bump chronicle to v0.2.0-beta (#581)

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

.github/scripts/goreleaser-install.sh

@@ -0,0 +1,398 @@
+#!/bin/sh
+set -e
+# Code generated by godownloader on 2019-12-25T12:47:14Z. DO NOT EDIT.
+#
+
+usage() {
+	this=$1
+	cat <<EOF
+$this: download go binaries for goreleaser/goreleaser
+
+Usage: $this [-b] bindir [-d] [tag]
+  -b sets bindir or installation directory, Defaults to ./bin
+  -d turns on debug logging
+   [tag] is a tag from
+   https://github.com/goreleaser/goreleaser/releases
+   If tag is missing, then the latest will be used.
+
+ Generated by godownloader
+  https://github.com/goreleaser/godownloader
+
+EOF
+	exit 2
+}
+
+parse_args() {
+	#BINDIR is ./bin unless set be ENV
+	# over-ridden by flag below
+
+	BINDIR=${BINDIR:-./bin}
+	while getopts "b:dh?x" arg; do
+		case "$arg" in
+		b) BINDIR="$OPTARG" ;;
+		d) log_set_priority 10 ;;
+		h | \?) usage "$0" ;;
+		x) set -x ;;
+		esac
+	done
+	shift $((OPTIND - 1))
+	TAG=$1
+}
+# this function wraps all the destructive operations
+# if a curl|bash cuts off the end of the script due to
+# network, either nothing will happen or will syntax error
+# out preventing half-done work
+execute() {
+	tmpdir=$(mktemp -d)
+	log_debug "downloading files into ${tmpdir}"
+	http_download "${tmpdir}/${TARBALL}" "${TARBALL_URL}"
+	http_download "${tmpdir}/${CHECKSUM}" "${CHECKSUM_URL}"
+	hash_sha256_verify "${tmpdir}/${TARBALL}" "${tmpdir}/${CHECKSUM}"
+	srcdir="${tmpdir}"
+	(cd "${tmpdir}" && untar "${TARBALL}")
+	test ! -d "${BINDIR}" && install -d "${BINDIR}"
+	for binexe in $BINARIES; do
+		if [ "$OS" = "windows" ]; then
+			binexe="${binexe}.exe"
+		fi
+		install "${srcdir}/${binexe}" "${BINDIR}/"
+		log_info "installed ${BINDIR}/${binexe}"
+	done
+	rm -rf "${tmpdir}"
+}
+get_binaries() {
+	case "$PLATFORM" in
+	darwin/386) BINARIES="goreleaser" ;;
+	darwin/amd64) BINARIES="goreleaser" ;;
+	darwin/arm64) BINARIES="goreleaser" ;;
+	darwin/armv6) BINARIES="goreleaser" ;;
+	linux/386) BINARIES="goreleaser" ;;
+	linux/amd64) BINARIES="goreleaser" ;;
+	linux/arm64) BINARIES="goreleaser" ;;
+	linux/armv6) BINARIES="goreleaser" ;;
+	windows/386) BINARIES="goreleaser" ;;
+	windows/amd64) BINARIES="goreleaser" ;;
+	windows/arm64) BINARIES="goreleaser" ;;
+	windows/armv6) BINARIES="goreleaser" ;;
+	*)
+		log_crit "platform $PLATFORM is not supported.  Make sure this script is up-to-date and file request at https://github.com/${PREFIX}/issues/new"
+		exit 1
+		;;
+	esac
+}
+tag_to_version() {
+	if [ -z "${TAG}" ]; then
+		log_info "checking GitHub for latest tag"
+	else
+		log_info "checking GitHub for tag '${TAG}'"
+	fi
+	REALTAG=$(github_release "$OWNER/$REPO" "${TAG}") && true
+	if test -z "$REALTAG"; then
+		log_crit "unable to find '${TAG}' - use 'latest' or see https://github.com/${PREFIX}/releases for details"
+		exit 1
+	fi
+	# if version starts with 'v', remove it
+	TAG="$REALTAG"
+	VERSION=${TAG#v}
+}
+adjust_format() {
+	# change format (tar.gz or zip) based on OS
+	case ${OS} in
+	windows) FORMAT=zip ;;
+	esac
+	true
+}
+adjust_os() {
+	# adjust archive name based on OS
+	case ${OS} in
+	386) OS=i386 ;;
+	amd64) OS=x86_64 ;;
+	darwin) OS=Darwin ;;
+	linux) OS=Linux ;;
+	windows) OS=Windows ;;
+	esac
+	true
+}
+adjust_arch() {
+	# adjust archive name based on ARCH
+	case ${ARCH} in
+	386) ARCH=i386 ;;
+	amd64) ARCH=x86_64 ;;
+	darwin) ARCH=Darwin ;;
+	linux) ARCH=Linux ;;
+	windows) ARCH=Windows ;;
+	esac
+	true
+}
+
+cat /dev/null <<EOF
+------------------------------------------------------------------------
+https://github.com/client9/shlib - portable posix shell functions
+Public domain - http://unlicense.org
+https://github.com/client9/shlib/blob/master/LICENSE.md
+but credit (and pull requests) appreciated.
+------------------------------------------------------------------------
+EOF
+is_command() {
+	command -v "$1" >/dev/null
+}
+echoerr() {
+	echo "$@" 1>&2
+}
+log_prefix() {
+	echo "$0"
+}
+_logp=6
+log_set_priority() {
+	_logp="$1"
+}
+log_priority() {
+	if test -z "$1"; then
+		echo "$_logp"
+		return
+	fi
+	[ "$1" -le "$_logp" ]
+}
+log_tag() {
+	case $1 in
+	0) echo "emerg" ;;
+	1) echo "alert" ;;
+	2) echo "crit" ;;
+	3) echo "err" ;;
+	4) echo "warning" ;;
+	5) echo "notice" ;;
+	6) echo "info" ;;
+	7) echo "debug" ;;
+	*) echo "$1" ;;
+	esac
+}
+log_debug() {
+	log_priority 7 || return 0
+	echoerr "$(log_prefix)" "$(log_tag 7)" "$@"
+}
+log_info() {
+	log_priority 6 || return 0
+	echoerr "$(log_prefix)" "$(log_tag 6)" "$@"
+}
+log_err() {
+	log_priority 3 || return 0
+	echoerr "$(log_prefix)" "$(log_tag 3)" "$@"
+}
+log_crit() {
+	log_priority 2 || return 0
+	echoerr "$(log_prefix)" "$(log_tag 2)" "$@"
+}
+uname_os() {
+	os=$(uname -s | tr '[:upper:]' '[:lower:]')
+	case "$os" in
+	cygwin_nt*) os="windows" ;;
+	mingw*) os="windows" ;;
+	msys_nt*) os="windows" ;;
+	esac
+	echo "$os"
+}
+uname_arch() {
+	arch=$(uname -m)
+	case $arch in
+	x86_64) arch="amd64" ;;
+	x86) arch="386" ;;
+	i686) arch="386" ;;
+	i386) arch="386" ;;
+	aarch64) arch="arm64" ;;
+	armv5*) arch="armv5" ;;
+	armv6*) arch="armv6" ;;
+	armv7*) arch="armv7" ;;
+	esac
+	echo ${arch}
+}
+uname_os_check() {
+	os=$(uname_os)
+	case "$os" in
+	darwin) return 0 ;;
+	dragonfly) return 0 ;;
+	freebsd) return 0 ;;
+	linux) return 0 ;;
+	android) return 0 ;;
+	nacl) return 0 ;;
+	netbsd) return 0 ;;
+	openbsd) return 0 ;;
+	plan9) return 0 ;;
+	solaris) return 0 ;;
+	windows) return 0 ;;
+	esac
+	log_crit "uname_os_check '$(uname -s)' got converted to '$os' which is not a GOOS value. Please file bug at https://github.com/client9/shlib"
+	return 1
+}
+uname_arch_check() {
+	arch=$(uname_arch)
+	case "$arch" in
+	386) return 0 ;;
+	amd64) return 0 ;;
+	arm64) return 0 ;;
+	armv5) return 0 ;;
+	armv6) return 0 ;;
+	armv7) return 0 ;;
+	ppc64) return 0 ;;
+	ppc64le) return 0 ;;
+	mips) return 0 ;;
+	mipsle) return 0 ;;
+	mips64) return 0 ;;
+	mips64le) return 0 ;;
+	s390x) return 0 ;;
+	amd64p32) return 0 ;;
+	esac
+	log_crit "uname_arch_check '$(uname -m)' got converted to '$arch' which is not a GOARCH value.  Please file bug report at https://github.com/client9/shlib"
+	return 1
+}
+untar() {
+	tarball=$1
+	case "${tarball}" in
+	*.tar.gz | *.tgz) tar --no-same-owner -xzf "${tarball}" ;;
+	*.tar) tar --no-same-owner -xf "${tarball}" ;;
+	*.zip) unzip "${tarball}" ;;
+	*)
+		log_err "untar unknown archive format for ${tarball}"
+		return 1
+		;;
+	esac
+}
+http_download_curl() {
+	local_file=$1
+	source_url=$2
+	header=$3
+	if [ -z "$header" ]; then
+		code=$(curl -w '%{http_code}' -sL -o "$local_file" "$source_url")
+	else
+		code=$(curl -w '%{http_code}' -sL -H "$header" -o "$local_file" "$source_url")
+	fi
+	if [ "$code" != "200" ]; then
+		log_debug "http_download_curl received HTTP status $code"
+		return 1
+	fi
+	return 0
+}
+http_download_wget() {
+	local_file=$1
+	source_url=$2
+	header=$3
+	if [ -z "$header" ]; then
+		wget -q -O "$local_file" "$source_url"
+	else
+		wget -q --header "$header" -O "$local_file" "$source_url"
+	fi
+}
+http_download() {
+	log_debug "http_download $2"
+	if is_command curl; then
+		http_download_curl "$@"
+		return
+	elif is_command wget; then
+		http_download_wget "$@"
+		return
+	fi
+	log_crit "http_download unable to find wget or curl"
+	return 1
+}
+http_copy() {
+	tmp=$(mktemp)
+	http_download "${tmp}" "$1" "$2" || return 1
+	body=$(cat "$tmp")
+	rm -f "${tmp}"
+	echo "$body"
+}
+github_release() {
+	owner_repo=$1
+	version=$2
+	test -z "$version" && version="latest"
+	giturl="https://github.com/${owner_repo}/releases/${version}"
+	json=$(http_copy "$giturl" "Accept:application/json")
+	test -z "$json" && return 1
+	version=$(echo "$json" | tr -s '\n' ' ' | sed 's/.*"tag_name":"//' | sed 's/".*//')
+	test -z "$version" && return 1
+	echo "$version"
+}
+hash_sha256() {
+	TARGET=${1:-/dev/stdin}
+	if is_command gsha256sum; then
+		hash=$(gsha256sum "$TARGET") || return 1
+		echo "$hash" | cut -d ' ' -f 1
+	elif is_command sha256sum; then
+		hash=$(sha256sum "$TARGET") || return 1
+		echo "$hash" | cut -d ' ' -f 1
+	elif is_command shasum; then
+		hash=$(shasum -a 256 "$TARGET" 2>/dev/null) || return 1
+		echo "$hash" | cut -d ' ' -f 1
+	elif is_command openssl; then
+		hash=$(openssl -dst openssl dgst -sha256 "$TARGET") || return 1
+		echo "$hash" | cut -d ' ' -f a
+	else
+		log_crit "hash_sha256 unable to find command to compute sha-256 hash"
+		return 1
+	fi
+}
+hash_sha256_verify() {
+	TARGET=$1
+	checksums=$2
+	if [ -z "$checksums" ]; then
+		log_err "hash_sha256_verify checksum file not specified in arg2"
+		return 1
+	fi
+	BASENAME=${TARGET##*/}
+	want=$(grep "${BASENAME}" "${checksums}" 2>/dev/null | tr '\t' ' ' | cut -d ' ' -f 1)
+	if [ -z "$want" ]; then
+		log_err "hash_sha256_verify unable to find checksum for '${TARGET}' in '${checksums}'"
+		return 1
+	fi
+	got=$(hash_sha256 "$TARGET")
+	if [ "$want" != "$got" ]; then
+		log_err "hash_sha256_verify checksum for '$TARGET' did not verify ${want} vs $got"
+		return 1
+	fi
+}
+cat /dev/null <<EOF
+------------------------------------------------------------------------
+End of functions from https://github.com/client9/shlib
+------------------------------------------------------------------------
+EOF
+
+PROJECT_NAME="goreleaser"
+OWNER=goreleaser
+REPO="goreleaser"
+BINARY=goreleaser
+FORMAT=tar.gz
+OS=$(uname_os)
+ARCH=$(uname_arch)
+PREFIX="$OWNER/$REPO"
+
+# use in logging routines
+log_prefix() {
+	echo "$PREFIX"
+}
+PLATFORM="${OS}/${ARCH}"
+GITHUB_DOWNLOAD=https://github.com/${OWNER}/${REPO}/releases/download
+
+uname_os_check "$OS"
+uname_arch_check "$ARCH"
+
+parse_args "$@"
+
+get_binaries
+
+tag_to_version
+
+adjust_format
+
+adjust_os
+
+adjust_arch
+
+log_info "found version: ${VERSION} for ${TAG}/${OS}/${ARCH}"
+
+NAME=${PROJECT_NAME}_${OS}_${ARCH}
+TARBALL=${NAME}.${FORMAT}
+TARBALL_URL=${GITHUB_DOWNLOAD}/${TAG}/${TARBALL}
+CHECKSUM=checksums.txt
+CHECKSUM_URL=${GITHUB_DOWNLOAD}/${TAG}/${CHECKSUM}
+
+execute
+log_err "this script is deprecated, please do not use it anymore. check https://github.com/goreleaser/godownloader/issues/207"

.github/workflows/codeql-analysis.yml

@@ -31,15 +31,6 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@v2
-      with:
-        # We must fetch at least the immediate parents so that if this is
-        # a pull request then we can checkout the head.
-        fetch-depth: 2
-
-    # If this run was triggered by a pull request event, then checkout
-    # the head of the pull request instead of the merge commit.
-    - run: git checkout HEAD^2
-      if: ${{ github.event_name == 'pull_request' }}
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/release.yaml

@@ -96,10 +96,6 @@ jobs:
     steps:
       - uses: docker-practice/actions-setup-docker@v1
 
-      # note, it is important to always be auth'd into docker.io to prevent rate limiting issues
-      - name: Login to Docker Hub
-        run: echo ${{ secrets.TOOLBOX_DOCKER_PASS }} | docker login docker.io -u ${{ secrets.TOOLBOX_DOCKER_USER }} --password-stdin
-
       - uses: actions/setup-go@v2
         with:
           go-version: ${{ env.GO_VERSION }}

.github/workflows/validations.yaml

@@ -305,6 +305,10 @@ jobs:
     needs: [Build-Snapshot-Artifacts]
     runs-on: ubuntu-20.04
     steps:
+      - uses: actions/setup-go@v2
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
       - uses: actions/checkout@v2
 
       - name: Restore go cache

.golangci.yaml

@@ -15,6 +15,7 @@ linters:
     - dogsled
     - dupl
     - errcheck
+    - exportloopref
     - funlen
     - gocognit
     - goconst
@@ -22,7 +23,6 @@ linters:
     - gocyclo
     - gofmt
     - goimports
-    - golint
     - goprintffuncname
     - gosec
     - gosimple
@@ -31,8 +31,8 @@ linters:
     - misspell
     - nakedret
     - nolintlint
+    - revive
     - rowserrcheck
-    - scopelint
     - staticcheck
     - structcheck
     - stylecheck
@@ -49,11 +49,13 @@ linters:
 #    - godot
 #    - godox
 #    - goerr113
+#    - golint      # deprecated
 #    - gomnd       # this is too aggressive
 #    - interfacer  # this is a good idea, but is no longer supported and is prone to false positives
 #    - lll         # without a way to specify per-line exception cases, this is not usable
 #    - maligned    # this is an excellent linter, but tricky to optimize and we are not sensitive to memory layout optimizations
 #    - nestif
 #    - prealloc    # following this rule isn't consistently a good idea, as it sometimes forces unnecessary allocations that result in less idiomatic code
+#    - scopelint   # deprecated
 #    - testpackage
-#    - wsl
+#    - wsl         # this doens't have an auto-fixer yet and is pretty noisy (https://github.com/bombsimon/wsl/issues/90)

.goreleaser.yaml

@@ -12,8 +12,7 @@ builds:
     env:
       - CGO_ENABLED=0
     goos:
-      # windows not supported yet (due to jotframe)
-      # - windows
+      - windows
       - linux
     goarch:
       - amd64
@@ -27,7 +26,7 @@ builds:
       -X github.com/anchore/syft/internal/version.gitCommit={{.Commit}}
       -X github.com/anchore/syft/internal/version.buildDate={{.Date}}
       -X github.com/anchore/syft/internal/version.gitTreeState={{.Env.BUILD_GIT_TREE_STATE}}
-  # For more info on this macOS build, see: https://github.com/mitchellh/gon#usage-with-goreleaser
+    # For more info on this macOS build, see: https://github.com/mitchellh/gon#usage-with-goreleaser
   - binary: syft
     id: syft-macos
     env:

Makefile

@@ -101,9 +101,10 @@ $(TEMPDIR):
 .PHONY: bootstrap-tools
 bootstrap-tools: $(TEMPDIR)
 	GO111MODULE=off GOBIN=$(shell realpath $(TEMPDIR)) go get -u golang.org/x/perf/cmd/benchstat
-	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(TEMPDIR)/ v1.26.0
+	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(TEMPDIR)/ v1.42.1
 	curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMPDIR)/ v0.2.0
-	curl -sfL https://install.goreleaser.com/github.com/goreleaser/goreleaser.sh | sh -s -- -b $(TEMPDIR)/ v0.177.0
+	curl -sSfL https://raw.githubusercontent.com/anchore/chronicle/main/install.sh | sh -s -- -b $(TEMPDIR)/ v0.2.0-beta
+	.github/scripts/goreleaser-install.sh -b $(TEMPDIR)/ v0.177.0
 
 .PHONY: bootstrap-go
 bootstrap-go:
@@ -251,31 +252,14 @@ cli: $(SNAPSHOTDIR) ## Run CLI tests
 
 .PHONY: changlog-release
 changelog-release:
-	@echo "Last tag: $(SECOND_TO_LAST_TAG)"
-	@docker run --rm \
-		-v "$(shell pwd)":/usr/local/src/your-app \
-		ferrarimarco/github-changelog-generator \
-		--user anchore \
-		--project $(BIN) \
-		-t ${GITHUB_TOKEN} \
-		--exclude-labels 'duplicate,question,invalid,wontfix,size:small,size:medium,size:large,size:x-large' \
-		--no-pr-wo-labels \
-		--no-issues-wo-labels \
-		--since-tag $(SECOND_TO_LAST_TAG)
+	$(TEMPDIR)/chronicle --since-tag $(SECOND_TO_LAST_TAG) --until-tag $(LAST_TAG) -vv > CHANGELOG.md
 
 	@printf '\n$(BOLD)$(CYAN)Release $(VERSION) Changelog$(RESET)\n\n'
 	@cat CHANGELOG.md
 
 .PHONY: changelog-unreleased
 changelog-unreleased: ## show the current changelog that will be produced on the next release (note: requires GITHUB_TOKEN set)
-	@docker run -it --rm \
-		-v "$(shell pwd)":/usr/local/src/your-app \
-		ferrarimarco/github-changelog-generator \
-		--user anchore \
-		--project $(BIN) \
-		-t ${GITHUB_TOKEN} \
-		--exclude-labels 'duplicate,question,invalid,wontfix,size:small,size:medium,size:large,size:x-large' \
-		--since-tag $(LAST_TAG)
+	$(TEMPDIR)/chronicle --since-tag $(LAST_TAG) -vv > CHANGELOG.md
 
 	@printf '\n$(BOLD)$(CYAN)Unreleased Changes (closed PRs and issues will not be in the final changelog)$(RESET)\n'
 

README.md

@@ -1,4 +1,6 @@
-# syft
+<p align="center">
+    <img src="https://user-images.githubusercontent.com/5199289/136844524-1527b09f-c5cb-4aa9-be54-5aa92a6086c1.png" width="271">
+</p>
 
 [![Validations](https://github.com/anchore/syft/actions/workflows/validations.yaml/badge.svg)](https://github.com/anchore/syft/actions/workflows/validations.yaml)
 [![Go Report Card](https://goreportcard.com/badge/github.com/anchore/syft)](https://goreportcard.com/report/github.com/anchore/syft)
@@ -9,17 +11,13 @@
 
 A CLI tool and go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Exceptional for vulnerability detection when used with a scanner tool like [Grype](https://github.com/anchore/grype).
 
-## We'll be at KubeCon 2021!
-
-Attending KubeCon 2021 in person? Join us for a meetup on **Tuesday, October 12th**.
-
-We’ll have free swag, giveaways, snacks, and sips. Space will be limited, so make sure to [save your seat](https://get.anchore.com/2021-kubecon-na-opensource-happy-hour/)!
+**Announcement:** Join us on October 20, 11am-noon PT for a webinar where we’ll discuss Anchore’s open source and enterprise solutions. [Save your seat!](https://get.anchore.com/anchore-open-source-vs-enterprise/)
 
 ---
 
 ![syft-demo](https://user-images.githubusercontent.com/590471/90277200-2a253000-de33-11ea-893f-32c219eea11a.gif)
 
-**Features**
+## Features
 - Catalog container images and filesystems to discover packages and libraries.
 - Supports packages and libraries from various ecosystems (APK, DEB, RPM, Ruby Bundles, Python Wheel/Egg/requirements.txt, JavaScript NPM/Yarn, Java JAR/EAR/WAR, Jenkins plugins JPI/HPI, Go modules)
 - Linux distribution identification (supports Alpine, BusyBox, CentOS/RedHat, Debian/Ubuntu flavored distributions)

cmd/packages.go

@@ -6,6 +6,8 @@ import (
 	"io/ioutil"
 	"os"
 
+	"github.com/anchore/syft/syft/format"
+
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/anchore"
@@ -48,8 +50,7 @@ const (
 )
 
 var (
-	packagesPresenterOpt packages.PresenterOption
-	packagesArgs         = cobra.MaximumNArgs(1)
+	packagesPresenterOpt format.Option
 	packagesCmd          = &cobra.Command{
 		Use:   "packages [SOURCE]",
 		Short: "Generate a package SBOM",
@@ -58,21 +59,13 @@ var (
 			"appName": internal.ApplicationName,
 			"command": "packages",
 		}),
-		Args:          packagesArgs,
+		Args:          validateInputArgs,
 		SilenceUsage:  true,
 		SilenceErrors: true,
 		PreRunE: func(cmd *cobra.Command, args []string) error {
-			if len(args) == 0 {
-				err := cmd.Help()
-				if err != nil {
-					return err
-				}
-				return fmt.Errorf("an image/directory argument is required")
-			}
-
 			// set the presenter
-			presenterOption := packages.ParsePresenterOption(appConfig.Output)
-			if presenterOption == packages.UnknownPresenterOption {
+			presenterOption := format.ParseOption(appConfig.Output)
+			if presenterOption == format.UnknownFormatOption {
 				return fmt.Errorf("bad --output value '%s'", appConfig.Output)
 			}
 			packagesPresenterOpt = presenterOption
@@ -102,15 +95,15 @@ func init() {
 }
 
 func setPackageFlags(flags *pflag.FlagSet) {
-	///////// Formatting & Input options //////////////////////////////////////////////
+	// Formatting & Input options //////////////////////////////////////////////
 
 	flags.StringP(
 		"scope", "s", source.SquashedScope.String(),
 		fmt.Sprintf("selection of layers to catalog, options=%v", source.AllScopes))
 
 	flags.StringP(
-		"output", "o", string(packages.TablePresenterOption),
-		fmt.Sprintf("report output formatter, options=%v", packages.AllPresenters),
+		"output", "o", string(format.TableOption),
+		fmt.Sprintf("report output formatter, options=%v", format.AllPresenters),
 	)
 
 	flags.StringP(
@@ -118,7 +111,7 @@ func setPackageFlags(flags *pflag.FlagSet) {
 		"file to write the report output to (default is STDOUT)",
 	)
 
-	///////// Upload options //////////////////////////////////////////////////////////
+	// Upload options //////////////////////////////////////////////////////////
 	flags.StringP(
 		"host", "H", "",
 		"the hostname or URL of the Anchore Enterprise instance to upload to",
@@ -151,7 +144,7 @@ func setPackageFlags(flags *pflag.FlagSet) {
 }
 
 func bindPackagesConfigOptions(flags *pflag.FlagSet) error {
-	///////// Formatting & Input options //////////////////////////////////////////////
+	// Formatting & Input options //////////////////////////////////////////////
 
 	if err := viper.BindPFlag("package.cataloger.scope", flags.Lookup("scope")); err != nil {
 		return err
@@ -165,7 +158,7 @@ func bindPackagesConfigOptions(flags *pflag.FlagSet) error {
 		return err
 	}
 
-	///////// Upload options //////////////////////////////////////////////////////////
+	// Upload options //////////////////////////////////////////////////////////
 
 	if err := viper.BindPFlag("anchore.host", flags.Lookup("host")); err != nil {
 		return err
@@ -194,6 +187,18 @@ func bindPackagesConfigOptions(flags *pflag.FlagSet) error {
 	return nil
 }
 
+func validateInputArgs(cmd *cobra.Command, args []string) error {
+	if len(args) == 0 {
+		// in the case that no arguments are given we want to show the help text and return with a non-0 return code.
+		if err := cmd.Help(); err != nil {
+			return fmt.Errorf("unable to display help: %w", err)
+		}
+		return fmt.Errorf("an image/directory argument is required")
+	}
+
+	return cobra.MaximumNArgs(1)(cmd, args)
+}
+
 func packagesExec(_ *cobra.Command, args []string) error {
 	// could be an image or a directory, with or without a scheme
 	userInput := args[0]
@@ -214,10 +219,21 @@ func packagesExec(_ *cobra.Command, args []string) error {
 		setupSignals(),
 		eventSubscription,
 		stereoscope.Cleanup,
-		ui.Select(appConfig.CliOptions.Verbosity > 0, appConfig.Quiet, reporter)...,
+		ui.Select(isVerbose(), appConfig.Quiet, reporter)...,
 	)
 }
 
+func isVerbose() (result bool) {
+	isPipedInput, err := internal.IsPipedInput()
+	if err != nil {
+		// since we can't tell if there was piped input we assume that there could be to disable the ETUI
+		log.Warnf("unable to determine if there is piped input: %+v", err)
+		return true
+	}
+	// verbosity should consider if there is piped input (in which case we should not show the ETUI)
+	return appConfig.CliOptions.Verbosity > 0 || isPipedInput
+}
+
 func packagesExecWorker(userInput string) <-chan error {
 	errs := make(chan error)
 	go func() {

cmd/power_user.go

@@ -35,19 +35,11 @@ var powerUserCmd = &cobra.Command{
 		"appName": internal.ApplicationName,
 		"command": "power-user",
 	}),
-	Args:          cobra.MaximumNArgs(1),
+	Args:          validateInputArgs,
 	Hidden:        true,
 	SilenceUsage:  true,
 	SilenceErrors: true,
 	PreRunE: func(cmd *cobra.Command, args []string) error {
-		if len(args) == 0 {
-			err := cmd.Help()
-			if err != nil {
-				return err
-			}
-			return fmt.Errorf("an image/directory argument is required")
-		}
-
 		if appConfig.Dev.ProfileCPU && appConfig.Dev.ProfileMem {
 			return fmt.Errorf("cannot profile CPU and memory simultaneously")
 		}
@@ -91,7 +83,7 @@ func powerUserExec(_ *cobra.Command, args []string) error {
 		setupSignals(),
 		eventSubscription,
 		stereoscope.Cleanup,
-		ui.Select(appConfig.CliOptions.Verbosity > 0, appConfig.Quiet, reporter)...,
+		ui.Select(isVerbose(), appConfig.Quiet, reporter)...,
 	)
 }
 

cmd/report_writer.go

@@ -11,18 +11,22 @@ import (
 
 func reportWriter() (io.Writer, func() error, error) {
 	nop := func() error { return nil }
-
 	path := strings.TrimSpace(appConfig.File)
+
 	switch len(path) {
 	case 0:
 		return os.Stdout, nop, nil
+
 	default:
 		reportFile, err := os.OpenFile(path, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0644)
+
 		if err != nil {
 			return nil, nop, fmt.Errorf("unable to create report file: %w", err)
 		}
+
 		return reportFile, func() error {
 			log.Infof("report written to file=%q", path)
+
 			return reportFile.Close()
 		}, nil
 	}

cmd/root.go

@@ -33,6 +33,7 @@ func init() {
 		flag, "q", false,
 		"suppress all logging output",
 	)
+
 	if err := viper.BindPFlag(flag, rootCmd.PersistentFlags().Lookup(flag)); err != nil {
 		fmt.Printf("unable to bind flag '%s': %+v", flag, err)
 		os.Exit(1)

go.mod

@@ -11,25 +11,26 @@ require (
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29
-	github.com/anchore/stereoscope v0.0.0-20211005213828-538011008578
+	github.com/anchore/stereoscope v0.0.0-20211021140357-9f8395cd95af
 	github.com/antihax/optional v1.0.0
 	github.com/bmatcuk/doublestar/v2 v2.0.4
 	github.com/docker/docker v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible
 	github.com/dustin/go-humanize v1.0.0
 	github.com/facebookincubator/nvdtools v0.1.4
 	github.com/go-test/deep v1.0.7
-	github.com/google/uuid v1.1.1
+	github.com/google/go-cmp v0.4.1
+	github.com/google/uuid v1.2.0
 	github.com/gookit/color v1.2.7
 	github.com/hashicorp/go-multierror v1.1.0
 	github.com/hashicorp/go-version v1.2.0
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/mitchellh/mapstructure v1.3.1
 	github.com/olekukonko/tablewriter v0.0.4
-	github.com/pelletier/go-toml v1.8.0
+	github.com/pelletier/go-toml v1.8.1
 	github.com/pkg/profile v1.5.0
 	github.com/scylladb/go-set v1.0.2
 	github.com/sergi/go-diff v1.1.0
-	github.com/sirupsen/logrus v1.6.0
+	github.com/sirupsen/logrus v1.8.1
 	github.com/spdx/tools-golang v0.1.0
 	github.com/spf13/afero v1.2.2
 	github.com/spf13/cobra v1.0.1-0.20200909172742-8a63648dd905
@@ -42,8 +43,8 @@ require (
 	github.com/wagoodman/jotframe v0.0.0-20200730190914-3517092dd163
 	github.com/x-cray/logrus-prefixed-formatter v0.5.2
 	github.com/xeipuuv/gojsonschema v1.2.0
-	golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9
 	golang.org/x/mod v0.3.0
 	golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d
-	gopkg.in/yaml.v2 v2.3.0
+	golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1
+	gopkg.in/yaml.v2 v2.4.0
 )

go.sum

@@ -73,7 +73,6 @@ github.com/Azure/go-autorest/autorest/validation v0.1.0/go.mod h1:Ha3z/SqBeaalWQ
 github.com/Azure/go-autorest/autorest/validation v0.2.0/go.mod h1:3EEqHnBxQGHXRYq3HT1WyXAvT7LLY3tl70hw6tQIbjI=
 github.com/Azure/go-autorest/logger v0.1.0/go.mod h1:oExouG+K6PryycPJfVSxi/koC6LSNgds39diKLz7Vrc=
 github.com/Azure/go-autorest/tracing v0.5.0/go.mod h1:r/s2XiOKccPW3HrqB+W0TQzfbtp2fGCgRFtBroKn4Dk=
-github.com/BurntSushi/toml v0.3.1 h1:WXkYYl6Yr3qBf1K79EBnL4mak0OimBfB0XUf9Vl28OQ=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/Djarvur/go-err113 v0.0.0-20200410182137-af658d038157/go.mod h1:4UJr5HIiMZrwgkSPdsjy2uOQExX/WEILpIrO9UPGuXs=
@@ -117,8 +116,8 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZV
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29 h1:K9LfnxwhqvihqU0+MF325FNy7fsKV9EGaUxdfR4gnWk=
 github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29/go.mod h1:Oc1UkGaJwY6ND6vtAqPSlYrptKRJngHwkwB6W7l1uP0=
-github.com/anchore/stereoscope v0.0.0-20211005213828-538011008578 h1:gSpftl0RWfdTwlPmsOLgEawHIw16xwwG1mFD/wrVDRE=
-github.com/anchore/stereoscope v0.0.0-20211005213828-538011008578/go.mod h1:kL7jfbXblrDcBhu5ja/s+VTYL3Mzof4eQNMJiSqcwXQ=
+github.com/anchore/stereoscope v0.0.0-20211021140357-9f8395cd95af h1:0w24yOOJx6DiaLvptAfp/Mro2cQkEcR7P1WRbL2apHw=
+github.com/anchore/stereoscope v0.0.0-20211021140357-9f8395cd95af/go.mod h1:Rqltg0KqVKoDy4kCuJMLPFDfUg7pEmSqUEA9pOO1L7c=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/antihax/optional v1.0.0 h1:xK2lYat7ZLaVVcIuj82J8kIro4V6kDe0AUDFboUCwcg=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
@@ -148,6 +147,8 @@ github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb/go.mod h1:PkYb9DJNAw
 github.com/blang/semver v3.5.0+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
 github.com/bmatcuk/doublestar/v2 v2.0.4 h1:6I6oUiT/sU27eE2OFcWqBhL1SwjyvQuOssxT4a1yidI=
 github.com/bmatcuk/doublestar/v2 v2.0.4/go.mod h1:QMmcs3H2AUQICWhfzLXz+IYln8lRQmTZRptLie8RgRw=
+github.com/bmatcuk/doublestar/v4 v4.0.2 h1:X0krlUVAVmtr2cRoTqR8aDMrDqnB36ht8wpWTiQ3jsA=
+github.com/bmatcuk/doublestar/v4 v4.0.2/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/bombsimon/wsl/v2 v2.0.0/go.mod h1:mf25kr/SqFEPhhcxW1+7pxzGlW+hIl/hYTKY95VwV8U=
 github.com/bombsimon/wsl/v2 v2.2.0/go.mod h1:Azh8c3XGEJl9LyX0/sFC+CKMc7Ssgua0g+6abzXN4Pg=
 github.com/bombsimon/wsl/v3 v3.0.0/go.mod h1:st10JtZYLE4D5sC7b8xV4zTKZwAQjCH/Hy2Pm1FNZIc=
@@ -374,8 +375,9 @@ github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm4
 github.com/google/rpmpack v0.0.0-20191226140753-aa36bfddb3a0/go.mod h1:RaTPr0KUf2K7fnZYLNDrr8rxAamWs3iNywJLtQ2AzBg=
 github.com/google/subcommands v1.0.1/go.mod h1:ZjhPrFU+Olkh9WazFPsl27BQ4UPiG37m3yTrtFlrHVk=
 github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.1.1 h1:Gkbcsh/GbpXz7lPftLA3P6TYMwjCLYm83jiFQZF/3gY=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.2.0 h1:qJYtXnJRWmpe7m/3XlyhrsLrEURqHRM2kxzoxXqyUDs=
+github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/wire v0.3.0/go.mod h1:i1DMg/Lu8Sz5yYl25iOdmc5CT5qusaa+zmRWs16741s=
 github.com/google/wire v0.4.0/go.mod h1:ngWDr9Qvq3yZA10YrxfyGELY/AFWGVpy9c1LTRi1EoU=
 github.com/googleapis/gax-go v2.0.2+incompatible/go.mod h1:SFVmujtThgffbyetf+mdk2eWhX2bMyUtNHzFKcPA9HY=
@@ -479,7 +481,6 @@ github.com/klauspost/cpuid v0.0.0-20180405133222-e7e905edc00e/go.mod h1:Pj4uuM52
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/konsorten/go-windows-terminal-sequences v1.0.3 h1:CE8S1cTafDpPvMhIxNJKvHsGVBgn1xWYf1NbHQhywc8=
 github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
@@ -595,8 +596,9 @@ github.com/opencontainers/runtime-spec v1.0.2/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
-github.com/pelletier/go-toml v1.8.0 h1:Keo9qb7iRJs2voHvunFtuuYFsbWeOBh8/P9v/kVMFtw=
 github.com/pelletier/go-toml v1.8.0/go.mod h1:D6yutnOGMveHEPV7VQOuvI/gXY61bv+9bAOTRnLElKs=
+github.com/pelletier/go-toml v1.8.1 h1:1Nf83orprkJyknT6h7zbuEGUEjcyVlCxSUGTENmNCRM=
+github.com/pelletier/go-toml v1.8.1/go.mod h1:T2/BmBdy8dvIRq1a/8aqjN41wvWlN4lrapLU/GW4pbc=
 github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
 github.com/phayes/checkstyle v0.0.0-20170904204023-bfd46e6a821d/go.mod h1:3OzsM7FXDQlpCiw2j81fOmAwQLnZnLGXVKUzeKQXIAw=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -660,8 +662,9 @@ github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPx
 github.com/sirupsen/logrus v1.3.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
-github.com/sirupsen/logrus v1.6.0 h1:UBcNElsrwanuuMsnGSlYmtmgbb23qDR5dG+6X6Oo89I=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
+github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
+github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
 github.com/smartystreets/assertions v1.0.0 h1:UVQPSSmc3qtTi+zPPkCXvZX9VvW/xT/NsRvKfwY81a8=
 github.com/smartystreets/assertions v1.0.0/go.mod h1:kHHU4qYBaI3q23Pp3VPrmWhuIUrLW/7eUrw0BU5VaoM=
@@ -800,9 +803,8 @@ golang.org/x/crypto v0.0.0-20191002192127-34f69633bfdc/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191206172530-e9b2fee46413/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20200510223506-06a226fb4e37 h1:cg5LA/zNPRzIXIWSCxQW10Rvpy94aQh3LT/ShoCpkHw=
 golang.org/x/crypto v0.0.0-20200510223506-06a226fb4e37/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 h1:psW17arqaxU48Z5kZ0CQnkZWQJsqcURM6tKiBApRjXI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190125153040-c74c464bbbf2/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -944,6 +946,7 @@ golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da h1:b3NXsE2LusjYGGjL5bxEVZZORm/YEFFrWFjR8eFrw/c=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1 h1:v+OssWQX+hTHEmOBgwxdZxK4zHq3yOs8F9J7mk0PY8E=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1138,8 +1141,9 @@ gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=

internal/anchore/import_package_sbom.go

@@ -8,7 +8,7 @@ import (
 	"fmt"
 	"net/http"
 
-	"github.com/anchore/syft/internal/presenter/packages"
+	"github.com/anchore/syft/internal/formats/syftjson"
 
 	"github.com/wagoodman/go-progress"
 
@@ -26,8 +26,8 @@ type packageSBOMImportAPI interface {
 
 func packageSbomModel(s source.Metadata, catalog *pkg.Catalog, d *distro.Distro, scope source.Scope) (*external.ImagePackageManifest, error) {
 	var buf bytes.Buffer
-	pres := packages.NewJSONPresenter(catalog, s, d, scope)
-	err := pres.Present(&buf)
+
+	err := syftjson.Format().Presenter(catalog, &s, d, scope).Present(&buf)
 	if err != nil {
 		return nil, fmt.Errorf("unable to serialize results: %w", err)
 	}

internal/anchore/import_package_sbom_test.go

@@ -9,18 +9,15 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/anchore/syft/internal/presenter/packages"
-
-	"github.com/wagoodman/go-progress"
-
-	"github.com/anchore/syft/syft/distro"
-
-	"github.com/docker/docker/pkg/ioutils"
-
 	"github.com/anchore/client-go/pkg/external"
+	"github.com/anchore/syft/internal/formats/syftjson"
+	syftjsonModel "github.com/anchore/syft/internal/formats/syftjson/model"
+	"github.com/anchore/syft/syft/distro"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
+	"github.com/docker/docker/pkg/ioutils"
 	"github.com/go-test/deep"
+	"github.com/wagoodman/go-progress"
 )
 
 func must(c pkg.CPE, e error) pkg.CPE {
@@ -88,19 +85,19 @@ func TestPackageSbomToModel(t *testing.T) {
 	}
 
 	var buf bytes.Buffer
-	pres := packages.NewJSONPresenter(c, m, &d, source.AllLayersScope)
+	pres := syftjson.Format().Presenter(c, &m, &d, source.AllLayersScope)
 	if err := pres.Present(&buf); err != nil {
 		t.Fatalf("unable to get expected json: %+v", err)
 	}
 
 	// unmarshal expected result
-	var expectedDoc packages.JSONDocument
+	var expectedDoc syftjsonModel.Document
 	if err := json.Unmarshal(buf.Bytes(), &expectedDoc); err != nil {
 		t.Fatalf("unable to parse json doc: %+v", err)
 	}
 
 	// unmarshal actual result
-	var actualDoc packages.JSONDocument
+	var actualDoc syftjsonModel.Document
 	if err := json.Unmarshal(modelJSON, &actualDoc); err != nil {
 		t.Fatalf("unable to parse json doc: %+v", err)
 	}

internal/config/application.go

@@ -89,42 +89,18 @@ func (cfg Application) loadDefaultValues(v *viper.Viper) {
 	}
 }
 
-// build inflates simple config values into syft native objects (or other complex objects) after the config is fully read in.
 func (cfg *Application) parseConfigValues() error {
-	if cfg.Quiet {
-		// TODO: this is bad: quiet option trumps all other logging options
-		// we should be able to quiet the console logging and leave file logging alone...
-		// ... this will be an enhancement for later
-		cfg.Log.LevelOpt = logrus.PanicLevel
-	} else {
-		if cfg.Log.Level != "" {
-			if cfg.CliOptions.Verbosity > 0 {
-				return fmt.Errorf("cannot explicitly set log level (cfg file or env var) and use -v flag together")
-			}
-
-			lvl, err := logrus.ParseLevel(strings.ToLower(cfg.Log.Level))
-			if err != nil {
-				return fmt.Errorf("bad log level configured (%q): %w", cfg.Log.Level, err)
-			}
-			// set the log level explicitly
-			cfg.Log.LevelOpt = lvl
-		} else {
-			// set the log level implicitly
-			switch v := cfg.CliOptions.Verbosity; {
-			case v == 1:
-				cfg.Log.LevelOpt = logrus.InfoLevel
-			case v >= 2:
-				cfg.Log.LevelOpt = logrus.DebugLevel
-			default:
-				cfg.Log.LevelOpt = logrus.WarnLevel
-			}
+	// parse application config options
+	for _, optionFn := range []func() error{
+		cfg.parseUploadOptions,
+		cfg.parseLogLevelOption,
+	} {
+		if err := optionFn(); err != nil {
+			return err
 		}
 	}
 
-	if cfg.Anchore.Host == "" && cfg.Anchore.Dockerfile != "" {
-		return fmt.Errorf("cannot provide dockerfile option without enabling upload")
-	}
-
+	// parse nested config options
 	// for each field in the configuration struct, see if the field implements the parser interface
 	// note: the app config is a pointer, so we need to grab the elements explicitly (to traverse the address)
 	value := reflect.ValueOf(cfg).Elem()
@@ -137,6 +113,48 @@ func (cfg *Application) parseConfigValues() error {
 			}
 		}
 	}
+	return nil
+}
+
+func (cfg *Application) parseUploadOptions() error {
+	if cfg.Anchore.Host == "" && cfg.Anchore.Dockerfile != "" {
+		return fmt.Errorf("cannot provide dockerfile option without enabling upload")
+	}
+	return nil
+}
+
+func (cfg *Application) parseLogLevelOption() error {
+	switch {
+	case cfg.Quiet:
+		// TODO: this is bad: quiet option trumps all other logging options (such as to a file on disk)
+		// we should be able to quiet the console logging and leave file logging alone...
+		// ... this will be an enhancement for later
+		cfg.Log.LevelOpt = logrus.PanicLevel
+	case cfg.Log.Level != "":
+		if cfg.CliOptions.Verbosity > 0 {
+			return fmt.Errorf("cannot explicitly set log level (cfg file or env var) and use -v flag together")
+		}
+
+		lvl, err := logrus.ParseLevel(strings.ToLower(cfg.Log.Level))
+		if err != nil {
+			return fmt.Errorf("bad log level configured (%q): %w", cfg.Log.Level, err)
+		}
+
+		cfg.Log.LevelOpt = lvl
+		if cfg.Log.LevelOpt >= logrus.InfoLevel {
+			cfg.CliOptions.Verbosity = 1
+		}
+	default:
+
+		switch v := cfg.CliOptions.Verbosity; {
+		case v == 1:
+			cfg.Log.LevelOpt = logrus.InfoLevel
+		case v >= 2:
+			cfg.Log.LevelOpt = logrus.DebugLevel
+		default:
+			cfg.Log.LevelOpt = logrus.ErrorLevel
+		}
+	}
 
 	return nil
 }

internal/formats/common/testutils/utils.go

@@ -1,15 +1,16 @@
-package packages
+package testutils
 
 import (
 	"bytes"
 	"testing"
 
+	"github.com/anchore/syft/syft/presenter"
+
 	"github.com/anchore/go-testutils"
 	"github.com/anchore/stereoscope/pkg/filetree"
 	"github.com/anchore/stereoscope/pkg/imagetest"
 	"github.com/anchore/syft/syft/distro"
 	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/presenter"
 	"github.com/anchore/syft/syft/source"
 	"github.com/sergi/go-diff/diffmatchpatch"
 	"github.com/stretchr/testify/assert"
@@ -17,7 +18,7 @@ import (
 
 type redactor func(s []byte) []byte
 
-func assertPresenterAgainstGoldenImageSnapshot(t *testing.T, pres presenter.Presenter, testImage string, updateSnapshot bool, redactors ...redactor) {
+func AssertPresenterAgainstGoldenImageSnapshot(t *testing.T, pres presenter.Presenter, testImage string, updateSnapshot bool, redactors ...redactor) {
 	var buffer bytes.Buffer
 
 	// grab the latest image contents and persist
@@ -50,7 +51,7 @@ func assertPresenterAgainstGoldenImageSnapshot(t *testing.T, pres presenter.Pres
 	}
 }
 
-func assertPresenterAgainstGoldenSnapshot(t *testing.T, pres presenter.Presenter, updateSnapshot bool, redactors ...redactor) {
+func AssertPresenterAgainstGoldenSnapshot(t *testing.T, pres presenter.Presenter, updateSnapshot bool, redactors ...redactor) {
 	var buffer bytes.Buffer
 
 	err := pres.Present(&buffer)
@@ -77,7 +78,7 @@ func assertPresenterAgainstGoldenSnapshot(t *testing.T, pres presenter.Presenter
 	}
 }
 
-func presenterImageInput(t testing.TB, testImage string) (*pkg.Catalog, source.Metadata, *distro.Distro) {
+func ImageInput(t testing.TB, testImage string) (*pkg.Catalog, source.Metadata, *distro.Distro) {
 	t.Helper()
 	catalog := pkg.NewCatalog()
 	img := imagetest.GetGoldenFixtureImage(t, testImage)
@@ -104,7 +105,7 @@ func presenterImageInput(t testing.TB, testImage string) (*pkg.Catalog, source.M
 		},
 		PURL: "a-purl-1",
 		CPEs: []pkg.CPE{
-			must(pkg.NewCPE("cpe:2.3:*:some:package:1:*:*:*:*:*:*:*")),
+			pkg.MustCPE("cpe:2.3:*:some:package:1:*:*:*:*:*:*:*"),
 		},
 	})
 	catalog.Add(pkg.Package{
@@ -123,7 +124,7 @@ func presenterImageInput(t testing.TB, testImage string) (*pkg.Catalog, source.M
 		},
 		PURL: "a-purl-2",
 		CPEs: []pkg.CPE{
-			must(pkg.NewCPE("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*")),
+			pkg.MustCPE("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"),
 		},
 	})
 
@@ -139,7 +140,7 @@ func presenterImageInput(t testing.TB, testImage string) (*pkg.Catalog, source.M
 	return catalog, src.Metadata, &dist
 }
 
-func presenterDirectoryInput(t testing.TB) (*pkg.Catalog, source.Metadata, *distro.Distro) {
+func DirectoryInput(t testing.TB) (*pkg.Catalog, source.Metadata, *distro.Distro) {
 	catalog := pkg.NewCatalog()
 
 	// populate catalog with test data
@@ -160,13 +161,13 @@ func presenterDirectoryInput(t testing.TB) (*pkg.Catalog, source.Metadata, *dist
 			Version: "1.0.1",
 			Files: []pkg.PythonFileRecord{
 				{
-					Path: "/some/path/pkg1/depedencies/foo",
+					Path: "/some/path/pkg1/dependencies/foo",
 				},
 			},
 		},
 		PURL: "a-purl-2",
 		CPEs: []pkg.CPE{
-			must(pkg.NewCPE("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*")),
+			pkg.MustCPE("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"),
 		},
 	})
 	catalog.Add(pkg.Package{
@@ -185,7 +186,7 @@ func presenterDirectoryInput(t testing.TB) (*pkg.Catalog, source.Metadata, *dist
 		},
 		PURL: "a-purl-2",
 		CPEs: []pkg.CPE{
-			must(pkg.NewCPE("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*")),
+			pkg.MustCPE("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"),
 		},
 	})
 

internal/formats/formats.go

@@ -0,0 +1,34 @@
+package formats
+
+import (
+	"bytes"
+
+	"github.com/anchore/syft/internal/formats/syftjson"
+	"github.com/anchore/syft/syft/format"
+)
+
+// TODO: eventually this is the source of truth for all formatters
+func All() []format.Format {
+	return []format.Format{
+		syftjson.Format(),
+	}
+}
+
+func Identify(by []byte) (*format.Format, error) {
+	for _, f := range All() {
+		if err := f.Validate(bytes.NewReader(by)); err != nil {
+			continue
+		}
+		return &f, nil
+	}
+	return nil, nil
+}
+
+func ByOption(option format.Option) *format.Format {
+	for _, f := range All() {
+		if f.Option == option {
+			return &f
+		}
+	}
+	return nil
+}

internal/formats/formats_test.go

@@ -0,0 +1,34 @@
+package formats
+
+import (
+	"io"
+	"os"
+	"testing"
+
+	"github.com/anchore/syft/syft/format"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIdentify(t *testing.T) {
+	tests := []struct {
+		fixture  string
+		expected format.Option
+	}{
+		{
+			fixture:  "test-fixtures/alpine-syft.json",
+			expected: format.JSONOption,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.fixture, func(t *testing.T) {
+			f, err := os.Open(test.fixture)
+			assert.NoError(t, err)
+			by, err := io.ReadAll(f)
+			assert.NoError(t, err)
+			frmt, err := Identify(by)
+			assert.NoError(t, err)
+			assert.NotNil(t, frmt)
+			assert.Equal(t, test.expected, frmt.Option)
+		})
+	}
+}

internal/formats/syftjson/decoder.go

@@ -0,0 +1,24 @@
+package syftjson
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+
+	"github.com/anchore/syft/internal/formats/syftjson/model"
+	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+func decoder(reader io.Reader) (*pkg.Catalog, *source.Metadata, *distro.Distro, source.Scope, error) {
+	dec := json.NewDecoder(reader)
+
+	var doc model.Document
+	err := dec.Decode(&doc)
+	if err != nil {
+		return nil, nil, nil, source.UnknownScope, fmt.Errorf("unable to decode syft-json: %w", err)
+	}
+
+	return toSyftModel(doc)
+}

internal/formats/syftjson/decoder_test.go

@@ -0,0 +1,52 @@
+package syftjson
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+
+	"github.com/anchore/syft/syft/source"
+
+	"github.com/anchore/syft/internal/formats/common/testutils"
+	"github.com/go-test/deep"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestEncodeDecodeCycle(t *testing.T) {
+	testImage := "image-simple"
+	originalCatalog, originalMetadata, _ := testutils.ImageInput(t, testImage)
+
+	var buf bytes.Buffer
+	assert.NoError(t, encoder(&buf, originalCatalog, &originalMetadata, nil, source.SquashedScope))
+
+	actualCatalog, actualMetadata, _, _, err := decoder(bytes.NewReader(buf.Bytes()))
+	assert.NoError(t, err)
+
+	for _, d := range deep.Equal(originalMetadata, *actualMetadata) {
+		t.Errorf("metadata difference: %+v", d)
+	}
+
+	actualPackages := actualCatalog.Sorted()
+	for idx, p := range originalCatalog.Sorted() {
+		if !assert.Equal(t, p.Name, actualPackages[idx].Name) {
+			t.Errorf("different package at idx=%d: %s vs %s", idx, p.Name, actualPackages[idx].Name)
+			continue
+		}
+
+		// ids will never be equal
+		p.ID = ""
+		actualPackages[idx].ID = ""
+
+		for _, d := range deep.Equal(*p, *actualPackages[idx]) {
+			if strings.Contains(d, ".VirtualPath: ") {
+				// location.Virtual path is not exposed in the json output
+				continue
+			}
+			if strings.HasSuffix(d, "<nil slice> != []") {
+				// semantically the same
+				continue
+			}
+			t.Errorf("package difference (%s): %+v", p.Name, d)
+		}
+	}
+}

internal/formats/syftjson/encoder.go

@@ -0,0 +1,23 @@
+package syftjson
+
+import (
+	"encoding/json"
+	"io"
+
+	"github.com/anchore/syft/syft/distro"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+func encoder(output io.Writer, catalog *pkg.Catalog, srcMetadata *source.Metadata, d *distro.Distro, scope source.Scope) error {
+	// TODO: application config not available yet
+	doc := ToFormatModel(catalog, srcMetadata, d, scope, nil)
+
+	enc := json.NewEncoder(output)
+	// prevent > and < from being escaped in the payload
+	enc.SetEscapeHTML(false)
+	enc.SetIndent("", " ")
+
+	return enc.Encode(&doc)
+}

internal/formats/syftjson/encoder_test.go

@@ -0,0 +1,31 @@
+package syftjson
+
+import (
+	"flag"
+	"testing"
+
+	"github.com/anchore/syft/syft/source"
+
+	"github.com/anchore/syft/internal/formats/common/testutils"
+	"github.com/anchore/syft/syft/format"
+)
+
+var updateJson = flag.Bool("update-json", false, "update the *.golden files for json presenters")
+
+func TestDirectoryPresenter(t *testing.T) {
+	catalog, metadata, distro := testutils.DirectoryInput(t)
+	testutils.AssertPresenterAgainstGoldenSnapshot(t,
+		format.NewPresenter(encoder, catalog, &metadata, distro, source.SquashedScope),
+		*updateJson,
+	)
+}
+
+func TestImagePresenter(t *testing.T) {
+	testImage := "image-simple"
+	catalog, metadata, distro := testutils.ImageInput(t, testImage)
+	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
+		format.NewPresenter(encoder, catalog, &metadata, distro, source.SquashedScope),
+		testImage,
+		*updateJson,
+	)
+}

internal/formats/syftjson/format.go

@@ -0,0 +1,12 @@
+package syftjson
+
+import "github.com/anchore/syft/syft/format"
+
+func Format() format.Format {
+	return format.NewFormat(
+		format.JSONOption,
+		encoder,
+		decoder,
+		validator,
+	)
+}

internal/formats/syftjson/model/distro.go

@@ -0,0 +1,8 @@
+package model
+
+// Distro provides information about a detected Linux Distro.
+type Distro struct {
+	Name    string `json:"name"`    // Name of the Linux distribution
+	Version string `json:"version"` // Version of the Linux distribution (major or major.minor version)
+	IDLike  string `json:"idLike"`  // the ID_LIKE field found within the /etc/os-release file
+}

internal/formats/syftjson/model/document.go

@@ -0,0 +1,23 @@
+package model
+
+// Document represents the syft cataloging findings as a JSON document
+type Document struct {
+	Artifacts             []Package      `json:"artifacts"` // Artifacts is the list of packages discovered and placed into the catalog
+	ArtifactRelationships []Relationship `json:"artifactRelationships"`
+	Source                Source         `json:"source"`     // Source represents the original object that was cataloged
+	Distro                Distro         `json:"distro"`     // Distro represents the Linux distribution that was detected from the source
+	Descriptor            Descriptor     `json:"descriptor"` // Descriptor is a block containing self-describing information about syft
+	Schema                Schema         `json:"schema"`     // Schema is a block reserved for defining the version for the shape of this JSON document and where to find the schema document to validate the shape
+}
+
+// Descriptor describes what created the document as well as surrounding metadata
+type Descriptor struct {
+	Name          string      `json:"name"`
+	Version       string      `json:"version"`
+	Configuration interface{} `json:"configuration,omitempty"`
+}
+
+type Schema struct {
+	Version string `json:"version"`
+	URL     string `json:"url"`
+}

internal/formats/syftjson/model/package.go

@@ -0,0 +1,123 @@
+package model
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+// Package represents a pkg.Package object specialized for JSON marshaling and unmarshaling.
+type Package struct {
+	PackageBasicData
+	PackageCustomData
+}
+
+// PackageBasicData contains non-ambiguous values (type-wise) from pkg.Package.
+type PackageBasicData struct {
+	ID        string            `json:"id"`
+	Name      string            `json:"name"`
+	Version   string            `json:"version"`
+	Type      pkg.Type          `json:"type"`
+	FoundBy   string            `json:"foundBy"`
+	Locations []source.Location `json:"locations"`
+	Licenses  []string          `json:"licenses"`
+	Language  pkg.Language      `json:"language"`
+	CPEs      []string          `json:"cpes"`
+	PURL      string            `json:"purl"`
+}
+
+// PackageCustomData contains ambiguous values (type-wise) from pkg.Package.
+type PackageCustomData struct {
+	MetadataType pkg.MetadataType `json:"metadataType"`
+	Metadata     interface{}      `json:"metadata"`
+}
+
+// packageMetadataUnpacker is all values needed from Package to disambiguate ambiguous fields during json unmarshaling.
+type packageMetadataUnpacker struct {
+	MetadataType pkg.MetadataType `json:"metadataType"`
+	Metadata     json.RawMessage  `json:"metadata"`
+}
+
+func (p *packageMetadataUnpacker) String() string {
+	return fmt.Sprintf("metadataType: %s, metadata: %s", p.MetadataType, string(p.Metadata))
+}
+
+// UnmarshalJSON is a custom unmarshaller for handling basic values and values with ambiguous types.
+// nolint:funlen
+func (p *Package) UnmarshalJSON(b []byte) error {
+	var basic PackageBasicData
+	if err := json.Unmarshal(b, &basic); err != nil {
+		return err
+	}
+	p.PackageBasicData = basic
+
+	var unpacker packageMetadataUnpacker
+	if err := json.Unmarshal(b, &unpacker); err != nil {
+		log.Warnf("failed to unmarshall into packageMetadataUnpacker: %v", err)
+		return err
+	}
+
+	p.MetadataType = unpacker.MetadataType
+
+	switch p.MetadataType {
+	case pkg.ApkMetadataType:
+		var payload pkg.ApkMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	case pkg.RpmdbMetadataType:
+		var payload pkg.RpmdbMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	case pkg.DpkgMetadataType:
+		var payload pkg.DpkgMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	case pkg.JavaMetadataType:
+		var payload pkg.JavaMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	case pkg.RustCargoPackageMetadataType:
+		var payload pkg.CargoPackageMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	case pkg.GemMetadataType:
+		var payload pkg.GemMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	case pkg.KbPackageMetadataType:
+		var payload pkg.KbPackageMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	case pkg.PythonPackageMetadataType:
+		var payload pkg.PythonPackageMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	case pkg.NpmPackageJSONMetadataType:
+		var payload pkg.NpmPackageJSONMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	}
+
+	return nil
+}

internal/formats/syftjson/model/relationship.go

@@ -0,0 +1,8 @@
+package model
+
+type Relationship struct {
+	Parent   string      `json:"parent"`
+	Child    string      `json:"child"`
+	Type     string      `json:"type"`
+	Metadata interface{} `json:"metadata"`
+}

internal/formats/syftjson/model/source.go

@@ -0,0 +1,57 @@
+package model
+
+import (
+	"encoding/json"
+	"fmt"
+	"strconv"
+
+	"github.com/anchore/syft/syft/source"
+)
+
+// Source object represents the thing that was cataloged
+type Source struct {
+	Type   string      `json:"type"`
+	Target interface{} `json:"target"`
+}
+
+// sourceUnpacker is used to unmarshal Source objects
+type sourceUnpacker struct {
+	Type   string          `json:"type"`
+	Target json.RawMessage `json:"target"`
+}
+
+type ImageSource struct {
+	source.ImageMetadata
+	Scope source.Scope `json:"scope"`
+}
+
+// UnmarshalJSON populates a source object from JSON bytes.
+func (s *Source) UnmarshalJSON(b []byte) error {
+	var unpacker sourceUnpacker
+	if err := json.Unmarshal(b, &unpacker); err != nil {
+		return err
+	}
+
+	s.Type = unpacker.Type
+
+	switch s.Type {
+	case "directory":
+		if target, err := strconv.Unquote(string(unpacker.Target)); err == nil {
+			s.Target = target
+		} else {
+			s.Target = string(unpacker.Target[:])
+		}
+
+	case "image":
+		var payload ImageSource
+		if err := json.Unmarshal(unpacker.Target, &payload); err != nil {
+			return err
+		}
+		s.Target = payload
+
+	default:
+		return fmt.Errorf("unsupported package metadata type: %+v", s.Type)
+	}
+
+	return nil
+}

internal/formats/syftjson/test-fixtures/image-simple/Dockerfile

@@ -0,0 +1,4 @@
+# Note: changes to this file will result in updating several test values. Consider making a new image fixture instead of editing this one.
+FROM scratch
+ADD file-1.txt /somefile-1.txt
+ADD file-2.txt /somefile-2.txt

internal/formats/syftjson/test-fixtures/image-simple/file-1.txt

@@ -0,0 +1 @@
+this file has contents

internal/formats/syftjson/test-fixtures/image-simple/file-2.txt

@@ -0,0 +1 @@
+file-2 contents!

internal/formats/syftjson/test-fixtures/snapshot/TestDirectoryPresenter.golden

@@ -0,0 +1,86 @@
+{
+ "artifacts": [
+  {
+   "id": "package-1-id",
+   "name": "package-1",
+   "version": "1.0.1",
+   "type": "python",
+   "foundBy": "the-cataloger-1",
+   "locations": [
+    {
+     "path": "/some/path/pkg1"
+    }
+   ],
+   "licenses": [
+    "MIT"
+   ],
+   "language": "python",
+   "cpes": [
+    "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"
+   ],
+   "purl": "a-purl-2",
+   "metadataType": "PythonPackageMetadata",
+   "metadata": {
+    "name": "package-1",
+    "version": "1.0.1",
+    "license": "",
+    "author": "",
+    "authorEmail": "",
+    "platform": "",
+    "files": [
+     {
+      "path": "/some/path/pkg1/dependencies/foo"
+     }
+    ],
+    "sitePackagesRootPath": ""
+   }
+  },
+  {
+   "id": "package-2-id",
+   "name": "package-2",
+   "version": "2.0.1",
+   "type": "deb",
+   "foundBy": "the-cataloger-2",
+   "locations": [
+    {
+     "path": "/some/path/pkg1"
+    }
+   ],
+   "licenses": [],
+   "language": "",
+   "cpes": [
+    "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"
+   ],
+   "purl": "a-purl-2",
+   "metadataType": "DpkgMetadata",
+   "metadata": {
+    "package": "package-2",
+    "source": "",
+    "version": "2.0.1",
+    "sourceVersion": "",
+    "architecture": "",
+    "maintainer": "",
+    "installedSize": 0,
+    "files": null
+   }
+  }
+ ],
+ "artifactRelationships": [],
+ "source": {
+  "type": "directory",
+  "target": "/some/path"
+ },
+ "distro": {
+  "name": "debian",
+  "version": "1.2.3",
+  "idLike": "like!"
+ },
+ "descriptor": {
+  "name": "syft",
+  "version": "[not provided]"
+ },
+ "schema": {
+  "version": "1.1.0",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-1.1.0.json"
+ }
+}

internal/formats/syftjson/test-fixtures/snapshot/TestImagePresenter.golden

@@ -0,0 +1,108 @@
+{
+ "artifacts": [
+  {
+   "id": "package-1-id",
+   "name": "package-1",
+   "version": "1.0.1",
+   "type": "python",
+   "foundBy": "the-cataloger-1",
+   "locations": [
+    {
+     "path": "/somefile-1.txt",
+     "layerID": "sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59"
+    }
+   ],
+   "licenses": [
+    "MIT"
+   ],
+   "language": "python",
+   "cpes": [
+    "cpe:2.3:*:some:package:1:*:*:*:*:*:*:*"
+   ],
+   "purl": "a-purl-1",
+   "metadataType": "PythonPackageMetadata",
+   "metadata": {
+    "name": "package-1",
+    "version": "1.0.1",
+    "license": "",
+    "author": "",
+    "authorEmail": "",
+    "platform": "",
+    "sitePackagesRootPath": ""
+   }
+  },
+  {
+   "id": "package-2-id",
+   "name": "package-2",
+   "version": "2.0.1",
+   "type": "deb",
+   "foundBy": "the-cataloger-2",
+   "locations": [
+    {
+     "path": "/somefile-2.txt",
+     "layerID": "sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec"
+    }
+   ],
+   "licenses": [],
+   "language": "",
+   "cpes": [
+    "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"
+   ],
+   "purl": "a-purl-2",
+   "metadataType": "DpkgMetadata",
+   "metadata": {
+    "package": "package-2",
+    "source": "",
+    "version": "2.0.1",
+    "sourceVersion": "",
+    "architecture": "",
+    "maintainer": "",
+    "installedSize": 0,
+    "files": null
+   }
+  }
+ ],
+ "artifactRelationships": [],
+ "source": {
+  "type": "image",
+  "target": {
+   "userInput": "user-image-input",
+   "imageID": "sha256:2480160b55bec40c44d3b145c7b2c1c47160db8575c3dcae086d76b9370ae7ca",
+   "manifestDigest": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368",
+   "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
+   "tags": [
+    "stereoscope-fixture-image-simple:85066c51088bdd274f7a89e99e00490f666c49e72ffc955707cd6e18f0e22c5b"
+   ],
+   "imageSize": 38,
+   "layers": [
+    {
+     "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
+     "digest": "sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59",
+     "size": 22
+    },
+    {
+     "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
+     "digest": "sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec",
+     "size": 16
+    }
+   ],
+   "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NjcsImRpZ2VzdCI6InNoYTI1NjoyNDgwMTYwYjU1YmVjNDBjNDRkM2IxNDVjN2IyYzFjNDcxNjBkYjg1NzVjM2RjYWUwODZkNzZiOTM3MGFlN2NhIn0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1NjpmYjZiZWVjYjc1YjM5ZjRiYjgxM2RiZjE3N2U1MDFlZGQ1ZGRiM2U2OWJiNDVjZWRlYjc4YzY3NmVlMWI3YTU5In0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2OjMxOWI1ODhjZTY0MjUzYTg3YjUzM2M4ZWQwMWNmMDAyNWUwZWFjOThlN2I1MTZlMTI1MzI5NTdlMTI0NGZkZWMifV19",
+   "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8iLCJPbkJ1aWxkIjpudWxsfSwiY3JlYXRlZCI6IjIwMjEtMTAtMDRUMTE6NDA6MDAuNjM4Mzk0NVoiLCJoaXN0b3J5IjpbeyJjcmVhdGVkIjoiMjAyMS0xMC0wNFQxMTo0MDowMC41OTA3MzE2WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0xLnR4dCAvc29tZWZpbGUtMS50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn0seyJjcmVhdGVkIjoiMjAyMS0xMC0wNFQxMTo0MDowMC42MzgzOTQ1WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0yLnR4dCAvc29tZWZpbGUtMi50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6ZmI2YmVlY2I3NWIzOWY0YmI4MTNkYmYxNzdlNTAxZWRkNWRkYjNlNjliYjQ1Y2VkZWI3OGM2NzZlZTFiN2E1OSIsInNoYTI1NjozMTliNTg4Y2U2NDI1M2E4N2I1MzNjOGVkMDFjZjAwMjVlMGVhYzk4ZTdiNTE2ZTEyNTMyOTU3ZTEyNDRmZGVjIl19fQ==",
+   "repoDigests": [],
+   "scope": "Squashed"
+  }
+ },
+ "distro": {
+  "name": "debian",
+  "version": "1.2.3",
+  "idLike": "like!"
+ },
+ "descriptor": {
+  "name": "syft",
+  "version": "[not provided]"
+ },
+ "schema": {
+  "version": "1.1.0",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-1.1.0.json"
+ }
+}

internal/formats/syftjson/to_format_model.go

@@ -0,0 +1,133 @@
+package syftjson
+
+import (
+	"fmt"
+
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/formats/syftjson/model"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/version"
+	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+// TODO: this is export4ed for the use of the power-user command (temp)
+func ToFormatModel(catalog *pkg.Catalog, srcMetadata *source.Metadata, d *distro.Distro, scope source.Scope, applicationConfig interface{}) model.Document {
+	src, err := toSourceModel(srcMetadata, scope)
+	if err != nil {
+		log.Warnf("unable to create syft-json source object: %+v", err)
+	}
+
+	return model.Document{
+		Artifacts:             toPackageModels(catalog),
+		ArtifactRelationships: toRelationshipModel(pkg.NewRelationships(catalog)),
+		Source:                src,
+		Distro:                toDistroModel(d),
+		Descriptor: model.Descriptor{
+			Name:          internal.ApplicationName,
+			Version:       version.FromBuild().Version,
+			Configuration: applicationConfig,
+		},
+		Schema: model.Schema{
+			Version: internal.JSONSchemaVersion,
+			URL:     fmt.Sprintf("https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-%s.json", internal.JSONSchemaVersion),
+		},
+	}
+}
+
+func toPackageModels(catalog *pkg.Catalog) []model.Package {
+	artifacts := make([]model.Package, 0)
+	if catalog == nil {
+		return artifacts
+	}
+	for _, p := range catalog.Sorted() {
+		artifacts = append(artifacts, toPackageModel(p))
+	}
+	return artifacts
+}
+
+// toPackageModel crates a new Package from the given pkg.Package.
+func toPackageModel(p *pkg.Package) model.Package {
+	var cpes = make([]string, len(p.CPEs))
+	for i, c := range p.CPEs {
+		cpes[i] = c.BindToFmtString()
+	}
+
+	// ensure collections are never nil for presentation reasons
+	var locations = make([]source.Location, 0)
+	if p.Locations != nil {
+		locations = p.Locations
+	}
+
+	var licenses = make([]string, 0)
+	if p.Licenses != nil {
+		licenses = p.Licenses
+	}
+
+	return model.Package{
+		PackageBasicData: model.PackageBasicData{
+			ID:        string(p.ID),
+			Name:      p.Name,
+			Version:   p.Version,
+			Type:      p.Type,
+			FoundBy:   p.FoundBy,
+			Locations: locations,
+			Licenses:  licenses,
+			Language:  p.Language,
+			CPEs:      cpes,
+			PURL:      p.PURL,
+		},
+		PackageCustomData: model.PackageCustomData{
+			MetadataType: p.MetadataType,
+			Metadata:     p.Metadata,
+		},
+	}
+}
+
+func toRelationshipModel(relationships []pkg.Relationship) []model.Relationship {
+	result := make([]model.Relationship, len(relationships))
+	for i, r := range relationships {
+		result[i] = model.Relationship{
+			Parent:   string(r.Parent),
+			Child:    string(r.Child),
+			Type:     string(r.Type),
+			Metadata: r.Metadata,
+		}
+	}
+	return result
+}
+
+// toSourceModel creates a new source object to be represented into JSON.
+func toSourceModel(src *source.Metadata, scope source.Scope) (model.Source, error) {
+	switch src.Scheme {
+	case source.ImageScheme:
+		return model.Source{
+			Type: "image",
+			Target: model.ImageSource{
+				ImageMetadata: src.ImageMetadata,
+				Scope:         scope,
+			},
+		}, nil
+	case source.DirectoryScheme:
+		return model.Source{
+			Type:   "directory",
+			Target: src.Path,
+		}, nil
+	default:
+		return model.Source{}, fmt.Errorf("unsupported source: %q", src.Scheme)
+	}
+}
+
+// toDistroModel creates a struct with the Linux distribution to be represented in JSON.
+func toDistroModel(d *distro.Distro) model.Distro {
+	if d == nil {
+		return model.Distro{}
+	}
+
+	return model.Distro{
+		Name:    d.Name(),
+		Version: d.FullVersion(),
+		IDLike:  d.IDLike,
+	}
+}

internal/formats/syftjson/to_syft_model.go

@@ -0,0 +1,73 @@
+package syftjson
+
+import (
+	"github.com/anchore/syft/internal/formats/syftjson/model"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+func toSyftModel(doc model.Document) (*pkg.Catalog, *source.Metadata, *distro.Distro, source.Scope, error) {
+	dist, err := distro.NewDistro(distro.Type(doc.Distro.Name), doc.Distro.Version, doc.Distro.IDLike)
+	if err != nil {
+		return nil, nil, nil, source.UnknownScope, err
+	}
+
+	srcMetadata, scope := toSyftSourceData(doc.Source)
+
+	return toSyftCatalog(doc.Artifacts), srcMetadata, &dist, scope, nil
+}
+
+func toSyftSourceData(s model.Source) (*source.Metadata, source.Scope) {
+	switch s.Type {
+	case "directory":
+		return &source.Metadata{
+			Scheme: source.DirectoryScheme,
+			Path:   s.Target.(string),
+		}, source.UnknownScope
+	case "image":
+		parsedSource := s.Target.(model.ImageSource)
+		return &source.Metadata{
+			Scheme:        source.ImageScheme,
+			ImageMetadata: parsedSource.ImageMetadata,
+		}, parsedSource.Scope
+	}
+	return nil, source.UnknownScope
+}
+
+func toSyftCatalog(pkgs []model.Package) *pkg.Catalog {
+	catalog := pkg.NewCatalog()
+	for _, p := range pkgs {
+		catalog.Add(toSyftPackage(p))
+	}
+	return catalog
+}
+
+func toSyftPackage(p model.Package) pkg.Package {
+	var cpes []pkg.CPE
+	for _, c := range p.CPEs {
+		value, err := pkg.NewCPE(c)
+		if err != nil {
+			log.Warnf("excluding invalid CPE %q: %v", c, err)
+			continue
+		}
+
+		cpes = append(cpes, value)
+	}
+
+	return pkg.Package{
+		ID:           pkg.ID(p.ID),
+		Name:         p.Name,
+		Version:      p.Version,
+		FoundBy:      p.FoundBy,
+		Locations:    p.Locations,
+		Licenses:     p.Licenses,
+		Language:     p.Language,
+		Type:         p.Type,
+		CPEs:         cpes,
+		PURL:         p.PURL,
+		MetadataType: p.MetadataType,
+		Metadata:     p.Metadata,
+	}
+}

internal/formats/syftjson/validator.go

@@ -0,0 +1,31 @@
+package syftjson
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/anchore/syft/internal/formats/syftjson/model"
+)
+
+func validator(reader io.Reader) error {
+	type Document struct {
+		Schema model.Schema `json:"schema"`
+	}
+
+	dec := json.NewDecoder(reader)
+
+	var doc Document
+	err := dec.Decode(&doc)
+	if err != nil {
+		return fmt.Errorf("unable to decode: %w", err)
+	}
+
+	// note: we accept all schema versions
+	// TODO: add per-schema version parsing
+	if strings.Contains(doc.Schema.URL, "anchore/syft") {
+		return nil
+	}
+	return fmt.Errorf("could not extract syft schema")
+}

internal/input.go

@@ -0,0 +1,16 @@
+package internal
+
+import (
+	"fmt"
+	"os"
+)
+
+// IsPipedInput returns true if there is no input device, which means the user **may** be providing input via a pipe.
+func IsPipedInput() (bool, error) {
+	fi, err := os.Stdin.Stat()
+	if err != nil {
+		return false, fmt.Errorf("unable to determine if there is piped input: %w", err)
+	}
+
+	return fi.Mode()&os.ModeCharDevice == 0, nil
+}

internal/presenter/packages/cyclonedx_presenter_test.go

@@ -4,13 +4,15 @@ import (
 	"flag"
 	"regexp"
 	"testing"
+
+	"github.com/anchore/syft/internal/formats/common/testutils"
 )
 
 var updateCycloneDx = flag.Bool("update-cyclonedx", false, "update the *.golden files for cyclone-dx presenters")
 
 func TestCycloneDxDirectoryPresenter(t *testing.T) {
-	catalog, metadata, _ := presenterDirectoryInput(t)
-	assertPresenterAgainstGoldenSnapshot(t,
+	catalog, metadata, _ := testutils.DirectoryInput(t)
+	testutils.AssertPresenterAgainstGoldenSnapshot(t,
 		NewCycloneDxPresenter(catalog, metadata),
 		*updateCycloneDx,
 		cycloneDxRedactor,
@@ -19,8 +21,8 @@ func TestCycloneDxDirectoryPresenter(t *testing.T) {
 
 func TestCycloneDxImagePresenter(t *testing.T) {
 	testImage := "image-simple"
-	catalog, metadata, _ := presenterImageInput(t, testImage)
-	assertPresenterAgainstGoldenImageSnapshot(t,
+	catalog, metadata, _ := testutils.ImageInput(t, testImage)
+	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
 		NewCycloneDxPresenter(catalog, metadata),
 		testImage,
 		*updateCycloneDx,

internal/presenter/packages/json_distribution.go

@@ -1,23 +0,0 @@
-package packages
-
-import "github.com/anchore/syft/syft/distro"
-
-// JSONDistribution provides information about a detected Linux JSONDistribution.
-type JSONDistribution struct {
-	Name    string `json:"name"`    // Name of the Linux distribution
-	Version string `json:"version"` // Version of the Linux distribution (major or major.minor version)
-	IDLike  string `json:"idLike"`  // the ID_LIKE field found within the /etc/os-release file
-}
-
-// NewJSONDistribution creates a struct with the Linux distribution to be represented in JSON.
-func NewJSONDistribution(d *distro.Distro) JSONDistribution {
-	if d == nil {
-		return JSONDistribution{}
-	}
-
-	return JSONDistribution{
-		Name:    d.Name(),
-		Version: d.FullVersion(),
-		IDLike:  d.IDLike,
-	}
-}

internal/presenter/packages/json_document.go

@@ -1,62 +0,0 @@
-package packages
-
-import (
-	"fmt"
-
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/version"
-	"github.com/anchore/syft/syft/distro"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
-)
-
-// JSONDocument represents the syft cataloging findings as a JSON document
-type JSONDocument struct {
-	Artifacts             []JSONPackage      `json:"artifacts"` // Artifacts is the list of packages discovered and placed into the catalog
-	ArtifactRelationships []JSONRelationship `json:"artifactRelationships"`
-	Source                JSONSource         `json:"source"`     // Source represents the original object that was cataloged
-	Distro                JSONDistribution   `json:"distro"`     // Distro represents the Linux distribution that was detected from the source
-	Descriptor            JSONDescriptor     `json:"descriptor"` // Descriptor is a block containing self-describing information about syft
-	Schema                JSONSchema         `json:"schema"`     // Schema is a block reserved for defining the version for the shape of this JSON document and where to find the schema document to validate the shape
-}
-
-// NewJSONDocument creates and populates a new JSON document struct from the given cataloging results.
-func NewJSONDocument(catalog *pkg.Catalog, srcMetadata source.Metadata, d *distro.Distro, scope source.Scope, configuration interface{}) (JSONDocument, error) {
-	src, err := NewJSONSource(srcMetadata, scope)
-	if err != nil {
-		return JSONDocument{}, err
-	}
-
-	artifacts, err := NewJSONPackages(catalog)
-	if err != nil {
-		return JSONDocument{}, err
-	}
-
-	return JSONDocument{
-		Artifacts:             artifacts,
-		ArtifactRelationships: newJSONRelationships(pkg.NewRelationships(catalog)),
-		Source:                src,
-		Distro:                NewJSONDistribution(d),
-		Descriptor: JSONDescriptor{
-			Name:          internal.ApplicationName,
-			Version:       version.FromBuild().Version,
-			Configuration: configuration,
-		},
-		Schema: JSONSchema{
-			Version: internal.JSONSchemaVersion,
-			URL:     fmt.Sprintf("https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-%s.json", internal.JSONSchemaVersion),
-		},
-	}, nil
-}
-
-// JSONDescriptor describes what created the document as well as surrounding metadata
-type JSONDescriptor struct {
-	Name          string      `json:"name"`
-	Version       string      `json:"version"`
-	Configuration interface{} `json:"configuration,omitempty"`
-}
-
-type JSONSchema struct {
-	Version string `json:"version"`
-	URL     string `json:"url"`
-}

internal/presenter/packages/json_package.go

@@ -1,71 +0,0 @@
-package packages
-
-import (
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
-)
-
-// JSONPackage represents a pkg.Package object specialized for JSON marshaling and unmarshaling.
-type JSONPackage struct {
-	ID           string            `json:"id"`
-	Name         string            `json:"name"`
-	Version      string            `json:"version"`
-	Type         string            `json:"type"`
-	FoundBy      string            `json:"foundBy"`
-	Locations    []source.Location `json:"locations"`
-	Licenses     []string          `json:"licenses"`
-	Language     string            `json:"language"`
-	CPEs         []string          `json:"cpes"`
-	PURL         string            `json:"purl"`
-	MetadataType string            `json:"metadataType"`
-	Metadata     interface{}       `json:"metadata"`
-}
-
-func NewJSONPackages(catalog *pkg.Catalog) ([]JSONPackage, error) {
-	artifacts := make([]JSONPackage, 0)
-	if catalog == nil {
-		return artifacts, nil
-	}
-	for _, p := range catalog.Sorted() {
-		art, err := NewJSONPackage(p)
-		if err != nil {
-			return nil, err
-		}
-		artifacts = append(artifacts, art)
-	}
-	return artifacts, nil
-}
-
-// NewJSONPackage crates a new JSONPackage from the given pkg.Package.
-func NewJSONPackage(p *pkg.Package) (JSONPackage, error) {
-	var cpes = make([]string, len(p.CPEs))
-	for i, c := range p.CPEs {
-		cpes[i] = c.BindToFmtString()
-	}
-
-	// ensure collections are never nil for presentation reasons
-	var locations = make([]source.Location, 0)
-	if p.Locations != nil {
-		locations = p.Locations
-	}
-
-	var licenses = make([]string, 0)
-	if p.Licenses != nil {
-		licenses = p.Licenses
-	}
-
-	return JSONPackage{
-		ID:           string(p.ID),
-		Name:         p.Name,
-		Version:      p.Version,
-		Type:         string(p.Type),
-		FoundBy:      p.FoundBy,
-		Locations:    locations,
-		Licenses:     licenses,
-		Language:     string(p.Language),
-		CPEs:         cpes,
-		PURL:         p.PURL,
-		MetadataType: string(p.MetadataType),
-		Metadata:     p.Metadata,
-	}, nil
-}

internal/presenter/packages/json_presenter.go

@@ -1,43 +0,0 @@
-package packages
-
-import (
-	"encoding/json"
-	"io"
-
-	"github.com/anchore/syft/syft/distro"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
-)
-
-// JSONPresenter is a JSON presentation object for the syft results
-type JSONPresenter struct {
-	catalog     *pkg.Catalog
-	srcMetadata source.Metadata
-	distro      *distro.Distro
-	scope       source.Scope
-}
-
-// NewJSONPresenter creates a new JSON presenter object for the given cataloging results.
-func NewJSONPresenter(catalog *pkg.Catalog, s source.Metadata, d *distro.Distro, scope source.Scope) *JSONPresenter {
-	return &JSONPresenter{
-		catalog:     catalog,
-		srcMetadata: s,
-		distro:      d,
-		scope:       scope,
-	}
-}
-
-// Present the catalog results to the given writer.
-func (pres *JSONPresenter) Present(output io.Writer) error {
-	// we do not pass in configuration for backwards compatibility
-	doc, err := NewJSONDocument(pres.catalog, pres.srcMetadata, pres.distro, pres.scope, nil)
-	if err != nil {
-		return err
-	}
-
-	enc := json.NewEncoder(output)
-	// prevent > and < from being escaped in the payload
-	enc.SetEscapeHTML(false)
-	enc.SetIndent("", " ")
-	return enc.Encode(&doc)
-}

internal/presenter/packages/json_presenter_test.go

@@ -1,37 +0,0 @@
-package packages
-
-import (
-	"flag"
-	"testing"
-
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
-)
-
-var updateJSONGoldenFiles = flag.Bool("update-json", false, "update the *.golden files for json presenters")
-
-func must(c pkg.CPE, e error) pkg.CPE {
-	if e != nil {
-		panic(e)
-	}
-	return c
-}
-
-func TestJSONDirectoryPresenter(t *testing.T) {
-	catalog, metadata, dist := presenterDirectoryInput(t)
-	assertPresenterAgainstGoldenSnapshot(t,
-		NewJSONPresenter(catalog, metadata, dist, source.SquashedScope),
-		*updateJSONGoldenFiles,
-	)
-
-}
-
-func TestJSONImagePresenter(t *testing.T) {
-	testImage := "image-simple"
-	catalog, metadata, dist := presenterImageInput(t, testImage)
-	assertPresenterAgainstGoldenImageSnapshot(t,
-		NewJSONPresenter(catalog, metadata, dist, source.SquashedScope),
-		testImage,
-		*updateJSONGoldenFiles,
-	)
-}

internal/presenter/packages/json_relationship.go

@@ -1,23 +0,0 @@
-package packages
-
-import "github.com/anchore/syft/syft/pkg"
-
-type JSONRelationship struct {
-	Parent   string      `json:"parent"`
-	Child    string      `json:"child"`
-	Type     string      `json:"type"`
-	Metadata interface{} `json:"metadata"`
-}
-
-func newJSONRelationships(relationships []pkg.Relationship) []JSONRelationship {
-	result := make([]JSONRelationship, len(relationships))
-	for i, r := range relationships {
-		result[i] = JSONRelationship{
-			Parent:   string(r.Parent),
-			Child:    string(r.Child),
-			Type:     string(r.Type),
-			Metadata: r.Metadata,
-		}
-	}
-	return result
-}

internal/presenter/packages/json_source.go

@@ -1,39 +0,0 @@
-package packages
-
-import (
-	"fmt"
-
-	"github.com/anchore/syft/syft/source"
-)
-
-// JSONSource object represents the thing that was cataloged
-type JSONSource struct {
-	Type   string      `json:"type"`
-	Target interface{} `json:"target"`
-}
-
-type JSONImageSource struct {
-	source.ImageMetadata
-	Scope source.Scope `json:"scope"`
-}
-
-// NewJSONSource creates a new source object to be represented into JSON.
-func NewJSONSource(src source.Metadata, scope source.Scope) (JSONSource, error) {
-	switch src.Scheme {
-	case source.ImageScheme:
-		return JSONSource{
-			Type: "image",
-			Target: JSONImageSource{
-				Scope:         scope,
-				ImageMetadata: src.ImageMetadata,
-			},
-		}, nil
-	case source.DirectoryScheme:
-		return JSONSource{
-			Type:   "directory",
-			Target: src.Path,
-		}, nil
-	default:
-		return JSONSource{}, fmt.Errorf("unsupported source: %q", src.Scheme)
-	}
-}

internal/presenter/packages/model/spdx22/creation_info.go

@@ -10,7 +10,7 @@ type CreationInfo struct {
 	Created time.Time `json:"created"`
 	// Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an
 	// individual, indicate the person's name. If the SPDX file was created on behalf of a company or organization,
-	//indicate the entity name. If the SPDX file was created using a software tool, indicate the name and version
+	// indicate the entity name. If the SPDX file was created using a software tool, indicate the name and version
 	// for that tool. If multiple participants or tools were involved, use multiple instances of this field. Person
 	// name or organization name may be designated as “anonymous” if appropriate.
 	Creators []string `json:"creators"`

internal/presenter/packages/spdx_helpers_test.go

@@ -12,7 +12,7 @@ import (
 )
 
 func Test_getSPDXExternalRefs(t *testing.T) {
-	testCPE := must(pkg.NewCPE("cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*"))
+	testCPE := pkg.MustCPE("cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*")
 	tests := []struct {
 		name     string
 		input    pkg.Package

internal/presenter/packages/spdx_json_presenter.go

@@ -132,10 +132,10 @@ func newSPDXJsonElements(catalog *pkg.Catalog) ([]spdx22.Package, []spdx22.File,
 
 func cleanSPDXName(name string) string {
 	// remove # according to specification
-	name = strings.Replace(name, "#", "-", -1)
+	name = strings.ReplaceAll(name, "#", "-")
 
 	// remove : for url construction
-	name = strings.Replace(name, ":", "-", -1)
+	name = strings.ReplaceAll(name, ":", "-")
 
 	// clean relative pathing
 	return path.Clean(name)

internal/presenter/packages/spdx_json_presenter_test.go

@@ -4,13 +4,15 @@ import (
 	"flag"
 	"regexp"
 	"testing"
+
+	"github.com/anchore/syft/internal/formats/common/testutils"
 )
 
 var updateSpdxJson = flag.Bool("update-spdx-json", false, "update the *.golden files for spdx-json presenters")
 
 func TestSPDXJSONDirectoryPresenter(t *testing.T) {
-	catalog, metadata, _ := presenterDirectoryInput(t)
-	assertPresenterAgainstGoldenSnapshot(t,
+	catalog, metadata, _ := testutils.DirectoryInput(t)
+	testutils.AssertPresenterAgainstGoldenSnapshot(t,
 		NewSPDXJSONPresenter(catalog, metadata),
 		*updateSpdxJson,
 		spdxJsonRedactor,
@@ -19,8 +21,8 @@ func TestSPDXJSONDirectoryPresenter(t *testing.T) {
 
 func TestSPDXJSONImagePresenter(t *testing.T) {
 	testImage := "image-simple"
-	catalog, metadata, _ := presenterImageInput(t, testImage)
-	assertPresenterAgainstGoldenImageSnapshot(t,
+	catalog, metadata, _ := testutils.ImageInput(t, testImage)
+	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
 		NewSPDXJSONPresenter(catalog, metadata),
 		testImage,
 		*updateSpdxJson,

internal/presenter/packages/spdx_tag_value_presenter_test.go

@@ -4,13 +4,15 @@ import (
 	"flag"
 	"regexp"
 	"testing"
+
+	"github.com/anchore/syft/internal/formats/common/testutils"
 )
 
 var updateSpdxTagValue = flag.Bool("update-spdx-tv", false, "update the *.golden files for spdx-tv presenters")
 
 func TestSPDXTagValueDirectoryPresenter(t *testing.T) {
-	catalog, metadata, _ := presenterDirectoryInput(t)
-	assertPresenterAgainstGoldenSnapshot(t,
+	catalog, metadata, _ := testutils.DirectoryInput(t)
+	testutils.AssertPresenterAgainstGoldenSnapshot(t,
 		NewSPDXTagValuePresenter(catalog, metadata),
 		*updateSpdxTagValue,
 		spdxTagValueRedactor,
@@ -19,8 +21,8 @@ func TestSPDXTagValueDirectoryPresenter(t *testing.T) {
 
 func TestSPDXTagValueImagePresenter(t *testing.T) {
 	testImage := "image-simple"
-	catalog, metadata, _ := presenterImageInput(t, testImage)
-	assertPresenterAgainstGoldenImageSnapshot(t,
+	catalog, metadata, _ := testutils.ImageInput(t, testImage)
+	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
 		NewSPDXTagValuePresenter(catalog, metadata),
 		testImage,
 		*updateSpdxTagValue,

internal/presenter/packages/table_presenter_test.go

@@ -4,6 +4,8 @@ import (
 	"flag"
 	"testing"
 
+	"github.com/anchore/syft/internal/formats/common/testutils"
+
 	"github.com/go-test/deep"
 )
 
@@ -11,8 +13,8 @@ var updateTablePresenterGoldenFiles = flag.Bool("update-table", false, "update t
 
 func TestTablePresenter(t *testing.T) {
 	testImage := "image-simple"
-	catalog, _, _ := presenterImageInput(t, testImage)
-	assertPresenterAgainstGoldenImageSnapshot(t,
+	catalog, _, _ := testutils.ImageInput(t, testImage)
+	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
 		NewTablePresenter(catalog),
 		testImage,
 		*updateTablePresenterGoldenFiles,

internal/presenter/packages/test-fixtures/snapshot/TestSPDXJSONDirectoryPresenter.golden

@@ -3,7 +3,7 @@
  "name": "/some/path",
  "spdxVersion": "SPDX-2.2",
  "creationInfo": {
-  "created": "2021-09-16T20:44:35.198887Z",
+  "created": "2021-10-12T18:40:22.948394Z",
   "creators": [
    "Organization: Anchore, Inc",
    "Tool: syft-[not provided]"
@@ -11,7 +11,7 @@
   "licenseListVersion": "3.14"
  },
  "dataLicense": "CC0-1.0",
- "documentNamespace": "https://anchore.com/syft/image/",
+ "documentNamespace": "https:/anchore.com/syft/dir/some/path-98ae71fb-f276-4c5c-acf7-25770bf7bca2",
  "packages": [
   {
    "SPDXID": "SPDXRef-Package-python-package-1-1.0.1",
@@ -32,7 +32,7 @@
    ],
    "filesAnalyzed": false,
    "hasFiles": [
-    "SPDXRef-File-package-1-04cd22424378dcd6c77fce08beb52493b5494a60ea5e1f9bdf9b16dc0cacffe9"
+    "SPDXRef-File-package-1-efae7fecc76ca25da40f79d7ef5b8933510434914835832c7976f3e866aa756a"
    ],
    "licenseDeclared": "MIT",
    "sourceInfo": "acquired package info from installed python package manifest file: /some/path/pkg1",
@@ -63,17 +63,17 @@
  ],
  "files": [
   {
-   "SPDXID": "SPDXRef-File-package-1-04cd22424378dcd6c77fce08beb52493b5494a60ea5e1f9bdf9b16dc0cacffe9",
+   "SPDXID": "SPDXRef-File-package-1-efae7fecc76ca25da40f79d7ef5b8933510434914835832c7976f3e866aa756a",
    "name": "foo",
    "licenseConcluded": "",
-   "fileName": "/some/path/pkg1/depedencies/foo"
+   "fileName": "/some/path/pkg1/dependencies/foo"
   }
  ],
  "relationships": [
   {
    "spdxElementId": "SPDXRef-Package-python-package-1-1.0.1",
    "relationshipType": "CONTAINS",
-   "relatedSpdxElement": "SPDXRef-File-package-1-04cd22424378dcd6c77fce08beb52493b5494a60ea5e1f9bdf9b16dc0cacffe9"
+   "relatedSpdxElement": "SPDXRef-File-package-1-efae7fecc76ca25da40f79d7ef5b8933510434914835832c7976f3e866aa756a"
   }
  ]
 }

internal/presenter/packages/test-fixtures/snapshot/TestSPDXJSONImagePresenter.golden

@@ -3,7 +3,7 @@
  "name": "user-image-input",
  "spdxVersion": "SPDX-2.2",
  "creationInfo": {
-  "created": "2021-09-16T20:44:35.203911Z",
+  "created": "2021-10-12T18:40:22.953633Z",
   "creators": [
    "Organization: Anchore, Inc",
    "Tool: syft-[not provided]"
@@ -11,7 +11,7 @@
   "licenseListVersion": "3.14"
  },
  "dataLicense": "CC0-1.0",
- "documentNamespace": "https://anchore.com/syft/image/user-image-input",
+ "documentNamespace": "https:/anchore.com/syft/image/user-image-input-149edbad-3c01-4ee0-b3a0-75232312bf51",
  "packages": [
   {
    "SPDXID": "SPDXRef-Package-python-package-1-1.0.1",

internal/presenter/packages/test-fixtures/snapshot/TestTextImagePresenter.golden

@@ -1,11 +1,11 @@
 [Image]
  Layer:		 0
- Digest:	 sha256:ffb5e9eaa453a002110719d12c294960117ca2903953d1faa40f01dc3f77045c
+ Digest:	 sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59
  Size:		 22
  MediaType:	 application/vnd.docker.image.rootfs.diff.tar.gzip
 
  Layer:		 1
- Digest:	 sha256:8463854829fc53d47b9dcdf7ee79fe7eb4ca7933c910f67f8521412f7a2f5c21
+ Digest:	 sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec
  Size:		 16
  MediaType:	 application/vnd.docker.image.rootfs.diff.tar.gzip
 

internal/presenter/packages/text_presenter.go

@@ -32,7 +32,7 @@ func (pres *TextPresenter) Present(output io.Writer) error {
 
 	switch pres.srcMetadata.Scheme {
 	case source.DirectoryScheme:
-		fmt.Fprintln(w, fmt.Sprintf("[Path: %s]", pres.srcMetadata.Path))
+		fmt.Fprintf(w, "[Path: %s]\n", pres.srcMetadata.Path)
 	case source.ImageScheme:
 		fmt.Fprintln(w, "[Image]")
 
@@ -51,7 +51,7 @@ func (pres *TextPresenter) Present(output io.Writer) error {
 	// populate artifacts...
 	rows := 0
 	for _, p := range pres.catalog.Sorted() {
-		fmt.Fprintln(w, fmt.Sprintf("[%s]", p.Name))
+		fmt.Fprintf(w, "[%s]\n", p.Name)
 		fmt.Fprintln(w, " Version:\t", p.Version)
 		fmt.Fprintln(w, " Type:\t", string(p.Type))
 		fmt.Fprintln(w, " Found by:\t", p.FoundBy)

internal/presenter/packages/text_presenter_test.go

@@ -3,13 +3,15 @@ package packages
 import (
 	"flag"
 	"testing"
+
+	"github.com/anchore/syft/internal/formats/common/testutils"
 )
 
 var updateTextPresenterGoldenFiles = flag.Bool("update-text", false, "update the *.golden files for text presenters")
 
 func TestTextDirectoryPresenter(t *testing.T) {
-	catalog, metadata, _ := presenterDirectoryInput(t)
-	assertPresenterAgainstGoldenSnapshot(t,
+	catalog, metadata, _ := testutils.DirectoryInput(t)
+	testutils.AssertPresenterAgainstGoldenSnapshot(t,
 		NewTextPresenter(catalog, metadata),
 		*updateTextPresenterGoldenFiles,
 	)
@@ -17,8 +19,8 @@ func TestTextDirectoryPresenter(t *testing.T) {
 
 func TestTextImagePresenter(t *testing.T) {
 	testImage := "image-simple"
-	catalog, metadata, _ := presenterImageInput(t, testImage)
-	assertPresenterAgainstGoldenImageSnapshot(t,
+	catalog, metadata, _ := testutils.ImageInput(t, testImage)
+	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
 		NewTextPresenter(catalog, metadata),
 		testImage,
 		*updateTextPresenterGoldenFiles,

internal/presenter/poweruser/json_document.go

@@ -1,7 +1,8 @@
 package poweruser
 
 import (
-	"github.com/anchore/syft/internal/presenter/packages"
+	"github.com/anchore/syft/internal/formats/syftjson"
+	"github.com/anchore/syft/internal/formats/syftjson/model"
 )
 
 type JSONDocument struct {
@@ -13,16 +14,11 @@ type JSONDocument struct {
 	FileContents        []JSONFileContents        `json:"fileContents,omitempty"`        // note: must have omitempty
 	FileMetadata        []JSONFileMetadata        `json:"fileMetadata,omitempty"`        // note: must have omitempty
 	Secrets             []JSONSecrets             `json:"secrets,omitempty"`             // note: must have omitempty
-	packages.JSONDocument
+	model.Document
 }
 
 // NewJSONDocument creates and populates a new JSON document struct from the given cataloging results.
 func NewJSONDocument(config JSONDocumentConfig) (JSONDocument, error) {
-	pkgsDoc, err := packages.NewJSONDocument(config.PackageCatalog, config.SourceMetadata, config.Distro, config.ApplicationConfig.Package.Cataloger.ScopeOpt, config.ApplicationConfig)
-	if err != nil {
-		return JSONDocument{}, err
-	}
-
 	fileMetadata, err := NewJSONFileMetadata(config.FileMetadata, config.FileDigests)
 	if err != nil {
 		return JSONDocument{}, err
@@ -33,6 +29,6 @@ func NewJSONDocument(config JSONDocumentConfig) (JSONDocument, error) {
 		FileContents:        NewJSONFileContents(config.FileContents),
 		FileMetadata:        fileMetadata,
 		Secrets:             NewJSONSecrets(config.Secrets),
-		JSONDocument:        pkgsDoc,
+		Document:            syftjson.ToFormatModel(config.PackageCatalog, &config.SourceMetadata, config.Distro, config.ApplicationConfig.Package.Cataloger.ScopeOpt, config.ApplicationConfig),
 	}, nil
 }

internal/spdxlicense/generate/generate_license_list.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"encoding/json"
+	"fmt"
 	"log"
 	"net/http"
 	"os"
@@ -49,14 +50,21 @@ type LicenseList struct {
 }
 
 func main() {
+	if err := run(); err != nil {
+		fmt.Println(err.Error())
+		os.Exit(1)
+	}
+}
+
+func run() error {
 	resp, err := http.Get(url)
 	if err != nil {
-		log.Fatalf("unable to get licenses list: %+v", err)
+		return fmt.Errorf("unable to get licenses list: %+v", err)
 	}
 
 	var result LicenseList
 	if err = json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		log.Fatalf("unable to decode license list: %+v", err)
+		return fmt.Errorf("unable to decode license list: %+v", err)
 	}
 	defer func() {
 		if err := resp.Body.Close(); err != nil {
@@ -66,7 +74,7 @@ func main() {
 
 	f, err := os.Create(source)
 	if err != nil {
-		log.Fatalf("unable to create %q: %+v", source, err)
+		return fmt.Errorf("unable to create %q: %+v", source, err)
 	}
 	defer func() {
 		if err := f.Close(); err != nil {
@@ -89,8 +97,9 @@ func main() {
 	})
 
 	if err != nil {
-		log.Fatalf("unable to generate template: %+v", err)
+		return fmt.Errorf("unable to generate template: %+v", err)
 	}
+	return nil
 }
 
 // Parsing the provided SPDX license list necessitates a two pass approach.

internal/ui/common_event_handlers.go

@@ -0,0 +1,24 @@
+package ui
+
+import (
+	"fmt"
+	"io"
+
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+	"github.com/wagoodman/go-partybus"
+)
+
+// handleCatalogerPresenterReady is a UI function for processing the CatalogerFinished bus event, displaying the catalog
+// via the given presenter to stdout.
+func handleCatalogerPresenterReady(event partybus.Event, reportOutput io.Writer) error {
+	// show the report to stdout
+	pres, err := syftEventParsers.ParsePresenterReady(event)
+	if err != nil {
+		return fmt.Errorf("bad CatalogerFinished event: %w", err)
+	}
+
+	if err := pres.Present(reportOutput); err != nil {
+		return fmt.Errorf("unable to show package catalog report: %w", err)
+	}
+	return nil
+}

internal/ui/ephemeral_terminal_ui.go

@@ -1,3 +1,6 @@
+//go:build linux || darwin
+// +build linux darwin
+
 package ui
 
 import (

internal/ui/etui_event_handlers.go

@@ -1,3 +1,6 @@
+//go:build linux || darwin
+// +build linux darwin
+
 package ui
 
 import (
@@ -14,21 +17,6 @@ import (
 	"github.com/wagoodman/go-partybus"
 )
 
-// handleCatalogerPresenterReady is a UI function for processing the CatalogerFinished bus event, displaying the catalog
-// via the given presenter to stdout.
-func handleCatalogerPresenterReady(event partybus.Event, reportOutput io.Writer) error {
-	// show the report to stdout
-	pres, err := syftEventParsers.ParsePresenterReady(event)
-	if err != nil {
-		return fmt.Errorf("bad CatalogerFinished event: %w", err)
-	}
-
-	if err := pres.Present(reportOutput); err != nil {
-		return fmt.Errorf("unable to show package catalog report: %w", err)
-	}
-	return nil
-}
-
 // handleAppUpdateAvailable is a UI handler function to display a new application version to the top of the screen.
 func handleAppUpdateAvailable(_ context.Context, fr *frame.Frame, event partybus.Event, _ *sync.WaitGroup) error {
 	newVersion, err := syftEventParsers.ParseAppUpdateAvailable(event)

internal/ui/select.go

@@ -1,3 +1,6 @@
+//go:build linux || darwin
+// +build linux darwin
+
 package ui
 
 import (
@@ -5,7 +8,7 @@ import (
 	"os"
 	"runtime"
 
-	"golang.org/x/crypto/ssh/terminal"
+	"golang.org/x/term"
 )
 
 // TODO: build tags to exclude options from windows
@@ -16,8 +19,8 @@ import (
 // are environmental problems (e.g. cannot write to the terminal). A writer is provided to capture the output of
 // the final SBOM report.
 func Select(verbose, quiet bool, reportWriter io.Writer) (uis []UI) {
-	isStdoutATty := terminal.IsTerminal(int(os.Stdout.Fd()))
-	isStderrATty := terminal.IsTerminal(int(os.Stderr.Fd()))
+	isStdoutATty := term.IsTerminal(int(os.Stdout.Fd()))
+	isStderrATty := term.IsTerminal(int(os.Stderr.Fd()))
 	notATerminal := !isStderrATty && !isStdoutATty
 
 	switch {

internal/ui/select_windows.go

@@ -0,0 +1,17 @@
+//go:build windows
+// +build windows
+
+package ui
+
+import (
+	"io"
+)
+
+// Select is responsible for determining the specific UI function given select user option, the current platform
+// config values, and environment status (such as a TTY being present). The first UI in the returned slice of UIs
+// is intended to be used and the UIs that follow are meant to be attempted only in a fallback posture when there
+// are environmental problems (e.g. cannot write to the terminal). A writer is provided to capture the output of
+// the final SBOM report.
+func Select(verbose, quiet bool, reportWriter io.Writer) (uis []UI) {
+	return append(uis, NewLoggerUI(reportWriter))
+}

schema/json/generate.go

@@ -45,11 +45,7 @@ func build() *jsonschema.Schema {
 	reflector := &jsonschema.Reflector{
 		AllowAdditionalProperties: true,
 		TypeNamer: func(r reflect.Type) string {
-			name := r.Name()
-			if strings.HasPrefix(name, "JSON") {
-				name = strings.TrimPrefix(name, "JSON")
-			}
-			return name
+			return strings.TrimPrefix(r.Name(), "JSON")
 		},
 	}
 	documentSchema := reflector.ReflectFromType(reflect.TypeOf(&poweruser.JSONDocument{}))

syft/encode_decode.go

@@ -0,0 +1,48 @@
+package syft
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+
+	"github.com/anchore/syft/internal/formats"
+	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/syft/format"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+// Encode takes all SBOM elements and a format option and encodes an SBOM document.
+// TODO: encapsulate input data into common sbom document object
+func Encode(catalog *pkg.Catalog, metadata *source.Metadata, dist *distro.Distro, scope source.Scope, option format.Option) ([]byte, error) {
+	f := formats.ByOption(option)
+	if f == nil {
+		return nil, fmt.Errorf("unsupported format: %+v", option)
+	}
+	buff := bytes.Buffer{}
+
+	if err := f.Encode(&buff, catalog, dist, metadata, scope); err != nil {
+		return nil, fmt.Errorf("unable to encode sbom: %w", err)
+	}
+
+	return buff.Bytes(), nil
+}
+
+// Decode takes a reader for an SBOM and generates all internal SBOM elements.
+// TODO: encapsulate return data into common sbom document object
+func Decode(reader io.Reader) (*pkg.Catalog, *source.Metadata, *distro.Distro, source.Scope, format.Option, error) {
+	by, err := io.ReadAll(reader)
+	if err != nil {
+		return nil, nil, nil, source.UnknownScope, format.UnknownFormatOption, fmt.Errorf("unable to read sbom: %w", err)
+	}
+
+	f, err := formats.Identify(by)
+	if err != nil {
+		return nil, nil, nil, source.UnknownScope, format.UnknownFormatOption, fmt.Errorf("unable to detect format: %w", err)
+	}
+	if f == nil {
+		return nil, nil, nil, source.UnknownScope, format.UnknownFormatOption, fmt.Errorf("unable to identify format")
+	}
+	c, m, d, s, err := f.Decode(bytes.NewReader(by))
+	return c, m, d, s, f.Option, err
+}

syft/encode_decode_test.go

@@ -0,0 +1,53 @@
+package syft
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/go-test/deep"
+
+	"github.com/anchore/syft/syft/format"
+	"github.com/anchore/syft/syft/source"
+	"github.com/stretchr/testify/assert"
+)
+
+// TestEncodeDecodeEncodeCycleComparison is testing for differences in how SBOM documents get encoded on multiple cycles.
+// By encding and decoding the sbom we can compare the differences between the set of resulting objects. However,
+// this requires specific comparisons being done, and select redactions/omissions being made. Additionally, there are
+// already unit tests on each format encoder-decoder for properly functioning comparisons in depth, so there is no need
+// to do an object-to-object comparison. For this reason this test focuses on a bytes-to-bytes comparison after an
+// encode-decode-encode loop which will detect lossy behavior in both directions.
+func TestEncodeDecodeEncodeCycleComparison(t *testing.T) {
+	testImage := "image-simple"
+	tests := []struct {
+		format format.Option
+	}{
+		{
+			format: format.JSONOption,
+		},
+	}
+	for _, test := range tests {
+		t.Run(testImage, func(t *testing.T) {
+
+			src, err := source.NewFromDirectory("./test-fixtures/pkgs")
+			if err != nil {
+				t.Fatalf("cant get dir")
+			}
+			originalCatalog, d, err := CatalogPackages(&src, source.SquashedScope)
+
+			by1, err := Encode(originalCatalog, &src.Metadata, d, source.SquashedScope, test.format)
+			assert.NoError(t, err)
+
+			newCatalog, newMetadata, newDistro, newScope, newFormat, err := Decode(bytes.NewReader(by1))
+			assert.NoError(t, err)
+			assert.Equal(t, test.format, newFormat)
+
+			by2, err := Encode(newCatalog, newMetadata, newDistro, newScope, test.format)
+			assert.NoError(t, err)
+			for _, diff := range deep.Equal(by1, by2) {
+				t.Errorf(diff)
+			}
+			assert.True(t, bytes.Equal(by1, by2))
+		})
+	}
+}

syft/file/digest_cataloger.go

@@ -99,7 +99,7 @@ func DigestAlgorithmName(hash crypto.Hash) string {
 
 func CleanDigestAlgorithmName(name string) string {
 	lower := strings.ToLower(name)
-	return strings.Replace(lower, "-", "", -1)
+	return strings.ReplaceAll(lower, "-", "")
 }
 
 func digestsCatalogingProgress(locations int64) (*progress.Stage, *progress.Manual) {

syft/format/decoder.go

@@ -0,0 +1,13 @@
+package format
+
+import (
+	"io"
+
+	"github.com/anchore/syft/syft/distro"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+// Decoder is a function that can convert an SBOM document of a specific format from a reader into Syft native objects.
+type Decoder func(reader io.Reader) (*pkg.Catalog, *source.Metadata, *distro.Distro, source.Scope, error)

syft/format/encoder.go

@@ -0,0 +1,12 @@
+package format
+
+import (
+	"io"
+
+	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+// Encoder is a function that can transform Syft native objects into an SBOM document of a specific format written to the given writer.
+type Encoder func(io.Writer, *pkg.Catalog, *source.Metadata, *distro.Distro, source.Scope) error

syft/format/format.go

@@ -0,0 +1,62 @@
+package format
+
+import (
+	"errors"
+	"io"
+
+	"github.com/anchore/syft/syft/distro"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+var (
+	ErrEncodingNotSupported   = errors.New("encoding not supported")
+	ErrDecodingNotSupported   = errors.New("decoding not supported")
+	ErrValidationNotSupported = errors.New("validation not supported")
+)
+
+type Format struct {
+	Option    Option
+	encoder   Encoder
+	decoder   Decoder
+	validator Validator
+}
+
+func NewFormat(option Option, encoder Encoder, decoder Decoder, validator Validator) Format {
+	return Format{
+		Option:    option,
+		encoder:   encoder,
+		decoder:   decoder,
+		validator: validator,
+	}
+}
+
+func (f Format) Encode(output io.Writer, catalog *pkg.Catalog, d *distro.Distro, metadata *source.Metadata, scope source.Scope) error {
+	if f.encoder == nil {
+		return ErrEncodingNotSupported
+	}
+	return f.encoder(output, catalog, metadata, d, scope)
+}
+
+func (f Format) Decode(reader io.Reader) (*pkg.Catalog, *source.Metadata, *distro.Distro, source.Scope, error) {
+	if f.decoder == nil {
+		return nil, nil, nil, source.UnknownScope, ErrDecodingNotSupported
+	}
+	return f.decoder(reader)
+}
+
+func (f Format) Validate(reader io.Reader) error {
+	if f.validator == nil {
+		return ErrValidationNotSupported
+	}
+
+	return f.validator(reader)
+}
+
+func (f Format) Presenter(catalog *pkg.Catalog, metadata *source.Metadata, d *distro.Distro, scope source.Scope) *Presenter {
+	if f.encoder == nil {
+		return nil
+	}
+	return NewPresenter(f.encoder, catalog, metadata, d, scope)
+}

syft/format/option.go

@@ -0,0 +1,43 @@
+package format
+
+import "strings"
+
+const (
+	UnknownFormatOption Option = "UnknownFormatOption"
+	JSONOption          Option = "json"
+	TextOption          Option = "text"
+	TableOption         Option = "table"
+	CycloneDxOption     Option = "cyclonedx"
+	SPDXTagValueOption  Option = "spdx-tag-value"
+	SPDXJSONOption      Option = "spdx-json"
+)
+
+var AllPresenters = []Option{
+	JSONOption,
+	TextOption,
+	TableOption,
+	CycloneDxOption,
+	SPDXTagValueOption,
+	SPDXJSONOption,
+}
+
+type Option string
+
+func ParseOption(userStr string) Option {
+	switch strings.ToLower(userStr) {
+	case string(JSONOption):
+		return JSONOption
+	case string(TextOption):
+		return TextOption
+	case string(TableOption):
+		return TableOption
+	case string(CycloneDxOption), "cyclone", "cyclone-dx":
+		return CycloneDxOption
+	case string(SPDXTagValueOption), "spdx", "spdx-tagvalue", "spdxtagvalue", "spdx-tv", "spdxtv":
+		return SPDXTagValueOption
+	case string(SPDXJSONOption), "spdxjson":
+		return SPDXJSONOption
+	default:
+		return UnknownFormatOption
+	}
+}

syft/format/presenter.go

@@ -0,0 +1,32 @@
+package format
+
+import (
+	"io"
+
+	"github.com/anchore/syft/syft/distro"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+type Presenter struct {
+	catalog     *pkg.Catalog
+	srcMetadata *source.Metadata
+	distro      *distro.Distro
+	scope       source.Scope
+	encoder     Encoder
+}
+
+func NewPresenter(encoder Encoder, catalog *pkg.Catalog, srcMetadata *source.Metadata, d *distro.Distro, scope source.Scope) *Presenter {
+	return &Presenter{
+		catalog:     catalog,
+		srcMetadata: srcMetadata,
+		distro:      d,
+		encoder:     encoder,
+		scope:       scope,
+	}
+}
+
+func (pres *Presenter) Present(output io.Writer) error {
+	return pres.encoder(output, pres.catalog, pres.srcMetadata, pres.distro, pres.scope)
+}

syft/format/validator.go

@@ -0,0 +1,12 @@
+package format
+
+import "io"
+
+// Validator reads the SBOM from the given reader and assesses whether the document conforms to the specific SBOM format.
+// The validator should positively confirm if the SBOM is not only the format but also has the minimal set of values
+// that the format requires. For example, all syftjson formatted documents have a schema section which should have
+// "anchore/syft" within the version --if this isn't found then the validator should raise an error. These active
+// assertions protect against "simple" format decoding validations that may lead to false positives (e.g. I decoded
+// json successfully therefore this must be the target format, however, all values are their default zero-value and
+// really represent a different format that also uses json)
+type Validator func(reader io.Reader) error

syft/pkg/apk_metadata.go

@@ -9,7 +9,7 @@ import (
 	"github.com/scylladb/go-set/strset"
 )
 
-const ApkDbGlob = "**/lib/apk/db/installed"
+const ApkDBGlob = "**/lib/apk/db/installed"
 
 var _ FileOwner = (*ApkMetadata)(nil)
 

syft/pkg/cataloger/apkdb/cataloger.go

@@ -11,7 +11,7 @@ import (
 // NewApkdbCataloger returns a new Alpine DB cataloger object.
 func NewApkdbCataloger() *common.GenericCataloger {
 	globParsers := map[string]common.ParserFn{
-		pkg.ApkDbGlob: parseApkDB,
+		pkg.ApkDBGlob: parseApkDB,
 	}
 
 	return common.NewGenericCataloger(nil, globParsers, "apkdb-cataloger")

syft/pkg/cataloger/cataloger.go

@@ -39,8 +39,7 @@ func ImageCatalogers() []Cataloger {
 		rpmdb.NewRpmdbCataloger(),
 		java.NewJavaCataloger(),
 		apkdb.NewApkdbCataloger(),
-		golang.NewGoModCataloger(),
-		rust.NewCargoLockCataloger(),
+		golang.NewGoModuleBinaryCataloger(),
 	}
 }
 
@@ -55,7 +54,8 @@ func DirectoryCatalogers() []Cataloger {
 		rpmdb.NewRpmdbCataloger(),
 		java.NewJavaCataloger(),
 		apkdb.NewApkdbCataloger(),
-		golang.NewGoModCataloger(),
+		golang.NewGoModuleBinaryCataloger(),
+		golang.NewGoModFileCataloger(),
 		rust.NewCargoLockCataloger(),
 	}
 }

syft/pkg/cataloger/common/cpe/candidate_by_package_type.go

@@ -29,20 +29,20 @@ var defaultCandidateAdditions = buildCandidateLookup(
 		{
 			// example image: docker.io/nuxeo:latest
 			pkg.JavaPkg,
-			candidateKey{PkgName: "elasticsearch"}, //, Vendor: "elasticsearch"},
+			candidateKey{PkgName: "elasticsearch"}, // , Vendor: "elasticsearch"},
 			candidateAddition{AdditionalVendors: []string{"elastic"}},
 		},
 		{
 			// example image: docker.io/kaazing-gateway:latest
 			pkg.JavaPkg,
-			candidateKey{PkgName: "log4j"}, //, Vendor: "apache-software-foundation"},
+			candidateKey{PkgName: "log4j"}, // , Vendor: "apache-software-foundation"},
 			candidateAddition{AdditionalVendors: []string{"apache"}},
 		},
 
 		{
 			// example image: cassandra:latest
 			pkg.JavaPkg,
-			candidateKey{PkgName: "apache-cassandra"}, //, Vendor: "apache"},
+			candidateKey{PkgName: "apache-cassandra"}, // , Vendor: "apache"},
 			candidateAddition{AdditionalProducts: []string{"cassandra"}},
 		},
 

syft/pkg/cataloger/deb/cataloger.go

@@ -36,9 +36,8 @@ func (c *Cataloger) Name() string {
 }
 
 // Catalog is given an object to resolve file references and content, this function returns any discovered Packages after analyzing dpkg support files.
-// nolint:funlen
 func (c *Cataloger) Catalog(resolver source.FileResolver) ([]pkg.Package, error) {
-	dbFileMatches, err := resolver.FilesByGlob(pkg.DpkgDbGlob)
+	dbFileMatches, err := resolver.FilesByGlob(pkg.DpkgDBGlob)
 	if err != nil {
 		return nil, fmt.Errorf("failed to find dpkg status files's by glob: %w", err)
 	}
@@ -80,15 +79,13 @@ func addLicenses(resolver source.FileResolver, dbLocation source.Location, p *pk
 	// get license information from the copyright file
 	copyrightReader, copyrightLocation := fetchCopyrightContents(resolver, dbLocation, p)
 
-	if copyrightReader != nil {
+	if copyrightReader != nil && copyrightLocation != nil {
 		defer internal.CloseAndLogError(copyrightReader, copyrightLocation.VirtualPath)
 		// attach the licenses
 		p.Licenses = parseLicensesFromCopyright(copyrightReader)
 
 		// keep a record of the file where this was discovered
-		if copyrightLocation != nil {
-			p.Locations = append(p.Locations, *copyrightLocation)
-		}
+		p.Locations = append(p.Locations, *copyrightLocation)
 	}
 }
 
@@ -127,28 +124,24 @@ func getAdditionalFileListing(resolver source.FileResolver, dbLocation source.Lo
 
 	md5Reader, md5Location := fetchMd5Contents(resolver, dbLocation, p)
 
-	if md5Reader != nil {
+	if md5Reader != nil && md5Location != nil {
 		defer internal.CloseAndLogError(md5Reader, md5Location.VirtualPath)
 		// attach the file list
 		files = append(files, parseDpkgMD5Info(md5Reader)...)
 
 		// keep a record of the file where this was discovered
-		if md5Location != nil {
-			locations = append(locations, *md5Location)
-		}
+		locations = append(locations, *md5Location)
 	}
 
 	conffilesReader, conffilesLocation := fetchConffileContents(resolver, dbLocation, p)
 
-	if conffilesReader != nil {
+	if conffilesReader != nil && conffilesLocation != nil {
 		defer internal.CloseAndLogError(conffilesReader, conffilesLocation.VirtualPath)
 		// attach the file list
 		files = append(files, parseDpkgConffileInfo(md5Reader)...)
 
 		// keep a record of the file where this was discovered
-		if conffilesLocation != nil {
-			locations = append(locations, *conffilesLocation)
-		}
+		locations = append(locations, *conffilesLocation)
 	}
 
 	return files, locations

syft/pkg/cataloger/golang/bin_cataloger.go

@@ -0,0 +1,61 @@
+/*
+Package golang provides a concrete Cataloger implementation for go.mod files.
+*/
+package golang
+
+import (
+	"fmt"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+const catalogerName = "go-module-binary-cataloger"
+
+// current mime types to search by to discover go binaries
+var mimeTypes = []string{
+	"application/x-executable",
+	"application/x-mach-binary",
+	"application/x-elf",
+	"application/x-sharedlib",
+	"application/vnd.microsoft.portable-executable",
+}
+
+type Cataloger struct{}
+
+// NewGoModuleBinaryCataloger returns a new Golang cataloger object.
+func NewGoModuleBinaryCataloger() *Cataloger {
+	return &Cataloger{}
+}
+
+// Name returns a string that uniquely describes a cataloger
+func (c *Cataloger) Name() string {
+	return catalogerName
+}
+
+// Catalog is given an object to resolve file references and content, this function returns any discovered Packages after analyzing rpm db installation.
+func (c *Cataloger) Catalog(resolver source.FileResolver) ([]pkg.Package, error) {
+	pkgs := make([]pkg.Package, 0)
+	fileMatches, err := resolver.FilesByMIMEType(mimeTypes...)
+	if err != nil {
+		return pkgs, fmt.Errorf("failed to find bin by mime types: %w", err)
+	}
+
+	for _, location := range fileMatches {
+		r, err := resolver.FileContentsByLocation(location)
+		if err != nil {
+			return pkgs, fmt.Errorf("failed to resolve file contents by location: %w", err)
+		}
+
+		goPkgs, err := parseGoBin(location.RealPath, r)
+		if err != nil {
+			log.Warnf("could not parse possible go binary: %+v", err)
+		}
+
+		r.Close()
+		pkgs = append(pkgs, goPkgs...)
+	}
+
+	return pkgs, nil
+}

syft/pkg/cataloger/golang/exe.go

@@ -0,0 +1,271 @@
+// This code was copied from the Go std library.
+// https://github.com/golang/go/blob/master/src/cmd/go/internal/version/exe.go
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//nolint
+package golang
+
+import (
+	"bytes"
+	"debug/elf"
+	"debug/macho"
+	"debug/pe"
+	"fmt"
+	"io"
+)
+
+// An exe is a generic interface to an OS executable (ELF, Mach-O, PE, XCOFF).
+type exe interface {
+	// Close closes the underlying file.
+	Close() error
+
+	// ReadData reads and returns up to size byte starting at virtual address addr.
+	ReadData(addr, size uint64) ([]byte, error)
+
+	// DataStart returns the writable data segment start address.
+	DataStart() uint64
+}
+
+// openExe opens file and returns it as an exe.
+// we changed this signature from accpeting a string
+// to a ReadCloser so we could adapt the code to the
+// stereoscope api. We removed the file open methods.
+func openExe(file io.ReadCloser) (exe, error) {
+	/*
+		f, err := os.Open(file)
+		if err != nil {
+			return nil, err
+		}
+		data := make([]byte, 16)
+		if _, err := io.ReadFull(f, data); err != nil {
+			return nil, err
+		}
+		f.Seek(0, 0)
+	*/
+	data, err := io.ReadAll(file)
+	if err != nil {
+		return nil, err
+	}
+
+	r := bytes.NewReader(data)
+	f := io.NewSectionReader(r, 0, int64(len(data)))
+	if bytes.HasPrefix(data, []byte("\x7FELF")) {
+		e, err := elf.NewFile(f)
+		if err != nil {
+			return nil, err
+		}
+
+		return &elfExe{file, e}, nil
+	}
+
+	if bytes.HasPrefix(data, []byte("MZ")) {
+		e, err := pe.NewFile(f)
+		if err != nil {
+			return nil, err
+		}
+		return &peExe{file, e}, nil
+	}
+
+	if bytes.HasPrefix(data, []byte("\xFE\xED\xFA")) || bytes.HasPrefix(data[1:], []byte("\xFA\xED\xFE")) {
+		e, err := macho.NewFile(f)
+		if err != nil {
+			return nil, err
+		}
+		return &machoExe{file, e}, nil
+	}
+
+	return nil, fmt.Errorf("unrecognized executable format")
+}
+
+// elfExe is the ELF implementation of the exe interface.
+// updated os to be io.ReadCloser to interopt with stereoscope
+type elfExe struct {
+	os io.ReadCloser
+	f  *elf.File
+}
+
+func (x *elfExe) Close() error {
+	return x.os.Close()
+}
+
+func (x *elfExe) ReadData(addr, size uint64) ([]byte, error) {
+	for _, prog := range x.f.Progs {
+		if prog.Vaddr <= addr && addr <= prog.Vaddr+prog.Filesz-1 {
+			n := prog.Vaddr + prog.Filesz - addr
+			if n > size {
+				n = size
+			}
+			data := make([]byte, n)
+			_, err := prog.ReadAt(data, int64(addr-prog.Vaddr))
+			if err != nil {
+				return nil, err
+			}
+			return data, nil
+		}
+	}
+	return nil, fmt.Errorf("address not mapped")
+}
+
+func (x *elfExe) DataStart() uint64 {
+	for _, s := range x.f.Sections {
+		if s.Name == ".go.buildinfo" {
+			return s.Addr
+		}
+	}
+	for _, p := range x.f.Progs {
+		if p.Type == elf.PT_LOAD && p.Flags&(elf.PF_X|elf.PF_W) == elf.PF_W {
+			return p.Vaddr
+		}
+	}
+	return 0
+}
+
+// peExe is the PE (Windows Portable Executable) implementation of the exe interface.
+type peExe struct {
+	os io.ReadCloser
+	f  *pe.File
+}
+
+func (x *peExe) Close() error {
+	return x.os.Close()
+}
+
+func (x *peExe) imageBase() uint64 {
+	switch oh := x.f.OptionalHeader.(type) {
+	case *pe.OptionalHeader32:
+		return uint64(oh.ImageBase)
+	case *pe.OptionalHeader64:
+		return oh.ImageBase
+	}
+	return 0
+}
+
+func (x *peExe) ReadData(addr, size uint64) ([]byte, error) {
+	addr -= x.imageBase()
+	for _, sect := range x.f.Sections {
+		if uint64(sect.VirtualAddress) <= addr && addr <= uint64(sect.VirtualAddress+sect.Size-1) {
+			n := uint64(sect.VirtualAddress+sect.Size) - addr
+			if n > size {
+				n = size
+			}
+			data := make([]byte, n)
+			_, err := sect.ReadAt(data, int64(addr-uint64(sect.VirtualAddress)))
+			if err != nil {
+				return nil, err
+			}
+			return data, nil
+		}
+	}
+	return nil, fmt.Errorf("address not mapped")
+}
+
+func (x *peExe) DataStart() uint64 {
+	// Assume data is first writable section.
+	const (
+		IMAGE_SCN_CNT_CODE               = 0x00000020
+		IMAGE_SCN_CNT_INITIALIZED_DATA   = 0x00000040
+		IMAGE_SCN_CNT_UNINITIALIZED_DATA = 0x00000080
+		IMAGE_SCN_MEM_EXECUTE            = 0x20000000
+		IMAGE_SCN_MEM_READ               = 0x40000000
+		IMAGE_SCN_MEM_WRITE              = 0x80000000
+		IMAGE_SCN_MEM_DISCARDABLE        = 0x2000000
+		IMAGE_SCN_LNK_NRELOC_OVFL        = 0x1000000
+		IMAGE_SCN_ALIGN_32BYTES          = 0x600000
+	)
+	for _, sect := range x.f.Sections {
+		if sect.VirtualAddress != 0 && sect.Size != 0 &&
+			sect.Characteristics&^IMAGE_SCN_ALIGN_32BYTES == IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE {
+			return uint64(sect.VirtualAddress) + x.imageBase()
+		}
+	}
+	return 0
+}
+
+// machoExe is the Mach-O (Apple macOS/iOS) implementation of the exe interface.
+type machoExe struct {
+	os io.ReadCloser
+	f  *macho.File
+}
+
+func (x *machoExe) Close() error {
+	return x.os.Close()
+}
+
+func (x *machoExe) ReadData(addr, size uint64) ([]byte, error) {
+	for _, load := range x.f.Loads {
+		seg, ok := load.(*macho.Segment)
+		if !ok {
+			continue
+		}
+		if seg.Addr <= addr && addr <= seg.Addr+seg.Filesz-1 {
+			if seg.Name == "__PAGEZERO" {
+				continue
+			}
+			n := seg.Addr + seg.Filesz - addr
+			if n > size {
+				n = size
+			}
+			data := make([]byte, n)
+			_, err := seg.ReadAt(data, int64(addr-seg.Addr))
+			if err != nil {
+				return nil, err
+			}
+			return data, nil
+		}
+	}
+	return nil, fmt.Errorf("address not mapped")
+}
+
+func (x *machoExe) DataStart() uint64 {
+	// Look for section named "__go_buildinfo".
+	for _, sec := range x.f.Sections {
+		if sec.Name == "__go_buildinfo" {
+			return sec.Addr
+		}
+	}
+	// Try the first non-empty writable segment.
+	const RW = 3
+	for _, load := range x.f.Loads {
+		seg, ok := load.(*macho.Segment)
+		if ok && seg.Addr != 0 && seg.Filesz != 0 && seg.Prot == RW && seg.Maxprot == RW {
+			return seg.Addr
+		}
+	}
+	return 0
+}
+
+/*
+// xcoffExe is the XCOFF (AIX eXtended COFF) implementation of the exe interface.
+type xcoffExe struct {
+	os *os.File
+	f  *xcoff.File
+}
+
+func (x *xcoffExe) Close() error {
+	return x.os.Close()
+}
+
+func (x *xcoffExe) ReadData(addr, size uint64) ([]byte, error) {
+	for _, sect := range x.f.Sections {
+		if uint64(sect.VirtualAddress) <= addr && addr <= uint64(sect.VirtualAddress+sect.Size-1) {
+			n := uint64(sect.VirtualAddress+sect.Size) - addr
+			if n > size {
+				n = size
+			}
+			data := make([]byte, n)
+			_, err := sect.ReadAt(data, int64(addr-uint64(sect.VirtualAddress)))
+			if err != nil {
+				return nil, err
+			}
+			return data, nil
+		}
+	}
+	return nil, fmt.Errorf("address not mapped")
+}
+
+func (x *xcoffExe) DataStart() uint64 {
+	return x.f.SectionByType(xcoff.STYP_DATA).VirtualAddress
+}
+*/

syft/pkg/cataloger/golang/mod_cataloger.go

@@ -7,11 +7,11 @@ import (
 	"github.com/anchore/syft/syft/pkg/cataloger/common"
 )
 
-// NewGoModCataloger returns a new Go module cataloger object.
-func NewGoModCataloger() *common.GenericCataloger {
+// NewGoModFileCataloger returns a new Go module cataloger object.
+func NewGoModFileCataloger() *common.GenericCataloger {
 	globParsers := map[string]common.ParserFn{
 		"**/go.mod": parseGoMod,
 	}
 
-	return common.NewGenericCataloger(nil, globParsers, "go-cataloger")
+	return common.NewGenericCataloger(nil, globParsers, "go-mod-file-cataloger")
 }

syft/pkg/cataloger/golang/parse_go_bin.go

@@ -0,0 +1,65 @@
+package golang
+
+import (
+	"bufio"
+	"io"
+	"strings"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+const (
+	packageIdentifier = "dep"
+	replaceIdentifier = "=>"
+)
+
+func parseGoBin(path string, reader io.ReadCloser) ([]pkg.Package, error) {
+	// Identify if bin was compiled by go
+	x, err := openExe(reader)
+	if err != nil {
+		return nil, err
+	}
+
+	goVersion, mod := findVers(x)
+
+	pkgs := buildGoPkgInfo(path, mod, goVersion)
+
+	return pkgs, nil
+}
+
+func buildGoPkgInfo(path, mod, goVersion string) []pkg.Package {
+	pkgsSlice := make([]pkg.Package, 0)
+	scanner := bufio.NewScanner(strings.NewReader(mod))
+
+	// filter mod dependencies: [dep, name, version, sha]
+	for scanner.Scan() {
+		fields := strings.Fields(scanner.Text())
+
+		// must have dep, name, version, sha
+		if len(fields) < 4 {
+			continue
+		}
+
+		if fields[0] == packageIdentifier || fields[0] == replaceIdentifier {
+			pkgsSlice = append(pkgsSlice, pkg.Package{
+				Name:     fields[1],
+				Version:  fields[2],
+				Language: pkg.Go,
+				Type:     pkg.GoModulePkg,
+				Locations: []source.Location{
+					{
+						RealPath: path,
+					},
+				},
+				MetadataType: pkg.GolangBinMetadataType,
+				Metadata: pkg.GolangBinMetadata{
+					GoCompiledVersion: goVersion,
+					H1Digest:          fields[3],
+				},
+			})
+		}
+	}
+
+	return pkgsSlice
+}

syft/pkg/cataloger/golang/parse_go_bin_test.go

@@ -0,0 +1,122 @@
+package golang
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+	"github.com/stretchr/testify/assert"
+)
+
+const goCompiledVersion = "1.17"
+
+func TestBuildGoPkgInfo(t *testing.T) {
+	tests := []struct {
+		name     string
+		mod      string
+		expected []pkg.Package
+	}{
+		{
+			name:     "buildGoPkgInfo parses a blank mod string and returns no packages",
+			mod:      "",
+			expected: make([]pkg.Package, 0),
+		},
+		{
+			name: "buildGoPkgInfo parses a populated mod string and returns packages but no source info",
+			mod: `path    github.com/anchore/syft mod     github.com/anchore/syft (devel)
+				  dep     github.com/adrg/xdg     v0.2.1  h1:VSVdnH7cQ7V+B33qSJHTCRlNgra1607Q8PzEmnvb2Ic=
+				  dep     github.com/anchore/client-go    v0.0.0-20210222170800-9c70f9b80bcf      h1:DYssiUV1pBmKqzKsm4mqXx8artqC0Q8HgZsVI3lMsAg=`,
+			expected: []pkg.Package{
+				{
+					Name:     "github.com/adrg/xdg",
+					Version:  "v0.2.1",
+					Language: pkg.Go,
+					Type:     pkg.GoModulePkg,
+					Locations: []source.Location{
+						{},
+					},
+					MetadataType: pkg.GolangBinMetadataType,
+					Metadata: pkg.GolangBinMetadata{
+						GoCompiledVersion: goCompiledVersion,
+						H1Digest:          "h1:VSVdnH7cQ7V+B33qSJHTCRlNgra1607Q8PzEmnvb2Ic=",
+					},
+				},
+				{
+					Name:     "github.com/anchore/client-go",
+					Version:  "v0.0.0-20210222170800-9c70f9b80bcf",
+					Language: pkg.Go,
+					Type:     pkg.GoModulePkg,
+					Locations: []source.Location{
+						{},
+					},
+					MetadataType: pkg.GolangBinMetadataType,
+					Metadata: pkg.GolangBinMetadata{
+						GoCompiledVersion: goCompiledVersion,
+						H1Digest:          "h1:DYssiUV1pBmKqzKsm4mqXx8artqC0Q8HgZsVI3lMsAg=",
+					},
+				},
+			},
+		},
+		{
+			name: "buildGoPkgInfo parses a populated mod string and returns packages when a replace directive exists",
+			mod: `path    github.com/anchore/test
+			      mod     github.com/anchore/test (devel)
+				  dep     golang.org/x/net        v0.0.0-20211006190231-62292e806868      h1:KlOXYy8wQWTUJYFgkUI40Lzr06ofg5IRXUK5C7qZt1k=
+				  dep     golang.org/x/sys        v0.0.0-20211006194710-c8a6f5223071      h1:PjhxBct4MZii8FFR8+oeS7QOvxKOTZXgk63EU2XpfJE=
+				  dep     golang.org/x/term       v0.0.0-20210927222741-03fcf44c2211
+				  =>      golang.org/x/term       v0.0.0-20210916214954-140adaaadfaf      h1:Ihq/mm/suC88gF8WFcVwk+OV6Tq+wyA1O0E5UEvDglI=`,
+			expected: []pkg.Package{
+				{
+					Name:     "golang.org/x/net",
+					Version:  "v0.0.0-20211006190231-62292e806868",
+					Language: pkg.Go,
+					Type:     pkg.GoModulePkg,
+					Locations: []source.Location{
+						{},
+					},
+					MetadataType: pkg.GolangBinMetadataType,
+					Metadata: pkg.GolangBinMetadata{
+						GoCompiledVersion: goCompiledVersion,
+						H1Digest:          "h1:KlOXYy8wQWTUJYFgkUI40Lzr06ofg5IRXUK5C7qZt1k=",
+					},
+				},
+				{
+					Name:     "golang.org/x/sys",
+					Version:  "v0.0.0-20211006194710-c8a6f5223071",
+					Language: pkg.Go,
+					Type:     pkg.GoModulePkg,
+					Locations: []source.Location{
+						{},
+					},
+					MetadataType: pkg.GolangBinMetadataType,
+					Metadata: pkg.GolangBinMetadata{
+						GoCompiledVersion: goCompiledVersion,
+						H1Digest:          "h1:PjhxBct4MZii8FFR8+oeS7QOvxKOTZXgk63EU2XpfJE=",
+					},
+				},
+				{
+					Name:     "golang.org/x/term",
+					Version:  "v0.0.0-20210916214954-140adaaadfaf",
+					Language: pkg.Go,
+					Type:     pkg.GoModulePkg,
+					Locations: []source.Location{
+						{},
+					},
+					MetadataType: pkg.GolangBinMetadataType,
+					Metadata: pkg.GolangBinMetadata{
+						GoCompiledVersion: goCompiledVersion,
+						H1Digest:          "h1:Ihq/mm/suC88gF8WFcVwk+OV6Tq+wyA1O0E5UEvDglI=",
+					},
+				},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			pkgs := buildGoPkgInfo("", tt.mod, goCompiledVersion)
+			assert.Equal(t, tt.expected, pkgs)
+		})
+	}
+}

syft/pkg/cataloger/golang/version.go

@@ -0,0 +1,226 @@
+// This code was copied from the Go std library.
+// https://github.com/golang/go/blob/master/src/cmd/go/internal/version/version.go
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package version implements the ``go version'' command.
+package golang
+
+import (
+	"bytes"
+	"encoding/binary"
+	// "cmd/go/internal/base"
+)
+
+/*
+var CmdVersion = &base.Command{
+	UsageLine: "go version [-m] [-v] [file ...]",
+	Short:     "print Go version",
+	Long: `Version prints the build information for Go executables.
+
+Go version reports the Go version used to build each of the named
+executable files.
+
+If no files are named on the command line, go version prints its own
+version information.
+
+If a directory is named, go version walks that directory, recursively,
+looking for recognized Go binaries and reporting their versions.
+By default, go version does not report unrecognized files found
+during a directory scan. The -v flag causes it to report unrecognized files.
+
+The -m flag causes go version to print each executable's embedded
+module version information, when available. In the output, the module
+information consists of multiple lines following the version line, each
+indented by a leading tab character.
+
+See also: go doc runtime/debug.BuildInfo.
+`,
+}
+
+func init() {
+	CmdVersion.Run = runVersion // break init cycle
+}
+
+var (
+	versionM = CmdVersion.Flag.Bool("m", false, "")
+	versionV = CmdVersion.Flag.Bool("v", false, "")
+)
+
+func runVersion(ctx context.Context, cmd *base.Command, args []string) {
+	if len(args) == 0 {
+		// If any of this command's flags were passed explicitly, error
+		// out, because they only make sense with arguments.
+		//
+		// Don't error if the flags came from GOFLAGS, since that can be
+		// a reasonable use case. For example, imagine GOFLAGS=-v to
+		// turn "verbose mode" on for all Go commands, which should not
+		// break "go version".
+		var argOnlyFlag string
+		if !base.InGOFLAGS("-m") && *versionM {
+			argOnlyFlag = "-m"
+		} else if !base.InGOFLAGS("-v") && *versionV {
+			argOnlyFlag = "-v"
+		}
+		if argOnlyFlag != "" {
+			fmt.Fprintf(os.Stderr, "go: 'go version' only accepts %s flag with arguments\n", argOnlyFlag)
+			base.SetExitStatus(2)
+			return
+		}
+		fmt.Printf("go version %s %s/%s\n", runtime.Version(), runtime.GOOS, runtime.GOARCH)
+		return
+	}
+
+	for _, arg := range args {
+		info, err := os.Stat(arg)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "%v\n", err)
+			base.SetExitStatus(1)
+			continue
+		}
+		if info.IsDir() {
+			scanDir(arg)
+		} else {
+			scanFile(arg, info, true)
+		}
+	}
+}
+
+// scanDir scans a directory for executables to run scanFile on.
+func scanDir(dir string) {
+	filepath.WalkDir(dir, func(path string, d fs.DirEntry, err error) error {
+		if d.Type().IsRegular() || d.Type()&fs.ModeSymlink != 0 {
+			info, err := d.Info()
+			if err != nil {
+				if *versionV {
+					fmt.Fprintf(os.Stderr, "%s: %v\n", path, err)
+				}
+				return nil
+			}
+			scanFile(path, info, *versionV)
+		}
+		return nil
+	})
+}
+
+// isExe reports whether the file should be considered executable.
+func isExe(file string, info fs.FileInfo) bool {
+	if runtime.GOOS == "windows" {
+		return strings.HasSuffix(strings.ToLower(file), ".exe")
+	}
+	return info.Mode().IsRegular() && info.Mode()&0111 != 0
+}
+
+// scanFile scans file to try to report the Go and module versions.
+// If mustPrint is true, scanFile will report any error reading file.
+// Otherwise (mustPrint is false, because scanFile is being called
+// by scanDir) scanFile prints nothing for non-Go executables.
+func scanFile(file string, info fs.FileInfo, mustPrint bool) {
+	if info.Mode()&fs.ModeSymlink != 0 {
+		// Accept file symlinks only.
+		i, err := os.Stat(file)
+		if err != nil || !i.Mode().IsRegular() {
+			if mustPrint {
+				fmt.Fprintf(os.Stderr, "%s: symlink\n", file)
+			}
+			return
+		}
+		info = i
+	}
+
+	if !isExe(file, info) {
+		if mustPrint {
+			fmt.Fprintf(os.Stderr, "%s: not executable file\n", file)
+		}
+		return
+	}
+
+	x, err := openExe(file)
+	if err != nil {
+		if mustPrint {
+			fmt.Fprintf(os.Stderr, "%s: %v\n", file, err)
+		}
+		return
+	}
+	defer x.Close()
+
+	vers, mod := findVers(x)
+	if vers == "" {
+		if mustPrint {
+			fmt.Fprintf(os.Stderr, "%s: go version not found\n", file)
+		}
+		return
+	}
+
+	fmt.Printf("%s: %s\n", file, vers)
+	if *versionM && mod != "" {
+		fmt.Printf("\t%s\n", strings.ReplaceAll(mod[:len(mod)-1], "\n", "\n\t"))
+	}
+}
+*/
+
+// The build info blob left by the linker is identified by
+// a 16-byte header, consisting of buildInfoMagic (14 bytes),
+// the binary's pointer size (1 byte),
+// and whether the binary is big endian (1 byte).
+var buildInfoMagic = []byte("\xff Go buildinf:")
+
+// findVers finds and returns the Go version and module version information
+// in the executable x.
+func findVers(x exe) (vers, mod string) {
+	// Read the first 64kB of text to find the build info blob.
+	text := x.DataStart()
+	data, err := x.ReadData(text, 64*1024)
+	if err != nil {
+		return
+	}
+	for ; !bytes.HasPrefix(data, buildInfoMagic); data = data[32:] {
+		if len(data) < 32 {
+			return
+		}
+	}
+
+	// Decode the blob.
+	ptrSize := int(data[14])
+	bigEndian := data[15] != 0
+	var bo binary.ByteOrder
+	if bigEndian {
+		bo = binary.BigEndian
+	} else {
+		bo = binary.LittleEndian
+	}
+	var readPtr func([]byte) uint64
+	if ptrSize == 4 {
+		readPtr = func(b []byte) uint64 { return uint64(bo.Uint32(b)) }
+	} else {
+		readPtr = bo.Uint64
+	}
+	vers = readString(x, ptrSize, readPtr, readPtr(data[16:]))
+	if vers == "" {
+		return
+	}
+	mod = readString(x, ptrSize, readPtr, readPtr(data[16+ptrSize:]))
+	if len(mod) >= 33 && mod[len(mod)-17] == '\n' {
+		// Strip module framing.
+		mod = mod[16 : len(mod)-16]
+	} else {
+		mod = ""
+	}
+	return vers, mod
+}
+
+// readString returns the string at address addr in the executable x.
+func readString(x exe, ptrSize int, readPtr func([]byte) uint64, addr uint64) string {
+	hdr, err := x.ReadData(addr, uint64(2*ptrSize))
+	if err != nil || len(hdr) < 2*ptrSize {
+		return ""
+	}
+	dataAddr := readPtr(hdr)
+	dataLen := readPtr(hdr[ptrSize:])
+	data, err := x.ReadData(dataAddr, dataLen)
+	if err != nil || uint64(len(data)) < dataLen {
+		return ""
+	}
+	return string(data)
+}

syft/pkg/cataloger/java/archive_parser_test.go

@@ -90,6 +90,7 @@ func TestParseJar(t *testing.T) {
 			fixture: "test-fixtures/java-builds/packages/example-jenkins-plugin.hpi",
 			ignoreExtras: []string{
 				"Plugin-Version", // has dynamic date
+				"Built-By",       // podman returns the real UID
 				"Build-Jdk",      // can't guarantee the JDK used at build time
 			},
 			expected: map[string]pkg.Package{
@@ -112,7 +113,7 @@ func TestParseJar(t *testing.T) {
 								"Plugin-License-Url":  "https://opensource.org/licenses/MIT",
 								"Plugin-License-Name": "MIT License",
 								"Created-By":          "Apache Maven",
-								"Built-By":            "?",
+								//"Built-By":            "?",
 								//"Build-Jdk":            "14.0.1",
 								"Jenkins-Version":      "2.164.3",
 								"Minimum-Java-Version": "1.8",
@@ -162,6 +163,7 @@ func TestParseJar(t *testing.T) {
 			fixture: "test-fixtures/java-builds/packages/example-java-app-maven-0.1.0.jar",
 			ignoreExtras: []string{
 				"Build-Jdk", // can't guarantee the JDK used at build time
+				"Built-By",  // podman returns the real UID
 			},
 			expected: map[string]pkg.Package{
 				"example-java-app-maven": {
@@ -178,7 +180,7 @@ func TestParseJar(t *testing.T) {
 								// extra fields...
 								"Archiver-Version": "Plexus Archiver",
 								"Created-By":       "Apache Maven 3.6.3",
-								"Built-By":         "?",
+								//"Built-By":         "?",
 								//"Build-Jdk":        "14.0.1",
 								"Main-Class": "hello.HelloWorld",
 							},

syft/pkg/cataloger/python/package_cataloger_test.go

@@ -78,6 +78,8 @@ func TestPythonPackageWheelCataloger(t *testing.T) {
 						{Path: "Pygments-2.6.1.dist-info/RECORD"},
 						{Path: "pygments/__pycache__/__init__.cpython-38.pyc"},
 						{Path: "pygments/util.py", Digest: &pkg.PythonFileDigest{"sha256", "586xXHiJGGZxqk5PMBu3vBhE68DLuAe5MBARWrSPGxA"}, Size: "10778"},
+
+						{Path: "pygments/x_util.py", Digest: &pkg.PythonFileDigest{"sha256", "qpzzsOW31KT955agi-7NS--90I0iNiJCyLJQnRCHgKI="}, Size: "10778"},
 					},
 					TopLevelPackages: []string{"pygments", "something_else"},
 				},

syft/pkg/cataloger/python/parse_wheel_egg_record.go

@@ -6,6 +6,7 @@ import (
 	"io"
 	"strings"
 
+	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/pkg"
 )
 
@@ -38,10 +39,10 @@ func parseWheelOrEggRecord(reader io.Reader) ([]pkg.PythonFileRecord, error) {
 				if item == "" {
 					continue
 				}
-				fields := strings.Split(item, "=")
-
+				fields := strings.SplitN(item, "=", 2)
 				if len(fields) != 2 {
-					return nil, fmt.Errorf("unexpected python record digest: %q", item)
+					log.Warnf("unexpected python record digest: %q", item)
+					continue
 				}
 
 				record.Digest = &pkg.PythonFileDigest{

syft/pkg/cataloger/python/parse_wheel_egg_record_test.go

@@ -32,6 +32,7 @@ func TestParseWheelEggRecord(t *testing.T) {
 				{Path: "Pygments-2.6.1.dist-info/RECORD"},
 				{Path: "pygments/__pycache__/__init__.cpython-38.pyc"},
 				{Path: "pygments/util.py", Digest: &pkg.PythonFileDigest{"sha256", "586xXHiJGGZxqk5PMBu3vBhE68DLuAe5MBARWrSPGxA"}, Size: "10778"},
+				{Path: "pygments/x_util.py", Digest: &pkg.PythonFileDigest{"sha256", "qpzzsOW31KT955agi-7NS--90I0iNiJCyLJQnRCHgKI="}, Size: "10778"},
 			},
 		},
 	}

syft/pkg/cataloger/python/test-fixtures/dist-info/RECORD

@@ -2,4 +2,5 @@
 Pygments-2.6.1.dist-info/AUTHORS,sha256=PVpa2_Oku6BGuiUvutvuPnWGpzxqFy2I8-NIrqCvqUY,8449
 Pygments-2.6.1.dist-info/RECORD,,
 pygments/__pycache__/__init__.cpython-38.pyc,,
-pygments/util.py,sha256=586xXHiJGGZxqk5PMBu3vBhE68DLuAe5MBARWrSPGxA,10778
+pygments/util.py,sha256=586xXHiJGGZxqk5PMBu3vBhE68DLuAe5MBARWrSPGxA,10778
+pygments/x_util.py,sha256=qpzzsOW31KT955agi-7NS--90I0iNiJCyLJQnRCHgKI=,10778

syft/pkg/cataloger/rpmdb/cataloger.go

@@ -28,7 +28,7 @@ func (c *Cataloger) Name() string {
 
 // Catalog is given an object to resolve file references and content, this function returns any discovered Packages after analyzing rpm db installation.
 func (c *Cataloger) Catalog(resolver source.FileResolver) ([]pkg.Package, error) {
-	fileMatches, err := resolver.FilesByGlob(pkg.RpmDbGlob)
+	fileMatches, err := resolver.FilesByGlob(pkg.RpmDBGlob)
 	if err != nil {
 		return nil, fmt.Errorf("failed to find rpmdb's by glob: %w", err)
 	}

syft/pkg/cataloger/rpmdb/parse_rpmdb.go

@@ -93,7 +93,7 @@ func extractRpmdbFileRecords(resolver source.FilePathResolver, entry *rpmdb.Pack
 	var records = make([]pkg.RpmdbFileRecord, 0)
 
 	for _, record := range entry.Files {
-		//only persist RPMDB file records which exist in the image/directory, otherwise ignore them
+		// only persist RPMDB file records which exist in the image/directory, otherwise ignore them
 		if resolver.HasPath(record.Path) {
 			records = append(records, pkg.RpmdbFileRecord{
 				Path: record.Path,

syft/pkg/cataloger/rpmdb/parse_rpmdb_test.go

@@ -51,8 +51,8 @@ func (r *rpmdbTestFileResolverMock) RelativeFileByPath(source.Location, string)
 	return nil
 }
 
-func (r rpmdbTestFileResolverMock) FilesByMIMEType(types ...string) ([]source.Location, error) {
-	panic("implement me")
+func (r *rpmdbTestFileResolverMock) FilesByMIMEType(...string) ([]source.Location, error) {
+	return nil, fmt.Errorf("not implemented")
 }
 
 func TestParseRpmDB(t *testing.T) {

syft/pkg/cpe.go

@@ -35,6 +35,14 @@ func NewCPE(cpeStr string) (CPE, error) {
 	return *value, nil
 }
 
+func MustCPE(cpeStr string) CPE {
+	c, err := NewCPE(cpeStr)
+	if err != nil {
+		panic(err)
+	}
+	return c
+}
+
 func normalizeCpeField(field string) string {
 	// keep dashes and forward slashes unescaped
 	return strings.ReplaceAll(wfn.StripSlashes(field), `\/`, "/")

syft/pkg/dpkg_metadata.go

@@ -10,7 +10,7 @@ import (
 	"github.com/scylladb/go-set/strset"
 )
 
-const DpkgDbGlob = "**/var/lib/dpkg/{status,status.d/**}"
+const DpkgDBGlob = "**/var/lib/dpkg/{status,status.d/**}"
 
 var _ FileOwner = (*DpkgMetadata)(nil)
 

syft/pkg/golang_bin_metadata.go

@@ -0,0 +1,7 @@
+package pkg
+
+// GolangBinMetadata represents all captured data for a Golang Binary
+type GolangBinMetadata struct {
+	GoCompiledVersion string
+	H1Digest          string
+}