[wip] git-root config search concept

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
directory resolver should account for the proc cwd relative to the root path (#644 )
2026-10-12 06:07:20 +02:00 · 2021-11-30 16:43:41 -05:00 · 2021-11-30 15:34:37 -05:00 · 2021-11-30 11:36:08 -05:00 · 2021-11-30 11:23:16 -05:00 · 2021-11-23 14:54:17 -05:00
269 changed files with 6566 additions and 3638 deletions
@@ -15,3 +15,8 @@ ignore-packages:
  # * GNU General Public License, version 2.0 or later (GPL-2.0-or-later).
  # (we choose Apache-2.0)
  - github.com/spdx/tools-golang
+
+  # from: https://github.com/xi2/xz/blob/master/LICENSE
+  # All these files have been put into the public domain.
+  # You can do whatever you want with these files.
+  - github.com/xi2/xz
@@ -15,10 +15,10 @@ RESET := $(shell tput -T linux sgr0)
 TITLE := $(BOLD)$(PURPLE)
 SUCCESS := $(BOLD)$(GREEN)
 # the quality gate lower threshold for unit test total % coverage (by function statements)
-COVERAGE_THRESHOLD := 65
+COVERAGE_THRESHOLD := 62
 # CI cache busting values; change these if you want CI to not use previous stored cache
 INTEGRATION_CACHE_BUSTER="88738d2f"
-CLI_CACHE_BUSTER="789bacdf"
+CLI_CACHE_BUSTER="9a2c03cf"
 BOOTSTRAP_CACHE="c7afb99ad"

 ## Build variables
@@ -37,10 +37,6 @@ ifeq "$(strip $(VERSION))" ""
 override VERSION = $(shell git describe --always --tags --dirty)
 endif

-# used to generate the changelog from the second to last tag to the current tag (used in the release pipeline when the release tag is in place)
-LAST_TAG := $(shell git describe --abbrev=0 --tags $(shell git rev-list --tags --max-count=1))
-SECOND_TO_LAST_TAG := $(shell git describe --abbrev=0 --tags $(shell git rev-list --tags --skip=1 --max-count=1))
-
 ## Variable assertions

 ifndef TEMPDIR
@@ -103,7 +99,7 @@ bootstrap-tools: $(TEMPDIR)
 	GO111MODULE=off GOBIN=$(shell realpath $(TEMPDIR)) go get -u golang.org/x/perf/cmd/benchstat
 	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(TEMPDIR)/ v1.42.1
 	curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMPDIR)/ v0.2.0
-	curl -sSfL https://raw.githubusercontent.com/anchore/chronicle/main/install.sh | sh -s -- -b $(TEMPDIR)/ v0.2.0-beta
+	curl -sSfL https://raw.githubusercontent.com/anchore/chronicle/main/install.sh | sh -s -- -b $(TEMPDIR)/ v0.3.0
 	.github/scripts/goreleaser-install.sh -b $(TEMPDIR)/ v0.177.0

 .PHONY: bootstrap-go
@@ -139,7 +135,7 @@ lint-fix: ## Auto-format all source code + run golangci lint fixers
 	go mod tidy

 .PHONY: check-licenses
-check-licenses:
+check-licenses: ## Ensure transitive dependencies are compliant with the current license policy
 	$(TEMPDIR)/bouncer check

 check-go-mod-tidy:
@@ -194,6 +190,11 @@ fixtures:
 generate-json-schema:  ## Generate a new json schema
 	cd schema/json && go run generate.go

+.PHONY: generate-license-list
+generate-license-list: ## Generate an updated spdx license list
+	go generate ./internal/spdxlicense/...
+	gofmt -s -w ./internal/spdxlicense
+
 .PHONY: build
 build: $(SNAPSHOTDIR) ## Build release snapshot binaries and packages

@@ -252,27 +253,19 @@ cli: $(SNAPSHOTDIR) ## Run CLI tests
 	SYFT_BINARY_LOCATION='$(SNAPSHOT_CMD)' \
 		go test -count=1 -v ./test/cli

-.PHONY: changelog-release
-changelog-release:
-	$(TEMPDIR)/chronicle --since-tag $(SECOND_TO_LAST_TAG) --until-tag $(LAST_TAG) -vv > CHANGELOG.md
-
-	@printf '\n$(BOLD)$(CYAN)Release $(VERSION) Changelog$(RESET)\n\n'
-	@cat CHANGELOG.md
-
-.PHONY: changelog-unreleased
-changelog-unreleased: ## show the current changelog that will be produced on the next release (note: requires GITHUB_TOKEN set)
-	$(TEMPDIR)/chronicle --since-tag $(LAST_TAG) -vv > CHANGELOG.md
-
-	@printf '\n$(BOLD)$(CYAN)Unreleased Changes (closed PRs and issues will not be in the final changelog)$(RESET)\n'
-
+.PHONY: changelog
+changelog: clean-changelog CHANGELOG.md
 	@docker run -it --rm \
 		-v $(shell pwd)/CHANGELOG.md:/CHANGELOG.md \
 		rawkode/mdv \
 			-t 748.5989 \
 			/CHANGELOG.md

+CHANGELOG.md:
+	$(TEMPDIR)/chronicle -vv > CHANGELOG.md
+
 .PHONY: release
-release: clean-dist changelog-release ## Build and publish final binaries and packages. Intended to be run only on macOS.
+release: clean-dist CHANGELOG.md  ## Build and publish final binaries and packages. Intended to be run only on macOS.
 	$(call title,Publishing release artifacts)

 	# Prepare for macOS-specific signing process
@@ -313,9 +306,13 @@ clean-snapshot:
 	rm -rf $(SNAPSHOTDIR) $(TEMPDIR)/goreleaser.yaml

 .PHONY: clean-dist
-clean-dist:
+clean-dist: clean-changelog
 	rm -rf $(DISTDIR) $(TEMPDIR)/goreleaser.yaml

+.PHONY: clean-changelog
+clean-changelog:
+	rm -f CHANGELOG.md
+
 clean-test-image-cache: clean-test-image-tar-cache clean-test-image-docker-cache

 .PHONY: clear-test-image-tar-cache
@@ -1,5 +1,5 @@
 <p align="center">
-    <img src="https://user-images.githubusercontent.com/5199289/136844524-1527b09f-c5cb-4aa9-be54-5aa92a6086c1.png" width="271">
+    <img src="https://user-images.githubusercontent.com/5199289/136844524-1527b09f-c5cb-4aa9-be54-5aa92a6086c1.png" width="271" alt="Cute pink owl syft logo">
 </p>

 [![Validations](https://github.com/anchore/syft/actions/workflows/validations.yaml/badge.svg)](https://github.com/anchore/syft/actions/workflows/validations.yaml)
@@ -11,6 +11,16 @@

 A CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Exceptional for vulnerability detection when used with a scanner tool like [Grype](https://github.com/anchore/grype).

+### Join us at the virtual OSS meetup!
+
+When: December 1, 2021 @ 11am-noon PT (2-3pm ET)
+
+We’ve got security experts from VMware and Anchore who will share their tips, tricks, and lessons learned on securing containers using [Syft](https://github.com/anchore/syft), [Grype](https://github.com/anchore/grype), and [Cartographer](https://github.com/vmware-tanzu/cartographer).
+
+Register now: https://get.anchore.com/anchore-oss-meetup-dec-1-2021/
+
+---
+
 ![syft-demo](https://user-images.githubusercontent.com/590471/90277200-2a253000-de33-11ea-893f-32c219eea11a.gif)

 ## Features
@@ -83,6 +93,7 @@ docker-archive:path/to/yourimage.tar   use a tarball from disk for archives crea
 oci-archive:path/to/yourimage.tar      use a tarball from disk for OCI archives (from Skopeo or otherwise)
 oci-dir:path/to/yourimage              read directly from a path on disk for OCI layout directories (from Skopeo or otherwise)
 dir:path/to/yourproject                read directly from a path on disk (any directory)
+file:path/to/yourproject/file          read directly from a path on disk (any single file)
 registry:yourrepo/yourimage:tag        pull image directly from a registry (no container runtime required)
 ```

@@ -94,7 +105,7 @@ The output format for Syft is configurable as well:
 syft packages <image> -o <format>
 ```

-Where the `format`s available are:
+Where the `formats` available are:
 - `json`: Use this to get as much information out of Syft as possible!
 - `text`: A row-oriented, human-and-machine-friendly output.
 - `cyclonedx`: A XML report conforming to the [CycloneDX 1.2 specification](https://cyclonedx.org/specification/overview/).
@@ -102,12 +113,96 @@ Where the `format`s available are:
 - `spdx-json`: A JSON report conforming to the [SPDX 2.2 JSON Schema](https://github.com/spdx/spdx-spec/blob/v2.2/schemas/spdx-schema.json).
 - `table`: A columnar summary (default).

+## Private Registry Authentication
+
+### Local Docker Credentials
+When a container runtime is not present, Syft can still utilize credentials configured in common credential sources (such as `~/.docker/config.json`). 
+It will pull images from private registries using these credentials. The config file is where your credentials are stored when authenticating with private registries via some command like `docker login`. 
+For more information see the `go-containerregistry` [documentation](https://github.com/google/go-containerregistry/tree/main/pkg/authn).
+
+
+An example `config.json` looks something like this:
+```
+// config.json
+{
+	"auths": {
+		"registry.example.com": {
+			"username": "AzureDiamond",
+			"password": "hunter2"
+		}
+	}
+}
+```
+
+You can run the following command as an example. It details the mount/environment configuration a container needs to access a private registry:
+
+`docker run -v ./config.json:/config/config.json -e "DOCKER_CONFIG=/config" anchore/syft:latest  <private_image>`
+
+
+### Docker Credentials in Kubernetes
+The below section shows a simple workflow on how to mount this config file as a secret into a container on kubernetes.
+1. Create a secret. The value of `config.json` is important. It refers to the specification detailed [here](https://github.com/google/go-containerregistry/tree/main/pkg/authn#the-config-file). 
+Below this section is the `secret.yaml` file that the pod configuration will consume as a volume. 
+The key `config.json` is important. It will end up being the name of the file when mounted into the pod.
+    ```
+    # secret.yaml
+    
+    apiVersion: v1
+    kind: Secret
+    metadata:
+      name: registry-config
+      namespace: syft
+    data:
+      config.json: <base64 encoded config.json>
+    ```
+
+    `kubectl apply -f secret.yaml`
+
+
+2. Create your pod running syft. The env `DOCKER_CONFIG` is important because it advertises where to look for the credential file. 
+In the below example, setting `DOCKER_CONFIG=/config` informs syft that credentials can be found at `/config/config.json`. 
+This is why we used `config.json` as the key for our secret. When mounted into containers the secrets' key is used as the filename. 
+The `volumeMounts` section mounts our secret to `/config`. The `volumes` section names our volume and leverages the secret we created in step one.
+    ```
+    # pod.yaml
+    
+    apiVersion: v1
+    kind: Pod
+    spec:
+      containers:
+        - image: anchore/syft:latest
+          name: syft-private-registry-demo
+          env:
+            - name: DOCKER_CONFIG
+              value: /config
+          volumeMounts:
+          - mountPath: /config
+            name: registry-config
+            readOnly: true
+          args:
+            - <private_image>
+      volumes:
+      - name: registry-config
+        secret:
+          secretName: registry-config
+    ```
+
+    `kubectl apply -f pod.yaml`
+
+
+3. The user can now run `kubectl logs syft-private-registry-demo`. The logs should show the syft analysis for the `<private_image>` provided in the pod configuration.
+
+Using the above information, users should be able to configure private registry access without having to do so in the `grype` or `syft` configuration files.
+They will also not be dependent on a docker daemon, (or some other runtime software) for registry configuration and access.
+
 ## Configuration

 Configuration search paths:

 - `.syft.yaml`
 - `.syft/config.yaml`
+- `<git repo root>/.syft.yaml`
+- `<git repo root>/.syft/config.yaml`
 - `~/.syft.yaml`
 - `<XDG_CONFIG_HOME>/syft/config.yaml`

@@ -48,7 +48,13 @@ func initCmdAliasBindings() {
 		panic(err)
 	}

-	if activeCmd == packagesCmd || activeCmd == rootCmd {
+	// enable all cataloger by default if power-user command is run
+	if activeCmd == powerUserCmd {
+		config.PowerUserCatalogerEnabledDefault()
+	}
+
+	switch activeCmd {
+	case packagesCmd, rootCmd:
 		// note: we need to lazily bind config options since they are shared between both the root command
 		// and the packages command. Otherwise there will be global viper state that is in contention.
 		// See for more details: https://github.com/spf13/viper/issues/233 . Additionally, the bindings must occur BEFORE
@@ -58,7 +64,7 @@ func initCmdAliasBindings() {
 		if err = bindPackagesConfigOptions(activeCmd.Flags()); err != nil {
 			panic(err)
 		}
-	} else {
+	default:
 		// even though the root command or packages command is NOT being run, we still need default bindings
 		// such that application config parsing passes.
 		if err = bindPackagesConfigOptions(packagesCmd.Flags()); err != nil {
@@ -14,7 +14,7 @@ import (
 // eventLoop listens to worker errors (from execution path), worker events (from a partybus subscription), and
 // signal interrupts. Is responsible for handling each event relative to a given UI an to coordinate eventing until
 // an eventual graceful exit.
-// nolint:gocognit,funlen
+// nolint:funlen
 func eventLoop(workerErrs <-chan error, signals <-chan os.Signal, subscription *partybus.Subscription, cleanupFn func(), uxs ...ui.UI) error {
 	defer cleanupFn()
 	events := subscription.Events()
@@ -41,9 +41,7 @@ func eventLoop(workerErrs <-chan error, signals <-chan os.Signal, subscription *
 			if err != nil {
 				// capture the error from the worker and unsubscribe to complete a graceful shutdown
 				retErr = multierror.Append(retErr, err)
-				if err := subscription.Unsubscribe(); err != nil {
-					retErr = multierror.Append(retErr, err)
-				}
+				_ = subscription.Unsubscribe()
 				// the worker has exited, we may have been mid-handling events for the UI which should now be
 				// ignored, in which case forcing a teardown of the UI irregardless of the state is required.
 				forceTeardown = true
@@ -6,19 +6,18 @@ import (
 	"io/ioutil"
 	"os"

-	"github.com/anchore/syft/syft/format"
-
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/anchore"
 	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/formats"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/ui"
-	"github.com/anchore/syft/syft"
-	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/internal/version"
+	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/presenter/packages"
+	"github.com/anchore/syft/syft/format"
+	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 	"github.com/pkg/profile"
 	"github.com/spf13/cobra"
@@ -45,6 +44,7 @@ const (
    {{.appName}} {{.command}} oci-archive:path/to/yourimage.tar      use a tarball from disk for OCI archives (from Skopeo or otherwise)
    {{.appName}} {{.command}} oci-dir:path/to/yourimage              read directly from a path on disk for OCI layout directories (from Skopeo or otherwise)
    {{.appName}} {{.command}} dir:path/to/yourproject                read directly from a path on disk (any directory)
+    {{.appName}} {{.command}} file:path/to/yourproject/file          read directly from a path on disk (any single file)
    {{.appName}} {{.command}} registry:yourrepo/yourimage:tag        pull image directly from a registry (no container runtime required)
 `
 )
@@ -239,6 +239,18 @@ func packagesExecWorker(userInput string) <-chan error {
 	go func() {
 		defer close(errs)

+		tasks, err := tasks()
+		if err != nil {
+			errs <- err
+			return
+		}
+
+		f := formats.ByOption(packagesPresenterOpt)
+		if f == nil {
+			errs <- fmt.Errorf("unknown format: %s", packagesPresenterOpt)
+			return
+		}
+
 		checkForApplicationUpdate()

 		src, cleanup, err := source.New(userInput, appConfig.Registry.ToOptions())
@@ -246,35 +258,54 @@ func packagesExecWorker(userInput string) <-chan error {
 			errs <- fmt.Errorf("failed to determine image source: %w", err)
 			return
 		}
-		defer cleanup()
-
-		catalog, d, err := syft.CatalogPackages(src, appConfig.Package.Cataloger.ScopeOpt)
-		if err != nil {
-			errs <- fmt.Errorf("failed to catalog input: %w", err)
-			return
+		if cleanup != nil {
+			defer cleanup()
 		}

+		s := sbom.SBOM{
+			Source: src.Metadata,
+			Descriptor: sbom.Descriptor{
+				Name:          internal.ApplicationName,
+				Version:       version.FromBuild().Version,
+				Configuration: appConfig,
+			},
+		}
+
+		var relationships []<-chan artifact.Relationship
+		for _, task := range tasks {
+			c := make(chan artifact.Relationship)
+			relationships = append(relationships, c)
+
+			go runTask(task, &s.Artifacts, src, c, errs)
+		}
+		s.Relationships = append(s.Relationships, mergeRelationships(relationships...)...)
+
 		if appConfig.Anchore.Host != "" {
-			if err := runPackageSbomUpload(src, src.Metadata, catalog, d, appConfig.Package.Cataloger.ScopeOpt); err != nil {
+			if err := runPackageSbomUpload(src, s); err != nil {
 				errs <- err
 				return
 			}
 		}

 		bus.Publish(partybus.Event{
-			Type: event.PresenterReady,
-			Value: packages.Presenter(packagesPresenterOpt, packages.PresenterConfig{
-				SourceMetadata: src.Metadata,
-				Catalog:        catalog,
-				Distro:         d,
-				Scope:          appConfig.Package.Cataloger.ScopeOpt,
-			}),
+			Type:  event.PresenterReady,
+			Value: f.Presenter(s),
 		})
 	}()
 	return errs
 }

-func runPackageSbomUpload(src *source.Source, s source.Metadata, catalog *pkg.Catalog, d *distro.Distro, scope source.Scope) error {
+func mergeRelationships(cs ...<-chan artifact.Relationship) (relationships []artifact.Relationship) {
+	for _, c := range cs {
+		for n := range c {
+			relationships = append(relationships, n)
+		}
+	}
+
+	return relationships
+}
+
+func runPackageSbomUpload(src *source.Source, s sbom.SBOM) error {
 	log.Infof("uploading results to %s", appConfig.Anchore.Host)

 	if src.Metadata.Scheme != source.ImageScheme {
@@ -309,17 +340,15 @@ func runPackageSbomUpload(src *source.Source, s source.Metadata, catalog *pkg.Ca

 	importCfg := anchore.ImportConfig{
 		ImageMetadata:           src.Image.Metadata,
-		SourceMetadata:          s,
-		Catalog:                 catalog,
-		Distro:                  d,
+		SBOM:                    s,
 		Dockerfile:              dockerfileContents,
 		OverwriteExistingUpload: appConfig.Anchore.OverwriteExistingImage,
-		Scope:                   scope,
 		Timeout:                 appConfig.Anchore.ImportTimeout,
 	}

 	if err := c.Import(context.Background(), importCfg); err != nil {
 		return fmt.Errorf("failed to upload results to host=%s: %+v", appConfig.Anchore.Host, err)
 	}
+
 	return nil
 }
@@ -2,16 +2,20 @@ package cmd

 import (
 	"fmt"
-	"sync"
+	"os"

 	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/formats/syftjson"
 	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/presenter/poweruser"
 	"github.com/anchore/syft/internal/ui"
+	"github.com/anchore/syft/internal/version"
+	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
+	"github.com/gookit/color"
 	"github.com/pkg/profile"
 	"github.com/spf13/cobra"
 	"github.com/wagoodman/go-partybus"
@@ -19,6 +23,8 @@ import (

 const powerUserExample = `  {{.appName}} {{.command}} <image>

+  DEPRECATED - THIS COMMAND WILL BE REMOVED in v1.0.0
+
  Only image sources are supported (e.g. docker: , docker-archive: , oci: , etc.), the directory source (dir:) is not supported.

  All behavior is controlled via application configuration and environment variables (see https://github.com/anchore/syft#configuration)
@@ -72,6 +78,10 @@ func powerUserExec(_ *cobra.Command, args []string) error {
 		if err := closer(); err != nil {
 			log.Warnf("unable to write to report destination: %+v", err)
 		}
+
+		// inform user at end of run that command will be removed
+		deprecated := color.Style{color.Red, color.OpBold}.Sprint("DEPRECATED: This command will be removed in v1.0.0")
+		fmt.Fprintln(os.Stderr, deprecated)
 	}()

 	if err != nil {
@@ -86,13 +96,16 @@ func powerUserExec(_ *cobra.Command, args []string) error {
 		ui.Select(isVerbose(), appConfig.Quiet, reporter)...,
 	)
 }
-
 func powerUserExecWorker(userInput string) <-chan error {
 	errs := make(chan error)
 	go func() {
 		defer close(errs)

-		tasks, err := powerUserTasks()
+		appConfig.Secrets.Cataloger.Enabled = true
+		appConfig.FileMetadata.Cataloger.Enabled = true
+		appConfig.FileContents.Cataloger.Enabled = true
+		appConfig.FileClassification.Cataloger.Enabled = true
+		tasks, err := tasks()
 		if err != nil {
 			errs <- err
 			return
@@ -105,31 +118,34 @@ func powerUserExecWorker(userInput string) <-chan error {
 			errs <- err
 			return
 		}
-		defer cleanup()
-
-		analysisResults := poweruser.JSONDocumentConfig{
-			SourceMetadata:    src.Metadata,
-			ApplicationConfig: *appConfig,
+		if cleanup != nil {
+			defer cleanup()
 		}

-		wg := &sync.WaitGroup{}
+		s := sbom.SBOM{
+			Source: src.Metadata,
+			Descriptor: sbom.Descriptor{
+				Name:          internal.ApplicationName,
+				Version:       version.FromBuild().Version,
+				Configuration: appConfig,
+			},
+		}
+
+		var relationships []<-chan artifact.Relationship
 		for _, task := range tasks {
-			wg.Add(1)
-			go func(task powerUserTask) {
-				defer wg.Done()
-				if err = task(&analysisResults, src); err != nil {
-					errs <- err
-					return
-				}
-			}(task)
+			c := make(chan artifact.Relationship)
+			relationships = append(relationships, c)
+
+			go runTask(task, &s.Artifacts, src, c, errs)
 		}

-		wg.Wait()
+		s.Relationships = append(s.Relationships, mergeRelationships(relationships...)...)

 		bus.Publish(partybus.Event{
 			Type:  event.PresenterReady,
-			Value: poweruser.NewJSONPresenter(analysisResults),
+			Value: syftjson.Format().Presenter(s),
 		})
 	}()
+
 	return errs
 }
@@ -4,24 +4,25 @@ import (
 	"crypto"
 	"fmt"

-	"github.com/anchore/syft/internal/presenter/poweruser"
 	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 )

-type powerUserTask func(*poweruser.JSONDocumentConfig, *source.Source) error
+type task func(*sbom.Artifacts, *source.Source) ([]artifact.Relationship, error)

-func powerUserTasks() ([]powerUserTask, error) {
-	var tasks []powerUserTask
+func tasks() ([]task, error) {
+	var tasks []task

-	generators := []func() (powerUserTask, error){
-		catalogPackagesTask,
-		catalogFileMetadataTask,
-		catalogFileDigestsTask,
-		catalogSecretsTask,
-		catalogFileClassificationsTask,
-		catalogContentsTask,
+	generators := []func() (task, error){
+		generateCatalogPackagesTask,
+		generateCatalogFileMetadataTask,
+		generateCatalogFileDigestsTask,
+		generateCatalogSecretsTask,
+		generateCatalogFileClassificationsTask,
+		generateCatalogContentsTask,
 	}

 	for _, generator := range generators {
@@ -29,6 +30,7 @@ func powerUserTasks() ([]powerUserTask, error) {
 		if err != nil {
 			return nil, err
 		}
+
 		if task != nil {
 			tasks = append(tasks, task)
 		}
@@ -37,51 +39,51 @@ func powerUserTasks() ([]powerUserTask, error) {
 	return tasks, nil
 }

-func catalogPackagesTask() (powerUserTask, error) {
+func generateCatalogPackagesTask() (task, error) {
 	if !appConfig.Package.Cataloger.Enabled {
 		return nil, nil
 	}

-	task := func(results *poweruser.JSONDocumentConfig, src *source.Source) error {
-		packageCatalog, theDistro, err := syft.CatalogPackages(src, appConfig.Package.Cataloger.ScopeOpt)
+	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
+		packageCatalog, relationships, theDistro, err := syft.CatalogPackages(src, appConfig.Package.Cataloger.ScopeOpt)
 		if err != nil {
-			return err
+			return nil, err
 		}

 		results.PackageCatalog = packageCatalog
 		results.Distro = theDistro

-		return nil
+		return relationships, nil
 	}

 	return task, nil
 }

-func catalogFileMetadataTask() (powerUserTask, error) {
+func generateCatalogFileMetadataTask() (task, error) {
 	if !appConfig.FileMetadata.Cataloger.Enabled {
 		return nil, nil
 	}

 	metadataCataloger := file.NewMetadataCataloger()

-	task := func(results *poweruser.JSONDocumentConfig, src *source.Source) error {
+	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
 		resolver, err := src.FileResolver(appConfig.FileMetadata.Cataloger.ScopeOpt)
 		if err != nil {
-			return err
+			return nil, err
 		}

 		result, err := metadataCataloger.Catalog(resolver)
 		if err != nil {
-			return err
+			return nil, err
 		}
 		results.FileMetadata = result
-		return nil
+		return nil, nil
 	}

 	return task, nil
 }

-func catalogFileDigestsTask() (powerUserTask, error) {
+func generateCatalogFileDigestsTask() (task, error) {
 	if !appConfig.FileMetadata.Cataloger.Enabled {
 		return nil, nil
 	}
@@ -110,24 +112,24 @@ func catalogFileDigestsTask() (powerUserTask, error) {
 		return nil, err
 	}

-	task := func(results *poweruser.JSONDocumentConfig, src *source.Source) error {
+	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
 		resolver, err := src.FileResolver(appConfig.FileMetadata.Cataloger.ScopeOpt)
 		if err != nil {
-			return err
+			return nil, err
 		}

 		result, err := digestsCataloger.Catalog(resolver)
 		if err != nil {
-			return err
+			return nil, err
 		}
 		results.FileDigests = result
-		return nil
+		return nil, nil
 	}

 	return task, nil
 }

-func catalogSecretsTask() (powerUserTask, error) {
+func generateCatalogSecretsTask() (task, error) {
 	if !appConfig.Secrets.Cataloger.Enabled {
 		return nil, nil
 	}
@@ -142,24 +144,24 @@ func catalogSecretsTask() (powerUserTask, error) {
 		return nil, err
 	}

-	task := func(results *poweruser.JSONDocumentConfig, src *source.Source) error {
+	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
 		resolver, err := src.FileResolver(appConfig.Secrets.Cataloger.ScopeOpt)
 		if err != nil {
-			return err
+			return nil, err
 		}

 		result, err := secretsCataloger.Catalog(resolver)
 		if err != nil {
-			return err
+			return nil, err
 		}
 		results.Secrets = result
-		return nil
+		return nil, nil
 	}

 	return task, nil
 }

-func catalogFileClassificationsTask() (powerUserTask, error) {
+func generateCatalogFileClassificationsTask() (task, error) {
 	if !appConfig.FileClassification.Cataloger.Enabled {
 		return nil, nil
 	}
@@ -170,24 +172,24 @@ func catalogFileClassificationsTask() (powerUserTask, error) {
 		return nil, err
 	}

-	task := func(results *poweruser.JSONDocumentConfig, src *source.Source) error {
+	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
 		resolver, err := src.FileResolver(appConfig.FileClassification.Cataloger.ScopeOpt)
 		if err != nil {
-			return err
+			return nil, err
 		}

 		result, err := classifierCataloger.Catalog(resolver)
 		if err != nil {
-			return err
+			return nil, err
 		}
 		results.FileClassifications = result
-		return nil
+		return nil, nil
 	}

 	return task, nil
 }

-func catalogContentsTask() (powerUserTask, error) {
+func generateCatalogContentsTask() (task, error) {
 	if !appConfig.FileContents.Cataloger.Enabled {
 		return nil, nil
 	}
@@ -197,19 +199,33 @@ func catalogContentsTask() (powerUserTask, error) {
 		return nil, err
 	}

-	task := func(results *poweruser.JSONDocumentConfig, src *source.Source) error {
+	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
 		resolver, err := src.FileResolver(appConfig.FileContents.Cataloger.ScopeOpt)
 		if err != nil {
-			return err
+			return nil, err
 		}

 		result, err := contentsCataloger.Catalog(resolver)
 		if err != nil {
-			return err
+			return nil, err
 		}
 		results.FileContents = result
-		return nil
+		return nil, nil
 	}

 	return task, nil
 }
+
+func runTask(t task, a *sbom.Artifacts, src *source.Source, c chan<- artifact.Relationship, errs chan<- error) {
+	defer close(c)
+
+	relationships, err := t(a, src)
+	if err != nil {
+		errs <- err
+		return
+	}
+
+	for _, relationship := range relationships {
+		c <- relationship
+	}
+}
@@ -7,45 +7,52 @@ require (
 	github.com/adrg/xdg v0.2.1
 	github.com/alecthomas/jsonschema v0.0.0-20210301060011-54c507b6f074
 	github.com/anchore/client-go v0.0.0-20210222170800-9c70f9b80bcf
+	github.com/anchore/go-presenter v0.0.0-20211102174526-0dbf20f6c7fa
 	github.com/anchore/go-rpmdb v0.0.0-20210914181456-a9c52348da63
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29
-	github.com/anchore/stereoscope v0.0.0-20211024152658-003132a67c10
+	github.com/anchore/stereoscope v0.0.0-20211116152349-7e4e1b56a15d
+	// we are hinting brotli to latest due to warning when installing archiver v3:
+	// go: warning: github.com/andybalholm/brotli@v1.0.1: retracted by module author: occasional panics and data corruption
+	github.com/andybalholm/brotli v1.0.4 // indirect
 	github.com/antihax/optional v1.0.0
 	github.com/bmatcuk/doublestar/v2 v2.0.4
-	github.com/docker/docker v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible
+	github.com/docker/docker v20.10.10+incompatible
 	github.com/dustin/go-humanize v1.0.0
 	github.com/facebookincubator/nvdtools v0.1.4
 	github.com/go-test/deep v1.0.7
-	github.com/google/go-cmp v0.4.1
+	github.com/google/go-cmp v0.5.6
 	github.com/google/uuid v1.2.0
 	github.com/gookit/color v1.2.7
 	github.com/hashicorp/go-multierror v1.1.0
 	github.com/hashicorp/go-version v1.2.0
+	github.com/jinzhu/copier v0.3.2
+	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
+	github.com/mholt/archiver/v3 v3.5.1
 	github.com/mitchellh/go-homedir v1.1.0
-	github.com/mitchellh/hashstructure v1.1.0
-	github.com/mitchellh/mapstructure v1.3.1
+	github.com/mitchellh/hashstructure/v2 v2.0.2
+	github.com/mitchellh/mapstructure v1.4.1
 	github.com/olekukonko/tablewriter v0.0.4
-	github.com/pelletier/go-toml v1.8.1
+	github.com/pelletier/go-toml v1.9.3
 	github.com/pkg/profile v1.5.0
 	github.com/scylladb/go-set v1.0.2
 	github.com/sergi/go-diff v1.1.0
 	github.com/sirupsen/logrus v1.8.1
 	github.com/spdx/tools-golang v0.1.0
-	github.com/spf13/afero v1.2.2
-	github.com/spf13/cobra v1.0.1-0.20200909172742-8a63648dd905
+	github.com/spf13/afero v1.6.0
+	github.com/spf13/cobra v1.2.1
 	github.com/spf13/pflag v1.0.5
-	github.com/spf13/viper v1.7.0
+	github.com/spf13/viper v1.8.1
 	github.com/stretchr/testify v1.7.0
 	github.com/vifraa/gopom v0.1.0
 	github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5
 	github.com/wagoodman/go-progress v0.0.0-20200731105512-1020f39e6240
-	github.com/wagoodman/jotframe v0.0.0-20200730190914-3517092dd163
+	github.com/wagoodman/jotframe v0.0.0-20211129225309-56b0d0a4aebb
 	github.com/x-cray/logrus-prefixed-formatter v0.5.2
 	github.com/xeipuuv/gojsonschema v1.2.0
-	golang.org/x/mod v0.3.0
-	golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d
-	golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1
+	golang.org/x/mod v0.4.2
+	golang.org/x/net v0.0.0-20211111160137-58aab5ef257a
+	golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b
 	gopkg.in/yaml.v2 v2.4.0
 )
@@ -6,27 +6,21 @@ import (
 	"fmt"
 	"time"

-	"github.com/antihax/optional"
-
 	"github.com/anchore/client-go/pkg/external"
 	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/syft/distro"
 	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/antihax/optional"
 	"github.com/wagoodman/go-partybus"
 	"github.com/wagoodman/go-progress"
 )

 type ImportConfig struct {
 	ImageMetadata           image.Metadata
-	SourceMetadata          source.Metadata
-	Catalog                 *pkg.Catalog
-	Distro                  *distro.Distro
+	SBOM                    sbom.SBOM
 	Dockerfile              []byte
 	OverwriteExistingUpload bool
-	Scope                   source.Scope
 	Timeout                 uint
 }

@@ -74,19 +68,19 @@ func (c *Client) Import(ctx context.Context, cfg ImportConfig) error {
 	prog.N++
 	sessionID := startOperation.Uuid

-	packageDigest, err := importPackageSBOM(authedCtx, c.client.ImportsApi, sessionID, cfg.SourceMetadata, cfg.Catalog, cfg.Distro, cfg.Scope, stage)
+	packageDigest, err := importPackageSBOM(authedCtx, c.client.ImportsApi, sessionID, cfg.SBOM, stage)
 	if err != nil {
 		return fmt.Errorf("failed to import Package SBOM: %w", err)
 	}
 	prog.N++

-	manifestDigest, err := importManifest(authedCtx, c.client.ImportsApi, sessionID, cfg.ImageMetadata.RawManifest, stage)
+	manifestDigest, err := importManifest(authedCtx, c.client.ImportsApi, sessionID, cfg.SBOM.Source.ImageMetadata.RawManifest, stage)
 	if err != nil {
 		return fmt.Errorf("failed to import Manifest: %w", err)
 	}
 	prog.N++

-	configDigest, err := importConfig(authedCtx, c.client.ImportsApi, sessionID, cfg.ImageMetadata.RawConfig, stage)
+	configDigest, err := importConfig(authedCtx, c.client.ImportsApi, sessionID, cfg.SBOM.Source.ImageMetadata.RawConfig, stage)
 	if err != nil {
 		return fmt.Errorf("failed to import Config: %w", err)
 	}
@@ -8,26 +8,24 @@ import (
 	"fmt"
 	"net/http"

+	"github.com/anchore/syft/syft/sbom"
+
 	"github.com/anchore/syft/internal/formats/syftjson"

 	"github.com/wagoodman/go-progress"

-	"github.com/anchore/syft/syft/distro"
-	"github.com/anchore/syft/syft/source"
-
 	"github.com/anchore/client-go/pkg/external"
 	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/pkg"
 )

 type packageSBOMImportAPI interface {
 	ImportImagePackages(context.Context, string, external.ImagePackageManifest) (external.ImageImportContentResponse, *http.Response, error)
 }

-func packageSbomModel(s source.Metadata, catalog *pkg.Catalog, d *distro.Distro, scope source.Scope) (*external.ImagePackageManifest, error) {
+func packageSbomModel(s sbom.SBOM) (*external.ImagePackageManifest, error) {
 	var buf bytes.Buffer

-	err := syftjson.Format().Presenter(catalog, &s, d, scope).Present(&buf)
+	err := syftjson.Format().Presenter(s).Present(&buf)
 	if err != nil {
 		return nil, fmt.Errorf("unable to serialize results: %w", err)
 	}
@@ -41,11 +39,11 @@ func packageSbomModel(s source.Metadata, catalog *pkg.Catalog, d *distro.Distro,
 	return &model, nil
 }

-func importPackageSBOM(ctx context.Context, api packageSBOMImportAPI, sessionID string, s source.Metadata, catalog *pkg.Catalog, d *distro.Distro, scope source.Scope, stage *progress.Stage) (string, error) {
+func importPackageSBOM(ctx context.Context, api packageSBOMImportAPI, sessionID string, s sbom.SBOM, stage *progress.Stage) (string, error) {
 	log.Debug("importing package SBOM")
 	stage.Current = "package SBOM"

-	model, err := packageSbomModel(s, catalog, d, scope)
+	model, err := packageSbomModel(s)
 	if err != nil {
 		return "", fmt.Errorf("unable to create PackageSBOM model: %w", err)
 	}
@@ -9,6 +9,8 @@ import (
 	"strings"
 	"testing"

+	"github.com/anchore/syft/syft/sbom"
+
 	"github.com/anchore/client-go/pkg/external"
 	"github.com/anchore/syft/internal/formats/syftjson"
 	syftjsonModel "github.com/anchore/syft/internal/formats/syftjson/model"
@@ -57,8 +59,10 @@ func TestPackageSbomToModel(t *testing.T) {
 		FoundBy: "foundBy",
 		Locations: []source.Location{
 			{
-				RealPath:     "path",
-				FileSystemID: "layerID",
+				Coordinates: source.Coordinates{
+					RealPath:     "path",
+					FileSystemID: "layerID",
+				},
 			},
 		},
 		Licenses: []string{"license"},
@@ -72,7 +76,15 @@ func TestPackageSbomToModel(t *testing.T) {

 	c := pkg.NewCatalog(p)

-	model, err := packageSbomModel(m, c, &d, source.AllLayersScope)
+	sbomResult := sbom.SBOM{
+		Artifacts: sbom.Artifacts{
+			PackageCatalog: c,
+			Distro:         &d,
+		},
+		Source: m,
+	}
+
+	model, err := packageSbomModel(sbomResult)
 	if err != nil {
 		t.Fatalf("unable to generate model from source material: %+v", err)
 	}
@@ -84,8 +96,16 @@ func TestPackageSbomToModel(t *testing.T) {
 		t.Fatalf("unable to marshal model: %+v", err)
 	}

+	s := sbom.SBOM{
+		Artifacts: sbom.Artifacts{
+			PackageCatalog: c,
+			Distro:         &d,
+		},
+		Source: m,
+	}
+
 	var buf bytes.Buffer
-	pres := syftjson.Format().Presenter(c, &m, &d, source.AllLayersScope)
+	pres := syftjson.Format().Presenter(s)
 	if err := pres.Present(&buf); err != nil {
 		t.Fatalf("unable to get expected json: %+v", err)
 	}
@@ -139,8 +159,10 @@ func TestPackageSbomImport(t *testing.T) {
 		FoundBy: "foundBy",
 		Locations: []source.Location{
 			{
-				RealPath:     "path",
-				FileSystemID: "layerID",
+				Coordinates: source.Coordinates{
+					RealPath:     "path",
+					FileSystemID: "layerID",
+				},
 			},
 		},
 		Licenses: []string{"license"},
@@ -187,7 +209,15 @@ func TestPackageSbomImport(t *testing.T) {

 	d, _ := distro.NewDistro(distro.CentOS, "8.0", "")

-	theModel, err := packageSbomModel(m, catalog, &d, source.AllLayersScope)
+	sbomResult := sbom.SBOM{
+		Artifacts: sbom.Artifacts{
+			PackageCatalog: catalog,
+			Distro:         &d,
+		},
+		Source: m,
+	}
+
+	theModel, err := packageSbomModel(sbomResult)
 	if err != nil {
 		t.Fatalf("could not get sbom model: %+v", err)
 	}
@@ -226,7 +256,7 @@ func TestPackageSbomImport(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {

-			digest, err := importPackageSBOM(context.TODO(), test.api, sessionID, m, catalog, &d, source.AllLayersScope, &progress.Stage{})
+			digest, err := importPackageSBOM(context.TODO(), test.api, sessionID, sbomResult, &progress.Stage{})

 			// validate error handling
 			if err != nil && !test.expectsError {
@@ -3,7 +3,10 @@ package config
 import (
 	"errors"
 	"fmt"
+	"os"
+	"os/exec"
 	"path"
+	"path/filepath"
 	"reflect"
 	"strings"

@@ -17,6 +20,8 @@ import (

 var ErrApplicationConfigNotFound = fmt.Errorf("application config not found")

+var catalogerEnabledDefault = false
+
 type defaultValueLoader interface {
 	loadDefaultValues(*viper.Viper)
 }
@@ -44,6 +49,11 @@ type Application struct {
 	Registry           registry           `yaml:"registry" json:"registry" mapstructure:"registry"`
 }

+// PowerUserCatalogerEnabledDefault switches all catalogers to be enabled when running power-user command
+func PowerUserCatalogerEnabledDefault() {
+	catalogerEnabledDefault = true
+}
+
 func newApplicationConfig(v *viper.Viper, cliOpts CliOnlyOptions) *Application {
 	config := &Application{
 		CliOptions: cliOpts,
@@ -156,6 +166,10 @@ func (cfg *Application) parseLogLevelOption() error {
 		}
 	}

+	if cfg.Log.Level == "" {
+		cfg.Log.Level = cfg.Log.LevelOpt.String()
+	}
+
 	return nil
 }

@@ -195,44 +209,80 @@ func readConfig(v *viper.Viper, configPath string) error {
 	// 1. look for .<appname>.yaml (in the current directory)
 	v.AddConfigPath(".")
 	v.SetConfigName("." + internal.ApplicationName)
-	if err = v.ReadInConfig(); err == nil {
-		return nil
-	} else if !errors.As(err, &viper.ConfigFileNotFoundError{}) {
-		return fmt.Errorf("unable to parse config=%q: %w", v.ConfigFileUsed(), err)
+	if exists, err := readViperConfig(v); exists || err != nil {
+		return err
 	}

 	// 2. look for .<appname>/config.yaml (in the current directory)
 	v.AddConfigPath("." + internal.ApplicationName)
 	v.SetConfigName("config")
-	if err = v.ReadInConfig(); err == nil {
-		return nil
-	} else if !errors.As(err, &viper.ConfigFileNotFoundError{}) {
-		return fmt.Errorf("unable to parse config=%q: %w", v.ConfigFileUsed(), err)
+	if exists, err := readViperConfig(v); exists || err != nil {
+		return err
 	}

-	// 3. look for ~/.<appname>.yaml
+	if root := gitRepoRoot(); root != "" {
+		// 3. look for <git repo root>/.<appname>.yaml, where the repo root is defined by "git rev-parse --show-toplevel"
+		v.AddConfigPath(root)
+		v.SetConfigName("." + internal.ApplicationName)
+		if exists, err := readViperConfig(v); exists {
+			if err != nil {
+				return err
+			}
+			return os.Chdir(root)
+		}
+
+		// 4. look for <git repo root>/.<appname>/config.yaml, where the repo root is defined by "git rev-parse --show-toplevel"
+		v.AddConfigPath(filepath.Join(root, "."+internal.ApplicationName))
+		v.SetConfigName("config")
+		if exists, err := readViperConfig(v); exists {
+			if err != nil {
+				return err
+			}
+			return os.Chdir(root)
+		}
+	}
+
+	// 5. look for ~/.<appname>.yaml
 	home, err := homedir.Dir()
 	if err == nil {
 		v.AddConfigPath(home)
 		v.SetConfigName("." + internal.ApplicationName)
-		if err = v.ReadInConfig(); err == nil {
-			return nil
-		} else if !errors.As(err, &viper.ConfigFileNotFoundError{}) {
-			return fmt.Errorf("unable to parse config=%q: %w", v.ConfigFileUsed(), err)
+		if exists, err := readViperConfig(v); exists || err != nil {
+			return err
 		}
 	}

-	// 4. look for <appname>/config.yaml in xdg locations (starting with xdg home config dir, then moving upwards)
+	// 6. look for <appname>/config.yaml in xdg locations (starting with xdg home config dir, then moving upwards)
 	v.AddConfigPath(path.Join(xdg.ConfigHome, internal.ApplicationName))
 	for _, dir := range xdg.ConfigDirs {
 		v.AddConfigPath(path.Join(dir, internal.ApplicationName))
 	}
 	v.SetConfigName("config")
-	if err = v.ReadInConfig(); err == nil {
-		return nil
-	} else if !errors.As(err, &viper.ConfigFileNotFoundError{}) {
-		return fmt.Errorf("unable to parse config=%q: %w", v.ConfigFileUsed(), err)
+	if exists, err := readViperConfig(v); exists || err != nil {
+		return err
 	}

 	return ErrApplicationConfigNotFound
 }
+
+func readViperConfig(v *viper.Viper) (bool, error) {
+	err := v.ReadInConfig()
+	if err == nil {
+		return true, nil
+	} else if errors.As(err, &viper.ConfigFileNotFoundError{}) {
+		return false, nil
+	}
+	return true, fmt.Errorf("unable to parse config=%q: %w", v.ConfigFileUsed(), err)
+}
+
+func gitRepoRoot() string {
+	root, err := exec.Command("git", "rev-parse", "--show-toplevel").Output()
+	if err != nil {
+		return ""
+	}
+	absRepoRoot, err := filepath.Abs(strings.TrimSpace(string(root)))
+	if err != nil {
+		return ""
+	}
+	return absRepoRoot
+}
@@ -10,7 +10,7 @@ type fileClassification struct {
 }

 func (cfg fileClassification) loadDefaultValues(v *viper.Viper) {
-	v.SetDefault("file-classification.cataloger.enabled", true)
+	v.SetDefault("file-classification.cataloger.enabled", catalogerEnabledDefault)
 	v.SetDefault("file-classification.cataloger.scope", source.SquashedScope)
 }

@@ -13,7 +13,7 @@ type fileContents struct {
 }

 func (cfg fileContents) loadDefaultValues(v *viper.Viper) {
-	v.SetDefault("file-contents.cataloger.enabled", true)
+	v.SetDefault("file-contents.cataloger.enabled", catalogerEnabledDefault)
 	v.SetDefault("file-contents.cataloger.scope", source.SquashedScope)
 	v.SetDefault("file-contents.skip-files-above-size", 1*file.MB)
 	v.SetDefault("file-contents.globs", []string{})
@@ -11,7 +11,7 @@ type FileMetadata struct {
 }

 func (cfg FileMetadata) loadDefaultValues(v *viper.Viper) {
-	v.SetDefault("file-metadata.cataloger.enabled", true)
+	v.SetDefault("file-metadata.cataloger.enabled", catalogerEnabledDefault)
 	v.SetDefault("file-metadata.cataloger.scope", source.SquashedScope)
 	v.SetDefault("file-metadata.digests", []string{"sha256"})
 }
@@ -15,7 +15,7 @@ type secrets struct {
 }

 func (cfg secrets) loadDefaultValues(v *viper.Viper) {
-	v.SetDefault("secrets.cataloger.enabled", true)
+	v.SetDefault("secrets.cataloger.enabled", catalogerEnabledDefault)
 	v.SetDefault("secrets.cataloger.scope", source.AllLayersScope)
 	v.SetDefault("secrets.reveal-values", false)
 	v.SetDefault("secrets.skip-files-above-size", 1*file.MB)
@@ -6,5 +6,5 @@ const (

 	// JSONSchemaVersion is the current schema version output by the JSON presenter
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "1.1.0"
+	JSONSchemaVersion = "2.0.0"
 )
@@ -2,7 +2,7 @@ package spdxhelpers

 import "github.com/anchore/syft/syft/pkg"

-func Description(p *pkg.Package) string {
+func Description(p pkg.Package) string {
 	if hasMetadata(p) {
 		switch metadata := p.Metadata.(type) {
 		case pkg.ApkMetadata:
@@ -14,10 +14,6 @@ func Description(p *pkg.Package) string {
 	return ""
 }

-func packageExists(p *pkg.Package) bool {
-	return p != nil
-}
-
-func hasMetadata(p *pkg.Package) bool {
-	return packageExists(p) && p.Metadata != nil
+func hasMetadata(p pkg.Package) bool {
+	return p.Metadata != nil
 }
@@ -50,7 +50,7 @@ func Test_Description(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, Description(&test.input))
+			assert.Equal(t, test.expected, Description(test.input))
 		})
 	}
 }
@@ -2,7 +2,7 @@ package spdxhelpers

 import "github.com/anchore/syft/syft/pkg"

-func DownloadLocation(p *pkg.Package) string {
+func DownloadLocation(p pkg.Package) string {
 	// 3.7: Package Download Location
 	// Cardinality: mandatory, one
 	// NONE if there is no download location whatsoever.
@@ -48,7 +48,7 @@ func Test_DownloadLocation(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, DownloadLocation(&test.input))
+			assert.Equal(t, test.expected, DownloadLocation(test.input))
 		})
 	}
 }
@@ -6,13 +6,9 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 )

-func ExternalRefs(p *pkg.Package) (externalRefs []model.ExternalRef) {
+func ExternalRefs(p pkg.Package) (externalRefs []model.ExternalRef) {
 	externalRefs = make([]model.ExternalRef, 0)

-	if !packageExists(p) {
-		return externalRefs
-	}
-
 	for _, c := range p.CPEs {
 		externalRefs = append(externalRefs, model.ExternalRef{
 			ReferenceCategory: model.SecurityReferenceCategory,
@@ -39,7 +39,7 @@ func Test_ExternalRefs(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			assert.ElementsMatch(t, test.expected, ExternalRefs(&test.input))
+			assert.ElementsMatch(t, test.expected, ExternalRefs(test.input))
 		})
 	}
 }
@@ -1,51 +0,0 @@
-package spdxhelpers
-
-import (
-	"crypto/sha256"
-	"fmt"
-	"path/filepath"
-
-	"github.com/anchore/syft/internal/formats/spdx22json/model"
-	"github.com/anchore/syft/syft/pkg"
-)
-
-func Files(packageSpdxID string, p *pkg.Package) (files []model.File, fileIDs []string, relationships []model.Relationship) {
-	files = make([]model.File, 0)
-	fileIDs = make([]string, 0)
-	relationships = make([]model.Relationship, 0)
-
-	if !hasMetadata(p) {
-		return files, fileIDs, relationships
-	}
-
-	pkgFileOwner, ok := p.Metadata.(pkg.FileOwner)
-	if !ok {
-		return files, fileIDs, relationships
-	}
-
-	for _, ownedFilePath := range pkgFileOwner.OwnedFiles() {
-		baseFileName := filepath.Base(ownedFilePath)
-		pathHash := sha256.Sum256([]byte(ownedFilePath))
-		fileSpdxID := model.ElementID(fmt.Sprintf("File-%s-%x", p.Name, pathHash)).String()
-
-		fileIDs = append(fileIDs, fileSpdxID)
-
-		files = append(files, model.File{
-			FileName: ownedFilePath,
-			Item: model.Item{
-				Element: model.Element{
-					SPDXID: fileSpdxID,
-					Name:   baseFileName,
-				},
-			},
-		})
-
-		relationships = append(relationships, model.Relationship{
-			SpdxElementID:      packageSpdxID,
-			RelationshipType:   model.ContainsRelationship,
-			RelatedSpdxElement: fileSpdxID,
-		})
-	}
-
-	return files, fileIDs, relationships
-}
@@ -2,7 +2,7 @@ package spdxhelpers

 import "github.com/anchore/syft/syft/pkg"

-func Homepage(p *pkg.Package) string {
+func Homepage(p pkg.Package) string {
 	if hasMetadata(p) {
 		switch metadata := p.Metadata.(type) {
 		case pkg.GemMetadata:
@@ -50,7 +50,7 @@ func Test_Homepage(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, Homepage(&test.input))
+			assert.Equal(t, test.expected, Homepage(test.input))
 		})
 	}
 }
@@ -7,7 +7,7 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 )

-func License(p *pkg.Package) string {
+func License(p pkg.Package) string {
 	// source: https://spdx.github.io/spdx-spec/3-package-information/#313-concluded-license
 	// The options to populate this field are limited to:
 	// A valid SPDX License Expression as defined in Appendix IV;
@@ -17,7 +17,7 @@ func License(p *pkg.Package) string {
 	//   (ii) the SPDX file creator has made no attempt to determine this field; or
 	//   (iii) the SPDX file creator has intentionally provided no information (no meaning should be implied by doing so).

-	if !packageExists(p) || len(p.Licenses) == 0 {
+	if len(p.Licenses) == 0 {
 		return "NONE"
 	}

@@ -67,7 +67,7 @@ func Test_License(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, License(&test.input))
+			assert.Equal(t, test.expected, License(test.input))
 		})
 	}
 }
@@ -108,7 +108,7 @@ func Test_Originator(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, Originator(&test.input))
+			assert.Equal(t, test.expected, Originator(test.input))
 		})
 	}
 }
@@ -6,7 +6,7 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 )

-func Originator(p *pkg.Package) string {
+func Originator(p pkg.Package) string {
 	if hasMetadata(p) {
 		switch metadata := p.Metadata.(type) {
 		case pkg.ApkMetadata:
@@ -6,11 +6,7 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 )

-func SourceInfo(p *pkg.Package) string {
-	if !packageExists(p) {
-		return ""
-	}
-
+func SourceInfo(p pkg.Package) string {
 	answer := ""
 	switch p.Type {
 	case pkg.RpmPkg:
@@ -31,6 +27,8 @@ func SourceInfo(p *pkg.Package) string {
 		answer = "acquired package info from go module information"
 	case pkg.RustPkg:
 		answer = "acquired package info from rust cargo manifest"
+	case pkg.PhpComposerPkg:
+		answer = "acquired package info from PHP composer manifest"
 	default:
 		answer = "acquired package info from the following paths"
 	}
@@ -19,14 +19,8 @@ func Test_SourceInfo(t *testing.T) {
 			input: pkg.Package{
 				// note: no type given
 				Locations: []source.Location{
-					{
-						RealPath:    "/a-place",
-						VirtualPath: "/b-place",
-					},
-					{
-						RealPath:    "/c-place",
-						VirtualPath: "/d-place",
-					},
+					source.NewVirtualLocation("/a-place", "/b-place"),
+					source.NewVirtualLocation("/c-place", "/d-place"),
 				},
 			},
 			expected: []string{
@@ -124,6 +118,14 @@ func Test_SourceInfo(t *testing.T) {
 				"from rust cargo manifest",
 			},
 		},
+		{
+			input: pkg.Package{
+				Type: pkg.PhpComposerPkg,
+			},
+			expected: []string{
+				"from PHP composer manifest",
+			},
+		},
 	}
 	var pkgTypes []pkg.Type
 	for _, test := range tests {
@@ -131,7 +133,7 @@ func Test_SourceInfo(t *testing.T) {
 			if test.input.Type != "" {
 				pkgTypes = append(pkgTypes, test.input.Type)
 			}
-			actual := SourceInfo(&test.input)
+			actual := SourceInfo(test.input)
 			for _, expected := range test.expected {
 				assert.Contains(t, actual, expected)
 			}
@@ -4,13 +4,14 @@ import (
 	"bytes"
 	"testing"

+	"github.com/anchore/go-presenter"
 	"github.com/anchore/go-testutils"
 	"github.com/anchore/stereoscope/pkg/filetree"
 	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/stereoscope/pkg/imagetest"
 	"github.com/anchore/syft/syft/distro"
 	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/presenter"
+	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 	"github.com/sergi/go-diff/diffmatchpatch"
 	"github.com/stretchr/testify/assert"
@@ -90,7 +91,7 @@ func AssertPresenterAgainstGoldenSnapshot(t *testing.T, pres presenter.Presenter
 	}
 }

-func ImageInput(t testing.TB, testImage string, options ...ImageOption) (*pkg.Catalog, source.Metadata, *distro.Distro) {
+func ImageInput(t testing.TB, testImage string, options ...ImageOption) sbom.SBOM {
 	t.Helper()
 	catalog := pkg.NewCatalog()
 	var cfg imageCfg
@@ -117,7 +118,22 @@ func ImageInput(t testing.TB, testImage string, options ...ImageOption) (*pkg.Ca
 	dist, err := distro.NewDistro(distro.Debian, "1.2.3", "like!")
 	assert.NoError(t, err)

-	return catalog, src.Metadata, &dist
+	return sbom.SBOM{
+		Artifacts: sbom.Artifacts{
+			PackageCatalog: catalog,
+			Distro:         &dist,
+		},
+		Source: src.Metadata,
+		Descriptor: sbom.Descriptor{
+			Name:    "syft",
+			Version: "v0.42.0-bogus",
+			// the application configuration should be persisted here, however, we do not want to import
+			// the application configuration in this package (it's reserved only for ingestion by the cmd package)
+			Configuration: map[string]string{
+				"config-key": "config-value",
+			},
+		},
+	}
 }

 func populateImageCatalog(catalog *pkg.Catalog, img *image.Image) {
@@ -126,7 +142,6 @@ func populateImageCatalog(catalog *pkg.Catalog, img *image.Image) {

 	// populate catalog with test data
 	catalog.Add(pkg.Package{
-		ID:      "package-1-id",
 		Name:    "package-1",
 		Version: "1.0.1",
 		Locations: []source.Location{
@@ -147,7 +162,6 @@ func populateImageCatalog(catalog *pkg.Catalog, img *image.Image) {
 		},
 	})
 	catalog.Add(pkg.Package{
-		ID:      "package-2-id",
 		Name:    "package-2",
 		Version: "2.0.1",
 		Locations: []source.Location{
@@ -167,7 +181,7 @@ func populateImageCatalog(catalog *pkg.Catalog, img *image.Image) {
 	})
 }

-func DirectoryInput(t testing.TB) (*pkg.Catalog, source.Metadata, *distro.Distro) {
+func DirectoryInput(t testing.TB) sbom.SBOM {
 	catalog := newDirectoryCatalog()

 	dist, err := distro.NewDistro(distro.Debian, "1.2.3", "like!")
@@ -176,7 +190,22 @@ func DirectoryInput(t testing.TB) (*pkg.Catalog, source.Metadata, *distro.Distro
 	src, err := source.NewFromDirectory("/some/path")
 	assert.NoError(t, err)

-	return catalog, src.Metadata, &dist
+	return sbom.SBOM{
+		Artifacts: sbom.Artifacts{
+			PackageCatalog: catalog,
+			Distro:         &dist,
+		},
+		Source: src.Metadata,
+		Descriptor: sbom.Descriptor{
+			Name:    "syft",
+			Version: "v0.42.0-bogus",
+			// the application configuration should be persisted here, however, we do not want to import
+			// the application configuration in this package (it's reserved only for ingestion by the cmd package)
+			Configuration: map[string]string{
+				"config-key": "config-value",
+			},
+		},
+	}
 }

 func newDirectoryCatalog() *pkg.Catalog {
@@ -184,13 +213,12 @@ func newDirectoryCatalog() *pkg.Catalog {

 	// populate catalog with test data
 	catalog.Add(pkg.Package{
-		ID:      "package-1-id",
 		Name:    "package-1",
 		Version: "1.0.1",
 		Type:    pkg.PythonPkg,
 		FoundBy: "the-cataloger-1",
 		Locations: []source.Location{
-			{RealPath: "/some/path/pkg1"},
+			source.NewLocation("/some/path/pkg1"),
 		},
 		Language:     pkg.Python,
 		MetadataType: pkg.PythonPackageMetadataType,
@@ -210,13 +238,12 @@ func newDirectoryCatalog() *pkg.Catalog {
 		},
 	})
 	catalog.Add(pkg.Package{
-		ID:      "package-2-id",
 		Name:    "package-2",
 		Version: "2.0.1",
 		Type:    pkg.DebPkg,
 		FoundBy: "the-cataloger-2",
 		Locations: []source.Location{
-			{RealPath: "/some/path/pkg1"},
+			source.NewLocation("/some/path/pkg1"),
 		},
 		MetadataType: pkg.DpkgMetadataType,
 		Metadata: pkg.DpkgMetadata{
@@ -4,13 +4,10 @@ import (
 	"encoding/xml"
 	"io"

-	"github.com/anchore/syft/syft/distro"
-
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
+	"github.com/anchore/syft/syft/sbom"
 )

-func encoder(output io.Writer, catalog *pkg.Catalog, srcMetadata *source.Metadata, d *distro.Distro, scope source.Scope) error {
+func encoder(output io.Writer, s sbom.SBOM) error {
 	enc := xml.NewEncoder(output)
 	enc.Indent("", "  ")

@@ -19,7 +16,7 @@ func encoder(output io.Writer, catalog *pkg.Catalog, srcMetadata *source.Metadat
 		return err
 	}

-	err = enc.Encode(toFormatModel(catalog, srcMetadata, d, scope))
+	err = enc.Encode(toFormatModel(s))
 	if err != nil {
 		return err
 	}
@@ -5,17 +5,14 @@ import (
 	"regexp"
 	"testing"

-	"github.com/anchore/syft/syft/source"
-
 	"github.com/anchore/syft/internal/formats/common/testutils"
 )

 var updateCycloneDx = flag.Bool("update-cyclonedx", false, "update the *.golden files for cyclone-dx presenters")

 func TestCycloneDxDirectoryPresenter(t *testing.T) {
-	catalog, metadata, _ := testutils.DirectoryInput(t)
 	testutils.AssertPresenterAgainstGoldenSnapshot(t,
-		Format().Presenter(catalog, &metadata, nil, source.SquashedScope),
+		Format().Presenter(testutils.DirectoryInput(t)),
 		*updateCycloneDx,
 		cycloneDxRedactor,
 	)
@@ -23,9 +20,8 @@ func TestCycloneDxDirectoryPresenter(t *testing.T) {

 func TestCycloneDxImagePresenter(t *testing.T) {
 	testImage := "image-simple"
-	catalog, metadata, _ := testutils.ImageInput(t, testImage)
 	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
-		Format().Presenter(catalog, &metadata, nil, source.SquashedScope),
+		Format().Presenter(testutils.ImageInput(t, testImage)),
 		testImage,
 		*updateCycloneDx,
 		cycloneDxRedactor,
@@ -4,35 +4,36 @@ import (
 	"encoding/xml"
 	"time"

+	"github.com/anchore/syft/syft/sbom"
+
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/formats/cyclonedx12xml/model"
 	"github.com/anchore/syft/internal/version"
-	"github.com/anchore/syft/syft/distro"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
 	"github.com/google/uuid"
 )

 // toFormatModel creates and populates a new in-memory representation of a CycloneDX 1.2 document
-func toFormatModel(catalog *pkg.Catalog, srcMetadata *source.Metadata, _ *distro.Distro, _ source.Scope) model.Document {
+func toFormatModel(s sbom.SBOM) model.Document {
 	versionInfo := version.FromBuild()

 	doc := model.Document{
 		XMLNs:         "http://cyclonedx.org/schema/bom/1.2",
 		Version:       1,
 		SerialNumber:  uuid.New().URN(),
-		BomDescriptor: toBomDescriptor(internal.ApplicationName, versionInfo.Version, srcMetadata),
+		BomDescriptor: toBomDescriptor(internal.ApplicationName, versionInfo.Version, s.Source),
 	}

 	// attach components
-	for _, p := range catalog.Sorted() {
+	for _, p := range s.Artifacts.PackageCatalog.Sorted() {
 		doc.Components = append(doc.Components, toComponent(p))
 	}

 	return doc
 }

-func toComponent(p *pkg.Package) model.Component {
+func toComponent(p pkg.Package) model.Component {
 	return model.Component{
 		Type:       "library", // TODO: this is not accurate
 		Name:       p.Name,
@@ -43,7 +44,7 @@ func toComponent(p *pkg.Package) model.Component {
 }

 // NewBomDescriptor returns a new BomDescriptor tailored for the current time and "syft" tool details.
-func toBomDescriptor(name, version string, srcMetadata *source.Metadata) *model.BomDescriptor {
+func toBomDescriptor(name, version string, srcMetadata source.Metadata) *model.BomDescriptor {
 	return &model.BomDescriptor{
 		XMLName:   xml.Name{},
 		Timestamp: time.Now().Format(time.RFC3339),
@@ -58,10 +59,7 @@ func toBomDescriptor(name, version string, srcMetadata *source.Metadata) *model.
 	}
 }

-func toBomDescriptorComponent(srcMetadata *source.Metadata) *model.BomDescriptorComponent {
-	if srcMetadata == nil {
-		return nil
-	}
+func toBomDescriptorComponent(srcMetadata source.Metadata) *model.BomDescriptorComponent {
 	switch srcMetadata.Scheme {
 	case source.ImageScheme:
 		return &model.BomDescriptorComponent{
@@ -5,6 +5,7 @@ import (

 	"github.com/anchore/syft/internal/formats/cyclonedx12xml"
 	"github.com/anchore/syft/internal/formats/spdx22json"
+	"github.com/anchore/syft/internal/formats/spdx22tagvalue"
 	"github.com/anchore/syft/internal/formats/syftjson"
 	"github.com/anchore/syft/internal/formats/table"
 	"github.com/anchore/syft/internal/formats/text"
@@ -18,6 +19,7 @@ func All() []format.Format {
 		table.Format(),
 		cyclonedx12xml.Format(),
 		spdx22json.Format(),
+		spdx22tagvalue.Format(),
 		text.Format(),
 	}
 }
@@ -4,16 +4,13 @@ import (
 	"encoding/json"
 	"io"

-	"github.com/anchore/syft/syft/distro"
-
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
+	"github.com/anchore/syft/syft/sbom"
 )

 const anchoreNamespace = "https://anchore.com/syft"

-func encoder(output io.Writer, catalog *pkg.Catalog, srcMetadata *source.Metadata, d *distro.Distro, scope source.Scope) error {
-	doc := toFormatModel(catalog, srcMetadata, d, scope)
+func encoder(output io.Writer, s sbom.SBOM) error {
+	doc := toFormatModel(s)

 	enc := json.NewEncoder(output)
 	// prevent > and < from being escaped in the payload
@@ -5,18 +5,14 @@ import (
 	"regexp"
 	"testing"

-	"github.com/anchore/syft/syft/source"
-
 	"github.com/anchore/syft/internal/formats/common/testutils"
-	"github.com/anchore/syft/syft/format"
 )

 var updateSpdxJson = flag.Bool("update-spdx-json", false, "update the *.golden files for spdx-json presenters")

 func TestSPDXJSONDirectoryPresenter(t *testing.T) {
-	catalog, metadata, distro := testutils.DirectoryInput(t)
 	testutils.AssertPresenterAgainstGoldenSnapshot(t,
-		format.NewPresenter(encoder, catalog, &metadata, distro, source.UnknownScope),
+		Format().Presenter(testutils.DirectoryInput(t)),
 		*updateSpdxJson,
 		spdxJsonRedactor,
 	)
@@ -24,9 +20,8 @@ func TestSPDXJSONDirectoryPresenter(t *testing.T) {

 func TestSPDXJSONImagePresenter(t *testing.T) {
 	testImage := "image-simple"
-	catalog, metadata, distro := testutils.ImageInput(t, testImage, testutils.FromSnapshot())
 	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
-		format.NewPresenter(encoder, catalog, &metadata, distro, source.SquashedScope),
+		Format().Presenter(testutils.ImageInput(t, testImage, testutils.FromSnapshot())),
 		testImage,
 		*updateSpdxJson,
 		spdxJsonRedactor,
@@ -1,7 +1,5 @@
 package model

-import "github.com/anchore/syft/syft/source"
-
 // derived from:
 // - https://spdx.github.io/spdx-spec/appendix-III-RDF-data-model-implementation-and-identifier-syntax/
 // - https://github.com/spdx/spdx-spec/blob/v2.2/schemas/spdx-schema.json
@@ -13,8 +11,6 @@ type Document struct {
 	// One instance is required for each SPDX file produced. It provides the necessary information for forward
 	// and backward compatibility for processing tools.
 	CreationInfo CreationInfo `json:"creationInfo"`
-	// SyftSourceData contains information about what is being described in this SPDX document (e.g. a container image, a directory, etc)
-	SyftSourceData *source.Metadata `json:"syftSourceData,omitempty"`
 	// 2.2: Data License; should be "CC0-1.0"
 	// Cardinality: mandatory, one
 	// License expression for dataLicense.  Compliance with the SPDX specification includes populating the SPDX
@@ -3,17 +3,17 @@ package model
 type FileType string

 const (
-	DocumentationFileType FileType = "DOCUMENTATION"
-	ImageFileType         FileType = "IMAGE"
-	VideoFileType         FileType = "VIDEO"
-	ArchiveFileType       FileType = "ARCHIVE"
-	SpdxFileType          FileType = "SPDX"
-	ApplicationFileType   FileType = "APPLICATION"
-	SourceFileType        FileType = "SOURCE"
-	BinaryFileType        FileType = "BINARY"
-	TextFileType          FileType = "TEXT"
-	AudioFileType         FileType = "AUDIO"
-	OtherFileType         FileType = "OTHER"
+	DocumentationFileType FileType = "DOCUMENTATION" // if the file serves as documentation
+	ImageFileType         FileType = "IMAGE"         // if the file is associated with a picture image file (MIME type of image/*, e.g., .jpg, .gif)
+	VideoFileType         FileType = "VIDEO"         // if the file is associated with a video file type (MIME type of video/*)
+	ArchiveFileType       FileType = "ARCHIVE"       // if the file represents an archive (.tar, .jar, etc.)
+	SpdxFileType          FileType = "SPDX"          // if the file is an SPDX document
+	ApplicationFileType   FileType = "APPLICATION"   // if the file is associated with a specific application type (MIME type of application/*)
+	SourceFileType        FileType = "SOURCE"        // if the file is human readable source code (.c, .html, etc.)
+	BinaryFileType        FileType = "BINARY"        // if the file is a compiled object, target image or binary executable (.o, .a, etc.)
+	TextFileType          FileType = "TEXT"          // if the file is human readable text file (MIME type of text/*)
+	AudioFileType         FileType = "AUDIO"         // if the file is associated with an audio file (MIME type of audio/* , e.g. .mp3)
+	OtherFileType         FileType = "OTHER"         // if the file doesn't fit into the above categories (generated artifacts, data files, etc.)
 )

 type File struct {
@@ -36,6 +36,6 @@ type File struct {
 	// Indicates the project in which the SpdxElement originated. Tools must preserve doap:homepage and doap:name
 	// properties and the URI (if one is known) of doap:Project resources that are values of this property. All other
 	// properties of doap:Projects are not directly supported by SPDX and may be dropped when translating to or
-	// from some SPDX formats(deprecated).
+	// from some SPDX formats (deprecated).
 	ArtifactOf []string `json:"artifactOf,omitempty"`
 }
@@ -3,34 +3,18 @@
 "name": "/some/path",
 "spdxVersion": "SPDX-2.2",
 "creationInfo": {
-  "created": "2021-10-22T19:25:38.33537Z",
+  "created": "2021-11-17T19:35:54.834877Z",
  "creators": [
   "Organization: Anchore, Inc",
   "Tool: syft-[not provided]"
  ],
-  "licenseListVersion": "3.14"
- },
- "syftSourceData": {
-  "Scheme": "DirectoryScheme",
-  "ImageMetadata": {
-   "userInput": "",
-   "imageID": "",
-   "manifestDigest": "",
-   "mediaType": "",
-   "tags": null,
-   "imageSize": 0,
-   "layers": null,
-   "manifest": null,
-   "config": null,
-   "repoDigests": null
-  },
-  "Path": "/some/path"
+  "licenseListVersion": "3.15"
 },
 "dataLicense": "CC0-1.0",
- "documentNamespace": "https:/anchore.com/syft/dir/some/path-a868c45f-e62b-473f-9dd3-b72994be6294",
+ "documentNamespace": "https:/anchore.com/syft/dir/some/path-65e2226e-a61e-4ed1-81bb-56022e1ff1eb",
 "packages": [
  {
-   "SPDXID": "SPDXRef-Package-python-package-1-1.0.1",
+   "SPDXID": "SPDXRef-2a115ac97d018a0e",
   "name": "package-1",
   "licenseConcluded": "MIT",
   "downloadLocation": "NOASSERTION",
@@ -47,15 +31,12 @@
    }
   ],
   "filesAnalyzed": false,
-   "hasFiles": [
-    "SPDXRef-File-package-1-efae7fecc76ca25da40f79d7ef5b8933510434914835832c7976f3e866aa756a"
-   ],
   "licenseDeclared": "MIT",
   "sourceInfo": "acquired package info from installed python package manifest file: /some/path/pkg1",
   "versionInfo": "1.0.1"
  },
  {
-   "SPDXID": "SPDXRef-Package-deb-package-2-2.0.1",
+   "SPDXID": "SPDXRef-5e920b2bece2c3ae",
   "name": "package-2",
   "licenseConcluded": "NONE",
   "downloadLocation": "NOASSERTION",
@@ -76,20 +57,5 @@
   "sourceInfo": "acquired package info from DPKG DB: /some/path/pkg1",
   "versionInfo": "2.0.1"
  }
- ],
- "files": [
-  {
-   "SPDXID": "SPDXRef-File-package-1-efae7fecc76ca25da40f79d7ef5b8933510434914835832c7976f3e866aa756a",
-   "name": "foo",
-   "licenseConcluded": "",
-   "fileName": "/some/path/pkg1/dependencies/foo"
-  }
- ],
- "relationships": [
-  {
-   "spdxElementId": "SPDXRef-Package-python-package-1-1.0.1",
-   "relationshipType": "CONTAINS",
-   "relatedSpdxElement": "SPDXRef-File-package-1-efae7fecc76ca25da40f79d7ef5b8933510434914835832c7976f3e866aa756a"
-  }
 ]
 }
@@ -3,47 +3,18 @@
 "name": "user-image-input",
 "spdxVersion": "SPDX-2.2",
 "creationInfo": {
-  "created": "2021-10-22T19:25:38.341582Z",
+  "created": "2021-11-17T19:35:57.761372Z",
  "creators": [
   "Organization: Anchore, Inc",
   "Tool: syft-[not provided]"
  ],
-  "licenseListVersion": "3.14"
- },
- "syftSourceData": {
-  "Scheme": "ImageScheme",
-  "ImageMetadata": {
-   "userInput": "user-image-input",
-   "imageID": "sha256:2480160b55bec40c44d3b145c7b2c1c47160db8575c3dcae086d76b9370ae7ca",
-   "manifestDigest": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368",
-   "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
-   "tags": [
-    "stereoscope-fixture-image-simple:85066c51088bdd274f7a89e99e00490f666c49e72ffc955707cd6e18f0e22c5b"
-   ],
-   "imageSize": 38,
-   "layers": [
-    {
-     "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59",
-     "size": 22
-    },
-    {
-     "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec",
-     "size": 16
-    }
-   ],
-   "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NjcsImRpZ2VzdCI6InNoYTI1NjoyNDgwMTYwYjU1YmVjNDBjNDRkM2IxNDVjN2IyYzFjNDcxNjBkYjg1NzVjM2RjYWUwODZkNzZiOTM3MGFlN2NhIn0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1NjpmYjZiZWVjYjc1YjM5ZjRiYjgxM2RiZjE3N2U1MDFlZGQ1ZGRiM2U2OWJiNDVjZWRlYjc4YzY3NmVlMWI3YTU5In0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2OjMxOWI1ODhjZTY0MjUzYTg3YjUzM2M4ZWQwMWNmMDAyNWUwZWFjOThlN2I1MTZlMTI1MzI5NTdlMTI0NGZkZWMifV19",
-   "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8iLCJPbkJ1aWxkIjpudWxsfSwiY3JlYXRlZCI6IjIwMjEtMTAtMDRUMTE6NDA6MDAuNjM4Mzk0NVoiLCJoaXN0b3J5IjpbeyJjcmVhdGVkIjoiMjAyMS0xMC0wNFQxMTo0MDowMC41OTA3MzE2WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0xLnR4dCAvc29tZWZpbGUtMS50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn0seyJjcmVhdGVkIjoiMjAyMS0xMC0wNFQxMTo0MDowMC42MzgzOTQ1WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0yLnR4dCAvc29tZWZpbGUtMi50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6ZmI2YmVlY2I3NWIzOWY0YmI4MTNkYmYxNzdlNTAxZWRkNWRkYjNlNjliYjQ1Y2VkZWI3OGM2NzZlZTFiN2E1OSIsInNoYTI1NjozMTliNTg4Y2U2NDI1M2E4N2I1MzNjOGVkMDFjZjAwMjVlMGVhYzk4ZTdiNTE2ZTEyNTMyOTU3ZTEyNDRmZGVjIl19fQ==",
-   "repoDigests": []
-  },
-  "Path": ""
+  "licenseListVersion": "3.15"
 },
 "dataLicense": "CC0-1.0",
- "documentNamespace": "https:/anchore.com/syft/image/user-image-input-7c996682-9cdf-45cd-b70b-e771d740c9ed",
+ "documentNamespace": "https:/anchore.com/syft/image/user-image-input-5383918f-ec96-4aa9-b756-ad16e1ada31e",
 "packages": [
  {
-   "SPDXID": "SPDXRef-Package-python-package-1-1.0.1",
+   "SPDXID": "SPDXRef-888661d4f0362f02",
   "name": "package-1",
   "licenseConcluded": "MIT",
   "downloadLocation": "NOASSERTION",
@@ -65,7 +36,7 @@
   "versionInfo": "1.0.1"
  },
  {
-   "SPDXID": "SPDXRef-Package-deb-package-2-2.0.1",
+   "SPDXID": "SPDXRef-4068ff5e8926b305",
   "name": "package-2",
   "licenseConcluded": "NONE",
   "downloadLocation": "NOASSERTION",
@@ -3,25 +3,28 @@ package spdx22json
 import (
 	"fmt"
 	"path"
+	"path/filepath"
+	"sort"
 	"strings"
 	"time"

-	"github.com/anchore/syft/syft/distro"
-
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/formats/common/spdxhelpers"
 	"github.com/anchore/syft/internal/formats/spdx22json/model"
+	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/spdxlicense"
 	"github.com/anchore/syft/internal/version"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 	"github.com/google/uuid"
 )

 // toFormatModel creates and populates a new JSON document struct that follows the SPDX 2.2 spec from the given cataloging results.
-func toFormatModel(catalog *pkg.Catalog, srcMetadata *source.Metadata, _ *distro.Distro, _ source.Scope) model.Document {
-	name := documentName(srcMetadata)
-	packages, files, relationships := extractFromCatalog(catalog)
+func toFormatModel(s sbom.SBOM) model.Document {
+	name := documentName(s.Source)

 	return model.Document{
 		Element: model.Element{
@@ -39,88 +42,25 @@ func toFormatModel(catalog *pkg.Catalog, srcMetadata *source.Metadata, _ *distro
 			LicenseListVersion: spdxlicense.Version,
 		},
 		DataLicense:       "CC0-1.0",
-		DocumentNamespace: documentNamespace(name, srcMetadata),
-		Packages:          packages,
-		Files:             files,
-		Relationships:     relationships,
-		// TODO: add scope
-		SyftSourceData: srcMetadata,
+		DocumentNamespace: documentNamespace(name, s.Source),
+		Packages:          toPackages(s.Artifacts.PackageCatalog, s.Relationships),
+		Files:             toFiles(s),
+		Relationships:     toRelationships(s.Relationships),
 	}
 }

-func documentName(srcMetadata *source.Metadata) string {
-	if srcMetadata != nil {
-		switch srcMetadata.Scheme {
-		case source.ImageScheme:
-			return cleanSPDXName(srcMetadata.ImageMetadata.UserInput)
-		case source.DirectoryScheme:
-			return cleanSPDXName(srcMetadata.Path)
-		}
+func documentName(srcMetadata source.Metadata) string {
+	switch srcMetadata.Scheme {
+	case source.ImageScheme:
+		return cleanSPDXName(srcMetadata.ImageMetadata.UserInput)
+	case source.DirectoryScheme:
+		return cleanSPDXName(srcMetadata.Path)
 	}
+
 	// TODO: is this alright?
 	return uuid.Must(uuid.NewRandom()).String()
 }

-func documentNamespace(name string, srcMetadata *source.Metadata) string {
-	input := "unknown-source-type"
-	if srcMetadata != nil {
-		switch srcMetadata.Scheme {
-		case source.ImageScheme:
-			input = "image"
-		case source.DirectoryScheme:
-			input = "dir"
-		}
-	}
-
-	uniqueID := uuid.Must(uuid.NewRandom())
-	identifier := path.Join(input, uniqueID.String())
-	if name != "." {
-		identifier = path.Join(input, fmt.Sprintf("%s-%s", name, uniqueID.String()))
-	}
-
-	return path.Join(anchoreNamespace, identifier)
-}
-
-func extractFromCatalog(catalog *pkg.Catalog) ([]model.Package, []model.File, []model.Relationship) {
-	packages := make([]model.Package, 0)
-	relationships := make([]model.Relationship, 0)
-	files := make([]model.File, 0)
-
-	for _, p := range catalog.Sorted() {
-		license := spdxhelpers.License(p)
-		packageSpdxID := model.ElementID(fmt.Sprintf("Package-%+v-%s-%s", p.Type, p.Name, p.Version)).String()
-
-		packageFiles, fileIDs, packageFileRelationships := spdxhelpers.Files(packageSpdxID, p)
-		files = append(files, packageFiles...)
-
-		relationships = append(relationships, packageFileRelationships...)
-
-		// note: the license concluded and declared should be the same since we are collecting license information
-		// from the project data itself (the installed package files).
-		packages = append(packages, model.Package{
-			Description:      spdxhelpers.Description(p),
-			DownloadLocation: spdxhelpers.DownloadLocation(p),
-			ExternalRefs:     spdxhelpers.ExternalRefs(p),
-			FilesAnalyzed:    false,
-			HasFiles:         fileIDs,
-			Homepage:         spdxhelpers.Homepage(p),
-			LicenseDeclared:  license, // The Declared License is what the authors of a project believe govern the package
-			Originator:       spdxhelpers.Originator(p),
-			SourceInfo:       spdxhelpers.SourceInfo(p),
-			VersionInfo:      p.Version,
-			Item: model.Item{
-				LicenseConcluded: license, // The Concluded License field is the license the SPDX file creator believes governs the package
-				Element: model.Element{
-					SPDXID: packageSpdxID,
-					Name:   p.Name,
-				},
-			},
-		})
-	}
-
-	return packages, files, relationships
-}
-
 func cleanSPDXName(name string) string {
 	// remove # according to specification
 	name = strings.ReplaceAll(name, "#", "-")
@@ -131,3 +71,196 @@ func cleanSPDXName(name string) string {
 	// clean relative pathing
 	return path.Clean(name)
 }
+
+func documentNamespace(name string, srcMetadata source.Metadata) string {
+	input := "unknown-source-type"
+	switch srcMetadata.Scheme {
+	case source.ImageScheme:
+		input = "image"
+	case source.DirectoryScheme:
+		input = "dir"
+	}
+
+	uniqueID := uuid.Must(uuid.NewRandom())
+	identifier := path.Join(input, uniqueID.String())
+	if name != "." {
+		identifier = path.Join(input, fmt.Sprintf("%s-%s", name, uniqueID.String()))
+	}
+
+	return path.Join(anchoreNamespace, identifier)
+}
+
+func toPackages(catalog *pkg.Catalog, relationships []artifact.Relationship) []model.Package {
+	packages := make([]model.Package, 0)
+
+	for _, p := range catalog.Sorted() {
+		license := spdxhelpers.License(p)
+		packageSpdxID := model.ElementID(p.ID()).String()
+
+		// note: the license concluded and declared should be the same since we are collecting license information
+		// from the project data itself (the installed package files).
+		packages = append(packages, model.Package{
+			Description:      spdxhelpers.Description(p),
+			DownloadLocation: spdxhelpers.DownloadLocation(p),
+			ExternalRefs:     spdxhelpers.ExternalRefs(p),
+			FilesAnalyzed:    false,
+			HasFiles:         fileIDsForPackage(packageSpdxID, relationships),
+			Homepage:         spdxhelpers.Homepage(p),
+			// The Declared License is what the authors of a project believe govern the package
+			LicenseDeclared: license,
+			Originator:      spdxhelpers.Originator(p),
+			SourceInfo:      spdxhelpers.SourceInfo(p),
+			VersionInfo:     p.Version,
+			Item: model.Item{
+				// The Concluded License field is the license the SPDX file creator believes governs the package
+				LicenseConcluded: license,
+				Element: model.Element{
+					SPDXID: packageSpdxID,
+					Name:   p.Name,
+				},
+			},
+		})
+	}
+
+	return packages
+}
+
+func fileIDsForPackage(packageSpdxID string, relationships []artifact.Relationship) (fileIDs []string) {
+	for _, relationship := range relationships {
+		if relationship.Type != artifact.ContainsRelationship {
+			continue
+		}
+
+		if _, ok := relationship.From.(pkg.Package); !ok {
+			continue
+		}
+
+		if _, ok := relationship.To.(source.Coordinates); !ok {
+			continue
+		}
+
+		if string(relationship.From.ID()) == packageSpdxID {
+			fileIDs = append(fileIDs, string(relationship.To.ID()))
+		}
+	}
+	return fileIDs
+}
+
+func toFiles(s sbom.SBOM) []model.File {
+	results := make([]model.File, 0)
+	artifacts := s.Artifacts
+
+	for _, coordinates := range sbom.AllCoordinates(s) {
+		var metadata *source.FileMetadata
+		if metadataForLocation, exists := artifacts.FileMetadata[coordinates]; exists {
+			metadata = &metadataForLocation
+		}
+
+		var digests []file.Digest
+		if digestsForLocation, exists := artifacts.FileDigests[coordinates]; exists {
+			digests = digestsForLocation
+		}
+
+		// TODO: add file classifications (?) and content as a snippet
+
+		var comment string
+		if coordinates.FileSystemID != "" {
+			comment = fmt.Sprintf("layerID: %s", coordinates.FileSystemID)
+		}
+
+		results = append(results, model.File{
+			Item: model.Item{
+				Element: model.Element{
+					SPDXID:  string(coordinates.ID()),
+					Name:    filepath.Base(coordinates.RealPath),
+					Comment: comment,
+				},
+				// required, no attempt made to determine license information
+				LicenseConcluded: "NOASSERTION",
+			},
+			Checksums: toFileChecksums(digests),
+			FileName:  coordinates.RealPath,
+			FileTypes: toFileTypes(metadata),
+		})
+	}
+
+	// sort by real path then virtual path to ensure the result is stable across multiple runs
+	sort.SliceStable(results, func(i, j int) bool {
+		return results[i].FileName < results[j].FileName
+	})
+	return results
+}
+
+func toFileChecksums(digests []file.Digest) (checksums []model.Checksum) {
+	for _, digest := range digests {
+		checksums = append(checksums, model.Checksum{
+			Algorithm:     digest.Algorithm,
+			ChecksumValue: digest.Value,
+		})
+	}
+	return checksums
+}
+
+func toFileTypes(metadata *source.FileMetadata) (ty []string) {
+	if metadata == nil {
+		return nil
+	}
+
+	mimeTypePrefix := strings.Split(metadata.MIMEType, "/")[0]
+	switch mimeTypePrefix {
+	case "image":
+		ty = append(ty, string(model.ImageFileType))
+	case "video":
+		ty = append(ty, string(model.VideoFileType))
+	case "application":
+		ty = append(ty, string(model.ApplicationFileType))
+	case "text":
+		ty = append(ty, string(model.TextFileType))
+	case "audio":
+		ty = append(ty, string(model.AudioFileType))
+	}
+
+	if internal.IsExecutable(metadata.MIMEType) {
+		ty = append(ty, string(model.BinaryFileType))
+	}
+
+	if internal.IsArchive(metadata.MIMEType) {
+		ty = append(ty, string(model.ArchiveFileType))
+	}
+
+	// TODO: add support for source, spdx, and documentation file types
+	if len(ty) == 0 {
+		ty = append(ty, string(model.OtherFileType))
+	}
+
+	return ty
+}
+
+func toRelationships(relationships []artifact.Relationship) (result []model.Relationship) {
+	for _, r := range relationships {
+		exists, relationshipType, comment := lookupRelationship(r.Type)
+
+		if !exists {
+			log.Warnf("unable to convert relationship from SPDX 2.2 JSON, dropping: %+v", r)
+			continue
+		}
+
+		result = append(result, model.Relationship{
+			SpdxElementID:      string(r.From.ID()),
+			RelationshipType:   relationshipType,
+			RelatedSpdxElement: string(r.To.ID()),
+			Comment:            comment,
+		})
+	}
+	return result
+}
+
+func lookupRelationship(ty artifact.RelationshipType) (bool, model.RelationshipType, string) {
+	switch ty {
+	case artifact.ContainsRelationship:
+		return true, model.ContainsRelationship, ""
+	case artifact.OwnershipByFileOverlapRelationship:
+		return true, model.OtherRelationship, fmt.Sprintf("%s: indicates that the parent package claims ownership of a child package since the parent metadata indicates overlap with a location that a cataloger found the child package by", ty)
+	}
+	return false, "", ""
+}
@@ -0,0 +1,256 @@
+package spdx22json
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+
+	"github.com/anchore/syft/syft/file"
+
+	"github.com/anchore/syft/syft/artifact"
+
+	"github.com/anchore/syft/internal/formats/spdx22json/model"
+	"github.com/anchore/syft/syft/source"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_toFileTypes(t *testing.T) {
+
+	tests := []struct {
+		name     string
+		metadata source.FileMetadata
+		expected []string
+	}{
+		{
+			name: "application",
+			metadata: source.FileMetadata{
+				MIMEType: "application/vnd.unknown",
+			},
+			expected: []string{
+				string(model.ApplicationFileType),
+			},
+		},
+		{
+			name: "archive",
+			metadata: source.FileMetadata{
+				MIMEType: "application/zip",
+			},
+			expected: []string{
+				string(model.ApplicationFileType),
+				string(model.ArchiveFileType),
+			},
+		},
+		{
+			name: "audio",
+			metadata: source.FileMetadata{
+				MIMEType: "audio/ogg",
+			},
+			expected: []string{
+				string(model.AudioFileType),
+			},
+		},
+		{
+			name: "video",
+			metadata: source.FileMetadata{
+				MIMEType: "video/3gpp",
+			},
+			expected: []string{
+				string(model.VideoFileType),
+			},
+		},
+		{
+			name: "text",
+			metadata: source.FileMetadata{
+				MIMEType: "text/html",
+			},
+			expected: []string{
+				string(model.TextFileType),
+			},
+		},
+		{
+			name: "image",
+			metadata: source.FileMetadata{
+				MIMEType: "image/png",
+			},
+			expected: []string{
+				string(model.ImageFileType),
+			},
+		},
+		{
+			name: "binary",
+			metadata: source.FileMetadata{
+				MIMEType: "application/x-sharedlib",
+			},
+			expected: []string{
+				string(model.ApplicationFileType),
+				string(model.BinaryFileType),
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.ElementsMatch(t, test.expected, toFileTypes(&test.metadata))
+		})
+	}
+}
+
+func Test_lookupRelationship(t *testing.T) {
+
+	tests := []struct {
+		input   artifact.RelationshipType
+		exists  bool
+		ty      model.RelationshipType
+		comment string
+	}{
+		{
+			input:  artifact.ContainsRelationship,
+			exists: true,
+			ty:     model.ContainsRelationship,
+		},
+		{
+			input:   artifact.OwnershipByFileOverlapRelationship,
+			exists:  true,
+			ty:      model.OtherRelationship,
+			comment: "ownership-by-file-overlap: indicates that the parent package claims ownership of a child package since the parent metadata indicates overlap with a location that a cataloger found the child package by",
+		},
+		{
+			input:  "made-up",
+			exists: false,
+		},
+	}
+	for _, test := range tests {
+		t.Run(string(test.input), func(t *testing.T) {
+			exists, ty, comment := lookupRelationship(test.input)
+			assert.Equal(t, exists, test.exists)
+			assert.Equal(t, ty, test.ty)
+			assert.Equal(t, comment, test.comment)
+		})
+	}
+}
+
+func Test_toFileChecksums(t *testing.T) {
+	tests := []struct {
+		name     string
+		digests  []file.Digest
+		expected []model.Checksum
+	}{
+		{
+			name: "empty",
+		},
+		{
+			name: "has digests",
+			digests: []file.Digest{
+				{
+					Algorithm: "sha256",
+					Value:     "deadbeefcafe",
+				},
+				{
+					Algorithm: "md5",
+					Value:     "meh",
+				},
+			},
+			expected: []model.Checksum{
+				{
+					Algorithm:     "sha256",
+					ChecksumValue: "deadbeefcafe",
+				},
+				{
+					Algorithm:     "md5",
+					ChecksumValue: "meh",
+				},
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.ElementsMatch(t, test.expected, toFileChecksums(test.digests))
+		})
+	}
+}
+
+func Test_fileIDsForPackage(t *testing.T) {
+
+	p := pkg.Package{
+		Name: "bogus",
+	}
+
+	c := source.Coordinates{
+		RealPath:     "/path",
+		FileSystemID: "nowhere",
+	}
+
+	tests := []struct {
+		name          string
+		id            string
+		relationships []artifact.Relationship
+		expected      []string
+	}{
+		{
+			name: "find file IDs for packages with package-file relationships",
+			id:   string(p.ID()),
+			relationships: []artifact.Relationship{
+				{
+					From: p,
+					To:   c,
+					Type: artifact.ContainsRelationship,
+				},
+			},
+			expected: []string{
+				string(c.ID()),
+			},
+		},
+		{
+			name: "ignore package-to-package",
+			id:   string(p.ID()),
+			relationships: []artifact.Relationship{
+				{
+					From: p,
+					To:   p,
+					Type: artifact.ContainsRelationship,
+				},
+			},
+			expected: []string{},
+		},
+		{
+			name: "ignore file-to-file",
+			id:   string(p.ID()),
+			relationships: []artifact.Relationship{
+				{
+					From: c,
+					To:   c,
+					Type: artifact.ContainsRelationship,
+				},
+			},
+			expected: []string{},
+		},
+		{
+			name: "ignore file-to-package",
+			id:   string(p.ID()),
+			relationships: []artifact.Relationship{
+				{
+					From: c,
+					To:   p,
+					Type: artifact.ContainsRelationship,
+				},
+			},
+			expected: []string{},
+		},
+		{
+			name: "filter by relationship type",
+			id:   string(p.ID()),
+			relationships: []artifact.Relationship{
+				{
+					From: p,
+					To:   c,
+					Type: artifact.OwnershipByFileOverlapRelationship,
+				},
+			},
+			expected: []string{},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.ElementsMatch(t, test.expected, fileIDsForPackage(test.id, test.relationships))
+		})
+	}
+}
@@ -0,0 +1,13 @@
+package spdx22tagvalue
+
+import (
+	"io"
+
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/spdx/tools-golang/tvsaver"
+)
+
+func encoder(output io.Writer, s sbom.SBOM) error {
+	model := toFormatModel(s)
+	return tvsaver.Save2_2(&model, output)
+}
@@ -1,4 +1,4 @@
-package packages
+package spdx22tagvalue

 import (
 	"flag"
@@ -11,9 +11,9 @@ import (
 var updateSpdxTagValue = flag.Bool("update-spdx-tv", false, "update the *.golden files for spdx-tv presenters")

 func TestSPDXTagValueDirectoryPresenter(t *testing.T) {
-	catalog, metadata, _ := testutils.DirectoryInput(t)
+
 	testutils.AssertPresenterAgainstGoldenSnapshot(t,
-		NewSPDXTagValuePresenter(catalog, metadata),
+		Format().Presenter(testutils.DirectoryInput(t)),
 		*updateSpdxTagValue,
 		spdxTagValueRedactor,
 	)
@@ -21,9 +21,8 @@ func TestSPDXTagValueDirectoryPresenter(t *testing.T) {

 func TestSPDXTagValueImagePresenter(t *testing.T) {
 	testImage := "image-simple"
-	catalog, metadata, _ := testutils.ImageInput(t, testImage)
 	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
-		NewSPDXTagValuePresenter(catalog, metadata),
+		Format().Presenter(testutils.ImageInput(t, testImage, testutils.FromSnapshot())),
 		testImage,
 		*updateSpdxTagValue,
 		spdxTagValueRedactor,
@@ -0,0 +1,13 @@
+package spdx22tagvalue
+
+import "github.com/anchore/syft/syft/format"
+
+// note: this format is LOSSY relative to the syftjson formation, which means that decoding and validation is not supported at this time
+func Format() format.Format {
+	return format.NewFormat(
+		format.SPDXTagValueOption,
+		encoder,
+		nil,
+		nil,
+	)
+}
@@ -1,40 +1,23 @@
-package packages
+package spdx22tagvalue

 import (
 	"fmt"
-	"io"
 	"time"

-	"github.com/anchore/syft/internal/formats/common/spdxhelpers"
-
-	"github.com/anchore/syft/internal/spdxlicense"
+	"github.com/anchore/syft/syft/sbom"

 	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/formats/common/spdxhelpers"
+	"github.com/anchore/syft/internal/spdxlicense"
 	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
 	"github.com/spdx/tools-golang/spdx"
-	"github.com/spdx/tools-golang/tvsaver"
 )

-// SPDXTagValuePresenter is a SPDX presentation object for the syft results (see https://github.com/spdx/spdx-spec)
-type SPDXTagValuePresenter struct {
-	catalog     *pkg.Catalog
-	srcMetadata source.Metadata
-}
-
-// NewJSONPresenter creates a new JSON presenter object for the given cataloging results.
-func NewSPDXTagValuePresenter(catalog *pkg.Catalog, srcMetadata source.Metadata) *SPDXTagValuePresenter {
-	return &SPDXTagValuePresenter{
-		catalog:     catalog,
-		srcMetadata: srcMetadata,
-	}
-}
-
-// Present the catalog results to the given writer.
-// nolint: funlen
-func (pres *SPDXTagValuePresenter) Present(output io.Writer) error {
-	doc := spdx.Document2_2{
+// toFormatModel creates and populates a new JSON document struct that follows the SPDX 2.2 spec from the given cataloging results.
+// nolint:funlen
+func toFormatModel(s sbom.SBOM) spdx.Document2_2 {
+	return spdx.Document2_2{
 		CreationInfo: &spdx.CreationInfo2_2{
 			// 2.1: SPDX Version; should be in the format "SPDX-2.2"
 			// Cardinality: mandatory, one
@@ -50,7 +33,7 @@ func (pres *SPDXTagValuePresenter) Present(output io.Writer) error {

 			// 2.4: Document Name
 			// Cardinality: mandatory, one
-			DocumentName: pres.srcMetadata.ImageMetadata.UserInput,
+			DocumentName: s.Source.ImageMetadata.UserInput,

 			// 2.5: Document Namespace
 			// Cardinality: mandatory, one
@@ -69,7 +52,7 @@ func (pres *SPDXTagValuePresenter) Present(output io.Writer) error {
 			// In many cases, the URI will point to a web accessible document, but this should not be assumed
 			// to be the case.

-			DocumentNamespace: fmt.Sprintf("https://anchore.com/syft/image/%s", pres.srcMetadata.ImageMetadata.UserInput),
+			DocumentNamespace: fmt.Sprintf("https://anchore.com/syft/image/%s", s.Source.ImageMetadata.UserInput),

 			// 2.6: External Document References
 			// Cardinality: optional, one or many
@@ -98,18 +81,16 @@ func (pres *SPDXTagValuePresenter) Present(output io.Writer) error {
 			// Cardinality: optional, one
 			DocumentComment: "",
 		},
-		Packages: pres.packages(),
+		Packages: toFormatPackages(s.Artifacts.PackageCatalog),
 	}
-
-	return tvsaver.Save2_2(&doc, output)
 }

 // packages populates all Package Information from the package Catalog (see https://spdx.github.io/spdx-spec/3-package-information/)
 // nolint: funlen
-func (pres *SPDXTagValuePresenter) packages() map[spdx.ElementID]*spdx.Package2_2 {
+func toFormatPackages(catalog *pkg.Catalog) map[spdx.ElementID]*spdx.Package2_2 {
 	results := make(map[spdx.ElementID]*spdx.Package2_2)

-	for p := range pres.catalog.Enumerate() {
+	for p := range catalog.Enumerate() {
 		// name should be guaranteed to be unique, but semantically useful and stable
 		id := fmt.Sprintf("Package-%+v-%s", p.Type, p.Name)

@@ -275,7 +256,7 @@ func (pres *SPDXTagValuePresenter) packages() map[spdx.ElementID]*spdx.Package2_
 	return results
 }

-func formatSPDXExternalRefs(p *pkg.Package) (refs []*spdx.PackageExternalReference2_2) {
+func formatSPDXExternalRefs(p pkg.Package) (refs []*spdx.PackageExternalReference2_2) {
 	for _, ref := range spdxhelpers.ExternalRefs(p) {
 		refs = append(refs, &spdx.PackageExternalReference2_2{
 			Category:           string(ref.ReferenceCategory),
@@ -5,19 +5,18 @@ import (
 	"fmt"
 	"io"

+	"github.com/anchore/syft/syft/sbom"
+
 	"github.com/anchore/syft/internal/formats/syftjson/model"
-	"github.com/anchore/syft/syft/distro"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
 )

-func decoder(reader io.Reader) (*pkg.Catalog, *source.Metadata, *distro.Distro, source.Scope, error) {
+func decoder(reader io.Reader) (*sbom.SBOM, error) {
 	dec := json.NewDecoder(reader)

 	var doc model.Document
 	err := dec.Decode(&doc)
 	if err != nil {
-		return nil, nil, nil, source.UnknownScope, fmt.Errorf("unable to decode syft-json: %w", err)
+		return nil, fmt.Errorf("unable to decode syft-json: %w", err)
 	}

 	return toSyftModel(doc)
@@ -5,8 +5,6 @@ import (
 	"strings"
 	"testing"

-	"github.com/anchore/syft/syft/source"
-
 	"github.com/anchore/syft/internal/formats/common/testutils"
 	"github.com/go-test/deep"
 	"github.com/stretchr/testify/assert"
@@ -14,30 +12,26 @@ import (

 func TestEncodeDecodeCycle(t *testing.T) {
 	testImage := "image-simple"
-	originalCatalog, originalMetadata, _ := testutils.ImageInput(t, testImage)
+	originalSBOM := testutils.ImageInput(t, testImage)

 	var buf bytes.Buffer
-	assert.NoError(t, encoder(&buf, originalCatalog, &originalMetadata, nil, source.SquashedScope))
+	assert.NoError(t, encoder(&buf, originalSBOM))

-	actualCatalog, actualMetadata, _, _, err := decoder(bytes.NewReader(buf.Bytes()))
+	actualSBOM, err := decoder(bytes.NewReader(buf.Bytes()))
 	assert.NoError(t, err)

-	for _, d := range deep.Equal(originalMetadata, *actualMetadata) {
+	for _, d := range deep.Equal(originalSBOM.Source, actualSBOM.Source) {
 		t.Errorf("metadata difference: %+v", d)
 	}

-	actualPackages := actualCatalog.Sorted()
-	for idx, p := range originalCatalog.Sorted() {
+	actualPackages := actualSBOM.Artifacts.PackageCatalog.Sorted()
+	for idx, p := range originalSBOM.Artifacts.PackageCatalog.Sorted() {
 		if !assert.Equal(t, p.Name, actualPackages[idx].Name) {
 			t.Errorf("different package at idx=%d: %s vs %s", idx, p.Name, actualPackages[idx].Name)
 			continue
 		}

-		// ids will never be equal
-		p.ID = ""
-		actualPackages[idx].ID = ""
-
-		for _, d := range deep.Equal(*p, *actualPackages[idx]) {
+		for _, d := range deep.Equal(p, actualPackages[idx]) {
 			if strings.Contains(d, ".VirtualPath: ") {
 				// location.Virtual path is not exposed in the json output
 				continue
@@ -4,15 +4,11 @@ import (
 	"encoding/json"
 	"io"

-	"github.com/anchore/syft/syft/distro"
-
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
+	"github.com/anchore/syft/syft/sbom"
 )

-func encoder(output io.Writer, catalog *pkg.Catalog, srcMetadata *source.Metadata, d *distro.Distro, scope source.Scope) error {
-	// TODO: application config not available yet
-	doc := ToFormatModel(catalog, srcMetadata, d, scope, nil)
+func encoder(output io.Writer, s sbom.SBOM) error {
+	doc := ToFormatModel(s)

 	enc := json.NewEncoder(output)
 	// prevent > and < from being escaped in the payload
@@ -4,28 +4,196 @@ import (
 	"flag"
 	"testing"

+	"github.com/anchore/syft/syft/file"
+
+	"github.com/anchore/syft/syft/artifact"
+
+	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"

 	"github.com/anchore/syft/internal/formats/common/testutils"
-	"github.com/anchore/syft/syft/format"
 )

 var updateJson = flag.Bool("update-json", false, "update the *.golden files for json presenters")

 func TestDirectoryPresenter(t *testing.T) {
-	catalog, metadata, distro := testutils.DirectoryInput(t)
 	testutils.AssertPresenterAgainstGoldenSnapshot(t,
-		format.NewPresenter(encoder, catalog, &metadata, distro, source.SquashedScope),
+		Format().Presenter(testutils.DirectoryInput(t)),
 		*updateJson,
 	)
 }

 func TestImagePresenter(t *testing.T) {
 	testImage := "image-simple"
-	catalog, metadata, distro := testutils.ImageInput(t, testImage, testutils.FromSnapshot())
 	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
-		format.NewPresenter(encoder, catalog, &metadata, distro, source.SquashedScope),
+		Format().Presenter(testutils.ImageInput(t, testImage, testutils.FromSnapshot())),
 		testImage,
 		*updateJson,
 	)
 }
+
+func TestEncodeFullJSONDocument(t *testing.T) {
+	catalog := pkg.NewCatalog()
+
+	p1 := pkg.Package{
+		Name:    "package-1",
+		Version: "1.0.1",
+		Locations: []source.Location{
+			{
+				Coordinates: source.Coordinates{
+					RealPath: "/a/place/a",
+				},
+			},
+		},
+		Type:         pkg.PythonPkg,
+		FoundBy:      "the-cataloger-1",
+		Language:     pkg.Python,
+		MetadataType: pkg.PythonPackageMetadataType,
+		Licenses:     []string{"MIT"},
+		Metadata: pkg.PythonPackageMetadata{
+			Name:    "package-1",
+			Version: "1.0.1",
+			Files:   []pkg.PythonFileRecord{},
+		},
+		PURL: "a-purl-1",
+		CPEs: []pkg.CPE{
+			pkg.MustCPE("cpe:2.3:*:some:package:1:*:*:*:*:*:*:*"),
+		},
+	}
+
+	p2 := pkg.Package{
+		Name:    "package-2",
+		Version: "2.0.1",
+		Locations: []source.Location{
+			{
+				Coordinates: source.Coordinates{
+					RealPath: "/b/place/b",
+				},
+			},
+		},
+		Type:         pkg.DebPkg,
+		FoundBy:      "the-cataloger-2",
+		MetadataType: pkg.DpkgMetadataType,
+		Metadata: pkg.DpkgMetadata{
+			Package: "package-2",
+			Version: "2.0.1",
+			Files:   []pkg.DpkgFileRecord{},
+		},
+		PURL: "a-purl-2",
+		CPEs: []pkg.CPE{
+			pkg.MustCPE("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"),
+		},
+	}
+
+	catalog.Add(p1)
+	catalog.Add(p2)
+
+	s := sbom.SBOM{
+		Artifacts: sbom.Artifacts{
+			PackageCatalog: catalog,
+			FileMetadata: map[source.Coordinates]source.FileMetadata{
+				source.NewLocation("/a/place").Coordinates: {
+					Mode:    0775,
+					Type:    "directory",
+					UserID:  0,
+					GroupID: 0,
+				},
+				source.NewLocation("/a/place/a").Coordinates: {
+					Mode:    0775,
+					Type:    "regularFile",
+					UserID:  0,
+					GroupID: 0,
+				},
+				source.NewLocation("/b").Coordinates: {
+					Mode:            0775,
+					Type:            "symbolicLink",
+					LinkDestination: "/c",
+					UserID:          0,
+					GroupID:         0,
+				},
+				source.NewLocation("/b/place/b").Coordinates: {
+					Mode:    0644,
+					Type:    "regularFile",
+					UserID:  1,
+					GroupID: 2,
+				},
+			},
+			FileDigests: map[source.Coordinates][]file.Digest{
+				source.NewLocation("/a/place/a").Coordinates: {
+					{
+						Algorithm: "sha256",
+						Value:     "366a3f5653e34673b875891b021647440d0127c2ef041e3b1a22da2a7d4f3703",
+					},
+				},
+				source.NewLocation("/b/place/b").Coordinates: {
+					{
+						Algorithm: "sha256",
+						Value:     "1b3722da2a7d90d033b87581a2a3f12021647445653e34666ef041e3b4f3707c",
+					},
+				},
+			},
+			FileContents: map[source.Coordinates]string{
+				source.NewLocation("/a/place/a").Coordinates: "the-contents",
+			},
+			Distro: &distro.Distro{
+				Type:       distro.RedHat,
+				RawVersion: "7",
+				IDLike:     "rhel",
+			},
+		},
+		Relationships: []artifact.Relationship{
+			{
+				From: p1,
+				To:   p2,
+				Type: artifact.OwnershipByFileOverlapRelationship,
+				Data: map[string]string{
+					"file": "path",
+				},
+			},
+		},
+		Source: source.Metadata{
+			Scheme: source.ImageScheme,
+			ImageMetadata: source.ImageMetadata{
+				UserInput:      "user-image-input",
+				ID:             "sha256:c2b46b4eb06296933b7cf0722683964e9ecbd93265b9ef6ae9642e3952afbba0",
+				ManifestDigest: "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368",
+				MediaType:      "application/vnd.docker.distribution.manifest.v2+json",
+				Tags: []string{
+					"stereoscope-fixture-image-simple:85066c51088bdd274f7a89e99e00490f666c49e72ffc955707cd6e18f0e22c5b",
+				},
+				Size: 38,
+				Layers: []source.LayerMetadata{
+					{
+						MediaType: "application/vnd.docker.image.rootfs.diff.tar.gzip",
+						Digest:    "sha256:3de16c5b8659a2e8d888b8ded8427be7a5686a3c8c4e4dd30de20f362827285b",
+						Size:      22,
+					},
+					{
+						MediaType: "application/vnd.docker.image.rootfs.diff.tar.gzip",
+						Digest:    "sha256:366a3f5653e34673b875891b021647440d0127c2ef041e3b1a22da2a7d4f3703",
+						Size:      16,
+					},
+				},
+				RawManifest: []byte("eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJh..."),
+				RawConfig:   []byte("eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZp..."),
+				RepoDigests: []string{},
+			},
+		},
+		Descriptor: sbom.Descriptor{
+			Name:    "syft",
+			Version: "v0.42.0-bogus",
+			// the application configuration should be persisted here, however, we do not want to import
+			// the application configuration in this package (it's reserved only for ingestion by the cmd package)
+			Configuration: map[string]string{
+				"config-key": "config-value",
+			},
+		},
+	}
+
+	testutils.AssertPresenterAgainstGoldenSnapshot(t,
+		Format().Presenter(s),
+		*updateJson,
+	)
+}
@@ -4,10 +4,12 @@ package model
 type Document struct {
 	Artifacts             []Package      `json:"artifacts"` // Artifacts is the list of packages discovered and placed into the catalog
 	ArtifactRelationships []Relationship `json:"artifactRelationships"`
-	Source                Source         `json:"source"`     // Source represents the original object that was cataloged
-	Distro                Distro         `json:"distro"`     // Distro represents the Linux distribution that was detected from the source
-	Descriptor            Descriptor     `json:"descriptor"` // Descriptor is a block containing self-describing information about syft
-	Schema                Schema         `json:"schema"`     // Schema is a block reserved for defining the version for the shape of this JSON document and where to find the schema document to validate the shape
+	Files                 []File         `json:"files,omitempty"`   // note: must have omitempty
+	Secrets               []Secrets      `json:"secrets,omitempty"` // note: must have omitempty
+	Source                Source         `json:"source"`            // Source represents the original object that was cataloged
+	Distro                Distro         `json:"distro"`            // Distro represents the Linux distribution that was detected from the source
+	Descriptor            Descriptor     `json:"descriptor"`        // Descriptor is a block containing self-describing information about syft
+	Schema                Schema         `json:"schema"`            // Schema is a block reserved for defining the version for the shape of this JSON document and where to find the schema document to validate the shape
 }

 // Descriptor describes what created the document as well as surrounding metadata
@@ -0,0 +1,25 @@
+package model
+
+import (
+	"github.com/anchore/syft/syft/file"
+
+	"github.com/anchore/syft/syft/source"
+)
+
+type File struct {
+	ID              string                `json:"id"`
+	Location        source.Coordinates    `json:"location"`
+	Metadata        *FileMetadataEntry    `json:"metadata,omitempty"`
+	Contents        string                `json:"contents,omitempty"`
+	Digests         []file.Digest         `json:"digests,omitempty"`
+	Classifications []file.Classification `json:"classifications,omitempty"`
+}
+
+type FileMetadataEntry struct {
+	Mode            int             `json:"mode"`
+	Type            source.FileType `json:"type"`
+	LinkDestination string          `json:"linkDestination,omitempty"`
+	UserID          int             `json:"userID"`
+	GroupID         int             `json:"groupID"`
+	MIMEType        string          `json:"mimeType"`
+}
@@ -9,7 +9,7 @@ import (
 	"github.com/anchore/syft/syft/source"
 )

-// Package represents a pkg.Package object specialized for JSON marshaling and unmarshaling.
+// Package represents a pkg.Package object specialized for JSON marshaling and unmarshalling.
 type Package struct {
 	PackageBasicData
 	PackageCustomData
@@ -17,16 +17,16 @@ type Package struct {

 // PackageBasicData contains non-ambiguous values (type-wise) from pkg.Package.
 type PackageBasicData struct {
-	ID        string            `json:"id"`
-	Name      string            `json:"name"`
-	Version   string            `json:"version"`
-	Type      pkg.Type          `json:"type"`
-	FoundBy   string            `json:"foundBy"`
-	Locations []source.Location `json:"locations"`
-	Licenses  []string          `json:"licenses"`
-	Language  pkg.Language      `json:"language"`
-	CPEs      []string          `json:"cpes"`
-	PURL      string            `json:"purl"`
+	ID        string               `json:"id"`
+	Name      string               `json:"name"`
+	Version   string               `json:"version"`
+	Type      pkg.Type             `json:"type"`
+	FoundBy   string               `json:"foundBy"`
+	Locations []source.Coordinates `json:"locations"`
+	Licenses  []string             `json:"licenses"`
+	Language  pkg.Language         `json:"language"`
+	CPEs      []string             `json:"cpes"`
+	PURL      string               `json:"purl"`
 }

 // PackageCustomData contains ambiguous values (type-wise) from pkg.Package.
@@ -4,5 +4,5 @@ type Relationship struct {
 	Parent   string      `json:"parent"`
 	Child    string      `json:"child"`
 	Type     string      `json:"type"`
-	Metadata interface{} `json:"metadata"`
+	Metadata interface{} `json:"metadata,omitempty"`
 }
@@ -0,0 +1,11 @@
+package model
+
+import (
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/source"
+)
+
+type Secrets struct {
+	Location source.Coordinates  `json:"location"`
+	Secrets  []file.SearchResult `json:"secrets"`
+}
@@ -20,11 +20,6 @@ type sourceUnpacker struct {
 	Target json.RawMessage `json:"target"`
 }

-type ImageSource struct {
-	source.ImageMetadata
-	Scope source.Scope `json:"scope"`
-}
-
 // UnmarshalJSON populates a source object from JSON bytes.
 func (s *Source) UnmarshalJSON(b []byte) error {
 	var unpacker sourceUnpacker
@@ -43,7 +38,7 @@ func (s *Source) UnmarshalJSON(b []byte) error {
 		}

 	case "image":
-		var payload ImageSource
+		var payload source.ImageMetadata
 		if err := json.Unmarshal(unpacker.Target, &payload); err != nil {
 			return err
 		}
@@ -1,7 +1,7 @@
 {
 "artifacts": [
  {
-   "id": "package-1-id",
+   "id": "2a115ac97d018a0e",
   "name": "package-1",
   "version": "1.0.1",
   "type": "python",
@@ -36,7 +36,7 @@
   }
  },
  {
-   "id": "package-2-id",
+   "id": "5e920b2bece2c3ae",
   "name": "package-2",
   "version": "2.0.1",
   "type": "deb",
@@ -77,10 +77,13 @@
 },
 "descriptor": {
  "name": "syft",
-  "version": "[not provided]"
+  "version": "v0.42.0-bogus",
+  "configuration": {
+   "config-key": "config-value"
+  }
 },
 "schema": {
-  "version": "1.1.0",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-1.1.0.json"
+  "version": "2.0.0",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-2.0.0.json"
 }
 }
@@ -1,78 +1,7 @@
 {
- "fileContents": [
-  {
-   "location": {
-    "path": "/a/place/a"
-   },
-   "contents": "the-contents"
-  }
- ],
- "fileMetadata": [
-  {
-   "location": {
-    "path": "/a/place"
-   },
-   "metadata": {
-    "mode": 775,
-    "type": "directory",
-    "userID": 0,
-    "groupID": 0,
-    "mimeType": ""
-   }
-  },
-  {
-   "location": {
-    "path": "/a/place/a"
-   },
-   "metadata": {
-    "mode": 775,
-    "type": "regularFile",
-    "userID": 0,
-    "groupID": 0,
-    "digests": [
-     {
-      "algorithm": "sha256",
-      "value": "366a3f5653e34673b875891b021647440d0127c2ef041e3b1a22da2a7d4f3703"
-     }
-    ],
-    "mimeType": ""
-   }
-  },
-  {
-   "location": {
-    "path": "/b"
-   },
-   "metadata": {
-    "mode": 775,
-    "type": "symbolicLink",
-    "linkDestination": "/c",
-    "userID": 0,
-    "groupID": 0,
-    "mimeType": ""
-   }
-  },
-  {
-   "location": {
-    "path": "/b/place/b"
-   },
-   "metadata": {
-    "mode": 644,
-    "type": "regularFile",
-    "userID": 1,
-    "groupID": 2,
-    "digests": [
-     {
-      "algorithm": "sha256",
-      "value": "1b3722da2a7d90d033b87581a2a3f12021647445653e34666ef041e3b4f3707c"
-     }
-    ],
-    "mimeType": ""
-   }
-  }
- ],
 "artifacts": [
  {
-   "id": "package-1-id",
+   "id": "962403cfb7be50d7",
   "name": "package-1",
   "version": "1.0.1",
   "type": "python",
@@ -102,7 +31,7 @@
   }
  },
  {
-   "id": "package-2-id",
+   "id": "b11f44847bba0ed1",
   "name": "package-2",
   "version": "2.0.1",
   "type": "deb",
@@ -131,7 +60,84 @@
   }
  }
 ],
- "artifactRelationships": [],
+ "artifactRelationships": [
+  {
+   "parent": "962403cfb7be50d7",
+   "child": "b11f44847bba0ed1",
+   "type": "ownership-by-file-overlap",
+   "metadata": {
+    "file": "path"
+   }
+  }
+ ],
+ "files": [
+  {
+   "id": "913b4592e2c2ebdf",
+   "location": {
+    "path": "/a/place"
+   },
+   "metadata": {
+    "mode": 775,
+    "type": "directory",
+    "userID": 0,
+    "groupID": 0,
+    "mimeType": ""
+   }
+  },
+  {
+   "id": "e7c88bd18e11b0b",
+   "location": {
+    "path": "/a/place/a"
+   },
+   "metadata": {
+    "mode": 775,
+    "type": "regularFile",
+    "userID": 0,
+    "groupID": 0,
+    "mimeType": ""
+   },
+   "contents": "the-contents",
+   "digests": [
+    {
+     "algorithm": "sha256",
+     "value": "366a3f5653e34673b875891b021647440d0127c2ef041e3b1a22da2a7d4f3703"
+    }
+   ]
+  },
+  {
+   "id": "5c3dc6885f48b5a1",
+   "location": {
+    "path": "/b"
+   },
+   "metadata": {
+    "mode": 775,
+    "type": "symbolicLink",
+    "linkDestination": "/c",
+    "userID": 0,
+    "groupID": 0,
+    "mimeType": ""
+   }
+  },
+  {
+   "id": "799d2f12da0bcec4",
+   "location": {
+    "path": "/b/place/b"
+   },
+   "metadata": {
+    "mode": 644,
+    "type": "regularFile",
+    "userID": 1,
+    "groupID": 2,
+    "mimeType": ""
+   },
+   "digests": [
+    {
+     "algorithm": "sha256",
+     "value": "1b3722da2a7d90d033b87581a2a3f12021647445653e34666ef041e3b4f3707c"
+    }
+   ]
+  }
+ ],
 "source": {
  "type": "image",
  "target": {
@@ -157,8 +163,7 @@
   ],
   "manifest": "ZXlKelkyaGxiV0ZXWlhKemFXOXVJam95TENKdFpXUnBZVlI1Y0dVaU9pSmguLi4=",
   "config": "ZXlKaGNtTm9hWFJsWTNSMWNtVWlPaUpoYldRMk5DSXNJbU52Ym1acC4uLg==",
-   "repoDigests": [],
-   "scope": ""
+   "repoDigests": []
  }
 },
 "distro": {
@@ -168,77 +173,13 @@
 },
 "descriptor": {
  "name": "syft",
-  "version": "[not provided]",
+  "version": "v0.42.0-bogus",
  "configuration": {
-   "configPath": "",
-   "output": "",
-   "file": "",
-   "quiet": false,
-   "check-for-app-update": false,
-   "anchore": {
-    "host": "",
-    "path": "",
-    "dockerfile": "",
-    "overwrite-existing-image": false,
-    "import-timeout": 0
-   },
-   "dev": {
-    "profile-cpu": false,
-    "profile-mem": false
-   },
-   "log": {
-    "structured": false,
-    "level": "",
-    "file-location": ""
-   },
-   "package": {
-    "cataloger": {
-     "enabled": false,
-     "scope": ""
-    }
-   },
-   "file-metadata": {
-    "cataloger": {
-     "enabled": false,
-     "scope": ""
-    },
-    "digests": [
-     "sha256"
-    ]
-   },
-   "file-classification": {
-    "cataloger": {
-     "enabled": false,
-     "scope": ""
-    }
-   },
-   "file-contents": {
-    "cataloger": {
-     "enabled": false,
-     "scope": ""
-    },
-    "skip-files-above-size": 0,
-    "globs": null
-   },
-   "secrets": {
-    "cataloger": {
-     "enabled": false,
-     "scope": ""
-    },
-    "additional-patterns": null,
-    "exclude-pattern-names": null,
-    "reveal-values": false,
-    "skip-files-above-size": 0
-   },
-   "registry": {
-    "insecure-skip-tls-verify": false,
-    "insecure-use-http": false,
-    "auth": null
-   }
+   "config-key": "config-value"
  }
 },
 "schema": {
-  "version": "1.1.0",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-1.1.0.json"
+  "version": "2.0.0",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-2.0.0.json"
 }
 }
@@ -1,7 +1,7 @@
 {
 "artifacts": [
  {
-   "id": "package-1-id",
+   "id": "888661d4f0362f02",
   "name": "package-1",
   "version": "1.0.1",
   "type": "python",
@@ -32,7 +32,7 @@
   }
  },
  {
-   "id": "package-2-id",
+   "id": "4068ff5e8926b305",
   "name": "package-2",
   "version": "2.0.1",
   "type": "deb",
@@ -88,8 +88,7 @@
   ],
   "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NjcsImRpZ2VzdCI6InNoYTI1NjoyNDgwMTYwYjU1YmVjNDBjNDRkM2IxNDVjN2IyYzFjNDcxNjBkYjg1NzVjM2RjYWUwODZkNzZiOTM3MGFlN2NhIn0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1NjpmYjZiZWVjYjc1YjM5ZjRiYjgxM2RiZjE3N2U1MDFlZGQ1ZGRiM2U2OWJiNDVjZWRlYjc4YzY3NmVlMWI3YTU5In0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2OjMxOWI1ODhjZTY0MjUzYTg3YjUzM2M4ZWQwMWNmMDAyNWUwZWFjOThlN2I1MTZlMTI1MzI5NTdlMTI0NGZkZWMifV19",
   "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8iLCJPbkJ1aWxkIjpudWxsfSwiY3JlYXRlZCI6IjIwMjEtMTAtMDRUMTE6NDA6MDAuNjM4Mzk0NVoiLCJoaXN0b3J5IjpbeyJjcmVhdGVkIjoiMjAyMS0xMC0wNFQxMTo0MDowMC41OTA3MzE2WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0xLnR4dCAvc29tZWZpbGUtMS50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn0seyJjcmVhdGVkIjoiMjAyMS0xMC0wNFQxMTo0MDowMC42MzgzOTQ1WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0yLnR4dCAvc29tZWZpbGUtMi50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6ZmI2YmVlY2I3NWIzOWY0YmI4MTNkYmYxNzdlNTAxZWRkNWRkYjNlNjliYjQ1Y2VkZWI3OGM2NzZlZTFiN2E1OSIsInNoYTI1NjozMTliNTg4Y2U2NDI1M2E4N2I1MzNjOGVkMDFjZjAwMjVlMGVhYzk4ZTdiNTE2ZTEyNTMyOTU3ZTEyNDRmZGVjIl19fQ==",
-   "repoDigests": [],
-   "scope": "Squashed"
+   "repoDigests": []
  }
 },
 "distro": {
@@ -99,10 +98,13 @@
 },
 "descriptor": {
  "name": "syft",
-  "version": "[not provided]"
+  "version": "v0.42.0-bogus",
+  "configuration": {
+   "config-key": "config-value"
+  }
 },
 "schema": {
-  "version": "1.1.0",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-1.1.0.json"
+  "version": "2.0.0",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-2.0.0.json"
 }
 }
@@ -2,33 +2,38 @@ package syftjson

 import (
 	"fmt"
+	"sort"
+	"strconv"
+
+	"github.com/anchore/syft/syft/file"
+
+	"github.com/anchore/syft/syft/artifact"
+
+	"github.com/anchore/syft/syft/sbom"

 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/formats/syftjson/model"
 	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft/distro"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
 )

-// TODO: this is export4ed for the use of the power-user command (temp)
-func ToFormatModel(catalog *pkg.Catalog, srcMetadata *source.Metadata, d *distro.Distro, scope source.Scope, applicationConfig interface{}) model.Document {
-	src, err := toSourceModel(srcMetadata, scope)
+// TODO: this is exported for the use of the power-user command (temp)
+func ToFormatModel(s sbom.SBOM) model.Document {
+	src, err := toSourceModel(s.Source)
 	if err != nil {
 		log.Warnf("unable to create syft-json source object: %+v", err)
 	}

 	return model.Document{
-		Artifacts:             toPackageModels(catalog),
-		ArtifactRelationships: toRelationshipModel(pkg.NewRelationships(catalog)),
+		Artifacts:             toPackageModels(s.Artifacts.PackageCatalog),
+		ArtifactRelationships: toRelationshipModel(s.Relationships),
+		Files:                 toFile(s),
+		Secrets:               toSecrets(s.Artifacts.Secrets),
 		Source:                src,
-		Distro:                toDistroModel(d),
-		Descriptor: model.Descriptor{
-			Name:          internal.ApplicationName,
-			Version:       version.FromBuild().Version,
-			Configuration: applicationConfig,
-		},
+		Distro:                toDistroModel(s.Artifacts.Distro),
+		Descriptor:            toDescriptor(s.Descriptor),
 		Schema: model.Schema{
 			Version: internal.JSONSchemaVersion,
 			URL:     fmt.Sprintf("https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-%s.json", internal.JSONSchemaVersion),
@@ -36,6 +41,93 @@ func ToFormatModel(catalog *pkg.Catalog, srcMetadata *source.Metadata, d *distro
 	}
 }

+func toDescriptor(d sbom.Descriptor) model.Descriptor {
+	return model.Descriptor{
+		Name:          d.Name,
+		Version:       d.Version,
+		Configuration: d.Configuration,
+	}
+}
+
+func toSecrets(data map[source.Coordinates][]file.SearchResult) []model.Secrets {
+	results := make([]model.Secrets, 0)
+	for coordinates, secrets := range data {
+		results = append(results, model.Secrets{
+			Location: coordinates,
+			Secrets:  secrets,
+		})
+	}
+
+	// sort by real path then virtual path to ensure the result is stable across multiple runs
+	sort.SliceStable(results, func(i, j int) bool {
+		return results[i].Location.RealPath < results[j].Location.RealPath
+	})
+	return results
+}
+
+func toFile(s sbom.SBOM) []model.File {
+	results := make([]model.File, 0)
+	artifacts := s.Artifacts
+
+	for _, coordinates := range sbom.AllCoordinates(s) {
+		var metadata *source.FileMetadata
+		if metadataForLocation, exists := artifacts.FileMetadata[coordinates]; exists {
+			metadata = &metadataForLocation
+		}
+
+		var digests []file.Digest
+		if digestsForLocation, exists := artifacts.FileDigests[coordinates]; exists {
+			digests = digestsForLocation
+		}
+
+		var classifications []file.Classification
+		if classificationsForLocation, exists := artifacts.FileClassifications[coordinates]; exists {
+			classifications = classificationsForLocation
+		}
+
+		var contents string
+		if contentsForLocation, exists := artifacts.FileContents[coordinates]; exists {
+			contents = contentsForLocation
+		}
+
+		results = append(results, model.File{
+			ID:              string(coordinates.ID()),
+			Location:        coordinates,
+			Metadata:        toFileMetadataEntry(coordinates, metadata),
+			Digests:         digests,
+			Classifications: classifications,
+			Contents:        contents,
+		})
+	}
+
+	// sort by real path then virtual path to ensure the result is stable across multiple runs
+	sort.SliceStable(results, func(i, j int) bool {
+		return results[i].Location.RealPath < results[j].Location.RealPath
+	})
+	return results
+}
+
+func toFileMetadataEntry(coordinates source.Coordinates, metadata *source.FileMetadata) *model.FileMetadataEntry {
+	if metadata == nil {
+		return nil
+	}
+
+	mode, err := strconv.Atoi(fmt.Sprintf("%o", metadata.Mode))
+	if err != nil {
+		log.Warnf("invalid mode found in file catalog @ location=%+v mode=%q: %+v", coordinates, metadata.Mode, err)
+		mode = 0
+	}
+
+	return &model.FileMetadataEntry{
+		Mode:            mode,
+		Type:            metadata.Type,
+		LinkDestination: metadata.LinkDestination,
+		UserID:          metadata.UserID,
+		GroupID:         metadata.GroupID,
+		MIMEType:        metadata.MIMEType,
+	}
+}
+
 func toPackageModels(catalog *pkg.Catalog) []model.Package {
 	artifacts := make([]model.Package, 0)
 	if catalog == nil {
@@ -48,31 +140,30 @@ func toPackageModels(catalog *pkg.Catalog) []model.Package {
 }

 // toPackageModel crates a new Package from the given pkg.Package.
-func toPackageModel(p *pkg.Package) model.Package {
+func toPackageModel(p pkg.Package) model.Package {
 	var cpes = make([]string, len(p.CPEs))
 	for i, c := range p.CPEs {
 		cpes[i] = c.BindToFmtString()
 	}

-	// ensure collections are never nil for presentation reasons
-	var locations = make([]source.Location, 0)
-	if p.Locations != nil {
-		locations = p.Locations
-	}
-
 	var licenses = make([]string, 0)
 	if p.Licenses != nil {
 		licenses = p.Licenses
 	}

+	var coordinates = make([]source.Coordinates, len(p.Locations))
+	for i, l := range p.Locations {
+		coordinates[i] = l.Coordinates
+	}
+
 	return model.Package{
 		PackageBasicData: model.PackageBasicData{
-			ID:        string(p.ID),
+			ID:        string(p.ID()),
 			Name:      p.Name,
 			Version:   p.Version,
 			Type:      p.Type,
 			FoundBy:   p.FoundBy,
-			Locations: locations,
+			Locations: coordinates,
 			Licenses:  licenses,
 			Language:  p.Language,
 			CPEs:      cpes,
@@ -85,29 +176,26 @@ func toPackageModel(p *pkg.Package) model.Package {
 	}
 }

-func toRelationshipModel(relationships []pkg.Relationship) []model.Relationship {
+func toRelationshipModel(relationships []artifact.Relationship) []model.Relationship {
 	result := make([]model.Relationship, len(relationships))
 	for i, r := range relationships {
 		result[i] = model.Relationship{
-			Parent:   string(r.Parent),
-			Child:    string(r.Child),
+			Parent:   string(r.From.ID()),
+			Child:    string(r.To.ID()),
 			Type:     string(r.Type),
-			Metadata: r.Metadata,
+			Metadata: r.Data,
 		}
 	}
 	return result
 }

 // toSourceModel creates a new source object to be represented into JSON.
-func toSourceModel(src *source.Metadata, scope source.Scope) (model.Source, error) {
+func toSourceModel(src source.Metadata) (model.Source, error) {
 	switch src.Scheme {
 	case source.ImageScheme:
 		return model.Source{
-			Type: "image",
-			Target: model.ImageSource{
-				ImageMetadata: src.ImageMetadata,
-				Scope:         scope,
-			},
+			Type:   "image",
+			Target: src.ImageMetadata,
 		}, nil
 	case source.DirectoryScheme:
 		return model.Source{
@@ -5,35 +5,48 @@ import (
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/distro"
 	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 )

-func toSyftModel(doc model.Document) (*pkg.Catalog, *source.Metadata, *distro.Distro, source.Scope, error) {
+func toSyftModel(doc model.Document) (*sbom.SBOM, error) {
 	dist, err := distro.NewDistro(distro.Type(doc.Distro.Name), doc.Distro.Version, doc.Distro.IDLike)
 	if err != nil {
-		return nil, nil, nil, source.UnknownScope, err
+		return nil, err
 	}

-	srcMetadata, scope := toSyftSourceData(doc.Source)
-
-	return toSyftCatalog(doc.Artifacts), srcMetadata, &dist, scope, nil
+	return &sbom.SBOM{
+		Artifacts: sbom.Artifacts{
+			PackageCatalog: toSyftCatalog(doc.Artifacts),
+			Distro:         &dist,
+		},
+		Source:     *toSyftSourceData(doc.Source),
+		Descriptor: toSyftDescriptor(doc.Descriptor),
+	}, nil
 }

-func toSyftSourceData(s model.Source) (*source.Metadata, source.Scope) {
+func toSyftDescriptor(d model.Descriptor) sbom.Descriptor {
+	return sbom.Descriptor{
+		Name:          d.Name,
+		Version:       d.Version,
+		Configuration: d.Configuration,
+	}
+}
+
+func toSyftSourceData(s model.Source) *source.Metadata {
 	switch s.Type {
 	case "directory":
 		return &source.Metadata{
 			Scheme: source.DirectoryScheme,
 			Path:   s.Target.(string),
-		}, source.UnknownScope
+		}
 	case "image":
-		parsedSource := s.Target.(model.ImageSource)
 		return &source.Metadata{
 			Scheme:        source.ImageScheme,
-			ImageMetadata: parsedSource.ImageMetadata,
-		}, parsedSource.Scope
+			ImageMetadata: s.Target.(source.ImageMetadata),
+		}
 	}
-	return nil, source.UnknownScope
+	return nil
 }

 func toSyftCatalog(pkgs []model.Package) *pkg.Catalog {
@@ -56,12 +69,16 @@ func toSyftPackage(p model.Package) pkg.Package {
 		cpes = append(cpes, value)
 	}

+	var locations = make([]source.Location, len(p.Locations))
+	for i, c := range p.Locations {
+		locations[i] = source.NewLocationFromCoordinates(c)
+	}
+
 	return pkg.Package{
-		ID:           pkg.ID(p.ID),
 		Name:         p.Name,
 		Version:      p.Version,
 		FoundBy:      p.FoundBy,
-		Locations:    p.Locations,
+		Locations:    locations,
 		Licenses:     p.Licenses,
 		Language:     p.Language,
 		Type:         p.Type,
@@ -6,18 +6,16 @@ import (
 	"sort"
 	"strings"

-	"github.com/olekukonko/tablewriter"
+	"github.com/anchore/syft/syft/sbom"

-	"github.com/anchore/syft/syft/distro"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
+	"github.com/olekukonko/tablewriter"
 )

-func encoder(output io.Writer, catalog *pkg.Catalog, _ *source.Metadata, _ *distro.Distro, _ source.Scope) error {
+func encoder(output io.Writer, s sbom.SBOM) error {
 	var rows [][]string

 	columns := []string{"Name", "Version", "Type"}
-	for _, p := range catalog.Sorted() {
+	for _, p := range s.Artifacts.PackageCatalog.Sorted() {
 		row := []string{
 			p.Name,
 			p.Version,
@@ -5,17 +5,14 @@ import (
 	"testing"

 	"github.com/anchore/syft/internal/formats/common/testutils"
-	"github.com/anchore/syft/syft/format"
-	"github.com/anchore/syft/syft/source"
 	"github.com/go-test/deep"
 )

 var updateTableGoldenFiles = flag.Bool("update-table", false, "update the *.golden files for table format")

 func TestTablePresenter(t *testing.T) {
-	catalog, metadata, distro := testutils.DirectoryInput(t)
 	testutils.AssertPresenterAgainstGoldenSnapshot(t,
-		format.NewPresenter(encoder, catalog, &metadata, distro, source.SquashedScope),
+		Format().Presenter(testutils.DirectoryInput(t)),
 		*updateTableGoldenFiles,
 	)
 }
@@ -5,23 +5,23 @@ import (
 	"io"
 	"text/tabwriter"

-	"github.com/anchore/syft/syft/distro"
-	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/sbom"
+
 	"github.com/anchore/syft/syft/source"
 )

-func encoder(output io.Writer, catalog *pkg.Catalog, srcMetadata *source.Metadata, _ *distro.Distro, _ source.Scope) error {
+func encoder(output io.Writer, s sbom.SBOM) error {
 	// init the tabular writer
 	w := new(tabwriter.Writer)
 	w.Init(output, 0, 8, 0, '\t', tabwriter.AlignRight)

-	switch srcMetadata.Scheme {
+	switch s.Source.Scheme {
 	case source.DirectoryScheme:
-		fmt.Fprintf(w, "[Path: %s]\n", srcMetadata.Path)
+		fmt.Fprintf(w, "[Path: %s]\n", s.Source.Path)
 	case source.ImageScheme:
 		fmt.Fprintln(w, "[Image]")

-		for idx, l := range srcMetadata.ImageMetadata.Layers {
+		for idx, l := range s.Source.ImageMetadata.Layers {
 			fmt.Fprintln(w, " Layer:\t", idx)
 			fmt.Fprintln(w, " Digest:\t", l.Digest)
 			fmt.Fprintln(w, " Size:\t", l.Size)
@@ -30,12 +30,12 @@ func encoder(output io.Writer, catalog *pkg.Catalog, srcMetadata *source.Metadat
 			w.Flush()
 		}
 	default:
-		return fmt.Errorf("unsupported source: %T", srcMetadata.Scheme)
+		return fmt.Errorf("unsupported source: %T", s.Source.Scheme)
 	}

 	// populate artifacts...
 	rows := 0
-	for _, p := range catalog.Sorted() {
+	for _, p := range s.Artifacts.PackageCatalog.Sorted() {
 		fmt.Fprintf(w, "[%s]\n", p.Name)
 		fmt.Fprintln(w, " Version:\t", p.Version)
 		fmt.Fprintln(w, " Type:\t", string(p.Type))
@@ -4,27 +4,22 @@ import (
 	"flag"
 	"testing"

-	"github.com/anchore/syft/syft/source"
-
 	"github.com/anchore/syft/internal/formats/common/testutils"
-	"github.com/anchore/syft/syft/format"
 )

 var updateTextPresenterGoldenFiles = flag.Bool("update-text", false, "update the *.golden files for text presenters")

 func TestTextDirectoryPresenter(t *testing.T) {
-	catalog, metadata, d := testutils.DirectoryInput(t)
 	testutils.AssertPresenterAgainstGoldenSnapshot(t,
-		format.NewPresenter(encoder, catalog, &metadata, d, source.UnknownScope),
+		Format().Presenter(testutils.DirectoryInput(t)),
 		*updateTextPresenterGoldenFiles,
 	)
 }

 func TestTextImagePresenter(t *testing.T) {
 	testImage := "image-simple"
-	catalog, metadata, d := testutils.ImageInput(t, testImage, testutils.FromSnapshot())
 	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
-		format.NewPresenter(encoder, catalog, &metadata, d, source.SquashedScope),
+		Format().Presenter(testutils.ImageInput(t, testImage, testutils.FromSnapshot())),
 		testImage,
 		*updateTextPresenterGoldenFiles,
 	)
@@ -12,5 +12,9 @@ func IsPipedInput() (bool, error) {
 		return false, fmt.Errorf("unable to determine if there is piped input: %w", err)
 	}

-	return fi.Mode()&os.ModeCharDevice == 0, nil
+	// note: we should NOT use the absence of a character device here as the hint that there may be input expected
+	// on stdin, as running syft as a subprocess you would expect no character device to be present but input can
+	// be from either stdin or indicated by the CLI. Checking if stdin is a pipe is the most direct way to determine
+	// if there *may* be bytes that will show up on stdin that should be used for the analysis source.
+	return fi.Mode()&os.ModeNamedPipe != 0, nil
 }
@@ -0,0 +1,72 @@
+package internal
+
+import "github.com/scylladb/go-set/strset"
+
+var (
+	ArchiveMIMETypeSet = strset.New(
+		// derived from https://en.wikipedia.org/wiki/List_of_archive_formats
+		[]string{
+			// archive only
+			"application/x-archive",
+			"application/x-cpio",
+			"application/x-shar",
+			"application/x-iso9660-image",
+			"application/x-sbx",
+			"application/x-tar",
+			// compression only
+			"application/x-bzip2",
+			"application/gzip",
+			"application/x-lzip",
+			"application/x-lzma",
+			"application/x-lzop",
+			"application/x-snappy-framed",
+			"application/x-xz",
+			"application/x-compress",
+			"application/zstd",
+			// archiving and compression
+			"application/x-7z-compressed",
+			"application/x-ace-compressed",
+			"application/x-astrotite-afa",
+			"application/x-alz-compressed",
+			"application/vnd.android.package-archive",
+			"application/x-freearc",
+			"application/x-arj",
+			"application/x-b1",
+			"application/vnd.ms-cab-compressed",
+			"application/x-cfs-compressed",
+			"application/x-dar",
+			"application/x-dgc-compressed",
+			"application/x-apple-diskimage",
+			"application/x-gca-compressed",
+			"application/java-archive",
+			"application/x-lzh",
+			"application/x-lzx",
+			"application/x-rar-compressed",
+			"application/x-stuffit",
+			"application/x-stuffitx",
+			"application/x-gtar",
+			"application/x-ms-wim",
+			"application/x-xar",
+			"application/zip",
+			"application/x-zoo",
+		}...,
+	)
+
+	ExecutableMIMETypeSet = strset.New(
+		[]string{
+			"application/x-executable",
+			"application/x-mach-binary",
+			"application/x-elf",
+			"application/x-sharedlib",
+			"application/vnd.microsoft.portable-executable",
+		}...,
+	)
+)
+
+func IsArchive(mimeType string) bool {
+	return ArchiveMIMETypeSet.Has(mimeType)
+}
+
+func IsExecutable(mimeType string) bool {
+	return ExecutableMIMETypeSet.Has(mimeType)
+}
@@ -0,0 +1,57 @@
+package internal
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_IsArchive(t *testing.T) {
+
+	tests := []struct {
+		name     string
+		mimeType string
+		expected bool
+	}{
+		{
+			name:     "not an archive",
+			mimeType: "application/vnd.unknown",
+			expected: false,
+		},
+		{
+			name:     "archive",
+			mimeType: "application/x-rar-compressed",
+			expected: true,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, IsArchive(test.mimeType))
+		})
+	}
+}
+
+func Test_IsExecutable(t *testing.T) {
+
+	tests := []struct {
+		name     string
+		mimeType string
+		expected bool
+	}{
+		{
+			name:     "not an executable",
+			mimeType: "application/vnd.unknown",
+			expected: false,
+		},
+		{
+			name:     "executable",
+			mimeType: "application/x-mach-binary",
+			expected: true,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, IsExecutable(test.mimeType))
+		})
+	}
+}
@@ -1,21 +0,0 @@
-package spdx22
-
-import "time"
-
-type AnnotationType string
-
-const (
-	ReviewerAnnotationType AnnotationType = "REVIEWER"
-	OtherAnnotationType    AnnotationType = "OTHER"
-)
-
-type Annotation struct {
-	// Identify when the comment was made. This is to be specified according to the combined date and time in the
-	// UTC format, as specified in the ISO 8601 standard.
-	AnnotationDate time.Time `json:"annotationDate"`
-	// Type of the annotation
-	AnnotationType AnnotationType `json:"annotationType"`
-	// This field identifies the person, organization or tool that has commented on a file, package, or the entire document.
-	Annotator string `json:"annotator"`
-	Comment   string `json:"comment"`
-}
@@ -1,7 +0,0 @@
-package spdx22
-
-type Checksum struct {
-	// Identifies the algorithm used to produce the subject Checksum. One of: "SHA256", "SHA1", "SHA384", "MD2", "MD4", "SHA512", "MD6", "MD5", "SHA224"
-	Algorithm     string `json:"algorithm"`
-	ChecksumValue string `json:"checksumValue"`
-}
@@ -1,19 +0,0 @@
-package spdx22
-
-import "time"
-
-type CreationInfo struct {
-	Comment string `json:"comment,omitempty"`
-	// Identify when the SPDX file was originally created. The date is to be specified according to combined date and
-	// time in UTC format as specified in ISO 8601 standard. This field is distinct from the fields in section 8,
-	// which involves the addition of information during a subsequent review.
-	Created time.Time `json:"created"`
-	// Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an
-	// individual, indicate the person's name. If the SPDX file was created on behalf of a company or organization,
-	// indicate the entity name. If the SPDX file was created using a software tool, indicate the name and version
-	// for that tool. If multiple participants or tools were involved, use multiple instances of this field. Person
-	// name or organization name may be designated as “anonymous” if appropriate.
-	Creators []string `json:"creators"`
-	// An optional field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created.
-	LicenseListVersion string `json:"licenseListVersion"`
-}
@@ -1,45 +0,0 @@
-package spdx22
-
-// derived from:
-// - https://spdx.github.io/spdx-spec/appendix-III-RDF-data-model-implementation-and-identifier-syntax/
-// - https://github.com/spdx/spdx-spec/blob/v2.2/schemas/spdx-schema.json
-// - https://github.com/spdx/spdx-spec/tree/v2.2/ontology
-
-type Document struct {
-	Element
-	SPDXVersion string `json:"spdxVersion"`
-	// One instance is required for each SPDX file produced. It provides the necessary information for forward
-	// and backward compatibility for processing tools.
-	CreationInfo CreationInfo `json:"creationInfo"`
-	// 2.2: Data License; should be "CC0-1.0"
-	// Cardinality: mandatory, one
-	// License expression for dataLicense.  Compliance with the SPDX specification includes populating the SPDX
-	// fields therein with data related to such fields (\"SPDX-Metadata\"). The SPDX specification contains numerous
-	// fields where an SPDX document creator may provide relevant explanatory text in SPDX-Metadata. Without
-	// opining on the lawfulness of \"database rights\" (in jurisdictions where applicable), such explanatory text
-	// is copyrightable subject matter in most Berne Convention countries. By using the SPDX specification, or any
-	// portion hereof, you hereby agree that any copyright rights (as determined by your jurisdiction) in any
-	// SPDX-Metadata, including without limitation explanatory text, shall be subject to the terms of the Creative
-	// Commons CC0 1.0 Universal license. For SPDX-Metadata not containing any copyright rights, you hereby agree
-	// and acknowledge that the SPDX-Metadata is provided to you \"as-is\" and without any representations or
-	// warranties of any kind concerning the SPDX-Metadata, express, implied, statutory or otherwise, including
-	// without limitation warranties of title, merchantability, fitness for a particular purpose, non-infringement,
-	// or the absence of latent or other defects, accuracy, or the presence or absence of errors, whether or not
-	// discoverable, all to the greatest extent permissible under applicable law.
-	DataLicense string `json:"dataLicense"`
-	// Information about an external SPDX document reference including the checksum. This allows for verification of the external references.
-	ExternalDocumentRefs []ExternalDocumentRef `json:"externalDocumentRefs,omitempty"`
-	// Indicates that a particular ExtractedLicensingInfo was defined in the subject SpdxDocument.
-	HasExtractedLicensingInfos []HasExtractedLicensingInfo `json:"hasExtractedLicensingInfos,omitempty"`
-	// note: found in example documents from SPDX, but not in the JSON schema. See https://spdx.github.io/spdx-spec/2-document-creation-information/#25-spdx-document-namespace
-	DocumentNamespace string `json:"documentNamespace"`
-	// note: found in example documents from SPDX, but not in the JSON schema
-	// DocumentDescribes []string  `json:"documentDescribes"`
-	Packages []Package `json:"packages"`
-	// Files referenced in the SPDX document
-	Files []File `json:"files,omitempty"`
-	// Snippets referenced in the SPDX document
-	Snippets []Snippet `json:"snippets,omitempty"`
-	// Relationships referenced in the SPDX document
-	Relationships []Relationship `json:"relationships,omitempty"`
-}
@@ -1,12 +0,0 @@
-package spdx22
-
-type Element struct {
-	SPDXID string `json:"SPDXID"`
-	// Identify name of this SpdxElement.
-	Name string `json:"name"`
-	// Relationships referenced in the SPDX document
-	Relationships []Relationship `json:"relationships,omitempty"`
-	// Provide additional information about an SpdxElement.
-	Annotations []Annotation `json:"annotations,omitempty"`
-	Comment     string       `json:"comment,omitempty"`
-}
@@ -1,37 +0,0 @@
-package spdx22
-
-// ElementID represents the identifier string portion of an SPDX element
-// identifier. DocElementID should be used for any attributes which can
-// contain identifiers defined in a different SPDX document.
-// ElementIDs should NOT contain the mandatory 'SPDXRef-' portion.
-type ElementID string
-
-func (e ElementID) String() string {
-	return "SPDXRef-" + string(e)
-}
-
-// DocElementID represents an SPDX element identifier that could be defined
-// in a different SPDX document, and therefore could have a "DocumentRef-"
-// portion, such as Relationship and Annotations.
-// ElementID is used for attributes in which a "DocumentRef-" portion cannot
-// appear, such as a Package or File definition (since it is necessarily
-// being defined in the present document).
-// DocumentRefID will be the empty string for elements defined in the
-// present document.
-// DocElementIDs should NOT contain the mandatory 'DocumentRef-' or
-// 'SPDXRef-' portions.
-type DocElementID struct {
-	DocumentRefID string
-	ElementRefID  ElementID
-}
-
-// RenderDocElementID takes a DocElementID and returns the string equivalent,
-// with the SPDXRef- prefix (and, if applicable, the DocumentRef- prefix)
-// reinserted.
-func (d DocElementID) String() string {
-	prefix := ""
-	if d.DocumentRefID != "" {
-		prefix = "DocumentRef-" + d.DocumentRefID + ":"
-	}
-	return prefix + d.ElementRefID.String()
-}
@@ -1,9 +0,0 @@
-package spdx22
-
-type ExternalDocumentRef struct {
-	// externalDocumentId is a string containing letters, numbers, ., - and/or + which uniquely identifies an external document within this document.
-	ExternalDocumentID string   `json:"externalDocumentId"`
-	Checksum           Checksum `json:"checksum"`
-	// SPDX ID for SpdxDocument.  A propoerty containing an SPDX document.
-	SpdxDocument string `json:"spdxDocument"`
-}
@@ -1,43 +0,0 @@
-package spdx22
-
-type ReferenceCategory string
-
-const (
-	SecurityReferenceCategory       ReferenceCategory = "SECURITY"
-	PackageManagerReferenceCategory ReferenceCategory = "PACKAGE_MANAGER"
-	OtherReferenceCategory          ReferenceCategory = "OTHER"
-)
-
-// source: https://spdx.github.io/spdx-spec/appendix-VI-external-repository-identifiers/
-
-type ExternalRefType string
-
-const (
-	// see https://nvd.nist.gov/cpe
-	Cpe22ExternalRefType ExternalRefType = "cpe22Type"
-	// see https://nvd.nist.gov/cpe
-	Cpe23ExternalRefType ExternalRefType = "cpe23Type"
-	// see http://repo1.maven.org/maven2/
-	MavenCentralExternalRefType ExternalRefType = "maven-central"
-	// see https://www.npmjs.com/
-	NpmExternalRefType ExternalRefType = "npm"
-	// see https://www.nuget.org/
-	NugetExternalRefType ExternalRefType = "nuget"
-	// see http://bower.io/
-	BowerExternalRefType ExternalRefType = "bower"
-	// see https://github.com/package-url/purl-spec
-	PurlExternalRefType ExternalRefType = "purl"
-	// These point to objects present in the Software Heritage archive by the means of SoftWare Heritage persistent Identifiers (SWHID)
-	SwhExternalRefType ExternalRefType = "swh"
-)
-
-type ExternalRef struct {
-	Comment string `json:"comment,omitempty"`
-	// Category for the external reference.
-	ReferenceCategory ReferenceCategory `json:"referenceCategory"`
-	// The unique string with no spaces necessary to access the package-specific information, metadata, or content
-	// within the target location. The format of the locator is subject to constraints defined by the <type>.
-	ReferenceLocator string `json:"referenceLocator"`
-	// Type of the external reference. These are defined in an appendix in the SPDX specification.
-	ReferenceType ExternalRefType `json:"referenceType"`
-}
@@ -1,41 +0,0 @@
-package spdx22
-
-type FileType string
-
-const (
-	DocumentationFileType FileType = "DOCUMENTATION"
-	ImageFileType         FileType = "IMAGE"
-	VideoFileType         FileType = "VIDEO"
-	ArchiveFileType       FileType = "ARCHIVE"
-	SpdxFileType          FileType = "SPDX"
-	ApplicationFileType   FileType = "APPLICATION"
-	SourceFileType        FileType = "SOURCE"
-	BinaryFileType        FileType = "BINARY"
-	TextFileType          FileType = "TEXT"
-	AudioFileType         FileType = "AUDIO"
-	OtherFileType         FileType = "OTHER"
-)
-
-type File struct {
-	Item
-	// (At least one is required.) The checksum property provides a mechanism that can be used to verify that the
-	// contents of a File or Package have not changed.
-	Checksums []Checksum `json:"checksums,omitempty"`
-	// This field provides a place for the SPDX file creator to record file contributors. Contributors could include
-	// names of copyright holders and/or authors who may not be copyright holders yet contributed to the file content.
-	FileContributors []string `json:"fileContributors,omitempty"`
-	// Each element is a SPDX ID for a File.
-	FileDependencies []string `json:"fileDependencies,omitempty"`
-	// The name of the file relative to the root of the package.
-	FileName string `json:"fileName"`
-	// The type of the file
-	FileTypes []string `json:"fileTypes,omitempty"`
-	// This field provides a place for the SPDX file creator to record potential legal notices found in the file.
-	// This may or may not include copyright statements.
-	NoticeText string `json:"noticeText,omitempty"`
-	// Indicates the project in which the SpdxElement originated. Tools must preserve doap:homepage and doap:name
-	// properties and the URI (if one is known) of doap:Project resources that are values of this property. All other
-	// properties of doap:Projects are not directly supported by SPDX and may be dropped when translating to or
-	// from some SPDX formats(deprecated).
-	ArtifactOf []string `json:"artifactOf,omitempty"`
-}
@@ -1,14 +0,0 @@
-package spdx22
-
-type HasExtractedLicensingInfo struct {
-	// Verbatim license or licensing notice text that was discovered.
-	ExtractedText string `json:"extractedText"`
-	// A human readable short form license identifier for a license. The license ID is iether on the standard license
-	// oist or the form \"LicenseRef-\"[idString] where [idString] is a unique string containing letters,
-	// numbers, \".\", \"-\" or \"+\".
-	LicenseID string `json:"licenseId"`
-	Comment   string `json:"comment,omitempty"`
-	// Identify name of this SpdxElement.
-	Name     string   `json:"name,omitempty"`
-	SeeAlsos []string `json:"seeAlsos,omitempty"`
-}
@@ -1,22 +0,0 @@
-package spdx22
-
-type Item struct {
-	Element
-	// The licenseComments property allows the preparer of the SPDX document to describe why the licensing in
-	// spdx:licenseConcluded was chosen.
-	LicenseComments  string `json:"licenseComments,omitempty"`
-	LicenseConcluded string `json:"licenseConcluded"`
-	// The licensing information that was discovered directly within the package. There will be an instance of this
-	// property for each distinct value of alllicenseInfoInFile properties of all files contained in the package.
-	LicenseInfoFromFiles []string `json:"licenseInfoFromFiles,omitempty"`
-	// Licensing information that was discovered directly in the subject file. This is also considered a declared license for the file.
-	LicenseInfoInFiles []string `json:"licenseInfoInFiles,omitempty"`
-	// The text of copyright declarations recited in the Package or File.
-	CopyrightText string `json:"copyrightText,omitempty"`
-	// This field provides a place for the SPDX data creator to record acknowledgements that may be required to be
-	// communicated in some contexts. This is not meant to include the actual complete license text (see
-	// licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText).
-	// The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from
-	// license texts, which may be necessary or desirable to reproduce.
-	AttributionTexts []string `json:"attributionTexts,omitempty"`
-}
@@ -1,50 +0,0 @@
-package spdx22
-
-type Package struct {
-	Item
-	// The checksum property provides a mechanism that can be used to verify that the contents of a File or
-	// Package have not changed.
-	Checksums []Checksum `json:"checksums,omitempty"`
-	// Provides a detailed description of the package.
-	Description string `json:"description,omitempty"`
-	// The URI at which this package is available for download. Private (i.e., not publicly reachable) URIs are
-	// acceptable as values of this property. The values http://spdx.org/rdf/terms#none and http://spdx.org/rdf/terms#noassertion
-	// may be used to specify that the package is not downloadable or that no attempt was made to determine its
-	// download location, respectively.
-	DownloadLocation string `json:"downloadLocation,omitempty"`
-	// An External Reference allows a Package to reference an external source of additional information, metadata,
-	// enumerations, asset identifiers, or downloadable content believed to be relevant to the Package.
-	ExternalRefs []ExternalRef `json:"externalRefs,omitempty"`
-	// Indicates whether the file content of this package has been available for or subjected to analysis when
-	// creating the SPDX document. If false indicates packages that represent metadata or URI references to a
-	// project, product, artifact, distribution or a component. If set to false, the package must not contain any files
-	FilesAnalyzed bool `json:"filesAnalyzed"`
-	// Indicates that a particular file belongs to a package (elements are SPDX ID for a File).
-	HasFiles []string `json:"hasFiles,omitempty"`
-	// Provide a place for the SPDX file creator to record a web site that serves as the package's home page.
-	// This link can also be used to reference further information about the package referenced by the SPDX file creator.
-	Homepage string `json:"homepage,omitempty"`
-	// List the licenses that have been declared by the authors of the package. Any license information that does not
-	// originate from the package authors, e.g. license information from a third party repository, should not be included in this field.
-	LicenseDeclared string `json:"licenseDeclared"`
-	// The name and, optionally, contact information of the person or organization that originally created the package.
-	// Values of this property must conform to the agent and tool syntax.
-	Originator string `json:"originator,omitempty"`
-	// The base name of the package file name. For example, zlib-1.2.5.tar.gz.
-	PackageFileName string `json:"packageFileName,omitempty"`
-	// A manifest based verification code (the algorithm is defined in section 4.7 of the full specification) of the
-	// SPDX Item. This allows consumers of this data and/or database to determine if an SPDX item they have in hand
-	// is identical to the SPDX item from which the data was produced. This algorithm works even if the SPDX document
-	// is included in the SPDX item.
-	PackageVerificationCode *PackageVerificationCode `json:"packageVerificationCode,omitempty"`
-	// Allows the producer(s) of the SPDX document to describe how the package was acquired and/or changed from the original source.
-	SourceInfo string `json:"sourceInfo,omitempty"`
-	// Provides a short description of the package.
-	Summary string `json:"summary,omitempty"`
-	// The name and, optionally, contact information of the person or organization who was the immediate supplier
-	// of this package to the recipient. The supplier may be different than originator when the software has been
-	// repackaged. Values of this property must conform to the agent and tool syntax.
-	Supplier string `json:"supplier,omitempty"`
-	// Provides an indication of the version of the package that is described by this SpdxDocument.
-	VersionInfo string `json:"versionInfo,omitempty"`
-}
@@ -1,23 +0,0 @@
-package spdx22
-
-// Why are there two package identifier fields Package Checksum and Package Verification?
-// Although the values of the two fields Package Checksum and Package Verification are similar, they each serve a
-// different purpose. The Package Checksum provides a unique identifier of a software package which is computed by
-// taking the SHA1 of the entire software package file. This enables one to quickly determine if two different copies
-// of a package are the same. One disadvantage of this approach is that one cannot add an SPDX data file into the
-// original package without changing the Package Checksum value. Alternatively, the Package Verification field enables
-// the inclusion of an SPDX file. It enables one to quickly verify if one or more of the original package files has
-// changed. The Package Verification field is a unique identifier that is based on SHAing only the original package
-// files (e.g., excluding the SPDX file). This allows one to add an SPDX file to the original package without changing
-// this unique identifier.
-// source: https://wiki.spdx.org/view/SPDX_FAQ
-type PackageVerificationCode struct {
-	// "A file that was excluded when calculating the package verification code. This is usually a file containing
-	// SPDX data regarding the package. If a package contains more than one SPDX file all SPDX files must be excluded
-	// from the package verification code. If this is not done it would be impossible to correctly calculate the
-	// verification codes in both files.
-	PackageVerificationCodeExcludedFiles []string `json:"packageVerificationCodeExcludedFiles"`
-
-	// The actual package verification code as a hex encoded value.
-	PackageVerificationCodeValue string `json:"packageVerificationCodeValue"`
-}
@@ -1,183 +0,0 @@
-package spdx22
-
-type Relationship struct {
-	// Id to which the SPDX element is related
-	SpdxElementID string `json:"spdxElementId"`
-	// Describes the type of relationship between two SPDX elements.
-	RelationshipType RelationshipType `json:"relationshipType"`
-	// SPDX ID for SpdxElement.  A related SpdxElement.
-	RelatedSpdxElement string `json:"relatedSpdxElement"`
-	Comment            string `json:"comment,omitempty"`
-}
-
-// source: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/
-type RelationshipType string
-
-const (
-	// DescribedByRelationship is to be used when SPDXRef-A is described by SPDXREF-Document.
-	// Example: The package 'WildFly' is described by SPDX document WildFly.spdx.
-	DescribedByRelationship RelationshipType = "DESCRIBED_BY"
-
-	// ContainsRelationship is to be used when SPDXRef-A contains SPDXRef-B.
-	// Example: An ARCHIVE file bar.tgz contains a SOURCE file foo.c.
-	ContainsRelationship RelationshipType = "CONTAINS"
-
-	// ContainedByRelationship is to be used when SPDXRef-A is contained by SPDXRef-B.
-	// Example: A SOURCE file foo.c is contained by ARCHIVE file bar.tgz
-	ContainedByRelationship RelationshipType = "CONTAINED_BY"
-
-	// DependsOnRelationship is to be used when SPDXRef-A depends on SPDXRef-B.
-	// Example: Package A depends on the presence of package B in order to build and run
-	DependsOnRelationship RelationshipType = "DEPENDS_ON"
-
-	// DependencyOfRelationship is to be used when SPDXRef-A is dependency of SPDXRef-B.
-	// Example: A is explicitly stated as a dependency of B in a machine-readable file. Use when a package manager does not define scopes.
-	DependencyOfRelationship RelationshipType = "DEPENDENCY_OF"
-
-	// DependencyManifestOfRelationship is to be used when SPDXRef-A is a manifest file that lists a set of dependencies for SPDXRef-B.
-	// Example: A file package.json is the dependency manifest of a package foo. Note that only one manifest should be used to define the same dependency graph.
-	DependencyManifestOfRelationship RelationshipType = "DEPENDENCY_MANIFEST_OF"
-
-	// BuildDependencyOfRelationship is to be used when SPDXRef-A is a build dependency of SPDXRef-B.
-	// Example: A is in the compile scope of B in a Maven project.
-	BuildDependencyOfRelationship RelationshipType = "BUILD_DEPENDENCY_OF"
-
-	// DevDependencyOfRelationship is to be used when SPDXRef-A is a development dependency of SPDXRef-B.
-	// Example: A is in the devDependencies scope of B in a Maven project.
-	DevDependencyOfRelationship RelationshipType = "DEV_DEPENDENCY_OF"
-
-	// OptionalDependencyOfRelationship is to be used when SPDXRef-A is an optional dependency of SPDXRef-B.
-	// Example: Use when building the code will proceed even if a dependency cannot be found, fails to install, or is only installed on a specific platform. For example, A is in the optionalDependencies scope of npm project B.
-	OptionalDependencyOfRelationship RelationshipType = "OPTIONAL_DEPENDENCY_OF"
-
-	// ProvidedDependencyOfRelationship is to be used when SPDXRef-A is a to be provided dependency of SPDXRef-B.
-	// Example: A is in the provided scope of B in a Maven project, indicating that the project expects it to be provided, for instance, by the container or JDK.
-	ProvidedDependencyOfRelationship RelationshipType = "PROVIDED_DEPENDENCY_OF"
-
-	// TestDependencyOfRelationship is to be used when SPDXRef-A is a test dependency of SPDXRef-B.
-	// Example: A is in the test scope of B in a Maven project.
-	TestDependencyOfRelationship RelationshipType = "TEST_DEPENDENCY_OF"
-
-	// RuntimeDependencyOfRelationship is to be used when SPDXRef-A is a dependency required for the execution of SPDXRef-B.
-	// Example: A is in the runtime scope of B in a Maven project.
-	RuntimeDependencyOfRelationship RelationshipType = "RUNTIME_DEPENDENCY_OF"
-
-	// ExampleOfRelationship is to be used when SPDXRef-A is an example of SPDXRef-B.
-	// Example: The file or snippet that illustrates how to use an application or library.
-	ExampleOfRelationship RelationshipType = "EXAMPLE_OF"
-
-	// GeneratesRelationship is to be used when SPDXRef-A generates SPDXRef-B.
-	// Example: A SOURCE file makefile.mk generates a BINARY file a.out
-	GeneratesRelationship RelationshipType = "GENERATES"
-
-	// GeneratedFromRelationship is to be used when SPDXRef-A was generated from SPDXRef-B.
-	// Example: A BINARY file a.out has been generated from a SOURCE file makefile.mk. A BINARY file foolib.a is generated from a SOURCE file bar.c.
-	GeneratedFromRelationship RelationshipType = "GENERATED_FROM"
-
-	// AncestorOfRelationship is to be used when SPDXRef-A is an ancestor (same lineage but pre-dates) SPDXRef-B.
-	// Example: A SOURCE file makefile.mk is a version of the original ancestor SOURCE file 'makefile2.mk'
-	AncestorOfRelationship RelationshipType = "ANCESTOR_OF"
-
-	// DescendantOfRelationship is to be used when SPDXRef-A is a descendant of (same lineage but postdates) SPDXRef-B.
-	// Example: A SOURCE file makefile2.mk is a descendant of the original SOURCE file 'makefile.mk'
-	DescendantOfRelationship RelationshipType = "DESCENDANT_OF"
-
-	// VariantOfRelationship is to be used when SPDXRef-A is a variant of (same lineage but not clear which came first) SPDXRef-B.
-	// Example: A SOURCE file makefile2.mk is a variant of SOURCE file makefile.mk if they differ by some edit, but there is no way to tell which came first (no reliable date information).
-	VariantOfRelationship RelationshipType = "VARIANT_OF"
-
-	// DistributionArtifactRelationship is to be used when distributing SPDXRef-A requires that SPDXRef-B also be distributed.
-	// Example: A BINARY file foo.o requires that the ARCHIVE file bar-sources.tgz be made available on distribution.
-	DistributionArtifactRelationship RelationshipType = "DISTRIBUTION_ARTIFACT"
-
-	// PatchForRelationship is to be used when SPDXRef-A is a patch file for (to be applied to) SPDXRef-B.
-	// Example: A SOURCE file foo.diff is a patch file for SOURCE file foo.c.
-	PatchForRelationship RelationshipType = "PATCH_FOR"
-
-	// PatchAppliedRelationship is to be used when SPDXRef-A is a patch file that has been applied to SPDXRef-B.
-	// Example: A SOURCE file foo.diff is a patch file that has been applied to SOURCE file 'foo-patched.c'.
-	PatchAppliedRelationship RelationshipType = "PATCH_APPLIED"
-
-	// CopyOfRelationship is to be used when SPDXRef-A is an exact copy of SPDXRef-B.
-	// Example: A BINARY file alib.a is an exact copy of BINARY file a2lib.a.
-	CopyOfRelationship RelationshipType = "COPY_OF"
-
-	// FileAddedRelationship is to be used when SPDXRef-A is a file that was added to SPDXRef-B.
-	// Example: A SOURCE file foo.c has been added to package ARCHIVE bar.tgz.
-	FileAddedRelationship RelationshipType = "FILE_ADDED"
-
-	// FileDeletedRelationship is to be used when SPDXRef-A is a file that was deleted from SPDXRef-B.
-	// Example: A SOURCE file foo.diff has been deleted from package ARCHIVE bar.tgz.
-	FileDeletedRelationship RelationshipType = "FILE_DELETED"
-
-	// FileModifiedRelationship is to be used when SPDXRef-A is a file that was modified from SPDXRef-B.
-	// Example: A SOURCE file foo.c has been modified from SOURCE file foo.orig.c.
-	FileModifiedRelationship RelationshipType = "FILE_MODIFIED"
-
-	// ExpandedFromArchiveRelationship is to be used when SPDXRef-A is expanded from the archive SPDXRef-B.
-	// Example: A SOURCE file foo.c, has been expanded from the archive ARCHIVE file xyz.tgz.
-	ExpandedFromArchiveRelationship RelationshipType = "EXPANDED_FROM_ARCHIVE"
-
-	// DynamicLinkRelationship is to be used when SPDXRef-A dynamically links to SPDXRef-B.
-	// Example: An APPLICATION file 'myapp' dynamically links to BINARY file zlib.so.
-	DynamicLinkRelationship RelationshipType = "DYNAMIC_LINK"
-
-	// StaticLinkRelationship is to be used when SPDXRef-A statically links to SPDXRef-B.
-	// Example: An APPLICATION file 'myapp' statically links to BINARY zlib.a.
-	StaticLinkRelationship RelationshipType = "STATIC_LINK"
-
-	// DataFileOfRelationship is to be used when SPDXRef-A is a data file used in SPDXRef-B.
-	// Example: An IMAGE file 'kitty.jpg' is a data file of an APPLICATION 'hellokitty'.
-	DataFileOfRelationship RelationshipType = "DATA_FILE_OF"
-
-	// TestCaseOfRelationship is to be used when SPDXRef-A is a test case used in testing SPDXRef-B.
-	// Example: A SOURCE file testMyCode.java is a unit test file used to test an APPLICATION MyPackage.
-	TestCaseOfRelationship RelationshipType = "TEST_CASE_OF"
-
-	// BuildToolOfRelationship is to be used when SPDXRef-A is used to build SPDXRef-B.
-	// Example: A SOURCE file makefile.mk is used to build an APPLICATION 'zlib'.
-	BuildToolOfRelationship RelationshipType = "BUILD_TOOL_OF"
-
-	// DevToolOfRelationship is to be used when SPDXRef-A is used as a development tool for SPDXRef-B.
-	// Example: Any tool used for development such as a code debugger.
-	DevToolOfRelationship RelationshipType = "DEV_TOOL_OF"
-
-	// TestOfRelationship is to be used when SPDXRef-A is used for testing SPDXRef-B.
-	// Example: Generic relationship for cases where it's clear that something is used for testing but unclear whether it's TEST_CASE_OF or TEST_TOOL_OF.
-	TestOfRelationship RelationshipType = "TEST_OF"
-
-	// TestToolOfRelationship is to be used when SPDXRef-A is used as a test tool for SPDXRef-B.
-	// Example: Any tool used to test the code such as ESlint.
-	TestToolOfRelationship RelationshipType = "TEST_TOOL_OF"
-
-	// DocumentationOfRelationship is to be used when SPDXRef-A provides documentation of SPDXRef-B.
-	// Example: A DOCUMENTATION file readme.txt documents the APPLICATION 'zlib'.
-	DocumentationOfRelationship RelationshipType = "DOCUMENTATION_OF"
-
-	// OptionalComponentOfRelationship is to be used when SPDXRef-A is an optional component of SPDXRef-B.
-	// Example: A SOURCE file fool.c (which is in the contributors directory) may or may not be included in the build of APPLICATION 'atthebar'.
-	OptionalComponentOfRelationship RelationshipType = "OPTIONAL_COMPONENT_OF"
-
-	// MetafileOfRelationship is to be used when SPDXRef-A is a metafile of SPDXRef-B.
-	// Example: A SOURCE file pom.xml is a metafile of the APPLICATION 'Apache Xerces'.
-	MetafileOfRelationship RelationshipType = "METAFILE_OF"
-
-	// PackageOfRelationship is to be used when SPDXRef-A is used as a package as part of SPDXRef-B.
-	// Example: A Linux distribution contains an APPLICATION package gawk as part of the distribution MyLinuxDistro.
-	PackageOfRelationship RelationshipType = "PACKAGE_OF"
-
-	// AmendsRelationship is to be used when (current) SPDXRef-DOCUMENT amends the SPDX information in SPDXRef-B.
-	// Example: (Current) SPDX document A version 2 contains a correction to a previous version of the SPDX document A version 1. Note the reserved identifier SPDXRef-DOCUMENT for the current document is required.
-	AmendsRelationship RelationshipType = "AMENDS"
-
-	// PrerequisiteForRelationship is to be used when SPDXRef-A is a prerequisite for SPDXRef-B.
-	// Example: A library bar.dll is a prerequisite or dependency for APPLICATION foo.exe
-	PrerequisiteForRelationship RelationshipType = "PREREQUISITE_FOR"
-
-	// HasPrerequisiteRelationship is to be used when SPDXRef-A has as a prerequisite SPDXRef-B.
-	// Example: An APPLICATION foo.exe has prerequisite or dependency on bar.dll
-	HasPrerequisiteRelationship RelationshipType = "HAS_PREREQUISITE"
-
-	// OtherRelationship is to be used for a relationship which has not been defined in the formal SPDX specification. A description of the relationship should be included in the Relationship comments field.
-	OtherRelationship RelationshipType = "OTHER"
-)
@@ -1,32 +0,0 @@
-package spdx22
-
-type StartPointer struct {
-	Offset     int `json:"offset,omitempty"`
-	LineNumber int `json:"lineNumber,omitempty"`
-	// SPDX ID for File
-	Reference string `json:"reference"`
-}
-
-type EndPointer struct {
-	Offset     int `json:"offset,omitempty"`
-	LineNumber int `json:"lineNumber,omitempty"`
-	// SPDX ID for File
-	Reference string `json:"reference"`
-}
-
-type Range struct {
-	StartPointer StartPointer `json:"startPointer"`
-	EndPointer   EndPointer   `json:"endPointer"`
-}
-
-type Snippet struct {
-	Item
-	// Licensing information that was discovered directly in the subject snippet. This is also considered a declared
-	// license for the snippet. (elements are license expressions)
-	LicenseInfoInSnippets []string `json:"licenseInfoInSnippets"`
-	// SPDX ID for File. File containing the SPDX element (e.g. the file contaning a snippet).
-	SnippetFromFile string `json:"snippetFromFile"`
-	// (At least 1 range is required). This field defines the byte range in the original host file (in X.2) that the
-	// snippet information applies to.
-	Ranges []Range `json:"ranges"`
-}
@@ -1,3 +0,0 @@
-package spdx22
-
-const Version = "SPDX-2.2"
@@ -1,34 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1" serialNumber="urn:uuid:5404937f-72d6-44a2-8e9b-954305ecb4f6">
-  <metadata>
-    <timestamp>2021-06-23T13:40:33-04:00</timestamp>
-    <tools>
-      <tool>
-        <vendor>anchore</vendor>
-        <name>syft</name>
-        <version>[not provided]</version>
-      </tool>
-    </tools>
-    <component type="file">
-      <name>/some/path</name>
-      <version></version>
-    </component>
-  </metadata>
-  <components>
-    <component type="library">
-      <name>package-1</name>
-      <version>1.0.1</version>
-      <licenses>
-        <license>
-          <name>MIT</name>
-        </license>
-      </licenses>
-      <purl>a-purl-2</purl>
-    </component>
-    <component type="library">
-      <name>package-2</name>
-      <version>2.0.1</version>
-      <purl>a-purl-2</purl>
-    </component>
-  </components>
-</bom>
@@ -1,34 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1" serialNumber="urn:uuid:e34bad2e-cd27-483c-86dc-f4e26d6103b0">
-  <metadata>
-    <timestamp>2021-06-23T13:40:33-04:00</timestamp>
-    <tools>
-      <tool>
-        <vendor>anchore</vendor>
-        <name>syft</name>
-        <version>[not provided]</version>
-      </tool>
-    </tools>
-    <component type="container">
-      <name>user-image-input</name>
-      <version>sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368</version>
-    </component>
-  </metadata>
-  <components>
-    <component type="library">
-      <name>package-1</name>
-      <version>1.0.1</version>
-      <licenses>
-        <license>
-          <name>MIT</name>
-        </license>
-      </licenses>
-      <purl>a-purl-1</purl>
-    </component>
-    <component type="library">
-      <name>package-2</name>
-      <version>2.0.1</version>
-      <purl>a-purl-2</purl>
-    </component>
-  </components>
-</bom>
@@ -1,86 +0,0 @@
-{
- "artifacts": [
-  {
-   "id": "package-1-id",
-   "name": "package-1",
-   "version": "1.0.1",
-   "type": "python",
-   "foundBy": "the-cataloger-1",
-   "locations": [
-    {
-     "path": "/some/path/pkg1"
-    }
-   ],
-   "licenses": [
-    "MIT"
-   ],
-   "language": "python",
-   "cpes": [
-    "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"
-   ],
-   "purl": "a-purl-2",
-   "metadataType": "PythonPackageMetadata",
-   "metadata": {
-    "name": "package-1",
-    "version": "1.0.1",
-    "license": "",
-    "author": "",
-    "authorEmail": "",
-    "platform": "",
-    "files": [
-     {
-      "path": "/some/path/pkg1/depedencies/foo"
-     }
-    ],
-    "sitePackagesRootPath": ""
-   }
-  },
-  {
-   "id": "package-2-id",
-   "name": "package-2",
-   "version": "2.0.1",
-   "type": "deb",
-   "foundBy": "the-cataloger-2",
-   "locations": [
-    {
-     "path": "/some/path/pkg1"
-    }
-   ],
-   "licenses": [],
-   "language": "",
-   "cpes": [
-    "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"
-   ],
-   "purl": "a-purl-2",
-   "metadataType": "DpkgMetadata",
-   "metadata": {
-    "package": "package-2",
-    "source": "",
-    "version": "2.0.1",
-    "sourceVersion": "",
-    "architecture": "",
-    "maintainer": "",
-    "installedSize": 0,
-    "files": null
-   }
-  }
- ],
- "artifactRelationships": [],
- "source": {
-  "type": "directory",
-  "target": "/some/path"
- },
- "distro": {
-  "name": "debian",
-  "version": "1.2.3",
-  "idLike": "like!"
- },
- "descriptor": {
-  "name": "syft",
-  "version": "[not provided]"
- },
- "schema": {
-  "version": "1.1.0",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-1.1.0.json"
- }
-}
@@ -1,108 +0,0 @@
-{
- "artifacts": [
-  {
-   "id": "package-1-id",
-   "name": "package-1",
-   "version": "1.0.1",
-   "type": "python",
-   "foundBy": "the-cataloger-1",
-   "locations": [
-    {
-     "path": "/somefile-1.txt",
-     "layerID": "sha256:ffb5e9eaa453a002110719d12c294960117ca2903953d1faa40f01dc3f77045c"
-    }
-   ],
-   "licenses": [
-    "MIT"
-   ],
-   "language": "python",
-   "cpes": [
-    "cpe:2.3:*:some:package:1:*:*:*:*:*:*:*"
-   ],
-   "purl": "a-purl-1",
-   "metadataType": "PythonPackageMetadata",
-   "metadata": {
-    "name": "package-1",
-    "version": "1.0.1",
-    "license": "",
-    "author": "",
-    "authorEmail": "",
-    "platform": "",
-    "sitePackagesRootPath": ""
-   }
-  },
-  {
-   "id": "package-2-id",
-   "name": "package-2",
-   "version": "2.0.1",
-   "type": "deb",
-   "foundBy": "the-cataloger-2",
-   "locations": [
-    {
-     "path": "/somefile-2.txt",
-     "layerID": "sha256:8463854829fc53d47b9dcdf7ee79fe7eb4ca7933c910f67f8521412f7a2f5c21"
-    }
-   ],
-   "licenses": [],
-   "language": "",
-   "cpes": [
-    "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"
-   ],
-   "purl": "a-purl-2",
-   "metadataType": "DpkgMetadata",
-   "metadata": {
-    "package": "package-2",
-    "source": "",
-    "version": "2.0.1",
-    "sourceVersion": "",
-    "architecture": "",
-    "maintainer": "",
-    "installedSize": 0,
-    "files": null
-   }
-  }
- ],
- "artifactRelationships": [],
- "source": {
-  "type": "image",
-  "target": {
-   "userInput": "user-image-input",
-   "imageID": "sha256:112851310e48e604f7379e2a3acddab50e91ce926edacb598a532e60ff6b776a",
-   "manifestDigest": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368",
-   "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
-   "tags": [
-    "stereoscope-fixture-image-simple:85066c51088bdd274f7a89e99e00490f666c49e72ffc955707cd6e18f0e22c5b"
-   ],
-   "imageSize": 38,
-   "layers": [
-    {
-     "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:ffb5e9eaa453a002110719d12c294960117ca2903953d1faa40f01dc3f77045c",
-     "size": 22
-    },
-    {
-     "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:8463854829fc53d47b9dcdf7ee79fe7eb4ca7933c910f67f8521412f7a2f5c21",
-     "size": 16
-    }
-   ],
-   "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NzMsImRpZ2VzdCI6InNoYTI1NjoxMTI4NTEzMTBlNDhlNjA0ZjczNzllMmEzYWNkZGFiNTBlOTFjZTkyNmVkYWNiNTk4YTUzMmU2MGZmNmI3NzZhIn0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1NjpmZmI1ZTllYWE0NTNhMDAyMTEwNzE5ZDEyYzI5NDk2MDExN2NhMjkwMzk1M2QxZmFhNDBmMDFkYzNmNzcwNDVjIn0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2Ojg0NjM4NTQ4MjlmYzUzZDQ3YjlkY2RmN2VlNzlmZTdlYjRjYTc5MzNjOTEwZjY3Zjg1MjE0MTJmN2EyZjVjMjEifV19",
-   "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8iLCJPbkJ1aWxkIjpudWxsfSwiY3JlYXRlZCI6IjIwMjEtMDktMDhUMTc6MjE6NTguODk2NTI5MTkyWiIsImhpc3RvcnkiOlt7ImNyZWF0ZWQiOiIyMDIxLTA5LTA4VDE3OjIxOjU4Ljg3OTY5MDgyNFoiLCJjcmVhdGVkX2J5IjoiQUREIGZpbGUtMS50eHQgL3NvbWVmaWxlLTEudHh0ICMgYnVpbGRraXQiLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCJ9LHsiY3JlYXRlZCI6IjIwMjEtMDktMDhUMTc6MjE6NTguODk2NTI5MTkyWiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0yLnR4dCAvc29tZWZpbGUtMi50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6ZmZiNWU5ZWFhNDUzYTAwMjExMDcxOWQxMmMyOTQ5NjAxMTdjYTI5MDM5NTNkMWZhYTQwZjAxZGMzZjc3MDQ1YyIsInNoYTI1Njo4NDYzODU0ODI5ZmM1M2Q0N2I5ZGNkZjdlZTc5ZmU3ZWI0Y2E3OTMzYzkxMGY2N2Y4NTIxNDEyZjdhMmY1YzIxIl19fQ==",
-   "repoDigests": [],
-   "scope": "Squashed"
-  }
- },
- "distro": {
-  "name": "debian",
-  "version": "1.2.3",
-  "idLike": "like!"
- },
- "descriptor": {
-  "name": "syft",
-  "version": "[not provided]"
- },
- "schema": {
-  "version": "1.1.0",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-1.1.0.json"
- }
-}
@@ -1,79 +0,0 @@
-{
- "SPDXID": "SPDXRef-DOCUMENT",
- "name": "/some/path",
- "spdxVersion": "SPDX-2.2",
- "creationInfo": {
-  "created": "2021-10-12T18:40:22.948394Z",
-  "creators": [
-   "Organization: Anchore, Inc",
-   "Tool: syft-[not provided]"
-  ],
-  "licenseListVersion": "3.14"
- },
- "dataLicense": "CC0-1.0",
- "documentNamespace": "https:/anchore.com/syft/dir/some/path-98ae71fb-f276-4c5c-acf7-25770bf7bca2",
- "packages": [
-  {
-   "SPDXID": "SPDXRef-Package-python-package-1-1.0.1",
-   "name": "package-1",
-   "licenseConcluded": "MIT",
-   "downloadLocation": "NOASSERTION",
-   "externalRefs": [
-    {
-     "referenceCategory": "SECURITY",
-     "referenceLocator": "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*",
-     "referenceType": "cpe23Type"
-    },
-    {
-     "referenceCategory": "PACKAGE_MANAGER",
-     "referenceLocator": "a-purl-2",
-     "referenceType": "purl"
-    }
-   ],
-   "filesAnalyzed": false,
-   "hasFiles": [
-    "SPDXRef-File-package-1-efae7fecc76ca25da40f79d7ef5b8933510434914835832c7976f3e866aa756a"
-   ],
-   "licenseDeclared": "MIT",
-   "sourceInfo": "acquired package info from installed python package manifest file: /some/path/pkg1",
-   "versionInfo": "1.0.1"
-  },
-  {
-   "SPDXID": "SPDXRef-Package-deb-package-2-2.0.1",
-   "name": "package-2",
-   "licenseConcluded": "NONE",
-   "downloadLocation": "NOASSERTION",
-   "externalRefs": [
-    {
-     "referenceCategory": "SECURITY",
-     "referenceLocator": "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*",
-     "referenceType": "cpe23Type"
-    },
-    {
-     "referenceCategory": "PACKAGE_MANAGER",
-     "referenceLocator": "a-purl-2",
-     "referenceType": "purl"
-    }
-   ],
-   "filesAnalyzed": false,
-   "licenseDeclared": "NONE",
-   "sourceInfo": "acquired package info from DPKG DB: /some/path/pkg1",
-   "versionInfo": "2.0.1"
-  }
- ],
- "files": [
-  {
-   "SPDXID": "SPDXRef-File-package-1-efae7fecc76ca25da40f79d7ef5b8933510434914835832c7976f3e866aa756a",
-   "name": "foo",
-   "licenseConcluded": "",
-   "fileName": "/some/path/pkg1/dependencies/foo"
-  }
- ],
- "relationships": [
-  {
-   "spdxElementId": "SPDXRef-Package-python-package-1-1.0.1",
-   "relationshipType": "CONTAINS",
-   "relatedSpdxElement": "SPDXRef-File-package-1-efae7fecc76ca25da40f79d7ef5b8933510434914835832c7976f3e866aa756a"
-  }
- ]
-}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Alex Goodman	f2aa4caf55	[wip] git-root config search concept Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2021-11-30 16:43:41 -05:00
Alex Goodman	fe616acd98	directory resolver should account for the proc cwd relative to the root path (#644 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2021-11-30 15:34:37 -05:00
Blaize KayeandAlex Goodman	6af132e088	Adds composer installed.json parser (#643 ) * Adds installed.json functionality and tests Signed-off-by: Blaize Kaye <blaize.kaye@amazee.com> * Adds php-installed-cataloger Signed-off-by: Blaize Kaye <blaize.kaye@amazee.com> * Changes fallback logic Signed-off-by: Blaize Kaye <blaize.kaye@amazee.com> * Adds image tests for installed.json composer packages Signed-off-by: Blaize Kaye <blaize.kaye@amazee.com> * tweak PHP cataloger names Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * unexport PHP types and fix CLI tests Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * rename PHP cataloger file Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>	2021-11-30 11:36:08 -05:00
Alex Goodman	00206233e6	use smaller jotframe event buffer (#647 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2021-11-30 11:23:16 -05:00
Alex Goodman	bd9007fc0e	Migrate SPDX-JSON relationships to SBOM model (#634 ) * remove power-user document shape Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add power-user specific fields to syft-json format Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * port remaining spdx-json relationships to sbom model Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add coordinate set Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add SBOM file path helper Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * use internal mimetype helper in go binary cataloger Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add new package-of relationship Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update json schema to v2 Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * replace power-user presenter with syft-json format Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * fix tests and linting Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * remove "package-of" relationship (in favor of "contains") Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add tests for spdx22json format encoding enhancements Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update TODO and log entries Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * introduce sbom.Descriptor Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2021-11-23 14:54:17 -05:00
Alex Goodman	e3b34813d7	ignore partybus unsubscribe errors (#641 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2021-11-22 16:07:55 -05:00
Dan Luhring	f0b2d81599	Announce meetup on 2021-12-01 (#640 ) Signed-off-by: Dan Luhring <dan+github@luhrings.com>	2021-11-22 10:13:18 -05:00
Christopher Angelo Phillips	0849539729	Update concurrency primitives for relationships in command layer (#639 ) * update concurrency primitives for relationships in command layer Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>	2021-11-20 03:44:17 -05:00
Christopher Angelo Phillips	4f0099583a	promote catalog task pattern to all commands (#636 ) Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>	2021-11-19 13:26:23 -05:00
Alex Goodman	d76c868481	Catalog archive contents for single-file input (#637 ) * add first-level archive processing when input is a file Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add license exception for github.com/xi2/xz Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * always return cleanup function Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * change source.NewFromFile log entry to warn Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * ensure file source always has cleanup function Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * ensure we are always preferring the unarchive cleanup function for source Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2021-11-19 14:16:25 +00:00
Alex GoodmanandDan Luhring	e38cde35ed	Introduce minimal source coordinates (#623 ) * split source.Location and create source.Coordinates for minimal path addressing Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * move coordinates into separate file Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * Update syft/source/coordinates.go Co-authored-by: Dan Luhring <luhring@users.noreply.github.com>	2021-11-18 18:13:22 +00:00
Alex Goodman	9090c3a772	bump stereoscope, docker, and GGCR (#633 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2021-11-16 19:43:46 +00:00
Alex Goodman	ef627d82ef	Introduce relationships as first-class objects (#607 ) * migrate pkg.ID and pkg.Relationship to artifact package Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * return relationships from tasks Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * fix more tests Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add artifact.Identifiable by Identity() method Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * fix linting Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * remove catalog ID assignment Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * adjust spdx helpers to use copy of packages Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * stabilize package ID relative to encode-decode format cycles Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * rename Identity() to ID() Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * use zero value for nils in ID generation Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * enable source.Location to be identifiable Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * hoist up package relationship discovery to analysis stage Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update ownership-by-file-overlap relationship description Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add test reminders to put new relationships under test Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * adjust PHP composer.lock parser function to return relationships Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2021-11-16 14:14:13 -05:00
Christopher Angelo Phillips	45ea4177e8	update SPDX license list => 3.15 (#630 ) * update SPDX license list Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>	2021-11-15 14:41:46 -05:00
Alex Goodman	e28b7b53b0	bump chronicle to v0.3.0 (#627 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2021-11-13 18:56:25 -08:00
Christopher Angelo Phillips	fc39710d06	287 - Add retry for image fetch using user's input (#626 ) * add fallback to user input if source hint fails Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com> * refactor for smaller functions Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>	2021-11-12 17:57:04 -05:00
Swathi Gangisetty	e732f419f8	Add new distro and mapping to support Rocky Linux distro identification (#624 ) Signed-off-by: Swathi Gangisetty <swathi@anchore.com>	2021-11-12 13:10:21 -08:00
NikitaandAlex Goodman	25835ef589	PHP parser composer.lock (#609 ) * PHP parse composer.lock Signed-off-by: Nikita <33390074+Zilborg@users.noreply.github.com> * rename PHP package type Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add PHP composer package support to source info SPDX helper Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update directory cataloger integration tests (make exception for images) Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>	2021-11-10 14:08:41 -05:00
Christopher Angelo Phillips	319c6ee2eb	document current draft for iana submission (#618 ) * document current draft for IANA submission Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>	2021-11-10 11:28:47 -05:00
Alex Goodman	9c27fa7b0b	use sbom.SBOM in ImportConfig (#621 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2021-11-08 18:39:06 -05:00
Christopher Angelo PhillipsandAlex Goodman	9bbc9ff633	Add layer information for go-module-binary-cataloger (#620 ) * update functions to pass Location Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com> * update unit tests to pass new locations Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com> * fix image source.FileResolvers to include layer info Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add non-empty location in golang binary cataloger testing Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>	2021-11-08 16:05:53 -05:00
Alex GoodmanandChristopher Angelo Phillips	bb0f35bac4	Introduce a single SBOM document (#606 ) * [wip] single sbom doc Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * fix tests Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * fix more tests Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * fix linting Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update cli tests Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * remove scope in import path Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * swap SPDX tag-value formatter to single sbom document Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * bust CLI cache Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update fixture to byte diff Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com> * byte for byte Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com> * bust the cache Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com> * who needs cache Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com> * add jar for testing Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com> * no more bit flips Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com> * update apk with the delta for image and directory cases Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com> * restore cache workflow Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com> Co-authored-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>	2021-11-05 10:05:49 -04:00
Jonas Galvão Xavier	6d0ee326d8	ignore irregular files while indexing directory (#616 ) * stop hidding command from help doc Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * do not index irregular files Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * fix fixture dir and err name Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * improve the description of irregular files Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * explicitly check indexed file name Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>	2021-11-04 11:24:05 -07:00
Alex Goodman	23a67dd729	document file scheme (#613 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2021-11-02 19:47:25 -04:00
Christopher Angelo Phillips	3e20edee55	update readme with private registry section (#610 )	2021-11-02 15:00:56 -04:00
Alex Goodman	8ec3f1d102	Use anchore fork of go-presenter (#611 ) * use anchore fork of go-presenter Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * drop coverage threshold Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2021-11-02 18:09:26 +00:00
Alex Goodman	ecab44bba1	Add SPDX tag-value format object (#605 ) * add new spdx tag-value format Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * remove public presenter package Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2021-11-02 13:45:34 -04:00
Alex GoodmanandChristopher Angelo Phillips	484284706c	Use named pipe bit when checking for piped input (#603 ) * use named pipe bit when checking for piped input Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>	2021-11-02 16:41:02 +00:00
Alex Goodman	3ac95ac4f6	Allow for cataloging a single file (#608 ) * allow for cataloging a single file Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * use all catalogers for file schemes Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2021-11-02 12:09:06 -04:00