working

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

.bouncer.yaml

@@ -3,4 +3,7 @@ permit:
   - MIT.*
   - Apache.*
   - MPL.*
-  - ISC
+  - ISC
+ignore-packages:
+  # packageurl-go is released under the MIT license located in the root of the repo at /mit.LICENSE
+  - github.com/package-url/packageurl-go

.circleci/config.yml

@@ -15,7 +15,6 @@ jobs:
     # 2CPU / 4GB RAM
     resource_class: medium
     steps:
-
       - checkout
 
       - restore_cache:
@@ -48,7 +47,6 @@ jobs:
     # 2CPU / 4GB RAM
     resource_class: medium
     steps:
-
       - checkout
 
       - restore_cache:
@@ -69,15 +67,15 @@ jobs:
       - run:
           name: enable docker client
           command: |
-              # all of this to enable "circleci local execute ..." cli commands for /var/run/docker.sock
-              mkdir -p ${HOME}/.local/bin
-              cat \<< EOF > ${HOME}/.local/bin/docker
-              #!/bin/bash
-              set -xue
-              sudo -E ${HOME}/.local/bin/docker.bin \$@
-              EOF
-              sudo mv /usr/bin/docker ${HOME}/.local/bin/docker.bin
-              chmod 755 ${HOME}/.local/bin/docker
+            # all of this to enable "circleci local execute ..." cli commands for /var/run/docker.sock
+            mkdir -p ${HOME}/.local/bin
+            cat \<< EOF > ${HOME}/.local/bin/docker
+            #!/bin/bash
+            set -xue
+            sudo -E ${HOME}/.local/bin/docker.bin \$@
+            EOF
+            sudo mv /usr/bin/docker ${HOME}/.local/bin/docker.bin
+            chmod 755 ${HOME}/.local/bin/docker
 
       - run:
           name: build cache key for java test-fixture blobs
@@ -96,6 +94,10 @@ jobs:
           paths:
             - "syft/cataloger/java/test-fixtures/java-builds/packages"
 
+      - run:
+          name: validate syft output against the CycloneDX schema
+          command: make validate-cyclonedx-schema
+
       - run:
           name: build hash key for integration test-fixtures blobs
           command: make integration-fingerprint
@@ -124,4 +126,4 @@ workflows:
           version: "1.13"
       - run-tests:
           name: "Unit & Integration Tests (go-latest)"
-          version: "latest"
+          version: "latest"

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+contact_links:
+
+  - name: Help & Support Slack Channel ⛑️
+    # link to toolbox-help channel
+    url: https://anchorecommunity.slack.com/archives/C019BUXV7R6
+    about: Ask a questions and get answers
+
+  - name: Developer Slack Channel 💬
+    # link to toolbox-dev channel
+    url: https://anchorecommunity.slack.com/archives/C0190NF9TSM
+    about: Participate in design discussions and feature development

.github/scripts/update-version-file.sh

@@ -5,7 +5,9 @@ BIN="syft"
 DISTDIR=$1
 VERSION=$2
 
-if [[ $VERSION == *-* ]] ; then
+# the source of truth as to whether we want to notify users of an update is if the release just created is NOT
+# flagged as a pre-release on github
+if [[ "$(curl -SsL https://api.github.com/repos/anchore/${BIN}/releases/tags/${VERSION} | jq .prerelease)" == "true" ]] ; then
    echo "skipping publishing a version file (this is a pre-release: ${VERSION})"
    exit 0
 fi

.github/workflows/acceptance-test.yaml

@@ -17,12 +17,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
 
-      # TODO: remove me after release
-      - name: Configure git for private modules
-        env:
-          TOKEN: ${{ secrets.ANCHORE_GIT_READ_TOKEN }}
-        run: git config --global url."https://anchore:${TOKEN}@github.com".insteadOf "https://github.com"
-
       - uses: actions/setup-go@v2
         with:
           go-version: ${{ env.GO_VERSION }}

.github/workflows/release.yaml

@@ -75,12 +75,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
 
-      # TODO: remove me after release
-      - name: Configure git for private modules
-        env:
-          TOKEN: ${{ secrets.ANCHORE_GIT_READ_TOKEN }}
-        run: git config --global url."https://anchore:${TOKEN}@github.com".insteadOf "https://github.com"
-
       - uses: actions/setup-go@v2
         with:
           go-version: ${{ env.GO_VERSION }}

.gitignore

@@ -1,3 +1,4 @@
+CHANGELOG.md
 /dist
 /snapshot
 .server/

.golangci.yaml

@@ -1,3 +1,9 @@
+# TODO: enable this when we have coverage on docstring comments
+#issues:
+#  # The list of ids of default excludes to include or disable.
+#  include:
+#    - EXC0002 # disable excluding of issues about comments from golint
+
 linters:
   # inverted configuration with `enable-all` and `disable` is not scalable during updates of golangci-lint
   disable-all: true
@@ -25,7 +31,6 @@ linters:
     - misspell
     - nakedret
     - nolintlint
-    - prealloc
     - rowserrcheck
     - scopelint
     - staticcheck
@@ -49,5 +54,6 @@ linters:
 #    - lll         # without a way to specify per-line exception cases, this is not usable
 #    - maligned    # this is an excellent linter, but tricky to optimize and we are not sensitive to memory layout optimizations
 #    - nestif
+#    - prealloc    # this unnecessarily requires preallocations for slices
 #    - testpackage
 #    - wsl

.goreleaser.yaml

@@ -1,9 +1,11 @@
 release:
-  # If set to auto, will mark the release as not ready for production
-  # in case there is an indicator for this in the tag e.g. v1.0.0-rc1
-  # If set to true, will mark the release as not ready for production.
+  # If set to auto, will mark the release as not ready for production in case there is an indicator for this in the
+  # tag e.g. v1.0.0-rc1 .If set to true, will mark the release as not ready for production.
   prerelease: false
 
+  # If set to true, will not auto-publish the release. This is done to allow us to review the changelog before publishing.
+  draft: true
+
 signs:
   - artifacts: checksum
     args: ["--output", "${signature}", "--detach-sign", "${artifact}"]

Makefile

@@ -60,7 +60,7 @@ all: clean static-analysis test ## Run all linux-based checks (linting, license
 	@printf '$(SUCCESS)All checks pass!$(RESET)\n'
 
 .PHONY: test
-test: unit integration acceptance-linux ## Run all tests (currently unit, integration, and linux acceptance tests)
+test: unit validate-cyclonedx-schema integration acceptance-linux ## Run all tests (currently unit, integration, and linux acceptance tests)
 
 .PHONY: help
 help:
@@ -68,7 +68,7 @@ help:
 
 .PHONY: ci-bootstrap
 ci-bootstrap: bootstrap
-	sudo apt install -y bc
+	DEBIAN_FRONTEND=noninteractive sudo apt update && sudo -E apt install -y bc jq libxml2-utils
 
 .PHONY: bootstrap
 bootstrap: ## Download and install all go dependencies (+ prep tooling in the ./tmp dir)
@@ -111,6 +111,10 @@ lint-fix: ## Auto-format all source code + run golangci lint fixers
 check-licenses:
 	$(TEMPDIR)/bouncer check
 
+.PHONY: validate-cyclonedx-schema
+validate-cyclonedx-schema:
+	cd schema/cyclonedx && make
+
 .PHONY: unit
 unit: fixtures ## Run unit tests (with coverage)
 	$(call title,Running unit tests)
@@ -143,7 +147,7 @@ generate-json-schema: clean-json-schema-examples integration ## Generate a new j
 	docker run \
 		-i \
 		--rm \
-		-v $(shell pwd)/json-schema:/work \
+		-v $(shell pwd)/schema/json:/work \
 		-w /work \
 		python:3.8 \
 			bash -x -c "\
@@ -165,6 +169,9 @@ check-pipeline: ## Run local CircleCI pipeline locally (sanity check)
 	circleci local execute -c .tmp/circleci.yml --job "Unit & Integration Tests (go-latest)"
 	@printf '$(SUCCESS)Pipeline checks pass!$(RESET)\n'
 
+proto:
+	protoc -I syft/plugin/proto/ syft/plugin/proto/cataloger.proto --go_out=plugins=grpc:syft/plugin/proto/
+
 .PHONY: build
 build: $(SNAPSHOTDIR) ## Build release snapshot binaries and packages
 
@@ -222,8 +229,21 @@ acceptance-test-rpm-package-install: $(SNAPSHOTDIR)
 			$(ACC_TEST_IMAGE) \
 			$(RESULTSDIR)
 
+.PHONY: changlog
+changelog:
+	mkdir -p $(DISTDIR)
+	@docker run -it --rm  \
+		-v "$(shell pwd)":/usr/local/src/your-app ferrarimarco/github-changelog-generator \
+		--user anchore \
+		--project $(BIN) \
+		-t ${GITHUB_TOKEN} \
+		--no-pr-wo-labels \
+		--no-issues-wo-labels \
+		--unreleased-only \
+		--future-release $(VERSION)
+
 .PHONY: release
-release: clean-dist ## Build and publish final binaries and packages
+release: clean-dist changelog ## Build and publish final binaries and packages
 	$(call title,Publishing release artifacts)
 	# create a config with the dist dir overridden
 	echo "dist: $(DISTDIR)" > $(TEMPDIR)/goreleaser.yaml
@@ -231,7 +251,10 @@ release: clean-dist ## Build and publish final binaries and packages
 
 	# release
 	BUILD_GIT_TREE_STATE=$(GITTREESTATE) \
-	$(TEMPDIR)/goreleaser --rm-dist --config $(TEMPDIR)/goreleaser.yaml
+	$(TEMPDIR)/goreleaser \
+		--rm-dist \
+		--config $(TEMPDIR)/goreleaser.yaml \
+		--release-notes <(cat CHANGELOG.md)
 
 	# verify checksum signatures
 	.github/scripts/verify-signature.sh "$(DISTDIR)"
@@ -253,4 +276,4 @@ clean-dist:
 
 .PHONY: clean-json-schema-examples
 clean-json-schema-examples:
-	rm json-schema/examples/*
+	rm -f schema/json/examples/*

README.md

@@ -3,16 +3,18 @@
 [![CircleCI](https://circleci.com/gh/anchore/syft.svg?style=svg)](https://circleci.com/gh/anchore/syft)
 [![Go Report Card](https://goreportcard.com/badge/github.com/anchore/syft)](https://goreportcard.com/report/github.com/anchore/syft)
 [![GitHub release](https://img.shields.io/github/release/anchore/syft.svg)](https://github.com/anchore/syft/releases/latest)
-[![License: Apache-2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://github.com/anchore/syft/blob/master/LICENSE)
+[![License: Apache-2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://github.com/anchore/syft/blob/main/LICENSE)
 
 A CLI tool and go library for generating a Software Bill of Materials (SBOM) from container images and filesystems.
 
-[//]: # (TODO: add example gif here)
+![syft-demo](https://user-images.githubusercontent.com/590471/90277200-2a253000-de33-11ea-893f-32c219eea11a.gif)
 
 **Features**
 - Catalog container images and filesystems to discover packages and libraries.
 - Supports packages and libraries from various ecosystems (APK, DEB, RPM, Ruby Bundles, Python Wheel/Egg/requirements.txt, JavaScript NPM/Yarn, Java JAR/EAR/WAR, Jenkins plugins JPI/HPI, Go modules)
-- OS distribution detection (supports alpine, busybox, centos/redhat, debian/ubuntu flavored distributions)
+- Linux distribution identification (supports Alpine, BusyBox, CentOS/RedHat, Debian/Ubuntu flavored distributions)
+
+> :warning: **This is pre-release software** and it may not work as expected. If you encounter an issue, please [let us know using the issue tracker](https://github.com/anchore/syft/issues).
 
 ## Getting started
 
@@ -48,10 +50,10 @@ syft <image> -o text
 **Recommended**
 ```bash
 # install the latest version to /usr/local/bin
-curl -sSfL https://raw.githubusercontent.com/anchore/syft/master/install.sh | sh -s -- -b /usr/local/bin
+curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
 
 # install a specific version into a specific dir
-curl -sSfL https://raw.githubusercontent.com/anchore/syft/master/install.sh | sh -s <RELEASE_VERSION> -b <SOME_BIN_PATH>
+curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s <RELEASE_VERSION> -b <SOME_BIN_PATH>
 ```
 
 **macOS**
@@ -99,3 +101,9 @@ log:
 # enable/disable checking for application updates on startup
 check-for-app-update: true
 ```
+
+## Future plans
+
+The following areas of potential development are currently being investigated:
+- Add CycloneDX to list of output formats
+- Establish a stable interchange format w/Grype

RELEASE.md

@@ -0,0 +1,99 @@
+# Release Process
+
+A good release process has the following qualities:
+
+1. There is a way to plan what should be in a release
+1. There is a way to see what is actually in a release
+1. Allow for different kinds of releases (major breaking vs backwards compatible
+   enhancements vs patch updates)
+1. Specify a repeatable way to build and publish software artifacts
+
+## Planning a release
+
+To indicate a set of features to be released together add each issue to an in-repository
+Milestone named with major-minor version to be released (e.g. `v0.1`). It is OK for other
+features to be in the release that were not originally planned, and these issues and PRs
+do not need to be added to the Milestone in question. Only the set of features that, when
+completed, would allow the release to be considered complete. A Milestone is only used to:
+
+- Plan what is desired to be in a release
+- Track progress to indicate when we may be ready to cut a new release
+
+Not all releases need to be planned. For instance, patch releases for fixes should be
+released when they are ready and when releasing would not interfere with another current
+release (where some partial or breaking features have already been merged). Beta releases
+and release candidates should not be independently planned from the non-beta release. That
+is, the features for a `v0.1-beta.1` release should be planned under the `v0.1` Milestone,
+not under a separate `v0.1-beta.1` Milestone.
+
+Unless necessary, feature releases should be small and frequent, which may obviate the
+need for regular release planning under a Milestone.
+
+## What is in a release
+
+Milestones are specifically for planning a release, not necessarily tracking all changes
+that a release may bring (and more importantly, not all releases are necessarily planned
+either).
+
+This is one of the (many) reasons for a Changelog. A good Changelog lists changes grouped
+by the type of change (new, enhancement, deprecation, breaking, bug fix, security fix), in
+chronological order (within groups), linking the PR where the change was made in the
+Changelog line. Furthermore, there should be a place to see all released versions, the
+release date for each release, the semantic version of the release, and the set of changes
+for each release.
+
+This project auto-generates the Changelog contents for each current release and posts the
+generated contents to the GitHub Release page. Leveraging the GitHub Releases feature
+allows GitHub to manage the Changelog on each release outside of the git repository while
+still being hosted with the released assets.
+
+The Changelog is generated from the metadata from in-repository issues and PRs, using
+labels to guide what kind of change each item is (e.g. breaking, new feature, bug fix,
+etx). Only issues/PRs with select labels are included in the Changelog, and only if the
+issue/PR was created after the last release. Additional labels are used to exclude items
+from the Changelog.
+
+The above suggestions imply that we should:
+
+- Ensure there is a sufficient title for each PR and issue title to be included in the
+  Changelog
+- The appropriate label is applied to PRs and/or issues to drive specific change type
+  sections (deprecated, breaking, security, bug, etc)
+
+With this approach as we cultivate good organization of PRs and issues we automatically
+get an equally good Changelog.
+
+## Major, minor, and patch releases
+
+The latest version of the tool is the only supported version, which implies that multiple
+parallel release branches will not be a regular process (if ever). Multiple releases can
+be planned in parallel, however, only one can be actively developed at a time. That is, if
+PRs attached to a release Milestone have been merged into the main branch, that release is
+now the "next" release. This implies that the source of truth for release lies with the
+git log and Changelog, not with the release Milestones (which are purely for planning and
+tracking).
+
+Semantic versioning should be used to indicate breaking changes, new features, and fixes.
+The exception to this is `< 1.0`, where the major version is not bumped for breaking changes,
+instead the minor version indicates both new features and breaking changes.
+
+## Cutting a release
+
+Ideally releasing should be done often with small increments when possible. Unless a
+breaking change is blocking the release, or no fixes/features have been merged, a good
+target release cadence is between every 2 or 4 weeks.
+
+This release process itself should be as automated as possible, and have only a few steps:
+
+1. Tag the main branch with a full semantic-version, prefixed with a `v`. If there is a
+   milestone with a partial version, the full version should be used for the git tag (e.g.
+   with a Milestone of `v0.1` the tag should be `v0.1.0`).
+
+1. Push the tag, the release pipeline will generate and publish all assets as well as a
+   draft GitHub Release.
+
+1. Promote the GitHub Release from draft to public. Note: since extra assets are made
+   available immediately from previous steps (i.e. the brew formula) the release should
+   only be in this state for a small amount of time (minutes).
+
+1. If there is a release Milestone, close it.

cmd/cmd.go

@@ -3,6 +3,10 @@ package cmd
 import (
 	"fmt"
 	"os"
+	"path"
+
+	"github.com/adrg/xdg"
+	"github.com/anchore/syft/internal"
 
 	"github.com/spf13/cobra"
 
@@ -59,7 +63,7 @@ func setGlobalCliOptions() {
 	// output & formatting options
 	flag = "output"
 	rootCmd.Flags().StringP(
-		flag, "o", presenter.TablePresenter.String(),
+		flag, "o", string(presenter.TablePresenter),
 		fmt.Sprintf("report output formatter, options=%v", presenter.Options),
 	)
 	if err := viper.BindPFlag(flag, rootCmd.Flags().Lookup(flag)); err != nil {
@@ -78,6 +82,18 @@ func setGlobalCliOptions() {
 	}
 
 	rootCmd.Flags().CountVarP(&cliOpts.Verbosity, "verbose", "v", "increase verbosity (-v = info, -vv = debug)")
+
+	// plugins
+	defaultPluginDir := path.Join(xdg.CacheHome, internal.ApplicationName, "plugins")
+	flag = "plugins.dir"
+	rootCmd.Flags().String(
+		flag, defaultPluginDir,
+		"plugin storage directory",
+	)
+	if err := viper.BindPFlag(flag, rootCmd.Flags().Lookup(flag)); err != nil {
+		fmt.Printf("unable to bind flag '%s': %+v", flag, err)
+		os.Exit(1)
+	}
 }
 
 func initAppConfig() {
@@ -101,7 +117,7 @@ func initLogging() {
 	logWrapper := logger.NewLogrusLogger(cfg)
 	syft.SetLogger(logWrapper)
 	stereoscope.SetLogger(&logger.LogrusNestedLogger{
-		Logger: logWrapper.Logger.WithField("from-lib", "steroscope"),
+		Logger: logWrapper.Logger.WithField("from-lib", "stereoscope"),
 	})
 }
 

cmd/root.go

@@ -28,8 +28,16 @@ Supports the following image sources:
 `, map[string]interface{}{
 		"appName": internal.ApplicationName,
 	}),
-	Args: cobra.ExactArgs(1),
+	Args: cobra.MaximumNArgs(1),
 	Run: func(cmd *cobra.Command, args []string) {
+		if len(args) == 0 {
+			err := cmd.Help()
+			if err != nil {
+				log.Errorf(err.Error())
+				os.Exit(1)
+			}
+			os.Exit(1)
+		}
 		err := doRunCmd(cmd, args)
 		if err != nil {
 			log.Errorf(err.Error())
@@ -60,7 +68,17 @@ func startWorker(userInput string) <-chan error {
 			}
 		}
 
-		catalog, scope, _, err := syft.Catalog(userInput, appConfig.ScopeOpt)
+		config := syft.Config{
+			PluginDirectory: appConfig.Plugins.Directory,
+		}
+
+		client, err := syft.NewClient(config)
+		if err != nil {
+			errs <- fmt.Errorf("could not initialize syft: %+v", err)
+			return
+		}
+
+		catalog, scope, distro, err := client.Catalog(userInput, appConfig.ScopeOpt)
 		if err != nil {
 			errs <- fmt.Errorf("failed to catalog input: %+v", err)
 			return
@@ -68,7 +86,7 @@ func startWorker(userInput string) <-chan error {
 
 		bus.Publish(partybus.Event{
 			Type:  event.CatalogerFinished,
-			Value: presenter.GetPresenter(appConfig.PresenterOpt, *scope, catalog),
+			Value: presenter.GetPresenter(appConfig.PresenterOpt, *scope, catalog, distro),
 		})
 	}()
 	return errs

go.mod

@@ -4,21 +4,27 @@ go 1.14
 
 require (
 	github.com/adrg/xdg v0.2.1
+	github.com/anchore/go-rpmdb v0.0.0-20200811175839-cbc751c28e8e
 	github.com/anchore/go-testutils v0.0.0-20200624184116-66aa578126db
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
-	github.com/anchore/stereoscope v0.0.0-20200803190343-146f38f8cc19
+	github.com/anchore/stereoscope v0.0.0-20200903223322-a3806f515470
 	github.com/bmatcuk/doublestar v1.3.1
 	github.com/containerd/continuity v0.0.0-20200710164510-efbc4488d8fe // indirect
 	github.com/dustin/go-humanize v1.0.0
 	github.com/go-test/deep v1.0.6
+	github.com/golang/protobuf v1.4.2
 	github.com/google/go-containerregistry v0.1.1 // indirect
+	github.com/google/uuid v1.1.1
 	github.com/gookit/color v1.2.7
 	github.com/gopherjs/gopherjs v0.0.0-20190910122728-9d188e94fb99 // indirect
+	github.com/hashicorp/go-hclog v0.14.1
 	github.com/hashicorp/go-multierror v1.1.0
+	github.com/hashicorp/go-plugin v1.3.0
 	github.com/hashicorp/go-version v1.2.0
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/mitchellh/mapstructure v1.3.1
 	github.com/olekukonko/tablewriter v0.0.4
+	github.com/package-url/packageurl-go v0.1.0
 	github.com/pelletier/go-toml v1.8.0
 	github.com/rogpeppe/go-internal v1.5.2
 	github.com/sergi/go-diff v1.1.0
@@ -27,13 +33,15 @@ require (
 	github.com/spf13/viper v1.7.0
 	github.com/wagoodman/go-partybus v0.0.0-20200526224238-eb215533f07d
 	github.com/wagoodman/go-progress v0.0.0-20200731105512-1020f39e6240
-	github.com/wagoodman/go-rpmdb v0.0.0-20200810111121-8136676cb95c
 	github.com/wagoodman/jotframe v0.0.0-20200730190914-3517092dd163
 	github.com/x-cray/logrus-prefixed-formatter v0.5.2
 	github.com/xeipuuv/gojsonschema v1.2.0
-	golang.org/x/crypto v0.0.0-20200604202706-70a84ac30bf9
+	golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9
+	golang.org/x/net v0.0.0-20200625001655-4c5254603344 // indirect
+	golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208 // indirect
 	golang.org/x/sys v0.0.0-20200610111108-226ff32320da // indirect
 	google.golang.org/genproto v0.0.0-20200615140333-fd031eab31e7 // indirect
+	google.golang.org/grpc v1.31.1
 	gopkg.in/ini.v1 v1.57.0 // indirect
 	gopkg.in/yaml.v2 v2.3.0
 )

go.sum

@@ -124,13 +124,15 @@ github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuy
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
+github.com/anchore/go-rpmdb v0.0.0-20200811175839-cbc751c28e8e h1:kty6r0R2JeaNPeWKSYDC+HW3hkqwFh4PP5TQ8pUPYFw=
+github.com/anchore/go-rpmdb v0.0.0-20200811175839-cbc751c28e8e/go.mod h1:iYuIG0Nai8dR0ri3LhZQKUyO1loxUWAGvoWhXDmjy1A=
 github.com/anchore/go-testutils v0.0.0-20200624184116-66aa578126db h1:LWKezJnFTFxNkZ4MzajVf+YWvJS0+7hwFr59u6SS7cw=
 github.com/anchore/go-testutils v0.0.0-20200624184116-66aa578126db/go.mod h1:D3rc2L/q4Hcp9eeX6AIJH4Q+kPjOtJCFhG9za90j+nU=
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZVsCYMrIZBpFxwV26CbsuoEh5muXD5I1Ods=
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/stereoscope v0.0.0-20200520221116-025e07f1c93e/go.mod h1:bkyLl5VITnrmgErv4S1vDfVz/TGAZ5il6161IQo7w2g=
-github.com/anchore/stereoscope v0.0.0-20200803190343-146f38f8cc19 h1:iJ6du/cA9KJ0ctP905u2zCcpJubsy6kxLZBvG4XG+uY=
-github.com/anchore/stereoscope v0.0.0-20200803190343-146f38f8cc19/go.mod h1:WntReQTI/I27FOQ87UgLVVzWgku6+ZsqfOTLxpIZFCs=
+github.com/anchore/stereoscope v0.0.0-20200903223322-a3806f515470 h1:apXyPyfiaL/YQF7VeXRbDDB9TA7dA9rxdq8YbzPk9ko=
+github.com/anchore/stereoscope v0.0.0-20200903223322-a3806f515470/go.mod h1:WntReQTI/I27FOQ87UgLVVzWgku6+ZsqfOTLxpIZFCs=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/apex/log v1.1.4/go.mod h1:AlpoD9aScyQfJDVHmLMEcx4oU6LqzkWp4Mg9GdAcEvQ=
 github.com/apex/log v1.3.0 h1:1fyfbPvUwD10nMoh3hY6MXzvZShJQn9/ck7ATgAt5pA=
@@ -472,12 +474,18 @@ github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/U
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-cleanhttp v0.5.1 h1:dH3aiDG9Jvb5r5+bYHsikaOUIpcM0xvgMXVoDkXMzJM=
 github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
+github.com/hashicorp/go-hclog v0.0.0-20180709165350-ff2cf002a8dd/go.mod h1:9bjs9uLqI8l75knNv3lV1kA55veR+WUPSiKIWcQHudI=
+github.com/hashicorp/go-hclog v0.9.2 h1:CG6TE5H9/JXsFWJCfoIVpKFIkFe6ysEuHirp4DxCsHI=
 github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
+github.com/hashicorp/go-hclog v0.14.1 h1:nQcJDQwIAGnmoUWp8ubocEX40cCml/17YkF6csQLReU=
+github.com/hashicorp/go-hclog v0.14.1/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
 github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
 github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
 github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
 github.com/hashicorp/go-multierror v1.1.0 h1:B9UzwGQJehnUY1yNrnwREHc3fGbC2xefo8g4TbElacI=
 github.com/hashicorp/go-multierror v1.1.0/go.mod h1:spPvp8C1qA32ftKqdAHm4hHTbPw+vmowP0z+KUhOZdA=
+github.com/hashicorp/go-plugin v1.3.0 h1:4d/wJojzvHV1I4i/rrjVaeuyxWrLzDE1mDCyDy8fXS8=
+github.com/hashicorp/go-plugin v1.3.0/go.mod h1:F9eH4LrE/ZsRdbwhfjs9k9HoDUwAHnYtXdgmf1AVNs0=
 github.com/hashicorp/go-retryablehttp v0.6.4/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
 github.com/hashicorp/go-retryablehttp v0.6.6 h1:HJunrbHTDDbBb/ay4kxa1n+dLmttUlnP3V9oNE4hmsM=
 github.com/hashicorp/go-retryablehttp v0.6.6/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
@@ -498,6 +506,8 @@ github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO
 github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0mNTz8vQ=
 github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2pPBoIllUwCN7I=
 github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc=
+github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb h1:b5rjCoWHc7eqmAS4/qyk21ZsHyb6Mxv/jykxvNTkU4M=
+github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
 github.com/hpcloud/tail v1.0.0 h1:nfCOvKYfkgYP8hkirhJocXT2+zOD8yUNjXaWfTlyFKI=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
@@ -508,6 +518,8 @@ github.com/imdario/mergo v0.3.9/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJ
 github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/jarcoal/httpmock v1.0.5/go.mod h1:ATjnClrvW/3tijVmpL/va5Z3aAyGvqU3gCT8nX0Txik=
+github.com/jhump/protoreflect v1.6.0 h1:h5jfMVslIg6l29nsMs0D8Wj17RDVdNYti0vDN/PZZoE=
+github.com/jhump/protoreflect v1.6.0/go.mod h1:eaTn3RZAmMBcV0fifFvlm6VHNz3wSkYyXYWUh7ymB74=
 github.com/jingyugao/rowserrcheck v0.0.0-20191204022205-72ab7603b68a h1:GmsqmapfzSJkm28dhRoHz2tLRbJmqhU86IPgBtN3mmk=
 github.com/jingyugao/rowserrcheck v0.0.0-20191204022205-72ab7603b68a/go.mod h1:xRskid8CManxVta/ALEhJha/pweKBaVG6fWgc0yH25s=
 github.com/jirfag/go-printf-func-name v0.0.0-20191110105641-45db9963cdd3/go.mod h1:HEWGJkRDzjJY2sqdDwxccsGicWEf9BQOZsq2tV+xzM0=
@@ -587,6 +599,7 @@ github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNx
 github.com/mattn/go-isatty v0.0.5/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.6/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
 github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
 github.com/mattn/go-isatty v0.0.12 h1:wuysRhFDzyxgEmMf5xjvJ2M9dZoWAXNNr5LSBS7uHXY=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
@@ -609,6 +622,8 @@ github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrk
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-ps v0.0.0-20190716172923-621e5597135b/go.mod h1:r1VsdOzOPt1ZSrGZWFoNhsAedKnEd6r9Np1+5blZCWk=
+github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
+github.com/mitchellh/go-testing-interface v1.0.0 h1:fzU/JVNcaqHQEcVFAKeR41fkiLdIPrefOvVG1VZ96U0=
 github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
 github.com/mitchellh/gox v0.4.0/go.mod h1:Sd9lOJ0+aimLBi73mGofS1ycjY8lL3uZM3JPS42BGNg=
 github.com/mitchellh/iochan v1.0.0/go.mod h1:JwYml1nuB7xOzsp52dPpHFffvOCDupsG0QubkSMEySY=
@@ -637,6 +652,8 @@ github.com/nbutton23/zxcvbn-go v0.0.0-20180912185939-ae427f1e4c1d h1:AREM5mwr4u1
 github.com/nbutton23/zxcvbn-go v0.0.0-20180912185939-ae427f1e4c1d/go.mod h1:o96djdrsSGy3AWPyBgZMAGfxZNfgntdJG+11KU4QvbU=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/oklog/run v1.0.0 h1:Ru7dDtJNOyC66gQ5dQmaCa0qIsAUFY3sFpK1Xk8igrw=
+github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/olekukonko/tablewriter v0.0.0-20170122224234-a0225b3f23b5/go.mod h1:vsDQFd/mU46D+Z4whnwzcISnGGzXWMclvtLoiIKAKIo=
 github.com/olekukonko/tablewriter v0.0.4 h1:vHD/YYe1Wolo78koG299f7V/VAS08c6IpCLn+Ejf/w8=
@@ -666,6 +683,8 @@ github.com/opencontainers/runc v0.0.0-20190115041553-12f6a991201f/go.mod h1:qT5X
 github.com/opencontainers/runc v0.1.1 h1:GlxAyO6x8rfZYN9Tt0Kti5a/cP41iuiO2yYT0IJGY8Y=
 github.com/opencontainers/runc v0.1.1/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runtime-spec v0.1.2-0.20190507144316-5b71a03e2700/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/package-url/packageurl-go v0.1.0 h1:efWBc98O/dBZRg1pw2xiDzovnlMjCa9NPnfaiBduh8I=
+github.com/package-url/packageurl-go v0.1.0/go.mod h1:C/ApiuWpmbpni4DIOECf6WCjFUZV7O1Fx7VAzrZHgBw=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
@@ -832,8 +851,6 @@ github.com/wagoodman/go-progress v0.0.0-20200621122631-1a2120f0695a h1:lV3ioFpbq
 github.com/wagoodman/go-progress v0.0.0-20200621122631-1a2120f0695a/go.mod h1:jLXFoL31zFaHKAAyZUh+sxiTDFe1L1ZHrcK2T1itVKA=
 github.com/wagoodman/go-progress v0.0.0-20200731105512-1020f39e6240 h1:r6BlIP7CVZtMlxUQhT40h1IE1TzEgKVqwmsVGuscvdk=
 github.com/wagoodman/go-progress v0.0.0-20200731105512-1020f39e6240/go.mod h1:jLXFoL31zFaHKAAyZUh+sxiTDFe1L1ZHrcK2T1itVKA=
-github.com/wagoodman/go-rpmdb v0.0.0-20200810111121-8136676cb95c h1:eEWc4HjIq0gSno1apdb5MjRn2995xNrNmRTiJyjUJd8=
-github.com/wagoodman/go-rpmdb v0.0.0-20200810111121-8136676cb95c/go.mod h1:MjoIZzKmbYfcpbC6ARWMcHijAjtLBViDaHcayXKWQWI=
 github.com/wagoodman/jotframe v0.0.0-20200730190914-3517092dd163 h1:qoZwR+bHbFFNirY4Yt7lqbOXnFAMnlFfR89w0TXwjrc=
 github.com/wagoodman/jotframe v0.0.0-20200730190914-3517092dd163/go.mod h1:DzXZ1wfRedNhC3KQTick8Gf3CEPMFHsP5k4R/ldjKtw=
 github.com/x-cray/logrus-prefixed-formatter v0.5.2 h1:00txxvfBM9muc0jiLIEAkAcIMJzfthRT6usrui8uGmg=
@@ -884,8 +901,8 @@ golang.org/x/crypto v0.0.0-20191206172530-e9b2fee46413/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200510223506-06a226fb4e37 h1:cg5LA/zNPRzIXIWSCxQW10Rvpy94aQh3LT/ShoCpkHw=
 golang.org/x/crypto v0.0.0-20200510223506-06a226fb4e37/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20200604202706-70a84ac30bf9 h1:vEg9joUBmeBcK9iSJftGNf3coIG4HqZElCPehJsfAYM=
-golang.org/x/crypto v0.0.0-20200604202706-70a84ac30bf9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 h1:psW17arqaxU48Z5kZ0CQnkZWQJsqcURM6tKiBApRjXI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190125153040-c74c464bbbf2/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -921,6 +938,7 @@ golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0 h1:RM4zey1++hCTbCVQfnWeKs9/IEsaBLA8vTkd0WVtmH4=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/net v0.0.0-20170114055629-f2499483f923/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180530234432-1e491301e022/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -960,6 +978,8 @@ golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/
 golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200602114024-627f9648deb9 h1:pNX+40auqi2JqRfOP1akLGtYcn15TUbkhwuCO3foqqM=
 golang.org/x/net v0.0.0-20200602114024-627f9648deb9/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200625001655-4c5254603344 h1:vGXIOMxbNfDTk/aXCmfdLgkrSV+Z2tcbze+pEc3v5W4=
+golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181106182150-f42d05182288/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -976,6 +996,8 @@ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a h1:WXEvlFVvvGxCJLG6REjsT03iWnKLEWinaScsxF2Vm2o=
 golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208 h1:qwRHBd0NqMbJxfbotnDhm2ByMI1Shq4Y6oRJo21SGJA=
+golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20170830134202-bb24a47a89ea/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1006,6 +1028,7 @@ golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190922100055-0a153f010e69/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191010194322-b09406accb47/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191112214154-59a1497f0cea/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -1142,6 +1165,7 @@ google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/appengine v1.6.6 h1:lMO5rYAqUxkmaj76jAkRUvt5JZgFymx/+Q5Mzfivuhc=
 google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/genproto v0.0.0-20170818010345-ee236bd376b0/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
@@ -1175,6 +1199,7 @@ google.golang.org/genproto v0.0.0-20200604104852-0b0486081ffb h1:ek2py5bOqzR7MR/
 google.golang.org/genproto v0.0.0-20200604104852-0b0486081ffb/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
 google.golang.org/genproto v0.0.0-20200615140333-fd031eab31e7 h1:1N7l1PuXZwEK7OhHdmKQROOM75PnUjABGwvVRbLBgFk=
 google.golang.org/genproto v0.0.0-20200615140333-fd031eab31e7/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
+google.golang.org/grpc v1.8.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.0/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -1189,6 +1214,8 @@ google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8
 google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60=
 google.golang.org/grpc v1.29.1 h1:EC2SB8S04d2r73uptxphDSUG+kTKVgjRPF+N3xpxRB4=
 google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
+google.golang.org/grpc v1.31.1 h1:SfXqXS5hkufcdZ/mHtYCh53P2b+92WQq/DZcKLgsFRs=
+google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=

internal/bus/bus.go

@@ -1,3 +1,16 @@
+/*
+Package bus provides access to a singleton instance of an event bus (provided by the calling application). The event bus
+is intended to allow for the syft library to publish events which library consumers can subscribe to. These events
+can provide static information, but also have an object as a payload for which the consumer can poll for updates.
+This is akin to a logger, except instead of only allowing strings to be logged, rich objects that can be interacted with.
+
+Note that the singleton instance is only allowed to publish events and not subscribe to them --this is intentional.
+Internal library interactions should continue to use traditional in-execution-path approaches for data sharing
+(e.g. function returns and channels) and not depend on bus subscriptions for critical interactions (e.g. one part of the
+lib publishes an event and another part of the lib subscribes and reacts to that event). The bus is provided only as a
+means for consumers to observe events emitted from the library (such as to provide a rich UI) and not to allow
+consumers to augment or otherwise change execution.
+*/
 package bus
 
 import "github.com/wagoodman/go-partybus"
@@ -5,6 +18,8 @@ import "github.com/wagoodman/go-partybus"
 var publisher partybus.Publisher
 var active bool
 
+// SetPublisher sets the singleton event bus publisher. This is optional; if no bus is provided, the library will
+// behave no differently than if a bus had been provided.
 func SetPublisher(p partybus.Publisher) {
 	publisher = p
 	if p != nil {
@@ -12,6 +27,7 @@ func SetPublisher(p partybus.Publisher) {
 	}
 }
 
+// Publish an event onto the bus. If there is no bus set by the calling application, this does nothing.
 func Publish(event partybus.Event) {
 	if active {
 		publisher.Publish(event)

internal/config/config.go

@@ -28,7 +28,13 @@ type Application struct {
 	Quiet             bool    `mapstructure:"quiet"`
 	Log               Logging `mapstructure:"log"`
 	CliOptions        CliOnlyOptions
-	CheckForAppUpdate bool `mapstructure:"check-for-app-update"`
+	CheckForAppUpdate bool    `mapstructure:"check-for-app-update"`
+	Plugins           Plugins `mapstructure:"plugins"`
+}
+
+type Plugins struct {
+	Enabled   bool   `mapstructure:"enabled"`
+	Directory string `mapstructure:"dir"`
 }
 
 type Logging struct {

internal/log/log.go

@@ -1,6 +1,8 @@
 package log
 
-import "github.com/anchore/syft/syft/logger"
+import (
+	"github.com/anchore/syft/syft/logger"
+)
 
 var Log logger.Logger = &nopLogger{}
 
@@ -8,6 +10,10 @@ func Errorf(format string, args ...interface{}) {
 	Log.Errorf(format, args...)
 }
 
+func Error(args ...interface{}) {
+	Log.Error(args...)
+}
+
 func Infof(format string, args ...interface{}) {
 	Log.Infof(format, args...)
 }

internal/log/nop.go

@@ -3,6 +3,7 @@ package log
 type nopLogger struct{}
 
 func (l *nopLogger) Errorf(format string, args ...interface{}) {}
+func (l *nopLogger) Error(args ...interface{})                 {}
 func (l *nopLogger) Infof(format string, args ...interface{})  {}
 func (l *nopLogger) Info(args ...interface{})                  {}
 func (l *nopLogger) Debugf(format string, args ...interface{}) {}

internal/logger/hclog_stdlog_adapter.go

@@ -0,0 +1,78 @@
+package logger
+
+import (
+	"bytes"
+	"strings"
+
+	"github.com/hashicorp/go-hclog"
+)
+
+// Source: https://github.com/hashicorp/go-hclog/blob/master/stdlog.go (MIT License)
+
+// Provides a io.Writer to shim the data out of *log.Logger
+// and back into our Logger. This is basically the only way to
+// build upon *log.Logger.
+type HCLogStdlogAdapter struct {
+	log         hclog.Logger
+	inferLevels bool
+	forceLevel  hclog.Level
+}
+
+// Take the data, infer the levels if configured, and send it through
+// a regular Logger.
+func (s *HCLogStdlogAdapter) Write(data []byte) (int, error) {
+	str := string(bytes.TrimRight(data, " \t\n"))
+
+	if s.forceLevel != hclog.NoLevel {
+		// Use pickLevel to strip log levels included in the line since we are
+		// forcing the level
+		_, str := s.pickLevel(str)
+
+		// Log at the forced level
+		s.dispatch(str, s.forceLevel)
+	} else if s.inferLevels {
+		level, str := s.pickLevel(str)
+		s.dispatch(str, level)
+	} else {
+		s.log.Info(str)
+	}
+
+	return len(data), nil
+}
+
+func (s *HCLogStdlogAdapter) dispatch(str string, level hclog.Level) {
+	switch level {
+	case hclog.Trace:
+		s.log.Trace(str)
+	case hclog.Debug:
+		s.log.Debug(str)
+	case hclog.Info:
+		s.log.Info(str)
+	case hclog.Warn:
+		s.log.Warn(str)
+	case hclog.Error:
+		s.log.Error(str)
+	default:
+		s.log.Info(str)
+	}
+}
+
+// Detect, based on conventions, what log level this is.
+func (s *HCLogStdlogAdapter) pickLevel(str string) (hclog.Level, string) {
+	switch {
+	case strings.HasPrefix(str, "[DEBUG]"):
+		return hclog.Debug, strings.TrimSpace(str[7:])
+	case strings.HasPrefix(str, "[TRACE]"):
+		return hclog.Trace, strings.TrimSpace(str[7:])
+	case strings.HasPrefix(str, "[INFO]"):
+		return hclog.Info, strings.TrimSpace(str[6:])
+	case strings.HasPrefix(str, "[WARN]"):
+		return hclog.Warn, strings.TrimSpace(str[7:])
+	case strings.HasPrefix(str, "[ERROR]"):
+		return hclog.Error, strings.TrimSpace(str[7:])
+	case strings.HasPrefix(str, "[ERR]"):
+		return hclog.Error, strings.TrimSpace(str[5:])
+	default:
+		return hclog.Info, str
+	}
+}

internal/logger/logger_hclog_adapter.go

@@ -0,0 +1,148 @@
+package logger
+
+import (
+	"io"
+	"log"
+
+	"github.com/anchore/syft/syft/logger"
+
+	"github.com/hashicorp/go-hclog"
+)
+
+// integrity check
+var _ hclog.Logger = &LoggerHCLogAdapter{}
+
+// LoggerHCLogAdapter is used to (partially) adapt a syft logger.Logger object to the hclog.Logger interface for syft plugins.
+// Note: this does not implement all functionality required by the hclog.Logger.
+type LoggerHCLogAdapter struct {
+	Logger logger.Logger
+}
+
+func NewLoggerHCLogAdapter(logger logger.Logger) *LoggerHCLogAdapter {
+	return &LoggerHCLogAdapter{
+		Logger: logger,
+	}
+}
+
+// Args are alternating key, val pairs
+// keys must be strings
+// vals can be any type, but display is implementation specific
+// Emit a message and key/value pairs at a provided log level
+func (l *LoggerHCLogAdapter) Log(level hclog.Level, msg string, args ...interface{}) {
+	l.Logger.Info(append([]interface{}{msg}, args...)...)
+}
+
+// Emit a message and key/value pairs at the TRACE level
+func (l *LoggerHCLogAdapter) Trace(msg string, args ...interface{}) {
+	l.Logger.Debug(append([]interface{}{msg}, args...)...)
+}
+
+// Emit a message and key/value pairs at the DEBUG level
+func (l *LoggerHCLogAdapter) Debug(msg string, args ...interface{}) {
+	l.Logger.Debug(append([]interface{}{msg}, args...)...)
+}
+
+// Emit a message and key/value pairs at the INFO level
+func (l *LoggerHCLogAdapter) Info(msg string, args ...interface{}) {
+	l.Logger.Info(append([]interface{}{msg}, args...)...)
+}
+
+// Emit a message and key/value pairs at the WARN level
+func (l *LoggerHCLogAdapter) Warn(msg string, args ...interface{}) {
+	l.Logger.Error(append([]interface{}{msg}, args...)...)
+}
+
+// Emit a message and key/value pairs at the ERROR level
+func (l *LoggerHCLogAdapter) Error(msg string, args ...interface{}) {
+	l.Logger.Error(append([]interface{}{msg}, args...)...)
+}
+
+// Indicate if TRACE logs would be emitted. This and the other Is* guards
+// are used to elide expensive logging code based on the current level.
+func (l *LoggerHCLogAdapter) IsTrace() bool {
+	// TODO: not implemented
+	return true
+}
+
+// Indicate if DEBUG logs would be emitted. This and the other Is* guards
+// are used to elide expensive logging code based on the current level.
+func (l *LoggerHCLogAdapter) IsDebug() bool {
+	// TODO: not implemented
+	return true
+}
+
+// Indicate if INFO logs would be emitted. This and the other Is* guards
+// are used to elide expensive logging code based on the current level.
+func (l *LoggerHCLogAdapter) IsInfo() bool {
+	// TODO: not implemented
+	return true
+}
+
+// Indicate if WARN logs would be emitted. This and the other Is* guards
+// are used to elide expensive logging code based on the current level.
+func (l *LoggerHCLogAdapter) IsWarn() bool {
+	// TODO: not implemented
+	return true
+}
+
+// Indicate if ERROR logs would be emitted. This and the other Is* guards
+// are used to elide expensive logging code based on the current level.
+func (l *LoggerHCLogAdapter) IsError() bool {
+	// TODO: not implemented
+	return true
+}
+
+// ImpliedArgs returns With key/value pairs
+func (l *LoggerHCLogAdapter) ImpliedArgs() []interface{} {
+	// TODO: not implemented
+	return nil
+}
+
+// Creates a sublogger that will always have the given key/value pairs
+func (l *LoggerHCLogAdapter) With(args ...interface{}) hclog.Logger {
+	// TODO: not implemented
+	return l
+}
+
+// Returns the Name of the logger
+func (l *LoggerHCLogAdapter) Name() string {
+	// TODO: not implemented
+	return ""
+}
+
+// Create a logger that will prepend the name string on the front of all messages.
+// If the logger already has a name, the new value will be appended to the current
+// name. That way, a major subsystem can use this to decorate all it's own logs
+// without losing context.
+func (l *LoggerHCLogAdapter) Named(name string) hclog.Logger {
+	// TODO: not implemented
+	return l
+}
+
+// Create a logger that will prepend the name string on the front of all messages.
+// This sets the name of the logger to the value directly, unlike Named which honor
+// the current name as well.
+func (l *LoggerHCLogAdapter) ResetNamed(name string) hclog.Logger {
+	// TODO: not implemented
+	return l
+}
+
+// Updates the level. This should affect all sub-loggers as well. If an
+// implementation cannot update the level on the fly, it should no-op.
+func (l *LoggerHCLogAdapter) SetLevel(level hclog.Level) {
+	// TODO: not implemented
+}
+
+// Return a value that conforms to the stdlib log.Logger interface
+func (l *LoggerHCLogAdapter) StandardLogger(opts *hclog.StandardLoggerOptions) *log.Logger {
+	return log.New(l.StandardWriter(opts), "", log.LstdFlags)
+}
+
+// Return a value that conforms to io.Writer, which can be passed into log.SetOutput()
+func (l *LoggerHCLogAdapter) StandardWriter(opts *hclog.StandardLoggerOptions) io.Writer {
+	return &HCLogStdlogAdapter{
+		log:         l,
+		inferLevels: opts.InferLevels,
+		forceLevel:  opts.ForceLevel,
+	}
+}

internal/logger/logrus.go

@@ -6,10 +6,15 @@ import (
 	"io/ioutil"
 	"os"
 
+	"github.com/anchore/syft/syft/logger"
 	"github.com/sirupsen/logrus"
 	prefixed "github.com/x-cray/logrus-prefixed-formatter"
 )
 
+// integrity check
+var _ logger.Logger = &LogrusLogger{}
+var _ logger.Logger = &LogrusNestedLogger{}
+
 type LogrusConfig struct {
 	EnableConsole bool
 	EnableFile    bool
@@ -76,42 +81,50 @@ func NewLogrusLogger(cfg LogrusConfig) *LogrusLogger {
 	}
 }
 
-func (l *LogrusLogger) Debugf(format string, args ...interface{}) {
-	l.Logger.Debugf(format, args...)
+func (l *LogrusLogger) Errorf(format string, args ...interface{}) {
+	l.Logger.Errorf(format, args...)
 }
 
 func (l *LogrusLogger) Infof(format string, args ...interface{}) {
 	l.Logger.Infof(format, args...)
 }
 
-func (l *LogrusLogger) Debug(args ...interface{}) {
-	l.Logger.Debug(args...)
+func (l *LogrusLogger) Debugf(format string, args ...interface{}) {
+	l.Logger.Debugf(format, args...)
+}
+
+func (l *LogrusLogger) Error(args ...interface{}) {
+	l.Logger.Error(args...)
 }
 
 func (l *LogrusLogger) Info(args ...interface{}) {
 	l.Logger.Info(args...)
 }
 
-func (l *LogrusLogger) Errorf(format string, args ...interface{}) {
-	l.Logger.Errorf(format, args...)
+func (l *LogrusLogger) Debug(args ...interface{}) {
+	l.Logger.Debug(args...)
 }
 
-func (l *LogrusNestedLogger) Debugf(format string, args ...interface{}) {
-	l.Logger.Debugf(format, args...)
+func (l *LogrusNestedLogger) Errorf(format string, args ...interface{}) {
+	l.Logger.Errorf(format, args...)
 }
 
 func (l *LogrusNestedLogger) Infof(format string, args ...interface{}) {
 	l.Logger.Infof(format, args...)
 }
 
-func (l *LogrusNestedLogger) Debug(args ...interface{}) {
-	l.Logger.Debug(args...)
+func (l *LogrusNestedLogger) Debugf(format string, args ...interface{}) {
+	l.Logger.Debugf(format, args...)
+}
+
+func (l *LogrusNestedLogger) Error(args ...interface{}) {
+	l.Logger.Error(args...)
 }
 
 func (l *LogrusNestedLogger) Info(args ...interface{}) {
 	l.Logger.Info(args...)
 }
 
-func (l *LogrusNestedLogger) Errorf(format string, args ...interface{}) {
-	l.Logger.Errorf(format, args...)
+func (l *LogrusNestedLogger) Debug(args ...interface{}) {
+	l.Logger.Debug(args...)
 }

internal/logger/logrus_hclog_adapter.go

@@ -0,0 +1,181 @@
+package logger
+
+import (
+	"fmt"
+	"io"
+	"log"
+
+	"github.com/hashicorp/go-hclog"
+	"github.com/sirupsen/logrus"
+)
+
+// integrity check
+var _ hclog.Logger = &LogrusHCLogAdapter{}
+
+var levels = map[hclog.Level]logrus.Level{
+	hclog.NoLevel: logrus.PanicLevel,
+	hclog.Error:   logrus.ErrorLevel,
+	hclog.Warn:    logrus.WarnLevel,
+	hclog.Info:    logrus.InfoLevel,
+	hclog.Debug:   logrus.DebugLevel,
+	hclog.Trace:   logrus.TraceLevel,
+}
+
+// LogrusHCLogAdapter is used to adapt a logrus logger object to the hclog.Logger interface for syft plugins.
+type LogrusHCLogAdapter struct {
+	logger *logrus.Logger
+	entry  *logrus.Entry
+}
+
+func NewLogrusHCLogAdapter(logger *logrus.Logger, fields map[string]interface{}) *LogrusHCLogAdapter {
+	if fields != nil {
+		return &LogrusHCLogAdapter{
+			logger: logger,
+			entry:  logger.WithFields(fields),
+		}
+	}
+	return &LogrusHCLogAdapter{
+		logger: logger,
+	}
+}
+
+func (l *LogrusHCLogAdapter) log(level hclog.Level, msg string, args ...interface{}) {
+	if l.entry != nil {
+		l.entry.WithFields(makeArgFields(args...)).Log(levels[level], msg)
+		return
+	}
+	l.logger.WithFields(makeArgFields(args...)).Log(levels[level], msg)
+}
+
+// Args are alternating key, val pairs
+// keys must be strings
+// vals can be any type, but display is implementation specific
+// Emit a message and key/value pairs at a provided log level
+func (l *LogrusHCLogAdapter) Log(level hclog.Level, msg string, args ...interface{}) {
+	l.log(level, msg, args...)
+}
+
+// Emit a message and key/value pairs at the TRACE level
+func (l *LogrusHCLogAdapter) Trace(msg string, args ...interface{}) {
+	l.log(hclog.Trace, msg, args...)
+}
+
+// Emit a message and key/value pairs at the DEBUG level
+func (l *LogrusHCLogAdapter) Debug(msg string, args ...interface{}) {
+	l.log(hclog.Debug, msg, args...)
+}
+
+// Emit a message and key/value pairs at the INFO level
+func (l *LogrusHCLogAdapter) Info(msg string, args ...interface{}) {
+	l.log(hclog.Info, msg, args...)
+}
+
+// Emit a message and key/value pairs at the WARN level
+func (l *LogrusHCLogAdapter) Warn(msg string, args ...interface{}) {
+	l.log(hclog.Warn, msg, args...)
+}
+
+// Emit a message and key/value pairs at the ERROR level
+func (l *LogrusHCLogAdapter) Error(msg string, args ...interface{}) {
+	l.log(hclog.Error, msg, args...)
+}
+
+// Indicate if TRACE logs would be emitted. This and the other Is* guards
+// are used to elide expensive logging code based on the current level.
+func (l *LogrusHCLogAdapter) IsTrace() bool {
+	return l.logger.Level <= logrus.TraceLevel
+}
+
+// Indicate if DEBUG logs would be emitted. This and the other Is* guards
+// are used to elide expensive logging code based on the current level.
+func (l *LogrusHCLogAdapter) IsDebug() bool {
+	return l.logger.Level <= logrus.DebugLevel
+}
+
+// Indicate if INFO logs would be emitted. This and the other Is* guards
+// are used to elide expensive logging code based on the current level.
+func (l *LogrusHCLogAdapter) IsInfo() bool {
+	return l.logger.Level <= logrus.InfoLevel
+}
+
+// Indicate if WARN logs would be emitted. This and the other Is* guards
+// are used to elide expensive logging code based on the current level.
+func (l *LogrusHCLogAdapter) IsWarn() bool {
+	return l.logger.Level <= logrus.WarnLevel
+}
+
+// Indicate if ERROR logs would be emitted. This and the other Is* guards
+// are used to elide expensive logging code based on the current level.
+func (l *LogrusHCLogAdapter) IsError() bool {
+	return l.logger.Level <= logrus.ErrorLevel
+}
+
+// ImpliedArgs returns With key/value pairs
+func (l *LogrusHCLogAdapter) ImpliedArgs() []interface{} {
+	// TODO: not implemented
+	return nil
+}
+
+// Creates a sublogger that will always have the given key/value pairs
+func (l *LogrusHCLogAdapter) With(args ...interface{}) hclog.Logger {
+	l.entry = l.logger.WithFields(makeArgFields(args...))
+	return l
+}
+
+// Returns the Name of the logger
+func (l *LogrusHCLogAdapter) Name() string {
+	// TODO: not implemented
+	return ""
+}
+
+// Create a logger that will prepend the name string on the front of all messages.
+// If the logger already has a name, the new value will be appended to the current
+// name. That way, a major subsystem can use this to decorate all it's own logs
+// without losing context.
+func (l *LogrusHCLogAdapter) Named(name string) hclog.Logger {
+	return NewLogrusHCLogAdapter(l.logger, logrus.Fields{"name": name})
+}
+
+// Create a logger that will prepend the name string on the front of all messages.
+// This sets the name of the logger to the value directly, unlike Named which honor
+// the current name as well.
+func (l *LogrusHCLogAdapter) ResetNamed(name string) hclog.Logger {
+	return NewLogrusHCLogAdapter(l.logger, logrus.Fields{"name": name})
+}
+
+// Updates the level. This should affect all sub-loggers as well. If an
+// implementation cannot update the level on the fly, it should no-op.
+func (l *LogrusHCLogAdapter) SetLevel(level hclog.Level) {
+	l.logger.SetLevel(levels[level])
+}
+
+// Return a value that conforms to the stdlib log.Logger interface
+func (l *LogrusHCLogAdapter) StandardLogger(opts *hclog.StandardLoggerOptions) *log.Logger {
+	return log.New(l.StandardWriter(opts), "", log.LstdFlags)
+}
+
+// Return a value that conforms to io.Writer, which can be passed into log.SetOutput()
+func (l *LogrusHCLogAdapter) StandardWriter(opts *hclog.StandardLoggerOptions) io.Writer {
+	return &HCLogStdlogAdapter{
+		log:         l,
+		inferLevels: opts.InferLevels,
+		forceLevel:  opts.ForceLevel,
+	}
+}
+
+func makeArgFields(args ...interface{}) logrus.Fields {
+	if len(args)%2 != 0 {
+		panic(fmt.Errorf("odd number of logger key-value pairs (%d): %+v", len(args), args))
+	}
+
+	var key string
+	var fields = make(logrus.Fields)
+	for i, arg := range args {
+		if i%2 == 0 {
+			key = arg.(string)
+		} else {
+			fields[key] = arg
+		}
+	}
+	return fields
+}

internal/ui/common/event_handlers.go

@@ -8,6 +8,8 @@ import (
 	"github.com/wagoodman/go-partybus"
 )
 
+// CatalogerFinishedHandler is a UI function for processing the CatalogerFinished bus event, displaying the catalog
+// via the given presenter to stdout.
 func CatalogerFinishedHandler(event partybus.Event) error {
 	// show the report to stdout
 	pres, err := syftEventParsers.ParseCatalogerFinished(event)

internal/ui/etui/ephemeral_tui.go

@@ -1,3 +1,21 @@
+/*
+Package etui provides an "ephemeral" terminal user interface to display the application state dynamically.
+The terminal is placed into raw mode and the cursor is manipulated to allow for a dynamic, multi-line
+UI (provided by the jotframe lib), for this reason all other application mechanisms that write to the screen
+must be suppressed before starting (such as logs); since bytes in the device and in application memory combine to make
+a shared state, bytes coming from elsewhere to the screen will disrupt this state.
+
+This UI is primarily driven off of events from the event bus, creating single-line terminal widgets to represent a
+published element on the event bus, typically polling the element for the latest state. This allows for the UI to
+control update frequency to the screen, provide "liveness" indications that are interpolated between bus events,
+and overall loosely couple the bus events from screen interactions.
+
+By convention, all elements published on the bus should be treated as read-only, and publishers on the bus should
+attempt to enforce this when possible by wrapping complex objects with interfaces to prescribe interactions. Also by
+convention, each new event that the UI should respond to should be added either in this package as a handler function,
+or in the shared ui package as a function on the main handler object. All handler functions should be completed
+processing an event before the ETUI exits (coordinated with a sync.WaitGroup)
+*/
 package etui
 
 import (
@@ -18,8 +36,10 @@ import (
 	"github.com/wagoodman/jotframe/pkg/frame"
 )
 
-// TODO: specify per-platform implementations with build tags
+// TODO: specify per-platform implementations with build tags (needed when windows is supported by syft)
 
+// setupScreen creates a new jotframe object to manage specific screen lines dynamically, preparing the screen device
+// as needed (i.e. setting the terminal to raw mode).
 func setupScreen(output *os.File) *frame.Frame {
 	config := frame.Config{
 		PositionPolicy: frame.PolicyFloatForward,
@@ -36,6 +56,8 @@ func setupScreen(output *os.File) *frame.Frame {
 }
 
 // nolint:funlen,gocognit
+// OutputToEphemeralTUI is a UI function that provides a terminal UI experience without a separate, in-application
+// screen buffer. All logging is suppressed, buffered to a string, and output after the ETUI has been torn down.
 func OutputToEphemeralTUI(workerErrs <-chan error, subscription *partybus.Subscription) error {
 	output := os.Stderr
 
@@ -84,6 +106,7 @@ eventLoop:
 	for {
 		select {
 		case err := <-workerErrs:
+			// TODO: we should show errors more explicitly in the ETUI
 			if err != nil {
 				return err
 			}

internal/ui/etui/internal_event_handlers.go

@@ -13,6 +13,7 @@ import (
 	"github.com/wagoodman/jotframe/pkg/frame"
 )
 
+// appUpdateAvailableHandler is a UI handler function to display a new application version to the top of the screen.
 func appUpdateAvailableHandler(_ context.Context, fr *frame.Frame, event partybus.Event, _ *sync.WaitGroup) error {
 	newVersion, err := syftEventParsers.ParseAppUpdateAvailable(event)
 	if err != nil {

internal/ui/logger_output.go

@@ -7,6 +7,7 @@ import (
 	"github.com/wagoodman/go-partybus"
 )
 
+// LoggerUI is a UI function that leverages the displays all application logs to the screen.
 func LoggerUI(workerErrs <-chan error, subscription *partybus.Subscription) error {
 	events := subscription.Events()
 eventLoop:

internal/ui/select.go

@@ -10,6 +10,8 @@ import (
 
 // TODO: build tags to exclude options from windows
 
+// Select is responsible for determining the specific UI function given select user option, the current platform
+// config values, and environment status (such as a TTY being present).
 func Select(verbose, quiet bool) UI {
 	var ui UI
 

internal/ui/ui.go

@@ -4,4 +4,6 @@ import (
 	"github.com/wagoodman/go-partybus"
 )
 
+// UI is a function that takes a channel of errors from the main() worker and a event bus subscription and is
+// responsible for displaying pertinent events to the user, on the screen or otherwise.
 type UI func(<-chan error, *partybus.Subscription) error

internal/version/build.go

@@ -7,22 +7,25 @@ import (
 
 const valueNotProvided = "[not provided]"
 
+// all variables here are provided as build-time arguments, with clear default values
 var version = valueNotProvided
 var gitCommit = valueNotProvided
 var gitTreeState = valueNotProvided
 var buildDate = valueNotProvided
 var platform = fmt.Sprintf("%s/%s", runtime.GOOS, runtime.GOARCH)
 
+// Version defines the application version details (generally from build information)
 type Version struct {
-	Version      string
-	GitCommit    string
-	GitTreeState string
-	BuildDate    string
-	GoVersion    string
-	Compiler     string
-	Platform     string
+	Version      string // application semantic version
+	GitCommit    string // git SHA at build-time
+	GitTreeState string // indication of git tree (either "clean" or "dirty") at build-time
+	BuildDate    string // date of the build
+	GoVersion    string // go runtime version at build-time
+	Compiler     string // compiler used at build-time
+	Platform     string // GOOS and GOARCH at build-time
 }
 
+// FromBuild provides all version details
 func FromBuild() Version {
 	return Version{
 		Version:      version,

main.go

@@ -1,3 +1,8 @@
+/*
+Syft is a CLI tool and go library for generating a Software Bill of Materials (SBOM) from container images and filesystems.
+
+Note that Syft is both a command line tool as well as a library. See the syft/ child package for library functionality.
+*/
 package main
 
 import (

schema/cyclonedx/.gitignore

@@ -0,0 +1 @@
+bom.xml

schema/cyclonedx/Makefile

@@ -0,0 +1,5 @@
+.DEFAULT_GOAL := validate-schema
+.PHONY: validate-schema
+validate-schema:
+	go run ../../main.go ubuntu:latest -vv -o cyclonedx > bom.xml
+	xmllint --noout --schema ./cyclonedx.xsd bom.xml

schema/cyclonedx/README.md

@@ -0,0 +1,7 @@
+# CycloneDX Schemas
+
+`syft` generates a CycloneDX BOm output. We want to be able to validate the CycloneDX schemas
+(and dependent schemas) against generated syft output. The best way to do this is with `xmllint`,
+however, this tool does not know how to deal with references from HTTP, only the local filesystem.
+For this reason we've included a copy of all schemas needed to validate `syft` output, modified
+to reference local copies of dependent schemas.

schema/cyclonedx/bd.xsd

@@ -0,0 +1,183 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+CycloneDX BOM Descriptor Extension
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
+           xmlns:vc="http://www.w3.org/2007/XMLSchema-versioning"
+           xmlns:bom="http://cyclonedx.org/schema/bom/1.1"
+           xmlns:bd="http://cyclonedx.org/schema/ext/bom-descriptor/1.0"
+           elementFormDefault="qualified"
+           targetNamespace="http://cyclonedx.org/schema/ext/bom-descriptor/1.0"
+           vc:minVersion="1.0"
+           vc:maxVersion="1.1"
+           version="1.0">
+
+  <xs:annotation>
+    <xs:documentation>
+      <name>CycloneDX BOM Descriptor Extension</name>
+      <url>https://cyclonedx.org/ext/bom-descriptor</url>
+      <license uri="http://www.apache.org/licenses/LICENSE-2.0"
+               version="2.0">Apache License, Version 2.0</license>
+      <authors>
+        <author>Steve Springett</author>
+      </authors>
+    </xs:documentation>
+  </xs:annotation>
+
+  <xs:import namespace="http://cyclonedx.org/schema/bom/1.1" schemaLocation="http://cyclonedx.org/schema/bom/1.1"/>
+
+  <xs:complexType name="metadata">
+    <xs:sequence minOccurs="0" maxOccurs="1">
+      <xs:element name="timestamp" type="xs:dateTime" minOccurs="0">
+        <xs:annotation>
+          <xs:documentation>The date and time (timestamp) when the document was created.</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+      <xs:element name="tool" minOccurs="0" type="bd:toolType">
+        <xs:annotation>
+          <xs:documentation>The tool used to create the BOM.</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+      <xs:element name="authors" minOccurs="0" maxOccurs="1">
+        <xs:annotation>
+          <xs:documentation>The person(s) who created the BOM. Authors are common in BOMs created through
+            manual processes. BOMs created through automated means may not have authors.</xs:documentation>
+        </xs:annotation>
+        <xs:complexType>
+          <xs:sequence minOccurs="0" maxOccurs="unbounded">
+            <xs:element name="author" type="bd:organizationalPerson"/>
+          </xs:sequence>
+        </xs:complexType>
+      </xs:element>
+      <xs:element name="component" type="bom:component" minOccurs="0">
+        <xs:annotation>
+          <xs:documentation>The component that the BOM describes.</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+      <xs:element name="manufacture" type="bd:organizationalEntity" minOccurs="0" maxOccurs="unbounded">
+        <xs:annotation>
+          <xs:documentation>The organization that manufactured the component that the BOM describes.</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+      <xs:element name="supplier" type="bd:organizationalEntity" minOccurs="0" maxOccurs="unbounded">
+        <xs:annotation>
+          <xs:documentation>The organization that supplied the component that the BOM describes. The
+            supplier may often be the manufacture, but may also be a distributor or repackager.</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+    </xs:sequence>
+    <xs:anyAttribute namespace="##other" processContents="lax">
+      <xs:annotation>
+        <xs:documentation>User-defined attributes may be used on this element as long as they
+          do not have the same name as an existing attribute used by the schema.</xs:documentation>
+      </xs:annotation>
+    </xs:anyAttribute>
+  </xs:complexType>
+
+  <xs:complexType name="organizationalEntity">
+    <xs:sequence minOccurs="0" maxOccurs="1">
+      <xs:element name="name" type="xs:normalizedString" minOccurs="0" maxOccurs="1">
+        <xs:annotation>
+          <xs:documentation>The name of the organization</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+      <xs:element name="url" type="xs:anyURI" minOccurs="0" maxOccurs="unbounded">
+        <xs:annotation>
+          <xs:documentation>The URL of the organization. Multiple URLs are allowed.</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+      <xs:element name="contact" type="bd:organizationalPerson" minOccurs="0" maxOccurs="unbounded">
+        <xs:annotation>
+          <xs:documentation>A contact person at the organization. Multiple contacts are allowed.</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+    </xs:sequence>
+    <xs:anyAttribute namespace="##other" processContents="lax">
+      <xs:annotation>
+        <xs:documentation>User-defined attributes may be used on this element as long as they
+          do not have the same name as an existing attribute used by the schema.</xs:documentation>
+      </xs:annotation>
+    </xs:anyAttribute>
+  </xs:complexType>
+
+  <xs:complexType name="toolType">
+    <xs:annotation>
+      <xs:documentation>Specifies a tool (manual or automated).</xs:documentation>
+    </xs:annotation>
+    <xs:sequence minOccurs="0" maxOccurs="1">
+      <xs:element name="vendor" minOccurs="0" maxOccurs="1" type="xs:normalizedString">
+        <xs:annotation>
+          <xs:documentation>The vendor of the tool used to create the BOM.</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+      <xs:element name="name" minOccurs="0" maxOccurs="1" type="xs:normalizedString">
+        <xs:annotation>
+          <xs:documentation>The name of the tool used to create the BOM.</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+      <xs:element name="version" minOccurs="0" maxOccurs="1" type="xs:normalizedString">
+        <xs:annotation>
+          <xs:documentation>The version of the tool used to create the BOM.</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+      <xs:element name="hashes" minOccurs="0" maxOccurs="1">
+        <xs:complexType>
+          <xs:sequence minOccurs="0" maxOccurs="unbounded">
+            <xs:element name="hash" type="bom:hashType"/>
+          </xs:sequence>
+        </xs:complexType>
+      </xs:element>
+    </xs:sequence>
+    <xs:anyAttribute namespace="##other" processContents="lax">
+      <xs:annotation>
+        <xs:documentation>User-defined attributes may be used on this element as long as they
+          do not have the same name as an existing attribute used by the schema.</xs:documentation>
+      </xs:annotation>
+    </xs:anyAttribute>
+  </xs:complexType>
+
+  <xs:complexType name="organizationalPerson">
+    <xs:sequence minOccurs="0" maxOccurs="1">
+      <xs:element name="name" type="xs:normalizedString" minOccurs="0" maxOccurs="1">
+        <xs:annotation>
+          <xs:documentation>The name of the person</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+      <xs:element name="email" type="xs:normalizedString" minOccurs="0" maxOccurs="unbounded">
+        <xs:annotation>
+          <xs:documentation>The email address of the person. Multiple email addresses are allowed.</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+      <xs:element name="phone" type="xs:normalizedString" minOccurs="0" maxOccurs="unbounded">
+        <xs:annotation>
+          <xs:documentation>The phone number of the person. Multiple phone numbers are allowed.</xs:documentation>
+        </xs:annotation>
+      </xs:element>
+    </xs:sequence>
+    <xs:anyAttribute namespace="##other" processContents="lax">
+      <xs:annotation>
+        <xs:documentation>User-defined attributes may be used on this element as long as they
+          do not have the same name as an existing attribute used by the schema.</xs:documentation>
+      </xs:annotation>
+    </xs:anyAttribute>
+  </xs:complexType>
+
+  <xs:element name="metadata" type="bd:metadata">
+    <xs:annotation>
+      <xs:documentation>Provides additional information about a BOM.</xs:documentation>
+    </xs:annotation>
+  </xs:element>
+
+</xs:schema>

syft/cataloger/apkdb/cataloger.go

@@ -1,17 +1,24 @@
+/*
+Package apkdb provides a concrete Cataloger implementation for Alpine DB files.
+*/
 package apkdb
 
 import (
+	"io"
+
 	"github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/scope"
 )
 
+// Cataloger catalogs pkg.ApkPkg Package Types defined in Alpine DB files.
 type Cataloger struct {
 	cataloger common.GenericCataloger
 }
 
-func NewCataloger() *Cataloger {
+// New returns a new Alpine DB cataloger object.
+func New() *Cataloger {
 	globParsers := map[string]common.ParserFn{
 		"**/lib/apk/db/installed": parseApkDB,
 	}
@@ -21,14 +28,17 @@ func NewCataloger() *Cataloger {
 	}
 }
 
-func (a *Cataloger) Name() string {
+// Name returns a string that uniquely describes this cataloger.
+func (c *Cataloger) Name() string {
 	return "apkdb-cataloger"
 }
 
-func (a *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
-	return a.cataloger.SelectFiles(resolver)
+// SelectFiles returns a set of discovered Alpine DB files from the user content source.
+func (c *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
+	return c.cataloger.SelectFiles(resolver)
 }
 
-func (a *Cataloger) Catalog(contents map[file.Reference]string) ([]pkg.Package, error) {
-	return a.cataloger.Catalog(contents, a.Name())
+// Catalog returns the Packages indexed from all Alpine DB files discovered.
+func (c *Cataloger) Catalog(contents map[file.Reference]io.Reader) ([]pkg.Package, error) {
+	return c.cataloger.Catalog(contents)
 }

syft/cataloger/apkdb/parse_apk_db.go

@@ -9,10 +9,16 @@ import (
 	"strings"
 
 	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/mitchellh/mapstructure"
 )
 
+// integrity check
+var _ common.ParserFn = parseApkDB
+
+// parseApkDb parses individual packages from a given Alpine DB file. For more information on specific fields
+// see https://wiki.alpinelinux.org/wiki/Apk_spec .
 func parseApkDB(_ string, reader io.Reader) ([]pkg.Package, error) {
 	packages := make([]pkg.Package, 0)
 
@@ -55,6 +61,7 @@ func parseApkDB(_ string, reader io.Reader) ([]pkg.Package, error) {
 }
 
 // nolint:funlen
+// parseApkDBEntry reads and parses a single pkg.ApkMetadata element from the stream, returning nil if their are no more entries.
 func parseApkDBEntry(reader io.Reader) (*pkg.ApkMetadata, error) {
 	var entry pkg.ApkMetadata
 	pkgFields := make(map[string]interface{})

syft/cataloger/bundler/cataloger.go

@@ -1,17 +1,24 @@
+/*
+Package bundler provides a concrete Cataloger implementation for Ruby Gemfile.lock bundler files.
+*/
 package bundler
 
 import (
+	"io"
+
 	"github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/scope"
 )
 
+// Cataloger catalogs pkg.GemPkg Package Types defined in Bundler Gemfile.lock files.
 type Cataloger struct {
 	cataloger common.GenericCataloger
 }
 
-func NewCataloger() *Cataloger {
+// New returns a new Bundler cataloger object.
+func New() *Cataloger {
 	globParsers := map[string]common.ParserFn{
 		"**/Gemfile.lock": parseGemfileLockEntries,
 	}
@@ -21,14 +28,17 @@ func NewCataloger() *Cataloger {
 	}
 }
 
-func (a *Cataloger) Name() string {
+// Name returns a string that uniquely describes this cataloger.
+func (c *Cataloger) Name() string {
 	return "bundler-cataloger"
 }
 
-func (a *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
-	return a.cataloger.SelectFiles(resolver)
+// SelectFiles returns a set of discovered Gemfile.lock files from the user content source.
+func (c *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
+	return c.cataloger.SelectFiles(resolver)
 }
 
-func (a *Cataloger) Catalog(contents map[file.Reference]string) ([]pkg.Package, error) {
-	return a.cataloger.Catalog(contents, a.Name())
+// Catalog returns the Packages indexed from all Gemfile.lock files discovered.
+func (c *Cataloger) Catalog(contents map[file.Reference]io.Reader) ([]pkg.Package, error) {
+	return c.cataloger.Catalog(contents)
 }

syft/cataloger/bundler/parse_gemfile_lock.go

@@ -6,11 +6,16 @@ import (
 	"strings"
 
 	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 )
 
+// integrity check
+var _ common.ParserFn = parseGemfileLockEntries
+
 var sectionsOfInterest = internal.NewStringSetFromSlice([]string{"GEM"})
 
+// parseGemfileLockEntries is a parser function for Gemfile.lock contents, returning all Gems discovered.
 func parseGemfileLockEntries(_ string, reader io.Reader) ([]pkg.Package, error) {
 	pkgs := make([]pkg.Package, 0)
 	scanner := bufio.NewScanner(reader)

syft/cataloger/catalog.go

@@ -0,0 +1,89 @@
+package cataloger
+
+import (
+	"github.com/anchore/stereoscope/pkg/file"
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/scope"
+	"github.com/hashicorp/go-multierror"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+)
+
+// Catalog a given scope (container image or filesystem) with the given catalogers, returning all discovered packages.
+// In order to efficiently retrieve contents from a underlying container image the content fetch requests are
+// done in bulk. Specifically, all files of interest are collected from each catalogers and accumulated into a single
+// request.
+func Catalog(resolver scope.Resolver, catalogers ...Cataloger) (*pkg.Catalog, error) {
+	catalog := pkg.NewCatalog()
+	fileSelection := make([]file.Reference, 0)
+
+	filesProcessed, packagesDiscovered := newMonitor()
+
+	// ask catalogers for files to extract from the image tar
+	for _, a := range catalogers {
+		catalogerSelection := a.SelectFiles(resolver)
+		fileSelection = append(fileSelection, catalogerSelection...)
+		log.Debugf("cataloger '%s' selected '%d' files", a.Name(), len(catalogerSelection))
+		filesProcessed.N += int64(len(fileSelection))
+	}
+
+	// fetch contents for requested selection by catalogers
+	// TODO: we should consider refactoring to return a set of io.Readers instead of the full contents themselves (allow for optional buffering).
+	contents, err := resolver.MultipleFileContentsByRef(fileSelection...)
+	if err != nil {
+		return nil, err
+	}
+
+	// perform analysis, accumulating errors for each failed analysis
+	var errs error
+	for _, c := range catalogers {
+		// TODO: check for multiple rounds of analyses by Iterate error
+		packages, err := c.Catalog(contents)
+		if err != nil {
+			errs = multierror.Append(errs, err)
+			continue
+		}
+
+		log.Debugf("cataloger '%s' discovered '%d' packages", c.Name(), len(packages))
+		packagesDiscovered.N += int64(len(packages))
+
+		catalogerName := c.Name()
+		for _, p := range packages {
+			p.FoundBy = catalogerName
+			catalog.Add(p)
+		}
+	}
+
+	if errs != nil {
+		return nil, errs
+	}
+
+	filesProcessed.SetCompleted()
+	packagesDiscovered.SetCompleted()
+
+	return catalog, nil
+}
+
+// Monitor provides progress-related data for observing the progress of a Catalog() call (published on the event bus).
+type Monitor struct {
+	FilesProcessed     progress.Monitorable // the number of files selected and contents analyzed from all registered catalogers
+	PackagesDiscovered progress.Monitorable // the number of packages discovered from all registered catalogers
+}
+
+// newMonitor creates a new Monitor object and publishes the object on the bus as a CatalogerStarted event.
+func newMonitor() (*progress.Manual, *progress.Manual) {
+	filesProcessed := progress.Manual{}
+	packagesDiscovered := progress.Manual{}
+
+	bus.Publish(partybus.Event{
+		Type: event.CatalogerStarted,
+		Value: Monitor{
+			FilesProcessed:     progress.Monitorable(&filesProcessed),
+			PackagesDiscovered: progress.Monitorable(&packagesDiscovered),
+		},
+	})
+	return &filesProcessed, &packagesDiscovered
+}

syft/cataloger/cataloger.go

@@ -1,16 +1,50 @@
+/*
+Package cataloger provides the ability to process files from a container image or file system and discover packages
+(gems, wheels, jars, rpms, debs, etc). Specifically, this package contains both a catalog function to utilize all
+catalogers defined in child packages as well as the interface definition to implement a cataloger.
+*/
 package cataloger
 
 import (
+	"io"
+
+	"github.com/anchore/syft/syft/cataloger/dpkg"
+
 	"github.com/anchore/stereoscope/pkg/file"
+	"github.com/anchore/syft/syft/cataloger/apkdb"
+	"github.com/anchore/syft/syft/cataloger/bundler"
+	"github.com/anchore/syft/syft/cataloger/golang"
+	"github.com/anchore/syft/syft/cataloger/java"
+	"github.com/anchore/syft/syft/cataloger/javascript"
+	"github.com/anchore/syft/syft/cataloger/python"
+	"github.com/anchore/syft/syft/cataloger/rpmdb"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/scope"
 )
 
+// Cataloger describes behavior for an object to participate in parsing container image or file system
+// contents for the purpose of discovering Packages. Each concrete implementation should focus on discovering Packages
+// for a specific Package Type or ecosystem.
 type Cataloger interface {
+	// Name returns a string that uniquely describes a cataloger
 	Name() string
-	// TODO: add ID / Name for catalog for uniquely identifying this cataloger type
+	// SelectFiles discovers and returns specific files that the cataloger would like to inspect the contents of.
 	SelectFiles(scope.FileResolver) []file.Reference
-	// NOTE: one of the errors which is returned is "IterationNeeded", which indicates to the driver to
-	// continue with another Select/Catalog pass
-	Catalog(map[file.Reference]string) ([]pkg.Package, error)
+	// Catalog is given the file contents and should return any discovered Packages after analyzing the contents.
+	Catalog(map[file.Reference]io.Reader) ([]pkg.Package, error)
+	// TODO: add "IterationNeeded" error to indicate to the driver to continue with another Select/Catalog pass
+}
+
+// All returns a slice of all locally defined catalogers (defined in child packages).
+func BuiltIn() []Cataloger {
+	return []Cataloger{
+		dpkg.New(),
+		bundler.New(),
+		python.New(),
+		rpmdb.New(),
+		java.New(),
+		apkdb.New(),
+		golang.New(),
+		javascript.New(),
+	}
 }

syft/cataloger/common/generic_cataloger.go

@@ -1,7 +1,10 @@
+/*
+Package common provides generic utilities used by multiple catalogers.
+*/
 package common
 
 import (
-	"strings"
+	"io"
 
 	"github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/syft/internal/log"
@@ -70,7 +73,7 @@ func (a *GenericCataloger) SelectFiles(resolver scope.FileResolver) []file.Refer
 }
 
 // Catalog takes a set of file contents and uses any configured parser functions to resolve and return discovered packages
-func (a *GenericCataloger) Catalog(contents map[file.Reference]string, upstreamMatcher string) ([]pkg.Package, error) {
+func (a *GenericCataloger) Catalog(contents map[file.Reference]io.Reader) ([]pkg.Package, error) {
 	defer a.clear()
 
 	packages := make([]pkg.Package, 0)
@@ -78,19 +81,18 @@ func (a *GenericCataloger) Catalog(contents map[file.Reference]string, upstreamM
 	for reference, parser := range a.parsers {
 		content, ok := contents[reference]
 		if !ok {
-			log.Errorf("cataloger '%s' missing file content: %+v", upstreamMatcher, reference)
+			log.Errorf("cataloger missing file content: %+v", reference)
 			continue
 		}
 
-		entries, err := parser(string(reference.Path), strings.NewReader(content))
+		entries, err := parser(string(reference.Path), content)
 		if err != nil {
 			// TODO: should we fail? or only log?
-			log.Errorf("cataloger '%s' failed to parse entries (reference=%+v): %w", upstreamMatcher, reference, err)
+			log.Errorf("cataloger failed to parse entries (reference=%+v): %w", reference, err)
 			continue
 		}
 
 		for _, entry := range entries {
-			entry.FoundBy = upstreamMatcher
 			entry.Source = []file.Reference{reference}
 
 			packages = append(packages, entry)

syft/cataloger/common/generic_cataloger_test.go

@@ -79,17 +79,15 @@ func TestGenericCataloger(t *testing.T) {
 		selectionByPath[string(s.Path)] = s
 	}
 
-	upstream := "some-other-cataloger"
 	expectedPkgs := make(map[file.Reference]pkg.Package)
 	for path, ref := range selectionByPath {
 		expectedPkgs[ref] = pkg.Package{
-			FoundBy: upstream,
-			Source:  []file.Reference{ref},
-			Name:    fmt.Sprintf("%s file contents!", path),
+			Source: []file.Reference{ref},
+			Name:   fmt.Sprintf("%s file contents!", path),
 		}
 	}
 
-	actualPkgs, err := cataloger.Catalog(resolver.contents, upstream)
+	actualPkgs, err := cataloger.Catalog(resolver.contents)
 	if err != nil {
 		t.Fatalf("cataloger catalog action failed: %+v", err)
 	}

syft/cataloger/controller.go

@@ -1,129 +0,0 @@
-package cataloger
-
-import (
-	"github.com/anchore/stereoscope/pkg/file"
-	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/cataloger/apkdb"
-	"github.com/anchore/syft/syft/cataloger/bundler"
-	"github.com/anchore/syft/syft/cataloger/dpkg"
-	golang "github.com/anchore/syft/syft/cataloger/golang"
-	"github.com/anchore/syft/syft/cataloger/java"
-	"github.com/anchore/syft/syft/cataloger/javascript"
-	"github.com/anchore/syft/syft/cataloger/python"
-	"github.com/anchore/syft/syft/cataloger/rpmdb"
-	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/scope"
-	"github.com/hashicorp/go-multierror"
-	"github.com/wagoodman/go-partybus"
-	"github.com/wagoodman/go-progress"
-)
-
-var controllerInstance controller
-
-func init() {
-	controllerInstance = newController()
-}
-
-func Catalogers() []string {
-	c := make([]string, len(controllerInstance.catalogers))
-	for idx, catalog := range controllerInstance.catalogers {
-		c[idx] = catalog.Name()
-	}
-	return c
-}
-
-func Catalog(s scope.Resolver) (*pkg.Catalog, error) {
-	return controllerInstance.catalog(s)
-}
-
-type controller struct {
-	catalogers []Cataloger
-}
-
-func newController() controller {
-	ctrlr := controller{
-		catalogers: make([]Cataloger, 0),
-	}
-	ctrlr.add(dpkg.NewCataloger())
-	ctrlr.add(bundler.NewCataloger())
-	ctrlr.add(python.NewCataloger())
-	ctrlr.add(rpmdb.NewCataloger())
-	ctrlr.add(java.NewCataloger())
-	ctrlr.add(apkdb.NewCataloger())
-	ctrlr.add(golang.NewCataloger())
-	ctrlr.add(javascript.NewCataloger())
-	return ctrlr
-}
-
-func (c *controller) add(a Cataloger) {
-	log.Debugf("adding cataloger: %s", a.Name())
-	c.catalogers = append(c.catalogers, a)
-}
-
-type Monitor struct {
-	FilesProcessed     progress.Monitorable
-	PackagesDiscovered progress.Monitorable
-}
-
-func (c *controller) trackCataloger() (*progress.Manual, *progress.Manual) {
-	filesProcessed := progress.Manual{}
-	packagesDiscovered := progress.Manual{}
-
-	bus.Publish(partybus.Event{
-		Type: event.CatalogerStarted,
-		Value: Monitor{
-			FilesProcessed:     progress.Monitorable(&filesProcessed),
-			PackagesDiscovered: progress.Monitorable(&packagesDiscovered),
-		},
-	})
-	return &filesProcessed, &packagesDiscovered
-}
-
-func (c *controller) catalog(s scope.Resolver) (*pkg.Catalog, error) {
-	catalog := pkg.NewCatalog()
-	fileSelection := make([]file.Reference, 0)
-
-	filesProcessed, packagesDiscovered := c.trackCataloger()
-
-	// ask catalogers for files to extract from the image tar
-	for _, a := range c.catalogers {
-		fileSelection = append(fileSelection, a.SelectFiles(s)...)
-		log.Debugf("cataloger '%s' selected '%d' files", a.Name(), len(fileSelection))
-		filesProcessed.N += int64(len(fileSelection))
-	}
-
-	// fetch contents for requested selection by catalogers
-	contents, err := s.MultipleFileContentsByRef(fileSelection...)
-	if err != nil {
-		return nil, err
-	}
-
-	// perform analysis, accumulating errors for each failed analysis
-	var errs error
-	for _, a := range c.catalogers {
-		// TODO: check for multiple rounds of analyses by Iterate error
-		packages, err := a.Catalog(contents)
-		if err != nil {
-			errs = multierror.Append(errs, err)
-			continue
-		}
-
-		log.Debugf("cataloger '%s' discovered '%d' packages", a.Name(), len(packages))
-		packagesDiscovered.N += int64(len(packages))
-
-		for _, p := range packages {
-			catalog.Add(p)
-		}
-	}
-
-	if errs != nil {
-		return nil, errs
-	}
-
-	filesProcessed.SetCompleted()
-	packagesDiscovered.SetCompleted()
-
-	return catalog, nil
-}

syft/cataloger/dpkg/cataloger.go

@@ -1,17 +1,24 @@
+/*
+Package dpkg provides a concrete Cataloger implementation for Debian package DB status files.
+*/
 package dpkg
 
 import (
+	"io"
+
 	"github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/scope"
 )
 
+// Cataloger catalogs pkg.DebPkg Package Types defined in DPKG status files.
 type Cataloger struct {
 	cataloger common.GenericCataloger
 }
 
-func NewCataloger() *Cataloger {
+// New returns a new Deb package cataloger object.
+func New() *Cataloger {
 	globParsers := map[string]common.ParserFn{
 		"**/var/lib/dpkg/status": parseDpkgStatus,
 	}
@@ -21,14 +28,17 @@ func NewCataloger() *Cataloger {
 	}
 }
 
-func (a *Cataloger) Name() string {
+// Name returns a string that uniquely describes this cataloger.
+func (c *Cataloger) Name() string {
 	return "dpkg-cataloger"
 }
 
-func (a *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
-	return a.cataloger.SelectFiles(resolver)
+// SelectFiles returns a set of discovered DPKG status files from the user content source.
+func (c *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
+	return c.cataloger.SelectFiles(resolver)
 }
 
-func (a *Cataloger) Catalog(contents map[file.Reference]string) ([]pkg.Package, error) {
-	return a.cataloger.Catalog(contents, a.Name())
+// Catalog returns the Packages indexed from all DPKG status files discovered.
+func (c *Cataloger) Catalog(contents map[file.Reference]io.Reader) ([]pkg.Package, error) {
+	return c.cataloger.Catalog(contents)
 }

syft/cataloger/dpkg/parse_dpkg_status.go

@@ -6,12 +6,17 @@ import (
 	"io"
 	"strings"
 
+	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/mitchellh/mapstructure"
 )
 
+// integrity check
+var _ common.ParserFn = parseDpkgStatus
+
 var errEndOfPackages = fmt.Errorf("no more packages to read")
 
+// parseDpkgStatus is a parser function for Debian DB status contents, returning all Debian packages listed.
 func parseDpkgStatus(_ string, reader io.Reader) ([]pkg.Package, error) {
 	buffedReader := bufio.NewReader(reader)
 	var packages = make([]pkg.Package, 0)
@@ -35,6 +40,7 @@ func parseDpkgStatus(_ string, reader io.Reader) ([]pkg.Package, error) {
 	return packages, nil
 }
 
+// parseDpkgStatusEntry returns an individual Dpkg entry, or returns errEndOfPackages if there are no more packages to parse from the reader.
 func parseDpkgStatusEntry(reader *bufio.Reader) (entry pkg.DpkgMetadata, err error) {
 	dpkgFields := make(map[string]string)
 	var key string

syft/cataloger/dpkg/parse_dpkg_status_test.go

@@ -24,9 +24,10 @@ func TestSinglePackage(t *testing.T) {
 		{
 			name: "Test Single Package",
 			expected: pkg.DpkgMetadata{
-				Package: "apt",
-				Source:  "apt-dev",
-				Version: "1.8.2",
+				Package:      "apt",
+				Source:       "apt-dev",
+				Version:      "1.8.2",
+				Architecture: "amd64",
 			},
 		},
 	}
@@ -65,13 +66,15 @@ func TestMultiplePackages(t *testing.T) {
 			name: "Test Multiple Package",
 			expected: []pkg.DpkgMetadata{
 				{
-					Package: "tzdata",
-					Version: "2020a-0+deb10u1",
-					Source:  "tzdata-dev",
+					Package:      "tzdata",
+					Version:      "2020a-0+deb10u1",
+					Source:       "tzdata-dev",
+					Architecture: "all",
 				},
 				{
-					Package: "util-linux",
-					Version: "2.33.1-0.1",
+					Package:      "util-linux",
+					Version:      "2.33.1-0.1",
+					Architecture: "amd64",
 				},
 			},
 		},

syft/cataloger/golang/cataloger.go

@@ -1,17 +1,24 @@
+/*
+Package golang provides a concrete Cataloger implementation for go.mod files.
+*/
 package golang
 
 import (
+	"io"
+
 	"github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/scope"
 )
 
+// Cataloger catalogs pkg.GoModulePkg Package Types defined in go.mod files.
 type Cataloger struct {
 	cataloger common.GenericCataloger
 }
 
-func NewCataloger() *Cataloger {
+// New returns a new Go module cataloger object.
+func New() *Cataloger {
 	globParsers := map[string]common.ParserFn{
 		"**/go.mod": parseGoMod,
 	}
@@ -21,14 +28,17 @@ func NewCataloger() *Cataloger {
 	}
 }
 
-func (a *Cataloger) Name() string {
+// Name returns a string that uniquely describes this cataloger.
+func (c *Cataloger) Name() string {
 	return "go-cataloger"
 }
 
-func (a *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
-	return a.cataloger.SelectFiles(resolver)
+// SelectFiles returns a set of discovered go.mod files from the user content source.
+func (c *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
+	return c.cataloger.SelectFiles(resolver)
 }
 
-func (a *Cataloger) Catalog(contents map[file.Reference]string) ([]pkg.Package, error) {
-	return a.cataloger.Catalog(contents, a.Name())
+// Catalog returns the Packages indexed from all go.mod files discovered.
+func (c *Cataloger) Catalog(contents map[file.Reference]io.Reader) ([]pkg.Package, error) {
+	return c.cataloger.Catalog(contents)
 }

syft/cataloger/golang/parse_go_mod.go

@@ -11,6 +11,7 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 )
 
+// parseGoMod takes a go.mod and lists all packages discovered.
 func parseGoMod(path string, reader io.Reader) ([]pkg.Package, error) {
 	packages := make(map[string]pkg.Package)
 

syft/cataloger/java/archive_parser.go

@@ -7,9 +7,13 @@ import (
 
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/file"
+	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 )
 
+// integrity check
+var _ common.ParserFn = parseJavaArchive
+
 var archiveFormatGlobs = []string{
 	"**/*.jar",
 	"**/*.war",
@@ -28,6 +32,7 @@ type archiveParser struct {
 	detectNested   bool
 }
 
+// parseJavaArchive is a parser function for java archive contents, returning all Java libraries and nested archives.
 func parseJavaArchive(virtualPath string, reader io.Reader) ([]pkg.Package, error) {
 	parser, cleanupFn, err := newJavaArchiveParser(virtualPath, reader, true)
 	// note: even on error, we should always run cleanup functions
@@ -38,6 +43,7 @@ func parseJavaArchive(virtualPath string, reader io.Reader) ([]pkg.Package, erro
 	return parser.parse()
 }
 
+// uniquePkgKey creates a unique string to identify the given package.
 func uniquePkgKey(p *pkg.Package) string {
 	if p == nil {
 		return ""
@@ -45,6 +51,8 @@ func uniquePkgKey(p *pkg.Package) string {
 	return fmt.Sprintf("%s|%s", p.Name, p.Version)
 }
 
+// newJavaArchiveParser returns a new java archive parser object for the given archive. Can be configured to discover
+// and parse nested archives or ignore them.
 func newJavaArchiveParser(virtualPath string, reader io.Reader, detectNested bool) (*archiveParser, func(), error) {
 	contentPath, archivePath, cleanupFn, err := saveArchiveToTmp(reader)
 	if err != nil {
@@ -67,6 +75,7 @@ func newJavaArchiveParser(virtualPath string, reader io.Reader, detectNested boo
 	}, cleanupFn, nil
 }
 
+// parse the loaded archive and return all packages found.
 func (j *archiveParser) parse() ([]pkg.Package, error) {
 	var pkgs = make([]pkg.Package, 0)
 
@@ -106,6 +115,7 @@ func (j *archiveParser) parse() ([]pkg.Package, error) {
 	return pkgs, nil
 }
 
+// discoverMainPackage parses the root Java manifest used as the parent package to all discovered nested packages.
 func (j *archiveParser) discoverMainPackage() (*pkg.Package, error) {
 	// search and parse java manifest files
 	manifestMatches := j.fileManifest.GlobMatch(manifestPath)
@@ -140,6 +150,8 @@ func (j *archiveParser) discoverMainPackage() (*pkg.Package, error) {
 	}, nil
 }
 
+// discoverPkgsFromPomProperties parses Maven POM properties for a given parent package, returning all listed Java packages found and
+// associating each discovered package to the given parent package.
 func (j *archiveParser) discoverPkgsFromPomProperties(parentPkg *pkg.Package) ([]pkg.Package, error) {
 	var pkgs = make([]pkg.Package, 0)
 	parentKey := uniquePkgKey(parentPkg)
@@ -192,6 +204,8 @@ func (j *archiveParser) discoverPkgsFromPomProperties(parentPkg *pkg.Package) ([
 	return pkgs, nil
 }
 
+// discoverPkgsFromNestedArchives finds Java archives within Java archives, returning all listed Java packages found and
+// associating each discovered package to the given parent package.
 func (j *archiveParser) discoverPkgsFromNestedArchives(parentPkg *pkg.Package) ([]pkg.Package, error) {
 	var pkgs = make([]pkg.Package, 0)
 

syft/cataloger/java/cataloger.go

@@ -1,17 +1,24 @@
+/*
+Package java provides a concrete Cataloger implementation for Java archives (jar, war, ear, jpi, hpi formats).
+*/
 package java
 
 import (
+	"io"
+
 	"github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/scope"
 )
 
+// Cataloger catalogs pkg.JavaPkg and pkg.JenkinsPluginPkg Package Types defined in java archive files.
 type Cataloger struct {
 	cataloger common.GenericCataloger
 }
 
-func NewCataloger() *Cataloger {
+// New returns a new Java archive cataloger object.
+func New() *Cataloger {
 	globParsers := make(map[string]common.ParserFn)
 	for _, pattern := range archiveFormatGlobs {
 		globParsers[pattern] = parseJavaArchive
@@ -22,14 +29,17 @@ func NewCataloger() *Cataloger {
 	}
 }
 
-func (a *Cataloger) Name() string {
+// Name returns a string that uniquely describes this cataloger.
+func (c *Cataloger) Name() string {
 	return "java-cataloger"
 }
 
-func (a *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
-	return a.cataloger.SelectFiles(resolver)
+// SelectFiles returns a set of discovered Java archive files from the user content source.
+func (c *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
+	return c.cataloger.SelectFiles(resolver)
 }
 
-func (a *Cataloger) Catalog(contents map[file.Reference]string) ([]pkg.Package, error) {
-	return a.cataloger.Catalog(contents, a.Name())
+// Catalog returns the Packages indexed from all Java archive files discovered.
+func (c *Cataloger) Catalog(contents map[file.Reference]io.Reader) ([]pkg.Package, error) {
+	return c.cataloger.Catalog(contents)
 }

syft/cataloger/javascript/cataloger.go

@@ -1,17 +1,24 @@
+/*
+Package javascript provides a concrete Cataloger implementation for JavaScript ecosystem files (yarn and npm).
+*/
 package javascript
 
 import (
+	"io"
+
 	"github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/scope"
 )
 
+// Cataloger catalogs pkg.YarnPkg and pkg.NpmPkg Package Types defined in package-lock.json and yarn.lock files.
 type Cataloger struct {
 	cataloger common.GenericCataloger
 }
 
-func NewCataloger() *Cataloger {
+// New returns a new JavaScript cataloger object.
+func New() *Cataloger {
 	globParsers := map[string]common.ParserFn{
 		"**/package-lock.json": parsePackageLock,
 		"**/yarn.lock":         parseYarnLock,
@@ -22,14 +29,17 @@ func NewCataloger() *Cataloger {
 	}
 }
 
-func (a *Cataloger) Name() string {
-	return "npm-cataloger"
+// Name returns a string that uniquely describes this cataloger.
+func (c *Cataloger) Name() string {
+	return "javascript-cataloger"
 }
 
-func (a *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
-	return a.cataloger.SelectFiles(resolver)
+// SelectFiles returns a set of discovered Javascript ecosystem files from the user content source.
+func (c *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
+	return c.cataloger.SelectFiles(resolver)
 }
 
-func (a *Cataloger) Catalog(contents map[file.Reference]string) ([]pkg.Package, error) {
-	return a.cataloger.Catalog(contents, a.Name())
+// Catalog returns the Packages indexed from all Javascript ecosystem files discovered.
+func (c *Cataloger) Catalog(contents map[file.Reference]io.Reader) ([]pkg.Package, error) {
+	return c.cataloger.Catalog(contents)
 }

syft/cataloger/javascript/parse_package_lock.go

@@ -5,15 +5,21 @@ import (
 	"fmt"
 	"io"
 
+	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 )
 
+// integrity check
+var _ common.ParserFn = parsePackageLock
+
+// PackageLock represents a JavaScript package.lock json file
 type PackageLock struct {
 	Requires        bool `json:"requires"`
 	LockfileVersion int  `json:"lockfileVersion"`
-	Dependencies    Dependencies
+	Dependencies    map[string]Dependency
 }
 
+// Dependency represents a single package dependency listed in the package.lock json file
 type Dependency struct {
 	Version   string `json:"version"`
 	Resolved  string `json:"resolved"`
@@ -21,8 +27,7 @@ type Dependency struct {
 	Requires  map[string]string
 }
 
-type Dependencies map[string]Dependency
-
+// parsePackageLock parses a package.lock and returns the discovered JavaScript packages.
 func parsePackageLock(_ string, reader io.Reader) ([]pkg.Package, error) {
 	packages := make([]pkg.Package, 0)
 	dec := json.NewDecoder(reader)

syft/cataloger/javascript/parse_yarn_lock.go

@@ -8,9 +8,13 @@ import (
 	"strings"
 
 	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 )
 
+// integrity check
+var _ common.ParserFn = parseYarnLock
+
 var composedNameExp = regexp.MustCompile("^\"(@{1}[^@]+)")
 var simpleNameExp = regexp.MustCompile(`^[a-zA-Z\-]+@`)
 var versionExp = regexp.MustCompile(`^\W+(version)\W+`)

syft/cataloger/python/cataloger.go

@@ -1,25 +1,30 @@
+/*
+Package python provides a concrete Cataloger implementation for Python ecosystem files (egg, wheel, requirements.txt).
+*/
 package python
 
 import (
+	"io"
+
 	"github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/scope"
 )
 
+// Cataloger catalogs pkg.WheelPkg, pkg.EggPkg, and pkg.PythonRequirementsPkg Package Types defined in Python ecosystem files.
 type Cataloger struct {
 	cataloger common.GenericCataloger
 }
 
-func NewCataloger() *Cataloger {
-	// we want to match on partial dir names
-	// 	/home/user/requests-2.10.0.dist-info/METADATA
-	//	/home/user/requests-2.10.0/dist-info/METADATA
+// New returns a new Python cataloger object.
+func New() *Cataloger {
 	globParsers := map[string]common.ParserFn{
 		"**/*egg-info/PKG-INFO":  parseEggMetadata,
 		"**/*dist-info/METADATA": parseWheelMetadata,
 		"**/requirements.txt":    parseRequirementsTxt,
 		"**/poetry.lock":         parsePoetryLock,
+		"**/setup.py":            parseSetup,
 	}
 
 	return &Cataloger{
@@ -27,14 +32,17 @@ func NewCataloger() *Cataloger {
 	}
 }
 
-func (a *Cataloger) Name() string {
+// Name returns a string that uniquely describes this cataloger.
+func (c *Cataloger) Name() string {
 	return "python-cataloger"
 }
 
-func (a *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
-	return a.cataloger.SelectFiles(resolver)
+// SelectFiles returns a set of discovered Python ecosystem files from the user content source.
+func (c *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
+	return c.cataloger.SelectFiles(resolver)
 }
 
-func (a *Cataloger) Catalog(contents map[file.Reference]string) ([]pkg.Package, error) {
-	return a.cataloger.Catalog(contents, a.Name())
+// Catalog returns the Packages indexed from all Python ecosystem files discovered.
+func (c *Cataloger) Catalog(contents map[file.Reference]io.Reader) ([]pkg.Package, error) {
+	return c.cataloger.Catalog(contents)
 }

syft/cataloger/python/parse_poetry_lock.go

@@ -4,10 +4,15 @@ import (
 	"fmt"
 	"io"
 
+	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/pelletier/go-toml"
 )
 
+// integrity check
+var _ common.ParserFn = parsePoetryLock
+
+// parsePoetryLock is a parser function for poetry.lock contents, returning all python packages discovered.
 func parsePoetryLock(_ string, reader io.Reader) ([]pkg.Package, error) {
 	tree, err := toml.LoadReader(reader)
 	if err != nil {

syft/cataloger/python/parse_requirements.go

@@ -6,9 +6,15 @@ import (
 	"io"
 	"strings"
 
+	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 )
 
+// integrity check
+var _ common.ParserFn = parseRequirementsTxt
+
+// parseRequirementsTxt takes a Python requirements.txt file, returning all Python packages that are locked to a
+// specific version.
 func parseRequirementsTxt(_ string, reader io.Reader) ([]pkg.Package, error) {
 	packages := make([]pkg.Package, 0)
 
@@ -55,6 +61,7 @@ func parseRequirementsTxt(_ string, reader io.Reader) ([]pkg.Package, error) {
 	return packages, nil
 }
 
+// removeTrailingComment takes a requirements.txt line and strips off comment strings.
 func removeTrailingComment(line string) string {
 	parts := strings.Split(line, "#")
 	switch len(parts) {

syft/cataloger/python/parse_setup.go

@@ -0,0 +1,50 @@
+package python
+
+import (
+	"bufio"
+	"io"
+	"regexp"
+	"strings"
+
+	"github.com/anchore/syft/syft/cataloger/common"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+// integrity check
+var _ common.ParserFn = parseSetup
+
+// match examples:
+//		'pathlib3==2.2.0;python_version<"3.6"'  --> match(name=pathlib3 version=2.2.0)
+//		 "mypy==v0.770",                        --> match(name=mypy version=v0.770)
+//		" mypy2 == v0.770", ' mypy3== v0.770',  --> match(name=mypy2 version=v0.770), match(name=mypy3, version=v0.770)
+var pinnedDependency = regexp.MustCompile(`['"]\W?(\w+\W?==\W?[\w\.]*)`)
+
+func parseSetup(_ string, reader io.Reader) ([]pkg.Package, error) {
+	packages := make([]pkg.Package, 0)
+
+	scanner := bufio.NewScanner(reader)
+
+	for scanner.Scan() {
+		line := scanner.Text()
+		line = strings.TrimRight(line, "\n")
+
+		for _, match := range pinnedDependency.FindAllString(line, -1) {
+			parts := strings.Split(match, "==")
+			if len(parts) != 2 {
+				continue
+			}
+			name := strings.Trim(parts[0], "'\"")
+			name = strings.TrimSpace(name)
+
+			version := strings.TrimSpace(parts[len(parts)-1])
+			packages = append(packages, pkg.Package{
+				Name:     strings.Trim(name, "'\""),
+				Version:  strings.Trim(version, "'\""),
+				Language: pkg.Python,
+				Type:     pkg.PythonSetupPkg,
+			})
+		}
+	}
+
+	return packages, nil
+}

syft/cataloger/python/parse_setup_test.go

@@ -0,0 +1,60 @@
+package python
+
+import (
+	"os"
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func TestParseSetup(t *testing.T) {
+	expected := map[string]pkg.Package{
+		"pathlib3": {
+			Name:     "pathlib3",
+			Version:  "2.2.0",
+			Language: pkg.Python,
+			Type:     pkg.PythonSetupPkg,
+			Licenses: []string{},
+		},
+		"mypy": {
+			Name:     "mypy",
+			Version:  "v0.770",
+			Language: pkg.Python,
+			Type:     pkg.PythonSetupPkg,
+			Licenses: []string{},
+		},
+		"mypy1": {
+			Name:     "mypy1",
+			Version:  "v0.770",
+			Language: pkg.Python,
+			Type:     pkg.PythonSetupPkg,
+			Licenses: []string{},
+		},
+		"mypy2": {
+			Name:     "mypy2",
+			Version:  "v0.770",
+			Language: pkg.Python,
+			Type:     pkg.PythonSetupPkg,
+			Licenses: []string{},
+		},
+		"mypy3": {
+			Name:     "mypy3",
+			Version:  "v0.770",
+			Language: pkg.Python,
+			Type:     pkg.PythonSetupPkg,
+			Licenses: []string{},
+		},
+	}
+	fixture, err := os.Open("test-fixtures/setup/setup.py")
+	if err != nil {
+		t.Fatalf("failed to open fixture: %+v", err)
+	}
+
+	actual, err := parseSetup(fixture.Name(), fixture)
+	if err != nil {
+		t.Fatalf("failed to parse requirements: %+v", err)
+	}
+
+	assertPkgsEqual(t, actual, expected)
+
+}

syft/cataloger/python/parse_wheel_egg.go

@@ -6,9 +6,16 @@ import (
 	"io"
 	"strings"
 
+	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 )
 
+// integrity check
+var _ common.ParserFn = parseWheelMetadata
+var _ common.ParserFn = parseEggMetadata
+
+// parseWheelMetadata is a parser function for individual Python Wheel metadata file contents, returning all Python
+// packages listed.
 func parseWheelMetadata(_ string, reader io.Reader) ([]pkg.Package, error) {
 	packages, err := parseWheelOrEggMetadata(reader)
 	for idx := range packages {
@@ -17,6 +24,8 @@ func parseWheelMetadata(_ string, reader io.Reader) ([]pkg.Package, error) {
 	return packages, err
 }
 
+// parseEggMetadata is a parser function for individual Python Egg metadata file contents, returning all Python
+// packages listed.
 func parseEggMetadata(_ string, reader io.Reader) ([]pkg.Package, error) {
 	packages, err := parseWheelOrEggMetadata(reader)
 	for idx := range packages {
@@ -25,6 +34,8 @@ func parseEggMetadata(_ string, reader io.Reader) ([]pkg.Package, error) {
 	return packages, err
 }
 
+// parseWheelOrEggMetadata takes a Python Egg or Wheel (which share the same format and values for our purposes),
+// returning all Python packages listed.
 func parseWheelOrEggMetadata(reader io.Reader) ([]pkg.Package, error) {
 	fields := make(map[string]string)
 	var key string

syft/cataloger/python/test-fixtures/setup/setup.py

@@ -0,0 +1,46 @@
+from setuptools import setup
+
+# Sample setup.py from the pytest project with added comments specific
+# to the cataloger
+
+INSTALL_REQUIRES = [
+    "py>=1.5.0",
+    "packaging",
+    "attrs>=17.4.0",
+    "more-itertools>=4.0.0",
+    'atomicwrites>=1.0;sys_platform=="win32"',  # sys_platform is ignored
+    'pathlib2>=2.2.0;python_version=="3.6"',  # python_version is ignored
+    'pathlib3==2.2.0;python_version<"3.6"',  # this is caught
+    'colorama;sys_platform=="win32"',
+    "pluggy>=0.12,<1.0",
+    'importlib-metadata>=0.12;python_version<"3.8"',
+    "wcwidth",
+]
+
+
+def main():
+    setup(
+        use_scm_version={"write_to": "src/_pytest/_version.py"},
+        setup_requires=["setuptools-scm", "setuptools>=40.0"],
+        package_dir={"": "src"},
+        extras_require={
+            "testing": [
+                "argcomplete",
+                "hypothesis>=3.56",
+                "mock",
+                "nose",
+                "requests",
+                "xmlschema",
+            ],
+            "checkqa-mypy": [
+                "mypy==v0.770",  # this is caught
+                " mypy1==v0.770",  # this is caught
+                " mypy2 == v0.770", ' mypy3== v0.770',  # this is caught
+            ],
+        },
+        install_requires=INSTALL_REQUIRES,
+    )
+
+
+if __name__ == "__main__":
+    main()

syft/cataloger/rpmdb/cataloger.go

@@ -1,17 +1,24 @@
+/*
+Package rpmdb provides a concrete Cataloger implementation for RPM "Package" DB files.
+*/
 package rpmdb
 
 import (
+	"io"
+
 	"github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/scope"
 )
 
+// Cataloger catalogs pkg.RpmPkg Package Types defined in RPM DB files.
 type Cataloger struct {
 	cataloger common.GenericCataloger
 }
 
-func NewCataloger() *Cataloger {
+// New returns a new RPM DB cataloger object.
+func New() *Cataloger {
 	globParsers := map[string]common.ParserFn{
 		"**/var/lib/rpm/Packages": parseRpmDB,
 	}
@@ -21,14 +28,17 @@ func NewCataloger() *Cataloger {
 	}
 }
 
-func (a *Cataloger) Name() string {
+// Name returns a string that uniquely describes this cataloger.
+func (c *Cataloger) Name() string {
 	return "rpmdb-cataloger"
 }
 
-func (a *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
-	return a.cataloger.SelectFiles(resolver)
+// SelectFiles returns a set of discovered RPM DB files from the user content source.
+func (c *Cataloger) SelectFiles(resolver scope.FileResolver) []file.Reference {
+	return c.cataloger.SelectFiles(resolver)
 }
 
-func (a *Cataloger) Catalog(contents map[file.Reference]string) ([]pkg.Package, error) {
-	return a.cataloger.Catalog(contents, a.Name())
+// Catalog returns the Packages indexed from all RPM DB files discovered.
+func (c *Cataloger) Catalog(contents map[file.Reference]io.Reader) ([]pkg.Package, error) {
+	return c.cataloger.Catalog(contents)
 }

syft/cataloger/rpmdb/parse_rpmdb.go

@@ -6,12 +6,17 @@ import (
 	"io/ioutil"
 	"os"
 
+	rpmdb "github.com/anchore/go-rpmdb/pkg"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/cataloger/common"
 	"github.com/anchore/syft/syft/pkg"
-	rpmdb "github.com/wagoodman/go-rpmdb/pkg"
 )
 
+// integrity check
+var _ common.ParserFn = parseRpmDB
+
+// parseApkDb parses an "Packages" RPM DB and returns the Packages listed within it.
 func parseRpmDB(_ string, reader io.Reader) ([]pkg.Package, error) {
 	f, err := ioutil.TempFile("", internal.ApplicationName+"-rpmdb")
 	if err != nil {
@@ -49,6 +54,7 @@ func parseRpmDB(_ string, reader io.Reader) ([]pkg.Package, error) {
 			//Version: fmt.Sprintf("%d:%s-%s.%s", entry.Epoch, entry.Version, entry.Release, entry.Arch),
 			Type: pkg.RpmPkg,
 			Metadata: pkg.RpmMetadata{
+				Name:      entry.Name,
 				Version:   entry.Version,
 				Epoch:     entry.Epoch,
 				Arch:      entry.Arch,

syft/cataloger/rpmdb/parse_rpmdb_test.go

@@ -14,6 +14,7 @@ func TestParseRpmDB(t *testing.T) {
 			Version: "0.9.2-1",
 			Type:    pkg.RpmPkg,
 			Metadata: pkg.RpmMetadata{
+				Name:      "dive",
 				Epoch:     0,
 				Arch:      "x86_64",
 				Release:   "1",

syft/client.go

@@ -0,0 +1,91 @@
+/*
+A "one-stop-shop" for helper utilities for all major functionality provided by child packages of the syft library.
+*/
+package syft
+
+import (
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/cataloger"
+	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/syft/logger"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/plugin"
+	"github.com/anchore/syft/syft/scope"
+	"github.com/wagoodman/go-partybus"
+)
+
+type Config struct {
+	PluginDirectory string
+}
+
+type Client struct {
+	config  Config
+	plugins *plugin.Repository
+}
+
+func NewClient(config Config) (Client, error) {
+	plugins, err := plugin.NewRepositoryFromDirectory(config.PluginDirectory)
+	if err != nil {
+		return Client{}, err
+	}
+
+	return Client{
+		config:  config,
+		plugins: plugins,
+	}, nil
+}
+
+// Catalog the given image from a particular perspective (e.g. squashed scope, all-layers scope). Returns the discovered
+// set of packages, the identified Linux distribution, and the scope object used to wrap the data source.
+func (c *Client) Catalog(userInput string, scoptOpt scope.Option) (*pkg.Catalog, *scope.Scope, *distro.Distro, error) {
+	log.Info("cataloging image")
+	s, cleanup, err := scope.NewScope(userInput, scoptOpt)
+	defer cleanup()
+	if err != nil {
+		return nil, nil, nil, err
+	}
+
+	d := c.IdentifyDistro(s)
+
+	catalog, err := c.CatalogFromScope(s)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+
+	return catalog, &s, &d, nil
+}
+
+// IdentifyDistro attempts to discover what the underlying Linux distribution may be from the available flat files
+// provided by the given scope object. If results are inconclusive a "UnknownDistro" Type is returned.
+func (c *Client) IdentifyDistro(s scope.Scope) distro.Distro {
+	d := distro.Identify(s.Resolver)
+	if d.Type != distro.UnknownDistroType {
+		log.Infof("identified distro: %s", d.String())
+	} else {
+		log.Info("could not identify distro")
+	}
+	return d
+}
+
+// Catalog the given scope, which may represent a container image or filesystem. Returns the discovered set of packages.
+func (c *Client) CatalogFromScope(s scope.Scope) (*pkg.Catalog, error) {
+	log.Info("building the catalog")
+	pluginCatalogers, deactivatePluginsFn, err := c.plugins.ActivateCatalogers()
+	defer deactivatePluginsFn()
+	if err != nil {
+		return nil, err
+	}
+
+	return cataloger.Catalog(s.Resolver, append(pluginCatalogers, cataloger.BuiltIn()...)...)
+}
+
+// SetLogger sets the logger object used for all syft logging calls.
+func SetLogger(logger logger.Logger) {
+	log.Log = logger
+}
+
+// SetBus sets the event bus for all syft library bus publish events onto (in-library subscriptions are not allowed).
+func SetBus(b *partybus.Bus) {
+	bus.SetPublisher(b)
+}

syft/distro/identify.go

@@ -1,6 +1,7 @@
 package distro
 
 import (
+	"io/ioutil"
 	"regexp"
 	"strings"
 
@@ -10,6 +11,7 @@ import (
 )
 
 // returns a distro or nil
+// TODO: refactor to io.Reader
 type parseFunc func(string) *Distro
 
 type parseEntry struct {
@@ -17,8 +19,9 @@ type parseEntry struct {
 	fn   parseFunc
 }
 
-// Identify parses distro-specific files to determine distro metadata like version and release
-func Identify(s scope.Scope) Distro {
+// nolint: funlen
+// Identify parses distro-specific files to determine distro metadata like version and release.
+func Identify(resolver scope.Resolver) Distro {
 	distro := NewUnknownDistro()
 
 	identityFiles := []parseEntry{
@@ -41,7 +44,7 @@ func Identify(s scope.Scope) Distro {
 
 identifyLoop:
 	for _, entry := range identityFiles {
-		refs, err := s.FilesByPath(entry.path)
+		refs, err := resolver.FilesByPath(entry.path)
 		if err != nil {
 			log.Errorf("unable to get path refs from %s: %s", entry.path, err)
 			break
@@ -52,8 +55,8 @@ identifyLoop:
 		}
 
 		for _, ref := range refs {
-			contents, err := s.MultipleFileContentsByRef(ref)
-			content, ok := contents[ref]
+			contentReaders, err := resolver.MultipleFileContentsByRef(ref)
+			contentReader, ok := contentReaders[ref]
 
 			if !ok {
 				log.Infof("no content present for ref: %s", ref)
@@ -65,6 +68,14 @@ identifyLoop:
 				continue
 			}
 
+			bytes, err := ioutil.ReadAll(contentReader)
+			if err != nil {
+				log.Debugf("unable to read contents from %s: %s", entry.path, err)
+				continue
+			}
+
+			content := string(bytes)
+
 			if content == "" {
 				log.Debugf("no contents in file, skipping: %s", entry.path)
 				continue

syft/distro/identify_test.go

@@ -75,12 +75,12 @@ func TestIdentifyDistro(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.fixture, func(t *testing.T) {
-			s, err := scope.NewScopeFromDir(test.fixture, scope.AllLayersScope)
+			s, err := scope.NewScopeFromDir(test.fixture)
 			if err != nil {
 				t.Fatalf("unable to produce a new scope for testing: %s", test.fixture)
 			}
 
-			d := Identify(s)
+			d := Identify(s.Resolver)
 			observedDistros.Add(d.String())
 
 			if d.Type != test.Type {

syft/event/event.go

@@ -1,3 +1,7 @@
+/*
+Package event provides event types for all events that the syft library published onto the event bus. By convention, for each event
+defined here there should be a corresponding event parser defined in the parsers/ child package.
+*/
 package event
 
 import "github.com/wagoodman/go-partybus"

syft/event/parsers/parsers.go

@@ -1,3 +1,6 @@
+/*
+Package parsers provides parser helpers to extract payloads for each event type that the syft library publishes onto the event bus.
+*/
 package parsers
 
 import (

syft/lib.go

@@ -1,53 +0,0 @@
-package syft
-
-import (
-	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/cataloger"
-	"github.com/anchore/syft/syft/distro"
-	"github.com/anchore/syft/syft/logger"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/scope"
-	"github.com/wagoodman/go-partybus"
-)
-
-func Catalog(userInput string, scoptOpt scope.Option) (*pkg.Catalog, *scope.Scope, *distro.Distro, error) {
-	log.Info("cataloging image")
-	s, cleanup, err := scope.NewScope(userInput, scoptOpt)
-	defer cleanup()
-	if err != nil {
-		return nil, nil, nil, err
-	}
-
-	d := IdentifyDistro(s)
-
-	catalog, err := CatalogFromScope(s)
-	if err != nil {
-		return nil, nil, nil, err
-	}
-
-	return catalog, &s, &d, nil
-}
-
-func IdentifyDistro(s scope.Scope) distro.Distro {
-	d := distro.Identify(s)
-	if d.Type != distro.UnknownDistroType {
-		log.Infof("identified distro: %s", d.String())
-	} else {
-		log.Info("could not identify distro")
-	}
-	return d
-}
-
-func CatalogFromScope(s scope.Scope) (*pkg.Catalog, error) {
-	log.Info("building the catalog")
-	return cataloger.Catalog(s)
-}
-
-func SetLogger(logger logger.Logger) {
-	log.Log = logger
-}
-
-func SetBus(b *partybus.Bus) {
-	bus.SetPublisher(b)
-}

syft/logger/logger.go

@@ -1,7 +1,11 @@
+/*
+Defines the logging interface which is used throughout the syft library.
+*/
 package logger
 
 type Logger interface {
 	Errorf(format string, args ...interface{})
+	Error(args ...interface{})
 	Infof(format string, args ...interface{})
 	Info(args ...interface{})
 	Debugf(format string, args ...interface{})

syft/pkg/apk_metadata.go

@@ -0,0 +1,50 @@
+package pkg
+
+import (
+	"github.com/package-url/packageurl-go"
+)
+
+// ApkMetadata represents all captured data for a Alpine DB package entry. See https://wiki.alpinelinux.org/wiki/Apk_spec for more information.
+type ApkMetadata struct {
+	Package          string          `mapstructure:"P" json:"package"`
+	OriginPackage    string          `mapstructure:"o" json:"origin-package"`
+	Maintainer       string          `mapstructure:"m" json:"maintainer"`
+	Version          string          `mapstructure:"V" json:"version"`
+	License          string          `mapstructure:"L" json:"license"`
+	Architecture     string          `mapstructure:"A" json:"architecture"`
+	URL              string          `mapstructure:"U" json:"url"`
+	Description      string          `mapstructure:"T" json:"description"`
+	Size             int             `mapstructure:"S" json:"size"`
+	InstalledSize    int             `mapstructure:"I" json:"installed-size"`
+	PullDependencies string          `mapstructure:"D" json:"pull-dependencies"`
+	PullChecksum     string          `mapstructure:"C" json:"pull-checksum"`
+	GitCommitOfAport string          `mapstructure:"c" json:"git-commit-of-apk-port"`
+	Files            []ApkFileRecord `json:"files"`
+}
+
+// ApkFileRecord represents a single file listing and metadata from a APK DB entry (which may have many of these file records).
+type ApkFileRecord struct {
+	Path        string `json:"path"`
+	OwnerUID    string `json:"owner-uid"`
+	OwnerGUI    string `json:"owner-gid"`
+	Permissions string `json:"permissions"`
+	Checksum    string `json:"checksum"`
+}
+
+func (m ApkMetadata) PackageURL() string {
+	pURL := packageurl.NewPackageURL(
+		// note: this is currently a candidate and not technically within spec
+		// see https://github.com/package-url/purl-spec#other-candidate-types-to-define
+		"alpine",
+		"",
+		m.Package,
+		m.Version,
+		packageurl.Qualifiers{
+			{
+				Key:   "arch",
+				Value: m.Architecture,
+			},
+		},
+		"")
+	return pURL.ToString()
+}

syft/pkg/apk_metadata_test.go

@@ -0,0 +1,33 @@
+package pkg
+
+import (
+	"github.com/sergi/go-diff/diffmatchpatch"
+	"testing"
+)
+
+func TestApkMetadata_pURL(t *testing.T) {
+	tests := []struct {
+		metadata ApkMetadata
+		expected string
+	}{
+		{
+			metadata: ApkMetadata{
+				Package:      "p",
+				Version:      "v",
+				Architecture: "a",
+			},
+			expected: "pkg:alpine/p@v?arch=a",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.expected, func(t *testing.T) {
+			actual := test.metadata.PackageURL()
+			if actual != test.expected {
+				dmp := diffmatchpatch.New()
+				diffs := dmp.DiffMain(test.expected, actual, true)
+				t.Errorf("diff: %s", dmp.DiffPrettyText(diffs))
+			}
+		})
+	}
+}

syft/pkg/catalog.go

@@ -12,6 +12,7 @@ import (
 
 var nextPackageID int64
 
+// Catalog represents a collection of Packages.
 type Catalog struct {
 	byID   map[ID]*Package
 	byType map[Type][]*Package
@@ -19,6 +20,7 @@ type Catalog struct {
 	lock   sync.RWMutex
 }
 
+// NewCatalog returns a new empty Catalog
 func NewCatalog() *Catalog {
 	return &Catalog{
 		byID:   make(map[ID]*Package),
@@ -27,18 +29,22 @@ func NewCatalog() *Catalog {
 	}
 }
 
+// PackageCount returns the total number of packages that have been added.
 func (c *Catalog) PackageCount() int {
 	return len(c.byID)
 }
 
+// Package returns the package with the given ID.
 func (c *Catalog) Package(id ID) *Package {
 	return c.byID[id]
 }
 
+// PackagesByFile returns all packages that were discovered from the given source file reference.
 func (c *Catalog) PackagesByFile(ref file.Reference) []*Package {
 	return c.byFile[ref]
 }
 
+// Add a package to the Catalog.
 func (c *Catalog) Add(p Package) {
 	if p.id != 0 {
 		log.Errorf("package already added to catalog: %s", p)
@@ -70,6 +76,7 @@ func (c *Catalog) Add(p Package) {
 	}
 }
 
+// Enumerate all packages for the given type(s), enumerating all packages if no type is specified.
 func (c *Catalog) Enumerate(types ...Type) <-chan *Package {
 	channel := make(chan *Package)
 	go func() {
@@ -96,6 +103,8 @@ func (c *Catalog) Enumerate(types ...Type) <-chan *Package {
 	return channel
 }
 
+// Sorted enumerates all packages for the given types sorted by package name. Enumerates all packages if no type
+// is specified.
 func (c *Catalog) Sorted(types ...Type) []*Package {
 	pkgs := make([]*Package, 0)
 	for p := range c.Enumerate(types...) {

syft/pkg/dpkg_metadata.go

@@ -0,0 +1,33 @@
+package pkg
+
+import (
+	"github.com/anchore/syft/syft/distro"
+	"github.com/package-url/packageurl-go"
+)
+
+// DpkgMetadata represents all captured data for a Debian package DB entry; available fields are described
+// at http://manpages.ubuntu.com/manpages/xenial/man1/dpkg-query.1.html in the --showformat section.
+type DpkgMetadata struct {
+	Package      string `mapstructure:"Package" json:"package"`
+	Source       string `mapstructure:"Source" json:"source"`
+	Version      string `mapstructure:"Version" json:"version"`
+	Architecture string `mapstructure:"Architecture" json:"architecture"`
+	// TODO: consider keeping the remaining values as an embedded map
+}
+
+func (m DpkgMetadata) PackageURL(d distro.Distro) string {
+	pURL := packageurl.NewPackageURL(
+		// TODO: replace with `packageurl.TypeDebian` upon merge of https://github.com/package-url/packageurl-go/pull/21
+		"deb",
+		d.Type.String(),
+		m.Package,
+		m.Version,
+		packageurl.Qualifiers{
+			{
+				Key:   "arch",
+				Value: m.Architecture,
+			},
+		},
+		"")
+	return pURL.ToString()
+}

syft/pkg/dpkg_metadata_test.go

@@ -0,0 +1,51 @@
+package pkg
+
+import (
+	"github.com/anchore/syft/syft/distro"
+	"github.com/sergi/go-diff/diffmatchpatch"
+	"testing"
+)
+
+func TestDpkgMetadata_pURL(t *testing.T) {
+	tests := []struct {
+		distro   distro.Distro
+		metadata DpkgMetadata
+		expected string
+	}{
+		{
+			distro: distro.Distro{
+				Type: distro.Debian,
+			},
+			metadata: DpkgMetadata{
+				Package:      "p",
+				Source:       "s",
+				Version:      "v",
+				Architecture: "a",
+			},
+			expected: "pkg:deb/debian/p@v?arch=a",
+		},
+		{
+			distro: distro.Distro{
+				Type: distro.Ubuntu,
+			},
+			metadata: DpkgMetadata{
+				Package:      "p",
+				Source:       "s",
+				Version:      "v",
+				Architecture: "a",
+			},
+			expected: "pkg:deb/ubuntu/p@v?arch=a",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.expected, func(t *testing.T) {
+			actual := test.metadata.PackageURL(test.distro)
+			if actual != test.expected {
+				dmp := diffmatchpatch.New()
+				diffs := dmp.DiffMain(test.expected, actual, true)
+				t.Errorf("diff: %s", dmp.DiffPrettyText(diffs))
+			}
+		})
+	}
+}

syft/pkg/java_metadata.go

@@ -0,0 +1,50 @@
+package pkg
+
+import "github.com/package-url/packageurl-go"
+
+// JavaMetadata encapsulates all Java ecosystem metadata for a package as well as an (optional) parent relationship.
+type JavaMetadata struct {
+	Manifest      *JavaManifest  `mapstructure:"Manifest" json:"manifest"`
+	PomProperties *PomProperties `mapstructure:"PomProperties" json:"pom-properties"`
+	Parent        *Package       `json:"parent-package"` // TODO: should this be included in the json output?
+}
+
+// PomProperties represents the fields of interest extracted from a Java archive's pom.xml file.
+type PomProperties struct {
+	Path       string
+	Name       string            `mapstructure:"name" json:"name"`
+	GroupID    string            `mapstructure:"groupId" json:"group-id"`
+	ArtifactID string            `mapstructure:"artifactId" json:"artifact-id"`
+	Version    string            `mapstructure:"version" json:"version"`
+	Extra      map[string]string `mapstructure:",remain" json:"extra-fields"`
+}
+
+// JavaManifest represents the fields of interest extracted from a Java archive's META-INF/MANIFEST.MF file.
+type JavaManifest struct {
+	Name            string            `mapstructure:"Name" json:"name"`
+	ManifestVersion string            `mapstructure:"Manifest-Version" json:"manifest-version"`
+	SpecTitle       string            `mapstructure:"Specification-Title" json:"specification-title"`
+	SpecVersion     string            `mapstructure:"Specification-Version" json:"specification-version"`
+	SpecVendor      string            `mapstructure:"Specification-Vendor" json:"specification-vendor"`
+	ImplTitle       string            `mapstructure:"Implementation-Title" json:"implementation-title"`
+	ImplVersion     string            `mapstructure:"Implementation-Version" json:"implementation-version"`
+	ImplVendor      string            `mapstructure:"Implementation-Vendor" json:"implementation-vendor"`
+	Extra           map[string]string `mapstructure:",remain" json:"extra-fields"`
+}
+
+func (m JavaMetadata) PackageURL() string {
+	if m.PomProperties != nil {
+		pURL := packageurl.NewPackageURL(
+			packageurl.TypeMaven,
+			m.PomProperties.GroupID,
+			m.PomProperties.ArtifactID,
+			m.PomProperties.Version,
+			nil, // TODO: there are probably several qualifiers that can be specified here
+			"")
+		return pURL.ToString()
+	}
+
+	// TODO: support non-maven artifacts
+
+	return ""
+}

syft/pkg/java_metadata_test.go

@@ -0,0 +1,41 @@
+package pkg
+
+import (
+	"github.com/sergi/go-diff/diffmatchpatch"
+	"testing"
+)
+
+func TestJavaMetadata_pURL(t *testing.T) {
+	tests := []struct {
+		metadata JavaMetadata
+		expected string
+	}{
+		{
+			metadata: JavaMetadata{
+				PomProperties: &PomProperties{
+					Path:       "p",
+					Name:       "n",
+					GroupID:    "g.id",
+					ArtifactID: "a",
+					Version:    "v",
+				},
+			},
+			expected: "pkg:maven/g.id/a@v",
+		},
+		{
+			metadata: JavaMetadata{},
+			expected: "",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.expected, func(t *testing.T) {
+			actual := test.metadata.PackageURL()
+			if actual != test.expected {
+				dmp := diffmatchpatch.New()
+				diffs := dmp.DiffMain(test.expected, actual, true)
+				t.Errorf("diff: %s", dmp.DiffPrettyText(diffs))
+			}
+		})
+	}
+}

syft/pkg/metadata.go

@@ -1,74 +0,0 @@
-package pkg
-
-// Available fields are described at http://manpages.ubuntu.com/manpages/xenial/man1/dpkg-query.1.html
-// in the --showformat section
-type DpkgMetadata struct {
-	Package string `mapstructure:"Package" json:"package"`
-	Source  string `mapstructure:"Source" json:"source"`
-	Version string `mapstructure:"Version" json:"version"`
-	// TODO: consider keeping the remaining values as an embedded map
-}
-
-type RpmMetadata struct {
-	Version   string `mapstructure:"Version" json:"version"`
-	Epoch     int    `mapstructure:"Epoch" json:"epoch"`
-	Arch      string `mapstructure:"Arch" json:"architecture"`
-	Release   string `mapstructure:"Release" json:"release"`
-	SourceRpm string `mapstructure:"SourceRpm" json:"source-rpm"`
-	Size      int    `mapstructure:"Size" json:"size"`
-	License   string `mapstructure:"License" json:"license"`
-	Vendor    string `mapstructure:"Vendor" json:"vendor"`
-}
-
-type JavaManifest struct {
-	Name            string            `mapstructure:"Name" json:"name"`
-	ManifestVersion string            `mapstructure:"Manifest-Version" json:"manifest-version"`
-	SpecTitle       string            `mapstructure:"Specification-Title" json:"specification-title"`
-	SpecVersion     string            `mapstructure:"Specification-Version" json:"specification-version"`
-	SpecVendor      string            `mapstructure:"Specification-Vendor" json:"specification-vendor"`
-	ImplTitle       string            `mapstructure:"Implementation-Title" json:"implementation-title"`
-	ImplVersion     string            `mapstructure:"Implementation-Version" json:"implementation-version"`
-	ImplVendor      string            `mapstructure:"Implementation-Vendor" json:"implementation-vendor"`
-	Extra           map[string]string `mapstructure:",remain" json:"extra-fields"`
-}
-
-type PomProperties struct {
-	Path       string
-	Name       string            `mapstructure:"name" json:"name"`
-	GroupID    string            `mapstructure:"groupId" json:"group-id"`
-	ArtifactID string            `mapstructure:"artifactId" json:"artifact-id"`
-	Version    string            `mapstructure:"version" json:"version"`
-	Extra      map[string]string `mapstructure:",remain" json:"extra-fields"`
-}
-
-type JavaMetadata struct {
-	Manifest      *JavaManifest  `mapstructure:"Manifest" json:"manifest"`
-	PomProperties *PomProperties `mapstructure:"PomProperties" json:"pom-properties"`
-	Parent        *Package       `json:"parent-package"`
-}
-
-// source: https://wiki.alpinelinux.org/wiki/Apk_spec
-type ApkMetadata struct {
-	Package          string          `mapstructure:"P" json:"package"`
-	OriginPackage    string          `mapstructure:"o" json:"origin-package"`
-	Maintainer       string          `mapstructure:"m" json:"maintainer"`
-	Version          string          `mapstructure:"V" json:"version"`
-	License          string          `mapstructure:"L" json:"license"`
-	Architecture     string          `mapstructure:"A" json:"architecture"`
-	URL              string          `mapstructure:"U" json:"url"`
-	Description      string          `mapstructure:"T" json:"description"`
-	Size             int             `mapstructure:"S" json:"size"`
-	InstalledSize    int             `mapstructure:"I" json:"installed-size"`
-	PullDependencies string          `mapstructure:"D" json:"pull-dependencies"`
-	PullChecksum     string          `mapstructure:"C" json:"pull-checksum"`
-	GitCommitOfAport string          `mapstructure:"c" json:"git-commit-of-apk-port"`
-	Files            []ApkFileRecord `json:"files"`
-}
-
-type ApkFileRecord struct {
-	Path        string `json:"path"`
-	OwnerUID    string `json:"owner-uid"`
-	OwnerGUI    string `json:"owner-gid"`
-	Permissions string `json:"permissions"`
-	Checksum    string `json:"checksum"`
-}

syft/pkg/package.go

@@ -1,32 +1,79 @@
+/*
+Package pkg provides the data structures for a package, a package catalog, package types, and domain-specific metadata.
+*/
 package pkg
 
 import (
 	"fmt"
+	"regexp"
+	"strings"
 
 	"github.com/anchore/stereoscope/pkg/file"
+	"github.com/anchore/syft/syft/distro"
+	"github.com/package-url/packageurl-go"
 )
 
 type ID int64
 
-// TODO: add field to trace which cataloger detected this
-
-// Package represents an application or library that has been bundled into a distributable format
+// Package represents an application or library that has been bundled into a distributable format.
 type Package struct {
-	id       ID               // this is set when a package is added to the catalog
-	Name     string           `json:"manifest"`
-	Version  string           `json:"version"`
-	FoundBy  string           `json:"found-by"` // FoundBy is the cataloger that discovered this package
-	Source   []file.Reference `json:"sources"`
-	Licenses []string         `json:"licenses"` // TODO: should we move this into metadata?
-	Language Language         `json:"language"` // TODO: should this support multiple languages as a slice?
-	Type     Type             `json:"type"`
-	Metadata interface{}      `json:"metadata,omitempty"`
+	id      ID               // uniquely identifies a package, set by the cataloger
+	Name    string           `json:"manifest"` // the package name
+	Version string           `json:"version"`  // the version of the package
+	FoundBy string           `json:"found-by"` // the specific cataloger that discovered this package
+	Source  []file.Reference `json:"sources"`  // the locations that lead to the discovery of this package (note: this is not necessarily the locations that make up this package)
+	// TODO: should we move licenses into metadata?
+	Licenses []string    `json:"licenses"`           // licenses discovered with the package metadata
+	Language Language    `json:"language"`           // the language ecosystem this package belongs to (e.g. JavaScript, Python, etc)
+	Type     Type        `json:"type"`               // the package type (e.g. Npm, Yarn, Egg, Wheel, Rpm, Deb, etc)
+	Metadata interface{} `json:"metadata,omitempty"` // additional data found while parsing the package source
 }
 
+// ID returns the package ID, which is unique relative to a package catalog.
 func (p Package) ID() ID {
 	return p.id
 }
 
+// Stringer to represent a package.
 func (p Package) String() string {
 	return fmt.Sprintf("Pkg(type=%s, name=%s, version=%s)", p.Type, p.Name, p.Version)
 }
+
+// PackageURL returns a package-URL representation of the given package (see https://github.com/package-url/purl-spec)
+func (p Package) PackageURL(d distro.Distro) string {
+	// default to pURLs on the metadata
+	if p.Metadata != nil {
+		if i, ok := p.Metadata.(interface{ PackageURL() string }); ok {
+			return i.PackageURL()
+		} else if i, ok := p.Metadata.(interface{ PackageURL(distro.Distro) string }); ok {
+			return i.PackageURL(d)
+		}
+	}
+
+	var purlType = p.Type.PackageURLType()
+	var name = p.Name
+	var namespace = ""
+
+	switch {
+	case purlType == "":
+		// there is no purl type, don't attempt to craft a purl
+		// TODO: should this be a "generic" purl type instead?
+		return ""
+	case p.Type == GoModulePkg:
+		re := regexp.MustCompile(`(\/)[^\/]*$`)
+		fields := re.Split(p.Name, -1)
+		namespace = fields[0]
+		name = strings.TrimPrefix(p.Name, namespace+"/")
+	}
+
+	// generate a purl from the package data
+	pURL := packageurl.NewPackageURL(
+		purlType,
+		namespace,
+		name,
+		p.Version,
+		nil,
+		"")
+
+	return pURL.ToString()
+}

syft/pkg/package_test.go

@@ -0,0 +1,136 @@
+package pkg
+
+import (
+	"github.com/anchore/syft/syft/distro"
+	"github.com/sergi/go-diff/diffmatchpatch"
+	"testing"
+)
+
+func TestPackage_pURL(t *testing.T) {
+	tests := []struct {
+		pkg      Package
+		distro   distro.Distro
+		expected string
+	}{
+		{
+			pkg: Package{
+				Name:    "github.com/anchore/syft",
+				Version: "v0.1.0",
+				Type:    GoModulePkg,
+			},
+			expected: "pkg:golang/github.com/anchore/syft@v0.1.0",
+		},
+		{
+			pkg: Package{
+				Name:    "name",
+				Version: "v0.1.0",
+				Type:    WheelPkg,
+			},
+			expected: "pkg:pypi/name@v0.1.0",
+		},
+		{
+			pkg: Package{
+				Name:    "name",
+				Version: "v0.1.0",
+				Type:    EggPkg,
+			},
+			expected: "pkg:pypi/name@v0.1.0",
+		},
+		{
+			pkg: Package{
+				Name:    "name",
+				Version: "v0.1.0",
+				Type:    PythonSetupPkg,
+			},
+			expected: "pkg:pypi/name@v0.1.0",
+		},
+		{
+			pkg: Package{
+				Name:    "name",
+				Version: "v0.1.0",
+				Type:    PythonRequirementsPkg,
+			},
+			expected: "pkg:pypi/name@v0.1.0",
+		},
+		{
+			pkg: Package{
+				Name:    "name",
+				Version: "v0.1.0",
+				Type:    BundlerPkg,
+			},
+			expected: "pkg:gem/name@v0.1.0",
+		},
+		{
+			pkg: Package{
+				Name:    "name",
+				Version: "v0.1.0",
+				Type:    NpmPkg,
+			},
+			expected: "pkg:npm/name@v0.1.0",
+		},
+		{
+			pkg: Package{
+				Name:    "name",
+				Version: "v0.1.0",
+				Type:    YarnPkg,
+			},
+			expected: "pkg:npm/name@v0.1.0",
+		},
+		{
+			distro: distro.Distro{
+				Type: distro.Ubuntu,
+			},
+			pkg: Package{
+				Name:    "bad-name",
+				Version: "bad-v0.1.0",
+				Type:    DebPkg,
+				Metadata: DpkgMetadata{
+					Package:      "name",
+					Version:      "v0.1.0",
+					Architecture: "amd64",
+				},
+			},
+			expected: "pkg:deb/ubuntu/name@v0.1.0?arch=amd64",
+		},
+		{
+			distro: distro.Distro{
+				Type: distro.CentOS,
+			},
+			pkg: Package{
+				Name:    "bad-name",
+				Version: "bad-v0.1.0",
+				Type:    RpmPkg,
+				Metadata: RpmMetadata{
+					Name:    "name",
+					Version: "v0.1.0",
+					Epoch:   2,
+					Arch:    "amd64",
+					Release: "3",
+				},
+			},
+			expected: "pkg:rpm/centos/name@2:v0.1.0-3?arch=amd64",
+		},
+		{
+			distro: distro.Distro{
+				Type: distro.UnknownDistroType,
+			},
+			pkg: Package{
+				Name:    "name",
+				Version: "v0.1.0",
+				Type:    DebPkg,
+			},
+			expected: "pkg:deb/name@v0.1.0",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(string(test.pkg.Type)+"|"+test.expected, func(t *testing.T) {
+			actual := test.pkg.PackageURL(test.distro)
+			if actual != test.expected {
+				dmp := diffmatchpatch.New()
+				diffs := dmp.DiffMain(test.expected, actual, true)
+				t.Errorf("diff: %s", dmp.DiffPrettyText(diffs))
+			}
+		})
+	}
+}

syft/pkg/rpm_metadata.go

@@ -0,0 +1,37 @@
+package pkg
+
+import (
+	"fmt"
+
+	"github.com/anchore/syft/syft/distro"
+	"github.com/package-url/packageurl-go"
+)
+
+// RpmMetadata represents all captured data for a RPM DB package entry.
+type RpmMetadata struct {
+	Name      string `json:"name"`
+	Version   string `json:"version"`
+	Epoch     int    `json:"epoch"`
+	Arch      string `json:"architecture"`
+	Release   string `json:"release"`
+	SourceRpm string `json:"source-rpm"`
+	Size      int    `json:"size"`
+	License   string `json:"license"`
+	Vendor    string `json:"vendor"`
+}
+
+func (m RpmMetadata) PackageURL(d distro.Distro) string {
+	pURL := packageurl.NewPackageURL(
+		packageurl.TypeRPM,
+		d.Type.String(),
+		m.Name,
+		fmt.Sprintf("%d:%s-%s", m.Epoch, m.Version, m.Release),
+		packageurl.Qualifiers{
+			{
+				Key:   "arch",
+				Value: m.Arch,
+			},
+		},
+		"")
+	return pURL.ToString()
+}

syft/pkg/rpm_metadata_test.go

@@ -0,0 +1,53 @@
+package pkg
+
+import (
+	"github.com/anchore/syft/syft/distro"
+	"github.com/sergi/go-diff/diffmatchpatch"
+	"testing"
+)
+
+func TestRpmMetadata_pURL(t *testing.T) {
+	tests := []struct {
+		distro   distro.Distro
+		metadata RpmMetadata
+		expected string
+	}{
+		{
+			distro: distro.Distro{
+				Type: distro.CentOS,
+			},
+			metadata: RpmMetadata{
+				Name:    "p",
+				Version: "v",
+				Arch:    "a",
+				Release: "r",
+				Epoch:   1,
+			},
+			expected: "pkg:rpm/centos/p@1:v-r?arch=a",
+		},
+		{
+			distro: distro.Distro{
+				Type: distro.RedHat,
+			},
+			metadata: RpmMetadata{
+				Name:    "p",
+				Version: "v",
+				Arch:    "a",
+				Release: "r",
+				Epoch:   1,
+			},
+			expected: "pkg:rpm/redhat/p@1:v-r?arch=a",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.expected, func(t *testing.T) {
+			actual := test.metadata.PackageURL(test.distro)
+			if actual != test.expected {
+				dmp := diffmatchpatch.New()
+				diffs := dmp.DiffMain(test.expected, actual, true)
+				t.Errorf("diff: %s", dmp.DiffPrettyText(diffs))
+			}
+		})
+	}
+}

syft/pkg/type.go

@@ -1,5 +1,8 @@
 package pkg
 
+import "github.com/package-url/packageurl-go"
+
+// Type represents a Package Type for or within a language ecosystem (there may be multiple package types within a language ecosystem)
 type Type string
 
 const (
@@ -15,6 +18,7 @@ const (
 	NpmPkg                Type = "npm"
 	YarnPkg               Type = "yarn"
 	PythonRequirementsPkg Type = "python-requirements"
+	PythonSetupPkg        Type = "python-setup"
 	JavaPkg               Type = "java-archive"
 	JenkinsPluginPkg      Type = "jenkins-plugin"
 	GoModulePkg           Type = "go-module"
@@ -31,7 +35,32 @@ var AllPkgs = []Type{
 	NpmPkg,
 	YarnPkg,
 	PythonRequirementsPkg,
+	PythonSetupPkg,
 	JavaPkg,
 	JenkinsPluginPkg,
 	GoModulePkg,
 }
+
+func (t Type) PackageURLType() string {
+	switch t {
+	case ApkPkg:
+		return "alpine"
+	case BundlerPkg:
+		return packageurl.TypeGem
+	case DebPkg:
+		return "deb"
+	case EggPkg, WheelPkg, PythonRequirementsPkg, PythonSetupPkg:
+		return packageurl.TypePyPi
+	case NpmPkg, YarnPkg:
+		return packageurl.TypeNPM
+	case JavaPkg, JenkinsPluginPkg:
+		return packageurl.TypeMaven
+	case RpmPkg:
+		return packageurl.TypeRPM
+	case GoModulePkg:
+		return packageurl.TypeGolang
+	default:
+		// TODO: should this be a "generic" purl type instead?
+		return ""
+	}
+}

syft/plugin/cataloger_plugin.go

@@ -0,0 +1,29 @@
+package plugin
+
+import (
+	"context"
+
+	"github.com/anchore/syft/syft/cataloger"
+	syftPluginGrpc "github.com/anchore/syft/syft/plugin/grpc"
+	"github.com/anchore/syft/syft/plugin/proto"
+	"github.com/hashicorp/go-plugin"
+	"google.golang.org/grpc"
+)
+
+// integrity check
+var _ plugin.GRPCPlugin = &CatalogerPlugin{}
+
+// CatalogerPlugin is the implementation of plugin.Plugin that is served/consumed.
+type CatalogerPlugin struct {
+	plugin.NetRPCUnsupportedPlugin
+	Impl cataloger.Cataloger
+}
+
+func (p *CatalogerPlugin) GRPCServer(broker *plugin.GRPCBroker, s *grpc.Server) error {
+	proto.RegisterCatalogerServer(s, syftPluginGrpc.NewCatalogServer(p.Impl, broker))
+	return nil
+}
+
+func (p *CatalogerPlugin) GRPCClient(ctx context.Context, broker *plugin.GRPCBroker, c *grpc.ClientConn) (interface{}, error) {
+	return syftPluginGrpc.NewCatalogerClient(proto.NewCatalogerClient(c), broker), nil
+}

syft/plugin/config.go

@@ -0,0 +1,10 @@
+package plugin
+
+type Config struct {
+	Name    string
+	Type    Type
+	Command string
+	Args    []string
+	Env     []string
+	Sha256  []byte
+}

syft/plugin/grpc/cataloger_client.go

@@ -0,0 +1,117 @@
+package grpc
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"io/ioutil"
+
+	"github.com/anchore/syft/syft/cataloger"
+
+	"github.com/anchore/stereoscope/pkg/file"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/plugin/proto"
+	"github.com/anchore/syft/syft/scope"
+	"github.com/hashicorp/go-plugin"
+	"google.golang.org/grpc"
+)
+
+var _ cataloger.Cataloger = &CatalogerClient{}
+
+type CatalogerClient struct {
+	broker *plugin.GRPCBroker
+	client proto.CatalogerClient
+}
+
+func NewCatalogerClient(client proto.CatalogerClient, broker *plugin.GRPCBroker) *CatalogerClient {
+	return &CatalogerClient{
+		broker: broker,
+		client: client,
+	}
+}
+
+func (c *CatalogerClient) Name() string {
+	resp, err := c.client.Name(context.Background(), &proto.Empty{})
+	if err != nil {
+		return fmt.Sprintf("error (%s)", err.Error())
+	}
+
+	return resp.Name
+}
+
+func (c *CatalogerClient) SelectFiles(resolver scope.FileResolver) []file.Reference {
+	fileResolverServer := &FileResolverServer{Impl: resolver}
+
+	var s *grpc.Server
+	serverFunc := func(opts []grpc.ServerOption) *grpc.Server {
+		s = grpc.NewServer(opts...)
+		proto.RegisterFileResolverServer(s, fileResolverServer)
+
+		return s
+	}
+
+	brokerID := c.broker.NextId()
+	go c.broker.AcceptAndServe(brokerID, serverFunc)
+
+	resp, err := c.client.SelectFiles(context.Background(), &proto.SelectFilesRequest{
+		FileResolverBrokerId: brokerID,
+	})
+
+	if err != nil {
+		// TODO: nope
+		panic(err)
+	}
+
+	s.Stop()
+
+	var result []file.Reference
+	for _, f := range resp.Files {
+		result = append(result, file.NewFileReferenceWithID(file.Path(f.Path), uint64(f.Id)))
+	}
+
+	return result
+}
+
+func (c *CatalogerClient) Catalog(contents map[file.Reference]io.Reader) ([]pkg.Package, error) {
+	var fileRefContents []*proto.FileReferenceContents
+	for ref, reader := range contents {
+		readerContents, err := ioutil.ReadAll(reader)
+		if err != nil {
+			return nil, fmt.Errorf("could not read %+v contents: %+v", ref, err)
+		}
+		fileRefContents = append(fileRefContents, &proto.FileReferenceContents{
+			Id:       int64(ref.ID()),
+			Path:     string(ref.Path),
+			Contents: string(readerContents),
+		})
+	}
+	resp, err := c.client.Catalog(context.Background(), &proto.CatalogRequest{
+		Contents: fileRefContents,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var result []pkg.Package
+	for _, p := range resp.Package {
+		if p != nil {
+			var sources []file.Reference
+			for _, s := range p.Source {
+				sources = append(sources, file.NewFileReferenceWithID(file.Path(s.Path), uint64(s.Id)))
+			}
+			// TODO: this is potentially brittle
+			result = append(result, pkg.Package{
+				Name:     p.Name,
+				Version:  p.Version,
+				FoundBy:  p.FoundBy,
+				Source:   sources,
+				Licenses: p.Licenses,
+				Language: pkg.Language(p.Language),
+				Type:     pkg.Type(p.Type),
+				Metadata: p.Metadata,
+			})
+		}
+	}
+
+	return result, nil
+}

syft/plugin/grpc/cataloger_server.go

@@ -0,0 +1,99 @@
+package grpc
+
+import (
+	"context"
+	"io"
+	"strings"
+
+	"github.com/anchore/stereoscope/pkg/file"
+	"github.com/anchore/syft/syft/cataloger"
+	"github.com/anchore/syft/syft/plugin/proto"
+	"github.com/hashicorp/go-plugin"
+)
+
+type CatalogerServer struct {
+	Impl   cataloger.Cataloger
+	broker *plugin.GRPCBroker
+}
+
+func NewCatalogServer(impl cataloger.Cataloger, broker *plugin.GRPCBroker) *CatalogerServer {
+	return &CatalogerServer{
+		Impl:   impl,
+		broker: broker,
+	}
+}
+
+func (s *CatalogerServer) Name(ctx context.Context, req *proto.Empty) (*proto.NameResponse, error) {
+	name := s.Impl.Name()
+	return &proto.NameResponse{
+		Name: name,
+	}, nil
+}
+
+func (s *CatalogerServer) SelectFiles(ctx context.Context, req *proto.SelectFilesRequest) (*proto.SelectFilesResponse, error) {
+	conn, err := s.broker.Dial(req.FileResolverBrokerId)
+	if err != nil {
+		return nil, err
+	}
+	defer conn.Close()
+
+	fileResolverClient := &FileResolverClient{proto.NewFileResolverClient(conn)}
+
+	fileRefs := s.Impl.SelectFiles(fileResolverClient)
+
+	var refs []*proto.FileReference
+	for _, ref := range fileRefs {
+		refs = append(refs, &proto.FileReference{
+			Id:   int64(ref.ID()),
+			Path: string(ref.Path),
+		})
+	}
+
+	return &proto.SelectFilesResponse{
+		Files: refs,
+	}, nil
+}
+
+func (s *CatalogerServer) Catalog(ctx context.Context, req *proto.CatalogRequest) (*proto.CatalogResponse, error) {
+	contents := make(map[file.Reference]io.Reader)
+	for _, f := range req.Contents {
+		contents[file.NewFileReferenceWithID(file.Path(f.Path), uint64(f.Id))] = strings.NewReader(f.Contents)
+	}
+	packages, err := s.Impl.Catalog(contents)
+	if err != nil {
+		return nil, err
+	}
+
+	var results []*proto.Package
+	for _, p := range packages {
+		var sources []*proto.FileReference
+		for _, s := range p.Source {
+			sources = append(sources, &proto.FileReference{
+				Id:   int64(s.ID()),
+				Path: string(s.Path),
+			})
+		}
+
+		var metadata map[string]string
+		if v, ok := p.Metadata.(map[string]string); ok {
+			metadata = v
+		}
+
+		// TODO: this is potentially brittle
+		results = append(results, &proto.Package{
+			Name:     p.Name,
+			Version:  p.Version,
+			FoundBy:  p.FoundBy,
+			Source:   sources,
+			Licenses: p.Licenses,
+			Language: uint64(p.Language),
+			Type:     string(p.Type),
+			// TODO: metadata needs to be more thoroughly thought through
+			Metadata: metadata,
+		})
+	}
+
+	return &proto.CatalogResponse{
+		Package: results,
+	}, nil
+}

syft/plugin/grpc/file_resolver_client.go

@@ -0,0 +1,50 @@
+package grpc
+
+import (
+	"context"
+
+	"github.com/anchore/syft/internal/log"
+
+	"github.com/anchore/stereoscope/pkg/file"
+	"github.com/anchore/syft/syft/plugin/proto"
+)
+
+type FileResolverClient struct{ client proto.FileResolverClient }
+
+func (m *FileResolverClient) FilesByPath(paths ...file.Path) ([]file.Reference, error) {
+	var pathStrs []string
+	for _, p := range paths {
+		pathStrs = append(pathStrs, string(p))
+	}
+	resp, err := m.client.FilesByPath(context.Background(), &proto.FileResolverRequest{
+		Paths: pathStrs,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var result []file.Reference
+	for _, ref := range resp.Files {
+		result = append(result, file.NewFileReferenceWithID(file.Path(ref.Path), uint64(ref.Id)))
+	}
+
+	return result, err
+}
+
+func (m *FileResolverClient) FilesByGlob(patterns ...string) ([]file.Reference, error) {
+	resp, err := m.client.FilesByGlob(context.Background(), &proto.FileResolverRequest{
+		Paths: patterns,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	log.Debugf("FilesByGlob Response: %+v", resp)
+
+	var result []file.Reference
+	for _, ref := range resp.Files {
+		result = append(result, file.NewFileReferenceWithID(file.Path(ref.Path), uint64(ref.Id)))
+	}
+
+	return result, err
+}

syft/plugin/grpc/file_resolver_server.go

@@ -0,0 +1,55 @@
+package grpc
+
+import (
+	"context"
+
+	"github.com/anchore/stereoscope/pkg/file"
+	"github.com/anchore/syft/syft/plugin/proto"
+	"github.com/anchore/syft/syft/scope"
+)
+
+type FileResolverServer struct {
+	Impl scope.FileResolver
+}
+
+func (m *FileResolverServer) FilesByPath(ctx context.Context, req *proto.FileResolverRequest) (resp *proto.FileResolverResponse, err error) {
+	var paths []file.Path
+	for _, p := range req.Paths {
+		paths = append(paths, file.Path(p))
+	}
+	r, err := m.Impl.FilesByPath(paths...)
+	if err != nil {
+		return nil, err
+	}
+
+	var refs []*proto.FileReference
+	for _, ref := range r {
+		refs = append(refs, &proto.FileReference{
+			Id:   int64(ref.ID()),
+			Path: string(ref.Path),
+		})
+	}
+
+	return &proto.FileResolverResponse{
+		Files: refs,
+	}, nil
+}
+
+func (m *FileResolverServer) FilesByGlob(ctx context.Context, req *proto.FileResolverRequest) (resp *proto.FileResolverResponse, err error) {
+	r, err := m.Impl.FilesByGlob(req.Paths...)
+	if err != nil {
+		return nil, err
+	}
+
+	var refs []*proto.FileReference
+	for _, ref := range r {
+		refs = append(refs, &proto.FileReference{
+			Id:   int64(ref.ID()),
+			Path: string(ref.Path),
+		})
+	}
+
+	return &proto.FileResolverResponse{
+		Files: refs,
+	}, nil
+}

syft/plugin/plugin.go

@@ -0,0 +1,96 @@
+package plugin
+
+import (
+	"crypto/sha256"
+	"fmt"
+	"os/exec"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/logger"
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-plugin"
+)
+
+var versionedPlugins = map[int]plugin.PluginSet{
+	1: {
+		TypeCataloger.String(): &CatalogerPlugin{},
+	},
+}
+
+type Plugin struct {
+	Config       Config
+	clientConfig plugin.ClientConfig
+	client       *plugin.Client
+}
+
+// TODO: type should be in the name like with terraform "terraform-<TYPE>-<NAME>"
+
+func NewPlugin(config Config) Plugin {
+	//cmd := exec.Command("sh", "-c", config.Command) //, config.Args...)
+	cmd := exec.Command(config.Command)
+	cmd.Env = append(cmd.Env, config.Env...)
+
+	var secureConfig *plugin.SecureConfig
+	if len(config.Sha256) > 0 {
+		secureConfig = &plugin.SecureConfig{
+			Checksum: config.Sha256,
+			Hash:     sha256.New(),
+		}
+	}
+
+	var pluginLogger hclog.Logger
+	if logrusLogger, ok := log.Log.(*logger.LogrusLogger); ok {
+		pluginLogger = logger.NewLogrusHCLogAdapter(logrusLogger.Logger, map[string]interface{}{"plugin": config.Name})
+	} else {
+		// TODO: this does not fully map features, thus logging will be awkward
+		// TODO: find a better way to map loggers (expand our interface?)
+		pluginLogger = logger.NewLoggerHCLogAdapter(log.Log)
+	}
+
+	clientConfig := plugin.ClientConfig{
+		HandshakeConfig:  config.Type.HandshakeConfig(),
+		VersionedPlugins: versionedPlugins,
+		SecureConfig:     secureConfig,
+		Cmd:              cmd,
+		Logger:           pluginLogger,
+		AllowedProtocols: []plugin.Protocol{
+			plugin.ProtocolGRPC,
+		},
+	}
+
+	return Plugin{
+		Config:       config,
+		clientConfig: clientConfig,
+	}
+}
+
+func (p *Plugin) Start() (interface{}, error) {
+	if p.client != nil {
+		return nil, fmt.Errorf("plugin already started")
+	}
+
+	// start the plugin in a sub process
+	p.client = plugin.NewClient(&p.clientConfig)
+
+	// connect to the sub process via RPC
+	rpcClient, err := p.client.Client()
+	if err != nil {
+		return nil, err
+	}
+
+	// fetch the plugin object meeting the requested interface
+	raw, err := rpcClient.Dispense(p.Config.Type.String())
+	if err != nil {
+		return nil, err
+	}
+
+	return raw, nil
+}
+
+func (p *Plugin) Stop() error {
+	if p.client == nil {
+		return fmt.Errorf("plugin has not been started")
+	}
+	p.client.Kill()
+	return nil
+}

syft/plugin/proto/cataloger.pb.go

@@ -0,0 +1,841 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// source: cataloger.proto
+
+package proto
+
+import (
+	context "context"
+	fmt "fmt"
+	proto "github.com/golang/protobuf/proto"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+	math "math"
+)
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the proto package it is being compiled against.
+// A compilation error at this line likely means your copy of the
+// proto package needs to be updated.
+const _ = proto.ProtoPackageIsVersion3 // please upgrade the proto package
+
+type FileReference struct {
+	Id                   int64    `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
+	Path                 string   `protobuf:"bytes,2,opt,name=path,proto3" json:"path,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *FileReference) Reset()         { *m = FileReference{} }
+func (m *FileReference) String() string { return proto.CompactTextString(m) }
+func (*FileReference) ProtoMessage()    {}
+func (*FileReference) Descriptor() ([]byte, []int) {
+	return fileDescriptor_346aaad5d7f2c092, []int{0}
+}
+
+func (m *FileReference) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_FileReference.Unmarshal(m, b)
+}
+func (m *FileReference) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_FileReference.Marshal(b, m, deterministic)
+}
+func (m *FileReference) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_FileReference.Merge(m, src)
+}
+func (m *FileReference) XXX_Size() int {
+	return xxx_messageInfo_FileReference.Size(m)
+}
+func (m *FileReference) XXX_DiscardUnknown() {
+	xxx_messageInfo_FileReference.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_FileReference proto.InternalMessageInfo
+
+func (m *FileReference) GetId() int64 {
+	if m != nil {
+		return m.Id
+	}
+	return 0
+}
+
+func (m *FileReference) GetPath() string {
+	if m != nil {
+		return m.Path
+	}
+	return ""
+}
+
+type FileReferenceContents struct {
+	Id                   int64    `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
+	Path                 string   `protobuf:"bytes,2,opt,name=path,proto3" json:"path,omitempty"`
+	Contents             string   `protobuf:"bytes,3,opt,name=contents,proto3" json:"contents,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *FileReferenceContents) Reset()         { *m = FileReferenceContents{} }
+func (m *FileReferenceContents) String() string { return proto.CompactTextString(m) }
+func (*FileReferenceContents) ProtoMessage()    {}
+func (*FileReferenceContents) Descriptor() ([]byte, []int) {
+	return fileDescriptor_346aaad5d7f2c092, []int{1}
+}
+
+func (m *FileReferenceContents) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_FileReferenceContents.Unmarshal(m, b)
+}
+func (m *FileReferenceContents) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_FileReferenceContents.Marshal(b, m, deterministic)
+}
+func (m *FileReferenceContents) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_FileReferenceContents.Merge(m, src)
+}
+func (m *FileReferenceContents) XXX_Size() int {
+	return xxx_messageInfo_FileReferenceContents.Size(m)
+}
+func (m *FileReferenceContents) XXX_DiscardUnknown() {
+	xxx_messageInfo_FileReferenceContents.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_FileReferenceContents proto.InternalMessageInfo
+
+func (m *FileReferenceContents) GetId() int64 {
+	if m != nil {
+		return m.Id
+	}
+	return 0
+}
+
+func (m *FileReferenceContents) GetPath() string {
+	if m != nil {
+		return m.Path
+	}
+	return ""
+}
+
+func (m *FileReferenceContents) GetContents() string {
+	if m != nil {
+		return m.Contents
+	}
+	return ""
+}
+
+type Empty struct {
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *Empty) Reset()         { *m = Empty{} }
+func (m *Empty) String() string { return proto.CompactTextString(m) }
+func (*Empty) ProtoMessage()    {}
+func (*Empty) Descriptor() ([]byte, []int) {
+	return fileDescriptor_346aaad5d7f2c092, []int{2}
+}
+
+func (m *Empty) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_Empty.Unmarshal(m, b)
+}
+func (m *Empty) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_Empty.Marshal(b, m, deterministic)
+}
+func (m *Empty) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_Empty.Merge(m, src)
+}
+func (m *Empty) XXX_Size() int {
+	return xxx_messageInfo_Empty.Size(m)
+}
+func (m *Empty) XXX_DiscardUnknown() {
+	xxx_messageInfo_Empty.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Empty proto.InternalMessageInfo
+
+type FileResolverRequest struct {
+	Paths                []string `protobuf:"bytes,1,rep,name=paths,proto3" json:"paths,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *FileResolverRequest) Reset()         { *m = FileResolverRequest{} }
+func (m *FileResolverRequest) String() string { return proto.CompactTextString(m) }
+func (*FileResolverRequest) ProtoMessage()    {}
+func (*FileResolverRequest) Descriptor() ([]byte, []int) {
+	return fileDescriptor_346aaad5d7f2c092, []int{3}
+}
+
+func (m *FileResolverRequest) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_FileResolverRequest.Unmarshal(m, b)
+}
+func (m *FileResolverRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_FileResolverRequest.Marshal(b, m, deterministic)
+}
+func (m *FileResolverRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_FileResolverRequest.Merge(m, src)
+}
+func (m *FileResolverRequest) XXX_Size() int {
+	return xxx_messageInfo_FileResolverRequest.Size(m)
+}
+func (m *FileResolverRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_FileResolverRequest.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_FileResolverRequest proto.InternalMessageInfo
+
+func (m *FileResolverRequest) GetPaths() []string {
+	if m != nil {
+		return m.Paths
+	}
+	return nil
+}
+
+type FileResolverResponse struct {
+	Files                []*FileReference `protobuf:"bytes,1,rep,name=files,proto3" json:"files,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}         `json:"-"`
+	XXX_unrecognized     []byte           `json:"-"`
+	XXX_sizecache        int32            `json:"-"`
+}
+
+func (m *FileResolverResponse) Reset()         { *m = FileResolverResponse{} }
+func (m *FileResolverResponse) String() string { return proto.CompactTextString(m) }
+func (*FileResolverResponse) ProtoMessage()    {}
+func (*FileResolverResponse) Descriptor() ([]byte, []int) {
+	return fileDescriptor_346aaad5d7f2c092, []int{4}
+}
+
+func (m *FileResolverResponse) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_FileResolverResponse.Unmarshal(m, b)
+}
+func (m *FileResolverResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_FileResolverResponse.Marshal(b, m, deterministic)
+}
+func (m *FileResolverResponse) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_FileResolverResponse.Merge(m, src)
+}
+func (m *FileResolverResponse) XXX_Size() int {
+	return xxx_messageInfo_FileResolverResponse.Size(m)
+}
+func (m *FileResolverResponse) XXX_DiscardUnknown() {
+	xxx_messageInfo_FileResolverResponse.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_FileResolverResponse proto.InternalMessageInfo
+
+func (m *FileResolverResponse) GetFiles() []*FileReference {
+	if m != nil {
+		return m.Files
+	}
+	return nil
+}
+
+type NameResponse struct {
+	Name                 string   `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *NameResponse) Reset()         { *m = NameResponse{} }
+func (m *NameResponse) String() string { return proto.CompactTextString(m) }
+func (*NameResponse) ProtoMessage()    {}
+func (*NameResponse) Descriptor() ([]byte, []int) {
+	return fileDescriptor_346aaad5d7f2c092, []int{5}
+}
+
+func (m *NameResponse) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_NameResponse.Unmarshal(m, b)
+}
+func (m *NameResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_NameResponse.Marshal(b, m, deterministic)
+}
+func (m *NameResponse) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_NameResponse.Merge(m, src)
+}
+func (m *NameResponse) XXX_Size() int {
+	return xxx_messageInfo_NameResponse.Size(m)
+}
+func (m *NameResponse) XXX_DiscardUnknown() {
+	xxx_messageInfo_NameResponse.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_NameResponse proto.InternalMessageInfo
+
+func (m *NameResponse) GetName() string {
+	if m != nil {
+		return m.Name
+	}
+	return ""
+}
+
+type SelectFilesRequest struct {
+	FileResolverBrokerId uint32   `protobuf:"varint,1,opt,name=fileResolverBrokerId,proto3" json:"fileResolverBrokerId,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *SelectFilesRequest) Reset()         { *m = SelectFilesRequest{} }
+func (m *SelectFilesRequest) String() string { return proto.CompactTextString(m) }
+func (*SelectFilesRequest) ProtoMessage()    {}
+func (*SelectFilesRequest) Descriptor() ([]byte, []int) {
+	return fileDescriptor_346aaad5d7f2c092, []int{6}
+}
+
+func (m *SelectFilesRequest) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_SelectFilesRequest.Unmarshal(m, b)
+}
+func (m *SelectFilesRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_SelectFilesRequest.Marshal(b, m, deterministic)
+}
+func (m *SelectFilesRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_SelectFilesRequest.Merge(m, src)
+}
+func (m *SelectFilesRequest) XXX_Size() int {
+	return xxx_messageInfo_SelectFilesRequest.Size(m)
+}
+func (m *SelectFilesRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_SelectFilesRequest.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_SelectFilesRequest proto.InternalMessageInfo
+
+func (m *SelectFilesRequest) GetFileResolverBrokerId() uint32 {
+	if m != nil {
+		return m.FileResolverBrokerId
+	}
+	return 0
+}
+
+type SelectFilesResponse struct {
+	Files                []*FileReference `protobuf:"bytes,1,rep,name=files,proto3" json:"files,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}         `json:"-"`
+	XXX_unrecognized     []byte           `json:"-"`
+	XXX_sizecache        int32            `json:"-"`
+}
+
+func (m *SelectFilesResponse) Reset()         { *m = SelectFilesResponse{} }
+func (m *SelectFilesResponse) String() string { return proto.CompactTextString(m) }
+func (*SelectFilesResponse) ProtoMessage()    {}
+func (*SelectFilesResponse) Descriptor() ([]byte, []int) {
+	return fileDescriptor_346aaad5d7f2c092, []int{7}
+}
+
+func (m *SelectFilesResponse) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_SelectFilesResponse.Unmarshal(m, b)
+}
+func (m *SelectFilesResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_SelectFilesResponse.Marshal(b, m, deterministic)
+}
+func (m *SelectFilesResponse) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_SelectFilesResponse.Merge(m, src)
+}
+func (m *SelectFilesResponse) XXX_Size() int {
+	return xxx_messageInfo_SelectFilesResponse.Size(m)
+}
+func (m *SelectFilesResponse) XXX_DiscardUnknown() {
+	xxx_messageInfo_SelectFilesResponse.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_SelectFilesResponse proto.InternalMessageInfo
+
+func (m *SelectFilesResponse) GetFiles() []*FileReference {
+	if m != nil {
+		return m.Files
+	}
+	return nil
+}
+
+type Package struct {
+	Name                 string            `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Version              string            `protobuf:"bytes,2,opt,name=version,proto3" json:"version,omitempty"`
+	FoundBy              string            `protobuf:"bytes,3,opt,name=foundBy,proto3" json:"foundBy,omitempty"`
+	Source               []*FileReference  `protobuf:"bytes,4,rep,name=source,proto3" json:"source,omitempty"`
+	Licenses             []string          `protobuf:"bytes,5,rep,name=licenses,proto3" json:"licenses,omitempty"`
+	Language             uint64            `protobuf:"varint,6,opt,name=language,proto3" json:"language,omitempty"`
+	Type                 string            `protobuf:"bytes,7,opt,name=type,proto3" json:"type,omitempty"`
+	Metadata             map[string]string `protobuf:"bytes,8,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	XXX_NoUnkeyedLiteral struct{}          `json:"-"`
+	XXX_unrecognized     []byte            `json:"-"`
+	XXX_sizecache        int32             `json:"-"`
+}
+
+func (m *Package) Reset()         { *m = Package{} }
+func (m *Package) String() string { return proto.CompactTextString(m) }
+func (*Package) ProtoMessage()    {}
+func (*Package) Descriptor() ([]byte, []int) {
+	return fileDescriptor_346aaad5d7f2c092, []int{8}
+}
+
+func (m *Package) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_Package.Unmarshal(m, b)
+}
+func (m *Package) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_Package.Marshal(b, m, deterministic)
+}
+func (m *Package) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_Package.Merge(m, src)
+}
+func (m *Package) XXX_Size() int {
+	return xxx_messageInfo_Package.Size(m)
+}
+func (m *Package) XXX_DiscardUnknown() {
+	xxx_messageInfo_Package.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Package proto.InternalMessageInfo
+
+func (m *Package) GetName() string {
+	if m != nil {
+		return m.Name
+	}
+	return ""
+}
+
+func (m *Package) GetVersion() string {
+	if m != nil {
+		return m.Version
+	}
+	return ""
+}
+
+func (m *Package) GetFoundBy() string {
+	if m != nil {
+		return m.FoundBy
+	}
+	return ""
+}
+
+func (m *Package) GetSource() []*FileReference {
+	if m != nil {
+		return m.Source
+	}
+	return nil
+}
+
+func (m *Package) GetLicenses() []string {
+	if m != nil {
+		return m.Licenses
+	}
+	return nil
+}
+
+func (m *Package) GetLanguage() uint64 {
+	if m != nil {
+		return m.Language
+	}
+	return 0
+}
+
+func (m *Package) GetType() string {
+	if m != nil {
+		return m.Type
+	}
+	return ""
+}
+
+func (m *Package) GetMetadata() map[string]string {
+	if m != nil {
+		return m.Metadata
+	}
+	return nil
+}
+
+type CatalogRequest struct {
+	Contents             []*FileReferenceContents `protobuf:"bytes,1,rep,name=contents,proto3" json:"contents,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}                 `json:"-"`
+	XXX_unrecognized     []byte                   `json:"-"`
+	XXX_sizecache        int32                    `json:"-"`
+}
+
+func (m *CatalogRequest) Reset()         { *m = CatalogRequest{} }
+func (m *CatalogRequest) String() string { return proto.CompactTextString(m) }
+func (*CatalogRequest) ProtoMessage()    {}
+func (*CatalogRequest) Descriptor() ([]byte, []int) {
+	return fileDescriptor_346aaad5d7f2c092, []int{9}
+}
+
+func (m *CatalogRequest) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_CatalogRequest.Unmarshal(m, b)
+}
+func (m *CatalogRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_CatalogRequest.Marshal(b, m, deterministic)
+}
+func (m *CatalogRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_CatalogRequest.Merge(m, src)
+}
+func (m *CatalogRequest) XXX_Size() int {
+	return xxx_messageInfo_CatalogRequest.Size(m)
+}
+func (m *CatalogRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_CatalogRequest.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_CatalogRequest proto.InternalMessageInfo
+
+func (m *CatalogRequest) GetContents() []*FileReferenceContents {
+	if m != nil {
+		return m.Contents
+	}
+	return nil
+}
+
+type CatalogResponse struct {
+	Package              []*Package `protobuf:"bytes,1,rep,name=package,proto3" json:"package,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}   `json:"-"`
+	XXX_unrecognized     []byte     `json:"-"`
+	XXX_sizecache        int32      `json:"-"`
+}
+
+func (m *CatalogResponse) Reset()         { *m = CatalogResponse{} }
+func (m *CatalogResponse) String() string { return proto.CompactTextString(m) }
+func (*CatalogResponse) ProtoMessage()    {}
+func (*CatalogResponse) Descriptor() ([]byte, []int) {
+	return fileDescriptor_346aaad5d7f2c092, []int{10}
+}
+
+func (m *CatalogResponse) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_CatalogResponse.Unmarshal(m, b)
+}
+func (m *CatalogResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_CatalogResponse.Marshal(b, m, deterministic)
+}
+func (m *CatalogResponse) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_CatalogResponse.Merge(m, src)
+}
+func (m *CatalogResponse) XXX_Size() int {
+	return xxx_messageInfo_CatalogResponse.Size(m)
+}
+func (m *CatalogResponse) XXX_DiscardUnknown() {
+	xxx_messageInfo_CatalogResponse.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_CatalogResponse proto.InternalMessageInfo
+
+func (m *CatalogResponse) GetPackage() []*Package {
+	if m != nil {
+		return m.Package
+	}
+	return nil
+}
+
+func init() {
+	proto.RegisterType((*FileReference)(nil), "proto.FileReference")
+	proto.RegisterType((*FileReferenceContents)(nil), "proto.FileReferenceContents")
+	proto.RegisterType((*Empty)(nil), "proto.Empty")
+	proto.RegisterType((*FileResolverRequest)(nil), "proto.FileResolverRequest")
+	proto.RegisterType((*FileResolverResponse)(nil), "proto.FileResolverResponse")
+	proto.RegisterType((*NameResponse)(nil), "proto.NameResponse")
+	proto.RegisterType((*SelectFilesRequest)(nil), "proto.SelectFilesRequest")
+	proto.RegisterType((*SelectFilesResponse)(nil), "proto.SelectFilesResponse")
+	proto.RegisterType((*Package)(nil), "proto.Package")
+	proto.RegisterMapType((map[string]string)(nil), "proto.Package.MetadataEntry")
+	proto.RegisterType((*CatalogRequest)(nil), "proto.CatalogRequest")
+	proto.RegisterType((*CatalogResponse)(nil), "proto.CatalogResponse")
+}
+
+func init() { proto.RegisterFile("cataloger.proto", fileDescriptor_346aaad5d7f2c092) }
+
+var fileDescriptor_346aaad5d7f2c092 = []byte{
+	// 541 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x9c, 0x53, 0xcb, 0x8e, 0xd3, 0x3c,
+	0x14, 0x56, 0x7a, 0x4b, 0x7b, 0x7a, 0x99, 0x5f, 0x6e, 0xe7, 0x57, 0x08, 0x2c, 0xaa, 0xac, 0xca,
+	0x45, 0x5d, 0x74, 0x36, 0x15, 0xb3, 0xa2, 0x65, 0x86, 0x8b, 0x04, 0x1a, 0x99, 0x05, 0x6b, 0x4f,
+	0x7a, 0x5a, 0xa2, 0xa6, 0x71, 0x88, 0xdd, 0x4a, 0x79, 0x19, 0x1e, 0x83, 0x07, 0xe0, 0xc9, 0x50,
+	0x6c, 0x27, 0xd4, 0x10, 0x21, 0x34, 0xab, 0xf8, 0xe4, 0xfb, 0xfc, 0x9d, 0xcf, 0xe7, 0x02, 0x17,
+	0x21, 0x93, 0x2c, 0xe6, 0x3b, 0xcc, 0xe6, 0x69, 0xc6, 0x25, 0x27, 0x6d, 0xf5, 0x09, 0xae, 0x60,
+	0x78, 0x1b, 0xc5, 0x48, 0x71, 0x8b, 0x19, 0x26, 0x21, 0x92, 0x11, 0x34, 0xa2, 0x8d, 0xe7, 0x4c,
+	0x9d, 0x59, 0x93, 0x36, 0xa2, 0x0d, 0x21, 0xd0, 0x4a, 0x99, 0xfc, 0xe2, 0x35, 0xa6, 0xce, 0xac,
+	0x47, 0xd5, 0x39, 0xf8, 0x0c, 0x97, 0xd6, 0xa5, 0x35, 0x4f, 0x24, 0x26, 0x52, 0xfc, 0xcb, 0x65,
+	0xe2, 0x43, 0x37, 0x34, 0x7c, 0xaf, 0xa9, 0xfe, 0x57, 0x71, 0xe0, 0x42, 0xfb, 0xe6, 0x90, 0xca,
+	0x3c, 0x78, 0x0e, 0x63, 0x9d, 0x41, 0xf0, 0xf8, 0x84, 0x19, 0xc5, 0xaf, 0x47, 0x14, 0x92, 0x4c,
+	0xa0, 0x5d, 0x68, 0x08, 0xcf, 0x99, 0x36, 0x67, 0x3d, 0xaa, 0x83, 0x60, 0x05, 0x13, 0x9b, 0x2c,
+	0x52, 0x9e, 0x08, 0x24, 0xcf, 0xa0, 0xbd, 0x8d, 0x62, 0xd4, 0xec, 0xfe, 0x62, 0xa2, 0x5f, 0x3e,
+	0xb7, 0xac, 0x53, 0x4d, 0x09, 0x02, 0x18, 0x7c, 0x64, 0x07, 0xac, 0xee, 0x12, 0x68, 0x25, 0xec,
+	0x80, 0xea, 0x2d, 0x3d, 0xaa, 0xce, 0xc1, 0x5b, 0x20, 0x9f, 0x30, 0xc6, 0x50, 0x16, 0x0a, 0xa2,
+	0xf4, 0xb4, 0x80, 0xc9, 0xf6, 0x2c, 0xfb, 0x2a, 0xe3, 0x7b, 0xcc, 0xde, 0xe9, 0x2a, 0x0c, 0x69,
+	0x2d, 0x16, 0xbc, 0x82, 0xb1, 0xa5, 0xf4, 0x00, 0xc3, 0x3f, 0x1a, 0xe0, 0xde, 0xb1, 0x70, 0xcf,
+	0x76, 0xb5, 0x66, 0x89, 0x07, 0xee, 0x09, 0x33, 0x11, 0xf1, 0xc4, 0x54, 0xbf, 0x0c, 0x0b, 0x64,
+	0xcb, 0x8f, 0xc9, 0x66, 0x95, 0x9b, 0xfa, 0x97, 0x21, 0x79, 0x01, 0x1d, 0xc1, 0x8f, 0x59, 0x88,
+	0x5e, 0xeb, 0x2f, 0x06, 0x0c, 0xa7, 0x68, 0x64, 0x1c, 0x85, 0x98, 0x08, 0x14, 0x5e, 0x5b, 0xf5,
+	0xa3, 0x8a, 0x15, 0xc6, 0x92, 0xdd, 0x91, 0xed, 0xd0, 0xeb, 0x4c, 0x9d, 0x59, 0x8b, 0x56, 0x71,
+	0xe1, 0x56, 0xe6, 0x29, 0x7a, 0xae, 0x76, 0x5b, 0x9c, 0xc9, 0x12, 0xba, 0x07, 0x94, 0x6c, 0xc3,
+	0x24, 0xf3, 0xba, 0x2a, 0xf7, 0x13, 0x93, 0xdb, 0xbc, 0x71, 0xfe, 0xc1, 0xc0, 0x37, 0x89, 0xcc,
+	0x72, 0x5a, 0xb1, 0xfd, 0x6b, 0x18, 0x5a, 0x10, 0xf9, 0x0f, 0x9a, 0x7b, 0xcc, 0x4d, 0x2d, 0x8a,
+	0x63, 0x31, 0x35, 0x27, 0x16, 0x1f, 0xd1, 0x14, 0x42, 0x07, 0x2f, 0x1b, 0x4b, 0x27, 0x78, 0x0f,
+	0xa3, 0xb5, 0xde, 0x8b, 0xb2, 0x9b, 0xcb, 0xb3, 0xe9, 0x74, 0x2c, 0x23, 0xb5, 0x13, 0x7f, 0x36,
+	0xbb, 0xd7, 0x70, 0x51, 0x69, 0x99, 0x7e, 0xce, 0xc0, 0x4d, 0xb5, 0x7d, 0xa3, 0x35, 0xb2, 0x1f,
+	0x45, 0x4b, 0x78, 0xf1, 0xdd, 0x81, 0xde, 0xba, 0xdc, 0x50, 0xf2, 0x14, 0x5a, 0xc5, 0x30, 0x92,
+	0x81, 0xa1, 0xab, 0x9d, 0xf0, 0xc7, 0x26, 0xb2, 0xe6, 0xf4, 0x35, 0xf4, 0xcf, 0x26, 0x89, 0x3c,
+	0x32, 0x9c, 0x3f, 0xe7, 0xd4, 0xf7, 0xeb, 0x20, 0xa3, 0xb2, 0x04, 0xd7, 0x64, 0x27, 0x97, 0x86,
+	0x66, 0xd7, 0xc5, 0xff, 0xff, 0xf7, 0xdf, 0xfa, 0xe6, 0xe2, 0x9b, 0x03, 0x83, 0xf3, 0xe5, 0x23,
+	0xb7, 0xd0, 0x57, 0xda, 0xab, 0xfc, 0x4e, 0x6d, 0xbb, 0x55, 0x3d, 0x6b, 0x9b, 0xfd, 0xc7, 0xb5,
+	0x98, 0xb1, 0xf4, 0x4b, 0xe7, 0x4d, 0xcc, 0xef, 0x1f, 0xac, 0x73, 0xdf, 0x51, 0xd8, 0xd5, 0xcf,
+	0x00, 0x00, 0x00, 0xff, 0xff, 0x6e, 0xfe, 0x04, 0x3e, 0x01, 0x05, 0x00, 0x00,
+}
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ context.Context
+var _ grpc.ClientConnInterface
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+const _ = grpc.SupportPackageIsVersion6
+
+// CatalogerClient is the client API for Cataloger service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
+type CatalogerClient interface {
+	Name(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*NameResponse, error)
+	SelectFiles(ctx context.Context, in *SelectFilesRequest, opts ...grpc.CallOption) (*SelectFilesResponse, error)
+	Catalog(ctx context.Context, in *CatalogRequest, opts ...grpc.CallOption) (*CatalogResponse, error)
+}
+
+type catalogerClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewCatalogerClient(cc grpc.ClientConnInterface) CatalogerClient {
+	return &catalogerClient{cc}
+}
+
+func (c *catalogerClient) Name(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*NameResponse, error) {
+	out := new(NameResponse)
+	err := c.cc.Invoke(ctx, "/proto.Cataloger/Name", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *catalogerClient) SelectFiles(ctx context.Context, in *SelectFilesRequest, opts ...grpc.CallOption) (*SelectFilesResponse, error) {
+	out := new(SelectFilesResponse)
+	err := c.cc.Invoke(ctx, "/proto.Cataloger/SelectFiles", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *catalogerClient) Catalog(ctx context.Context, in *CatalogRequest, opts ...grpc.CallOption) (*CatalogResponse, error) {
+	out := new(CatalogResponse)
+	err := c.cc.Invoke(ctx, "/proto.Cataloger/Catalog", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// CatalogerServer is the server API for Cataloger service.
+type CatalogerServer interface {
+	Name(context.Context, *Empty) (*NameResponse, error)
+	SelectFiles(context.Context, *SelectFilesRequest) (*SelectFilesResponse, error)
+	Catalog(context.Context, *CatalogRequest) (*CatalogResponse, error)
+}
+
+// UnimplementedCatalogerServer can be embedded to have forward compatible implementations.
+type UnimplementedCatalogerServer struct {
+}
+
+func (*UnimplementedCatalogerServer) Name(ctx context.Context, req *Empty) (*NameResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Name not implemented")
+}
+func (*UnimplementedCatalogerServer) SelectFiles(ctx context.Context, req *SelectFilesRequest) (*SelectFilesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method SelectFiles not implemented")
+}
+func (*UnimplementedCatalogerServer) Catalog(ctx context.Context, req *CatalogRequest) (*CatalogResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Catalog not implemented")
+}
+
+func RegisterCatalogerServer(s *grpc.Server, srv CatalogerServer) {
+	s.RegisterService(&_Cataloger_serviceDesc, srv)
+}
+
+func _Cataloger_Name_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(Empty)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(CatalogerServer).Name(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/proto.Cataloger/Name",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(CatalogerServer).Name(ctx, req.(*Empty))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Cataloger_SelectFiles_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SelectFilesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(CatalogerServer).SelectFiles(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/proto.Cataloger/SelectFiles",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(CatalogerServer).SelectFiles(ctx, req.(*SelectFilesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Cataloger_Catalog_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CatalogRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(CatalogerServer).Catalog(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/proto.Cataloger/Catalog",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(CatalogerServer).Catalog(ctx, req.(*CatalogRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+var _Cataloger_serviceDesc = grpc.ServiceDesc{
+	ServiceName: "proto.Cataloger",
+	HandlerType: (*CatalogerServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Name",
+			Handler:    _Cataloger_Name_Handler,
+		},
+		{
+			MethodName: "SelectFiles",
+			Handler:    _Cataloger_SelectFiles_Handler,
+		},
+		{
+			MethodName: "Catalog",
+			Handler:    _Cataloger_Catalog_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "cataloger.proto",
+}
+
+// FileResolverClient is the client API for FileResolver service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
+type FileResolverClient interface {
+	FilesByPath(ctx context.Context, in *FileResolverRequest, opts ...grpc.CallOption) (*FileResolverResponse, error)
+	FilesByGlob(ctx context.Context, in *FileResolverRequest, opts ...grpc.CallOption) (*FileResolverResponse, error)
+}
+
+type fileResolverClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewFileResolverClient(cc grpc.ClientConnInterface) FileResolverClient {
+	return &fileResolverClient{cc}
+}
+
+func (c *fileResolverClient) FilesByPath(ctx context.Context, in *FileResolverRequest, opts ...grpc.CallOption) (*FileResolverResponse, error) {
+	out := new(FileResolverResponse)
+	err := c.cc.Invoke(ctx, "/proto.FileResolver/FilesByPath", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *fileResolverClient) FilesByGlob(ctx context.Context, in *FileResolverRequest, opts ...grpc.CallOption) (*FileResolverResponse, error) {
+	out := new(FileResolverResponse)
+	err := c.cc.Invoke(ctx, "/proto.FileResolver/FilesByGlob", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// FileResolverServer is the server API for FileResolver service.
+type FileResolverServer interface {
+	FilesByPath(context.Context, *FileResolverRequest) (*FileResolverResponse, error)
+	FilesByGlob(context.Context, *FileResolverRequest) (*FileResolverResponse, error)
+}
+
+// UnimplementedFileResolverServer can be embedded to have forward compatible implementations.
+type UnimplementedFileResolverServer struct {
+}
+
+func (*UnimplementedFileResolverServer) FilesByPath(ctx context.Context, req *FileResolverRequest) (*FileResolverResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method FilesByPath not implemented")
+}
+func (*UnimplementedFileResolverServer) FilesByGlob(ctx context.Context, req *FileResolverRequest) (*FileResolverResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method FilesByGlob not implemented")
+}
+
+func RegisterFileResolverServer(s *grpc.Server, srv FileResolverServer) {
+	s.RegisterService(&_FileResolver_serviceDesc, srv)
+}
+
+func _FileResolver_FilesByPath_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(FileResolverRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(FileResolverServer).FilesByPath(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/proto.FileResolver/FilesByPath",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(FileResolverServer).FilesByPath(ctx, req.(*FileResolverRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _FileResolver_FilesByGlob_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(FileResolverRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(FileResolverServer).FilesByGlob(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/proto.FileResolver/FilesByGlob",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(FileResolverServer).FilesByGlob(ctx, req.(*FileResolverRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+var _FileResolver_serviceDesc = grpc.ServiceDesc{
+	ServiceName: "proto.FileResolver",
+	HandlerType: (*FileResolverServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "FilesByPath",
+			Handler:    _FileResolver_FilesByPath_Handler,
+		},
+		{
+			MethodName: "FilesByGlob",
+			Handler:    _FileResolver_FilesByGlob_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "cataloger.proto",
+}

syft/plugin/proto/cataloger.proto

@@ -0,0 +1,67 @@
+syntax = "proto3";
+package proto;
+
+message FileReference {
+    int64 id = 1;
+    string path = 2;
+}
+
+message FileReferenceContents {
+    int64 id = 1;
+    string path = 2;
+    string contents = 3;
+}
+
+message Empty {
+}
+
+message FileResolverRequest {
+    repeated string paths = 1;
+}
+
+message FileResolverResponse {
+    repeated FileReference files = 1;
+}
+
+message NameResponse {
+    string name = 1;
+}
+
+message SelectFilesRequest {
+    uint32 fileResolverBrokerId = 1;
+}
+
+message SelectFilesResponse {
+    repeated FileReference files = 1;
+}
+
+message Package {
+    string name = 1;
+    string version = 2;
+    string foundBy = 3;
+    repeated FileReference source = 4;
+    repeated string licenses = 5;
+    uint64 language = 6;
+    string type = 7;
+    map<string, string> metadata = 8;
+}
+
+message CatalogRequest {
+    repeated FileReferenceContents contents = 1;
+}
+
+message CatalogResponse {
+    repeated Package package = 1;
+}
+
+service Cataloger {
+    rpc Name(Empty) returns (NameResponse);
+    rpc SelectFiles(SelectFilesRequest) returns (SelectFilesResponse);
+    rpc Catalog(CatalogRequest) returns (CatalogResponse);
+}
+
+service FileResolver {
+    rpc FilesByPath(FileResolverRequest) returns (FileResolverResponse);
+    rpc FilesByGlob(FileResolverRequest) returns (FileResolverResponse);
+}
+