working

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

.bouncer.yaml

@@ -3,4 +3,7 @@ permit:
   - MIT.*
   - Apache.*
   - MPL.*
-  - ISC
+  - ISC
+ignore-packages:
+  # packageurl-go is released under the MIT license located in the root of the repo at /mit.LICENSE
+  - github.com/package-url/packageurl-go

.circleci/config.yml

@@ -15,7 +15,6 @@ jobs:
     # 2CPU / 4GB RAM
     resource_class: medium
     steps:
-
       - checkout
 
       - restore_cache:
@@ -48,7 +47,6 @@ jobs:
     # 2CPU / 4GB RAM
     resource_class: medium
     steps:
-
       - checkout
 
       - restore_cache:
@@ -69,15 +67,15 @@ jobs:
       - run:
           name: enable docker client
           command: |
-              # all of this to enable "circleci local execute ..." cli commands for /var/run/docker.sock
-              mkdir -p ${HOME}/.local/bin
-              cat \<< EOF > ${HOME}/.local/bin/docker
-              #!/bin/bash
-              set -xue
-              sudo -E ${HOME}/.local/bin/docker.bin \$@
-              EOF
-              sudo mv /usr/bin/docker ${HOME}/.local/bin/docker.bin
-              chmod 755 ${HOME}/.local/bin/docker
+            # all of this to enable "circleci local execute ..." cli commands for /var/run/docker.sock
+            mkdir -p ${HOME}/.local/bin
+            cat \<< EOF > ${HOME}/.local/bin/docker
+            #!/bin/bash
+            set -xue
+            sudo -E ${HOME}/.local/bin/docker.bin \$@
+            EOF
+            sudo mv /usr/bin/docker ${HOME}/.local/bin/docker.bin
+            chmod 755 ${HOME}/.local/bin/docker
 
       - run:
           name: build cache key for java test-fixture blobs
@@ -96,6 +94,10 @@ jobs:
           paths:
             - "syft/cataloger/java/test-fixtures/java-builds/packages"
 
+      - run:
+          name: validate syft output against the CycloneDX schema
+          command: make validate-cyclonedx-schema
+
       - run:
           name: build hash key for integration test-fixtures blobs
           command: make integration-fingerprint
@@ -124,4 +126,4 @@ workflows:
           version: "1.13"
       - run-tests:
           name: "Unit & Integration Tests (go-latest)"
-          version: "latest"
+          version: "latest"

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,20 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: bug
+assignees: ''
+
+---
+
+**What happened**:
+
+**What you expected to happen**:
+
+**How to reproduce it (as minimally and precisely as possible)**:
+
+**Anything else we need to know?**:
+
+**Environment**:
+- syft version (use `syft version -v`):
+- OS (e.g: `cat /etc/os-release` or similar):

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+contact_links:
+
+  - name: Help & Support Slack Channel ⛑️
+    # link to toolbox-help channel
+    url: https://anchorecommunity.slack.com/archives/C019BUXV7R6
+    about: Ask a questions and get answers
+
+  - name: Developer Slack Channel 💬
+    # link to toolbox-dev channel
+    url: https://anchorecommunity.slack.com/archives/C0190NF9TSM
+    about: Participate in design discussions and feature development

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,15 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: enhancement
+assignees: ''
+
+---
+
+**What would you like to be added**:
+
+**Why is this needed**:
+
+**Additional context**:
+<!-- Add any other context or screenshots about the feature request here. -->

.github/scripts/update-version-file.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -ue
+
+BIN="syft"
+DISTDIR=$1
+VERSION=$2
+
+# the source of truth as to whether we want to notify users of an update is if the release just created is NOT
+# flagged as a pre-release on github
+if [[ "$(curl -SsL https://api.github.com/repos/anchore/${BIN}/releases/tags/${VERSION} | jq .prerelease)" == "true" ]] ; then
+   echo "skipping publishing a version file (this is a pre-release: ${VERSION})"
+   exit 0
+fi
+
+echo "creating and publishing version file"
+
+# create a version file for version-update checks
+echo "${VERSION}" | tee ${DISTDIR}/VERSION
+
+# upload the version file that supports the application version update check
+docker run --rm \
+    -i \
+    -e AWS_DEFAULT_REGION=us-west-2 \
+    -e AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} \
+    -e AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} \
+    -v $(pwd)/${DISTDIR}/:/distmount \
+    amazon/aws-cli \
+        s3 cp /distmount/VERSION s3://toolbox-data.anchore.io/${BIN}/releases/latest/VERSION

.github/workflows/acceptance-test.yaml

@@ -1,25 +1,22 @@
 name: 'Acceptance'
 on:
+  workflow_dispatch:
   push:
-    # ... only act on pushes to master
+    # ... only act on pushes to main
     branches:
-      - master
+      - main
     # ... do not act on release tags
     tags-ignore:
       - v*
+
 env:
   GO_VERSION: "1.14.x"
+
 jobs:
   Build-Snapshot-Artifacts:
     runs-on: ubuntu-latest
     steps:
 
-      # TODO: remove me after release
-      - name: Configure git for private modules
-        env:
-          TOKEN: ${{ secrets.ANCHORE_GIT_READ_TOKEN }}
-        run: git config --global url."https://anchore:${TOKEN}@github.com".insteadOf "https://github.com"
-
       - uses: actions/setup-go@v2
         with:
           go-version: ${{ env.GO_VERSION }}
@@ -98,3 +95,29 @@ jobs:
 
       - name: Run Acceptance Tests (Mac)
         run: make acceptance-mac
+
+  # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
+  Inline-Compare:
+    needs: [ Build-Snapshot-Artifacts ]
+    runs-on: ubuntu-latest
+    steps:
+
+      - uses: actions/checkout@v2
+
+      - name: Fingerprint inline-compare sources
+        run: make compare-fingerprint
+
+      - name: Restore inline reports cache
+        id: cache
+        uses: actions/cache@v2
+        with:
+          path: ${{ github.workspace }}/test/inline-compare/inline-reports
+          key: inline-reports-${{ hashFiles('**/inline-compare.fingerprint') }}
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: artifacts
+          path: snapshot
+
+      - name: Compare Anchore inline-scan results against snapshot build output
+        run: make compare-snapshot

.github/workflows/release.yaml

@@ -1,14 +1,16 @@
 name: 'Release'
 on:
   push:
-    # take no actions on push...
+    # take no actions on push to any branch...
     branches-ignore:
       - '**'
     # ... only act on release tags
     tags:
       - 'v*'
+
 env:
   GO_VERSION: "1.14.x"
+
 jobs:
   wait-for-checks:
     runs-on: ubuntu-latest
@@ -16,12 +18,12 @@ jobs:
 
       - uses: actions/checkout@v2
 
-      # we don't want to release commits that have been pushed and tagged, but not necessarily merged onto master
-      - name: Ensure tagged commit is on master
+      # we don't want to release commits that have been pushed and tagged, but not necessarily merged onto main
+      - name: Ensure tagged commit is on main
         run: |
           echo "Tag: ${GITHUB_REF##*/}"
-          git fetch origin master
-          git merge-base --is-ancestor ${GITHUB_REF##*/} origin/master && echo "${GITHUB_REF##*/} is a commit on master!"
+          git fetch origin main
+          git merge-base --is-ancestor ${GITHUB_REF##*/} origin/main && echo "${GITHUB_REF##*/} is a commit on main!"
 
       - name: Check static anaylysis, unit, and integration test results
         uses: fountainhead/action-wait-for-check@v1.0.0
@@ -50,12 +52,22 @@ jobs:
           checkName: "Acceptance-Mac"
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
+      - name: Check inline comparison test results
+        uses: fountainhead/action-wait-for-check@v1.0.0
+        id: inline-compare
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          # This check name is defined as the github action job name (in .github/workflows/acceptance-test.yaml)
+          checkName: "Inline-Compare"
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
       - name: Quality gate
-        if: steps.sa-unit-int.outputs.conclusion != 'success' || steps.acceptance-linux.outputs.conclusion != 'success' || steps.acceptance-mac.outputs.conclusion != 'success'
+        if: steps.sa-unit-int.outputs.conclusion != 'success' || steps.inline-compare.outputs.conclusion != 'success' || steps.acceptance-linux.outputs.conclusion != 'success' || steps.acceptance-mac.outputs.conclusion != 'success'
         run: |
           echo "Static/Unit/Integration Status: ${{ steps.sa-unit-int.outputs.conclusion }}"
           echo "Acceptance Test (Linux) Status: ${{ steps.acceptance-linux.outputs.conclusion }}"
           echo "Acceptance Test (Mac) Status: ${{ steps.acceptance-mac.outputs.conclusion }}"
+          echo "Inline Compare Status: ${{ steps.inline-compare.outputs.conclusion }}"
           false
 
   release:
@@ -63,17 +75,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
 
-      # TODO: remove me after release
-      - name: Configure git for private modules
-        env:
-          TOKEN: ${{ secrets.ANCHORE_GIT_READ_TOKEN }}
-        run: git config --global url."https://anchore:${TOKEN}@github.com".insteadOf "https://github.com"
-
       - uses: actions/setup-go@v2
         with:
           go-version: ${{ env.GO_VERSION }}
 
       - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
 
       - name: Restore bootstrap cache
         id: cache
@@ -108,12 +116,12 @@ jobs:
       - name: Build & publish release artifacts
         run: make release
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.ANCHORE_GIT_READ_TOKEN }}
           GPG_PRIVATE_KEY: ${{ secrets.SIGNING_GPG_PRIVATE_KEY }}
           PASSPHRASE: ${{ secrets.SIGNING_GPG_PASSPHRASE }}
           SIGNING_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
-          TOOLBOX_AWS_ACCESS_KEY_ID: ${{ secrets.TOOLBOX_AWS_ACCESS_KEY_ID }}
-          TOOLBOX_AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLBOX_AWS_SECRET_ACCESS_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.TOOLBOX_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLBOX_AWS_SECRET_ACCESS_KEY }}
 
       - uses: actions/upload-artifact@v2
         with:

.gitignore

@@ -1,7 +1,9 @@
+CHANGELOG.md
 /dist
 /snapshot
 .server/
 .vscode/
+*.fingerprint
 *.tar
 *.jar
 *.war

.golangci.yaml

@@ -1,3 +1,9 @@
+# TODO: enable this when we have coverage on docstring comments
+#issues:
+#  # The list of ids of default excludes to include or disable.
+#  include:
+#    - EXC0002 # disable excluding of issues about comments from golint
+
 linters:
   # inverted configuration with `enable-all` and `disable` is not scalable during updates of golangci-lint
   disable-all: true
@@ -25,7 +31,6 @@ linters:
     - misspell
     - nakedret
     - nolintlint
-    - prealloc
     - rowserrcheck
     - scopelint
     - staticcheck
@@ -49,5 +54,6 @@ linters:
 #    - lll         # without a way to specify per-line exception cases, this is not usable
 #    - maligned    # this is an excellent linter, but tricky to optimize and we are not sensitive to memory layout optimizations
 #    - nestif
+#    - prealloc    # this unnecessarily requires preallocations for slices
 #    - testpackage
 #    - wsl

.goreleaser.yaml

@@ -1,8 +1,10 @@
 release:
-  # If set to auto, will mark the release as not ready for production
-  # in case there is an indicator for this in the tag e.g. v1.0.0-rc1
-  # If set to true, will mark the release as not ready for production.
-  prerelease: auto
+  # If set to auto, will mark the release as not ready for production in case there is an indicator for this in the
+  # tag e.g. v1.0.0-rc1 .If set to true, will mark the release as not ready for production.
+  prerelease: false
+
+  # If set to true, will not auto-publish the release. This is done to allow us to review the changelog before publishing.
+  draft: true
 
 signs:
   - artifacts: checksum
@@ -39,13 +41,12 @@ nfpms:
       - rpm
       - deb
 
-# TODO: add back in when open sourced
-#brews:
-#  - tap:
-#      owner: anchore
-#      name: homebrew-syft
-#    homepage: *website
-#    description: *description
+brews:
+  - tap:
+      owner: anchore
+      name: homebrew-syft
+    homepage: *website
+    description: *description
 
 archives:
   - format: tar.gz

CONTRIBUTING.md

@@ -0,0 +1,103 @@
+# Contributing to `syft`
+
+If you are looking to contribute to this project and want to open a Github pull request ("PR"), there are a few guidelines of what we are looking for in patches. Make sure you go through this document and ensure that your code proposal is aligned.
+
+## Sign your work
+
+The `sign-off` is an added line at the end of the explanation for the commit, certifying that you wrote it or otherwise have the right to submit it as an open-source patch. By submitting a contribution, you agree to be bound by the terms of the DCO Version 1.1 and Apache License Version 2.0.
+
+Signing a commit certifies the below Developer's Certificate of Origin (DCO):
+
+```text
+Developer's Certificate of Origin 1.1
+
+By making a contribution to this project, I certify that:
+
+   (a) The contribution was created in whole or in part by me and I
+       have the right to submit it under the open source license
+       indicated in the file; or
+
+   (b) The contribution is based upon previous work that, to the best
+       of my knowledge, is covered under an appropriate open source
+       license and I have the right under that license to submit that
+       work with modifications, whether created in whole or in part
+       by me, under the same open source license (unless I am
+       permitted to submit under a different license), as indicated
+       in the file; or
+
+   (c) The contribution was provided directly to me by some other
+       person who certified (a), (b) or (c) and I have not modified
+       it.
+
+   (d) I understand and agree that this project and the contribution
+       are public and that a record of the contribution (including all
+       personal information I submit with it, including my sign-off) is
+       maintained indefinitely and may be redistributed consistent with
+       this project or the open source license(s) involved.
+```
+
+All contributions to this project are licensed under the [Apache License Version 2.0, January 2004](http://www.apache.org/licenses/).
+
+When committing your change, you can add the required line manually so that it looks like this:
+
+```text
+Signed-off-by: John Doe <john.doe@example.com>
+```
+
+Alternatively, configure your Git client with your name and email to use the `-s` flag when creating a commit:
+
+```text
+$ git config --global user.name "John Doe"
+$ git config --global user.email "john.doe@example.com"
+```
+
+Creating a signed commit is then possible with `-s`:
+
+```text
+$ git commit -s -m "this is a commit message"
+```
+
+To double check if the commit was signed, look at the log output:
+
+```text
+$ git log -1
+commit 37ceh170e4hb283bb73d958f2036ee5k07e7fde7 (HEAD -> issue-35, origin/main, main)
+Author: John Doe <john.doe@example.com>
+Date:   Mon Aug 1 11:27:13 2020 -0400
+
+    this is a commit message
+
+    Signed-off-by: John Doe <john.doe@example.com>
+```
+
+
+[//]: # (TODO: Commit guidelines, granular commits)
+
+
+[//]: # (TODO: Commit guidelines, descriptive messages)
+
+
+[//]: # (TODO: Commit guidelines, commit title, extra body description)
+
+
+[//]: # (TODO: PR title and description)
+
+
+## Test your changes
+
+This project has a `Makefile` which includes many helpers running both unit and integration tests. Although PRs will have automatic checks for these, it is useful to run them locally, ensuring they pass before submitting changes. Ensure you've bootstrapped once before running tests:
+
+```text
+$ make bootstrap
+```
+
+You only need to bootstrap once. After the bootstrap process, you can run the tests as many times as needed:
+
+```text
+$ make unit
+$ make integration
+```
+
+## Document your changes
+
+When proposed changes are modifying user-facing functionality or output, it is expected the PR will include updates to the documentation as well.

Makefile

@@ -21,6 +21,7 @@ COVERAGE_THRESHOLD := 72
 DISTDIR=./dist
 SNAPSHOTDIR=./snapshot
 GITTREESTATE=$(if $(shell git status --porcelain),dirty,clean)
+SNAPSHOT_CMD=$(shell realpath $(shell pwd)/$(SNAPSHOTDIR)/syft_linux_amd64/syft)
 
 ifeq "$(strip $(VERSION))" ""
  override VERSION = $(shell git describe --always --tags --dirty)
@@ -58,12 +59,8 @@ endef
 all: clean static-analysis test ## Run all linux-based checks (linting, license check, unit, integration, and linux acceptance tests)
 	@printf '$(SUCCESS)All checks pass!$(RESET)\n'
 
-.PHONY: compare
-compare:
-	@cd test/inline-compare && make
-
 .PHONY: test
-test: unit integration acceptance-linux ## Run all tests (currently unit, integration, and linux acceptance tests)
+test: unit validate-cyclonedx-schema integration acceptance-linux ## Run all tests (currently unit, integration, and linux acceptance tests)
 
 .PHONY: help
 help:
@@ -71,11 +68,11 @@ help:
 
 .PHONY: ci-bootstrap
 ci-bootstrap: bootstrap
-	sudo apt install -y bc
+	DEBIAN_FRONTEND=noninteractive sudo apt update && sudo -E apt install -y bc jq libxml2-utils
 
-.PHONY: boostrap
+.PHONY: bootstrap
 bootstrap: ## Download and install all go dependencies (+ prep tooling in the ./tmp dir)
-	$(call title,Boostrapping dependencies)
+	$(call title,Bootstrapping dependencies)
 	@pwd
 	# prep temp dirs
 	mkdir -p $(TEMPDIR)
@@ -114,6 +111,10 @@ lint-fix: ## Auto-format all source code + run golangci lint fixers
 check-licenses:
 	$(TEMPDIR)/bouncer check
 
+.PHONY: validate-cyclonedx-schema
+validate-cyclonedx-schema:
+	cd schema/cyclonedx && make
+
 .PHONY: unit
 unit: fixtures ## Run unit tests (with coverage)
 	$(call title,Running unit tests)
@@ -127,7 +128,8 @@ integration: ## Run integration tests
 	$(call title,Running integration tests)
 	go test -v -tags=integration ./test/integration
 
-test/integration/test-fixtures/tar-cache.key, integration-fingerprint:
+# note: this is used by CI to determine if the integration test fixture cache (docker image tars) should be busted
+integration-fingerprint:
 	find test/integration/test-fixtures/image-* -type f -exec md5sum {} + | awk '{print $1}' | sort | md5sum | tee test/integration/test-fixtures/tar-cache.fingerprint
 
 .PHONY: java-packages-fingerprint
@@ -140,6 +142,19 @@ fixtures:
 	$(call title,Generating test fixtures)
 	cd syft/cataloger/java/test-fixtures/java-builds && make
 
+.PHONY: generate-json-schema
+generate-json-schema: clean-json-schema-examples integration ## Generate a new json schema for the json presenter, derived from integration test cases
+	docker run \
+		-i \
+		--rm \
+		-v $(shell pwd)/schema/json:/work \
+		-w /work \
+		python:3.8 \
+			bash -x -c "\
+				pip install -r requirements.txt && \
+				python generate.py \
+			"
+
 .PHONY: clear-test-cache
 clear-test-cache: ## Delete all test cache (built docker image tars)
 	find . -type f -wholename "**/test-fixtures/tar-cache/*.tar" -delete
@@ -154,6 +169,9 @@ check-pipeline: ## Run local CircleCI pipeline locally (sanity check)
 	circleci local execute -c .tmp/circleci.yml --job "Unit & Integration Tests (go-latest)"
 	@printf '$(SUCCESS)Pipeline checks pass!$(RESET)\n'
 
+proto:
+	protoc -I syft/plugin/proto/ syft/plugin/proto/cataloger.proto --go_out=plugins=grpc:syft/plugin/proto/
+
 .PHONY: build
 build: $(SNAPSHOTDIR) ## Build release snapshot binaries and packages
 
@@ -179,6 +197,20 @@ acceptance-mac: $(SNAPSHOTDIR) ## Run acceptance tests on build snapshot binarie
 .PHONY: acceptance-linux
 acceptance-linux: acceptance-test-deb-package-install acceptance-test-rpm-package-install ## Run acceptance tests on build snapshot binaries and packages (Linux)
 
+# note: this is used by CI to determine if the inline-scan report cache should be busted for the inline-compare tests
+.PHONY: compare-fingerprint
+compare-fingerprint:
+	find test/inline-compare/* -type f -exec md5sum {} + | grep -v '\-reports' | grep -v 'fingerprint' | awk '{print $1}' | sort | md5sum | tee test/inline-compare/inline-compare.fingerprint
+
+.PHONY: compare-snapshot
+compare-snapshot: $(SNAPSHOTDIR) ## Compare the reports of a run of a snapshot build of syft against inline-scan
+	chmod 755 $(SNAPSHOT_CMD)
+	@cd test/inline-compare && SYFT_CMD=$(SNAPSHOT_CMD) make
+
+.PHONY: compare
+compare:  ## Compare the reports of a run of a main-branch build of syft against inline-scan
+	@cd test/inline-compare && make
+
 .PHONY: acceptance-test-deb-package-install
 acceptance-test-deb-package-install: $(SNAPSHOTDIR)
 	$(call title,Running acceptance test: DEB install)
@@ -197,8 +229,21 @@ acceptance-test-rpm-package-install: $(SNAPSHOTDIR)
 			$(ACC_TEST_IMAGE) \
 			$(RESULTSDIR)
 
+.PHONY: changlog
+changelog:
+	mkdir -p $(DISTDIR)
+	@docker run -it --rm  \
+		-v "$(shell pwd)":/usr/local/src/your-app ferrarimarco/github-changelog-generator \
+		--user anchore \
+		--project $(BIN) \
+		-t ${GITHUB_TOKEN} \
+		--no-pr-wo-labels \
+		--no-issues-wo-labels \
+		--unreleased-only \
+		--future-release $(VERSION)
+
 .PHONY: release
-release: clean-dist ## Build and publish final binaries and packages
+release: clean-dist changelog ## Build and publish final binaries and packages
 	$(call title,Publishing release artifacts)
 	# create a config with the dist dir overridden
 	echo "dist: $(DISTDIR)" > $(TEMPDIR)/goreleaser.yaml
@@ -206,26 +251,19 @@ release: clean-dist ## Build and publish final binaries and packages
 
 	# release
 	BUILD_GIT_TREE_STATE=$(GITTREESTATE) \
-	$(TEMPDIR)/goreleaser --rm-dist --config $(TEMPDIR)/goreleaser.yaml
+	$(TEMPDIR)/goreleaser \
+		--rm-dist \
+		--config $(TEMPDIR)/goreleaser.yaml \
+		--release-notes <(cat CHANGELOG.md)
 
 	# verify checksum signatures
 	.github/scripts/verify-signature.sh "$(DISTDIR)"
 
-	# create a version file for version-update checks
-	echo "$(VERSION)" > $(DISTDIR)/VERSION
-
-	# upload the version file that supports the application version update check
-	@docker run --rm \
-		-i \
-		-e AWS_DEFAULT_REGION=us-west-2 \
-		-e AWS_ACCESS_KEY_ID=${TOOLBOX_AWS_ACCESS_KEY_ID} \
-		-e AWS_SECRET_ACCESS_KEY=${TOOLBOX_AWS_SECRET_ACCESS_KEY} \
-		-v $(shell pwd)/$(DISTDIR)/:/distmount \
-		amazon/aws-cli --debug \
-			s3 cp /distmount/VERSION s3://toolbox-data.anchore.io/$(BIN)/releases/latest/VERSION
+	# upload the version file that supports the application version update check (excluding pre-releases)
+	.github/scripts/update-version-file.sh "$(DISTDIR)" "$(VERSION)"
 
 .PHONY: clean
-clean: clean-dist clean-snapshot  ## Remove previous builds and result reports
+clean: clean-dist clean-snapshot clean-json-schema-examples ## Remove previous builds and result reports
 	rm -rf $(RESULTSDIR)/*
 
 .PHONY: clean-snapshot
@@ -235,3 +273,7 @@ clean-snapshot:
 .PHONY: clean-dist
 clean-dist:
 	rm -rf $(DISTDIR) $(TEMPDIR)/goreleaser.yaml
+
+.PHONY: clean-json-schema-examples
+clean-json-schema-examples:
+	rm -f schema/json/examples/*

README.md

@@ -1,3 +1,109 @@
 # syft
 
-A CLI tool and go library for generating a Software Bill of Materials from container images and filesystems.
+[![CircleCI](https://circleci.com/gh/anchore/syft.svg?style=svg)](https://circleci.com/gh/anchore/syft)
+[![Go Report Card](https://goreportcard.com/badge/github.com/anchore/syft)](https://goreportcard.com/report/github.com/anchore/syft)
+[![GitHub release](https://img.shields.io/github/release/anchore/syft.svg)](https://github.com/anchore/syft/releases/latest)
+[![License: Apache-2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://github.com/anchore/syft/blob/main/LICENSE)
+
+A CLI tool and go library for generating a Software Bill of Materials (SBOM) from container images and filesystems.
+
+![syft-demo](https://user-images.githubusercontent.com/590471/90277200-2a253000-de33-11ea-893f-32c219eea11a.gif)
+
+**Features**
+- Catalog container images and filesystems to discover packages and libraries.
+- Supports packages and libraries from various ecosystems (APK, DEB, RPM, Ruby Bundles, Python Wheel/Egg/requirements.txt, JavaScript NPM/Yarn, Java JAR/EAR/WAR, Jenkins plugins JPI/HPI, Go modules)
+- Linux distribution identification (supports Alpine, BusyBox, CentOS/RedHat, Debian/Ubuntu flavored distributions)
+
+> :warning: **This is pre-release software** and it may not work as expected. If you encounter an issue, please [let us know using the issue tracker](https://github.com/anchore/syft/issues).
+
+## Getting started
+
+To generate an SBOM for an image:
+```
+syft <image>
+```
+
+The above output includes only software that is visible in the container (i.e., the squashed representation of the image).
+To include software from all image layers in the SBOM, regardless of its presence in the final image, provide `--scope all-layers`:
+
+```
+syft <image> --scope all-layers
+```
+
+Syft can generate a SBOM from a variety of sources:
+```
+# catalog a docker image tar (from the result of "docker image save ... -o image.tar" command)
+syft docker-archive://path/to/image.tar
+
+# catalog a directory
+syft dir://path/to/dir
+```
+
+By default Syft shows a summary table, however, more detailed `text` and `json` formats are also available.
+```
+syft <image> -o json
+syft <image> -o text
+```
+
+## Installation
+
+**Recommended**
+```bash
+# install the latest version to /usr/local/bin
+curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
+
+# install a specific version into a specific dir
+curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s <RELEASE_VERSION> -b <SOME_BIN_PATH>
+```
+
+**macOS**
+```bash
+brew tap anchore/syft
+brew install syft
+```
+
+You may experience a "macOS cannot verify app is free from malware" error upon running Syft because it is not yet signed and notarized. You can override this using `xattr`.
+```bash
+xattr -rd com.apple.quarantine syft
+```
+
+## Configuration
+
+Configuration search paths:
+
+- `.syft.yaml`
+- `.syft/config.yaml`
+- `~/.syft.yaml`
+- `<XDG_CONFIG_HOME>/syft/config.yaml`
+
+Configuration options (example values are the default):
+
+```yaml
+# same as -o ; the output format of the SBOM report (options: table, text, json)
+output: "table"
+
+# same as -s ; the search space to look for packages (options: all-layers, squashed)
+scope: "squashed"
+
+# same as -q ; suppress all output (except for the SBOM report)
+quiet: false
+
+log:
+  # use structured logging
+  structured: false
+
+  # the log level; note: detailed logging suppress the ETUI
+  level: "error"
+
+  # location to write the log file (default is not to have a log file)
+  file: ""
+
+# enable/disable checking for application updates on startup
+check-for-app-update: true
+```
+
+## Future plans
+
+The following areas of potential development are currently being investigated:
+- Add CycloneDX to list of output formats
+- Establish a stable interchange format w/Grype

RELEASE.md

@@ -0,0 +1,99 @@
+# Release Process
+
+A good release process has the following qualities:
+
+1. There is a way to plan what should be in a release
+1. There is a way to see what is actually in a release
+1. Allow for different kinds of releases (major breaking vs backwards compatible
+   enhancements vs patch updates)
+1. Specify a repeatable way to build and publish software artifacts
+
+## Planning a release
+
+To indicate a set of features to be released together add each issue to an in-repository
+Milestone named with major-minor version to be released (e.g. `v0.1`). It is OK for other
+features to be in the release that were not originally planned, and these issues and PRs
+do not need to be added to the Milestone in question. Only the set of features that, when
+completed, would allow the release to be considered complete. A Milestone is only used to:
+
+- Plan what is desired to be in a release
+- Track progress to indicate when we may be ready to cut a new release
+
+Not all releases need to be planned. For instance, patch releases for fixes should be
+released when they are ready and when releasing would not interfere with another current
+release (where some partial or breaking features have already been merged). Beta releases
+and release candidates should not be independently planned from the non-beta release. That
+is, the features for a `v0.1-beta.1` release should be planned under the `v0.1` Milestone,
+not under a separate `v0.1-beta.1` Milestone.
+
+Unless necessary, feature releases should be small and frequent, which may obviate the
+need for regular release planning under a Milestone.
+
+## What is in a release
+
+Milestones are specifically for planning a release, not necessarily tracking all changes
+that a release may bring (and more importantly, not all releases are necessarily planned
+either).
+
+This is one of the (many) reasons for a Changelog. A good Changelog lists changes grouped
+by the type of change (new, enhancement, deprecation, breaking, bug fix, security fix), in
+chronological order (within groups), linking the PR where the change was made in the
+Changelog line. Furthermore, there should be a place to see all released versions, the
+release date for each release, the semantic version of the release, and the set of changes
+for each release.
+
+This project auto-generates the Changelog contents for each current release and posts the
+generated contents to the GitHub Release page. Leveraging the GitHub Releases feature
+allows GitHub to manage the Changelog on each release outside of the git repository while
+still being hosted with the released assets.
+
+The Changelog is generated from the metadata from in-repository issues and PRs, using
+labels to guide what kind of change each item is (e.g. breaking, new feature, bug fix,
+etx). Only issues/PRs with select labels are included in the Changelog, and only if the
+issue/PR was created after the last release. Additional labels are used to exclude items
+from the Changelog.
+
+The above suggestions imply that we should:
+
+- Ensure there is a sufficient title for each PR and issue title to be included in the
+  Changelog
+- The appropriate label is applied to PRs and/or issues to drive specific change type
+  sections (deprecated, breaking, security, bug, etc)
+
+With this approach as we cultivate good organization of PRs and issues we automatically
+get an equally good Changelog.
+
+## Major, minor, and patch releases
+
+The latest version of the tool is the only supported version, which implies that multiple
+parallel release branches will not be a regular process (if ever). Multiple releases can
+be planned in parallel, however, only one can be actively developed at a time. That is, if
+PRs attached to a release Milestone have been merged into the main branch, that release is
+now the "next" release. This implies that the source of truth for release lies with the
+git log and Changelog, not with the release Milestones (which are purely for planning and
+tracking).
+
+Semantic versioning should be used to indicate breaking changes, new features, and fixes.
+The exception to this is `< 1.0`, where the major version is not bumped for breaking changes,
+instead the minor version indicates both new features and breaking changes.
+
+## Cutting a release
+
+Ideally releasing should be done often with small increments when possible. Unless a
+breaking change is blocking the release, or no fixes/features have been merged, a good
+target release cadence is between every 2 or 4 weeks.
+
+This release process itself should be as automated as possible, and have only a few steps:
+
+1. Tag the main branch with a full semantic-version, prefixed with a `v`. If there is a
+   milestone with a partial version, the full version should be used for the git tag (e.g.
+   with a Milestone of `v0.1` the tag should be `v0.1.0`).
+
+1. Push the tag, the release pipeline will generate and publish all assets as well as a
+   draft GitHub Release.
+
+1. Promote the GitHub Release from draft to public. Note: since extra assets are made
+   available immediately from previous steps (i.e. the brew formula) the release should
+   only be in this state for a small amount of time (minutes).
+
+1. If there is a release Milestone, close it.

cmd/cmd.go

@@ -3,6 +3,10 @@ package cmd
 import (
 	"fmt"
 	"os"
+	"path"
+
+	"github.com/adrg/xdg"
+	"github.com/anchore/syft/internal"
 
 	"github.com/spf13/cobra"
 
@@ -38,7 +42,7 @@ func init() {
 
 func Execute() {
 	if err := rootCmd.Execute(); err != nil {
-		log.Errorf(err.Error())
+		fmt.Fprintln(os.Stderr, err.Error())
 		os.Exit(1)
 	}
 }
@@ -49,7 +53,7 @@ func setGlobalCliOptions() {
 	// scan options
 	flag := "scope"
 	rootCmd.Flags().StringP(
-		"scope", "s", scope.AllLayersScope.String(),
+		"scope", "s", scope.SquashedScope.String(),
 		fmt.Sprintf("selection of layers to catalog, options=%v", scope.Options))
 	if err := viper.BindPFlag(flag, rootCmd.Flags().Lookup(flag)); err != nil {
 		fmt.Printf("unable to bind flag '%s': %+v", flag, err)
@@ -59,7 +63,7 @@ func setGlobalCliOptions() {
 	// output & formatting options
 	flag = "output"
 	rootCmd.Flags().StringP(
-		flag, "o", presenter.TablePresenter.String(),
+		flag, "o", string(presenter.TablePresenter),
 		fmt.Sprintf("report output formatter, options=%v", presenter.Options),
 	)
 	if err := viper.BindPFlag(flag, rootCmd.Flags().Lookup(flag)); err != nil {
@@ -78,6 +82,18 @@ func setGlobalCliOptions() {
 	}
 
 	rootCmd.Flags().CountVarP(&cliOpts.Verbosity, "verbose", "v", "increase verbosity (-v = info, -vv = debug)")
+
+	// plugins
+	defaultPluginDir := path.Join(xdg.CacheHome, internal.ApplicationName, "plugins")
+	flag = "plugins.dir"
+	rootCmd.Flags().String(
+		flag, defaultPluginDir,
+		"plugin storage directory",
+	)
+	if err := viper.BindPFlag(flag, rootCmd.Flags().Lookup(flag)); err != nil {
+		fmt.Printf("unable to bind flag '%s': %+v", flag, err)
+		os.Exit(1)
+	}
 }
 
 func initAppConfig() {
@@ -90,7 +106,7 @@ func initAppConfig() {
 }
 
 func initLogging() {
-	config := logger.LogConfig{
+	cfg := logger.LogrusConfig{
 		EnableConsole: (appConfig.Log.FileLocation == "" || appConfig.CliOptions.Verbosity > 0) && !appConfig.Quiet,
 		EnableFile:    appConfig.Log.FileLocation != "",
 		Level:         appConfig.Log.LevelOpt,
@@ -98,9 +114,11 @@ func initLogging() {
 		FileLocation:  appConfig.Log.FileLocation,
 	}
 
-	logWrapper := logger.NewZapLogger(config)
+	logWrapper := logger.NewLogrusLogger(cfg)
 	syft.SetLogger(logWrapper)
-	stereoscope.SetLogger(logWrapper)
+	stereoscope.SetLogger(&logger.LogrusNestedLogger{
+		Logger: logWrapper.Logger.WithField("from-lib", "stereoscope"),
+	})
 }
 
 func logAppConfig() {

cmd/root.go

@@ -19,7 +19,7 @@ import (
 var rootCmd = &cobra.Command{
 	Use:   fmt.Sprintf("%s [SOURCE]", internal.ApplicationName),
 	Short: "A tool for generating a Software Bill Of Materials (SBOM) from container images and filesystems",
-	Long: internal.Tprintf(`\
+	Long: internal.Tprintf(`
 Supports the following image sources:
     {{.appName}} yourrepo/yourimage:tag             defaults to using images from a docker daemon
     {{.appName}} docker://yourrepo/yourimage:tag    explicitly use the docker daemon
@@ -28,8 +28,16 @@ Supports the following image sources:
 `, map[string]interface{}{
 		"appName": internal.ApplicationName,
 	}),
-	Args: cobra.ExactArgs(1),
+	Args: cobra.MaximumNArgs(1),
 	Run: func(cmd *cobra.Command, args []string) {
+		if len(args) == 0 {
+			err := cmd.Help()
+			if err != nil {
+				log.Errorf(err.Error())
+				os.Exit(1)
+			}
+			os.Exit(1)
+		}
 		err := doRunCmd(cmd, args)
 		if err != nil {
 			log.Errorf(err.Error())
@@ -49,16 +57,28 @@ func startWorker(userInput string) <-chan error {
 				log.Errorf(err.Error())
 			}
 			if isAvailable {
-				log.Infof("New version of %s is available: %s", internal.ApplicationName, newVersion)
+				log.Infof("new version of %s is available: %s", internal.ApplicationName, newVersion)
 
 				bus.Publish(partybus.Event{
 					Type:  event.AppUpdateAvailable,
 					Value: newVersion,
 				})
+			} else {
+				log.Debugf("no new %s update available", internal.ApplicationName)
 			}
 		}
 
-		catalog, scope, _, err := syft.Catalog(userInput, appConfig.ScopeOpt)
+		config := syft.Config{
+			PluginDirectory: appConfig.Plugins.Directory,
+		}
+
+		client, err := syft.NewClient(config)
+		if err != nil {
+			errs <- fmt.Errorf("could not initialize syft: %+v", err)
+			return
+		}
+
+		catalog, scope, distro, err := client.Catalog(userInput, appConfig.ScopeOpt)
 		if err != nil {
 			errs <- fmt.Errorf("failed to catalog input: %+v", err)
 			return
@@ -66,7 +86,7 @@ func startWorker(userInput string) <-chan error {
 
 		bus.Publish(partybus.Event{
 			Type:  event.CatalogerFinished,
-			Value: presenter.GetPresenter(appConfig.PresenterOpt, *scope, catalog),
+			Value: presenter.GetPresenter(appConfig.PresenterOpt, *scope, catalog, distro),
 		})
 	}()
 	return errs

go.mod

@@ -4,31 +4,44 @@ go 1.14
 
 require (
 	github.com/adrg/xdg v0.2.1
+	github.com/anchore/go-rpmdb v0.0.0-20200811175839-cbc751c28e8e
 	github.com/anchore/go-testutils v0.0.0-20200624184116-66aa578126db
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
-	github.com/anchore/stereoscope v0.0.0-20200706164556-7cf39d7f4639
+	github.com/anchore/stereoscope v0.0.0-20200903223322-a3806f515470
 	github.com/bmatcuk/doublestar v1.3.1
+	github.com/containerd/continuity v0.0.0-20200710164510-efbc4488d8fe // indirect
+	github.com/dustin/go-humanize v1.0.0
 	github.com/go-test/deep v1.0.6
+	github.com/golang/protobuf v1.4.2
 	github.com/google/go-containerregistry v0.1.1 // indirect
-	github.com/gookit/color v1.2.5
+	github.com/google/uuid v1.1.1
+	github.com/gookit/color v1.2.7
 	github.com/gopherjs/gopherjs v0.0.0-20190910122728-9d188e94fb99 // indirect
+	github.com/hashicorp/go-hclog v0.14.1
 	github.com/hashicorp/go-multierror v1.1.0
+	github.com/hashicorp/go-plugin v1.3.0
 	github.com/hashicorp/go-version v1.2.0
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/mitchellh/mapstructure v1.3.1
 	github.com/olekukonko/tablewriter v0.0.4
+	github.com/package-url/packageurl-go v0.1.0
+	github.com/pelletier/go-toml v1.8.0
 	github.com/rogpeppe/go-internal v1.5.2
 	github.com/sergi/go-diff v1.1.0
+	github.com/sirupsen/logrus v1.6.0
 	github.com/spf13/cobra v1.0.0
 	github.com/spf13/viper v1.7.0
 	github.com/wagoodman/go-partybus v0.0.0-20200526224238-eb215533f07d
-	github.com/wagoodman/go-progress v0.0.0-20200621153512-2778c704bf22
-	github.com/wagoodman/go-rpmdb v0.0.0-20200719223757-ce54a4b0607b
-	github.com/wagoodman/jotframe v0.0.0-20200622123948-2995cbd43525
-	go.uber.org/zap v1.15.0
-	golang.org/x/crypto v0.0.0-20200604202706-70a84ac30bf9
+	github.com/wagoodman/go-progress v0.0.0-20200731105512-1020f39e6240
+	github.com/wagoodman/jotframe v0.0.0-20200730190914-3517092dd163
+	github.com/x-cray/logrus-prefixed-formatter v0.5.2
+	github.com/xeipuuv/gojsonschema v1.2.0
+	golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9
+	golang.org/x/net v0.0.0-20200625001655-4c5254603344 // indirect
+	golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208 // indirect
 	golang.org/x/sys v0.0.0-20200610111108-226ff32320da // indirect
 	google.golang.org/genproto v0.0.0-20200615140333-fd031eab31e7 // indirect
+	google.golang.org/grpc v1.31.1
 	gopkg.in/ini.v1 v1.57.0 // indirect
 	gopkg.in/yaml.v2 v2.3.0
 )

go.sum

@@ -124,13 +124,15 @@ github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuy
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
+github.com/anchore/go-rpmdb v0.0.0-20200811175839-cbc751c28e8e h1:kty6r0R2JeaNPeWKSYDC+HW3hkqwFh4PP5TQ8pUPYFw=
+github.com/anchore/go-rpmdb v0.0.0-20200811175839-cbc751c28e8e/go.mod h1:iYuIG0Nai8dR0ri3LhZQKUyO1loxUWAGvoWhXDmjy1A=
 github.com/anchore/go-testutils v0.0.0-20200624184116-66aa578126db h1:LWKezJnFTFxNkZ4MzajVf+YWvJS0+7hwFr59u6SS7cw=
 github.com/anchore/go-testutils v0.0.0-20200624184116-66aa578126db/go.mod h1:D3rc2L/q4Hcp9eeX6AIJH4Q+kPjOtJCFhG9za90j+nU=
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZVsCYMrIZBpFxwV26CbsuoEh5muXD5I1Ods=
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/stereoscope v0.0.0-20200520221116-025e07f1c93e/go.mod h1:bkyLl5VITnrmgErv4S1vDfVz/TGAZ5il6161IQo7w2g=
-github.com/anchore/stereoscope v0.0.0-20200706164556-7cf39d7f4639 h1:J1oytkj+aBuACNF2whtEiVxRXIZ8zwT+EiPTqm/FvwA=
-github.com/anchore/stereoscope v0.0.0-20200706164556-7cf39d7f4639/go.mod h1:WntReQTI/I27FOQ87UgLVVzWgku6+ZsqfOTLxpIZFCs=
+github.com/anchore/stereoscope v0.0.0-20200903223322-a3806f515470 h1:apXyPyfiaL/YQF7VeXRbDDB9TA7dA9rxdq8YbzPk9ko=
+github.com/anchore/stereoscope v0.0.0-20200903223322-a3806f515470/go.mod h1:WntReQTI/I27FOQ87UgLVVzWgku6+ZsqfOTLxpIZFCs=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/apex/log v1.1.4/go.mod h1:AlpoD9aScyQfJDVHmLMEcx4oU6LqzkWp4Mg9GdAcEvQ=
 github.com/apex/log v1.3.0 h1:1fyfbPvUwD10nMoh3hY6MXzvZShJQn9/ck7ATgAt5pA=
@@ -191,8 +193,9 @@ github.com/containerd/containerd v1.3.2/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMX
 github.com/containerd/containerd v1.3.4 h1:3o0smo5SKY7H6AJCmJhsnCjR2/V2T8VmiHt7seN2/kI=
 github.com/containerd/containerd v1.3.4/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
 github.com/containerd/continuity v0.0.0-20190426062206-aaeac12a7ffc/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
-github.com/containerd/continuity v0.0.0-20200413184840-d3ef23f19fbb h1:nXPkFq8X1a9ycY3GYQpFNxHh3j2JgY7zDZfq2EXMIzk=
 github.com/containerd/continuity v0.0.0-20200413184840-d3ef23f19fbb/go.mod h1:Dq467ZllaHgAtVp4p1xUQWBrFXR9s/wyoTpG8zOJGkY=
+github.com/containerd/continuity v0.0.0-20200710164510-efbc4488d8fe h1:PEmIrUvwG9Yyv+0WKZqjXfSFDeZjs/q15g0m08BYS9k=
+github.com/containerd/continuity v0.0.0-20200710164510-efbc4488d8fe/go.mod h1:cECdGN1O8G9bgKTlLhuPJimka6Xb/Gg7vYzCTNVxhvo=
 github.com/containerd/fifo v0.0.0-20190226154929-a9fb20d87448/go.mod h1:ODA38xgv3Kuk8dQz2ZQXpnv/UZZUHUCL7pnLehbXgQI=
 github.com/containerd/go-runc v0.0.0-20180907222934-5a6d9f37cfa3/go.mod h1:IV7qH3hrUgRmyYrtgEeGWJfWbgcHL9CSRruz2Vqcph0=
 github.com/containerd/ttrpc v0.0.0-20190828154514-0e0f228740de/go.mod h1:PvCDdDGpgqzQIzDW1TphrGLssLDZp2GuS+X5DkEJB8o=
@@ -438,6 +441,8 @@ github.com/googleapis/gnostic v0.2.2/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTV
 github.com/gookit/color v1.2.4/go.mod h1:AhIE+pS6D4Ql0SQWbBeXPHw7gY0/sjHoA4s/n1KB7xg=
 github.com/gookit/color v1.2.5 h1:s1gzb/fg3HhkSLKyWVUsZcVBUo+R1TwEYTmmxH8gGFg=
 github.com/gookit/color v1.2.5/go.mod h1:AhIE+pS6D4Ql0SQWbBeXPHw7gY0/sjHoA4s/n1KB7xg=
+github.com/gookit/color v1.2.7 h1:4qePMNWZhrmbfYJDix+J4V2l0iVW+6jQGjicELlN14E=
+github.com/gookit/color v1.2.7/go.mod h1:AhIE+pS6D4Ql0SQWbBeXPHw7gY0/sjHoA4s/n1KB7xg=
 github.com/gophercloud/gophercloud v0.1.0/go.mod h1:vxM41WHh5uqHVBMZHzuwNOHh8XEoIEcSTewFxm1c5g8=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
 github.com/gopherjs/gopherjs v0.0.0-20190910122728-9d188e94fb99 h1:twflg0XRTjwKpxb/jFExr4HGq6on2dEOmnL6FV+fgPw=
@@ -469,12 +474,18 @@ github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/U
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-cleanhttp v0.5.1 h1:dH3aiDG9Jvb5r5+bYHsikaOUIpcM0xvgMXVoDkXMzJM=
 github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
+github.com/hashicorp/go-hclog v0.0.0-20180709165350-ff2cf002a8dd/go.mod h1:9bjs9uLqI8l75knNv3lV1kA55veR+WUPSiKIWcQHudI=
+github.com/hashicorp/go-hclog v0.9.2 h1:CG6TE5H9/JXsFWJCfoIVpKFIkFe6ysEuHirp4DxCsHI=
 github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
+github.com/hashicorp/go-hclog v0.14.1 h1:nQcJDQwIAGnmoUWp8ubocEX40cCml/17YkF6csQLReU=
+github.com/hashicorp/go-hclog v0.14.1/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
 github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
 github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
 github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
 github.com/hashicorp/go-multierror v1.1.0 h1:B9UzwGQJehnUY1yNrnwREHc3fGbC2xefo8g4TbElacI=
 github.com/hashicorp/go-multierror v1.1.0/go.mod h1:spPvp8C1qA32ftKqdAHm4hHTbPw+vmowP0z+KUhOZdA=
+github.com/hashicorp/go-plugin v1.3.0 h1:4d/wJojzvHV1I4i/rrjVaeuyxWrLzDE1mDCyDy8fXS8=
+github.com/hashicorp/go-plugin v1.3.0/go.mod h1:F9eH4LrE/ZsRdbwhfjs9k9HoDUwAHnYtXdgmf1AVNs0=
 github.com/hashicorp/go-retryablehttp v0.6.4/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
 github.com/hashicorp/go-retryablehttp v0.6.6 h1:HJunrbHTDDbBb/ay4kxa1n+dLmttUlnP3V9oNE4hmsM=
 github.com/hashicorp/go-retryablehttp v0.6.6/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
@@ -495,6 +506,9 @@ github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO
 github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0mNTz8vQ=
 github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2pPBoIllUwCN7I=
 github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc=
+github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb h1:b5rjCoWHc7eqmAS4/qyk21ZsHyb6Mxv/jykxvNTkU4M=
+github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
+github.com/hpcloud/tail v1.0.0 h1:nfCOvKYfkgYP8hkirhJocXT2+zOD8yUNjXaWfTlyFKI=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
@@ -504,6 +518,8 @@ github.com/imdario/mergo v0.3.9/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJ
 github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/jarcoal/httpmock v1.0.5/go.mod h1:ATjnClrvW/3tijVmpL/va5Z3aAyGvqU3gCT8nX0Txik=
+github.com/jhump/protoreflect v1.6.0 h1:h5jfMVslIg6l29nsMs0D8Wj17RDVdNYti0vDN/PZZoE=
+github.com/jhump/protoreflect v1.6.0/go.mod h1:eaTn3RZAmMBcV0fifFvlm6VHNz3wSkYyXYWUh7ymB74=
 github.com/jingyugao/rowserrcheck v0.0.0-20191204022205-72ab7603b68a h1:GmsqmapfzSJkm28dhRoHz2tLRbJmqhU86IPgBtN3mmk=
 github.com/jingyugao/rowserrcheck v0.0.0-20191204022205-72ab7603b68a/go.mod h1:xRskid8CManxVta/ALEhJha/pweKBaVG6fWgc0yH25s=
 github.com/jirfag/go-printf-func-name v0.0.0-20191110105641-45db9963cdd3/go.mod h1:HEWGJkRDzjJY2sqdDwxccsGicWEf9BQOZsq2tV+xzM0=
@@ -583,6 +599,7 @@ github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNx
 github.com/mattn/go-isatty v0.0.5/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.6/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
 github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
 github.com/mattn/go-isatty v0.0.12 h1:wuysRhFDzyxgEmMf5xjvJ2M9dZoWAXNNr5LSBS7uHXY=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
@@ -597,6 +614,7 @@ github.com/mattn/go-zglob v0.0.1/go.mod h1:9fxibJccNxU2cnpIKLRRFA7zX7qhkJIQWBb44
 github.com/mattn/goveralls v0.0.2/go.mod h1:8d1ZMHsd7fW6IRPKQh46F2WRpyib5/X4FOpevwGNQEw=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/maxbrunsfeld/counterfeiter/v6 v6.2.2/go.mod h1:eD9eIE7cdwcMi9rYluz88Jz2VyhSmden33/aXg4oVIY=
+github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b h1:j7+1HpAFS1zy5+Q4qx1fWh90gTKwiN4QCGoY9TWyyO4=
 github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
 github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
 github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
@@ -604,6 +622,8 @@ github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrk
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-ps v0.0.0-20190716172923-621e5597135b/go.mod h1:r1VsdOzOPt1ZSrGZWFoNhsAedKnEd6r9Np1+5blZCWk=
+github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
+github.com/mitchellh/go-testing-interface v1.0.0 h1:fzU/JVNcaqHQEcVFAKeR41fkiLdIPrefOvVG1VZ96U0=
 github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
 github.com/mitchellh/gox v0.4.0/go.mod h1:Sd9lOJ0+aimLBi73mGofS1ycjY8lL3uZM3JPS42BGNg=
 github.com/mitchellh/iochan v1.0.0/go.mod h1:JwYml1nuB7xOzsp52dPpHFffvOCDupsG0QubkSMEySY=
@@ -632,6 +652,8 @@ github.com/nbutton23/zxcvbn-go v0.0.0-20180912185939-ae427f1e4c1d h1:AREM5mwr4u1
 github.com/nbutton23/zxcvbn-go v0.0.0-20180912185939-ae427f1e4c1d/go.mod h1:o96djdrsSGy3AWPyBgZMAGfxZNfgntdJG+11KU4QvbU=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/oklog/run v1.0.0 h1:Ru7dDtJNOyC66gQ5dQmaCa0qIsAUFY3sFpK1Xk8igrw=
+github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/olekukonko/tablewriter v0.0.0-20170122224234-a0225b3f23b5/go.mod h1:vsDQFd/mU46D+Z4whnwzcISnGGzXWMclvtLoiIKAKIo=
 github.com/olekukonko/tablewriter v0.0.4 h1:vHD/YYe1Wolo78koG299f7V/VAS08c6IpCLn+Ejf/w8=
@@ -641,12 +663,14 @@ github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+W
 github.com/onsi/ginkgo v1.8.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.10.1/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.11.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.12.0 h1:Iw5WCbBcaAAd0fpRb1c9r5YCylv4XDoCSigm1zLevwU=
 github.com/onsi/ginkgo v1.12.0/go.mod h1:oUhWkIvk5aDxtKvDDuw8gItl8pKl42LzjC9KZE0HfGg=
 github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
 github.com/onsi/gomega v1.5.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
 github.com/onsi/gomega v1.8.1/go.mod h1:Ho0h+IUsWyvy1OpqCwxlQ/21gkhVunqlU8fDGcoTdcA=
+github.com/onsi/gomega v1.9.0 h1:R1uwffexN6Pr340GtYRIdZmAiN4J+iw6WG4wog1DUXg=
 github.com/onsi/gomega v1.9.0/go.mod h1:Ho0h+IUsWyvy1OpqCwxlQ/21gkhVunqlU8fDGcoTdcA=
 github.com/op/go-logging v0.0.0-20160315200505-970db520ece7/go.mod h1:HzydrMdWErDVzsI23lYNej1Htcns9BCg93Dk0bBINWk=
 github.com/opencontainers/go-digest v0.0.0-20180430190053-c9281466c8b2/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
@@ -659,6 +683,8 @@ github.com/opencontainers/runc v0.0.0-20190115041553-12f6a991201f/go.mod h1:qT5X
 github.com/opencontainers/runc v0.1.1 h1:GlxAyO6x8rfZYN9Tt0Kti5a/cP41iuiO2yYT0IJGY8Y=
 github.com/opencontainers/runc v0.1.1/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runtime-spec v0.1.2-0.20190507144316-5b71a03e2700/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/package-url/packageurl-go v0.1.0 h1:efWBc98O/dBZRg1pw2xiDzovnlMjCa9NPnfaiBduh8I=
+github.com/package-url/packageurl-go v0.1.0/go.mod h1:C/ApiuWpmbpni4DIOECf6WCjFUZV7O1Fx7VAzrZHgBw=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
@@ -823,15 +849,21 @@ github.com/wagoodman/go-partybus v0.0.0-20200526224238-eb215533f07d h1:KOxOL6qpm
 github.com/wagoodman/go-partybus v0.0.0-20200526224238-eb215533f07d/go.mod h1:JPirS5jde/CF5qIjcK4WX+eQmKXdPc6vcZkJ/P0hfPw=
 github.com/wagoodman/go-progress v0.0.0-20200621122631-1a2120f0695a h1:lV3ioFpbqvfZ1bXSQfloLWzom1OPU/5UjyU0wmBlkNc=
 github.com/wagoodman/go-progress v0.0.0-20200621122631-1a2120f0695a/go.mod h1:jLXFoL31zFaHKAAyZUh+sxiTDFe1L1ZHrcK2T1itVKA=
-github.com/wagoodman/go-progress v0.0.0-20200621153512-2778c704bf22 h1:GYaiTP0ywrCjJ4qMxxCg+YKPSDMeFJg6i1X9X55LJCA=
-github.com/wagoodman/go-progress v0.0.0-20200621153512-2778c704bf22/go.mod h1:jLXFoL31zFaHKAAyZUh+sxiTDFe1L1ZHrcK2T1itVKA=
-github.com/wagoodman/go-rpmdb v0.0.0-20200719223757-ce54a4b0607b h1:elYGLFZPymeTWJ6qA3tIzFet3LQ9D/Jl6HLWNyFjdQc=
-github.com/wagoodman/go-rpmdb v0.0.0-20200719223757-ce54a4b0607b/go.mod h1:MjoIZzKmbYfcpbC6ARWMcHijAjtLBViDaHcayXKWQWI=
-github.com/wagoodman/jotframe v0.0.0-20200622123948-2995cbd43525 h1:fGlwSBQrl9/axciK2+gJ9q86SeQYJpbPx4vOrExvZXY=
-github.com/wagoodman/jotframe v0.0.0-20200622123948-2995cbd43525/go.mod h1:DzXZ1wfRedNhC3KQTick8Gf3CEPMFHsP5k4R/ldjKtw=
+github.com/wagoodman/go-progress v0.0.0-20200731105512-1020f39e6240 h1:r6BlIP7CVZtMlxUQhT40h1IE1TzEgKVqwmsVGuscvdk=
+github.com/wagoodman/go-progress v0.0.0-20200731105512-1020f39e6240/go.mod h1:jLXFoL31zFaHKAAyZUh+sxiTDFe1L1ZHrcK2T1itVKA=
+github.com/wagoodman/jotframe v0.0.0-20200730190914-3517092dd163 h1:qoZwR+bHbFFNirY4Yt7lqbOXnFAMnlFfR89w0TXwjrc=
+github.com/wagoodman/jotframe v0.0.0-20200730190914-3517092dd163/go.mod h1:DzXZ1wfRedNhC3KQTick8Gf3CEPMFHsP5k4R/ldjKtw=
+github.com/x-cray/logrus-prefixed-formatter v0.5.2 h1:00txxvfBM9muc0jiLIEAkAcIMJzfthRT6usrui8uGmg=
+github.com/x-cray/logrus-prefixed-formatter v0.5.2/go.mod h1:2duySbKsL6M18s5GU7VPsoEPHyzalCE06qoARUCeBBE=
 github.com/xanzy/go-gitlab v0.31.0/go.mod h1:sPLojNBn68fMUWSxIJtdVVIP8uSBYqesTfDUseX11Ug=
 github.com/xanzy/go-gitlab v0.32.0 h1:tBm+OXv1t+KBsqlXkSDFz+YUjRM0GFsjpOWYOod3Ebs=
 github.com/xanzy/go-gitlab v0.32.0/go.mod h1:sPLojNBn68fMUWSxIJtdVVIP8uSBYqesTfDUseX11Ug=
+github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f h1:J9EGpcZtP0E/raorCMxlFGSTBrsSlaDGf3jU/qvAE2c=
+github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
+github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
+github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
 github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8/go.mod h1:HUYIGzjTL3rfEspMxjDjgmT5uz5wzYJKVo23qUhYTos=
 github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
@@ -848,16 +880,8 @@ go.opencensus.io v0.22.3 h1:8sGtKOrtQqkN1bp2AtX+misvLIlOmsEsNd+9NIcPEm8=
 go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
-go.uber.org/atomic v1.6.0 h1:Ezj3JGmsOnG1MoRWQkPBsKLe9DwWD9QeXzTRzzldNVk=
-go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
 go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
-go.uber.org/multierr v1.5.0 h1:KCa4XfM8CWFCpxXRGok+Q0SS/0XBhMDbHHGABQLvD2A=
-go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
-go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee h1:0mgffUl7nfd+FpvXMVz4IDEaUSmT1ysygQC7qYo7sG4=
-go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee/go.mod h1:vJERXedbb3MVM5f9Ejo0C68/HhF8uaILCdgjnY+goOA=
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
-go.uber.org/zap v1.15.0 h1:ZZCA22JRF2gQE5FoNmhmrf7jeJJ2uhqDUNRYKm8dvmM=
-go.uber.org/zap v1.15.0/go.mod h1:Mb2vm2krFEG5DV0W9qcHBYFtp/Wku1cvYaqPsS/WYfc=
 gocloud.dev v0.19.0 h1:EDRyaRAnMGSq/QBto486gWFxMLczAfIYUmusV7XLNBM=
 gocloud.dev v0.19.0/go.mod h1:SmKwiR8YwIMMJvQBKLsC3fHNyMwXLw3PMDO+VVteJMI=
 golang.org/x/crypto v0.0.0-20171113213409-9f005a07e0d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
@@ -877,8 +901,8 @@ golang.org/x/crypto v0.0.0-20191206172530-e9b2fee46413/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200510223506-06a226fb4e37 h1:cg5LA/zNPRzIXIWSCxQW10Rvpy94aQh3LT/ShoCpkHw=
 golang.org/x/crypto v0.0.0-20200510223506-06a226fb4e37/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20200604202706-70a84ac30bf9 h1:vEg9joUBmeBcK9iSJftGNf3coIG4HqZElCPehJsfAYM=
-golang.org/x/crypto v0.0.0-20200604202706-70a84ac30bf9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 h1:psW17arqaxU48Z5kZ0CQnkZWQJsqcURM6tKiBApRjXI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190125153040-c74c464bbbf2/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -914,6 +938,7 @@ golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0 h1:RM4zey1++hCTbCVQfnWeKs9/IEsaBLA8vTkd0WVtmH4=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/net v0.0.0-20170114055629-f2499483f923/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180530234432-1e491301e022/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -953,6 +978,8 @@ golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/
 golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200602114024-627f9648deb9 h1:pNX+40auqi2JqRfOP1akLGtYcn15TUbkhwuCO3foqqM=
 golang.org/x/net v0.0.0-20200602114024-627f9648deb9/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200625001655-4c5254603344 h1:vGXIOMxbNfDTk/aXCmfdLgkrSV+Z2tcbze+pEc3v5W4=
+golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181106182150-f42d05182288/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -969,6 +996,8 @@ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a h1:WXEvlFVvvGxCJLG6REjsT03iWnKLEWinaScsxF2Vm2o=
 golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208 h1:qwRHBd0NqMbJxfbotnDhm2ByMI1Shq4Y6oRJo21SGJA=
+golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20170830134202-bb24a47a89ea/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -999,6 +1028,7 @@ golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190922100055-0a153f010e69/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191010194322-b09406accb47/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191112214154-59a1497f0cea/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -1068,8 +1098,6 @@ golang.org/x/tools v0.0.0-20190910044552-dd2b5c81c578/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190920225731-5eefd052ad72/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191029190741-b9c20aec41a5/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191108193012-7d206e10da11/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191112195655-aa38f8e97acc/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
@@ -1137,6 +1165,7 @@ google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/appengine v1.6.6 h1:lMO5rYAqUxkmaj76jAkRUvt5JZgFymx/+Q5Mzfivuhc=
 google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/genproto v0.0.0-20170818010345-ee236bd376b0/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
@@ -1170,6 +1199,7 @@ google.golang.org/genproto v0.0.0-20200604104852-0b0486081ffb h1:ek2py5bOqzR7MR/
 google.golang.org/genproto v0.0.0-20200604104852-0b0486081ffb/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
 google.golang.org/genproto v0.0.0-20200615140333-fd031eab31e7 h1:1N7l1PuXZwEK7OhHdmKQROOM75PnUjABGwvVRbLBgFk=
 google.golang.org/genproto v0.0.0-20200615140333-fd031eab31e7/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
+google.golang.org/grpc v1.8.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.0/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -1184,6 +1214,8 @@ google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8
 google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60=
 google.golang.org/grpc v1.29.1 h1:EC2SB8S04d2r73uptxphDSUG+kTKVgjRPF+N3xpxRB4=
 google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
+google.golang.org/grpc v1.31.1 h1:SfXqXS5hkufcdZ/mHtYCh53P2b+92WQq/DZcKLgsFRs=
+google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -1203,6 +1235,7 @@ gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8X
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/cheggaaa/pb.v1 v1.0.25/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
+gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/gcfg.v1 v1.2.0/go.mod h1:yesOnuUOFQAhST5vPY4nbZsb/huCgGGXlipJsBn0b3o=
 gopkg.in/gemnasium/logrus-airbrake-hook.v2 v2.1.2/go.mod h1:Xk6kEKp8OKb+X14hQBKWaSkCsqBpgog8nAV2xsGOxlo=
@@ -1216,6 +1249,7 @@ gopkg.in/ini.v1 v1.57.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=
 gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
 gopkg.in/square/go-jose.v2 v2.2.2/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/warnings.v0 v0.1.1/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
 gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bli9HhUf9+ttbYbLASfIpnQbh74=

install.sh

@@ -0,0 +1,375 @@
+#!/bin/sh
+set -e
+# Code generated by godownloader on 2020-08-10T20:55:46Z. DO NOT EDIT.
+#
+
+usage() {
+  this=$1
+  cat <<EOF
+$this: download go binaries for anchore/syft
+
+Usage: $this [-b] bindir [-d] [tag]
+  -b sets bindir or installation directory, Defaults to ./bin
+  -d turns on debug logging
+   [tag] is a tag from
+   https://github.com/anchore/syft/releases
+   If tag is missing, then the latest will be used.
+
+ Generated by godownloader
+  https://github.com/goreleaser/godownloader
+
+EOF
+  exit 2
+}
+
+parse_args() {
+  #BINDIR is ./bin unless set be ENV
+  # over-ridden by flag below
+
+  BINDIR=${BINDIR:-./bin}
+  while getopts "b:dh?x" arg; do
+    case "$arg" in
+      b) BINDIR="$OPTARG" ;;
+      d) log_set_priority 10 ;;
+      h | \?) usage "$0" ;;
+      x) set -x ;;
+    esac
+  done
+  shift $((OPTIND - 1))
+  TAG=$1
+}
+# this function wraps all the destructive operations
+# if a curl|bash cuts off the end of the script due to
+# network, either nothing will happen or will syntax error
+# out preventing half-done work
+execute() {
+  tmpdir=$(mktemp -d)
+  log_debug "downloading files into ${tmpdir}"
+  http_download "${tmpdir}/${TARBALL}" "${TARBALL_URL}"
+  http_download "${tmpdir}/${CHECKSUM}" "${CHECKSUM_URL}"
+  hash_sha256_verify "${tmpdir}/${TARBALL}" "${tmpdir}/${CHECKSUM}"
+  srcdir="${tmpdir}"
+  (cd "${tmpdir}" && untar "${TARBALL}")
+  test ! -d "${BINDIR}" && install -d "${BINDIR}"
+  for binexe in $BINARIES; do
+    if [ "$OS" = "windows" ]; then
+      binexe="${binexe}.exe"
+    fi
+    install "${srcdir}/${binexe}" "${BINDIR}/"
+    log_info "installed ${BINDIR}/${binexe}"
+  done
+  rm -rf "${tmpdir}"
+}
+get_binaries() {
+  case "$PLATFORM" in
+    darwin/amd64) BINARIES="syft" ;;
+    linux/amd64) BINARIES="syft" ;;
+    windows/amd64) BINARIES="syft" ;;
+    *)
+      log_crit "platform $PLATFORM is not supported.  Make sure this script is up-to-date and file request at https://github.com/${PREFIX}/issues/new"
+      exit 1
+      ;;
+  esac
+}
+tag_to_version() {
+  if [ -z "${TAG}" ]; then
+    log_info "checking GitHub for latest tag"
+  else
+    log_info "checking GitHub for tag '${TAG}'"
+  fi
+  REALTAG=$(github_release "$OWNER/$REPO" "${TAG}") && true
+  if test -z "$REALTAG"; then
+    log_crit "unable to find '${TAG}' - use 'latest' or see https://github.com/${PREFIX}/releases for details"
+    exit 1
+  fi
+  # if version starts with 'v', remove it
+  TAG="$REALTAG"
+  VERSION=${TAG#v}
+}
+adjust_format() {
+  # change format (tar.gz or zip) based on OS
+  case ${OS} in
+    windows) FORMAT=zip ;;
+  esac
+  true
+}
+adjust_os() {
+  # adjust archive name based on OS
+  true
+}
+adjust_arch() {
+  # adjust archive name based on ARCH
+  true
+}
+
+cat /dev/null <<EOF
+------------------------------------------------------------------------
+https://github.com/client9/shlib - portable posix shell functions
+Public domain - http://unlicense.org
+https://github.com/client9/shlib/blob/master/LICENSE.md
+but credit (and pull requests) appreciated.
+------------------------------------------------------------------------
+EOF
+is_command() {
+  command -v "$1" >/dev/null
+}
+echoerr() {
+  echo "$@" 1>&2
+}
+log_prefix() {
+  echo "$0"
+}
+_logp=6
+log_set_priority() {
+  _logp="$1"
+}
+log_priority() {
+  if test -z "$1"; then
+    echo "$_logp"
+    return
+  fi
+  [ "$1" -le "$_logp" ]
+}
+log_tag() {
+  case $1 in
+    0) echo "emerg" ;;
+    1) echo "alert" ;;
+    2) echo "crit" ;;
+    3) echo "err" ;;
+    4) echo "warning" ;;
+    5) echo "notice" ;;
+    6) echo "info" ;;
+    7) echo "debug" ;;
+    *) echo "$1" ;;
+  esac
+}
+log_debug() {
+  log_priority 7 || return 0
+  echoerr "$(log_prefix)" "$(log_tag 7)" "$@"
+}
+log_info() {
+  log_priority 6 || return 0
+  echoerr "$(log_prefix)" "$(log_tag 6)" "$@"
+}
+log_err() {
+  log_priority 3 || return 0
+  echoerr "$(log_prefix)" "$(log_tag 3)" "$@"
+}
+log_crit() {
+  log_priority 2 || return 0
+  echoerr "$(log_prefix)" "$(log_tag 2)" "$@"
+}
+uname_os() {
+  os=$(uname -s | tr '[:upper:]' '[:lower:]')
+  case "$os" in
+    cygwin_nt*) os="windows" ;;
+    mingw*) os="windows" ;;
+    msys_nt*) os="windows" ;;
+  esac
+  echo "$os"
+}
+uname_arch() {
+  arch=$(uname -m)
+  case $arch in
+    x86_64) arch="amd64" ;;
+    x86) arch="386" ;;
+    i686) arch="386" ;;
+    i386) arch="386" ;;
+    aarch64) arch="arm64" ;;
+    armv5*) arch="armv5" ;;
+    armv6*) arch="armv6" ;;
+    armv7*) arch="armv7" ;;
+  esac
+  echo ${arch}
+}
+uname_os_check() {
+  os=$(uname_os)
+  case "$os" in
+    darwin) return 0 ;;
+    dragonfly) return 0 ;;
+    freebsd) return 0 ;;
+    linux) return 0 ;;
+    android) return 0 ;;
+    nacl) return 0 ;;
+    netbsd) return 0 ;;
+    openbsd) return 0 ;;
+    plan9) return 0 ;;
+    solaris) return 0 ;;
+    windows) return 0 ;;
+  esac
+  log_crit "uname_os_check '$(uname -s)' got converted to '$os' which is not a GOOS value. Please file bug at https://github.com/client9/shlib"
+  return 1
+}
+uname_arch_check() {
+  arch=$(uname_arch)
+  case "$arch" in
+    386) return 0 ;;
+    amd64) return 0 ;;
+    arm64) return 0 ;;
+    armv5) return 0 ;;
+    armv6) return 0 ;;
+    armv7) return 0 ;;
+    ppc64) return 0 ;;
+    ppc64le) return 0 ;;
+    mips) return 0 ;;
+    mipsle) return 0 ;;
+    mips64) return 0 ;;
+    mips64le) return 0 ;;
+    s390x) return 0 ;;
+    amd64p32) return 0 ;;
+  esac
+  log_crit "uname_arch_check '$(uname -m)' got converted to '$arch' which is not a GOARCH value.  Please file bug report at https://github.com/client9/shlib"
+  return 1
+}
+untar() {
+  tarball=$1
+  case "${tarball}" in
+    *.tar.gz | *.tgz) tar --no-same-owner -xzf "${tarball}" ;;
+    *.tar) tar --no-same-owner -xf "${tarball}" ;;
+    *.zip) unzip "${tarball}" ;;
+    *)
+      log_err "untar unknown archive format for ${tarball}"
+      return 1
+      ;;
+  esac
+}
+http_download_curl() {
+  local_file=$1
+  source_url=$2
+  header=$3
+  if [ -z "$header" ]; then
+    code=$(curl -w '%{http_code}' -sL -o "$local_file" "$source_url")
+  else
+    code=$(curl -w '%{http_code}' -sL -H "$header" -o "$local_file" "$source_url")
+  fi
+  if [ "$code" != "200" ]; then
+    log_debug "http_download_curl received HTTP status $code"
+    return 1
+  fi
+  return 0
+}
+http_download_wget() {
+  local_file=$1
+  source_url=$2
+  header=$3
+  if [ -z "$header" ]; then
+    wget -q -O "$local_file" "$source_url"
+  else
+    wget -q --header "$header" -O "$local_file" "$source_url"
+  fi
+}
+http_download() {
+  log_debug "http_download $2"
+  if is_command curl; then
+    http_download_curl "$@"
+    return
+  elif is_command wget; then
+    http_download_wget "$@"
+    return
+  fi
+  log_crit "http_download unable to find wget or curl"
+  return 1
+}
+http_copy() {
+  tmp=$(mktemp)
+  http_download "${tmp}" "$1" "$2" || return 1
+  body=$(cat "$tmp")
+  rm -f "${tmp}"
+  echo "$body"
+}
+github_release() {
+  owner_repo=$1
+  version=$2
+  test -z "$version" && version="latest"
+  giturl="https://github.com/${owner_repo}/releases/${version}"
+  json=$(http_copy "$giturl" "Accept:application/json")
+  test -z "$json" && return 1
+  version=$(echo "$json" | tr -s '\n' ' ' | sed 's/.*"tag_name":"//' | sed 's/".*//')
+  test -z "$version" && return 1
+  echo "$version"
+}
+hash_sha256() {
+  TARGET=${1:-/dev/stdin}
+  if is_command gsha256sum; then
+    hash=$(gsha256sum "$TARGET") || return 1
+    echo "$hash" | cut -d ' ' -f 1
+  elif is_command sha256sum; then
+    hash=$(sha256sum "$TARGET") || return 1
+    echo "$hash" | cut -d ' ' -f 1
+  elif is_command shasum; then
+    hash=$(shasum -a 256 "$TARGET" 2>/dev/null) || return 1
+    echo "$hash" | cut -d ' ' -f 1
+  elif is_command openssl; then
+    hash=$(openssl -dst openssl dgst -sha256 "$TARGET") || return 1
+    echo "$hash" | cut -d ' ' -f a
+  else
+    log_crit "hash_sha256 unable to find command to compute sha-256 hash"
+    return 1
+  fi
+}
+hash_sha256_verify() {
+  TARGET=$1
+  checksums=$2
+  if [ -z "$checksums" ]; then
+    log_err "hash_sha256_verify checksum file not specified in arg2"
+    return 1
+  fi
+  BASENAME=${TARGET##*/}
+  want=$(grep "${BASENAME}" "${checksums}" 2>/dev/null | tr '\t' ' ' | cut -d ' ' -f 1)
+  if [ -z "$want" ]; then
+    log_err "hash_sha256_verify unable to find checksum for '${TARGET}' in '${checksums}'"
+    return 1
+  fi
+  got=$(hash_sha256 "$TARGET")
+  if [ "$want" != "$got" ]; then
+    log_err "hash_sha256_verify checksum for '$TARGET' did not verify ${want} vs $got"
+    return 1
+  fi
+}
+cat /dev/null <<EOF
+------------------------------------------------------------------------
+End of functions from https://github.com/client9/shlib
+------------------------------------------------------------------------
+EOF
+
+PROJECT_NAME="syft"
+OWNER=anchore
+REPO="syft"
+BINARY=syft
+FORMAT=tar.gz
+OS=$(uname_os)
+ARCH=$(uname_arch)
+PREFIX="$OWNER/$REPO"
+
+# use in logging routines
+log_prefix() {
+	echo "$PREFIX"
+}
+PLATFORM="${OS}/${ARCH}"
+GITHUB_DOWNLOAD=https://github.com/${OWNER}/${REPO}/releases/download
+
+uname_os_check "$OS"
+uname_arch_check "$ARCH"
+
+parse_args "$@"
+
+get_binaries
+
+tag_to_version
+
+adjust_format
+
+adjust_os
+
+adjust_arch
+
+log_info "found version: ${VERSION} for ${TAG}/${OS}/${ARCH}"
+
+NAME=${PROJECT_NAME}_${VERSION}_${OS}_${ARCH}
+TARBALL=${NAME}.${FORMAT}
+TARBALL_URL=${GITHUB_DOWNLOAD}/${TAG}/${TARBALL}
+CHECKSUM=${PROJECT_NAME}_${VERSION}_checksums.txt
+CHECKSUM_URL=${GITHUB_DOWNLOAD}/${TAG}/${CHECKSUM}
+
+
+execute

internal/bus/bus.go

@@ -1,3 +1,16 @@
+/*
+Package bus provides access to a singleton instance of an event bus (provided by the calling application). The event bus
+is intended to allow for the syft library to publish events which library consumers can subscribe to. These events
+can provide static information, but also have an object as a payload for which the consumer can poll for updates.
+This is akin to a logger, except instead of only allowing strings to be logged, rich objects that can be interacted with.
+
+Note that the singleton instance is only allowed to publish events and not subscribe to them --this is intentional.
+Internal library interactions should continue to use traditional in-execution-path approaches for data sharing
+(e.g. function returns and channels) and not depend on bus subscriptions for critical interactions (e.g. one part of the
+lib publishes an event and another part of the lib subscribes and reacts to that event). The bus is provided only as a
+means for consumers to observe events emitted from the library (such as to provide a rich UI) and not to allow
+consumers to augment or otherwise change execution.
+*/
 package bus
 
 import "github.com/wagoodman/go-partybus"
@@ -5,6 +18,8 @@ import "github.com/wagoodman/go-partybus"
 var publisher partybus.Publisher
 var active bool
 
+// SetPublisher sets the singleton event bus publisher. This is optional; if no bus is provided, the library will
+// behave no differently than if a bus had been provided.
 func SetPublisher(p partybus.Publisher) {
 	publisher = p
 	if p != nil {
@@ -12,6 +27,7 @@ func SetPublisher(p partybus.Publisher) {
 	}
 }
 
+// Publish an event onto the bus. If there is no bus set by the calling application, this does nothing.
 func Publish(event partybus.Event) {
 	if active {
 		publisher.Publish(event)

internal/config/config.go

@@ -10,8 +10,8 @@ import (
 	"github.com/anchore/syft/syft/presenter"
 	"github.com/anchore/syft/syft/scope"
 	"github.com/mitchellh/go-homedir"
+	"github.com/sirupsen/logrus"
 	"github.com/spf13/viper"
-	"go.uber.org/zap/zapcore"
 )
 
 type CliOnlyOptions struct {
@@ -28,12 +28,18 @@ type Application struct {
 	Quiet             bool    `mapstructure:"quiet"`
 	Log               Logging `mapstructure:"log"`
 	CliOptions        CliOnlyOptions
-	CheckForAppUpdate bool `mapstructure:"check-for-app-update"`
+	CheckForAppUpdate bool    `mapstructure:"check-for-app-update"`
+	Plugins           Plugins `mapstructure:"plugins"`
+}
+
+type Plugins struct {
+	Enabled   bool   `mapstructure:"enabled"`
+	Directory string `mapstructure:"dir"`
 }
 
 type Logging struct {
 	Structured   bool `mapstructure:"structured"`
-	LevelOpt     zapcore.Level
+	LevelOpt     logrus.Level
 	Level        string `mapstructure:"level"`
 	FileLocation string `mapstructure:"file"`
 }
@@ -88,29 +94,30 @@ func (cfg *Application) Build() error {
 
 	if cfg.Quiet {
 		// TODO: this is bad: quiet option trumps all other logging options
-		// we should be able to quiet the consol logging and leave file logging alone...
+		// we should be able to quiet the console logging and leave file logging alone...
 		// ... this will be an enhancement for later
-		cfg.Log.LevelOpt = zapcore.PanicLevel
+		cfg.Log.LevelOpt = logrus.PanicLevel
 	} else {
 		if cfg.Log.Level != "" {
 			if cfg.CliOptions.Verbosity > 0 {
 				return fmt.Errorf("cannot explicitly set log level (cfg file or env var) and use -v flag together")
 			}
 
-			// set the log level explicitly
-			err := cfg.Log.LevelOpt.Set(cfg.Log.Level)
+			lvl, err := logrus.ParseLevel(strings.ToLower(cfg.Log.Level))
 			if err != nil {
-				return fmt.Errorf("bad log level value '%s': %+v", cfg.Log.Level, err)
+				return fmt.Errorf("bad log level configured (%q): %w", cfg.Log.Level, err)
 			}
+			// set the log level explicitly
+			cfg.Log.LevelOpt = lvl
 		} else {
 			// set the log level implicitly
 			switch v := cfg.CliOptions.Verbosity; {
 			case v == 1:
-				cfg.Log.LevelOpt = zapcore.InfoLevel
+				cfg.Log.LevelOpt = logrus.InfoLevel
 			case v >= 2:
-				cfg.Log.LevelOpt = zapcore.DebugLevel
+				cfg.Log.LevelOpt = logrus.DebugLevel
 			default:
-				cfg.Log.LevelOpt = zapcore.ErrorLevel
+				cfg.Log.LevelOpt = logrus.ErrorLevel
 			}
 		}
 	}

internal/log/log.go

@@ -1,6 +1,8 @@
 package log
 
-import "github.com/anchore/syft/syft/logger"
+import (
+	"github.com/anchore/syft/syft/logger"
+)
 
 var Log logger.Logger = &nopLogger{}
 
@@ -8,6 +10,10 @@ func Errorf(format string, args ...interface{}) {
 	Log.Errorf(format, args...)
 }
 
+func Error(args ...interface{}) {
+	Log.Error(args...)
+}
+
 func Infof(format string, args ...interface{}) {
 	Log.Infof(format, args...)
 }

internal/log/nop.go

@@ -3,6 +3,7 @@ package log
 type nopLogger struct{}
 
 func (l *nopLogger) Errorf(format string, args ...interface{}) {}
+func (l *nopLogger) Error(args ...interface{})                 {}
 func (l *nopLogger) Infof(format string, args ...interface{})  {}
 func (l *nopLogger) Info(args ...interface{})                  {}
 func (l *nopLogger) Debugf(format string, args ...interface{}) {}

internal/logger/hclog_stdlog_adapter.go

@@ -0,0 +1,78 @@
+package logger
+
+import (
+	"bytes"
+	"strings"
+
+	"github.com/hashicorp/go-hclog"
+)
+
+// Source: https://github.com/hashicorp/go-hclog/blob/master/stdlog.go (MIT License)
+
+// Provides a io.Writer to shim the data out of *log.Logger
+// and back into our Logger. This is basically the only way to
+// build upon *log.Logger.
+type HCLogStdlogAdapter struct {
+	log         hclog.Logger
+	inferLevels bool
+	forceLevel  hclog.Level
+}
+
+// Take the data, infer the levels if configured, and send it through
+// a regular Logger.
+func (s *HCLogStdlogAdapter) Write(data []byte) (int, error) {
+	str := string(bytes.TrimRight(data, " \t\n"))
+
+	if s.forceLevel != hclog.NoLevel {
+		// Use pickLevel to strip log levels included in the line since we are
+		// forcing the level
+		_, str := s.pickLevel(str)
+
+		// Log at the forced level
+		s.dispatch(str, s.forceLevel)
+	} else if s.inferLevels {
+		level, str := s.pickLevel(str)
+		s.dispatch(str, level)
+	} else {
+		s.log.Info(str)
+	}
+
+	return len(data), nil
+}
+
+func (s *HCLogStdlogAdapter) dispatch(str string, level hclog.Level) {
+	switch level {
+	case hclog.Trace:
+		s.log.Trace(str)
+	case hclog.Debug:
+		s.log.Debug(str)
+	case hclog.Info:
+		s.log.Info(str)
+	case hclog.Warn:
+		s.log.Warn(str)
+	case hclog.Error:
+		s.log.Error(str)
+	default:
+		s.log.Info(str)
+	}
+}
+
+// Detect, based on conventions, what log level this is.
+func (s *HCLogStdlogAdapter) pickLevel(str string) (hclog.Level, string) {
+	switch {
+	case strings.HasPrefix(str, "[DEBUG]"):
+		return hclog.Debug, strings.TrimSpace(str[7:])
+	case strings.HasPrefix(str, "[TRACE]"):
+		return hclog.Trace, strings.TrimSpace(str[7:])
+	case strings.HasPrefix(str, "[INFO]"):
+		return hclog.Info, strings.TrimSpace(str[6:])
+	case strings.HasPrefix(str, "[WARN]"):
+		return hclog.Warn, strings.TrimSpace(str[7:])
+	case strings.HasPrefix(str, "[ERROR]"):
+		return hclog.Error, strings.TrimSpace(str[7:])
+	case strings.HasPrefix(str, "[ERR]"):
+		return hclog.Error, strings.TrimSpace(str[5:])
+	default:
+		return hclog.Info, str
+	}
+}

internal/logger/logger_hclog_adapter.go

@@ -0,0 +1,148 @@
+package logger
+
+import (
+	"io"
+	"log"
+
+	"github.com/anchore/syft/syft/logger"
+
+	"github.com/hashicorp/go-hclog"
+)
+
+// integrity check
+var _ hclog.Logger = &LoggerHCLogAdapter{}
+
+// LoggerHCLogAdapter is used to (partially) adapt a syft logger.Logger object to the hclog.Logger interface for syft plugins.
+// Note: this does not implement all functionality required by the hclog.Logger.
+type LoggerHCLogAdapter struct {
+	Logger logger.Logger
+}
+
+func NewLoggerHCLogAdapter(logger logger.Logger) *LoggerHCLogAdapter {
+	return &LoggerHCLogAdapter{
+		Logger: logger,
+	}
+}
+
+// Args are alternating key, val pairs
+// keys must be strings
+// vals can be any type, but display is implementation specific
+// Emit a message and key/value pairs at a provided log level
+func (l *LoggerHCLogAdapter) Log(level hclog.Level, msg string, args ...interface{}) {
+	l.Logger.Info(append([]interface{}{msg}, args...)...)
+}
+
+// Emit a message and key/value pairs at the TRACE level
+func (l *LoggerHCLogAdapter) Trace(msg string, args ...interface{}) {
+	l.Logger.Debug(append([]interface{}{msg}, args...)...)
+}
+
+// Emit a message and key/value pairs at the DEBUG level
+func (l *LoggerHCLogAdapter) Debug(msg string, args ...interface{}) {
+	l.Logger.Debug(append([]interface{}{msg}, args...)...)
+}
+
+// Emit a message and key/value pairs at the INFO level
+func (l *LoggerHCLogAdapter) Info(msg string, args ...interface{}) {
+	l.Logger.Info(append([]interface{}{msg}, args...)...)
+}
+
+// Emit a message and key/value pairs at the WARN level
+func (l *LoggerHCLogAdapter) Warn(msg string, args ...interface{}) {
+	l.Logger.Error(append([]interface{}{msg}, args...)...)
+}
+
+// Emit a message and key/value pairs at the ERROR level
+func (l *LoggerHCLogAdapter) Error(msg string, args ...interface{}) {
+	l.Logger.Error(append([]interface{}{msg}, args...)...)
+}
+
+// Indicate if TRACE logs would be emitted. This and the other Is* guards
+// are used to elide expensive logging code based on the current level.
+func (l *LoggerHCLogAdapter) IsTrace() bool {
+	// TODO: not implemented
+	return true
+}
+
+// Indicate if DEBUG logs would be emitted. This and the other Is* guards
+// are used to elide expensive logging code based on the current level.
+func (l *LoggerHCLogAdapter) IsDebug() bool {
+	// TODO: not implemented
+	return true
+}
+
+// Indicate if INFO logs would be emitted. This and the other Is* guards
+// are used to elide expensive logging code based on the current level.
+func (l *LoggerHCLogAdapter) IsInfo() bool {
+	// TODO: not implemented
+	return true
+}
+
+// Indicate if WARN logs would be emitted. This and the other Is* guards
+// are used to elide expensive logging code based on the current level.
+func (l *LoggerHCLogAdapter) IsWarn() bool {
+	// TODO: not implemented
+	return true
+}
+
+// Indicate if ERROR logs would be emitted. This and the other Is* guards
+// are used to elide expensive logging code based on the current level.
+func (l *LoggerHCLogAdapter) IsError() bool {
+	// TODO: not implemented
+	return true
+}
+
+// ImpliedArgs returns With key/value pairs
+func (l *LoggerHCLogAdapter) ImpliedArgs() []interface{} {
+	// TODO: not implemented
+	return nil
+}
+
+// Creates a sublogger that will always have the given key/value pairs
+func (l *LoggerHCLogAdapter) With(args ...interface{}) hclog.Logger {
+	// TODO: not implemented
+	return l
+}
+
+// Returns the Name of the logger
+func (l *LoggerHCLogAdapter) Name() string {
+	// TODO: not implemented
+	return ""
+}
+
+// Create a logger that will prepend the name string on the front of all messages.
+// If the logger already has a name, the new value will be appended to the current
+// name. That way, a major subsystem can use this to decorate all it's own logs
+// without losing context.
+func (l *LoggerHCLogAdapter) Named(name string) hclog.Logger {
+	// TODO: not implemented
+	return l
+}
+
+// Create a logger that will prepend the name string on the front of all messages.
+// This sets the name of the logger to the value directly, unlike Named which honor
+// the current name as well.
+func (l *LoggerHCLogAdapter) ResetNamed(name string) hclog.Logger {
+	// TODO: not implemented
+	return l
+}
+
+// Updates the level. This should affect all sub-loggers as well. If an
+// implementation cannot update the level on the fly, it should no-op.
+func (l *LoggerHCLogAdapter) SetLevel(level hclog.Level) {
+	// TODO: not implemented
+}
+
+// Return a value that conforms to the stdlib log.Logger interface
+func (l *LoggerHCLogAdapter) StandardLogger(opts *hclog.StandardLoggerOptions) *log.Logger {
+	return log.New(l.StandardWriter(opts), "", log.LstdFlags)
+}
+
+// Return a value that conforms to io.Writer, which can be passed into log.SetOutput()
+func (l *LoggerHCLogAdapter) StandardWriter(opts *hclog.StandardLoggerOptions) io.Writer {
+	return &HCLogStdlogAdapter{
+		log:         l,
+		inferLevels: opts.InferLevels,
+		forceLevel:  opts.ForceLevel,
+	}
+}

internal/logger/logrus.go

@@ -0,0 +1,130 @@
+package logger
+
+import (
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+
+	"github.com/anchore/syft/syft/logger"
+	"github.com/sirupsen/logrus"
+	prefixed "github.com/x-cray/logrus-prefixed-formatter"
+)
+
+// integrity check
+var _ logger.Logger = &LogrusLogger{}
+var _ logger.Logger = &LogrusNestedLogger{}
+
+type LogrusConfig struct {
+	EnableConsole bool
+	EnableFile    bool
+	Structured    bool
+	Level         logrus.Level
+	FileLocation  string
+}
+
+type LogrusLogger struct {
+	Config LogrusConfig
+	Logger *logrus.Logger
+	Output io.Writer
+}
+
+type LogrusNestedLogger struct {
+	Logger *logrus.Entry
+}
+
+func NewLogrusLogger(cfg LogrusConfig) *LogrusLogger {
+	appLogger := logrus.New()
+
+	var output io.Writer
+	switch {
+	case cfg.EnableConsole && cfg.EnableFile:
+		logFile, err := os.OpenFile(cfg.FileLocation, os.O_WRONLY|os.O_CREATE, 0755)
+		if err != nil {
+			panic(fmt.Errorf("unable to setup log file: %w", err))
+		}
+		output = io.MultiWriter(os.Stderr, logFile)
+	case cfg.EnableConsole:
+		output = os.Stderr
+	case cfg.EnableFile:
+		logFile, err := os.OpenFile(cfg.FileLocation, os.O_WRONLY|os.O_CREATE, 0755)
+		if err != nil {
+			panic(fmt.Errorf("unable to setup log file: %w", err))
+		}
+		output = logFile
+	default:
+		output = ioutil.Discard
+	}
+
+	appLogger.SetOutput(output)
+	appLogger.SetLevel(cfg.Level)
+
+	if cfg.Structured {
+		appLogger.SetFormatter(&logrus.JSONFormatter{
+			TimestampFormat:   "2006-01-02 15:04:05",
+			DisableTimestamp:  false,
+			DisableHTMLEscape: false,
+			PrettyPrint:       false,
+		})
+	} else {
+		appLogger.SetFormatter(&prefixed.TextFormatter{
+			TimestampFormat: "2006-01-02 15:04:05",
+			ForceColors:     true,
+			ForceFormatting: true,
+		})
+	}
+
+	return &LogrusLogger{
+		Config: cfg,
+		Logger: appLogger,
+		Output: output,
+	}
+}
+
+func (l *LogrusLogger) Errorf(format string, args ...interface{}) {
+	l.Logger.Errorf(format, args...)
+}
+
+func (l *LogrusLogger) Infof(format string, args ...interface{}) {
+	l.Logger.Infof(format, args...)
+}
+
+func (l *LogrusLogger) Debugf(format string, args ...interface{}) {
+	l.Logger.Debugf(format, args...)
+}
+
+func (l *LogrusLogger) Error(args ...interface{}) {
+	l.Logger.Error(args...)
+}
+
+func (l *LogrusLogger) Info(args ...interface{}) {
+	l.Logger.Info(args...)
+}
+
+func (l *LogrusLogger) Debug(args ...interface{}) {
+	l.Logger.Debug(args...)
+}
+
+func (l *LogrusNestedLogger) Errorf(format string, args ...interface{}) {
+	l.Logger.Errorf(format, args...)
+}
+
+func (l *LogrusNestedLogger) Infof(format string, args ...interface{}) {
+	l.Logger.Infof(format, args...)
+}
+
+func (l *LogrusNestedLogger) Debugf(format string, args ...interface{}) {
+	l.Logger.Debugf(format, args...)
+}
+
+func (l *LogrusNestedLogger) Error(args ...interface{}) {
+	l.Logger.Error(args...)
+}
+
+func (l *LogrusNestedLogger) Info(args ...interface{}) {
+	l.Logger.Info(args...)
+}
+
+func (l *LogrusNestedLogger) Debug(args ...interface{}) {
+	l.Logger.Debug(args...)
+}

internal/logger/logrus_hclog_adapter.go

@@ -0,0 +1,181 @@
+package logger
+
+import (
+	"fmt"
+	"io"
+	"log"
+
+	"github.com/hashicorp/go-hclog"
+	"github.com/sirupsen/logrus"
+)
+
+// integrity check
+var _ hclog.Logger = &LogrusHCLogAdapter{}
+
+var levels = map[hclog.Level]logrus.Level{
+	hclog.NoLevel: logrus.PanicLevel,
+	hclog.Error:   logrus.ErrorLevel,
+	hclog.Warn:    logrus.WarnLevel,
+	hclog.Info:    logrus.InfoLevel,
+	hclog.Debug:   logrus.DebugLevel,
+	hclog.Trace:   logrus.TraceLevel,
+}
+
+// LogrusHCLogAdapter is used to adapt a logrus logger object to the hclog.Logger interface for syft plugins.
+type LogrusHCLogAdapter struct {
+	logger *logrus.Logger
+	entry  *logrus.Entry
+}
+
+func NewLogrusHCLogAdapter(logger *logrus.Logger, fields map[string]interface{}) *LogrusHCLogAdapter {
+	if fields != nil {
+		return &LogrusHCLogAdapter{
+			logger: logger,
+			entry:  logger.WithFields(fields),
+		}
+	}
+	return &LogrusHCLogAdapter{
+		logger: logger,
+	}
+}
+
+func (l *LogrusHCLogAdapter) log(level hclog.Level, msg string, args ...interface{}) {
+	if l.entry != nil {
+		l.entry.WithFields(makeArgFields(args...)).Log(levels[level], msg)
+		return
+	}
+	l.logger.WithFields(makeArgFields(args...)).Log(levels[level], msg)
+}
+
+// Args are alternating key, val pairs
+// keys must be strings
+// vals can be any type, but display is implementation specific
+// Emit a message and key/value pairs at a provided log level
+func (l *LogrusHCLogAdapter) Log(level hclog.Level, msg string, args ...interface{}) {
+	l.log(level, msg, args...)
+}
+
+// Emit a message and key/value pairs at the TRACE level
+func (l *LogrusHCLogAdapter) Trace(msg string, args ...interface{}) {
+	l.log(hclog.Trace, msg, args...)
+}
+
+// Emit a message and key/value pairs at the DEBUG level
+func (l *LogrusHCLogAdapter) Debug(msg string, args ...interface{}) {
+	l.log(hclog.Debug, msg, args...)
+}
+
+// Emit a message and key/value pairs at the INFO level
+func (l *LogrusHCLogAdapter) Info(msg string, args ...interface{}) {
+	l.log(hclog.Info, msg, args...)
+}
+
+// Emit a message and key/value pairs at the WARN level
+func (l *LogrusHCLogAdapter) Warn(msg string, args ...interface{}) {
+	l.log(hclog.Warn, msg, args...)
+}
+
+// Emit a message and key/value pairs at the ERROR level
+func (l *LogrusHCLogAdapter) Error(msg string, args ...interface{}) {
+	l.log(hclog.Error, msg, args...)
+}
+
+// Indicate if TRACE logs would be emitted. This and the other Is* guards
+// are used to elide expensive logging code based on the current level.
+func (l *LogrusHCLogAdapter) IsTrace() bool {
+	return l.logger.Level <= logrus.TraceLevel
+}
+
+// Indicate if DEBUG logs would be emitted. This and the other Is* guards
+// are used to elide expensive logging code based on the current level.
+func (l *LogrusHCLogAdapter) IsDebug() bool {
+	return l.logger.Level <= logrus.DebugLevel
+}
+
+// Indicate if INFO logs would be emitted. This and the other Is* guards
+// are used to elide expensive logging code based on the current level.
+func (l *LogrusHCLogAdapter) IsInfo() bool {
+	return l.logger.Level <= logrus.InfoLevel
+}
+
+// Indicate if WARN logs would be emitted. This and the other Is* guards
+// are used to elide expensive logging code based on the current level.
+func (l *LogrusHCLogAdapter) IsWarn() bool {
+	return l.logger.Level <= logrus.WarnLevel
+}
+
+// Indicate if ERROR logs would be emitted. This and the other Is* guards
+// are used to elide expensive logging code based on the current level.
+func (l *LogrusHCLogAdapter) IsError() bool {
+	return l.logger.Level <= logrus.ErrorLevel
+}
+
+// ImpliedArgs returns With key/value pairs
+func (l *LogrusHCLogAdapter) ImpliedArgs() []interface{} {
+	// TODO: not implemented
+	return nil
+}
+
+// Creates a sublogger that will always have the given key/value pairs
+func (l *LogrusHCLogAdapter) With(args ...interface{}) hclog.Logger {
+	l.entry = l.logger.WithFields(makeArgFields(args...))
+	return l
+}
+
+// Returns the Name of the logger
+func (l *LogrusHCLogAdapter) Name() string {
+	// TODO: not implemented
+	return ""
+}
+
+// Create a logger that will prepend the name string on the front of all messages.
+// If the logger already has a name, the new value will be appended to the current
+// name. That way, a major subsystem can use this to decorate all it's own logs
+// without losing context.
+func (l *LogrusHCLogAdapter) Named(name string) hclog.Logger {
+	return NewLogrusHCLogAdapter(l.logger, logrus.Fields{"name": name})
+}
+
+// Create a logger that will prepend the name string on the front of all messages.
+// This sets the name of the logger to the value directly, unlike Named which honor
+// the current name as well.
+func (l *LogrusHCLogAdapter) ResetNamed(name string) hclog.Logger {
+	return NewLogrusHCLogAdapter(l.logger, logrus.Fields{"name": name})
+}
+
+// Updates the level. This should affect all sub-loggers as well. If an
+// implementation cannot update the level on the fly, it should no-op.
+func (l *LogrusHCLogAdapter) SetLevel(level hclog.Level) {
+	l.logger.SetLevel(levels[level])
+}
+
+// Return a value that conforms to the stdlib log.Logger interface
+func (l *LogrusHCLogAdapter) StandardLogger(opts *hclog.StandardLoggerOptions) *log.Logger {
+	return log.New(l.StandardWriter(opts), "", log.LstdFlags)
+}
+
+// Return a value that conforms to io.Writer, which can be passed into log.SetOutput()
+func (l *LogrusHCLogAdapter) StandardWriter(opts *hclog.StandardLoggerOptions) io.Writer {
+	return &HCLogStdlogAdapter{
+		log:         l,
+		inferLevels: opts.InferLevels,
+		forceLevel:  opts.ForceLevel,
+	}
+}
+
+func makeArgFields(args ...interface{}) logrus.Fields {
+	if len(args)%2 != 0 {
+		panic(fmt.Errorf("odd number of logger key-value pairs (%d): %+v", len(args), args))
+	}
+
+	var key string
+	var fields = make(logrus.Fields)
+	for i, arg := range args {
+		if i%2 == 0 {
+			key = arg.(string)
+		} else {
+			fields[key] = arg
+		}
+	}
+	return fields
+}

internal/logger/zap.go

@@ -1,141 +0,0 @@
-package logger
-
-import (
-	"os"
-
-	"github.com/anchore/syft/internal/format"
-	"go.uber.org/zap"
-	"go.uber.org/zap/zapcore"
-)
-
-var levelToColor = map[zapcore.Level]format.Color{
-	zapcore.DebugLevel:  format.Magenta,
-	zapcore.InfoLevel:   format.Blue,
-	zapcore.WarnLevel:   format.Yellow,
-	zapcore.ErrorLevel:  format.Red,
-	zapcore.DPanicLevel: format.Red,
-	zapcore.PanicLevel:  format.Red,
-	zapcore.FatalLevel:  format.Red,
-}
-
-type LogConfig struct {
-	EnableConsole bool
-	EnableFile    bool
-	Structured    bool
-	Level         zapcore.Level
-	FileLocation  string
-}
-
-type ZapLogger struct {
-	Config LogConfig
-	Logger *zap.SugaredLogger
-}
-
-// TODO: Consider a human readable text encoder for better field handeling:
-// - https://github.com/uber-go/zap/issues/570
-// - https://github.com/uber-go/zap/pull/123
-// - TextEncoder w/ old interface: https://github.com/uber-go/zap/blob/6c2107996402d47d559199b78e1c44747fe732f9/text_encoder.go
-// - New interface example: https://github.com/uber-go/zap/blob/c2633d6de2d6e1170ad8f150660e3cf5310067c8/zapcore/json_encoder.go
-// - Register the encoder: https://github.com/uber-go/zap/blob/v1.15.0/encoder.go
-func NewZapLogger(config LogConfig) *ZapLogger {
-	appLogger := ZapLogger{
-		Config: config,
-	}
-	cores := []zapcore.Core{}
-
-	if config.EnableConsole {
-		// note: the report should go to stdout, all logs should go to stderr
-		writer := zapcore.Lock(os.Stderr)
-		core := zapcore.NewCore(appLogger.getConsoleEncoder(config), writer, config.Level)
-		cores = append(cores, core)
-	}
-
-	if config.EnableFile {
-		writer := zapcore.AddSync(appLogger.logFileWriter(config.FileLocation))
-		core := zapcore.NewCore(appLogger.fileEncoder(config), writer, config.Level)
-		cores = append(cores, core)
-	}
-
-	combinedCore := zapcore.NewTee(cores...)
-
-	// AddCallerSkip skips 2 number of callers, this is important else the file that gets
-	// logged will always be the wrapped file (In our case logger.go)
-	appLogger.Logger = zap.New(
-		combinedCore,
-		zap.AddCallerSkip(2),
-		zap.AddCaller(),
-	).Sugar()
-
-	return &appLogger
-}
-
-func (l *ZapLogger) GetNamedLogger(name string) *ZapLogger {
-	return &ZapLogger{
-		Logger: l.Logger.Named(name),
-	}
-}
-
-func (l *ZapLogger) getConsoleEncoder(config LogConfig) zapcore.Encoder {
-	encoderConfig := zap.NewProductionEncoderConfig()
-	if config.Structured {
-		encoderConfig.EncodeName = zapcore.FullNameEncoder
-		encoderConfig.EncodeCaller = zapcore.ShortCallerEncoder
-		return zapcore.NewJSONEncoder(encoderConfig)
-	}
-	encoderConfig.EncodeTime = nil
-	encoderConfig.EncodeCaller = nil
-	encoderConfig.EncodeLevel = l.consoleLevelEncoder
-	encoderConfig.EncodeName = l.nameEncoder
-	return zapcore.NewConsoleEncoder(encoderConfig)
-}
-
-func (l *ZapLogger) nameEncoder(loggerName string, enc zapcore.PrimitiveArrayEncoder) {
-	enc.AppendString("[" + loggerName + "]")
-}
-
-func (l *ZapLogger) consoleLevelEncoder(level zapcore.Level, enc zapcore.PrimitiveArrayEncoder) {
-	if level != zapcore.InfoLevel || l.Config.Level == zapcore.DebugLevel {
-		color, ok := levelToColor[level]
-		if !ok {
-			enc.AppendString("[" + level.CapitalString() + "]")
-		} else {
-			enc.AppendString("[" + color.Format(level.CapitalString()) + "]")
-		}
-	}
-}
-
-func (l *ZapLogger) fileEncoder(config LogConfig) zapcore.Encoder {
-	encoderConfig := zap.NewProductionEncoderConfig()
-	encoderConfig.EncodeTime = zapcore.ISO8601TimeEncoder
-	encoderConfig.EncodeName = zapcore.FullNameEncoder
-	encoderConfig.EncodeCaller = zapcore.FullCallerEncoder
-	if config.Structured {
-		return zapcore.NewJSONEncoder(encoderConfig)
-	}
-	return zapcore.NewConsoleEncoder(encoderConfig)
-}
-
-func (l *ZapLogger) logFileWriter(location string) zapcore.WriteSyncer {
-	file, _ := os.Create(location)
-	return zapcore.AddSync(file)
-}
-
-func (l *ZapLogger) Debugf(format string, args ...interface{}) {
-	l.Logger.Debugf(format, args...)
-}
-
-func (l *ZapLogger) Infof(format string, args ...interface{}) {
-	l.Logger.Infof(format, args...)
-}
-
-func (l *ZapLogger) Debug(args ...interface{}) {
-	l.Logger.Debug(args...)
-}
-
-func (l *ZapLogger) Info(args ...interface{}) {
-	l.Logger.Info(args...)
-}
-
-func (l *ZapLogger) Errorf(format string, args ...interface{}) {
-	l.Logger.Errorf(format, args...)
-}

internal/ui/common/event_handlers.go

@@ -8,6 +8,8 @@ import (
 	"github.com/wagoodman/go-partybus"
 )
 
+// CatalogerFinishedHandler is a UI function for processing the CatalogerFinished bus event, displaying the catalog
+// via the given presenter to stdout.
 func CatalogerFinishedHandler(event partybus.Event) error {
 	// show the report to stdout
 	pres, err := syftEventParsers.ParseCatalogerFinished(event)

internal/ui/common/spinner.go

@@ -1,4 +1,4 @@
-package etui
+package common
 
 import (
 	"strings"

internal/ui/etui/ephemeral_tui.go

@@ -1,21 +1,45 @@
+/*
+Package etui provides an "ephemeral" terminal user interface to display the application state dynamically.
+The terminal is placed into raw mode and the cursor is manipulated to allow for a dynamic, multi-line
+UI (provided by the jotframe lib), for this reason all other application mechanisms that write to the screen
+must be suppressed before starting (such as logs); since bytes in the device and in application memory combine to make
+a shared state, bytes coming from elsewhere to the screen will disrupt this state.
+
+This UI is primarily driven off of events from the event bus, creating single-line terminal widgets to represent a
+published element on the event bus, typically polling the element for the latest state. This allows for the UI to
+control update frequency to the screen, provide "liveness" indications that are interpolated between bus events,
+and overall loosely couple the bus events from screen interactions.
+
+By convention, all elements published on the bus should be treated as read-only, and publishers on the bus should
+attempt to enforce this when possible by wrapping complex objects with interfaces to prescribe interactions. Also by
+convention, each new event that the UI should respond to should be added either in this package as a handler function,
+or in the shared ui package as a function on the main handler object. All handler functions should be completed
+processing an event before the ETUI exits (coordinated with a sync.WaitGroup)
+*/
 package etui
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"os"
 	"sync"
 
-	stereoscopeEvent "github.com/anchore/stereoscope/pkg/event"
-	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/logger"
+
 	"github.com/anchore/syft/internal/ui/common"
+	"github.com/anchore/syft/ui"
+
+	"github.com/anchore/syft/internal/log"
 	syftEvent "github.com/anchore/syft/syft/event"
 	"github.com/wagoodman/go-partybus"
 	"github.com/wagoodman/jotframe/pkg/frame"
 )
 
-// TODO: specify per-platform implementations with build tags
+// TODO: specify per-platform implementations with build tags (needed when windows is supported by syft)
 
+// setupScreen creates a new jotframe object to manage specific screen lines dynamically, preparing the screen device
+// as needed (i.e. setting the terminal to raw mode).
 func setupScreen(output *os.File) *frame.Frame {
 	config := frame.Config{
 		PositionPolicy: frame.PolicyFloatForward,
@@ -32,9 +56,18 @@ func setupScreen(output *os.File) *frame.Frame {
 }
 
 // nolint:funlen,gocognit
+// OutputToEphemeralTUI is a UI function that provides a terminal UI experience without a separate, in-application
+// screen buffer. All logging is suppressed, buffered to a string, and output after the ETUI has been torn down.
 func OutputToEphemeralTUI(workerErrs <-chan error, subscription *partybus.Subscription) error {
 	output := os.Stderr
 
+	// prep the logger to not clobber the screen from now on (logrus only)
+	logBuffer := bytes.NewBufferString("")
+	logWrapper, ok := log.Log.(*logger.LogrusLogger)
+	if ok {
+		logWrapper.Logger.SetOutput(logBuffer)
+	}
+
 	// hide cursor
 	_, _ = fmt.Fprint(output, "\x1b[?25l")
 	// show cursor
@@ -47,7 +80,19 @@ func OutputToEphemeralTUI(workerErrs <-chan error, subscription *partybus.Subscr
 	var isClosed bool
 	defer func() {
 		if !isClosed {
+			fr.Close()
 			frame.Close()
+			// flush any errors to the screen before the report
+			logWrapper, ok := log.Log.(*logger.LogrusLogger)
+			if ok {
+				fmt.Fprint(logWrapper.Output, logBuffer.String())
+			} else {
+				fmt.Fprint(output, logBuffer.String())
+			}
+		}
+		logWrapper, ok := log.Log.(*logger.LogrusLogger)
+		if ok {
+			logWrapper.Logger.SetOutput(output)
 		}
 	}()
 
@@ -55,11 +100,13 @@ func OutputToEphemeralTUI(workerErrs <-chan error, subscription *partybus.Subscr
 	var wg = &sync.WaitGroup{}
 	events := subscription.Events()
 	ctx := context.Background()
+	syftUIHandler := ui.NewHandler()
 
 eventLoop:
 	for {
 		select {
 		case err := <-workerErrs:
+			// TODO: we should show errors more explicitly in the ETUI
 			if err != nil {
 				return err
 			}
@@ -67,41 +114,36 @@ eventLoop:
 			if !ok {
 				break eventLoop
 			}
-			switch e.Type {
-			case syftEvent.AppUpdateAvailable:
-				err = appUpdateAvailableHandler(ctx, fr, e, wg)
-				if err != nil {
-					log.Errorf("unable to show AppUpdateAvailable event: %+v", err)
+			switch {
+			case syftUIHandler.RespondsTo(e):
+				if err = syftUIHandler.Handle(ctx, fr, e, wg); err != nil {
+					log.Errorf("unable to show %s event: %+v", e.Type, err)
 				}
 
-			case stereoscopeEvent.ReadImage:
-				err = imageReadHandler(ctx, fr, e, wg)
-				if err != nil {
-					log.Errorf("unable to show ReadImage event: %+v", err)
+			case e.Type == syftEvent.AppUpdateAvailable:
+				if err = appUpdateAvailableHandler(ctx, fr, e, wg); err != nil {
+					log.Errorf("unable to show %s event: %+v", e.Type, err)
 				}
 
-			case stereoscopeEvent.FetchImage:
-				err = imageFetchHandler(ctx, fr, e, wg)
-				if err != nil {
-					log.Errorf("unable to show FetchImage event: %+v", err)
-				}
-
-			case syftEvent.CatalogerStarted:
-				err = catalogerStartedHandler(ctx, fr, e, wg)
-				if err != nil {
-					log.Errorf("unable to show CatalogerStarted event: %+v", err)
-				}
-			case syftEvent.CatalogerFinished:
+			case e.Type == syftEvent.CatalogerFinished:
 				// we may have other background processes still displaying progress, wait for them to
 				// finish before discontinuing dynamic content and showing the final report
 				wg.Wait()
+				fr.Close()
+				// TODO: there is a race condition within frame.Close() that sometimes leads to an extra blank line being output
 				frame.Close()
 				isClosed = true
-				fmt.Println()
 
-				err := common.CatalogerFinishedHandler(e)
-				if err != nil {
-					log.Errorf("unable to show CatalogerFinished event: %+v", err)
+				// flush any errors to the screen before the report
+				logWrapper, ok := log.Log.(*logger.LogrusLogger)
+				if ok {
+					fmt.Fprint(logWrapper.Output, logBuffer.String())
+				} else {
+					fmt.Fprint(output, logBuffer.String())
+				}
+
+				if err := common.CatalogerFinishedHandler(e); err != nil {
+					log.Errorf("unable to show %s event: %+v", e.Type, err)
 				}
 
 				// this is the last expected event

internal/ui/etui/event_handlers.go

@@ -1,162 +0,0 @@
-package etui
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"sync"
-	"time"
-
-	stereoEventParsers "github.com/anchore/stereoscope/pkg/event/parsers"
-	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
-	"github.com/gookit/color"
-	"github.com/wagoodman/go-partybus"
-	"github.com/wagoodman/go-progress"
-	"github.com/wagoodman/go-progress/format"
-	"github.com/wagoodman/jotframe/pkg/frame"
-)
-
-const maxBarWidth = 50
-const statusSet = SpinnerDotSet // SpinnerCircleOutlineSet
-const completedStatus = "✔"     //"●"
-const tileFormat = color.Bold
-const statusTitleTemplate = " %s %-28s "
-
-var auxInfoFormat = color.HEX("#777777")
-
-func startProcess() (format.Simple, *Spinner) {
-	width, _ := frame.GetTerminalSize()
-	barWidth := int(0.25 * float64(width))
-	if barWidth > maxBarWidth {
-		barWidth = maxBarWidth
-	}
-	formatter := format.NewSimpleWithTheme(barWidth, format.HeavyNoBarTheme, format.ColorCompleted, format.ColorTodo)
-	spinner := NewSpinner(statusSet)
-
-	return formatter, &spinner
-}
-
-func imageFetchHandler(ctx context.Context, fr *frame.Frame, event partybus.Event, wg *sync.WaitGroup) error {
-	_, prog, err := stereoEventParsers.ParseFetchImage(event)
-	if err != nil {
-		return fmt.Errorf("bad FetchImage event: %w", err)
-	}
-
-	line, err := fr.Append()
-	if err != nil {
-		return err
-	}
-
-	wg.Add(1)
-
-	go func() {
-		defer wg.Done()
-		formatter, spinner := startProcess()
-		stream := progress.Stream(ctx, prog, 150*time.Millisecond)
-		title := tileFormat.Sprint("Fetching image...")
-
-		for p := range stream {
-			progStr, err := formatter.Format(p)
-			spin := color.Magenta.Sprint(spinner.Next())
-			if err != nil {
-				_, _ = io.WriteString(line, fmt.Sprintf("Error: %+v", err))
-			} else {
-				auxInfo := auxInfoFormat.Sprintf("[%s]", prog.Stage())
-				_, _ = io.WriteString(line, fmt.Sprintf(statusTitleTemplate+"%s %s", spin, title, progStr, auxInfo))
-			}
-		}
-
-		spin := color.Green.Sprint(completedStatus)
-		title = tileFormat.Sprint("Fetched image")
-		_, _ = io.WriteString(line, fmt.Sprintf(statusTitleTemplate, spin, title))
-	}()
-	return err
-}
-
-func imageReadHandler(ctx context.Context, fr *frame.Frame, event partybus.Event, wg *sync.WaitGroup) error {
-	_, prog, err := stereoEventParsers.ParseReadImage(event)
-	if err != nil {
-		return fmt.Errorf("bad ReadImage event: %w", err)
-	}
-
-	line, err := fr.Append()
-	if err != nil {
-		return err
-	}
-
-	wg.Add(1)
-
-	go func() {
-		defer wg.Done()
-		formatter, spinner := startProcess()
-		stream := progress.Stream(ctx, prog, 150*time.Millisecond)
-		title := tileFormat.Sprint("Reading image...")
-
-		for p := range stream {
-			progStr, err := formatter.Format(p)
-			spin := color.Magenta.Sprint(spinner.Next())
-			if err != nil {
-				_, _ = io.WriteString(line, fmt.Sprintf("Error: %+v", err))
-			} else {
-				_, _ = io.WriteString(line, fmt.Sprintf(statusTitleTemplate+"%s", spin, title, progStr))
-			}
-		}
-
-		spin := color.Green.Sprint(completedStatus)
-		title = tileFormat.Sprint("Read image")
-		_, _ = io.WriteString(line, fmt.Sprintf(statusTitleTemplate, spin, title))
-	}()
-
-	return nil
-}
-
-func catalogerStartedHandler(ctx context.Context, fr *frame.Frame, event partybus.Event, wg *sync.WaitGroup) error {
-	monitor, err := syftEventParsers.ParseCatalogerStarted(event)
-	if err != nil {
-		return fmt.Errorf("bad CatalogerStarted event: %w", err)
-	}
-
-	line, err := fr.Append()
-	if err != nil {
-		return err
-	}
-
-	wg.Add(1)
-
-	go func() {
-		defer wg.Done()
-		_, spinner := startProcess()
-		stream := progress.StreamMonitors(ctx, []progress.Monitorable{monitor.FilesProcessed, monitor.PackagesDiscovered}, 50*time.Millisecond)
-		title := tileFormat.Sprint("Cataloging image...")
-
-		for p := range stream {
-			spin := color.Magenta.Sprint(spinner.Next())
-			auxInfo := auxInfoFormat.Sprintf("[packages %d]", p[1])
-			_, _ = io.WriteString(line, fmt.Sprintf(statusTitleTemplate+"%s", spin, title, auxInfo))
-		}
-
-		spin := color.Green.Sprint(completedStatus)
-		title = tileFormat.Sprint("Cataloged image")
-		auxInfo := auxInfoFormat.Sprintf("[%d packages]", monitor.PackagesDiscovered.Current())
-		_, _ = io.WriteString(line, fmt.Sprintf(statusTitleTemplate+"%s", spin, title, auxInfo))
-	}()
-
-	return nil
-}
-
-func appUpdateAvailableHandler(_ context.Context, fr *frame.Frame, event partybus.Event, _ *sync.WaitGroup) error {
-	newVersion, err := syftEventParsers.ParseAppUpdateAvailable(event)
-	if err != nil {
-		return fmt.Errorf("bad AppUpdateAvailable event: %w", err)
-	}
-
-	line, err := fr.Prepend()
-	if err != nil {
-		return err
-	}
-
-	message := color.Magenta.Sprintf("New Update Available: %s", newVersion)
-	_, _ = io.WriteString(line, message)
-
-	return nil
-}

internal/ui/etui/internal_event_handlers.go

@@ -0,0 +1,32 @@
+package etui
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"sync"
+
+	"github.com/anchore/syft/internal"
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+	"github.com/gookit/color"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/jotframe/pkg/frame"
+)
+
+// appUpdateAvailableHandler is a UI handler function to display a new application version to the top of the screen.
+func appUpdateAvailableHandler(_ context.Context, fr *frame.Frame, event partybus.Event, _ *sync.WaitGroup) error {
+	newVersion, err := syftEventParsers.ParseAppUpdateAvailable(event)
+	if err != nil {
+		return fmt.Errorf("bad AppUpdateAvailable event: %w", err)
+	}
+
+	line, err := fr.Prepend()
+	if err != nil {
+		return err
+	}
+
+	message := color.Magenta.Sprintf("New version of %s is available: %s", internal.ApplicationName, newVersion)
+	_, _ = io.WriteString(line, message)
+
+	return nil
+}

internal/ui/logger_output.go

@@ -7,6 +7,7 @@ import (
 	"github.com/wagoodman/go-partybus"
 )
 
+// LoggerUI is a UI function that leverages the displays all application logs to the screen.
 func LoggerUI(workerErrs <-chan error, subscription *partybus.Subscription) error {
 	events := subscription.Events()
 eventLoop:

internal/ui/select.go

@@ -10,6 +10,8 @@ import (
 
 // TODO: build tags to exclude options from windows
 
+// Select is responsible for determining the specific UI function given select user option, the current platform
+// config values, and environment status (such as a TTY being present).
 func Select(verbose, quiet bool) UI {
 	var ui UI
 

internal/ui/ui.go

@@ -4,4 +4,6 @@ import (
 	"github.com/wagoodman/go-partybus"
 )
 
+// UI is a function that takes a channel of errors from the main() worker and a event bus subscription and is
+// responsible for displaying pertinent events to the user, on the screen or otherwise.
 type UI func(<-chan error, *partybus.Subscription) error

internal/version/build.go

@@ -7,22 +7,25 @@ import (
 
 const valueNotProvided = "[not provided]"
 
+// all variables here are provided as build-time arguments, with clear default values
 var version = valueNotProvided
 var gitCommit = valueNotProvided
 var gitTreeState = valueNotProvided
 var buildDate = valueNotProvided
 var platform = fmt.Sprintf("%s/%s", runtime.GOOS, runtime.GOARCH)
 
+// Version defines the application version details (generally from build information)
 type Version struct {
-	Version      string
-	GitCommit    string
-	GitTreeState string
-	BuildDate    string
-	GoVersion    string
-	Compiler     string
-	Platform     string
+	Version      string // application semantic version
+	GitCommit    string // git SHA at build-time
+	GitTreeState string // indication of git tree (either "clean" or "dirty") at build-time
+	BuildDate    string // date of the build
+	GoVersion    string // go runtime version at build-time
+	Compiler     string // compiler used at build-time
+	Platform     string // GOOS and GOARCH at build-time
 }
 
+// FromBuild provides all version details
 func FromBuild() Version {
 	return Version{
 		Version:      version,

main.go

@@ -1,3 +1,8 @@
+/*
+Syft is a CLI tool and go library for generating a Software Bill of Materials (SBOM) from container images and filesystems.
+
+Note that Syft is both a command line tool as well as a library. See the syft/ child package for library functionality.
+*/
 package main
 
 import (

resources/shell-completion.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+
+# Source this file in your shell sessions in order to use this shell completion.
+
+complete -W "$(docker images --format '{{.Repository}}:{{.Tag}}')" syft

schema/cyclonedx/.gitignore

@@ -0,0 +1 @@
+bom.xml

schema/cyclonedx/Makefile

@@ -0,0 +1,5 @@
+.DEFAULT_GOAL := validate-schema
+.PHONY: validate-schema
+validate-schema:
+	go run ../../main.go ubuntu:latest -vv -o cyclonedx > bom.xml
+	xmllint --noout --schema ./cyclonedx.xsd bom.xml

schema/cyclonedx/README.md

@@ -0,0 +1,7 @@
+# CycloneDX Schemas
+
+`syft` generates a CycloneDX BOm output. We want to be able to validate the CycloneDX schemas
+(and dependent schemas) against generated syft output. The best way to do this is with `xmllint`,
+however, this tool does not know how to deal with references from HTTP, only the local filesystem.
+For this reason we've included a copy of all schemas needed to validate `syft` output, modified
+to reference local copies of dependent schemas.

schema/cyclonedx/bd.xsd

@@ -0,0 +1,183 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+CycloneDX BOM Descriptor Extension
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
+           xmlns:vc="http://www.w3.org/2007/XMLSchema-versioning"
+           xmlns:bom="http://cyclonedx.org/schema/bom/1.1"
+           xmlns:bd="http://cyclonedx.org/schema/ext/bom-descriptor/1.0"
+           elementFormDefault="qualified"
+           targetNamespace="http://cyclonedx.org/schema/ext/bom-descriptor/1.0"
+           vc:minVersion="1.0"
+           vc:maxVersion="1.1"
+           version="1.0">
+
+  <xs:annotation>
+    <xs:documentation>
+      <name>CycloneDX BOM Descriptor Extension</name>
+      <url>https://cyclonedx.org/ext/bom-descriptor</url>
+      <license uri="http://www.apache.org/licenses/LICENSE-2.0"
+               version="2.0">Apache License, Version 2.0</license>
+      <authors>
+        <author>Steve Springett</author>
+      </authors>
+    </xs:documentation>
+  </xs:annotation>
+
+  <xs:import namespace="http://cyclonedx.org/schema/bom/1.1" schemaLocation="http://cyclonedx.org/schema/bom/1.1"/>
+
+  <xs:complexType name="metadata">
+    <xs:sequence minOccurs="0" maxOccurs="1">
+      <xs:element name="timestamp" type="xs:dateTime" minOccurs="0">
+        <xs:annotation>
+          <xs:documentation>The date and time (timestamp) when the document was created.</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+      <xs:element name="tool" minOccurs="0" type="bd:toolType">
+        <xs:annotation>
+          <xs:documentation>The tool used to create the BOM.</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+      <xs:element name="authors" minOccurs="0" maxOccurs="1">
+        <xs:annotation>
+          <xs:documentation>The person(s) who created the BOM. Authors are common in BOMs created through
+            manual processes. BOMs created through automated means may not have authors.</xs:documentation>
+        </xs:annotation>
+        <xs:complexType>
+          <xs:sequence minOccurs="0" maxOccurs="unbounded">
+            <xs:element name="author" type="bd:organizationalPerson"/>
+          </xs:sequence>
+        </xs:complexType>
+      </xs:element>
+      <xs:element name="component" type="bom:component" minOccurs="0">
+        <xs:annotation>
+          <xs:documentation>The component that the BOM describes.</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+      <xs:element name="manufacture" type="bd:organizationalEntity" minOccurs="0" maxOccurs="unbounded">
+        <xs:annotation>
+          <xs:documentation>The organization that manufactured the component that the BOM describes.</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+      <xs:element name="supplier" type="bd:organizationalEntity" minOccurs="0" maxOccurs="unbounded">
+        <xs:annotation>
+          <xs:documentation>The organization that supplied the component that the BOM describes. The
+            supplier may often be the manufacture, but may also be a distributor or repackager.</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+    </xs:sequence>
+    <xs:anyAttribute namespace="##other" processContents="lax">
+      <xs:annotation>
+        <xs:documentation>User-defined attributes may be used on this element as long as they
+          do not have the same name as an existing attribute used by the schema.</xs:documentation>
+      </xs:annotation>
+    </xs:anyAttribute>
+  </xs:complexType>
+
+  <xs:complexType name="organizationalEntity">
+    <xs:sequence minOccurs="0" maxOccurs="1">
+      <xs:element name="name" type="xs:normalizedString" minOccurs="0" maxOccurs="1">
+        <xs:annotation>
+          <xs:documentation>The name of the organization</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+      <xs:element name="url" type="xs:anyURI" minOccurs="0" maxOccurs="unbounded">
+        <xs:annotation>
+          <xs:documentation>The URL of the organization. Multiple URLs are allowed.</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+      <xs:element name="contact" type="bd:organizationalPerson" minOccurs="0" maxOccurs="unbounded">
+        <xs:annotation>
+          <xs:documentation>A contact person at the organization. Multiple contacts are allowed.</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+    </xs:sequence>
+    <xs:anyAttribute namespace="##other" processContents="lax">
+      <xs:annotation>
+        <xs:documentation>User-defined attributes may be used on this element as long as they
+          do not have the same name as an existing attribute used by the schema.</xs:documentation>
+      </xs:annotation>
+    </xs:anyAttribute>
+  </xs:complexType>
+
+  <xs:complexType name="toolType">
+    <xs:annotation>
+      <xs:documentation>Specifies a tool (manual or automated).</xs:documentation>
+    </xs:annotation>
+    <xs:sequence minOccurs="0" maxOccurs="1">
+      <xs:element name="vendor" minOccurs="0" maxOccurs="1" type="xs:normalizedString">
+        <xs:annotation>
+          <xs:documentation>The vendor of the tool used to create the BOM.</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+      <xs:element name="name" minOccurs="0" maxOccurs="1" type="xs:normalizedString">
+        <xs:annotation>
+          <xs:documentation>The name of the tool used to create the BOM.</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+      <xs:element name="version" minOccurs="0" maxOccurs="1" type="xs:normalizedString">
+        <xs:annotation>
+          <xs:documentation>The version of the tool used to create the BOM.</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+      <xs:element name="hashes" minOccurs="0" maxOccurs="1">
+        <xs:complexType>
+          <xs:sequence minOccurs="0" maxOccurs="unbounded">
+            <xs:element name="hash" type="bom:hashType"/>
+          </xs:sequence>
+        </xs:complexType>
+      </xs:element>
+    </xs:sequence>
+    <xs:anyAttribute namespace="##other" processContents="lax">
+      <xs:annotation>
+        <xs:documentation>User-defined attributes may be used on this element as long as they
+          do not have the same name as an existing attribute used by the schema.</xs:documentation>
+      </xs:annotation>
+    </xs:anyAttribute>
+  </xs:complexType>
+
+  <xs:complexType name="organizationalPerson">
+    <xs:sequence minOccurs="0" maxOccurs="1">
+      <xs:element name="name" type="xs:normalizedString" minOccurs="0" maxOccurs="1">
+        <xs:annotation>
+          <xs:documentation>The name of the person</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+      <xs:element name="email" type="xs:normalizedString" minOccurs="0" maxOccurs="unbounded">
+        <xs:annotation>
+          <xs:documentation>The email address of the person. Multiple email addresses are allowed.</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+      <xs:element name="phone" type="xs:normalizedString" minOccurs="0" maxOccurs="unbounded">
+        <xs:annotation>
+          <xs:documentation>The phone number of the person. Multiple phone numbers are allowed.</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+    </xs:sequence>
+    <xs:anyAttribute namespace="##other" processContents="lax">
+      <xs:annotation>
+        <xs:documentation>User-defined attributes may be used on this element as long as they
+          do not have the same name as an existing attribute used by the schema.</xs:documentation>
+      </xs:annotation>
+    </xs:anyAttribute>
+  </xs:complexType>
+
+  <xs:element name="metadata" type="bd:metadata">
+    <xs:annotation>
+      <xs:documentation>Provides additional information about a BOM.</xs:documentation>
+    </xs:annotation>
+  </xs:element>
+
+</xs:schema>

schema/json/.gitignore

@@ -0,0 +1 @@
+examples/

schema/json/generate.py

@@ -0,0 +1,30 @@
+#!/usr/env/bin python3
+import os
+import glob
+import json
+
+from genson import SchemaBuilder
+
+EXAMPLES_DIR = "examples/"
+OUTPUT = "schema.json"
+
+
+def main():
+    builder = SchemaBuilder()
+
+    print("Generating new Syft json schema...")
+    for filepath in glob.glob(os.path.join(EXAMPLES_DIR, '*.json')):
+        with open(filepath, 'r') as f:
+            print(f"  adding {filepath}")
+            builder.add_object(json.loads(f.read()))
+
+    print("Building schema...")
+    new_schema = builder.to_schema()
+    with open(OUTPUT, 'w') as f:
+        f.write(json.dumps(new_schema, sort_keys=True, indent=4))
+
+    print(f"New schema written to '{OUTPUT}'")
+
+
+if __name__ == "__main__":
+    main()

schema/json/requirements.txt

@@ -0,0 +1 @@
+genson

schema/json/schema.json

@@ -0,0 +1,534 @@
+{
+    "$schema": "http://json-schema.org/schema#",
+    "properties": {
+        "artifacts": {
+            "items": {
+                "properties": {
+                    "found-by": {
+                        "items": {
+                            "type": "string"
+                        },
+                        "type": "array"
+                    },
+                    "locations": {
+                        "items": {
+                            "anyOf": [
+                                {
+                                    "type": "string"
+                                },
+                                {
+                                    "properties": {
+                                        "layer-index": {
+                                            "type": "integer"
+                                        },
+                                        "path": {
+                                            "type": "string"
+                                        }
+                                    },
+                                    "required": [
+                                        "layer-index",
+                                        "path"
+                                    ],
+                                    "type": "object"
+                                }
+                            ]
+                        },
+                        "type": "array"
+                    },
+                    "metadata": {
+                        "properties": {
+                            "architecture": {
+                                "type": "string"
+                            },
+                            "description": {
+                                "type": "string"
+                            },
+                            "epoch": {
+                                "type": "integer"
+                            },
+                            "files": {
+                                "items": {
+                                    "properties": {
+                                        "checksum": {
+                                            "type": "string"
+                                        },
+                                        "owner-gid": {
+                                            "type": "string"
+                                        },
+                                        "owner-uid": {
+                                            "type": "string"
+                                        },
+                                        "path": {
+                                            "type": "string"
+                                        },
+                                        "permissions": {
+                                            "type": "string"
+                                        }
+                                    },
+                                    "required": [
+                                        "checksum",
+                                        "owner-gid",
+                                        "owner-uid",
+                                        "path",
+                                        "permissions"
+                                    ],
+                                    "type": "object"
+                                },
+                                "type": "array"
+                            },
+                            "git-commit-of-apk-port": {
+                                "type": "string"
+                            },
+                            "installed-size": {
+                                "type": "integer"
+                            },
+                            "license": {
+                                "type": "string"
+                            },
+                            "maintainer": {
+                                "type": "string"
+                            },
+                            "manifest": {
+                                "anyOf": [
+                                    {
+                                        "type": "null"
+                                    },
+                                    {
+                                        "properties": {
+                                            "extra-fields": {
+                                                "properties": {
+                                                    "Archiver-Version": {
+                                                        "type": "string"
+                                                    },
+                                                    "Build-Jdk": {
+                                                        "type": "string"
+                                                    },
+                                                    "Built-By": {
+                                                        "type": "string"
+                                                    },
+                                                    "Created-By": {
+                                                        "type": "string"
+                                                    },
+                                                    "Extension-Name": {
+                                                        "type": "string"
+                                                    },
+                                                    "Group-Id": {
+                                                        "type": "string"
+                                                    },
+                                                    "Hudson-Version": {
+                                                        "type": "string"
+                                                    },
+                                                    "Jenkins-Version": {
+                                                        "type": "string"
+                                                    },
+                                                    "Long-Name": {
+                                                        "type": "string"
+                                                    },
+                                                    "Main-Class": {
+                                                        "type": "string"
+                                                    },
+                                                    "Minimum-Java-Version": {
+                                                        "type": "string"
+                                                    },
+                                                    "Plugin-Dependencies": {
+                                                        "type": "string"
+                                                    },
+                                                    "Plugin-Developers": {
+                                                        "type": "string"
+                                                    },
+                                                    "Plugin-License-Name": {
+                                                        "type": "string"
+                                                    },
+                                                    "Plugin-License-Url": {
+                                                        "type": "string"
+                                                    },
+                                                    "Plugin-ScmUrl": {
+                                                        "type": "string"
+                                                    },
+                                                    "Plugin-Version": {
+                                                        "type": "string"
+                                                    },
+                                                    "Short-Name": {
+                                                        "type": "string"
+                                                    }
+                                                },
+                                                "required": [
+                                                    "Archiver-Version",
+                                                    "Build-Jdk",
+                                                    "Built-By",
+                                                    "Created-By"
+                                                ],
+                                                "type": "object"
+                                            },
+                                            "implementation-title": {
+                                                "type": "string"
+                                            },
+                                            "implementation-vendor": {
+                                                "type": "string"
+                                            },
+                                            "implementation-version": {
+                                                "type": "string"
+                                            },
+                                            "manifest-version": {
+                                                "type": "string"
+                                            },
+                                            "name": {
+                                                "type": "string"
+                                            },
+                                            "specification-title": {
+                                                "type": "string"
+                                            },
+                                            "specification-vendor": {
+                                                "type": "string"
+                                            },
+                                            "specification-version": {
+                                                "type": "string"
+                                            }
+                                        },
+                                        "required": [
+                                            "extra-fields",
+                                            "implementation-title",
+                                            "implementation-vendor",
+                                            "implementation-version",
+                                            "manifest-version",
+                                            "name",
+                                            "specification-title",
+                                            "specification-vendor",
+                                            "specification-version"
+                                        ],
+                                        "type": "object"
+                                    }
+                                ]
+                            },
+                            "origin-package": {
+                                "type": "string"
+                            },
+                            "package": {
+                                "type": "string"
+                            },
+                            "parent-package": {
+                                "anyOf": [
+                                    {
+                                        "type": "null"
+                                    },
+                                    {
+                                        "properties": {
+                                            "found-by": {
+                                                "type": "string"
+                                            },
+                                            "language": {
+                                                "type": "integer"
+                                            },
+                                            "licenses": {
+                                                "type": "null"
+                                            },
+                                            "manifest": {
+                                                "type": "string"
+                                            },
+                                            "metadata": {
+                                                "properties": {
+                                                    "manifest": {
+                                                        "properties": {
+                                                            "extra-fields": {
+                                                                "properties": {
+                                                                    "Archiver-Version": {
+                                                                        "type": "string"
+                                                                    },
+                                                                    "Build-Jdk": {
+                                                                        "type": "string"
+                                                                    },
+                                                                    "Built-By": {
+                                                                        "type": "string"
+                                                                    },
+                                                                    "Created-By": {
+                                                                        "type": "string"
+                                                                    },
+                                                                    "Extension-Name": {
+                                                                        "type": "string"
+                                                                    },
+                                                                    "Group-Id": {
+                                                                        "type": "string"
+                                                                    },
+                                                                    "Hudson-Version": {
+                                                                        "type": "string"
+                                                                    },
+                                                                    "Jenkins-Version": {
+                                                                        "type": "string"
+                                                                    },
+                                                                    "Long-Name": {
+                                                                        "type": "string"
+                                                                    },
+                                                                    "Main-Class": {
+                                                                        "type": "string"
+                                                                    },
+                                                                    "Minimum-Java-Version": {
+                                                                        "type": "string"
+                                                                    },
+                                                                    "Plugin-Dependencies": {
+                                                                        "type": "string"
+                                                                    },
+                                                                    "Plugin-Developers": {
+                                                                        "type": "string"
+                                                                    },
+                                                                    "Plugin-License-Name": {
+                                                                        "type": "string"
+                                                                    },
+                                                                    "Plugin-License-Url": {
+                                                                        "type": "string"
+                                                                    },
+                                                                    "Plugin-ScmUrl": {
+                                                                        "type": "string"
+                                                                    },
+                                                                    "Plugin-Version": {
+                                                                        "type": "string"
+                                                                    },
+                                                                    "Short-Name": {
+                                                                        "type": "string"
+                                                                    }
+                                                                },
+                                                                "required": [
+                                                                    "Archiver-Version",
+                                                                    "Build-Jdk",
+                                                                    "Built-By",
+                                                                    "Created-By"
+                                                                ],
+                                                                "type": "object"
+                                                            },
+                                                            "implementation-title": {
+                                                                "type": "string"
+                                                            },
+                                                            "implementation-vendor": {
+                                                                "type": "string"
+                                                            },
+                                                            "implementation-version": {
+                                                                "type": "string"
+                                                            },
+                                                            "manifest-version": {
+                                                                "type": "string"
+                                                            },
+                                                            "name": {
+                                                                "type": "string"
+                                                            },
+                                                            "specification-title": {
+                                                                "type": "string"
+                                                            },
+                                                            "specification-vendor": {
+                                                                "type": "string"
+                                                            },
+                                                            "specification-version": {
+                                                                "type": "string"
+                                                            }
+                                                        },
+                                                        "required": [
+                                                            "extra-fields",
+                                                            "implementation-title",
+                                                            "implementation-vendor",
+                                                            "implementation-version",
+                                                            "manifest-version",
+                                                            "name",
+                                                            "specification-title",
+                                                            "specification-vendor",
+                                                            "specification-version"
+                                                        ],
+                                                        "type": "object"
+                                                    },
+                                                    "parent-package": {
+                                                        "type": "null"
+                                                    },
+                                                    "pom-properties": {
+                                                        "properties": {
+                                                            "Path": {
+                                                                "type": "string"
+                                                            },
+                                                            "artifact-id": {
+                                                                "type": "string"
+                                                            },
+                                                            "extra-fields": {
+                                                                "type": "null"
+                                                            },
+                                                            "group-id": {
+                                                                "type": "string"
+                                                            },
+                                                            "name": {
+                                                                "type": "string"
+                                                            },
+                                                            "version": {
+                                                                "type": "string"
+                                                            }
+                                                        },
+                                                        "required": [
+                                                            "Path",
+                                                            "artifact-id",
+                                                            "extra-fields",
+                                                            "group-id",
+                                                            "name",
+                                                            "version"
+                                                        ],
+                                                        "type": "object"
+                                                    }
+                                                },
+                                                "required": [
+                                                    "manifest",
+                                                    "parent-package",
+                                                    "pom-properties"
+                                                ],
+                                                "type": "object"
+                                            },
+                                            "sources": {
+                                                "type": "null"
+                                            },
+                                            "type": {
+                                                "type": "string"
+                                            },
+                                            "version": {
+                                                "type": "string"
+                                            }
+                                        },
+                                        "required": [
+                                            "found-by",
+                                            "language",
+                                            "licenses",
+                                            "manifest",
+                                            "metadata",
+                                            "sources",
+                                            "type",
+                                            "version"
+                                        ],
+                                        "type": "object"
+                                    }
+                                ]
+                            },
+                            "pom-properties": {
+                                "properties": {
+                                    "Path": {
+                                        "type": "string"
+                                    },
+                                    "artifact-id": {
+                                        "type": "string"
+                                    },
+                                    "extra-fields": {
+                                        "type": "null"
+                                    },
+                                    "group-id": {
+                                        "type": "string"
+                                    },
+                                    "name": {
+                                        "type": "string"
+                                    },
+                                    "version": {
+                                        "type": "string"
+                                    }
+                                },
+                                "required": [
+                                    "Path",
+                                    "artifact-id",
+                                    "extra-fields",
+                                    "group-id",
+                                    "name",
+                                    "version"
+                                ],
+                                "type": "object"
+                            },
+                            "pull-checksum": {
+                                "type": "string"
+                            },
+                            "pull-dependencies": {
+                                "type": "string"
+                            },
+                            "release": {
+                                "type": "string"
+                            },
+                            "size": {
+                                "type": "integer"
+                            },
+                            "source": {
+                                "type": "string"
+                            },
+                            "url": {
+                                "type": "string"
+                            },
+                            "version": {
+                                "type": "string"
+                            }
+                        },
+                        "type": "object"
+                    },
+                    "name": {
+                        "type": "string"
+                    },
+                    "type": {
+                        "type": "string"
+                    },
+                    "version": {
+                        "type": "string"
+                    }
+                },
+                "required": [
+                    "found-by",
+                    "locations",
+                    "name",
+                    "type",
+                    "version"
+                ],
+                "type": "object"
+            },
+            "type": "array"
+        },
+        "directory": {
+            "type": "string"
+        },
+        "image": {
+            "properties": {
+                "digest": {
+                    "type": "string"
+                },
+                "layers": {
+                    "items": {
+                        "properties": {
+                            "digest": {
+                                "type": "string"
+                            },
+                            "media-type": {
+                                "type": "string"
+                            },
+                            "size": {
+                                "type": "integer"
+                            }
+                        },
+                        "required": [
+                            "digest",
+                            "media-type",
+                            "size"
+                        ],
+                        "type": "object"
+                    },
+                    "type": "array"
+                },
+                "media-type": {
+                    "type": "string"
+                },
+                "size": {
+                    "type": "integer"
+                },
+                "tags": {
+                    "items": {
+                        "type": "string"
+                    },
+                    "type": "array"
+                }
+            },
+            "required": [
+                "digest",
+                "layers",
+                "media-type",
+                "size",
+                "tags"
+            ],
+            "type": "object"
+        }
+    },
+    "required": [
+        "artifacts"
+    ],
+    "type": "object"
+}

syft/cataloger/apkdb/cataloger.go

@@ -1,17 +1,24 @@
+/*
+Package apkdb provides a concrete Cataloger implementation for Alpine DB files.
+*/
 package apkdb
 
 import (
+	"io"
+
 	"github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/scope"
 )
 
+// Cataloger catalogs pkg.ApkPkg Package Types defined in Alpine DB files.
 type Cataloger struct {
 	cataloger common.GenericCataloger
 }
 
-func NewCataloger() *Cataloger {
+// New returns a new Alpine DB cataloger object.
+func New() *Cataloger {
 	globParsers := map[string]common.ParserFn{
 		"**/lib/apk/db/installed": parseApkDB,
 	}
@@ -21,14 +28,17 @@ func NewCataloger() *Cataloger {
 	}
 }
 
-func (a *Cataloger) Name() string {
+// Name returns a string that uniquely describes this cataloger.
+func (c *Cataloger) Name() string {
 	return "apkdb-cataloger"
 }
 
-func (a *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
-	return a.cataloger.SelectFiles(resolver)
+// SelectFiles returns a set of discovered Alpine DB files from the user content source.
+func (c *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
+	return c.cataloger.SelectFiles(resolver)
 }
 
-func (a *Cataloger) Catalog(contents map[file.Reference]string) ([]pkg.Package, error) {
-	return a.cataloger.Catalog(contents, a.Name())
+// Catalog returns the Packages indexed from all Alpine DB files discovered.
+func (c *Cataloger) Catalog(contents map[file.Reference]io.Reader) ([]pkg.Package, error) {
+	return c.cataloger.Catalog(contents)
 }

syft/cataloger/apkdb/parse_apk_db.go

@@ -4,14 +4,21 @@ import (
 	"bufio"
 	"fmt"
 	"io"
+	"path"
 	"strconv"
 	"strings"
 
-	"github.com/mitchellh/mapstructure"
-
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
+	"github.com/mitchellh/mapstructure"
 )
 
+// integrity check
+var _ common.ParserFn = parseApkDB
+
+// parseApkDb parses individual packages from a given Alpine DB file. For more information on specific fields
+// see https://wiki.alpinelinux.org/wiki/Apk_spec .
 func parseApkDB(_ string, reader io.Reader) ([]pkg.Package, error) {
 	packages := make([]pkg.Package, 0)
 
@@ -53,10 +60,15 @@ func parseApkDB(_ string, reader io.Reader) ([]pkg.Package, error) {
 	return packages, nil
 }
 
+// nolint:funlen
+// parseApkDBEntry reads and parses a single pkg.ApkMetadata element from the stream, returning nil if their are no more entries.
 func parseApkDBEntry(reader io.Reader) (*pkg.ApkMetadata, error) {
 	var entry pkg.ApkMetadata
 	pkgFields := make(map[string]interface{})
-	files := make([]string, 0)
+	files := make([]pkg.ApkFileRecord, 0)
+
+	var fileRecord *pkg.ApkFileRecord
+	lastFile := "/"
 
 	scanner := bufio.NewScanner(reader)
 	for scanner.Scan() {
@@ -71,9 +83,33 @@ func parseApkDBEntry(reader io.Reader) (*pkg.ApkMetadata, error) {
 
 		switch key {
 		case "F":
-			// extract all file entries, don't store in map
-			files = append(files, value)
+			lastFile = "/" + value
 			continue
+		case "R":
+			newFileRecord := pkg.ApkFileRecord{
+				Path: path.Join(lastFile, value),
+			}
+			files = append(files, newFileRecord)
+			fileRecord = &files[len(files)-1]
+		case "a":
+			ownershipFields := strings.Split(value, ":")
+			if len(ownershipFields) != 3 {
+				log.Errorf("unexpected APK ownership field: %q", value)
+				continue
+			}
+			if fileRecord == nil {
+				log.Errorf("ownership field with no parent record: %q", value)
+				continue
+			}
+			fileRecord.OwnerUID = ownershipFields[0]
+			fileRecord.OwnerGUI = ownershipFields[1]
+			fileRecord.Permissions = ownershipFields[2]
+		case "Z":
+			if fileRecord == nil {
+				log.Errorf("checksum field with no parent record: %q", value)
+				continue
+			}
+			fileRecord.Checksum = value
 		case "I", "S":
 			// coerce to integer
 			iVal, err := strconv.Atoi(value)

syft/cataloger/apkdb/parse_apk_db_test.go

@@ -31,7 +31,43 @@ func TestSinglePackage(t *testing.T) {
 				PullDependencies: "scanelf so:libc.musl-x86_64.so.1",
 				PullChecksum:     "Q1bTtF5526tETKfL+lnigzIDvm+2o=",
 				GitCommitOfAport: "4024cc3b29ad4c65544ad068b8f59172b5494306",
-				Files:            []string{"sbin", "usr", "usr/bin"},
+				Files: []pkg.ApkFileRecord{
+					{
+						Path:        "/sbin/ldconfig",
+						OwnerUID:    "0",
+						OwnerGUI:    "0",
+						Permissions: "755",
+						Checksum:    "Q1Kja2+POZKxEkUOZqwSjC6kmaED4=",
+					},
+					{
+						Path:        "/usr/bin/iconv",
+						OwnerUID:    "0",
+						OwnerGUI:    "0",
+						Permissions: "755",
+						Checksum:    "Q1CVmFbdY+Hv6/jAHl1gec2Kbx1EY=",
+					},
+					{
+						Path:        "/usr/bin/ldd",
+						OwnerUID:    "0",
+						OwnerGUI:    "0",
+						Permissions: "755",
+						Checksum:    "Q1yFAhGggmL7ERgbIA7KQxyTzf3ks=",
+					},
+					{
+						Path:        "/usr/bin/getconf",
+						OwnerUID:    "0",
+						OwnerGUI:    "0",
+						Permissions: "755",
+						Checksum:    "Q1dAdYK8M/INibRQF5B3Rw7cmNDDA=",
+					},
+					{
+						Path:        "/usr/bin/getent",
+						OwnerUID:    "0",
+						OwnerGUI:    "0",
+						Permissions: "755",
+						Checksum:    "Q1eR2Dz/WylabgbWMTkd2+hGmEya4=",
+					},
+				},
 			},
 		},
 	}
@@ -92,7 +128,7 @@ func TestMultiplePackages(t *testing.T) {
 						PullChecksum:     "Q1p78yvTLG094tHE1+dToJGbmYzQE=",
 						GitCommitOfAport: "97b1c2842faa3bfa30f5811ffbf16d5ff9f1a479",
 						PullDependencies: "musl-utils",
-						Files:            []string{},
+						Files:            []pkg.ApkFileRecord{},
 					},
 				},
 				{
@@ -114,7 +150,43 @@ func TestMultiplePackages(t *testing.T) {
 						PullDependencies: "scanelf so:libc.musl-x86_64.so.1",
 						PullChecksum:     "Q1bTtF5526tETKfL+lnigzIDvm+2o=",
 						GitCommitOfAport: "4024cc3b29ad4c65544ad068b8f59172b5494306",
-						Files:            []string{"sbin", "usr", "usr/bin"},
+						Files: []pkg.ApkFileRecord{
+							{
+								Path:        "/sbin/ldconfig",
+								OwnerUID:    "0",
+								OwnerGUI:    "0",
+								Permissions: "755",
+								Checksum:    "Q1Kja2+POZKxEkUOZqwSjC6kmaED4=",
+							},
+							{
+								Path:        "/usr/bin/iconv",
+								OwnerUID:    "0",
+								OwnerGUI:    "0",
+								Permissions: "755",
+								Checksum:    "Q1CVmFbdY+Hv6/jAHl1gec2Kbx1EY=",
+							},
+							{
+								Path:        "/usr/bin/ldd",
+								OwnerUID:    "0",
+								OwnerGUI:    "0",
+								Permissions: "755",
+								Checksum:    "Q1yFAhGggmL7ERgbIA7KQxyTzf3ks=",
+							},
+							{
+								Path:        "/usr/bin/getconf",
+								OwnerUID:    "0",
+								OwnerGUI:    "0",
+								Permissions: "755",
+								Checksum:    "Q1dAdYK8M/INibRQF5B3Rw7cmNDDA=",
+							},
+							{
+								Path:        "/usr/bin/getent",
+								OwnerUID:    "0",
+								OwnerGUI:    "0",
+								Permissions: "755",
+								Checksum:    "Q1eR2Dz/WylabgbWMTkd2+hGmEya4=",
+							},
+						},
 					},
 				},
 			},

syft/cataloger/bundler/cataloger.go

@@ -1,17 +1,24 @@
+/*
+Package bundler provides a concrete Cataloger implementation for Ruby Gemfile.lock bundler files.
+*/
 package bundler
 
 import (
+	"io"
+
 	"github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/scope"
 )
 
+// Cataloger catalogs pkg.GemPkg Package Types defined in Bundler Gemfile.lock files.
 type Cataloger struct {
 	cataloger common.GenericCataloger
 }
 
-func NewCataloger() *Cataloger {
+// New returns a new Bundler cataloger object.
+func New() *Cataloger {
 	globParsers := map[string]common.ParserFn{
 		"**/Gemfile.lock": parseGemfileLockEntries,
 	}
@@ -21,14 +28,17 @@ func NewCataloger() *Cataloger {
 	}
 }
 
-func (a *Cataloger) Name() string {
+// Name returns a string that uniquely describes this cataloger.
+func (c *Cataloger) Name() string {
 	return "bundler-cataloger"
 }
 
-func (a *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
-	return a.cataloger.SelectFiles(resolver)
+// SelectFiles returns a set of discovered Gemfile.lock files from the user content source.
+func (c *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
+	return c.cataloger.SelectFiles(resolver)
 }
 
-func (a *Cataloger) Catalog(contents map[file.Reference]string) ([]pkg.Package, error) {
-	return a.cataloger.Catalog(contents, a.Name())
+// Catalog returns the Packages indexed from all Gemfile.lock files discovered.
+func (c *Cataloger) Catalog(contents map[file.Reference]io.Reader) ([]pkg.Package, error) {
+	return c.cataloger.Catalog(contents)
 }

syft/cataloger/bundler/parse_gemfile_lock.go

@@ -6,11 +6,16 @@ import (
 	"strings"
 
 	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 )
 
+// integrity check
+var _ common.ParserFn = parseGemfileLockEntries
+
 var sectionsOfInterest = internal.NewStringSetFromSlice([]string{"GEM"})
 
+// parseGemfileLockEntries is a parser function for Gemfile.lock contents, returning all Gems discovered.
 func parseGemfileLockEntries(_ string, reader io.Reader) ([]pkg.Package, error) {
 	pkgs := make([]pkg.Package, 0)
 	scanner := bufio.NewScanner(reader)

syft/cataloger/catalog.go

@@ -0,0 +1,89 @@
+package cataloger
+
+import (
+	"github.com/anchore/stereoscope/pkg/file"
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/scope"
+	"github.com/hashicorp/go-multierror"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+)
+
+// Catalog a given scope (container image or filesystem) with the given catalogers, returning all discovered packages.
+// In order to efficiently retrieve contents from a underlying container image the content fetch requests are
+// done in bulk. Specifically, all files of interest are collected from each catalogers and accumulated into a single
+// request.
+func Catalog(resolver scope.Resolver, catalogers ...Cataloger) (*pkg.Catalog, error) {
+	catalog := pkg.NewCatalog()
+	fileSelection := make([]file.Reference, 0)
+
+	filesProcessed, packagesDiscovered := newMonitor()
+
+	// ask catalogers for files to extract from the image tar
+	for _, a := range catalogers {
+		catalogerSelection := a.SelectFiles(resolver)
+		fileSelection = append(fileSelection, catalogerSelection...)
+		log.Debugf("cataloger '%s' selected '%d' files", a.Name(), len(catalogerSelection))
+		filesProcessed.N += int64(len(fileSelection))
+	}
+
+	// fetch contents for requested selection by catalogers
+	// TODO: we should consider refactoring to return a set of io.Readers instead of the full contents themselves (allow for optional buffering).
+	contents, err := resolver.MultipleFileContentsByRef(fileSelection...)
+	if err != nil {
+		return nil, err
+	}
+
+	// perform analysis, accumulating errors for each failed analysis
+	var errs error
+	for _, c := range catalogers {
+		// TODO: check for multiple rounds of analyses by Iterate error
+		packages, err := c.Catalog(contents)
+		if err != nil {
+			errs = multierror.Append(errs, err)
+			continue
+		}
+
+		log.Debugf("cataloger '%s' discovered '%d' packages", c.Name(), len(packages))
+		packagesDiscovered.N += int64(len(packages))
+
+		catalogerName := c.Name()
+		for _, p := range packages {
+			p.FoundBy = catalogerName
+			catalog.Add(p)
+		}
+	}
+
+	if errs != nil {
+		return nil, errs
+	}
+
+	filesProcessed.SetCompleted()
+	packagesDiscovered.SetCompleted()
+
+	return catalog, nil
+}
+
+// Monitor provides progress-related data for observing the progress of a Catalog() call (published on the event bus).
+type Monitor struct {
+	FilesProcessed     progress.Monitorable // the number of files selected and contents analyzed from all registered catalogers
+	PackagesDiscovered progress.Monitorable // the number of packages discovered from all registered catalogers
+}
+
+// newMonitor creates a new Monitor object and publishes the object on the bus as a CatalogerStarted event.
+func newMonitor() (*progress.Manual, *progress.Manual) {
+	filesProcessed := progress.Manual{}
+	packagesDiscovered := progress.Manual{}
+
+	bus.Publish(partybus.Event{
+		Type: event.CatalogerStarted,
+		Value: Monitor{
+			FilesProcessed:     progress.Monitorable(&filesProcessed),
+			PackagesDiscovered: progress.Monitorable(&packagesDiscovered),
+		},
+	})
+	return &filesProcessed, &packagesDiscovered
+}

syft/cataloger/cataloger.go

@@ -1,16 +1,50 @@
+/*
+Package cataloger provides the ability to process files from a container image or file system and discover packages
+(gems, wheels, jars, rpms, debs, etc). Specifically, this package contains both a catalog function to utilize all
+catalogers defined in child packages as well as the interface definition to implement a cataloger.
+*/
 package cataloger
 
 import (
+	"io"
+
+	"github.com/anchore/syft/syft/cataloger/dpkg"
+
 	"github.com/anchore/stereoscope/pkg/file"
+	"github.com/anchore/syft/syft/cataloger/apkdb"
+	"github.com/anchore/syft/syft/cataloger/bundler"
+	"github.com/anchore/syft/syft/cataloger/golang"
+	"github.com/anchore/syft/syft/cataloger/java"
+	"github.com/anchore/syft/syft/cataloger/javascript"
+	"github.com/anchore/syft/syft/cataloger/python"
+	"github.com/anchore/syft/syft/cataloger/rpmdb"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/scope"
 )
 
+// Cataloger describes behavior for an object to participate in parsing container image or file system
+// contents for the purpose of discovering Packages. Each concrete implementation should focus on discovering Packages
+// for a specific Package Type or ecosystem.
 type Cataloger interface {
+	// Name returns a string that uniquely describes a cataloger
 	Name() string
-	// TODO: add ID / Name for catalog for uniquely identifying this cataloger type
+	// SelectFiles discovers and returns specific files that the cataloger would like to inspect the contents of.
 	SelectFiles(scope.FileResolver) []file.Reference
-	// NOTE: one of the errors which is returned is "IterationNeeded", which indicates to the driver to
-	// continue with another Select/Catalog pass
-	Catalog(map[file.Reference]string) ([]pkg.Package, error)
+	// Catalog is given the file contents and should return any discovered Packages after analyzing the contents.
+	Catalog(map[file.Reference]io.Reader) ([]pkg.Package, error)
+	// TODO: add "IterationNeeded" error to indicate to the driver to continue with another Select/Catalog pass
+}
+
+// All returns a slice of all locally defined catalogers (defined in child packages).
+func BuiltIn() []Cataloger {
+	return []Cataloger{
+		dpkg.New(),
+		bundler.New(),
+		python.New(),
+		rpmdb.New(),
+		java.New(),
+		apkdb.New(),
+		golang.New(),
+		javascript.New(),
+	}
 }

syft/cataloger/common/generic_cataloger.go

@@ -1,7 +1,10 @@
+/*
+Package common provides generic utilities used by multiple catalogers.
+*/
 package common
 
 import (
-	"strings"
+	"io"
 
 	"github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/syft/internal/log"
@@ -70,7 +73,7 @@ func (a *GenericCataloger) SelectFiles(resolver scope.FileResolver) []file.Refer
 }
 
 // Catalog takes a set of file contents and uses any configured parser functions to resolve and return discovered packages
-func (a *GenericCataloger) Catalog(contents map[file.Reference]string, upstreamMatcher string) ([]pkg.Package, error) {
+func (a *GenericCataloger) Catalog(contents map[file.Reference]io.Reader) ([]pkg.Package, error) {
 	defer a.clear()
 
 	packages := make([]pkg.Package, 0)
@@ -78,19 +81,18 @@ func (a *GenericCataloger) Catalog(contents map[file.Reference]string, upstreamM
 	for reference, parser := range a.parsers {
 		content, ok := contents[reference]
 		if !ok {
-			log.Errorf("cataloger '%s' missing file content: %+v", upstreamMatcher, reference)
+			log.Errorf("cataloger missing file content: %+v", reference)
 			continue
 		}
 
-		entries, err := parser(string(reference.Path), strings.NewReader(content))
+		entries, err := parser(string(reference.Path), content)
 		if err != nil {
 			// TODO: should we fail? or only log?
-			log.Errorf("cataloger '%s' failed to parse entries (reference=%+v): %w", upstreamMatcher, reference, err)
+			log.Errorf("cataloger failed to parse entries (reference=%+v): %w", reference, err)
 			continue
 		}
 
 		for _, entry := range entries {
-			entry.FoundBy = upstreamMatcher
 			entry.Source = []file.Reference{reference}
 
 			packages = append(packages, entry)

syft/cataloger/common/generic_cataloger_test.go

@@ -79,17 +79,15 @@ func TestGenericCataloger(t *testing.T) {
 		selectionByPath[string(s.Path)] = s
 	}
 
-	upstream := "some-other-cataloger"
 	expectedPkgs := make(map[file.Reference]pkg.Package)
 	for path, ref := range selectionByPath {
 		expectedPkgs[ref] = pkg.Package{
-			FoundBy: upstream,
-			Source:  []file.Reference{ref},
-			Name:    fmt.Sprintf("%s file contents!", path),
+			Source: []file.Reference{ref},
+			Name:   fmt.Sprintf("%s file contents!", path),
 		}
 	}
 
-	actualPkgs, err := cataloger.Catalog(resolver.contents, upstream)
+	actualPkgs, err := cataloger.Catalog(resolver.contents)
 	if err != nil {
 		t.Fatalf("cataloger catalog action failed: %+v", err)
 	}

syft/cataloger/controller.go

@@ -1,129 +0,0 @@
-package cataloger
-
-import (
-	"github.com/anchore/stereoscope/pkg/file"
-	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/cataloger/apkdb"
-	"github.com/anchore/syft/syft/cataloger/bundler"
-	"github.com/anchore/syft/syft/cataloger/dpkg"
-	golang "github.com/anchore/syft/syft/cataloger/golang"
-	"github.com/anchore/syft/syft/cataloger/java"
-	"github.com/anchore/syft/syft/cataloger/npm"
-	"github.com/anchore/syft/syft/cataloger/python"
-	"github.com/anchore/syft/syft/cataloger/rpmdb"
-	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/scope"
-	"github.com/hashicorp/go-multierror"
-	"github.com/wagoodman/go-partybus"
-	"github.com/wagoodman/go-progress"
-)
-
-var controllerInstance controller
-
-func init() {
-	controllerInstance = newController()
-}
-
-func Catalogers() []string {
-	c := make([]string, len(controllerInstance.catalogers))
-	for idx, catalog := range controllerInstance.catalogers {
-		c[idx] = catalog.Name()
-	}
-	return c
-}
-
-func Catalog(s scope.Resolver) (*pkg.Catalog, error) {
-	return controllerInstance.catalog(s)
-}
-
-type controller struct {
-	catalogers []Cataloger
-}
-
-func newController() controller {
-	ctrlr := controller{
-		catalogers: make([]Cataloger, 0),
-	}
-	ctrlr.add(dpkg.NewCataloger())
-	ctrlr.add(bundler.NewCataloger())
-	ctrlr.add(python.NewCataloger())
-	ctrlr.add(rpmdb.NewCataloger())
-	ctrlr.add(java.NewCataloger())
-	ctrlr.add(apkdb.NewCataloger())
-	ctrlr.add(golang.NewCataloger())
-	ctrlr.add(npm.NewCataloger())
-	return ctrlr
-}
-
-func (c *controller) add(a Cataloger) {
-	log.Debugf("adding cataloger: %s", a.Name())
-	c.catalogers = append(c.catalogers, a)
-}
-
-type Monitor struct {
-	FilesProcessed     progress.Monitorable
-	PackagesDiscovered progress.Monitorable
-}
-
-func (c *controller) trackCataloger() (*progress.Manual, *progress.Manual) {
-	filesProcessed := progress.Manual{}
-	packagesDiscovered := progress.Manual{}
-
-	bus.Publish(partybus.Event{
-		Type: event.CatalogerStarted,
-		Value: Monitor{
-			FilesProcessed:     progress.Monitorable(&filesProcessed),
-			PackagesDiscovered: progress.Monitorable(&packagesDiscovered),
-		},
-	})
-	return &filesProcessed, &packagesDiscovered
-}
-
-func (c *controller) catalog(s scope.Resolver) (*pkg.Catalog, error) {
-	catalog := pkg.NewCatalog()
-	fileSelection := make([]file.Reference, 0)
-
-	filesProcessed, packagesDiscovered := c.trackCataloger()
-
-	// ask catalogers for files to extract from the image tar
-	for _, a := range c.catalogers {
-		fileSelection = append(fileSelection, a.SelectFiles(s)...)
-		log.Debugf("cataloger '%s' selected '%d' files", a.Name(), len(fileSelection))
-		filesProcessed.N += int64(len(fileSelection))
-	}
-
-	// fetch contents for requested selection by catalogers
-	contents, err := s.MultipleFileContentsByRef(fileSelection...)
-	if err != nil {
-		return nil, err
-	}
-
-	// perform analysis, accumulating errors for each failed analysis
-	var errs error
-	for _, a := range c.catalogers {
-		// TODO: check for multiple rounds of analyses by Iterate error
-		packages, err := a.Catalog(contents)
-		if err != nil {
-			errs = multierror.Append(errs, err)
-			continue
-		}
-
-		log.Debugf("cataloger '%s' discovered '%d' packages", a.Name(), len(packages))
-		packagesDiscovered.N += int64(len(packages))
-
-		for _, p := range packages {
-			catalog.Add(p)
-		}
-	}
-
-	if errs != nil {
-		return nil, errs
-	}
-
-	filesProcessed.SetCompleted()
-	packagesDiscovered.SetCompleted()
-
-	return catalog, nil
-}

syft/cataloger/dpkg/cataloger.go

@@ -1,17 +1,24 @@
+/*
+Package dpkg provides a concrete Cataloger implementation for Debian package DB status files.
+*/
 package dpkg
 
 import (
+	"io"
+
 	"github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/scope"
 )
 
+// Cataloger catalogs pkg.DebPkg Package Types defined in DPKG status files.
 type Cataloger struct {
 	cataloger common.GenericCataloger
 }
 
-func NewCataloger() *Cataloger {
+// New returns a new Deb package cataloger object.
+func New() *Cataloger {
 	globParsers := map[string]common.ParserFn{
 		"**/var/lib/dpkg/status": parseDpkgStatus,
 	}
@@ -21,14 +28,17 @@ func NewCataloger() *Cataloger {
 	}
 }
 
-func (a *Cataloger) Name() string {
+// Name returns a string that uniquely describes this cataloger.
+func (c *Cataloger) Name() string {
 	return "dpkg-cataloger"
 }
 
-func (a *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
-	return a.cataloger.SelectFiles(resolver)
+// SelectFiles returns a set of discovered DPKG status files from the user content source.
+func (c *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
+	return c.cataloger.SelectFiles(resolver)
 }
 
-func (a *Cataloger) Catalog(contents map[file.Reference]string) ([]pkg.Package, error) {
-	return a.cataloger.Catalog(contents, a.Name())
+// Catalog returns the Packages indexed from all DPKG status files discovered.
+func (c *Cataloger) Catalog(contents map[file.Reference]io.Reader) ([]pkg.Package, error) {
+	return c.cataloger.Catalog(contents)
 }

syft/cataloger/dpkg/parse_dpkg_status.go

@@ -6,12 +6,17 @@ import (
 	"io"
 	"strings"
 
+	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/mitchellh/mapstructure"
 )
 
+// integrity check
+var _ common.ParserFn = parseDpkgStatus
+
 var errEndOfPackages = fmt.Errorf("no more packages to read")
 
+// parseDpkgStatus is a parser function for Debian DB status contents, returning all Debian packages listed.
 func parseDpkgStatus(_ string, reader io.Reader) ([]pkg.Package, error) {
 	buffedReader := bufio.NewReader(reader)
 	var packages = make([]pkg.Package, 0)
@@ -35,6 +40,7 @@ func parseDpkgStatus(_ string, reader io.Reader) ([]pkg.Package, error) {
 	return packages, nil
 }
 
+// parseDpkgStatusEntry returns an individual Dpkg entry, or returns errEndOfPackages if there are no more packages to parse from the reader.
 func parseDpkgStatusEntry(reader *bufio.Reader) (entry pkg.DpkgMetadata, err error) {
 	dpkgFields := make(map[string]string)
 	var key string

syft/cataloger/dpkg/parse_dpkg_status_test.go

@@ -24,9 +24,10 @@ func TestSinglePackage(t *testing.T) {
 		{
 			name: "Test Single Package",
 			expected: pkg.DpkgMetadata{
-				Package: "apt",
-				Source:  "apt-dev",
-				Version: "1.8.2",
+				Package:      "apt",
+				Source:       "apt-dev",
+				Version:      "1.8.2",
+				Architecture: "amd64",
 			},
 		},
 	}
@@ -65,13 +66,15 @@ func TestMultiplePackages(t *testing.T) {
 			name: "Test Multiple Package",
 			expected: []pkg.DpkgMetadata{
 				{
-					Package: "tzdata",
-					Version: "2020a-0+deb10u1",
-					Source:  "tzdata-dev",
+					Package:      "tzdata",
+					Version:      "2020a-0+deb10u1",
+					Source:       "tzdata-dev",
+					Architecture: "all",
 				},
 				{
-					Package: "util-linux",
-					Version: "2.33.1-0.1",
+					Package:      "util-linux",
+					Version:      "2.33.1-0.1",
+					Architecture: "amd64",
 				},
 			},
 		},

syft/cataloger/golang/cataloger.go

@@ -1,17 +1,24 @@
+/*
+Package golang provides a concrete Cataloger implementation for go.mod files.
+*/
 package golang
 
 import (
+	"io"
+
 	"github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/scope"
 )
 
+// Cataloger catalogs pkg.GoModulePkg Package Types defined in go.mod files.
 type Cataloger struct {
 	cataloger common.GenericCataloger
 }
 
-func NewCataloger() *Cataloger {
+// New returns a new Go module cataloger object.
+func New() *Cataloger {
 	globParsers := map[string]common.ParserFn{
 		"**/go.mod": parseGoMod,
 	}
@@ -21,14 +28,17 @@ func NewCataloger() *Cataloger {
 	}
 }
 
-func (a *Cataloger) Name() string {
+// Name returns a string that uniquely describes this cataloger.
+func (c *Cataloger) Name() string {
 	return "go-cataloger"
 }
 
-func (a *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
-	return a.cataloger.SelectFiles(resolver)
+// SelectFiles returns a set of discovered go.mod files from the user content source.
+func (c *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
+	return c.cataloger.SelectFiles(resolver)
 }
 
-func (a *Cataloger) Catalog(contents map[file.Reference]string) ([]pkg.Package, error) {
-	return a.cataloger.Catalog(contents, a.Name())
+// Catalog returns the Packages indexed from all go.mod files discovered.
+func (c *Cataloger) Catalog(contents map[file.Reference]io.Reader) ([]pkg.Package, error) {
+	return c.cataloger.Catalog(contents)
 }

syft/cataloger/golang/parse_go_mod.go

@@ -11,6 +11,7 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 )
 
+// parseGoMod takes a go.mod and lists all packages discovered.
 func parseGoMod(path string, reader io.Reader) ([]pkg.Package, error) {
 	packages := make(map[string]pkg.Package)
 

syft/cataloger/java/archive_parser.go

@@ -7,9 +7,13 @@ import (
 
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/file"
+	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 )
 
+// integrity check
+var _ common.ParserFn = parseJavaArchive
+
 var archiveFormatGlobs = []string{
 	"**/*.jar",
 	"**/*.war",
@@ -28,6 +32,7 @@ type archiveParser struct {
 	detectNested   bool
 }
 
+// parseJavaArchive is a parser function for java archive contents, returning all Java libraries and nested archives.
 func parseJavaArchive(virtualPath string, reader io.Reader) ([]pkg.Package, error) {
 	parser, cleanupFn, err := newJavaArchiveParser(virtualPath, reader, true)
 	// note: even on error, we should always run cleanup functions
@@ -38,6 +43,7 @@ func parseJavaArchive(virtualPath string, reader io.Reader) ([]pkg.Package, erro
 	return parser.parse()
 }
 
+// uniquePkgKey creates a unique string to identify the given package.
 func uniquePkgKey(p *pkg.Package) string {
 	if p == nil {
 		return ""
@@ -45,6 +51,8 @@ func uniquePkgKey(p *pkg.Package) string {
 	return fmt.Sprintf("%s|%s", p.Name, p.Version)
 }
 
+// newJavaArchiveParser returns a new java archive parser object for the given archive. Can be configured to discover
+// and parse nested archives or ignore them.
 func newJavaArchiveParser(virtualPath string, reader io.Reader, detectNested bool) (*archiveParser, func(), error) {
 	contentPath, archivePath, cleanupFn, err := saveArchiveToTmp(reader)
 	if err != nil {
@@ -67,6 +75,7 @@ func newJavaArchiveParser(virtualPath string, reader io.Reader, detectNested boo
 	}, cleanupFn, nil
 }
 
+// parse the loaded archive and return all packages found.
 func (j *archiveParser) parse() ([]pkg.Package, error) {
 	var pkgs = make([]pkg.Package, 0)
 
@@ -106,6 +115,7 @@ func (j *archiveParser) parse() ([]pkg.Package, error) {
 	return pkgs, nil
 }
 
+// discoverMainPackage parses the root Java manifest used as the parent package to all discovered nested packages.
 func (j *archiveParser) discoverMainPackage() (*pkg.Package, error) {
 	// search and parse java manifest files
 	manifestMatches := j.fileManifest.GlobMatch(manifestPath)
@@ -133,12 +143,15 @@ func (j *archiveParser) discoverMainPackage() (*pkg.Package, error) {
 		Name:     selectName(manifest, j.fileInfo),
 		Version:  selectVersion(manifest, j.fileInfo),
 		Language: pkg.Java,
+		Type:     pkg.JavaPkg,
 		Metadata: pkg.JavaMetadata{
 			Manifest: manifest,
 		},
 	}, nil
 }
 
+// discoverPkgsFromPomProperties parses Maven POM properties for a given parent package, returning all listed Java packages found and
+// associating each discovered package to the given parent package.
 func (j *archiveParser) discoverPkgsFromPomProperties(parentPkg *pkg.Package) ([]pkg.Package, error) {
 	var pkgs = make([]pkg.Package, 0)
 	parentKey := uniquePkgKey(parentPkg)
@@ -165,6 +178,7 @@ func (j *archiveParser) discoverPkgsFromPomProperties(parentPkg *pkg.Package) ([
 					Name:     propsObj.ArtifactID,
 					Version:  propsObj.Version,
 					Language: pkg.Java,
+					Type:     pkg.JavaPkg,
 					Metadata: pkg.JavaMetadata{
 						PomProperties: propsObj,
 						Parent:        parentPkg,
@@ -190,6 +204,8 @@ func (j *archiveParser) discoverPkgsFromPomProperties(parentPkg *pkg.Package) ([
 	return pkgs, nil
 }
 
+// discoverPkgsFromNestedArchives finds Java archives within Java archives, returning all listed Java packages found and
+// associating each discovered package to the given parent package.
 func (j *archiveParser) discoverPkgsFromNestedArchives(parentPkg *pkg.Package) ([]pkg.Package, error) {
 	var pkgs = make([]pkg.Package, 0)
 

syft/cataloger/java/archive_parser_test.go

@@ -78,6 +78,51 @@ func generateJavaBuildFixture(t *testing.T, fixturePath string) {
 	}
 }
 
+func TestSelectName(t *testing.T) {
+	tests := []struct {
+		desc     string
+		manifest pkg.JavaManifest
+		archive  archiveFilename
+		expected string
+	}{
+		{
+			desc:    "name from Implementation-Title",
+			archive: archiveFilename{},
+			manifest: pkg.JavaManifest{
+				Name:      "",
+				SpecTitle: "",
+				ImplTitle: "maven-wrapper",
+			},
+			expected: "maven-wrapper",
+		},
+		{
+			desc: "Implementation-Title does not override",
+			manifest: pkg.JavaManifest{
+				Name:      "Foo",
+				SpecTitle: "",
+				ImplTitle: "maven-wrapper",
+			},
+			archive: archiveFilename{
+				fields: []map[string]string{
+					{"name": "omg"},
+				},
+			},
+			expected: "omg",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.desc, func(t *testing.T) {
+			result := selectName(&test.manifest, test.archive)
+
+			if result != test.expected {
+				t.Errorf("mismatch in names: '%s' != '%s'", result, test.expected)
+			}
+		})
+	}
+
+}
+
 func TestParseJar(t *testing.T) {
 	tests := []struct {
 		fixture      string
@@ -182,7 +227,7 @@ func TestParseJar(t *testing.T) {
 					Name:     "joda-time",
 					Version:  "2.9.2",
 					Language: pkg.Java,
-					Type:     pkg.UnknownPkg,
+					Type:     pkg.JavaPkg,
 					Metadata: pkg.JavaMetadata{
 						PomProperties: &pkg.PomProperties{
 							Path:       "META-INF/maven/joda-time/joda-time/pom.properties",

syft/cataloger/java/cataloger.go

@@ -1,17 +1,24 @@
+/*
+Package java provides a concrete Cataloger implementation for Java archives (jar, war, ear, jpi, hpi formats).
+*/
 package java
 
 import (
+	"io"
+
 	"github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/scope"
 )
 
+// Cataloger catalogs pkg.JavaPkg and pkg.JenkinsPluginPkg Package Types defined in java archive files.
 type Cataloger struct {
 	cataloger common.GenericCataloger
 }
 
-func NewCataloger() *Cataloger {
+// New returns a new Java archive cataloger object.
+func New() *Cataloger {
 	globParsers := make(map[string]common.ParserFn)
 	for _, pattern := range archiveFormatGlobs {
 		globParsers[pattern] = parseJavaArchive
@@ -22,14 +29,17 @@ func NewCataloger() *Cataloger {
 	}
 }
 
-func (a *Cataloger) Name() string {
+// Name returns a string that uniquely describes this cataloger.
+func (c *Cataloger) Name() string {
 	return "java-cataloger"
 }
 
-func (a *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
-	return a.cataloger.SelectFiles(resolver)
+// SelectFiles returns a set of discovered Java archive files from the user content source.
+func (c *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
+	return c.cataloger.SelectFiles(resolver)
 }
 
-func (a *Cataloger) Catalog(contents map[file.Reference]string) ([]pkg.Package, error) {
-	return a.cataloger.Catalog(contents, a.Name())
+// Catalog returns the Packages indexed from all Java archive files discovered.
+func (c *Cataloger) Catalog(contents map[file.Reference]io.Reader) ([]pkg.Package, error) {
+	return c.cataloger.Catalog(contents)
 }

syft/cataloger/java/java_manifest.go

@@ -82,6 +82,12 @@ func selectName(manifest *pkg.JavaManifest, filenameObj archiveFilename) string
 		// Jenkins...
 		name = manifest.Extra["Extension-Name"]
 	}
+
+	// in situations where we hit this point and no name was
+	// determined, look at the Implementation-Title
+	if name == "" && manifest.ImplTitle != "" {
+		name = manifest.ImplTitle
+	}
 	return name
 }
 

syft/cataloger/javascript/cataloger.go

@@ -0,0 +1,45 @@
+/*
+Package javascript provides a concrete Cataloger implementation for JavaScript ecosystem files (yarn and npm).
+*/
+package javascript
+
+import (
+	"io"
+
+	"github.com/anchore/stereoscope/pkg/file"
+	"github.com/anchore/syft/syft/cataloger/common"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/scope"
+)
+
+// Cataloger catalogs pkg.YarnPkg and pkg.NpmPkg Package Types defined in package-lock.json and yarn.lock files.
+type Cataloger struct {
+	cataloger common.GenericCataloger
+}
+
+// New returns a new JavaScript cataloger object.
+func New() *Cataloger {
+	globParsers := map[string]common.ParserFn{
+		"**/package-lock.json": parsePackageLock,
+		"**/yarn.lock":         parseYarnLock,
+	}
+
+	return &Cataloger{
+		cataloger: common.NewGenericCataloger(nil, globParsers),
+	}
+}
+
+// Name returns a string that uniquely describes this cataloger.
+func (c *Cataloger) Name() string {
+	return "javascript-cataloger"
+}
+
+// SelectFiles returns a set of discovered Javascript ecosystem files from the user content source.
+func (c *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
+	return c.cataloger.SelectFiles(resolver)
+}
+
+// Catalog returns the Packages indexed from all Javascript ecosystem files discovered.
+func (c *Cataloger) Catalog(contents map[file.Reference]io.Reader) ([]pkg.Package, error) {
+	return c.cataloger.Catalog(contents)
+}

syft/cataloger/javascript/parse_package_lock.go

@@ -1,19 +1,25 @@
-package npm
+package javascript
 
 import (
 	"encoding/json"
 	"fmt"
 	"io"
 
+	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 )
 
+// integrity check
+var _ common.ParserFn = parsePackageLock
+
+// PackageLock represents a JavaScript package.lock json file
 type PackageLock struct {
 	Requires        bool `json:"requires"`
 	LockfileVersion int  `json:"lockfileVersion"`
-	Dependencies    Dependencies
+	Dependencies    map[string]Dependency
 }
 
+// Dependency represents a single package dependency listed in the package.lock json file
 type Dependency struct {
 	Version   string `json:"version"`
 	Resolved  string `json:"resolved"`
@@ -21,8 +27,7 @@ type Dependency struct {
 	Requires  map[string]string
 }
 
-type Dependencies map[string]Dependency
-
+// parsePackageLock parses a package.lock and returns the discovered JavaScript packages.
 func parsePackageLock(_ string, reader io.Reader) ([]pkg.Package, error) {
 	packages := make([]pkg.Package, 0)
 	dec := json.NewDecoder(reader)

syft/cataloger/javascript/parse_package_lock_test.go

@@ -1,4 +1,4 @@
-package npm
+package javascript
 
 import (
 	"os"

syft/cataloger/javascript/parse_yarn_lock.go

@@ -0,0 +1,79 @@
+package javascript
+
+import (
+	"bufio"
+	"fmt"
+	"io"
+	"regexp"
+	"strings"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/cataloger/common"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+// integrity check
+var _ common.ParserFn = parseYarnLock
+
+var composedNameExp = regexp.MustCompile("^\"(@{1}[^@]+)")
+var simpleNameExp = regexp.MustCompile(`^[a-zA-Z\-]+@`)
+var versionExp = regexp.MustCompile(`^\W+(version)\W+`)
+
+func parseYarnLock(_ string, reader io.Reader) ([]pkg.Package, error) {
+	packages := make([]pkg.Package, 0)
+	fields := make(map[string]string)
+	var currentName string
+
+	scanner := bufio.NewScanner(reader)
+
+	for scanner.Scan() {
+		line := scanner.Text()
+		line = strings.TrimRight(line, "\n")
+
+		// create the entry so that the loop can keep appending versions later
+		_, ok := fields[currentName]
+		if !ok {
+			fields[currentName] = ""
+		}
+
+		switch {
+		case composedNameExp.MatchString(line):
+			name := composedNameExp.FindString(line)
+			if len(name) == 0 {
+				log.Errorf("unable to parse line: '%s'", line)
+			}
+			currentName = strings.TrimLeft(name, "\"")
+		case simpleNameExp.MatchString(line):
+			parts := strings.Split(line, "@")
+			currentName = parts[0]
+		case versionExp.MatchString(line):
+			parts := strings.Split(line, " \"")
+			version := parts[len(parts)-1]
+
+			versions, ok := fields[currentName]
+			if !ok {
+				return nil, fmt.Errorf("no previous key exists, expecting: %s", currentName)
+			}
+
+			if strings.Contains(versions, version) {
+				// already exists from another dependency declaration
+				continue
+			}
+
+			// append the version as a string so that we can check on it later
+			fields[currentName] = versions + " " + version
+			packages = append(packages, pkg.Package{
+				Name:     currentName,
+				Version:  strings.Trim(version, "\""),
+				Language: pkg.JavaScript,
+				Type:     pkg.YarnPkg,
+			})
+		}
+	}
+
+	if err := scanner.Err(); err != nil {
+		return nil, fmt.Errorf("failed to parse yarn.lock file: %w", err)
+	}
+
+	return packages, nil
+}

syft/cataloger/javascript/parse_yarn_lock_test.go

@@ -0,0 +1,67 @@
+package javascript
+
+import (
+	"os"
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func TestParseYarnLock(t *testing.T) {
+	expected := map[string]pkg.Package{
+		"@babel/code-frame": {
+			Name:     "@babel/code-frame",
+			Version:  "7.10.4",
+			Language: pkg.JavaScript,
+			Type:     pkg.YarnPkg,
+		},
+		"@types/minimatch": {
+			Name:     "@types/minimatch",
+			Version:  "3.0.3",
+			Language: pkg.JavaScript,
+			Type:     pkg.YarnPkg,
+		},
+		"@types/qs": {
+			Name:     "@types/qs",
+			Version:  "6.9.4",
+			Language: pkg.JavaScript,
+			Type:     pkg.YarnPkg,
+		},
+		"ajv": {
+			Name:     "ajv",
+			Version:  "6.12.3",
+			Language: pkg.JavaScript,
+			Type:     pkg.YarnPkg,
+		},
+		"atob": {
+			Name:     "atob",
+			Version:  "2.1.2",
+			Language: pkg.JavaScript,
+			Type:     pkg.YarnPkg,
+		},
+		"aws-sdk": {
+			Name:     "aws-sdk",
+			Version:  "2.706.0",
+			Language: pkg.JavaScript,
+			Type:     pkg.YarnPkg,
+		},
+		"jhipster-core": {
+			Name:     "jhipster-core",
+			Version:  "7.3.4",
+			Language: pkg.JavaScript,
+			Type:     pkg.YarnPkg,
+		},
+	}
+	fixture, err := os.Open("test-fixtures/yarn/yarn.lock")
+	if err != nil {
+		t.Fatalf("failed to open fixture: %+v", err)
+	}
+
+	actual, err := parseYarnLock(fixture.Name(), fixture)
+	if err != nil {
+		t.Fatalf("failed to parse yarn.lock: %+v", err)
+	}
+
+	assertPkgsEqual(t, actual, expected)
+
+}

syft/cataloger/javascript/test-fixtures/yarn/yarn.lock

@@ -0,0 +1,71 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+"@babel/code-frame@^7.0.0", "@babel/code-frame@^7.10.4":
+  version "7.10.4"
+  resolved "https://registry.yarnpkg.com/@babel/code-frame/-/code-frame-7.10.4.tgz#168da1a36e90da68ae8d49c0f1b48c7c6249213a"
+  integrity sha512-vG6SvB6oYEhvgisZNFRmRCUkLz11c7rp+tbNTynGqc6mS1d5ATd/sGyV6W0KZZnXRKMTzZDRgQT3Ou9jhpAfUg==
+  dependencies:
+    "@babel/highlight" "^7.10.4"
+
+"@types/minimatch@*", "@types/minimatch@^3.0.3":
+  version "3.0.3"
+  resolved "https://registry.yarnpkg.com/@types/minimatch/-/minimatch-3.0.3.tgz#3dca0e3f33b200fc7d1139c0cd96c1268cadfd9d"
+  integrity sha512-tHq6qdbT9U1IRSGf14CL0pUlULksvY9OZ+5eEgl1N7t+OA3tGvNpxJCzuKQlsNgCVwbAs670L1vcVQi8j9HjnA==
+
+"@types/qs@^6.2.31":
+  version "6.9.4"
+  resolved "https://registry.yarnpkg.com/@types/qs/-/qs-6.9.4.tgz#a59e851c1ba16c0513ea123830dd639a0a15cb6a"
+  integrity sha512-+wYo+L6ZF6BMoEjtf8zB2esQsqdV6WsjRK/GP9WOgLPrq87PbNWgIxS76dS5uvl/QXtHGakZmwTznIfcPXcKlQ==
+
+"@types/qs@^6.2.31":
+  version "6.9.4"
+  resolved "https://registry.yarnpkg.com/@types/qs/-/qs-6.9.4.tgz#a59e851c1ba16c0513ea123830dd639a0a15cb6a"
+  integrity sha512-+wYo+L6ZF6BMoEjtf8zB2esQsqdV6WsjRK/GP9WOgLPrq87PbNWgIxS76dS5uvl/QXtHGakZmwTznIfcPXcKlQ==
+
+ajv@^6.10.2, ajv@^6.5.5:
+  version "6.12.3"
+  resolved "https://registry.yarnpkg.com/ajv/-/ajv-6.12.3.tgz#18c5af38a111ddeb4f2697bd78d68abc1cabd706"
+  integrity sha512-4K0cK3L1hsqk9xIb2z9vs/XU+PGJZ9PNpJRDS9YLzmNdX6jmVPfamLvTJr0aDAusnHyCHO6MjzlkAsgtqp9teA==
+  dependencies:
+    fast-deep-equal "^3.1.1"
+    fast-json-stable-stringify "^2.0.0"
+    json-schema-traverse "^0.4.1"
+    uri-js "^4.2.2"
+
+atob@^2.1.2:
+  version "2.1.2"
+  resolved "https://registry.yarnpkg.com/atob/-/atob-2.1.2.tgz#6d9517eb9e030d2436666651e86bd9f6f13533c9"
+  integrity sha512-Wm6ukoaOGJi/73p/cl2GvLjTI5JM1k/O14isD73YML8StrH/7/lRFgmg8nICZgD3bZZvjwCGxtMOD3wWNAu8cg==
+
+atob@^2.1.2:
+  version "2.1.2"
+  resolved "https://registry.yarnpkg.com/atob/-/atob-2.1.2.tgz#6d9517eb9e030d2436666651e86bd9f6f13533c9"
+  integrity sha512-Wm6ukoaOGJi/73p/cl2GvLjTI5JM1k/O14isD73YML8StrH/7/lRFgmg8nICZgD3bZZvjwCGxtMOD3wWNAu8cg==
+
+aws-sdk@2.706.0:
+  version "2.706.0"
+  resolved "https://registry.yarnpkg.com/aws-sdk/-/aws-sdk-2.706.0.tgz#09f65e9a91ecac5a635daf934082abae30eca953"
+  integrity sha512-7GT+yrB5Wb/zOReRdv/Pzkb2Qt+hz6B/8FGMVaoysX3NryHvQUdz7EQWi5yhg9CxOjKxdw5lFwYSs69YlSp1KA==
+  dependencies:
+    buffer "4.9.2"
+    events "1.1.1"
+    ieee754 "1.1.13"
+    jmespath "0.15.0"
+    querystring "0.2.0"
+    sax "1.2.1"
+    url "0.10.3"
+    uuid "3.3.2"
+    xml2js "0.4.19"
+
+jhipster-core@7.3.4:
+  version "7.3.4"
+  resolved "https://registry.yarnpkg.com/jhipster-core/-/jhipster-core-7.3.4.tgz#c34b8c97c7f4e8b7518dae015517e2112c73cc80"
+  integrity sha512-AUhT69kNkqppaJZVfan/xnKG4Gs9Ggj7YLtTZFVe+xg+THrbMb5Ng7PL07PDlDw4KAEA33GMCwuAf65E8EpC4g==
+  dependencies:
+    chevrotain "7.0.1"
+    fs-extra "8.1.0"
+    lodash "4.17.15"
+    winston "3.2.1"
+

syft/cataloger/npm/cataloger.go

@@ -1,34 +0,0 @@
-package npm
-
-import (
-	"github.com/anchore/stereoscope/pkg/file"
-	"github.com/anchore/syft/syft/cataloger/common"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/scope"
-)
-
-type Cataloger struct {
-	cataloger common.GenericCataloger
-}
-
-func NewCataloger() *Cataloger {
-	globParsers := map[string]common.ParserFn{
-		"**/package-lock.json": parsePackageLock,
-	}
-
-	return &Cataloger{
-		cataloger: common.NewGenericCataloger(nil, globParsers),
-	}
-}
-
-func (a *Cataloger) Name() string {
-	return "npm-cataloger"
-}
-
-func (a *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
-	return a.cataloger.SelectFiles(resolver)
-}
-
-func (a *Cataloger) Catalog(contents map[file.Reference]string) ([]pkg.Package, error) {
-	return a.cataloger.Catalog(contents, a.Name())
-}

syft/cataloger/python/cataloger.go

@@ -1,24 +1,30 @@
+/*
+Package python provides a concrete Cataloger implementation for Python ecosystem files (egg, wheel, requirements.txt).
+*/
 package python
 
 import (
+	"io"
+
 	"github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/scope"
 )
 
+// Cataloger catalogs pkg.WheelPkg, pkg.EggPkg, and pkg.PythonRequirementsPkg Package Types defined in Python ecosystem files.
 type Cataloger struct {
 	cataloger common.GenericCataloger
 }
 
-func NewCataloger() *Cataloger {
-	// we want to match on partial dir names
-	// 	/home/user/requests-2.10.0.dist-info/METADATA
-	//	/home/user/requests-2.10.0/dist-info/METADATA
+// New returns a new Python cataloger object.
+func New() *Cataloger {
 	globParsers := map[string]common.ParserFn{
 		"**/*egg-info/PKG-INFO":  parseEggMetadata,
 		"**/*dist-info/METADATA": parseWheelMetadata,
 		"**/requirements.txt":    parseRequirementsTxt,
+		"**/poetry.lock":         parsePoetryLock,
+		"**/setup.py":            parseSetup,
 	}
 
 	return &Cataloger{
@@ -26,14 +32,17 @@ func NewCataloger() *Cataloger {
 	}
 }
 
-func (a *Cataloger) Name() string {
+// Name returns a string that uniquely describes this cataloger.
+func (c *Cataloger) Name() string {
 	return "python-cataloger"
 }
 
-func (a *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
-	return a.cataloger.SelectFiles(resolver)
+// SelectFiles returns a set of discovered Python ecosystem files from the user content source.
+func (c *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
+	return c.cataloger.SelectFiles(resolver)
 }
 
-func (a *Cataloger) Catalog(contents map[file.Reference]string) ([]pkg.Package, error) {
-	return a.cataloger.Catalog(contents, a.Name())
+// Catalog returns the Packages indexed from all Python ecosystem files discovered.
+func (c *Cataloger) Catalog(contents map[file.Reference]io.Reader) ([]pkg.Package, error) {
+	return c.cataloger.Catalog(contents)
 }

syft/cataloger/python/parse_poetry_lock.go

@@ -0,0 +1,29 @@
+package python
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/anchore/syft/syft/cataloger/common"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/pelletier/go-toml"
+)
+
+// integrity check
+var _ common.ParserFn = parsePoetryLock
+
+// parsePoetryLock is a parser function for poetry.lock contents, returning all python packages discovered.
+func parsePoetryLock(_ string, reader io.Reader) ([]pkg.Package, error) {
+	tree, err := toml.LoadReader(reader)
+	if err != nil {
+		return nil, fmt.Errorf("unable to load poetry.lock for parsing: %v", err)
+	}
+
+	metadata := PoetryMetadata{}
+	err = tree.Unmarshal(&metadata)
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse poetry.lock: %v", err)
+	}
+
+	return metadata.Pkgs(), nil
+}

syft/cataloger/python/parse_poetry_lock_test.go

@@ -0,0 +1,56 @@
+package python
+
+import (
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/go-test/deep"
+	"os"
+	"testing"
+)
+
+func TestParsePoetryLock(t *testing.T) {
+	expected := []pkg.Package{
+		{
+			Name:     "added-value",
+			Version:  "0.14.2",
+			Language: pkg.Python,
+			Type:     pkg.PoetryPkg,
+			Licenses: nil,
+		},
+		{
+			Name:     "alabaster",
+			Version:  "0.7.12",
+			Language: pkg.Python,
+			Type:     pkg.PoetryPkg,
+			Licenses: nil,
+		},
+		{
+			Name:     "appnope",
+			Version:  "0.1.0",
+			Language: pkg.Python,
+			Type:     pkg.PoetryPkg,
+			Licenses: nil,
+		},
+		{
+			Name:     "asciitree",
+			Version:  "0.3.3",
+			Language: pkg.Python,
+			Type:     pkg.PoetryPkg,
+			Licenses: nil,
+		},
+	}
+
+	fixture, err := os.Open("test-fixtures/poetry/poetry.lock")
+	if err != nil {
+		t.Fatalf("failed to open fixture: %+v", err)
+	}
+
+	actual, err := parsePoetryLock(fixture.Name(), fixture)
+	if err != nil {
+		t.Error(err)
+	}
+
+	differences := deep.Equal(expected, actual)
+	if differences != nil {
+		t.Errorf("returned package list differed from expectation: %+v", differences)
+	}
+}

syft/cataloger/python/parse_requirements.go

@@ -6,9 +6,15 @@ import (
 	"io"
 	"strings"
 
+	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 )
 
+// integrity check
+var _ common.ParserFn = parseRequirementsTxt
+
+// parseRequirementsTxt takes a Python requirements.txt file, returning all Python packages that are locked to a
+// specific version.
 func parseRequirementsTxt(_ string, reader io.Reader) ([]pkg.Package, error) {
 	packages := make([]pkg.Package, 0)
 
@@ -55,6 +61,7 @@ func parseRequirementsTxt(_ string, reader io.Reader) ([]pkg.Package, error) {
 	return packages, nil
 }
 
+// removeTrailingComment takes a requirements.txt line and strips off comment strings.
 func removeTrailingComment(line string) string {
 	parts := strings.Split(line, "#")
 	switch len(parts) {

syft/cataloger/python/parse_setup.go

@@ -0,0 +1,50 @@
+package python
+
+import (
+	"bufio"
+	"io"
+	"regexp"
+	"strings"
+
+	"github.com/anchore/syft/syft/cataloger/common"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+// integrity check
+var _ common.ParserFn = parseSetup
+
+// match examples:
+//		'pathlib3==2.2.0;python_version<"3.6"'  --> match(name=pathlib3 version=2.2.0)
+//		 "mypy==v0.770",                        --> match(name=mypy version=v0.770)
+//		" mypy2 == v0.770", ' mypy3== v0.770',  --> match(name=mypy2 version=v0.770), match(name=mypy3, version=v0.770)
+var pinnedDependency = regexp.MustCompile(`['"]\W?(\w+\W?==\W?[\w\.]*)`)
+
+func parseSetup(_ string, reader io.Reader) ([]pkg.Package, error) {
+	packages := make([]pkg.Package, 0)
+
+	scanner := bufio.NewScanner(reader)
+
+	for scanner.Scan() {
+		line := scanner.Text()
+		line = strings.TrimRight(line, "\n")
+
+		for _, match := range pinnedDependency.FindAllString(line, -1) {
+			parts := strings.Split(match, "==")
+			if len(parts) != 2 {
+				continue
+			}
+			name := strings.Trim(parts[0], "'\"")
+			name = strings.TrimSpace(name)
+
+			version := strings.TrimSpace(parts[len(parts)-1])
+			packages = append(packages, pkg.Package{
+				Name:     strings.Trim(name, "'\""),
+				Version:  strings.Trim(version, "'\""),
+				Language: pkg.Python,
+				Type:     pkg.PythonSetupPkg,
+			})
+		}
+	}
+
+	return packages, nil
+}

syft/cataloger/python/parse_setup_test.go

@@ -0,0 +1,60 @@
+package python
+
+import (
+	"os"
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func TestParseSetup(t *testing.T) {
+	expected := map[string]pkg.Package{
+		"pathlib3": {
+			Name:     "pathlib3",
+			Version:  "2.2.0",
+			Language: pkg.Python,
+			Type:     pkg.PythonSetupPkg,
+			Licenses: []string{},
+		},
+		"mypy": {
+			Name:     "mypy",
+			Version:  "v0.770",
+			Language: pkg.Python,
+			Type:     pkg.PythonSetupPkg,
+			Licenses: []string{},
+		},
+		"mypy1": {
+			Name:     "mypy1",
+			Version:  "v0.770",
+			Language: pkg.Python,
+			Type:     pkg.PythonSetupPkg,
+			Licenses: []string{},
+		},
+		"mypy2": {
+			Name:     "mypy2",
+			Version:  "v0.770",
+			Language: pkg.Python,
+			Type:     pkg.PythonSetupPkg,
+			Licenses: []string{},
+		},
+		"mypy3": {
+			Name:     "mypy3",
+			Version:  "v0.770",
+			Language: pkg.Python,
+			Type:     pkg.PythonSetupPkg,
+			Licenses: []string{},
+		},
+	}
+	fixture, err := os.Open("test-fixtures/setup/setup.py")
+	if err != nil {
+		t.Fatalf("failed to open fixture: %+v", err)
+	}
+
+	actual, err := parseSetup(fixture.Name(), fixture)
+	if err != nil {
+		t.Fatalf("failed to parse requirements: %+v", err)
+	}
+
+	assertPkgsEqual(t, actual, expected)
+
+}

syft/cataloger/python/parse_wheel_egg.go

@@ -6,9 +6,16 @@ import (
 	"io"
 	"strings"
 
+	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 )
 
+// integrity check
+var _ common.ParserFn = parseWheelMetadata
+var _ common.ParserFn = parseEggMetadata
+
+// parseWheelMetadata is a parser function for individual Python Wheel metadata file contents, returning all Python
+// packages listed.
 func parseWheelMetadata(_ string, reader io.Reader) ([]pkg.Package, error) {
 	packages, err := parseWheelOrEggMetadata(reader)
 	for idx := range packages {
@@ -17,6 +24,8 @@ func parseWheelMetadata(_ string, reader io.Reader) ([]pkg.Package, error) {
 	return packages, err
 }
 
+// parseEggMetadata is a parser function for individual Python Egg metadata file contents, returning all Python
+// packages listed.
 func parseEggMetadata(_ string, reader io.Reader) ([]pkg.Package, error) {
 	packages, err := parseWheelOrEggMetadata(reader)
 	for idx := range packages {
@@ -25,6 +34,8 @@ func parseEggMetadata(_ string, reader io.Reader) ([]pkg.Package, error) {
 	return packages, err
 }
 
+// parseWheelOrEggMetadata takes a Python Egg or Wheel (which share the same format and values for our purposes),
+// returning all Python packages listed.
 func parseWheelOrEggMetadata(reader io.Reader) ([]pkg.Package, error) {
 	fields := make(map[string]string)
 	var key string

syft/cataloger/python/parse_wheel_egg_test.go

@@ -45,6 +45,7 @@ func assertPkgsEqual(t *testing.T, actual []pkg.Package, expected map[string]pkg
 
 	}
 }
+
 func TestParseEggMetadata(t *testing.T) {
 	expected := map[string]pkg.Package{
 		"requests": {
@@ -66,7 +67,6 @@ func TestParseEggMetadata(t *testing.T) {
 	}
 
 	assertPkgsEqual(t, actual, expected)
-
 }
 
 func TestParseWheelMetadata(t *testing.T) {
@@ -90,5 +90,4 @@ func TestParseWheelMetadata(t *testing.T) {
 	}
 
 	assertPkgsEqual(t, actual, expected)
-
 }

syft/cataloger/python/poetry_metadata.go

@@ -0,0 +1,18 @@
+package python
+
+import "github.com/anchore/syft/syft/pkg"
+
+type PoetryMetadata struct {
+	Packages []PoetryMetadataPackage `toml:"package"`
+}
+
+// Pkgs returns all of the packages referenced within the poetry.lock metadata.
+func (m PoetryMetadata) Pkgs() []pkg.Package {
+	pkgs := make([]pkg.Package, 0)
+
+	for _, p := range m.Packages {
+		pkgs = append(pkgs, p.Pkg())
+	}
+
+	return pkgs
+}

syft/cataloger/python/poetry_metadata_package.go

@@ -0,0 +1,21 @@
+package python
+
+import "github.com/anchore/syft/syft/pkg"
+
+type PoetryMetadataPackage struct {
+	Name        string `toml:"name"`
+	Version     string `toml:"version"`
+	Category    string `toml:"category"`
+	Description string `toml:"description"`
+	Optional    bool   `toml:"optional"`
+}
+
+// Pkg returns the standard `pkg.Package` representation of the package referenced within the poetry.lock metadata.
+func (p PoetryMetadataPackage) Pkg() pkg.Package {
+	return pkg.Package{
+		Name:     p.Name,
+		Version:  p.Version,
+		Language: pkg.Python,
+		Type:     pkg.PoetryPkg,
+	}
+}

syft/cataloger/python/test-fixtures/poetry/poetry.lock

@@ -0,0 +1,64 @@
+[[package]]
+category = "dev"
+description = "Sphinx \"added-value\" extension"
+name = "added-value"
+optional = false
+python-versions = "*"
+version = "0.14.2"
+
+[package.dependencies]
+docutils = "*"
+natsort = "*"
+six = "*"
+sphinx = "*"
+
+[package.extras]
+deploy = ["bumpversion", "twine", "wheel"]
+docs = ["sphinx", "sphinx-rtd-theme"]
+test = ["pytest", "pytest-cov", "coveralls", "beautifulsoup4", "hypothesis"]
+
+[[package]]
+category = "dev"
+description = "A configurable sidebar-enabled Sphinx theme"
+name = "alabaster"
+optional = false
+python-versions = "*"
+version = "0.7.12"
+
+[[package]]
+category = "dev"
+description = "Disable App Nap on OS X 10.9"
+marker = "python_version >= \"3.4\" and sys_platform == \"darwin\" or sys_platform == \"darwin\""
+name = "appnope"
+optional = false
+python-versions = "*"
+version = "0.1.0"
+
+[[package]]
+category = "dev"
+description = "Draws ASCII trees."
+name = "asciitree"
+optional = false
+python-versions = "*"
+version = "0.3.3"
+
+[metadata]
+content-hash = "6e35f765c2f01c635c2fb0d54a9d7dd68742350f04449ee24efad03e3c9eb0bb"
+python-versions = "^3.6"
+
+[metadata.files]
+added-value = [
+    {file = "added-value-0.14.2.tar.gz", hash = "sha256:8c886aee74635cec15beb64c28a90ae664526f331c1a4941e4d6ab98af232028"},
+    {file = "added_value-0.14.2-py2.py3-none-any.whl", hash = "sha256:b25fcb86f9bfad9a40adf4d344322690e312741556c7b75681bc948380a251e6"},
+]
+alabaster = [
+    {file = "alabaster-0.7.12-py2.py3-none-any.whl", hash = "sha256:446438bdcca0e05bd45ea2de1668c1d9b032e1a9154c2c259092d77031ddd359"},
+    {file = "alabaster-0.7.12.tar.gz", hash = "sha256:a661d72d58e6ea8a57f7a86e37d86716863ee5e92788398526d58b26a4e4dc02"},
+]
+appnope = [
+    {file = "appnope-0.1.0-py2.py3-none-any.whl", hash = "sha256:5b26757dc6f79a3b7dc9fab95359328d5747fcb2409d331ea66d0272b90ab2a0"},
+    {file = "appnope-0.1.0.tar.gz", hash = "sha256:8b995ffe925347a2138d7ac0fe77155e4311a0ea6d6da4f5128fe4b3cbe5ed71"},
+]
+asciitree = [
+    {file = "asciitree-0.3.3.tar.gz", hash = "sha256:4aa4b9b649f85e3fcb343363d97564aa1fb62e249677f2e18a96765145cc0f6e"},
+]

syft/cataloger/python/test-fixtures/setup/setup.py

@@ -0,0 +1,46 @@
+from setuptools import setup
+
+# Sample setup.py from the pytest project with added comments specific
+# to the cataloger
+
+INSTALL_REQUIRES = [
+    "py>=1.5.0",
+    "packaging",
+    "attrs>=17.4.0",
+    "more-itertools>=4.0.0",
+    'atomicwrites>=1.0;sys_platform=="win32"',  # sys_platform is ignored
+    'pathlib2>=2.2.0;python_version=="3.6"',  # python_version is ignored
+    'pathlib3==2.2.0;python_version<"3.6"',  # this is caught
+    'colorama;sys_platform=="win32"',
+    "pluggy>=0.12,<1.0",
+    'importlib-metadata>=0.12;python_version<"3.8"',
+    "wcwidth",
+]
+
+
+def main():
+    setup(
+        use_scm_version={"write_to": "src/_pytest/_version.py"},
+        setup_requires=["setuptools-scm", "setuptools>=40.0"],
+        package_dir={"": "src"},
+        extras_require={
+            "testing": [
+                "argcomplete",
+                "hypothesis>=3.56",
+                "mock",
+                "nose",
+                "requests",
+                "xmlschema",
+            ],
+            "checkqa-mypy": [
+                "mypy==v0.770",  # this is caught
+                " mypy1==v0.770",  # this is caught
+                " mypy2 == v0.770", ' mypy3== v0.770',  # this is caught
+            ],
+        },
+        install_requires=INSTALL_REQUIRES,
+    )
+
+
+if __name__ == "__main__":
+    main()

syft/cataloger/rpmdb/cataloger.go

@@ -1,17 +1,24 @@
+/*
+Package rpmdb provides a concrete Cataloger implementation for RPM "Package" DB files.
+*/
 package rpmdb
 
 import (
+	"io"
+
 	"github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/scope"
 )
 
+// Cataloger catalogs pkg.RpmPkg Package Types defined in RPM DB files.
 type Cataloger struct {
 	cataloger common.GenericCataloger
 }
 
-func NewCataloger() *Cataloger {
+// New returns a new RPM DB cataloger object.
+func New() *Cataloger {
 	globParsers := map[string]common.ParserFn{
 		"**/var/lib/rpm/Packages": parseRpmDB,
 	}
@@ -21,14 +28,17 @@ func NewCataloger() *Cataloger {
 	}
 }
 
-func (a *Cataloger) Name() string {
+// Name returns a string that uniquely describes this cataloger.
+func (c *Cataloger) Name() string {
 	return "rpmdb-cataloger"
 }
 
-func (a *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
-	return a.cataloger.SelectFiles(resolver)
+// SelectFiles returns a set of discovered RPM DB files from the user content source.
+func (c *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
+	return c.cataloger.SelectFiles(resolver)
 }
 
-func (a *Cataloger) Catalog(contents map[file.Reference]string) ([]pkg.Package, error) {
-	return a.cataloger.Catalog(contents, a.Name())
+// Catalog returns the Packages indexed from all RPM DB files discovered.
+func (c *Cataloger) Catalog(contents map[file.Reference]io.Reader) ([]pkg.Package, error) {
+	return c.cataloger.Catalog(contents)
 }

syft/cataloger/rpmdb/parse_rpmdb.go

@@ -6,12 +6,17 @@ import (
 	"io/ioutil"
 	"os"
 
+	rpmdb "github.com/anchore/go-rpmdb/pkg"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
-	rpmdb "github.com/wagoodman/go-rpmdb/pkg"
 )
 
+// integrity check
+var _ common.ParserFn = parseRpmDB
+
+// parseApkDb parses an "Packages" RPM DB and returns the Packages listed within it.
 func parseRpmDB(_ string, reader io.Reader) ([]pkg.Package, error) {
 	f, err := ioutil.TempFile("", internal.ApplicationName+"-rpmdb")
 	if err != nil {
@@ -45,12 +50,19 @@ func parseRpmDB(_ string, reader io.Reader) ([]pkg.Package, error) {
 	for _, entry := range pkgList {
 		p := pkg.Package{
 			Name:    entry.Name,
-			Version: entry.Version,
-			Type:    pkg.RpmPkg,
+			Version: fmt.Sprintf("%s-%s", entry.Version, entry.Release), // this is what engine does
+			//Version: fmt.Sprintf("%d:%s-%s.%s", entry.Epoch, entry.Version, entry.Release, entry.Arch),
+			Type: pkg.RpmPkg,
 			Metadata: pkg.RpmMetadata{
-				Epoch:   entry.Epoch,
-				Arch:    entry.Arch,
-				Release: entry.Release,
+				Name:      entry.Name,
+				Version:   entry.Version,
+				Epoch:     entry.Epoch,
+				Arch:      entry.Arch,
+				Release:   entry.Release,
+				SourceRpm: entry.SourceRpm,
+				Vendor:    entry.Vendor,
+				License:   entry.License,
+				Size:      entry.Size,
 			},
 		}
 

syft/cataloger/rpmdb/parse_rpmdb_test.go

@@ -11,12 +11,18 @@ func TestParseRpmDB(t *testing.T) {
 	expected := map[string]pkg.Package{
 		"dive": {
 			Name:    "dive",
-			Version: "0.9.2",
+			Version: "0.9.2-1",
 			Type:    pkg.RpmPkg,
 			Metadata: pkg.RpmMetadata{
-				Epoch:   0,
-				Arch:    "x86_64",
-				Release: "1",
+				Name:      "dive",
+				Epoch:     0,
+				Arch:      "x86_64",
+				Release:   "1",
+				Version:   "0.9.2",
+				SourceRpm: "dive-0.9.2-1.src.rpm",
+				Size:      12406784,
+				License:   "MIT",
+				Vendor:    "",
 			},
 		},
 	}
@@ -31,11 +37,11 @@ func TestParseRpmDB(t *testing.T) {
 		t.Fatalf("failed to parse rpmdb: %+v", err)
 	}
 
-	if len(actual) != 1 {
+	if len(actual) != len(expected) {
 		for _, a := range actual {
 			t.Log("   ", a)
 		}
-		t.Fatalf("unexpected package count: %d!=%d", len(actual), 1)
+		t.Fatalf("unexpected package count: %d!=%d", len(actual), len(expected))
 	}
 
 	for _, a := range actual {

syft/cataloger/rpmdb/test-fixtures/generate-fixture.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -eux
 
-docker create --name generate-rpmdb-fixture centos:latest sh -c 'tail -f /dev/null'
+docker create --name generate-rpmdb-fixture centos:8 sh -c 'tail -f /dev/null'
 
 function cleanup {
   docker kill generate-rpmdb-fixture

syft/client.go

@@ -0,0 +1,91 @@
+/*
+A "one-stop-shop" for helper utilities for all major functionality provided by child packages of the syft library.
+*/
+package syft
+
+import (
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/cataloger"
+	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/syft/logger"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/plugin"
+	"github.com/anchore/syft/syft/scope"
+	"github.com/wagoodman/go-partybus"
+)
+
+type Config struct {
+	PluginDirectory string
+}
+
+type Client struct {
+	config  Config
+	plugins *plugin.Repository
+}
+
+func NewClient(config Config) (Client, error) {
+	plugins, err := plugin.NewRepositoryFromDirectory(config.PluginDirectory)
+	if err != nil {
+		return Client{}, err
+	}
+
+	return Client{
+		config:  config,
+		plugins: plugins,
+	}, nil
+}
+
+// Catalog the given image from a particular perspective (e.g. squashed scope, all-layers scope). Returns the discovered
+// set of packages, the identified Linux distribution, and the scope object used to wrap the data source.
+func (c *Client) Catalog(userInput string, scoptOpt scope.Option) (*pkg.Catalog, *scope.Scope, *distro.Distro, error) {
+	log.Info("cataloging image")
+	s, cleanup, err := scope.NewScope(userInput, scoptOpt)
+	defer cleanup()
+	if err != nil {
+		return nil, nil, nil, err
+	}
+
+	d := c.IdentifyDistro(s)
+
+	catalog, err := c.CatalogFromScope(s)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+
+	return catalog, &s, &d, nil
+}
+
+// IdentifyDistro attempts to discover what the underlying Linux distribution may be from the available flat files
+// provided by the given scope object. If results are inconclusive a "UnknownDistro" Type is returned.
+func (c *Client) IdentifyDistro(s scope.Scope) distro.Distro {
+	d := distro.Identify(s.Resolver)
+	if d.Type != distro.UnknownDistroType {
+		log.Infof("identified distro: %s", d.String())
+	} else {
+		log.Info("could not identify distro")
+	}
+	return d
+}
+
+// Catalog the given scope, which may represent a container image or filesystem. Returns the discovered set of packages.
+func (c *Client) CatalogFromScope(s scope.Scope) (*pkg.Catalog, error) {
+	log.Info("building the catalog")
+	pluginCatalogers, deactivatePluginsFn, err := c.plugins.ActivateCatalogers()
+	defer deactivatePluginsFn()
+	if err != nil {
+		return nil, err
+	}
+
+	return cataloger.Catalog(s.Resolver, append(pluginCatalogers, cataloger.BuiltIn()...)...)
+}
+
+// SetLogger sets the logger object used for all syft logging calls.
+func SetLogger(logger logger.Logger) {
+	log.Log = logger
+}
+
+// SetBus sets the event bus for all syft library bus publish events onto (in-library subscriptions are not allowed).
+func SetBus(b *partybus.Bus) {
+	bus.SetPublisher(b)
+}

syft/distro/identify.go

@@ -1,6 +1,7 @@
 package distro
 
 import (
+	"io/ioutil"
 	"regexp"
 	"strings"
 
@@ -10,6 +11,7 @@ import (
 )
 
 // returns a distro or nil
+// TODO: refactor to io.Reader
 type parseFunc func(string) *Distro
 
 type parseEntry struct {
@@ -17,8 +19,9 @@ type parseEntry struct {
 	fn   parseFunc
 }
 
-// Identify parses distro-specific files to determine distro metadata like version and release
-func Identify(s scope.Scope) Distro {
+// nolint: funlen
+// Identify parses distro-specific files to determine distro metadata like version and release.
+func Identify(resolver scope.Resolver) Distro {
 	distro := NewUnknownDistro()
 
 	identityFiles := []parseEntry{
@@ -41,7 +44,7 @@ func Identify(s scope.Scope) Distro {
 
 identifyLoop:
 	for _, entry := range identityFiles {
-		refs, err := s.FilesByPath(entry.path)
+		refs, err := resolver.FilesByPath(entry.path)
 		if err != nil {
 			log.Errorf("unable to get path refs from %s: %s", entry.path, err)
 			break
@@ -52,8 +55,8 @@ identifyLoop:
 		}
 
 		for _, ref := range refs {
-			contents, err := s.MultipleFileContentsByRef(ref)
-			content, ok := contents[ref]
+			contentReaders, err := resolver.MultipleFileContentsByRef(ref)
+			contentReader, ok := contentReaders[ref]
 
 			if !ok {
 				log.Infof("no content present for ref: %s", ref)
@@ -65,6 +68,14 @@ identifyLoop:
 				continue
 			}
 
+			bytes, err := ioutil.ReadAll(contentReader)
+			if err != nil {
+				log.Debugf("unable to read contents from %s: %s", entry.path, err)
+				continue
+			}
+
+			content := string(bytes)
+
 			if content == "" {
 				log.Debugf("no contents in file, skipping: %s", entry.path)
 				continue

syft/distro/identify_test.go

@@ -75,12 +75,12 @@ func TestIdentifyDistro(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.fixture, func(t *testing.T) {
-			s, err := scope.NewScopeFromDir(test.fixture, scope.AllLayersScope)
+			s, err := scope.NewScopeFromDir(test.fixture)
 			if err != nil {
 				t.Fatalf("unable to produce a new scope for testing: %s", test.fixture)
 			}
 
-			d := Identify(s)
+			d := Identify(s.Resolver)
 			observedDistros.Add(d.String())
 
 			if d.Type != test.Type {

syft/event/event.go

@@ -1,9 +1,13 @@
+/*
+Package event provides event types for all events that the syft library published onto the event bus. By convention, for each event
+defined here there should be a corresponding event parser defined in the parsers/ child package.
+*/
 package event
 
 import "github.com/wagoodman/go-partybus"
 
 const (
-	AppUpdateAvailable partybus.EventType = "app-update-available"
-	CatalogerStarted   partybus.EventType = "cataloger-started-event"
-	CatalogerFinished  partybus.EventType = "cataloger-finished-event"
+	AppUpdateAvailable partybus.EventType = "syft-app-update-available"
+	CatalogerStarted   partybus.EventType = "syft-cataloger-started-event"
+	CatalogerFinished  partybus.EventType = "syft-cataloger-finished-event"
 )

syft/event/parsers/parsers.go

@@ -1,3 +1,6 @@
+/*
+Package parsers provides parser helpers to extract payloads for each event type that the syft library publishes onto the event bus.
+*/
 package parsers
 
 import (

syft/lib.go

@@ -1,52 +0,0 @@
-package syft
-
-import (
-	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/cataloger"
-	"github.com/anchore/syft/syft/distro"
-	"github.com/anchore/syft/syft/logger"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/scope"
-	"github.com/wagoodman/go-partybus"
-)
-
-func Catalog(userInput string, scoptOpt scope.Option) (*pkg.Catalog, *scope.Scope, *distro.Distro, error) {
-	s, cleanup, err := scope.NewScope(userInput, scoptOpt)
-	defer cleanup()
-	if err != nil {
-		return nil, nil, nil, err
-	}
-
-	d := IdentifyDistro(s)
-
-	catalog, err := CatalogFromScope(s)
-	if err != nil {
-		return nil, nil, nil, err
-	}
-
-	return catalog, &s, &d, nil
-}
-
-func IdentifyDistro(s scope.Scope) distro.Distro {
-	d := distro.Identify(s)
-	if d.Type != distro.UnknownDistroType {
-		log.Infof("Identified Distro: %s", d.String())
-	} else {
-		log.Info("Could not identify distro")
-	}
-	return d
-}
-
-func CatalogFromScope(s scope.Scope) (*pkg.Catalog, error) {
-	log.Info("Building the Catalog")
-	return cataloger.Catalog(s)
-}
-
-func SetLogger(logger logger.Logger) {
-	log.Log = logger
-}
-
-func SetBus(b *partybus.Bus) {
-	bus.SetPublisher(b)
-}

syft/logger/logger.go

@@ -1,7 +1,11 @@
+/*
+Defines the logging interface which is used throughout the syft library.
+*/
 package logger
 
 type Logger interface {
 	Errorf(format string, args ...interface{})
+	Error(args ...interface{})
 	Infof(format string, args ...interface{})
 	Info(args ...interface{})
 	Debugf(format string, args ...interface{})