[WIP] migrate helper functions for spdx

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Makefile

@@ -15,10 +15,10 @@ RESET := $(shell tput -T linux sgr0)
 TITLE := $(BOLD)$(PURPLE)
 SUCCESS := $(BOLD)$(GREEN)
 # the quality gate lower threshold for unit test total % coverage (by function statements)
-COVERAGE_THRESHOLD := 65
+COVERAGE_THRESHOLD := 62
 # CI cache busting values; change these if you want CI to not use previous stored cache
 INTEGRATION_CACHE_BUSTER="88738d2f"
-CLI_CACHE_BUSTER="789bacdf"
+CLI_CACHE_BUSTER="9a2c03cf"
 BOOTSTRAP_CACHE="c7afb99ad"
 
 ## Build variables

README.md

@@ -1,5 +1,5 @@
 <p align="center">
-    <img src="https://user-images.githubusercontent.com/5199289/136844524-1527b09f-c5cb-4aa9-be54-5aa92a6086c1.png" width="271">
+    <img src="https://user-images.githubusercontent.com/5199289/136844524-1527b09f-c5cb-4aa9-be54-5aa92a6086c1.png" width="271" alt="Cute pink owl syft logo">
 </p>
 
 [![Validations](https://github.com/anchore/syft/actions/workflows/validations.yaml/badge.svg)](https://github.com/anchore/syft/actions/workflows/validations.yaml)
@@ -83,6 +83,7 @@ docker-archive:path/to/yourimage.tar   use a tarball from disk for archives crea
 oci-archive:path/to/yourimage.tar      use a tarball from disk for OCI archives (from Skopeo or otherwise)
 oci-dir:path/to/yourimage              read directly from a path on disk for OCI layout directories (from Skopeo or otherwise)
 dir:path/to/yourproject                read directly from a path on disk (any directory)
+file:path/to/yourproject/file          read directly from a path on disk (any single file)
 registry:yourrepo/yourimage:tag        pull image directly from a registry (no container runtime required)
 ```
 
@@ -94,7 +95,7 @@ The output format for Syft is configurable as well:
 syft packages <image> -o <format>
 ```
 
-Where the `format`s available are:
+Where the `formats` available are:
 - `json`: Use this to get as much information out of Syft as possible!
 - `text`: A row-oriented, human-and-machine-friendly output.
 - `cyclonedx`: A XML report conforming to the [CycloneDX 1.2 specification](https://cyclonedx.org/specification/overview/).
@@ -102,6 +103,88 @@ Where the `format`s available are:
 - `spdx-json`: A JSON report conforming to the [SPDX 2.2 JSON Schema](https://github.com/spdx/spdx-spec/blob/v2.2/schemas/spdx-schema.json).
 - `table`: A columnar summary (default).
 
+## Private Registry Authentication
+
+### Local Docker Credentials
+When a container runtime is not present, Syft can still utilize credentials configured in common credential sources (such as `~/.docker/config.json`). 
+It will pull images from private registries using these credentials. The config file is where your credentials are stored when authenticating with private registries via some command like `docker login`. 
+For more information see the `go-containerregistry` [documentation](https://github.com/google/go-containerregistry/tree/main/pkg/authn).
+
+
+An example `config.json` looks something like this:
+```
+// config.json
+{
+	"auths": {
+		"registry.example.com": {
+			"username": "AzureDiamond",
+			"password": "hunter2"
+		}
+	}
+}
+```
+
+You can run the following command as an example. It details the mount/environment configuration a container needs to access a private registry:
+
+`docker run -v ./config.json:/config/config.json -e "DOCKER_CONFIG=/config" anchore/syft:latest  <private_image>`
+
+
+### Docker Credentials in Kubernetes
+The below section shows a simple workflow on how to mount this config file as a secret into a container on kubernetes.
+1. Create a secret. The value of `config.json` is important. It refers to the specification detailed [here](https://github.com/google/go-containerregistry/tree/main/pkg/authn#the-config-file). 
+Below this section is the `secret.yaml` file that the pod configuration will consume as a volume. 
+The key `config.json` is important. It will end up being the name of the file when mounted into the pod.
+    ```
+    # secret.yaml
+    
+    apiVersion: v1
+    kind: Secret
+    metadata:
+      name: registry-config
+      namespace: syft
+    data:
+      config.json: <base64 encoded config.json>
+    ```
+
+    `kubectl apply -f secret.yaml`
+
+
+2. Create your pod running syft. The env `DOCKER_CONFIG` is important because it advertises where to look for the credential file. 
+In the below example, setting `DOCKER_CONFIG=/config` informs syft that credentials can be found at `/config/config.json`. 
+This is why we used `config.json` as the key for our secret. When mounted into containers the secrets' key is used as the filename. 
+The `volumeMounts` section mounts our secret to `/config`. The `volumes` section names our volume and leverages the secret we created in step one.
+    ```
+    # pod.yaml
+    
+    apiVersion: v1
+    kind: Pod
+    spec:
+      containers:
+        - image: anchore/syft:latest
+          name: syft-private-registry-demo
+          env:
+            - name: DOCKER_CONFIG
+              value: /config
+          volumeMounts:
+          - mountPath: /config
+            name: registry-config
+            readOnly: true
+          args:
+            - <private_image>
+      volumes:
+      - name: registry-config
+        secret:
+          secretName: registry-config
+    ```
+
+    `kubectl apply -f pod.yaml`
+
+
+3. The user can now run `kubectl logs syft-private-registry-demo`. The logs should show the syft analysis for the `<private_image>` provided in the pod configuration.
+
+Using the above information, users should be able to configure private registry access without having to do so in the `grype` or `syft` configuration files.
+They will also not be dependent on a docker daemon, (or some other runtime software) for registry configuration and access.
+
 ## Configuration
 
 Configuration search paths:

cmd/packages.go

@@ -6,19 +6,19 @@ import (
 	"io/ioutil"
 	"os"
 
-	"github.com/anchore/syft/syft/format"
-
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/anchore"
 	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/formats"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/ui"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/distro"
 	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/format"
 	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/presenter/packages"
+	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 	"github.com/pkg/profile"
 	"github.com/spf13/cobra"
@@ -45,6 +45,7 @@ const (
     {{.appName}} {{.command}} oci-archive:path/to/yourimage.tar      use a tarball from disk for OCI archives (from Skopeo or otherwise)
     {{.appName}} {{.command}} oci-dir:path/to/yourimage              read directly from a path on disk for OCI layout directories (from Skopeo or otherwise)
     {{.appName}} {{.command}} dir:path/to/yourproject                read directly from a path on disk (any directory)
+    {{.appName}} {{.command}} file:path/to/yourproject/file          read directly from a path on disk (any single file)
     {{.appName}} {{.command}} registry:yourrepo/yourimage:tag        pull image directly from a registry (no container runtime required)
 `
 )
@@ -239,6 +240,12 @@ func packagesExecWorker(userInput string) <-chan error {
 	go func() {
 		defer close(errs)
 
+		f := formats.ByOption(packagesPresenterOpt)
+		if f == nil {
+			errs <- fmt.Errorf("unknown format: %s", packagesPresenterOpt)
+			return
+		}
+
 		checkForApplicationUpdate()
 
 		src, cleanup, err := source.New(userInput, appConfig.Registry.ToOptions())
@@ -248,33 +255,37 @@ func packagesExecWorker(userInput string) <-chan error {
 		}
 		defer cleanup()
 
-		catalog, d, err := syft.CatalogPackages(src, appConfig.Package.Cataloger.ScopeOpt)
+		catalog, relationships, d, err := syft.CatalogPackages(src, appConfig.Package.Cataloger.ScopeOpt)
 		if err != nil {
 			errs <- fmt.Errorf("failed to catalog input: %w", err)
 			return
 		}
 
 		if appConfig.Anchore.Host != "" {
-			if err := runPackageSbomUpload(src, src.Metadata, catalog, d, appConfig.Package.Cataloger.ScopeOpt); err != nil {
+			if err := runPackageSbomUpload(src, src.Metadata, catalog, d); err != nil {
 				errs <- err
 				return
 			}
 		}
 
-		bus.Publish(partybus.Event{
-			Type: event.PresenterReady,
-			Value: packages.Presenter(packagesPresenterOpt, packages.PresenterConfig{
-				SourceMetadata: src.Metadata,
-				Catalog:        catalog,
+		sbomResult := sbom.SBOM{
+			Artifacts: sbom.Artifacts{
+				PackageCatalog: catalog,
 				Distro:         d,
-				Scope:          appConfig.Package.Cataloger.ScopeOpt,
-			}),
+			},
+			Relationships: relationships,
+			Source:        src.Metadata,
+		}
+
+		bus.Publish(partybus.Event{
+			Type:  event.PresenterReady,
+			Value: f.Presenter(sbomResult),
 		})
 	}()
 	return errs
 }
 
-func runPackageSbomUpload(src *source.Source, s source.Metadata, catalog *pkg.Catalog, d *distro.Distro, scope source.Scope) error {
+func runPackageSbomUpload(src *source.Source, s source.Metadata, catalog *pkg.Catalog, d *distro.Distro) error {
 	log.Infof("uploading results to %s", appConfig.Anchore.Host)
 
 	if src.Metadata.Scheme != source.ImageScheme {
@@ -314,7 +325,6 @@ func runPackageSbomUpload(src *source.Source, s source.Metadata, catalog *pkg.Ca
 		Distro:                  d,
 		Dockerfile:              dockerfileContents,
 		OverwriteExistingUpload: appConfig.Anchore.OverwriteExistingImage,
-		Scope:                   scope,
 		Timeout:                 appConfig.Anchore.ImportTimeout,
 	}
 

cmd/power_user.go

@@ -4,6 +4,10 @@ import (
 	"fmt"
 	"sync"
 
+	"github.com/anchore/syft/syft/artifact"
+
+	"github.com/anchore/syft/syft/sbom"
+
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/bus"
@@ -86,7 +90,6 @@ func powerUserExec(_ *cobra.Command, args []string) error {
 		ui.Select(isVerbose(), appConfig.Quiet, reporter)...,
 	)
 }
-
 func powerUserExecWorker(userInput string) <-chan error {
 	errs := make(chan error)
 	go func() {
@@ -107,29 +110,61 @@ func powerUserExecWorker(userInput string) <-chan error {
 		}
 		defer cleanup()
 
-		analysisResults := poweruser.JSONDocumentConfig{
-			SourceMetadata:    src.Metadata,
-			ApplicationConfig: *appConfig,
+		s := sbom.SBOM{
+			Source: src.Metadata,
 		}
 
-		wg := &sync.WaitGroup{}
+		var results []<-chan artifact.Relationship
 		for _, task := range tasks {
-			wg.Add(1)
-			go func(task powerUserTask) {
-				defer wg.Done()
-				if err = task(&analysisResults, src); err != nil {
-					errs <- err
-					return
-				}
-			}(task)
+			c := make(chan artifact.Relationship)
+			results = append(results, c)
+
+			go runTask(task, &s.Artifacts, src, c, errs)
 		}
 
-		wg.Wait()
+		for relationship := range mergeResults(results...) {
+			s.Relationships = append(s.Relationships, relationship)
+		}
 
 		bus.Publish(partybus.Event{
 			Type:  event.PresenterReady,
-			Value: poweruser.NewJSONPresenter(analysisResults),
+			Value: poweruser.NewJSONPresenter(s, *appConfig),
 		})
 	}()
 	return errs
 }
+
+func runTask(t powerUserTask, a *sbom.Artifacts, src *source.Source, c chan<- artifact.Relationship, errs chan<- error) {
+	defer close(c)
+
+	relationships, err := t(a, src)
+	if err != nil {
+		errs <- err
+		return
+	}
+
+	for _, relationship := range relationships {
+		c <- relationship
+	}
+}
+
+func mergeResults(cs ...<-chan artifact.Relationship) <-chan artifact.Relationship {
+	var wg sync.WaitGroup
+	var results = make(chan artifact.Relationship)
+
+	wg.Add(len(cs))
+	for _, c := range cs {
+		go func(c <-chan artifact.Relationship) {
+			for n := range c {
+				results <- n
+			}
+			wg.Done()
+		}(c)
+	}
+
+	go func() {
+		wg.Wait()
+		close(results)
+	}()
+	return results
+}

cmd/power_user_tasks.go

@@ -4,13 +4,16 @@ import (
 	"crypto"
 	"fmt"
 
-	"github.com/anchore/syft/internal/presenter/poweruser"
+	"github.com/anchore/syft/syft/artifact"
+
+	"github.com/anchore/syft/syft/sbom"
+
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/source"
 )
 
-type powerUserTask func(*poweruser.JSONDocumentConfig, *source.Source) error
+type powerUserTask func(*sbom.Artifacts, *source.Source) ([]artifact.Relationship, error)
 
 func powerUserTasks() ([]powerUserTask, error) {
 	var tasks []powerUserTask
@@ -42,16 +45,16 @@ func catalogPackagesTask() (powerUserTask, error) {
 		return nil, nil
 	}
 
-	task := func(results *poweruser.JSONDocumentConfig, src *source.Source) error {
-		packageCatalog, theDistro, err := syft.CatalogPackages(src, appConfig.Package.Cataloger.ScopeOpt)
+	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
+		packageCatalog, relationships, theDistro, err := syft.CatalogPackages(src, appConfig.Package.Cataloger.ScopeOpt)
 		if err != nil {
-			return err
+			return nil, err
 		}
 
 		results.PackageCatalog = packageCatalog
 		results.Distro = theDistro
 
-		return nil
+		return relationships, nil
 	}
 
 	return task, nil
@@ -64,18 +67,18 @@ func catalogFileMetadataTask() (powerUserTask, error) {
 
 	metadataCataloger := file.NewMetadataCataloger()
 
-	task := func(results *poweruser.JSONDocumentConfig, src *source.Source) error {
+	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
 		resolver, err := src.FileResolver(appConfig.FileMetadata.Cataloger.ScopeOpt)
 		if err != nil {
-			return err
+			return nil, err
 		}
 
 		result, err := metadataCataloger.Catalog(resolver)
 		if err != nil {
-			return err
+			return nil, err
 		}
 		results.FileMetadata = result
-		return nil
+		return nil, nil
 	}
 
 	return task, nil
@@ -110,18 +113,18 @@ func catalogFileDigestsTask() (powerUserTask, error) {
 		return nil, err
 	}
 
-	task := func(results *poweruser.JSONDocumentConfig, src *source.Source) error {
+	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
 		resolver, err := src.FileResolver(appConfig.FileMetadata.Cataloger.ScopeOpt)
 		if err != nil {
-			return err
+			return nil, err
 		}
 
 		result, err := digestsCataloger.Catalog(resolver)
 		if err != nil {
-			return err
+			return nil, err
 		}
 		results.FileDigests = result
-		return nil
+		return nil, nil
 	}
 
 	return task, nil
@@ -142,18 +145,18 @@ func catalogSecretsTask() (powerUserTask, error) {
 		return nil, err
 	}
 
-	task := func(results *poweruser.JSONDocumentConfig, src *source.Source) error {
+	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
 		resolver, err := src.FileResolver(appConfig.Secrets.Cataloger.ScopeOpt)
 		if err != nil {
-			return err
+			return nil, err
 		}
 
 		result, err := secretsCataloger.Catalog(resolver)
 		if err != nil {
-			return err
+			return nil, err
 		}
 		results.Secrets = result
-		return nil
+		return nil, nil
 	}
 
 	return task, nil
@@ -170,18 +173,18 @@ func catalogFileClassificationsTask() (powerUserTask, error) {
 		return nil, err
 	}
 
-	task := func(results *poweruser.JSONDocumentConfig, src *source.Source) error {
+	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
 		resolver, err := src.FileResolver(appConfig.FileClassification.Cataloger.ScopeOpt)
 		if err != nil {
-			return err
+			return nil, err
 		}
 
 		result, err := classifierCataloger.Catalog(resolver)
 		if err != nil {
-			return err
+			return nil, err
 		}
 		results.FileClassifications = result
-		return nil
+		return nil, nil
 	}
 
 	return task, nil
@@ -197,18 +200,18 @@ func catalogContentsTask() (powerUserTask, error) {
 		return nil, err
 	}
 
-	task := func(results *poweruser.JSONDocumentConfig, src *source.Source) error {
+	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
 		resolver, err := src.FileResolver(appConfig.FileContents.Cataloger.ScopeOpt)
 		if err != nil {
-			return err
+			return nil, err
 		}
 
 		result, err := contentsCataloger.Catalog(resolver)
 		if err != nil {
-			return err
+			return nil, err
 		}
 		results.FileContents = result
-		return nil
+		return nil, nil
 	}
 
 	return task, nil

go.mod

@@ -7,6 +7,7 @@ require (
 	github.com/adrg/xdg v0.2.1
 	github.com/alecthomas/jsonschema v0.0.0-20210301060011-54c507b6f074
 	github.com/anchore/client-go v0.0.0-20210222170800-9c70f9b80bcf
+	github.com/anchore/go-presenter v0.0.0-20211102174526-0dbf20f6c7fa
 	github.com/anchore/go-rpmdb v0.0.0-20210914181456-a9c52348da63
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
@@ -23,8 +24,9 @@ require (
 	github.com/gookit/color v1.2.7
 	github.com/hashicorp/go-multierror v1.1.0
 	github.com/hashicorp/go-version v1.2.0
+	github.com/jinzhu/copier v0.3.2
 	github.com/mitchellh/go-homedir v1.1.0
-	github.com/mitchellh/hashstructure v1.1.0
+	github.com/mitchellh/hashstructure/v2 v2.0.2
 	github.com/mitchellh/mapstructure v1.3.1
 	github.com/olekukonko/tablewriter v0.0.4
 	github.com/pelletier/go-toml v1.8.1

go.sum

@@ -108,6 +108,8 @@ github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRF
 github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
 github.com/anchore/client-go v0.0.0-20210222170800-9c70f9b80bcf h1:DYssiUV1pBmKqzKsm4mqXx8artqC0Q8HgZsVI3lMsAg=
 github.com/anchore/client-go v0.0.0-20210222170800-9c70f9b80bcf/go.mod h1:FaODhIA06mxO1E6R32JE0TL1JWZZkmjRIAd4ULvHUKk=
+github.com/anchore/go-presenter v0.0.0-20211102174526-0dbf20f6c7fa h1:mDLUAkgXsV5Z8D0EEj8eS6FBekolV/A+Xxbs9054bPw=
+github.com/anchore/go-presenter v0.0.0-20211102174526-0dbf20f6c7fa/go.mod h1:29jwxTSAS6pBcrmuwf1U3r1Tqp1o1XpuiOJ0NT9NoGg=
 github.com/anchore/go-rpmdb v0.0.0-20210914181456-a9c52348da63 h1:C9W/LAydEz/qdUhx1MdjO9l8NEcFKYknkxDVyo9LAoM=
 github.com/anchore/go-rpmdb v0.0.0-20210914181456-a9c52348da63/go.mod h1:6qH8c6U/3CBVvDDDBZnPSTbTINq3cIdADUYTaVf75EM=
 github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04 h1:VzprUTpc0vW0nnNKJfJieyH/TZ9UYAnTZs5/gHTdAe8=
@@ -452,6 +454,8 @@ github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NH
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/jarcoal/httpmock v1.0.5/go.mod h1:ATjnClrvW/3tijVmpL/va5Z3aAyGvqU3gCT8nX0Txik=
 github.com/jingyugao/rowserrcheck v0.0.0-20191204022205-72ab7603b68a/go.mod h1:xRskid8CManxVta/ALEhJha/pweKBaVG6fWgc0yH25s=
+github.com/jinzhu/copier v0.3.2 h1:QdBOCbaouLDYaIPFfi1bKv5F5tPpeTwXe4sD0jqtz5w=
+github.com/jinzhu/copier v0.3.2/go.mod h1:24xnZezI2Yqac9J61UC6/dG/k76ttpq0DdJI3QmUvro=
 github.com/jirfag/go-printf-func-name v0.0.0-20191110105641-45db9963cdd3/go.mod h1:HEWGJkRDzjJY2sqdDwxccsGicWEf9BQOZsq2tV+xzM0=
 github.com/jirfag/go-printf-func-name v0.0.0-20200119135958-7558a9eaa5af/go.mod h1:HEWGJkRDzjJY2sqdDwxccsGicWEf9BQOZsq2tV+xzM0=
 github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
@@ -542,8 +546,8 @@ github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrk
 github.com/mitchellh/go-ps v0.0.0-20190716172923-621e5597135b/go.mod h1:r1VsdOzOPt1ZSrGZWFoNhsAedKnEd6r9Np1+5blZCWk=
 github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
 github.com/mitchellh/gox v0.4.0/go.mod h1:Sd9lOJ0+aimLBi73mGofS1ycjY8lL3uZM3JPS42BGNg=
-github.com/mitchellh/hashstructure v1.1.0 h1:P6P1hdjqAAknpY/M1CGipelZgp+4y9ja9kmUZPXP+H0=
-github.com/mitchellh/hashstructure v1.1.0/go.mod h1:xUDAozZz0Wmdiufv0uyhnHkUTN6/6d8ulp4AwfLKrmA=
+github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4NcD46KavDd4=
+github.com/mitchellh/hashstructure/v2 v2.0.2/go.mod h1:MG3aRVU/N29oo/V/IhBX8GR/zz4kQkprJgF2EVszyDE=
 github.com/mitchellh/iochan v1.0.0/go.mod h1:JwYml1nuB7xOzsp52dPpHFffvOCDupsG0QubkSMEySY=
 github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=

internal/anchore/import.go

@@ -26,7 +26,6 @@ type ImportConfig struct {
 	Distro                  *distro.Distro
 	Dockerfile              []byte
 	OverwriteExistingUpload bool
-	Scope                   source.Scope
 	Timeout                 uint
 }
 
@@ -74,7 +73,7 @@ func (c *Client) Import(ctx context.Context, cfg ImportConfig) error {
 	prog.N++
 	sessionID := startOperation.Uuid
 
-	packageDigest, err := importPackageSBOM(authedCtx, c.client.ImportsApi, sessionID, cfg.SourceMetadata, cfg.Catalog, cfg.Distro, cfg.Scope, stage)
+	packageDigest, err := importPackageSBOM(authedCtx, c.client.ImportsApi, sessionID, cfg.SourceMetadata, cfg.Catalog, cfg.Distro, stage)
 	if err != nil {
 		return fmt.Errorf("failed to import Package SBOM: %w", err)
 	}

internal/anchore/import_package_sbom.go

@@ -8,6 +8,8 @@ import (
 	"fmt"
 	"net/http"
 
+	"github.com/anchore/syft/syft/sbom"
+
 	"github.com/anchore/syft/internal/formats/syftjson"
 
 	"github.com/wagoodman/go-progress"
@@ -24,10 +26,19 @@ type packageSBOMImportAPI interface {
 	ImportImagePackages(context.Context, string, external.ImagePackageManifest) (external.ImageImportContentResponse, *http.Response, error)
 }
 
-func packageSbomModel(s source.Metadata, catalog *pkg.Catalog, d *distro.Distro, scope source.Scope) (*external.ImagePackageManifest, error) {
+func packageSbomModel(srcMetadata source.Metadata, catalog *pkg.Catalog, d *distro.Distro) (*external.ImagePackageManifest, error) {
 	var buf bytes.Buffer
 
-	err := syftjson.Format().Presenter(catalog, &s, d, scope).Present(&buf)
+	// TODO: once the top-level API is refactored and SBOMs are the unit of work, then this function will be passed an SBOM and there would be no more need to create an SBOM object here.
+	s := sbom.SBOM{
+		Artifacts: sbom.Artifacts{
+			PackageCatalog: catalog,
+			Distro:         d,
+		},
+		Source: srcMetadata,
+	}
+
+	err := syftjson.Format().Presenter(s).Present(&buf)
 	if err != nil {
 		return nil, fmt.Errorf("unable to serialize results: %w", err)
 	}
@@ -41,11 +52,11 @@ func packageSbomModel(s source.Metadata, catalog *pkg.Catalog, d *distro.Distro,
 	return &model, nil
 }
 
-func importPackageSBOM(ctx context.Context, api packageSBOMImportAPI, sessionID string, s source.Metadata, catalog *pkg.Catalog, d *distro.Distro, scope source.Scope, stage *progress.Stage) (string, error) {
+func importPackageSBOM(ctx context.Context, api packageSBOMImportAPI, sessionID string, s source.Metadata, catalog *pkg.Catalog, d *distro.Distro, stage *progress.Stage) (string, error) {
 	log.Debug("importing package SBOM")
 	stage.Current = "package SBOM"
 
-	model, err := packageSbomModel(s, catalog, d, scope)
+	model, err := packageSbomModel(s, catalog, d)
 	if err != nil {
 		return "", fmt.Errorf("unable to create PackageSBOM model: %w", err)
 	}

internal/anchore/import_package_sbom_test.go

@@ -9,6 +9,8 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/anchore/syft/syft/sbom"
+
 	"github.com/anchore/client-go/pkg/external"
 	"github.com/anchore/syft/internal/formats/syftjson"
 	syftjsonModel "github.com/anchore/syft/internal/formats/syftjson/model"
@@ -72,7 +74,7 @@ func TestPackageSbomToModel(t *testing.T) {
 
 	c := pkg.NewCatalog(p)
 
-	model, err := packageSbomModel(m, c, &d, source.AllLayersScope)
+	model, err := packageSbomModel(m, c, &d)
 	if err != nil {
 		t.Fatalf("unable to generate model from source material: %+v", err)
 	}
@@ -84,8 +86,16 @@ func TestPackageSbomToModel(t *testing.T) {
 		t.Fatalf("unable to marshal model: %+v", err)
 	}
 
+	s := sbom.SBOM{
+		Artifacts: sbom.Artifacts{
+			PackageCatalog: c,
+			Distro:         &d,
+		},
+		Source: m,
+	}
+
 	var buf bytes.Buffer
-	pres := syftjson.Format().Presenter(c, &m, &d, source.AllLayersScope)
+	pres := syftjson.Format().Presenter(s)
 	if err := pres.Present(&buf); err != nil {
 		t.Fatalf("unable to get expected json: %+v", err)
 	}
@@ -187,7 +197,7 @@ func TestPackageSbomImport(t *testing.T) {
 
 	d, _ := distro.NewDistro(distro.CentOS, "8.0", "")
 
-	theModel, err := packageSbomModel(m, catalog, &d, source.AllLayersScope)
+	theModel, err := packageSbomModel(m, catalog, &d)
 	if err != nil {
 		t.Fatalf("could not get sbom model: %+v", err)
 	}
@@ -226,7 +236,7 @@ func TestPackageSbomImport(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 
-			digest, err := importPackageSBOM(context.TODO(), test.api, sessionID, m, catalog, &d, source.AllLayersScope, &progress.Stage{})
+			digest, err := importPackageSBOM(context.TODO(), test.api, sessionID, m, catalog, &d, &progress.Stage{})
 
 			// validate error handling
 			if err != nil && !test.expectsError {

internal/formats/common/spdxhelpers/description.go

@@ -2,7 +2,7 @@ package spdxhelpers
 
 import "github.com/anchore/syft/syft/pkg"
 
-func Description(p *pkg.Package) string {
+func Description(p pkg.Package) string {
 	if hasMetadata(p) {
 		switch metadata := p.Metadata.(type) {
 		case pkg.ApkMetadata:
@@ -14,10 +14,6 @@ func Description(p *pkg.Package) string {
 	return ""
 }
 
-func packageExists(p *pkg.Package) bool {
-	return p != nil
-}
-
-func hasMetadata(p *pkg.Package) bool {
-	return packageExists(p) && p.Metadata != nil
+func hasMetadata(p pkg.Package) bool {
+	return p.Metadata != nil
 }

internal/formats/common/spdxhelpers/description_test.go

@@ -50,7 +50,7 @@ func Test_Description(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, Description(&test.input))
+			assert.Equal(t, test.expected, Description(test.input))
 		})
 	}
 }

internal/formats/common/spdxhelpers/document_name.go

@@ -0,0 +1,32 @@
+package spdxhelpers
+
+import (
+	"path"
+	"strings"
+
+	"github.com/anchore/syft/syft/source"
+	"github.com/google/uuid"
+)
+
+func DocumentName(srcMetadata source.Metadata) string {
+	switch srcMetadata.Scheme {
+	case source.ImageScheme:
+		return cleanSPDXName(srcMetadata.ImageMetadata.UserInput)
+	case source.DirectoryScheme:
+		return cleanSPDXName(srcMetadata.Path)
+	}
+
+	// TODO: is this alright?
+	return uuid.Must(uuid.NewRandom()).String()
+}
+
+func cleanSPDXName(name string) string {
+	// remove # according to specification
+	name = strings.ReplaceAll(name, "#", "-")
+
+	// remove : for url construction
+	name = strings.ReplaceAll(name, ":", "-")
+
+	// clean relative pathing
+	return path.Clean(name)
+}

internal/formats/common/spdxhelpers/document_namespace.go

@@ -0,0 +1,29 @@
+package spdxhelpers
+
+import (
+	"fmt"
+	"path"
+
+	"github.com/anchore/syft/syft/source"
+	"github.com/google/uuid"
+)
+
+const SyftDocumentNamespace = "https://anchore.com/syft"
+
+func DocumentNamespace(name string, srcMetadata source.Metadata) string {
+	input := "unknown-source-type"
+	switch srcMetadata.Scheme {
+	case source.ImageScheme:
+		input = "image"
+	case source.DirectoryScheme:
+		input = "dir"
+	}
+
+	uniqueID := uuid.Must(uuid.NewRandom())
+	identifier := path.Join(input, uniqueID.String())
+	if name != "." {
+		identifier = path.Join(input, fmt.Sprintf("%s-%s", name, uniqueID.String()))
+	}
+
+	return path.Join(SyftDocumentNamespace, identifier)
+}

internal/formats/common/spdxhelpers/download_location.go

@@ -2,7 +2,7 @@ package spdxhelpers
 
 import "github.com/anchore/syft/syft/pkg"
 
-func DownloadLocation(p *pkg.Package) string {
+func DownloadLocation(p pkg.Package) string {
 	// 3.7: Package Download Location
 	// Cardinality: mandatory, one
 	// NONE if there is no download location whatsoever.

internal/formats/common/spdxhelpers/download_location_test.go

@@ -48,7 +48,7 @@ func Test_DownloadLocation(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, DownloadLocation(&test.input))
+			assert.Equal(t, test.expected, DownloadLocation(test.input))
 		})
 	}
 }

internal/formats/common/spdxhelpers/external_refs.go

@@ -6,13 +6,9 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 )
 
-func ExternalRefs(p *pkg.Package) (externalRefs []model.ExternalRef) {
+func ExternalRefs(p pkg.Package) (externalRefs []model.ExternalRef) {
 	externalRefs = make([]model.ExternalRef, 0)
 
-	if !packageExists(p) {
-		return externalRefs
-	}
-
 	for _, c := range p.CPEs {
 		externalRefs = append(externalRefs, model.ExternalRef{
 			ReferenceCategory: model.SecurityReferenceCategory,

internal/formats/common/spdxhelpers/external_refs_test.go

@@ -39,7 +39,7 @@ func Test_ExternalRefs(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			assert.ElementsMatch(t, test.expected, ExternalRefs(&test.input))
+			assert.ElementsMatch(t, test.expected, ExternalRefs(test.input))
 		})
 	}
 }

internal/formats/common/spdxhelpers/files.go

@@ -9,7 +9,7 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 )
 
-func Files(packageSpdxID string, p *pkg.Package) (files []model.File, fileIDs []string, relationships []model.Relationship) {
+func Files(packageSpdxID string, p pkg.Package) (files []model.File, fileIDs []string, relationships []model.Relationship) {
 	files = make([]model.File, 0)
 	fileIDs = make([]string, 0)
 	relationships = make([]model.Relationship, 0)

internal/formats/common/spdxhelpers/homepage.go

@@ -2,7 +2,7 @@ package spdxhelpers
 
 import "github.com/anchore/syft/syft/pkg"
 
-func Homepage(p *pkg.Package) string {
+func Homepage(p pkg.Package) string {
 	if hasMetadata(p) {
 		switch metadata := p.Metadata.(type) {
 		case pkg.GemMetadata:

internal/formats/common/spdxhelpers/homepage_test.go

@@ -50,7 +50,7 @@ func Test_Homepage(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, Homepage(&test.input))
+			assert.Equal(t, test.expected, Homepage(test.input))
 		})
 	}
 }

internal/formats/common/spdxhelpers/license.go

@@ -7,7 +7,7 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 )
 
-func License(p *pkg.Package) string {
+func License(p pkg.Package) string {
 	// source: https://spdx.github.io/spdx-spec/3-package-information/#313-concluded-license
 	// The options to populate this field are limited to:
 	// A valid SPDX License Expression as defined in Appendix IV;
@@ -17,7 +17,7 @@ func License(p *pkg.Package) string {
 	//   (ii) the SPDX file creator has made no attempt to determine this field; or
 	//   (iii) the SPDX file creator has intentionally provided no information (no meaning should be implied by doing so).
 
-	if !packageExists(p) || len(p.Licenses) == 0 {
+	if len(p.Licenses) == 0 {
 		return "NONE"
 	}
 

internal/formats/common/spdxhelpers/license_test.go

@@ -67,7 +67,7 @@ func Test_License(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, License(&test.input))
+			assert.Equal(t, test.expected, License(test.input))
 		})
 	}
 }

internal/formats/common/spdxhelpers/originator_test.go

@@ -108,7 +108,7 @@ func Test_Originator(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, Originator(&test.input))
+			assert.Equal(t, test.expected, Originator(test.input))
 		})
 	}
 }

internal/formats/common/spdxhelpers/origintor.go

@@ -6,7 +6,7 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 )
 
-func Originator(p *pkg.Package) string {
+func Originator(p pkg.Package) string {
 	if hasMetadata(p) {
 		switch metadata := p.Metadata.(type) {
 		case pkg.ApkMetadata:

internal/formats/common/spdxhelpers/source_info.go

@@ -6,11 +6,7 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 )
 
-func SourceInfo(p *pkg.Package) string {
-	if !packageExists(p) {
-		return ""
-	}
-
+func SourceInfo(p pkg.Package) string {
 	answer := ""
 	switch p.Type {
 	case pkg.RpmPkg:

internal/formats/common/spdxhelpers/source_info_test.go

@@ -131,7 +131,7 @@ func Test_SourceInfo(t *testing.T) {
 			if test.input.Type != "" {
 				pkgTypes = append(pkgTypes, test.input.Type)
 			}
-			actual := SourceInfo(&test.input)
+			actual := SourceInfo(test.input)
 			for _, expected := range test.expected {
 				assert.Contains(t, actual, expected)
 			}

internal/formats/common/testutils/utils.go

@@ -4,13 +4,14 @@ import (
 	"bytes"
 	"testing"
 
+	"github.com/anchore/go-presenter"
 	"github.com/anchore/go-testutils"
 	"github.com/anchore/stereoscope/pkg/filetree"
 	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/stereoscope/pkg/imagetest"
 	"github.com/anchore/syft/syft/distro"
 	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/presenter"
+	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 	"github.com/sergi/go-diff/diffmatchpatch"
 	"github.com/stretchr/testify/assert"
@@ -90,7 +91,7 @@ func AssertPresenterAgainstGoldenSnapshot(t *testing.T, pres presenter.Presenter
 	}
 }
 
-func ImageInput(t testing.TB, testImage string, options ...ImageOption) (*pkg.Catalog, source.Metadata, *distro.Distro) {
+func ImageInput(t testing.TB, testImage string, options ...ImageOption) sbom.SBOM {
 	t.Helper()
 	catalog := pkg.NewCatalog()
 	var cfg imageCfg
@@ -117,7 +118,13 @@ func ImageInput(t testing.TB, testImage string, options ...ImageOption) (*pkg.Ca
 	dist, err := distro.NewDistro(distro.Debian, "1.2.3", "like!")
 	assert.NoError(t, err)
 
-	return catalog, src.Metadata, &dist
+	return sbom.SBOM{
+		Artifacts: sbom.Artifacts{
+			PackageCatalog: catalog,
+			Distro:         &dist,
+		},
+		Source: src.Metadata,
+	}
 }
 
 func populateImageCatalog(catalog *pkg.Catalog, img *image.Image) {
@@ -126,7 +133,6 @@ func populateImageCatalog(catalog *pkg.Catalog, img *image.Image) {
 
 	// populate catalog with test data
 	catalog.Add(pkg.Package{
-		ID:      "package-1-id",
 		Name:    "package-1",
 		Version: "1.0.1",
 		Locations: []source.Location{
@@ -147,7 +153,6 @@ func populateImageCatalog(catalog *pkg.Catalog, img *image.Image) {
 		},
 	})
 	catalog.Add(pkg.Package{
-		ID:      "package-2-id",
 		Name:    "package-2",
 		Version: "2.0.1",
 		Locations: []source.Location{
@@ -167,7 +172,7 @@ func populateImageCatalog(catalog *pkg.Catalog, img *image.Image) {
 	})
 }
 
-func DirectoryInput(t testing.TB) (*pkg.Catalog, source.Metadata, *distro.Distro) {
+func DirectoryInput(t testing.TB) sbom.SBOM {
 	catalog := newDirectoryCatalog()
 
 	dist, err := distro.NewDistro(distro.Debian, "1.2.3", "like!")
@@ -176,7 +181,13 @@ func DirectoryInput(t testing.TB) (*pkg.Catalog, source.Metadata, *distro.Distro
 	src, err := source.NewFromDirectory("/some/path")
 	assert.NoError(t, err)
 
-	return catalog, src.Metadata, &dist
+	return sbom.SBOM{
+		Artifacts: sbom.Artifacts{
+			PackageCatalog: catalog,
+			Distro:         &dist,
+		},
+		Source: src.Metadata,
+	}
 }
 
 func newDirectoryCatalog() *pkg.Catalog {
@@ -184,7 +195,6 @@ func newDirectoryCatalog() *pkg.Catalog {
 
 	// populate catalog with test data
 	catalog.Add(pkg.Package{
-		ID:      "package-1-id",
 		Name:    "package-1",
 		Version: "1.0.1",
 		Type:    pkg.PythonPkg,
@@ -210,7 +220,6 @@ func newDirectoryCatalog() *pkg.Catalog {
 		},
 	})
 	catalog.Add(pkg.Package{
-		ID:      "package-2-id",
 		Name:    "package-2",
 		Version: "2.0.1",
 		Type:    pkg.DebPkg,

internal/formats/cyclonedx12xml/encoder.go

@@ -4,13 +4,10 @@ import (
 	"encoding/xml"
 	"io"
 
-	"github.com/anchore/syft/syft/distro"
-
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
+	"github.com/anchore/syft/syft/sbom"
 )
 
-func encoder(output io.Writer, catalog *pkg.Catalog, srcMetadata *source.Metadata, d *distro.Distro, scope source.Scope) error {
+func encoder(output io.Writer, s sbom.SBOM) error {
 	enc := xml.NewEncoder(output)
 	enc.Indent("", "  ")
 
@@ -19,7 +16,7 @@ func encoder(output io.Writer, catalog *pkg.Catalog, srcMetadata *source.Metadat
 		return err
 	}
 
-	err = enc.Encode(toFormatModel(catalog, srcMetadata, d, scope))
+	err = enc.Encode(toFormatModel(s))
 	if err != nil {
 		return err
 	}

internal/formats/cyclonedx12xml/encoder_test.go

@@ -5,17 +5,14 @@ import (
 	"regexp"
 	"testing"
 
-	"github.com/anchore/syft/syft/source"
-
 	"github.com/anchore/syft/internal/formats/common/testutils"
 )
 
 var updateCycloneDx = flag.Bool("update-cyclonedx", false, "update the *.golden files for cyclone-dx presenters")
 
 func TestCycloneDxDirectoryPresenter(t *testing.T) {
-	catalog, metadata, _ := testutils.DirectoryInput(t)
 	testutils.AssertPresenterAgainstGoldenSnapshot(t,
-		Format().Presenter(catalog, &metadata, nil, source.SquashedScope),
+		Format().Presenter(testutils.DirectoryInput(t)),
 		*updateCycloneDx,
 		cycloneDxRedactor,
 	)
@@ -23,9 +20,8 @@ func TestCycloneDxDirectoryPresenter(t *testing.T) {
 
 func TestCycloneDxImagePresenter(t *testing.T) {
 	testImage := "image-simple"
-	catalog, metadata, _ := testutils.ImageInput(t, testImage)
 	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
-		Format().Presenter(catalog, &metadata, nil, source.SquashedScope),
+		Format().Presenter(testutils.ImageInput(t, testImage)),
 		testImage,
 		*updateCycloneDx,
 		cycloneDxRedactor,

internal/formats/cyclonedx12xml/to_format_model.go

@@ -4,35 +4,36 @@ import (
 	"encoding/xml"
 	"time"
 
+	"github.com/anchore/syft/syft/sbom"
+
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/formats/cyclonedx12xml/model"
 	"github.com/anchore/syft/internal/version"
-	"github.com/anchore/syft/syft/distro"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
 	"github.com/google/uuid"
 )
 
 // toFormatModel creates and populates a new in-memory representation of a CycloneDX 1.2 document
-func toFormatModel(catalog *pkg.Catalog, srcMetadata *source.Metadata, _ *distro.Distro, _ source.Scope) model.Document {
+func toFormatModel(s sbom.SBOM) model.Document {
 	versionInfo := version.FromBuild()
 
 	doc := model.Document{
 		XMLNs:         "http://cyclonedx.org/schema/bom/1.2",
 		Version:       1,
 		SerialNumber:  uuid.New().URN(),
-		BomDescriptor: toBomDescriptor(internal.ApplicationName, versionInfo.Version, srcMetadata),
+		BomDescriptor: toBomDescriptor(internal.ApplicationName, versionInfo.Version, s.Source),
 	}
 
 	// attach components
-	for _, p := range catalog.Sorted() {
+	for _, p := range s.Artifacts.PackageCatalog.Sorted() {
 		doc.Components = append(doc.Components, toComponent(p))
 	}
 
 	return doc
 }
 
-func toComponent(p *pkg.Package) model.Component {
+func toComponent(p pkg.Package) model.Component {
 	return model.Component{
 		Type:       "library", // TODO: this is not accurate
 		Name:       p.Name,
@@ -43,7 +44,7 @@ func toComponent(p *pkg.Package) model.Component {
 }
 
 // NewBomDescriptor returns a new BomDescriptor tailored for the current time and "syft" tool details.
-func toBomDescriptor(name, version string, srcMetadata *source.Metadata) *model.BomDescriptor {
+func toBomDescriptor(name, version string, srcMetadata source.Metadata) *model.BomDescriptor {
 	return &model.BomDescriptor{
 		XMLName:   xml.Name{},
 		Timestamp: time.Now().Format(time.RFC3339),
@@ -58,10 +59,7 @@ func toBomDescriptor(name, version string, srcMetadata *source.Metadata) *model.
 	}
 }
 
-func toBomDescriptorComponent(srcMetadata *source.Metadata) *model.BomDescriptorComponent {
-	if srcMetadata == nil {
-		return nil
-	}
+func toBomDescriptorComponent(srcMetadata source.Metadata) *model.BomDescriptorComponent {
 	switch srcMetadata.Scheme {
 	case source.ImageScheme:
 		return &model.BomDescriptorComponent{

internal/formats/formats.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/anchore/syft/internal/formats/cyclonedx12xml"
 	"github.com/anchore/syft/internal/formats/spdx22json"
+	"github.com/anchore/syft/internal/formats/spdx22tagvalue"
 	"github.com/anchore/syft/internal/formats/syftjson"
 	"github.com/anchore/syft/internal/formats/table"
 	"github.com/anchore/syft/internal/formats/text"
@@ -18,6 +19,7 @@ func All() []format.Format {
 		table.Format(),
 		cyclonedx12xml.Format(),
 		spdx22json.Format(),
+		spdx22tagvalue.Format(),
 		text.Format(),
 	}
 }

internal/formats/spdx22json/decoder.go

@@ -0,0 +1,22 @@
+package spdx22json
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+
+	"github.com/anchore/syft/internal/formats/spdx22json/model"
+	"github.com/anchore/syft/syft/sbom"
+)
+
+func decoder(reader io.Reader) (*sbom.SBOM, error) {
+	dec := json.NewDecoder(reader)
+
+	var doc model.Document
+	err := dec.Decode(&doc)
+	if err != nil {
+		return nil, fmt.Errorf("unable to decode syft-json: %w", err)
+	}
+
+	return toSyftModel(doc)
+}

internal/formats/spdx22json/decoder_test.go

@@ -0,0 +1,46 @@
+package spdx22json
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+
+	"github.com/anchore/syft/internal/formats/common/testutils"
+	"github.com/go-test/deep"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestEncodeDecodeCycle(t *testing.T) {
+	testImage := "image-simple"
+	originalSBOM := testutils.ImageInput(t, testImage)
+
+	var buf bytes.Buffer
+	assert.NoError(t, encoder(&buf, originalSBOM))
+
+	actualSBOM, err := decoder(bytes.NewReader(buf.Bytes()))
+	assert.NoError(t, err)
+
+	for _, d := range deep.Equal(originalSBOM.Source, actualSBOM.Source) {
+		t.Errorf("metadata difference: %+v", d)
+	}
+
+	actualPackages := actualSBOM.Artifacts.PackageCatalog.Sorted()
+	for idx, p := range originalSBOM.Artifacts.PackageCatalog.Sorted() {
+		if !assert.Equal(t, p.Name, actualPackages[idx].Name) {
+			t.Errorf("different package at idx=%d: %s vs %s", idx, p.Name, actualPackages[idx].Name)
+			continue
+		}
+
+		for _, d := range deep.Equal(p, actualPackages[idx]) {
+			if strings.Contains(d, ".VirtualPath: ") {
+				// location.Virtual path is not exposed in the json output
+				continue
+			}
+			if strings.HasSuffix(d, "<nil slice> != []") {
+				// semantically the same
+				continue
+			}
+			t.Errorf("package difference (%s): %+v", p.Name, d)
+		}
+	}
+}

internal/formats/spdx22json/encoder.go

@@ -4,16 +4,11 @@ import (
 	"encoding/json"
 	"io"
 
-	"github.com/anchore/syft/syft/distro"
-
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
+	"github.com/anchore/syft/syft/sbom"
 )
 
-const anchoreNamespace = "https://anchore.com/syft"
-
-func encoder(output io.Writer, catalog *pkg.Catalog, srcMetadata *source.Metadata, d *distro.Distro, scope source.Scope) error {
-	doc := toFormatModel(catalog, srcMetadata, d, scope)
+func encoder(output io.Writer, s sbom.SBOM) error {
+	doc := toFormatModel(s)
 
 	enc := json.NewEncoder(output)
 	// prevent > and < from being escaped in the payload

internal/formats/spdx22json/encoder_test.go

@@ -5,18 +5,14 @@ import (
 	"regexp"
 	"testing"
 
-	"github.com/anchore/syft/syft/source"
-
 	"github.com/anchore/syft/internal/formats/common/testutils"
-	"github.com/anchore/syft/syft/format"
 )
 
 var updateSpdxJson = flag.Bool("update-spdx-json", false, "update the *.golden files for spdx-json presenters")
 
 func TestSPDXJSONDirectoryPresenter(t *testing.T) {
-	catalog, metadata, distro := testutils.DirectoryInput(t)
 	testutils.AssertPresenterAgainstGoldenSnapshot(t,
-		format.NewPresenter(encoder, catalog, &metadata, distro, source.UnknownScope),
+		Format().Presenter(testutils.DirectoryInput(t)),
 		*updateSpdxJson,
 		spdxJsonRedactor,
 	)
@@ -24,9 +20,8 @@ func TestSPDXJSONDirectoryPresenter(t *testing.T) {
 
 func TestSPDXJSONImagePresenter(t *testing.T) {
 	testImage := "image-simple"
-	catalog, metadata, distro := testutils.ImageInput(t, testImage, testutils.FromSnapshot())
 	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
-		format.NewPresenter(encoder, catalog, &metadata, distro, source.SquashedScope),
+		Format().Presenter(testutils.ImageInput(t, testImage, testutils.FromSnapshot())),
 		testImage,
 		*updateSpdxJson,
 		spdxJsonRedactor,

internal/formats/spdx22json/model/document.go

@@ -1,7 +1,5 @@
 package model
 
-import "github.com/anchore/syft/syft/source"
-
 // derived from:
 // - https://spdx.github.io/spdx-spec/appendix-III-RDF-data-model-implementation-and-identifier-syntax/
 // - https://github.com/spdx/spdx-spec/blob/v2.2/schemas/spdx-schema.json
@@ -13,8 +11,6 @@ type Document struct {
 	// One instance is required for each SPDX file produced. It provides the necessary information for forward
 	// and backward compatibility for processing tools.
 	CreationInfo CreationInfo `json:"creationInfo"`
-	// SyftSourceData contains information about what is being described in this SPDX document (e.g. a container image, a directory, etc)
-	SyftSourceData *source.Metadata `json:"syftSourceData,omitempty"`
 	// 2.2: Data License; should be "CC0-1.0"
 	// Cardinality: mandatory, one
 	// License expression for dataLicense.  Compliance with the SPDX specification includes populating the SPDX

internal/formats/spdx22json/test-fixtures/snapshot/TestSPDXJSONDirectoryPresenter.golden

@@ -3,31 +3,15 @@
  "name": "/some/path",
  "spdxVersion": "SPDX-2.2",
  "creationInfo": {
-  "created": "2021-10-22T19:25:38.33537Z",
+  "created": "2021-10-29T16:26:08.995826Z",
   "creators": [
    "Organization: Anchore, Inc",
    "Tool: syft-[not provided]"
   ],
   "licenseListVersion": "3.14"
  },
- "syftSourceData": {
-  "Scheme": "DirectoryScheme",
-  "ImageMetadata": {
-   "userInput": "",
-   "imageID": "",
-   "manifestDigest": "",
-   "mediaType": "",
-   "tags": null,
-   "imageSize": 0,
-   "layers": null,
-   "manifest": null,
-   "config": null,
-   "repoDigests": null
-  },
-  "Path": "/some/path"
- },
  "dataLicense": "CC0-1.0",
- "documentNamespace": "https:/anchore.com/syft/dir/some/path-a868c45f-e62b-473f-9dd3-b72994be6294",
+ "documentNamespace": "https:/anchore.com/syft/dir/some/path-5362d380-914a-458f-b059-d8d27899574c",
  "packages": [
   {
    "SPDXID": "SPDXRef-Package-python-package-1-1.0.1",

internal/formats/spdx22json/test-fixtures/snapshot/TestSPDXJSONImagePresenter.golden

@@ -3,44 +3,15 @@
  "name": "user-image-input",
  "spdxVersion": "SPDX-2.2",
  "creationInfo": {
-  "created": "2021-10-22T19:25:38.341582Z",
+  "created": "2021-10-29T16:26:09.001799Z",
   "creators": [
    "Organization: Anchore, Inc",
    "Tool: syft-[not provided]"
   ],
   "licenseListVersion": "3.14"
  },
- "syftSourceData": {
-  "Scheme": "ImageScheme",
-  "ImageMetadata": {
-   "userInput": "user-image-input",
-   "imageID": "sha256:2480160b55bec40c44d3b145c7b2c1c47160db8575c3dcae086d76b9370ae7ca",
-   "manifestDigest": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368",
-   "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
-   "tags": [
-    "stereoscope-fixture-image-simple:85066c51088bdd274f7a89e99e00490f666c49e72ffc955707cd6e18f0e22c5b"
-   ],
-   "imageSize": 38,
-   "layers": [
-    {
-     "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59",
-     "size": 22
-    },
-    {
-     "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec",
-     "size": 16
-    }
-   ],
-   "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NjcsImRpZ2VzdCI6InNoYTI1NjoyNDgwMTYwYjU1YmVjNDBjNDRkM2IxNDVjN2IyYzFjNDcxNjBkYjg1NzVjM2RjYWUwODZkNzZiOTM3MGFlN2NhIn0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1NjpmYjZiZWVjYjc1YjM5ZjRiYjgxM2RiZjE3N2U1MDFlZGQ1ZGRiM2U2OWJiNDVjZWRlYjc4YzY3NmVlMWI3YTU5In0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2OjMxOWI1ODhjZTY0MjUzYTg3YjUzM2M4ZWQwMWNmMDAyNWUwZWFjOThlN2I1MTZlMTI1MzI5NTdlMTI0NGZkZWMifV19",
-   "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8iLCJPbkJ1aWxkIjpudWxsfSwiY3JlYXRlZCI6IjIwMjEtMTAtMDRUMTE6NDA6MDAuNjM4Mzk0NVoiLCJoaXN0b3J5IjpbeyJjcmVhdGVkIjoiMjAyMS0xMC0wNFQxMTo0MDowMC41OTA3MzE2WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0xLnR4dCAvc29tZWZpbGUtMS50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn0seyJjcmVhdGVkIjoiMjAyMS0xMC0wNFQxMTo0MDowMC42MzgzOTQ1WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0yLnR4dCAvc29tZWZpbGUtMi50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6ZmI2YmVlY2I3NWIzOWY0YmI4MTNkYmYxNzdlNTAxZWRkNWRkYjNlNjliYjQ1Y2VkZWI3OGM2NzZlZTFiN2E1OSIsInNoYTI1NjozMTliNTg4Y2U2NDI1M2E4N2I1MzNjOGVkMDFjZjAwMjVlMGVhYzk4ZTdiNTE2ZTEyNTMyOTU3ZTEyNDRmZGVjIl19fQ==",
-   "repoDigests": []
-  },
-  "Path": ""
- },
  "dataLicense": "CC0-1.0",
- "documentNamespace": "https:/anchore.com/syft/image/user-image-input-7c996682-9cdf-45cd-b70b-e771d740c9ed",
+ "documentNamespace": "https:/anchore.com/syft/image/user-image-input-3ad8571c-513f-4fce-944e-5125353c3186",
  "packages": [
   {
    "SPDXID": "SPDXRef-Package-python-package-1-1.0.1",

internal/formats/spdx22json/to_format_model.go

@@ -2,11 +2,9 @@ package spdx22json
 
 import (
 	"fmt"
-	"path"
-	"strings"
 	"time"
 
-	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/syft/sbom"
 
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/formats/common/spdxhelpers"
@@ -14,14 +12,12 @@ import (
 	"github.com/anchore/syft/internal/spdxlicense"
 	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
-	"github.com/google/uuid"
 )
 
 // toFormatModel creates and populates a new JSON document struct that follows the SPDX 2.2 spec from the given cataloging results.
-func toFormatModel(catalog *pkg.Catalog, srcMetadata *source.Metadata, _ *distro.Distro, _ source.Scope) model.Document {
-	name := documentName(srcMetadata)
-	packages, files, relationships := extractFromCatalog(catalog)
+func toFormatModel(s sbom.SBOM) model.Document {
+	name := spdxhelpers.DocumentName(s.Source)
+	packages, files, relationships := extractFromCatalog(s.Artifacts.PackageCatalog)
 
 	return model.Document{
 		Element: model.Element{
@@ -39,48 +35,13 @@ func toFormatModel(catalog *pkg.Catalog, srcMetadata *source.Metadata, _ *distro
 			LicenseListVersion: spdxlicense.Version,
 		},
 		DataLicense:       "CC0-1.0",
-		DocumentNamespace: documentNamespace(name, srcMetadata),
+		DocumentNamespace: spdxhelpers.DocumentNamespace(name, s.Source),
 		Packages:          packages,
 		Files:             files,
 		Relationships:     relationships,
-		// TODO: add scope
-		SyftSourceData: srcMetadata,
 	}
 }
 
-func documentName(srcMetadata *source.Metadata) string {
-	if srcMetadata != nil {
-		switch srcMetadata.Scheme {
-		case source.ImageScheme:
-			return cleanSPDXName(srcMetadata.ImageMetadata.UserInput)
-		case source.DirectoryScheme:
-			return cleanSPDXName(srcMetadata.Path)
-		}
-	}
-	// TODO: is this alright?
-	return uuid.Must(uuid.NewRandom()).String()
-}
-
-func documentNamespace(name string, srcMetadata *source.Metadata) string {
-	input := "unknown-source-type"
-	if srcMetadata != nil {
-		switch srcMetadata.Scheme {
-		case source.ImageScheme:
-			input = "image"
-		case source.DirectoryScheme:
-			input = "dir"
-		}
-	}
-
-	uniqueID := uuid.Must(uuid.NewRandom())
-	identifier := path.Join(input, uniqueID.String())
-	if name != "." {
-		identifier = path.Join(input, fmt.Sprintf("%s-%s", name, uniqueID.String()))
-	}
-
-	return path.Join(anchoreNamespace, identifier)
-}
-
 func extractFromCatalog(catalog *pkg.Catalog) ([]model.Package, []model.File, []model.Relationship) {
 	packages := make([]model.Package, 0)
 	relationships := make([]model.Relationship, 0)
@@ -120,14 +81,3 @@ func extractFromCatalog(catalog *pkg.Catalog) ([]model.Package, []model.File, []
 
 	return packages, files, relationships
 }
-
-func cleanSPDXName(name string) string {
-	// remove # according to specification
-	name = strings.ReplaceAll(name, "#", "-")
-
-	// remove : for url construction
-	name = strings.ReplaceAll(name, ":", "-")
-
-	// clean relative pathing
-	return path.Clean(name)
-}

internal/formats/spdx22json/to_syft_model.go

@@ -0,0 +1,10 @@
+package spdx22json
+
+import (
+	"github.com/anchore/syft/internal/formats/spdx22json/model"
+	"github.com/anchore/syft/syft/sbom"
+)
+
+func toSyftModel(doc model.Document) (*sbom.SBOM, error) {
+
+}

internal/formats/spdx22tagvalue/encoder.go

@@ -0,0 +1,13 @@
+package spdx22tagvalue
+
+import (
+	"io"
+
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/spdx/tools-golang/tvsaver"
+)
+
+func encoder(output io.Writer, s sbom.SBOM) error {
+	model := toFormatModel(s)
+	return tvsaver.Save2_2(&model, output)
+}

internal/formats/spdx22tagvalue/encoder_test.go

@@ -1,4 +1,4 @@
-package packages
+package spdx22tagvalue
 
 import (
 	"flag"
@@ -11,9 +11,9 @@ import (
 var updateSpdxTagValue = flag.Bool("update-spdx-tv", false, "update the *.golden files for spdx-tv presenters")
 
 func TestSPDXTagValueDirectoryPresenter(t *testing.T) {
-	catalog, metadata, _ := testutils.DirectoryInput(t)
+
 	testutils.AssertPresenterAgainstGoldenSnapshot(t,
-		NewSPDXTagValuePresenter(catalog, metadata),
+		Format().Presenter(testutils.DirectoryInput(t)),
 		*updateSpdxTagValue,
 		spdxTagValueRedactor,
 	)
@@ -21,9 +21,8 @@ func TestSPDXTagValueDirectoryPresenter(t *testing.T) {
 
 func TestSPDXTagValueImagePresenter(t *testing.T) {
 	testImage := "image-simple"
-	catalog, metadata, _ := testutils.ImageInput(t, testImage)
 	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
-		NewSPDXTagValuePresenter(catalog, metadata),
+		Format().Presenter(testutils.ImageInput(t, testImage, testutils.FromSnapshot())),
 		testImage,
 		*updateSpdxTagValue,
 		spdxTagValueRedactor,

internal/formats/spdx22tagvalue/format.go

@@ -0,0 +1,13 @@
+package spdx22tagvalue
+
+import "github.com/anchore/syft/syft/format"
+
+// note: this format is LOSSY relative to the syftjson formation, which means that decoding and validation is not supported at this time
+func Format() format.Format {
+	return format.NewFormat(
+		format.SPDXTagValueOption,
+		encoder,
+		nil,
+		nil,
+	)
+}

internal/formats/spdx22tagvalue/to_format_model.go

@@ -1,40 +1,23 @@
-package packages
+package spdx22tagvalue
 
 import (
 	"fmt"
-	"io"
 	"time"
 
-	"github.com/anchore/syft/internal/formats/common/spdxhelpers"
-
-	"github.com/anchore/syft/internal/spdxlicense"
+	"github.com/anchore/syft/syft/sbom"
 
 	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/formats/common/spdxhelpers"
+	"github.com/anchore/syft/internal/spdxlicense"
 	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
 	"github.com/spdx/tools-golang/spdx"
-	"github.com/spdx/tools-golang/tvsaver"
 )
 
-// SPDXTagValuePresenter is a SPDX presentation object for the syft results (see https://github.com/spdx/spdx-spec)
-type SPDXTagValuePresenter struct {
-	catalog     *pkg.Catalog
-	srcMetadata source.Metadata
-}
-
-// NewJSONPresenter creates a new JSON presenter object for the given cataloging results.
-func NewSPDXTagValuePresenter(catalog *pkg.Catalog, srcMetadata source.Metadata) *SPDXTagValuePresenter {
-	return &SPDXTagValuePresenter{
-		catalog:     catalog,
-		srcMetadata: srcMetadata,
-	}
-}
-
-// Present the catalog results to the given writer.
-// nolint: funlen
-func (pres *SPDXTagValuePresenter) Present(output io.Writer) error {
-	doc := spdx.Document2_2{
+// toFormatModel creates and populates a new JSON document struct that follows the SPDX 2.2 spec from the given cataloging results.
+// nolint:funlen
+func toFormatModel(s sbom.SBOM) spdx.Document2_2 {
+	return spdx.Document2_2{
 		CreationInfo: &spdx.CreationInfo2_2{
 			// 2.1: SPDX Version; should be in the format "SPDX-2.2"
 			// Cardinality: mandatory, one
@@ -50,7 +33,7 @@ func (pres *SPDXTagValuePresenter) Present(output io.Writer) error {
 
 			// 2.4: Document Name
 			// Cardinality: mandatory, one
-			DocumentName: pres.srcMetadata.ImageMetadata.UserInput,
+			DocumentName: s.Source.ImageMetadata.UserInput,
 
 			// 2.5: Document Namespace
 			// Cardinality: mandatory, one
@@ -69,7 +52,7 @@ func (pres *SPDXTagValuePresenter) Present(output io.Writer) error {
 			// In many cases, the URI will point to a web accessible document, but this should not be assumed
 			// to be the case.
 
-			DocumentNamespace: fmt.Sprintf("https://anchore.com/syft/image/%s", pres.srcMetadata.ImageMetadata.UserInput),
+			DocumentNamespace: fmt.Sprintf("https://anchore.com/syft/image/%s", s.Source.ImageMetadata.UserInput),
 
 			// 2.6: External Document References
 			// Cardinality: optional, one or many
@@ -98,18 +81,16 @@ func (pres *SPDXTagValuePresenter) Present(output io.Writer) error {
 			// Cardinality: optional, one
 			DocumentComment: "",
 		},
-		Packages: pres.packages(),
+		Packages: toFormatPackages(s.Artifacts.PackageCatalog),
 	}
-
-	return tvsaver.Save2_2(&doc, output)
 }
 
 // packages populates all Package Information from the package Catalog (see https://spdx.github.io/spdx-spec/3-package-information/)
 // nolint: funlen
-func (pres *SPDXTagValuePresenter) packages() map[spdx.ElementID]*spdx.Package2_2 {
+func toFormatPackages(catalog *pkg.Catalog) map[spdx.ElementID]*spdx.Package2_2 {
 	results := make(map[spdx.ElementID]*spdx.Package2_2)
 
-	for p := range pres.catalog.Enumerate() {
+	for p := range catalog.Enumerate() {
 		// name should be guaranteed to be unique, but semantically useful and stable
 		id := fmt.Sprintf("Package-%+v-%s", p.Type, p.Name)
 
@@ -275,7 +256,7 @@ func (pres *SPDXTagValuePresenter) packages() map[spdx.ElementID]*spdx.Package2_
 	return results
 }
 
-func formatSPDXExternalRefs(p *pkg.Package) (refs []*spdx.PackageExternalReference2_2) {
+func formatSPDXExternalRefs(p pkg.Package) (refs []*spdx.PackageExternalReference2_2) {
 	for _, ref := range spdxhelpers.ExternalRefs(p) {
 		refs = append(refs, &spdx.PackageExternalReference2_2{
 			Category:           string(ref.ReferenceCategory),

internal/formats/syftjson/decoder.go

@@ -5,19 +5,18 @@ import (
 	"fmt"
 	"io"
 
+	"github.com/anchore/syft/syft/sbom"
+
 	"github.com/anchore/syft/internal/formats/syftjson/model"
-	"github.com/anchore/syft/syft/distro"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
 )
 
-func decoder(reader io.Reader) (*pkg.Catalog, *source.Metadata, *distro.Distro, source.Scope, error) {
+func decoder(reader io.Reader) (*sbom.SBOM, error) {
 	dec := json.NewDecoder(reader)
 
 	var doc model.Document
 	err := dec.Decode(&doc)
 	if err != nil {
-		return nil, nil, nil, source.UnknownScope, fmt.Errorf("unable to decode syft-json: %w", err)
+		return nil, fmt.Errorf("unable to decode syft-json: %w", err)
 	}
 
 	return toSyftModel(doc)

internal/formats/syftjson/decoder_test.go

@@ -5,8 +5,6 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/anchore/syft/syft/source"
-
 	"github.com/anchore/syft/internal/formats/common/testutils"
 	"github.com/go-test/deep"
 	"github.com/stretchr/testify/assert"
@@ -14,30 +12,26 @@ import (
 
 func TestEncodeDecodeCycle(t *testing.T) {
 	testImage := "image-simple"
-	originalCatalog, originalMetadata, _ := testutils.ImageInput(t, testImage)
+	originalSBOM := testutils.ImageInput(t, testImage)
 
 	var buf bytes.Buffer
-	assert.NoError(t, encoder(&buf, originalCatalog, &originalMetadata, nil, source.SquashedScope))
+	assert.NoError(t, encoder(&buf, originalSBOM))
 
-	actualCatalog, actualMetadata, _, _, err := decoder(bytes.NewReader(buf.Bytes()))
+	actualSBOM, err := decoder(bytes.NewReader(buf.Bytes()))
 	assert.NoError(t, err)
 
-	for _, d := range deep.Equal(originalMetadata, *actualMetadata) {
+	for _, d := range deep.Equal(originalSBOM.Source, actualSBOM.Source) {
 		t.Errorf("metadata difference: %+v", d)
 	}
 
-	actualPackages := actualCatalog.Sorted()
-	for idx, p := range originalCatalog.Sorted() {
+	actualPackages := actualSBOM.Artifacts.PackageCatalog.Sorted()
+	for idx, p := range originalSBOM.Artifacts.PackageCatalog.Sorted() {
 		if !assert.Equal(t, p.Name, actualPackages[idx].Name) {
 			t.Errorf("different package at idx=%d: %s vs %s", idx, p.Name, actualPackages[idx].Name)
 			continue
 		}
 
-		// ids will never be equal
-		p.ID = ""
-		actualPackages[idx].ID = ""
-
-		for _, d := range deep.Equal(*p, *actualPackages[idx]) {
+		for _, d := range deep.Equal(p, actualPackages[idx]) {
 			if strings.Contains(d, ".VirtualPath: ") {
 				// location.Virtual path is not exposed in the json output
 				continue

internal/formats/syftjson/encoder.go

@@ -4,15 +4,12 @@ import (
 	"encoding/json"
 	"io"
 
-	"github.com/anchore/syft/syft/distro"
-
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
+	"github.com/anchore/syft/syft/sbom"
 )
 
-func encoder(output io.Writer, catalog *pkg.Catalog, srcMetadata *source.Metadata, d *distro.Distro, scope source.Scope) error {
+func encoder(output io.Writer, s sbom.SBOM) error {
 	// TODO: application config not available yet
-	doc := ToFormatModel(catalog, srcMetadata, d, scope, nil)
+	doc := ToFormatModel(s, nil)
 
 	enc := json.NewEncoder(output)
 	// prevent > and < from being escaped in the payload

internal/formats/syftjson/encoder_test.go

@@ -4,27 +4,22 @@ import (
 	"flag"
 	"testing"
 
-	"github.com/anchore/syft/syft/source"
-
 	"github.com/anchore/syft/internal/formats/common/testutils"
-	"github.com/anchore/syft/syft/format"
 )
 
 var updateJson = flag.Bool("update-json", false, "update the *.golden files for json presenters")
 
 func TestDirectoryPresenter(t *testing.T) {
-	catalog, metadata, distro := testutils.DirectoryInput(t)
 	testutils.AssertPresenterAgainstGoldenSnapshot(t,
-		format.NewPresenter(encoder, catalog, &metadata, distro, source.SquashedScope),
+		Format().Presenter(testutils.DirectoryInput(t)),
 		*updateJson,
 	)
 }
 
 func TestImagePresenter(t *testing.T) {
 	testImage := "image-simple"
-	catalog, metadata, distro := testutils.ImageInput(t, testImage, testutils.FromSnapshot())
 	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
-		format.NewPresenter(encoder, catalog, &metadata, distro, source.SquashedScope),
+		Format().Presenter(testutils.ImageInput(t, testImage, testutils.FromSnapshot())),
 		testImage,
 		*updateJson,
 	)

internal/formats/syftjson/model/source.go

@@ -20,11 +20,6 @@ type sourceUnpacker struct {
 	Target json.RawMessage `json:"target"`
 }
 
-type ImageSource struct {
-	source.ImageMetadata
-	Scope source.Scope `json:"scope"`
-}
-
 // UnmarshalJSON populates a source object from JSON bytes.
 func (s *Source) UnmarshalJSON(b []byte) error {
 	var unpacker sourceUnpacker
@@ -43,7 +38,7 @@ func (s *Source) UnmarshalJSON(b []byte) error {
 		}
 
 	case "image":
-		var payload ImageSource
+		var payload source.ImageMetadata
 		if err := json.Unmarshal(unpacker.Target, &payload); err != nil {
 			return err
 		}

internal/formats/syftjson/test-fixtures/snapshot/TestDirectoryPresenter.golden

@@ -1,7 +1,7 @@
 {
  "artifacts": [
   {
-   "id": "package-1-id",
+   "id": "cbf4f3077fc7deee",
    "name": "package-1",
    "version": "1.0.1",
    "type": "python",
@@ -36,7 +36,7 @@
    }
   },
   {
-   "id": "package-2-id",
+   "id": "1a39aadd9705c2b9",
    "name": "package-2",
    "version": "2.0.1",
    "type": "deb",

internal/formats/syftjson/test-fixtures/snapshot/TestImagePresenter.golden

@@ -1,7 +1,7 @@
 {
  "artifacts": [
   {
-   "id": "package-1-id",
+   "id": "d1d433485a31ed07",
    "name": "package-1",
    "version": "1.0.1",
    "type": "python",
@@ -32,7 +32,7 @@
    }
   },
   {
-   "id": "package-2-id",
+   "id": "2db629ca48fa6786",
    "name": "package-2",
    "version": "2.0.1",
    "type": "deb",
@@ -88,8 +88,7 @@
    ],
    "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NjcsImRpZ2VzdCI6InNoYTI1NjoyNDgwMTYwYjU1YmVjNDBjNDRkM2IxNDVjN2IyYzFjNDcxNjBkYjg1NzVjM2RjYWUwODZkNzZiOTM3MGFlN2NhIn0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1NjpmYjZiZWVjYjc1YjM5ZjRiYjgxM2RiZjE3N2U1MDFlZGQ1ZGRiM2U2OWJiNDVjZWRlYjc4YzY3NmVlMWI3YTU5In0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2OjMxOWI1ODhjZTY0MjUzYTg3YjUzM2M4ZWQwMWNmMDAyNWUwZWFjOThlN2I1MTZlMTI1MzI5NTdlMTI0NGZkZWMifV19",
    "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8iLCJPbkJ1aWxkIjpudWxsfSwiY3JlYXRlZCI6IjIwMjEtMTAtMDRUMTE6NDA6MDAuNjM4Mzk0NVoiLCJoaXN0b3J5IjpbeyJjcmVhdGVkIjoiMjAyMS0xMC0wNFQxMTo0MDowMC41OTA3MzE2WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0xLnR4dCAvc29tZWZpbGUtMS50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn0seyJjcmVhdGVkIjoiMjAyMS0xMC0wNFQxMTo0MDowMC42MzgzOTQ1WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0yLnR4dCAvc29tZWZpbGUtMi50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6ZmI2YmVlY2I3NWIzOWY0YmI4MTNkYmYxNzdlNTAxZWRkNWRkYjNlNjliYjQ1Y2VkZWI3OGM2NzZlZTFiN2E1OSIsInNoYTI1NjozMTliNTg4Y2U2NDI1M2E4N2I1MzNjOGVkMDFjZjAwMjVlMGVhYzk4ZTdiNTE2ZTEyNTMyOTU3ZTEyNDRmZGVjIl19fQ==",
-   "repoDigests": [],
-   "scope": "Squashed"
+   "repoDigests": []
   }
  },
  "distro": {

internal/formats/syftjson/to_format_model.go

@@ -3,6 +3,10 @@ package syftjson
 import (
 	"fmt"
 
+	"github.com/anchore/syft/syft/artifact"
+
+	"github.com/anchore/syft/syft/sbom"
+
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/formats/syftjson/model"
 	"github.com/anchore/syft/internal/log"
@@ -13,17 +17,17 @@ import (
 )
 
 // TODO: this is export4ed for the use of the power-user command (temp)
-func ToFormatModel(catalog *pkg.Catalog, srcMetadata *source.Metadata, d *distro.Distro, scope source.Scope, applicationConfig interface{}) model.Document {
-	src, err := toSourceModel(srcMetadata, scope)
+func ToFormatModel(s sbom.SBOM, applicationConfig interface{}) model.Document {
+	src, err := toSourceModel(s.Source)
 	if err != nil {
 		log.Warnf("unable to create syft-json source object: %+v", err)
 	}
 
 	return model.Document{
-		Artifacts:             toPackageModels(catalog),
-		ArtifactRelationships: toRelationshipModel(pkg.NewRelationships(catalog)),
+		Artifacts:             toPackageModels(s.Artifacts.PackageCatalog),
+		ArtifactRelationships: toRelationshipModel(s.Relationships),
 		Source:                src,
-		Distro:                toDistroModel(d),
+		Distro:                toDistroModel(s.Artifacts.Distro),
 		Descriptor: model.Descriptor{
 			Name:          internal.ApplicationName,
 			Version:       version.FromBuild().Version,
@@ -48,7 +52,7 @@ func toPackageModels(catalog *pkg.Catalog) []model.Package {
 }
 
 // toPackageModel crates a new Package from the given pkg.Package.
-func toPackageModel(p *pkg.Package) model.Package {
+func toPackageModel(p pkg.Package) model.Package {
 	var cpes = make([]string, len(p.CPEs))
 	for i, c := range p.CPEs {
 		cpes[i] = c.BindToFmtString()
@@ -67,7 +71,7 @@ func toPackageModel(p *pkg.Package) model.Package {
 
 	return model.Package{
 		PackageBasicData: model.PackageBasicData{
-			ID:        string(p.ID),
+			ID:        string(p.ID()),
 			Name:      p.Name,
 			Version:   p.Version,
 			Type:      p.Type,
@@ -85,29 +89,26 @@ func toPackageModel(p *pkg.Package) model.Package {
 	}
 }
 
-func toRelationshipModel(relationships []pkg.Relationship) []model.Relationship {
+func toRelationshipModel(relationships []artifact.Relationship) []model.Relationship {
 	result := make([]model.Relationship, len(relationships))
 	for i, r := range relationships {
 		result[i] = model.Relationship{
-			Parent:   string(r.Parent),
-			Child:    string(r.Child),
+			Parent:   string(r.From.ID()),
+			Child:    string(r.To.ID()),
 			Type:     string(r.Type),
-			Metadata: r.Metadata,
+			Metadata: r.Data,
 		}
 	}
 	return result
 }
 
 // toSourceModel creates a new source object to be represented into JSON.
-func toSourceModel(src *source.Metadata, scope source.Scope) (model.Source, error) {
+func toSourceModel(src source.Metadata) (model.Source, error) {
 	switch src.Scheme {
 	case source.ImageScheme:
 		return model.Source{
-			Type: "image",
-			Target: model.ImageSource{
-				ImageMetadata: src.ImageMetadata,
-				Scope:         scope,
-			},
+			Type:   "image",
+			Target: src.ImageMetadata,
 		}, nil
 	case source.DirectoryScheme:
 		return model.Source{

internal/formats/syftjson/to_syft_model.go

@@ -5,35 +5,39 @@ import (
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/distro"
 	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 )
 
-func toSyftModel(doc model.Document) (*pkg.Catalog, *source.Metadata, *distro.Distro, source.Scope, error) {
+func toSyftModel(doc model.Document) (*sbom.SBOM, error) {
 	dist, err := distro.NewDistro(distro.Type(doc.Distro.Name), doc.Distro.Version, doc.Distro.IDLike)
 	if err != nil {
-		return nil, nil, nil, source.UnknownScope, err
+		return nil, err
 	}
 
-	srcMetadata, scope := toSyftSourceData(doc.Source)
-
-	return toSyftCatalog(doc.Artifacts), srcMetadata, &dist, scope, nil
+	return &sbom.SBOM{
+		Artifacts: sbom.Artifacts{
+			PackageCatalog: toSyftCatalog(doc.Artifacts),
+			Distro:         &dist,
+		},
+		Source: *toSyftSourceData(doc.Source),
+	}, nil
 }
 
-func toSyftSourceData(s model.Source) (*source.Metadata, source.Scope) {
+func toSyftSourceData(s model.Source) *source.Metadata {
 	switch s.Type {
 	case "directory":
 		return &source.Metadata{
 			Scheme: source.DirectoryScheme,
 			Path:   s.Target.(string),
-		}, source.UnknownScope
+		}
 	case "image":
-		parsedSource := s.Target.(model.ImageSource)
 		return &source.Metadata{
 			Scheme:        source.ImageScheme,
-			ImageMetadata: parsedSource.ImageMetadata,
-		}, parsedSource.Scope
+			ImageMetadata: s.Target.(source.ImageMetadata),
+		}
 	}
-	return nil, source.UnknownScope
+	return nil
 }
 
 func toSyftCatalog(pkgs []model.Package) *pkg.Catalog {
@@ -57,7 +61,6 @@ func toSyftPackage(p model.Package) pkg.Package {
 	}
 
 	return pkg.Package{
-		ID:           pkg.ID(p.ID),
 		Name:         p.Name,
 		Version:      p.Version,
 		FoundBy:      p.FoundBy,

internal/formats/table/encoder.go

@@ -6,18 +6,16 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/olekukonko/tablewriter"
+	"github.com/anchore/syft/syft/sbom"
 
-	"github.com/anchore/syft/syft/distro"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
+	"github.com/olekukonko/tablewriter"
 )
 
-func encoder(output io.Writer, catalog *pkg.Catalog, _ *source.Metadata, _ *distro.Distro, _ source.Scope) error {
+func encoder(output io.Writer, s sbom.SBOM) error {
 	var rows [][]string
 
 	columns := []string{"Name", "Version", "Type"}
-	for _, p := range catalog.Sorted() {
+	for _, p := range s.Artifacts.PackageCatalog.Sorted() {
 		row := []string{
 			p.Name,
 			p.Version,

internal/formats/table/encoder_test.go

@@ -5,17 +5,14 @@ import (
 	"testing"
 
 	"github.com/anchore/syft/internal/formats/common/testutils"
-	"github.com/anchore/syft/syft/format"
-	"github.com/anchore/syft/syft/source"
 	"github.com/go-test/deep"
 )
 
 var updateTableGoldenFiles = flag.Bool("update-table", false, "update the *.golden files for table format")
 
 func TestTablePresenter(t *testing.T) {
-	catalog, metadata, distro := testutils.DirectoryInput(t)
 	testutils.AssertPresenterAgainstGoldenSnapshot(t,
-		format.NewPresenter(encoder, catalog, &metadata, distro, source.SquashedScope),
+		Format().Presenter(testutils.DirectoryInput(t)),
 		*updateTableGoldenFiles,
 	)
 }

internal/formats/text/encoder.go

@@ -5,23 +5,23 @@ import (
 	"io"
 	"text/tabwriter"
 
-	"github.com/anchore/syft/syft/distro"
-	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/sbom"
+
 	"github.com/anchore/syft/syft/source"
 )
 
-func encoder(output io.Writer, catalog *pkg.Catalog, srcMetadata *source.Metadata, _ *distro.Distro, _ source.Scope) error {
+func encoder(output io.Writer, s sbom.SBOM) error {
 	// init the tabular writer
 	w := new(tabwriter.Writer)
 	w.Init(output, 0, 8, 0, '\t', tabwriter.AlignRight)
 
-	switch srcMetadata.Scheme {
+	switch s.Source.Scheme {
 	case source.DirectoryScheme:
-		fmt.Fprintf(w, "[Path: %s]\n", srcMetadata.Path)
+		fmt.Fprintf(w, "[Path: %s]\n", s.Source.Path)
 	case source.ImageScheme:
 		fmt.Fprintln(w, "[Image]")
 
-		for idx, l := range srcMetadata.ImageMetadata.Layers {
+		for idx, l := range s.Source.ImageMetadata.Layers {
 			fmt.Fprintln(w, " Layer:\t", idx)
 			fmt.Fprintln(w, " Digest:\t", l.Digest)
 			fmt.Fprintln(w, " Size:\t", l.Size)
@@ -30,12 +30,12 @@ func encoder(output io.Writer, catalog *pkg.Catalog, srcMetadata *source.Metadat
 			w.Flush()
 		}
 	default:
-		return fmt.Errorf("unsupported source: %T", srcMetadata.Scheme)
+		return fmt.Errorf("unsupported source: %T", s.Source.Scheme)
 	}
 
 	// populate artifacts...
 	rows := 0
-	for _, p := range catalog.Sorted() {
+	for _, p := range s.Artifacts.PackageCatalog.Sorted() {
 		fmt.Fprintf(w, "[%s]\n", p.Name)
 		fmt.Fprintln(w, " Version:\t", p.Version)
 		fmt.Fprintln(w, " Type:\t", string(p.Type))

internal/formats/text/encoder_test.go

@@ -4,27 +4,22 @@ import (
 	"flag"
 	"testing"
 
-	"github.com/anchore/syft/syft/source"
-
 	"github.com/anchore/syft/internal/formats/common/testutils"
-	"github.com/anchore/syft/syft/format"
 )
 
 var updateTextPresenterGoldenFiles = flag.Bool("update-text", false, "update the *.golden files for text presenters")
 
 func TestTextDirectoryPresenter(t *testing.T) {
-	catalog, metadata, d := testutils.DirectoryInput(t)
 	testutils.AssertPresenterAgainstGoldenSnapshot(t,
-		format.NewPresenter(encoder, catalog, &metadata, d, source.UnknownScope),
+		Format().Presenter(testutils.DirectoryInput(t)),
 		*updateTextPresenterGoldenFiles,
 	)
 }
 
 func TestTextImagePresenter(t *testing.T) {
 	testImage := "image-simple"
-	catalog, metadata, d := testutils.ImageInput(t, testImage, testutils.FromSnapshot())
 	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
-		format.NewPresenter(encoder, catalog, &metadata, d, source.SquashedScope),
+		Format().Presenter(testutils.ImageInput(t, testImage, testutils.FromSnapshot())),
 		testImage,
 		*updateTextPresenterGoldenFiles,
 	)

internal/input.go

@@ -12,5 +12,9 @@ func IsPipedInput() (bool, error) {
 		return false, fmt.Errorf("unable to determine if there is piped input: %w", err)
 	}
 
-	return fi.Mode()&os.ModeCharDevice == 0, nil
+	// note: we should NOT use the absence of a character device here as the hint that there may be input expected
+	// on stdin, as running syft as a subprocess you would expect no character device to be present but input can
+	// be from either stdin or indicated by the CLI. Checking if stdin is a pipe is the most direct way to determine
+	// if there *may* be bytes that will show up on stdin that should be used for the analysis source.
+	return fi.Mode()&os.ModeNamedPipe != 0, nil
 }

internal/presenter/packages/model/spdx22/annotation.go

@@ -1,21 +0,0 @@
-package spdx22
-
-import "time"
-
-type AnnotationType string
-
-const (
-	ReviewerAnnotationType AnnotationType = "REVIEWER"
-	OtherAnnotationType    AnnotationType = "OTHER"
-)
-
-type Annotation struct {
-	// Identify when the comment was made. This is to be specified according to the combined date and time in the
-	// UTC format, as specified in the ISO 8601 standard.
-	AnnotationDate time.Time `json:"annotationDate"`
-	// Type of the annotation
-	AnnotationType AnnotationType `json:"annotationType"`
-	// This field identifies the person, organization or tool that has commented on a file, package, or the entire document.
-	Annotator string `json:"annotator"`
-	Comment   string `json:"comment"`
-}

internal/presenter/packages/model/spdx22/checksum.go

@@ -1,7 +0,0 @@
-package spdx22
-
-type Checksum struct {
-	// Identifies the algorithm used to produce the subject Checksum. One of: "SHA256", "SHA1", "SHA384", "MD2", "MD4", "SHA512", "MD6", "MD5", "SHA224"
-	Algorithm     string `json:"algorithm"`
-	ChecksumValue string `json:"checksumValue"`
-}

internal/presenter/packages/model/spdx22/creation_info.go

@@ -1,19 +0,0 @@
-package spdx22
-
-import "time"
-
-type CreationInfo struct {
-	Comment string `json:"comment,omitempty"`
-	// Identify when the SPDX file was originally created. The date is to be specified according to combined date and
-	// time in UTC format as specified in ISO 8601 standard. This field is distinct from the fields in section 8,
-	// which involves the addition of information during a subsequent review.
-	Created time.Time `json:"created"`
-	// Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an
-	// individual, indicate the person's name. If the SPDX file was created on behalf of a company or organization,
-	// indicate the entity name. If the SPDX file was created using a software tool, indicate the name and version
-	// for that tool. If multiple participants or tools were involved, use multiple instances of this field. Person
-	// name or organization name may be designated as “anonymous” if appropriate.
-	Creators []string `json:"creators"`
-	// An optional field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created.
-	LicenseListVersion string `json:"licenseListVersion"`
-}

internal/presenter/packages/model/spdx22/document.go

@@ -1,45 +0,0 @@
-package spdx22
-
-// derived from:
-// - https://spdx.github.io/spdx-spec/appendix-III-RDF-data-model-implementation-and-identifier-syntax/
-// - https://github.com/spdx/spdx-spec/blob/v2.2/schemas/spdx-schema.json
-// - https://github.com/spdx/spdx-spec/tree/v2.2/ontology
-
-type Document struct {
-	Element
-	SPDXVersion string `json:"spdxVersion"`
-	// One instance is required for each SPDX file produced. It provides the necessary information for forward
-	// and backward compatibility for processing tools.
-	CreationInfo CreationInfo `json:"creationInfo"`
-	// 2.2: Data License; should be "CC0-1.0"
-	// Cardinality: mandatory, one
-	// License expression for dataLicense.  Compliance with the SPDX specification includes populating the SPDX
-	// fields therein with data related to such fields (\"SPDX-Metadata\"). The SPDX specification contains numerous
-	// fields where an SPDX document creator may provide relevant explanatory text in SPDX-Metadata. Without
-	// opining on the lawfulness of \"database rights\" (in jurisdictions where applicable), such explanatory text
-	// is copyrightable subject matter in most Berne Convention countries. By using the SPDX specification, or any
-	// portion hereof, you hereby agree that any copyright rights (as determined by your jurisdiction) in any
-	// SPDX-Metadata, including without limitation explanatory text, shall be subject to the terms of the Creative
-	// Commons CC0 1.0 Universal license. For SPDX-Metadata not containing any copyright rights, you hereby agree
-	// and acknowledge that the SPDX-Metadata is provided to you \"as-is\" and without any representations or
-	// warranties of any kind concerning the SPDX-Metadata, express, implied, statutory or otherwise, including
-	// without limitation warranties of title, merchantability, fitness for a particular purpose, non-infringement,
-	// or the absence of latent or other defects, accuracy, or the presence or absence of errors, whether or not
-	// discoverable, all to the greatest extent permissible under applicable law.
-	DataLicense string `json:"dataLicense"`
-	// Information about an external SPDX document reference including the checksum. This allows for verification of the external references.
-	ExternalDocumentRefs []ExternalDocumentRef `json:"externalDocumentRefs,omitempty"`
-	// Indicates that a particular ExtractedLicensingInfo was defined in the subject SpdxDocument.
-	HasExtractedLicensingInfos []HasExtractedLicensingInfo `json:"hasExtractedLicensingInfos,omitempty"`
-	// note: found in example documents from SPDX, but not in the JSON schema. See https://spdx.github.io/spdx-spec/2-document-creation-information/#25-spdx-document-namespace
-	DocumentNamespace string `json:"documentNamespace"`
-	// note: found in example documents from SPDX, but not in the JSON schema
-	// DocumentDescribes []string  `json:"documentDescribes"`
-	Packages []Package `json:"packages"`
-	// Files referenced in the SPDX document
-	Files []File `json:"files,omitempty"`
-	// Snippets referenced in the SPDX document
-	Snippets []Snippet `json:"snippets,omitempty"`
-	// Relationships referenced in the SPDX document
-	Relationships []Relationship `json:"relationships,omitempty"`
-}

internal/presenter/packages/model/spdx22/element.go

@@ -1,12 +0,0 @@
-package spdx22
-
-type Element struct {
-	SPDXID string `json:"SPDXID"`
-	// Identify name of this SpdxElement.
-	Name string `json:"name"`
-	// Relationships referenced in the SPDX document
-	Relationships []Relationship `json:"relationships,omitempty"`
-	// Provide additional information about an SpdxElement.
-	Annotations []Annotation `json:"annotations,omitempty"`
-	Comment     string       `json:"comment,omitempty"`
-}

internal/presenter/packages/model/spdx22/element_id.go

@@ -1,37 +0,0 @@
-package spdx22
-
-// ElementID represents the identifier string portion of an SPDX element
-// identifier. DocElementID should be used for any attributes which can
-// contain identifiers defined in a different SPDX document.
-// ElementIDs should NOT contain the mandatory 'SPDXRef-' portion.
-type ElementID string
-
-func (e ElementID) String() string {
-	return "SPDXRef-" + string(e)
-}
-
-// DocElementID represents an SPDX element identifier that could be defined
-// in a different SPDX document, and therefore could have a "DocumentRef-"
-// portion, such as Relationship and Annotations.
-// ElementID is used for attributes in which a "DocumentRef-" portion cannot
-// appear, such as a Package or File definition (since it is necessarily
-// being defined in the present document).
-// DocumentRefID will be the empty string for elements defined in the
-// present document.
-// DocElementIDs should NOT contain the mandatory 'DocumentRef-' or
-// 'SPDXRef-' portions.
-type DocElementID struct {
-	DocumentRefID string
-	ElementRefID  ElementID
-}
-
-// RenderDocElementID takes a DocElementID and returns the string equivalent,
-// with the SPDXRef- prefix (and, if applicable, the DocumentRef- prefix)
-// reinserted.
-func (d DocElementID) String() string {
-	prefix := ""
-	if d.DocumentRefID != "" {
-		prefix = "DocumentRef-" + d.DocumentRefID + ":"
-	}
-	return prefix + d.ElementRefID.String()
-}

internal/presenter/packages/model/spdx22/external_document_ref.go

@@ -1,9 +0,0 @@
-package spdx22
-
-type ExternalDocumentRef struct {
-	// externalDocumentId is a string containing letters, numbers, ., - and/or + which uniquely identifies an external document within this document.
-	ExternalDocumentID string   `json:"externalDocumentId"`
-	Checksum           Checksum `json:"checksum"`
-	// SPDX ID for SpdxDocument.  A propoerty containing an SPDX document.
-	SpdxDocument string `json:"spdxDocument"`
-}

internal/presenter/packages/model/spdx22/external_ref.go

@@ -1,43 +0,0 @@
-package spdx22
-
-type ReferenceCategory string
-
-const (
-	SecurityReferenceCategory       ReferenceCategory = "SECURITY"
-	PackageManagerReferenceCategory ReferenceCategory = "PACKAGE_MANAGER"
-	OtherReferenceCategory          ReferenceCategory = "OTHER"
-)
-
-// source: https://spdx.github.io/spdx-spec/appendix-VI-external-repository-identifiers/
-
-type ExternalRefType string
-
-const (
-	// see https://nvd.nist.gov/cpe
-	Cpe22ExternalRefType ExternalRefType = "cpe22Type"
-	// see https://nvd.nist.gov/cpe
-	Cpe23ExternalRefType ExternalRefType = "cpe23Type"
-	// see http://repo1.maven.org/maven2/
-	MavenCentralExternalRefType ExternalRefType = "maven-central"
-	// see https://www.npmjs.com/
-	NpmExternalRefType ExternalRefType = "npm"
-	// see https://www.nuget.org/
-	NugetExternalRefType ExternalRefType = "nuget"
-	// see http://bower.io/
-	BowerExternalRefType ExternalRefType = "bower"
-	// see https://github.com/package-url/purl-spec
-	PurlExternalRefType ExternalRefType = "purl"
-	// These point to objects present in the Software Heritage archive by the means of SoftWare Heritage persistent Identifiers (SWHID)
-	SwhExternalRefType ExternalRefType = "swh"
-)
-
-type ExternalRef struct {
-	Comment string `json:"comment,omitempty"`
-	// Category for the external reference.
-	ReferenceCategory ReferenceCategory `json:"referenceCategory"`
-	// The unique string with no spaces necessary to access the package-specific information, metadata, or content
-	// within the target location. The format of the locator is subject to constraints defined by the <type>.
-	ReferenceLocator string `json:"referenceLocator"`
-	// Type of the external reference. These are defined in an appendix in the SPDX specification.
-	ReferenceType ExternalRefType `json:"referenceType"`
-}

internal/presenter/packages/model/spdx22/file.go

@@ -1,41 +0,0 @@
-package spdx22
-
-type FileType string
-
-const (
-	DocumentationFileType FileType = "DOCUMENTATION"
-	ImageFileType         FileType = "IMAGE"
-	VideoFileType         FileType = "VIDEO"
-	ArchiveFileType       FileType = "ARCHIVE"
-	SpdxFileType          FileType = "SPDX"
-	ApplicationFileType   FileType = "APPLICATION"
-	SourceFileType        FileType = "SOURCE"
-	BinaryFileType        FileType = "BINARY"
-	TextFileType          FileType = "TEXT"
-	AudioFileType         FileType = "AUDIO"
-	OtherFileType         FileType = "OTHER"
-)
-
-type File struct {
-	Item
-	// (At least one is required.) The checksum property provides a mechanism that can be used to verify that the
-	// contents of a File or Package have not changed.
-	Checksums []Checksum `json:"checksums,omitempty"`
-	// This field provides a place for the SPDX file creator to record file contributors. Contributors could include
-	// names of copyright holders and/or authors who may not be copyright holders yet contributed to the file content.
-	FileContributors []string `json:"fileContributors,omitempty"`
-	// Each element is a SPDX ID for a File.
-	FileDependencies []string `json:"fileDependencies,omitempty"`
-	// The name of the file relative to the root of the package.
-	FileName string `json:"fileName"`
-	// The type of the file
-	FileTypes []string `json:"fileTypes,omitempty"`
-	// This field provides a place for the SPDX file creator to record potential legal notices found in the file.
-	// This may or may not include copyright statements.
-	NoticeText string `json:"noticeText,omitempty"`
-	// Indicates the project in which the SpdxElement originated. Tools must preserve doap:homepage and doap:name
-	// properties and the URI (if one is known) of doap:Project resources that are values of this property. All other
-	// properties of doap:Projects are not directly supported by SPDX and may be dropped when translating to or
-	// from some SPDX formats(deprecated).
-	ArtifactOf []string `json:"artifactOf,omitempty"`
-}

internal/presenter/packages/model/spdx22/has_extracted_licensing_info.go

@@ -1,14 +0,0 @@
-package spdx22
-
-type HasExtractedLicensingInfo struct {
-	// Verbatim license or licensing notice text that was discovered.
-	ExtractedText string `json:"extractedText"`
-	// A human readable short form license identifier for a license. The license ID is iether on the standard license
-	// oist or the form \"LicenseRef-\"[idString] where [idString] is a unique string containing letters,
-	// numbers, \".\", \"-\" or \"+\".
-	LicenseID string `json:"licenseId"`
-	Comment   string `json:"comment,omitempty"`
-	// Identify name of this SpdxElement.
-	Name     string   `json:"name,omitempty"`
-	SeeAlsos []string `json:"seeAlsos,omitempty"`
-}

internal/presenter/packages/model/spdx22/item.go

@@ -1,22 +0,0 @@
-package spdx22
-
-type Item struct {
-	Element
-	// The licenseComments property allows the preparer of the SPDX document to describe why the licensing in
-	// spdx:licenseConcluded was chosen.
-	LicenseComments  string `json:"licenseComments,omitempty"`
-	LicenseConcluded string `json:"licenseConcluded"`
-	// The licensing information that was discovered directly within the package. There will be an instance of this
-	// property for each distinct value of alllicenseInfoInFile properties of all files contained in the package.
-	LicenseInfoFromFiles []string `json:"licenseInfoFromFiles,omitempty"`
-	// Licensing information that was discovered directly in the subject file. This is also considered a declared license for the file.
-	LicenseInfoInFiles []string `json:"licenseInfoInFiles,omitempty"`
-	// The text of copyright declarations recited in the Package or File.
-	CopyrightText string `json:"copyrightText,omitempty"`
-	// This field provides a place for the SPDX data creator to record acknowledgements that may be required to be
-	// communicated in some contexts. This is not meant to include the actual complete license text (see
-	// licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText).
-	// The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from
-	// license texts, which may be necessary or desirable to reproduce.
-	AttributionTexts []string `json:"attributionTexts,omitempty"`
-}

internal/presenter/packages/model/spdx22/package.go

@@ -1,50 +0,0 @@
-package spdx22
-
-type Package struct {
-	Item
-	// The checksum property provides a mechanism that can be used to verify that the contents of a File or
-	// Package have not changed.
-	Checksums []Checksum `json:"checksums,omitempty"`
-	// Provides a detailed description of the package.
-	Description string `json:"description,omitempty"`
-	// The URI at which this package is available for download. Private (i.e., not publicly reachable) URIs are
-	// acceptable as values of this property. The values http://spdx.org/rdf/terms#none and http://spdx.org/rdf/terms#noassertion
-	// may be used to specify that the package is not downloadable or that no attempt was made to determine its
-	// download location, respectively.
-	DownloadLocation string `json:"downloadLocation,omitempty"`
-	// An External Reference allows a Package to reference an external source of additional information, metadata,
-	// enumerations, asset identifiers, or downloadable content believed to be relevant to the Package.
-	ExternalRefs []ExternalRef `json:"externalRefs,omitempty"`
-	// Indicates whether the file content of this package has been available for or subjected to analysis when
-	// creating the SPDX document. If false indicates packages that represent metadata or URI references to a
-	// project, product, artifact, distribution or a component. If set to false, the package must not contain any files
-	FilesAnalyzed bool `json:"filesAnalyzed"`
-	// Indicates that a particular file belongs to a package (elements are SPDX ID for a File).
-	HasFiles []string `json:"hasFiles,omitempty"`
-	// Provide a place for the SPDX file creator to record a web site that serves as the package's home page.
-	// This link can also be used to reference further information about the package referenced by the SPDX file creator.
-	Homepage string `json:"homepage,omitempty"`
-	// List the licenses that have been declared by the authors of the package. Any license information that does not
-	// originate from the package authors, e.g. license information from a third party repository, should not be included in this field.
-	LicenseDeclared string `json:"licenseDeclared"`
-	// The name and, optionally, contact information of the person or organization that originally created the package.
-	// Values of this property must conform to the agent and tool syntax.
-	Originator string `json:"originator,omitempty"`
-	// The base name of the package file name. For example, zlib-1.2.5.tar.gz.
-	PackageFileName string `json:"packageFileName,omitempty"`
-	// A manifest based verification code (the algorithm is defined in section 4.7 of the full specification) of the
-	// SPDX Item. This allows consumers of this data and/or database to determine if an SPDX item they have in hand
-	// is identical to the SPDX item from which the data was produced. This algorithm works even if the SPDX document
-	// is included in the SPDX item.
-	PackageVerificationCode *PackageVerificationCode `json:"packageVerificationCode,omitempty"`
-	// Allows the producer(s) of the SPDX document to describe how the package was acquired and/or changed from the original source.
-	SourceInfo string `json:"sourceInfo,omitempty"`
-	// Provides a short description of the package.
-	Summary string `json:"summary,omitempty"`
-	// The name and, optionally, contact information of the person or organization who was the immediate supplier
-	// of this package to the recipient. The supplier may be different than originator when the software has been
-	// repackaged. Values of this property must conform to the agent and tool syntax.
-	Supplier string `json:"supplier,omitempty"`
-	// Provides an indication of the version of the package that is described by this SpdxDocument.
-	VersionInfo string `json:"versionInfo,omitempty"`
-}

internal/presenter/packages/model/spdx22/package_verification_code.go

@@ -1,23 +0,0 @@
-package spdx22
-
-// Why are there two package identifier fields Package Checksum and Package Verification?
-// Although the values of the two fields Package Checksum and Package Verification are similar, they each serve a
-// different purpose. The Package Checksum provides a unique identifier of a software package which is computed by
-// taking the SHA1 of the entire software package file. This enables one to quickly determine if two different copies
-// of a package are the same. One disadvantage of this approach is that one cannot add an SPDX data file into the
-// original package without changing the Package Checksum value. Alternatively, the Package Verification field enables
-// the inclusion of an SPDX file. It enables one to quickly verify if one or more of the original package files has
-// changed. The Package Verification field is a unique identifier that is based on SHAing only the original package
-// files (e.g., excluding the SPDX file). This allows one to add an SPDX file to the original package without changing
-// this unique identifier.
-// source: https://wiki.spdx.org/view/SPDX_FAQ
-type PackageVerificationCode struct {
-	// "A file that was excluded when calculating the package verification code. This is usually a file containing
-	// SPDX data regarding the package. If a package contains more than one SPDX file all SPDX files must be excluded
-	// from the package verification code. If this is not done it would be impossible to correctly calculate the
-	// verification codes in both files.
-	PackageVerificationCodeExcludedFiles []string `json:"packageVerificationCodeExcludedFiles"`
-
-	// The actual package verification code as a hex encoded value.
-	PackageVerificationCodeValue string `json:"packageVerificationCodeValue"`
-}

internal/presenter/packages/model/spdx22/relationship.go

@@ -1,183 +0,0 @@
-package spdx22
-
-type Relationship struct {
-	// Id to which the SPDX element is related
-	SpdxElementID string `json:"spdxElementId"`
-	// Describes the type of relationship between two SPDX elements.
-	RelationshipType RelationshipType `json:"relationshipType"`
-	// SPDX ID for SpdxElement.  A related SpdxElement.
-	RelatedSpdxElement string `json:"relatedSpdxElement"`
-	Comment            string `json:"comment,omitempty"`
-}
-
-// source: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/
-type RelationshipType string
-
-const (
-	// DescribedByRelationship is to be used when SPDXRef-A is described by SPDXREF-Document.
-	// Example: The package 'WildFly' is described by SPDX document WildFly.spdx.
-	DescribedByRelationship RelationshipType = "DESCRIBED_BY"
-
-	// ContainsRelationship is to be used when SPDXRef-A contains SPDXRef-B.
-	// Example: An ARCHIVE file bar.tgz contains a SOURCE file foo.c.
-	ContainsRelationship RelationshipType = "CONTAINS"
-
-	// ContainedByRelationship is to be used when SPDXRef-A is contained by SPDXRef-B.
-	// Example: A SOURCE file foo.c is contained by ARCHIVE file bar.tgz
-	ContainedByRelationship RelationshipType = "CONTAINED_BY"
-
-	// DependsOnRelationship is to be used when SPDXRef-A depends on SPDXRef-B.
-	// Example: Package A depends on the presence of package B in order to build and run
-	DependsOnRelationship RelationshipType = "DEPENDS_ON"
-
-	// DependencyOfRelationship is to be used when SPDXRef-A is dependency of SPDXRef-B.
-	// Example: A is explicitly stated as a dependency of B in a machine-readable file. Use when a package manager does not define scopes.
-	DependencyOfRelationship RelationshipType = "DEPENDENCY_OF"
-
-	// DependencyManifestOfRelationship is to be used when SPDXRef-A is a manifest file that lists a set of dependencies for SPDXRef-B.
-	// Example: A file package.json is the dependency manifest of a package foo. Note that only one manifest should be used to define the same dependency graph.
-	DependencyManifestOfRelationship RelationshipType = "DEPENDENCY_MANIFEST_OF"
-
-	// BuildDependencyOfRelationship is to be used when SPDXRef-A is a build dependency of SPDXRef-B.
-	// Example: A is in the compile scope of B in a Maven project.
-	BuildDependencyOfRelationship RelationshipType = "BUILD_DEPENDENCY_OF"
-
-	// DevDependencyOfRelationship is to be used when SPDXRef-A is a development dependency of SPDXRef-B.
-	// Example: A is in the devDependencies scope of B in a Maven project.
-	DevDependencyOfRelationship RelationshipType = "DEV_DEPENDENCY_OF"
-
-	// OptionalDependencyOfRelationship is to be used when SPDXRef-A is an optional dependency of SPDXRef-B.
-	// Example: Use when building the code will proceed even if a dependency cannot be found, fails to install, or is only installed on a specific platform. For example, A is in the optionalDependencies scope of npm project B.
-	OptionalDependencyOfRelationship RelationshipType = "OPTIONAL_DEPENDENCY_OF"
-
-	// ProvidedDependencyOfRelationship is to be used when SPDXRef-A is a to be provided dependency of SPDXRef-B.
-	// Example: A is in the provided scope of B in a Maven project, indicating that the project expects it to be provided, for instance, by the container or JDK.
-	ProvidedDependencyOfRelationship RelationshipType = "PROVIDED_DEPENDENCY_OF"
-
-	// TestDependencyOfRelationship is to be used when SPDXRef-A is a test dependency of SPDXRef-B.
-	// Example: A is in the test scope of B in a Maven project.
-	TestDependencyOfRelationship RelationshipType = "TEST_DEPENDENCY_OF"
-
-	// RuntimeDependencyOfRelationship is to be used when SPDXRef-A is a dependency required for the execution of SPDXRef-B.
-	// Example: A is in the runtime scope of B in a Maven project.
-	RuntimeDependencyOfRelationship RelationshipType = "RUNTIME_DEPENDENCY_OF"
-
-	// ExampleOfRelationship is to be used when SPDXRef-A is an example of SPDXRef-B.
-	// Example: The file or snippet that illustrates how to use an application or library.
-	ExampleOfRelationship RelationshipType = "EXAMPLE_OF"
-
-	// GeneratesRelationship is to be used when SPDXRef-A generates SPDXRef-B.
-	// Example: A SOURCE file makefile.mk generates a BINARY file a.out
-	GeneratesRelationship RelationshipType = "GENERATES"
-
-	// GeneratedFromRelationship is to be used when SPDXRef-A was generated from SPDXRef-B.
-	// Example: A BINARY file a.out has been generated from a SOURCE file makefile.mk. A BINARY file foolib.a is generated from a SOURCE file bar.c.
-	GeneratedFromRelationship RelationshipType = "GENERATED_FROM"
-
-	// AncestorOfRelationship is to be used when SPDXRef-A is an ancestor (same lineage but pre-dates) SPDXRef-B.
-	// Example: A SOURCE file makefile.mk is a version of the original ancestor SOURCE file 'makefile2.mk'
-	AncestorOfRelationship RelationshipType = "ANCESTOR_OF"
-
-	// DescendantOfRelationship is to be used when SPDXRef-A is a descendant of (same lineage but postdates) SPDXRef-B.
-	// Example: A SOURCE file makefile2.mk is a descendant of the original SOURCE file 'makefile.mk'
-	DescendantOfRelationship RelationshipType = "DESCENDANT_OF"
-
-	// VariantOfRelationship is to be used when SPDXRef-A is a variant of (same lineage but not clear which came first) SPDXRef-B.
-	// Example: A SOURCE file makefile2.mk is a variant of SOURCE file makefile.mk if they differ by some edit, but there is no way to tell which came first (no reliable date information).
-	VariantOfRelationship RelationshipType = "VARIANT_OF"
-
-	// DistributionArtifactRelationship is to be used when distributing SPDXRef-A requires that SPDXRef-B also be distributed.
-	// Example: A BINARY file foo.o requires that the ARCHIVE file bar-sources.tgz be made available on distribution.
-	DistributionArtifactRelationship RelationshipType = "DISTRIBUTION_ARTIFACT"
-
-	// PatchForRelationship is to be used when SPDXRef-A is a patch file for (to be applied to) SPDXRef-B.
-	// Example: A SOURCE file foo.diff is a patch file for SOURCE file foo.c.
-	PatchForRelationship RelationshipType = "PATCH_FOR"
-
-	// PatchAppliedRelationship is to be used when SPDXRef-A is a patch file that has been applied to SPDXRef-B.
-	// Example: A SOURCE file foo.diff is a patch file that has been applied to SOURCE file 'foo-patched.c'.
-	PatchAppliedRelationship RelationshipType = "PATCH_APPLIED"
-
-	// CopyOfRelationship is to be used when SPDXRef-A is an exact copy of SPDXRef-B.
-	// Example: A BINARY file alib.a is an exact copy of BINARY file a2lib.a.
-	CopyOfRelationship RelationshipType = "COPY_OF"
-
-	// FileAddedRelationship is to be used when SPDXRef-A is a file that was added to SPDXRef-B.
-	// Example: A SOURCE file foo.c has been added to package ARCHIVE bar.tgz.
-	FileAddedRelationship RelationshipType = "FILE_ADDED"
-
-	// FileDeletedRelationship is to be used when SPDXRef-A is a file that was deleted from SPDXRef-B.
-	// Example: A SOURCE file foo.diff has been deleted from package ARCHIVE bar.tgz.
-	FileDeletedRelationship RelationshipType = "FILE_DELETED"
-
-	// FileModifiedRelationship is to be used when SPDXRef-A is a file that was modified from SPDXRef-B.
-	// Example: A SOURCE file foo.c has been modified from SOURCE file foo.orig.c.
-	FileModifiedRelationship RelationshipType = "FILE_MODIFIED"
-
-	// ExpandedFromArchiveRelationship is to be used when SPDXRef-A is expanded from the archive SPDXRef-B.
-	// Example: A SOURCE file foo.c, has been expanded from the archive ARCHIVE file xyz.tgz.
-	ExpandedFromArchiveRelationship RelationshipType = "EXPANDED_FROM_ARCHIVE"
-
-	// DynamicLinkRelationship is to be used when SPDXRef-A dynamically links to SPDXRef-B.
-	// Example: An APPLICATION file 'myapp' dynamically links to BINARY file zlib.so.
-	DynamicLinkRelationship RelationshipType = "DYNAMIC_LINK"
-
-	// StaticLinkRelationship is to be used when SPDXRef-A statically links to SPDXRef-B.
-	// Example: An APPLICATION file 'myapp' statically links to BINARY zlib.a.
-	StaticLinkRelationship RelationshipType = "STATIC_LINK"
-
-	// DataFileOfRelationship is to be used when SPDXRef-A is a data file used in SPDXRef-B.
-	// Example: An IMAGE file 'kitty.jpg' is a data file of an APPLICATION 'hellokitty'.
-	DataFileOfRelationship RelationshipType = "DATA_FILE_OF"
-
-	// TestCaseOfRelationship is to be used when SPDXRef-A is a test case used in testing SPDXRef-B.
-	// Example: A SOURCE file testMyCode.java is a unit test file used to test an APPLICATION MyPackage.
-	TestCaseOfRelationship RelationshipType = "TEST_CASE_OF"
-
-	// BuildToolOfRelationship is to be used when SPDXRef-A is used to build SPDXRef-B.
-	// Example: A SOURCE file makefile.mk is used to build an APPLICATION 'zlib'.
-	BuildToolOfRelationship RelationshipType = "BUILD_TOOL_OF"
-
-	// DevToolOfRelationship is to be used when SPDXRef-A is used as a development tool for SPDXRef-B.
-	// Example: Any tool used for development such as a code debugger.
-	DevToolOfRelationship RelationshipType = "DEV_TOOL_OF"
-
-	// TestOfRelationship is to be used when SPDXRef-A is used for testing SPDXRef-B.
-	// Example: Generic relationship for cases where it's clear that something is used for testing but unclear whether it's TEST_CASE_OF or TEST_TOOL_OF.
-	TestOfRelationship RelationshipType = "TEST_OF"
-
-	// TestToolOfRelationship is to be used when SPDXRef-A is used as a test tool for SPDXRef-B.
-	// Example: Any tool used to test the code such as ESlint.
-	TestToolOfRelationship RelationshipType = "TEST_TOOL_OF"
-
-	// DocumentationOfRelationship is to be used when SPDXRef-A provides documentation of SPDXRef-B.
-	// Example: A DOCUMENTATION file readme.txt documents the APPLICATION 'zlib'.
-	DocumentationOfRelationship RelationshipType = "DOCUMENTATION_OF"
-
-	// OptionalComponentOfRelationship is to be used when SPDXRef-A is an optional component of SPDXRef-B.
-	// Example: A SOURCE file fool.c (which is in the contributors directory) may or may not be included in the build of APPLICATION 'atthebar'.
-	OptionalComponentOfRelationship RelationshipType = "OPTIONAL_COMPONENT_OF"
-
-	// MetafileOfRelationship is to be used when SPDXRef-A is a metafile of SPDXRef-B.
-	// Example: A SOURCE file pom.xml is a metafile of the APPLICATION 'Apache Xerces'.
-	MetafileOfRelationship RelationshipType = "METAFILE_OF"
-
-	// PackageOfRelationship is to be used when SPDXRef-A is used as a package as part of SPDXRef-B.
-	// Example: A Linux distribution contains an APPLICATION package gawk as part of the distribution MyLinuxDistro.
-	PackageOfRelationship RelationshipType = "PACKAGE_OF"
-
-	// AmendsRelationship is to be used when (current) SPDXRef-DOCUMENT amends the SPDX information in SPDXRef-B.
-	// Example: (Current) SPDX document A version 2 contains a correction to a previous version of the SPDX document A version 1. Note the reserved identifier SPDXRef-DOCUMENT for the current document is required.
-	AmendsRelationship RelationshipType = "AMENDS"
-
-	// PrerequisiteForRelationship is to be used when SPDXRef-A is a prerequisite for SPDXRef-B.
-	// Example: A library bar.dll is a prerequisite or dependency for APPLICATION foo.exe
-	PrerequisiteForRelationship RelationshipType = "PREREQUISITE_FOR"
-
-	// HasPrerequisiteRelationship is to be used when SPDXRef-A has as a prerequisite SPDXRef-B.
-	// Example: An APPLICATION foo.exe has prerequisite or dependency on bar.dll
-	HasPrerequisiteRelationship RelationshipType = "HAS_PREREQUISITE"
-
-	// OtherRelationship is to be used for a relationship which has not been defined in the formal SPDX specification. A description of the relationship should be included in the Relationship comments field.
-	OtherRelationship RelationshipType = "OTHER"
-)

internal/presenter/packages/model/spdx22/snippet.go

@@ -1,32 +0,0 @@
-package spdx22
-
-type StartPointer struct {
-	Offset     int `json:"offset,omitempty"`
-	LineNumber int `json:"lineNumber,omitempty"`
-	// SPDX ID for File
-	Reference string `json:"reference"`
-}
-
-type EndPointer struct {
-	Offset     int `json:"offset,omitempty"`
-	LineNumber int `json:"lineNumber,omitempty"`
-	// SPDX ID for File
-	Reference string `json:"reference"`
-}
-
-type Range struct {
-	StartPointer StartPointer `json:"startPointer"`
-	EndPointer   EndPointer   `json:"endPointer"`
-}
-
-type Snippet struct {
-	Item
-	// Licensing information that was discovered directly in the subject snippet. This is also considered a declared
-	// license for the snippet. (elements are license expressions)
-	LicenseInfoInSnippets []string `json:"licenseInfoInSnippets"`
-	// SPDX ID for File. File containing the SPDX element (e.g. the file contaning a snippet).
-	SnippetFromFile string `json:"snippetFromFile"`
-	// (At least 1 range is required). This field defines the byte range in the original host file (in X.2) that the
-	// snippet information applies to.
-	Ranges []Range `json:"ranges"`
-}

internal/presenter/packages/model/spdx22/version.go

@@ -1,3 +0,0 @@
-package spdx22
-
-const Version = "SPDX-2.2"

internal/presenter/packages/test-fixtures/snapshot/TestCycloneDxDirectoryPresenter.golden

@@ -1,34 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1" serialNumber="urn:uuid:5404937f-72d6-44a2-8e9b-954305ecb4f6">
-  <metadata>
-    <timestamp>2021-06-23T13:40:33-04:00</timestamp>
-    <tools>
-      <tool>
-        <vendor>anchore</vendor>
-        <name>syft</name>
-        <version>[not provided]</version>
-      </tool>
-    </tools>
-    <component type="file">
-      <name>/some/path</name>
-      <version></version>
-    </component>
-  </metadata>
-  <components>
-    <component type="library">
-      <name>package-1</name>
-      <version>1.0.1</version>
-      <licenses>
-        <license>
-          <name>MIT</name>
-        </license>
-      </licenses>
-      <purl>a-purl-2</purl>
-    </component>
-    <component type="library">
-      <name>package-2</name>
-      <version>2.0.1</version>
-      <purl>a-purl-2</purl>
-    </component>
-  </components>
-</bom>

internal/presenter/packages/test-fixtures/snapshot/TestCycloneDxImagePresenter.golden

@@ -1,34 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1" serialNumber="urn:uuid:e34bad2e-cd27-483c-86dc-f4e26d6103b0">
-  <metadata>
-    <timestamp>2021-06-23T13:40:33-04:00</timestamp>
-    <tools>
-      <tool>
-        <vendor>anchore</vendor>
-        <name>syft</name>
-        <version>[not provided]</version>
-      </tool>
-    </tools>
-    <component type="container">
-      <name>user-image-input</name>
-      <version>sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368</version>
-    </component>
-  </metadata>
-  <components>
-    <component type="library">
-      <name>package-1</name>
-      <version>1.0.1</version>
-      <licenses>
-        <license>
-          <name>MIT</name>
-        </license>
-      </licenses>
-      <purl>a-purl-1</purl>
-    </component>
-    <component type="library">
-      <name>package-2</name>
-      <version>2.0.1</version>
-      <purl>a-purl-2</purl>
-    </component>
-  </components>
-</bom>

internal/presenter/packages/test-fixtures/snapshot/TestJSONDirectoryPresenter.golden

@@ -1,86 +0,0 @@
-{
- "artifacts": [
-  {
-   "id": "package-1-id",
-   "name": "package-1",
-   "version": "1.0.1",
-   "type": "python",
-   "foundBy": "the-cataloger-1",
-   "locations": [
-    {
-     "path": "/some/path/pkg1"
-    }
-   ],
-   "licenses": [
-    "MIT"
-   ],
-   "language": "python",
-   "cpes": [
-    "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"
-   ],
-   "purl": "a-purl-2",
-   "metadataType": "PythonPackageMetadata",
-   "metadata": {
-    "name": "package-1",
-    "version": "1.0.1",
-    "license": "",
-    "author": "",
-    "authorEmail": "",
-    "platform": "",
-    "files": [
-     {
-      "path": "/some/path/pkg1/depedencies/foo"
-     }
-    ],
-    "sitePackagesRootPath": ""
-   }
-  },
-  {
-   "id": "package-2-id",
-   "name": "package-2",
-   "version": "2.0.1",
-   "type": "deb",
-   "foundBy": "the-cataloger-2",
-   "locations": [
-    {
-     "path": "/some/path/pkg1"
-    }
-   ],
-   "licenses": [],
-   "language": "",
-   "cpes": [
-    "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"
-   ],
-   "purl": "a-purl-2",
-   "metadataType": "DpkgMetadata",
-   "metadata": {
-    "package": "package-2",
-    "source": "",
-    "version": "2.0.1",
-    "sourceVersion": "",
-    "architecture": "",
-    "maintainer": "",
-    "installedSize": 0,
-    "files": null
-   }
-  }
- ],
- "artifactRelationships": [],
- "source": {
-  "type": "directory",
-  "target": "/some/path"
- },
- "distro": {
-  "name": "debian",
-  "version": "1.2.3",
-  "idLike": "like!"
- },
- "descriptor": {
-  "name": "syft",
-  "version": "[not provided]"
- },
- "schema": {
-  "version": "1.1.0",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-1.1.0.json"
- }
-}

internal/presenter/packages/test-fixtures/snapshot/TestJSONImagePresenter.golden

@@ -1,108 +0,0 @@
-{
- "artifacts": [
-  {
-   "id": "package-1-id",
-   "name": "package-1",
-   "version": "1.0.1",
-   "type": "python",
-   "foundBy": "the-cataloger-1",
-   "locations": [
-    {
-     "path": "/somefile-1.txt",
-     "layerID": "sha256:ffb5e9eaa453a002110719d12c294960117ca2903953d1faa40f01dc3f77045c"
-    }
-   ],
-   "licenses": [
-    "MIT"
-   ],
-   "language": "python",
-   "cpes": [
-    "cpe:2.3:*:some:package:1:*:*:*:*:*:*:*"
-   ],
-   "purl": "a-purl-1",
-   "metadataType": "PythonPackageMetadata",
-   "metadata": {
-    "name": "package-1",
-    "version": "1.0.1",
-    "license": "",
-    "author": "",
-    "authorEmail": "",
-    "platform": "",
-    "sitePackagesRootPath": ""
-   }
-  },
-  {
-   "id": "package-2-id",
-   "name": "package-2",
-   "version": "2.0.1",
-   "type": "deb",
-   "foundBy": "the-cataloger-2",
-   "locations": [
-    {
-     "path": "/somefile-2.txt",
-     "layerID": "sha256:8463854829fc53d47b9dcdf7ee79fe7eb4ca7933c910f67f8521412f7a2f5c21"
-    }
-   ],
-   "licenses": [],
-   "language": "",
-   "cpes": [
-    "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"
-   ],
-   "purl": "a-purl-2",
-   "metadataType": "DpkgMetadata",
-   "metadata": {
-    "package": "package-2",
-    "source": "",
-    "version": "2.0.1",
-    "sourceVersion": "",
-    "architecture": "",
-    "maintainer": "",
-    "installedSize": 0,
-    "files": null
-   }
-  }
- ],
- "artifactRelationships": [],
- "source": {
-  "type": "image",
-  "target": {
-   "userInput": "user-image-input",
-   "imageID": "sha256:112851310e48e604f7379e2a3acddab50e91ce926edacb598a532e60ff6b776a",
-   "manifestDigest": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368",
-   "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
-   "tags": [
-    "stereoscope-fixture-image-simple:85066c51088bdd274f7a89e99e00490f666c49e72ffc955707cd6e18f0e22c5b"
-   ],
-   "imageSize": 38,
-   "layers": [
-    {
-     "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:ffb5e9eaa453a002110719d12c294960117ca2903953d1faa40f01dc3f77045c",
-     "size": 22
-    },
-    {
-     "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:8463854829fc53d47b9dcdf7ee79fe7eb4ca7933c910f67f8521412f7a2f5c21",
-     "size": 16
-    }
-   ],
-   "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NzMsImRpZ2VzdCI6InNoYTI1NjoxMTI4NTEzMTBlNDhlNjA0ZjczNzllMmEzYWNkZGFiNTBlOTFjZTkyNmVkYWNiNTk4YTUzMmU2MGZmNmI3NzZhIn0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1NjpmZmI1ZTllYWE0NTNhMDAyMTEwNzE5ZDEyYzI5NDk2MDExN2NhMjkwMzk1M2QxZmFhNDBmMDFkYzNmNzcwNDVjIn0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2Ojg0NjM4NTQ4MjlmYzUzZDQ3YjlkY2RmN2VlNzlmZTdlYjRjYTc5MzNjOTEwZjY3Zjg1MjE0MTJmN2EyZjVjMjEifV19",
-   "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8iLCJPbkJ1aWxkIjpudWxsfSwiY3JlYXRlZCI6IjIwMjEtMDktMDhUMTc6MjE6NTguODk2NTI5MTkyWiIsImhpc3RvcnkiOlt7ImNyZWF0ZWQiOiIyMDIxLTA5LTA4VDE3OjIxOjU4Ljg3OTY5MDgyNFoiLCJjcmVhdGVkX2J5IjoiQUREIGZpbGUtMS50eHQgL3NvbWVmaWxlLTEudHh0ICMgYnVpbGRraXQiLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCJ9LHsiY3JlYXRlZCI6IjIwMjEtMDktMDhUMTc6MjE6NTguODk2NTI5MTkyWiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0yLnR4dCAvc29tZWZpbGUtMi50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6ZmZiNWU5ZWFhNDUzYTAwMjExMDcxOWQxMmMyOTQ5NjAxMTdjYTI5MDM5NTNkMWZhYTQwZjAxZGMzZjc3MDQ1YyIsInNoYTI1Njo4NDYzODU0ODI5ZmM1M2Q0N2I5ZGNkZjdlZTc5ZmU3ZWI0Y2E3OTMzYzkxMGY2N2Y4NTIxNDEyZjdhMmY1YzIxIl19fQ==",
-   "repoDigests": [],
-   "scope": "Squashed"
-  }
- },
- "distro": {
-  "name": "debian",
-  "version": "1.2.3",
-  "idLike": "like!"
- },
- "descriptor": {
-  "name": "syft",
-  "version": "[not provided]"
- },
- "schema": {
-  "version": "1.1.0",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-1.1.0.json"
- }
-}

internal/presenter/packages/test-fixtures/snapshot/TestSPDXJSONDirectoryPresenter.golden

@@ -1,79 +0,0 @@
-{
- "SPDXID": "SPDXRef-DOCUMENT",
- "name": "/some/path",
- "spdxVersion": "SPDX-2.2",
- "creationInfo": {
-  "created": "2021-10-12T18:40:22.948394Z",
-  "creators": [
-   "Organization: Anchore, Inc",
-   "Tool: syft-[not provided]"
-  ],
-  "licenseListVersion": "3.14"
- },
- "dataLicense": "CC0-1.0",
- "documentNamespace": "https:/anchore.com/syft/dir/some/path-98ae71fb-f276-4c5c-acf7-25770bf7bca2",
- "packages": [
-  {
-   "SPDXID": "SPDXRef-Package-python-package-1-1.0.1",
-   "name": "package-1",
-   "licenseConcluded": "MIT",
-   "downloadLocation": "NOASSERTION",
-   "externalRefs": [
-    {
-     "referenceCategory": "SECURITY",
-     "referenceLocator": "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*",
-     "referenceType": "cpe23Type"
-    },
-    {
-     "referenceCategory": "PACKAGE_MANAGER",
-     "referenceLocator": "a-purl-2",
-     "referenceType": "purl"
-    }
-   ],
-   "filesAnalyzed": false,
-   "hasFiles": [
-    "SPDXRef-File-package-1-efae7fecc76ca25da40f79d7ef5b8933510434914835832c7976f3e866aa756a"
-   ],
-   "licenseDeclared": "MIT",
-   "sourceInfo": "acquired package info from installed python package manifest file: /some/path/pkg1",
-   "versionInfo": "1.0.1"
-  },
-  {
-   "SPDXID": "SPDXRef-Package-deb-package-2-2.0.1",
-   "name": "package-2",
-   "licenseConcluded": "NONE",
-   "downloadLocation": "NOASSERTION",
-   "externalRefs": [
-    {
-     "referenceCategory": "SECURITY",
-     "referenceLocator": "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*",
-     "referenceType": "cpe23Type"
-    },
-    {
-     "referenceCategory": "PACKAGE_MANAGER",
-     "referenceLocator": "a-purl-2",
-     "referenceType": "purl"
-    }
-   ],
-   "filesAnalyzed": false,
-   "licenseDeclared": "NONE",
-   "sourceInfo": "acquired package info from DPKG DB: /some/path/pkg1",
-   "versionInfo": "2.0.1"
-  }
- ],
- "files": [
-  {
-   "SPDXID": "SPDXRef-File-package-1-efae7fecc76ca25da40f79d7ef5b8933510434914835832c7976f3e866aa756a",
-   "name": "foo",
-   "licenseConcluded": "",
-   "fileName": "/some/path/pkg1/dependencies/foo"
-  }
- ],
- "relationships": [
-  {
-   "spdxElementId": "SPDXRef-Package-python-package-1-1.0.1",
-   "relationshipType": "CONTAINS",
-   "relatedSpdxElement": "SPDXRef-File-package-1-efae7fecc76ca25da40f79d7ef5b8933510434914835832c7976f3e866aa756a"
-  }
- ]
-}

internal/presenter/packages/test-fixtures/snapshot/TestSPDXJSONImagePresenter.golden

@@ -1,61 +0,0 @@
-{
- "SPDXID": "SPDXRef-DOCUMENT",
- "name": "user-image-input",
- "spdxVersion": "SPDX-2.2",
- "creationInfo": {
-  "created": "2021-10-12T18:40:22.953633Z",
-  "creators": [
-   "Organization: Anchore, Inc",
-   "Tool: syft-[not provided]"
-  ],
-  "licenseListVersion": "3.14"
- },
- "dataLicense": "CC0-1.0",
- "documentNamespace": "https:/anchore.com/syft/image/user-image-input-149edbad-3c01-4ee0-b3a0-75232312bf51",
- "packages": [
-  {
-   "SPDXID": "SPDXRef-Package-python-package-1-1.0.1",
-   "name": "package-1",
-   "licenseConcluded": "MIT",
-   "downloadLocation": "NOASSERTION",
-   "externalRefs": [
-    {
-     "referenceCategory": "SECURITY",
-     "referenceLocator": "cpe:2.3:*:some:package:1:*:*:*:*:*:*:*",
-     "referenceType": "cpe23Type"
-    },
-    {
-     "referenceCategory": "PACKAGE_MANAGER",
-     "referenceLocator": "a-purl-1",
-     "referenceType": "purl"
-    }
-   ],
-   "filesAnalyzed": false,
-   "licenseDeclared": "MIT",
-   "sourceInfo": "acquired package info from installed python package manifest file: /somefile-1.txt",
-   "versionInfo": "1.0.1"
-  },
-  {
-   "SPDXID": "SPDXRef-Package-deb-package-2-2.0.1",
-   "name": "package-2",
-   "licenseConcluded": "NONE",
-   "downloadLocation": "NOASSERTION",
-   "externalRefs": [
-    {
-     "referenceCategory": "SECURITY",
-     "referenceLocator": "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*",
-     "referenceType": "cpe23Type"
-    },
-    {
-     "referenceCategory": "PACKAGE_MANAGER",
-     "referenceLocator": "a-purl-2",
-     "referenceType": "purl"
-    }
-   ],
-   "filesAnalyzed": false,
-   "licenseDeclared": "NONE",
-   "sourceInfo": "acquired package info from DPKG DB: /somefile-2.txt",
-   "versionInfo": "2.0.1"
-  }
- ]
-}

internal/presenter/poweruser/json_document.go

@@ -3,6 +3,7 @@ package poweruser
 import (
 	"github.com/anchore/syft/internal/formats/syftjson"
 	"github.com/anchore/syft/internal/formats/syftjson/model"
+	"github.com/anchore/syft/syft/sbom"
 )
 
 type JSONDocument struct {
@@ -18,17 +19,17 @@ type JSONDocument struct {
 }
 
 // NewJSONDocument creates and populates a new JSON document struct from the given cataloging results.
-func NewJSONDocument(config JSONDocumentConfig) (JSONDocument, error) {
-	fileMetadata, err := NewJSONFileMetadata(config.FileMetadata, config.FileDigests)
+func NewJSONDocument(s sbom.SBOM, appConfig interface{}) (JSONDocument, error) {
+	fileMetadata, err := NewJSONFileMetadata(s.Artifacts.FileMetadata, s.Artifacts.FileDigests)
 	if err != nil {
 		return JSONDocument{}, err
 	}
 
 	return JSONDocument{
-		FileClassifications: NewJSONFileClassifications(config.FileClassifications),
-		FileContents:        NewJSONFileContents(config.FileContents),
+		FileClassifications: NewJSONFileClassifications(s.Artifacts.FileClassifications),
+		FileContents:        NewJSONFileContents(s.Artifacts.FileContents),
 		FileMetadata:        fileMetadata,
-		Secrets:             NewJSONSecrets(config.Secrets),
-		Document:            syftjson.ToFormatModel(config.PackageCatalog, &config.SourceMetadata, config.Distro, config.ApplicationConfig.Package.Cataloger.ScopeOpt, config.ApplicationConfig),
+		Secrets:             NewJSONSecrets(s.Artifacts.Secrets),
+		Document:            syftjson.ToFormatModel(s, appConfig),
 	}, nil
 }

internal/presenter/poweruser/json_presenter.go

@@ -3,23 +3,27 @@ package poweruser
 import (
 	"encoding/json"
 	"io"
+
+	"github.com/anchore/syft/syft/sbom"
 )
 
 // JSONPresenter is a JSON presentation object for the syft results
 type JSONPresenter struct {
-	config JSONDocumentConfig
+	sbom   sbom.SBOM
+	config interface{}
 }
 
 // NewJSONPresenter creates a new JSON presenter object for the given cataloging results.
-func NewJSONPresenter(config JSONDocumentConfig) *JSONPresenter {
+func NewJSONPresenter(s sbom.SBOM, appConfig interface{}) *JSONPresenter {
 	return &JSONPresenter{
-		config: config,
+		sbom:   s,
+		config: appConfig,
 	}
 }
 
 // Present the PackageCatalog results to the given writer.
 func (p *JSONPresenter) Present(output io.Writer) error {
-	doc, err := NewJSONDocument(p.config)
+	doc, err := NewJSONDocument(p.sbom, p.config)
 	if err != nil {
 		return err
 	}

internal/presenter/poweruser/json_presenter_test.go

@@ -5,6 +5,8 @@ import (
 	"flag"
 	"testing"
 
+	"github.com/anchore/syft/syft/sbom"
+
 	"github.com/sergi/go-diff/diffmatchpatch"
 
 	"github.com/anchore/syft/syft/file"
@@ -31,7 +33,6 @@ func TestJSONPresenter(t *testing.T) {
 	catalog := pkg.NewCatalog()
 
 	catalog.Add(pkg.Package{
-		ID:      "package-1-id",
 		Name:    "package-1",
 		Version: "1.0.1",
 		Locations: []source.Location{
@@ -55,7 +56,6 @@ func TestJSONPresenter(t *testing.T) {
 		},
 	})
 	catalog.Add(pkg.Package{
-		ID:      "package-2-id",
 		Name:    "package-2",
 		Version: "2.0.1",
 		Locations: []source.Location{
@@ -77,63 +77,66 @@ func TestJSONPresenter(t *testing.T) {
 		},
 	})
 
-	cfg := JSONDocumentConfig{
-		ApplicationConfig: config.Application{
-			FileMetadata: config.FileMetadata{
-				Digests: []string{"sha256"},
-			},
+	appConfig := config.Application{
+		FileMetadata: config.FileMetadata{
+			Digests: []string{"sha256"},
 		},
-		PackageCatalog: catalog,
-		FileMetadata: map[source.Location]source.FileMetadata{
-			source.NewLocation("/a/place"): {
-				Mode:    0775,
-				Type:    "directory",
-				UserID:  0,
-				GroupID: 0,
-			},
-			source.NewLocation("/a/place/a"): {
-				Mode:    0775,
-				Type:    "regularFile",
-				UserID:  0,
-				GroupID: 0,
-			},
-			source.NewLocation("/b"): {
-				Mode:            0775,
-				Type:            "symbolicLink",
-				LinkDestination: "/c",
-				UserID:          0,
-				GroupID:         0,
-			},
-			source.NewLocation("/b/place/b"): {
-				Mode:    0644,
-				Type:    "regularFile",
-				UserID:  1,
-				GroupID: 2,
-			},
-		},
-		FileDigests: map[source.Location][]file.Digest{
-			source.NewLocation("/a/place/a"): {
-				{
-					Algorithm: "sha256",
-					Value:     "366a3f5653e34673b875891b021647440d0127c2ef041e3b1a22da2a7d4f3703",
+	}
+
+	cfg := sbom.SBOM{
+		Artifacts: sbom.Artifacts{
+			PackageCatalog: catalog,
+			FileMetadata: map[source.Location]source.FileMetadata{
+				source.NewLocation("/a/place"): {
+					Mode:    0775,
+					Type:    "directory",
+					UserID:  0,
+					GroupID: 0,
+				},
+				source.NewLocation("/a/place/a"): {
+					Mode:    0775,
+					Type:    "regularFile",
+					UserID:  0,
+					GroupID: 0,
+				},
+				source.NewLocation("/b"): {
+					Mode:            0775,
+					Type:            "symbolicLink",
+					LinkDestination: "/c",
+					UserID:          0,
+					GroupID:         0,
+				},
+				source.NewLocation("/b/place/b"): {
+					Mode:    0644,
+					Type:    "regularFile",
+					UserID:  1,
+					GroupID: 2,
 				},
 			},
-			source.NewLocation("/b/place/b"): {
-				{
-					Algorithm: "sha256",
-					Value:     "1b3722da2a7d90d033b87581a2a3f12021647445653e34666ef041e3b4f3707c",
+			FileDigests: map[source.Location][]file.Digest{
+				source.NewLocation("/a/place/a"): {
+					{
+						Algorithm: "sha256",
+						Value:     "366a3f5653e34673b875891b021647440d0127c2ef041e3b1a22da2a7d4f3703",
+					},
+				},
+				source.NewLocation("/b/place/b"): {
+					{
+						Algorithm: "sha256",
+						Value:     "1b3722da2a7d90d033b87581a2a3f12021647445653e34666ef041e3b4f3707c",
+					},
 				},
 			},
+			FileContents: map[source.Location]string{
+				source.NewLocation("/a/place/a"): "the-contents",
+			},
+			Distro: &distro.Distro{
+				Type:       distro.RedHat,
+				RawVersion: "7",
+				IDLike:     "rhel",
+			},
 		},
-		FileContents: map[source.Location]string{
-			source.NewLocation("/a/place/a"): "the-contents",
-		},
-		Distro: &distro.Distro{
-			Type:       distro.RedHat,
-			RawVersion: "7",
-			IDLike:     "rhel",
-		},
-		SourceMetadata: source.Metadata{
+		Source: source.Metadata{
 			Scheme: source.ImageScheme,
 			ImageMetadata: source.ImageMetadata{
 				UserInput:      "user-image-input",
@@ -163,7 +166,7 @@ func TestJSONPresenter(t *testing.T) {
 		},
 	}
 
-	if err := NewJSONPresenter(cfg).Present(&buffer); err != nil {
+	if err := NewJSONPresenter(cfg, appConfig).Present(&buffer); err != nil {
 		t.Fatal(err)
 	}
 	actual := buffer.Bytes()

internal/presenter/poweruser/test-fixtures/snapshot/TestJSONPresenter.golden

@@ -72,7 +72,7 @@
  ],
  "artifacts": [
   {
-   "id": "package-1-id",
+   "id": "b84dfe0eb2c5670f",
    "name": "package-1",
    "version": "1.0.1",
    "type": "python",
@@ -102,7 +102,7 @@
    }
   },
   {
-   "id": "package-2-id",
+   "id": "6619226d6979963f",
    "name": "package-2",
    "version": "2.0.1",
    "type": "deb",
@@ -157,8 +157,7 @@
    ],
    "manifest": "ZXlKelkyaGxiV0ZXWlhKemFXOXVJam95TENKdFpXUnBZVlI1Y0dVaU9pSmguLi4=",
    "config": "ZXlKaGNtTm9hWFJsWTNSMWNtVWlPaUpoYldRMk5DSXNJbU52Ym1acC4uLg==",
-   "repoDigests": [],
-   "scope": ""
+   "repoDigests": []
   }
  },
  "distro": {

syft/artifact/id.go

@@ -0,0 +1,26 @@
+package artifact
+
+import (
+	"fmt"
+
+	"github.com/mitchellh/hashstructure/v2"
+)
+
+// ID represents a unique value for each package added to a package catalog.
+type ID string
+
+type Identifiable interface {
+	ID() ID
+}
+
+func IDFromHash(obj interface{}) (ID, error) {
+	f, err := hashstructure.Hash(obj, hashstructure.FormatV2, &hashstructure.HashOptions{
+		ZeroNil:      true,
+		SlicesAsSets: true,
+	})
+	if err != nil {
+		return "", fmt.Errorf("could not build ID for object=%+v: %+v", obj, err)
+	}
+
+	return ID(fmt.Sprintf("%x", f)), nil
+}

syft/artifact/relationship.go

@@ -0,0 +1,17 @@
+package artifact
+
+const (
+	// OwnershipByFileOverlapRelationship indicates that the parent package claims ownership of a child package since
+	// the parent metadata indicates overlap with a location that a cataloger found the child package by. This is
+	// by definition a package-to-package relationship and is created only after all package cataloging has been completed.
+	OwnershipByFileOverlapRelationship RelationshipType = "ownership-by-file-overlap"
+)
+
+type RelationshipType string
+
+type Relationship struct {
+	From Identifiable     `json:"from"`
+	To   Identifiable     `json:"to"`
+	Type RelationshipType `json:"type"`
+	Data interface{}      `json:"data,omitempty"`
+}

syft/encode_decode.go

@@ -5,23 +5,21 @@ import (
 	"fmt"
 	"io"
 
+	"github.com/anchore/syft/syft/sbom"
+
 	"github.com/anchore/syft/internal/formats"
-	"github.com/anchore/syft/syft/distro"
 	"github.com/anchore/syft/syft/format"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
 )
 
 // Encode takes all SBOM elements and a format option and encodes an SBOM document.
-// TODO: encapsulate input data into common sbom document object
-func Encode(catalog *pkg.Catalog, metadata *source.Metadata, dist *distro.Distro, scope source.Scope, option format.Option) ([]byte, error) {
+func Encode(s sbom.SBOM, option format.Option) ([]byte, error) {
 	f := formats.ByOption(option)
 	if f == nil {
 		return nil, fmt.Errorf("unsupported format: %+v", option)
 	}
 	buff := bytes.Buffer{}
 
-	if err := f.Encode(&buff, catalog, dist, metadata, scope); err != nil {
+	if err := f.Encode(&buff, s); err != nil {
 		return nil, fmt.Errorf("unable to encode sbom: %w", err)
 	}
 
@@ -29,20 +27,19 @@ func Encode(catalog *pkg.Catalog, metadata *source.Metadata, dist *distro.Distro
 }
 
 // Decode takes a reader for an SBOM and generates all internal SBOM elements.
-// TODO: encapsulate return data into common sbom document object
-func Decode(reader io.Reader) (*pkg.Catalog, *source.Metadata, *distro.Distro, source.Scope, format.Option, error) {
+func Decode(reader io.Reader) (*sbom.SBOM, format.Option, error) {
 	by, err := io.ReadAll(reader)
 	if err != nil {
-		return nil, nil, nil, source.UnknownScope, format.UnknownFormatOption, fmt.Errorf("unable to read sbom: %w", err)
+		return nil, format.UnknownFormatOption, fmt.Errorf("unable to read sbom: %w", err)
 	}
 
 	f, err := formats.Identify(by)
 	if err != nil {
-		return nil, nil, nil, source.UnknownScope, format.UnknownFormatOption, fmt.Errorf("unable to detect format: %w", err)
+		return nil, format.UnknownFormatOption, fmt.Errorf("unable to detect format: %w", err)
 	}
 	if f == nil {
-		return nil, nil, nil, source.UnknownScope, format.UnknownFormatOption, fmt.Errorf("unable to identify format")
+		return nil, format.UnknownFormatOption, fmt.Errorf("unable to identify format")
 	}
-	c, m, d, s, err := f.Decode(bytes.NewReader(by))
-	return c, m, d, s, f.Option, err
+	s, err := f.Decode(bytes.NewReader(by))
+	return s, f.Option, err
 }

syft/event/parsers/parsers.go

@@ -6,15 +6,12 @@ package parsers
 import (
 	"fmt"
 
-	"github.com/anchore/syft/syft/presenter"
-
-	"github.com/anchore/syft/syft/file"
-
-	"github.com/wagoodman/go-progress"
-
+	"github.com/anchore/go-presenter"
 	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg/cataloger"
 	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
 )
 
 type ErrBadPayload struct {

syft/format/decoder.go

@@ -3,11 +3,8 @@ package format
 import (
 	"io"
 
-	"github.com/anchore/syft/syft/distro"
-
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
+	"github.com/anchore/syft/syft/sbom"
 )
 
 // Decoder is a function that can convert an SBOM document of a specific format from a reader into Syft native objects.
-type Decoder func(reader io.Reader) (*pkg.Catalog, *source.Metadata, *distro.Distro, source.Scope, error)
+type Decoder func(reader io.Reader) (*sbom.SBOM, error)

syft/format/encoder.go

@@ -3,10 +3,8 @@ package format
 import (
 	"io"
 
-	"github.com/anchore/syft/syft/distro"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
+	"github.com/anchore/syft/syft/sbom"
 )
 
 // Encoder is a function that can transform Syft native objects into an SBOM document of a specific format written to the given writer.
-type Encoder func(io.Writer, *pkg.Catalog, *source.Metadata, *distro.Distro, source.Scope) error
+type Encoder func(io.Writer, sbom.SBOM) error

syft/format/format.go

@@ -4,10 +4,7 @@ import (
 	"errors"
 	"io"
 
-	"github.com/anchore/syft/syft/distro"
-
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
+	"github.com/anchore/syft/syft/sbom"
 )
 
 var (
@@ -32,16 +29,16 @@ func NewFormat(option Option, encoder Encoder, decoder Decoder, validator Valida
 	}
 }
 
-func (f Format) Encode(output io.Writer, catalog *pkg.Catalog, d *distro.Distro, metadata *source.Metadata, scope source.Scope) error {
+func (f Format) Encode(output io.Writer, s sbom.SBOM) error {
 	if f.encoder == nil {
 		return ErrEncodingNotSupported
 	}
-	return f.encoder(output, catalog, metadata, d, scope)
+	return f.encoder(output, s)
 }
 
-func (f Format) Decode(reader io.Reader) (*pkg.Catalog, *source.Metadata, *distro.Distro, source.Scope, error) {
+func (f Format) Decode(reader io.Reader) (*sbom.SBOM, error) {
 	if f.decoder == nil {
-		return nil, nil, nil, source.UnknownScope, ErrDecodingNotSupported
+		return nil, ErrDecodingNotSupported
 	}
 	return f.decoder(reader)
 }
@@ -54,9 +51,9 @@ func (f Format) Validate(reader io.Reader) error {
 	return f.validator(reader)
 }
 
-func (f Format) Presenter(catalog *pkg.Catalog, metadata *source.Metadata, d *distro.Distro, scope source.Scope) *Presenter {
+func (f Format) Presenter(s sbom.SBOM) *Presenter {
 	if f.encoder == nil {
 		return nil
 	}
-	return NewPresenter(f.encoder, catalog, metadata, d, scope)
+	return NewPresenter(f.encoder, s)
 }

syft/format/presenter.go

@@ -3,30 +3,21 @@ package format
 import (
 	"io"
 
-	"github.com/anchore/syft/syft/distro"
-
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
+	"github.com/anchore/syft/syft/sbom"
 )
 
 type Presenter struct {
-	catalog     *pkg.Catalog
-	srcMetadata *source.Metadata
-	distro      *distro.Distro
-	scope       source.Scope
-	encoder     Encoder
+	sbom    sbom.SBOM
+	encoder Encoder
 }
 
-func NewPresenter(encoder Encoder, catalog *pkg.Catalog, srcMetadata *source.Metadata, d *distro.Distro, scope source.Scope) *Presenter {
+func NewPresenter(encoder Encoder, s sbom.SBOM) *Presenter {
 	return &Presenter{
-		catalog:     catalog,
-		srcMetadata: srcMetadata,
-		distro:      d,
-		encoder:     encoder,
-		scope:       scope,
+		sbom:    s,
+		encoder: encoder,
 	}
 }
 
 func (pres *Presenter) Present(output io.Writer) error {
-	return pres.encoder(output, pres.catalog, pres.srcMetadata, pres.distro, pres.scope)
+	return pres.encoder(output, pres.sbom)
 }

syft/lib.go

@@ -19,6 +19,8 @@ package syft
 import (
 	"fmt"
 
+	"github.com/anchore/syft/syft/artifact"
+
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/distro"
@@ -32,10 +34,10 @@ import (
 // CatalogPackages takes an inventory of packages from the given image from a particular perspective
 // (e.g. squashed source, all-layers source). Returns the discovered  set of packages, the identified Linux
 // distribution, and the source object used to wrap the data source.
-func CatalogPackages(src *source.Source, scope source.Scope) (*pkg.Catalog, *distro.Distro, error) {
+func CatalogPackages(src *source.Source, scope source.Scope) (*pkg.Catalog, []artifact.Relationship, *distro.Distro, error) {
 	resolver, err := src.FileResolver(scope)
 	if err != nil {
-		return nil, nil, fmt.Errorf("unable to determine resolver while cataloging packages: %w", err)
+		return nil, nil, nil, fmt.Errorf("unable to determine resolver while cataloging packages: %w", err)
 	}
 
 	// find the distro
@@ -52,19 +54,22 @@ func CatalogPackages(src *source.Source, scope source.Scope) (*pkg.Catalog, *dis
 	case source.ImageScheme:
 		log.Info("cataloging image")
 		catalogers = cataloger.ImageCatalogers()
+	case source.FileScheme:
+		log.Info("cataloging file")
+		catalogers = cataloger.AllCatalogers()
 	case source.DirectoryScheme:
 		log.Info("cataloging directory")
 		catalogers = cataloger.DirectoryCatalogers()
 	default:
-		return nil, nil, fmt.Errorf("unable to determine cataloger set from scheme=%+v", src.Metadata.Scheme)
+		return nil, nil, nil, fmt.Errorf("unable to determine cataloger set from scheme=%+v", src.Metadata.Scheme)
 	}
 
-	catalog, err := cataloger.Catalog(resolver, theDistro, catalogers...)
+	catalog, relationships, err := cataloger.Catalog(resolver, theDistro, catalogers...)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
 
-	return catalog, theDistro, nil
+	return catalog, relationships, theDistro, nil
 }
 
 // SetLogger sets the logger object used for all syft logging calls.