make updates due to linter update

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

.github/scripts/goreleaser-install.sh

@@ -1,405 +0,0 @@
-#!/bin/sh
-set -e
-# Code generated by godownloader on 2019-12-25T12:47:14Z. DO NOT EDIT.
-#
-
-usage() {
-	this=$1
-	cat <<EOF
-$this: download go binaries for goreleaser/goreleaser
-
-Usage: $this [-b] bindir [-d] [tag]
-  -b sets bindir or installation directory, Defaults to ./bin
-  -d turns on debug logging
-   [tag] is a tag from
-   https://github.com/goreleaser/goreleaser/releases
-   If tag is missing, then the latest will be used.
-
- Generated by godownloader
-  https://github.com/goreleaser/godownloader
-
-EOF
-	exit 2
-}
-
-parse_args() {
-	#BINDIR is ./bin unless set be ENV
-	# over-ridden by flag below
-
-	BINDIR=${BINDIR:-./bin}
-	while getopts "b:dh?x" arg; do
-		case "$arg" in
-		b) BINDIR="$OPTARG" ;;
-		d) log_set_priority 10 ;;
-		h | \?) usage "$0" ;;
-		x) set -x ;;
-		esac
-	done
-	shift $((OPTIND - 1))
-	TAG=$1
-}
-# this function wraps all the destructive operations
-# if a curl|bash cuts off the end of the script due to
-# network, either nothing will happen or will syntax error
-# out preventing half-done work
-execute() {
-	tmpdir=$(mktemp -d)
-	log_debug "downloading files into ${tmpdir}"
-	http_download "${tmpdir}/${TARBALL}" "${TARBALL_URL}"
-	http_download "${tmpdir}/${CHECKSUM}" "${CHECKSUM_URL}"
-	hash_sha256_verify "${tmpdir}/${TARBALL}" "${tmpdir}/${CHECKSUM}"
-	srcdir="${tmpdir}"
-	(cd "${tmpdir}" && untar "${TARBALL}")
-	test ! -d "${BINDIR}" && install -d "${BINDIR}"
-	for binexe in $BINARIES; do
-		if [ "$OS" = "windows" ]; then
-			binexe="${binexe}.exe"
-		fi
-		install "${srcdir}/${binexe}" "${BINDIR}/"
-		log_info "installed ${BINDIR}/${binexe}"
-	done
-	rm -rf "${tmpdir}"
-}
-get_binaries() {
-	case "$PLATFORM" in
-	darwin/all) BINARIES="goreleaser" ;;
-	darwin/386) BINARIES="goreleaser" ;;
-	darwin/amd64) BINARIES="goreleaser" ;;
-	darwin/arm64) BINARIES="goreleaser" ;;
-	darwin/armv6) BINARIES="goreleaser" ;;
-	linux/386) BINARIES="goreleaser" ;;
-	linux/amd64) BINARIES="goreleaser" ;;
-	linux/arm64) BINARIES="goreleaser" ;;
-	linux/armv6) BINARIES="goreleaser" ;;
-	windows/386) BINARIES="goreleaser" ;;
-	windows/amd64) BINARIES="goreleaser" ;;
-	windows/arm64) BINARIES="goreleaser" ;;
-	windows/armv6) BINARIES="goreleaser" ;;
-	*)
-		log_crit "platform $PLATFORM is not supported.  Make sure this script is up-to-date and file request at https://github.com/${PREFIX}/issues/new"
-		exit 1
-		;;
-	esac
-}
-tag_to_version() {
-	if [ -z "${TAG}" ]; then
-		log_info "checking GitHub for latest tag"
-	else
-		log_info "checking GitHub for tag '${TAG}'"
-	fi
-	REALTAG=$(github_release "$OWNER/$REPO" "${TAG}") && true
-	if test -z "$REALTAG"; then
-		log_crit "unable to find '${TAG}' - use 'latest' or see https://github.com/${PREFIX}/releases for details"
-		exit 1
-	fi
-	# if version starts with 'v', remove it
-	TAG="$REALTAG"
-	VERSION=${TAG#v}
-}
-adjust_format() {
-	# change format (tar.gz or zip) based on OS
-	case ${OS} in
-	windows) FORMAT=zip ;;
-	esac
-	true
-}
-adjust_os() {
-	# adjust archive name based on OS
-	case ${OS} in
-	386) OS=i386 ;;
-	amd64) OS=x86_64 ;;
-	darwin) OS=Darwin ;;
-	linux) OS=Linux ;;
-	windows) OS=Windows ;;
-	esac
-	true
-}
-adjust_arch() {
-	# adjust archive name based on ARCH
-	case ${ARCH} in
-	386) ARCH=i386 ;;
-	amd64) ARCH=x86_64 ;;
-	darwin) ARCH=Darwin ;;
-	linux) ARCH=Linux ;;
-	windows) ARCH=Windows ;;
-	esac
-	true
-}
-
-cat /dev/null <<EOF
-------------------------------------------------------------------------
-https://github.com/client9/shlib - portable posix shell functions
-Public domain - http://unlicense.org
-https://github.com/client9/shlib/blob/master/LICENSE.md
-but credit (and pull requests) appreciated.
-------------------------------------------------------------------------
-EOF
-is_command() {
-	command -v "$1" >/dev/null
-}
-echoerr() {
-	echo "$@" 1>&2
-}
-log_prefix() {
-	echo "$0"
-}
-_logp=6
-log_set_priority() {
-	_logp="$1"
-}
-log_priority() {
-	if test -z "$1"; then
-		echo "$_logp"
-		return
-	fi
-	[ "$1" -le "$_logp" ]
-}
-log_tag() {
-	case $1 in
-	0) echo "emerg" ;;
-	1) echo "alert" ;;
-	2) echo "crit" ;;
-	3) echo "err" ;;
-	4) echo "warning" ;;
-	5) echo "notice" ;;
-	6) echo "info" ;;
-	7) echo "debug" ;;
-	*) echo "$1" ;;
-	esac
-}
-log_debug() {
-	log_priority 7 || return 0
-	echoerr "$(log_prefix)" "$(log_tag 7)" "$@"
-}
-log_info() {
-	log_priority 6 || return 0
-	echoerr "$(log_prefix)" "$(log_tag 6)" "$@"
-}
-log_err() {
-	log_priority 3 || return 0
-	echoerr "$(log_prefix)" "$(log_tag 3)" "$@"
-}
-log_crit() {
-	log_priority 2 || return 0
-	echoerr "$(log_prefix)" "$(log_tag 2)" "$@"
-}
-uname_os() {
-	os=$(uname -s | tr '[:upper:]' '[:lower:]')
-	case "$os" in
-	cygwin_nt*) os="windows" ;;
-	mingw*) os="windows" ;;
-	msys_nt*) os="windows" ;;
-	esac
-	echo "$os"
-}
-uname_arch() {
-	arch=$(uname -m)
-	case $arch in
-	x86_64) arch="amd64" ;;
-	x86) arch="386" ;;
-	i686) arch="386" ;;
-	i386) arch="386" ;;
-	aarch64) arch="arm64" ;;
-	armv5*) arch="armv5" ;;
-	armv6*) arch="armv6" ;;
-	armv7*) arch="armv7" ;;
-	esac
-	os=$(uname_os)
-	case "$os" in
-	darwin) arch="all" ;;
-	esac
-	echo ${arch}
-}
-uname_os_check() {
-	os=$(uname_os)
-	case "$os" in
-	darwin) return 0 ;;
-	dragonfly) return 0 ;;
-	freebsd) return 0 ;;
-	linux) return 0 ;;
-	android) return 0 ;;
-	nacl) return 0 ;;
-	netbsd) return 0 ;;
-	openbsd) return 0 ;;
-	plan9) return 0 ;;
-	solaris) return 0 ;;
-	windows) return 0 ;;
-	all) return 0 ;;
-	esac
-	log_crit "uname_os_check '$(uname -s)' got converted to '$os' which is not a GOOS value. Please file bug at https://github.com/client9/shlib"
-	return 1
-}
-uname_arch_check() {
-	arch=$(uname_arch)
-	case "$arch" in
-	386) return 0 ;;
-	all) return 0 ;;
-	amd64) return 0 ;;
-	arm64) return 0 ;;
-	armv5) return 0 ;;
-	armv6) return 0 ;;
-	armv7) return 0 ;;
-	ppc64) return 0 ;;
-	ppc64le) return 0 ;;
-	mips) return 0 ;;
-	mipsle) return 0 ;;
-	mips64) return 0 ;;
-	mips64le) return 0 ;;
-	s390x) return 0 ;;
-	amd64p32) return 0 ;;
-	esac
-	log_crit "uname_arch_check '$(uname -m)' got converted to '$arch' which is not a GOARCH value.  Please file bug report at https://github.com/client9/shlib"
-	return 1
-}
-untar() {
-	tarball=$1
-	case "${tarball}" in
-	*.tar.gz | *.tgz) tar --no-same-owner -xzf "${tarball}" ;;
-	*.tar) tar --no-same-owner -xf "${tarball}" ;;
-	*.zip) unzip "${tarball}" ;;
-	*)
-		log_err "untar unknown archive format for ${tarball}"
-		return 1
-		;;
-	esac
-}
-http_download_curl() {
-	local_file=$1
-	source_url=$2
-	header=$3
-	if [ -z "$header" ]; then
-		code=$(curl -w '%{http_code}' -sL -o "$local_file" "$source_url")
-	else
-		code=$(curl -w '%{http_code}' -sL -H "$header" -o "$local_file" "$source_url")
-	fi
-	if [ "$code" != "200" ]; then
-		log_debug "http_download_curl received HTTP status $code"
-		return 1
-	fi
-	return 0
-}
-http_download_wget() {
-	local_file=$1
-	source_url=$2
-	header=$3
-	if [ -z "$header" ]; then
-		wget -q -O "$local_file" "$source_url"
-	else
-		wget -q --header "$header" -O "$local_file" "$source_url"
-	fi
-}
-http_download() {
-	log_debug "http_download $2"
-	if is_command curl; then
-		http_download_curl "$@"
-		return
-	elif is_command wget; then
-		http_download_wget "$@"
-		return
-	fi
-	log_crit "http_download unable to find wget or curl"
-	return 1
-}
-http_copy() {
-	tmp=$(mktemp)
-	http_download "${tmp}" "$1" "$2" || return 1
-	body=$(cat "$tmp")
-	rm -f "${tmp}"
-	echo "$body"
-}
-github_release() {
-	owner_repo=$1
-	version=$2
-	test -z "$version" && version="latest"
-	giturl="https://github.com/${owner_repo}/releases/${version}"
-	json=$(http_copy "$giturl" "Accept:application/json")
-	test -z "$json" && return 1
-	version=$(echo "$json" | tr -s '\n' ' ' | sed 's/.*"tag_name":"//' | sed 's/".*//')
-	test -z "$version" && return 1
-	echo "$version"
-}
-hash_sha256() {
-	TARGET=${1:-/dev/stdin}
-	if is_command gsha256sum; then
-		hash=$(gsha256sum "$TARGET") || return 1
-		echo "$hash" | cut -d ' ' -f 1
-	elif is_command sha256sum; then
-		hash=$(sha256sum "$TARGET") || return 1
-		echo "$hash" | cut -d ' ' -f 1
-	elif is_command shasum; then
-		hash=$(shasum -a 256 "$TARGET" 2>/dev/null) || return 1
-		echo "$hash" | cut -d ' ' -f 1
-	elif is_command openssl; then
-		hash=$(openssl -dst openssl dgst -sha256 "$TARGET") || return 1
-		echo "$hash" | cut -d ' ' -f a
-	else
-		log_crit "hash_sha256 unable to find command to compute sha-256 hash"
-		return 1
-	fi
-}
-hash_sha256_verify() {
-	TARGET=$1
-	checksums=$2
-	if [ -z "$checksums" ]; then
-		log_err "hash_sha256_verify checksum file not specified in arg2"
-		return 1
-	fi
-	BASENAME=${TARGET##*/}
-	want=$(grep "${BASENAME}" "${checksums}" 2>/dev/null | tr '\t' ' ' | cut -d ' ' -f 1)
-	if [ -z "$want" ]; then
-		log_err "hash_sha256_verify unable to find checksum for '${TARGET}' in '${checksums}'"
-		return 1
-	fi
-	got=$(hash_sha256 "$TARGET")
-	if [ "$want" != "$got" ]; then
-		log_err "hash_sha256_verify checksum for '$TARGET' did not verify ${want} vs $got"
-		return 1
-	fi
-}
-cat /dev/null <<EOF
-------------------------------------------------------------------------
-End of functions from https://github.com/client9/shlib
-------------------------------------------------------------------------
-EOF
-
-PROJECT_NAME="goreleaser"
-OWNER=goreleaser
-REPO="goreleaser"
-BINARY=goreleaser
-FORMAT=tar.gz
-OS=$(uname_os)
-ARCH=$(uname_arch)
-PREFIX="$OWNER/$REPO"
-
-# use in logging routines
-log_prefix() {
-	echo "$PREFIX"
-}
-PLATFORM="${OS}/${ARCH}"
-GITHUB_DOWNLOAD=https://github.com/${OWNER}/${REPO}/releases/download
-
-uname_os_check "$OS"
-uname_arch_check "$ARCH"
-
-parse_args "$@"
-
-get_binaries
-
-tag_to_version
-
-adjust_format
-
-adjust_os
-
-adjust_arch
-
-log_info "found version: ${VERSION} for ${TAG}/${OS}/${ARCH}"
-
-NAME=${PROJECT_NAME}_${OS}_${ARCH}
-TARBALL=${NAME}.${FORMAT}
-TARBALL_URL=${GITHUB_DOWNLOAD}/${TAG}/${TARBALL}
-CHECKSUM=checksums.txt
-CHECKSUM_URL=${GITHUB_DOWNLOAD}/${TAG}/${CHECKSUM}
-
-execute
-log_err "this script is deprecated, please do not use it anymore. check https://github.com/goreleaser/godownloader/issues/207"

.golangci.yaml

@@ -4,33 +4,57 @@
 #  include:
 #    - EXC0002 # disable excluding of issues about comments from golint
 
+linters-settings:
+
+  cyclop:
+    # the maximal code complexity to report
+    max-complexity: 15
+
 linters:
   # inverted configuration with `enable-all` and `disable` is not scalable during updates of golangci-lint
   disable-all: true
   enable:
     - asciicheck
     - bodyclose
+    - cyclop
     - deadcode
     - depguard
     - dogsled
     - dupl
+    - durationcheck
     - errcheck
+    - errname
+    - errorlint
     - exportloopref
+    - forbidigo
+    - forcetypeassert
     - funlen
+    - gci
     - gocognit
     - goconst
     - gocritic
     - gocyclo
     - gofmt
+    - gofumpt
     - goimports
+    - gomoddirectives
+    - gomodguard
     - goprintffuncname
     - gosec
     - gosimple
     - govet
+    - ifshort
+    - importas
     - ineffassign
+#    - ireturn   # will be added in 1.43.0 (accept interfaces, return structs)
+    - makezero
     - misspell
     - nakedret
+    - nilerr
+#    - nilnil   # will be added in 1.43.0
     - nolintlint
+    - paralleltest
+    - predeclared
     - revive
     - rowserrcheck
     - staticcheck
@@ -41,21 +65,29 @@ linters:
     - unparam
     - unused
     - varcheck
+    - wastedassign
     - whitespace
+#    - wrapcheck
+
 
 # do not enable...
+#    - exhaustive        # makes to many assumptions about enums and if a switch case should contain all enum instances
+#    - exhaustivestruct  # we like to depend on zero values
 #    - gochecknoglobals
 #    - gochecknoinits    # this is too aggressive
 #    - godot
 #    - godox
-#    - goerr113
-#    - golint      # deprecated
+#    - goerr113    # does not allow use of dynamic errors
+#    - golint      # replaced by revive
 #    - gomnd       # this is too aggressive
 #    - interfacer  # this is a good idea, but is no longer supported and is prone to false positives
 #    - lll         # without a way to specify per-line exception cases, this is not usable
 #    - maligned    # this is an excellent linter, but tricky to optimize and we are not sensitive to memory layout optimizations
-#    - nestif
+#    - nestif      # other complexity linters already cover this well
+#    - nlreturn    # no robust auto-fixers supported
+#    - noctx       # we don't use context a lot
 #    - prealloc    # following this rule isn't consistently a good idea, as it sometimes forces unnecessary allocations that result in less idiomatic code
-#    - scopelint   # deprecated
+#    - scopelint   # replaced by exportloopref
+#    - tagliatelle # too presumptive at which struct tag conventions should be used
 #    - testpackage
-#    - wsl         # this doens't have an auto-fixer yet and is pretty noisy (https://github.com/bombsimon/wsl/issues/90)
+#    - wsl         # very verbose and there is no auto-fixer for this project yet https://github.com/bombsimon/wsl/issues/90

Makefile

@@ -103,7 +103,7 @@ bootstrap-tools: $(TEMPDIR)
 	GO111MODULE=off GOBIN=$(shell realpath $(TEMPDIR)) go get -u golang.org/x/perf/cmd/benchstat
 	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(TEMPDIR)/ v1.42.1
 	curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMPDIR)/ v0.2.0
-	.github/scripts/goreleaser-install.sh -b $(TEMPDIR)/ v0.182.1
+	curl -sfL https://install.goreleaser.com/github.com/goreleaser/goreleaser.sh | sh -s -- -b $(TEMPDIR)/ v0.177.0
 
 .PHONY: bootstrap-go
 bootstrap-go:

README.md

@@ -1,6 +1,4 @@
-<p align="center">
-    <img src="https://user-images.githubusercontent.com/5199289/136844524-1527b09f-c5cb-4aa9-be54-5aa92a6086c1.png" width="271">
-</p>
+# syft
 
 [![Validations](https://github.com/anchore/syft/actions/workflows/validations.yaml/badge.svg)](https://github.com/anchore/syft/actions/workflows/validations.yaml)
 [![Go Report Card](https://goreportcard.com/badge/github.com/anchore/syft)](https://goreportcard.com/report/github.com/anchore/syft)
@@ -11,13 +9,17 @@
 
 A CLI tool and go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Exceptional for vulnerability detection when used with a scanner tool like [Grype](https://github.com/anchore/grype).
 
-**Announcement:** Join us on October 20, 11am-noon PT for a webinar where we’ll discuss Anchore’s open source and enterprise solutions. [Save your seat!](https://get.anchore.com/anchore-open-source-vs-enterprise/)
+## We'll be at KubeCon 2021!
+
+Attending KubeCon 2021 in person? Join us for a meetup on **Tuesday, October 12th**.
+
+We’ll have free swag, giveaways, snacks, and sips. Space will be limited, so make sure to [save your seat](https://get.anchore.com/2021-kubecon-na-opensource-happy-hour/)!
 
 ---
 
 ![syft-demo](https://user-images.githubusercontent.com/590471/90277200-2a253000-de33-11ea-893f-32c219eea11a.gif)
 
-## Features
+**Features**
 - Catalog container images and filesystems to discover packages and libraries.
 - Supports packages and libraries from various ecosystems (APK, DEB, RPM, Ruby Bundles, Python Wheel/Egg/requirements.txt, JavaScript NPM/Yarn, Java JAR/EAR/WAR, Jenkins plugins JPI/HPI, Go modules)
 - Linux distribution identification (supports Alpine, BusyBox, CentOS/RedHat, Debian/Ubuntu flavored distributions)

cmd/cmd.go

@@ -4,14 +4,13 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/spf13/cobra"
-
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/internal/config"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/logger"
 	"github.com/anchore/syft/syft"
 	"github.com/gookit/color"
+	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 	"github.com/wagoodman/go-partybus"
 )
@@ -67,6 +66,7 @@ func initCmdAliasBindings() {
 	}
 }
 
+// nolint:forbidigo
 func initAppConfig() {
 	cfg, err := config.LoadApplicationConfig(viper.GetViper(), persistentOpts)
 	if err != nil {

cmd/completion.go

@@ -8,7 +8,6 @@ import (
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/docker/docker/client"
-
 	"github.com/spf13/cobra"
 )
 
@@ -87,7 +86,7 @@ func dockerImageValidArgsFunction(cmd *cobra.Command, args []string, toComplete
 }
 
 func listLocalDockerImages(prefix string) ([]string, error) {
-	var repoTags = make([]string, 0)
+	repoTags := make([]string, 0)
 	ctx := context.Background()
 	cli, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
 	if err != nil {

cmd/packages.go

@@ -303,7 +303,7 @@ func runPackageSbomUpload(src *source.Source, s source.Metadata, catalog *pkg.Ca
 	}
 
 	if err := c.Import(context.Background(), importCfg); err != nil {
-		return fmt.Errorf("failed to upload results to host=%s: %+v", appConfig.Anchore.Host, err)
+		return fmt.Errorf("failed to upload results to host=%s: %w", appConfig.Anchore.Host, err)
 	}
 	return nil
 }

cmd/report_writer.go

@@ -11,22 +11,18 @@ import (
 
 func reportWriter() (io.Writer, func() error, error) {
 	nop := func() error { return nil }
-	path := strings.TrimSpace(appConfig.File)
 
+	path := strings.TrimSpace(appConfig.File)
 	switch len(path) {
 	case 0:
 		return os.Stdout, nop, nil
-
 	default:
-		reportFile, err := os.OpenFile(path, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0644)
-
+		reportFile, err := os.OpenFile(path, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0o644)
 		if err != nil {
 			return nil, nop, fmt.Errorf("unable to create report file: %w", err)
 		}
-
 		return reportFile, func() error {
 			log.Infof("report written to file=%q", path)
-
 			return reportFile.Close()
 		}, nil
 	}

cmd/root.go

@@ -24,6 +24,7 @@ var rootCmd = &cobra.Command{
 	ValidArgsFunction: packagesCmd.ValidArgsFunction,
 }
 
+// nolint:forbidigo
 func init() {
 	// set universal flags
 	rootCmd.PersistentFlags().StringVarP(&persistentOpts.ConfigPath, "config", "c", "", "application config file")

cmd/version.go

@@ -6,7 +6,6 @@ import (
 	"os"
 
 	"github.com/anchore/syft/internal"
-
 	"github.com/anchore/syft/internal/version"
 	"github.com/spf13/cobra"
 )
@@ -24,6 +23,7 @@ func init() {
 	rootCmd.AddCommand(versionCmd)
 }
 
+// nolint:forbidigo
 func printVersion(_ *cobra.Command, _ []string) {
 	versionInfo := version.FromBuild()
 

go.mod

@@ -18,19 +18,18 @@ require (
 	github.com/dustin/go-humanize v1.0.0
 	github.com/facebookincubator/nvdtools v0.1.4
 	github.com/go-test/deep v1.0.7
-	github.com/google/go-cmp v0.4.1
-	github.com/google/uuid v1.2.0
+	github.com/google/uuid v1.1.1
 	github.com/gookit/color v1.2.7
 	github.com/hashicorp/go-multierror v1.1.0
 	github.com/hashicorp/go-version v1.2.0
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/mitchellh/mapstructure v1.3.1
 	github.com/olekukonko/tablewriter v0.0.4
-	github.com/pelletier/go-toml v1.8.1
+	github.com/pelletier/go-toml v1.8.0
 	github.com/pkg/profile v1.5.0
 	github.com/scylladb/go-set v1.0.2
 	github.com/sergi/go-diff v1.1.0
-	github.com/sirupsen/logrus v1.8.1
+	github.com/sirupsen/logrus v1.6.0
 	github.com/spdx/tools-golang v0.1.0
 	github.com/spf13/afero v1.2.2
 	github.com/spf13/cobra v1.0.1-0.20200909172742-8a63648dd905
@@ -43,8 +42,8 @@ require (
 	github.com/wagoodman/jotframe v0.0.0-20200730190914-3517092dd163
 	github.com/x-cray/logrus-prefixed-formatter v0.5.2
 	github.com/xeipuuv/gojsonschema v1.2.0
+	golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9
 	golang.org/x/mod v0.3.0
 	golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d
-	golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1
-	gopkg.in/yaml.v2 v2.4.0
+	gopkg.in/yaml.v2 v2.3.0
 )

go.sum

@@ -73,6 +73,7 @@ github.com/Azure/go-autorest/autorest/validation v0.1.0/go.mod h1:Ha3z/SqBeaalWQ
 github.com/Azure/go-autorest/autorest/validation v0.2.0/go.mod h1:3EEqHnBxQGHXRYq3HT1WyXAvT7LLY3tl70hw6tQIbjI=
 github.com/Azure/go-autorest/logger v0.1.0/go.mod h1:oExouG+K6PryycPJfVSxi/koC6LSNgds39diKLz7Vrc=
 github.com/Azure/go-autorest/tracing v0.5.0/go.mod h1:r/s2XiOKccPW3HrqB+W0TQzfbtp2fGCgRFtBroKn4Dk=
+github.com/BurntSushi/toml v0.3.1 h1:WXkYYl6Yr3qBf1K79EBnL4mak0OimBfB0XUf9Vl28OQ=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/Djarvur/go-err113 v0.0.0-20200410182137-af658d038157/go.mod h1:4UJr5HIiMZrwgkSPdsjy2uOQExX/WEILpIrO9UPGuXs=
@@ -373,9 +374,8 @@ github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm4
 github.com/google/rpmpack v0.0.0-20191226140753-aa36bfddb3a0/go.mod h1:RaTPr0KUf2K7fnZYLNDrr8rxAamWs3iNywJLtQ2AzBg=
 github.com/google/subcommands v1.0.1/go.mod h1:ZjhPrFU+Olkh9WazFPsl27BQ4UPiG37m3yTrtFlrHVk=
 github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.1.1 h1:Gkbcsh/GbpXz7lPftLA3P6TYMwjCLYm83jiFQZF/3gY=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.2.0 h1:qJYtXnJRWmpe7m/3XlyhrsLrEURqHRM2kxzoxXqyUDs=
-github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/wire v0.3.0/go.mod h1:i1DMg/Lu8Sz5yYl25iOdmc5CT5qusaa+zmRWs16741s=
 github.com/google/wire v0.4.0/go.mod h1:ngWDr9Qvq3yZA10YrxfyGELY/AFWGVpy9c1LTRi1EoU=
 github.com/googleapis/gax-go v2.0.2+incompatible/go.mod h1:SFVmujtThgffbyetf+mdk2eWhX2bMyUtNHzFKcPA9HY=
@@ -479,6 +479,7 @@ github.com/klauspost/cpuid v0.0.0-20180405133222-e7e905edc00e/go.mod h1:Pj4uuM52
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/konsorten/go-windows-terminal-sequences v1.0.3 h1:CE8S1cTafDpPvMhIxNJKvHsGVBgn1xWYf1NbHQhywc8=
 github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
@@ -594,9 +595,8 @@ github.com/opencontainers/runtime-spec v1.0.2/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
+github.com/pelletier/go-toml v1.8.0 h1:Keo9qb7iRJs2voHvunFtuuYFsbWeOBh8/P9v/kVMFtw=
 github.com/pelletier/go-toml v1.8.0/go.mod h1:D6yutnOGMveHEPV7VQOuvI/gXY61bv+9bAOTRnLElKs=
-github.com/pelletier/go-toml v1.8.1 h1:1Nf83orprkJyknT6h7zbuEGUEjcyVlCxSUGTENmNCRM=
-github.com/pelletier/go-toml v1.8.1/go.mod h1:T2/BmBdy8dvIRq1a/8aqjN41wvWlN4lrapLU/GW4pbc=
 github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
 github.com/phayes/checkstyle v0.0.0-20170904204023-bfd46e6a821d/go.mod h1:3OzsM7FXDQlpCiw2j81fOmAwQLnZnLGXVKUzeKQXIAw=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -660,9 +660,8 @@ github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPx
 github.com/sirupsen/logrus v1.3.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
+github.com/sirupsen/logrus v1.6.0 h1:UBcNElsrwanuuMsnGSlYmtmgbb23qDR5dG+6X6Oo89I=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
-github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
-github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
 github.com/smartystreets/assertions v1.0.0 h1:UVQPSSmc3qtTi+zPPkCXvZX9VvW/xT/NsRvKfwY81a8=
 github.com/smartystreets/assertions v1.0.0/go.mod h1:kHHU4qYBaI3q23Pp3VPrmWhuIUrLW/7eUrw0BU5VaoM=
@@ -801,8 +800,9 @@ golang.org/x/crypto v0.0.0-20191002192127-34f69633bfdc/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191206172530-e9b2fee46413/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20200510223506-06a226fb4e37 h1:cg5LA/zNPRzIXIWSCxQW10Rvpy94aQh3LT/ShoCpkHw=
 golang.org/x/crypto v0.0.0-20200510223506-06a226fb4e37/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 h1:psW17arqaxU48Z5kZ0CQnkZWQJsqcURM6tKiBApRjXI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190125153040-c74c464bbbf2/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -944,7 +944,6 @@ golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da h1:b3NXsE2LusjYGGjL5bxEVZZORm/YEFFrWFjR8eFrw/c=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1 h1:v+OssWQX+hTHEmOBgwxdZxK4zHq3yOs8F9J7mk0PY8E=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1139,9 +1138,8 @@ gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=

internal/anchore/import.go

@@ -6,8 +6,6 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/antihax/optional"
-
 	"github.com/anchore/client-go/pkg/external"
 	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/syft/internal/bus"
@@ -15,6 +13,7 @@ import (
 	"github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
+	"github.com/antihax/optional"
 	"github.com/wagoodman/go-partybus"
 	"github.com/wagoodman/go-progress"
 )
@@ -64,7 +63,7 @@ func (c *Client) Import(ctx context.Context, cfg ImportConfig) error {
 	stage.Current = "starting session"
 	startOperation, _, err := c.client.ImportsApi.CreateOperation(authedCtx)
 	if err != nil {
-		var detail = "no details given"
+		detail := "no details given"
 		var openAPIErr external.GenericOpenAPIError
 		if errors.As(err, &openAPIErr) {
 			detail = string(openAPIErr.Body())
@@ -106,7 +105,7 @@ func (c *Client) Import(ctx context.Context, cfg ImportConfig) error {
 
 	_, _, err = c.client.ImagesApi.AddImage(authedCtx, imageModel, &opts)
 	if err != nil {
-		var detail = "no details given"
+		detail := "no details given"
 		var openAPIErr external.GenericOpenAPIError
 		if errors.As(err, &openAPIErr) {
 			detail = string(openAPIErr.Body())
@@ -122,7 +121,7 @@ func (c *Client) Import(ctx context.Context, cfg ImportConfig) error {
 }
 
 func addImageModel(imageMetadata image.Metadata, packageDigest, manifestDigest, dockerfileDigest, configDigest, sessionID string) external.ImageAnalysisRequest {
-	var tags = make([]string, len(imageMetadata.Tags))
+	tags := make([]string, len(imageMetadata.Tags))
 	for i, t := range imageMetadata.Tags {
 		tags[i] = t.String()
 	}

internal/anchore/import_config.go

@@ -8,10 +8,9 @@ import (
 	"fmt"
 	"net/http"
 
-	"github.com/wagoodman/go-progress"
-
 	"github.com/anchore/client-go/pkg/external"
 	"github.com/anchore/syft/internal/log"
+	"github.com/wagoodman/go-progress"
 )
 
 type configImportAPI interface {

internal/anchore/import_dockerfile.go

@@ -6,11 +6,9 @@ import (
 	"fmt"
 	"net/http"
 
-	"github.com/wagoodman/go-progress"
-
-	"github.com/anchore/syft/internal/log"
-
 	"github.com/anchore/client-go/pkg/external"
+	"github.com/anchore/syft/internal/log"
+	"github.com/wagoodman/go-progress"
 )
 
 type dockerfileImportAPI interface {

internal/anchore/import_manifest.go

@@ -8,10 +8,9 @@ import (
 	"fmt"
 	"net/http"
 
-	"github.com/wagoodman/go-progress"
-
 	"github.com/anchore/client-go/pkg/external"
 	"github.com/anchore/syft/internal/log"
+	"github.com/wagoodman/go-progress"
 )
 
 type manifestImportAPI interface {

internal/anchore/import_package_sbom.go

@@ -8,16 +8,13 @@ import (
 	"fmt"
 	"net/http"
 
-	"github.com/anchore/syft/internal/presenter/packages"
-
-	"github.com/wagoodman/go-progress"
-
-	"github.com/anchore/syft/syft/distro"
-	"github.com/anchore/syft/syft/source"
-
 	"github.com/anchore/client-go/pkg/external"
 	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/presenter/packages"
+	"github.com/anchore/syft/syft/distro"
 	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+	"github.com/wagoodman/go-progress"
 )
 
 type packageSBOMImportAPI interface {

internal/bus/bus.go

@@ -15,8 +15,10 @@ package bus
 
 import "github.com/wagoodman/go-partybus"
 
-var publisher partybus.Publisher
-var active bool
+var (
+	publisher partybus.Publisher
+	active    bool
+)
 
 // SetPublisher sets the singleton event bus publisher. This is optional; if no bus is provided, the library will
 // behave no differently than if a bus had been provided.

internal/config/application.go

@@ -89,43 +89,10 @@ func (cfg Application) loadDefaultValues(v *viper.Viper) {
 	}
 }
 
+// build inflates simple config values into syft native objects (or other complex objects) after the config is fully read in.
 func (cfg *Application) parseConfigValues() error {
-	// parse application config options
-	for _, optionFn := range []func() error{
-		cfg.parseUploadOptions,
-		cfg.parseLogLevelOption,
-	} {
-		if err := optionFn(); err != nil {
-			return err
-		}
-	}
-
-	// parse nested config options
-	// for each field in the configuration struct, see if the field implements the parser interface
-	// note: the app config is a pointer, so we need to grab the elements explicitly (to traverse the address)
-	value := reflect.ValueOf(cfg).Elem()
-	for i := 0; i < value.NumField(); i++ {
-		// note: since the interface method of parser is a pointer receiver we need to get the value of the field as a pointer.
-		if parsable, ok := value.Field(i).Addr().Interface().(parser); ok {
-			// the field implements parser, call it
-			if err := parsable.parseConfigValues(); err != nil {
-				return err
-			}
-		}
-	}
-	return nil
-}
-
-func (cfg *Application) parseUploadOptions() error {
-	if cfg.Anchore.Host == "" && cfg.Anchore.Dockerfile != "" {
-		return fmt.Errorf("cannot provide dockerfile option without enabling upload")
-	}
-	return nil
-}
-
-func (cfg *Application) parseLogLevelOption() error {
 	if cfg.Quiet {
-		// TODO: this is bad: quiet option trumps all other logging options (such as to a file on disk)
+		// TODO: this is bad: quiet option trumps all other logging options
 		// we should be able to quiet the console logging and leave file logging alone...
 		// ... this will be an enhancement for later
 		cfg.Log.LevelOpt = logrus.PanicLevel
@@ -149,17 +116,34 @@ func (cfg *Application) parseLogLevelOption() error {
 			case v >= 2:
 				cfg.Log.LevelOpt = logrus.DebugLevel
 			default:
-				cfg.Log.LevelOpt = logrus.ErrorLevel
+				cfg.Log.LevelOpt = logrus.WarnLevel
 			}
 		}
 	}
+
+	if cfg.Anchore.Host == "" && cfg.Anchore.Dockerfile != "" {
+		return fmt.Errorf("cannot provide dockerfile option without enabling upload")
+	}
+
+	// for each field in the configuration struct, see if the field implements the parser interface
+	// note: the app config is a pointer, so we need to grab the elements explicitly (to traverse the address)
+	value := reflect.ValueOf(cfg).Elem()
+	for i := 0; i < value.NumField(); i++ {
+		// note: since the interface method of parser is a pointer receiver we need to get the value of the field as a pointer.
+		if parsable, ok := value.Field(i).Addr().Interface().(parser); ok {
+			// the field implements parser, call it
+			if err := parsable.parseConfigValues(); err != nil {
+				return err
+			}
+		}
+	}
+
 	return nil
 }
 
 func (cfg Application) String() string {
 	// yaml is pretty human friendly (at least when compared to json)
 	appCfgStr, err := yaml.Marshal(&cfg)
-
 	if err != nil {
 		return err.Error()
 	}

internal/config/registry.go

@@ -4,7 +4,6 @@ import (
 	"os"
 
 	"github.com/anchore/stereoscope/pkg/image"
-
 	"github.com/spf13/viper"
 )
 
@@ -58,7 +57,7 @@ func hasNonEmptyCredentials(username, password, token string) bool {
 }
 
 func (cfg *registry) ToOptions() *image.RegistryOptions {
-	var auth = make([]image.RegistryCredentials, len(cfg.Auth))
+	auth := make([]image.RegistryCredentials, len(cfg.Auth))
 	for i, a := range cfg.Auth {
 		auth[i] = image.RegistryCredentials{
 			Authority: a.Authority,

internal/err_helper.go

@@ -1,6 +1,7 @@
 package internal
 
 import (
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -15,24 +16,23 @@ func CloseAndLogError(closer io.Closer, location string) {
 	}
 }
 
-type ErrPath struct {
+type PathError struct {
 	Path string
 	Err  error
 }
 
-func (e ErrPath) Error() string {
+func (e PathError) Error() string {
 	return fmt.Sprintf("unable to observe contents of %+v: %v", e.Path, e.Err)
 }
 
-func IsErrPath(err error) bool {
-	_, ok := err.(ErrPath)
-	return ok
+func IsPathError(err error) bool {
+	return errors.As(err, &PathError{})
 }
 
 func IsErrPathPermission(err error) bool {
-	pathErr, ok := err.(ErrPath)
-	if ok {
+	var pathErr *PathError
+	if errors.As(err, pathErr) {
 		return os.IsPermission(pathErr.Err)
 	}
-	return ok
+	return false
 }

internal/file/zip_file_traversal.go

@@ -24,12 +24,12 @@ const (
 
 const perFileReadLimit = 2 * GB
 
-type errZipSlipDetected struct {
+type zipSlipDetectedError struct {
 	Prefix   string
 	JoinArgs []string
 }
 
-func (e *errZipSlipDetected) Error() string {
+func (e *zipSlipDetectedError) Error() string {
 	return fmt.Sprintf("paths are not allowed to resolve outside of the root prefix (%q). Destination: %q", e.Prefix, e.JoinArgs)
 }
 
@@ -197,7 +197,7 @@ func safeJoin(prefix string, dest ...string) (string, error) {
 	joinResult := filepath.Join(append([]string{prefix}, dest...)...)
 	cleanJoinResult := filepath.Clean(joinResult)
 	if !strings.HasPrefix(cleanJoinResult, filepath.Clean(prefix)) {
-		return "", &errZipSlipDetected{
+		return "", &zipSlipDetectedError{
 			Prefix:   prefix,
 			JoinArgs: dest,
 		}

internal/file/zip_file_traversal_test.go

@@ -299,7 +299,7 @@ func TestSafeJoin(t *testing.T) {
 				"../../../etc/passwd",
 			},
 			expected:     "",
-			errAssertion: assertErrorAs(&errZipSlipDetected{}),
+			errAssertion: assertErrorAs(&zipSlipDetectedError{}),
 		},
 		{
 			prefix: "/a/place",
@@ -308,7 +308,7 @@ func TestSafeJoin(t *testing.T) {
 				"../",
 			},
 			expected:     "",
-			errAssertion: assertErrorAs(&errZipSlipDetected{}),
+			errAssertion: assertErrorAs(&zipSlipDetectedError{}),
 		},
 		{
 			prefix: "/a/place",
@@ -316,7 +316,7 @@ func TestSafeJoin(t *testing.T) {
 				"../",
 			},
 			expected:     "",
-			errAssertion: assertErrorAs(&errZipSlipDetected{}),
+			errAssertion: assertErrorAs(&zipSlipDetectedError{}),
 		},
 	}
 

internal/file/zip_read_closer.go

@@ -3,6 +3,7 @@ package file
 import (
 	"archive/zip"
 	"encoding/binary"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -91,7 +92,7 @@ func findArchiveStartOffset(r io.ReaderAt, size int64) (startOfArchive uint64, e
 			bLen = size
 		}
 		buf = make([]byte, int(bLen))
-		if _, err := r.ReadAt(buf, size-bLen); err != nil && err != io.EOF {
+		if _, err := r.ReadAt(buf, size-bLen); err != nil && !errors.Is(err, io.EOF) {
 			return 0, err
 		}
 		if p := findSignatureInBlock(buf); p >= 0 {

internal/logger/logrus.go

@@ -11,7 +11,7 @@ import (
 	prefixed "github.com/x-cray/logrus-prefixed-formatter"
 )
 
-const defaultLogFilePermissions fs.FileMode = 0644
+const defaultLogFilePermissions fs.FileMode = 0o644
 
 // LogrusConfig contains all configurable values for the Logrus logger
 type LogrusConfig struct {

internal/presenter/packages/json_package.go

@@ -38,18 +38,18 @@ func NewJSONPackages(catalog *pkg.Catalog) ([]JSONPackage, error) {
 
 // NewJSONPackage crates a new JSONPackage from the given pkg.Package.
 func NewJSONPackage(p *pkg.Package) (JSONPackage, error) {
-	var cpes = make([]string, len(p.CPEs))
+	cpes := make([]string, len(p.CPEs))
 	for i, c := range p.CPEs {
 		cpes[i] = c.BindToFmtString()
 	}
 
 	// ensure collections are never nil for presentation reasons
-	var locations = make([]source.Location, 0)
+	locations := make([]source.Location, 0)
 	if p.Locations != nil {
 		locations = p.Locations
 	}
 
-	var licenses = make([]string, 0)
+	licenses := make([]string, 0)
 	if p.Licenses != nil {
 		licenses = p.Licenses
 	}

internal/presenter/packages/spdx_helpers.go

@@ -135,7 +135,7 @@ func getSPDXHomepage(p *pkg.Package) string {
 }
 
 func getSPDXSourceInfo(p *pkg.Package) string {
-	answer := ""
+	var answer string
 	switch p.Type {
 	case pkg.RpmPkg:
 		answer = "acquired package info from RPM DB"

internal/presenter/packages/spdx_tag_value_presenter.go

@@ -5,9 +5,8 @@ import (
 	"io"
 	"time"
 
-	"github.com/anchore/syft/internal/spdxlicense"
-
 	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/spdxlicense"
 	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"

internal/presenter/packages/table_presenter.go

@@ -6,9 +6,8 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/olekukonko/tablewriter"
-
 	"github.com/anchore/syft/syft/pkg"
+	"github.com/olekukonko/tablewriter"
 )
 
 type TablePresenter struct {

internal/presenter/packages/text_presenter.go

@@ -2,7 +2,6 @@ package packages
 
 import (
 	"fmt"
-
 	"io"
 	"text/tabwriter"
 

internal/presenter/poweruser/json_file_metadata.go

@@ -6,7 +6,6 @@ import (
 	"strconv"
 
 	"github.com/anchore/syft/syft/file"
-
 	"github.com/anchore/syft/syft/source"
 )
 

internal/spdxlicense/generate/generate_license_list.go

@@ -51,7 +51,6 @@ type LicenseList struct {
 
 func main() {
 	if err := run(); err != nil {
-		fmt.Println(err.Error())
 		os.Exit(1)
 	}
 }
@@ -59,12 +58,12 @@ func main() {
 func run() error {
 	resp, err := http.Get(url)
 	if err != nil {
-		return fmt.Errorf("unable to get licenses list: %+v", err)
+		return fmt.Errorf("unable to get licenses list: %w", err)
 	}
 
 	var result LicenseList
 	if err = json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		return fmt.Errorf("unable to decode license list: %+v", err)
+		return fmt.Errorf("unable to decode license list: %w", err)
 	}
 	defer func() {
 		if err := resp.Body.Close(); err != nil {
@@ -74,7 +73,7 @@ func run() error {
 
 	f, err := os.Create(source)
 	if err != nil {
-		return fmt.Errorf("unable to create %q: %+v", source, err)
+		return fmt.Errorf("unable to create %q: %w", source, err)
 	}
 	defer func() {
 		if err := f.Close(); err != nil {
@@ -97,7 +96,7 @@ func run() error {
 	})
 
 	if err != nil {
-		return fmt.Errorf("unable to generate template: %+v", err)
+		return fmt.Errorf("unable to generate template: %w", err)
 	}
 	return nil
 }
@@ -113,7 +112,7 @@ func run() error {
 // We also sort the licenses for the second pass so that cases like `GPL-1` associate to `GPL-1.0` and not `GPL-1.1`.
 func processSPDXLicense(result LicenseList) map[string]string {
 	// first pass build map
-	var licenseIDs = make(map[string]string)
+	licenseIDs := make(map[string]string)
 	for _, l := range result.Licenses {
 		cleanID := strings.ToLower(l.ID)
 		if _, exists := licenseIDs[cleanID]; exists {

internal/ui/event_handlers.go

@@ -7,11 +7,10 @@ import (
 	"sync"
 
 	"github.com/anchore/syft/internal"
-	"github.com/gookit/color"
-	"github.com/wagoodman/jotframe/pkg/frame"
-
 	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+	"github.com/gookit/color"
 	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/jotframe/pkg/frame"
 )
 
 // handleCatalogerPresenterReady is a UI function for processing the CatalogerFinished bus event, displaying the catalog

internal/ui/select.go

@@ -5,7 +5,7 @@ import (
 	"os"
 	"runtime"
 
-	"golang.org/x/term"
+	"golang.org/x/crypto/ssh/terminal"
 )
 
 // TODO: build tags to exclude options from windows
@@ -16,8 +16,8 @@ import (
 // are environmental problems (e.g. cannot write to the terminal). A writer is provided to capture the output of
 // the final SBOM report.
 func Select(verbose, quiet bool, reportWriter io.Writer) (uis []UI) {
-	isStdoutATty := term.IsTerminal(int(os.Stdout.Fd()))
-	isStderrATty := term.IsTerminal(int(os.Stderr.Fd()))
+	isStdoutATty := terminal.IsTerminal(int(os.Stdout.Fd()))
+	isStderrATty := terminal.IsTerminal(int(os.Stderr.Fd()))
 	notATerminal := !isStderrATty && !isStdoutATty
 
 	switch {

internal/version/build.go

@@ -12,11 +12,13 @@ import (
 const valueNotProvided = "[not provided]"
 
 // all variables here are provided as build-time arguments, with clear default values
-var version = valueNotProvided
-var gitCommit = valueNotProvided
-var gitTreeState = valueNotProvided
-var buildDate = valueNotProvided
-var platform = fmt.Sprintf("%s/%s", runtime.GOOS, runtime.GOARCH)
+var (
+	version      = valueNotProvided
+	gitCommit    = valueNotProvided
+	gitTreeState = valueNotProvided
+	buildDate    = valueNotProvided
+	platform     = fmt.Sprintf("%s/%s", runtime.GOOS, runtime.GOARCH)
+)
 
 // Version defines the application version details (generally from build information)
 type Version struct {

schema/json/generate.go

@@ -1,3 +1,4 @@
+// nolint:forbidigo
 package main
 
 import (
@@ -70,7 +71,7 @@ func build() *jsonschema.Schema {
 	// ensure the generated list of names is stable between runs
 	sort.Strings(metadataNames)
 
-	var metadataTypes = []map[string]string{
+	metadataTypes := []map[string]string{
 		// allow for no metadata to be provided
 		{"type": "null"},
 	}
@@ -89,13 +90,13 @@ func build() *jsonschema.Schema {
 }
 
 func encode(schema *jsonschema.Schema) []byte {
-	var newSchemaBuffer = new(bytes.Buffer)
+	newSchemaBuffer := new(bytes.Buffer)
 	enc := json.NewEncoder(newSchemaBuffer)
 	// prevent > and < from being escaped in the payload
 	enc.SetEscapeHTML(false)
 	enc.SetIndent("", "  ")
-	err := enc.Encode(&schema)
-	if err != nil {
+
+	if err := enc.Encode(&schema); err != nil {
 		panic(err)
 	}
 

syft/distro/identify.go

@@ -6,7 +6,6 @@ import (
 	"strings"
 
 	"github.com/anchore/syft/internal"
-
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/source"
 )

syft/event/parsers/parsers.go

@@ -6,29 +6,26 @@ package parsers
 import (
 	"fmt"
 
-	"github.com/anchore/syft/syft/presenter"
-
-	"github.com/anchore/syft/syft/file"
-
-	"github.com/wagoodman/go-progress"
-
 	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg/cataloger"
+	"github.com/anchore/syft/syft/presenter"
 	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
 )
 
-type ErrBadPayload struct {
+type badPayloadError struct {
 	Type  partybus.EventType
 	Field string
 	Value interface{}
 }
 
-func (e *ErrBadPayload) Error() string {
+func (e *badPayloadError) Error() string {
 	return fmt.Sprintf("event='%s' has bad event payload field='%v': '%+v'", string(e.Type), e.Field, e.Value)
 }
 
 func newPayloadErr(t partybus.EventType, field string, value interface{}) error {
-	return &ErrBadPayload{
+	return &badPayloadError{
 		Type:  t,
 		Field: field,
 		Value: value,

syft/file/contents_cataloger.go

@@ -6,7 +6,6 @@ import (
 	"io"
 
 	"github.com/anchore/syft/internal"
-
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/source"
 )
@@ -65,7 +64,7 @@ func (i *ContentsCataloger) catalogLocation(resolver source.FileResolver, locati
 
 	buf := &bytes.Buffer{}
 	if _, err = io.Copy(base64.NewEncoder(base64.StdEncoding, buf), contentReader); err != nil {
-		return "", internal.ErrPath{Path: location.RealPath, Err: err}
+		return "", internal.PathError{Path: location.RealPath, Err: err}
 	}
 
 	return buf.String(), nil

syft/file/digest_cataloger.go

@@ -8,15 +8,12 @@ import (
 	"strings"
 
 	"github.com/anchore/syft/internal"
-
-	"github.com/anchore/syft/internal/log"
-
 	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/source"
 	"github.com/wagoodman/go-partybus"
 	"github.com/wagoodman/go-progress"
-
-	"github.com/anchore/syft/syft/source"
 )
 
 type DigestsCataloger struct {
@@ -72,7 +69,7 @@ func (i *DigestsCataloger) catalogLocation(resolver source.FileResolver, locatio
 
 	size, err := io.Copy(io.MultiWriter(writers...), contentReader)
 	if err != nil {
-		return nil, internal.ErrPath{Path: location.RealPath, Err: err}
+		return nil, internal.PathError{Path: location.RealPath, Err: err}
 	}
 
 	if size == 0 {

syft/file/generate_search_patterns.go

@@ -11,7 +11,7 @@ import (
 // GenerateSearchPatterns takes a set of named base patterns, a set of additional named patterns and an name exclusion list and generates a final
 // set of regular expressions (indexed by name). The sets are aggregated roughly as such: (base - excluded) + additional.
 func GenerateSearchPatterns(basePatterns map[string]string, additionalPatterns map[string]string, excludePatternNames []string) (map[string]*regexp.Regexp, error) {
-	var regexObjs = make(map[string]*regexp.Regexp)
+	regexObjs := make(map[string]*regexp.Regexp)
 	var errs error
 
 	addFn := func(name, pattern string) {

syft/file/metadata_cataloger.go

@@ -9,8 +9,7 @@ import (
 	"github.com/wagoodman/go-progress"
 )
 
-type MetadataCataloger struct {
-}
+type MetadataCataloger struct{}
 
 func NewMetadataCataloger() *MetadataCataloger {
 	return &MetadataCataloger{}

syft/file/secrets_cataloger.go

@@ -9,7 +9,6 @@ import (
 	"sort"
 
 	"github.com/anchore/syft/internal"
-
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/event"
@@ -82,7 +81,7 @@ func (i *SecretsCataloger) catalogLocation(resolver source.FileResolver, locatio
 	// TODO: in the future we can swap out search strategies here
 	secrets, err := catalogLocationByLine(resolver, location, i.patterns)
 	if err != nil {
-		return nil, internal.ErrPath{Path: location.RealPath, Err: err}
+		return nil, internal.PathError{Path: location.RealPath, Err: err}
 	}
 
 	if i.revealValues {

syft/file/secrets_search_by_line_strategy.go

@@ -9,7 +9,6 @@ import (
 	"regexp"
 
 	"github.com/anchore/syft/internal"
-
 	"github.com/anchore/syft/syft/source"
 )
 
@@ -20,7 +19,7 @@ func catalogLocationByLine(resolver source.FileResolver, location source.Locatio
 	}
 	defer internal.CloseAndLogError(readCloser, location.VirtualPath)
 
-	var scanner = bufio.NewReader(readCloser)
+	scanner := bufio.NewReader(readCloser)
 	var position int64
 	var allSecrets []SearchResult
 	var lineNo int64
@@ -30,7 +29,7 @@ func catalogLocationByLine(resolver source.FileResolver, location source.Locatio
 		var line []byte
 		// TODO: we're at risk of large memory usage for very long lines
 		line, readErr = scanner.ReadBytes('\n')
-		if readErr != nil && readErr != io.EOF {
+		if readErr != nil && !errors.Is(readErr, io.EOF) {
 			return nil, readErr
 		}
 
@@ -119,9 +118,9 @@ func extractSecretFromPosition(readCloser io.ReadCloser, name string, pattern *r
 	}
 
 	// lineNoOfSecret are the number of lines which occur before the start of the secret value
-	var lineNoOfSecret = lineNo + int64(reader.newlinesBefore(start))
+	lineNoOfSecret := lineNo + int64(reader.newlinesBefore(start))
 	// lineOffsetOfSecret are the number of bytes that occur after the last newline but before the secret value.
-	var lineOffsetOfSecret = start - reader.newlinePositionBefore(start)
+	lineOffsetOfSecret := start - reader.newlinePositionBefore(start)
 	if lineNoOfSecret == lineNo {
 		// the secret value starts in the same line as the overall match, so we must consider that line offset
 		lineOffsetOfSecret += lineOffset

syft/pkg/apk_metadata.go

@@ -3,9 +3,8 @@ package pkg
 import (
 	"sort"
 
-	"github.com/anchore/syft/syft/file"
-
 	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/syft/file"
 	"github.com/scylladb/go-set/strset"
 )
 

syft/pkg/catalog.go

@@ -5,7 +5,6 @@ import (
 	"sync"
 
 	"github.com/anchore/syft/internal"
-
 	"github.com/anchore/syft/internal/log"
 )
 
@@ -67,8 +66,7 @@ func (c *Catalog) Add(p Package) {
 	c.lock.Lock()
 	defer c.lock.Unlock()
 
-	_, exists := c.byID[p.ID]
-	if exists {
+	if _, exists := c.byID[p.ID]; exists {
 		log.Errorf("package ID already exists in the catalog : id=%+v %+v", p.ID, p)
 		return
 	}

syft/pkg/cataloger/apkdb/parse_apk_db.go

@@ -8,9 +8,8 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/anchore/syft/syft/file"
-
 	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/common"
 	"github.com/mitchellh/mapstructure"

syft/pkg/cataloger/cataloger.go

@@ -39,7 +39,8 @@ func ImageCatalogers() []Cataloger {
 		rpmdb.NewRpmdbCataloger(),
 		java.NewJavaCataloger(),
 		apkdb.NewApkdbCataloger(),
-		golang.NewGoModuleBinaryCataloger(),
+		golang.NewGoModCataloger(),
+		rust.NewCargoLockCataloger(),
 	}
 }
 
@@ -54,8 +55,7 @@ func DirectoryCatalogers() []Cataloger {
 		rpmdb.NewRpmdbCataloger(),
 		java.NewJavaCataloger(),
 		apkdb.NewApkdbCataloger(),
-		golang.NewGoModuleBinaryCataloger(),
-		golang.NewGoModFileCataloger(),
+		golang.NewGoModCataloger(),
 		rust.NewCargoLockCataloger(),
 	}
 }

syft/pkg/cataloger/common/generic_cataloger.go

@@ -66,7 +66,7 @@ func (c *GenericCataloger) Catalog(resolver source.FileResolver) ([]pkg.Package,
 
 // SelectFiles takes a set of file trees and resolves and file references of interest for future cataloging
 func (c *GenericCataloger) selectFiles(resolver source.FilePathResolver) map[source.Location]ParserFn {
-	var parserByLocation = make(map[source.Location]ParserFn)
+	parserByLocation := make(map[source.Location]ParserFn)
 
 	// select by exact path
 	for path, parser := range c.pathParsers {

syft/pkg/cataloger/deb/cataloger.go

@@ -11,7 +11,6 @@ import (
 	"sort"
 
 	"github.com/anchore/syft/internal"
-
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
@@ -36,6 +35,7 @@ func (c *Cataloger) Name() string {
 }
 
 // Catalog is given an object to resolve file references and content, this function returns any discovered Packages after analyzing dpkg support files.
+
 func (c *Cataloger) Catalog(resolver source.FileResolver) ([]pkg.Package, error) {
 	dbFileMatches, err := resolver.FilesByGlob(pkg.DpkgDBGlob)
 	if err != nil {
@@ -90,7 +90,10 @@ func addLicenses(resolver source.FileResolver, dbLocation source.Location, p *pk
 }
 
 func mergeFileListing(resolver source.FileResolver, dbLocation source.Location, p *pkg.Package) {
-	metadata := p.Metadata.(pkg.DpkgMetadata)
+	metadata, ok := p.Metadata.(pkg.DpkgMetadata)
+	if !ok {
+		log.Warnf("unable to get DPKG metadata while merging file info")
+	}
 
 	// get file listing (package files + additional config files)
 	files, infoLocations := getAdditionalFileListing(resolver, dbLocation, p)
@@ -119,7 +122,7 @@ loopNewFiles:
 
 func getAdditionalFileListing(resolver source.FileResolver, dbLocation source.Location, p *pkg.Package) ([]pkg.DpkgFileRecord, []source.Location) {
 	// ensure the default value for a collection is never nil since this may be shown as JSON
-	var files = make([]pkg.DpkgFileRecord, 0)
+	files := make([]pkg.DpkgFileRecord, 0)
 	var locations []source.Location
 
 	md5Reader, md5Location := fetchMd5Contents(resolver, dbLocation, p)
@@ -221,7 +224,10 @@ func fetchCopyrightContents(resolver source.FileResolver, dbLocation source.Loca
 }
 
 func md5Key(p *pkg.Package) string {
-	metadata := p.Metadata.(pkg.DpkgMetadata)
+	metadata, ok := p.Metadata.(pkg.DpkgMetadata)
+	if !ok {
+		log.Warnf("unable to get DPKG metadata while fetching md5 key")
+	}
 
 	contentKey := p.Name
 	if metadata.Architecture != "" && metadata.Architecture != "all" {

syft/pkg/cataloger/deb/parse_dpkg_status.go

@@ -10,7 +10,6 @@ import (
 	"strings"
 
 	"github.com/anchore/syft/internal"
-
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/mitchellh/mapstructure"
 )
@@ -23,7 +22,7 @@ var (
 // parseDpkgStatus is a parser function for Debian DB status contents, returning all Debian packages listed.
 func parseDpkgStatus(reader io.Reader) ([]pkg.Package, error) {
 	buffedReader := bufio.NewReader(reader)
-	var packages = make([]pkg.Package, 0)
+	packages := make([]pkg.Package, 0)
 
 	continueProcessing := true
 	for continueProcessing {
@@ -152,7 +151,7 @@ func extractSourceVersion(source string) (string, string) {
 // handleNewKeyValue parse a new key-value pair from the given unprocessed line
 func handleNewKeyValue(line string) (string, interface{}, error) {
 	if i := strings.Index(line, ":"); i > 0 {
-		var key = strings.TrimSpace(line[0:i])
+		key := strings.TrimSpace(line[0:i])
 		// mapstruct cant handle "-"
 		key = strings.ReplaceAll(key, "-", "")
 		val := strings.TrimSpace(line[i+1:])

syft/pkg/cataloger/golang/bin_cataloger.go

@@ -1,61 +0,0 @@
-/*
-Package golang provides a concrete Cataloger implementation for go.mod files.
-*/
-package golang
-
-import (
-	"fmt"
-
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
-)
-
-const catalogerName = "go-module-binary-cataloger"
-
-// current mime types to search by to discover go binaries
-var mimeTypes = []string{
-	"application/x-executable",
-	"application/x-mach-binary",
-	"application/x-elf",
-	"application/x-sharedlib",
-	"application/vnd.microsoft.portable-executable",
-}
-
-type Cataloger struct{}
-
-// NewGoModuleBinaryCataloger returns a new Golang cataloger object.
-func NewGoModuleBinaryCataloger() *Cataloger {
-	return &Cataloger{}
-}
-
-// Name returns a string that uniquely describes a cataloger
-func (c *Cataloger) Name() string {
-	return catalogerName
-}
-
-// Catalog is given an object to resolve file references and content, this function returns any discovered Packages after analyzing rpm db installation.
-func (c *Cataloger) Catalog(resolver source.FileResolver) ([]pkg.Package, error) {
-	pkgs := make([]pkg.Package, 0)
-	fileMatches, err := resolver.FilesByMIMEType(mimeTypes...)
-	if err != nil {
-		return pkgs, fmt.Errorf("failed to find bin by mime types: %w", err)
-	}
-
-	for _, location := range fileMatches {
-		r, err := resolver.FileContentsByLocation(location)
-		if err != nil {
-			return pkgs, fmt.Errorf("failed to resolve file contents by location: %w", err)
-		}
-
-		goPkgs, err := parseGoBin(location.RealPath, r)
-		if err != nil {
-			log.Infof("could not parse go bin for: %w", err)
-		}
-
-		r.Close()
-		pkgs = append(pkgs, goPkgs...)
-	}
-
-	return pkgs, nil
-}

syft/pkg/cataloger/golang/cataloger.go

@@ -7,11 +7,11 @@ import (
 	"github.com/anchore/syft/syft/pkg/cataloger/common"
 )
 
-// NewGoModFileCataloger returns a new Go module cataloger object.
-func NewGoModFileCataloger() *common.GenericCataloger {
+// NewGoModCataloger returns a new Go module cataloger object.
+func NewGoModCataloger() *common.GenericCataloger {
 	globParsers := map[string]common.ParserFn{
 		"**/go.mod": parseGoMod,
 	}
 
-	return common.NewGenericCataloger(nil, globParsers, "go-mod-file-cataloger")
+	return common.NewGenericCataloger(nil, globParsers, "go-cataloger")
 }

syft/pkg/cataloger/golang/exe.go

@@ -1,271 +0,0 @@
-// This code was copied from the Go std library.
-// https://github.com/golang/go/blob/master/src/cmd/go/internal/version/exe.go
-// Copyright 2019 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//nolint
-package golang
-
-import (
-	"bytes"
-	"debug/elf"
-	"debug/macho"
-	"debug/pe"
-	"fmt"
-	"io"
-)
-
-// An exe is a generic interface to an OS executable (ELF, Mach-O, PE, XCOFF).
-type exe interface {
-	// Close closes the underlying file.
-	Close() error
-
-	// ReadData reads and returns up to size byte starting at virtual address addr.
-	ReadData(addr, size uint64) ([]byte, error)
-
-	// DataStart returns the writable data segment start address.
-	DataStart() uint64
-}
-
-// openExe opens file and returns it as an exe.
-// we changed this signature from accpeting a string
-// to a ReadCloser so we could adapt the code to the
-// stereoscope api. We removed the file open methods.
-func openExe(file io.ReadCloser) (exe, error) {
-	/*
-		f, err := os.Open(file)
-		if err != nil {
-			return nil, err
-		}
-		data := make([]byte, 16)
-		if _, err := io.ReadFull(f, data); err != nil {
-			return nil, err
-		}
-		f.Seek(0, 0)
-	*/
-	data, err := io.ReadAll(file)
-	if err != nil {
-		return nil, err
-	}
-
-	r := bytes.NewReader(data)
-	f := io.NewSectionReader(r, 0, int64(len(data)))
-	if bytes.HasPrefix(data, []byte("\x7FELF")) {
-		e, err := elf.NewFile(f)
-		if err != nil {
-			return nil, err
-		}
-
-		return &elfExe{file, e}, nil
-	}
-
-	if bytes.HasPrefix(data, []byte("MZ")) {
-		e, err := pe.NewFile(f)
-		if err != nil {
-			return nil, err
-		}
-		return &peExe{file, e}, nil
-	}
-
-	if bytes.HasPrefix(data, []byte("\xFE\xED\xFA")) || bytes.HasPrefix(data[1:], []byte("\xFA\xED\xFE")) {
-		e, err := macho.NewFile(f)
-		if err != nil {
-			return nil, err
-		}
-		return &machoExe{file, e}, nil
-	}
-
-	return nil, fmt.Errorf("unrecognized executable format")
-}
-
-// elfExe is the ELF implementation of the exe interface.
-// updated os to be io.ReadCloser to interopt with stereoscope
-type elfExe struct {
-	os io.ReadCloser
-	f  *elf.File
-}
-
-func (x *elfExe) Close() error {
-	return x.os.Close()
-}
-
-func (x *elfExe) ReadData(addr, size uint64) ([]byte, error) {
-	for _, prog := range x.f.Progs {
-		if prog.Vaddr <= addr && addr <= prog.Vaddr+prog.Filesz-1 {
-			n := prog.Vaddr + prog.Filesz - addr
-			if n > size {
-				n = size
-			}
-			data := make([]byte, n)
-			_, err := prog.ReadAt(data, int64(addr-prog.Vaddr))
-			if err != nil {
-				return nil, err
-			}
-			return data, nil
-		}
-	}
-	return nil, fmt.Errorf("address not mapped")
-}
-
-func (x *elfExe) DataStart() uint64 {
-	for _, s := range x.f.Sections {
-		if s.Name == ".go.buildinfo" {
-			return s.Addr
-		}
-	}
-	for _, p := range x.f.Progs {
-		if p.Type == elf.PT_LOAD && p.Flags&(elf.PF_X|elf.PF_W) == elf.PF_W {
-			return p.Vaddr
-		}
-	}
-	return 0
-}
-
-// peExe is the PE (Windows Portable Executable) implementation of the exe interface.
-type peExe struct {
-	os io.ReadCloser
-	f  *pe.File
-}
-
-func (x *peExe) Close() error {
-	return x.os.Close()
-}
-
-func (x *peExe) imageBase() uint64 {
-	switch oh := x.f.OptionalHeader.(type) {
-	case *pe.OptionalHeader32:
-		return uint64(oh.ImageBase)
-	case *pe.OptionalHeader64:
-		return oh.ImageBase
-	}
-	return 0
-}
-
-func (x *peExe) ReadData(addr, size uint64) ([]byte, error) {
-	addr -= x.imageBase()
-	for _, sect := range x.f.Sections {
-		if uint64(sect.VirtualAddress) <= addr && addr <= uint64(sect.VirtualAddress+sect.Size-1) {
-			n := uint64(sect.VirtualAddress+sect.Size) - addr
-			if n > size {
-				n = size
-			}
-			data := make([]byte, n)
-			_, err := sect.ReadAt(data, int64(addr-uint64(sect.VirtualAddress)))
-			if err != nil {
-				return nil, err
-			}
-			return data, nil
-		}
-	}
-	return nil, fmt.Errorf("address not mapped")
-}
-
-func (x *peExe) DataStart() uint64 {
-	// Assume data is first writable section.
-	const (
-		IMAGE_SCN_CNT_CODE               = 0x00000020
-		IMAGE_SCN_CNT_INITIALIZED_DATA   = 0x00000040
-		IMAGE_SCN_CNT_UNINITIALIZED_DATA = 0x00000080
-		IMAGE_SCN_MEM_EXECUTE            = 0x20000000
-		IMAGE_SCN_MEM_READ               = 0x40000000
-		IMAGE_SCN_MEM_WRITE              = 0x80000000
-		IMAGE_SCN_MEM_DISCARDABLE        = 0x2000000
-		IMAGE_SCN_LNK_NRELOC_OVFL        = 0x1000000
-		IMAGE_SCN_ALIGN_32BYTES          = 0x600000
-	)
-	for _, sect := range x.f.Sections {
-		if sect.VirtualAddress != 0 && sect.Size != 0 &&
-			sect.Characteristics&^IMAGE_SCN_ALIGN_32BYTES == IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE {
-			return uint64(sect.VirtualAddress) + x.imageBase()
-		}
-	}
-	return 0
-}
-
-// machoExe is the Mach-O (Apple macOS/iOS) implementation of the exe interface.
-type machoExe struct {
-	os io.ReadCloser
-	f  *macho.File
-}
-
-func (x *machoExe) Close() error {
-	return x.os.Close()
-}
-
-func (x *machoExe) ReadData(addr, size uint64) ([]byte, error) {
-	for _, load := range x.f.Loads {
-		seg, ok := load.(*macho.Segment)
-		if !ok {
-			continue
-		}
-		if seg.Addr <= addr && addr <= seg.Addr+seg.Filesz-1 {
-			if seg.Name == "__PAGEZERO" {
-				continue
-			}
-			n := seg.Addr + seg.Filesz - addr
-			if n > size {
-				n = size
-			}
-			data := make([]byte, n)
-			_, err := seg.ReadAt(data, int64(addr-seg.Addr))
-			if err != nil {
-				return nil, err
-			}
-			return data, nil
-		}
-	}
-	return nil, fmt.Errorf("address not mapped")
-}
-
-func (x *machoExe) DataStart() uint64 {
-	// Look for section named "__go_buildinfo".
-	for _, sec := range x.f.Sections {
-		if sec.Name == "__go_buildinfo" {
-			return sec.Addr
-		}
-	}
-	// Try the first non-empty writable segment.
-	const RW = 3
-	for _, load := range x.f.Loads {
-		seg, ok := load.(*macho.Segment)
-		if ok && seg.Addr != 0 && seg.Filesz != 0 && seg.Prot == RW && seg.Maxprot == RW {
-			return seg.Addr
-		}
-	}
-	return 0
-}
-
-/*
-// xcoffExe is the XCOFF (AIX eXtended COFF) implementation of the exe interface.
-type xcoffExe struct {
-	os *os.File
-	f  *xcoff.File
-}
-
-func (x *xcoffExe) Close() error {
-	return x.os.Close()
-}
-
-func (x *xcoffExe) ReadData(addr, size uint64) ([]byte, error) {
-	for _, sect := range x.f.Sections {
-		if uint64(sect.VirtualAddress) <= addr && addr <= uint64(sect.VirtualAddress+sect.Size-1) {
-			n := uint64(sect.VirtualAddress+sect.Size) - addr
-			if n > size {
-				n = size
-			}
-			data := make([]byte, n)
-			_, err := sect.ReadAt(data, int64(addr-uint64(sect.VirtualAddress)))
-			if err != nil {
-				return nil, err
-			}
-			return data, nil
-		}
-	}
-	return nil, fmt.Errorf("address not mapped")
-}
-
-func (x *xcoffExe) DataStart() uint64 {
-	return x.f.SectionByType(xcoff.STYP_DATA).VirtualAddress
-}
-*/

syft/pkg/cataloger/golang/parse_go_bin.go

@@ -1,65 +0,0 @@
-package golang
-
-import (
-	"bufio"
-	"io"
-	"strings"
-
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
-)
-
-const (
-	packageIdentifier = "dep"
-	replaceIdentifier = "=>"
-)
-
-func parseGoBin(path string, reader io.ReadCloser) ([]pkg.Package, error) {
-	// Identify if bin was compiled by go
-	x, err := openExe(reader)
-	if err != nil {
-		return nil, err
-	}
-
-	goVersion, mod := findVers(x)
-
-	pkgs := buildGoPkgInfo(path, mod, goVersion)
-
-	return pkgs, nil
-}
-
-func buildGoPkgInfo(path, mod, goVersion string) []pkg.Package {
-	pkgsSlice := make([]pkg.Package, 0)
-	scanner := bufio.NewScanner(strings.NewReader(mod))
-
-	// filter mod dependencies: [dep, name, version, sha]
-	for scanner.Scan() {
-		fields := strings.Fields(scanner.Text())
-
-		// must have dep, name, version, sha
-		if len(fields) < 4 {
-			continue
-		}
-
-		if fields[0] == packageIdentifier || fields[0] == replaceIdentifier {
-			pkgsSlice = append(pkgsSlice, pkg.Package{
-				Name:     fields[1],
-				Version:  fields[2],
-				Language: pkg.Go,
-				Type:     pkg.GoModulePkg,
-				Locations: []source.Location{
-					{
-						RealPath: path,
-					},
-				},
-				MetadataType: pkg.GolangBinMetadataType,
-				Metadata: pkg.GolangBinMetadata{
-					GoCompiledVersion: goVersion,
-					H1Digest:          fields[3],
-				},
-			})
-		}
-	}
-
-	return pkgsSlice
-}

syft/pkg/cataloger/golang/parse_go_bin_test.go

@@ -1,122 +0,0 @@
-package golang
-
-import (
-	"testing"
-
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
-	"github.com/stretchr/testify/assert"
-)
-
-const goCompiledVersion = "1.17"
-
-func TestBuildGoPkgInfo(t *testing.T) {
-	tests := []struct {
-		name     string
-		mod      string
-		expected []pkg.Package
-	}{
-		{
-			name:     "buildGoPkgInfo parses a blank mod string and returns no packages",
-			mod:      "",
-			expected: make([]pkg.Package, 0),
-		},
-		{
-			name: "buildGoPkgInfo parses a populated mod string and returns packages but no source info",
-			mod: `path    github.com/anchore/syft mod     github.com/anchore/syft (devel)
-				  dep     github.com/adrg/xdg     v0.2.1  h1:VSVdnH7cQ7V+B33qSJHTCRlNgra1607Q8PzEmnvb2Ic=
-				  dep     github.com/anchore/client-go    v0.0.0-20210222170800-9c70f9b80bcf      h1:DYssiUV1pBmKqzKsm4mqXx8artqC0Q8HgZsVI3lMsAg=`,
-			expected: []pkg.Package{
-				{
-					Name:     "github.com/adrg/xdg",
-					Version:  "v0.2.1",
-					Language: pkg.Go,
-					Type:     pkg.GoModulePkg,
-					Locations: []source.Location{
-						{},
-					},
-					MetadataType: pkg.GolangBinMetadataType,
-					Metadata: pkg.GolangBinMetadata{
-						GoCompiledVersion: goCompiledVersion,
-						H1Digest:          "h1:VSVdnH7cQ7V+B33qSJHTCRlNgra1607Q8PzEmnvb2Ic=",
-					},
-				},
-				{
-					Name:     "github.com/anchore/client-go",
-					Version:  "v0.0.0-20210222170800-9c70f9b80bcf",
-					Language: pkg.Go,
-					Type:     pkg.GoModulePkg,
-					Locations: []source.Location{
-						{},
-					},
-					MetadataType: pkg.GolangBinMetadataType,
-					Metadata: pkg.GolangBinMetadata{
-						GoCompiledVersion: goCompiledVersion,
-						H1Digest:          "h1:DYssiUV1pBmKqzKsm4mqXx8artqC0Q8HgZsVI3lMsAg=",
-					},
-				},
-			},
-		},
-		{
-			name: "buildGoPkgInfo parses a populated mod string and returns packages when a replace directive exists",
-			mod: `path    github.com/anchore/test
-			      mod     github.com/anchore/test (devel)
-				  dep     golang.org/x/net        v0.0.0-20211006190231-62292e806868      h1:KlOXYy8wQWTUJYFgkUI40Lzr06ofg5IRXUK5C7qZt1k=
-				  dep     golang.org/x/sys        v0.0.0-20211006194710-c8a6f5223071      h1:PjhxBct4MZii8FFR8+oeS7QOvxKOTZXgk63EU2XpfJE=
-				  dep     golang.org/x/term       v0.0.0-20210927222741-03fcf44c2211
-				  =>      golang.org/x/term       v0.0.0-20210916214954-140adaaadfaf      h1:Ihq/mm/suC88gF8WFcVwk+OV6Tq+wyA1O0E5UEvDglI=`,
-			expected: []pkg.Package{
-				{
-					Name:     "golang.org/x/net",
-					Version:  "v0.0.0-20211006190231-62292e806868",
-					Language: pkg.Go,
-					Type:     pkg.GoModulePkg,
-					Locations: []source.Location{
-						{},
-					},
-					MetadataType: pkg.GolangBinMetadataType,
-					Metadata: pkg.GolangBinMetadata{
-						GoCompiledVersion: goCompiledVersion,
-						H1Digest:          "h1:KlOXYy8wQWTUJYFgkUI40Lzr06ofg5IRXUK5C7qZt1k=",
-					},
-				},
-				{
-					Name:     "golang.org/x/sys",
-					Version:  "v0.0.0-20211006194710-c8a6f5223071",
-					Language: pkg.Go,
-					Type:     pkg.GoModulePkg,
-					Locations: []source.Location{
-						{},
-					},
-					MetadataType: pkg.GolangBinMetadataType,
-					Metadata: pkg.GolangBinMetadata{
-						GoCompiledVersion: goCompiledVersion,
-						H1Digest:          "h1:PjhxBct4MZii8FFR8+oeS7QOvxKOTZXgk63EU2XpfJE=",
-					},
-				},
-				{
-					Name:     "golang.org/x/term",
-					Version:  "v0.0.0-20210916214954-140adaaadfaf",
-					Language: pkg.Go,
-					Type:     pkg.GoModulePkg,
-					Locations: []source.Location{
-						{},
-					},
-					MetadataType: pkg.GolangBinMetadataType,
-					Metadata: pkg.GolangBinMetadata{
-						GoCompiledVersion: goCompiledVersion,
-						H1Digest:          "h1:Ihq/mm/suC88gF8WFcVwk+OV6Tq+wyA1O0E5UEvDglI=",
-					},
-				},
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		tt := tt
-		t.Run(tt.name, func(t *testing.T) {
-			pkgs := buildGoPkgInfo("", tt.mod, goCompiledVersion)
-			assert.Equal(t, tt.expected, pkgs)
-		})
-	}
-}

syft/pkg/cataloger/golang/version.go

@@ -1,226 +0,0 @@
-// This code was copied from the Go std library.
-// https://github.com/golang/go/blob/master/src/cmd/go/internal/version/version.go
-// Copyright 2011 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Package version implements the ``go version'' command.
-package golang
-
-import (
-	"bytes"
-	"encoding/binary"
-	// "cmd/go/internal/base"
-)
-
-/*
-var CmdVersion = &base.Command{
-	UsageLine: "go version [-m] [-v] [file ...]",
-	Short:     "print Go version",
-	Long: `Version prints the build information for Go executables.
-
-Go version reports the Go version used to build each of the named
-executable files.
-
-If no files are named on the command line, go version prints its own
-version information.
-
-If a directory is named, go version walks that directory, recursively,
-looking for recognized Go binaries and reporting their versions.
-By default, go version does not report unrecognized files found
-during a directory scan. The -v flag causes it to report unrecognized files.
-
-The -m flag causes go version to print each executable's embedded
-module version information, when available. In the output, the module
-information consists of multiple lines following the version line, each
-indented by a leading tab character.
-
-See also: go doc runtime/debug.BuildInfo.
-`,
-}
-
-func init() {
-	CmdVersion.Run = runVersion // break init cycle
-}
-
-var (
-	versionM = CmdVersion.Flag.Bool("m", false, "")
-	versionV = CmdVersion.Flag.Bool("v", false, "")
-)
-
-func runVersion(ctx context.Context, cmd *base.Command, args []string) {
-	if len(args) == 0 {
-		// If any of this command's flags were passed explicitly, error
-		// out, because they only make sense with arguments.
-		//
-		// Don't error if the flags came from GOFLAGS, since that can be
-		// a reasonable use case. For example, imagine GOFLAGS=-v to
-		// turn "verbose mode" on for all Go commands, which should not
-		// break "go version".
-		var argOnlyFlag string
-		if !base.InGOFLAGS("-m") && *versionM {
-			argOnlyFlag = "-m"
-		} else if !base.InGOFLAGS("-v") && *versionV {
-			argOnlyFlag = "-v"
-		}
-		if argOnlyFlag != "" {
-			fmt.Fprintf(os.Stderr, "go: 'go version' only accepts %s flag with arguments\n", argOnlyFlag)
-			base.SetExitStatus(2)
-			return
-		}
-		fmt.Printf("go version %s %s/%s\n", runtime.Version(), runtime.GOOS, runtime.GOARCH)
-		return
-	}
-
-	for _, arg := range args {
-		info, err := os.Stat(arg)
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "%v\n", err)
-			base.SetExitStatus(1)
-			continue
-		}
-		if info.IsDir() {
-			scanDir(arg)
-		} else {
-			scanFile(arg, info, true)
-		}
-	}
-}
-
-// scanDir scans a directory for executables to run scanFile on.
-func scanDir(dir string) {
-	filepath.WalkDir(dir, func(path string, d fs.DirEntry, err error) error {
-		if d.Type().IsRegular() || d.Type()&fs.ModeSymlink != 0 {
-			info, err := d.Info()
-			if err != nil {
-				if *versionV {
-					fmt.Fprintf(os.Stderr, "%s: %v\n", path, err)
-				}
-				return nil
-			}
-			scanFile(path, info, *versionV)
-		}
-		return nil
-	})
-}
-
-// isExe reports whether the file should be considered executable.
-func isExe(file string, info fs.FileInfo) bool {
-	if runtime.GOOS == "windows" {
-		return strings.HasSuffix(strings.ToLower(file), ".exe")
-	}
-	return info.Mode().IsRegular() && info.Mode()&0111 != 0
-}
-
-// scanFile scans file to try to report the Go and module versions.
-// If mustPrint is true, scanFile will report any error reading file.
-// Otherwise (mustPrint is false, because scanFile is being called
-// by scanDir) scanFile prints nothing for non-Go executables.
-func scanFile(file string, info fs.FileInfo, mustPrint bool) {
-	if info.Mode()&fs.ModeSymlink != 0 {
-		// Accept file symlinks only.
-		i, err := os.Stat(file)
-		if err != nil || !i.Mode().IsRegular() {
-			if mustPrint {
-				fmt.Fprintf(os.Stderr, "%s: symlink\n", file)
-			}
-			return
-		}
-		info = i
-	}
-
-	if !isExe(file, info) {
-		if mustPrint {
-			fmt.Fprintf(os.Stderr, "%s: not executable file\n", file)
-		}
-		return
-	}
-
-	x, err := openExe(file)
-	if err != nil {
-		if mustPrint {
-			fmt.Fprintf(os.Stderr, "%s: %v\n", file, err)
-		}
-		return
-	}
-	defer x.Close()
-
-	vers, mod := findVers(x)
-	if vers == "" {
-		if mustPrint {
-			fmt.Fprintf(os.Stderr, "%s: go version not found\n", file)
-		}
-		return
-	}
-
-	fmt.Printf("%s: %s\n", file, vers)
-	if *versionM && mod != "" {
-		fmt.Printf("\t%s\n", strings.ReplaceAll(mod[:len(mod)-1], "\n", "\n\t"))
-	}
-}
-*/
-
-// The build info blob left by the linker is identified by
-// a 16-byte header, consisting of buildInfoMagic (14 bytes),
-// the binary's pointer size (1 byte),
-// and whether the binary is big endian (1 byte).
-var buildInfoMagic = []byte("\xff Go buildinf:")
-
-// findVers finds and returns the Go version and module version information
-// in the executable x.
-func findVers(x exe) (vers, mod string) {
-	// Read the first 64kB of text to find the build info blob.
-	text := x.DataStart()
-	data, err := x.ReadData(text, 64*1024)
-	if err != nil {
-		return
-	}
-	for ; !bytes.HasPrefix(data, buildInfoMagic); data = data[32:] {
-		if len(data) < 32 {
-			return
-		}
-	}
-
-	// Decode the blob.
-	ptrSize := int(data[14])
-	bigEndian := data[15] != 0
-	var bo binary.ByteOrder
-	if bigEndian {
-		bo = binary.BigEndian
-	} else {
-		bo = binary.LittleEndian
-	}
-	var readPtr func([]byte) uint64
-	if ptrSize == 4 {
-		readPtr = func(b []byte) uint64 { return uint64(bo.Uint32(b)) }
-	} else {
-		readPtr = bo.Uint64
-	}
-	vers = readString(x, ptrSize, readPtr, readPtr(data[16:]))
-	if vers == "" {
-		return
-	}
-	mod = readString(x, ptrSize, readPtr, readPtr(data[16+ptrSize:]))
-	if len(mod) >= 33 && mod[len(mod)-17] == '\n' {
-		// Strip module framing.
-		mod = mod[16 : len(mod)-16]
-	} else {
-		mod = ""
-	}
-	return vers, mod
-}
-
-// readString returns the string at address addr in the executable x.
-func readString(x exe, ptrSize int, readPtr func([]byte) uint64, addr uint64) string {
-	hdr, err := x.ReadData(addr, uint64(2*ptrSize))
-	if err != nil || len(hdr) < 2*ptrSize {
-		return ""
-	}
-	dataAddr := readPtr(hdr)
-	dataLen := readPtr(hdr[ptrSize:])
-	data, err := x.ReadData(dataAddr, dataLen)
-	if err != nil || uint64(len(data)) < dataLen {
-		return ""
-	}
-	return string(data)
-}

syft/pkg/cataloger/java/archive_filename.go

@@ -6,7 +6,6 @@ import (
 	"strings"
 
 	"github.com/anchore/syft/internal/log"
-
 	"github.com/anchore/syft/syft/pkg"
 )
 

syft/pkg/cataloger/java/archive_parser.go

@@ -6,9 +6,8 @@ import (
 	"path"
 	"strings"
 
-	"github.com/anchore/syft/internal/log"
-
 	"github.com/anchore/syft/internal/file"
+	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/common"
 )
@@ -81,7 +80,7 @@ func newJavaArchiveParser(virtualPath string, reader io.Reader, detectNested boo
 
 // parse the loaded archive and return all packages found.
 func (j *archiveParser) parse() ([]pkg.Package, error) {
-	var pkgs = make([]pkg.Package, 0)
+	pkgs := make([]pkg.Package, 0)
 
 	// find the parent package from the java manifest
 	parentPkg, err := j.discoverMainPackage()
@@ -190,7 +189,7 @@ func (j *archiveParser) discoverPkgsFromAllMavenFiles(parentPkg *pkg.Package) ([
 // discoverPkgsFromNestedArchives finds Java archives within Java archives, returning all listed Java packages found and
 // associating each discovered package to the given parent package.
 func (j *archiveParser) discoverPkgsFromNestedArchives(parentPkg *pkg.Package) ([]pkg.Package, error) {
-	var pkgs = make([]pkg.Package, 0)
+	pkgs := make([]pkg.Package, 0)
 
 	// search and parse pom.properties files & fetch the contents
 	openers, err := file.ExtractFromZipToUniqueTempFile(j.archivePath, j.contentPath, j.fileManifest.GlobMatch(archiveFormatGlobs...)...)
@@ -326,7 +325,10 @@ func packageIdentitiesMatch(p pkg.Package, parentPkg *pkg.Package) bool {
 		return true
 	}
 
-	metadata := p.Metadata.(pkg.JavaMetadata)
+	metadata, ok := p.Metadata.(pkg.JavaMetadata)
+	if !ok {
+		log.Warnf("unable to get java metadata while determining package identities")
+	}
 
 	// the virtual path matches...
 	if parentPkg.Metadata.(pkg.JavaMetadata).VirtualPath == metadata.VirtualPath {

syft/pkg/cataloger/java/archive_parser_test.go

@@ -90,7 +90,6 @@ func TestParseJar(t *testing.T) {
 			fixture: "test-fixtures/java-builds/packages/example-jenkins-plugin.hpi",
 			ignoreExtras: []string{
 				"Plugin-Version", // has dynamic date
-				"Built-By",       // podman returns the real UID
 				"Build-Jdk",      // can't guarantee the JDK used at build time
 			},
 			expected: map[string]pkg.Package{
@@ -113,7 +112,7 @@ func TestParseJar(t *testing.T) {
 								"Plugin-License-Url":  "https://opensource.org/licenses/MIT",
 								"Plugin-License-Name": "MIT License",
 								"Created-By":          "Apache Maven",
-								//"Built-By":            "?",
+								"Built-By":            "?",
 								//"Build-Jdk":            "14.0.1",
 								"Jenkins-Version":      "2.164.3",
 								"Minimum-Java-Version": "1.8",
@@ -163,7 +162,6 @@ func TestParseJar(t *testing.T) {
 			fixture: "test-fixtures/java-builds/packages/example-java-app-maven-0.1.0.jar",
 			ignoreExtras: []string{
 				"Build-Jdk", // can't guarantee the JDK used at build time
-				"Built-By",  // podman returns the real UID
 			},
 			expected: map[string]pkg.Package{
 				"example-java-app-maven": {
@@ -180,7 +178,7 @@ func TestParseJar(t *testing.T) {
 								// extra fields...
 								"Archiver-Version": "Plexus Archiver",
 								"Created-By":       "Apache Maven 3.6.3",
-								//"Built-By":         "?",
+								"Built-By":         "?",
 								//"Build-Jdk":        "14.0.1",
 								"Main-Class": "hello.HelloWorld",
 							},

syft/pkg/cataloger/java/parse_java_manifest.go

@@ -8,7 +8,6 @@ import (
 	"strings"
 
 	"github.com/anchore/syft/internal/log"
-
 	"github.com/anchore/syft/syft/pkg"
 )
 

syft/pkg/cataloger/java/save_archive_to_tmp.go

@@ -26,7 +26,7 @@ func saveArchiveToTmp(reader io.Reader) (string, string, func(), error) {
 	archivePath := filepath.Join(tempDir, "archive")
 	contentDir := filepath.Join(tempDir, "contents")
 
-	err = os.Mkdir(contentDir, 0755)
+	err = os.Mkdir(contentDir, 0o755)
 	if err != nil {
 		return contentDir, "", cleanupFn, fmt.Errorf("unable to create processing tempdir: %w", err)
 	}

syft/pkg/cataloger/javascript/parse_package_json.go

@@ -7,14 +7,11 @@ import (
 	"io"
 	"regexp"
 
-	"github.com/anchore/syft/internal/log"
-
 	"github.com/anchore/syft/internal"
-
-	"github.com/mitchellh/mapstructure"
-
+	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/common"
+	"github.com/mitchellh/mapstructure"
 )
 
 // integrity check
@@ -168,7 +165,7 @@ func parsePackageJSON(_ string, reader io.Reader) ([]pkg.Package, error) {
 
 	for {
 		var p PackageJSON
-		if err := dec.Decode(&p); err == io.EOF {
+		if err := dec.Decode(&p); errors.Is(err, io.EOF) {
 			break
 		} else if err != nil {
 			return nil, fmt.Errorf("failed to parse package.json file: %w", err)

syft/pkg/cataloger/javascript/parse_package_lock.go

@@ -2,6 +2,7 @@ package javascript
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 
@@ -40,7 +41,7 @@ func parsePackageLock(path string, reader io.Reader) ([]pkg.Package, error) {
 
 	for {
 		var lock PackageLock
-		if err := dec.Decode(&lock); err == io.EOF {
+		if err := dec.Decode(&lock); errors.Is(err, io.EOF) {
 			break
 		} else if err != nil {
 			return nil, fmt.Errorf("failed to parse package-lock.json file: %w", err)

syft/pkg/cataloger/package_url.go

@@ -20,9 +20,9 @@ func generatePackageURL(p pkg.Package, d *distro.Distro) string {
 		}
 	}
 
-	var purlType = p.Type.PackageURLType()
-	var name = p.Name
-	var namespace = ""
+	purlType := p.Type.PackageURLType()
+	name := p.Name
+	namespace := ""
 
 	switch {
 	case purlType == "":

syft/pkg/cataloger/python/package_cataloger.go

@@ -6,9 +6,7 @@ import (
 	"path/filepath"
 
 	"github.com/anchore/syft/internal"
-
 	"github.com/anchore/syft/syft/pkg"
-
 	"github.com/anchore/syft/syft/source"
 )
 
@@ -149,7 +147,7 @@ func (c *PackageCataloger) fetchTopLevelPackages(resolver source.FileResolver, m
 
 // assembleEggOrWheelMetadata discovers and accumulates python package metadata from multiple file sources and returns a single metadata object as well as a list of files where the metadata was derived from.
 func (c *PackageCataloger) assembleEggOrWheelMetadata(resolver source.FileResolver, metadataLocation source.Location) (*pkg.PythonPackageMetadata, []source.Location, error) {
-	var sources = []source.Location{metadataLocation}
+	sources := []source.Location{metadataLocation}
 
 	metadataContents, err := resolver.FileContentsByLocation(metadataLocation)
 	if err != nil {

syft/pkg/cataloger/python/package_cataloger_test.go

@@ -78,8 +78,6 @@ func TestPythonPackageWheelCataloger(t *testing.T) {
 						{Path: "Pygments-2.6.1.dist-info/RECORD"},
 						{Path: "pygments/__pycache__/__init__.cpython-38.pyc"},
 						{Path: "pygments/util.py", Digest: &pkg.PythonFileDigest{"sha256", "586xXHiJGGZxqk5PMBu3vBhE68DLuAe5MBARWrSPGxA"}, Size: "10778"},
-
-						{Path: "pygments/x_util.py", Digest: &pkg.PythonFileDigest{"sha256", "qpzzsOW31KT955agi-7NS--90I0iNiJCyLJQnRCHgKI="}, Size: "10778"},
 					},
 					TopLevelPackages: []string{"pygments", "something_else"},
 				},

syft/pkg/cataloger/python/parse_pipfile_lock.go

@@ -2,6 +2,7 @@ package python
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"strings"
@@ -43,7 +44,7 @@ func parsePipfileLock(_ string, reader io.Reader) ([]pkg.Package, error) {
 
 	for {
 		var lock PipfileLock
-		if err := dec.Decode(&lock); err == io.EOF {
+		if err := dec.Decode(&lock); errors.Is(err, io.EOF) {
 			break
 		} else if err != nil {
 			return nil, fmt.Errorf("failed to parse Pipfile.lock file: %w", err)

syft/pkg/cataloger/python/parse_poetry_lock.go

@@ -16,13 +16,13 @@ var _ common.ParserFn = parsePoetryLock
 func parsePoetryLock(_ string, reader io.Reader) ([]pkg.Package, error) {
 	tree, err := toml.LoadReader(reader)
 	if err != nil {
-		return nil, fmt.Errorf("unable to load poetry.lock for parsing: %v", err)
+		return nil, fmt.Errorf("unable to load poetry.lock for parsing: %w", err)
 	}
 
 	metadata := PoetryMetadata{}
 	err = tree.Unmarshal(&metadata)
 	if err != nil {
-		return nil, fmt.Errorf("unable to parse poetry.lock: %v", err)
+		return nil, fmt.Errorf("unable to parse poetry.lock: %w", err)
 	}
 
 	return metadata.Pkgs(), nil

syft/pkg/cataloger/python/parse_wheel_egg_metadata.go

@@ -9,10 +9,8 @@ import (
 
 	"github.com/anchore/syft/internal/file"
 	"github.com/anchore/syft/internal/log"
-
-	"github.com/mitchellh/mapstructure"
-
 	"github.com/anchore/syft/syft/pkg"
+	"github.com/mitchellh/mapstructure"
 )
 
 // parseWheelOrEggMetadata takes a Python Egg or Wheel (which share the same format and values for our purposes),

syft/pkg/cataloger/python/parse_wheel_egg_record.go

@@ -2,11 +2,11 @@ package python
 
 import (
 	"encoding/csv"
+	"errors"
 	"fmt"
 	"io"
 	"strings"
 
-	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/pkg"
 )
 
@@ -18,7 +18,7 @@ func parseWheelOrEggRecord(reader io.Reader) ([]pkg.PythonFileRecord, error) {
 
 	for {
 		recordList, err := r.Read()
-		if err == io.EOF {
+		if errors.Is(err, io.EOF) {
 			break
 		}
 		if err != nil {
@@ -39,10 +39,10 @@ func parseWheelOrEggRecord(reader io.Reader) ([]pkg.PythonFileRecord, error) {
 				if item == "" {
 					continue
 				}
-				fields := strings.SplitN(item, "=", 2)
+				fields := strings.Split(item, "=")
+
 				if len(fields) != 2 {
-					log.Warnf("unexpected python record digest: %q", item)
-					continue
+					return nil, fmt.Errorf("unexpected python record digest: %q", item)
 				}
 
 				record.Digest = &pkg.PythonFileDigest{

syft/pkg/cataloger/python/parse_wheel_egg_record_test.go

@@ -32,7 +32,6 @@ func TestParseWheelEggRecord(t *testing.T) {
 				{Path: "Pygments-2.6.1.dist-info/RECORD"},
 				{Path: "pygments/__pycache__/__init__.cpython-38.pyc"},
 				{Path: "pygments/util.py", Digest: &pkg.PythonFileDigest{"sha256", "586xXHiJGGZxqk5PMBu3vBhE68DLuAe5MBARWrSPGxA"}, Size: "10778"},
-				{Path: "pygments/x_util.py", Digest: &pkg.PythonFileDigest{"sha256", "qpzzsOW31KT955agi-7NS--90I0iNiJCyLJQnRCHgKI="}, Size: "10778"},
 			},
 		},
 	}

syft/pkg/cataloger/python/test-fixtures/dist-info/RECORD

@@ -2,5 +2,4 @@
 Pygments-2.6.1.dist-info/AUTHORS,sha256=PVpa2_Oku6BGuiUvutvuPnWGpzxqFy2I8-NIrqCvqUY,8449
 Pygments-2.6.1.dist-info/RECORD,,
 pygments/__pycache__/__init__.cpython-38.pyc,,
-pygments/util.py,sha256=586xXHiJGGZxqk5PMBu3vBhE68DLuAe5MBARWrSPGxA,10778
-pygments/x_util.py,sha256=qpzzsOW31KT955agi-7NS--90I0iNiJCyLJQnRCHgKI=,10778
+pygments/util.py,sha256=586xXHiJGGZxqk5PMBu3vBhE68DLuAe5MBARWrSPGxA,10778

syft/pkg/cataloger/rpmdb/cataloger.go

@@ -7,7 +7,6 @@ import (
 	"fmt"
 
 	"github.com/anchore/syft/internal"
-
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
 )

syft/pkg/cataloger/rpmdb/parse_rpmdb.go

@@ -6,11 +6,10 @@ import (
 	"io/ioutil"
 	"os"
 
-	"github.com/anchore/syft/syft/file"
-
 	rpmdb "github.com/anchore/go-rpmdb/pkg"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
 )
@@ -90,7 +89,7 @@ func toELVersion(metadata pkg.RpmdbMetadata) string {
 }
 
 func extractRpmdbFileRecords(resolver source.FilePathResolver, entry *rpmdb.PackageInfo) []pkg.RpmdbFileRecord {
-	var records = make([]pkg.RpmdbFileRecord, 0)
+	records := make([]pkg.RpmdbFileRecord, 0)
 
 	for _, record := range entry.Files {
 		// only persist RPMDB file records which exist in the image/directory, otherwise ignore them

syft/pkg/cataloger/rpmdb/parse_rpmdb_test.go

@@ -51,8 +51,8 @@ func (r *rpmdbTestFileResolverMock) RelativeFileByPath(source.Location, string)
 	return nil
 }
 
-func (r *rpmdbTestFileResolverMock) FilesByMIMEType(...string) ([]source.Location, error) {
-	return nil, fmt.Errorf("not implemented")
+func (r rpmdbTestFileResolverMock) FilesByMIMEType(types ...string) ([]source.Location, error) {
+	panic("implement me")
 }
 
 func TestParseRpmDB(t *testing.T) {

syft/pkg/cataloger/ruby/parse_gemspec.go

@@ -9,11 +9,9 @@ import (
 	"strings"
 
 	"github.com/anchore/syft/internal"
-
-	"github.com/mitchellh/mapstructure"
-
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/common"
+	"github.com/mitchellh/mapstructure"
 )
 
 // integrity check
@@ -62,7 +60,7 @@ func processList(s string) []string {
 
 func parseGemSpecEntries(_ string, reader io.Reader) ([]pkg.Package, error) {
 	var pkgs []pkg.Package
-	var fields = make(map[string]interface{})
+	fields := make(map[string]interface{})
 	scanner := bufio.NewScanner(reader)
 
 	for scanner.Scan() {

syft/pkg/cataloger/rust/parse_cargo_lock.go

@@ -16,13 +16,13 @@ var _ common.ParserFn = parseCargoLock
 func parseCargoLock(_ string, reader io.Reader) ([]pkg.Package, error) {
 	tree, err := toml.LoadReader(reader)
 	if err != nil {
-		return nil, fmt.Errorf("unable to load Cargo.lock for parsing: %v", err)
+		return nil, fmt.Errorf("unable to load Cargo.lock for parsing: %w", err)
 	}
 
 	metadata := CargoMetadata{}
 	err = tree.Unmarshal(&metadata)
 	if err != nil {
-		return nil, fmt.Errorf("unable to parse Cargo.lock: %v", err)
+		return nil, fmt.Errorf("unable to parse Cargo.lock: %w", err)
 	}
 
 	return metadata.Pkgs(), nil

syft/pkg/dpkg_metadata.go

@@ -3,10 +3,9 @@ package pkg
 import (
 	"sort"
 
-	"github.com/anchore/syft/syft/file"
-
 	"github.com/anchore/packageurl-go"
 	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/syft/file"
 	"github.com/scylladb/go-set/strset"
 )
 

syft/pkg/golang_bin_metadata.go

@@ -1,7 +0,0 @@
-package pkg
-
-// GolangBinMetadata represents all captured data for a Golang Binary
-type GolangBinMetadata struct {
-	GoCompiledVersion string
-	H1Digest          string
-}

syft/pkg/metadata.go

@@ -15,7 +15,6 @@ const (
 	PythonPackageMetadataType    MetadataType = "PythonPackageMetadata"
 	RustCargoPackageMetadataType MetadataType = "RustCargoPackageMetadata"
 	KbPackageMetadataType        MetadataType = "KbPackageMetadata"
-	GolangBinMetadataType        MetadataType = "GolangBinMetadata"
 )
 
 var AllMetadataTypes = []MetadataType{
@@ -28,5 +27,4 @@ var AllMetadataTypes = []MetadataType{
 	PythonPackageMetadataType,
 	RustCargoPackageMetadataType,
 	KbPackageMetadataType,
-	GolangBinMetadataType,
 }

syft/pkg/ownership_by_files_relationship.go

@@ -21,7 +21,7 @@ type ownershipByFilesMetadata struct {
 }
 
 func ownershipByFilesRelationships(catalog *Catalog) []Relationship {
-	var relationships = findOwnershipByFilesRelationships(catalog)
+	relationships := findOwnershipByFilesRelationships(catalog)
 
 	var edges []Relationship
 	for parent, children := range relationships {
@@ -43,7 +43,7 @@ func ownershipByFilesRelationships(catalog *Catalog) []Relationship {
 // findOwnershipByFilesRelationships find overlaps in file ownership with a file that defines another package. Specifically, a .Location.Path of
 // a package is found to be owned by another (from the owner's .Metadata.Files[]).
 func findOwnershipByFilesRelationships(catalog *Catalog) map[ID]map[ID]*strset.Set {
-	var relationships = make(map[ID]map[ID]*strset.Set)
+	relationships := make(map[ID]map[ID]*strset.Set)
 
 	if catalog == nil {
 		return relationships

syft/pkg/rpmdb_metadata.go

@@ -5,12 +5,10 @@ import (
 	"sort"
 	"strconv"
 
-	"github.com/anchore/syft/syft/file"
-
-	"github.com/scylladb/go-set/strset"
-
 	"github.com/anchore/packageurl-go"
 	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/syft/file"
+	"github.com/scylladb/go-set/strset"
 )
 
 const RpmDBGlob = "**/var/lib/rpm/Packages"

syft/source/all_layers_resolver.go

@@ -25,7 +25,7 @@ func newAllLayersResolver(img *image.Image) (*allLayersResolver, error) {
 		return nil, fmt.Errorf("the image does not contain any layers")
 	}
 
-	var layers = make([]int, 0)
+	layers := make([]int, 0)
 	for idx := range img.Layers {
 		layers = append(layers, idx)
 	}
@@ -120,6 +120,7 @@ func (r *allLayersResolver) FilesByPath(paths ...string) ([]Location, error) {
 }
 
 // FilesByGlob returns all file.References that match the given path glob pattern from any layer in the image.
+
 func (r *allLayersResolver) FilesByGlob(patterns ...string) ([]Location, error) {
 	uniqueFileIDs := file.NewFileReferenceSet()
 	uniqueLocations := make([]Location, 0)

syft/source/directory_resolver.go

@@ -163,7 +163,6 @@ func (r directoryResolver) addPathToIndex(p string, info os.FileInfo) (string, e
 	if ref != nil {
 		r.refsByMIMEType[metadata.MIMEType] = append(r.refsByMIMEType[metadata.MIMEType], *ref)
 	}
-
 	r.metadata[ref.ID()] = metadata
 	return newRoot, nil
 }
@@ -205,7 +204,7 @@ func (r directoryResolver) String() string {
 
 // FilesByPath returns all file.References that match the given paths from the directory.
 func (r directoryResolver) FilesByPath(userPaths ...string) ([]Location, error) {
-	var references = make([]Location, 0)
+	references := make([]Location, 0)
 
 	for _, userPath := range userPaths {
 		userStrPath, err := r.requestPath(userPath)

syft/source/file_metadata.go

@@ -4,11 +4,9 @@ import (
 	"os"
 	"syscall"
 
-	"github.com/anchore/syft/internal/log"
-
 	"github.com/anchore/stereoscope/pkg/file"
-
 	"github.com/anchore/stereoscope/pkg/image"
+	"github.com/anchore/syft/internal/log"
 )
 
 type FileMetadata struct {

syft/source/file_resolver.go

@@ -29,7 +29,7 @@ type FilePathResolver interface {
 	FilesByPath(paths ...string) ([]Location, error)
 	// FilesByGlob fetches a set of file references which the given glob matches
 	FilesByGlob(patterns ...string) ([]Location, error)
-	// FilesByMIMEType fetches a set of file references which the contents have been classified as one of the given MIME Types
+	// FilesByGlob fetches a set of file references which the contents have been classified as one of the given MIME Types
 	FilesByMIMEType(types ...string) ([]Location, error)
 	// RelativeFileByPath fetches a single file at the given path relative to the layer squash of the given reference.
 	// This is helpful when attempting to find a file that is in the same layer or lower as another file.

syft/source/location.go

@@ -3,10 +3,9 @@ package source
 import (
 	"fmt"
 
-	"github.com/anchore/syft/internal/log"
-
 	"github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/stereoscope/pkg/image"
+	"github.com/anchore/syft/internal/log"
 )
 
 // Location represents a path relative to a particular filesystem resolved to a specific file.Reference. This struct is used as a key

syft/source/mock_resolver.go

@@ -35,7 +35,7 @@ func NewMockResolverForPaths(paths ...string) *MockResolver {
 
 func NewMockResolverForPathsWithMetadata(metadata map[Location]FileMetadata) *MockResolver {
 	var locations []Location
-	var mimeTypeIndex = make(map[string][]Location)
+	mimeTypeIndex := make(map[string][]Location)
 	for l, m := range metadata {
 		locations = append(locations, l)
 		mimeTypeIndex[m.MIMEType] = append(mimeTypeIndex[m.MIMEType], l)

syft/source/scheme.go

@@ -46,6 +46,7 @@ func detectScheme(fs afero.Fs, imageDetector sourceDetector, userInput string) (
 
 		fileMeta, err := fs.Stat(dirLocation)
 		if err != nil {
+			// nolint: nilerr
 			return UnknownScheme, source, "", nil
 		}
 

test/integration/catalog_packages_cases_test.go

@@ -131,24 +131,6 @@ var dirOnlyTestCases = []testCase{
 			"someotherpkg": "3.19.0",
 		},
 	},
-	{
-		name:        "find golang modules",
-		pkgType:     pkg.GoModulePkg,
-		pkgLanguage: pkg.Go,
-		pkgInfo: map[string]string{
-			"github.com/bmatcuk/doublestar": "v1.3.1",
-		},
-	},
-	{
-		name:        "find rust crates",
-		pkgType:     pkg.RustPkg,
-		pkgLanguage: pkg.Rust,
-		pkgInfo: map[string]string{
-			"memchr":        "2.3.3",
-			"nom":           "4.2.3",
-			"version_check": "0.1.5",
-		},
-	},
 }
 
 var commonTestCases = []testCase{
@@ -195,4 +177,22 @@ var commonTestCases = []testCase{
 			"libc-utils": "0.7.2-r0",
 		},
 	},
+	{
+		name:        "find golang modules",
+		pkgType:     pkg.GoModulePkg,
+		pkgLanguage: pkg.Go,
+		pkgInfo: map[string]string{
+			"github.com/bmatcuk/doublestar": "v1.3.1",
+		},
+	},
+	{
+		name:        "find rust crates",
+		pkgType:     pkg.RustPkg,
+		pkgLanguage: pkg.Rust,
+		pkgInfo: map[string]string{
+			"memchr":        "2.3.3",
+			"nom":           "4.2.3",
+			"version_check": "0.1.5",
+		},
+	},
 }

test/integration/catalog_packages_test.go

@@ -5,11 +5,12 @@ import (
 
 	"github.com/anchore/syft/syft/distro"
 	"github.com/anchore/syft/syft/pkg/cataloger"
-	"github.com/google/go-cmp/cmp"
 
 	"github.com/anchore/stereoscope/pkg/imagetest"
 	"github.com/anchore/syft/syft/source"
 
+	"github.com/go-test/deep"
+
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/syft/pkg"
 )
@@ -57,20 +58,12 @@ func TestPkgCoverageImage(t *testing.T) {
 		definedLanguages.Add(l.String())
 	}
 
-	// for image we remove the go mod and rust support by default
-	definedLanguages.Remove(pkg.Go.String())
-	definedLanguages.Remove(pkg.Rust.String())
-
 	observedPkgs := internal.NewStringSet()
 	definedPkgs := internal.NewStringSet()
 	for _, p := range pkg.AllPkgs {
 		definedPkgs.Add(string(p))
 	}
-
-	// for image we remove the go-module and rust-crate support by default
 	definedPkgs.Remove(string(pkg.KbPkg))
-	definedPkgs.Remove(string(pkg.GoModulePkg))
-	definedPkgs.Remove(string(pkg.RustPkg))
 
 	var cases []testCase
 	cases = append(cases, commonTestCases...)
@@ -82,11 +75,9 @@ func TestPkgCoverageImage(t *testing.T) {
 
 			for a := range catalog.Enumerate(c.pkgType) {
 
-				if a.Language.String() != "" {
-					observedLanguages.Add(a.Language.String())
-				}
-
+				observedLanguages.Add(a.Language.String())
 				observedPkgs.Add(string(a.Type))
+
 				expectedVersion, ok := c.pkgInfo[a.Name]
 				if !ok {
 					t.Errorf("unexpected package found: %s", a.Name)
@@ -123,14 +114,18 @@ func TestPkgCoverageImage(t *testing.T) {
 	definedPkgs.Remove(string(pkg.UnknownPkg))
 
 	// ensure that integration test cases stay in sync with the available catalogers
-	if diff := cmp.Diff(definedLanguages, observedLanguages); diff != "" {
+	if len(observedLanguages) < len(definedLanguages) {
 		t.Errorf("language coverage incomplete (languages=%d, coverage=%d)", len(definedLanguages), len(observedLanguages))
-		t.Errorf("definedLanguages mismatch observedLanguages (-want +got):\n%s", diff)
+		for _, d := range deep.Equal(observedLanguages, definedLanguages) {
+			t.Errorf("diff: %+v", d)
+		}
 	}
 
-	if diff := cmp.Diff(definedPkgs, observedPkgs); diff != "" {
+	if len(observedPkgs) < len(definedPkgs) {
 		t.Errorf("package coverage incomplete (packages=%d, coverage=%d)", len(definedPkgs), len(observedPkgs))
-		t.Errorf("definedPkgs mismatch observedPkgs (-want +got):\n%s", diff)
+		for _, d := range deep.Equal(observedPkgs, definedPkgs) {
+			t.Errorf("diff: %+v", d)
+		}
 	}
 }
 

test/integration/regression_go_bin_scanner_arch_test.go

@@ -1,48 +0,0 @@
-package integration
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/anchore/syft/syft/pkg"
-)
-
-func TestRegressionGoArchDiscovery(t *testing.T) {
-	const (
-		expectedELFPkg   = 3
-		expectedWINPkg   = 3
-		expectedMACOSPkg = 3
-	)
-	// This is a regression test to make sure the way we detect go binary packages
-	// stays consistent and reproducible as the tool chain evolves
-	catalog, _, _ := catalogFixtureImage(t, "image-go-bin-arch-coverage")
-
-	var actualELF, actualWIN, actualMACOS int
-
-	for p := range catalog.Enumerate(pkg.GoModulePkg) {
-		for _, l := range p.Locations {
-			switch {
-			case strings.Contains(l.RealPath, "elf"):
-				actualELF++
-			case strings.Contains(l.RealPath, "win"):
-				actualWIN++
-			case strings.Contains(l.RealPath, "macos"):
-				actualMACOS++
-			default:
-
-			}
-		}
-	}
-
-	if actualELF != expectedELFPkg {
-		t.Errorf("unexpected number of elf packages: %d != %d", expectedELFPkg, actualELF)
-	}
-
-	if actualWIN != expectedWINPkg {
-		t.Errorf("unexpected number of win packages: %d != %d", expectedWINPkg, actualWIN)
-	}
-
-	if actualMACOS != expectedMACOSPkg {
-		t.Errorf("unexpected number of macos packages: %d != %d", expectedMACOSPkg, actualMACOS)
-	}
-}

test/integration/test-fixtures/image-go-bin-arch-coverage/Dockerfile

@@ -1,16 +0,0 @@
-FROM golang:latest as builder
-WORKDIR /app
-COPY go.sum go.mod app.go ./
-
-RUN GOOS=linux go build -o elf .
-RUN GOOS=windows go build -o win .
-RUN GOOS=darwin go build -o macos .
-
-FROM scratch
-
-WORKDIR /tmp
-COPY --from=builder /app/elf /
-COPY --from=builder /app/win /
-COPY --from=builder /app/macos /
-
-ENTRYPOINT ["/elf"]

test/integration/test-fixtures/image-go-bin-arch-coverage/app.go

@@ -1,18 +0,0 @@
-//build:ignore
-package main
-
-import (
-	"fmt"
-	"os"
-
-	"golang.org/x/net/html"
-	"golang.org/x/term"
-)
-
-var test = html.ErrBufferExceeded
-
-func main() {
-	t := term.NewTerminal(os.Stdout, "foo")
-	t.Write([]byte("hello anchore"))
-	t.Write([]byte(fmt.Sprintf("%v", test)))
-}

test/integration/test-fixtures/image-go-bin-arch-coverage/go.mod

@@ -1,14 +0,0 @@
-module github.com/anchore/test
-
-go 1.17
-
-require (
-	golang.org/x/net v0.0.0-20211006190231-62292e806868
-	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211
-)
-
-require golang.org/x/sys v0.0.0-20211006194710-c8a6f5223071 // indirect
-
-exclude golang.org/x/net v0.0.0-20211005215030-d2e5035098b3
-
-replace golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 => golang.org/x/term v0.0.0-20210916214954-140adaaadfaf

test/integration/test-fixtures/image-go-bin-arch-coverage/go.sum

@@ -1,12 +0,0 @@
-golang.org/x/net v0.0.0-20211006190231-62292e806868 h1:KlOXYy8wQWTUJYFgkUI40Lzr06ofg5IRXUK5C7qZt1k=
-golang.org/x/net v0.0.0-20211006190231-62292e806868/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211006194710-c8a6f5223071 h1:PjhxBct4MZii8FFR8+oeS7QOvxKOTZXgk63EU2XpfJE=
-golang.org/x/sys v0.0.0-20211006194710-c8a6f5223071/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210916214954-140adaaadfaf h1:Ihq/mm/suC88gF8WFcVwk+OV6Tq+wyA1O0E5UEvDglI=
-golang.org/x/term v0.0.0-20210916214954-140adaaadfaf/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

test/integration/test-fixtures/image-large-apk-data/Dockerfile

@@ -1,8 +1,5 @@
 FROM alpine@sha256:d9a7354e3845ea8466bb00b22224d9116b183e594527fb5b6c3d30bc01a20378
-
-# we keep these unpinned so that if alpine
-# changes our integration tests can adapt
 RUN apk add --no-cache \
-            tzdata \
-            vim \
-            alpine-sdk
+            tzdata=2021a-r0 \
+            vim=8.2.2320-r0 \
+            alpine-sdk=1.0-r0

ui/event_handlers.go

@@ -21,11 +21,13 @@ import (
 	"github.com/wagoodman/jotframe/pkg/frame"
 )
 
-const maxBarWidth = 50
-const statusSet = components.SpinnerDotSet
-const completedStatus = "✔"
-const tileFormat = color.Bold
-const interval = 150 * time.Millisecond
+const (
+	maxBarWidth     = 50
+	statusSet       = components.SpinnerDotSet
+	completedStatus = "✔"
+	tileFormat      = color.Bold
+	interval        = 150 * time.Millisecond
+)
 
 // StatusTitleColumn is the column index in a given row where status text will be displayed.
 const StatusTitleColumn = 31
@@ -184,6 +186,7 @@ func PullDockerImageHandler(ctx context.Context, fr *frame.Frame, event partybus
 }
 
 // FetchImageHandler periodically writes a the image save and write-to-disk process in the form of a progress bar.
+
 func FetchImageHandler(ctx context.Context, fr *frame.Frame, event partybus.Event, wg *sync.WaitGroup) error {
 	_, prog, err := stereoEventParsers.ParseFetchImage(event)
 	if err != nil {
@@ -312,6 +315,7 @@ func PackageCatalogerStartedHandler(ctx context.Context, fr *frame.Frame, event
 }
 
 // SecretsCatalogerStartedHandler shows the intermittent secrets searching progress.
+
 func SecretsCatalogerStartedHandler(ctx context.Context, fr *frame.Frame, event partybus.Event, wg *sync.WaitGroup) error {
 	prog, err := syftEventParsers.ParseSecretsCatalogingStarted(event)
 	if err != nil {
@@ -399,6 +403,7 @@ func FileMetadataCatalogerStartedHandler(ctx context.Context, fr *frame.Frame, e
 }
 
 // FileIndexingStartedHandler shows the intermittent indexing progress from a directory resolver.
+
 func FileIndexingStartedHandler(ctx context.Context, fr *frame.Frame, event partybus.Event, wg *sync.WaitGroup) error {
 	path, prog, err := syftEventParsers.ParseFileIndexingStarted(event)
 	if err != nil {
@@ -484,6 +489,7 @@ func FileDigestsCatalogerStartedHandler(ctx context.Context, fr *frame.Frame, ev
 }
 
 // ImportStartedHandler shows the intermittent upload progress to Anchore Enterprise.
+
 func ImportStartedHandler(ctx context.Context, fr *frame.Frame, event partybus.Event, wg *sync.WaitGroup) error {
 	host, prog, err := syftEventParsers.ParseImportStarted(event)
 	if err != nil {