func Test_getSPDXExternalRefs(t *testing.T) {
+	testCPE := must(pkg.NewCPE("cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*"))
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected []spdx22.ExternalRef
+	}{
+		{
+			name: "cpe + purl",
+			input: pkg.Package{
+				CPEs: []pkg.CPE{
+					testCPE,
+				},
+				PURL: "a-purl",
+			},
+			expected: []spdx22.ExternalRef{
+				{
+					ReferenceCategory: spdx22.SecurityReferenceCategory,
+					ReferenceLocator:  testCPE.BindToFmtString(),
+					ReferenceType:     spdx22.Cpe23ExternalRefType,
+				},
+				{
+					ReferenceCategory: spdx22.PackageManagerReferenceCategory,
+					ReferenceLocator:  "a-purl",
+					ReferenceType:     spdx22.PurlExternalRefType,
+				},
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.ElementsMatch(t, test.expected, getSPDXExternalRefs(&test.input))
+		})
+	}
+}
+
+func Test_getSPDXLicense(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected string
+	}{
+		{
+			name:     "no licenses",
+			input:    pkg.Package{},
+			expected: "NONE",
+		},
+		{
+			name: "no SPDX licenses",
+			input: pkg.Package{
+				Licenses: []string{
+					"made-up",
+				},
+			},
+			expected: "NOASSERTION",
+		},
+		{
+			name: "with SPDX license",
+			input: pkg.Package{
+				Licenses: []string{
+					"MIT",
+				},
+			},
+			expected: "MIT",
+		},
+		{
+			name: "with SPDX license expression",
+			input: pkg.Package{
+				Licenses: []string{
+					"MIT",
+					"GPL-3.0",
+				},
+			},
+			expected: "MIT AND GPL-3.0",
+		},
+		{
+			name: "cap insensitive",
+			input: pkg.Package{
+				Licenses: []string{
+					"gpl-3.0",
+				},
+			},
+			expected: "GPL-3.0",
+		},
+		{
+			name: "debian to spdx conversion",
+			input: pkg.Package{
+				Licenses: []string{
+					"GPL-2",
+				},
+			},
+			expected: "GPL-2.0",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, getSPDXLicense(&test.input))
+		})
+	}
+}
+
+func Test_noneIfEmpty(t *testing.T) {
+	tests := []struct {
+		name     string
+		value    string
+		expected string
+	}{
+		{
+			name:     "non-zero value",
+			value:    "something",
+			expected: "something",
+		},
+		{
+			name:     "empty",
+			value:    "",
+			expected: "NONE",
+		},
+		{
+			name:     "space",
+			value:    " ",
+			expected: "NONE",
+		},
+		{
+			name:     "tab",
+			value:    "\t",
+			expected: "NONE",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, noneIfEmpty(test.value))
+		})
+	}
+}
+
+func Test_getSPDXDownloadLocation(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected string
+	}{
+		{
+			name:     "no metadata",
+			input:    pkg.Package{},
+			expected: "NOASSERTION",
+		},
+		{
+			name: "from apk",
+			input: pkg.Package{
+				Metadata: pkg.ApkMetadata{
+					URL: "http://a-place.gov",
+				},
+			},
+			expected: "http://a-place.gov",
+		},
+		{
+			name: "from npm",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					URL: "http://a-place.gov",
+				},
+			},
+			expected: "http://a-place.gov",
+		},
+		{
+			name: "empty",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					URL: "",
+				},
+			},
+			expected: "NONE",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, getSPDXDownloadLocation(&test.input))
+		})
+	}
+}
+
+func Test_getSPDXHomepage(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected string
+	}{
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name:     "no metadata",
+			input:    pkg.Package{},
+			expected: "",
+		},
+		{
+			name: "from gem",
+			input: pkg.Package{
+				Metadata: pkg.GemMetadata{
+					Homepage: "http://a-place.gov",
+				},
+			},
+			expected: "http://a-place.gov",
+		},
+		{
+			name: "from npm",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					Homepage: "http://a-place.gov",
+				},
+			},
+			expected: "http://a-place.gov",
+		},
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name: "empty",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					Homepage: "",
+				},
+			},
+			expected: "",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, getSPDXHomepage(&test.input))
+		})
+	}
+}
+
+func Test_getSPDXSourceInfo(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected []string
+	}{
+		{
+			name: "locations are captured",
+			input: pkg.Package{
+				// note: no type given
+				Locations: []source.Location{
+					{
+						RealPath:    "/a-place",
+						VirtualPath: "/b-place",
+					},
+					{
+						RealPath:    "/c-place",
+						VirtualPath: "/d-place",
+					},
+				},
+			},
+			expected: []string{
+				"from the following paths",
+				"/a-place",
+				"/c-place",
+			},
+		},
+		{
+			// note: no specific support for this
+			input: pkg.Package{
+				Type: pkg.KbPkg,
+			},
+			expected: []string{
+				"from the following paths",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.RpmPkg,
+			},
+			expected: []string{
+				"from RPM DB",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.ApkPkg,
+			},
+			expected: []string{
+				"from APK DB",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.DebPkg,
+			},
+			expected: []string{
+				"from DPKG DB",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.NpmPkg,
+			},
+			expected: []string{
+				"from installed node module manifest file",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.PythonPkg,
+			},
+			expected: []string{
+				"from installed python package manifest file",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.JavaPkg,
+			},
+			expected: []string{
+				"from installed java archive",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.JenkinsPluginPkg,
+			},
+			expected: []string{
+				"from installed java archive",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.GemPkg,
+			},
+			expected: []string{
+				"from installed gem metadata file",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.GoModulePkg,
+			},
+			expected: []string{
+				"from go module information",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.RustPkg,
+			},
+			expected: []string{
+				"from rust cargo manifest",
+			},
+		},
+	}
+	var pkgTypes []pkg.Type
+	for _, test := range tests {
+		t.Run(test.name+" "+string(test.input.Type), func(t *testing.T) {
+			if test.input.Type != "" {
+				pkgTypes = append(pkgTypes, test.input.Type)
+			}
+			actual := getSPDXSourceInfo(&test.input)
+			for _, expected := range test.expected {
+				assert.Contains(t, actual, expected)
+			}
+		})
+	}
+	assert.ElementsMatch(t, pkg.AllPkgs, pkgTypes, "missing one or more package types to test against (maybe a package type was added?)")
+}
+
+func Test_getSPDXOriginator(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected string
+	}{
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name:     "no metadata",
+			input:    pkg.Package{},
+			expected: "",
+		},
+		{
+			name: "from gem",
+			input: pkg.Package{
+				Metadata: pkg.GemMetadata{
+					Authors: []string{
+						"auth1",
+						"auth2",
+					},
+				},
+			},
+			expected: "auth1",
+		},
+		{
+			name: "from npm",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					Author: "auth",
+				},
+			},
+			expected: "auth",
+		},
+		{
+			name: "from apk",
+			input: pkg.Package{
+				Metadata: pkg.ApkMetadata{
+					Maintainer: "auth",
+				},
+			},
+			expected: "auth",
+		},
+		{
+			name: "from python - just name",
+			input: pkg.Package{
+				Metadata: pkg.PythonPackageMetadata{
+					Author: "auth",
+				},
+			},
+			expected: "auth",
+		},
+		{
+			name: "from python - just email",
+			input: pkg.Package{
+				Metadata: pkg.PythonPackageMetadata{
+					AuthorEmail: "auth@auth.gov",
+				},
+			},
+			expected: "auth@auth.gov",
+		},
+		{
+			name: "from python - both name and email",
+			input: pkg.Package{
+				Metadata: pkg.PythonPackageMetadata{
+					Author:      "auth",
+					AuthorEmail: "auth@auth.gov",
+				},
+			},
+			expected: "auth <auth@auth.gov>",
+		},
+		{
+			name: "from rpm",
+			input: pkg.Package{
+				Metadata: pkg.RpmdbMetadata{
+					Vendor: "auth",
+				},
+			},
+			expected: "auth",
+		},
+		{
+			name: "from dpkg",
+			input: pkg.Package{
+				Metadata: pkg.DpkgMetadata{
+					Maintainer: "auth",
+				},
+			},
+			expected: "auth",
+		},
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name: "empty",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					Author: "",
+				},
+			},
+			expected: "",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, getSPDXOriginator(&test.input))
+		})
+	}
+}
+
+func Test_getSPDXDescription(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected string
+	}{
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name:     "no metadata",
+			input:    pkg.Package{},
+			expected: "",
+		},
+		{
+			name: "from apk",
+			input: pkg.Package{
+				Metadata: pkg.ApkMetadata{
+					Description: "a description!",
+				},
+			},
+			expected: "a description!",
+		},
+		{
+			name: "from npm",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					Description: "a description!",
+				},
+			},
+			expected: "a description!",
+		},
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name: "empty",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					Homepage: "",
+				},
+			},
+			expected: "",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, getSPDXDescription(&test.input))
+		})
+	}
+}

internal/presenter/packages/spdx_json_presenter.go

@@ -0,0 +1,142 @@
+package packages
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"path"
+	"strings"
+	"time"
+
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/presenter/packages/model/spdx22"
+	"github.com/anchore/syft/internal/spdxlicense"
+	"github.com/anchore/syft/internal/version"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+	"github.com/google/uuid"
+)
+
+const anchoreNamespace = "https://anchore.com/syft"
+
+// SPDXJsonPresenter is a SPDX presentation object for the syft results (see https://github.com/spdx/spdx-spec)
+type SPDXJsonPresenter struct {
+	catalog     *pkg.Catalog
+	srcMetadata source.Metadata
+}
+
+// NewSPDXJSONPresenter creates a new JSON presenter object for the given cataloging results.
+func NewSPDXJSONPresenter(catalog *pkg.Catalog, srcMetadata source.Metadata) *SPDXJsonPresenter {
+	return &SPDXJsonPresenter{
+		catalog:     catalog,
+		srcMetadata: srcMetadata,
+	}
+}
+
+// Present the catalog results to the given writer.
+func (pres *SPDXJsonPresenter) Present(output io.Writer) error {
+	doc := newSPDXJsonDocument(pres.catalog, pres.srcMetadata)
+
+	enc := json.NewEncoder(output)
+	// prevent > and < from being escaped in the payload
+	enc.SetEscapeHTML(false)
+	enc.SetIndent("", " ")
+	return enc.Encode(&doc)
+}
+
+// newSPDXJsonDocument creates and populates a new JSON document struct that follows the SPDX 2.2 spec from the given cataloging results.
+func newSPDXJsonDocument(catalog *pkg.Catalog, srcMetadata source.Metadata) spdx22.Document {
+	uniqueID := uuid.Must(uuid.NewRandom())
+
+	var name, input, identifier string
+	switch srcMetadata.Scheme {
+	case source.ImageScheme:
+		name = cleanSPDXName(srcMetadata.ImageMetadata.UserInput)
+		input = "image"
+	case source.DirectoryScheme:
+		name = cleanSPDXName(srcMetadata.Path)
+		input = "dir"
+	}
+
+	if name != "." {
+		identifier = path.Join(input, fmt.Sprintf("%s-%s", name, uniqueID.String()))
+	} else {
+		identifier = path.Join(input, uniqueID.String())
+	}
+
+	namespace := path.Join(anchoreNamespace, identifier)
+	packages, files, relationships := newSPDXJsonElements(catalog)
+
+	return spdx22.Document{
+		Element: spdx22.Element{
+			SPDXID: spdx22.ElementID("DOCUMENT").String(),
+			Name:   name,
+		},
+		SPDXVersion: spdx22.Version,
+		CreationInfo: spdx22.CreationInfo{
+			Created: time.Now().UTC(),
+			Creators: []string{
+				// note: key-value format derived from the JSON example document examples: https://github.com/spdx/spdx-spec/blob/v2.2/examples/SPDXJSONExample-v2.2.spdx.json
+				"Organization: Anchore, Inc",
+				"Tool: " + internal.ApplicationName + "-" + version.FromBuild().Version,
+			},
+			LicenseListVersion: spdxlicense.Version,
+		},
+		DataLicense:       "CC0-1.0",
+		DocumentNamespace: namespace,
+		Packages:          packages,
+		Files:             files,
+		Relationships:     relationships,
+	}
+}
+
+func newSPDXJsonElements(catalog *pkg.Catalog) ([]spdx22.Package, []spdx22.File, []spdx22.Relationship) {
+	packages := make([]spdx22.Package, 0)
+	relationships := make([]spdx22.Relationship, 0)
+	files := make([]spdx22.File, 0)
+
+	for _, p := range catalog.Sorted() {
+		license := getSPDXLicense(p)
+		packageSpdxID := spdx22.ElementID(fmt.Sprintf("Package-%+v-%s-%s", p.Type, p.Name, p.Version)).String()
+
+		packageFiles, fileIDs, packageFileRelationships := getSPDXFiles(packageSpdxID, p)
+		files = append(files, packageFiles...)
+
+		relationships = append(relationships, packageFileRelationships...)
+
+		// note: the license concluded and declared should be the same since we are collecting license information
+		// from the project data itself (the installed package files).
+		packages = append(packages, spdx22.Package{
+			Description:      getSPDXDescription(p),
+			DownloadLocation: getSPDXDownloadLocation(p),
+			ExternalRefs:     getSPDXExternalRefs(p),
+			FilesAnalyzed:    false,
+			HasFiles:         fileIDs,
+			Homepage:         getSPDXHomepage(p),
+			LicenseDeclared:  license, // The Declared License is what the authors of a project believe govern the package
+			Originator:       getSPDXOriginator(p),
+			SourceInfo:       getSPDXSourceInfo(p),
+			VersionInfo:      p.Version,
+			Item: spdx22.Item{
+				LicenseConcluded: license, // The Concluded License field is the license the SPDX file creator believes governs the package
+				Element: spdx22.Element{
+					SPDXID: packageSpdxID,
+					Name:   p.Name,
+				},
+			},
+		})
+	}
+
+	return packages, files, relationships
+}
+
+func cleanSPDXName(name string) string {
+	// remove # according to specification
+	name = strings.ReplaceAll(name, "#", "-")
+
+	// remove : for url construction
+	name = strings.ReplaceAll(name, ":", "-")
+
+	// clean relative pathing
+	return path.Clean(name)
+}

internal/presenter/packages/spdx_json_presenter_test.go

@@ -1,20 +1,17 @@
-package spdx22json
+package packages
 
 import (
 	"flag"
 	"regexp"
 	"testing"
-
-	"github.com/anchore/syft/internal/formats/common/testutils"
-	"github.com/anchore/syft/syft/format"
 )
 
 var updateSpdxJson = flag.Bool("update-spdx-json", false, "update the *.golden files for spdx-json presenters")
 
 func TestSPDXJSONDirectoryPresenter(t *testing.T) {
-	catalog, metadata, distro := testutils.DirectoryInput(t)
-	testutils.AssertPresenterAgainstGoldenSnapshot(t,
-		format.NewPresenter(encoder, catalog, &metadata, distro),
+	catalog, metadata, _ := presenterDirectoryInput(t)
+	assertPresenterAgainstGoldenSnapshot(t,
+		NewSPDXJSONPresenter(catalog, metadata),
 		*updateSpdxJson,
 		spdxJsonRedactor,
 	)
@@ -22,9 +19,9 @@ func TestSPDXJSONDirectoryPresenter(t *testing.T) {
 
 func TestSPDXJSONImagePresenter(t *testing.T) {
 	testImage := "image-simple"
-	catalog, metadata, distro := testutils.ImageInput(t, testImage)
-	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
-		format.NewPresenter(encoder, catalog, &metadata, distro),
+	catalog, metadata, _ := presenterImageInput(t, testImage)
+	assertPresenterAgainstGoldenImageSnapshot(t,
+		NewSPDXJSONPresenter(catalog, metadata),
 		testImage,
 		*updateSpdxJson,
 		spdxJsonRedactor,

internal/presenter/packages/spdx_tag_value_presenter.go

@@ -5,8 +5,6 @@ import (
 	"io"
 	"time"
 
-	"github.com/anchore/syft/internal/formats/common/spdxhelpers"
-
 	"github.com/anchore/syft/internal/spdxlicense"
 
 	"github.com/anchore/syft/internal"
@@ -116,7 +114,7 @@ func (pres *SPDXTagValuePresenter) packages() map[spdx.ElementID]*spdx.Package2_
 		// If the Concluded License is not the same as the Declared License, a written explanation should be provided
 		// in the Comments on License field (section 3.16). With respect to NOASSERTION, a written explanation in
 		// the Comments on License field (section 3.16) is preferred.
-		license := spdxhelpers.License(p)
+		license := getSPDXLicense(p)
 
 		results[spdx.ElementID(id)] = &spdx.Package2_2{
 
@@ -276,7 +274,7 @@ func (pres *SPDXTagValuePresenter) packages() map[spdx.ElementID]*spdx.Package2_
 }
 
 func formatSPDXExternalRefs(p *pkg.Package) (refs []*spdx.PackageExternalReference2_2) {
-	for _, ref := range spdxhelpers.ExternalRefs(p) {
+	for _, ref := range getSPDXExternalRefs(p) {
 		refs = append(refs, &spdx.PackageExternalReference2_2{
 			Category:           string(ref.ReferenceCategory),
 			RefType:            string(ref.ReferenceType),

internal/presenter/packages/spdx_tag_value_presenter_test.go

@@ -4,15 +4,13 @@ import (
 	"flag"
 	"regexp"
 	"testing"
-
-	"github.com/anchore/syft/internal/formats/common/testutils"
 )
 
 var updateSpdxTagValue = flag.Bool("update-spdx-tv", false, "update the *.golden files for spdx-tv presenters")
 
 func TestSPDXTagValueDirectoryPresenter(t *testing.T) {
-	catalog, metadata, _ := testutils.DirectoryInput(t)
-	testutils.AssertPresenterAgainstGoldenSnapshot(t,
+	catalog, metadata, _ := presenterDirectoryInput(t)
+	assertPresenterAgainstGoldenSnapshot(t,
 		NewSPDXTagValuePresenter(catalog, metadata),
 		*updateSpdxTagValue,
 		spdxTagValueRedactor,
@@ -21,8 +19,8 @@ func TestSPDXTagValueDirectoryPresenter(t *testing.T) {
 
 func TestSPDXTagValueImagePresenter(t *testing.T) {
 	testImage := "image-simple"
-	catalog, metadata, _ := testutils.ImageInput(t, testImage)
-	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
+	catalog, metadata, _ := presenterImageInput(t, testImage)
+	assertPresenterAgainstGoldenImageSnapshot(t,
 		NewSPDXTagValuePresenter(catalog, metadata),
 		testImage,
 		*updateSpdxTagValue,

internal/presenter/packages/table_presenter_test.go

@@ -4,8 +4,6 @@ import (
 	"flag"
 	"testing"
 
-	"github.com/anchore/syft/internal/formats/common/testutils"
-
 	"github.com/go-test/deep"
 )
 
@@ -13,8 +11,8 @@ var updateTablePresenterGoldenFiles = flag.Bool("update-table", false, "update t
 
 func TestTablePresenter(t *testing.T) {
 	testImage := "image-simple"
-	catalog, _, _ := testutils.ImageInput(t, testImage)
-	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
+	catalog, _, _ := presenterImageInput(t, testImage)
+	assertPresenterAgainstGoldenImageSnapshot(t,
 		NewTablePresenter(catalog),
 		testImage,
 		*updateTablePresenterGoldenFiles,

internal/presenter/packages/test-fixtures/snapshot/TestSPDXJSONDirectoryPresenter.golden

@@ -3,36 +3,15 @@
  "name": "/some/path",
  "spdxVersion": "SPDX-2.2",
  "creationInfo": {
-  "created": "2021-10-11T01:54:40.609143Z",
+  "created": "2021-09-16T20:44:35.198887Z",
   "creators": [
    "Organization: Anchore, Inc",
    "Tool: syft-[not provided]"
   ],
   "licenseListVersion": "3.14"
  },
- "syftSourceData": {
-  "Scheme": "DirectoryScheme",
-  "ImageMetadata": {
-   "userInput": "",
-   "imageID": "",
-   "manifestDigest": "",
-   "mediaType": "",
-   "tags": null,
-   "imageSize": 0,
-   "layers": null,
-   "manifest": null,
-   "config": null,
-   "repoDigests": null
-  },
-  "Path": "/some/path"
- },
- "syftDistroData": {
-  "name": "debian",
-  "version": "1.2.3",
-  "idLike": "like!"
- },
  "dataLicense": "CC0-1.0",
- "documentNamespace": "https:/anchore.com/syft/dir/some/path-e94d6e43-5de5-4849-8e21-983ada9103c5",
+ "documentNamespace": "https://anchore.com/syft/image/",
  "packages": [
   {
    "SPDXID": "SPDXRef-Package-python-package-1-1.0.1",
@@ -57,35 +36,7 @@
    ],
    "licenseDeclared": "MIT",
    "sourceInfo": "acquired package info from installed python package manifest file: /some/path/pkg1",
-   "versionInfo": "1.0.1",
-   "syftPackageData": {
-    "type": "python",
-    "foundBy": "the-cataloger-1",
-    "locations": [
-     {
-      "path": "/some/path/pkg1"
-     }
-    ],
-    "licenses": [
-     "MIT"
-    ],
-    "language": "python",
-    "metadataType": "PythonPackageMetadata",
-    "metadata": {
-     "name": "package-1",
-     "version": "1.0.1",
-     "license": "",
-     "author": "",
-     "authorEmail": "",
-     "platform": "",
-     "files": [
-      {
-       "path": "/some/path/pkg1/depedencies/foo"
-      }
-     ],
-     "sitePackagesRootPath": ""
-    }
-   }
+   "versionInfo": "1.0.1"
   },
   {
    "SPDXID": "SPDXRef-Package-deb-package-2-2.0.1",
@@ -107,27 +58,7 @@
    "filesAnalyzed": false,
    "licenseDeclared": "NONE",
    "sourceInfo": "acquired package info from DPKG DB: /some/path/pkg1",
-   "versionInfo": "2.0.1",
-   "syftPackageData": {
-    "type": "deb",
-    "foundBy": "the-cataloger-2",
-    "locations": [
-     {
-      "path": "/some/path/pkg1"
-     }
-    ],
-    "metadataType": "DpkgMetadata",
-    "metadata": {
-     "package": "package-2",
-     "source": "",
-     "version": "2.0.1",
-     "sourceVersion": "",
-     "architecture": "",
-     "maintainer": "",
-     "installedSize": 0,
-     "files": null
-    }
-   }
+   "versionInfo": "2.0.1"
   }
  ],
  "files": [

internal/presenter/packages/test-fixtures/snapshot/TestSPDXJSONImagePresenter.golden

@@ -0,0 +1,61 @@
+{
+ "SPDXID": "SPDXRef-DOCUMENT",
+ "name": "user-image-input",
+ "spdxVersion": "SPDX-2.2",
+ "creationInfo": {
+  "created": "2021-09-16T20:44:35.203911Z",
+  "creators": [
+   "Organization: Anchore, Inc",
+   "Tool: syft-[not provided]"
+  ],
+  "licenseListVersion": "3.14"
+ },
+ "dataLicense": "CC0-1.0",
+ "documentNamespace": "https://anchore.com/syft/image/user-image-input",
+ "packages": [
+  {
+   "SPDXID": "SPDXRef-Package-python-package-1-1.0.1",
+   "name": "package-1",
+   "licenseConcluded": "MIT",
+   "downloadLocation": "NOASSERTION",
+   "externalRefs": [
+    {
+     "referenceCategory": "SECURITY",
+     "referenceLocator": "cpe:2.3:*:some:package:1:*:*:*:*:*:*:*",
+     "referenceType": "cpe23Type"
+    },
+    {
+     "referenceCategory": "PACKAGE_MANAGER",
+     "referenceLocator": "a-purl-1",
+     "referenceType": "purl"
+    }
+   ],
+   "filesAnalyzed": false,
+   "licenseDeclared": "MIT",
+   "sourceInfo": "acquired package info from installed python package manifest file: /somefile-1.txt",
+   "versionInfo": "1.0.1"
+  },
+  {
+   "SPDXID": "SPDXRef-Package-deb-package-2-2.0.1",
+   "name": "package-2",
+   "licenseConcluded": "NONE",
+   "downloadLocation": "NOASSERTION",
+   "externalRefs": [
+    {
+     "referenceCategory": "SECURITY",
+     "referenceLocator": "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*",
+     "referenceType": "cpe23Type"
+    },
+    {
+     "referenceCategory": "PACKAGE_MANAGER",
+     "referenceLocator": "a-purl-2",
+     "referenceType": "purl"
+    }
+   ],
+   "filesAnalyzed": false,
+   "licenseDeclared": "NONE",
+   "sourceInfo": "acquired package info from DPKG DB: /somefile-2.txt",
+   "versionInfo": "2.0.1"
+  }
+ ]
+}

internal/presenter/packages/text_presenter.go

@@ -32,7 +32,7 @@ func (pres *TextPresenter) Present(output io.Writer) error {
 
 	switch pres.srcMetadata.Scheme {
 	case source.DirectoryScheme:
-		fmt.Fprintln(w, fmt.Sprintf("[Path: %s]", pres.srcMetadata.Path))
+		fmt.Fprintf(w, "[Path: %s]\n", pres.srcMetadata.Path)
 	case source.ImageScheme:
 		fmt.Fprintln(w, "[Image]")
 
@@ -51,7 +51,7 @@ func (pres *TextPresenter) Present(output io.Writer) error {
 	// populate artifacts...
 	rows := 0
 	for _, p := range pres.catalog.Sorted() {
-		fmt.Fprintln(w, fmt.Sprintf("[%s]", p.Name))
+		fmt.Fprintf(w, "[%s]\n", p.Name)
 		fmt.Fprintln(w, " Version:\t", p.Version)
 		fmt.Fprintln(w, " Type:\t", string(p.Type))
 		fmt.Fprintln(w, " Found by:\t", p.FoundBy)

internal/presenter/packages/text_presenter_test.go

@@ -3,15 +3,13 @@ package packages
 import (
 	"flag"
 	"testing"
-
-	"github.com/anchore/syft/internal/formats/common/testutils"
 )
 
 var updateTextPresenterGoldenFiles = flag.Bool("update-text", false, "update the *.golden files for text presenters")
 
 func TestTextDirectoryPresenter(t *testing.T) {
-	catalog, metadata, _ := testutils.DirectoryInput(t)
-	testutils.AssertPresenterAgainstGoldenSnapshot(t,
+	catalog, metadata, _ := presenterDirectoryInput(t)
+	assertPresenterAgainstGoldenSnapshot(t,
 		NewTextPresenter(catalog, metadata),
 		*updateTextPresenterGoldenFiles,
 	)
@@ -19,8 +17,8 @@ func TestTextDirectoryPresenter(t *testing.T) {
 
 func TestTextImagePresenter(t *testing.T) {
 	testImage := "image-simple"
-	catalog, metadata, _ := testutils.ImageInput(t, testImage)
-	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
+	catalog, metadata, _ := presenterImageInput(t, testImage)
+	assertPresenterAgainstGoldenImageSnapshot(t,
 		NewTextPresenter(catalog, metadata),
 		testImage,
 		*updateTextPresenterGoldenFiles,