(464) - remove mod and cargo from image cataloger (#539 )

* remove mod and cargo from image cataloger Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com> * update test error messages for clear failures Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>
478 identify go binaries and extract mod information (#534 )
2026-10-14 23:27:20 +02:00 · 2021-10-07 15:18:20 -04:00 · 2021-10-07 12:16:38 -04:00 · 2021-10-06 09:48:53 -04:00 · 2021-10-06 13:46:55 +00:00
92 changed files with 1122 additions and 272 deletions
@@ -4,57 +4,33 @@
 #  include:
 #    - EXC0002 # disable excluding of issues about comments from golint

-linters-settings:
-
-  cyclop:
-    # the maximal code complexity to report
-    max-complexity: 15
-
 linters:
  # inverted configuration with `enable-all` and `disable` is not scalable during updates of golangci-lint
  disable-all: true
  enable:
    - asciicheck
    - bodyclose
-    - cyclop
    - deadcode
    - depguard
    - dogsled
    - dupl
-    - durationcheck
    - errcheck
-    - errname
-    - errorlint
    - exportloopref
-    - forbidigo
-    - forcetypeassert
    - funlen
-    - gci
    - gocognit
    - goconst
    - gocritic
    - gocyclo
    - gofmt
-    - gofumpt
    - goimports
-    - gomoddirectives
-    - gomodguard
    - goprintffuncname
    - gosec
    - gosimple
    - govet
-    - ifshort
-    - importas
    - ineffassign
-#    - ireturn   # will be added in 1.43.0 (accept interfaces, return structs)
-    - makezero
    - misspell
    - nakedret
-    - nilerr
-#    - nilnil   # will be added in 1.43.0
    - nolintlint
-    - paralleltest
-    - predeclared
    - revive
    - rowserrcheck
    - staticcheck
@@ -65,29 +41,21 @@ linters:
    - unparam
    - unused
    - varcheck
-    - wastedassign
    - whitespace
-#    - wrapcheck
-

 # do not enable...
-#    - exhaustive        # makes to many assumptions about enums and if a switch case should contain all enum instances
-#    - exhaustivestruct  # we like to depend on zero values
 #    - gochecknoglobals
 #    - gochecknoinits    # this is too aggressive
 #    - godot
 #    - godox
-#    - goerr113    # does not allow use of dynamic errors
-#    - golint      # replaced by revive
+#    - goerr113
+#    - golint      # deprecated
 #    - gomnd       # this is too aggressive
 #    - interfacer  # this is a good idea, but is no longer supported and is prone to false positives
 #    - lll         # without a way to specify per-line exception cases, this is not usable
 #    - maligned    # this is an excellent linter, but tricky to optimize and we are not sensitive to memory layout optimizations
-#    - nestif      # other complexity linters already cover this well
-#    - nlreturn    # no robust auto-fixers supported
-#    - noctx       # we don't use context a lot
+#    - nestif
 #    - prealloc    # following this rule isn't consistently a good idea, as it sometimes forces unnecessary allocations that result in less idiomatic code
-#    - scopelint   # replaced by exportloopref
-#    - tagliatelle # too presumptive at which struct tag conventions should be used
+#    - scopelint   # deprecated
 #    - testpackage
-#    - wsl         # very verbose and there is no auto-fixer for this project yet https://github.com/bombsimon/wsl/issues/90
+#    - wsl         # this doens't have an auto-fixer yet and is pretty noisy (https://github.com/bombsimon/wsl/issues/90)
@@ -4,13 +4,14 @@ import (
 	"fmt"
 	"os"

+	"github.com/spf13/cobra"
+
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/internal/config"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/logger"
 	"github.com/anchore/syft/syft"
 	"github.com/gookit/color"
-	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 	"github.com/wagoodman/go-partybus"
 )
@@ -66,7 +67,6 @@ func initCmdAliasBindings() {
 	}
 }

-// nolint:forbidigo
 func initAppConfig() {
 	cfg, err := config.LoadApplicationConfig(viper.GetViper(), persistentOpts)
 	if err != nil {
@@ -8,6 +8,7 @@ import (
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/docker/docker/client"
+
 	"github.com/spf13/cobra"
 )

@@ -86,7 +87,7 @@ func dockerImageValidArgsFunction(cmd *cobra.Command, args []string, toComplete
 }

 func listLocalDockerImages(prefix string) ([]string, error) {
-	repoTags := make([]string, 0)
+	var repoTags = make([]string, 0)
 	ctx := context.Background()
 	cli, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
 	if err != nil {
@@ -303,7 +303,7 @@ func runPackageSbomUpload(src *source.Source, s source.Metadata, catalog *pkg.Ca
 	}

 	if err := c.Import(context.Background(), importCfg); err != nil {
-		return fmt.Errorf("failed to upload results to host=%s: %w", appConfig.Anchore.Host, err)
+		return fmt.Errorf("failed to upload results to host=%s: %+v", appConfig.Anchore.Host, err)
 	}
 	return nil
 }
@@ -11,18 +11,22 @@ import (

 func reportWriter() (io.Writer, func() error, error) {
 	nop := func() error { return nil }
-
 	path := strings.TrimSpace(appConfig.File)
+
 	switch len(path) {
 	case 0:
 		return os.Stdout, nop, nil
+
 	default:
-		reportFile, err := os.OpenFile(path, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0o644)
+		reportFile, err := os.OpenFile(path, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0644)
+
 		if err != nil {
 			return nil, nop, fmt.Errorf("unable to create report file: %w", err)
 		}
+
 		return reportFile, func() error {
 			log.Infof("report written to file=%q", path)
+
 			return reportFile.Close()
 		}, nil
 	}
@@ -24,7 +24,6 @@ var rootCmd = &cobra.Command{
 	ValidArgsFunction: packagesCmd.ValidArgsFunction,
 }

-// nolint:forbidigo
 func init() {
 	// set universal flags
 	rootCmd.PersistentFlags().StringVarP(&persistentOpts.ConfigPath, "config", "c", "", "application config file")
@@ -6,6 +6,7 @@ import (
 	"os"

 	"github.com/anchore/syft/internal"
+
 	"github.com/anchore/syft/internal/version"
 	"github.com/spf13/cobra"
 )
@@ -23,7 +24,6 @@ func init() {
 	rootCmd.AddCommand(versionCmd)
 }

-// nolint:forbidigo
 func printVersion(_ *cobra.Command, _ []string) {
 	versionInfo := version.FromBuild()

@@ -18,18 +18,19 @@ require (
 	github.com/dustin/go-humanize v1.0.0
 	github.com/facebookincubator/nvdtools v0.1.4
 	github.com/go-test/deep v1.0.7
-	github.com/google/uuid v1.1.1
+	github.com/google/go-cmp v0.4.1
+	github.com/google/uuid v1.2.0
 	github.com/gookit/color v1.2.7
 	github.com/hashicorp/go-multierror v1.1.0
 	github.com/hashicorp/go-version v1.2.0
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/mitchellh/mapstructure v1.3.1
 	github.com/olekukonko/tablewriter v0.0.4
-	github.com/pelletier/go-toml v1.8.0
+	github.com/pelletier/go-toml v1.8.1
 	github.com/pkg/profile v1.5.0
 	github.com/scylladb/go-set v1.0.2
 	github.com/sergi/go-diff v1.1.0
-	github.com/sirupsen/logrus v1.6.0
+	github.com/sirupsen/logrus v1.8.1
 	github.com/spdx/tools-golang v0.1.0
 	github.com/spf13/afero v1.2.2
 	github.com/spf13/cobra v1.0.1-0.20200909172742-8a63648dd905
@@ -42,8 +43,8 @@ require (
 	github.com/wagoodman/jotframe v0.0.0-20200730190914-3517092dd163
 	github.com/x-cray/logrus-prefixed-formatter v0.5.2
 	github.com/xeipuuv/gojsonschema v1.2.0
-	golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9
 	golang.org/x/mod v0.3.0
 	golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d
-	gopkg.in/yaml.v2 v2.3.0
+	golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1
+	gopkg.in/yaml.v2 v2.4.0
 )
@@ -73,7 +73,6 @@ github.com/Azure/go-autorest/autorest/validation v0.1.0/go.mod h1:Ha3z/SqBeaalWQ
 github.com/Azure/go-autorest/autorest/validation v0.2.0/go.mod h1:3EEqHnBxQGHXRYq3HT1WyXAvT7LLY3tl70hw6tQIbjI=
 github.com/Azure/go-autorest/logger v0.1.0/go.mod h1:oExouG+K6PryycPJfVSxi/koC6LSNgds39diKLz7Vrc=
 github.com/Azure/go-autorest/tracing v0.5.0/go.mod h1:r/s2XiOKccPW3HrqB+W0TQzfbtp2fGCgRFtBroKn4Dk=
-github.com/BurntSushi/toml v0.3.1 h1:WXkYYl6Yr3qBf1K79EBnL4mak0OimBfB0XUf9Vl28OQ=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/Djarvur/go-err113 v0.0.0-20200410182137-af658d038157/go.mod h1:4UJr5HIiMZrwgkSPdsjy2uOQExX/WEILpIrO9UPGuXs=
@@ -374,8 +373,9 @@ github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm4
 github.com/google/rpmpack v0.0.0-20191226140753-aa36bfddb3a0/go.mod h1:RaTPr0KUf2K7fnZYLNDrr8rxAamWs3iNywJLtQ2AzBg=
 github.com/google/subcommands v1.0.1/go.mod h1:ZjhPrFU+Olkh9WazFPsl27BQ4UPiG37m3yTrtFlrHVk=
 github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.1.1 h1:Gkbcsh/GbpXz7lPftLA3P6TYMwjCLYm83jiFQZF/3gY=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.2.0 h1:qJYtXnJRWmpe7m/3XlyhrsLrEURqHRM2kxzoxXqyUDs=
+github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/wire v0.3.0/go.mod h1:i1DMg/Lu8Sz5yYl25iOdmc5CT5qusaa+zmRWs16741s=
 github.com/google/wire v0.4.0/go.mod h1:ngWDr9Qvq3yZA10YrxfyGELY/AFWGVpy9c1LTRi1EoU=
 github.com/googleapis/gax-go v2.0.2+incompatible/go.mod h1:SFVmujtThgffbyetf+mdk2eWhX2bMyUtNHzFKcPA9HY=
@@ -479,7 +479,6 @@ github.com/klauspost/cpuid v0.0.0-20180405133222-e7e905edc00e/go.mod h1:Pj4uuM52
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/konsorten/go-windows-terminal-sequences v1.0.3 h1:CE8S1cTafDpPvMhIxNJKvHsGVBgn1xWYf1NbHQhywc8=
 github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
@@ -595,8 +594,9 @@ github.com/opencontainers/runtime-spec v1.0.2/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
-github.com/pelletier/go-toml v1.8.0 h1:Keo9qb7iRJs2voHvunFtuuYFsbWeOBh8/P9v/kVMFtw=
 github.com/pelletier/go-toml v1.8.0/go.mod h1:D6yutnOGMveHEPV7VQOuvI/gXY61bv+9bAOTRnLElKs=
+github.com/pelletier/go-toml v1.8.1 h1:1Nf83orprkJyknT6h7zbuEGUEjcyVlCxSUGTENmNCRM=
+github.com/pelletier/go-toml v1.8.1/go.mod h1:T2/BmBdy8dvIRq1a/8aqjN41wvWlN4lrapLU/GW4pbc=
 github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
 github.com/phayes/checkstyle v0.0.0-20170904204023-bfd46e6a821d/go.mod h1:3OzsM7FXDQlpCiw2j81fOmAwQLnZnLGXVKUzeKQXIAw=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -660,8 +660,9 @@ github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPx
 github.com/sirupsen/logrus v1.3.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
-github.com/sirupsen/logrus v1.6.0 h1:UBcNElsrwanuuMsnGSlYmtmgbb23qDR5dG+6X6Oo89I=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
+github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
+github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
 github.com/smartystreets/assertions v1.0.0 h1:UVQPSSmc3qtTi+zPPkCXvZX9VvW/xT/NsRvKfwY81a8=
 github.com/smartystreets/assertions v1.0.0/go.mod h1:kHHU4qYBaI3q23Pp3VPrmWhuIUrLW/7eUrw0BU5VaoM=
@@ -800,9 +801,8 @@ golang.org/x/crypto v0.0.0-20191002192127-34f69633bfdc/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191206172530-e9b2fee46413/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20200510223506-06a226fb4e37 h1:cg5LA/zNPRzIXIWSCxQW10Rvpy94aQh3LT/ShoCpkHw=
 golang.org/x/crypto v0.0.0-20200510223506-06a226fb4e37/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 h1:psW17arqaxU48Z5kZ0CQnkZWQJsqcURM6tKiBApRjXI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190125153040-c74c464bbbf2/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -944,6 +944,7 @@ golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da h1:b3NXsE2LusjYGGjL5bxEVZZORm/YEFFrWFjR8eFrw/c=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1 h1:v+OssWQX+hTHEmOBgwxdZxK4zHq3yOs8F9J7mk0PY8E=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1138,8 +1139,9 @@ gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
@@ -6,6 +6,8 @@ import (
 	"fmt"
 	"time"

+	"github.com/antihax/optional"
+
 	"github.com/anchore/client-go/pkg/external"
 	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/syft/internal/bus"
@@ -13,7 +15,6 @@ import (
 	"github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
-	"github.com/antihax/optional"
 	"github.com/wagoodman/go-partybus"
 	"github.com/wagoodman/go-progress"
 )
@@ -63,7 +64,7 @@ func (c *Client) Import(ctx context.Context, cfg ImportConfig) error {
 	stage.Current = "starting session"
 	startOperation, _, err := c.client.ImportsApi.CreateOperation(authedCtx)
 	if err != nil {
-		detail := "no details given"
+		var detail = "no details given"
 		var openAPIErr external.GenericOpenAPIError
 		if errors.As(err, &openAPIErr) {
 			detail = string(openAPIErr.Body())
@@ -105,7 +106,7 @@ func (c *Client) Import(ctx context.Context, cfg ImportConfig) error {

 	_, _, err = c.client.ImagesApi.AddImage(authedCtx, imageModel, &opts)
 	if err != nil {
-		detail := "no details given"
+		var detail = "no details given"
 		var openAPIErr external.GenericOpenAPIError
 		if errors.As(err, &openAPIErr) {
 			detail = string(openAPIErr.Body())
@@ -121,7 +122,7 @@ func (c *Client) Import(ctx context.Context, cfg ImportConfig) error {
 }

 func addImageModel(imageMetadata image.Metadata, packageDigest, manifestDigest, dockerfileDigest, configDigest, sessionID string) external.ImageAnalysisRequest {
-	tags := make([]string, len(imageMetadata.Tags))
+	var tags = make([]string, len(imageMetadata.Tags))
 	for i, t := range imageMetadata.Tags {
 		tags[i] = t.String()
 	}
@@ -8,9 +8,10 @@ import (
 	"fmt"
 	"net/http"

+	"github.com/wagoodman/go-progress"
+
 	"github.com/anchore/client-go/pkg/external"
 	"github.com/anchore/syft/internal/log"
-	"github.com/wagoodman/go-progress"
 )

 type configImportAPI interface {
@@ -6,9 +6,11 @@ import (
 	"fmt"
 	"net/http"

-	"github.com/anchore/client-go/pkg/external"
-	"github.com/anchore/syft/internal/log"
 	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/syft/internal/log"
+
+	"github.com/anchore/client-go/pkg/external"
 )

 type dockerfileImportAPI interface {
@@ -8,9 +8,10 @@ import (
 	"fmt"
 	"net/http"

+	"github.com/wagoodman/go-progress"
+
 	"github.com/anchore/client-go/pkg/external"
 	"github.com/anchore/syft/internal/log"
-	"github.com/wagoodman/go-progress"
 )

 type manifestImportAPI interface {
@@ -8,13 +8,16 @@ import (
 	"fmt"
 	"net/http"

+	"github.com/anchore/syft/internal/presenter/packages"
+
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/syft/source"
+
 	"github.com/anchore/client-go/pkg/external"
 	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/presenter/packages"
-	"github.com/anchore/syft/syft/distro"
 	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
-	"github.com/wagoodman/go-progress"
 )

 type packageSBOMImportAPI interface {
@@ -15,10 +15,8 @@ package bus

 import "github.com/wagoodman/go-partybus"

-var (
-	publisher partybus.Publisher
-	active    bool
-)
+var publisher partybus.Publisher
+var active bool

 // SetPublisher sets the singleton event bus publisher. This is optional; if no bus is provided, the library will
 // behave no differently than if a bus had been provided.
@@ -89,10 +89,43 @@ func (cfg Application) loadDefaultValues(v *viper.Viper) {
 	}
 }

-// build inflates simple config values into syft native objects (or other complex objects) after the config is fully read in.
 func (cfg *Application) parseConfigValues() error {
+	// parse application config options
+	for _, optionFn := range []func() error{
+		cfg.parseUploadOptions,
+		cfg.parseLogLevelOption,
+	} {
+		if err := optionFn(); err != nil {
+			return err
+		}
+	}
+
+	// parse nested config options
+	// for each field in the configuration struct, see if the field implements the parser interface
+	// note: the app config is a pointer, so we need to grab the elements explicitly (to traverse the address)
+	value := reflect.ValueOf(cfg).Elem()
+	for i := 0; i < value.NumField(); i++ {
+		// note: since the interface method of parser is a pointer receiver we need to get the value of the field as a pointer.
+		if parsable, ok := value.Field(i).Addr().Interface().(parser); ok {
+			// the field implements parser, call it
+			if err := parsable.parseConfigValues(); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func (cfg *Application) parseUploadOptions() error {
+	if cfg.Anchore.Host == "" && cfg.Anchore.Dockerfile != "" {
+		return fmt.Errorf("cannot provide dockerfile option without enabling upload")
+	}
+	return nil
+}
+
+func (cfg *Application) parseLogLevelOption() error {
 	if cfg.Quiet {
-		// TODO: this is bad: quiet option trumps all other logging options
+		// TODO: this is bad: quiet option trumps all other logging options (such as to a file on disk)
 		// we should be able to quiet the console logging and leave file logging alone...
 		// ... this will be an enhancement for later
 		cfg.Log.LevelOpt = logrus.PanicLevel
@@ -116,34 +149,17 @@ func (cfg *Application) parseConfigValues() error {
 			case v >= 2:
 				cfg.Log.LevelOpt = logrus.DebugLevel
 			default:
-				cfg.Log.LevelOpt = logrus.WarnLevel
+				cfg.Log.LevelOpt = logrus.ErrorLevel
 			}
 		}
 	}
-
-	if cfg.Anchore.Host == "" && cfg.Anchore.Dockerfile != "" {
-		return fmt.Errorf("cannot provide dockerfile option without enabling upload")
-	}
-
-	// for each field in the configuration struct, see if the field implements the parser interface
-	// note: the app config is a pointer, so we need to grab the elements explicitly (to traverse the address)
-	value := reflect.ValueOf(cfg).Elem()
-	for i := 0; i < value.NumField(); i++ {
-		// note: since the interface method of parser is a pointer receiver we need to get the value of the field as a pointer.
-		if parsable, ok := value.Field(i).Addr().Interface().(parser); ok {
-			// the field implements parser, call it
-			if err := parsable.parseConfigValues(); err != nil {
-				return err
-			}
-		}
-	}
-
 	return nil
 }

 func (cfg Application) String() string {
 	// yaml is pretty human friendly (at least when compared to json)
 	appCfgStr, err := yaml.Marshal(&cfg)
+
 	if err != nil {
 		return err.Error()
 	}
@@ -4,6 +4,7 @@ import (
 	"os"

 	"github.com/anchore/stereoscope/pkg/image"
+
 	"github.com/spf13/viper"
 )

@@ -57,7 +58,7 @@ func hasNonEmptyCredentials(username, password, token string) bool {
 }

 func (cfg *registry) ToOptions() *image.RegistryOptions {
-	auth := make([]image.RegistryCredentials, len(cfg.Auth))
+	var auth = make([]image.RegistryCredentials, len(cfg.Auth))
 	for i, a := range cfg.Auth {
 		auth[i] = image.RegistryCredentials{
 			Authority: a.Authority,
@@ -1,7 +1,6 @@
 package internal

 import (
-	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -16,23 +15,24 @@ func CloseAndLogError(closer io.Closer, location string) {
 	}
 }

-type PathError struct {
+type ErrPath struct {
 	Path string
 	Err  error
 }

-func (e PathError) Error() string {
+func (e ErrPath) Error() string {
 	return fmt.Sprintf("unable to observe contents of %+v: %v", e.Path, e.Err)
 }

-func IsPathError(err error) bool {
-	return errors.As(err, &PathError{})
+func IsErrPath(err error) bool {
+	_, ok := err.(ErrPath)
+	return ok
 }

 func IsErrPathPermission(err error) bool {
-	var pathErr *PathError
-	if errors.As(err, pathErr) {
+	pathErr, ok := err.(ErrPath)
+	if ok {
 		return os.IsPermission(pathErr.Err)
 	}
-	return false
+	return ok
 }
@@ -24,12 +24,12 @@ const (

 const perFileReadLimit = 2 * GB

-type zipSlipDetectedError struct {
+type errZipSlipDetected struct {
 	Prefix   string
 	JoinArgs []string
 }

-func (e *zipSlipDetectedError) Error() string {
+func (e *errZipSlipDetected) Error() string {
 	return fmt.Sprintf("paths are not allowed to resolve outside of the root prefix (%q). Destination: %q", e.Prefix, e.JoinArgs)
 }

@@ -197,7 +197,7 @@ func safeJoin(prefix string, dest ...string) (string, error) {
 	joinResult := filepath.Join(append([]string{prefix}, dest...)...)
 	cleanJoinResult := filepath.Clean(joinResult)
 	if !strings.HasPrefix(cleanJoinResult, filepath.Clean(prefix)) {
-		return "", &zipSlipDetectedError{
+		return "", &errZipSlipDetected{
 			Prefix:   prefix,
 			JoinArgs: dest,
 		}
@@ -299,7 +299,7 @@ func TestSafeJoin(t *testing.T) {
 				"../../../etc/passwd",
 			},
 			expected:     "",
-			errAssertion: assertErrorAs(&zipSlipDetectedError{}),
+			errAssertion: assertErrorAs(&errZipSlipDetected{}),
 		},
 		{
 			prefix: "/a/place",
@@ -308,7 +308,7 @@ func TestSafeJoin(t *testing.T) {
 				"../",
 			},
 			expected:     "",
-			errAssertion: assertErrorAs(&zipSlipDetectedError{}),
+			errAssertion: assertErrorAs(&errZipSlipDetected{}),
 		},
 		{
 			prefix: "/a/place",
@@ -316,7 +316,7 @@ func TestSafeJoin(t *testing.T) {
 				"../",
 			},
 			expected:     "",
-			errAssertion: assertErrorAs(&zipSlipDetectedError{}),
+			errAssertion: assertErrorAs(&errZipSlipDetected{}),
 		},
 	}

@@ -3,7 +3,6 @@ package file
 import (
 	"archive/zip"
 	"encoding/binary"
-	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -92,7 +91,7 @@ func findArchiveStartOffset(r io.ReaderAt, size int64) (startOfArchive uint64, e
 			bLen = size
 		}
 		buf = make([]byte, int(bLen))
-		if _, err := r.ReadAt(buf, size-bLen); err != nil && !errors.Is(err, io.EOF) {
+		if _, err := r.ReadAt(buf, size-bLen); err != nil && err != io.EOF {
 			return 0, err
 		}
 		if p := findSignatureInBlock(buf); p >= 0 {
@@ -11,7 +11,7 @@ import (
 	prefixed "github.com/x-cray/logrus-prefixed-formatter"
 )

-const defaultLogFilePermissions fs.FileMode = 0o644
+const defaultLogFilePermissions fs.FileMode = 0644

 // LogrusConfig contains all configurable values for the Logrus logger
 type LogrusConfig struct {
@@ -38,18 +38,18 @@ func NewJSONPackages(catalog *pkg.Catalog) ([]JSONPackage, error) {

 // NewJSONPackage crates a new JSONPackage from the given pkg.Package.
 func NewJSONPackage(p *pkg.Package) (JSONPackage, error) {
-	cpes := make([]string, len(p.CPEs))
+	var cpes = make([]string, len(p.CPEs))
 	for i, c := range p.CPEs {
 		cpes[i] = c.BindToFmtString()
 	}

 	// ensure collections are never nil for presentation reasons
-	locations := make([]source.Location, 0)
+	var locations = make([]source.Location, 0)
 	if p.Locations != nil {
 		locations = p.Locations
 	}

-	licenses := make([]string, 0)
+	var licenses = make([]string, 0)
 	if p.Licenses != nil {
 		licenses = p.Licenses
 	}
@@ -135,7 +135,7 @@ func getSPDXHomepage(p *pkg.Package) string {
 }

 func getSPDXSourceInfo(p *pkg.Package) string {
-	var answer string
+	answer := ""
 	switch p.Type {
 	case pkg.RpmPkg:
 		answer = "acquired package info from RPM DB"
@@ -5,8 +5,9 @@ import (
 	"io"
 	"time"

-	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/spdxlicense"
+
+	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
@@ -6,8 +6,9 @@ import (
 	"sort"
 	"strings"

-	"github.com/anchore/syft/syft/pkg"
 	"github.com/olekukonko/tablewriter"
+
+	"github.com/anchore/syft/syft/pkg"
 )

 type TablePresenter struct {
@@ -2,6 +2,7 @@ package packages

 import (
 	"fmt"
+
 	"io"
 	"text/tabwriter"

@@ -6,6 +6,7 @@ import (
 	"strconv"

 	"github.com/anchore/syft/syft/file"
+
 	"github.com/anchore/syft/syft/source"
 )

@@ -51,6 +51,7 @@ type LicenseList struct {

 func main() {
 	if err := run(); err != nil {
+		fmt.Println(err.Error())
 		os.Exit(1)
 	}
 }
@@ -58,12 +59,12 @@ func main() {
 func run() error {
 	resp, err := http.Get(url)
 	if err != nil {
-		return fmt.Errorf("unable to get licenses list: %w", err)
+		return fmt.Errorf("unable to get licenses list: %+v", err)
 	}

 	var result LicenseList
 	if err = json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		return fmt.Errorf("unable to decode license list: %w", err)
+		return fmt.Errorf("unable to decode license list: %+v", err)
 	}
 	defer func() {
 		if err := resp.Body.Close(); err != nil {
@@ -73,7 +74,7 @@ func run() error {

 	f, err := os.Create(source)
 	if err != nil {
-		return fmt.Errorf("unable to create %q: %w", source, err)
+		return fmt.Errorf("unable to create %q: %+v", source, err)
 	}
 	defer func() {
 		if err := f.Close(); err != nil {
@@ -96,7 +97,7 @@ func run() error {
 	})

 	if err != nil {
-		return fmt.Errorf("unable to generate template: %w", err)
+		return fmt.Errorf("unable to generate template: %+v", err)
 	}
 	return nil
 }
@@ -112,7 +113,7 @@ func run() error {
 // We also sort the licenses for the second pass so that cases like `GPL-1` associate to `GPL-1.0` and not `GPL-1.1`.
 func processSPDXLicense(result LicenseList) map[string]string {
 	// first pass build map
-	licenseIDs := make(map[string]string)
+	var licenseIDs = make(map[string]string)
 	for _, l := range result.Licenses {
 		cleanID := strings.ToLower(l.ID)
 		if _, exists := licenseIDs[cleanID]; exists {
@@ -7,10 +7,11 @@ import (
 	"sync"

 	"github.com/anchore/syft/internal"
-	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
 	"github.com/gookit/color"
-	"github.com/wagoodman/go-partybus"
 	"github.com/wagoodman/jotframe/pkg/frame"
+
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+	"github.com/wagoodman/go-partybus"
 )

 // handleCatalogerPresenterReady is a UI function for processing the CatalogerFinished bus event, displaying the catalog
@@ -5,7 +5,7 @@ import (
 	"os"
 	"runtime"

-	"golang.org/x/crypto/ssh/terminal"
+	"golang.org/x/term"
 )

 // TODO: build tags to exclude options from windows
@@ -16,8 +16,8 @@ import (
 // are environmental problems (e.g. cannot write to the terminal). A writer is provided to capture the output of
 // the final SBOM report.
 func Select(verbose, quiet bool, reportWriter io.Writer) (uis []UI) {
-	isStdoutATty := terminal.IsTerminal(int(os.Stdout.Fd()))
-	isStderrATty := terminal.IsTerminal(int(os.Stderr.Fd()))
+	isStdoutATty := term.IsTerminal(int(os.Stdout.Fd()))
+	isStderrATty := term.IsTerminal(int(os.Stderr.Fd()))
 	notATerminal := !isStderrATty && !isStdoutATty

 	switch {
@@ -12,13 +12,11 @@ import (
 const valueNotProvided = "[not provided]"

 // all variables here are provided as build-time arguments, with clear default values
-var (
-	version      = valueNotProvided
-	gitCommit    = valueNotProvided
-	gitTreeState = valueNotProvided
-	buildDate    = valueNotProvided
-	platform     = fmt.Sprintf("%s/%s", runtime.GOOS, runtime.GOARCH)
-)
+var version = valueNotProvided
+var gitCommit = valueNotProvided
+var gitTreeState = valueNotProvided
+var buildDate = valueNotProvided
+var platform = fmt.Sprintf("%s/%s", runtime.GOOS, runtime.GOARCH)

 // Version defines the application version details (generally from build information)
 type Version struct {
@@ -1,4 +1,3 @@
-// nolint:forbidigo
 package main

 import (
@@ -71,7 +70,7 @@ func build() *jsonschema.Schema {
 	// ensure the generated list of names is stable between runs
 	sort.Strings(metadataNames)

-	metadataTypes := []map[string]string{
+	var metadataTypes = []map[string]string{
 		// allow for no metadata to be provided
 		{"type": "null"},
 	}
@@ -90,13 +89,13 @@ func build() *jsonschema.Schema {
 }

 func encode(schema *jsonschema.Schema) []byte {
-	newSchemaBuffer := new(bytes.Buffer)
+	var newSchemaBuffer = new(bytes.Buffer)
 	enc := json.NewEncoder(newSchemaBuffer)
 	// prevent > and < from being escaped in the payload
 	enc.SetEscapeHTML(false)
 	enc.SetIndent("", "  ")
-
-	if err := enc.Encode(&schema); err != nil {
+	err := enc.Encode(&schema)
+	if err != nil {
 		panic(err)
 	}

@@ -6,6 +6,7 @@ import (
 	"strings"

 	"github.com/anchore/syft/internal"
+
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/source"
 )
@@ -6,26 +6,29 @@ package parsers
 import (
 	"fmt"

-	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/file"
-	"github.com/anchore/syft/syft/pkg/cataloger"
 	"github.com/anchore/syft/syft/presenter"
-	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/syft/syft/file"
+
 	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/pkg/cataloger"
+	"github.com/wagoodman/go-partybus"
 )

-type badPayloadError struct {
+type ErrBadPayload struct {
 	Type  partybus.EventType
 	Field string
 	Value interface{}
 }

-func (e *badPayloadError) Error() string {
+func (e *ErrBadPayload) Error() string {
 	return fmt.Sprintf("event='%s' has bad event payload field='%v': '%+v'", string(e.Type), e.Field, e.Value)
 }

 func newPayloadErr(t partybus.EventType, field string, value interface{}) error {
-	return &badPayloadError{
+	return &ErrBadPayload{
 		Type:  t,
 		Field: field,
 		Value: value,
@@ -6,6 +6,7 @@ import (
 	"io"

 	"github.com/anchore/syft/internal"
+
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/source"
 )
@@ -64,7 +65,7 @@ func (i *ContentsCataloger) catalogLocation(resolver source.FileResolver, locati

 	buf := &bytes.Buffer{}
 	if _, err = io.Copy(base64.NewEncoder(base64.StdEncoding, buf), contentReader); err != nil {
-		return "", internal.PathError{Path: location.RealPath, Err: err}
+		return "", internal.ErrPath{Path: location.RealPath, Err: err}
 	}

 	return buf.String(), nil
@@ -8,12 +8,15 @@ import (
 	"strings"

 	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/bus"
+
 	"github.com/anchore/syft/internal/log"
+
+	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/source"
 	"github.com/wagoodman/go-partybus"
 	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/syft/syft/source"
 )

 type DigestsCataloger struct {
@@ -69,7 +72,7 @@ func (i *DigestsCataloger) catalogLocation(resolver source.FileResolver, locatio

 	size, err := io.Copy(io.MultiWriter(writers...), contentReader)
 	if err != nil {
-		return nil, internal.PathError{Path: location.RealPath, Err: err}
+		return nil, internal.ErrPath{Path: location.RealPath, Err: err}
 	}

 	if size == 0 {
@@ -11,7 +11,7 @@ import (
 // GenerateSearchPatterns takes a set of named base patterns, a set of additional named patterns and an name exclusion list and generates a final
 // set of regular expressions (indexed by name). The sets are aggregated roughly as such: (base - excluded) + additional.
 func GenerateSearchPatterns(basePatterns map[string]string, additionalPatterns map[string]string, excludePatternNames []string) (map[string]*regexp.Regexp, error) {
-	regexObjs := make(map[string]*regexp.Regexp)
+	var regexObjs = make(map[string]*regexp.Regexp)
 	var errs error

 	addFn := func(name, pattern string) {
@@ -9,7 +9,8 @@ import (
 	"github.com/wagoodman/go-progress"
 )

-type MetadataCataloger struct{}
+type MetadataCataloger struct {
+}

 func NewMetadataCataloger() *MetadataCataloger {
 	return &MetadataCataloger{}
@@ -9,6 +9,7 @@ import (
 	"sort"

 	"github.com/anchore/syft/internal"
+
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/event"
@@ -81,7 +82,7 @@ func (i *SecretsCataloger) catalogLocation(resolver source.FileResolver, locatio
 	// TODO: in the future we can swap out search strategies here
 	secrets, err := catalogLocationByLine(resolver, location, i.patterns)
 	if err != nil {
-		return nil, internal.PathError{Path: location.RealPath, Err: err}
+		return nil, internal.ErrPath{Path: location.RealPath, Err: err}
 	}

 	if i.revealValues {
@@ -9,6 +9,7 @@ import (
 	"regexp"

 	"github.com/anchore/syft/internal"
+
 	"github.com/anchore/syft/syft/source"
 )

@@ -19,7 +20,7 @@ func catalogLocationByLine(resolver source.FileResolver, location source.Locatio
 	}
 	defer internal.CloseAndLogError(readCloser, location.VirtualPath)

-	scanner := bufio.NewReader(readCloser)
+	var scanner = bufio.NewReader(readCloser)
 	var position int64
 	var allSecrets []SearchResult
 	var lineNo int64
@@ -29,7 +30,7 @@ func catalogLocationByLine(resolver source.FileResolver, location source.Locatio
 		var line []byte
 		// TODO: we're at risk of large memory usage for very long lines
 		line, readErr = scanner.ReadBytes('\n')
-		if readErr != nil && !errors.Is(readErr, io.EOF) {
+		if readErr != nil && readErr != io.EOF {
 			return nil, readErr
 		}

@@ -118,9 +119,9 @@ func extractSecretFromPosition(readCloser io.ReadCloser, name string, pattern *r
 	}

 	// lineNoOfSecret are the number of lines which occur before the start of the secret value
-	lineNoOfSecret := lineNo + int64(reader.newlinesBefore(start))
+	var lineNoOfSecret = lineNo + int64(reader.newlinesBefore(start))
 	// lineOffsetOfSecret are the number of bytes that occur after the last newline but before the secret value.
-	lineOffsetOfSecret := start - reader.newlinePositionBefore(start)
+	var lineOffsetOfSecret = start - reader.newlinePositionBefore(start)
 	if lineNoOfSecret == lineNo {
 		// the secret value starts in the same line as the overall match, so we must consider that line offset
 		lineOffsetOfSecret += lineOffset
@@ -3,8 +3,9 @@ package pkg
 import (
 	"sort"

-	"github.com/anchore/packageurl-go"
 	"github.com/anchore/syft/syft/file"
+
+	"github.com/anchore/packageurl-go"
 	"github.com/scylladb/go-set/strset"
 )

@@ -5,6 +5,7 @@ import (
 	"sync"

 	"github.com/anchore/syft/internal"
+
 	"github.com/anchore/syft/internal/log"
 )

@@ -66,7 +67,8 @@ func (c *Catalog) Add(p Package) {
 	c.lock.Lock()
 	defer c.lock.Unlock()

-	if _, exists := c.byID[p.ID]; exists {
+	_, exists := c.byID[p.ID]
+	if exists {
 		log.Errorf("package ID already exists in the catalog : id=%+v %+v", p.ID, p)
 		return
 	}
@@ -8,8 +8,9 @@ import (
 	"strconv"
 	"strings"

-	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/file"
+
+	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/common"
 	"github.com/mitchellh/mapstructure"
@@ -39,8 +39,7 @@ func ImageCatalogers() []Cataloger {
 		rpmdb.NewRpmdbCataloger(),
 		java.NewJavaCataloger(),
 		apkdb.NewApkdbCataloger(),
-		golang.NewGoModCataloger(),
-		rust.NewCargoLockCataloger(),
+		golang.NewGoModuleBinaryCataloger(),
 	}
 }

@@ -55,7 +54,8 @@ func DirectoryCatalogers() []Cataloger {
 		rpmdb.NewRpmdbCataloger(),
 		java.NewJavaCataloger(),
 		apkdb.NewApkdbCataloger(),
-		golang.NewGoModCataloger(),
+		golang.NewGoModuleBinaryCataloger(),
+		golang.NewGoModFileCataloger(),
 		rust.NewCargoLockCataloger(),
 	}
 }
@@ -66,7 +66,7 @@ func (c *GenericCataloger) Catalog(resolver source.FileResolver) ([]pkg.Package,

 // SelectFiles takes a set of file trees and resolves and file references of interest for future cataloging
 func (c *GenericCataloger) selectFiles(resolver source.FilePathResolver) map[source.Location]ParserFn {
-	parserByLocation := make(map[source.Location]ParserFn)
+	var parserByLocation = make(map[source.Location]ParserFn)

 	// select by exact path
 	for path, parser := range c.pathParsers {
@@ -11,6 +11,7 @@ import (
 	"sort"

 	"github.com/anchore/syft/internal"
+
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
@@ -35,7 +36,6 @@ func (c *Cataloger) Name() string {
 }

 // Catalog is given an object to resolve file references and content, this function returns any discovered Packages after analyzing dpkg support files.
-
 func (c *Cataloger) Catalog(resolver source.FileResolver) ([]pkg.Package, error) {
 	dbFileMatches, err := resolver.FilesByGlob(pkg.DpkgDBGlob)
 	if err != nil {
@@ -90,10 +90,7 @@ func addLicenses(resolver source.FileResolver, dbLocation source.Location, p *pk
 }

 func mergeFileListing(resolver source.FileResolver, dbLocation source.Location, p *pkg.Package) {
-	metadata, ok := p.Metadata.(pkg.DpkgMetadata)
-	if !ok {
-		log.Warnf("unable to get DPKG metadata while merging file info")
-	}
+	metadata := p.Metadata.(pkg.DpkgMetadata)

 	// get file listing (package files + additional config files)
 	files, infoLocations := getAdditionalFileListing(resolver, dbLocation, p)
@@ -122,7 +119,7 @@ loopNewFiles:

 func getAdditionalFileListing(resolver source.FileResolver, dbLocation source.Location, p *pkg.Package) ([]pkg.DpkgFileRecord, []source.Location) {
 	// ensure the default value for a collection is never nil since this may be shown as JSON
-	files := make([]pkg.DpkgFileRecord, 0)
+	var files = make([]pkg.DpkgFileRecord, 0)
 	var locations []source.Location

 	md5Reader, md5Location := fetchMd5Contents(resolver, dbLocation, p)
@@ -224,10 +221,7 @@ func fetchCopyrightContents(resolver source.FileResolver, dbLocation source.Loca
 }

 func md5Key(p *pkg.Package) string {
-	metadata, ok := p.Metadata.(pkg.DpkgMetadata)
-	if !ok {
-		log.Warnf("unable to get DPKG metadata while fetching md5 key")
-	}
+	metadata := p.Metadata.(pkg.DpkgMetadata)

 	contentKey := p.Name
 	if metadata.Architecture != "" && metadata.Architecture != "all" {
@@ -10,6 +10,7 @@ import (
 	"strings"

 	"github.com/anchore/syft/internal"
+
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/mitchellh/mapstructure"
 )
@@ -22,7 +23,7 @@ var (
 // parseDpkgStatus is a parser function for Debian DB status contents, returning all Debian packages listed.
 func parseDpkgStatus(reader io.Reader) ([]pkg.Package, error) {
 	buffedReader := bufio.NewReader(reader)
-	packages := make([]pkg.Package, 0)
+	var packages = make([]pkg.Package, 0)

 	continueProcessing := true
 	for continueProcessing {
@@ -151,7 +152,7 @@ func extractSourceVersion(source string) (string, string) {
 // handleNewKeyValue parse a new key-value pair from the given unprocessed line
 func handleNewKeyValue(line string) (string, interface{}, error) {
 	if i := strings.Index(line, ":"); i > 0 {
-		key := strings.TrimSpace(line[0:i])
+		var key = strings.TrimSpace(line[0:i])
 		// mapstruct cant handle "-"
 		key = strings.ReplaceAll(key, "-", "")
 		val := strings.TrimSpace(line[i+1:])
@@ -0,0 +1,61 @@
+/*
+Package golang provides a concrete Cataloger implementation for go.mod files.
+*/
+package golang
+
+import (
+	"fmt"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+const catalogerName = "go-module-binary-cataloger"
+
+// current mime types to search by to discover go binaries
+var mimeTypes = []string{
+	"application/x-executable",
+	"application/x-mach-binary",
+	"application/x-elf",
+	"application/x-sharedlib",
+	"application/vnd.microsoft.portable-executable",
+}
+
+type Cataloger struct{}
+
+// NewGoModuleBinaryCataloger returns a new Golang cataloger object.
+func NewGoModuleBinaryCataloger() *Cataloger {
+	return &Cataloger{}
+}
+
+// Name returns a string that uniquely describes a cataloger
+func (c *Cataloger) Name() string {
+	return catalogerName
+}
+
+// Catalog is given an object to resolve file references and content, this function returns any discovered Packages after analyzing rpm db installation.
+func (c *Cataloger) Catalog(resolver source.FileResolver) ([]pkg.Package, error) {
+	pkgs := make([]pkg.Package, 0)
+	fileMatches, err := resolver.FilesByMIMEType(mimeTypes...)
+	if err != nil {
+		return pkgs, fmt.Errorf("failed to find bin by mime types: %w", err)
+	}
+
+	for _, location := range fileMatches {
+		r, err := resolver.FileContentsByLocation(location)
+		if err != nil {
+			return pkgs, fmt.Errorf("failed to resolve file contents by location: %w", err)
+		}
+
+		goPkgs, err := parseGoBin(location.RealPath, r)
+		if err != nil {
+			log.Infof("could not parse go bin for: %w", err)
+		}
+
+		r.Close()
+		pkgs = append(pkgs, goPkgs...)
+	}
+
+	return pkgs, nil
+}
@@ -0,0 +1,271 @@
+// This code was copied from the Go std library.
+// https://github.com/golang/go/blob/master/src/cmd/go/internal/version/exe.go
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//nolint
+package golang
+
+import (
+	"bytes"
+	"debug/elf"
+	"debug/macho"
+	"debug/pe"
+	"fmt"
+	"io"
+)
+
+// An exe is a generic interface to an OS executable (ELF, Mach-O, PE, XCOFF).
+type exe interface {
+	// Close closes the underlying file.
+	Close() error
+
+	// ReadData reads and returns up to size byte starting at virtual address addr.
+	ReadData(addr, size uint64) ([]byte, error)
+
+	// DataStart returns the writable data segment start address.
+	DataStart() uint64
+}
+
+// openExe opens file and returns it as an exe.
+// we changed this signature from accpeting a string
+// to a ReadCloser so we could adapt the code to the
+// stereoscope api. We removed the file open methods.
+func openExe(file io.ReadCloser) (exe, error) {
+	/*
+		f, err := os.Open(file)
+		if err != nil {
+			return nil, err
+		}
+		data := make([]byte, 16)
+		if _, err := io.ReadFull(f, data); err != nil {
+			return nil, err
+		}
+		f.Seek(0, 0)
+	*/
+	data, err := io.ReadAll(file)
+	if err != nil {
+		return nil, err
+	}
+
+	r := bytes.NewReader(data)
+	f := io.NewSectionReader(r, 0, int64(len(data)))
+	if bytes.HasPrefix(data, []byte("\x7FELF")) {
+		e, err := elf.NewFile(f)
+		if err != nil {
+			return nil, err
+		}
+
+		return &elfExe{file, e}, nil
+	}
+
+	if bytes.HasPrefix(data, []byte("MZ")) {
+		e, err := pe.NewFile(f)
+		if err != nil {
+			return nil, err
+		}
+		return &peExe{file, e}, nil
+	}
+
+	if bytes.HasPrefix(data, []byte("\xFE\xED\xFA")) || bytes.HasPrefix(data[1:], []byte("\xFA\xED\xFE")) {
+		e, err := macho.NewFile(f)
+		if err != nil {
+			return nil, err
+		}
+		return &machoExe{file, e}, nil
+	}
+
+	return nil, fmt.Errorf("unrecognized executable format")
+}
+
+// elfExe is the ELF implementation of the exe interface.
+// updated os to be io.ReadCloser to interopt with stereoscope
+type elfExe struct {
+	os io.ReadCloser
+	f  *elf.File
+}
+
+func (x *elfExe) Close() error {
+	return x.os.Close()
+}
+
+func (x *elfExe) ReadData(addr, size uint64) ([]byte, error) {
+	for _, prog := range x.f.Progs {
+		if prog.Vaddr <= addr && addr <= prog.Vaddr+prog.Filesz-1 {
+			n := prog.Vaddr + prog.Filesz - addr
+			if n > size {
+				n = size
+			}
+			data := make([]byte, n)
+			_, err := prog.ReadAt(data, int64(addr-prog.Vaddr))
+			if err != nil {
+				return nil, err
+			}
+			return data, nil
+		}
+	}
+	return nil, fmt.Errorf("address not mapped")
+}
+
+func (x *elfExe) DataStart() uint64 {
+	for _, s := range x.f.Sections {
+		if s.Name == ".go.buildinfo" {
+			return s.Addr
+		}
+	}
+	for _, p := range x.f.Progs {
+		if p.Type == elf.PT_LOAD && p.Flags&(elf.PF_X|elf.PF_W) == elf.PF_W {
+			return p.Vaddr
+		}
+	}
+	return 0
+}
+
+// peExe is the PE (Windows Portable Executable) implementation of the exe interface.
+type peExe struct {
+	os io.ReadCloser
+	f  *pe.File
+}
+
+func (x *peExe) Close() error {
+	return x.os.Close()
+}
+
+func (x *peExe) imageBase() uint64 {
+	switch oh := x.f.OptionalHeader.(type) {
+	case *pe.OptionalHeader32:
+		return uint64(oh.ImageBase)
+	case *pe.OptionalHeader64:
+		return oh.ImageBase
+	}
+	return 0
+}
+
+func (x *peExe) ReadData(addr, size uint64) ([]byte, error) {
+	addr -= x.imageBase()
+	for _, sect := range x.f.Sections {
+		if uint64(sect.VirtualAddress) <= addr && addr <= uint64(sect.VirtualAddress+sect.Size-1) {
+			n := uint64(sect.VirtualAddress+sect.Size) - addr
+			if n > size {
+				n = size
+			}
+			data := make([]byte, n)
+			_, err := sect.ReadAt(data, int64(addr-uint64(sect.VirtualAddress)))
+			if err != nil {
+				return nil, err
+			}
+			return data, nil
+		}
+	}
+	return nil, fmt.Errorf("address not mapped")
+}
+
+func (x *peExe) DataStart() uint64 {
+	// Assume data is first writable section.
+	const (
+		IMAGE_SCN_CNT_CODE               = 0x00000020
+		IMAGE_SCN_CNT_INITIALIZED_DATA   = 0x00000040
+		IMAGE_SCN_CNT_UNINITIALIZED_DATA = 0x00000080
+		IMAGE_SCN_MEM_EXECUTE            = 0x20000000
+		IMAGE_SCN_MEM_READ               = 0x40000000
+		IMAGE_SCN_MEM_WRITE              = 0x80000000
+		IMAGE_SCN_MEM_DISCARDABLE        = 0x2000000
+		IMAGE_SCN_LNK_NRELOC_OVFL        = 0x1000000
+		IMAGE_SCN_ALIGN_32BYTES          = 0x600000
+	)
+	for _, sect := range x.f.Sections {
+		if sect.VirtualAddress != 0 && sect.Size != 0 &&
+			sect.Characteristics&^IMAGE_SCN_ALIGN_32BYTES == IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE {
+			return uint64(sect.VirtualAddress) + x.imageBase()
+		}
+	}
+	return 0
+}
+
+// machoExe is the Mach-O (Apple macOS/iOS) implementation of the exe interface.
+type machoExe struct {
+	os io.ReadCloser
+	f  *macho.File
+}
+
+func (x *machoExe) Close() error {
+	return x.os.Close()
+}
+
+func (x *machoExe) ReadData(addr, size uint64) ([]byte, error) {
+	for _, load := range x.f.Loads {
+		seg, ok := load.(*macho.Segment)
+		if !ok {
+			continue
+		}
+		if seg.Addr <= addr && addr <= seg.Addr+seg.Filesz-1 {
+			if seg.Name == "__PAGEZERO" {
+				continue
+			}
+			n := seg.Addr + seg.Filesz - addr
+			if n > size {
+				n = size
+			}
+			data := make([]byte, n)
+			_, err := seg.ReadAt(data, int64(addr-seg.Addr))
+			if err != nil {
+				return nil, err
+			}
+			return data, nil
+		}
+	}
+	return nil, fmt.Errorf("address not mapped")
+}
+
+func (x *machoExe) DataStart() uint64 {
+	// Look for section named "__go_buildinfo".
+	for _, sec := range x.f.Sections {
+		if sec.Name == "__go_buildinfo" {
+			return sec.Addr
+		}
+	}
+	// Try the first non-empty writable segment.
+	const RW = 3
+	for _, load := range x.f.Loads {
+		seg, ok := load.(*macho.Segment)
+		if ok && seg.Addr != 0 && seg.Filesz != 0 && seg.Prot == RW && seg.Maxprot == RW {
+			return seg.Addr
+		}
+	}
+	return 0
+}
+
+/*
+// xcoffExe is the XCOFF (AIX eXtended COFF) implementation of the exe interface.
+type xcoffExe struct {
+	os *os.File
+	f  *xcoff.File
+}
+
+func (x *xcoffExe) Close() error {
+	return x.os.Close()
+}
+
+func (x *xcoffExe) ReadData(addr, size uint64) ([]byte, error) {
+	for _, sect := range x.f.Sections {
+		if uint64(sect.VirtualAddress) <= addr && addr <= uint64(sect.VirtualAddress+sect.Size-1) {
+			n := uint64(sect.VirtualAddress+sect.Size) - addr
+			if n > size {
+				n = size
+			}
+			data := make([]byte, n)
+			_, err := sect.ReadAt(data, int64(addr-uint64(sect.VirtualAddress)))
+			if err != nil {
+				return nil, err
+			}
+			return data, nil
+		}
+	}
+	return nil, fmt.Errorf("address not mapped")
+}
+
+func (x *xcoffExe) DataStart() uint64 {
+	return x.f.SectionByType(xcoff.STYP_DATA).VirtualAddress
+}
+*/
@@ -7,11 +7,11 @@ import (
 	"github.com/anchore/syft/syft/pkg/cataloger/common"
 )

-// NewGoModCataloger returns a new Go module cataloger object.
-func NewGoModCataloger() *common.GenericCataloger {
+// NewGoModFileCataloger returns a new Go module cataloger object.
+func NewGoModFileCataloger() *common.GenericCataloger {
 	globParsers := map[string]common.ParserFn{
 		"**/go.mod": parseGoMod,
 	}

-	return common.NewGenericCataloger(nil, globParsers, "go-cataloger")
+	return common.NewGenericCataloger(nil, globParsers, "go-mod-file-cataloger")
 }
@@ -0,0 +1,63 @@
+package golang
+
+import (
+	"bufio"
+	"io"
+	"strings"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+const (
+	packageIdentifier = "dep"
+	replaceIdentifier = "=>"
+)
+
+func parseGoBin(path string, reader io.ReadCloser) ([]pkg.Package, error) {
+	// Identify if bin was compiled by go
+	x, err := openExe(reader)
+	if err != nil {
+		return nil, err
+	}
+
+	_, mod := findVers(x)
+
+	pkgs := buildGoPkgInfo(path, mod)
+
+	return pkgs, nil
+}
+
+func buildGoPkgInfo(path, mod string) []pkg.Package {
+	pkgsSlice := make([]pkg.Package, 0)
+	scanner := bufio.NewScanner(strings.NewReader(mod))
+
+	// filter mod dependencies: [dep, name, version, sha]
+	for scanner.Scan() {
+		fields := strings.Fields(scanner.Text())
+		// must have dep, name, version
+		if len(fields) < 3 {
+			continue
+		}
+		switch fields[0] {
+		case packageIdentifier:
+			pkgsSlice = append(pkgsSlice, pkg.Package{
+				Name:     fields[1],
+				Version:  fields[2],
+				Language: pkg.Go,
+				Type:     pkg.GoModulePkg,
+				Locations: []source.Location{
+					{
+						RealPath: path,
+					},
+				},
+			})
+		case replaceIdentifier:
+			pkg := &pkgsSlice[len(pkgsSlice)-1]
+			pkg.Name = fields[1]
+			pkg.Version = fields[2]
+		}
+	}
+
+	return pkgsSlice
+}
@@ -0,0 +1,95 @@
+package golang
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestBuildGoPkgInfo(t *testing.T) {
+	tests := []struct {
+		name     string
+		mod      string
+		expected []pkg.Package
+	}{
+		{
+			name:     "buildGoPkgInfo parses a blank mod string and returns no packages",
+			mod:      "",
+			expected: make([]pkg.Package, 0),
+		},
+		{
+			name: "buildGoPkgInfo parses a populated mod string and returns packages but no source info",
+			mod: `path    github.com/anchore/syft mod     github.com/anchore/syft (devel)
+				  dep     github.com/adrg/xdg     v0.2.1  h1:VSVdnH7cQ7V+B33qSJHTCRlNgra1607Q8PzEmnvb2Ic=
+				  dep     github.com/anchore/client-go    v0.0.0-20210222170800-9c70f9b80bcf      h1:DYssiUV1pBmKqzKsm4mqXx8artqC0Q8HgZsVI3lMsAg=`,
+			expected: []pkg.Package{
+				{
+					Name:     "github.com/adrg/xdg",
+					Version:  "v0.2.1",
+					Language: pkg.Go,
+					Type:     pkg.GoModulePkg,
+					Locations: []source.Location{
+						{},
+					},
+				},
+				{
+					Name:     "github.com/anchore/client-go",
+					Version:  "v0.0.0-20210222170800-9c70f9b80bcf",
+					Language: pkg.Go,
+					Type:     pkg.GoModulePkg,
+					Locations: []source.Location{
+						{},
+					},
+				},
+			},
+		},
+		{
+			name: "buildGoPkgInfo parses a populated mod string and returns packages when a replace directive exists",
+			mod: `path    github.com/anchore/test
+			      mod     github.com/anchore/test (devel)
+				  dep     golang.org/x/net        v0.0.0-20211006190231-62292e806868      h1:KlOXYy8wQWTUJYFgkUI40Lzr06ofg5IRXUK5C7qZt1k=
+				  dep     golang.org/x/sys        v0.0.0-20211006194710-c8a6f5223071      h1:PjhxBct4MZii8FFR8+oeS7QOvxKOTZXgk63EU2XpfJE=
+				  dep     golang.org/x/term       v0.0.0-20210927222741-03fcf44c2211
+				  =>      golang.org/x/term       v0.0.0-20210916214954-140adaaadfaf      h1:Ihq/mm/suC88gF8WFcVwk+OV6Tq+wyA1O0E5UEvDglI=`,
+			expected: []pkg.Package{
+				{
+					Name:     "golang.org/x/net",
+					Version:  "v0.0.0-20211006190231-62292e806868",
+					Language: pkg.Go,
+					Type:     pkg.GoModulePkg,
+					Locations: []source.Location{
+						{},
+					},
+				},
+				{
+					Name:     "golang.org/x/sys",
+					Version:  "v0.0.0-20211006194710-c8a6f5223071",
+					Language: pkg.Go,
+					Type:     pkg.GoModulePkg,
+					Locations: []source.Location{
+						{},
+					},
+				},
+				{
+					Name:     "golang.org/x/term",
+					Version:  "v0.0.0-20210916214954-140adaaadfaf",
+					Language: pkg.Go,
+					Type:     pkg.GoModulePkg,
+					Locations: []source.Location{
+						{},
+					},
+				},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			pkgs := buildGoPkgInfo("", tt.mod)
+			assert.Equal(t, tt.expected, pkgs)
+		})
+	}
+}
@@ -0,0 +1,226 @@
+// This code was copied from the Go std library.
+// https://github.com/golang/go/blob/master/src/cmd/go/internal/version/version.go
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package version implements the ``go version'' command.
+package golang
+
+import (
+	"bytes"
+	"encoding/binary"
+	// "cmd/go/internal/base"
+)
+
+/*
+var CmdVersion = &base.Command{
+	UsageLine: "go version [-m] [-v] [file ...]",
+	Short:     "print Go version",
+	Long: `Version prints the build information for Go executables.
+
+Go version reports the Go version used to build each of the named
+executable files.
+
+If no files are named on the command line, go version prints its own
+version information.
+
+If a directory is named, go version walks that directory, recursively,
+looking for recognized Go binaries and reporting their versions.
+By default, go version does not report unrecognized files found
+during a directory scan. The -v flag causes it to report unrecognized files.
+
+The -m flag causes go version to print each executable's embedded
+module version information, when available. In the output, the module
+information consists of multiple lines following the version line, each
+indented by a leading tab character.
+
+See also: go doc runtime/debug.BuildInfo.
+`,
+}
+
+func init() {
+	CmdVersion.Run = runVersion // break init cycle
+}
+
+var (
+	versionM = CmdVersion.Flag.Bool("m", false, "")
+	versionV = CmdVersion.Flag.Bool("v", false, "")
+)
+
+func runVersion(ctx context.Context, cmd *base.Command, args []string) {
+	if len(args) == 0 {
+		// If any of this command's flags were passed explicitly, error
+		// out, because they only make sense with arguments.
+		//
+		// Don't error if the flags came from GOFLAGS, since that can be
+		// a reasonable use case. For example, imagine GOFLAGS=-v to
+		// turn "verbose mode" on for all Go commands, which should not
+		// break "go version".
+		var argOnlyFlag string
+		if !base.InGOFLAGS("-m") && *versionM {
+			argOnlyFlag = "-m"
+		} else if !base.InGOFLAGS("-v") && *versionV {
+			argOnlyFlag = "-v"
+		}
+		if argOnlyFlag != "" {
+			fmt.Fprintf(os.Stderr, "go: 'go version' only accepts %s flag with arguments\n", argOnlyFlag)
+			base.SetExitStatus(2)
+			return
+		}
+		fmt.Printf("go version %s %s/%s\n", runtime.Version(), runtime.GOOS, runtime.GOARCH)
+		return
+	}
+
+	for _, arg := range args {
+		info, err := os.Stat(arg)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "%v\n", err)
+			base.SetExitStatus(1)
+			continue
+		}
+		if info.IsDir() {
+			scanDir(arg)
+		} else {
+			scanFile(arg, info, true)
+		}
+	}
+}
+
+// scanDir scans a directory for executables to run scanFile on.
+func scanDir(dir string) {
+	filepath.WalkDir(dir, func(path string, d fs.DirEntry, err error) error {
+		if d.Type().IsRegular() || d.Type()&fs.ModeSymlink != 0 {
+			info, err := d.Info()
+			if err != nil {
+				if *versionV {
+					fmt.Fprintf(os.Stderr, "%s: %v\n", path, err)
+				}
+				return nil
+			}
+			scanFile(path, info, *versionV)
+		}
+		return nil
+	})
+}
+
+// isExe reports whether the file should be considered executable.
+func isExe(file string, info fs.FileInfo) bool {
+	if runtime.GOOS == "windows" {
+		return strings.HasSuffix(strings.ToLower(file), ".exe")
+	}
+	return info.Mode().IsRegular() && info.Mode()&0111 != 0
+}
+
+// scanFile scans file to try to report the Go and module versions.
+// If mustPrint is true, scanFile will report any error reading file.
+// Otherwise (mustPrint is false, because scanFile is being called
+// by scanDir) scanFile prints nothing for non-Go executables.
+func scanFile(file string, info fs.FileInfo, mustPrint bool) {
+	if info.Mode()&fs.ModeSymlink != 0 {
+		// Accept file symlinks only.
+		i, err := os.Stat(file)
+		if err != nil || !i.Mode().IsRegular() {
+			if mustPrint {
+				fmt.Fprintf(os.Stderr, "%s: symlink\n", file)
+			}
+			return
+		}
+		info = i
+	}
+
+	if !isExe(file, info) {
+		if mustPrint {
+			fmt.Fprintf(os.Stderr, "%s: not executable file\n", file)
+		}
+		return
+	}
+
+	x, err := openExe(file)
+	if err != nil {
+		if mustPrint {
+			fmt.Fprintf(os.Stderr, "%s: %v\n", file, err)
+		}
+		return
+	}
+	defer x.Close()
+
+	vers, mod := findVers(x)
+	if vers == "" {
+		if mustPrint {
+			fmt.Fprintf(os.Stderr, "%s: go version not found\n", file)
+		}
+		return
+	}
+
+	fmt.Printf("%s: %s\n", file, vers)
+	if *versionM && mod != "" {
+		fmt.Printf("\t%s\n", strings.ReplaceAll(mod[:len(mod)-1], "\n", "\n\t"))
+	}
+}
+*/
+
+// The build info blob left by the linker is identified by
+// a 16-byte header, consisting of buildInfoMagic (14 bytes),
+// the binary's pointer size (1 byte),
+// and whether the binary is big endian (1 byte).
+var buildInfoMagic = []byte("\xff Go buildinf:")
+
+// findVers finds and returns the Go version and module version information
+// in the executable x.
+func findVers(x exe) (vers, mod string) {
+	// Read the first 64kB of text to find the build info blob.
+	text := x.DataStart()
+	data, err := x.ReadData(text, 64*1024)
+	if err != nil {
+		return
+	}
+	for ; !bytes.HasPrefix(data, buildInfoMagic); data = data[32:] {
+		if len(data) < 32 {
+			return
+		}
+	}
+
+	// Decode the blob.
+	ptrSize := int(data[14])
+	bigEndian := data[15] != 0
+	var bo binary.ByteOrder
+	if bigEndian {
+		bo = binary.BigEndian
+	} else {
+		bo = binary.LittleEndian
+	}
+	var readPtr func([]byte) uint64
+	if ptrSize == 4 {
+		readPtr = func(b []byte) uint64 { return uint64(bo.Uint32(b)) }
+	} else {
+		readPtr = bo.Uint64
+	}
+	vers = readString(x, ptrSize, readPtr, readPtr(data[16:]))
+	if vers == "" {
+		return
+	}
+	mod = readString(x, ptrSize, readPtr, readPtr(data[16+ptrSize:]))
+	if len(mod) >= 33 && mod[len(mod)-17] == '\n' {
+		// Strip module framing.
+		mod = mod[16 : len(mod)-16]
+	} else {
+		mod = ""
+	}
+	return vers, mod
+}
+
+// readString returns the string at address addr in the executable x.
+func readString(x exe, ptrSize int, readPtr func([]byte) uint64, addr uint64) string {
+	hdr, err := x.ReadData(addr, uint64(2*ptrSize))
+	if err != nil || len(hdr) < 2*ptrSize {
+		return ""
+	}
+	dataAddr := readPtr(hdr)
+	dataLen := readPtr(hdr[ptrSize:])
+	data, err := x.ReadData(dataAddr, dataLen)
+	if err != nil || uint64(len(data)) < dataLen {
+		return ""
+	}
+	return string(data)
+}
@@ -6,6 +6,7 @@ import (
 	"strings"

 	"github.com/anchore/syft/internal/log"
+
 	"github.com/anchore/syft/syft/pkg"
 )

@@ -6,8 +6,9 @@ import (
 	"path"
 	"strings"

-	"github.com/anchore/syft/internal/file"
 	"github.com/anchore/syft/internal/log"
+
+	"github.com/anchore/syft/internal/file"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/common"
 )
@@ -80,7 +81,7 @@ func newJavaArchiveParser(virtualPath string, reader io.Reader, detectNested boo

 // parse the loaded archive and return all packages found.
 func (j *archiveParser) parse() ([]pkg.Package, error) {
-	pkgs := make([]pkg.Package, 0)
+	var pkgs = make([]pkg.Package, 0)

 	// find the parent package from the java manifest
 	parentPkg, err := j.discoverMainPackage()
@@ -189,7 +190,7 @@ func (j *archiveParser) discoverPkgsFromAllMavenFiles(parentPkg *pkg.Package) ([
 // discoverPkgsFromNestedArchives finds Java archives within Java archives, returning all listed Java packages found and
 // associating each discovered package to the given parent package.
 func (j *archiveParser) discoverPkgsFromNestedArchives(parentPkg *pkg.Package) ([]pkg.Package, error) {
-	pkgs := make([]pkg.Package, 0)
+	var pkgs = make([]pkg.Package, 0)

 	// search and parse pom.properties files & fetch the contents
 	openers, err := file.ExtractFromZipToUniqueTempFile(j.archivePath, j.contentPath, j.fileManifest.GlobMatch(archiveFormatGlobs...)...)
@@ -325,10 +326,7 @@ func packageIdentitiesMatch(p pkg.Package, parentPkg *pkg.Package) bool {
 		return true
 	}

-	metadata, ok := p.Metadata.(pkg.JavaMetadata)
-	if !ok {
-		log.Warnf("unable to get java metadata while determining package identities")
-	}
+	metadata := p.Metadata.(pkg.JavaMetadata)

 	// the virtual path matches...
 	if parentPkg.Metadata.(pkg.JavaMetadata).VirtualPath == metadata.VirtualPath {
@@ -8,6 +8,7 @@ import (
 	"strings"

 	"github.com/anchore/syft/internal/log"
+
 	"github.com/anchore/syft/syft/pkg"
 )

@@ -26,7 +26,7 @@ func saveArchiveToTmp(reader io.Reader) (string, string, func(), error) {
 	archivePath := filepath.Join(tempDir, "archive")
 	contentDir := filepath.Join(tempDir, "contents")

-	err = os.Mkdir(contentDir, 0o755)
+	err = os.Mkdir(contentDir, 0755)
 	if err != nil {
 		return contentDir, "", cleanupFn, fmt.Errorf("unable to create processing tempdir: %w", err)
 	}
@@ -7,11 +7,14 @@ import (
 	"io"
 	"regexp"

-	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/log"
+
+	"github.com/anchore/syft/internal"
+
+	"github.com/mitchellh/mapstructure"
+
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/common"
-	"github.com/mitchellh/mapstructure"
 )

 // integrity check
@@ -165,7 +168,7 @@ func parsePackageJSON(_ string, reader io.Reader) ([]pkg.Package, error) {

 	for {
 		var p PackageJSON
-		if err := dec.Decode(&p); errors.Is(err, io.EOF) {
+		if err := dec.Decode(&p); err == io.EOF {
 			break
 		} else if err != nil {
 			return nil, fmt.Errorf("failed to parse package.json file: %w", err)
@@ -2,7 +2,6 @@ package javascript

 import (
 	"encoding/json"
-	"errors"
 	"fmt"
 	"io"

@@ -41,7 +40,7 @@ func parsePackageLock(path string, reader io.Reader) ([]pkg.Package, error) {

 	for {
 		var lock PackageLock
-		if err := dec.Decode(&lock); errors.Is(err, io.EOF) {
+		if err := dec.Decode(&lock); err == io.EOF {
 			break
 		} else if err != nil {
 			return nil, fmt.Errorf("failed to parse package-lock.json file: %w", err)
@@ -20,9 +20,9 @@ func generatePackageURL(p pkg.Package, d *distro.Distro) string {
 		}
 	}

-	purlType := p.Type.PackageURLType()
-	name := p.Name
-	namespace := ""
+	var purlType = p.Type.PackageURLType()
+	var name = p.Name
+	var namespace = ""

 	switch {
 	case purlType == "":
@@ -6,7 +6,9 @@ import (
 	"path/filepath"

 	"github.com/anchore/syft/internal"
+
 	"github.com/anchore/syft/syft/pkg"
+
 	"github.com/anchore/syft/syft/source"
 )

@@ -147,7 +149,7 @@ func (c *PackageCataloger) fetchTopLevelPackages(resolver source.FileResolver, m

 // assembleEggOrWheelMetadata discovers and accumulates python package metadata from multiple file sources and returns a single metadata object as well as a list of files where the metadata was derived from.
 func (c *PackageCataloger) assembleEggOrWheelMetadata(resolver source.FileResolver, metadataLocation source.Location) (*pkg.PythonPackageMetadata, []source.Location, error) {
-	sources := []source.Location{metadataLocation}
+	var sources = []source.Location{metadataLocation}

 	metadataContents, err := resolver.FileContentsByLocation(metadataLocation)
 	if err != nil {
@@ -2,7 +2,6 @@ package python

 import (
 	"encoding/json"
-	"errors"
 	"fmt"
 	"io"
 	"strings"
@@ -44,7 +43,7 @@ func parsePipfileLock(_ string, reader io.Reader) ([]pkg.Package, error) {

 	for {
 		var lock PipfileLock
-		if err := dec.Decode(&lock); errors.Is(err, io.EOF) {
+		if err := dec.Decode(&lock); err == io.EOF {
 			break
 		} else if err != nil {
 			return nil, fmt.Errorf("failed to parse Pipfile.lock file: %w", err)
@@ -16,13 +16,13 @@ var _ common.ParserFn = parsePoetryLock
 func parsePoetryLock(_ string, reader io.Reader) ([]pkg.Package, error) {
 	tree, err := toml.LoadReader(reader)
 	if err != nil {
-		return nil, fmt.Errorf("unable to load poetry.lock for parsing: %w", err)
+		return nil, fmt.Errorf("unable to load poetry.lock for parsing: %v", err)
 	}

 	metadata := PoetryMetadata{}
 	err = tree.Unmarshal(&metadata)
 	if err != nil {
-		return nil, fmt.Errorf("unable to parse poetry.lock: %w", err)
+		return nil, fmt.Errorf("unable to parse poetry.lock: %v", err)
 	}

 	return metadata.Pkgs(), nil
@@ -9,8 +9,10 @@ import (

 	"github.com/anchore/syft/internal/file"
 	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/pkg"
+
 	"github.com/mitchellh/mapstructure"
+
+	"github.com/anchore/syft/syft/pkg"
 )

 // parseWheelOrEggMetadata takes a Python Egg or Wheel (which share the same format and values for our purposes),
@@ -2,7 +2,6 @@ package python

 import (
 	"encoding/csv"
-	"errors"
 	"fmt"
 	"io"
 	"strings"
@@ -18,7 +17,7 @@ func parseWheelOrEggRecord(reader io.Reader) ([]pkg.PythonFileRecord, error) {

 	for {
 		recordList, err := r.Read()
-		if errors.Is(err, io.EOF) {
+		if err == io.EOF {
 			break
 		}
 		if err != nil {
@@ -7,6 +7,7 @@ import (
 	"fmt"

 	"github.com/anchore/syft/internal"
+
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
 )
@@ -6,10 +6,11 @@ import (
 	"io/ioutil"
 	"os"

+	"github.com/anchore/syft/syft/file"
+
 	rpmdb "github.com/anchore/go-rpmdb/pkg"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
 )
@@ -89,7 +90,7 @@ func toELVersion(metadata pkg.RpmdbMetadata) string {
 }

 func extractRpmdbFileRecords(resolver source.FilePathResolver, entry *rpmdb.PackageInfo) []pkg.RpmdbFileRecord {
-	records := make([]pkg.RpmdbFileRecord, 0)
+	var records = make([]pkg.RpmdbFileRecord, 0)

 	for _, record := range entry.Files {
 		// only persist RPMDB file records which exist in the image/directory, otherwise ignore them
@@ -51,8 +51,8 @@ func (r *rpmdbTestFileResolverMock) RelativeFileByPath(source.Location, string)
 	return nil
 }

-func (r rpmdbTestFileResolverMock) FilesByMIMEType(types ...string) ([]source.Location, error) {
-	panic("implement me")
+func (r *rpmdbTestFileResolverMock) FilesByMIMEType(...string) ([]source.Location, error) {
+	return nil, fmt.Errorf("not implemented")
 }

 func TestParseRpmDB(t *testing.T) {
@@ -9,9 +9,11 @@ import (
 	"strings"

 	"github.com/anchore/syft/internal"
+
+	"github.com/mitchellh/mapstructure"
+
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/common"
-	"github.com/mitchellh/mapstructure"
 )

 // integrity check
@@ -60,7 +62,7 @@ func processList(s string) []string {

 func parseGemSpecEntries(_ string, reader io.Reader) ([]pkg.Package, error) {
 	var pkgs []pkg.Package
-	fields := make(map[string]interface{})
+	var fields = make(map[string]interface{})
 	scanner := bufio.NewScanner(reader)

 	for scanner.Scan() {
@@ -16,13 +16,13 @@ var _ common.ParserFn = parseCargoLock
 func parseCargoLock(_ string, reader io.Reader) ([]pkg.Package, error) {
 	tree, err := toml.LoadReader(reader)
 	if err != nil {
-		return nil, fmt.Errorf("unable to load Cargo.lock for parsing: %w", err)
+		return nil, fmt.Errorf("unable to load Cargo.lock for parsing: %v", err)
 	}

 	metadata := CargoMetadata{}
 	err = tree.Unmarshal(&metadata)
 	if err != nil {
-		return nil, fmt.Errorf("unable to parse Cargo.lock: %w", err)
+		return nil, fmt.Errorf("unable to parse Cargo.lock: %v", err)
 	}

 	return metadata.Pkgs(), nil
@@ -3,9 +3,10 @@ package pkg
 import (
 	"sort"

+	"github.com/anchore/syft/syft/file"
+
 	"github.com/anchore/packageurl-go"
 	"github.com/anchore/syft/syft/distro"
-	"github.com/anchore/syft/syft/file"
 	"github.com/scylladb/go-set/strset"
 )

@@ -21,7 +21,7 @@ type ownershipByFilesMetadata struct {
 }

 func ownershipByFilesRelationships(catalog *Catalog) []Relationship {
-	relationships := findOwnershipByFilesRelationships(catalog)
+	var relationships = findOwnershipByFilesRelationships(catalog)

 	var edges []Relationship
 	for parent, children := range relationships {
@@ -43,7 +43,7 @@ func ownershipByFilesRelationships(catalog *Catalog) []Relationship {
 // findOwnershipByFilesRelationships find overlaps in file ownership with a file that defines another package. Specifically, a .Location.Path of
 // a package is found to be owned by another (from the owner's .Metadata.Files[]).
 func findOwnershipByFilesRelationships(catalog *Catalog) map[ID]map[ID]*strset.Set {
-	relationships := make(map[ID]map[ID]*strset.Set)
+	var relationships = make(map[ID]map[ID]*strset.Set)

 	if catalog == nil {
 		return relationships
@@ -5,10 +5,12 @@ import (
 	"sort"
 	"strconv"

+	"github.com/anchore/syft/syft/file"
+
+	"github.com/scylladb/go-set/strset"
+
 	"github.com/anchore/packageurl-go"
 	"github.com/anchore/syft/syft/distro"
-	"github.com/anchore/syft/syft/file"
-	"github.com/scylladb/go-set/strset"
 )

 const RpmDBGlob = "**/var/lib/rpm/Packages"
@@ -25,7 +25,7 @@ func newAllLayersResolver(img *image.Image) (*allLayersResolver, error) {
 		return nil, fmt.Errorf("the image does not contain any layers")
 	}

-	layers := make([]int, 0)
+	var layers = make([]int, 0)
 	for idx := range img.Layers {
 		layers = append(layers, idx)
 	}
@@ -120,7 +120,6 @@ func (r *allLayersResolver) FilesByPath(paths ...string) ([]Location, error) {
 }

 // FilesByGlob returns all file.References that match the given path glob pattern from any layer in the image.
-
 func (r *allLayersResolver) FilesByGlob(patterns ...string) ([]Location, error) {
 	uniqueFileIDs := file.NewFileReferenceSet()
 	uniqueLocations := make([]Location, 0)
@@ -163,6 +163,7 @@ func (r directoryResolver) addPathToIndex(p string, info os.FileInfo) (string, e
 	if ref != nil {
 		r.refsByMIMEType[metadata.MIMEType] = append(r.refsByMIMEType[metadata.MIMEType], *ref)
 	}
+
 	r.metadata[ref.ID()] = metadata
 	return newRoot, nil
 }
@@ -204,7 +205,7 @@ func (r directoryResolver) String() string {

 // FilesByPath returns all file.References that match the given paths from the directory.
 func (r directoryResolver) FilesByPath(userPaths ...string) ([]Location, error) {
-	references := make([]Location, 0)
+	var references = make([]Location, 0)

 	for _, userPath := range userPaths {
 		userStrPath, err := r.requestPath(userPath)
@@ -4,9 +4,11 @@ import (
 	"os"
 	"syscall"

-	"github.com/anchore/stereoscope/pkg/file"
-	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/syft/internal/log"
+
+	"github.com/anchore/stereoscope/pkg/file"
+
+	"github.com/anchore/stereoscope/pkg/image"
 )

 type FileMetadata struct {
@@ -29,7 +29,7 @@ type FilePathResolver interface {
 	FilesByPath(paths ...string) ([]Location, error)
 	// FilesByGlob fetches a set of file references which the given glob matches
 	FilesByGlob(patterns ...string) ([]Location, error)
-	// FilesByGlob fetches a set of file references which the contents have been classified as one of the given MIME Types
+	// FilesByMIMEType fetches a set of file references which the contents have been classified as one of the given MIME Types
 	FilesByMIMEType(types ...string) ([]Location, error)
 	// RelativeFileByPath fetches a single file at the given path relative to the layer squash of the given reference.
 	// This is helpful when attempting to find a file that is in the same layer or lower as another file.
@@ -3,9 +3,10 @@ package source
 import (
 	"fmt"

+	"github.com/anchore/syft/internal/log"
+
 	"github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/stereoscope/pkg/image"
-	"github.com/anchore/syft/internal/log"
 )

 // Location represents a path relative to a particular filesystem resolved to a specific file.Reference. This struct is used as a key
@@ -35,7 +35,7 @@ func NewMockResolverForPaths(paths ...string) *MockResolver {

 func NewMockResolverForPathsWithMetadata(metadata map[Location]FileMetadata) *MockResolver {
 	var locations []Location
-	mimeTypeIndex := make(map[string][]Location)
+	var mimeTypeIndex = make(map[string][]Location)
 	for l, m := range metadata {
 		locations = append(locations, l)
 		mimeTypeIndex[m.MIMEType] = append(mimeTypeIndex[m.MIMEType], l)
@@ -46,7 +46,6 @@ func detectScheme(fs afero.Fs, imageDetector sourceDetector, userInput string) (

 		fileMeta, err := fs.Stat(dirLocation)
 		if err != nil {
-			// nolint: nilerr
 			return UnknownScheme, source, "", nil
 		}

@@ -131,6 +131,24 @@ var dirOnlyTestCases = []testCase{
 			"someotherpkg": "3.19.0",
 		},
 	},
+	{
+		name:        "find golang modules",
+		pkgType:     pkg.GoModulePkg,
+		pkgLanguage: pkg.Go,
+		pkgInfo: map[string]string{
+			"github.com/bmatcuk/doublestar": "v1.3.1",
+		},
+	},
+	{
+		name:        "find rust crates",
+		pkgType:     pkg.RustPkg,
+		pkgLanguage: pkg.Rust,
+		pkgInfo: map[string]string{
+			"memchr":        "2.3.3",
+			"nom":           "4.2.3",
+			"version_check": "0.1.5",
+		},
+	},
 }

 var commonTestCases = []testCase{
@@ -177,22 +195,4 @@ var commonTestCases = []testCase{
 			"libc-utils": "0.7.2-r0",
 		},
 	},
-	{
-		name:        "find golang modules",
-		pkgType:     pkg.GoModulePkg,
-		pkgLanguage: pkg.Go,
-		pkgInfo: map[string]string{
-			"github.com/bmatcuk/doublestar": "v1.3.1",
-		},
-	},
-	{
-		name:        "find rust crates",
-		pkgType:     pkg.RustPkg,
-		pkgLanguage: pkg.Rust,
-		pkgInfo: map[string]string{
-			"memchr":        "2.3.3",
-			"nom":           "4.2.3",
-			"version_check": "0.1.5",
-		},
-	},
 }
@@ -5,12 +5,11 @@ import (

 	"github.com/anchore/syft/syft/distro"
 	"github.com/anchore/syft/syft/pkg/cataloger"
+	"github.com/google/go-cmp/cmp"

 	"github.com/anchore/stereoscope/pkg/imagetest"
 	"github.com/anchore/syft/syft/source"

-	"github.com/go-test/deep"
-
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/syft/pkg"
 )
@@ -58,12 +57,20 @@ func TestPkgCoverageImage(t *testing.T) {
 		definedLanguages.Add(l.String())
 	}

+	// for image we remove the go mod and rust support by default
+	definedLanguages.Remove(pkg.Go.String())
+	definedLanguages.Remove(pkg.Rust.String())
+
 	observedPkgs := internal.NewStringSet()
 	definedPkgs := internal.NewStringSet()
 	for _, p := range pkg.AllPkgs {
 		definedPkgs.Add(string(p))
 	}
+
+	// for image we remove the go-module and rust-crate support by default
 	definedPkgs.Remove(string(pkg.KbPkg))
+	definedPkgs.Remove(string(pkg.GoModulePkg))
+	definedPkgs.Remove(string(pkg.RustPkg))

 	var cases []testCase
 	cases = append(cases, commonTestCases...)
@@ -75,9 +82,11 @@ func TestPkgCoverageImage(t *testing.T) {

 			for a := range catalog.Enumerate(c.pkgType) {

-				observedLanguages.Add(a.Language.String())
-				observedPkgs.Add(string(a.Type))
+				if a.Language.String() != "" {
+					observedLanguages.Add(a.Language.String())
+				}

+				observedPkgs.Add(string(a.Type))
 				expectedVersion, ok := c.pkgInfo[a.Name]
 				if !ok {
 					t.Errorf("unexpected package found: %s", a.Name)
@@ -114,18 +123,14 @@ func TestPkgCoverageImage(t *testing.T) {
 	definedPkgs.Remove(string(pkg.UnknownPkg))

 	// ensure that integration test cases stay in sync with the available catalogers
-	if len(observedLanguages) < len(definedLanguages) {
+	if diff := cmp.Diff(definedLanguages, observedLanguages); diff != "" {
 		t.Errorf("language coverage incomplete (languages=%d, coverage=%d)", len(definedLanguages), len(observedLanguages))
-		for _, d := range deep.Equal(observedLanguages, definedLanguages) {
-			t.Errorf("diff: %+v", d)
-		}
+		t.Errorf("definedLanguages mismatch observedLanguages (-want +got):\n%s", diff)
 	}

-	if len(observedPkgs) < len(definedPkgs) {
+	if diff := cmp.Diff(definedPkgs, observedPkgs); diff != "" {
 		t.Errorf("package coverage incomplete (packages=%d, coverage=%d)", len(definedPkgs), len(observedPkgs))
-		for _, d := range deep.Equal(observedPkgs, definedPkgs) {
-			t.Errorf("diff: %+v", d)
-		}
+		t.Errorf("definedPkgs mismatch observedPkgs (-want +got):\n%s", diff)
 	}
 }

@@ -0,0 +1,48 @@
+package integration
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func TestRegressionGoArchDiscovery(t *testing.T) {
+	const (
+		expectedELFPkg   = 3
+		expectedWINPkg   = 3
+		expectedMACOSPkg = 3
+	)
+	// This is a regression test to make sure the way we detect go binary packages
+	// stays consistent and reproducible as the tool chain evolves
+	catalog, _, _ := catalogFixtureImage(t, "image-go-bin-arch-coverage")
+
+	var actualELF, actualWIN, actualMACOS int
+
+	for p := range catalog.Enumerate(pkg.GoModulePkg) {
+		for _, l := range p.Locations {
+			switch {
+			case strings.Contains(l.RealPath, "elf"):
+				actualELF++
+			case strings.Contains(l.RealPath, "win"):
+				actualWIN++
+			case strings.Contains(l.RealPath, "macos"):
+				actualMACOS++
+			default:
+
+			}
+		}
+	}
+
+	if actualELF != expectedELFPkg {
+		t.Errorf("unexpected number of elf packages: %d != %d", expectedELFPkg, actualELF)
+	}
+
+	if actualWIN != expectedWINPkg {
+		t.Errorf("unexpected number of win packages: %d != %d", expectedWINPkg, actualWIN)
+	}
+
+	if actualMACOS != expectedMACOSPkg {
+		t.Errorf("unexpected number of macos packages: %d != %d", expectedMACOSPkg, actualMACOS)
+	}
+}
@@ -0,0 +1,16 @@
+FROM golang:latest as builder
+WORKDIR /app
+COPY go.sum go.mod app.go ./
+
+RUN GOOS=linux go build -o elf .
+RUN GOOS=windows go build -o win .
+RUN GOOS=darwin go build -o macos .
+
+FROM scratch
+
+WORKDIR /tmp
+COPY --from=builder /app/elf /
+COPY --from=builder /app/win /
+COPY --from=builder /app/macos /
+
+ENTRYPOINT ["/elf"]
@@ -0,0 +1,18 @@
+//build:ignore
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"golang.org/x/net/html"
+	"golang.org/x/term"
+)
+
+var test = html.ErrBufferExceeded
+
+func main() {
+	t := term.NewTerminal(os.Stdout, "foo")
+	t.Write([]byte("hello anchore"))
+	t.Write([]byte(fmt.Sprintf("%v", test)))
+}
@@ -0,0 +1,14 @@
+module github.com/anchore/test
+
+go 1.17
+
+require (
+	golang.org/x/net v0.0.0-20211006190231-62292e806868
+	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211
+)
+
+require golang.org/x/sys v0.0.0-20211006194710-c8a6f5223071 // indirect
+
+exclude golang.org/x/net v0.0.0-20211005215030-d2e5035098b3
+
+replace golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 => golang.org/x/term v0.0.0-20210916214954-140adaaadfaf
@@ -0,0 +1,12 @@
+golang.org/x/net v0.0.0-20211006190231-62292e806868 h1:KlOXYy8wQWTUJYFgkUI40Lzr06ofg5IRXUK5C7qZt1k=
+golang.org/x/net v0.0.0-20211006190231-62292e806868/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211006194710-c8a6f5223071 h1:PjhxBct4MZii8FFR8+oeS7QOvxKOTZXgk63EU2XpfJE=
+golang.org/x/sys v0.0.0-20211006194710-c8a6f5223071/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210916214954-140adaaadfaf h1:Ihq/mm/suC88gF8WFcVwk+OV6Tq+wyA1O0E5UEvDglI=
+golang.org/x/term v0.0.0-20210916214954-140adaaadfaf/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -1,5 +1,8 @@
 FROM alpine@sha256:d9a7354e3845ea8466bb00b22224d9116b183e594527fb5b6c3d30bc01a20378
+
+# we keep these unpinned so that if alpine
+# changes our integration tests can adapt
 RUN apk add --no-cache \
-            tzdata=2021a-r0 \
-            vim=8.2.2320-r0 \
-            alpine-sdk=1.0-r0
+            tzdata \
+            vim \
+            alpine-sdk
@@ -21,13 +21,11 @@ import (
 	"github.com/wagoodman/jotframe/pkg/frame"
 )

-const (
-	maxBarWidth     = 50
-	statusSet       = components.SpinnerDotSet
-	completedStatus = "✔"
-	tileFormat      = color.Bold
-	interval        = 150 * time.Millisecond
-)
+const maxBarWidth = 50
+const statusSet = components.SpinnerDotSet
+const completedStatus = "✔"
+const tileFormat = color.Bold
+const interval = 150 * time.Millisecond

 // StatusTitleColumn is the column index in a given row where status text will be displayed.
 const StatusTitleColumn = 31
@@ -186,7 +184,6 @@ func PullDockerImageHandler(ctx context.Context, fr *frame.Frame, event partybus
 }

 // FetchImageHandler periodically writes a the image save and write-to-disk process in the form of a progress bar.
-
 func FetchImageHandler(ctx context.Context, fr *frame.Frame, event partybus.Event, wg *sync.WaitGroup) error {
 	_, prog, err := stereoEventParsers.ParseFetchImage(event)
 	if err != nil {
@@ -315,7 +312,6 @@ func PackageCatalogerStartedHandler(ctx context.Context, fr *frame.Frame, event
 }

 // SecretsCatalogerStartedHandler shows the intermittent secrets searching progress.
-
 func SecretsCatalogerStartedHandler(ctx context.Context, fr *frame.Frame, event partybus.Event, wg *sync.WaitGroup) error {
 	prog, err := syftEventParsers.ParseSecretsCatalogingStarted(event)
 	if err != nil {
@@ -403,7 +399,6 @@ func FileMetadataCatalogerStartedHandler(ctx context.Context, fr *frame.Frame, e
 }

 // FileIndexingStartedHandler shows the intermittent indexing progress from a directory resolver.
-
 func FileIndexingStartedHandler(ctx context.Context, fr *frame.Frame, event partybus.Event, wg *sync.WaitGroup) error {
 	path, prog, err := syftEventParsers.ParseFileIndexingStarted(event)
 	if err != nil {
@@ -489,7 +484,6 @@ func FileDigestsCatalogerStartedHandler(ctx context.Context, fr *frame.Frame, ev
 }

 // ImportStartedHandler shows the intermittent upload progress to Anchore Enterprise.
-
 func ImportStartedHandler(ctx context.Context, fr *frame.Frame, event partybus.Event, wg *sync.WaitGroup) error {
 	host, prog, err := syftEventParsers.ParseImportStarted(event)
 	if err != nil {
@@ -16,7 +16,8 @@ import (
 )

 // Handler is an aggregated event handler for the set of supported events (PullDockerImage, ReadImage, FetchImage, PackageCatalogerStarted)
-type Handler struct{}
+type Handler struct {
+}

 // NewHandler returns an empty Handler
 func NewHandler() *Handler {
Author	SHA1	Message	Date
Christopher Angelo Phillips	b25f5b664b	(464) - remove mod and cargo from image cataloger (#539 ) * remove mod and cargo from image cataloger Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com> * update test error messages for clear failures Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>	2021-10-07 15:18:20 -04:00
Christopher Angelo PhillipsandAlex Goodman	3462e18af3	478 identify go binaries and extract mod information (#534 ) * add query by MIME type to source.FileResolver Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * import stereoscope lib changes to find mime type - add bin cataloger - add bin parser - add mime type go utils - import new resolver Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com> * add go std library code to unpack bin - keep them in their own (original) files - add note for "this code was copied from" - comment the lines the required changing Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>	2021-10-07 12:16:38 -04:00
Alex Goodman	05ac3f1eff	split application configuration parsing to multiple methods (#532 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2021-10-06 09:48:53 -04:00
Alex Goodman	a000a2926b	update linter + fix whitespace (#536 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2021-10-06 13:46:55 +00:00