add test and linting fixes

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

.github/ISSUE_TEMPLATE/config.yml

@@ -3,4 +3,4 @@ contact_links:
   - name: Join the Slack community 💬
     # link to our community Slack registration page
     url: https://anchore.com/slack
-    about: 'Be sure to check out the channels #syft-help (ask us questions) and #syft-dev (collaborate with us on design and development)!'
+    about: 'Come chat with us! Ask for help, join our software development efforts, or just give us feedback!'

CONTRIBUTING.md

@@ -1,12 +1,12 @@
-# Contributing to `syft`
+# Contributing to Syft
 
-If you are looking to contribute to this project and want to open a Github pull request ("PR"), there are a few guidelines of what we are looking for in patches. Make sure you go through this document and ensure that your code proposal is aligned.
+If you are looking to contribute to this project and want to open a GitHub pull request ("PR"), there are a few guidelines of what we are looking for in patches. Make sure you go through this document and ensure that your code proposal is aligned.
 
-## Sign your work
+## Sign off your work
 
 The `sign-off` is an added line at the end of the explanation for the commit, certifying that you wrote it or otherwise have the right to submit it as an open-source patch. By submitting a contribution, you agree to be bound by the terms of the DCO Version 1.1 and Apache License Version 2.0.
 
-Signing a commit certifies the below Developer's Certificate of Origin (DCO):
+Signing off a commit certifies the below Developer's Certificate of Origin (DCO):
 
 ```text
 Developer's Certificate of Origin 1.1
@@ -51,13 +51,13 @@ $ git config --global user.name "John Doe"
 $ git config --global user.email "john.doe@example.com"
 ```
 
-Creating a signed commit is then possible with `-s`:
+Creating a signed-off commit is then possible with `-s` or `--signoff`:
 
 ```text
 $ git commit -s -m "this is a commit message"
 ```
 
-To double check if the commit was signed, look at the log output:
+To double-check that the commit was signed-off, look at the log output:
 
 ```text
 $ git log -1
@@ -82,6 +82,11 @@ Date:   Mon Aug 1 11:27:13 2020 -0400
 
 [//]: # (TODO: PR title and description)
 
+## Sign your commits
+
+To ensure the authenticity and integrity of code contributions, **we require that all commits are signed**. Signing commits proves that your commits were truly created by you, as the holder of a private key.
+
+Configuring git to sign your commits is a straightforward process. To get set up, see [GitHub's documentation on signing commits](https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits).
 
 ## Test your changes
 

README.md

@@ -3,8 +3,9 @@
 [![Validations](https://github.com/anchore/syft/actions/workflows/validations.yaml/badge.svg)](https://github.com/anchore/syft/actions/workflows/validations.yaml)
 [![Go Report Card](https://goreportcard.com/badge/github.com/anchore/syft)](https://goreportcard.com/report/github.com/anchore/syft)
 [![GitHub release](https://img.shields.io/github/release/anchore/syft.svg)](https://github.com/anchore/syft/releases/latest)
-[![License: Apache-2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://github.com/anchore/syft/blob/main/LICENSE)
 [![GitHub go.mod Go version](https://img.shields.io/github/go-mod/go-version/anchore/syft.svg)](https://github.com/anchore/syft)
+[![License: Apache-2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://github.com/anchore/syft/blob/main/LICENSE)
+[![Slack Invite](https://img.shields.io/badge/Slack-Join-blue?logo=slack)](https://anchore.com/slack)
 
 A CLI tool and go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Exceptional for vulnerability detection when used with a scanner tool like [Grype](https://github.com/anchore/grype).
 
@@ -28,6 +29,27 @@ We’ll have free swag, giveaways, snacks, and sips. Space will be limited, so m
 
 If you encounter an issue, please [let us know using the issue tracker](https://github.com/anchore/syft/issues).
 
+## Installation
+
+### Recommended
+```bash
+curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
+```
+
+...or, you can specify a release version and destination directory for the installation:
+
+```
+curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b <DESTINATION_DIR> <RELEASE_VERSION>
+```
+
+### Homebrew
+```bash
+brew tap anchore/syft
+brew install syft
+```
+
+**Note**: Currently, Syft is built only for macOS and Linux.
+
 ## Getting started
 
 To generate an SBOM for a Docker or OCI image:
@@ -47,7 +69,10 @@ To include software from all image layers in the SBOM, regardless of its presenc
 syft packages <image> --scope all-layers
 ```
 
+### Supported sources
+
 Syft can generate a SBOM from a variety of sources:
+
 ```
 # catalog a container image archive (from the result of `docker image save ...`, `podman save ...`, or `skopeo copy` commands)
 syft packages path/to/image.tar
@@ -57,6 +82,7 @@ syft packages path/to/dir
 ```
 
 Sources can be explicitly provided with a scheme:
+
 ```
 docker:yourrepo/yourimage:tag          use images from the Docker daemon
 docker-archive:path/to/yourimage.tar   use a tarball from disk for archives created from "docker save"
@@ -66,7 +92,10 @@ dir:path/to/yourproject                read directly from a path on disk (any di
 registry:yourrepo/yourimage:tag        pull image directly from a registry (no container runtime required)
 ```
 
+### Output formats
+
 The output format for Syft is configurable as well:
+
 ```
 syft packages <image> -o <format>
 ```
@@ -79,23 +108,6 @@ Where the `format`s available are:
 - `spdx-json`: A JSON report conforming to the [SPDX 2.2 JSON Schema](https://github.com/spdx/spdx-spec/blob/v2.2/schemas/spdx-schema.json).
 - `table`: A columnar summary (default).
 
-## Installation
-
-**Recommended (macOS and Linux)**
-```bash
-# install the latest version to /usr/local/bin
-curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
-
-# install a specific version into a specific dir
-curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b <SOME_BIN_PATH> <RELEASE_VERSION>
-```
-
-**Homebrew (macOS)**
-```bash
-brew tap anchore/syft
-brew install syft
-```
-
 ## Configuration
 
 Configuration search paths:
@@ -116,6 +128,9 @@ output: "table"
 # same as -q ; SYFT_QUIET env var
 quiet: false
 
+# same as --file; write output report to a file (default is to write to stdout)
+file: ""
+
 # enable/disable checking for application updates on startup
 # same as SYFT_CHECK_FOR_APP_UPDATE env var
 check-for-app-update: true

cmd/event_loop.go

@@ -2,6 +2,7 @@ package cmd
 
 import (
 	"errors"
+	"fmt"
 	"os"
 
 	"github.com/anchore/syft/internal/log"
@@ -14,11 +15,13 @@ import (
 // signal interrupts. Is responsible for handling each event relative to a given UI an to coordinate eventing until
 // an eventual graceful exit.
 // nolint:gocognit,funlen
-func eventLoop(workerErrs <-chan error, signals <-chan os.Signal, subscription *partybus.Subscription, ux ui.UI, cleanupFn func()) error {
+func eventLoop(workerErrs <-chan error, signals <-chan os.Signal, subscription *partybus.Subscription, cleanupFn func(), uxs ...ui.UI) error {
 	defer cleanupFn()
 	events := subscription.Events()
 	var err error
-	if ux, err = setupUI(subscription.Unsubscribe, ux); err != nil {
+	var ux ui.UI
+
+	if ux, err = setupUI(subscription.Unsubscribe, uxs...); err != nil {
 		return err
 	}
 
@@ -78,15 +81,18 @@ func eventLoop(workerErrs <-chan error, signals <-chan os.Signal, subscription *
 	return retErr
 }
 
-func setupUI(unsubscribe func() error, ux ui.UI) (ui.UI, error) {
-	if err := ux.Setup(unsubscribe); err != nil {
-		// replace the existing UI with a (simpler) logger UI
-		ux = ui.NewLoggerUI()
+// setupUI takes one or more UIs that responds to events and takes a event bus unsubscribe function for use
+// during teardown. With the given UIs, the first UI which the ui.Setup() function does not return an error
+// will be utilized in execution. Providing a set of UIs allows for the caller to provide graceful fallbacks
+// when there are environmental problem (e.g. unable to setup a TUI with the current TTY).
+func setupUI(unsubscribe func() error, uis ...ui.UI) (ui.UI, error) {
+	for _, ux := range uis {
 		if err := ux.Setup(unsubscribe); err != nil {
-			// something is very wrong, bail.
-			return ux, err
+			log.Warnf("unable to setup given UI, falling back to alternative UI: %+v", err)
+			continue
 		}
-		log.Errorf("unable to setup given UI, falling back to logger: %+v", err)
+
+		return ux, nil
 	}
-	return ux, nil
+	return nil, fmt.Errorf("unable to setup any UI")
 }

cmd/event_loop_test.go

@@ -96,8 +96,8 @@ func Test_eventLoop_gracefulExit(t *testing.T) {
 				worker(),
 				signaler(),
 				subscription,
-				ux,
 				cleanupFn,
+				ux,
 			),
 		)
 
@@ -159,8 +159,8 @@ func Test_eventLoop_workerError(t *testing.T) {
 				worker(),
 				signaler(),
 				subscription,
-				ux,
 				cleanupFn,
+				ux,
 			),
 			workerErr,
 			"should have seen a worker error, but did not",
@@ -230,8 +230,8 @@ func Test_eventLoop_unsubscribeError(t *testing.T) {
 				worker(),
 				signaler(),
 				subscription,
-				ux,
 				cleanupFn,
+				ux,
 			),
 		)
 
@@ -300,8 +300,8 @@ func Test_eventLoop_handlerError(t *testing.T) {
 				worker(),
 				signaler(),
 				subscription,
-				ux,
 				cleanupFn,
+				ux,
 			),
 			finalEvent.Error,
 			"should have seen a event error, but did not",
@@ -355,8 +355,8 @@ func Test_eventLoop_signalsStopExecution(t *testing.T) {
 				worker(),
 				signaler(),
 				subscription,
-				ux,
 				cleanupFn,
+				ux,
 			),
 		)
 
@@ -425,8 +425,8 @@ func Test_eventLoop_uiTeardownError(t *testing.T) {
 				worker(),
 				signaler(),
 				subscription,
-				ux,
 				cleanupFn,
+				ux,
 			),
 			teardownError,
 			"should have seen a UI teardown error, but did not",

cmd/packages.go

@@ -6,6 +6,8 @@ import (
 	"io/ioutil"
 	"os"
 
+	"github.com/anchore/syft/syft/format"
+
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/anchore"
@@ -35,7 +37,7 @@ const (
 
   Supports the following image sources:
     {{.appName}} {{.command}} yourrepo/yourimage:tag     defaults to using images from a Docker daemon. If Docker is not present, the image is pulled directly from the registry.
-    {{.appName}} {{.command}} path/to/a/file/or/dir      a Docker tar, OCI tar, OCI directory, or generic filesystem directory 
+    {{.appName}} {{.command}} path/to/a/file/or/dir      a Docker tar, OCI tar, OCI directory, or generic filesystem directory
 
   You can also explicitly specify the scheme to use:
     {{.appName}} {{.command}} docker:yourrepo/yourimage:tag          explicitly use the Docker daemon
@@ -48,7 +50,7 @@ const (
 )
 
 var (
-	packagesPresenterOpt packages.PresenterOption
+	packagesPresenterOpt format.Option
 	packagesArgs         = cobra.MaximumNArgs(1)
 	packagesCmd          = &cobra.Command{
 		Use:   "packages [SOURCE]",
@@ -71,8 +73,8 @@ var (
 			}
 
 			// set the presenter
-			presenterOption := packages.ParsePresenterOption(appConfig.Output)
-			if presenterOption == packages.UnknownPresenterOption {
+			presenterOption := format.ParseOption(appConfig.Output)
+			if presenterOption == format.UnknownOption {
 				return fmt.Errorf("bad --output value '%s'", appConfig.Output)
 			}
 			packagesPresenterOpt = presenterOption
@@ -109,8 +111,13 @@ func setPackageFlags(flags *pflag.FlagSet) {
 		fmt.Sprintf("selection of layers to catalog, options=%v", source.AllScopes))
 
 	flags.StringP(
-		"output", "o", string(packages.TablePresenterOption),
-		fmt.Sprintf("report output formatter, options=%v", packages.AllPresenters),
+		"output", "o", string(format.TableOption),
+		fmt.Sprintf("report output formatter, options=%v", format.AllOptions),
+	)
+
+	flags.StringP(
+		"file", "", "",
+		"file to write the report output to (default is STDOUT)",
 	)
 
 	///////// Upload options //////////////////////////////////////////////////////////
@@ -156,6 +163,10 @@ func bindPackagesConfigOptions(flags *pflag.FlagSet) error {
 		return err
 	}
 
+	if err := viper.BindPFlag("file", flags.Lookup("file")); err != nil {
+		return err
+	}
+
 	///////// Upload options //////////////////////////////////////////////////////////
 
 	if err := viper.BindPFlag("anchore.host", flags.Lookup("host")); err != nil {
@@ -188,12 +199,24 @@ func bindPackagesConfigOptions(flags *pflag.FlagSet) error {
 func packagesExec(_ *cobra.Command, args []string) error {
 	// could be an image or a directory, with or without a scheme
 	userInput := args[0]
+
+	reporter, closer, err := reportWriter()
+	defer func() {
+		if err := closer(); err != nil {
+			log.Warnf("unable to write to report destination: %+v", err)
+		}
+	}()
+
+	if err != nil {
+		return err
+	}
+
 	return eventLoop(
 		packagesExecWorker(userInput),
 		setupSignals(),
 		eventSubscription,
-		ui.Select(appConfig.CliOptions.Verbosity > 0, appConfig.Quiet),
 		stereoscope.Cleanup,
+		ui.Select(appConfig.CliOptions.Verbosity > 0, appConfig.Quiet, reporter)...,
 	)
 }
 
@@ -226,7 +249,7 @@ func packagesExecWorker(userInput string) <-chan error {
 
 		bus.Publish(partybus.Event{
 			Type: event.PresenterReady,
-			Value: packages.Presenter(packagesPresenterOpt, packages.PresenterConfig{
+			Value: packages.Presenter(packagesPresenterOpt, packages.Config{
 				SourceMetadata: src.Metadata,
 				Catalog:        catalog,
 				Distro:         d,

cmd/power_user.go

@@ -7,6 +7,7 @@ import (
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/presenter/poweruser"
 	"github.com/anchore/syft/internal/ui"
 	"github.com/anchore/syft/syft/event"
@@ -73,12 +74,24 @@ func init() {
 func powerUserExec(_ *cobra.Command, args []string) error {
 	// could be an image or a directory, with or without a scheme
 	userInput := args[0]
+
+	reporter, closer, err := reportWriter()
+	defer func() {
+		if err := closer(); err != nil {
+			log.Warnf("unable to write to report destination: %+v", err)
+		}
+	}()
+
+	if err != nil {
+		return err
+	}
+
 	return eventLoop(
 		powerUserExecWorker(userInput),
 		setupSignals(),
 		eventSubscription,
-		ui.Select(appConfig.CliOptions.Verbosity > 0, appConfig.Quiet),
 		stereoscope.Cleanup,
+		ui.Select(appConfig.CliOptions.Verbosity > 0, appConfig.Quiet, reporter)...,
 	)
 }
 

cmd/report_writer.go

@@ -0,0 +1,29 @@
+package cmd
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"strings"
+
+	"github.com/anchore/syft/internal/log"
+)
+
+func reportWriter() (io.Writer, func() error, error) {
+	nop := func() error { return nil }
+
+	path := strings.TrimSpace(appConfig.File)
+	switch len(path) {
+	case 0:
+		return os.Stdout, nop, nil
+	default:
+		reportFile, err := os.OpenFile(path, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0644)
+		if err != nil {
+			return nil, nop, fmt.Errorf("unable to create report file: %w", err)
+		}
+		return reportFile, func() error {
+			log.Infof("report written to file=%q", path)
+			return reportFile.Close()
+		}, nil
+	}
+}

go.mod

@@ -11,7 +11,7 @@ require (
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29
-	github.com/anchore/stereoscope v0.0.0-20210817160504-0f4abc2a5a5a
+	github.com/anchore/stereoscope v0.0.0-20211005213828-538011008578
 	github.com/antihax/optional v1.0.0
 	github.com/bmatcuk/doublestar/v2 v2.0.4
 	github.com/docker/docker v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible

go.sum

@@ -117,8 +117,8 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZV
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29 h1:K9LfnxwhqvihqU0+MF325FNy7fsKV9EGaUxdfR4gnWk=
 github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29/go.mod h1:Oc1UkGaJwY6ND6vtAqPSlYrptKRJngHwkwB6W7l1uP0=
-github.com/anchore/stereoscope v0.0.0-20210817160504-0f4abc2a5a5a h1:RQb+Gft1MKxjDfJCnHP/f1mwfy0Jz50Kp9QGgSWKQiY=
-github.com/anchore/stereoscope v0.0.0-20210817160504-0f4abc2a5a5a/go.mod h1:165DfE5jApgEkHTWwu7Bijeml9fofudrgcpuWaD9+tk=
+github.com/anchore/stereoscope v0.0.0-20211005213828-538011008578 h1:gSpftl0RWfdTwlPmsOLgEawHIw16xwwG1mFD/wrVDRE=
+github.com/anchore/stereoscope v0.0.0-20211005213828-538011008578/go.mod h1:kL7jfbXblrDcBhu5ja/s+VTYL3Mzof4eQNMJiSqcwXQ=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/antihax/optional v1.0.0 h1:xK2lYat7ZLaVVcIuj82J8kIro4V6kDe0AUDFboUCwcg=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
@@ -242,6 +242,8 @@ github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHqu
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
+github.com/gabriel-vasile/mimetype v1.3.0 h1:4YOHITFLyYwF+iqG0ybSLGArRItynpfwdlWRmJnd75E=
+github.com/gabriel-vasile/mimetype v1.3.0/go.mod h1:fA8fi6KUiG7MgQQ+mEWotXoEOvmxRtOJlERCzSmRvr8=
 github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/go-critic/go-critic v0.4.1/go.mod h1:7/14rZGnZbY6E38VEGk2kVhoq6itzc1E68facVDK23g=
@@ -872,7 +874,7 @@ golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/
 golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200602114024-627f9648deb9/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20210505024714-0287a6fb4125/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d h1:LO7XpTYMwTqxjLcGWPijK3vRXg1aWdlNOVOHRq45d7c=
 golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -939,7 +941,6 @@ golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200602225109-6fdc65e7d980/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da h1:b3NXsE2LusjYGGjL5bxEVZZORm/YEFFrWFjR8eFrw/c=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=

internal/anchore/import_package_sbom.go

@@ -8,7 +8,8 @@ import (
 	"fmt"
 	"net/http"
 
-	"github.com/anchore/syft/internal/presenter/packages"
+	"github.com/anchore/syft/internal/formats"
+	"github.com/anchore/syft/syft/format"
 
 	"github.com/wagoodman/go-progress"
 
@@ -24,9 +25,9 @@ type packageSBOMImportAPI interface {
 	ImportImagePackages(context.Context, string, external.ImagePackageManifest) (external.ImageImportContentResponse, *http.Response, error)
 }
 
-func packageSbomModel(s source.Metadata, catalog *pkg.Catalog, d *distro.Distro, scope source.Scope) (*external.ImagePackageManifest, error) {
+func packageSbomModel(s source.Metadata, catalog *pkg.Catalog, d *distro.Distro, _ source.Scope) (*external.ImagePackageManifest, error) {
 	var buf bytes.Buffer
-	pres := packages.NewJSONPresenter(catalog, s, d, scope)
+	pres := formats.ByOption(format.JSONOption).Presenter(catalog, &s, d)
 	err := pres.Present(&buf)
 	if err != nil {
 		return nil, fmt.Errorf("unable to serialize results: %w", err)

internal/anchore/import_package_sbom_test.go

@@ -1,7 +1,6 @@
 package anchore
 
 import (
-	"bytes"
 	"context"
 	"encoding/json"
 	"fmt"
@@ -9,18 +8,16 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/anchore/syft/internal/presenter/packages"
-
-	"github.com/wagoodman/go-progress"
-
-	"github.com/anchore/syft/syft/distro"
-
-	"github.com/docker/docker/pkg/ioutils"
-
 	"github.com/anchore/client-go/pkg/external"
+	syftjsonModel "github.com/anchore/syft/internal/formats/syftjson/model"
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/syft/format"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
+	"github.com/docker/docker/pkg/ioutils"
 	"github.com/go-test/deep"
+	"github.com/wagoodman/go-progress"
 )
 
 func must(c pkg.CPE, e error) pkg.CPE {
@@ -87,20 +84,19 @@ func TestPackageSbomToModel(t *testing.T) {
 		t.Fatalf("unable to marshal model: %+v", err)
 	}
 
-	var buf bytes.Buffer
-	pres := packages.NewJSONPresenter(c, m, &d, source.AllLayersScope)
-	if err := pres.Present(&buf); err != nil {
+	by, err := syft.Encode(c, &m, &d, format.JSONOption)
+	if err != nil {
 		t.Fatalf("unable to get expected json: %+v", err)
 	}
 
 	// unmarshal expected result
-	var expectedDoc packages.JSONDocument
-	if err := json.Unmarshal(buf.Bytes(), &expectedDoc); err != nil {
+	var expectedDoc syftjsonModel.Document
+	if err := json.Unmarshal(by, &expectedDoc); err != nil {
 		t.Fatalf("unable to parse json doc: %+v", err)
 	}
 
 	// unmarshal actual result
-	var actualDoc packages.JSONDocument
+	var actualDoc syftjsonModel.Document
 	if err := json.Unmarshal(modelJSON, &actualDoc); err != nil {
 		t.Fatalf("unable to parse json doc: %+v", err)
 	}

internal/config/application.go

@@ -29,6 +29,7 @@ type parser interface {
 type Application struct {
 	ConfigPath         string             `yaml:",omitempty" json:"configPath"`                                                         // the location where the application config was read from (either from -c or discovered while loading)
 	Output             string             `yaml:"output" json:"output" mapstructure:"output"`                                           // -o, the Presenter hint string to use for report formatting
+	File               string             `yaml:"file" json:"file" mapstructure:"file"`                                                 // --file, the file to write report output to
 	Quiet              bool               `yaml:"quiet" json:"quiet" mapstructure:"quiet"`                                              // -q, indicates to not show any status output to stderr (ETUI or logging UI)
 	CheckForAppUpdate  bool               `yaml:"check-for-app-update" json:"check-for-app-update" mapstructure:"check-for-app-update"` // whether to check for an application update on start up or not
 	Anchore            anchore            `yaml:"anchore" json:"anchore" mapstructure:"anchore"`                                        // options for interacting with Anchore Engine/Enterprise

internal/formats/common/spdxhelpers/description.go

@@ -0,0 +1,14 @@
+package spdxhelpers
+
+import "github.com/anchore/syft/syft/pkg"
+
+func Description(p *pkg.Package) string {
+	switch metadata := p.Metadata.(type) {
+	case pkg.ApkMetadata:
+		return metadata.Description
+	case pkg.NpmPackageJSONMetadata:
+		return metadata.Description
+	default:
+		return ""
+	}
+}

internal/formats/common/spdxhelpers/description_test.go

@@ -0,0 +1,56 @@
+package spdxhelpers
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_Description(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected string
+	}{
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name:     "no metadata",
+			input:    pkg.Package{},
+			expected: "",
+		},
+		{
+			name: "from apk",
+			input: pkg.Package{
+				Metadata: pkg.ApkMetadata{
+					Description: "a description!",
+				},
+			},
+			expected: "a description!",
+		},
+		{
+			name: "from npm",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					Description: "a description!",
+				},
+			},
+			expected: "a description!",
+		},
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name: "empty",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					Homepage: "",
+				},
+			},
+			expected: "",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, Description(&test.input))
+		})
+	}
+}

internal/formats/common/spdxhelpers/download_location.go

@@ -0,0 +1,22 @@
+package spdxhelpers
+
+import "github.com/anchore/syft/syft/pkg"
+
+func DownloadLocation(p *pkg.Package) string {
+	// 3.7: Package Download Location
+	// Cardinality: mandatory, one
+	// NONE if there is no download location whatsoever.
+	// NOASSERTION if:
+	//   (i) the SPDX file creator has attempted to but cannot reach a reasonable objective determination;
+	//   (ii) the SPDX file creator has made no attempt to determine this field; or
+	//   (iii) the SPDX file creator has intentionally provided no information (no meaning should be implied by doing so).
+
+	switch metadata := p.Metadata.(type) {
+	case pkg.ApkMetadata:
+		return NoneIfEmpty(metadata.URL)
+	case pkg.NpmPackageJSONMetadata:
+		return NoneIfEmpty(metadata.URL)
+	default:
+		return "NOASSERTION"
+	}
+}

internal/formats/common/spdxhelpers/download_location_test.go

@@ -0,0 +1,54 @@
+package spdxhelpers
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_DownloadLocation(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected string
+	}{
+		{
+			name:     "no metadata",
+			input:    pkg.Package{},
+			expected: "NOASSERTION",
+		},
+		{
+			name: "from apk",
+			input: pkg.Package{
+				Metadata: pkg.ApkMetadata{
+					URL: "http://a-place.gov",
+				},
+			},
+			expected: "http://a-place.gov",
+		},
+		{
+			name: "from npm",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					URL: "http://a-place.gov",
+				},
+			},
+			expected: "http://a-place.gov",
+		},
+		{
+			name: "empty",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					URL: "",
+				},
+			},
+			expected: "NONE",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, DownloadLocation(&test.input))
+		})
+	}
+}

internal/formats/common/spdxhelpers/external_refs.go

@@ -0,0 +1,50 @@
+package spdxhelpers
+
+import (
+	"github.com/anchore/syft/internal/formats/spdx22json/model"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func ExternalRefs(p *pkg.Package) (externalRefs []model.ExternalRef) {
+	externalRefs = make([]model.ExternalRef, 0)
+	for _, c := range p.CPEs {
+		externalRefs = append(externalRefs, model.ExternalRef{
+			ReferenceCategory: model.SecurityReferenceCategory,
+			ReferenceLocator:  c.BindToFmtString(),
+			ReferenceType:     model.Cpe23ExternalRefType,
+		})
+	}
+
+	if p.PURL != "" {
+		externalRefs = append(externalRefs, model.ExternalRef{
+			ReferenceCategory: model.PackageManagerReferenceCategory,
+			ReferenceLocator:  p.PURL,
+			ReferenceType:     model.PurlExternalRefType,
+		})
+	}
+	return externalRefs
+}
+
+func ExtractPURL(refs []model.ExternalRef) string {
+	for _, r := range refs {
+		if r.ReferenceType == model.PurlExternalRefType {
+			return r.ReferenceLocator
+		}
+	}
+	return ""
+}
+
+func ExtractCPEs(refs []model.ExternalRef) (cpes []pkg.CPE) {
+	for _, r := range refs {
+		if r.ReferenceType == model.Cpe23ExternalRefType {
+			cpe, err := pkg.NewCPE(r.ReferenceLocator)
+			if err != nil {
+				log.Warnf("unable to extract SPDX CPE=%q: %+v", r.ReferenceLocator, err)
+				continue
+			}
+			cpes = append(cpes, cpe)
+		}
+	}
+	return cpes
+}

internal/formats/common/spdxhelpers/external_refs_test.go

@@ -0,0 +1,46 @@
+package spdxhelpers
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/internal/formats/common/testutils"
+	"github.com/anchore/syft/internal/formats/spdx22json/model"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_ExternalRefs(t *testing.T) {
+	testCPE := testutils.MustCPE(pkg.NewCPE("cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*"))
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected []model.ExternalRef
+	}{
+		{
+			name: "cpe + purl",
+			input: pkg.Package{
+				CPEs: []pkg.CPE{
+					testCPE,
+				},
+				PURL: "a-purl",
+			},
+			expected: []model.ExternalRef{
+				{
+					ReferenceCategory: model.SecurityReferenceCategory,
+					ReferenceLocator:  testCPE.BindToFmtString(),
+					ReferenceType:     model.Cpe23ExternalRefType,
+				},
+				{
+					ReferenceCategory: model.PackageManagerReferenceCategory,
+					ReferenceLocator:  "a-purl",
+					ReferenceType:     model.PurlExternalRefType,
+				},
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.ElementsMatch(t, test.expected, ExternalRefs(&test.input))
+		})
+	}
+}

internal/formats/common/spdxhelpers/files.go

@@ -0,0 +1,47 @@
+package spdxhelpers
+
+import (
+	"crypto/sha256"
+	"fmt"
+	"path/filepath"
+
+	"github.com/anchore/syft/internal/formats/spdx22json/model"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func Files(packageSpdxID string, p *pkg.Package) (files []model.File, fileIDs []string, relationships []model.Relationship) {
+	files = make([]model.File, 0)
+	fileIDs = make([]string, 0)
+	relationships = make([]model.Relationship, 0)
+
+	pkgFileOwner, ok := p.Metadata.(pkg.FileOwner)
+	if !ok {
+		return files, fileIDs, relationships
+	}
+
+	for _, ownedFilePath := range pkgFileOwner.OwnedFiles() {
+		baseFileName := filepath.Base(ownedFilePath)
+		pathHash := sha256.Sum256([]byte(ownedFilePath))
+		fileSpdxID := model.ElementID(fmt.Sprintf("File-%s-%x", p.Name, pathHash)).String()
+
+		fileIDs = append(fileIDs, fileSpdxID)
+
+		files = append(files, model.File{
+			FileName: ownedFilePath,
+			Item: model.Item{
+				Element: model.Element{
+					SPDXID: fileSpdxID,
+					Name:   baseFileName,
+				},
+			},
+		})
+
+		relationships = append(relationships, model.Relationship{
+			SpdxElementID:      packageSpdxID,
+			RelationshipType:   model.ContainsRelationship,
+			RelatedSpdxElement: fileSpdxID,
+		})
+	}
+
+	return files, fileIDs, relationships
+}

internal/formats/common/spdxhelpers/homepage.go

@@ -0,0 +1,14 @@
+package spdxhelpers
+
+import "github.com/anchore/syft/syft/pkg"
+
+func Homepage(p *pkg.Package) string {
+	switch metadata := p.Metadata.(type) {
+	case pkg.GemMetadata:
+		return metadata.Homepage
+	case pkg.NpmPackageJSONMetadata:
+		return metadata.Homepage
+	default:
+		return ""
+	}
+}

internal/formats/common/spdxhelpers/homepage_test.go

@@ -0,0 +1,56 @@
+package spdxhelpers
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_Homepage(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected string
+	}{
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name:     "no metadata",
+			input:    pkg.Package{},
+			expected: "",
+		},
+		{
+			name: "from gem",
+			input: pkg.Package{
+				Metadata: pkg.GemMetadata{
+					Homepage: "http://a-place.gov",
+				},
+			},
+			expected: "http://a-place.gov",
+		},
+		{
+			name: "from npm",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					Homepage: "http://a-place.gov",
+				},
+			},
+			expected: "http://a-place.gov",
+		},
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name: "empty",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					Homepage: "",
+				},
+			},
+			expected: "",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, Homepage(&test.input))
+		})
+	}
+}

internal/formats/common/spdxhelpers/license.go

@@ -0,0 +1,37 @@
+package spdxhelpers
+
+import (
+	"strings"
+
+	"github.com/anchore/syft/internal/spdxlicense"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func License(p *pkg.Package) string {
+	// source: https://spdx.github.io/spdx-spec/3-package-information/#313-concluded-license
+	// The options to populate this field are limited to:
+	// A valid SPDX License Expression as defined in Appendix IV;
+	// NONE, if the SPDX file creator concludes there is no license available for this package; or
+	// NOASSERTION if:
+	//   (i) the SPDX file creator has attempted to but cannot reach a reasonable objective determination;
+	//   (ii) the SPDX file creator has made no attempt to determine this field; or
+	//   (iii) the SPDX file creator has intentionally provided no information (no meaning should be implied by doing so).
+
+	if len(p.Licenses) == 0 {
+		return "NONE"
+	}
+
+	// take all licenses and assume an AND expression; for information about license expressions see https://spdx.github.io/spdx-spec/appendix-IV-SPDX-license-expressions/
+	var parsedLicenses []string
+	for _, l := range p.Licenses {
+		if value, exists := spdxlicense.ID(l); exists {
+			parsedLicenses = append(parsedLicenses, value)
+		}
+	}
+
+	if len(parsedLicenses) == 0 {
+		return "NOASSERTION"
+	}
+
+	return strings.Join(parsedLicenses, " AND ")
+}

internal/formats/common/spdxhelpers/license_test.go

@@ -0,0 +1,73 @@
+package spdxhelpers
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_License(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected string
+	}{
+		{
+			name:     "no licenses",
+			input:    pkg.Package{},
+			expected: "NONE",
+		},
+		{
+			name: "no SPDX licenses",
+			input: pkg.Package{
+				Licenses: []string{
+					"made-up",
+				},
+			},
+			expected: "NOASSERTION",
+		},
+		{
+			name: "with SPDX license",
+			input: pkg.Package{
+				Licenses: []string{
+					"MIT",
+				},
+			},
+			expected: "MIT",
+		},
+		{
+			name: "with SPDX license expression",
+			input: pkg.Package{
+				Licenses: []string{
+					"MIT",
+					"GPL-3.0",
+				},
+			},
+			expected: "MIT AND GPL-3.0",
+		},
+		{
+			name: "cap insensitive",
+			input: pkg.Package{
+				Licenses: []string{
+					"gpl-3.0",
+				},
+			},
+			expected: "GPL-3.0",
+		},
+		{
+			name: "debian to spdx conversion",
+			input: pkg.Package{
+				Licenses: []string{
+					"GPL-2",
+				},
+			},
+			expected: "GPL-2.0",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, License(&test.input))
+		})
+	}
+}

internal/formats/common/spdxhelpers/none_if_empty.go

@@ -0,0 +1,12 @@
+package spdxhelpers
+
+import (
+	"strings"
+)
+
+func NoneIfEmpty(value string) string {
+	if strings.TrimSpace(value) == "" {
+		return "NONE"
+	}
+	return value
+}

internal/formats/common/spdxhelpers/none_if_empty_test.go

@@ -0,0 +1,41 @@
+package spdxhelpers
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_noneIfEmpty(t *testing.T) {
+	tests := []struct {
+		name     string
+		value    string
+		expected string
+	}{
+		{
+			name:     "non-zero value",
+			value:    "something",
+			expected: "something",
+		},
+		{
+			name:     "empty",
+			value:    "",
+			expected: "NONE",
+		},
+		{
+			name:     "space",
+			value:    " ",
+			expected: "NONE",
+		},
+		{
+			name:     "tab",
+			value:    "\t",
+			expected: "NONE",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, NoneIfEmpty(test.value))
+		})
+	}
+}

internal/formats/common/spdxhelpers/originator_test.go

@@ -0,0 +1,114 @@
+package spdxhelpers
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_Originator(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected string
+	}{
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name:     "no metadata",
+			input:    pkg.Package{},
+			expected: "",
+		},
+		{
+			name: "from gem",
+			input: pkg.Package{
+				Metadata: pkg.GemMetadata{
+					Authors: []string{
+						"auth1",
+						"auth2",
+					},
+				},
+			},
+			expected: "auth1",
+		},
+		{
+			name: "from npm",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					Author: "auth",
+				},
+			},
+			expected: "auth",
+		},
+		{
+			name: "from apk",
+			input: pkg.Package{
+				Metadata: pkg.ApkMetadata{
+					Maintainer: "auth",
+				},
+			},
+			expected: "auth",
+		},
+		{
+			name: "from python - just name",
+			input: pkg.Package{
+				Metadata: pkg.PythonPackageMetadata{
+					Author: "auth",
+				},
+			},
+			expected: "auth",
+		},
+		{
+			name: "from python - just email",
+			input: pkg.Package{
+				Metadata: pkg.PythonPackageMetadata{
+					AuthorEmail: "auth@auth.gov",
+				},
+			},
+			expected: "auth@auth.gov",
+		},
+		{
+			name: "from python - both name and email",
+			input: pkg.Package{
+				Metadata: pkg.PythonPackageMetadata{
+					Author:      "auth",
+					AuthorEmail: "auth@auth.gov",
+				},
+			},
+			expected: "auth <auth@auth.gov>",
+		},
+		{
+			name: "from rpm",
+			input: pkg.Package{
+				Metadata: pkg.RpmdbMetadata{
+					Vendor: "auth",
+				},
+			},
+			expected: "auth",
+		},
+		{
+			name: "from dpkg",
+			input: pkg.Package{
+				Metadata: pkg.DpkgMetadata{
+					Maintainer: "auth",
+				},
+			},
+			expected: "auth",
+		},
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name: "empty",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					Author: "",
+				},
+			},
+			expected: "",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, Originator(&test.input))
+		})
+	}
+}

internal/formats/common/spdxhelpers/origintor.go

@@ -0,0 +1,36 @@
+package spdxhelpers
+
+import (
+	"fmt"
+
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func Originator(p *pkg.Package) string {
+	switch metadata := p.Metadata.(type) {
+	case pkg.ApkMetadata:
+		return metadata.Maintainer
+	case pkg.NpmPackageJSONMetadata:
+		return metadata.Author
+	case pkg.PythonPackageMetadata:
+		author := metadata.Author
+		if author == "" {
+			return metadata.AuthorEmail
+		}
+		if metadata.AuthorEmail != "" {
+			author += fmt.Sprintf(" <%s>", metadata.AuthorEmail)
+		}
+		return author
+	case pkg.GemMetadata:
+		if len(metadata.Authors) > 0 {
+			return metadata.Authors[0]
+		}
+		return ""
+	case pkg.RpmdbMetadata:
+		return metadata.Vendor
+	case pkg.DpkgMetadata:
+		return metadata.Maintainer
+	default:
+		return ""
+	}
+}

internal/formats/common/spdxhelpers/source_info.go

@@ -0,0 +1,39 @@
+package spdxhelpers
+
+import (
+	"strings"
+
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func SourceInfo(p *pkg.Package) string {
+	answer := ""
+	switch p.Type {
+	case pkg.RpmPkg:
+		answer = "acquired package info from RPM DB"
+	case pkg.ApkPkg:
+		answer = "acquired package info from APK DB"
+	case pkg.DebPkg:
+		answer = "acquired package info from DPKG DB"
+	case pkg.NpmPkg:
+		answer = "acquired package info from installed node module manifest file"
+	case pkg.PythonPkg:
+		answer = "acquired package info from installed python package manifest file"
+	case pkg.JavaPkg, pkg.JenkinsPluginPkg:
+		answer = "acquired package info from installed java archive"
+	case pkg.GemPkg:
+		answer = "acquired package info from installed gem metadata file"
+	case pkg.GoModulePkg:
+		answer = "acquired package info from go module information"
+	case pkg.RustPkg:
+		answer = "acquired package info from rust cargo manifest"
+	default:
+		answer = "acquired package info from the following paths"
+	}
+	var paths []string
+	for _, l := range p.Locations {
+		paths = append(paths, l.RealPath)
+	}
+
+	return answer + ": " + strings.Join(paths, ", ")
+}

internal/formats/common/spdxhelpers/source_info_test.go

@@ -0,0 +1,141 @@
+package spdxhelpers
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_SourceInfo(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected []string
+	}{
+		{
+			name: "locations are captured",
+			input: pkg.Package{
+				// note: no type given
+				Locations: []source.Location{
+					{
+						RealPath:    "/a-place",
+						VirtualPath: "/b-place",
+					},
+					{
+						RealPath:    "/c-place",
+						VirtualPath: "/d-place",
+					},
+				},
+			},
+			expected: []string{
+				"from the following paths",
+				"/a-place",
+				"/c-place",
+			},
+		},
+		{
+			// note: no specific support for this
+			input: pkg.Package{
+				Type: pkg.KbPkg,
+			},
+			expected: []string{
+				"from the following paths",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.RpmPkg,
+			},
+			expected: []string{
+				"from RPM DB",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.ApkPkg,
+			},
+			expected: []string{
+				"from APK DB",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.DebPkg,
+			},
+			expected: []string{
+				"from DPKG DB",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.NpmPkg,
+			},
+			expected: []string{
+				"from installed node module manifest file",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.PythonPkg,
+			},
+			expected: []string{
+				"from installed python package manifest file",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.JavaPkg,
+			},
+			expected: []string{
+				"from installed java archive",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.JenkinsPluginPkg,
+			},
+			expected: []string{
+				"from installed java archive",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.GemPkg,
+			},
+			expected: []string{
+				"from installed gem metadata file",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.GoModulePkg,
+			},
+			expected: []string{
+				"from go module information",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.RustPkg,
+			},
+			expected: []string{
+				"from rust cargo manifest",
+			},
+		},
+	}
+	var pkgTypes []pkg.Type
+	for _, test := range tests {
+		t.Run(test.name+" "+string(test.input.Type), func(t *testing.T) {
+			if test.input.Type != "" {
+				pkgTypes = append(pkgTypes, test.input.Type)
+			}
+			actual := SourceInfo(&test.input)
+			for _, expected := range test.expected {
+				assert.Contains(t, actual, expected)
+			}
+		})
+	}
+	assert.ElementsMatch(t, pkg.AllPkgs, pkgTypes, "missing one or more package types to test against (maybe a package type was added?)")
+}

internal/formats/common/testutils/utils.go

@@ -1,15 +1,16 @@
-package packages
+package testutils
 
 import (
 	"bytes"
 	"testing"
 
+	"github.com/anchore/syft/syft/presenter"
+
 	"github.com/anchore/go-testutils"
 	"github.com/anchore/stereoscope/pkg/filetree"
 	"github.com/anchore/stereoscope/pkg/imagetest"
 	"github.com/anchore/syft/syft/distro"
 	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/presenter"
 	"github.com/anchore/syft/syft/source"
 	"github.com/sergi/go-diff/diffmatchpatch"
 	"github.com/stretchr/testify/assert"
@@ -17,7 +18,14 @@ import (
 
 type redactor func(s []byte) []byte
 
-func assertPresenterAgainstGoldenImageSnapshot(t *testing.T, pres presenter.Presenter, testImage string, updateSnapshot bool, redactors ...redactor) {
+func MustCPE(c pkg.CPE, e error) pkg.CPE {
+	if e != nil {
+		panic(e)
+	}
+	return c
+}
+
+func AssertPresenterAgainstGoldenImageSnapshot(t *testing.T, pres presenter.Presenter, testImage string, updateSnapshot bool, redactors ...redactor) {
 	var buffer bytes.Buffer
 
 	// grab the latest image contents and persist
@@ -50,7 +58,7 @@ func assertPresenterAgainstGoldenImageSnapshot(t *testing.T, pres presenter.Pres
 	}
 }
 
-func assertPresenterAgainstGoldenSnapshot(t *testing.T, pres presenter.Presenter, updateSnapshot bool, redactors ...redactor) {
+func AssertPresenterAgainstGoldenSnapshot(t *testing.T, pres presenter.Presenter, updateSnapshot bool, redactors ...redactor) {
 	var buffer bytes.Buffer
 
 	err := pres.Present(&buffer)
@@ -77,7 +85,7 @@ func assertPresenterAgainstGoldenSnapshot(t *testing.T, pres presenter.Presenter
 	}
 }
 
-func presenterImageInput(t testing.TB, testImage string) (*pkg.Catalog, source.Metadata, *distro.Distro) {
+func ImageInput(t testing.TB, testImage string) (*pkg.Catalog, source.Metadata, *distro.Distro) {
 	t.Helper()
 	catalog := pkg.NewCatalog()
 	img := imagetest.GetGoldenFixtureImage(t, testImage)
@@ -104,7 +112,7 @@ func presenterImageInput(t testing.TB, testImage string) (*pkg.Catalog, source.M
 		},
 		PURL: "a-purl-1",
 		CPEs: []pkg.CPE{
-			must(pkg.NewCPE("cpe:2.3:*:some:package:1:*:*:*:*:*:*:*")),
+			MustCPE(pkg.NewCPE("cpe:2.3:*:some:package:1:*:*:*:*:*:*:*")),
 		},
 	})
 	catalog.Add(pkg.Package{
@@ -123,7 +131,7 @@ func presenterImageInput(t testing.TB, testImage string) (*pkg.Catalog, source.M
 		},
 		PURL: "a-purl-2",
 		CPEs: []pkg.CPE{
-			must(pkg.NewCPE("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*")),
+			MustCPE(pkg.NewCPE("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*")),
 		},
 	})
 
@@ -139,7 +147,7 @@ func presenterImageInput(t testing.TB, testImage string) (*pkg.Catalog, source.M
 	return catalog, src.Metadata, &dist
 }
 
-func presenterDirectoryInput(t testing.TB) (*pkg.Catalog, source.Metadata, *distro.Distro) {
+func DirectoryInput(t testing.TB) (*pkg.Catalog, source.Metadata, *distro.Distro) {
 	catalog := pkg.NewCatalog()
 
 	// populate catalog with test data
@@ -160,13 +168,13 @@ func presenterDirectoryInput(t testing.TB) (*pkg.Catalog, source.Metadata, *dist
 			Version: "1.0.1",
 			Files: []pkg.PythonFileRecord{
 				{
-					Path: "/some/path/pkg1/depedencies/foo",
+					Path: "/some/path/pkg1/dependencies/foo",
 				},
 			},
 		},
 		PURL: "a-purl-2",
 		CPEs: []pkg.CPE{
-			must(pkg.NewCPE("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*")),
+			MustCPE(pkg.NewCPE("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*")),
 		},
 	})
 	catalog.Add(pkg.Package{
@@ -185,7 +193,7 @@ func presenterDirectoryInput(t testing.TB) (*pkg.Catalog, source.Metadata, *dist
 		},
 		PURL: "a-purl-2",
 		CPEs: []pkg.CPE{
-			must(pkg.NewCPE("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*")),
+			MustCPE(pkg.NewCPE("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*")),
 		},
 	})
 

internal/formats/formats.go

@@ -0,0 +1,33 @@
+package formats
+
+import (
+	"github.com/anchore/syft/internal/formats/spdx22json"
+	"github.com/anchore/syft/internal/formats/syftjson"
+	"github.com/anchore/syft/syft/format"
+)
+
+// TODO: eventually this is the source of truth for all formatters
+func All() []format.Format {
+	return []format.Format{
+		spdx22json.Format(),
+		syftjson.Format(),
+	}
+}
+
+func Identify(by []byte) (*format.Format, error) {
+	for _, f := range All() {
+		if f.Detect(by) {
+			return &f, nil
+		}
+	}
+	return nil, nil
+}
+
+func ByOption(option format.Option) *format.Format {
+	for _, f := range All() {
+		if f.Option == option {
+			return &f
+		}
+	}
+	return nil
+}

internal/formats/formats_test.go

@@ -0,0 +1,39 @@
+package formats
+
+import (
+	"io"
+	"os"
+	"testing"
+
+	"github.com/anchore/syft/syft/format"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIdentify(t *testing.T) {
+
+	tests := []struct {
+		fixture  string
+		expected format.Option
+	}{
+		{
+			fixture:  "test-fixtures/alpine-syft.json",
+			expected: format.JSONOption,
+		},
+		{
+			fixture:  "test-fixtures/alpine-syft-spdx.json",
+			expected: format.SPDXJSONOption,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.fixture, func(t *testing.T) {
+			f, err := os.Open(test.fixture)
+			assert.NoError(t, err)
+			by, err := io.ReadAll(f)
+			assert.NoError(t, err)
+			frmt, err := Identify(by)
+			assert.NoError(t, err)
+			assert.NotNil(t, frmt)
+			assert.Equal(t, test.expected, frmt.Option)
+		})
+	}
+}

internal/formats/spdx22json/decoder.go

@@ -0,0 +1,24 @@
+package spdx22json
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+
+	"github.com/anchore/syft/internal/formats/spdx22json/model"
+	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+func decoder(reader io.Reader) (*pkg.Catalog, *source.Metadata, *distro.Distro, error) {
+	dec := json.NewDecoder(reader)
+
+	var doc model.Document
+	err := dec.Decode(&doc)
+	if err != nil {
+		return nil, nil, nil, fmt.Errorf("unable to decode spdx-json: %w", err)
+	}
+
+	return toSyftModel(doc)
+}

internal/formats/spdx22json/decoder_test.go

@@ -0,0 +1,50 @@
+package spdx22json
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+
+	"github.com/anchore/syft/internal/formats/common/testutils"
+	"github.com/go-test/deep"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestEncodeDecodeCycle(t *testing.T) {
+	testImage := "image-simple"
+	originalCatalog, originalMetadata, _ := testutils.ImageInput(t, testImage)
+
+	var buf bytes.Buffer
+	assert.NoError(t, encoder(&buf, originalCatalog, &originalMetadata, nil))
+
+	actualCatalog, actualMetadata, _, err := decoder(bytes.NewReader(buf.Bytes()))
+	assert.NoError(t, err)
+
+	for _, d := range deep.Equal(originalMetadata, *actualMetadata) {
+		t.Errorf("metadata difference: %+v", d)
+	}
+
+	actualPackages := actualCatalog.Sorted()
+	for idx, p := range originalCatalog.Sorted() {
+		if !assert.Equal(t, p.Name, actualPackages[idx].Name) {
+			t.Errorf("different package at idx=%d: %s vs %s", idx, p.Name, actualPackages[idx].Name)
+			continue
+		}
+
+		// ids will never be equal
+		p.ID = ""
+		actualPackages[idx].ID = ""
+
+		for _, d := range deep.Equal(*p, *actualPackages[idx]) {
+			if strings.Contains(d, ".VirtualPath: ") {
+				// location.Virtual path is not exposed in the json output
+				continue
+			}
+			if strings.HasSuffix(d, "<nil slice> != []") {
+				// semantically the same
+				continue
+			}
+			t.Errorf("package difference (%s): %+v", p.Name, d)
+		}
+	}
+}

internal/formats/spdx22json/encoder.go

@@ -0,0 +1,24 @@
+package spdx22json
+
+import (
+	"encoding/json"
+	"io"
+
+	"github.com/anchore/syft/syft/distro"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+const anchoreNamespace = "https://anchore.com/syft"
+
+func encoder(output io.Writer, catalog *pkg.Catalog, srcMetadata *source.Metadata, d *distro.Distro) error {
+	doc := toFormatModel(catalog, srcMetadata, d)
+
+	enc := json.NewEncoder(output)
+	// prevent > and < from being escaped in the payload
+	enc.SetEscapeHTML(false)
+	enc.SetIndent("", " ")
+
+	return enc.Encode(&doc)
+}

internal/formats/spdx22json/encoder_test.go

@@ -1,17 +1,20 @@
-package packages
+package spdx22json
 
 import (
 	"flag"
 	"regexp"
 	"testing"
+
+	"github.com/anchore/syft/internal/formats/common/testutils"
+	"github.com/anchore/syft/syft/format"
 )
 
 var updateSpdxJson = flag.Bool("update-spdx-json", false, "update the *.golden files for spdx-json presenters")
 
 func TestSPDXJSONDirectoryPresenter(t *testing.T) {
-	catalog, metadata, _ := presenterDirectoryInput(t)
-	assertPresenterAgainstGoldenSnapshot(t,
-		NewSPDXJSONPresenter(catalog, metadata),
+	catalog, metadata, distro := testutils.DirectoryInput(t)
+	testutils.AssertPresenterAgainstGoldenSnapshot(t,
+		format.NewPresenter(encoder, catalog, &metadata, distro),
 		*updateSpdxJson,
 		spdxJsonRedactor,
 	)
@@ -19,9 +22,9 @@ func TestSPDXJSONDirectoryPresenter(t *testing.T) {
 
 func TestSPDXJSONImagePresenter(t *testing.T) {
 	testImage := "image-simple"
-	catalog, metadata, _ := presenterImageInput(t, testImage)
-	assertPresenterAgainstGoldenImageSnapshot(t,
-		NewSPDXJSONPresenter(catalog, metadata),
+	catalog, metadata, distro := testutils.ImageInput(t, testImage)
+	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
+		format.NewPresenter(encoder, catalog, &metadata, distro),
 		testImage,
 		*updateSpdxJson,
 		spdxJsonRedactor,
@@ -31,6 +34,10 @@ func TestSPDXJSONImagePresenter(t *testing.T) {
 func spdxJsonRedactor(s []byte) []byte {
 	// each SBOM reports the time it was generated, which is not useful during snapshot testing
 	s = regexp.MustCompile(`"created": .*`).ReplaceAll(s, []byte("redacted"))
+
+	// each SBOM reports a unique documentNamespace when generated, this is not useful for snapshot testing
+	s = regexp.MustCompile(`"documentNamespace": .*`).ReplaceAll(s, []byte("redacted"))
+
 	// the license list will be updated periodically, the value here should not be directly tested in snapshot tests
 	return regexp.MustCompile(`"licenseListVersion": .*`).ReplaceAll(s, []byte("redacted"))
 }

internal/formats/spdx22json/format.go

@@ -0,0 +1,12 @@
+package spdx22json
+
+import "github.com/anchore/syft/syft/format"
+
+func Format() format.Format {
+	return format.NewFormat(
+		format.SPDXJSONOption,
+		encoder,
+		decoder,
+		validator,
+	)
+}

internal/formats/spdx22json/model/annotation.go

@@ -1,4 +1,4 @@
-package spdx22
+package model
 
 import "time"
 

internal/formats/spdx22json/model/checksum.go

@@ -1,4 +1,4 @@
-package spdx22
+package model
 
 type Checksum struct {
 	// Identifies the algorithm used to produce the subject Checksum. One of: "SHA256", "SHA1", "SHA384", "MD2", "MD4", "SHA512", "MD6", "MD5", "SHA224"

internal/formats/spdx22json/model/creation_info.go

@@ -1,4 +1,4 @@
-package spdx22
+package model
 
 import "time"
 

internal/formats/spdx22json/model/document.go

@@ -1,4 +1,6 @@
-package spdx22
+package model
+
+import "github.com/anchore/syft/syft/source"
 
 // derived from:
 // - https://spdx.github.io/spdx-spec/appendix-III-RDF-data-model-implementation-and-identifier-syntax/
@@ -11,6 +13,10 @@ type Document struct {
 	// One instance is required for each SPDX file produced. It provides the necessary information for forward
 	// and backward compatibility for processing tools.
 	CreationInfo CreationInfo `json:"creationInfo"`
+	// SyftSourceData contains information about what is being described in this SPDX document (e.g. a container image, a directory, etc)
+	SyftSourceData *source.Metadata `json:"syftSourceData,omitempty"`
+	// SyftDistroData contains information about the linux distribution discovered
+	SyftDistroData *SyftDistroData `json:"syftDistroData,omitempty"`
 	// 2.2: Data License; should be "CC0-1.0"
 	// Cardinality: mandatory, one
 	// License expression for dataLicense.  Compliance with the SPDX specification includes populating the SPDX

internal/formats/spdx22json/model/element.go

@@ -1,4 +1,4 @@
-package spdx22
+package model
 
 type Element struct {
 	SPDXID string `json:"SPDXID"`

internal/formats/spdx22json/model/element_id.go

@@ -1,4 +1,4 @@
-package spdx22
+package model
 
 // ElementID represents the identifier string portion of an SPDX element
 // identifier. DocElementID should be used for any attributes which can

internal/formats/spdx22json/model/external_document_ref.go

@@ -1,4 +1,4 @@
-package spdx22
+package model
 
 type ExternalDocumentRef struct {
 	// externalDocumentId is a string containing letters, numbers, ., - and/or + which uniquely identifies an external document within this document.

internal/formats/spdx22json/model/external_ref.go

@@ -1,4 +1,4 @@
-package spdx22
+package model
 
 type ReferenceCategory string
 

internal/formats/spdx22json/model/file.go

@@ -1,4 +1,4 @@
-package spdx22
+package model
 
 type FileType string
 

internal/formats/spdx22json/model/has_extracted_licensing_info.go

@@ -1,4 +1,4 @@
-package spdx22
+package model
 
 type HasExtractedLicensingInfo struct {
 	// Verbatim license or licensing notice text that was discovered.

internal/formats/spdx22json/model/item.go

@@ -1,4 +1,4 @@
-package spdx22
+package model
 
 type Item struct {
 	Element

internal/formats/spdx22json/model/package.go

@@ -1,4 +1,4 @@
-package spdx22
+package model
 
 type Package struct {
 	Item
@@ -47,4 +47,7 @@ type Package struct {
 	Supplier string `json:"supplier,omitempty"`
 	// Provides an indication of the version of the package that is described by this SpdxDocument.
 	VersionInfo string `json:"versionInfo,omitempty"`
+	// SyftPackageData provides a spot to add syft-specific data that is not available in-spec or is not easily decodable from
+	// other SPDX fields.
+	SyftPackageData *SyftPackageData `json:"syftPackageData,omitempty"`
 }

internal/formats/spdx22json/model/package_verification_code.go

@@ -1,4 +1,4 @@
-package spdx22
+package model
 
 // Why are there two package identifier fields Package Checksum and Package Verification?
 // Although the values of the two fields Package Checksum and Package Verification are similar, they each serve a

internal/formats/spdx22json/model/relationship.go

@@ -1,4 +1,4 @@
-package spdx22
+package model
 
 type Relationship struct {
 	// Id to which the SPDX element is related

internal/formats/spdx22json/model/snippet.go

@@ -1,4 +1,4 @@
-package spdx22
+package model
 
 type StartPointer struct {
 	Offset     int `json:"offset,omitempty"`

internal/formats/spdx22json/model/syft_distro_data.go

@@ -0,0 +1,7 @@
+package model
+
+type SyftDistroData struct {
+	Name    string `json:"name"`    // Name of the Linux distribution
+	Version string `json:"version"` // Version of the Linux distribution (major or major.minor version)
+	IDLike  string `json:"idLike"`  // the ID_LIKE field found within the /etc/os-release file
+}

internal/formats/spdx22json/model/syft_package_data.go

@@ -0,0 +1,115 @@
+package model
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+type SyftPackageData struct {
+	SyftPackageBasicData
+	SyftPackageCustomData
+}
+
+type SyftPackageCustomData struct {
+	MetadataType pkg.MetadataType `json:"metadataType,omitempty"`
+	Metadata     interface{}      `json:"metadata,omitempty"`
+}
+
+type SyftPackageBasicData struct {
+	PackageType pkg.Type          `json:"type,omitempty"`
+	FoundBy     string            `json:"foundBy,omitempty"`
+	Locations   []source.Location `json:"locations,omitempty"`
+	Licenses    []string          `json:"licenses,omitempty"`
+	Language    pkg.Language      `json:"language,omitempty"`
+}
+
+// syftPackageMetadataUnpacker is all values needed from Package to disambiguate ambiguous fields during json unmarshaling.
+type syftPackageMetadataUnpacker struct {
+	MetadataType pkg.MetadataType `json:"metadataType"`
+	Metadata     json.RawMessage  `json:"metadata"`
+}
+
+func (p *syftPackageMetadataUnpacker) String() string {
+	return fmt.Sprintf("metadataType: %s, metadata: %s", p.MetadataType, string(p.Metadata))
+}
+
+// UnmarshalJSON is a custom unmarshaller for handling basic values and values with ambiguous types.
+// nolint:funlen
+func (p *SyftPackageData) UnmarshalJSON(b []byte) error {
+	var basic SyftPackageBasicData
+	if err := json.Unmarshal(b, &basic); err != nil {
+		return err
+	}
+	p.SyftPackageBasicData = basic
+
+	var unpacker syftPackageMetadataUnpacker
+	if err := json.Unmarshal(b, &unpacker); err != nil {
+		log.Warnf("failed to unmarshall into syftPackageMetadataUnpacker: %v", err)
+		return err
+	}
+
+	p.MetadataType = unpacker.MetadataType
+
+	switch p.MetadataType {
+	case pkg.ApkMetadataType:
+		var payload pkg.ApkMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	case pkg.RpmdbMetadataType:
+		var payload pkg.RpmdbMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	case pkg.DpkgMetadataType:
+		var payload pkg.DpkgMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	case pkg.JavaMetadataType:
+		var payload pkg.JavaMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	case pkg.RustCargoPackageMetadataType:
+		var payload pkg.CargoPackageMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	case pkg.GemMetadataType:
+		var payload pkg.GemMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	case pkg.KbPackageMetadataType:
+		var payload pkg.KbPackageMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	case pkg.PythonPackageMetadataType:
+		var payload pkg.PythonPackageMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	case pkg.NpmPackageJSONMetadataType:
+		var payload pkg.NpmPackageJSONMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	}
+
+	return nil
+}

internal/formats/spdx22json/model/version.go

@@ -1,3 +1,3 @@
-package spdx22
+package model
 
 const Version = "SPDX-2.2"

internal/formats/spdx22json/test-fixtures/image-simple/Dockerfile

@@ -0,0 +1,4 @@
+# Note: changes to this file will result in updating several test values. Consider making a new image fixture instead of editing this one.
+FROM scratch
+ADD file-1.txt /somefile-1.txt
+ADD file-2.txt /somefile-2.txt

internal/formats/spdx22json/test-fixtures/image-simple/file-1.txt

@@ -0,0 +1 @@
+this file has contents

internal/formats/spdx22json/test-fixtures/image-simple/file-2.txt

@@ -0,0 +1 @@
+file-2 contents!

internal/formats/spdx22json/test-fixtures/snapshot/TestSPDXJSONDirectoryPresenter.golden

@@ -3,15 +3,36 @@
  "name": "/some/path",
  "spdxVersion": "SPDX-2.2",
  "creationInfo": {
-  "created": "2021-09-16T20:44:35.198887Z",
+  "created": "2021-10-11T01:54:40.609143Z",
   "creators": [
    "Organization: Anchore, Inc",
    "Tool: syft-[not provided]"
   ],
   "licenseListVersion": "3.14"
  },
+ "syftSourceData": {
+  "Scheme": "DirectoryScheme",
+  "ImageMetadata": {
+   "userInput": "",
+   "imageID": "",
+   "manifestDigest": "",
+   "mediaType": "",
+   "tags": null,
+   "imageSize": 0,
+   "layers": null,
+   "manifest": null,
+   "config": null,
+   "repoDigests": null
+  },
+  "Path": "/some/path"
+ },
+ "syftDistroData": {
+  "name": "debian",
+  "version": "1.2.3",
+  "idLike": "like!"
+ },
  "dataLicense": "CC0-1.0",
- "documentNamespace": "https://anchore.com/syft/image/",
+ "documentNamespace": "https:/anchore.com/syft/dir/some/path-e94d6e43-5de5-4849-8e21-983ada9103c5",
  "packages": [
   {
    "SPDXID": "SPDXRef-Package-python-package-1-1.0.1",
@@ -36,7 +57,35 @@
    ],
    "licenseDeclared": "MIT",
    "sourceInfo": "acquired package info from installed python package manifest file: /some/path/pkg1",
-   "versionInfo": "1.0.1"
+   "versionInfo": "1.0.1",
+   "syftPackageData": {
+    "type": "python",
+    "foundBy": "the-cataloger-1",
+    "locations": [
+     {
+      "path": "/some/path/pkg1"
+     }
+    ],
+    "licenses": [
+     "MIT"
+    ],
+    "language": "python",
+    "metadataType": "PythonPackageMetadata",
+    "metadata": {
+     "name": "package-1",
+     "version": "1.0.1",
+     "license": "",
+     "author": "",
+     "authorEmail": "",
+     "platform": "",
+     "files": [
+      {
+       "path": "/some/path/pkg1/depedencies/foo"
+      }
+     ],
+     "sitePackagesRootPath": ""
+    }
+   }
   },
   {
    "SPDXID": "SPDXRef-Package-deb-package-2-2.0.1",
@@ -58,7 +107,27 @@
    "filesAnalyzed": false,
    "licenseDeclared": "NONE",
    "sourceInfo": "acquired package info from DPKG DB: /some/path/pkg1",
-   "versionInfo": "2.0.1"
+   "versionInfo": "2.0.1",
+   "syftPackageData": {
+    "type": "deb",
+    "foundBy": "the-cataloger-2",
+    "locations": [
+     {
+      "path": "/some/path/pkg1"
+     }
+    ],
+    "metadataType": "DpkgMetadata",
+    "metadata": {
+     "package": "package-2",
+     "source": "",
+     "version": "2.0.1",
+     "sourceVersion": "",
+     "architecture": "",
+     "maintainer": "",
+     "installedSize": 0,
+     "files": null
+    }
+   }
   }
  ],
  "files": [

internal/formats/spdx22json/test-fixtures/snapshot/TestSPDXJSONImagePresenter.golden

@@ -0,0 +1,140 @@
+{
+ "SPDXID": "SPDXRef-DOCUMENT",
+ "name": "user-image-input",
+ "spdxVersion": "SPDX-2.2",
+ "creationInfo": {
+  "created": "2021-10-11T01:54:40.61361Z",
+  "creators": [
+   "Organization: Anchore, Inc",
+   "Tool: syft-[not provided]"
+  ],
+  "licenseListVersion": "3.14"
+ },
+ "syftSourceData": {
+  "Scheme": "ImageScheme",
+  "ImageMetadata": {
+   "userInput": "user-image-input",
+   "imageID": "sha256:2480160b55bec40c44d3b145c7b2c1c47160db8575c3dcae086d76b9370ae7ca",
+   "manifestDigest": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368",
+   "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
+   "tags": [
+    "stereoscope-fixture-image-simple:85066c51088bdd274f7a89e99e00490f666c49e72ffc955707cd6e18f0e22c5b"
+   ],
+   "imageSize": 38,
+   "layers": [
+    {
+     "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
+     "digest": "sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59",
+     "size": 22
+    },
+    {
+     "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
+     "digest": "sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec",
+     "size": 16
+    }
+   ],
+   "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NjcsImRpZ2VzdCI6InNoYTI1NjoyNDgwMTYwYjU1YmVjNDBjNDRkM2IxNDVjN2IyYzFjNDcxNjBkYjg1NzVjM2RjYWUwODZkNzZiOTM3MGFlN2NhIn0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1NjpmYjZiZWVjYjc1YjM5ZjRiYjgxM2RiZjE3N2U1MDFlZGQ1ZGRiM2U2OWJiNDVjZWRlYjc4YzY3NmVlMWI3YTU5In0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2OjMxOWI1ODhjZTY0MjUzYTg3YjUzM2M4ZWQwMWNmMDAyNWUwZWFjOThlN2I1MTZlMTI1MzI5NTdlMTI0NGZkZWMifV19",
+   "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8iLCJPbkJ1aWxkIjpudWxsfSwiY3JlYXRlZCI6IjIwMjEtMTAtMDRUMTE6NDA6MDAuNjM4Mzk0NVoiLCJoaXN0b3J5IjpbeyJjcmVhdGVkIjoiMjAyMS0xMC0wNFQxMTo0MDowMC41OTA3MzE2WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0xLnR4dCAvc29tZWZpbGUtMS50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn0seyJjcmVhdGVkIjoiMjAyMS0xMC0wNFQxMTo0MDowMC42MzgzOTQ1WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0yLnR4dCAvc29tZWZpbGUtMi50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6ZmI2YmVlY2I3NWIzOWY0YmI4MTNkYmYxNzdlNTAxZWRkNWRkYjNlNjliYjQ1Y2VkZWI3OGM2NzZlZTFiN2E1OSIsInNoYTI1NjozMTliNTg4Y2U2NDI1M2E4N2I1MzNjOGVkMDFjZjAwMjVlMGVhYzk4ZTdiNTE2ZTEyNTMyOTU3ZTEyNDRmZGVjIl19fQ==",
+   "repoDigests": []
+  },
+  "Path": ""
+ },
+ "syftDistroData": {
+  "name": "debian",
+  "version": "1.2.3",
+  "idLike": "like!"
+ },
+ "dataLicense": "CC0-1.0",
+ "documentNamespace": "https:/anchore.com/syft/image/user-image-input-9badd1fb-a067-4207-addf-243c5b7705fe",
+ "packages": [
+  {
+   "SPDXID": "SPDXRef-Package-python-package-1-1.0.1",
+   "name": "package-1",
+   "licenseConcluded": "MIT",
+   "downloadLocation": "NOASSERTION",
+   "externalRefs": [
+    {
+     "referenceCategory": "SECURITY",
+     "referenceLocator": "cpe:2.3:*:some:package:1:*:*:*:*:*:*:*",
+     "referenceType": "cpe23Type"
+    },
+    {
+     "referenceCategory": "PACKAGE_MANAGER",
+     "referenceLocator": "a-purl-1",
+     "referenceType": "purl"
+    }
+   ],
+   "filesAnalyzed": false,
+   "licenseDeclared": "MIT",
+   "sourceInfo": "acquired package info from installed python package manifest file: /somefile-1.txt",
+   "versionInfo": "1.0.1",
+   "syftPackageData": {
+    "type": "python",
+    "foundBy": "the-cataloger-1",
+    "locations": [
+     {
+      "path": "/somefile-1.txt",
+      "layerID": "sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59"
+     }
+    ],
+    "licenses": [
+     "MIT"
+    ],
+    "language": "python",
+    "metadataType": "PythonPackageMetadata",
+    "metadata": {
+     "name": "package-1",
+     "version": "1.0.1",
+     "license": "",
+     "author": "",
+     "authorEmail": "",
+     "platform": "",
+     "sitePackagesRootPath": ""
+    }
+   }
+  },
+  {
+   "SPDXID": "SPDXRef-Package-deb-package-2-2.0.1",
+   "name": "package-2",
+   "licenseConcluded": "NONE",
+   "downloadLocation": "NOASSERTION",
+   "externalRefs": [
+    {
+     "referenceCategory": "SECURITY",
+     "referenceLocator": "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*",
+     "referenceType": "cpe23Type"
+    },
+    {
+     "referenceCategory": "PACKAGE_MANAGER",
+     "referenceLocator": "a-purl-2",
+     "referenceType": "purl"
+    }
+   ],
+   "filesAnalyzed": false,
+   "licenseDeclared": "NONE",
+   "sourceInfo": "acquired package info from DPKG DB: /somefile-2.txt",
+   "versionInfo": "2.0.1",
+   "syftPackageData": {
+    "type": "deb",
+    "foundBy": "the-cataloger-2",
+    "locations": [
+     {
+      "path": "/somefile-2.txt",
+      "layerID": "sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec"
+     }
+    ],
+    "metadataType": "DpkgMetadata",
+    "metadata": {
+     "package": "package-2",
+     "source": "",
+     "version": "2.0.1",
+     "sourceVersion": "",
+     "architecture": "",
+     "maintainer": "",
+     "installedSize": 0,
+     "files": null
+    }
+   }
+  }
+ ]
+}

internal/formats/spdx22json/to_format_model.go

@@ -0,0 +1,164 @@
+package spdx22json
+
+import (
+	"fmt"
+	"path"
+	"strings"
+	"time"
+
+	"github.com/anchore/syft/syft/distro"
+
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/formats/common/spdxhelpers"
+	"github.com/anchore/syft/internal/formats/spdx22json/model"
+	"github.com/anchore/syft/internal/spdxlicense"
+	"github.com/anchore/syft/internal/version"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+	"github.com/google/uuid"
+)
+
+// toFormatModel creates and populates a new JSON document struct that follows the SPDX 2.2 spec from the given cataloging results.
+func toFormatModel(catalog *pkg.Catalog, srcMetadata *source.Metadata, d *distro.Distro) model.Document {
+	name := documentName(srcMetadata)
+	packages, files, relationships := extractFromCatalog(catalog)
+
+	return model.Document{
+		Element: model.Element{
+			SPDXID: model.ElementID("DOCUMENT").String(),
+			Name:   name,
+		},
+		SPDXVersion: model.Version,
+		CreationInfo: model.CreationInfo{
+			Created: time.Now().UTC(),
+			Creators: []string{
+				// note: key-value format derived from the JSON example document examples: https://github.com/spdx/spdx-spec/blob/v2.2/examples/SPDXJSONExample-v2.2.spdx.json
+				"Organization: Anchore, Inc",
+				"Tool: " + internal.ApplicationName + "-" + version.FromBuild().Version,
+			},
+			LicenseListVersion: spdxlicense.Version,
+		},
+		DataLicense:       "CC0-1.0",
+		DocumentNamespace: documentNamespace(name, srcMetadata),
+		Packages:          packages,
+		Files:             files,
+		Relationships:     relationships,
+		SyftSourceData:    srcMetadata,
+		SyftDistroData:    toSyftDistroData(d),
+	}
+}
+
+func toSyftDistroData(d *distro.Distro) *model.SyftDistroData {
+	if d == nil {
+		return nil
+	}
+	return &model.SyftDistroData{
+		Name:    d.Name(),
+		Version: d.FullVersion(),
+		IDLike:  d.IDLike,
+	}
+}
+
+func documentName(srcMetadata *source.Metadata) string {
+	if srcMetadata != nil {
+		switch srcMetadata.Scheme {
+		case source.ImageScheme:
+			return cleanSPDXName(srcMetadata.ImageMetadata.UserInput)
+		case source.DirectoryScheme:
+			return cleanSPDXName(srcMetadata.Path)
+		}
+	}
+	// TODO: is this alright?
+	return uuid.Must(uuid.NewRandom()).String()
+}
+
+func documentNamespace(name string, srcMetadata *source.Metadata) string {
+	input := "unknown-source-type"
+	if srcMetadata != nil {
+		switch srcMetadata.Scheme {
+		case source.ImageScheme:
+			input = "image"
+		case source.DirectoryScheme:
+			input = "dir"
+		}
+	}
+
+	uniqueID := uuid.Must(uuid.NewRandom())
+	identifier := path.Join(input, uniqueID.String())
+	if name != "." {
+		identifier = path.Join(input, fmt.Sprintf("%s-%s", name, uniqueID.String()))
+	}
+
+	return path.Join(anchoreNamespace, identifier)
+}
+
+func extractFromCatalog(catalog *pkg.Catalog) ([]model.Package, []model.File, []model.Relationship) {
+	packages := make([]model.Package, 0)
+	relationships := make([]model.Relationship, 0)
+	files := make([]model.File, 0)
+
+	for _, p := range catalog.Sorted() {
+		license := spdxhelpers.License(p)
+		packageSpdxID := model.ElementID(fmt.Sprintf("Package-%+v-%s-%s", p.Type, p.Name, p.Version)).String()
+
+		packageFiles, fileIDs, packageFileRelationships := spdxhelpers.Files(packageSpdxID, p)
+		files = append(files, packageFiles...)
+
+		relationships = append(relationships, packageFileRelationships...)
+
+		// note: the license concluded and declared should be the same since we are collecting license information
+		// from the project data itself (the installed package files).
+		packages = append(packages, model.Package{
+			Description:      spdxhelpers.Description(p),
+			DownloadLocation: spdxhelpers.DownloadLocation(p),
+			ExternalRefs:     spdxhelpers.ExternalRefs(p),
+			FilesAnalyzed:    false,
+			HasFiles:         fileIDs,
+			Homepage:         spdxhelpers.Homepage(p),
+			LicenseDeclared:  license, // The Declared License is what the authors of a project believe govern the package
+			Originator:       spdxhelpers.Originator(p),
+			SourceInfo:       spdxhelpers.SourceInfo(p),
+			VersionInfo:      p.Version,
+			Item: model.Item{
+				LicenseConcluded: license, // The Concluded License field is the license the SPDX file creator believes governs the package
+				Element: model.Element{
+					SPDXID: packageSpdxID,
+					Name:   p.Name,
+				},
+			},
+			SyftPackageData: toSyftPackageData(p),
+		})
+	}
+
+	return packages, files, relationships
+}
+
+func toSyftPackageData(p *pkg.Package) *model.SyftPackageData {
+	if p == nil {
+		return nil
+	}
+	return &model.SyftPackageData{
+		SyftPackageBasicData: model.SyftPackageBasicData{
+			PackageType: p.Type,
+			FoundBy:     p.FoundBy,
+			Locations:   p.Locations,
+			Language:    p.Language,
+			Licenses:    p.Licenses,
+		},
+		SyftPackageCustomData: model.SyftPackageCustomData{
+			MetadataType: p.MetadataType,
+			Metadata:     p.Metadata,
+		},
+	}
+}
+
+func cleanSPDXName(name string) string {
+	// remove # according to specification
+	name = strings.ReplaceAll(name, "#", "-")
+
+	// remove : for url construction
+	name = strings.ReplaceAll(name, ":", "-")
+
+	// clean relative pathing
+	return path.Clean(name)
+}

internal/formats/spdx22json/to_syft_model.go

@@ -0,0 +1,64 @@
+package spdx22json
+
+import (
+	"github.com/anchore/syft/internal/formats/common/spdxhelpers"
+	"github.com/anchore/syft/internal/formats/spdx22json/model"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+func toSyftModel(doc model.Document) (*pkg.Catalog, *source.Metadata, *distro.Distro, error) {
+	d, err := toSyftDistro(doc.SyftDistroData)
+	if err != nil {
+		log.Warnf("unable to parse distro info=%+v: %+v", d, err)
+		d = nil
+	}
+
+	return toSyftCatalog(doc.Packages), doc.SyftSourceData, d, nil
+}
+
+func toSyftCatalog(pkgs []model.Package) *pkg.Catalog {
+	catalog := pkg.NewCatalog()
+	for _, p := range pkgs {
+		catalog.Add(toSyftPackage(p))
+	}
+	return catalog
+}
+
+func toSyftPackage(p model.Package) pkg.Package {
+	syftPkg := pkg.Package{
+		Name:    p.Name,
+		Version: p.VersionInfo,
+		CPEs:    spdxhelpers.ExtractCPEs(p.ExternalRefs),
+		PURL:    spdxhelpers.ExtractPURL(p.ExternalRefs),
+	}
+
+	if extra := p.SyftPackageData; extra != nil {
+		syftPkg.Type = extra.PackageType
+		syftPkg.FoundBy = extra.FoundBy
+		syftPkg.Locations = extra.Locations
+		syftPkg.Language = extra.Language
+		syftPkg.Licenses = extra.Licenses
+		syftPkg.MetadataType = extra.MetadataType
+		syftPkg.Metadata = extra.Metadata
+	}
+
+	//if syftPkg.Type == "" && syftPkg.PURL != "" {
+	//	// TODO: extract package type from purl --this is useful for ingesting from tools other than syft and is important for grype
+	//}
+
+	return syftPkg
+}
+
+func toSyftDistro(d *model.SyftDistroData) (*distro.Distro, error) {
+	if d == nil {
+		return nil, nil
+	}
+	newDistro, err := distro.NewDistro(distro.Type(d.Name), d.Version, d.IDLike)
+	if err != nil {
+		return nil, err
+	}
+	return &newDistro, nil
+}

internal/formats/spdx22json/validator.go

@@ -0,0 +1,26 @@
+package spdx22json
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+)
+
+func validator(reader io.Reader) error {
+	type Document struct {
+		SPDXID string `json:"SPDXID"`
+	}
+
+	dec := json.NewDecoder(reader)
+
+	var doc Document
+	err := dec.Decode(&doc)
+	if err != nil {
+		return fmt.Errorf("unable to decode: %w", err)
+	}
+
+	if doc.SPDXID != "" {
+		return nil
+	}
+	return fmt.Errorf("could not extract document SPDXID")
+}

internal/formats/syftjson/decoder.go

@@ -0,0 +1,24 @@
+package syftjson
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+
+	"github.com/anchore/syft/internal/formats/syftjson/model"
+	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+func decoder(reader io.Reader) (*pkg.Catalog, *source.Metadata, *distro.Distro, error) {
+	dec := json.NewDecoder(reader)
+
+	var doc model.Document
+	err := dec.Decode(&doc)
+	if err != nil {
+		return nil, nil, nil, fmt.Errorf("unable to decode syft-json: %w", err)
+	}
+
+	return toSyftModel(doc)
+}

internal/formats/syftjson/decoder_test.go

@@ -0,0 +1,50 @@
+package syftjson
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+
+	"github.com/anchore/syft/internal/formats/common/testutils"
+	"github.com/go-test/deep"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestEncodeDecodeCycle(t *testing.T) {
+	testImage := "image-simple"
+	originalCatalog, originalMetadata, _ := testutils.ImageInput(t, testImage)
+
+	var buf bytes.Buffer
+	assert.NoError(t, encoder(&buf, originalCatalog, &originalMetadata, nil))
+
+	actualCatalog, actualMetadata, _, err := decoder(bytes.NewReader(buf.Bytes()))
+	assert.NoError(t, err)
+
+	for _, d := range deep.Equal(originalMetadata, *actualMetadata) {
+		t.Errorf("metadata difference: %+v", d)
+	}
+
+	actualPackages := actualCatalog.Sorted()
+	for idx, p := range originalCatalog.Sorted() {
+		if !assert.Equal(t, p.Name, actualPackages[idx].Name) {
+			t.Errorf("different package at idx=%d: %s vs %s", idx, p.Name, actualPackages[idx].Name)
+			continue
+		}
+
+		// ids will never be equal
+		p.ID = ""
+		actualPackages[idx].ID = ""
+
+		for _, d := range deep.Equal(*p, *actualPackages[idx]) {
+			if strings.Contains(d, ".VirtualPath: ") {
+				// location.Virtual path is not exposed in the json output
+				continue
+			}
+			if strings.HasSuffix(d, "<nil slice> != []") {
+				// semantically the same
+				continue
+			}
+			t.Errorf("package difference (%s): %+v", p.Name, d)
+		}
+	}
+}

internal/formats/syftjson/encoder.go

@@ -0,0 +1,23 @@
+package syftjson
+
+import (
+	"encoding/json"
+	"io"
+
+	"github.com/anchore/syft/syft/distro"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+func encoder(output io.Writer, catalog *pkg.Catalog, srcMetadata *source.Metadata, d *distro.Distro) error {
+	// TODO: application config not available yet
+	doc := ToFormatModel(catalog, srcMetadata, d, nil)
+
+	enc := json.NewEncoder(output)
+	// prevent > and < from being escaped in the payload
+	enc.SetEscapeHTML(false)
+	enc.SetIndent("", " ")
+
+	return enc.Encode(&doc)
+}

internal/formats/syftjson/encoder_test.go

@@ -0,0 +1,29 @@
+package syftjson
+
+import (
+	"flag"
+	"testing"
+
+	"github.com/anchore/syft/internal/formats/common/testutils"
+	"github.com/anchore/syft/syft/format"
+)
+
+var updateJson = flag.Bool("update-json", false, "update the *.golden files for json presenters")
+
+func TestJSONDirectoryPresenter(t *testing.T) {
+	catalog, metadata, distro := testutils.DirectoryInput(t)
+	testutils.AssertPresenterAgainstGoldenSnapshot(t,
+		format.NewPresenter(encoder, catalog, &metadata, distro),
+		*updateJson,
+	)
+}
+
+func TestJSONImagePresenter(t *testing.T) {
+	testImage := "image-simple"
+	catalog, metadata, distro := testutils.ImageInput(t, testImage)
+	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
+		format.NewPresenter(encoder, catalog, &metadata, distro),
+		testImage,
+		*updateJson,
+	)
+}

internal/formats/syftjson/format.go

@@ -0,0 +1,12 @@
+package syftjson
+
+import "github.com/anchore/syft/syft/format"
+
+func Format() format.Format {
+	return format.NewFormat(
+		format.JSONOption,
+		encoder,
+		decoder,
+		validator,
+	)
+}

internal/formats/syftjson/model/distro.go

@@ -0,0 +1,8 @@
+package model
+
+// Distro provides information about a detected Linux Distro.
+type Distro struct {
+	Name    string `json:"name"`    // Name of the Linux distribution
+	Version string `json:"version"` // Version of the Linux distribution (major or major.minor version)
+	IDLike  string `json:"idLike"`  // the ID_LIKE field found within the /etc/os-release file
+}

internal/formats/syftjson/model/document.go

@@ -0,0 +1,23 @@
+package model
+
+// Document represents the syft cataloging findings as a JSON document
+type Document struct {
+	Artifacts             []Package      `json:"artifacts"` // Artifacts is the list of packages discovered and placed into the catalog
+	ArtifactRelationships []Relationship `json:"artifactRelationships"`
+	Source                Source         `json:"source"`     // Source represents the original object that was cataloged
+	Distro                Distro         `json:"distro"`     // Distro represents the Linux distribution that was detected from the source
+	Descriptor            Descriptor     `json:"descriptor"` // Descriptor is a block containing self-describing information about syft
+	Schema                Schema         `json:"schema"`     // Schema is a block reserved for defining the version for the shape of this JSON document and where to find the schema document to validate the shape
+}
+
+// Descriptor describes what created the document as well as surrounding metadata
+type Descriptor struct {
+	Name          string      `json:"name"`
+	Version       string      `json:"version"`
+	Configuration interface{} `json:"configuration,omitempty"`
+}
+
+type Schema struct {
+	Version string `json:"version"`
+	URL     string `json:"url"`
+}

internal/formats/syftjson/model/package.go

@@ -0,0 +1,123 @@
+package model
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+// Package represents a pkg.Package object specialized for JSON marshaling and unmarshaling.
+type Package struct {
+	PackageBasicData
+	PackageCustomData
+}
+
+// PackageBasicData contains non-ambiguous values (type-wise) from pkg.Package.
+type PackageBasicData struct {
+	ID        string            `json:"id"`
+	Name      string            `json:"name"`
+	Version   string            `json:"version"`
+	Type      pkg.Type          `json:"type"`
+	FoundBy   string            `json:"foundBy"`
+	Locations []source.Location `json:"locations"`
+	Licenses  []string          `json:"licenses"`
+	Language  pkg.Language      `json:"language"`
+	CPEs      []string          `json:"cpes"`
+	PURL      string            `json:"purl"`
+}
+
+// PackageCustomData contains ambiguous values (type-wise) from pkg.Package.
+type PackageCustomData struct {
+	MetadataType pkg.MetadataType `json:"metadataType"`
+	Metadata     interface{}      `json:"metadata"`
+}
+
+// packageMetadataUnpacker is all values needed from Package to disambiguate ambiguous fields during json unmarshaling.
+type packageMetadataUnpacker struct {
+	MetadataType pkg.MetadataType `json:"metadataType"`
+	Metadata     json.RawMessage  `json:"metadata"`
+}
+
+func (p *packageMetadataUnpacker) String() string {
+	return fmt.Sprintf("metadataType: %s, metadata: %s", p.MetadataType, string(p.Metadata))
+}
+
+// UnmarshalJSON is a custom unmarshaller for handling basic values and values with ambiguous types.
+// nolint:funlen
+func (p *Package) UnmarshalJSON(b []byte) error {
+	var basic PackageBasicData
+	if err := json.Unmarshal(b, &basic); err != nil {
+		return err
+	}
+	p.PackageBasicData = basic
+
+	var unpacker packageMetadataUnpacker
+	if err := json.Unmarshal(b, &unpacker); err != nil {
+		log.Warnf("failed to unmarshall into packageMetadataUnpacker: %v", err)
+		return err
+	}
+
+	p.MetadataType = unpacker.MetadataType
+
+	switch p.MetadataType {
+	case pkg.ApkMetadataType:
+		var payload pkg.ApkMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	case pkg.RpmdbMetadataType:
+		var payload pkg.RpmdbMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	case pkg.DpkgMetadataType:
+		var payload pkg.DpkgMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	case pkg.JavaMetadataType:
+		var payload pkg.JavaMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	case pkg.RustCargoPackageMetadataType:
+		var payload pkg.CargoPackageMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	case pkg.GemMetadataType:
+		var payload pkg.GemMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	case pkg.KbPackageMetadataType:
+		var payload pkg.KbPackageMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	case pkg.PythonPackageMetadataType:
+		var payload pkg.PythonPackageMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	case pkg.NpmPackageJSONMetadataType:
+		var payload pkg.NpmPackageJSONMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	}
+
+	return nil
+}

internal/formats/syftjson/model/relationship.go

@@ -0,0 +1,8 @@
+package model
+
+type Relationship struct {
+	Parent   string      `json:"parent"`
+	Child    string      `json:"child"`
+	Type     string      `json:"type"`
+	Metadata interface{} `json:"metadata"`
+}

internal/formats/syftjson/model/source.go

@@ -0,0 +1,45 @@
+package model
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/anchore/syft/syft/source"
+)
+
+// Source object represents the thing that was cataloged
+type Source struct {
+	Type   string      `json:"type"`
+	Target interface{} `json:"target"`
+}
+
+// sourceUnpacker is used to unmarshal Source objects
+type sourceUnpacker struct {
+	Type   string          `json:"type"`
+	Target json.RawMessage `json:"target"`
+}
+
+// UnmarshalJSON populates a source object from JSON bytes.
+func (s *Source) UnmarshalJSON(b []byte) error {
+	var unpacker sourceUnpacker
+	if err := json.Unmarshal(b, &unpacker); err != nil {
+		return err
+	}
+
+	s.Type = unpacker.Type
+
+	switch s.Type {
+	case "directory":
+		s.Target = string(unpacker.Target[:])
+	case "image":
+		var payload source.ImageMetadata
+		if err := json.Unmarshal(unpacker.Target, &payload); err != nil {
+			return err
+		}
+		s.Target = payload
+	default:
+		return fmt.Errorf("unsupported package metadata type: %+v", s.Type)
+	}
+
+	return nil
+}

internal/formats/syftjson/test-fixtures/image-simple/Dockerfile

@@ -0,0 +1,4 @@
+# Note: changes to this file will result in updating several test values. Consider making a new image fixture instead of editing this one.
+FROM scratch
+ADD file-1.txt /somefile-1.txt
+ADD file-2.txt /somefile-2.txt

internal/formats/syftjson/test-fixtures/image-simple/file-1.txt

@@ -0,0 +1 @@
+this file has contents

internal/formats/syftjson/test-fixtures/image-simple/file-2.txt

@@ -0,0 +1 @@
+file-2 contents!

internal/formats/syftjson/test-fixtures/snapshot/TestJSONDirectoryPresenter.golden

@@ -0,0 +1,86 @@
+{
+ "artifacts": [
+  {
+   "id": "package-1-id",
+   "name": "package-1",
+   "version": "1.0.1",
+   "type": "python",
+   "foundBy": "the-cataloger-1",
+   "locations": [
+    {
+     "path": "/some/path/pkg1"
+    }
+   ],
+   "licenses": [
+    "MIT"
+   ],
+   "language": "python",
+   "cpes": [
+    "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"
+   ],
+   "purl": "a-purl-2",
+   "metadataType": "PythonPackageMetadata",
+   "metadata": {
+    "name": "package-1",
+    "version": "1.0.1",
+    "license": "",
+    "author": "",
+    "authorEmail": "",
+    "platform": "",
+    "files": [
+     {
+      "path": "/some/path/pkg1/depedencies/foo"
+     }
+    ],
+    "sitePackagesRootPath": ""
+   }
+  },
+  {
+   "id": "package-2-id",
+   "name": "package-2",
+   "version": "2.0.1",
+   "type": "deb",
+   "foundBy": "the-cataloger-2",
+   "locations": [
+    {
+     "path": "/some/path/pkg1"
+    }
+   ],
+   "licenses": [],
+   "language": "",
+   "cpes": [
+    "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"
+   ],
+   "purl": "a-purl-2",
+   "metadataType": "DpkgMetadata",
+   "metadata": {
+    "package": "package-2",
+    "source": "",
+    "version": "2.0.1",
+    "sourceVersion": "",
+    "architecture": "",
+    "maintainer": "",
+    "installedSize": 0,
+    "files": null
+   }
+  }
+ ],
+ "artifactRelationships": [],
+ "source": {
+  "type": "directory",
+  "target": "/some/path"
+ },
+ "distro": {
+  "name": "debian",
+  "version": "1.2.3",
+  "idLike": "like!"
+ },
+ "descriptor": {
+  "name": "syft",
+  "version": "[not provided]"
+ },
+ "schema": {
+  "version": "1.1.0",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-1.1.0.json"
+ }
+}

internal/formats/syftjson/test-fixtures/snapshot/TestJSONImagePresenter.golden

@@ -0,0 +1,108 @@
+{
+ "artifacts": [
+  {
+   "id": "package-1-id",
+   "name": "package-1",
+   "version": "1.0.1",
+   "type": "python",
+   "foundBy": "the-cataloger-1",
+   "locations": [
+    {
+     "path": "/somefile-1.txt",
+     "layerID": "sha256:ffb5e9eaa453a002110719d12c294960117ca2903953d1faa40f01dc3f77045c"
+    }
+   ],
+   "licenses": [
+    "MIT"
+   ],
+   "language": "python",
+   "cpes": [
+    "cpe:2.3:*:some:package:1:*:*:*:*:*:*:*"
+   ],
+   "purl": "a-purl-1",
+   "metadataType": "PythonPackageMetadata",
+   "metadata": {
+    "name": "package-1",
+    "version": "1.0.1",
+    "license": "",
+    "author": "",
+    "authorEmail": "",
+    "platform": "",
+    "sitePackagesRootPath": ""
+   }
+  },
+  {
+   "id": "package-2-id",
+   "name": "package-2",
+   "version": "2.0.1",
+   "type": "deb",
+   "foundBy": "the-cataloger-2",
+   "locations": [
+    {
+     "path": "/somefile-2.txt",
+     "layerID": "sha256:8463854829fc53d47b9dcdf7ee79fe7eb4ca7933c910f67f8521412f7a2f5c21"
+    }
+   ],
+   "licenses": [],
+   "language": "",
+   "cpes": [
+    "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"
+   ],
+   "purl": "a-purl-2",
+   "metadataType": "DpkgMetadata",
+   "metadata": {
+    "package": "package-2",
+    "source": "",
+    "version": "2.0.1",
+    "sourceVersion": "",
+    "architecture": "",
+    "maintainer": "",
+    "installedSize": 0,
+    "files": null
+   }
+  }
+ ],
+ "artifactRelationships": [],
+ "source": {
+  "type": "image",
+  "target": {
+   "userInput": "user-image-input",
+   "imageID": "sha256:112851310e48e604f7379e2a3acddab50e91ce926edacb598a532e60ff6b776a",
+   "manifestDigest": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368",
+   "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
+   "tags": [
+    "stereoscope-fixture-image-simple:85066c51088bdd274f7a89e99e00490f666c49e72ffc955707cd6e18f0e22c5b"
+   ],
+   "imageSize": 38,
+   "layers": [
+    {
+     "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
+     "digest": "sha256:ffb5e9eaa453a002110719d12c294960117ca2903953d1faa40f01dc3f77045c",
+     "size": 22
+    },
+    {
+     "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
+     "digest": "sha256:8463854829fc53d47b9dcdf7ee79fe7eb4ca7933c910f67f8521412f7a2f5c21",
+     "size": 16
+    }
+   ],
+   "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NzMsImRpZ2VzdCI6InNoYTI1NjoxMTI4NTEzMTBlNDhlNjA0ZjczNzllMmEzYWNkZGFiNTBlOTFjZTkyNmVkYWNiNTk4YTUzMmU2MGZmNmI3NzZhIn0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1NjpmZmI1ZTllYWE0NTNhMDAyMTEwNzE5ZDEyYzI5NDk2MDExN2NhMjkwMzk1M2QxZmFhNDBmMDFkYzNmNzcwNDVjIn0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2Ojg0NjM4NTQ4MjlmYzUzZDQ3YjlkY2RmN2VlNzlmZTdlYjRjYTc5MzNjOTEwZjY3Zjg1MjE0MTJmN2EyZjVjMjEifV19",
+   "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8iLCJPbkJ1aWxkIjpudWxsfSwiY3JlYXRlZCI6IjIwMjEtMDktMDhUMTc6MjE6NTguODk2NTI5MTkyWiIsImhpc3RvcnkiOlt7ImNyZWF0ZWQiOiIyMDIxLTA5LTA4VDE3OjIxOjU4Ljg3OTY5MDgyNFoiLCJjcmVhdGVkX2J5IjoiQUREIGZpbGUtMS50eHQgL3NvbWVmaWxlLTEudHh0ICMgYnVpbGRraXQiLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCJ9LHsiY3JlYXRlZCI6IjIwMjEtMDktMDhUMTc6MjE6NTguODk2NTI5MTkyWiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0yLnR4dCAvc29tZWZpbGUtMi50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6ZmZiNWU5ZWFhNDUzYTAwMjExMDcxOWQxMmMyOTQ5NjAxMTdjYTI5MDM5NTNkMWZhYTQwZjAxZGMzZjc3MDQ1YyIsInNoYTI1Njo4NDYzODU0ODI5ZmM1M2Q0N2I5ZGNkZjdlZTc5ZmU3ZWI0Y2E3OTMzYzkxMGY2N2Y4NTIxNDEyZjdhMmY1YzIxIl19fQ==",
+   "repoDigests": [],
+   "scope": "Squashed"
+  }
+ },
+ "distro": {
+  "name": "debian",
+  "version": "1.2.3",
+  "idLike": "like!"
+ },
+ "descriptor": {
+  "name": "syft",
+  "version": "[not provided]"
+ },
+ "schema": {
+  "version": "1.1.0",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-1.1.0.json"
+ }
+}

internal/formats/syftjson/to_format_model.go

@@ -0,0 +1,135 @@
+package syftjson
+
+import (
+	"fmt"
+
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/formats/syftjson/model"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/version"
+	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+//// NewJSONDocument creates and populates a new JSON document struct from the given cataloging results.
+//func NewJSONDocument(catalog *pkg.Catalog, srcMetadata source.Metadata, d *distro.Distro, scope source.Scope, configuration interface{}) (Document, error) {
+//
+//}
+
+// TODO: this is export4ed for the use of the power-user command (temp)
+func ToFormatModel(catalog *pkg.Catalog, srcMetadata *source.Metadata, d *distro.Distro, applicationConfig interface{}) model.Document {
+	src, err := toSourceModel(srcMetadata)
+	if err != nil {
+		log.Warnf("unable to create syft-json source object: %+v", err)
+	}
+
+	return model.Document{
+		Artifacts:             toPackageModels(catalog),
+		ArtifactRelationships: toRelationshipModel(pkg.NewRelationships(catalog)),
+		Source:                src,
+		Distro:                toDistroModel(d),
+		Descriptor: model.Descriptor{
+			Name:          internal.ApplicationName,
+			Version:       version.FromBuild().Version,
+			Configuration: applicationConfig,
+		},
+		Schema: model.Schema{
+			Version: internal.JSONSchemaVersion,
+			URL:     fmt.Sprintf("https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-%s.json", internal.JSONSchemaVersion),
+		},
+	}
+}
+
+func toPackageModels(catalog *pkg.Catalog) []model.Package {
+	artifacts := make([]model.Package, 0)
+	if catalog == nil {
+		return artifacts
+	}
+	for _, p := range catalog.Sorted() {
+		artifacts = append(artifacts, toPackageModel(p))
+	}
+	return artifacts
+}
+
+// toPackageModel crates a new Package from the given pkg.Package.
+func toPackageModel(p *pkg.Package) model.Package {
+	var cpes = make([]string, len(p.CPEs))
+	for i, c := range p.CPEs {
+		cpes[i] = c.BindToFmtString()
+	}
+
+	// ensure collections are never nil for presentation reasons
+	var locations = make([]source.Location, 0)
+	if p.Locations != nil {
+		locations = p.Locations
+	}
+
+	var licenses = make([]string, 0)
+	if p.Licenses != nil {
+		licenses = p.Licenses
+	}
+
+	return model.Package{
+		PackageBasicData: model.PackageBasicData{
+			ID:        string(p.ID),
+			Name:      p.Name,
+			Version:   p.Version,
+			Type:      p.Type,
+			FoundBy:   p.FoundBy,
+			Locations: locations,
+			Licenses:  licenses,
+			Language:  p.Language,
+			CPEs:      cpes,
+			PURL:      p.PURL,
+		},
+		PackageCustomData: model.PackageCustomData{
+			MetadataType: p.MetadataType,
+			Metadata:     p.Metadata,
+		},
+	}
+}
+
+func toRelationshipModel(relationships []pkg.Relationship) []model.Relationship {
+	result := make([]model.Relationship, len(relationships))
+	for i, r := range relationships {
+		result[i] = model.Relationship{
+			Parent:   string(r.Parent),
+			Child:    string(r.Child),
+			Type:     string(r.Type),
+			Metadata: r.Metadata,
+		}
+	}
+	return result
+}
+
+// toSourceModel creates a new source object to be represented into JSON.
+func toSourceModel(src *source.Metadata) (model.Source, error) {
+	switch src.Scheme {
+	case source.ImageScheme:
+		return model.Source{
+			Type:   "image",
+			Target: src.ImageMetadata,
+		}, nil
+	case source.DirectoryScheme:
+		return model.Source{
+			Type:   "directory",
+			Target: src.Path,
+		}, nil
+	default:
+		return model.Source{}, fmt.Errorf("unsupported source: %q", src.Scheme)
+	}
+}
+
+// toDistroModel creates a struct with the Linux distribution to be represented in JSON.
+func toDistroModel(d *distro.Distro) model.Distro {
+	if d == nil {
+		return model.Distro{}
+	}
+
+	return model.Distro{
+		Name:    d.Name(),
+		Version: d.FullVersion(),
+		IDLike:  d.IDLike,
+	}
+}

internal/formats/syftjson/to_syft_model.go

@@ -0,0 +1,70 @@
+package syftjson
+
+import (
+	"github.com/anchore/syft/internal/formats/syftjson/model"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+func toSyftModel(doc model.Document) (*pkg.Catalog, *source.Metadata, *distro.Distro, error) {
+	dist, err := distro.NewDistro(distro.Type(doc.Distro.Name), doc.Distro.Version, doc.Distro.IDLike)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+
+	return toSyftCatalog(doc.Artifacts), toSyftSourceMetadata(doc.Source), &dist, nil
+}
+
+func toSyftSourceMetadata(s model.Source) *source.Metadata {
+	switch s.Type {
+	case "directory":
+		return &source.Metadata{
+			Scheme: source.DirectoryScheme,
+			Path:   s.Target.(string),
+		}
+	case "image":
+		return &source.Metadata{
+			Scheme:        source.ImageScheme,
+			ImageMetadata: s.Target.(source.ImageMetadata),
+		}
+	}
+	return nil
+}
+
+func toSyftCatalog(pkgs []model.Package) *pkg.Catalog {
+	catalog := pkg.NewCatalog()
+	for _, p := range pkgs {
+		catalog.Add(toSyftPackage(p))
+	}
+	return catalog
+}
+
+func toSyftPackage(p model.Package) pkg.Package {
+	var cpes []pkg.CPE
+	for _, c := range p.CPEs {
+		value, err := pkg.NewCPE(c)
+		if err != nil {
+			log.Warnf("excluding invalid CPE %q: %v", c, err)
+			continue
+		}
+
+		cpes = append(cpes, value)
+	}
+
+	return pkg.Package{
+		ID:           pkg.ID(p.ID),
+		Name:         p.Name,
+		Version:      p.Version,
+		FoundBy:      p.FoundBy,
+		Locations:    p.Locations,
+		Licenses:     p.Licenses,
+		Language:     p.Language,
+		Type:         p.Type,
+		CPEs:         cpes,
+		PURL:         p.PURL,
+		MetadataType: p.MetadataType,
+		Metadata:     p.Metadata,
+	}
+}

internal/formats/syftjson/validator.go

@@ -0,0 +1,31 @@
+package syftjson
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/anchore/syft/internal/formats/syftjson/model"
+)
+
+func validator(reader io.Reader) error {
+	type Document struct {
+		Schema model.Schema `json:"schema"`
+	}
+
+	dec := json.NewDecoder(reader)
+
+	var doc Document
+	err := dec.Decode(&doc)
+	if err != nil {
+		return fmt.Errorf("unable to decode: %w", err)
+	}
+
+	// note: we accept al schema versions
+	// TODO: add per-schema version parsing
+	if strings.Contains(doc.Schema.URL, "anchore/syft") {
+		return nil
+	}
+	return fmt.Errorf("could not extract syft schema")
+}

internal/presenter/packages/cyclonedx_presenter_test.go

@@ -4,13 +4,15 @@ import (
 	"flag"
 	"regexp"
 	"testing"
+
+	"github.com/anchore/syft/internal/formats/common/testutils"
 )
 
 var updateCycloneDx = flag.Bool("update-cyclonedx", false, "update the *.golden files for cyclone-dx presenters")
 
 func TestCycloneDxDirectoryPresenter(t *testing.T) {
-	catalog, metadata, _ := presenterDirectoryInput(t)
-	assertPresenterAgainstGoldenSnapshot(t,
+	catalog, metadata, _ := testutils.DirectoryInput(t)
+	testutils.AssertPresenterAgainstGoldenSnapshot(t,
 		NewCycloneDxPresenter(catalog, metadata),
 		*updateCycloneDx,
 		cycloneDxRedactor,
@@ -19,8 +21,8 @@ func TestCycloneDxDirectoryPresenter(t *testing.T) {
 
 func TestCycloneDxImagePresenter(t *testing.T) {
 	testImage := "image-simple"
-	catalog, metadata, _ := presenterImageInput(t, testImage)
-	assertPresenterAgainstGoldenImageSnapshot(t,
+	catalog, metadata, _ := testutils.ImageInput(t, testImage)
+	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
 		NewCycloneDxPresenter(catalog, metadata),
 		testImage,
 		*updateCycloneDx,

internal/presenter/packages/json_distribution.go

@@ -1,23 +0,0 @@
-package packages
-
-import "github.com/anchore/syft/syft/distro"
-
-// JSONDistribution provides information about a detected Linux JSONDistribution.
-type JSONDistribution struct {
-	Name    string `json:"name"`    // Name of the Linux distribution
-	Version string `json:"version"` // Version of the Linux distribution (major or major.minor version)
-	IDLike  string `json:"idLike"`  // the ID_LIKE field found within the /etc/os-release file
-}
-
-// NewJSONDistribution creates a struct with the Linux distribution to be represented in JSON.
-func NewJSONDistribution(d *distro.Distro) JSONDistribution {
-	if d == nil {
-		return JSONDistribution{}
-	}
-
-	return JSONDistribution{
-		Name:    d.Name(),
-		Version: d.FullVersion(),
-		IDLike:  d.IDLike,
-	}
-}

internal/presenter/packages/json_document.go

@@ -1,62 +0,0 @@
-package packages
-
-import (
-	"fmt"
-
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/version"
-	"github.com/anchore/syft/syft/distro"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
-)
-
-// JSONDocument represents the syft cataloging findings as a JSON document
-type JSONDocument struct {
-	Artifacts             []JSONPackage      `json:"artifacts"` // Artifacts is the list of packages discovered and placed into the catalog
-	ArtifactRelationships []JSONRelationship `json:"artifactRelationships"`
-	Source                JSONSource         `json:"source"`     // Source represents the original object that was cataloged
-	Distro                JSONDistribution   `json:"distro"`     // Distro represents the Linux distribution that was detected from the source
-	Descriptor            JSONDescriptor     `json:"descriptor"` // Descriptor is a block containing self-describing information about syft
-	Schema                JSONSchema         `json:"schema"`     // Schema is a block reserved for defining the version for the shape of this JSON document and where to find the schema document to validate the shape
-}
-
-// NewJSONDocument creates and populates a new JSON document struct from the given cataloging results.
-func NewJSONDocument(catalog *pkg.Catalog, srcMetadata source.Metadata, d *distro.Distro, scope source.Scope, configuration interface{}) (JSONDocument, error) {
-	src, err := NewJSONSource(srcMetadata, scope)
-	if err != nil {
-		return JSONDocument{}, err
-	}
-
-	artifacts, err := NewJSONPackages(catalog)
-	if err != nil {
-		return JSONDocument{}, err
-	}
-
-	return JSONDocument{
-		Artifacts:             artifacts,
-		ArtifactRelationships: newJSONRelationships(pkg.NewRelationships(catalog)),
-		Source:                src,
-		Distro:                NewJSONDistribution(d),
-		Descriptor: JSONDescriptor{
-			Name:          internal.ApplicationName,
-			Version:       version.FromBuild().Version,
-			Configuration: configuration,
-		},
-		Schema: JSONSchema{
-			Version: internal.JSONSchemaVersion,
-			URL:     fmt.Sprintf("https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-%s.json", internal.JSONSchemaVersion),
-		},
-	}, nil
-}
-
-// JSONDescriptor describes what created the document as well as surrounding metadata
-type JSONDescriptor struct {
-	Name          string      `json:"name"`
-	Version       string      `json:"version"`
-	Configuration interface{} `json:"configuration,omitempty"`
-}
-
-type JSONSchema struct {
-	Version string `json:"version"`
-	URL     string `json:"url"`
-}

internal/presenter/packages/json_package.go

@@ -1,71 +0,0 @@
-package packages
-
-import (
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
-)
-
-// JSONPackage represents a pkg.Package object specialized for JSON marshaling and unmarshaling.
-type JSONPackage struct {
-	ID           string            `json:"id"`
-	Name         string            `json:"name"`
-	Version      string            `json:"version"`
-	Type         string            `json:"type"`
-	FoundBy      string            `json:"foundBy"`
-	Locations    []source.Location `json:"locations"`
-	Licenses     []string          `json:"licenses"`
-	Language     string            `json:"language"`
-	CPEs         []string          `json:"cpes"`
-	PURL         string            `json:"purl"`
-	MetadataType string            `json:"metadataType"`
-	Metadata     interface{}       `json:"metadata"`
-}
-
-func NewJSONPackages(catalog *pkg.Catalog) ([]JSONPackage, error) {
-	artifacts := make([]JSONPackage, 0)
-	if catalog == nil {
-		return artifacts, nil
-	}
-	for _, p := range catalog.Sorted() {
-		art, err := NewJSONPackage(p)
-		if err != nil {
-			return nil, err
-		}
-		artifacts = append(artifacts, art)
-	}
-	return artifacts, nil
-}
-
-// NewJSONPackage crates a new JSONPackage from the given pkg.Package.
-func NewJSONPackage(p *pkg.Package) (JSONPackage, error) {
-	var cpes = make([]string, len(p.CPEs))
-	for i, c := range p.CPEs {
-		cpes[i] = c.BindToFmtString()
-	}
-
-	// ensure collections are never nil for presentation reasons
-	var locations = make([]source.Location, 0)
-	if p.Locations != nil {
-		locations = p.Locations
-	}
-
-	var licenses = make([]string, 0)
-	if p.Licenses != nil {
-		licenses = p.Licenses
-	}
-
-	return JSONPackage{
-		ID:           string(p.ID),
-		Name:         p.Name,
-		Version:      p.Version,
-		Type:         string(p.Type),
-		FoundBy:      p.FoundBy,
-		Locations:    locations,
-		Licenses:     licenses,
-		Language:     string(p.Language),
-		CPEs:         cpes,
-		PURL:         p.PURL,
-		MetadataType: string(p.MetadataType),
-		Metadata:     p.Metadata,
-	}, nil
-}

internal/presenter/packages/json_presenter.go

@@ -1,43 +0,0 @@
-package packages
-
-import (
-	"encoding/json"
-	"io"
-
-	"github.com/anchore/syft/syft/distro"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
-)
-
-// JSONPresenter is a JSON presentation object for the syft results
-type JSONPresenter struct {
-	catalog     *pkg.Catalog
-	srcMetadata source.Metadata
-	distro      *distro.Distro
-	scope       source.Scope
-}
-
-// NewJSONPresenter creates a new JSON presenter object for the given cataloging results.
-func NewJSONPresenter(catalog *pkg.Catalog, s source.Metadata, d *distro.Distro, scope source.Scope) *JSONPresenter {
-	return &JSONPresenter{
-		catalog:     catalog,
-		srcMetadata: s,
-		distro:      d,
-		scope:       scope,
-	}
-}
-
-// Present the catalog results to the given writer.
-func (pres *JSONPresenter) Present(output io.Writer) error {
-	// we do not pass in configuration for backwards compatibility
-	doc, err := NewJSONDocument(pres.catalog, pres.srcMetadata, pres.distro, pres.scope, nil)
-	if err != nil {
-		return err
-	}
-
-	enc := json.NewEncoder(output)
-	// prevent > and < from being escaped in the payload
-	enc.SetEscapeHTML(false)
-	enc.SetIndent("", " ")
-	return enc.Encode(&doc)
-}

internal/presenter/packages/json_presenter_test.go

@@ -1,37 +0,0 @@
-package packages
-
-import (
-	"flag"
-	"testing"
-
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
-)
-
-var updateJSONGoldenFiles = flag.Bool("update-json", false, "update the *.golden files for json presenters")
-
-func must(c pkg.CPE, e error) pkg.CPE {
-	if e != nil {
-		panic(e)
-	}
-	return c
-}
-
-func TestJSONDirectoryPresenter(t *testing.T) {
-	catalog, metadata, dist := presenterDirectoryInput(t)
-	assertPresenterAgainstGoldenSnapshot(t,
-		NewJSONPresenter(catalog, metadata, dist, source.SquashedScope),
-		*updateJSONGoldenFiles,
-	)
-
-}
-
-func TestJSONImagePresenter(t *testing.T) {
-	testImage := "image-simple"
-	catalog, metadata, dist := presenterImageInput(t, testImage)
-	assertPresenterAgainstGoldenImageSnapshot(t,
-		NewJSONPresenter(catalog, metadata, dist, source.SquashedScope),
-		testImage,
-		*updateJSONGoldenFiles,
-	)
-}

internal/presenter/packages/json_relationship.go

@@ -1,23 +0,0 @@
-package packages
-
-import "github.com/anchore/syft/syft/pkg"
-
-type JSONRelationship struct {
-	Parent   string      `json:"parent"`
-	Child    string      `json:"child"`
-	Type     string      `json:"type"`
-	Metadata interface{} `json:"metadata"`
-}
-
-func newJSONRelationships(relationships []pkg.Relationship) []JSONRelationship {
-	result := make([]JSONRelationship, len(relationships))
-	for i, r := range relationships {
-		result[i] = JSONRelationship{
-			Parent:   string(r.Parent),
-			Child:    string(r.Child),
-			Type:     string(r.Type),
-			Metadata: r.Metadata,
-		}
-	}
-	return result
-}

internal/presenter/packages/json_source.go

@@ -1,39 +0,0 @@
-package packages
-
-import (
-	"fmt"
-
-	"github.com/anchore/syft/syft/source"
-)
-
-// JSONSource object represents the thing that was cataloged
-type JSONSource struct {
-	Type   string      `json:"type"`
-	Target interface{} `json:"target"`
-}
-
-type JSONImageSource struct {
-	source.ImageMetadata
-	Scope source.Scope `json:"scope"`
-}
-
-// NewJSONSource creates a new source object to be represented into JSON.
-func NewJSONSource(src source.Metadata, scope source.Scope) (JSONSource, error) {
-	switch src.Scheme {
-	case source.ImageScheme:
-		return JSONSource{
-			Type: "image",
-			Target: JSONImageSource{
-				Scope:         scope,
-				ImageMetadata: src.ImageMetadata,
-			},
-		}, nil
-	case source.DirectoryScheme:
-		return JSONSource{
-			Type:   "directory",
-			Target: src.Path,
-		}, nil
-	default:
-		return JSONSource{}, fmt.Errorf("unsupported source: %q", src.Scheme)
-	}
-}

internal/presenter/packages/spdx_helpers.go

@@ -1,207 +0,0 @@
-package packages
-
-import (
-	"crypto/sha256"
-	"fmt"
-	"path/filepath"
-	"strings"
-
-	"github.com/anchore/syft/internal/presenter/packages/model/spdx22"
-	"github.com/anchore/syft/internal/spdxlicense"
-	"github.com/anchore/syft/syft/pkg"
-)
-
-func getSPDXExternalRefs(p *pkg.Package) (externalRefs []spdx22.ExternalRef) {
-	externalRefs = make([]spdx22.ExternalRef, 0)
-	for _, c := range p.CPEs {
-		externalRefs = append(externalRefs, spdx22.ExternalRef{
-			ReferenceCategory: spdx22.SecurityReferenceCategory,
-			ReferenceLocator:  c.BindToFmtString(),
-			ReferenceType:     spdx22.Cpe23ExternalRefType,
-		})
-	}
-
-	if p.PURL != "" {
-		externalRefs = append(externalRefs, spdx22.ExternalRef{
-			ReferenceCategory: spdx22.PackageManagerReferenceCategory,
-			ReferenceLocator:  p.PURL,
-			ReferenceType:     spdx22.PurlExternalRefType,
-		})
-	}
-	return externalRefs
-}
-
-func getSPDXFiles(packageSpdxID string, p *pkg.Package) (files []spdx22.File, fileIDs []string, relationships []spdx22.Relationship) {
-	files = make([]spdx22.File, 0)
-	fileIDs = make([]string, 0)
-	relationships = make([]spdx22.Relationship, 0)
-
-	pkgFileOwner, ok := p.Metadata.(pkg.FileOwner)
-	if !ok {
-		return files, fileIDs, relationships
-	}
-
-	for _, ownedFilePath := range pkgFileOwner.OwnedFiles() {
-		baseFileName := filepath.Base(ownedFilePath)
-		pathHash := sha256.Sum256([]byte(ownedFilePath))
-		fileSpdxID := spdx22.ElementID(fmt.Sprintf("File-%s-%x", p.Name, pathHash)).String()
-
-		fileIDs = append(fileIDs, fileSpdxID)
-
-		files = append(files, spdx22.File{
-			FileName: ownedFilePath,
-			Item: spdx22.Item{
-				Element: spdx22.Element{
-					SPDXID: fileSpdxID,
-					Name:   baseFileName,
-				},
-			},
-		})
-
-		relationships = append(relationships, spdx22.Relationship{
-			SpdxElementID:      packageSpdxID,
-			RelationshipType:   spdx22.ContainsRelationship,
-			RelatedSpdxElement: fileSpdxID,
-		})
-	}
-
-	return files, fileIDs, relationships
-}
-
-func getSPDXLicense(p *pkg.Package) string {
-	// source: https://spdx.github.io/spdx-spec/3-package-information/#313-concluded-license
-	// The options to populate this field are limited to:
-	// A valid SPDX License Expression as defined in Appendix IV;
-	// NONE, if the SPDX file creator concludes there is no license available for this package; or
-	// NOASSERTION if:
-	//   (i) the SPDX file creator has attempted to but cannot reach a reasonable objective determination;
-	//   (ii) the SPDX file creator has made no attempt to determine this field; or
-	//   (iii) the SPDX file creator has intentionally provided no information (no meaning should be implied by doing so).
-
-	if len(p.Licenses) == 0 {
-		return "NONE"
-	}
-
-	// take all licenses and assume an AND expression; for information about license expressions see https://spdx.github.io/spdx-spec/appendix-IV-SPDX-license-expressions/
-	var parsedLicenses []string
-	for _, l := range p.Licenses {
-		if value, exists := spdxlicense.ID(l); exists {
-			parsedLicenses = append(parsedLicenses, value)
-		}
-	}
-
-	if len(parsedLicenses) == 0 {
-		return "NOASSERTION"
-	}
-
-	return strings.Join(parsedLicenses, " AND ")
-}
-
-func noneIfEmpty(value string) string {
-	if strings.TrimSpace(value) == "" {
-		return "NONE"
-	}
-	return value
-}
-
-func getSPDXDownloadLocation(p *pkg.Package) string {
-	// 3.7: Package Download Location
-	// Cardinality: mandatory, one
-	// NONE if there is no download location whatsoever.
-	// NOASSERTION if:
-	//   (i) the SPDX file creator has attempted to but cannot reach a reasonable objective determination;
-	//   (ii) the SPDX file creator has made no attempt to determine this field; or
-	//   (iii) the SPDX file creator has intentionally provided no information (no meaning should be implied by doing so).
-
-	switch metadata := p.Metadata.(type) {
-	case pkg.ApkMetadata:
-		return noneIfEmpty(metadata.URL)
-	case pkg.NpmPackageJSONMetadata:
-		return noneIfEmpty(metadata.URL)
-	default:
-		return "NOASSERTION"
-	}
-}
-
-func getSPDXHomepage(p *pkg.Package) string {
-	switch metadata := p.Metadata.(type) {
-	case pkg.GemMetadata:
-		return metadata.Homepage
-	case pkg.NpmPackageJSONMetadata:
-		return metadata.Homepage
-	default:
-		return ""
-	}
-}
-
-func getSPDXSourceInfo(p *pkg.Package) string {
-	answer := ""
-	switch p.Type {
-	case pkg.RpmPkg:
-		answer = "acquired package info from RPM DB"
-	case pkg.ApkPkg:
-		answer = "acquired package info from APK DB"
-	case pkg.DebPkg:
-		answer = "acquired package info from DPKG DB"
-	case pkg.NpmPkg:
-		answer = "acquired package info from installed node module manifest file"
-	case pkg.PythonPkg:
-		answer = "acquired package info from installed python package manifest file"
-	case pkg.JavaPkg, pkg.JenkinsPluginPkg:
-		answer = "acquired package info from installed java archive"
-	case pkg.GemPkg:
-		answer = "acquired package info from installed gem metadata file"
-	case pkg.GoModulePkg:
-		answer = "acquired package info from go module information"
-	case pkg.RustPkg:
-		answer = "acquired package info from rust cargo manifest"
-	default:
-		answer = "acquired package info from the following paths"
-	}
-	var paths []string
-	for _, l := range p.Locations {
-		paths = append(paths, l.RealPath)
-	}
-
-	return answer + ": " + strings.Join(paths, ", ")
-}
-
-func getSPDXOriginator(p *pkg.Package) string {
-	switch metadata := p.Metadata.(type) {
-	case pkg.ApkMetadata:
-		return metadata.Maintainer
-	case pkg.NpmPackageJSONMetadata:
-		return metadata.Author
-	case pkg.PythonPackageMetadata:
-		author := metadata.Author
-		if author == "" {
-			return metadata.AuthorEmail
-		}
-		if metadata.AuthorEmail != "" {
-			author += fmt.Sprintf(" <%s>", metadata.AuthorEmail)
-		}
-		return author
-	case pkg.GemMetadata:
-		if len(metadata.Authors) > 0 {
-			return metadata.Authors[0]
-		}
-		return ""
-	case pkg.RpmdbMetadata:
-		return metadata.Vendor
-	case pkg.DpkgMetadata:
-		return metadata.Maintainer
-	default:
-		return ""
-	}
-}
-
-func getSPDXDescription(p *pkg.Package) string {
-	switch metadata := p.Metadata.(type) {
-	case pkg.ApkMetadata:
-		return metadata.Description
-	case pkg.NpmPackageJSONMetadata:
-		return metadata.Description
-	default:
-		return ""
-	}
-}

internal/presenter/packages/spdx_helpers_test.go

@@ -1,518 +0,0 @@
-package packages
-
-import (
-	"testing"
-
-	"github.com/anchore/syft/syft/source"
-
-	"github.com/stretchr/testify/assert"
-
-	"github.com/anchore/syft/internal/presenter/packages/model/spdx22"
-	"github.com/anchore/syft/syft/pkg"
-)
-
-func Test_getSPDXExternalRefs(t *testing.T) {
-	testCPE := must(pkg.NewCPE("cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*"))
-	tests := []struct {
-		name     string
-		input    pkg.Package
-		expected []spdx22.ExternalRef
-	}{
-		{
-			name: "cpe + purl",
-			input: pkg.Package{
-				CPEs: []pkg.CPE{
-					testCPE,
-				},
-				PURL: "a-purl",
-			},
-			expected: []spdx22.ExternalRef{
-				{
-					ReferenceCategory: spdx22.SecurityReferenceCategory,
-					ReferenceLocator:  testCPE.BindToFmtString(),
-					ReferenceType:     spdx22.Cpe23ExternalRefType,
-				},
-				{
-					ReferenceCategory: spdx22.PackageManagerReferenceCategory,
-					ReferenceLocator:  "a-purl",
-					ReferenceType:     spdx22.PurlExternalRefType,
-				},
-			},
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			assert.ElementsMatch(t, test.expected, getSPDXExternalRefs(&test.input))
-		})
-	}
-}
-
-func Test_getSPDXLicense(t *testing.T) {
-	tests := []struct {
-		name     string
-		input    pkg.Package
-		expected string
-	}{
-		{
-			name:     "no licenses",
-			input:    pkg.Package{},
-			expected: "NONE",
-		},
-		{
-			name: "no SPDX licenses",
-			input: pkg.Package{
-				Licenses: []string{
-					"made-up",
-				},
-			},
-			expected: "NOASSERTION",
-		},
-		{
-			name: "with SPDX license",
-			input: pkg.Package{
-				Licenses: []string{
-					"MIT",
-				},
-			},
-			expected: "MIT",
-		},
-		{
-			name: "with SPDX license expression",
-			input: pkg.Package{
-				Licenses: []string{
-					"MIT",
-					"GPL-3.0",
-				},
-			},
-			expected: "MIT AND GPL-3.0",
-		},
-		{
-			name: "cap insensitive",
-			input: pkg.Package{
-				Licenses: []string{
-					"gpl-3.0",
-				},
-			},
-			expected: "GPL-3.0",
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, getSPDXLicense(&test.input))
-		})
-	}
-}
-
-func Test_noneIfEmpty(t *testing.T) {
-	tests := []struct {
-		name     string
-		value    string
-		expected string
-	}{
-		{
-			name:     "non-zero value",
-			value:    "something",
-			expected: "something",
-		},
-		{
-			name:     "empty",
-			value:    "",
-			expected: "NONE",
-		},
-		{
-			name:     "space",
-			value:    " ",
-			expected: "NONE",
-		},
-		{
-			name:     "tab",
-			value:    "\t",
-			expected: "NONE",
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, noneIfEmpty(test.value))
-		})
-	}
-}
-
-func Test_getSPDXDownloadLocation(t *testing.T) {
-	tests := []struct {
-		name     string
-		input    pkg.Package
-		expected string
-	}{
-		{
-			name:     "no metadata",
-			input:    pkg.Package{},
-			expected: "NOASSERTION",
-		},
-		{
-			name: "from apk",
-			input: pkg.Package{
-				Metadata: pkg.ApkMetadata{
-					URL: "http://a-place.gov",
-				},
-			},
-			expected: "http://a-place.gov",
-		},
-		{
-			name: "from npm",
-			input: pkg.Package{
-				Metadata: pkg.NpmPackageJSONMetadata{
-					URL: "http://a-place.gov",
-				},
-			},
-			expected: "http://a-place.gov",
-		},
-		{
-			name: "empty",
-			input: pkg.Package{
-				Metadata: pkg.NpmPackageJSONMetadata{
-					URL: "",
-				},
-			},
-			expected: "NONE",
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, getSPDXDownloadLocation(&test.input))
-		})
-	}
-}
-
-func Test_getSPDXHomepage(t *testing.T) {
-	tests := []struct {
-		name     string
-		input    pkg.Package
-		expected string
-	}{
-		{
-			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
-			name:     "no metadata",
-			input:    pkg.Package{},
-			expected: "",
-		},
-		{
-			name: "from gem",
-			input: pkg.Package{
-				Metadata: pkg.GemMetadata{
-					Homepage: "http://a-place.gov",
-				},
-			},
-			expected: "http://a-place.gov",
-		},
-		{
-			name: "from npm",
-			input: pkg.Package{
-				Metadata: pkg.NpmPackageJSONMetadata{
-					Homepage: "http://a-place.gov",
-				},
-			},
-			expected: "http://a-place.gov",
-		},
-		{
-			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
-			name: "empty",
-			input: pkg.Package{
-				Metadata: pkg.NpmPackageJSONMetadata{
-					Homepage: "",
-				},
-			},
-			expected: "",
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, getSPDXHomepage(&test.input))
-		})
-	}
-}
-
-func Test_getSPDXSourceInfo(t *testing.T) {
-	tests := []struct {
-		name     string
-		input    pkg.Package
-		expected []string
-	}{
-		{
-			name: "locations are captured",
-			input: pkg.Package{
-				// note: no type given
-				Locations: []source.Location{
-					{
-						RealPath:    "/a-place",
-						VirtualPath: "/b-place",
-					},
-					{
-						RealPath:    "/c-place",
-						VirtualPath: "/d-place",
-					},
-				},
-			},
-			expected: []string{
-				"from the following paths",
-				"/a-place",
-				"/c-place",
-			},
-		},
-		{
-			// note: no specific support for this
-			input: pkg.Package{
-				Type: pkg.KbPkg,
-			},
-			expected: []string{
-				"from the following paths",
-			},
-		},
-		{
-			input: pkg.Package{
-				Type: pkg.RpmPkg,
-			},
-			expected: []string{
-				"from RPM DB",
-			},
-		},
-		{
-			input: pkg.Package{
-				Type: pkg.ApkPkg,
-			},
-			expected: []string{
-				"from APK DB",
-			},
-		},
-		{
-			input: pkg.Package{
-				Type: pkg.DebPkg,
-			},
-			expected: []string{
-				"from DPKG DB",
-			},
-		},
-		{
-			input: pkg.Package{
-				Type: pkg.NpmPkg,
-			},
-			expected: []string{
-				"from installed node module manifest file",
-			},
-		},
-		{
-			input: pkg.Package{
-				Type: pkg.PythonPkg,
-			},
-			expected: []string{
-				"from installed python package manifest file",
-			},
-		},
-		{
-			input: pkg.Package{
-				Type: pkg.JavaPkg,
-			},
-			expected: []string{
-				"from installed java archive",
-			},
-		},
-		{
-			input: pkg.Package{
-				Type: pkg.JenkinsPluginPkg,
-			},
-			expected: []string{
-				"from installed java archive",
-			},
-		},
-		{
-			input: pkg.Package{
-				Type: pkg.GemPkg,
-			},
-			expected: []string{
-				"from installed gem metadata file",
-			},
-		},
-		{
-			input: pkg.Package{
-				Type: pkg.GoModulePkg,
-			},
-			expected: []string{
-				"from go module information",
-			},
-		},
-		{
-			input: pkg.Package{
-				Type: pkg.RustPkg,
-			},
-			expected: []string{
-				"from rust cargo manifest",
-			},
-		},
-	}
-	var pkgTypes []pkg.Type
-	for _, test := range tests {
-		t.Run(test.name+" "+string(test.input.Type), func(t *testing.T) {
-			if test.input.Type != "" {
-				pkgTypes = append(pkgTypes, test.input.Type)
-			}
-			actual := getSPDXSourceInfo(&test.input)
-			for _, expected := range test.expected {
-				assert.Contains(t, actual, expected)
-			}
-		})
-	}
-	assert.ElementsMatch(t, pkg.AllPkgs, pkgTypes, "missing one or more package types to test against (maybe a package type was added?)")
-}
-
-func Test_getSPDXOriginator(t *testing.T) {
-	tests := []struct {
-		name     string
-		input    pkg.Package
-		expected string
-	}{
-		{
-			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
-			name:     "no metadata",
-			input:    pkg.Package{},
-			expected: "",
-		},
-		{
-			name: "from gem",
-			input: pkg.Package{
-				Metadata: pkg.GemMetadata{
-					Authors: []string{
-						"auth1",
-						"auth2",
-					},
-				},
-			},
-			expected: "auth1",
-		},
-		{
-			name: "from npm",
-			input: pkg.Package{
-				Metadata: pkg.NpmPackageJSONMetadata{
-					Author: "auth",
-				},
-			},
-			expected: "auth",
-		},
-		{
-			name: "from apk",
-			input: pkg.Package{
-				Metadata: pkg.ApkMetadata{
-					Maintainer: "auth",
-				},
-			},
-			expected: "auth",
-		},
-		{
-			name: "from python - just name",
-			input: pkg.Package{
-				Metadata: pkg.PythonPackageMetadata{
-					Author: "auth",
-				},
-			},
-			expected: "auth",
-		},
-		{
-			name: "from python - just email",
-			input: pkg.Package{
-				Metadata: pkg.PythonPackageMetadata{
-					AuthorEmail: "auth@auth.gov",
-				},
-			},
-			expected: "auth@auth.gov",
-		},
-		{
-			name: "from python - both name and email",
-			input: pkg.Package{
-				Metadata: pkg.PythonPackageMetadata{
-					Author:      "auth",
-					AuthorEmail: "auth@auth.gov",
-				},
-			},
-			expected: "auth <auth@auth.gov>",
-		},
-		{
-			name: "from rpm",
-			input: pkg.Package{
-				Metadata: pkg.RpmdbMetadata{
-					Vendor: "auth",
-				},
-			},
-			expected: "auth",
-		},
-		{
-			name: "from dpkg",
-			input: pkg.Package{
-				Metadata: pkg.DpkgMetadata{
-					Maintainer: "auth",
-				},
-			},
-			expected: "auth",
-		},
-		{
-			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
-			name: "empty",
-			input: pkg.Package{
-				Metadata: pkg.NpmPackageJSONMetadata{
-					Author: "",
-				},
-			},
-			expected: "",
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, getSPDXOriginator(&test.input))
-		})
-	}
-}
-
-func Test_getSPDXDescription(t *testing.T) {
-	tests := []struct {
-		name     string
-		input    pkg.Package
-		expected string
-	}{
-		{
-			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
-			name:     "no metadata",
-			input:    pkg.Package{},
-			expected: "",
-		},
-		{
-			name: "from apk",
-			input: pkg.Package{
-				Metadata: pkg.ApkMetadata{
-					Description: "a description!",
-				},
-			},
-			expected: "a description!",
-		},
-		{
-			name: "from npm",
-			input: pkg.Package{
-				Metadata: pkg.NpmPackageJSONMetadata{
-					Description: "a description!",
-				},
-			},
-			expected: "a description!",
-		},
-		{
-			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
-			name: "empty",
-			input: pkg.Package{
-				Metadata: pkg.NpmPackageJSONMetadata{
-					Homepage: "",
-				},
-			},
-			expected: "",
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, getSPDXDescription(&test.input))
-		})
-	}
-}

internal/presenter/packages/spdx_json_presenter.go

@@ -1,115 +0,0 @@
-package packages
-
-import (
-	"encoding/json"
-	"fmt"
-	"io"
-	"time"
-
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/presenter/packages/model/spdx22"
-	"github.com/anchore/syft/internal/spdxlicense"
-	"github.com/anchore/syft/internal/version"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
-)
-
-// SPDXJsonPresenter is a SPDX presentation object for the syft results (see https://github.com/spdx/spdx-spec)
-type SPDXJsonPresenter struct {
-	catalog     *pkg.Catalog
-	srcMetadata source.Metadata
-}
-
-// NewSPDXJSONPresenter creates a new JSON presenter object for the given cataloging results.
-func NewSPDXJSONPresenter(catalog *pkg.Catalog, srcMetadata source.Metadata) *SPDXJsonPresenter {
-	return &SPDXJsonPresenter{
-		catalog:     catalog,
-		srcMetadata: srcMetadata,
-	}
-}
-
-// Present the catalog results to the given writer.
-func (pres *SPDXJsonPresenter) Present(output io.Writer) error {
-	doc := newSPDXJsonDocument(pres.catalog, pres.srcMetadata)
-
-	enc := json.NewEncoder(output)
-	// prevent > and < from being escaped in the payload
-	enc.SetEscapeHTML(false)
-	enc.SetIndent("", " ")
-	return enc.Encode(&doc)
-}
-
-// newSPDXJsonDocument creates and populates a new JSON document struct that follows the SPDX 2.2 spec from the given cataloging results.
-func newSPDXJsonDocument(catalog *pkg.Catalog, srcMetadata source.Metadata) spdx22.Document {
-	var name string
-	switch srcMetadata.Scheme {
-	case source.ImageScheme:
-		name = srcMetadata.ImageMetadata.UserInput
-	case source.DirectoryScheme:
-		name = srcMetadata.Path
-	}
-
-	packages, files, relationships := newSPDXJsonElements(catalog)
-
-	return spdx22.Document{
-		Element: spdx22.Element{
-			SPDXID: spdx22.ElementID("DOCUMENT").String(),
-			Name:   name,
-		},
-		SPDXVersion: spdx22.Version,
-		CreationInfo: spdx22.CreationInfo{
-			Created: time.Now().UTC(),
-			Creators: []string{
-				// note: key-value format derived from the JSON example document examples: https://github.com/spdx/spdx-spec/blob/v2.2/examples/SPDXJSONExample-v2.2.spdx.json
-				"Organization: Anchore, Inc",
-				"Tool: " + internal.ApplicationName + "-" + version.FromBuild().Version,
-			},
-			LicenseListVersion: spdxlicense.Version,
-		},
-		DataLicense:       "CC0-1.0",
-		DocumentNamespace: fmt.Sprintf("https://anchore.com/syft/image/%s", srcMetadata.ImageMetadata.UserInput),
-		Packages:          packages,
-		Files:             files,
-		Relationships:     relationships,
-	}
-}
-
-func newSPDXJsonElements(catalog *pkg.Catalog) ([]spdx22.Package, []spdx22.File, []spdx22.Relationship) {
-	packages := make([]spdx22.Package, 0)
-	relationships := make([]spdx22.Relationship, 0)
-	files := make([]spdx22.File, 0)
-
-	for _, p := range catalog.Sorted() {
-		license := getSPDXLicense(p)
-		packageSpdxID := spdx22.ElementID(fmt.Sprintf("Package-%+v-%s-%s", p.Type, p.Name, p.Version)).String()
-
-		packageFiles, fileIDs, packageFileRelationships := getSPDXFiles(packageSpdxID, p)
-		files = append(files, packageFiles...)
-
-		relationships = append(relationships, packageFileRelationships...)
-
-		// note: the license concluded and declared should be the same since we are collecting license information
-		// from the project data itself (the installed package files).
-		packages = append(packages, spdx22.Package{
-			Description:      getSPDXDescription(p),
-			DownloadLocation: getSPDXDownloadLocation(p),
-			ExternalRefs:     getSPDXExternalRefs(p),
-			FilesAnalyzed:    false,
-			HasFiles:         fileIDs,
-			Homepage:         getSPDXHomepage(p),
-			LicenseDeclared:  license, // The Declared License is what the authors of a project believe govern the package
-			Originator:       getSPDXOriginator(p),
-			SourceInfo:       getSPDXSourceInfo(p),
-			VersionInfo:      p.Version,
-			Item: spdx22.Item{
-				LicenseConcluded: license, // The Concluded License field is the license the SPDX file creator believes governs the package
-				Element: spdx22.Element{
-					SPDXID: packageSpdxID,
-					Name:   p.Name,
-				},
-			},
-		})
-	}
-
-	return packages, files, relationships
-}

internal/presenter/packages/spdx_tag_value_presenter.go

@@ -5,6 +5,8 @@ import (
 	"io"
 	"time"
 
+	"github.com/anchore/syft/internal/formats/common/spdxhelpers"
+
 	"github.com/anchore/syft/internal/spdxlicense"
 
 	"github.com/anchore/syft/internal"
@@ -114,7 +116,7 @@ func (pres *SPDXTagValuePresenter) packages() map[spdx.ElementID]*spdx.Package2_
 		// If the Concluded License is not the same as the Declared License, a written explanation should be provided
 		// in the Comments on License field (section 3.16). With respect to NOASSERTION, a written explanation in
 		// the Comments on License field (section 3.16) is preferred.
-		license := getSPDXLicense(p)
+		license := spdxhelpers.License(p)
 
 		results[spdx.ElementID(id)] = &spdx.Package2_2{
 
@@ -274,7 +276,7 @@ func (pres *SPDXTagValuePresenter) packages() map[spdx.ElementID]*spdx.Package2_
 }
 
 func formatSPDXExternalRefs(p *pkg.Package) (refs []*spdx.PackageExternalReference2_2) {
-	for _, ref := range getSPDXExternalRefs(p) {
+	for _, ref := range spdxhelpers.ExternalRefs(p) {
 		refs = append(refs, &spdx.PackageExternalReference2_2{
 			Category:           string(ref.ReferenceCategory),
 			RefType:            string(ref.ReferenceType),

internal/presenter/packages/spdx_tag_value_presenter_test.go

@@ -4,13 +4,15 @@ import (
 	"flag"
 	"regexp"
 	"testing"
+
+	"github.com/anchore/syft/internal/formats/common/testutils"
 )
 
 var updateSpdxTagValue = flag.Bool("update-spdx-tv", false, "update the *.golden files for spdx-tv presenters")
 
 func TestSPDXTagValueDirectoryPresenter(t *testing.T) {
-	catalog, metadata, _ := presenterDirectoryInput(t)
-	assertPresenterAgainstGoldenSnapshot(t,
+	catalog, metadata, _ := testutils.DirectoryInput(t)
+	testutils.AssertPresenterAgainstGoldenSnapshot(t,
 		NewSPDXTagValuePresenter(catalog, metadata),
 		*updateSpdxTagValue,
 		spdxTagValueRedactor,
@@ -19,8 +21,8 @@ func TestSPDXTagValueDirectoryPresenter(t *testing.T) {
 
 func TestSPDXTagValueImagePresenter(t *testing.T) {
 	testImage := "image-simple"
-	catalog, metadata, _ := presenterImageInput(t, testImage)
-	assertPresenterAgainstGoldenImageSnapshot(t,
+	catalog, metadata, _ := testutils.ImageInput(t, testImage)
+	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
 		NewSPDXTagValuePresenter(catalog, metadata),
 		testImage,
 		*updateSpdxTagValue,

internal/presenter/packages/table_presenter_test.go

@@ -4,6 +4,8 @@ import (
 	"flag"
 	"testing"
 
+	"github.com/anchore/syft/internal/formats/common/testutils"
+
 	"github.com/go-test/deep"
 )
 
@@ -11,8 +13,8 @@ var updateTablePresenterGoldenFiles = flag.Bool("update-table", false, "update t
 
 func TestTablePresenter(t *testing.T) {
 	testImage := "image-simple"
-	catalog, _, _ := presenterImageInput(t, testImage)
-	assertPresenterAgainstGoldenImageSnapshot(t,
+	catalog, _, _ := testutils.ImageInput(t, testImage)
+	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
 		NewTablePresenter(catalog),
 		testImage,
 		*updateTablePresenterGoldenFiles,