use anchore/go-logger interface

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

.github/scripts/apple-signing/.gitignore

@@ -0,0 +1,3 @@
+dev-pki
+log
+signing-identity.txt

.github/scripts/apple-signing/cleanup.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -eu
+
+# grab utilities
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+. "$SCRIPT_DIR"/utils.sh
+
+# cleanup any dev certs left behind
+. "$SCRIPT_DIR"/setup-dev.sh
+cleanup_signing

.github/scripts/apple-signing/notarize.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+set -ue
+
+set +xu
+if [ -z "$AC_USERNAME" ]; then
+  exit_with_error "AC_USERNAME not set"
+fi
+
+if [ -z "$AC_PASSWORD" ]; then
+  exit_with_error "AC_PASSWORD not set"
+fi
+set -u
+
+# repackage [archive-path]
+#
+# returns an archive compatible for Apple's notarization process, repackaging the input archive as needed
+#
+repackage() {
+  archive=$1
+
+  case "$archive" in
+    *.tar.gz)
+      new_archive=${archive%.tar.gz}.zip
+      (
+        tmp_dir=$(mktemp -d)
+        cd "$tmp_dir"
+        # redirect stdout to stderr to preserve the return value
+        tar xzf "$archive" && zip "$new_archive" ./* 1>&2
+        rm -rf "$tmp_dir"
+      )
+      echo "$new_archive"
+      ;;
+    *.zip)
+      echo "$archive"
+      ;;
+    *) return 1
+      ;;
+  esac
+}
+
+# notarize [archive-path]
+#
+notarize() {
+  archive_path=$1
+
+  title "notarizing binaries found in the release archive"
+
+  payload_archive_path=$(repackage "$archive_path")
+  if [ "$?" != "0" ]; then
+    exit_with_error "cannot prepare payload for notarization: $archive_path"
+  fi
+
+  if [ ! -f "$payload_archive_path" ]; then
+    exit_with_error "cannot find payload for notarization: $payload_archive_path"
+  fi
+
+  # install gon
+  which gon || (brew tap mitchellh/gon && brew install mitchellh/gon/gon)
+
+  # create config (note: json via stdin with gon is broken, can only use HCL from file)
+  tmp_file=$(mktemp).hcl
+
+  cat <<EOF > "$tmp_file"
+notarize {
+  path = "$payload_archive_path"
+  bundle_id = "com.anchore.toolbox.syft"
+}
+
+apple_id {
+   username = "$AC_USERNAME"
+   password = "@env:AC_PASSWORD"
+}
+EOF
+
+  gon -log-level info "$tmp_file"
+
+  result="$?"
+
+  rm "$tmp_file"
+
+  if [ "$result" -ne "0" ]; then
+      exit_with_error "notarization failed"
+  fi
+}
+

.github/scripts/apple-signing/setup-dev.sh

@@ -0,0 +1,171 @@
+#!/usr/bin/env bash
+set -eu
+
+NAME=syft-dev
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+DIR=$SCRIPT_DIR/dev-pki
+FILE_PREFIX=$DIR/$NAME
+IDENTITY=${NAME}-id-415d8c69793
+
+## OpenSSL material
+
+KEY_PASSWORD="letthedevin"
+P12_PASSWORD="popeofnope"
+
+KEY_FILE=$FILE_PREFIX-key.pem
+CSR_FILE=$FILE_PREFIX-csr.pem
+CERT_FILE=$FILE_PREFIX-cert.pem
+EXT_FILE=$FILE_PREFIX-ext.cnf
+P12_FILE=$FILE_PREFIX.p12
+
+EXT_SECTION=codesign_reqext
+
+## Keychain material
+
+KEYCHAIN_NAME=$NAME
+KEYCHAIN_PATH=$HOME/Library/Keychains/$KEYCHAIN_NAME-db
+KEYCHAIN_PASSWORD="topsykretts"
+
+# setup_signing
+#
+# preps the MAC_SIGNING_IDENTITY env var for use in the signing process, using ephemeral developer certificate material
+#
+function setup_signing() {
+  # check to see if this has already been done... if so, bail!
+  set +ue
+  if security find-identity -p codesigning "$KEYCHAIN_PATH" | grep $IDENTITY ; then
+      export MAC_SIGNING_IDENTITY=$IDENTITY
+      commentary "skipping creating dev certificate material (already exists)"
+      commentary "setting MAC_SIGNING_IDENTITY=${IDENTITY}"
+      return 0
+  fi
+  set -ue
+
+  title "setting up developer certificate material"
+
+  mkdir -p "${DIR}"
+
+  # configure the openssl extensions
+  cat << EOF > $EXT_FILE
+  [ req ]
+  default_bits          = 2048                  # RSA key size
+  encrypt_key           = yes                   # Protect private key
+  default_md            = sha256                # MD to use
+  utf8                  = yes                   # Input is UTF-8
+  string_mask           = utf8only              # Emit UTF-8 strings
+  prompt                = yes                   # Prompt for DN
+  distinguished_name    = codesign_dn           # DN template
+  req_extensions        = $EXT_SECTION          # Desired extensions
+
+  [ codesign_dn ]
+  commonName            = $IDENTITY
+  commonName_max        = 64
+
+  [ $EXT_SECTION ]
+  keyUsage              = critical,digitalSignature
+  extendedKeyUsage      = critical,codeSigning
+  subjectKeyIdentifier  = hash
+EOF
+
+  title "create the private key"
+  openssl genrsa \
+            -des3 \
+            -out "$KEY_FILE" \
+            -passout "pass:$KEY_PASSWORD" \
+           2048
+
+  title "create the csr"
+  openssl req \
+            -new \
+            -key "$KEY_FILE" \
+            -out "$CSR_FILE" \
+            -passin "pass:$KEY_PASSWORD" \
+            -config "$EXT_FILE" \
+            -subj "/CN=$IDENTITY"
+
+  commentary "verify the csr: we should see X509 v3 extensions for codesigning in the CSR"
+  openssl req -in "$CSR_FILE" -noout -text | grep -A1 "X509v3" || exit_with_error "could not find x509 extensions in CSR"
+
+  title "create the certificate"
+  # note: Extensions in certificates are not transferred to certificate requests and vice versa. This means that
+  # just because the CSR has x509 v3 extensions doesn't mean that you'll see these extensions in the cert output.
+  # To prove this do:
+  # 	openssl x509 -text -noout -in server.crt | grep -A10 "X509v3 extensions:"
+  # ... and you will see no output (if -extensions is not used). (see https://www.openssl.org/docs/man1.1.0/man1/x509.html#BUGS)
+  # To get the extensions, use "-extensions codesign_reqext" when creating the cert. The codesign_reqext value matches
+  # the section name in the ext file used in CSR / cert creation (-extfile and -config).
+  openssl x509 \
+            -req \
+            -days 10000 \
+            -in "$CSR_FILE" \
+            -signkey "$KEY_FILE" \
+            -out "$CERT_FILE" \
+            -extfile "$EXT_FILE" \
+            -passin "pass:$KEY_PASSWORD" \
+            -extensions $EXT_SECTION
+
+  commentary "verify the certificate: we should see our extensions"
+  openssl x509 -text -noout -in $CERT_FILE | grep -A1 'X509v3' || exit_with_error "could not find x509 extensions in certificate"
+
+  title "export cert and private key to .p12 file"
+  # note: this step may be entirely optional, however, I found it useful to follow the prod path which goes the route of using a p12
+  openssl pkcs12 \
+            -export \
+            -out "$P12_FILE" \
+            -inkey "$KEY_FILE" \
+            -in "$CERT_FILE" \
+            -passin "pass:$KEY_PASSWORD" \
+            -passout "pass:$P12_PASSWORD"
+
+
+  title "create the dev keychain"
+
+  # delete the keychain if it already exists
+  if [ -f "$(KEYCHAIN_PATH)" ]; then
+    security delete-keychain "$KEYCHAIN_NAME" &> /dev/null
+  fi
+
+  security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"
+
+  set +e
+  if ! security verify-cert -k "$KEYCHAIN_PATH" -c "$CERT_FILE" &> /dev/null; then
+    set -e
+    title "import the cert into the dev keychain if it is not already trusted by the system"
+
+    security import "$P12_FILE" -P $P12_PASSWORD -f pkcs12 -k "$KEYCHAIN_PATH" -T /usr/bin/codesign
+
+    # note: set the partition list for this certificate's private key to include "apple-tool:" and "apple:" allows the codesign command to access this keychain item without an interactive user prompt.
+    security set-key-partition-list -S "apple-tool:,apple:,codesign:" -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+
+    # note: add-trusted-cert requires user interaction
+    commentary "adding the developer certificate as a trusted certificate... (requires user interaction)"
+    security add-trusted-cert -d -r trustRoot -k "$KEYCHAIN_PATH" "$CERT_FILE"
+  else
+    set -e
+    commentary "...dev cert has already been imported onto the dev keychain"
+  fi
+
+  # remove any generated cert material since the keychain now has all of this material loaded
+  rm -rf "${DIR}"
+
+  commentary "make certain there are identities that can be used for code signing"
+  security find-identity -p codesigning "$KEYCHAIN_PATH" | grep -C 30 "$IDENTITY" || exit_with_error "could not find identity that can be used with codesign"
+
+  title "add the dev keychain to the search path for codesign"
+  add_keychain $KEYCHAIN_NAME
+
+  commentary "verify the keychain actually shows up"
+  security list-keychains | grep "$KEYCHAIN_NAME" || exit_with_error "could not find new keychain"
+
+  export MAC_SIGNING_IDENTITY=$IDENTITY
+  commentary "setting MAC_SIGNING_IDENTITY=${IDENTITY}"
+
+}
+
+function cleanup_signing() {
+  title "delete the dev keychain and all certificate material"
+  set -xue
+  security delete-keychain "$KEYCHAIN_NAME"
+  rm -f "$KEYCHAIN_PATH"
+  rm -rf "${DIR}"
+}

.github/scripts/apple-signing/setup-prod.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+set -eu
+
+assert_in_ci
+
+set +xu
+if [ -z "$APPLE_DEVELOPER_ID_CERT" ]; then
+  exit_with_error "APPLE_DEVELOPER_ID_CERT not set"
+fi
+
+if [ -z "$APPLE_DEVELOPER_ID_CERT_PASS" ]; then
+  exit_with_error "APPLE_DEVELOPER_ID_CERT_PASS not set"
+fi
+
+if [ -z "$DOCKER_USERNAME" ]; then
+  exit_with_error "DOCKER_USERNAME not set"
+fi
+
+if [ -z "$DOCKER_PASSWORD" ]; then
+  exit_with_error "DOCKER_PASSWORD not set"
+fi
+set -u
+
+# setup_signing
+#
+# preps the MAC_SIGNING_IDENTITY env var for use in the signing process, using production certificate material
+#
+setup_signing() {
+  title "setting up production certificate material"
+
+  # Write signing certificate to disk from environment variable.
+  cert_file="$HOME/developer_id_certificate.p12"
+  echo -n "$APPLE_DEVELOPER_ID_CERT" | base64 --decode > "$cert_file"
+
+  # In order to have all keychain interactions avoid an interactive user prompt, we need to control the password for the keychain in question, which means we need to create a new keychain into which we'll import the signing certificate and from which we'll later access this certificate during code signing.
+  ephemeral_keychain="ci-ephemeral-keychain"
+  ephemeral_keychain_password="$(openssl rand -base64 100)"
+  security create-keychain -p "${ephemeral_keychain_password}" "${ephemeral_keychain}"
+
+  # Import signing certificate into the keychain. (This is a pre-requisite for gon, which is invoked via goreleaser.)
+  ephemeral_keychain_full_path="$HOME/Library/Keychains/${ephemeral_keychain}-db"
+  security import "${cert_file}" -k "${ephemeral_keychain_full_path}" -P "${APPLE_DEVELOPER_ID_CERT_PASS}" -T "$(command -v codesign)"
+
+  # Setting the partition list for this certificate's private key to include "apple-tool:" and "apple:" allows the codesign command to access this keychain item without an interactive user prompt. (codesign is invoked by gon.)
+  security set-key-partition-list -S "apple-tool:,apple:" -s -k "${ephemeral_keychain_password}" "${ephemeral_keychain_full_path}"
+
+  # Make this new keychain the user's default keychain, so that codesign will be able to find this certificate when we specify it during signing.
+  security default-keychain -d "user" -s "${ephemeral_keychain_full_path}"
+
+  # TODO: extract this from the certificate material itself
+  export MAC_SIGNING_IDENTITY="Developer ID Application: ANCHORE, INC. (9MJHKYX5AT)"
+  commentary "setting MAC_SIGNING_IDENTITY=${MAC_SIGNING_IDENTITY}"
+
+  commentary "log into docker -- required for publishing (since the default keychain has now been replaced)"
+  echo "${DOCKER_PASSWORD}" | docker login docker.io -u "${DOCKER_USERNAME}"  --password-stdin
+}

.github/scripts/apple-signing/setup.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+set -eu
+
+IS_SNAPSHOT="$1"
+
+## grab utilities
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+. "$SCRIPT_DIR"/utils.sh
+
+main() {
+
+  case "$IS_SNAPSHOT" in
+
+    "1" |  "true" | "yes")
+      commentary "assuming development setup..."
+      . "$SCRIPT_DIR"/setup-dev.sh
+      ;;
+
+    "0" |  "false" | "no")
+      commentary "assuming production setup..."
+      . "$SCRIPT_DIR"/setup-prod.sh
+      ;;
+
+    *)
+      exit_with_error "could not determine if this was a production build (isSnapshot='$IS_SNAPSHOT')"
+      ;;
+  esac
+
+  # load up all signing material into a keychain (note: this should set the MAC_SIGNING_IDENTITY env var)
+  setup_signing
+
+  # write out identity to a file
+  echo -n "$MAC_SIGNING_IDENTITY" > "$SCRIPT_DIR/$SIGNING_IDENTITY_FILENAME"
+}
+
+set +u
+if [ -z "$SCRIPT" ]
+then
+    set -u
+    # log all output
+    mkdir -p "$SCRIPT_DIR/log"
+    /usr/bin/script "$SCRIPT_DIR/log/setup.txt" /bin/bash -c "$0 $*"
+    exit $?
+elif [ -n "$SKIP_SIGNING" ]; then
+    commentary "skipping signing setup..."
+else
+  set -u
+  main
+fi

.github/scripts/apple-signing/sign.sh

@@ -0,0 +1,140 @@
+#!/usr/bin/env bash
+set -eu
+
+ARCHIVE_PATH="$1"
+IS_SNAPSHOT="$2"
+
+## grab utilities
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+. "$SCRIPT_DIR"/utils.sh
+
+
+# sign_binary [binary-path] [signing-identity]
+#
+# signs a single binary with cosign
+#
+sign_binary() {
+  exe_path=$1
+  identity=$2
+
+  if [ -x "$exe_path" ] && file -b "$exe_path" | grep -q "Mach-O"
+  then
+      echo "signing $exe_path ..."
+  else
+      echo "skip signing $exe_path ..."
+      return 0
+  fi
+
+  codesign \
+    -s "$identity" \
+    -f \
+    --verbose=4 \
+    --timestamp \
+    --options runtime \
+      $exe_path
+
+  if [ $? -ne 0 ]; then
+      exit_with_error "signing failed"
+  fi
+
+  codesign --verify "$exe_path"  --verbose=4
+
+  if [ $? -ne 0 ]; then
+      exit_with_error "signing verification failed"
+  fi
+}
+
+# sign_binaries_in_archive [archive-abs-path] [signing-identity]
+#
+# signs all binaries within an archive (there must be at least one)
+#
+sign_binaries_in_archive() {
+  archive_abs_path=$1
+  identity=$2
+
+  scratch_path=$(mktemp -d)
+  trap "rm -rf -- $scratch_path" EXIT
+
+  title "getting contents from the release archive: $archive_abs_path"
+  tar -C "$scratch_path" -xvf "$archive_abs_path"
+
+  # invalidate the current archive, we only want an asset with signed binaries from this point forward
+  rm "$archive_abs_path"
+
+  title "signing binaries found in the release archive"
+
+  discovered_binaries=0
+  tmp_pipe=$(mktemp -ut pipe.XXX)
+  mkfifo "$tmp_pipe"
+
+  find "$scratch_path" -perm +111 -type f > "$tmp_pipe" &
+
+  while IFS= read -r binary; do
+    sign_binary "$binary" "$identity"
+    ((discovered_binaries++))
+  done < "$tmp_pipe"
+
+  rm "$tmp_pipe"
+
+  if [ "$discovered_binaries" = "0" ]; then
+      exit_with_error "found no binaries to sign"
+  fi
+
+  title "recreating the release archive: $archive_abs_path"
+  (cd "$scratch_path" && tar -czvf "$archive_abs_path" .)
+}
+
+
+main() {
+  archive_abs_path=$(realpath "$ARCHIVE_PATH")
+
+  if [ ! -f "$archive_abs_path" ]; then
+      echo "archive does not exist: $archive_abs_path"
+  fi
+
+  case "$IS_SNAPSHOT" in
+
+    "1" |  "true" | "yes")
+      commentary "disabling notarization..."
+      perform_notarization=false
+      ;;
+
+    "0" |  "false" | "no")
+      commentary "enabling notarization..."
+      . "$SCRIPT_DIR"/notarize.sh
+      perform_notarization=true
+      ;;
+
+    *)
+      exit_with_error "could not determine if this was a production build (isSnapshot='$IS_SNAPSHOT')"
+      ;;
+  esac
+
+  # grab the signing identity from the local temp file (setup by setup.sh)
+  MAC_SIGNING_IDENTITY=$(cat "$SCRIPT_DIR/$SIGNING_IDENTITY_FILENAME")
+
+  # sign all of the binaries in the archive and recreate the input archive with the signed binaries
+  sign_binaries_in_archive "$archive_abs_path" "$MAC_SIGNING_IDENTITY"
+
+  # send all of the binaries off to apple to bless
+  if $perform_notarization ; then
+    notarize "$archive_abs_path"
+  else
+    commentary "skipping notarization..."
+  fi
+}
+
+set +u
+if [ -z "$SCRIPT" ]
+then
+    set -u
+    # log all output
+    mkdir -p "$SCRIPT_DIR/log"
+    /usr/bin/script "$SCRIPT_DIR/log/signing-$(basename $ARCHIVE_PATH).txt" /bin/bash -c "$0 $*"
+    exit $?
+elif [ -n "$SKIP_SIGNING" ]; then
+    commentary "skipping signing..."
+else
+  set -u
+  main
+fi

.github/scripts/apple-signing/utils.sh

@@ -0,0 +1,78 @@
+SIGNING_IDENTITY_FILENAME=signing-identity.txt
+
+## terminal goodies
+PURPLE='\033[0;35m'
+GREEN='\033[0;32m'
+RED='\033[0;31m'
+BOLD=$(tput -T linux bold)
+RESET='\033[0m'
+
+function success() {
+  echo -e "\n${GREEN}${BOLD}$@${RESET}"
+}
+
+function title() {
+  success "Task: $@"
+}
+
+function commentary() {
+  echo -e "\n${PURPLE}# $@${RESET}"
+}
+
+function error() {
+  echo -e "${RED}${BOLD}error: $@${RESET}"
+}
+
+function exit_with_error() {
+  error $@
+  exit 1
+}
+
+function exit_with_message() {
+  success $@
+  exit 0
+}
+
+function realpath {
+  echo "$(cd $(dirname $1); pwd)/$(basename $1)";
+}
+
+
+# this function adds all of the existing keychains plus the new one which is the same as going to Keychain Access
+# and selecting "Add Keychain" to make the keychain visible under "Custom Keychains". This is done with
+# "security list-keychains -s" for some reason. The downside is that this sets the search path, not appends
+# to it, so you will loose existing keychains in the search path... which is truly terrible.
+function add_keychain() {
+  keychains=$(security list-keychains -d user)
+  keychainNames=();
+  for keychain in $keychains
+  do
+    basename=$(basename "$keychain")
+    keychainName=${basename::${#basename}-4}
+    keychainNames+=("$keychainName")
+  done
+
+  echo "existing user keychains: ${keychainNames[@]}"
+
+  security -v list-keychains -s "${keychainNames[@]}" "$1"
+}
+
+function exit_not_ci() {
+    printf "WARNING! It looks like this isn't the CI environment. This script modifies the macOS Keychain setup in ways you probably wouldn't want for your own machine. It also requires an Apple Developer ID Certificate that you shouldn't have outside of the CI environment.\n\nExiting early to make sure nothing bad happens.\n"
+    exit 1
+}
+
+CI_HOME="/Users/runner"
+
+function assert_in_ci() {
+
+  if [[ "${HOME}" != "${CI_HOME}" ]]; then
+    exit_not_ci
+  fi
+
+  set +u
+  if [ -z "${GITHUB_ACTIONS}" ]; then
+    exit_not_ci
+  fi
+  set -u
+}

.github/scripts/goreleaser-install.sh

@@ -338,7 +338,7 @@ hash_sha256_verify() {
 		return 1
 	fi
 	BASENAME=${TARGET##*/}
-	want=$(grep "${BASENAME}" "${checksums}" 2>/dev/null | tr '\t' ' ' | cut -d ' ' -f 1)
+	want=$(grep "${BASENAME}$" "${checksums}" 2>/dev/null | tr '\t' ' ' | cut -d ' ' -f 1)
 	if [ -z "$want" ]; then
 		log_err "hash_sha256_verify unable to find checksum for '${TARGET}' in '${checksums}'"
 		return 1

.github/scripts/mac-prepare-for-signing.sh

@@ -1,31 +0,0 @@
-#!/usr/bin/env bash
-set -eu
-
-CI_HOME="/Users/runner"
-if [[ "${HOME}" != "${CI_HOME}" ]]; then
-  printf "WARNING! It looks like this isn't the CI environment. This script modifies the macOS Keychain setup in ways you probably wouldn't want for your own machine. It also requires an Apple Developer ID Certificate that you shouldn't have outside of the CI environment.\n\nExiting early to make sure nothing bad happens.\n"
-  exit 1
-fi
-
-# Install gon (see https://github.com/mitchellh/gon for details).
-brew tap mitchellh/gon
-brew install mitchellh/gon/gon
-
-# Write signing certificate to disk from environment variable.
-CERT_FILE="$HOME/developer_id_certificate.p12"
-echo -n "$APPLE_DEVELOPER_ID_CERT" | base64 --decode > "$CERT_FILE"
-
-# In order to have all keychain interactions avoid an interactive user prompt, we need to control the password for the keychain in question, which means we need to create a new keychain into which we'll import the signing certificate and from which we'll later access this certificate during code signing.
-EPHEMERAL_KEYCHAIN="ci-ephemeral-keychain"
-EPHEMERAL_KEYCHAIN_PASSWORD="$(openssl rand -base64 100)"
-security create-keychain -p "${EPHEMERAL_KEYCHAIN_PASSWORD}" "${EPHEMERAL_KEYCHAIN}"
-
-# Import signing certificate into the keychain. (This is a pre-requisite for gon, which is invoked via goreleaser.)
-EPHEMERAL_KEYCHAIN_FULL_PATH="$HOME/Library/Keychains/${EPHEMERAL_KEYCHAIN}-db"
-security import "${CERT_FILE}" -k "${EPHEMERAL_KEYCHAIN_FULL_PATH}" -P "${APPLE_DEVELOPER_ID_CERT_PASS}" -T "$(command -v codesign)"
-
-# Setting the partition list for this certificate's private key to include "apple-tool:" and "apple:" allows the codesign command to access this keychain item without an interactive user prompt. (codesign is invoked by gon.)
-security set-key-partition-list -S "apple-tool:,apple:" -s -k "${EPHEMERAL_KEYCHAIN_PASSWORD}" "${EPHEMERAL_KEYCHAIN_FULL_PATH}"
-
-# Make this new keychain the user's default keychain, so that codesign will be able to find this certificate when we specify it during signing.
-security default-keychain -d "user" -s "${EPHEMERAL_KEYCHAIN_FULL_PATH}"

.github/scripts/mac-sign-and-notarize.sh

@@ -1,19 +0,0 @@
-#!/usr/bin/env bash
-set -eu
-
-IS_SNAPSHOT="$1"                        # e.g. "true", "false"
-
-if [[ "${IS_SNAPSHOT}" == "true" ]]; then
-  # This is a snapshot build —— skipping signing and notarization...
-  exit 0
-fi
-
-GON_CONFIG="$2"                                       # e.g. "gon.hcl"
-NEW_NAME_WITHOUT_EXTENSION="$3"                       # e.g. "./dist/syft-0.1.0"
-ORIGINAL_NAME_WITHOUT_EXTENSION="./dist/output"       # This should match dmg and zip output_path in the gon config file, without the extension.
-
-gon "${GON_CONFIG}"
-
-# Rename outputs with specified desired name
-mv -v "${ORIGINAL_NAME_WITHOUT_EXTENSION}.dmg" "${NEW_NAME_WITHOUT_EXTENSION}.dmg"
-mv -v "${ORIGINAL_NAME_WITHOUT_EXTENSION}.zip" "${NEW_NAME_WITHOUT_EXTENSION}.zip"

.github/scripts/verify-signature.sh

@@ -1,14 +0,0 @@
-#!/usr/bin/env bash
-set -ue
-
-DISTDIR=$1
-
-export FINGERPRINT=$(gpg --verify ${DISTDIR}/*checksums.txt.sig ${DISTDIR}/*checksums.txt 2>&1 | grep 'using RSA key' | awk '{ print $NF }')
-
-if [[ "${FINGERPRINT}" == "${SIGNING_FINGERPRINT}" ]]; then
-    echo 'verified signature'
-else
-    echo "signed with unknown fingerprint: ${FINGERPRINT}"
-    echo "           expected fingerprint: ${SIGNING_FINGERPRINT}"
-    exit 1
-fi

.github/workflows/release.yaml

@@ -14,7 +14,7 @@ env:
 jobs:
   quality-gate:
     environment: release
-    runs-on: ubuntu-latest # This OS choice is arbitrary. None of the steps in this job are specific to either Linux or macOS.
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
 
@@ -92,7 +92,8 @@ jobs:
 
   release:
     needs: [quality-gate]
-    runs-on: macos-latest # Due to our code signing process, it's vital that we run our release steps on macOS.
+    # due to our code signing process, it's vital that we run our release steps on macOS
+    runs-on: macos-latest
     steps:
       - uses: docker-practice/actions-setup-docker@v1
 
@@ -124,35 +125,21 @@ jobs:
         if: steps.tool-cache.outputs.cache-hit != 'true' || steps.go-cache.outputs.cache-hit != 'true'
         run: make bootstrap
 
-      - name: Import GPG key
-        id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@v2
-        env:
-          GPG_PRIVATE_KEY: ${{ secrets.SIGNING_GPG_PRIVATE_KEY }}
-          PASSPHRASE: ${{ secrets.SIGNING_GPG_PASSPHRASE }}
-
-      - name: GPG signing info
-        run: |
-          echo "fingerprint: ${{ steps.import_gpg.outputs.fingerprint }}"
-          echo "keyid:       ${{ steps.import_gpg.outputs.keyid }}"
-          echo "name:        ${{ steps.import_gpg.outputs.name }}"
-          echo "email:       ${{ steps.import_gpg.outputs.email }}"
-
       - name: Build & publish release artifacts
         run: make release
         env:
           DOCKER_USERNAME: ${{ secrets.TOOLBOX_DOCKER_USER }}
           DOCKER_PASSWORD: ${{ secrets.TOOLBOX_DOCKER_PASS }}
+          # we use a different token than GITHUB_SECRETS to additionally allow updating the homebrew repos
           GITHUB_TOKEN: ${{ secrets.ANCHORE_GIT_READ_TOKEN }}
-          GPG_PRIVATE_KEY: ${{ secrets.SIGNING_GPG_PRIVATE_KEY }}
-          PASSPHRASE: ${{ secrets.SIGNING_GPG_PASSPHRASE }}
-          SIGNING_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
           AWS_ACCESS_KEY_ID: ${{ secrets.TOOLBOX_AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLBOX_AWS_SECRET_ACCESS_KEY }}
-          APPLE_DEVELOPER_ID_CERT: ${{ secrets.APPLE_DEVELOPER_ID_CERT }} # Used during macOS code signing.
-          APPLE_DEVELOPER_ID_CERT_PASS: ${{ secrets.APPLE_DEVELOPER_ID_CERT_PASS }} # Used during macOS code signing.
-          AC_USERNAME: ${{ secrets.ENG_CI_APPLE_ID }} # Used during macOS notarization.
-          AC_PASSWORD: ${{ secrets.ENG_CI_APPLE_ID_PASS }} # Used during macOS notarization.
+          # used during macOS code signing
+          APPLE_DEVELOPER_ID_CERT: ${{ secrets.APPLE_DEVELOPER_ID_CERT }}
+          APPLE_DEVELOPER_ID_CERT_PASS: ${{ secrets.APPLE_DEVELOPER_ID_CERT_PASS }}
+          # used during macOS notarization
+          AC_USERNAME: ${{ secrets.ENG_CI_APPLE_ID }}
+          AC_PASSWORD: ${{ secrets.ENG_CI_APPLE_ID_PASS }}
 
       - uses: anchore/sbom-action@v0
         with:

.github/workflows/validations.yaml

@@ -276,8 +276,30 @@ jobs:
           name: artifacts
           path: snapshot
 
-      - name: Run Acceptance Tests (Linux)
-        run: make acceptance-linux
+      - name: Run comparison tests (Linux)
+        run: make compare-linux
+
+      - name: Build key for image cache
+        run: make install-fingerprint
+
+      - name: Restore install.sh test image cache
+        id: install-test-image-cache
+        uses: actions/cache@v2.1.3
+        with:
+          path: ${{ github.workspace }}/test/install/cache
+          key: ${{ runner.os }}-install-test-image-cache-${{ hashFiles('test/install/cache.fingerprint') }}
+
+      - name: Load test image cache
+        if: steps.install-test-image-cache.outputs.cache-hit == 'true'
+        run: make install-test-cache-load
+
+      - name: Run install.sh tests (Linux)
+        run: make install-test
+
+      - name: (cache-miss) Create test image cache
+        if: steps.install-test-image-cache.outputs.cache-hit != 'true'
+        run: make install-test-cache-save
+
 
   Acceptance-Mac:
     # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
@@ -292,15 +314,18 @@ jobs:
           name: artifacts
           path: snapshot
 
-      - name: Restore docker image cache
-        id: go-cache
+      - name: Restore docker image cache for compare testing
+        id: mac-compare-testing-cache
         uses: actions/cache@v2.1.3
         with:
           path: image.tar
-          key: ${{ runner.os }}-${{ hashFiles('test/acceptance/mac.sh') }}
+          key: ${{ runner.os }}-${{ hashFiles('test/compare/mac.sh') }}
 
-      - name: Run Acceptance Tests (Mac)
-        run: make acceptance-mac
+      - name: Run comparison tests (Mac)
+        run: make compare-mac
+
+      - name: Run install.sh tests (Mac)
+        run: make install-test-ci-mac
 
   Cli-Linux:
     # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline

.gitignore

@@ -18,6 +18,7 @@ CHANGELOG.md
 .images
 .tmp/
 coverage.txt
+bin/
 
 # Binaries for programs and plugins
 *.exe

.goreleaser.yaml

@@ -1,100 +1,81 @@
 release:
-  # If set to auto, will mark the release as not ready for production in case there is an indicator for this in the
-  # tag e.g. v1.0.0-rc1 .If set to true, will mark the release as not ready for production.
   prerelease: auto
-
-  # If set to true, will not auto-publish the release. This is done to allow us to review the changelog before publishing.
   draft: true
 
+env:
+  # required to support multi architecture docker builds
+  - DOCKER_CLI_EXPERIMENTAL=enabled
+
+before:
+  hooks:
+    - ./.github/scripts/apple-signing/setup.sh {{ .IsSnapshot }}
+
 builds:
-  - binary: syft
-    id: syft
-    env:
-      - CGO_ENABLED=0
+  - id: linux-build
+    binary: syft
     goos:
       - linux
     goarch:
       - amd64
       - arm64
-    # Set the modified timestamp on the output binary to the git timestamp (to ensure a reproducible build)
-    mod_timestamp: '{{ .CommitTimestamp }}'
-    ldflags: |
+    # set the modified timestamp on the output binary to the git timestamp to ensure a reproducible build
+    mod_timestamp: &build-timestamp '{{ .CommitTimestamp }}'
+    env: &build-env
+      - CGO_ENABLED=0
+    ldflags: &build-ldflags |
       -w
       -s
       -extldflags '-static'
       -X github.com/anchore/syft/internal/version.version={{.Version}}
       -X github.com/anchore/syft/internal/version.gitCommit={{.Commit}}
       -X github.com/anchore/syft/internal/version.buildDate={{.Date}}
-      -X github.com/anchore/syft/internal/version.gitTreeState={{.Env.BUILD_GIT_TREE_STATE}}
+      -X github.com/anchore/syft/internal/version.gitDescription={{.Summary}}
 
-  - binary: syft
-    id: syft-win
-    env:
-      - CGO_ENABLED=0
-    goos:
-      - windows
-    goarch:
-      - amd64
-    # Set the modified timestamp on the output binary to the git timestamp (to ensure a reproducible build)
-    mod_timestamp: '{{ .CommitTimestamp }}'
-    ldflags: |
-      -w
-      -s
-      -extldflags '-static'
-      -X github.com/anchore/syft/internal/version.version={{.Version}}
-      -X github.com/anchore/syft/internal/version.gitCommit={{.Commit}}
-      -X github.com/anchore/syft/internal/version.buildDate={{.Date}}
-      -X github.com/anchore/syft/internal/version.gitTreeState={{.Env.BUILD_GIT_TREE_STATE}}
-
-    # For more info on this macOS build, see: https://github.com/mitchellh/gon#usage-with-goreleaser
-  - binary: syft
-    id: syft-macos
-    env:
-      - CGO_ENABLED=0
+  - id: darwin-build
+    binary: syft
     goos:
       - darwin
     goarch:
       - amd64
       - arm64
-    # Set the modified timestamp on the output binary to the git timestamp (to ensure a reproducible build)
-    mod_timestamp: '{{ .CommitTimestamp }}'
-    ldflags: |
-      -w
-      -s
-      -extldflags '-static'
-      -X github.com/anchore/syft/internal/version.version={{.Version}}
-      -X github.com/anchore/syft/internal/version.gitCommit={{.Commit}}
-      -X github.com/anchore/syft/internal/version.buildDate={{.Date}}
-      -X github.com/anchore/syft/internal/version.gitTreeState={{.Env.BUILD_GIT_TREE_STATE}}
+    mod_timestamp: *build-timestamp
+    env: *build-env
+    ldflags: *build-ldflags
+
+  - id: windows-build
+    binary: syft
+    goos:
+      - windows
+    goarch:
+      - amd64
+    mod_timestamp: *build-timestamp
+    env: *build-env
+    ldflags: *build-ldflags
 
 archives:
-  - format: tar.gz
+  - id: linux-archives
     builds:
-      - syft # i.e. Linux only
-  - format: zip # This is a hack for syft-macos! We don't actually intend to use _this_ ZIP file, we just need goreleaser to consider the ZIP file produced by gon (which will have the same file name) to be an artifact so we can use it downstream in publishing (e.g. to a homebrew tap)
-    id: syft-zip
+      - linux-build
+
+  # note: the signing process is depending on tar.gz archives. If this format changes then .github/scripts/apple-signing/*.sh will need to be adjusted
+  - id: darwin-archives
     builds:
-      - syft-macos
-      - syft-win
+      - darwin-build
+
+  - id: windows-archives
+    format: zip
+    builds:
+      - windows-build
 
 signs:
-  - artifacts: checksum
-    cmd: sh
-    args:
-      - '-c'
-      # we should not include the zip artifact, as the artifact is mutated throughout the next macOS notarization step
-      # note: sed -i is not portable
-      - 'sed "/.*\.zip/d" ${artifact} > tmpfile && mv tmpfile ${artifact} && gpg --output ${signature} --detach-sign ${artifact}'
-  - id: syft-macos-signing
+  - artifacts: archive
     ids:
-      - syft-macos
-    cmd: ./.github/scripts/mac-sign-and-notarize.sh
-    signature: "syft_${VERSION}_darwin_amd64.dmg" # This is somewhat unintuitive. This gets the DMG file recognized as an artifact. In fact, both a DMG and a ZIP file are being produced by this signing step.
+      - darwin-archives
+    signature: "${artifact}"
+    cmd: ./.github/scripts/apple-signing/sign.sh
     args:
+      - "${artifact}"
       - "{{ .IsSnapshot }}"
-      - "gon.hcl"
-      - "./dist/syft_{{ .Version }}_darwin_amd64"
-    artifacts: all
 
 nfpms:
   - license: "Apache 2.0"
@@ -109,8 +90,12 @@ brews:
   - tap:
       owner: anchore
       name: homebrew-syft
+    ids:
+      - darwin-archives
+      - linux-archives
     homepage: *website
     description: *description
+    license: "Apache License 2.0"
 
 dockers:
   - image_templates:

DEVELOPING.md

@@ -0,0 +1,179 @@
+# Developing
+
+## Getting started
+
+In order to test and develop in this repo you will need the following dependencies installed:
+- docker
+- make
+
+After cloning do the following:
+1. run `make bootstrap` to download go mod dependencies, create the `/.tmp` dir, and download helper utilities.
+2. run `make` to run linting, tests, and other verifications to make certain everything is working alright.
+
+Checkout `make help` to see what other actions you can take.
+
+The main make tasks for common static analysis and testing are `lint`, `lint-fix`, `unit`, `integration`, and `cli`.
+
+## Levels of testing
+
+- `unit`: The default level of test which is distributed throughout the repo are unit tests. Any `_test.go` file that 
+  does not reside somewhere within the `/test` directory is a unit test. Other forms of testing should be organized in 
+  the `/test` directory. These tests should focus on correctness of functionality in depth. % Test coverage metrics 
+  only considers unit tests and no other forms of testing.
+
+- `integration`: located within `test/integration`, these tests focus on the behavior surfaced by the common library 
+  entrypoints from the `syft` package and make light assertions about the results surfaced. Additionally, these tests
+  tend to make diversity assertions for enum-like objects, ensuring that as enum values are added to a definition
+  that integration tests will automatically fail if no test attempts to use that enum value. For more details see 
+  the "Data diversity and freshness assertions" section below.
+
+- `cli`: located with in `test/cli`, these are tests that test the correctness of application behavior from a 
+  snapshot build. This should be used in cases where a unit or integration test will not do or if you are looking
+  for in-depth testing of code in the `cmd/` package (such as testing the proper behavior of application configuration,
+  CLI switches, and glue code before syft library calls).
+
+- `acceptance`: located within `test/compare` and `test/install`, these are smoke-like tests that ensure that application  
+  packaging and installation works as expected. For example, during release we provide RPM packages as a download 
+  artifact. We also have an accompanying RPM acceptance test that installs the RPM from a snapshot build and ensures the 
+  output of a syft invocation matches canned expected output. New acceptance tests should be added for each release artifact
+  and architecture supported (when possible).
+
+### Data diversity and freshness assertions
+
+It is important that tests against the codebase are flexible enough to begin failing when they do not cover "enough"
+of the objects under test. "Cover" in this case does not mean that some percentage of the code has been executed 
+during testing, but instead that there is enough diversity of data input reflected in testing relative to the
+definitions available.
+
+For instance, consider an enum-like value like so:
+```go
+type Language string
+
+const (
+  Java            Language = "java"
+  JavaScript      Language = "javascript"
+  Python          Language = "python"
+  Ruby            Language = "ruby"
+  Go              Language = "go"
+)
+```
+
+Say we have a test that exercises all the languages defined today:
+
+```go
+func TestCatalogPackages(t *testing.T) {
+  testTable := []struct {
+    // ... the set of test cases that test all languages
+  }
+  for _, test := range cases {
+    t.Run(test.name, func (t *testing.T) {
+      // use inputFixturePath and assert that syft.CatalogPackages() returns the set of expected Package objects
+      // ...
+    })
+  }
+}
+```
+
+Where each test case has a `inputFixturePath` that would result with packages from each language. This test is
+brittle since it does not assert that all languages were exercised directly and future modifications (such as 
+adding a new language) won't be covered by any test cases.
+
+To address this the enum-like object should have a definition of all objects that can be used in testing:
+
+```go
+type Language string
+
+// const( Java Language = ..., ... )
+
+var AllLanguages = []Language{
+	Java,
+	JavaScript,
+	Python,
+	Ruby,
+	Go,
+	Rust,
+}
+```
+
+Allowing testing to automatically fail when adding a new language:
+
+```go
+func TestCatalogPackages(t *testing.T) {
+  testTable := []struct {
+  	// ... the set of test cases that (hopefully) covers all languages
+  }
+
+  // new stuff...
+  observedLanguages := strset.New()
+  
+  for _, test := range cases {
+    t.Run(test.name, func (t *testing.T) {
+      // use inputFixturePath and assert that syft.CatalogPackages() returns the set of expected Package objects
+    	// ...
+    	
+    	// new stuff...
+    	for _, actualPkg := range actual {
+        observedLanguages.Add(string(actualPkg.Language))
+    	}
+    	
+    })
+  }
+
+   // new stuff...
+  for _, expectedLanguage := range pkg.AllLanguages {
+    if 	!observedLanguages.Contains(expectedLanguage) {
+      t.Errorf("failed to test language=%q", expectedLanguage)	
+    }
+  }
+}
+```
+
+This is a better test since it will fail when someone adds a new language but fails to write a test case that should
+exercise that new language. This method is ideal for integration-level testing, where testing correctness in depth 
+is not needed (that is what unit tests are for) but instead testing in breadth to ensure that units are well integrated.
+
+A similar case can be made for data freshness; if the quality of the results will be diminished if the input data
+is not kept up to date then a test should be written (when possible) to assert any input data is not stale.
+
+An example of this is the static list of licenses that is stored in `internal/spdxlicense` for use by the SPDX 
+presenters. This list is updated and published periodically by an external group and syft can grab and update this
+list by running `go generate ./...` from the root of the repo.
+
+An integration test has been written to grabs the latest license list version externally and compares that version
+with the version generated in the codebase. If they differ, the test fails, indicating to someone that there is an
+action needed to update it.
+
+**_The key takeaway is to try and write tests that fail when data assumptions change and not just when code changes.**_
+
+### Snapshot tests
+
+The format objects make a lot of use of "snapshot" testing, where you save the expected output bytes from a call into the
+git repository and during testing make a comparison of the actual bytes from the subject under test with the golden
+copy saved in the repo. The "golden" files are stored in the `test-fixtures/snapshot` directory relative to the go 
+package under test and should always be updated by invoking `go test` on the specific test file with a specific CLI 
+update flag provided.
+
+Many of the `Format` tests make use of this approach, where the raw SBOM report is saved in the repo and the test 
+compares that SBOM with what is generated from the latest presenter code. For instance, at the time of this writing 
+the CycloneDX presenter snapshots can be updated by running:
+
+```bash
+go test ./internal/formats -update-cyclonedx
+```
+
+These flags are defined at the top of the test files that have tests that use the snapshot files.
+
+Snapshot testing is only as good as the manual verification of the golden snapshot file saved to the repo! Be careful 
+and diligent when updating these files.
+
+## Architecture
+
+TODO: outline:
+- analysis creates a static SBOM which can be encoded and decoded.
+- format objects, should strive to not add or enrich data in encoding that could otherwise be done during analysis
+- pkg.Catalogers
+- file catalogers
+- source.Source
+- file.Resolvers
+- logger abstraction 
+- events / bus abstraction 

Dockerfile

@@ -16,13 +16,14 @@ ARG BUILD_VERSION
 ARG VCS_REF
 ARG VCS_URL
 
-LABEL org.label-schema.schema-version="1.0"
-LABEL org.label-schema.build-date=$BUILD_DATE
-LABEL org.label-schema.name="syft"
-LABEL org.label-schema.description="CLI tool and library for generating a Software Bill of Materials from container images and filesystems"
-LABEL org.label-schema.vcs-url=$VCS_URL
-LABEL org.label-schema.vcs-ref=$VCS_REF
-LABEL org.label-schema.vendor="Anchore, Inc."
-LABEL org.label-schema.version=$BUILD_VERSION
+LABEL org.opencontainers.image.created=$BUILD_DATE
+LABEL org.opencontainers.image.title="syft"
+LABEL org.opencontainers.image.description="CLI tool and library for generating a Software Bill of Materials from container images and filesystems"
+LABEL org.opencontainers.image.source=$VCS_URL
+LABEL org.opencontainers.image.revision=$VCS_REF
+LABEL org.opencontainers.image.vendor="Anchore, Inc."
+LABEL org.opencontainers.image.version=$BUILD_VERSION
+LABEL org.opencontainers.image.licenses="Apache-2.0"
+
 
 ENTRYPOINT ["/syft"]

Makefile

@@ -4,8 +4,12 @@ RESULTSDIR = test/results
 COVER_REPORT = $(RESULTSDIR)/unit-coverage-details.txt
 COVER_TOTAL = $(RESULTSDIR)/unit-coverage-summary.txt
 LINTCMD = $(TEMPDIR)/golangci-lint run --tests=false --timeout=2m --config .golangci.yaml
-ACC_TEST_IMAGE = centos:8.2.2004
-ACC_DIR = ./test/acceptance
+RELEASE_CMD=$(TEMPDIR)/goreleaser release --rm-dist
+SNAPSHOT_CMD=$(RELEASE_CMD) --skip-publish --snapshot
+COMPARE_TEST_IMAGE = centos:8.2.2004
+COMPARE_DIR = ./test/compare
+
+# formatting variables
 BOLD := $(shell tput -T linux bold)
 PURPLE := $(shell tput -T linux setaf 5)
 GREEN := $(shell tput -T linux setaf 2)
@@ -14,28 +18,20 @@ RED := $(shell tput -T linux setaf 1)
 RESET := $(shell tput -T linux sgr0)
 TITLE := $(BOLD)$(PURPLE)
 SUCCESS := $(BOLD)$(GREEN)
+
 # the quality gate lower threshold for unit test total % coverage (by function statements)
 COVERAGE_THRESHOLD := 62
+
 # CI cache busting values; change these if you want CI to not use previous stored cache
-INTEGRATION_CACHE_BUSTER="88738d2f"
-CLI_CACHE_BUSTER="9a2c03cf"
+INTEGRATION_CACHE_BUSTER="894d8ca"
+CLI_CACHE_BUSTER="894d8ca"
 BOOTSTRAP_CACHE="c7afb99ad"
 
 ## Build variables
 DISTDIR=./dist
 SNAPSHOTDIR=./snapshot
-GITTREESTATE=$(if $(shell git status --porcelain),dirty,clean)
-OS := $(shell uname)
-
-ifeq ($(OS),Darwin)
-	SNAPSHOT_CMD=$(shell realpath $(shell pwd)/$(SNAPSHOTDIR)/$(BIN)-macos_darwin_amd64/$(BIN))
-else
-	SNAPSHOT_CMD=$(shell realpath $(shell pwd)/$(SNAPSHOTDIR)/$(BIN)_linux_amd64/$(BIN))
-endif
-
-ifeq "$(strip $(VERSION))" ""
- override VERSION = $(shell git describe --always --tags --dirty)
-endif
+OS=$(shell uname | tr '[:upper:]' '[:lower:]')
+SNAPSHOT_BIN=$(shell realpath $(shell pwd)/$(SNAPSHOTDIR)/$(OS)-build_$(OS)_amd64/$(BIN))
 
 ## Variable assertions
 
@@ -47,8 +43,8 @@ ifndef RESULTSDIR
 	$(error RESULTSDIR is not set)
 endif
 
-ifndef ACC_DIR
-	$(error ACC_DIR is not set)
+ifndef COMPARE_DIR
+	$(error COMPARE_DIR is not set)
 endif
 
 ifndef DISTDIR
@@ -67,14 +63,22 @@ define title
     @printf '$(TITLE)$(1)$(RESET)\n'
 endef
 
+define safe_rm_rf
+	bash -c 'test -z "$(1)" && false || rm -rf $(1)'
+endef
+
+define safe_rm_rf_children
+	bash -c 'test -z "$(1)" && false || rm -rf $(1)/*'
+endef
+
 ## Tasks
 
 .PHONY: all
-all: clean static-analysis test ## Run all linux-based checks (linting, license check, unit, integration, and linux acceptance tests)
+all: clean static-analysis test ## Run all linux-based checks (linting, license check, unit, integration, and linux compare tests)
 	@printf '$(SUCCESS)All checks pass!$(RESET)\n'
 
 .PHONY: test
-test: unit validate-cyclonedx-schema integration benchmark acceptance-linux cli ## Run all tests (currently unit, integration, linux acceptance, and cli tests)
+test: unit validate-cyclonedx-schema integration benchmark compare-linux cli ## Run all tests (currently unit, integration, linux compare, and cli tests)
 
 .PHONY: help
 help:
@@ -98,9 +102,9 @@ $(TEMPDIR):
 bootstrap-tools: $(TEMPDIR)
 	GO111MODULE=off GOBIN=$(shell realpath $(TEMPDIR)) go get -u golang.org/x/perf/cmd/benchstat
 	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(TEMPDIR)/ v1.42.1
-	curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMPDIR)/ v0.2.0
+	curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMPDIR)/ v0.3.0
 	curl -sSfL https://raw.githubusercontent.com/anchore/chronicle/main/install.sh | sh -s -- -b $(TEMPDIR)/ v0.3.0
-	.github/scripts/goreleaser-install.sh -b $(TEMPDIR)/ v0.177.0
+	.github/scripts/goreleaser-install.sh -d -b $(TEMPDIR)/ v1.3.1
 	GOBIN="$(shell realpath $(TEMPDIR))" go install github.com/neilpa/yajsv@v1.4.0
 
 .PHONY: bootstrap-go
@@ -167,20 +171,42 @@ benchmark: $(RESULTSDIR) ## Run benchmark tests and compare against the baseline
 show-benchstat:
 	@cat $(RESULTSDIR)/benchstat.txt
 
+# note: this is used by CI to determine if the install test fixture cache (docker image tars) should be busted
+install-fingerprint:
+	cd test/install && \
+		make cache.fingerprint
+
+install-test: $(SNAPSHOTDIR)
+	cd test/install && \
+		make
+
+install-test-cache-save: $(SNAPSHOTDIR)
+	cd test/install && \
+		make save
+
+install-test-cache-load: $(SNAPSHOTDIR)
+	cd test/install && \
+		make load
+
+install-test-ci-mac: $(SNAPSHOTDIR)
+	cd test/install && \
+		make ci-test-mac
+
 .PHONY: integration
 integration: ## Run integration tests
 	$(call title,Running integration tests)
-
 	go test -v ./test/integration
 
 # note: this is used by CI to determine if the integration test fixture cache (docker image tars) should be busted
 integration-fingerprint:
-	find test/integration/test-fixtures/image-* -type f -exec md5sum {} + | awk '{print $1}' | sort | md5sum | tee test/integration/test-fixtures/cache.fingerprint && echo "$(INTEGRATION_CACHE_BUSTER)" >> test/integration/test-fixtures/cache.fingerprint
+	$(call title,Integration test fixture fingerprint)
+	find test/integration/test-fixtures/image-* -type f -exec md5sum {} + | awk '{print $1}' | sort | tee /dev/stderr | md5sum | tee test/integration/test-fixtures/cache.fingerprint && echo "$(INTEGRATION_CACHE_BUSTER)" >> test/integration/test-fixtures/cache.fingerprint
 
 .PHONY: java-packages-fingerprint
 java-packages-fingerprint:
-	@cd syft/pkg/cataloger/java/test-fixtures/java-builds && \
-	make packages.fingerprint
+	$(call title,Java test fixture fingerprint)
+	cd syft/pkg/cataloger/java/test-fixtures/java-builds && \
+		make packages.fingerprint
 
 .PHONY: fixtures
 fixtures:
@@ -201,57 +227,72 @@ build: $(SNAPSHOTDIR) ## Build release snapshot binaries and packages
 
 $(SNAPSHOTDIR): ## Build snapshot release binaries and packages
 	$(call title,Building snapshot artifacts)
+
 	# create a config with the dist dir overridden
 	echo "dist: $(SNAPSHOTDIR)" > $(TEMPDIR)/goreleaser.yaml
 	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml
 
 	# build release snapshots
-	# DOCKER_CLI_EXPERIMENTAL needed to support multi architecture builds for goreleaser
-	BUILD_GIT_TREE_STATE=$(GITTREESTATE) \
-	DOCKER_CLI_EXPERIMENTAL=enabled \
-	$(TEMPDIR)/goreleaser release --skip-publish --skip-sign --rm-dist --snapshot --config $(TEMPDIR)/goreleaser.yaml
+	bash -c "SKIP_SIGNING=true $(SNAPSHOT_CMD) --skip-sign --config $(TEMPDIR)/goreleaser.yaml"
+
+.PHONY: snapshot-with-signing
+snapshot-with-signing: ## Build snapshot release binaries and packages (with dummy signing)
+	$(call title,Building snapshot artifacts (+ signing))
+
+	# create a config with the dist dir overridden
+	echo "dist: $(SNAPSHOTDIR)" > $(TEMPDIR)/goreleaser.yaml
+	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml
+
+	rm -f .github/scripts/apple-signing/log/*.txt
+
+	# build release snapshots
+	bash -c "$(SNAPSHOT_CMD) --config $(TEMPDIR)/goreleaser.yaml || (cat .github/scripts/apple-signing/log/*.txt && false)"
+
+	# remove the keychain with the trusted self-signed cert automatically
+	.github/scripts/apple-signing/cleanup.sh
 
 # note: we cannot clean the snapshot directory since the pipeline builds the snapshot separately
-.PHONY: acceptance-mac
-acceptance-mac: $(RESULTSDIR) $(SNAPSHOTDIR) ## Run acceptance tests on build snapshot binaries and packages (Mac)
-	$(call title,Running acceptance test: Run on Mac)
-	$(ACC_DIR)/mac.sh \
+.PHONY: compare-mac
+compare-mac: $(RESULTSDIR) $(SNAPSHOTDIR) ## Run compare tests on build snapshot binaries and packages (Mac)
+	$(call title,Running compare test: Run on Mac)
+	$(COMPARE_DIR)/mac.sh \
 			$(SNAPSHOTDIR) \
-			$(ACC_DIR) \
-			$(ACC_TEST_IMAGE) \
+			$(COMPARE_DIR) \
+			$(COMPARE_TEST_IMAGE) \
 			$(RESULTSDIR)
 
 # note: we cannot clean the snapshot directory since the pipeline builds the snapshot separately
-.PHONY: acceptance-linux
-acceptance-linux: acceptance-test-deb-package-install acceptance-test-rpm-package-install ## Run acceptance tests on build snapshot binaries and packages (Linux)
+.PHONY: compare-linux
+compare-linux: compare-test-deb-package-install compare-test-rpm-package-install ## Run compare tests on build snapshot binaries and packages (Linux)
 
-.PHONY: acceptance-test-deb-package-install
-acceptance-test-deb-package-install: $(RESULTSDIR) $(SNAPSHOTDIR)
-	$(call title,Running acceptance test: DEB install)
-	$(ACC_DIR)/deb.sh \
+.PHONY: compare-test-deb-package-install
+compare-test-deb-package-install: $(RESULTSDIR) $(SNAPSHOTDIR)
+	$(call title,Running compare test: DEB install)
+	$(COMPARE_DIR)/deb.sh \
 			$(SNAPSHOTDIR) \
-			$(ACC_DIR) \
-			$(ACC_TEST_IMAGE) \
+			$(COMPARE_DIR) \
+			$(COMPARE_TEST_IMAGE) \
 			$(RESULTSDIR)
 
-.PHONY: acceptance-test-rpm-package-install
-acceptance-test-rpm-package-install: $(RESULTSDIR) $(SNAPSHOTDIR)
-	$(call title,Running acceptance test: RPM install)
-	$(ACC_DIR)/rpm.sh \
+.PHONY: compare-test-rpm-package-install
+compare-test-rpm-package-install: $(RESULTSDIR) $(SNAPSHOTDIR)
+	$(call title,Running compare test: RPM install)
+	$(COMPARE_DIR)/rpm.sh \
 			$(SNAPSHOTDIR) \
-			$(ACC_DIR) \
-			$(ACC_TEST_IMAGE) \
+			$(COMPARE_DIR) \
+			$(COMPARE_TEST_IMAGE) \
 			$(RESULTSDIR)
 
 # note: this is used by CI to determine if the integration test fixture cache (docker image tars) should be busted
 cli-fingerprint:
+	$(call title,CLI test fixture fingerprint)
 	find test/cli/test-fixtures/image-* -type f -exec md5sum {} + | awk '{print $1}' | sort | md5sum | tee test/cli/test-fixtures/cache.fingerprint && echo "$(CLI_CACHE_BUSTER)" >> test/cli/test-fixtures/cache.fingerprint
 
 .PHONY: cli
 cli: $(SNAPSHOTDIR) ## Run CLI tests
-	chmod 755 "$(SNAPSHOT_CMD)"
-	$(SNAPSHOT_CMD) version
-	SYFT_BINARY_LOCATION='$(SNAPSHOT_CMD)' \
+	chmod 755 "$(SNAPSHOT_BIN)"
+	$(SNAPSHOT_BIN) version
+	SYFT_BINARY_LOCATION='$(SNAPSHOT_BIN)' \
 		go test -count=1 -v ./test/cli
 
 .PHONY: changelog
@@ -269,30 +310,19 @@ CHANGELOG.md:
 release: clean-dist CHANGELOG.md  ## Build and publish final binaries and packages. Intended to be run only on macOS.
 	$(call title,Publishing release artifacts)
 
-	# Prepare for macOS-specific signing process
-	.github/scripts/mac-prepare-for-signing.sh
-
-	# login to docker
-	# note: the previous step creates a new keychain, so it is important to reauth into docker.io
-	@echo $${DOCKER_PASSWORD} | docker login docker.io -u $${DOCKER_USERNAME}  --password-stdin
-
 	# create a config with the dist dir overridden
 	echo "dist: $(DISTDIR)" > $(TEMPDIR)/goreleaser.yaml
 	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml
 
-	# release (note the version transformation from v0.7.0 --> 0.7.0)
-	# DOCKER_CLI_EXPERIMENTAL needed to support multi architecture builds for goreleaser
-	bash -c "\
-		BUILD_GIT_TREE_STATE=$(GITTREESTATE) \
-		VERSION=$(VERSION:v%=%) \
-		DOCKER_CLI_EXPERIMENTAL=enabled \
-		$(TEMPDIR)/goreleaser \
-			--rm-dist \
-			--config $(TEMPDIR)/goreleaser.yaml \
-			--release-notes <(cat CHANGELOG.md)"
+	rm -f .github/scripts/apple-signing/log/*.txt
 
-	# verify checksum signatures
-	.github/scripts/verify-signature.sh "$(DISTDIR)"
+	bash -c "\
+		$(RELEASE_CMD) \
+			--config $(TEMPDIR)/goreleaser.yaml \
+			--release-notes <(cat CHANGELOG.md)\
+				 || cat .github/scripts/apple-signing/log/*.txt && false"
+
+	cat .github/scripts/apple-signing/log/*.txt
 
 	# upload the version file that supports the application version update check (excluding pre-releases)
 	.github/scripts/update-version-file.sh "$(DISTDIR)" "$(VERSION)"
@@ -300,15 +330,17 @@ release: clean-dist CHANGELOG.md  ## Build and publish final binaries and packag
 
 .PHONY: clean
 clean: clean-dist clean-snapshot clean-test-image-cache ## Remove previous builds, result reports, and test cache
-	rm -rf $(RESULTSDIR)/*
+	$(call safe_rm_rf_children,$(RESULTSDIR))
 
 .PHONY: clean-snapshot
 clean-snapshot:
-	rm -rf $(SNAPSHOTDIR) $(TEMPDIR)/goreleaser.yaml
+	$(call safe_rm_rf,$(SNAPSHOTDIR))
+	rm -f $(TEMPDIR)/goreleaser.yaml
 
 .PHONY: clean-dist
 clean-dist: clean-changelog
-	rm -rf $(DISTDIR) $(TEMPDIR)/goreleaser.yaml
+	$(call safe_rm_rf,$(DISTDIR))
+	rm -f $(TEMPDIR)/goreleaser.yaml
 
 .PHONY: clean-changelog
 clean-changelog:

README.md

@@ -21,7 +21,7 @@ A CLI tool and Go library for generating a Software Bill of Materials (SBOM) fro
 
 ## Features
 - Catalog container images and filesystems to discover packages and libraries.
-- Supports packages and libraries from various ecosystems (APK, DEB, RPM, Ruby Bundles, Python Wheel/Egg/requirements.txt, JavaScript NPM/Yarn, Java JAR/EAR/WAR, Jenkins plugins JPI/HPI, Go modules)
+- Supports packages and libraries from various ecosystems (APK, DEB, RPM, Ruby Bundles, Python Wheel/Egg/requirements.txt, JavaScript NPM/Yarn, Java JAR/EAR/WAR/PAR/SAR, Jenkins plugins JPI/HPI, Go modules, PHP Composer)
 - Linux distribution identification (supports Alpine, BusyBox, CentOS/RedHat, Debian/Ubuntu flavored distributions)
 - Supports Docker and OCI image formats
 - Direct support for [Grype](https://github.com/anchore/grype), a fast and powerful vulnerability matcher.
@@ -269,7 +269,7 @@ package:
   # note: for now this only applies to the java package cataloger
   # SYFT_PACKAGE_SEARCH_UNINDEXED_ARCHIVES env var
   search-unindexed-archives: false
-   
+
   cataloger:
     # enable/disable cataloging of packages
     # SYFT_PACKAGE_CATALOGER_ENABLED env var
@@ -366,9 +366,9 @@ registry:
 
   # credentials for specific registries
   auth:
-    - # the URL to the registry (e.g. "docker.io", "localhost:5000", etc.)
+      # the URL to the registry (e.g. "docker.io", "localhost:5000", etc.)
       # SYFT_REGISTRY_AUTH_AUTHORITY env var
-      authority: ""
+    - authority: ""
       # SYFT_REGISTRY_AUTH_USERNAME env var
       username: ""
       # SYFT_REGISTRY_AUTH_PASSWORD env var
@@ -376,7 +376,7 @@ registry:
       # note: token and username/password are mutually exclusive
       # SYFT_REGISTRY_AUTH_TOKEN env var
       token: ""
-    - ... # note, more credentials can be provided via config file only
+      # - ... # note, more credentials can be provided via config file only
 
 log:
   # use structured logging
@@ -412,5 +412,36 @@ anchore:
   # (feature-preview) path to dockerfile to be uploaded with the syft results to Anchore Enterprise (supported on Enterprise 3.0+)
   # same as -d ; SYFT_ANCHORE_DOCKERFILE env var
   dockerfile: ""
-
 ```
+
+### Adding an SBOM to an image as an attestation
+SBOMs themselves can serve as input to different analysis tools. The Anchore organization offers the vulnerability scanner
+[grype](https://github.com/anchore/grype) as one such tool.
+One of the foundational approaches to "trust" between tools is for producers to use the artifacts generated by syft as attestations to their images.
+The SBOM output of syft can be used with the [cosign](https://github.com/sigstore/cosign) tool to generate an attestation that is attached to a signed image.
+
+#### Example attest
+Note for the following example replace `test/image:latest` with an image you own. You should also have push access to 
+its remote reference. Replace $MY_PRIVATE_KEY with a private key you own or have generated with cosign.
+
+```bash
+cosign sign --key $MY_PRIVATE_KEY test/image:latest
+syft test/image:latest -o json > test_latest_sbom.json
+cosign attest --predicate test_latest_sbom.json --key $MY_PRIVATE_KEY test/image:latest
+```
+
+Verify the new attestation exists on your image
+```bash
+cosign verify-attestation -key $MY_PUBLIC_KEY test/image:latest | jq '.payload |= @base64d | .payload | fromjson | .predicate.Data | fromjson | .'
+```
+
+You should see this output along with the attached SBOM.
+```
+Verification for test/image:latest --
+The following checks were performed on each of these signatures:
+  - The cosign claims were validated
+  - The signatures were verified against the specified public key
+  - Any certificates were verified against the Fulcio roots.
+```
+
+Consumers of your image can now trust that the SBOM associated with your image is correct and from a trusted source.

cmd/cmd.go

@@ -6,10 +6,10 @@ import (
 	"os"
 	"sort"
 
+	"github.com/anchore/go-logger/logrus"
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/internal/config"
 	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/logger"
 	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft"
 	"github.com/gookit/color"
@@ -88,7 +88,7 @@ func initAppConfig() {
 }
 
 func initLogging() {
-	cfg := logger.LogrusConfig{
+	cfg := logrus.Config{
 		EnableConsole: (appConfig.Log.FileLocation == "" || appConfig.CliOptions.Verbosity > 0) && !appConfig.Quiet,
 		EnableFile:    appConfig.Log.FileLocation != "",
 		Level:         appConfig.Log.LevelOpt,
@@ -96,11 +96,12 @@ func initLogging() {
 		FileLocation:  appConfig.Log.FileLocation,
 	}
 
-	logWrapper := logger.NewLogrusLogger(cfg)
-	syft.SetLogger(logWrapper)
-	stereoscope.SetLogger(&logger.LogrusNestedLogger{
-		Logger: logWrapper.Logger.WithField("from-lib", "stereoscope"),
-	})
+	logger, err := logrus.New(cfg)
+	if err != nil {
+		panic(err)
+	}
+	syft.SetLogger(logger)
+	stereoscope.SetLogger(logger.Nested("from-lib", "stereoscope"))
 }
 
 func logAppConfig() {

cmd/tasks.go

@@ -51,7 +51,7 @@ func generateCatalogPackagesTask() (task, error) {
 		}
 
 		results.PackageCatalog = packageCatalog
-		results.Distro = theDistro
+		results.LinuxDistribution = theDistro
 
 		return relationships, nil
 	}

cmd/version.go

@@ -29,14 +29,14 @@ func printVersion(_ *cobra.Command, _ []string) {
 
 	switch outputFormat {
 	case "text":
-		fmt.Println("Application:  ", internal.ApplicationName)
-		fmt.Println("Version:      ", versionInfo.Version)
-		fmt.Println("BuildDate:    ", versionInfo.BuildDate)
-		fmt.Println("GitCommit:    ", versionInfo.GitCommit)
-		fmt.Println("GitTreeState: ", versionInfo.GitTreeState)
-		fmt.Println("Platform:     ", versionInfo.Platform)
-		fmt.Println("GoVersion:    ", versionInfo.GoVersion)
-		fmt.Println("Compiler:     ", versionInfo.Compiler)
+		fmt.Println("Application:    ", internal.ApplicationName)
+		fmt.Println("Version:        ", versionInfo.Version)
+		fmt.Println("BuildDate:      ", versionInfo.BuildDate)
+		fmt.Println("GitCommit:      ", versionInfo.GitCommit)
+		fmt.Println("GitDescription: ", versionInfo.GitDescription)
+		fmt.Println("Platform:       ", versionInfo.Platform)
+		fmt.Println("GoVersion:      ", versionInfo.GoVersion)
+		fmt.Println("Compiler:       ", versionInfo.Compiler)
 
 	case "json":
 		enc := json.NewEncoder(os.Stdout)

go.mod

@@ -5,30 +5,31 @@ go 1.16
 require (
 	github.com/CycloneDX/cyclonedx-go v0.4.0
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
+	github.com/acobaugh/osrelease v0.1.0
 	github.com/adrg/xdg v0.2.1
 	github.com/alecthomas/jsonschema v0.0.0-20210301060011-54c507b6f074
 	github.com/anchore/client-go v0.0.0-20210222170800-9c70f9b80bcf
+	github.com/anchore/go-logger v0.0.0
 	github.com/anchore/go-rpmdb v0.0.0-20210914181456-a9c52348da63
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29
-	github.com/anchore/stereoscope v0.0.0-20211222141827-6e663afeef5d
+	github.com/anchore/stereoscope v0.0.0-20220201190559-f162f1e96f45
 	// we are hinting brotli to latest due to warning when installing archiver v3:
 	// go: warning: github.com/andybalholm/brotli@v1.0.1: retracted by module author: occasional panics and data corruption
 	github.com/andybalholm/brotli v1.0.4 // indirect
 	github.com/antihax/optional v1.0.0
 	github.com/bmatcuk/doublestar/v4 v4.0.2
-	github.com/docker/docker v20.10.11+incompatible
+	github.com/containerd/containerd v1.5.9 // indirect
+	github.com/docker/docker v20.10.12+incompatible
 	github.com/dustin/go-humanize v1.0.0
 	github.com/facebookincubator/nvdtools v0.1.4
-	github.com/go-test/deep v1.0.7
+	github.com/go-test/deep v1.0.8
 	github.com/google/go-cmp v0.5.6
 	github.com/google/uuid v1.2.0
 	github.com/gookit/color v1.2.7
 	github.com/hashicorp/go-multierror v1.1.0
-	github.com/hashicorp/go-version v1.2.0
 	github.com/jinzhu/copier v0.3.2
-	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
 	github.com/mholt/archiver/v3 v3.5.1
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/mitchellh/hashstructure/v2 v2.0.2
@@ -49,10 +50,13 @@ require (
 	github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5
 	github.com/wagoodman/go-progress v0.0.0-20200731105512-1020f39e6240
 	github.com/wagoodman/jotframe v0.0.0-20211129225309-56b0d0a4aebb
-	github.com/x-cray/logrus-prefixed-formatter v0.5.2
 	github.com/xeipuuv/gojsonschema v1.2.0
 	golang.org/x/mod v0.4.2
-	golang.org/x/net v0.0.0-20211111160137-58aab5ef257a
+	golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2
 	golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b
 	gopkg.in/yaml.v2 v2.4.0
 )
+
+replace github.com/anchore/stereoscope => ../stereoscope
+
+replace github.com/anchore/go-logger => ../go-logger

go.sum

@@ -90,6 +90,8 @@ github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdko
 github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d/go.mod h1:HI8ITrYtUY+O+ZhtlqUnD8+KwNPOyugEhfP9fdUIaEQ=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d/go.mod h1:asat636LX7Bqt5lYEZ27JNDcqxfjdBQuJ/MM4CN/Lzo=
+github.com/acobaugh/osrelease v0.1.0 h1:Yb59HQDGGNhCj4suHaFQQfBps5wyoKLSSX/J/+UifRE=
+github.com/acobaugh/osrelease v0.1.0/go.mod h1:4bFEs0MtgHNHBrmHCt67gNisnabCRAlzdVasCEGHTWY=
 github.com/adrg/xdg v0.2.1 h1:VSVdnH7cQ7V+B33qSJHTCRlNgra1607Q8PzEmnvb2Ic=
 github.com/adrg/xdg v0.2.1/go.mod h1:ZuOshBmzV4Ta+s23hdfFZnBsdzmoR3US0d7ErpqSbTQ=
 github.com/alecthomas/jsonschema v0.0.0-20210301060011-54c507b6f074 h1:Lw9q+WyJLFOR+AULchS5/2GKfM+6gOh4szzizdfH3MU=
@@ -109,8 +111,6 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZV
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29 h1:K9LfnxwhqvihqU0+MF325FNy7fsKV9EGaUxdfR4gnWk=
 github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29/go.mod h1:Oc1UkGaJwY6ND6vtAqPSlYrptKRJngHwkwB6W7l1uP0=
-github.com/anchore/stereoscope v0.0.0-20211222141827-6e663afeef5d h1:ggdC5SRb8rAXmBkwxah8gfSxwpoAVcpp12tQ+XbDi20=
-github.com/anchore/stereoscope v0.0.0-20211222141827-6e663afeef5d/go.mod h1:FNm1rtauEjkC3elA3jr3bJkU+/4QiovApwJdPnHQ9x0=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
 github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY3JY=
@@ -201,8 +201,8 @@ github.com/containerd/containerd v1.5.0-beta.4/go.mod h1:GmdgZd2zA2GYIBZ0w09Zvgq
 github.com/containerd/containerd v1.5.0-rc.0/go.mod h1:V/IXoMqNGgBlabz3tHD2TWDoTJseu1FGOKuoA4nNb2s=
 github.com/containerd/containerd v1.5.1/go.mod h1:0DOxVqwDy2iZvrZp2JUx/E+hS0UNTVn7dJnIOwtYR4g=
 github.com/containerd/containerd v1.5.7/go.mod h1:gyvv6+ugqY25TiXxcZC3L5yOeYgEw0QMhscqVp1AR9c=
-github.com/containerd/containerd v1.5.8 h1:NmkCC1/QxyZFBny8JogwLpOy2f+VEbO/f6bV2Mqtwuw=
-github.com/containerd/containerd v1.5.8/go.mod h1:YdFSv5bTFLpG2HIYmfqDpSYYTDX+mc5qtSuYx1YUb/s=
+github.com/containerd/containerd v1.5.9 h1:rs6Xg1gtIxaeyG+Smsb/0xaSDu1VgFhOCKBXxMxbsF4=
+github.com/containerd/containerd v1.5.9/go.mod h1:fvQqCfadDGga5HZyn3j4+dx56qj2I9YwBrlSdalvJYQ=
 github.com/containerd/continuity v0.0.0-20190426062206-aaeac12a7ffc/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
 github.com/containerd/continuity v0.0.0-20190815185530-f2a389ac0a02/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
 github.com/containerd/continuity v0.0.0-20191127005431-f65d91d395eb/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
@@ -289,15 +289,16 @@ github.com/dgrijalva/jwt-go v0.0.0-20170104182250-a601269ab70c/go.mod h1:E3ru+11
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
 github.com/dnaeon/go-vcr v1.0.1/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyGc8n1E=
-github.com/docker/cli v20.10.10+incompatible h1:kcbwdgWbrBOH8QwQzaJmyriHwF7XIl4HT1qh0HTRys4=
 github.com/docker/cli v20.10.10+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v20.10.12+incompatible h1:lZlz0uzG+GH+c0plStMUdF/qk3ppmgnswpR5EbqzVGA=
+github.com/docker/cli v20.10.12+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v0.0.0-20190905152932-14b96e55d84c/go.mod h1:0+TTO4EOBfRPhZXAeF1Vu+W3hHZ8eLp8PgKVZlcvtFY=
 github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.7.1+incompatible h1:a5mlkVzth6W5A4fOsS3D2EO5BUmsJpcB+cRlLU7cSug=
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker v20.10.10+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v20.10.11+incompatible h1:OqzI/g/W54LczvhnccGqniFoQghHx3pklbLuhfXpqGo=
-github.com/docker/docker v20.10.11+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v20.10.12+incompatible h1:CEeNmFM0QZIsJCZKMkZx0ZcahTiewkrgiwfYD+dfl1U=
+github.com/docker/docker v20.10.12+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.6.4 h1:axCks+yV+2MR3/kZhAmy07yC56WZ2Pwu/fKWtKuZB0o=
 github.com/docker/docker-credential-helpers v0.6.4/go.mod h1:ofX3UI0Gz1TteYBjtgs07O36Pyasyp66D2uKT7H8W1c=
 github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
@@ -341,8 +342,8 @@ github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMo
 github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa/go.mod h1:KnogPXtdwXqoenmZCw6S+25EAm2MkxbG0deNDu4cbSA=
-github.com/gabriel-vasile/mimetype v1.3.0 h1:4YOHITFLyYwF+iqG0ybSLGArRItynpfwdlWRmJnd75E=
-github.com/gabriel-vasile/mimetype v1.3.0/go.mod h1:fA8fi6KUiG7MgQQ+mEWotXoEOvmxRtOJlERCzSmRvr8=
+github.com/gabriel-vasile/mimetype v1.4.0 h1:Cn9dkdYsMIu56tGho+fqzh7XmvY2YyGU0FnbhiOsEro=
+github.com/gabriel-vasile/mimetype v1.4.0/go.mod h1:fA8fi6KUiG7MgQQ+mEWotXoEOvmxRtOJlERCzSmRvr8=
 github.com/garyburd/redigo v0.0.0-20150301180006-535138d7bcd7/go.mod h1:NR3MbYisc3/PwhQ00EMzDiPmrwpPxAn5GI05/YaO1SY=
 github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
@@ -366,8 +367,9 @@ github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh
 github.com/go-restruct/restruct v1.2.0-alpha h1:2Lp474S/9660+SJjpVxoKuWX09JsXHSrdV7Nv3/gkvc=
 github.com/go-restruct/restruct v1.2.0-alpha/go.mod h1:KqrpKpn4M8OLznErihXTGLlsXFGeLxHUrLRRI/1YjGk=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
-github.com/go-test/deep v1.0.7 h1:/VSMRlnY/JSyqxQUzQLKVMAskpY/NZKFA5j2P+0pP2M=
 github.com/go-test/deep v1.0.7/go.mod h1:QV8Hv/iy04NyLBxAdO9njL0iVPN1S4d/A3NVv1V36o8=
+github.com/go-test/deep v1.0.8 h1:TDsG77qcSprGbC6vTN8OuXp5g+J+b5Pcguhf7Zt61VM=
+github.com/go-test/deep v1.0.8/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/godbus/dbus v0.0.0-20151105175453-c7fdd8b5cd55/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
 github.com/godbus/dbus v0.0.0-20180201030542-885f9cc04c9c/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
 github.com/godbus/dbus v0.0.0-20190422162347-ade71ed3457e/go.mod h1:bBOAhwG1umN6/6ZUMtDFBMQR8jRg9O75tm9K00oMsK4=
@@ -501,8 +503,6 @@ github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerX
 github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
 github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go-version v1.2.0 h1:3vNe/fWF5CBgRIguda1meWhsZHy3m8gCJ5wx+dIzX/E=
-github.com/hashicorp/go-version v1.2.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/go.net v0.0.1/go.mod h1:hjKkEWcCURg++eb33jQU7oqQcI9XDCnUzHA0oac0k90=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
@@ -576,12 +576,14 @@ github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN
 github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.7.0/go.mod h1:KAzv3t3aY1NaHWoQz1+4F1ccyAH66Jk7yos7ldAVICs=
 github.com/marstr/guid v1.1.0/go.mod h1:74gB1z2wpxxInTG6yaqA7KrtM0NZ+RbrcqDvYHefzho=
-github.com/mattn/go-colorable v0.0.9 h1:UVL0vNpWh04HeJXV0KLcaT7r06gOH2l4OW6ddYRUIY4=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/mattn/go-colorable v0.1.12 h1:jF+Du6AlPIjs2BiUiQlKOX0rt3SujHxPnksPKZbaA40=
+github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
 github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
-github.com/mattn/go-isatty v0.0.6 h1:SrwhHcpV4nWrMGdNcC2kXpMfcBVYGDuTArqyhocJgvA=
 github.com/mattn/go-isatty v0.0.6/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.14 h1:yVuAays6BHfxijgZPzw+3Zlu5yQgKGP2/hcQbHb7S9Y=
+github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-runewidth v0.0.7 h1:Ei8KR0497xHyKJPAv59M1dkC+rOZCMBJ+t3fZ+twI54=
 github.com/mattn/go-runewidth v0.0.7/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
@@ -894,8 +896,9 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2 h1:It14KIkyBFYkHkwZ7k45minvA9aorojkyjGk9KJ5B/w=
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
+golang.org/x/crypto v0.0.0-20220131195533-30dcbda58838 h1:71vQrMauZZhcTVK6KdYM+rklehEEwb3E+ZhaE5jrPrE=
+golang.org/x/crypto v0.0.0-20220131195533-30dcbda58838/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -982,8 +985,9 @@ golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLd
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210505024714-0287a6fb4125/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20211111160137-58aab5ef257a h1:c83jeVQW0KGKNaKBRfelNYNHaev+qawl9yaA825s8XE=
 golang.org/x/net v0.0.0-20211111160137-58aab5ef257a/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2 h1:CIJ76btIcR3eFI5EgSo6k1qKw9KJexJuRLI9G7Hp5wE=
+golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1102,6 +1106,7 @@ golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211110154304-99a53858aa08 h1:WecRHqgE09JBkh/584XIE6PMz5KKE/vER4izNUi30AQ=
 golang.org/x/sys v0.0.0-20211110154304-99a53858aa08/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=

gon.hcl

@@ -1,15 +0,0 @@
-source = ["./dist/syft-macos_darwin_amd64/syft"] # The 'dist' directory path should ideally reference an env var, where the source of truth is the Makefile. I wasn't able to figure out how to solve this.
-bundle_id = "com.anchore.toolbox.syft"
-
-sign {
-  application_identity = "Developer ID Application: ANCHORE, INC. (9MJHKYX5AT)"
-}
-
-dmg {
-  output_path = "./dist/output.dmg"
-  volume_name = "Syft"
-}
-
-zip {
-  output_path = "./dist/output.zip"
-}

install.sh

@@ -1,198 +1,129 @@
 #!/bin/sh
-set -e
+# note: we require errors to propagate (don't set -e)
+set -u
 
-usage() {
+PROJECT_NAME="syft"
+OWNER=anchore
+REPO="${PROJECT_NAME}"
+GITHUB_DOWNLOAD_PREFIX=https://github.com/${OWNER}/${REPO}/releases/download
+
+#
+# usage [script-name]
+#
+usage() (
   this=$1
   cat <<EOF
 $this: download go binaries for anchore/syft
 
-Usage: $this [-b] bindir [-d] [tag]
-  -b sets bindir or installation directory, Defaults to ./bin
-  -d turns on debug logging
-   [tag] is a tag from
-   https://github.com/anchore/syft/releases
-   If tag is missing, then the latest will be used.
-
- Generated by godownloader
-  https://github.com/goreleaser/godownloader
-
+Usage: $this [-b] dir [-d] [tag]
+  -b  the installation directory (dDefaults to ./bin)
+  -d  turns on debug logging
+  -dd turns on trace logging
+  [tag] the specific release to use (if missing, then the latest will be used)
 EOF
   exit 2
-}
+)
 
-parse_args() {
-  # BINDIR is ./bin unless set be ENV
-  # over-ridden by flag below
 
-  BINDIR=${BINDIR:-./bin}
-  while getopts "b:dh?x" arg; do
-    case "$arg" in
-      b) BINDIR="$OPTARG" ;;
-      d) log_set_priority 10 ;;
-      h | \?) usage "$0" ;;
-      x) set -x ;;
-    esac
-  done
-  shift $((OPTIND - 1))
-  TAG=$1
-}
-# this function wraps all the destructive operations
-# if a curl|bash cuts off the end of the script due to
-# network, either nothing will happen or will syntax error
-# out preventing half-done work
-execute() {
-  tmpdir=$(mktemp -d)
-  log_debug "downloading files into ${tmpdir}"
-  http_download "${tmpdir}/${ARCHIVE}" "${ARCHIVE_URL}"
-  http_download "${tmpdir}/${CHECKSUM}" "${CHECKSUM_URL}"
+# ------------------------------------------------------------------------
+# https://github.com/client9/shlib - portable posix shell functions
+# Public domain - http://unlicense.org
+# https://github.com/client9/shlib/blob/master/LICENSE.md
+# but credit (and pull requests) appreciated.
+# ------------------------------------------------------------------------
 
-  # macOS has its own secure verification mechanism, and checksums.txt is not used.
-  if [ "$OS" != "darwin" ]; then
-    hash_sha256_verify "${tmpdir}/${ARCHIVE}" "${tmpdir}/${CHECKSUM}"
-  fi
-
-  srcdir="${tmpdir}"
-  (cd "${tmpdir}" && unpack "${ARCHIVE}")
-  test ! -d "${BINDIR}" && install -d "${BINDIR}"
-  for binexe in $BINARIES; do
-    if [ "$OS" = "windows" ]; then
-      binexe="${binexe}.exe"
-    fi
-    install "${srcdir}/${binexe}" "${BINDIR}/"
-    log_info "installed ${BINDIR}/${binexe}"
-  done
-  rm -rf "${tmpdir}"
-}
-get_binaries() {
-  case "$PLATFORM" in
-    darwin/arm64) BINARIES="syft" ;;
-    darwin/amd64) BINARIES="syft" ;;
-    linux/amd64) BINARIES="syft" ;;
-    linux/arm64) BINARIES="syft" ;;
-    windows/amd64) BINARIES="syft" ;;
-    *)
-      log_crit "platform $PLATFORM is not supported.  Make sure this script is up-to-date and file request at https://github.com/${PREFIX}/issues/new"
-      exit 1
-      ;;
-  esac
-}
-tag_to_version() {
-  if [ -z "${TAG}" ]; then
-    log_info "checking GitHub for latest tag"
-  else
-    log_info "checking GitHub for tag '${TAG}'"
-  fi
-  REALTAG=$(github_release "$OWNER/$REPO" "${TAG}") && true
-  if test -z "$REALTAG"; then
-    log_crit "unable to find '${TAG}' - use 'latest' or see https://github.com/${PREFIX}/releases for details"
-    exit 1
-  fi
-  # if version starts with 'v', remove it
-  TAG="$REALTAG"
-  VERSION=${TAG#v}
-}
-adjust_format() {
-  # change format (tar.gz or zip) based on OS
-  case ${OS} in
-    darwin) FORMAT=dmg ;;
-    windows) FORMAT=zip ;;
-  esac
-  case "${PLATFORM}" in
-    darwin/arm64) FORMAT=zip ;;
-  esac
-  true
-}
-adjust_os() {
-  # adjust archive name based on OS
-  true
-}
-adjust_arch() {
-  # adjust archive name based on ARCH
-  true
-}
-
-cat /dev/null <<EOF
-------------------------------------------------------------------------
-https://github.com/client9/shlib - portable posix shell functions
-Public domain - http://unlicense.org
-https://github.com/client9/shlib/blob/master/LICENSE.md
-but credit (and pull requests) appreciated.
-------------------------------------------------------------------------
-EOF
-is_command() {
+is_command() (
   command -v "$1" >/dev/null
-}
-echoerr() {
+)
+
+echo_stderr() (
   echo "$@" 1>&2
-}
-log_prefix() {
-  echo "$0"
-}
-_logp=6
+)
+
+_logp=2
 log_set_priority() {
   _logp="$1"
 }
-log_priority() {
+
+log_priority() (
   if test -z "$1"; then
     echo "$_logp"
     return
   fi
   [ "$1" -le "$_logp" ]
+)
+
+init_colors() {
+  RED=''
+  BLUE=''
+  PURPLE=''
+  BOLD=''
+  RESET=''
+  # check if stdout is a terminal
+  if test -t 1 && is_command tput; then
+      # see if it supports colors
+      ncolors=$(tput colors)
+      if test -n "$ncolors" && test $ncolors -ge 8; then
+        RED='\033[0;31m'
+        BLUE='\033[0;34m'
+        PURPLE='\033[0;35m'
+        BOLD='\033[1m'
+        RESET='\033[0m'
+      fi
+  fi
 }
-log_tag() {
+
+init_colors
+
+log_tag() (
   case $1 in
-    0) echo "emerg" ;;
-    1) echo "alert" ;;
-    2) echo "crit" ;;
-    3) echo "err" ;;
-    4) echo "warning" ;;
-    5) echo "notice" ;;
-    6) echo "info" ;;
-    7) echo "debug" ;;
-    *) echo "$1" ;;
+    0) echo "${RED}${BOLD}[error]${RESET}" ;;
+    1) echo "${RED}[warn]${RESET}" ;;
+    2) echo "[info]${RESET}" ;;
+    3) echo "${BLUE}[debug]${RESET}" ;;
+    4) echo "${PURPLE}[trace]${RESET}" ;;
+    *) echo "[$1]" ;;
   esac
-}
-log_debug() {
-  log_priority 7 || return 0
-  echoerr "$(log_prefix)" "$(log_tag 7)" "$@"
-}
-log_info() {
-  log_priority 6 || return 0
-  echoerr "$(log_prefix)" "$(log_tag 6)" "$@"
-}
-log_err() {
-  log_priority 3 || return 0
-  echoerr "$(log_prefix)" "$(log_tag 3)" "$@"
-}
-log_crit() {
-  log_priority 2 || return 0
-  echoerr "$(log_prefix)" "$(log_tag 2)" "$@"
-}
-uname_os() {
-  os=$(uname -s | tr '[:upper:]' '[:lower:]')
-  case "$os" in
-    cygwin_nt*) os="windows" ;;
-    mingw*) os="windows" ;;
-    msys_nt*) os="windows" ;;
-  esac
-  echo "$os"
-}
-uname_arch() {
-  arch=$(uname -m)
-  case $arch in
-    x86_64) arch="amd64" ;;
-    x86) arch="386" ;;
-    i686) arch="386" ;;
-    i386) arch="386" ;;
-    aarch64) arch="arm64" ;;
-    armv5*) arch="armv5" ;;
-    armv6*) arch="armv6" ;;
-    armv7*) arch="armv7" ;;
-  esac
-  echo ${arch}
-}
-uname_os_check() {
-  os=$(uname_os)
+)
+
+
+log_trace_priority=4
+log_trace() (
+  priority=$log_trace_priority
+  log_priority "$priority" || return 0
+  echo_stderr "$(log_tag $priority)" "${@}" "${RESET}"
+)
+
+log_debug_priority=3
+log_debug() (
+  priority=$log_debug_priority
+  log_priority "$priority" || return 0
+  echo_stderr "$(log_tag $priority)" "${@}" "${RESET}"
+)
+
+log_info_priority=2
+log_info() (
+  priority=$log_info_priority
+  log_priority "$priority" || return 0
+  echo_stderr "$(log_tag $priority)" "${@}" "${RESET}"
+)
+
+log_warn_priority=1
+log_warn() (
+  priority=$log_warn_priority
+  log_priority "$priority" || return 0
+  echo_stderr "$(log_tag $priority)" "${@}" "${RESET}"
+)
+
+log_err_priority=0
+log_err() (
+  priority=$log_err_priority
+  log_priority "$priority" || return 0
+  echo_stderr "$(log_tag $priority)" "${@}" "${RESET}"
+)
+
+uname_os_check() (
+  os=$1
   case "$os" in
     darwin) return 0 ;;
     dragonfly) return 0 ;;
@@ -206,11 +137,12 @@ uname_os_check() {
     solaris) return 0 ;;
     windows) return 0 ;;
   esac
-  log_crit "uname_os_check '$(uname -s)' got converted to '$os' which is not a GOOS value. Please file bug at https://github.com/client9/shlib"
+  log_err "uname_os_check '$(uname -s)' got converted to '$os' which is not a GOOS value. Please file bug at https://github.com/client9/shlib"
   return 1
-}
-uname_arch_check() {
-  arch=$(uname_arch)
+)
+
+uname_arch_check() (
+  arch=$1
   case "$arch" in
     386) return 0 ;;
     amd64) return 0 ;;
@@ -227,56 +159,72 @@ uname_arch_check() {
     s390x) return 0 ;;
     amd64p32) return 0 ;;
   esac
-  log_crit "uname_arch_check '$(uname -m)' got converted to '$arch' which is not a GOARCH value.  Please file bug report at https://github.com/client9/shlib"
+  log_err "uname_arch_check '$(uname -m)' got converted to '$arch' which is not a GOARCH value.  Please file bug report at https://github.com/client9/shlib"
   return 1
-}
-unpack() {
+)
+
+unpack() (
   archive=$1
+
+  log_trace "unpack(archive=${archive})"
+
   case "${archive}" in
     *.tar.gz | *.tgz) tar --no-same-owner -xzf "${archive}" ;;
     *.tar) tar --no-same-owner -xf "${archive}" ;;
-    *.zip) unzip "${archive}" ;;
+    *.zip) unzip -q "${archive}" ;;
     *.dmg) extract_from_dmg "${archive}" ;;
     *)
       log_err "unpack unknown archive format for ${archive}"
       return 1
       ;;
   esac
-}
-extract_from_dmg() {
+)
+
+extract_from_dmg() (
   dmg_file=$1
+
   mount_point="/Volumes/tmp-dmg"
   hdiutil attach -quiet -nobrowse -mountpoint "${mount_point}" "${dmg_file}"
   cp -fR "${mount_point}/." ./
   hdiutil detach -quiet -force "${mount_point}"
-}
-http_download_curl() {
+)
+
+http_download_curl() (
   local_file=$1
   source_url=$2
   header=$3
+
+  log_trace "http_download_curl(local_file=$local_file, source_url=$source_url, header=$header)"
+
   if [ -z "$header" ]; then
     code=$(curl -w '%{http_code}' -sL -o "$local_file" "$source_url")
   else
     code=$(curl -w '%{http_code}' -sL -H "$header" -o "$local_file" "$source_url")
   fi
+
   if [ "$code" != "200" ]; then
-    log_debug "http_download_curl received HTTP status $code"
+    log_err "received HTTP status=$code for url='$source_url'"
     return 1
   fi
   return 0
-}
-http_download_wget() {
+)
+
+http_download_wget() (
   local_file=$1
   source_url=$2
   header=$3
+
+  log_trace "http_download_wget(local_file=$local_file, source_url=$source_url, header=$header)"
+
   if [ -z "$header" ]; then
     wget -q -O "$local_file" "$source_url"
   else
     wget -q --header "$header" -O "$local_file" "$source_url"
   fi
-}
-http_download() {
-  log_debug "http_download $2"
+)
+
+http_download() (
+  log_debug "http_download(url=$2)"
   if is_command curl; then
     http_download_curl "$@"
     return
@@ -284,28 +232,19 @@ http_download() {
     http_download_wget "$@"
     return
   fi
-  log_crit "http_download unable to find wget or curl"
+  log_err "http_download unable to find wget or curl"
   return 1
-}
-http_copy() {
+)
+
+http_copy() (
   tmp=$(mktemp)
   http_download "${tmp}" "$1" "$2" || return 1
   body=$(cat "$tmp")
   rm -f "${tmp}"
   echo "$body"
-}
-github_release() {
-  owner_repo=$1
-  version=$2
-  test -z "$version" && version="latest"
-  giturl="https://github.com/${owner_repo}/releases/${version}"
-  json=$(http_copy "$giturl" "Accept:application/json")
-  test -z "$json" && return 1
-  version=$(echo "$json" | tr -s '\n' ' ' | sed 's/.*"tag_name":"//' | sed 's/".*//')
-  test -z "$version" && return 1
-  echo "$version"
-}
-hash_sha256() {
+)
+
+hash_sha256() (
   TARGET=${1:-/dev/stdin}
   if is_command gsha256sum; then
     hash=$(gsha256sum "$TARGET") || return 1
@@ -320,11 +259,12 @@ hash_sha256() {
     hash=$(openssl -dst openssl dgst -sha256 "$TARGET") || return 1
     echo "$hash" | cut -d ' ' -f a
   else
-    log_crit "hash_sha256 unable to find command to compute sha-256 hash"
+    log_err "hash_sha256 unable to find command to compute sha-256 hash"
     return 1
   fi
-}
-hash_sha256_verify() {
+)
+
+hash_sha256_verify() (
   TARGET=$1
   checksums=$2
   if [ -z "$checksums" ]; then
@@ -342,51 +282,400 @@ hash_sha256_verify() {
     log_err "hash_sha256_verify checksum for '$TARGET' did not verify ${want} vs $got"
     return 1
   fi
-}
-cat /dev/null <<EOF
-------------------------------------------------------------------------
-End of functions from https://github.com/client9/shlib
-------------------------------------------------------------------------
+)
+
+# ------------------------------------------------------------------------
+# End of functions from https://github.com/client9/shlib
+# ------------------------------------------------------------------------
+
+# asset_file_exists [path]
+#
+# returns 1 if the given file does not exist
+#
+asset_file_exists() (
+  path="$1"
+  if [ ! -f "${path}" ]; then
+      return 1
+  fi
+)
+
+
+# github_release_json [owner] [repo] [version]
+#
+# outputs release json string
+#
+github_release_json() (
+  owner=$1
+  repo=$2
+  version=$3
+  test -z "$version" && version="latest"
+  giturl="https://github.com/${owner}/${repo}/releases/${version}"
+  json=$(http_copy "$giturl" "Accept:application/json")
+
+  log_trace "github_release_json(owner=${owner}, repo=${repo}, version=${version}) returned '${json}'"
+
+  test -z "$json" && return 1
+  echo "${json}"
+)
+
+# extract_value [key-value-pair]
+#
+# outputs value from a colon delimited key-value pair
+#
+extract_value() (
+  key_value="$1"
+  IFS=':' read -r _ value << EOF
+${key_value}
 EOF
+  echo "$value"
+)
 
-PROJECT_NAME="syft"
-OWNER=anchore
-REPO="syft"
-BINARY=syft
-FORMAT=tar.gz
-OS=$(uname_os)
-ARCH=$(uname_arch)
-PREFIX="$OWNER/$REPO"
+# extract_json_value [json] [key]
+#
+# outputs value of the key from the given json string
+#
+extract_json_value() (
+  json="$1"
+  key="$2"
+  key_value=$(echo "${json}" | grep  -o "\"$key\":[^,]*[,}]" | tr -d '",}')
 
-# use in logging routines
-log_prefix() {
-	echo "$PREFIX"
-}
-PLATFORM="${OS}/${ARCH}"
-GITHUB_DOWNLOAD=https://github.com/${OWNER}/${REPO}/releases/download
+  extract_value "$key_value"
+)
 
-uname_os_check "$OS"
-uname_arch_check "$ARCH"
+# github_release_tag [release-json]
+#
+# outputs release tag string
+#
+github_release_tag() (
+  json="$1"
+  tag=$(extract_json_value "${json}" "tag_name")
+  test -z "$tag" && return 1
+  echo "$tag"
+)
 
-parse_args "$@"
+# download_github_release_checksums [release-url-prefix] [name] [version] [output-dir]
+#
+# outputs path to the downloaded checksums file
+#
+download_github_release_checksums() (
+  download_url="$1"
+  name="$2"
+  version="$3"
+  output_dir="$4"
 
-get_binaries
+  log_trace "download_github_release_checksums(url=${download_url}, name=${name}, version=${version}, output_dir=${output_dir})"
 
-tag_to_version
+  checksum_filename=${name}_${version}_checksums.txt
+  checksum_url=${download_url}/${checksum_filename}
+  output_path="${output_dir}/${checksum_filename}"
 
-adjust_format
+  http_download "${output_path}" "${checksum_url}" ""
+  asset_file_exists "${output_path}"
 
-adjust_os
+  log_trace "download_github_release_checksums() returned '${output_path}'"
 
-adjust_arch
+  echo "${output_path}"
+)
 
-log_info "found version: ${VERSION} for ${TAG}/${OS}/${ARCH}"
+# search_for_asset [checksums-file-path] [name] [os] [arch] [format]
+#
+# outputs name of the asset to download
+#
+search_for_asset() (
+  checksum_path="$1"
+  name="$2"
+  os="$3"
+  arch="$4"
+  format="$5"
 
-NAME=${PROJECT_NAME}_${VERSION}_${OS}_${ARCH}
-ARCHIVE=${NAME}.${FORMAT}
-ARCHIVE_URL=${GITHUB_DOWNLOAD}/${TAG}/${ARCHIVE}
-CHECKSUM=${PROJECT_NAME}_${VERSION}_checksums.txt
-CHECKSUM_URL=${GITHUB_DOWNLOAD}/${TAG}/${CHECKSUM}
+  log_trace "search_for_asset(checksum-path=${checksum_path}, name=${name}, os=${os}, arch=${arch}, format=${format})"
+
+  asset_glob="${name}_.*_${os}_${arch}.${format}"
+  output_path=$(grep -o "${asset_glob}" "${checksum_path}" || true)
+
+  log_trace "search_for_asset() returned '${output_path}'"
+
+  echo "${output_path}"
+)
+
+# uname_os
+#
+# outputs an adjusted os value
+#
+uname_os() (
+  os=$(uname -s | tr '[:upper:]' '[:lower:]')
+  case "$os" in
+    cygwin_nt*) os="windows" ;;
+    mingw*) os="windows" ;;
+    msys_nt*) os="windows" ;;
+  esac
+
+  uname_os_check "$os"
+
+  log_trace "uname_os() returned '${os}'"
+
+  echo "$os"
+)
+
+# uname_arch
+#
+# outputs an adjusted architecture value
+#
+uname_arch() (
+  arch=$(uname -m)
+  case $arch in
+    x86_64) arch="amd64" ;;
+    x86) arch="386" ;;
+    i686) arch="386" ;;
+    i386) arch="386" ;;
+    aarch64) arch="arm64" ;;
+    armv5*) arch="armv5" ;;
+    armv6*) arch="armv6" ;;
+    armv7*) arch="armv7" ;;
+  esac
+
+  uname_arch_check "${arch}"
+
+  log_trace "uname_arch() returned '${arch}'"
+
+  echo "${arch}"
+)
+
+# get_release_tag [owner] [repo] [tag]
+#
+# outputs tag string
+#
+get_release_tag() (
+  owner="$1"
+  repo="$2"
+  tag="$3"
+
+  log_trace "get_release_tag(owner=${owner}, repo=${repo}, tag=${tag})"
+
+  json=$(github_release_json "${owner}" "${repo}" "${tag}")
+  real_tag=$(github_release_tag "${json}")
+  if test -z "${real_tag}"; then
+    return 1
+  fi
+
+  log_trace "get_release_tag() returned '${real_tag}'"
+
+  echo "${real_tag}"
+)
+
+# tag_to_version [tag]
+#
+# outputs version string
+#
+tag_to_version() (
+  tag="$1"
+  value="${tag#v}"
+
+  log_trace "tag_to_version(tag=${tag}) returned '${value}'"
+
+  echo "$value"
+)
+
+# get_binary_name [os] [arch] [default-name]
+#
+# outputs a the binary string name
+#
+get_binary_name() (
+  os="$1"
+  arch="$2"
+  binary="$3"
+  original_binary="${binary}"
+
+  case "${os}" in
+    windows) binary="${binary}.exe" ;;
+  esac
+
+  log_trace "get_binary_name(os=${os}, arch=${arch}, binary=${original_binary}) returned '${binary}'"
+
+  echo "${binary}"
+)
 
 
-execute
+# get_format_name [os] [arch] [default-format]
+#
+# outputs an adjusted file format
+#
+get_format_name() (
+  os="$1"
+  arch="$2"
+  format="$3"
+  original_format="${format}"
+
+  case ${os} in
+    windows) format=zip ;;
+  esac
+
+  log_trace "get_format_name(os=${os}, arch=${arch}, format=${original_format}) returned '${format}'"
+
+  echo "${format}"
+)
+
+# download_and_install_asset [release-url-prefix] [download-path] [install-path] [name] [os] [arch] [version] [format] [binary]
+#
+# attempts to download the archive and install it to the given path.
+#
+download_and_install_asset() (
+  download_url="$1"
+  download_path="$2"
+  install_path=$3
+  name="$4"
+  os="$5"
+  arch="$6"
+  version="$7"
+  format="$8"
+  binary="$9"
+
+  asset_filepath=$(download_asset "${download_url}" "${download_path}" "${name}" "${os}" "${arch}" "${version}" "${format}")
+
+  # don't continue if we couldn't download an asset
+  if [ -z "${asset_filepath}" ]; then
+      log_err "could not find release asset for os='${os}' arch='${arch}' format='${format}' "
+      return 1
+  fi
+
+  install_asset "${asset_filepath}" "${install_path}" "${binary}"
+)
+
+# download_asset [release-url-prefix] [download-path] [name] [os] [arch] [version] [format] [binary]
+#
+# outputs the path to the downloaded asset asset_filepath
+#
+download_asset() (
+  download_url="$1"
+  destination="$2"
+  name="$3"
+  os="$4"
+  arch="$5"
+  version="$6"
+  format="$7"
+
+  log_trace "download_asset(url=${download_url}, destination=${destination}, name=${name}, os=${os}, arch=${arch}, version=${version}, format=${format})"
+
+  checksums_filepath=$(download_github_release_checksums "${download_url}" "${name}" "${version}" "${destination}")
+
+  log_trace "checksums content:\n$(cat ${checksums_filepath})"
+
+  asset_filename=$(search_for_asset "${checksums_filepath}" "${name}" "${os}" "${arch}" "${format}")
+
+  # don't continue if we couldn't find a matching asset from the checksums file
+  if [ -z "${asset_filename}" ]; then
+      return 1
+  fi
+
+  asset_url="${download_url}/${asset_filename}"
+  asset_filepath="${destination}/${asset_filename}"
+  http_download "${asset_filepath}" "${asset_url}" ""
+
+  hash_sha256_verify "${asset_filepath}" "${checksums_filepath}"
+
+  log_trace "download_asset_by_checksums_file() returned '${asset_filepath}'"
+
+  echo "${asset_filepath}"
+)
+
+# install_asset [asset-path] [destination-path] [binary]
+#
+install_asset() (
+  asset_filepath="$1"
+  destination="$2"
+  binary="$3"
+
+  log_trace "install_asset(asset=${asset_filepath}, destination=${destination}, binary=${binary})"
+
+  # don't continue if we don't have anything to install
+  if [ -z "${asset_filepath}" ]; then
+      return
+  fi
+
+  archive_dir=$(dirname "${asset_filepath}")
+
+  # unarchive the downloaded archive to the temp dir
+  (cd "${archive_dir}" && unpack "${asset_filepath}")
+
+  # create the destination dir
+  test ! -d "${destination}" && install -d "${destination}"
+
+  # install the binary to the destination dir
+  install "${archive_dir}/${binary}" "${destination}/"
+)
+
+main() (
+  # parse arguments
+
+  install_dir=${install_dir:-./bin}
+  while getopts "b:dh?x" arg; do
+    case "$arg" in
+      b) install_dir="$OPTARG" ;;
+      d)
+        if [ "$_logp" = "$log_info_priority" ]; then
+          # -d == debug
+          log_set_priority $log_debug_priority
+        else
+          # -dd (or -ddd...) == trace
+          log_set_priority $log_trace_priority
+        fi
+        ;;
+      h | \?) usage "$0" ;;
+      x) set -x ;;
+    esac
+  done
+  shift $((OPTIND - 1))
+  set +u
+  tag=$1
+
+  if [ -z "${tag}" ]; then
+    log_info "checking github for the current release tag"
+    tag=""
+  else
+    log_info "checking github for release tag='${tag}'"
+  fi
+  set -u
+
+  tag=$(get_release_tag "${OWNER}" "${REPO}" "${tag}")
+
+  if [ "$?" != "0" ]; then
+      log_err "unable to find tag='${tag}'"
+      log_err "do not specify a version or select a valid version from https://github.com/${OWNER}/${REPO}/releases"
+      return 1
+  fi
+
+  version=$(tag_to_version "${tag}")
+
+  download_dir=$(mktemp -d)
+  trap 'rm -rf -- "$download_dir"' EXIT
+
+  # run the application
+
+  os=$(uname_os)
+  arch=$(uname_arch)
+  format=$(get_format_name "${os}" "${arch}" "tar.gz")
+  binary=$(get_binary_name "${os}" "${arch}" "${PROJECT_NAME}")
+  download_url="${GITHUB_DOWNLOAD_PREFIX}/${tag}"
+
+  log_info "using release tag='${tag}' version='${version}' os='${os}' arch='${arch}'"
+  log_debug "downloading files into ${download_dir}"
+
+  download_and_install_asset "${download_url}" "${download_dir}" "${install_dir}" "${PROJECT_NAME}" "${os}" "${arch}" "${version}" "${format}" "${binary}"
+
+  # don't continue if we couldn't install the asset
+  if [ "$?" != "0" ]; then
+      log_err "failed to install ${PROJECT_NAME}"
+      return 1
+  fi
+
+  log_info "installed ${install_dir}/${binary}"
+)
+
+# entrypoint
+
+set +u
+if [ -z "${TEST_INSTALL_SH}" ]; then
+  set -u
+  main "$@"
+fi
+set -u

internal/anchore/import_package_sbom.go

@@ -8,31 +8,82 @@ import (
 	"fmt"
 	"net/http"
 
-	"github.com/anchore/syft/syft/sbom"
-
-	"github.com/anchore/syft/internal/formats/syftjson"
-
-	"github.com/wagoodman/go-progress"
-
 	"github.com/anchore/client-go/pkg/external"
+	"github.com/anchore/syft/internal/formats/syftjson"
+	syftjsonModel "github.com/anchore/syft/internal/formats/syftjson/model"
 	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/wagoodman/go-progress"
 )
 
 type packageSBOMImportAPI interface {
 	ImportImagePackages(context.Context, string, external.ImagePackageManifest) (external.ImageImportContentResponse, *http.Response, error)
 }
 
+// importSBOM mirrors all elements found on the syftjson model format object relative to the anchore engine import schema.
+type importSBOM struct {
+	Artifacts             []syftjsonModel.Package      `json:"artifacts"` // Artifacts is the list of packages discovered and placed into the catalog
+	ArtifactRelationships []syftjsonModel.Relationship `json:"artifactRelationships"`
+	Files                 []syftjsonModel.File         `json:"files,omitempty"`   // note: must have omitempty
+	Secrets               []syftjsonModel.Secrets      `json:"secrets,omitempty"` // note: must have omitempty
+	Source                syftjsonModel.Source         `json:"source"`            // Source represents the original object that was cataloged
+	Distro                external.ImportDistribution  `json:"distro"`            // Distro represents the Linux distribution that was detected from the source
+	Descriptor            syftjsonModel.Descriptor     `json:"descriptor"`        // Descriptor is a block containing self-describing information about syft
+	Schema                syftjsonModel.Schema         `json:"schema"`            // Schema is a block reserved for defining the version for the shape of this JSON document and where to find the schema document to validate the shape
+}
+
+// toImportSBOMModel transforms the current sbom shape into what is needed for the current anchore import api shape.
+func toImportSBOMModel(s sbom.SBOM) importSBOM {
+	m := syftjson.ToFormatModel(s)
+
+	var idLike string
+	if len(m.Distro.IDLike) > 0 {
+		idLike = m.Distro.IDLike[0]
+	}
+
+	var version = m.Distro.VersionID // note: version is intentionally not used as the default
+	if version == "" {
+		version = m.Distro.Version
+	}
+
+	var name = m.Distro.ID // note: name is intentionally not used as the default
+	if name == "" {
+		name = m.Distro.Name
+	}
+
+	return importSBOM{
+		Artifacts:             m.Artifacts,
+		ArtifactRelationships: m.ArtifactRelationships,
+		Files:                 m.Files,
+		Secrets:               m.Secrets,
+		Source:                m.Source,
+		Distro: external.ImportDistribution{
+			Name:    name,
+			Version: version,
+			IdLike:  idLike,
+		},
+		Descriptor: m.Descriptor,
+		Schema:     m.Schema,
+	}
+}
+
 func packageSbomModel(s sbom.SBOM) (*external.ImagePackageManifest, error) {
 	var buf bytes.Buffer
 
-	err := syftjson.Format().Encode(&buf, s)
-	if err != nil {
-		return nil, fmt.Errorf("unable to serialize results: %w", err)
+	doc := toImportSBOMModel(s)
+
+	enc := json.NewEncoder(&buf)
+	// prevent > and < from being escaped in the payload
+	enc.SetEscapeHTML(false)
+	enc.SetIndent("", " ")
+
+	if err := enc.Encode(&doc); err != nil {
+		return nil, fmt.Errorf("unable to encode import JSON model: %w", err)
 	}
 
 	// the model is 1:1 the JSON output of today. As the schema changes, this will need to be converted into individual mappings.
 	var model external.ImagePackageManifest
-	if err = json.Unmarshal(buf.Bytes(), &model); err != nil {
+	if err := json.Unmarshal(buf.Bytes(), &model); err != nil {
 		return nil, fmt.Errorf("unable to convert JSON output to import model: %w", err)
 	}
 

internal/anchore/import_package_sbom_test.go

@@ -1,7 +1,6 @@
 package anchore
 
 import (
-	"bytes"
 	"context"
 	"encoding/json"
 	"fmt"
@@ -9,16 +8,17 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/anchore/syft/syft/sbom"
-
 	"github.com/anchore/client-go/pkg/external"
 	"github.com/anchore/syft/internal/formats/syftjson"
-	syftjsonModel "github.com/anchore/syft/internal/formats/syftjson/model"
-	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 	"github.com/docker/docker/pkg/ioutils"
 	"github.com/go-test/deep"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"github.com/wagoodman/go-progress"
 )
 
@@ -29,107 +29,6 @@ func must(c pkg.CPE, e error) pkg.CPE {
 	return c
 }
 
-// this test is tailored towards the assumption that the import doc shape and the syft json shape are the same.
-// TODO: replace this as the document shapes diverge.
-func TestPackageSbomToModel(t *testing.T) {
-
-	m := source.Metadata{
-		Scheme: source.ImageScheme,
-		ImageMetadata: source.ImageMetadata{
-			UserInput: "user-in",
-			Layers: []source.LayerMetadata{
-				{
-					MediaType: "layer-metadata-type!",
-					Digest:    "layer-digest",
-					Size:      20,
-				},
-			},
-			Size:           10,
-			ManifestDigest: "sha256:digest!",
-			MediaType:      "mediatype!",
-			Tags:           nil,
-		},
-	}
-
-	d, _ := distro.NewDistro(distro.CentOS, "8.0", "")
-
-	p := pkg.Package{
-		Name:    "name",
-		Version: "version",
-		FoundBy: "foundBy",
-		Locations: []source.Location{
-			{
-				Coordinates: source.Coordinates{
-					RealPath:     "path",
-					FileSystemID: "layerID",
-				},
-			},
-		},
-		Licenses: []string{"license"},
-		Language: pkg.Python,
-		Type:     pkg.PythonPkg,
-		CPEs: []pkg.CPE{
-			must(pkg.NewCPE("cpe:2.3:*:some:package:1:*:*:*:*:*:*:*")),
-		},
-		PURL: "purl",
-	}
-
-	c := pkg.NewCatalog(p)
-
-	sbomResult := sbom.SBOM{
-		Artifacts: sbom.Artifacts{
-			PackageCatalog: c,
-			Distro:         &d,
-		},
-		Source: m,
-	}
-
-	model, err := packageSbomModel(sbomResult)
-	if err != nil {
-		t.Fatalf("unable to generate model from source material: %+v", err)
-	}
-
-	var modelJSON []byte
-
-	modelJSON, err = json.Marshal(&model)
-	if err != nil {
-		t.Fatalf("unable to marshal model: %+v", err)
-	}
-
-	s := sbom.SBOM{
-		Artifacts: sbom.Artifacts{
-			PackageCatalog: c,
-			Distro:         &d,
-		},
-		Source: m,
-	}
-
-	var buf bytes.Buffer
-	if err := syftjson.Format().Encode(&buf, s); err != nil {
-		t.Fatalf("unable to get expected json: %+v", err)
-	}
-
-	// unmarshal expected result
-	var expectedDoc syftjsonModel.Document
-	if err := json.Unmarshal(buf.Bytes(), &expectedDoc); err != nil {
-		t.Fatalf("unable to parse json doc: %+v", err)
-	}
-
-	// unmarshal actual result
-	var actualDoc syftjsonModel.Document
-	if err := json.Unmarshal(modelJSON, &actualDoc); err != nil {
-		t.Fatalf("unable to parse json doc: %+v", err)
-	}
-
-	for _, d := range deep.Equal(actualDoc, expectedDoc) {
-		if strings.HasSuffix(d, "<nil slice> != []") {
-			// do not consider nil vs empty collection semantics as a "difference"
-			continue
-		}
-		t.Errorf("diff: %+v", d)
-	}
-}
-
 type mockPackageSBOMImportAPI struct {
 	sessionID      string
 	model          external.ImagePackageManifest
@@ -150,72 +49,81 @@ func (m *mockPackageSBOMImportAPI) ImportImagePackages(ctx context.Context, sess
 	return external.ImageImportContentResponse{Digest: m.responseDigest}, m.httpResponse, m.err
 }
 
-func TestPackageSbomImport(t *testing.T) {
-
-	catalog := pkg.NewCatalog(pkg.Package{
-		Name:    "name",
-		Version: "version",
-		FoundBy: "foundBy",
-		Locations: []source.Location{
-			{
-				Coordinates: source.Coordinates{
-					RealPath:     "path",
-					FileSystemID: "layerID",
-				},
-			},
-		},
-		Licenses: []string{"license"},
-		Language: pkg.Python,
-		Type:     pkg.PythonPkg,
-		CPEs: []pkg.CPE{
-			must(pkg.NewCPE("cpe:2.3:*:some:package:1:*:*:*:*:*:*:*")),
-		},
-		PURL:         "purl",
-		MetadataType: pkg.PythonPackageMetadataType,
-		Metadata: pkg.PythonPackageMetadata{
-			Name:        "p-name",
-			Version:     "p-version",
-			License:     "p-license",
-			Author:      "p-author",
-			AuthorEmail: "p-email",
-			Platform:    "p-platform",
-			Files: []pkg.PythonFileRecord{
-				{
-					Path: "p-path",
-					Digest: &pkg.PythonFileDigest{
-						Algorithm: "p-alg",
-						Value:     "p-digest",
-					},
-					Size: "p-size",
-				},
-			},
-			SitePackagesRootPath: "p-site-packages-root",
-			TopLevelPackages:     []string{"top-level"},
-		},
-	})
-
-	m := source.Metadata{
-		Scheme: source.ImageScheme,
-		ImageMetadata: source.ImageMetadata{
-			UserInput:      "user-in",
-			Layers:         nil,
-			Size:           10,
-			ManifestDigest: "sha256:digest!",
-			MediaType:      "mediatype!",
-			Tags:           nil,
-		},
-	}
-
-	d, _ := distro.NewDistro(distro.CentOS, "8.0", "")
-
-	sbomResult := sbom.SBOM{
+func sbomFixture() sbom.SBOM {
+	return sbom.SBOM{
 		Artifacts: sbom.Artifacts{
-			PackageCatalog: catalog,
-			Distro:         &d,
+			PackageCatalog: pkg.NewCatalog(pkg.Package{
+				Name:    "name",
+				Version: "version",
+				FoundBy: "foundBy",
+				Locations: []source.Location{
+					{
+						Coordinates: source.Coordinates{
+							RealPath:     "path",
+							FileSystemID: "layerID",
+						},
+					},
+				},
+				Licenses: []string{"license"},
+				Language: pkg.Python,
+				Type:     pkg.PythonPkg,
+				CPEs: []pkg.CPE{
+					must(pkg.NewCPE("cpe:2.3:*:some:package:1:*:*:*:*:*:*:*")),
+				},
+				PURL:         "purl",
+				MetadataType: pkg.PythonPackageMetadataType,
+				Metadata: pkg.PythonPackageMetadata{
+					Name:        "p-name",
+					Version:     "p-version",
+					License:     "p-license",
+					Author:      "p-author",
+					AuthorEmail: "p-email",
+					Platform:    "p-platform",
+					Files: []pkg.PythonFileRecord{
+						{
+							Path: "p-path",
+							Digest: &pkg.PythonFileDigest{
+								Algorithm: "p-alg",
+								Value:     "p-digest",
+							},
+							Size: "p-size",
+						},
+					},
+					SitePackagesRootPath: "p-site-packages-root",
+					TopLevelPackages:     []string{"top-level"},
+				},
+			}),
+			LinuxDistribution: &linux.Release{
+				ID:        "centos",
+				Version:   "8.0",
+				VersionID: "8.0",
+				IDLike:    []string{"rhel"},
+			},
+		},
+		Relationships: []artifact.Relationship{
+			{
+				From: source.NewLocation("/place1"),
+				To:   source.NewLocation("/place2"),
+				Type: artifact.ContainsRelationship,
+			},
+		},
+		Source: source.Metadata{
+			Scheme: source.ImageScheme,
+			ImageMetadata: source.ImageMetadata{
+				UserInput:      "user-in",
+				Layers:         nil,
+				Size:           10,
+				ManifestDigest: "sha256:digest!",
+				MediaType:      "mediatype!",
+				Tags:           nil,
+			},
 		},
-		Source: m,
 	}
 
+}
+
+func TestPackageSbomImport(t *testing.T) {
+	sbomResult := sbomFixture()
 	theModel, err := packageSbomModel(sbomResult)
 	if err != nil {
 		t.Fatalf("could not get sbom model: %+v", err)
@@ -280,3 +188,210 @@ func TestPackageSbomImport(t *testing.T) {
 		})
 	}
 }
+
+type modelAssertion func(t *testing.T, model *external.ImagePackageManifest)
+
+func Test_packageSbomModel(t *testing.T) {
+	fix := sbomFixture()
+
+	tests := []struct {
+		name   string
+		sbom   sbom.SBOM
+		traits []modelAssertion
+	}{
+		{
+			name: "distro: has single distro id-like",
+			sbom: sbom.SBOM{
+				Artifacts: sbom.Artifacts{
+					LinuxDistribution: &linux.Release{
+						Name: "centos-name",
+						ID:   "centos-id",
+						IDLike: []string{
+							"centos-id-like-1",
+						},
+						Version:   "version",
+						VersionID: "version-id",
+					},
+				},
+			},
+			traits: []modelAssertion{
+				hasDistroInfo("centos-id", "version-id", "centos-id-like-1"),
+			},
+		},
+		{
+			name: "distro: has multiple distro id-like",
+			sbom: sbom.SBOM{
+				Artifacts: sbom.Artifacts{
+					LinuxDistribution: &linux.Release{
+						Name: "centos-name",
+						ID:   "centos-id",
+						IDLike: []string{
+							"centos-id-like-1",
+							"centos-id-like-2",
+						},
+						Version:   "version",
+						VersionID: "version-id",
+					},
+				},
+			},
+			traits: []modelAssertion{
+				hasDistroInfo("centos-id", "version-id", "centos-id-like-1"),
+			},
+		},
+		{
+			name: "distro: has no distro id-like",
+			sbom: sbom.SBOM{
+				Artifacts: sbom.Artifacts{
+					LinuxDistribution: &linux.Release{
+						Name:      "centos-name",
+						ID:        "centos-id",
+						IDLike:    []string{},
+						Version:   "version",
+						VersionID: "version-id",
+					},
+				},
+			},
+			traits: []modelAssertion{
+				hasDistroInfo("centos-id", "version-id", ""),
+			},
+		},
+		{
+			name: "distro: has no version-id",
+			sbom: sbom.SBOM{
+				Artifacts: sbom.Artifacts{
+					LinuxDistribution: &linux.Release{
+						Name:      "centos-name",
+						ID:        "centos-id",
+						IDLike:    []string{},
+						Version:   "version",
+						VersionID: "",
+					},
+				},
+			},
+			traits: []modelAssertion{
+				hasDistroInfo("centos-id", "version", ""),
+			},
+		},
+		{
+			name: "distro: has no id",
+			sbom: sbom.SBOM{
+				Artifacts: sbom.Artifacts{
+					LinuxDistribution: &linux.Release{
+						Name:      "centos-name",
+						ID:        "",
+						IDLike:    []string{},
+						Version:   "version",
+						VersionID: "version-id",
+					},
+				},
+			},
+			traits: []modelAssertion{
+				hasDistroInfo("centos-name", "version-id", ""),
+			},
+		},
+		{
+			name: "should have expected packages",
+			sbom: fix,
+			traits: []modelAssertion{
+				func(t *testing.T, model *external.ImagePackageManifest) {
+					require.Len(t, model.Artifacts, 1)
+
+					modelPkg := model.Artifacts
+					modelBytes, err := json.Marshal(&modelPkg)
+					require.NoError(t, err)
+
+					fixPkg := syftjson.ToFormatModel(fix).Artifacts
+					fixBytes, err := json.Marshal(&fixPkg)
+					require.NoError(t, err)
+
+					assert.JSONEq(t, string(fixBytes), string(modelBytes))
+				},
+			},
+		},
+		{
+			name: "should have expected relationships",
+			sbom: fix,
+			traits: []modelAssertion{
+				func(t *testing.T, model *external.ImagePackageManifest) {
+					modelPkg := model.ArtifactRelationships
+					modelBytes, err := json.Marshal(&modelPkg)
+					require.NoError(t, err)
+
+					fixPkg := syftjson.ToFormatModel(fix).ArtifactRelationships
+					fixBytes, err := json.Marshal(&fixPkg)
+					require.NoError(t, err)
+
+					assert.JSONEq(t, string(fixBytes), string(modelBytes))
+				},
+			},
+		},
+		{
+			name: "should have expected schema",
+			sbom: fix,
+			traits: []modelAssertion{
+				func(t *testing.T, model *external.ImagePackageManifest) {
+					modelPkg := model.Schema
+					modelBytes, err := json.Marshal(&modelPkg)
+					require.NoError(t, err)
+
+					fixPkg := syftjson.ToFormatModel(fix).Schema
+					fixBytes, err := json.Marshal(&fixPkg)
+					require.NoError(t, err)
+
+					assert.JSONEq(t, string(fixBytes), string(modelBytes))
+				},
+			},
+		},
+		{
+			name: "should have expected descriptor",
+			sbom: fix,
+			traits: []modelAssertion{
+				func(t *testing.T, model *external.ImagePackageManifest) {
+					modelPkg := model.Descriptor
+					modelBytes, err := json.Marshal(&modelPkg)
+					require.NoError(t, err)
+
+					fixPkg := syftjson.ToFormatModel(fix).Descriptor
+					fixBytes, err := json.Marshal(&fixPkg)
+					require.NoError(t, err)
+
+					assert.JSONEq(t, string(fixBytes), string(modelBytes))
+				},
+			},
+		},
+		{
+			name: "should have expected source",
+			sbom: fix,
+			traits: []modelAssertion{
+				func(t *testing.T, model *external.ImagePackageManifest) {
+					modelPkg := model.Source
+					modelBytes, err := json.Marshal(&modelPkg)
+					require.NoError(t, err)
+
+					fixPkg := syftjson.ToFormatModel(fix).Source
+					fixBytes, err := json.Marshal(&fixPkg)
+					require.NoError(t, err)
+
+					assert.JSONEq(t, string(fixBytes), string(modelBytes))
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := packageSbomModel(tt.sbom)
+			require.NoError(t, err)
+			for _, fn := range tt.traits {
+				fn(t, got)
+			}
+		})
+	}
+}
+
+func hasDistroInfo(name, version, idLike string) modelAssertion {
+	return func(t *testing.T, model *external.ImagePackageManifest) {
+		assert.Equal(t, name, model.Distro.Name)
+		assert.Equal(t, version, model.Distro.Version)
+		assert.Equal(t, idLike, model.Distro.IdLike)
+	}
+}

internal/constants.go

@@ -6,5 +6,5 @@ const (
 
 	// JSONSchemaVersion is the current schema version output by the JSON encoder
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "2.0.2"
+	JSONSchemaVersion = "3.0.1"
 )

internal/formats/common/cyclonedxhelpers/author.go

@@ -0,0 +1,32 @@
+package cyclonedxhelpers
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func Author(p pkg.Package) string {
+	if hasMetadata(p) {
+		switch metadata := p.Metadata.(type) {
+		case pkg.NpmPackageJSONMetadata:
+			return metadata.Author
+		case pkg.PythonPackageMetadata:
+			author := metadata.Author
+			if metadata.AuthorEmail != "" {
+				if author == "" {
+					return metadata.AuthorEmail
+				}
+				author += fmt.Sprintf(" <%s>", metadata.AuthorEmail)
+			}
+			return author
+		case pkg.GemMetadata:
+			if len(metadata.Authors) > 0 {
+				return strings.Join(metadata.Authors, ",")
+			}
+			return ""
+		}
+	}
+	return ""
+}

internal/formats/common/cyclonedxhelpers/author_test.go

@@ -0,0 +1,87 @@
+package cyclonedxhelpers
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_Author(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected string
+	}{
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name:     "no metadata",
+			input:    pkg.Package{},
+			expected: "",
+		},
+		{
+			name: "from gem",
+			input: pkg.Package{
+				Metadata: pkg.GemMetadata{
+					Authors: []string{
+						"auth1",
+						"auth2",
+					},
+				},
+			},
+			expected: "auth1,auth2",
+		},
+		{
+			name: "from npm",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					Author: "auth",
+				},
+			},
+			expected: "auth",
+		},
+		{
+			name: "from python - just name",
+			input: pkg.Package{
+				Metadata: pkg.PythonPackageMetadata{
+					Author: "auth",
+				},
+			},
+			expected: "auth",
+		},
+		{
+			name: "from python - just email",
+			input: pkg.Package{
+				Metadata: pkg.PythonPackageMetadata{
+					AuthorEmail: "auth@auth.gov",
+				},
+			},
+			expected: "auth@auth.gov",
+		},
+		{
+			name: "from python - both name and email",
+			input: pkg.Package{
+				Metadata: pkg.PythonPackageMetadata{
+					Author:      "auth",
+					AuthorEmail: "auth@auth.gov",
+				},
+			},
+			expected: "auth <auth@auth.gov>",
+		},
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name: "empty",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					Author: "",
+				},
+			},
+			expected: "",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, Author(test.input))
+		})
+	}
+}

internal/formats/common/cyclonedxhelpers/component.go

@@ -0,0 +1,27 @@
+package cyclonedxhelpers
+
+import (
+	"github.com/CycloneDX/cyclonedx-go"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func Component(p pkg.Package) cyclonedx.Component {
+	return cyclonedx.Component{
+		Type:               cyclonedx.ComponentTypeLibrary,
+		Name:               p.Name,
+		Group:              Group(p),
+		Version:            p.Version,
+		PackageURL:         p.PURL,
+		Licenses:           Licenses(p),
+		CPE:                CPE(p),
+		Author:             Author(p),
+		Publisher:          Publisher(p),
+		Description:        Description(p),
+		ExternalReferences: ExternalReferences(p),
+		Properties:         Properties(p),
+	}
+}
+
+func hasMetadata(p pkg.Package) bool {
+	return p.Metadata != nil
+}

internal/formats/common/cyclonedxhelpers/cpe.go

@@ -0,0 +1,12 @@
+package cyclonedxhelpers
+
+import "github.com/anchore/syft/syft/pkg"
+
+func CPE(p pkg.Package) string {
+	// Since the CPEs in a package are sorted by specificity
+	// we can extract the first CPE as the one to output in cyclonedx
+	if len(p.CPEs) > 0 {
+		return pkg.CPEString(p.CPEs[0])
+	}
+	return ""
+}

internal/formats/common/cyclonedxhelpers/cpe_test.go

@@ -0,0 +1,57 @@
+package cyclonedxhelpers
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_CPE(t *testing.T) {
+	testCPE := pkg.MustCPE("cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*")
+	testCPE2 := pkg.MustCPE("cpe:2.3:a:name:name2:3.2:*:*:*:*:*:*:*")
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected string
+	}{
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name: "no metadata",
+			input: pkg.Package{
+				CPEs: []pkg.CPE{},
+			},
+			expected: "",
+		},
+		{
+			name: "single CPE",
+			input: pkg.Package{
+				CPEs: []pkg.CPE{
+					testCPE,
+				},
+			},
+			expected: "cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
+		},
+		{
+			name: "multiple CPEs",
+			input: pkg.Package{
+				CPEs: []pkg.CPE{
+					testCPE2,
+					testCPE,
+				},
+			},
+			expected: "cpe:2.3:a:name:name2:3.2:*:*:*:*:*:*:*",
+		},
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name:     "empty",
+			input:    pkg.Package{},
+			expected: "",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, CPE(test.input))
+		})
+	}
+}

internal/formats/common/cyclonedxhelpers/description.go

@@ -0,0 +1,15 @@
+package cyclonedxhelpers
+
+import "github.com/anchore/syft/syft/pkg"
+
+func Description(p pkg.Package) string {
+	if hasMetadata(p) {
+		switch metadata := p.Metadata.(type) {
+		case pkg.ApkMetadata:
+			return metadata.Description
+		case pkg.NpmPackageJSONMetadata:
+			return metadata.Description
+		}
+	}
+	return ""
+}

internal/formats/common/cyclonedxhelpers/description_test.go

@@ -0,0 +1,56 @@
+package cyclonedxhelpers
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_Description(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected string
+	}{
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name:     "no metadata",
+			input:    pkg.Package{},
+			expected: "",
+		},
+		{
+			name: "from apk",
+			input: pkg.Package{
+				Metadata: pkg.ApkMetadata{
+					Description: "a description!",
+				},
+			},
+			expected: "a description!",
+		},
+		{
+			name: "from npm",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					Description: "a description!",
+				},
+			},
+			expected: "a description!",
+		},
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name: "empty",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					Homepage: "",
+				},
+			},
+			expected: "",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, Description(test.input))
+		})
+	}
+}

internal/formats/common/cyclonedxhelpers/external_references.go

@@ -0,0 +1,65 @@
+package cyclonedxhelpers
+
+import (
+	"fmt"
+
+	"github.com/CycloneDX/cyclonedx-go"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func ExternalReferences(p pkg.Package) *[]cyclonedx.ExternalReference {
+	refs := []cyclonedx.ExternalReference{}
+	if hasMetadata(p) {
+		switch metadata := p.Metadata.(type) {
+		case pkg.ApkMetadata:
+			if metadata.URL != "" {
+				refs = append(refs, cyclonedx.ExternalReference{
+					URL:  metadata.URL,
+					Type: cyclonedx.ERTypeDistribution,
+				})
+			}
+		case pkg.CargoPackageMetadata:
+			if metadata.Source != "" {
+				refs = append(refs, cyclonedx.ExternalReference{
+					URL:  metadata.Source,
+					Type: cyclonedx.ERTypeDistribution,
+				})
+			}
+		case pkg.NpmPackageJSONMetadata:
+			if metadata.URL != "" {
+				refs = append(refs, cyclonedx.ExternalReference{
+					URL:  metadata.URL,
+					Type: cyclonedx.ERTypeDistribution,
+				})
+			}
+			if metadata.Homepage != "" {
+				refs = append(refs, cyclonedx.ExternalReference{
+					URL:  metadata.Homepage,
+					Type: cyclonedx.ERTypeWebsite,
+				})
+			}
+		case pkg.GemMetadata:
+			if metadata.Homepage != "" {
+				refs = append(refs, cyclonedx.ExternalReference{
+					URL:  metadata.Homepage,
+					Type: cyclonedx.ERTypeWebsite,
+				})
+			}
+		case pkg.PythonPackageMetadata:
+			if metadata.DirectURLOrigin != nil && metadata.DirectURLOrigin.URL != "" {
+				ref := cyclonedx.ExternalReference{
+					URL:  metadata.DirectURLOrigin.URL,
+					Type: cyclonedx.ERTypeVCS,
+				}
+				if metadata.DirectURLOrigin.CommitID != "" {
+					ref.Comment = fmt.Sprintf("commit: %s", metadata.DirectURLOrigin.CommitID)
+				}
+				refs = append(refs, ref)
+			}
+		}
+	}
+	if len(refs) > 0 {
+		return &refs
+	}
+	return nil
+}

internal/formats/common/cyclonedxhelpers/external_references_test.go

@@ -0,0 +1,133 @@
+package cyclonedxhelpers
+
+import (
+	"testing"
+
+	"github.com/CycloneDX/cyclonedx-go"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_ExternalReferences(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected *[]cyclonedx.ExternalReference
+	}{
+		{
+			name:     "no metadata",
+			input:    pkg.Package{},
+			expected: nil,
+		},
+		{
+			name: "from apk",
+			input: pkg.Package{
+				Metadata: pkg.ApkMetadata{
+					URL: "http://a-place.gov",
+				},
+			},
+			expected: &[]cyclonedx.ExternalReference{
+				{URL: "http://a-place.gov", Type: cyclonedx.ERTypeDistribution},
+			},
+		},
+		{
+			name: "from npm",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					URL: "http://a-place.gov",
+				},
+			},
+			expected: &[]cyclonedx.ExternalReference{
+				{URL: "http://a-place.gov", Type: cyclonedx.ERTypeDistribution},
+			},
+		},
+		{
+			name: "from cargo lock",
+			input: pkg.Package{
+				Name:         "ansi_term",
+				Version:      "0.12.1",
+				Language:     pkg.Rust,
+				Type:         pkg.RustPkg,
+				MetadataType: pkg.RustCargoPackageMetadataType,
+				Licenses:     nil,
+				Metadata: pkg.CargoPackageMetadata{
+					Name:     "ansi_term",
+					Version:  "0.12.1",
+					Source:   "registry+https://github.com/rust-lang/crates.io-index",
+					Checksum: "d52a9bb7ec0cf484c551830a7ce27bd20d67eac647e1befb56b0be4ee39a55d2",
+					Dependencies: []string{
+						"winapi",
+					},
+				},
+			},
+			expected: &[]cyclonedx.ExternalReference{
+				{URL: "registry+https://github.com/rust-lang/crates.io-index", Type: cyclonedx.ERTypeDistribution},
+			},
+		},
+		{
+			name: "from npm with homepage",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					URL:      "http://a-place.gov",
+					Homepage: "http://homepage",
+				},
+			},
+			expected: &[]cyclonedx.ExternalReference{
+				{URL: "http://a-place.gov", Type: cyclonedx.ERTypeDistribution},
+				{URL: "http://homepage", Type: cyclonedx.ERTypeWebsite},
+			},
+		},
+		{
+			name: "from gem",
+			input: pkg.Package{
+				Metadata: pkg.GemMetadata{
+					Homepage: "http://a-place.gov",
+				},
+			},
+			expected: &[]cyclonedx.ExternalReference{
+				{URL: "http://a-place.gov", Type: cyclonedx.ERTypeWebsite},
+			},
+		},
+		{
+			name: "from python direct url",
+			input: pkg.Package{
+				Metadata: pkg.PythonPackageMetadata{
+					DirectURLOrigin: &pkg.PythonDirectURLOriginInfo{
+						URL: "http://a-place.gov",
+					},
+				},
+			},
+			expected: &[]cyclonedx.ExternalReference{
+				{URL: "http://a-place.gov", Type: cyclonedx.ERTypeVCS},
+			},
+		},
+		{
+			name: "from python direct url with commit",
+			input: pkg.Package{
+				Metadata: pkg.PythonPackageMetadata{
+					DirectURLOrigin: &pkg.PythonDirectURLOriginInfo{
+						URL:      "http://a-place.gov",
+						CommitID: "test",
+					},
+				},
+			},
+			expected: &[]cyclonedx.ExternalReference{
+				{URL: "http://a-place.gov", Type: cyclonedx.ERTypeVCS, Comment: "commit: test"},
+			},
+		},
+		{
+			name: "empty",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					URL: "",
+				},
+			},
+			expected: nil,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, ExternalReferences(test.input))
+		})
+	}
+}

internal/formats/common/cyclonedxhelpers/format.go

@@ -5,8 +5,10 @@ import (
 
 	"github.com/CycloneDX/cyclonedx-go"
 	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/version"
-	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 	"github.com/google/uuid"
@@ -25,13 +27,69 @@ func ToFormatModel(s sbom.SBOM) *cyclonedx.BOM {
 	packages := s.Artifacts.PackageCatalog.Sorted()
 	components := make([]cyclonedx.Component, len(packages))
 	for i, p := range packages {
-		components[i] = toComponent(p)
+		components[i] = Component(p)
 	}
+	components = append(components, toOSComponent(s.Artifacts.LinuxDistribution)...)
 	cdxBOM.Components = &components
 
+	dependencies := toDependencies(s.Relationships)
+	if len(dependencies) > 0 {
+		cdxBOM.Dependencies = &dependencies
+	}
+
 	return cdxBOM
 }
 
+func toOSComponent(distro *linux.Release) []cyclonedx.Component {
+	if distro == nil {
+		return []cyclonedx.Component{}
+	}
+	eRefs := &[]cyclonedx.ExternalReference{}
+	if distro.BugReportURL != "" {
+		*eRefs = append(*eRefs, cyclonedx.ExternalReference{
+			URL:  distro.BugReportURL,
+			Type: cyclonedx.ERTypeIssueTracker,
+		})
+	}
+	if distro.HomeURL != "" {
+		*eRefs = append(*eRefs, cyclonedx.ExternalReference{
+			URL:  distro.HomeURL,
+			Type: cyclonedx.ERTypeWebsite,
+		})
+	}
+	if distro.SupportURL != "" {
+		*eRefs = append(*eRefs, cyclonedx.ExternalReference{
+			URL:     distro.SupportURL,
+			Type:    cyclonedx.ERTypeOther,
+			Comment: "support",
+		})
+	}
+	if distro.PrivacyPolicyURL != "" {
+		*eRefs = append(*eRefs, cyclonedx.ExternalReference{
+			URL:     distro.PrivacyPolicyURL,
+			Type:    cyclonedx.ERTypeOther,
+			Comment: "privacyPolicy",
+		})
+	}
+	if len(*eRefs) == 0 {
+		eRefs = nil
+	}
+	props := getCycloneDXProperties(*distro)
+	if len(*props) == 0 {
+		props = nil
+	}
+	return []cyclonedx.Component{
+		{
+			Type:               cyclonedx.ComponentTypeOS,
+			Name:               distro.Name,
+			Version:            distro.Version,
+			CPE:                distro.CPEName,
+			ExternalReferences: eRefs,
+			Properties:         props,
+		},
+	}
+}
+
 // NewBomDescriptor returns a new BomDescriptor tailored for the current time and "syft" tool details.
 func toBomDescriptor(name, version string, srcMetadata source.Metadata) *cyclonedx.Metadata {
 	return &cyclonedx.Metadata{
@@ -47,47 +105,68 @@ func toBomDescriptor(name, version string, srcMetadata source.Metadata) *cyclone
 	}
 }
 
-func toComponent(p pkg.Package) cyclonedx.Component {
-	return cyclonedx.Component{
-		Type:       cyclonedx.ComponentTypeLibrary,
-		Name:       p.Name,
-		Version:    p.Version,
-		PackageURL: p.PURL,
-		Licenses:   toLicenses(p.Licenses),
+// used to indicate that a relationship listed under the syft artifact package can be represented as a cyclonedx dependency.
+// NOTE: CycloneDX provides the ability to describe components and their dependency on other components.
+// The dependency graph is capable of representing both direct and transitive relationships.
+// If a relationship is either direct or transitive it can be included in this function.
+// An example of a relationship to not include would be: OwnershipByFileOverlapRelationship.
+func isExpressiblePackageRelationship(ty artifact.RelationshipType) bool {
+	switch ty {
+	case artifact.RuntimeDependencyOfRelationship:
+		return true
+	case artifact.DevDependencyOfRelationship:
+		return true
+	case artifact.BuildDependencyOfRelationship:
+		return true
+	case artifact.DependencyOfRelationship:
+		return true
 	}
+	return false
+}
+
+func toDependencies(relationships []artifact.Relationship) []cyclonedx.Dependency {
+	result := make([]cyclonedx.Dependency, 0)
+	for _, r := range relationships {
+		exists := isExpressiblePackageRelationship(r.Type)
+		if !exists {
+			log.Warnf("unable to convert relationship from CycloneDX 1.3 JSON, dropping: %+v", r)
+			continue
+		}
+
+		innerDeps := []cyclonedx.Dependency{}
+		innerDeps = append(innerDeps, cyclonedx.Dependency{Ref: string(r.From.ID())})
+		result = append(result, cyclonedx.Dependency{
+			Ref:          string(r.To.ID()),
+			Dependencies: &innerDeps,
+		})
+	}
+	return result
 }
 
 func toBomDescriptorComponent(srcMetadata source.Metadata) *cyclonedx.Component {
 	switch srcMetadata.Scheme {
 	case source.ImageScheme:
+		bomRef, err := artifact.IDByHash(srcMetadata.ImageMetadata.ID)
+		if err != nil {
+			log.Warnf("unable to get fingerprint of image metadata=%s: %+v", srcMetadata.ImageMetadata.ID, err)
+		}
 		return &cyclonedx.Component{
+			BOMRef:  string(bomRef),
 			Type:    cyclonedx.ComponentTypeContainer,
 			Name:    srcMetadata.ImageMetadata.UserInput,
 			Version: srcMetadata.ImageMetadata.ManifestDigest,
 		}
 	case source.DirectoryScheme, source.FileScheme:
+		bomRef, err := artifact.IDByHash(srcMetadata.Path)
+		if err != nil {
+			log.Warnf("unable to get fingerprint of source metadata path=%s: %+v", srcMetadata.Path, err)
+		}
 		return &cyclonedx.Component{
-			Type: cyclonedx.ComponentTypeFile,
-			Name: srcMetadata.Path,
+			BOMRef: string(bomRef),
+			Type:   cyclonedx.ComponentTypeFile,
+			Name:   srcMetadata.Path,
 		}
 	}
 
 	return nil
 }
-
-func toLicenses(ls []string) *cyclonedx.Licenses {
-	if len(ls) == 0 {
-		return nil
-	}
-
-	lc := make(cyclonedx.Licenses, len(ls))
-	for i, licenseName := range ls {
-		lc[i] = cyclonedx.LicenseChoice{
-			License: &cyclonedx.License{
-				Name: licenseName,
-			},
-		}
-	}
-
-	return &lc
-}

internal/formats/common/cyclonedxhelpers/group.go

@@ -0,0 +1,12 @@
+package cyclonedxhelpers
+
+import "github.com/anchore/syft/syft/pkg"
+
+func Group(p pkg.Package) string {
+	if hasMetadata(p) {
+		if metadata, ok := p.Metadata.(pkg.JavaMetadata); ok && metadata.PomProperties != nil {
+			return metadata.PomProperties.GroupID
+		}
+	}
+	return ""
+}

internal/formats/common/cyclonedxhelpers/group_test.go

@@ -0,0 +1,52 @@
+package cyclonedxhelpers
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGroup(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected string
+	}{
+		{
+			name:     "no metadata",
+			input:    pkg.Package{},
+			expected: "",
+		},
+		{
+			name: "metadata is not Java",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{},
+			},
+			expected: "",
+		},
+		{
+			name: "metadata is Java but pom properties is empty",
+			input: pkg.Package{
+				Metadata: pkg.JavaMetadata{},
+			},
+			expected: "",
+		},
+		{
+			name: "metadata is Java and contains pomProperties",
+			input: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						GroupID: "test",
+					},
+				},
+			},
+			expected: "test",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, Group(test.input))
+		})
+	}
+}

internal/formats/common/cyclonedxhelpers/licenses.go

@@ -0,0 +1,24 @@
+package cyclonedxhelpers
+
+import (
+	"github.com/CycloneDX/cyclonedx-go"
+	"github.com/anchore/syft/internal/spdxlicense"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func Licenses(p pkg.Package) *cyclonedx.Licenses {
+	lc := cyclonedx.Licenses{}
+	for _, licenseName := range p.Licenses {
+		if value, exists := spdxlicense.ID(licenseName); exists {
+			lc = append(lc, cyclonedx.LicenseChoice{
+				License: &cyclonedx.License{
+					ID: value,
+				},
+			})
+		}
+	}
+	if len(lc) > 0 {
+		return &lc
+	}
+	return nil
+}

internal/formats/common/cyclonedxhelpers/licenses_test.go

@@ -0,0 +1,83 @@
+package cyclonedxhelpers
+
+import (
+	"testing"
+
+	"github.com/CycloneDX/cyclonedx-go"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_License(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected *cyclonedx.Licenses
+	}{
+		{
+			name:     "no licenses",
+			input:    pkg.Package{},
+			expected: nil,
+		},
+		{
+			name: "no SPDX licenses",
+			input: pkg.Package{
+				Licenses: []string{
+					"made-up",
+				},
+			},
+			expected: nil,
+		},
+		{
+			name: "with SPDX license",
+			input: pkg.Package{
+				Licenses: []string{
+					"MIT",
+				},
+			},
+			expected: &cyclonedx.Licenses{
+				{License: &cyclonedx.License{ID: "MIT"}},
+			},
+		},
+		{
+			name: "with SPDX license expression",
+			input: pkg.Package{
+				Licenses: []string{
+					"MIT",
+					"GPL-3.0",
+				},
+			},
+			expected: &cyclonedx.Licenses{
+				{License: &cyclonedx.License{ID: "MIT"}},
+				{License: &cyclonedx.License{ID: "GPL-3.0"}},
+			},
+		},
+		{
+			name: "cap insensitive",
+			input: pkg.Package{
+				Licenses: []string{
+					"gpl-3.0",
+				},
+			},
+			expected: &cyclonedx.Licenses{
+				{License: &cyclonedx.License{ID: "GPL-3.0"}},
+			},
+		},
+		{
+			name: "debian to spdx conversion",
+			input: pkg.Package{
+				Licenses: []string{
+					"GPL-2",
+				},
+			},
+			expected: &cyclonedx.Licenses{
+				{License: &cyclonedx.License{ID: "GPL-2.0"}},
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, Licenses(test.input))
+		})
+	}
+}

internal/formats/common/cyclonedxhelpers/properties.go

@@ -0,0 +1,78 @@
+package cyclonedxhelpers
+
+import (
+	"fmt"
+	"reflect"
+
+	"github.com/CycloneDX/cyclonedx-go"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func Properties(p pkg.Package) *[]cyclonedx.Property {
+	props := []cyclonedx.Property{}
+	props = append(props, *getCycloneDXProperties(p)...)
+	if len(p.Locations) > 0 {
+		for _, l := range p.Locations {
+			props = append(props, *getCycloneDXProperties(l.Coordinates)...)
+		}
+	}
+	if hasMetadata(p) {
+		props = append(props, *getCycloneDXProperties(p.Metadata)...)
+	}
+	if len(props) > 0 {
+		return &props
+	}
+	return nil
+}
+
+func getCycloneDXProperties(m interface{}) *[]cyclonedx.Property {
+	props := []cyclonedx.Property{}
+	structValue := reflect.ValueOf(m)
+	if structValue.Kind() != reflect.Struct {
+		return &props
+	}
+	structType := structValue.Type()
+	for i := 0; i < structValue.NumField(); i++ {
+		if name, value := getCycloneDXPropertyName(structType.Field(i)), getCycloneDXPropertyValue(structValue.Field(i)); name != "" && value != "" {
+			// In the case of the value is a struct and has cyclonedx tag with name "-"
+			// call the getCycloneDXProperties recursively.
+			if name == "-" && reflect.ValueOf(value).Kind() == reflect.Struct {
+				props = append(props, *getCycloneDXProperties(value)...)
+			} else if reflect.ValueOf(value).Kind() == reflect.String {
+				props = append(props, cyclonedx.Property{
+					Name:  name,
+					Value: fmt.Sprint(value),
+				})
+			}
+		}
+	}
+	return &props
+}
+
+func getCycloneDXPropertyName(field reflect.StructField) string {
+	if value, exists := field.Tag.Lookup("cyclonedx"); exists {
+		return value
+	}
+	return ""
+}
+
+func getCycloneDXPropertyValue(field reflect.Value) interface{} {
+	if field.IsZero() {
+		return ""
+	}
+	switch field.Kind() {
+	case reflect.String, reflect.Bool, reflect.Int, reflect.Float32, reflect.Float64, reflect.Complex128, reflect.Complex64:
+		if field.CanInterface() {
+			return fmt.Sprint(field.Interface())
+		}
+		return ""
+	case reflect.Struct:
+		if field.CanInterface() {
+			return field.Interface()
+		}
+		return ""
+	case reflect.Ptr:
+		return getCycloneDXPropertyValue(reflect.Indirect(field))
+	}
+	return ""
+}

internal/formats/common/cyclonedxhelpers/properties_test.go

@@ -0,0 +1,138 @@
+package cyclonedxhelpers
+
+import (
+	"testing"
+
+	"github.com/CycloneDX/cyclonedx-go"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_Properties(t *testing.T) {
+	epoch := 2
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected *[]cyclonedx.Property
+	}{
+		{
+			name:     "no metadata",
+			input:    pkg.Package{},
+			expected: nil,
+		},
+		{
+			name: "from apk",
+			input: pkg.Package{
+				FoundBy: "cataloger",
+				Locations: []source.Location{
+					{Coordinates: source.Coordinates{RealPath: "test"}},
+				},
+				Metadata: pkg.ApkMetadata{
+					Package:          "libc-utils",
+					OriginPackage:    "libc-dev",
+					Maintainer:       "Natanael Copa <ncopa@alpinelinux.org>",
+					Version:          "0.7.2-r0",
+					License:          "BSD",
+					Architecture:     "x86_64",
+					URL:              "http://alpinelinux.org",
+					Description:      "Meta package to pull in correct libc",
+					Size:             0,
+					InstalledSize:    4096,
+					PullDependencies: "musl-utils",
+					PullChecksum:     "Q1p78yvTLG094tHE1+dToJGbmYzQE=",
+					GitCommitOfAport: "97b1c2842faa3bfa30f5811ffbf16d5ff9f1a479",
+					Files:            []pkg.ApkFileRecord{},
+				},
+			},
+			expected: &[]cyclonedx.Property{
+				{Name: "foundBy", Value: "cataloger"},
+				{Name: "path", Value: "test"},
+				{Name: "originPackage", Value: "libc-dev"},
+				{Name: "installedSize", Value: "4096"},
+				{Name: "pullDependencies", Value: "musl-utils"},
+				{Name: "pullChecksum", Value: "Q1p78yvTLG094tHE1+dToJGbmYzQE="},
+				{Name: "gitCommitOfApkPort", Value: "97b1c2842faa3bfa30f5811ffbf16d5ff9f1a479"},
+			},
+		},
+		{
+			name: "from dpkg",
+			input: pkg.Package{
+				MetadataType: pkg.DpkgMetadataType,
+				Metadata: pkg.DpkgMetadata{
+					Package:       "tzdata",
+					Version:       "2020a-0+deb10u1",
+					Source:        "tzdata-dev",
+					SourceVersion: "1.0",
+					Architecture:  "all",
+					InstalledSize: 3036,
+					Maintainer:    "GNU Libc Maintainers <debian-glibc@lists.debian.org>",
+					Files:         []pkg.DpkgFileRecord{},
+				},
+			},
+			expected: &[]cyclonedx.Property{
+				{Name: "metadataType", Value: "DpkgMetadata"},
+				{Name: "source", Value: "tzdata-dev"},
+				{Name: "sourceVersion", Value: "1.0"},
+				{Name: "installedSize", Value: "3036"},
+			},
+		},
+		{
+			name: "from go bin",
+			input: pkg.Package{
+				Name:         "golang.org/x/net",
+				Version:      "v0.0.0-20211006190231-62292e806868",
+				Language:     pkg.Go,
+				Type:         pkg.GoModulePkg,
+				MetadataType: pkg.GolangBinMetadataType,
+				Metadata: pkg.GolangBinMetadata{
+					GoCompiledVersion: "1.17",
+					Architecture:      "amd64",
+					H1Digest:          "h1:KlOXYy8wQWTUJYFgkUI40Lzr06ofg5IRXUK5C7qZt1k=",
+				},
+			},
+			expected: &[]cyclonedx.Property{
+				{Name: "language", Value: pkg.Go.String()},
+				{Name: "type", Value: "go-module"},
+				{Name: "metadataType", Value: "GolangBinMetadata"},
+				{Name: "goCompiledVersion", Value: "1.17"},
+				{Name: "architecture", Value: "amd64"},
+				{Name: "h1Digest", Value: "h1:KlOXYy8wQWTUJYFgkUI40Lzr06ofg5IRXUK5C7qZt1k="},
+			},
+		},
+		{
+			name: "from rpm",
+			input: pkg.Package{
+				Name:         "dive",
+				Version:      "0.9.2-1",
+				Type:         pkg.RpmPkg,
+				MetadataType: pkg.RpmdbMetadataType,
+				Metadata: pkg.RpmdbMetadata{
+					Name:      "dive",
+					Epoch:     &epoch,
+					Arch:      "x86_64",
+					Release:   "1",
+					Version:   "0.9.2",
+					SourceRpm: "dive-0.9.2-1.src.rpm",
+					Size:      12406784,
+					License:   "MIT",
+					Vendor:    "",
+					Files:     []pkg.RpmdbFileRecord{},
+				},
+			},
+			expected: &[]cyclonedx.Property{
+				{Name: "type", Value: "rpm"},
+				{Name: "metadataType", Value: "RpmdbMetadata"},
+				{Name: "epoch", Value: "2"},
+				{Name: "release", Value: "1"},
+				{Name: "sourceRpm", Value: "dive-0.9.2-1.src.rpm"},
+				{Name: "size", Value: "12406784"},
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, Properties(test.input))
+		})
+	}
+}

internal/formats/common/cyclonedxhelpers/publisher.go

@@ -0,0 +1,19 @@
+package cyclonedxhelpers
+
+import (
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func Publisher(p pkg.Package) string {
+	if hasMetadata(p) {
+		switch metadata := p.Metadata.(type) {
+		case pkg.ApkMetadata:
+			return metadata.Maintainer
+		case pkg.RpmdbMetadata:
+			return metadata.Vendor
+		case pkg.DpkgMetadata:
+			return metadata.Maintainer
+		}
+	}
+	return ""
+}

internal/formats/common/cyclonedxhelpers/publisher_test.go

@@ -0,0 +1,65 @@
+package cyclonedxhelpers
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_Publisher(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected string
+	}{
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name:     "no metadata",
+			input:    pkg.Package{},
+			expected: "",
+		},
+		{
+			name: "from apk",
+			input: pkg.Package{
+				Metadata: pkg.ApkMetadata{
+					Maintainer: "auth",
+				},
+			},
+			expected: "auth",
+		},
+		{
+			name: "from rpm",
+			input: pkg.Package{
+				Metadata: pkg.RpmdbMetadata{
+					Vendor: "auth",
+				},
+			},
+			expected: "auth",
+		},
+		{
+			name: "from dpkg",
+			input: pkg.Package{
+				Metadata: pkg.DpkgMetadata{
+					Maintainer: "auth",
+				},
+			},
+			expected: "auth",
+		},
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name: "empty",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{
+					Author: "",
+				},
+			},
+			expected: "",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, Publisher(test.input))
+		})
+	}
+}

internal/formats/common/spdxhelpers/originator_test.go

@@ -29,7 +29,7 @@ func Test_Originator(t *testing.T) {
 					},
 				},
 			},
-			expected: "auth1",
+			expected: "Person: auth1",
 		},
 		{
 			name: "from npm",
@@ -38,7 +38,7 @@ func Test_Originator(t *testing.T) {
 					Author: "auth",
 				},
 			},
-			expected: "auth",
+			expected: "Person: auth",
 		},
 		{
 			name: "from apk",
@@ -47,7 +47,7 @@ func Test_Originator(t *testing.T) {
 					Maintainer: "auth",
 				},
 			},
-			expected: "auth",
+			expected: "Person: auth",
 		},
 		{
 			name: "from python - just name",
@@ -56,7 +56,7 @@ func Test_Originator(t *testing.T) {
 					Author: "auth",
 				},
 			},
-			expected: "auth",
+			expected: "Person: auth",
 		},
 		{
 			name: "from python - just email",
@@ -65,7 +65,7 @@ func Test_Originator(t *testing.T) {
 					AuthorEmail: "auth@auth.gov",
 				},
 			},
-			expected: "auth@auth.gov",
+			expected: "Person: auth@auth.gov",
 		},
 		{
 			name: "from python - both name and email",
@@ -75,7 +75,7 @@ func Test_Originator(t *testing.T) {
 					AuthorEmail: "auth@auth.gov",
 				},
 			},
-			expected: "auth <auth@auth.gov>",
+			expected: "Person: auth (auth@auth.gov)",
 		},
 		{
 			name: "from rpm",
@@ -84,7 +84,7 @@ func Test_Originator(t *testing.T) {
 					Vendor: "auth",
 				},
 			},
-			expected: "auth",
+			expected: "Organization: auth",
 		},
 		{
 			name: "from dpkg",
@@ -93,7 +93,7 @@ func Test_Originator(t *testing.T) {
 					Maintainer: "auth",
 				},
 			},
-			expected: "auth",
+			expected: "Person: auth",
 		},
 		{
 			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION

internal/formats/common/spdxhelpers/origintor.go

@@ -6,31 +6,35 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 )
 
+// Originator needs to conform to the SPDX spec here:
+// https://spdx.github.io/spdx-spec/package-information/#76-package-originator-field
+// Available options are: <omit>, NOASSERTION, Person: <person>, Organization: <org>
 func Originator(p pkg.Package) string {
 	if hasMetadata(p) {
+		author := ""
 		switch metadata := p.Metadata.(type) {
 		case pkg.ApkMetadata:
-			return metadata.Maintainer
+			author = metadata.Maintainer
 		case pkg.NpmPackageJSONMetadata:
-			return metadata.Author
+			author = metadata.Author
 		case pkg.PythonPackageMetadata:
-			author := metadata.Author
+			author = metadata.Author
 			if author == "" {
-				return metadata.AuthorEmail
+				author = metadata.AuthorEmail
+			} else if metadata.AuthorEmail != "" {
+				author = fmt.Sprintf("%s (%s)", author, metadata.AuthorEmail)
 			}
-			if metadata.AuthorEmail != "" {
-				author += fmt.Sprintf(" <%s>", metadata.AuthorEmail)
-			}
-			return author
 		case pkg.GemMetadata:
 			if len(metadata.Authors) > 0 {
-				return metadata.Authors[0]
+				author = metadata.Authors[0]
 			}
-			return ""
 		case pkg.RpmdbMetadata:
-			return metadata.Vendor
+			return "Organization: " + metadata.Vendor
 		case pkg.DpkgMetadata:
-			return metadata.Maintainer
+			author = metadata.Maintainer
+		}
+		if author != "" {
+			return "Person: " + author
 		}
 	}
 	return ""

internal/formats/common/testutils/utils.go

@@ -9,8 +9,8 @@ import (
 	"github.com/anchore/stereoscope/pkg/filetree"
 	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/stereoscope/pkg/imagetest"
-	"github.com/anchore/syft/syft/distro"
 	"github.com/anchore/syft/syft/format"
+	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
@@ -120,13 +120,17 @@ func ImageInput(t testing.TB, testImage string, options ...ImageOption) sbom.SBO
 	src, err := source.NewFromImage(img, "user-image-input")
 	assert.NoError(t, err)
 
-	dist, err := distro.NewDistro(distro.Debian, "1.2.3", "like!")
-	assert.NoError(t, err)
-
 	return sbom.SBOM{
 		Artifacts: sbom.Artifacts{
 			PackageCatalog: catalog,
-			Distro:         &dist,
+			LinuxDistribution: &linux.Release{
+				PrettyName: "debian",
+				Name:       "debian",
+				ID:         "debian",
+				IDLike:     []string{"like!"},
+				Version:    "1.2.3",
+				VersionID:  "1.2.3",
+			},
 		},
 		Source: src.Metadata,
 		Descriptor: sbom.Descriptor{
@@ -194,16 +198,20 @@ func populateImageCatalog(catalog *pkg.Catalog, img *image.Image) {
 func DirectoryInput(t testing.TB) sbom.SBOM {
 	catalog := newDirectoryCatalog()
 
-	dist, err := distro.NewDistro(distro.Debian, "1.2.3", "like!")
-	assert.NoError(t, err)
-
 	src, err := source.NewFromDirectory("/some/path")
 	assert.NoError(t, err)
 
 	return sbom.SBOM{
 		Artifacts: sbom.Artifacts{
 			PackageCatalog: catalog,
-			Distro:         &dist,
+			LinuxDistribution: &linux.Release{
+				PrettyName: "debian",
+				Name:       "debian",
+				ID:         "debian",
+				IDLike:     []string{"like!"},
+				Version:    "1.2.3",
+				VersionID:  "1.2.3",
+			},
 		},
 		Source: src.Metadata,
 		Descriptor: sbom.Descriptor{

internal/formats/cyclonedx13json/encoder_test.go

@@ -33,9 +33,12 @@ func TestCycloneDxImageEncoder(t *testing.T) {
 func cycloneDxRedactor(s []byte) []byte {
 	serialPattern := regexp.MustCompile(`urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}`)
 	rfc3339Pattern := regexp.MustCompile(`([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\.[0-9]+)?(([Zz])|([\+|\-]([01][0-9]|2[0-3]):[0-5][0-9]))`)
-
-	for _, pattern := range []*regexp.Regexp{serialPattern, rfc3339Pattern} {
+	sha256Pattern := regexp.MustCompile(`sha256:[A-Fa-f0-9]{64}`)
+	for _, pattern := range []*regexp.Regexp{serialPattern, rfc3339Pattern, sha256Pattern} {
 		s = pattern.ReplaceAll(s, []byte("redacted"))
 	}
+	// the bom-ref will be autogenerated every time, the value here should not be directly tested in snapshot tests
+	s = regexp.MustCompile(`      "bom-ref": .*\n`).ReplaceAll(s, []byte(""))
+
 	return s
 }

internal/formats/cyclonedx13json/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden

@@ -1,10 +1,10 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.3",
-  "serialNumber": "urn:uuid:a81dc685-cf22-48e0-bda5-65ea1a8bca5b",
+  "serialNumber": "urn:uuid:258d2616-5b1f-48cd-82a3-d6c95e262950",
   "version": 1,
   "metadata": {
-    "timestamp": "2021-12-03T13:17:26-08:00",
+    "timestamp": "2022-01-14T22:47:00Z",
     "tools": [
       {
         "vendor": "anchore",
@@ -26,17 +26,78 @@
       "licenses": [
         {
           "license": {
-            "name": "MIT"
+            "id": "MIT"
           }
         }
       ],
-      "purl": "a-purl-2"
+      "cpe": "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*",
+      "purl": "a-purl-2",
+      "properties": [
+        {
+          "name": "foundBy",
+          "value": "the-cataloger-1"
+        },
+        {
+          "name": "language",
+          "value": "python"
+        },
+        {
+          "name": "type",
+          "value": "python"
+        },
+        {
+          "name": "metadataType",
+          "value": "PythonPackageMetadata"
+        },
+        {
+          "name": "path",
+          "value": "/some/path/pkg1"
+        }
+      ]
     },
     {
       "type": "library",
       "name": "package-2",
       "version": "2.0.1",
-      "purl": "a-purl-2"
+      "cpe": "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*",
+      "purl": "a-purl-2",
+      "properties": [
+        {
+          "name": "foundBy",
+          "value": "the-cataloger-2"
+        },
+        {
+          "name": "type",
+          "value": "deb"
+        },
+        {
+          "name": "metadataType",
+          "value": "DpkgMetadata"
+        },
+        {
+          "name": "path",
+          "value": "/some/path/pkg1"
+        }
+      ]
+    },
+    {
+      "type": "operating-system",
+      "name": "debian",
+      "version": "1.2.3",
+      "properties": [
+        {
+          "name": "prettyName",
+          "value": "debian"
+        },
+        {
+          "name": "id",
+          "value": "debian"
+        },
+        {
+          "name": "versionID",
+          "value": "1.2.3"
+        }
+      ]
     }
   ]
 }

internal/formats/cyclonedx13json/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden

@@ -1,10 +1,10 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.3",
-  "serialNumber": "urn:uuid:2156ac1f-c838-4e93-8dc5-a3874ffeb967",
+  "serialNumber": "urn:uuid:8a84b1cf-e918-4842-a6a8-c7fdafc55bc0",
   "version": 1,
   "metadata": {
-    "timestamp": "2021-12-03T13:17:26-08:00",
+    "timestamp": "2022-01-14T22:47:00Z",
     "tools": [
       {
         "vendor": "anchore",
@@ -26,17 +26,86 @@
       "licenses": [
         {
           "license": {
-            "name": "MIT"
+            "id": "MIT"
           }
         }
       ],
-      "purl": "a-purl-1"
+      "cpe": "cpe:2.3:*:some:package:1:*:*:*:*:*:*:*",
+      "purl": "a-purl-1",
+      "properties": [
+        {
+          "name": "foundBy",
+          "value": "the-cataloger-1"
+        },
+        {
+          "name": "language",
+          "value": "python"
+        },
+        {
+          "name": "type",
+          "value": "python"
+        },
+        {
+          "name": "metadataType",
+          "value": "PythonPackageMetadata"
+        },
+        {
+          "name": "path",
+          "value": "/somefile-1.txt"
+        },
+        {
+          "name": "layerID",
+          "value": "sha256:16e64541f2ddf59a90391ce7bb8af90313f7d373f2105d88f3d3267b72e0ebab"
+        }
+      ]
     },
     {
       "type": "library",
       "name": "package-2",
       "version": "2.0.1",
-      "purl": "a-purl-2"
+      "cpe": "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*",
+      "purl": "a-purl-2",
+      "properties": [
+        {
+          "name": "foundBy",
+          "value": "the-cataloger-2"
+        },
+        {
+          "name": "type",
+          "value": "deb"
+        },
+        {
+          "name": "metadataType",
+          "value": "DpkgMetadata"
+        },
+        {
+          "name": "path",
+          "value": "/somefile-2.txt"
+        },
+        {
+          "name": "layerID",
+          "value": "sha256:de6c235f76ea24c8503ec08891445b5d6a8bdf8249117ed8d8b0b6fb3ebe4f67"
+        }
+      ]
+    },
+    {
+      "type": "operating-system",
+      "name": "debian",
+      "version": "1.2.3",
+      "properties": [
+        {
+          "name": "prettyName",
+          "value": "debian"
+        },
+        {
+          "name": "id",
+          "value": "debian"
+        },
+        {
+          "name": "versionID",
+          "value": "1.2.3"
+        }
+      ]
     }
   ]
 }

internal/formats/cyclonedx13xml/encoder_test.go

@@ -33,9 +33,18 @@ func TestCycloneDxImageEncoder(t *testing.T) {
 func cycloneDxRedactor(s []byte) []byte {
 	serialPattern := regexp.MustCompile(`serialNumber="[a-zA-Z0-9\-:]+"`)
 	rfc3339Pattern := regexp.MustCompile(`([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\.[0-9]+)?(([Zz])|([\+|\-]([01][0-9]|2[0-3]):[0-5][0-9]))`)
+	sha256Pattern := regexp.MustCompile(`sha256:[A-Fa-f0-9]{64}`)
 
-	for _, pattern := range []*regexp.Regexp{serialPattern, rfc3339Pattern} {
+	for _, pattern := range []*regexp.Regexp{serialPattern, rfc3339Pattern, sha256Pattern} {
 		s = pattern.ReplaceAll(s, []byte("redacted"))
 	}
+
+	// the bom-ref will be autogenerated every time, the value here should not be directly tested in snapshot tests
+	bomRefPattern := regexp.MustCompile(` bom-ref="[a-zA-Z0-9\-:]+"`)
+	bomRef3339Pattern := regexp.MustCompile(`([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\.[0-9]+)?(([Zz])|([\+|\-]([01][0-9]|2[0-3]):[0-5][0-9]))`)
+	for _, pattern := range []*regexp.Regexp{bomRefPattern, bomRef3339Pattern} {
+		s = pattern.ReplaceAll(s, []byte(""))
+	}
+
 	return s
 }

internal/formats/cyclonedx13xml/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.3" serialNumber="urn:uuid:7b1c3b1d-ea3b-4022-9dcc-80f4b4cbce36" version="1">
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" serialNumber="urn:uuid:16a426e7-fcc7-4b94-abd2-66c67569cc44" version="1">
   <metadata>
-    <timestamp>2021-12-03T13:16:45-08:00</timestamp>
+    <timestamp>2022-01-14T22:46:49Z</timestamp>
     <tools>
       <tool>
         <vendor>anchore</vendor>
@@ -20,15 +20,39 @@
       <version>1.0.1</version>
       <licenses>
         <license>
-          <name>MIT</name>
+          <id>MIT</id>
         </license>
       </licenses>
+      <cpe>cpe:2.3:*:some:package:2:*:*:*:*:*:*:*</cpe>
       <purl>a-purl-2</purl>
+      <properties>
+        <property name="foundBy">the-cataloger-1</property>
+        <property name="language">python</property>
+        <property name="type">python</property>
+        <property name="metadataType">PythonPackageMetadata</property>
+        <property name="path">/some/path/pkg1</property>
+      </properties>
     </component>
     <component type="library">
       <name>package-2</name>
       <version>2.0.1</version>
+      <cpe>cpe:2.3:*:some:package:2:*:*:*:*:*:*:*</cpe>
       <purl>a-purl-2</purl>
+      <properties>
+        <property name="foundBy">the-cataloger-2</property>
+        <property name="type">deb</property>
+        <property name="metadataType">DpkgMetadata</property>
+        <property name="path">/some/path/pkg1</property>
+      </properties>
+    </component>
+    <component type="operating-system">
+      <name>debian</name>
+      <version>1.2.3</version>
+      <properties>
+        <property name="prettyName">debian</property>
+        <property name="id">debian</property>
+        <property name="versionID">1.2.3</property>
+      </properties>
     </component>
   </components>
 </bom>

internal/formats/cyclonedx13xml/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.3" serialNumber="urn:uuid:66bda3e1-888a-4d43-b906-7fd96d428753" version="1">
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" serialNumber="urn:uuid:a3d776c6-a2ca-4116-8b99-b3538dd1a460" version="1">
   <metadata>
-    <timestamp>2021-12-03T13:16:45-08:00</timestamp>
+    <timestamp>2022-01-14T22:46:49Z</timestamp>
     <tools>
       <tool>
         <vendor>anchore</vendor>
@@ -20,15 +20,41 @@
       <version>1.0.1</version>
       <licenses>
         <license>
-          <name>MIT</name>
+          <id>MIT</id>
         </license>
       </licenses>
+      <cpe>cpe:2.3:*:some:package:1:*:*:*:*:*:*:*</cpe>
       <purl>a-purl-1</purl>
+      <properties>
+        <property name="foundBy">the-cataloger-1</property>
+        <property name="language">python</property>
+        <property name="type">python</property>
+        <property name="metadataType">PythonPackageMetadata</property>
+        <property name="path">/somefile-1.txt</property>
+        <property name="layerID">sha256:16e64541f2ddf59a90391ce7bb8af90313f7d373f2105d88f3d3267b72e0ebab</property>
+      </properties>
     </component>
     <component type="library">
       <name>package-2</name>
       <version>2.0.1</version>
+      <cpe>cpe:2.3:*:some:package:2:*:*:*:*:*:*:*</cpe>
       <purl>a-purl-2</purl>
+      <properties>
+        <property name="foundBy">the-cataloger-2</property>
+        <property name="type">deb</property>
+        <property name="metadataType">DpkgMetadata</property>
+        <property name="path">/somefile-2.txt</property>
+        <property name="layerID">sha256:de6c235f76ea24c8503ec08891445b5d6a8bdf8249117ed8d8b0b6fb3ebe4f67</property>
+      </properties>
+    </component>
+    <component type="operating-system">
+      <name>debian</name>
+      <version>1.2.3</version>
+      <properties>
+        <property name="prettyName">debian</property>
+        <property name="id">debian</property>
+        <property name="versionID">1.2.3</property>
+      </properties>
     </component>
   </components>
 </bom>

internal/formats/spdx22json/model/element.go

@@ -3,7 +3,7 @@ package model
 type Element struct {
 	SPDXID string `json:"SPDXID"`
 	// Identify name of this SpdxElement.
-	Name string `json:"name"`
+	Name string `json:"name,omitempty"`
 	// Relationships referenced in the SPDX document
 	Relationships []Relationship `json:"relationships,omitempty"`
 	// Provide additional information about an SpdxElement.

internal/formats/spdx22json/to_format_model.go

@@ -2,7 +2,6 @@ package spdx22json
 
 import (
 	"fmt"
-	"path/filepath"
 	"sort"
 	"strings"
 	"time"
@@ -131,8 +130,7 @@ func toFiles(s sbom.SBOM) []model.File {
 		results = append(results, model.File{
 			Item: model.Item{
 				Element: model.Element{
-					SPDXID:  string(coordinates.ID()),
-					Name:    filepath.Base(coordinates.RealPath),
+					SPDXID:  model.ElementID(coordinates.ID()).String(),
 					Comment: comment,
 				},
 				// required, no attempt made to determine license information
@@ -206,9 +204,9 @@ func toRelationships(relationships []artifact.Relationship) (result []model.Rela
 		}
 
 		result = append(result, model.Relationship{
-			SpdxElementID:      string(r.From.ID()),
+			SpdxElementID:      model.ElementID(r.From.ID()).String(),
 			RelationshipType:   relationshipType,
-			RelatedSpdxElement: string(r.To.ID()),
+			RelatedSpdxElement: model.ElementID(r.To.ID()).String(),
 			Comment:            comment,
 		})
 	}

internal/formats/syftjson/encoder.go

@@ -8,7 +8,7 @@ import (
 )
 
 func encoder(output io.Writer, s sbom.SBOM) error {
-	doc := toFormatModel(s)
+	doc := ToFormatModel(s)
 
 	enc := json.NewEncoder(output)
 	// prevent > and < from being escaped in the payload

internal/formats/syftjson/encoder_test.go

@@ -8,7 +8,7 @@ import (
 
 	"github.com/anchore/syft/syft/artifact"
 
-	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
@@ -139,10 +139,13 @@ func TestEncodeFullJSONDocument(t *testing.T) {
 			FileContents: map[source.Coordinates]string{
 				source.NewLocation("/a/place/a").Coordinates: "the-contents",
 			},
-			Distro: &distro.Distro{
-				Type:       distro.RedHat,
-				RawVersion: "7",
-				IDLike:     "rhel",
+			LinuxDistribution: &linux.Release{
+				ID:        "redhat",
+				Version:   "7",
+				VersionID: "7",
+				IDLike: []string{
+					"rhel",
+				},
 			},
 		},
 		Relationships: []artifact.Relationship{

internal/formats/syftjson/model/distro.go

@@ -1,8 +0,0 @@
-package model
-
-// Distro provides information about a detected Linux Distro.
-type Distro struct {
-	Name    string `json:"name"`    // Name of the Linux distribution
-	Version string `json:"version"` // Version of the Linux distribution (major or major.minor version)
-	IDLike  string `json:"idLike"`  // the ID_LIKE field found within the /etc/os-release file
-}

internal/formats/syftjson/model/document.go

@@ -7,7 +7,7 @@ type Document struct {
 	Files                 []File         `json:"files,omitempty"`   // note: must have omitempty
 	Secrets               []Secrets      `json:"secrets,omitempty"` // note: must have omitempty
 	Source                Source         `json:"source"`            // Source represents the original object that was cataloged
-	Distro                Distro         `json:"distro"`            // Distro represents the Linux distribution that was detected from the source
+	Distro                LinuxRelease   `json:"distro"`            // Distro represents the Linux distribution that was detected from the source
 	Descriptor            Descriptor     `json:"descriptor"`        // Descriptor is a block containing self-describing information about syft
 	Schema                Schema         `json:"schema"`            // Schema is a block reserved for defining the version for the shape of this JSON document and where to find the schema document to validate the shape
 }

internal/formats/syftjson/model/linux_release.go

@@ -0,0 +1,38 @@
+package model
+
+import (
+	"encoding/json"
+)
+
+type IDLikes []string
+
+type LinuxRelease struct {
+	PrettyName       string  `json:"prettyName,omitempty"`
+	Name             string  `json:"name,omitempty"`
+	ID               string  `json:"id,omitempty"`
+	IDLike           IDLikes `json:"idLike,omitempty"`
+	Version          string  `json:"version,omitempty"`
+	VersionID        string  `json:"versionID,omitempty"`
+	Variant          string  `json:"variant,omitempty"`
+	VariantID        string  `json:"variantID,omitempty"`
+	HomeURL          string  `json:"homeURL,omitempty"`
+	SupportURL       string  `json:"supportURL,omitempty"`
+	BugReportURL     string  `json:"bugReportURL,omitempty"`
+	PrivacyPolicyURL string  `json:"privacyPolicyURL,omitempty"`
+	CPEName          string  `json:"cpeName,omitempty"`
+}
+
+func (s *IDLikes) UnmarshalJSON(data []byte) error {
+	var str string
+	var strSlice []string
+
+	// we support unmarshalling from a single value to support syft json schema v2
+	if err := json.Unmarshal(data, &str); err == nil {
+		*s = []string{str}
+	} else if err := json.Unmarshal(data, &strSlice); err == nil {
+		*s = strSlice
+	} else {
+		return err
+	}
+	return nil
+}

internal/formats/syftjson/model/linux_release_test.go

@@ -0,0 +1,47 @@
+package model
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestIDLikes_UnmarshalJSON(t *testing.T) {
+	tests := []struct {
+		name     string
+		data     interface{}
+		expected IDLikes
+	}{
+		{
+			name: "single string",
+			data: "well hello there!",
+			expected: IDLikes{
+				"well hello there!",
+			},
+		},
+		{
+			name: "multiple strings",
+			data: []string{
+				"well hello there!",
+				"...hello there, john!",
+			},
+			expected: IDLikes{
+				"well hello there!",
+				"...hello there, john!",
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			data, err := json.Marshal(&tt.data)
+			require.NoError(t, err)
+
+			var obj IDLikes
+			require.NoError(t, json.Unmarshal(data, &obj))
+
+			assert.Equal(t, tt.expected, obj)
+		})
+	}
+}

internal/formats/syftjson/model/package.go

@@ -32,8 +32,8 @@ type PackageBasicData struct {
 
 // PackageCustomData contains ambiguous values (type-wise) from pkg.Package.
 type PackageCustomData struct {
-	MetadataType pkg.MetadataType `json:"metadataType"`
-	Metadata     interface{}      `json:"metadata"`
+	MetadataType pkg.MetadataType `json:"metadataType,omitempty"`
+	Metadata     interface{}      `json:"metadata,omitempty"`
 }
 
 // packageMetadataUnpacker is all values needed from Package to disambiguate ambiguous fields during json unmarshaling.
@@ -118,6 +118,14 @@ func (p *Package) UnmarshalJSON(b []byte) error {
 			return err
 		}
 		p.Metadata = payload
+	case pkg.PhpComposerJSONMetadataType:
+		var payload pkg.PhpComposerJSONMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	default:
+		log.Warnf("unknown package metadata type=%q for packageID=%q", p.MetadataType, p.ID)
 	}
 
 	return nil

internal/formats/syftjson/model/source.go

@@ -30,7 +30,7 @@ func (s *Source) UnmarshalJSON(b []byte) error {
 	s.Type = unpacker.Type
 
 	switch s.Type {
-	case "directory":
+	case "directory", "file":
 		if target, err := strconv.Unquote(string(unpacker.Target)); err == nil {
 			s.Target = target
 		} else {

internal/formats/syftjson/model/source_test.go

@@ -0,0 +1,136 @@
+package model
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/anchore/syft/syft/source"
+
+	"github.com/google/go-cmp/cmp"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSource_UnmarshalJSON(t *testing.T) {
+	cases := []struct {
+		name           string
+		input          []byte
+		expectedSource *Source
+		errAssertion   assert.ErrorAssertionFunc
+	}{
+		{
+			name: "directory",
+			input: []byte(`{
+				"type": "directory",
+				"target":"/var/lib/foo"
+			}`),
+			expectedSource: &Source{
+				Type:   "directory",
+				Target: "/var/lib/foo",
+			},
+			errAssertion: assert.NoError,
+		},
+		{
+			name: "image",
+			input: []byte(`{
+				"type": "image",
+				"target": {
+					"userInput": "alpine:3.10",
+					"imageID": "sha256:e7b300aee9f9bf3433d32bc9305bfdd22183beb59d933b48d77ab56ba53a197a",
+					"manifestDigest": "sha256:e515aad2ed234a5072c4d2ef86a1cb77d5bfe4b11aa865d9214875734c4eeb3c",
+					"mediaType": "application/vnd.docker.distribution.manifest.v2+json",
+					"tags": [],
+					"imageSize": 5576169,
+					"layers": [
+						{
+							"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
+							"digest": "sha256:9fb3aa2f8b8023a4bebbf92aa567caf88e38e969ada9f0ac12643b2847391635",
+							"size": 5576169
+						}
+					],
+					"manifest": "ewogICAic2NoZW1hVmVyc2lvbiI6IDIsCiAgICJtZWRpYVR5cGUiOiAiYXBwbGljYXRpb24vdm5kLmRvY2tlci5kaXN0cmlidXRpb24ubWFuaWZlc3QudjIranNvbiIsCiAgICJjb25maWciOiB7CiAgICAgICJtZWRpYVR5cGUiOiAiYXBwbGljYXRpb24vdm5kLmRvY2tlci5jb250YWluZXIuaW1hZ2UudjEranNvbiIsCiAgICAgICJzaXplIjogMTQ3MiwKICAgICAgImRpZ2VzdCI6ICJzaGEyNTY6ZTdiMzAwYWVlOWY5YmYzNDMzZDMyYmM5MzA1YmZkZDIyMTgzYmViNTlkOTMzYjQ4ZDc3YWI1NmJhNTNhMTk3YSIKICAgfSwKICAgImxheWVycyI6IFsKICAgICAgewogICAgICAgICAibWVkaWFUeXBlIjogImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuaW1hZ2Uucm9vdGZzLmRpZmYudGFyLmd6aXAiLAogICAgICAgICAic2l6ZSI6IDI3OTgzMzgsCiAgICAgICAgICJkaWdlc3QiOiAic2hhMjU2OjM5NmMzMTgzNzExNmFjMjkwNDU4YWZjYjkyOGY2OGI2Y2MxYzdiZGQ2OTYzZmM3MmY1MmYzNjVhMmE4OWMxYjUiCiAgICAgIH0KICAgXQp9",
+					"config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJIb3N0bmFtZSI6IiIsIkRvbWFpbm5hbWUiOiIiLCJVc2VyIjoiIiwiQXR0YWNoU3RkaW4iOmZhbHNlLCJBdHRhY2hTdGRvdXQiOmZhbHNlLCJBdHRhY2hTdGRlcnIiOmZhbHNlLCJUdHkiOmZhbHNlLCJPcGVuU3RkaW4iOmZhbHNlLCJTdGRpbk9uY2UiOmZhbHNlLCJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiQ21kIjpbIi9iaW4vc2giXSwiSW1hZ2UiOiJzaGEyNTY6ZWIyMDgwYzQ1NWU5NGMyMmFlMzViM2FlZjllMDc4YzQ5MmEwMDc5NTQxMmUwMjZlNGQ2YjQxZWY2NGJjN2RkOCIsIlZvbHVtZXMiOm51bGwsIldvcmtpbmdEaXIiOiIiLCJFbnRyeXBvaW50IjpudWxsLCJPbkJ1aWxkIjpudWxsLCJMYWJlbHMiOm51bGx9LCJjb250YWluZXIiOiJmZGI3ZTgwZTMzMzllOGQwNTk5MjgyZTYwNmM5MDdhYTU4ODFlZTRjNjY4YTY4MTM2MTE5ZTZkZmFjNmNlM2E0IiwiY29udGFpbmVyX2NvbmZpZyI6eyJIb3N0bmFtZSI6ImZkYjdlODBlMzMzOSIsIkRvbWFpbm5hbWUiOiIiLCJVc2VyIjoiIiwiQXR0YWNoU3RkaW4iOmZhbHNlLCJBdHRhY2hTdGRvdXQiOmZhbHNlLCJBdHRhY2hTdGRlcnIiOmZhbHNlLCJUdHkiOmZhbHNlLCJPcGVuU3RkaW4iOmZhbHNlLCJTdGRpbk9uY2UiOmZhbHNlLCJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiQ21kIjpbIi9iaW4vc2giLCItYyIsIiMobm9wKSAiLCJDTUQgW1wiL2Jpbi9zaFwiXSJdLCJJbWFnZSI6InNoYTI1NjplYjIwODBjNDU1ZTk0YzIyYWUzNWIzYWVmOWUwNzhjNDkyYTAwNzk1NDEyZTAyNmU0ZDZiNDFlZjY0YmM3ZGQ4IiwiVm9sdW1lcyI6bnVsbCwiV29ya2luZ0RpciI6IiIsIkVudHJ5cG9pbnQiOm51bGwsIk9uQnVpbGQiOm51bGwsIkxhYmVscyI6e319LCJjcmVhdGVkIjoiMjAyMS0wNC0xNFQxOToyMDowNS4zMzgzOTc3NjFaIiwiZG9ja2VyX3ZlcnNpb24iOiIxOS4wMy4xMiIsImhpc3RvcnkiOlt7ImNyZWF0ZWQiOiIyMDIxLTA0LTE0VDE5OjIwOjA0Ljk4NzIxOTEyNFoiLCJjcmVhdGVkX2J5IjoiL2Jpbi9zaCAtYyAjKG5vcCkgQUREIGZpbGU6YzUzNzdlYWE5MjZiZjQxMmRkOGQ0YTA4YjBhMWYyMzk5Y2ZkNzA4NzQzNTMzYjBhYTAzYjUzZDE0Y2I0YmI0ZSBpbiAvICJ9LHsiY3JlYXRlZCI6IjIwMjEtMDQtMTRUMTk6MjA6MDUuMzM4Mzk3NzYxWiIsImNyZWF0ZWRfYnkiOiIvYmluL3NoIC1jICMobm9wKSAgQ01EIFtcIi9iaW4vc2hcIl0iLCJlbXB0eV9sYXllciI6dHJ1ZX1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6OWZiM2FhMmY4YjgwMjNhNGJlYmJmOTJhYTU2N2NhZjg4ZTM4ZTk2OWFkYTlmMGFjMTI2NDNiMjg0NzM5MTYzNSJdfX0=",
+					"repoDigests": [
+						"index.docker.io/library/alpine@sha256:451eee8bedcb2f029756dc3e9d73bab0e7943c1ac55cff3a4861c52a0fdd3e98"
+					]
+				}
+			}`),
+			expectedSource: &Source{
+				Type: "image",
+				Target: source.ImageMetadata{
+					UserInput:      "alpine:3.10",
+					ID:             "sha256:e7b300aee9f9bf3433d32bc9305bfdd22183beb59d933b48d77ab56ba53a197a",
+					ManifestDigest: "sha256:e515aad2ed234a5072c4d2ef86a1cb77d5bfe4b11aa865d9214875734c4eeb3c",
+					MediaType:      "application/vnd.docker.distribution.manifest.v2+json",
+					Tags:           []string{},
+					Size:           5576169,
+					Layers: []source.LayerMetadata{
+						{
+							MediaType: "application/vnd.docker.image.rootfs.diff.tar.gzip",
+							Digest:    "sha256:9fb3aa2f8b8023a4bebbf92aa567caf88e38e969ada9f0ac12643b2847391635",
+							Size:      5576169,
+						},
+					},
+					RawManifest: []byte(`{
+   "schemaVersion": 2,
+   "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
+   "config": {
+      "mediaType": "application/vnd.docker.container.image.v1+json",
+      "size": 1472,
+      "digest": "sha256:e7b300aee9f9bf3433d32bc9305bfdd22183beb59d933b48d77ab56ba53a197a"
+   },
+   "layers": [
+      {
+         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
+         "size": 2798338,
+         "digest": "sha256:396c31837116ac290458afcb928f68b6cc1c7bdd6963fc72f52f365a2a89c1b5"
+      }
+   ]
+}`),
+					RawConfig: []byte(`{"architecture":"amd64","config":{"Hostname":"","Domainname":"","User":"","AttachStdin":false,"AttachStdout":false,"AttachStderr":false,"Tty":false,"OpenStdin":false,"StdinOnce":false,"Env":["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"],"Cmd":["/bin/sh"],"Image":"sha256:eb2080c455e94c22ae35b3aef9e078c492a00795412e026e4d6b41ef64bc7dd8","Volumes":null,"WorkingDir":"","Entrypoint":null,"OnBuild":null,"Labels":null},"container":"fdb7e80e3339e8d0599282e606c907aa5881ee4c668a68136119e6dfac6ce3a4","container_config":{"Hostname":"fdb7e80e3339","Domainname":"","User":"","AttachStdin":false,"AttachStdout":false,"AttachStderr":false,"Tty":false,"OpenStdin":false,"StdinOnce":false,"Env":["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"],"Cmd":["/bin/sh","-c","#(nop) ","CMD [\"/bin/sh\"]"],"Image":"sha256:eb2080c455e94c22ae35b3aef9e078c492a00795412e026e4d6b41ef64bc7dd8","Volumes":null,"WorkingDir":"","Entrypoint":null,"OnBuild":null,"Labels":{}},"created":"2021-04-14T19:20:05.338397761Z","docker_version":"19.03.12","history":[{"created":"2021-04-14T19:20:04.987219124Z","created_by":"/bin/sh -c #(nop) ADD file:c5377eaa926bf412dd8d4a08b0a1f2399cfd708743533b0aa03b53d14cb4bb4e in / "},{"created":"2021-04-14T19:20:05.338397761Z","created_by":"/bin/sh -c #(nop)  CMD [\"/bin/sh\"]","empty_layer":true}],"os":"linux","rootfs":{"type":"layers","diff_ids":["sha256:9fb3aa2f8b8023a4bebbf92aa567caf88e38e969ada9f0ac12643b2847391635"]}}`),
+					RepoDigests: []string{
+						"index.docker." +
+							"io/library/alpine@sha256:451eee8bedcb2f029756dc3e9d73bab0e7943c1ac55cff3a4861c52a0fdd3e98",
+					},
+				},
+			},
+			errAssertion: assert.NoError,
+		},
+		{
+			name: "file",
+			input: []byte(`{
+				"type": "file",
+				"target":"/var/lib/foo/go.mod"
+			}`),
+			expectedSource: &Source{
+				Type:   "file",
+				Target: "/var/lib/foo/go.mod",
+			},
+			errAssertion: assert.NoError,
+		},
+		{
+			name: "unknown source type",
+			input: []byte(`{
+				"type": "unknown-thing",
+				"target":"/var/lib/foo"
+			}`),
+			expectedSource: &Source{
+				Type: "unknown-thing",
+			},
+			errAssertion: assert.Error,
+		},
+	}
+
+	for _, testCase := range cases {
+		t.Run(testCase.name, func(t *testing.T) {
+			source := new(Source)
+
+			err := json.Unmarshal(testCase.input, source)
+
+			testCase.errAssertion(t, err)
+			if diff := cmp.Diff(testCase.expectedSource, source); diff != "" {
+				t.Errorf("unexpected result from Source unmarshaling (-want +got)\n%s", diff)
+			}
+		})
+	}
+}

internal/formats/syftjson/test-fixtures/snapshot/TestDirectoryEncoder.golden

@@ -71,9 +71,14 @@
   "target": "/some/path"
  },
  "distro": {
+  "prettyName": "debian",
   "name": "debian",
+  "id": "debian",
+  "idLike": [
+   "like!"
+  ],
   "version": "1.2.3",
-  "idLike": "like!"
+  "versionID": "1.2.3"
  },
  "descriptor": {
   "name": "syft",
@@ -83,7 +88,7 @@
   }
  },
  "schema": {
-  "version": "2.0.2",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-2.0.2.json"
+  "version": "3.0.1",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.0.1.json"
  }
 }

internal/formats/syftjson/test-fixtures/snapshot/TestEncodeFullJSONDocument.golden

@@ -167,9 +167,12 @@
   }
  },
  "distro": {
-  "name": "redhat",
+  "id": "redhat",
+  "idLike": [
+   "rhel"
+  ],
   "version": "7",
-  "idLike": "rhel"
+  "versionID": "7"
  },
  "descriptor": {
   "name": "syft",
@@ -179,7 +182,7 @@
   }
  },
  "schema": {
-  "version": "2.0.2",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-2.0.2.json"
+  "version": "3.0.1",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.0.1.json"
  }
 }

internal/formats/syftjson/test-fixtures/snapshot/TestImageEncoder.golden

@@ -1,7 +1,7 @@
 {
  "artifacts": [
   {
-   "id": "d16127444133b5c1",
+   "id": "3a6c7061f86ac3f7",
    "name": "package-1",
    "version": "1.0.1",
    "type": "python",
@@ -9,7 +9,7 @@
    "locations": [
     {
      "path": "/somefile-1.txt",
-     "layerID": "sha256:16e64541f2ddf59a90391ce7bb8af90313f7d373f2105d88f3d3267b72e0ebab"
+     "layerID": "sha256:135c16aca35f76c25a18cb6650c621a46b8b79864ad6f2834167de2679bb587d"
     }
    ],
    "licenses": [
@@ -32,7 +32,7 @@
    }
   },
   {
-   "id": "24907357f3705420",
+   "id": "4e916af2d387ce9",
    "name": "package-2",
    "version": "2.0.1",
    "type": "deb",
@@ -40,7 +40,7 @@
    "locations": [
     {
      "path": "/somefile-2.txt",
-     "layerID": "sha256:de6c235f76ea24c8503ec08891445b5d6a8bdf8249117ed8d8b0b6fb3ebe4f67"
+     "layerID": "sha256:c751a2f31455b3049bcab3e3af5861c9431116c9f4a46213e44dbeff8ab36985"
     }
    ],
    "licenses": [],
@@ -67,7 +67,7 @@
   "type": "image",
   "target": {
    "userInput": "user-image-input",
-   "imageID": "sha256:9624b89704d23fa5f61b427379d172dac91dc7a508c4d7dea7aed0e04a4cf39e",
+   "imageID": "sha256:9998e833a66442934ad948e5cbe898630773c369ef16517623254fa46edd171b",
    "manifestDigest": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368",
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
    "tags": [
@@ -77,24 +77,29 @@
    "layers": [
     {
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:16e64541f2ddf59a90391ce7bb8af90313f7d373f2105d88f3d3267b72e0ebab",
+     "digest": "sha256:135c16aca35f76c25a18cb6650c621a46b8b79864ad6f2834167de2679bb587d",
      "size": 22
     },
     {
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:de6c235f76ea24c8503ec08891445b5d6a8bdf8249117ed8d8b0b6fb3ebe4f67",
+     "digest": "sha256:c751a2f31455b3049bcab3e3af5861c9431116c9f4a46213e44dbeff8ab36985",
      "size": 16
     }
    ],
-   "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NjcsImRpZ2VzdCI6InNoYTI1Njo5NjI0Yjg5NzA0ZDIzZmE1ZjYxYjQyNzM3OWQxNzJkYWM5MWRjN2E1MDhjNGQ3ZGVhN2FlZDBlMDRhNGNmMzllIn0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1NjoxNmU2NDU0MWYyZGRmNTlhOTAzOTFjZTdiYjhhZjkwMzEzZjdkMzczZjIxMDVkODhmM2QzMjY3YjcyZTBlYmFiIn0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2OmRlNmMyMzVmNzZlYTI0Yzg1MDNlYzA4ODkxNDQ1YjVkNmE4YmRmODI0OTExN2VkOGQ4YjBiNmZiM2ViZTRmNjcifV19",
-   "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8iLCJPbkJ1aWxkIjpudWxsfSwiY3JlYXRlZCI6IjIwMjEtMTItMDFUMTI6MTM6NDMuNDAxMzkxNFoiLCJoaXN0b3J5IjpbeyJjcmVhdGVkIjoiMjAyMS0xMi0wMVQxMjoxMzo0My4zNDM2MzQyWiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0xLnR4dCAvc29tZWZpbGUtMS50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn0seyJjcmVhdGVkIjoiMjAyMS0xMi0wMVQxMjoxMzo0My40MDEzOTE0WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0yLnR4dCAvc29tZWZpbGUtMi50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6MTZlNjQ1NDFmMmRkZjU5YTkwMzkxY2U3YmI4YWY5MDMxM2Y3ZDM3M2YyMTA1ZDg4ZjNkMzI2N2I3MmUwZWJhYiIsInNoYTI1NjpkZTZjMjM1Zjc2ZWEyNGM4NTAzZWMwODg5MTQ0NWI1ZDZhOGJkZjgyNDkxMTdlZDhkOGIwYjZmYjNlYmU0ZjY3Il19fQ==",
+   "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NzMsImRpZ2VzdCI6InNoYTI1Njo5OTk4ZTgzM2E2NjQ0MjkzNGFkOTQ4ZTVjYmU4OTg2MzA3NzNjMzY5ZWYxNjUxNzYyMzI1NGZhNDZlZGQxNzFiIn0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1NjoxMzVjMTZhY2EzNWY3NmMyNWExOGNiNjY1MGM2MjFhNDZiOGI3OTg2NGFkNmYyODM0MTY3ZGUyNjc5YmI1ODdkIn0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2OmM3NTFhMmYzMTQ1NWIzMDQ5YmNhYjNlM2FmNTg2MWM5NDMxMTE2YzlmNGE0NjIxM2U0NGRiZWZmOGFiMzY5ODUifV19",
+   "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8iLCJPbkJ1aWxkIjpudWxsfSwiY3JlYXRlZCI6IjIwMjItMDEtMThUMjA6MzA6MTMuMDQ0Njg1NTg5WiIsImhpc3RvcnkiOlt7ImNyZWF0ZWQiOiIyMDIyLTAxLTE4VDIwOjMwOjEyLjE5OTA3MjQxOVoiLCJjcmVhdGVkX2J5IjoiQUREIGZpbGUtMS50eHQgL3NvbWVmaWxlLTEudHh0ICMgYnVpbGRraXQiLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCJ9LHsiY3JlYXRlZCI6IjIwMjItMDEtMThUMjA6MzA6MTMuMDQ0Njg1NTg5WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0yLnR4dCAvc29tZWZpbGUtMi50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6MTM1YzE2YWNhMzVmNzZjMjVhMThjYjY2NTBjNjIxYTQ2YjhiNzk4NjRhZDZmMjgzNDE2N2RlMjY3OWJiNTg3ZCIsInNoYTI1NjpjNzUxYTJmMzE0NTViMzA0OWJjYWIzZTNhZjU4NjFjOTQzMTExNmM5ZjRhNDYyMTNlNDRkYmVmZjhhYjM2OTg1Il19fQ==",
    "repoDigests": []
   }
  },
  "distro": {
+  "prettyName": "debian",
   "name": "debian",
+  "id": "debian",
+  "idLike": [
+   "like!"
+  ],
   "version": "1.2.3",
-  "idLike": "like!"
+  "versionID": "1.2.3"
  },
  "descriptor": {
   "name": "syft",
@@ -104,7 +109,7 @@
   }
  },
  "schema": {
-  "version": "2.0.2",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-2.0.2.json"
+  "version": "3.0.1",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.0.1.json"
  }
 }

internal/formats/syftjson/to_format_model.go

@@ -5,6 +5,8 @@ import (
 	"sort"
 	"strconv"
 
+	"github.com/anchore/syft/syft/linux"
+
 	"github.com/anchore/syft/syft/file"
 
 	"github.com/anchore/syft/syft/artifact"
@@ -14,12 +16,14 @@ import (
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/formats/syftjson/model"
 	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/distro"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
 )
 
-func toFormatModel(s sbom.SBOM) model.Document {
+// ToFormatModel transforms the sbom import a format-specific model.
+// note: this is needed for anchore import functionality
+// TODO: unexport this when/if anchore import functionality is removed
+func ToFormatModel(s sbom.SBOM) model.Document {
 	src, err := toSourceModel(s.Source)
 	if err != nil {
 		log.Warnf("unable to create syft-json source object: %+v", err)
@@ -31,7 +35,7 @@ func toFormatModel(s sbom.SBOM) model.Document {
 		Files:                 toFile(s),
 		Secrets:               toSecrets(s.Artifacts.Secrets),
 		Source:                src,
-		Distro:                toDistroModel(s.Artifacts.Distro),
+		Distro:                toLinuxReleaser(s.Artifacts.LinuxDistribution),
 		Descriptor:            toDescriptor(s.Descriptor),
 		Schema: model.Schema{
 			Version: internal.JSONSchemaVersion,
@@ -40,6 +44,27 @@ func toFormatModel(s sbom.SBOM) model.Document {
 	}
 }
 
+func toLinuxReleaser(d *linux.Release) model.LinuxRelease {
+	if d == nil {
+		return model.LinuxRelease{}
+	}
+	return model.LinuxRelease{
+		PrettyName:       d.PrettyName,
+		Name:             d.Name,
+		ID:               d.ID,
+		IDLike:           d.IDLike,
+		Version:          d.Version,
+		VersionID:        d.VersionID,
+		Variant:          d.Variant,
+		VariantID:        d.VariantID,
+		HomeURL:          d.HomeURL,
+		SupportURL:       d.SupportURL,
+		BugReportURL:     d.BugReportURL,
+		PrivacyPolicyURL: d.PrivacyPolicyURL,
+		CPEName:          d.CPEName,
+	}
+}
+
 func toDescriptor(d sbom.Descriptor) model.Descriptor {
 	return model.Descriptor{
 		Name:          d.Name,
@@ -210,16 +235,3 @@ func toSourceModel(src source.Metadata) (model.Source, error) {
 		return model.Source{}, fmt.Errorf("unsupported source: %q", src.Scheme)
 	}
 }
-
-// toDistroModel creates a struct with the Linux distribution to be represented in JSON.
-func toDistroModel(d *distro.Distro) model.Distro {
-	if d == nil {
-		return model.Distro{}
-	}
-
-	return model.Distro{
-		Name:    d.Name(),
-		Version: d.FullVersion(),
-		IDLike:  d.IDLike,
-	}
-}

internal/formats/syftjson/to_syft_model.go

@@ -3,28 +3,45 @@ package syftjson
 import (
 	"github.com/anchore/syft/internal/formats/syftjson/model"
 	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/distro"
+	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
+	"github.com/google/go-cmp/cmp"
 )
 
 func toSyftModel(doc model.Document) (*sbom.SBOM, error) {
-	dist, err := distro.NewDistro(distro.Type(doc.Distro.Name), doc.Distro.Version, doc.Distro.IDLike)
-	if err != nil {
-		return nil, err
-	}
-
 	return &sbom.SBOM{
 		Artifacts: sbom.Artifacts{
-			PackageCatalog: toSyftCatalog(doc.Artifacts),
-			Distro:         &dist,
+			PackageCatalog:    toSyftCatalog(doc.Artifacts),
+			LinuxDistribution: toSyftLinuxRelease(doc.Distro),
 		},
 		Source:     *toSyftSourceData(doc.Source),
 		Descriptor: toSyftDescriptor(doc.Descriptor),
 	}, nil
 }
 
+func toSyftLinuxRelease(d model.LinuxRelease) *linux.Release {
+	if cmp.Equal(d, model.LinuxRelease{}) {
+		return nil
+	}
+	return &linux.Release{
+		PrettyName:       d.PrettyName,
+		Name:             d.Name,
+		ID:               d.ID,
+		IDLike:           d.IDLike,
+		Version:          d.Version,
+		VersionID:        d.VersionID,
+		Variant:          d.Variant,
+		VariantID:        d.VariantID,
+		HomeURL:          d.HomeURL,
+		SupportURL:       d.SupportURL,
+		BugReportURL:     d.BugReportURL,
+		PrivacyPolicyURL: d.PrivacyPolicyURL,
+		CPEName:          d.CPEName,
+	}
+}
+
 func toSyftDescriptor(d model.Descriptor) sbom.Descriptor {
 	return sbom.Descriptor{
 		Name:          d.Name,

internal/log/log.go

@@ -3,7 +3,7 @@ Package log contains the singleton object and helper functions for facilitating
 */
 package log
 
-import "github.com/anchore/syft/syft/logger"
+import "github.com/anchore/go-logger"
 
 // Log is the singleton used to facilitate logging internally within syft
 var Log logger.Logger = &nopLogger{}
@@ -47,3 +47,8 @@ func Debugf(format string, args ...interface{}) {
 func Debug(args ...interface{}) {
 	Log.Debug(args...)
 }
+
+// WithFields returns a message logger with multiple key-value fields.
+func WithFields(fields ...interface{}) logger.MessageLogger {
+	return Log.WithFields(fields...)
+}

internal/log/nop.go

@@ -1,12 +1,18 @@
 package log
 
+import (
+	"github.com/anchore/go-logger"
+)
+
 type nopLogger struct{}
 
-func (l *nopLogger) Errorf(format string, args ...interface{}) {}
-func (l *nopLogger) Error(args ...interface{})                 {}
-func (l *nopLogger) Warnf(format string, args ...interface{})  {}
-func (l *nopLogger) Warn(args ...interface{})                  {}
-func (l *nopLogger) Infof(format string, args ...interface{})  {}
-func (l *nopLogger) Info(args ...interface{})                  {}
-func (l *nopLogger) Debugf(format string, args ...interface{}) {}
-func (l *nopLogger) Debug(args ...interface{})                 {}
+func (l *nopLogger) Errorf(format string, args ...interface{})             {}
+func (l *nopLogger) Error(args ...interface{})                             {}
+func (l *nopLogger) Warnf(format string, args ...interface{})              {}
+func (l *nopLogger) Warn(args ...interface{})                              {}
+func (l *nopLogger) Infof(format string, args ...interface{})              {}
+func (l *nopLogger) Info(args ...interface{})                              {}
+func (l *nopLogger) Debugf(format string, args ...interface{})             {}
+func (l *nopLogger) Debug(args ...interface{})                             {}
+func (l *nopLogger) WithFields(fields ...interface{}) logger.MessageLogger { return l }
+func (l *nopLogger) Nested(fields ...interface{}) logger.Logger            { return l }

internal/logger/doc.go

@@ -1,4 +0,0 @@
-/*
-Package logger contains implementations for the syft.logger.Logger interface.
-*/
-package logger

internal/logger/logrus.go

@@ -1,164 +0,0 @@
-package logger
-
-import (
-	"fmt"
-	"io"
-	"io/fs"
-	"io/ioutil"
-	"os"
-
-	"github.com/sirupsen/logrus"
-	prefixed "github.com/x-cray/logrus-prefixed-formatter"
-)
-
-const defaultLogFilePermissions fs.FileMode = 0644
-
-// LogrusConfig contains all configurable values for the Logrus logger
-type LogrusConfig struct {
-	EnableConsole bool
-	EnableFile    bool
-	Structured    bool
-	Level         logrus.Level
-	FileLocation  string
-}
-
-// LogrusLogger contains all runtime values for using Logrus with the configured output target and input configuration values.
-type LogrusLogger struct {
-	Config LogrusConfig
-	Logger *logrus.Logger
-	Output io.Writer
-}
-
-// LogrusNestedLogger is a wrapper for Logrus to enable nested logging configuration (loggers that always attach key-value pairs to all log entries)
-type LogrusNestedLogger struct {
-	Logger *logrus.Entry
-}
-
-// NewLogrusLogger creates a new LogrusLogger with the given configuration
-func NewLogrusLogger(cfg LogrusConfig) *LogrusLogger {
-	appLogger := logrus.New()
-
-	var output io.Writer
-	switch {
-	case cfg.EnableConsole && cfg.EnableFile:
-		logFile, err := os.OpenFile(cfg.FileLocation, os.O_WRONLY|os.O_CREATE, defaultLogFilePermissions)
-		if err != nil {
-			panic(fmt.Errorf("unable to setup log file: %w", err))
-		}
-		output = io.MultiWriter(os.Stderr, logFile)
-	case cfg.EnableConsole:
-		output = os.Stderr
-	case cfg.EnableFile:
-		logFile, err := os.OpenFile(cfg.FileLocation, os.O_WRONLY|os.O_CREATE, defaultLogFilePermissions)
-		if err != nil {
-			panic(fmt.Errorf("unable to setup log file: %w", err))
-		}
-		output = logFile
-	default:
-		output = ioutil.Discard
-	}
-
-	appLogger.SetOutput(output)
-	appLogger.SetLevel(cfg.Level)
-
-	if cfg.Structured {
-		appLogger.SetFormatter(&logrus.JSONFormatter{
-			TimestampFormat:   "2006-01-02 15:04:05",
-			DisableTimestamp:  false,
-			DisableHTMLEscape: false,
-			PrettyPrint:       false,
-		})
-	} else {
-		appLogger.SetFormatter(&prefixed.TextFormatter{
-			TimestampFormat: "2006-01-02 15:04:05",
-			ForceColors:     true,
-			ForceFormatting: true,
-		})
-	}
-
-	return &LogrusLogger{
-		Config: cfg,
-		Logger: appLogger,
-		Output: output,
-	}
-}
-
-// Debugf takes a formatted template string and template arguments for the debug logging level.
-func (l *LogrusLogger) Debugf(format string, args ...interface{}) {
-	l.Logger.Debugf(format, args...)
-}
-
-// Infof takes a formatted template string and template arguments for the info logging level.
-func (l *LogrusLogger) Infof(format string, args ...interface{}) {
-	l.Logger.Infof(format, args...)
-}
-
-// Warnf takes a formatted template string and template arguments for the warning logging level.
-func (l *LogrusLogger) Warnf(format string, args ...interface{}) {
-	l.Logger.Warnf(format, args...)
-}
-
-// Errorf takes a formatted template string and template arguments for the error logging level.
-func (l *LogrusLogger) Errorf(format string, args ...interface{}) {
-	l.Logger.Errorf(format, args...)
-}
-
-// Debug logs the given arguments at the debug logging level.
-func (l *LogrusLogger) Debug(args ...interface{}) {
-	l.Logger.Debug(args...)
-}
-
-// Info logs the given arguments at the info logging level.
-func (l *LogrusLogger) Info(args ...interface{}) {
-	l.Logger.Info(args...)
-}
-
-// Warn logs the given arguments at the warning logging level.
-func (l *LogrusLogger) Warn(args ...interface{}) {
-	l.Logger.Warn(args...)
-}
-
-// Error logs the given arguments at the error logging level.
-func (l *LogrusLogger) Error(args ...interface{}) {
-	l.Logger.Error(args...)
-}
-
-// Debugf takes a formatted template string and template arguments for the debug logging level.
-func (l *LogrusNestedLogger) Debugf(format string, args ...interface{}) {
-	l.Logger.Debugf(format, args...)
-}
-
-// Infof takes a formatted template string and template arguments for the info logging level.
-func (l *LogrusNestedLogger) Infof(format string, args ...interface{}) {
-	l.Logger.Infof(format, args...)
-}
-
-// Warnf takes a formatted template string and template arguments for the warning logging level.
-func (l *LogrusNestedLogger) Warnf(format string, args ...interface{}) {
-	l.Logger.Warnf(format, args...)
-}
-
-// Errorf takes a formatted template string and template arguments for the error logging level.
-func (l *LogrusNestedLogger) Errorf(format string, args ...interface{}) {
-	l.Logger.Errorf(format, args...)
-}
-
-// Debug logs the given arguments at the debug logging level.
-func (l *LogrusNestedLogger) Debug(args ...interface{}) {
-	l.Logger.Debug(args...)
-}
-
-// Info logs the given arguments at the info logging level.
-func (l *LogrusNestedLogger) Info(args ...interface{}) {
-	l.Logger.Info(args...)
-}
-
-// Warn logs the given arguments at the warning logging level.
-func (l *LogrusNestedLogger) Warn(args ...interface{}) {
-	l.Logger.Warn(args...)
-}
-
-// Error logs the given arguments at the error logging level.
-func (l *LogrusNestedLogger) Error(args ...interface{}) {
-	l.Logger.Error(args...)
-}

internal/ui/ephemeral_terminal_ui.go

@@ -7,12 +7,12 @@ import (
 	"bytes"
 	"context"
 	"fmt"
+	"github.com/anchore/go-logger"
 	"io"
 	"os"
 	"sync"
 
 	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/logger"
 	syftEvent "github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/ui"
 	"github.com/wagoodman/go-partybus"
@@ -59,9 +59,8 @@ func (h *ephemeralTerminalUI) Setup(unsubscribe func() error) error {
 
 	// prep the logger to not clobber the screen from now on (logrus only)
 	h.logBuffer = bytes.NewBufferString("")
-	logWrapper, ok := log.Log.(*logger.LogrusLogger)
-	if ok {
-		logWrapper.Logger.SetOutput(h.logBuffer)
+	if rootLogger, ok := log.Log.(logger.Controller); ok {
+		rootLogger.SetOutput(h.logBuffer)
 	}
 
 	return h.openScreen()
@@ -129,10 +128,10 @@ func (h *ephemeralTerminalUI) closeScreen(force bool) {
 
 func (h *ephemeralTerminalUI) flushLog() {
 	// flush any errors to the screen before the report
-	logWrapper, ok := log.Log.(*logger.LogrusLogger)
+	rootLogger, ok := log.Log.(logger.Controller)
 	if ok {
-		fmt.Fprint(logWrapper.Output, h.logBuffer.String())
-		logWrapper.Logger.SetOutput(h.uiOutput)
+		fmt.Fprint(rootLogger.GetOutput(), h.logBuffer.String())
+		rootLogger.SetOutput(h.uiOutput)
 	} else {
 		fmt.Fprint(h.uiOutput, h.logBuffer.String())
 	}

internal/version/build.go

@@ -14,19 +14,19 @@ const valueNotProvided = "[not provided]"
 // all variables here are provided as build-time arguments, with clear default values
 var version = valueNotProvided
 var gitCommit = valueNotProvided
-var gitTreeState = valueNotProvided
+var gitDescription = valueNotProvided
 var buildDate = valueNotProvided
 var platform = fmt.Sprintf("%s/%s", runtime.GOOS, runtime.GOARCH)
 
 // Version defines the application version details (generally from build information)
 type Version struct {
-	Version      string `json:"version"`      // application semantic version
-	GitCommit    string `json:"gitCommit"`    // git SHA at build-time
-	GitTreeState string `json:"gitTreeState"` // indication of git tree (either "clean" or "dirty") at build-time
-	BuildDate    string `json:"buildDate"`    // date of the build
-	GoVersion    string `json:"goVersion"`    // go runtime version at build-time
-	Compiler     string `json:"compiler"`     // compiler used at build-time
-	Platform     string `json:"platform"`     // GOOS and GOARCH at build-time
+	Version        string `json:"version"`        // application semantic version
+	GitCommit      string `json:"gitCommit"`      // git SHA at build-time
+	GitDescription string `json:"gitDescription"` // output of 'git describe --dirty --always --tags'
+	BuildDate      string `json:"buildDate"`      // date of the build
+	GoVersion      string `json:"goVersion"`      // go runtime version at build-time
+	Compiler       string `json:"compiler"`       // compiler used at build-time
+	Platform       string `json:"platform"`       // GOOS and GOARCH at build-time
 }
 
 func (v Version) IsProductionBuild() bool {
@@ -39,12 +39,12 @@ func (v Version) IsProductionBuild() bool {
 // FromBuild provides all version details
 func FromBuild() Version {
 	return Version{
-		Version:      version,
-		GitCommit:    gitCommit,
-		GitTreeState: gitTreeState,
-		BuildDate:    buildDate,
-		GoVersion:    runtime.Version(),
-		Compiler:     runtime.Compiler,
-		Platform:     platform,
+		Version:        version,
+		GitCommit:      gitCommit,
+		GitDescription: gitDescription,
+		BuildDate:      buildDate,
+		GoVersion:      runtime.Version(),
+		Compiler:       runtime.Compiler,
+		Platform:       platform,
 	}
 }

schema/json/generate.go

@@ -36,6 +36,7 @@ type artifactMetadataContainer struct {
 	Rpm    pkg.RpmdbMetadata
 	Cargo  pkg.CargoPackageMetadata
 	Go     pkg.GolangBinMetadata
+	Php    pkg.PhpComposerJSONMetadata
 }
 
 func main() {

syft/artifact/relationship.go

@@ -9,6 +9,18 @@ const (
 
 	// ContainsRelationship (supports any-to-any linkages) is a proxy for the SPDX 2.2 CONTAINS relationship.
 	ContainsRelationship RelationshipType = "contains"
+
+	// RuntimeDependencyOfRelationship is a proxy for the SPDX 2.2.1 RUNTIME_DEPENDENCY_OF relationship.
+	RuntimeDependencyOfRelationship RelationshipType = "runtime-dependency-of"
+
+	// DevDependencyOfRelationship is a proxy for the SPDX 2.2.1 DEV_DEPENDENCY_OF relationship.
+	DevDependencyOfRelationship RelationshipType = "dev-dependency-of"
+
+	// BuildDependencyOfRelationship is a proxy for the SPDX 2.2.1 BUILD_DEPENDENCY_OF relationship.
+	BuildDependencyOfRelationship RelationshipType = "build-dependency-of"
+
+	// DependencyOfRelationship is a proxy for the SPDX 2.2.1 DEPENDENCY_OF	relationship.
+	DependencyOfRelationship RelationshipType = "dependency-of"
 )
 
 type RelationshipType string

syft/distro/distro.go

@@ -1,61 +0,0 @@
-package distro
-
-import (
-	"fmt"
-
-	hashiVer "github.com/hashicorp/go-version"
-)
-
-// Distro represents a Linux Distribution.
-type Distro struct {
-	Type       Type
-	Version    *hashiVer.Version
-	RawVersion string
-	IDLike     string
-}
-
-// NewDistro creates a new Distro object populated with the given values.
-func NewDistro(t Type, ver, like string) (Distro, error) {
-	if ver == "" {
-		return Distro{Type: t}, nil
-	}
-
-	verObj, err := hashiVer.NewVersion(ver)
-	if err != nil {
-		return Distro{}, fmt.Errorf("could not create distro version: %w", err)
-	}
-
-	return Distro{
-		Type:       t,
-		Version:    verObj,
-		RawVersion: ver,
-		IDLike:     like,
-	}, nil
-}
-
-// Name provides a string repr of the distro
-func (d Distro) Name() string {
-	return string(d.Type)
-}
-
-// MajorVersion returns the major version value from the pseudo-semantically versioned distro version value.
-func (d Distro) MajorVersion() string {
-	if d.Version == nil {
-		return "(version unknown)"
-	}
-	return fmt.Sprintf("%d", d.Version.Segments()[0])
-}
-
-// FullVersion returns the original user version value.
-func (d Distro) FullVersion() string {
-	return d.RawVersion
-}
-
-// String returns a human-friendly representation of the Linux distribution.
-func (d Distro) String() string {
-	versionStr := "(version unknown)"
-	if d.RawVersion != "" {
-		versionStr = d.RawVersion
-	}
-	return fmt.Sprintf("%s %s", d.Type, versionStr)
-}

syft/distro/distro_test.go

@@ -1,95 +0,0 @@
-package distro
-
-import (
-	"fmt"
-	"testing"
-)
-
-func TestDistro_FullVersion(t *testing.T) {
-
-	tests := []struct {
-		dist     Type
-		version  string
-		expected string
-	}{
-		{
-			version:  "8",
-			expected: "8",
-		},
-		{
-			version:  "18.04",
-			expected: "18.04",
-		},
-		{
-			version:  "0",
-			expected: "0",
-		},
-		{
-			version:  "18.1.2",
-			expected: "18.1.2",
-		},
-	}
-
-	for _, test := range tests {
-		name := fmt.Sprintf("%s:%s", test.dist, test.version)
-		t.Run(name, func(t *testing.T) {
-			d, err := NewDistro(test.dist, test.version, "")
-			if err != nil {
-				t.Errorf("could not create distro='%+v:%+v': %+v", test.dist, test.version, err)
-			}
-
-			actual := d.FullVersion()
-			if actual != test.expected {
-				t.Errorf("mismatched distro raw version: '%s'!='%s'", actual, test.expected)
-			}
-		})
-	}
-
-}
-
-func TestDistro_MajorVersion(t *testing.T) {
-
-	tests := []struct {
-		dist     Type
-		version  string
-		expected string
-		like     string
-	}{
-		{
-			version:  "8",
-			expected: "8",
-			like:     "",
-		},
-		{
-			version:  "18.04",
-			expected: "18",
-			like:     "debian",
-		},
-		{
-			version:  "0",
-			expected: "0",
-			like:     "",
-		},
-		{
-			version:  "18.1.2",
-			expected: "18",
-			like:     "debian",
-		},
-	}
-
-	for _, test := range tests {
-		name := fmt.Sprintf("%s:%s", test.dist, test.version)
-		t.Run(name, func(t *testing.T) {
-			d, err := NewDistro(test.dist, test.version, test.like)
-			if err != nil {
-				t.Errorf("could not create distro='%+v:%+v': %+v", test.dist, test.version, err)
-			}
-
-			actual := d.MajorVersion()
-			if actual != test.expected {
-				t.Errorf("mismatched major version: '%s'!='%s'", actual, test.expected)
-			}
-		})
-	}
-
-}

syft/distro/identify.go

@@ -1,204 +0,0 @@
-package distro
-
-import (
-	"io/ioutil"
-	"regexp"
-	"strings"
-
-	"github.com/anchore/syft/internal"
-
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/source"
-)
-
-// returns a distro or nil
-type parseFunc func(string) *Distro
-
-type parseEntry struct {
-	path string
-	fn   parseFunc
-}
-
-var identityFiles = []parseEntry{
-	{
-		// most distros provide a link at this location
-		path: "/etc/os-release",
-		fn:   parseOsRelease,
-	},
-	{
-		// standard location for rhel & debian distros
-		path: "/usr/lib/os-release",
-		fn:   parseOsRelease,
-	},
-	{
-		// check for busybox (important to check this last since other distros contain the busybox binary)
-		path: "/bin/busybox",
-		fn:   parseBusyBox,
-	},
-	{
-		// check for centos:6
-		path: "/etc/system-release-cpe",
-		fn:   parseSystemReleaseCPE,
-	},
-	{
-		// last ditch effort for determining older centos version distro information
-		path: "/etc/redhat-release",
-		fn:   parseRedhatRelease,
-	},
-}
-
-// Identify parses distro-specific files to determine distro metadata like version and release.
-func Identify(resolver source.FileResolver) *Distro {
-	var distro *Distro
-
-identifyLoop:
-	for _, entry := range identityFiles {
-		locations, err := resolver.FilesByPath(entry.path)
-		if err != nil {
-			log.Errorf("unable to get path locations from %s: %s", entry.path, err)
-			break
-		}
-
-		if len(locations) == 0 {
-			log.Debugf("path not found: %s", entry.path)
-			continue
-		}
-
-		for _, location := range locations {
-			contentReader, err := resolver.FileContentsByLocation(location)
-			if err != nil {
-				log.Debugf("unable to get contents from %s: %s", entry.path, err)
-				continue
-			}
-
-			content, err := ioutil.ReadAll(contentReader)
-			internal.CloseAndLogError(contentReader, location.VirtualPath)
-			if err != nil {
-				log.Errorf("unable to read %q: %+v", location.RealPath, err)
-				break
-			}
-
-			if len(content) == 0 {
-				log.Debugf("no contents in file, skipping: %s", entry.path)
-				continue
-			}
-
-			if candidateDistro := entry.fn(string(content)); candidateDistro != nil {
-				distro = candidateDistro
-				break identifyLoop
-			}
-		}
-	}
-
-	if distro != nil && distro.Type == UnknownDistroType {
-		return nil
-	}
-
-	return distro
-}
-
-func assemble(id, version, like string) *Distro {
-	distroType, ok := IDMapping[id]
-
-	// Both distro and version must be present
-	if len(id) == 0 && len(version) == 0 {
-		return nil
-	}
-
-	// If it's an unknown distro, try mapping the ID_LIKE
-	if !ok && len(like) != 0 {
-		distroType, ok = IDMapping[like]
-	}
-
-	// If we still can't match allow name to be used in constructor
-	if !ok {
-		distroType = Type(id)
-	}
-
-	distro, err := NewDistro(distroType, version, like)
-	if err != nil {
-		return nil
-	}
-
-	return &distro
-}
-
-func parseOsRelease(contents string) *Distro {
-	id, vers, like := "", "", ""
-	for _, line := range strings.Split(contents, "\n") {
-		parts := strings.Split(line, "=")
-		prefix := parts[0]
-		value := strings.ReplaceAll(parts[len(parts)-1], `"`, "")
-
-		switch prefix {
-		case "ID":
-			id = strings.TrimSpace(value)
-		case "VERSION_ID":
-			vers = strings.TrimSpace(value)
-		case "ID_LIKE":
-			like = strings.TrimSpace(value)
-		}
-	}
-
-	return assemble(id, vers, like)
-}
-
-var busyboxVersionMatcher = regexp.MustCompile(`BusyBox v[\d.]+`)
-
-func parseBusyBox(contents string) *Distro {
-	matches := busyboxVersionMatcher.FindAllString(contents, -1)
-	for _, match := range matches {
-		parts := strings.Split(match, " ")
-		version := strings.ReplaceAll(parts[1], "v", "")
-		distro := assemble("busybox", version, "")
-		if distro != nil {
-			return distro
-		}
-	}
-	return nil
-}
-
-// TODO: we should update parseSystemReleaseCPE to use the CPE struct, pkg.CPE, which requires a refactor to avoid a circular import:
-// TODO: pkg depends on distro to support pURLs. To avoid the circular import, either try to make pkg to not depend on distro (medium lift-ish)
-// TODO: or migrate the cpe code out of the pkg package (small lift).
-// example CPE: cpe:/o:centos:linux:6:GA
-var systemReleaseCpeMatcher = regexp.MustCompile(`cpe:\/o:(.*?):.*?:(.*?):.*?$`)
-
-// parseSystemReleaseCPE parses the older centos (6) file to determine distro metadata
-func parseSystemReleaseCPE(contents string) *Distro {
-	matches := systemReleaseCpeMatcher.FindAllStringSubmatch(contents, -1)
-	for _, match := range matches {
-		if len(match) < 3 {
-			log.Warnf("system release cpe does not match expected format")
-			return nil
-		}
-		// note: in SubMatches (capture groups), the 0th index is the full match string
-		// see https://pkg.go.dev/regexp#pkg-overview for more info
-		distro := assemble(match[1], match[2], "")
-		if distro != nil {
-			return distro
-		}
-	}
-	return nil
-}
-
-// example: "CentOS release 6.10 (Final)"
-var redhatReleaseMatcher = regexp.MustCompile(`(.*?)\srelease\s(\d\.\d+)`)
-
-// parseRedhatRelease is a fallback parsing method for determining distro information in older redhat versions
-func parseRedhatRelease(contents string) *Distro {
-	matches := redhatReleaseMatcher.FindAllStringSubmatch(contents, -1)
-	for _, match := range matches {
-		if len(match) < 3 {
-			log.Warnf("failed to parse redhat-release file, unexpected format")
-			return nil
-		}
-		// note: in SubMatches (capture groups), the 0th index is the full match string
-		// see https://pkg.go.dev/regexp#pkg-overview for more info
-		distro := assemble(strings.ToLower(match[1]), match[2], "")
-		if distro != nil {
-			return distro
-		}
-	}
-	return nil
-}

syft/distro/identify_test.go

@@ -1,372 +0,0 @@
-package distro
-
-import (
-	"fmt"
-	"io/ioutil"
-	"os"
-	"testing"
-
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/syft/source"
-	hashiVer "github.com/hashicorp/go-version"
-	"github.com/stretchr/testify/assert"
-)
-
-const CustomDistro Type = "scientific"
-
-func TestIdentifyDistro(t *testing.T) {
-	tests := []struct {
-		fixture string
-		Type    Type
-		Version string
-	}{
-		{
-			fixture: "test-fixtures/os/alpine",
-			Type:    Alpine,
-			Version: "3.11.6",
-		},
-		{
-			fixture: "test-fixtures/os/amazon",
-			Type:    AmazonLinux,
-			Version: "2.0.0",
-		},
-		{
-			fixture: "test-fixtures/os/busybox",
-			Type:    Busybox,
-			Version: "1.31.1",
-		},
-		{
-			fixture: "test-fixtures/os/centos",
-			Type:    CentOS,
-			Version: "8.0.0",
-		},
-		{
-			fixture: "test-fixtures/os/debian",
-			Type:    Debian,
-			Version: "8.0.0",
-		},
-		{
-			fixture: "test-fixtures/os/fedora",
-			Type:    Fedora,
-			Version: "31.0.0",
-		},
-		{
-			fixture: "test-fixtures/os/redhat",
-			Type:    RedHat,
-			Version: "7.3.0",
-		},
-		{
-			fixture: "test-fixtures/os/ubuntu",
-			Type:    Ubuntu,
-			Version: "20.4.0",
-		},
-		{
-			fixture: "test-fixtures/os/oraclelinux",
-			Type:    OracleLinux,
-			Version: "8.3.0",
-		},
-		{
-			fixture: "test-fixtures/os/empty",
-			Type:    UnknownDistroType,
-		},
-		{
-			fixture: "test-fixtures/os/custom",
-			Type:    CustomDistro,
-			Version: "8.0.0",
-		},
-		{
-			fixture: "test-fixtures/os/opensuse-leap",
-			Type:    OpenSuseLeap,
-			Version: "15.2.0",
-		},
-		{
-			fixture: "test-fixtures/os/sles",
-			Type:    SLES,
-			Version: "15.2.0",
-		},
-		{
-			fixture: "test-fixtures/os/photon",
-			Type:    Photon,
-			Version: "2.0.0",
-		},
-		{
-			fixture: "test-fixtures/os/arch",
-			Type:    ArchLinux,
-		},
-		{
-			fixture: "test-fixtures/partial-fields/missing-id",
-			Type:    Debian,
-			Version: "8.0.0",
-		},
-		{
-			fixture: "test-fixtures/partial-fields/unknown-id",
-			Type:    Debian,
-			Version: "8.0.0",
-		},
-		{
-			fixture: "test-fixtures/partial-fields/missing-version",
-			Type:    UnknownDistroType,
-		},
-		{
-			fixture: "test-fixtures/os/centos6",
-			Type:    CentOS,
-			Version: "6.0.0",
-		},
-		{
-			fixture: "test-fixtures/os/centos5",
-			Type:    CentOS,
-			Version: "5.7.0",
-		},
-		{
-			fixture: "test-fixtures/os/mariner",
-			Type:    Mariner,
-			Version: "1.0.0",
-		},
-		{
-			fixture: "test-fixtures/os/rockylinux",
-			Type:    RockyLinux,
-			Version: "8.4.0",
-		},
-		{
-			fixture: "test-fixtures/os/almalinux",
-			Type:    AlmaLinux,
-			Version: "8.4.0",
-		},
-	}
-
-	observedDistros := internal.NewStringSet()
-	definedDistros := internal.NewStringSet()
-
-	for _, distroType := range All {
-		definedDistros.Add(string(distroType))
-	}
-
-	// Somewhat cheating with Windows. There is no support for detecting/parsing a Windows OS, so it is not
-	// possible to comply with this test unless it is added manually to the "observed distros"
-	definedDistros.Remove(string(Windows))
-
-	for _, test := range tests {
-		t.Run(test.fixture, func(t *testing.T) {
-			s, err := source.NewFromDirectory(test.fixture)
-			if err != nil {
-				t.Fatalf("unable to produce a new source for testing: %s", test.fixture)
-			}
-
-			resolver, err := s.FileResolver(source.SquashedScope)
-			if err != nil {
-				t.Fatalf("unable to get resolver: %+v", err)
-			}
-
-			d := Identify(resolver)
-			if d == nil {
-				if test.Type == UnknownDistroType {
-					return
-				}
-				t.Fatalf("expected a distro but got none")
-			}
-			observedDistros.Add(d.String())
-
-			if d.Type != test.Type {
-				t.Errorf("expected distro doesn't match: %v != %v", d.Type, test.Type)
-			}
-
-			if d.Type == UnknownDistroType && d.Version != nil {
-				t.Fatalf("version should be nil for unknown distros")
-			} else if d.Type == UnknownDistroType && d.Version == nil {
-				// don't check versions for unknown distro types
-				return
-			}
-
-			if d.Version == nil && test.Version == "" {
-				// this distro does not have a version
-				return
-			}
-
-			assert.Equal(t, d.Version.String(), test.Version)
-		})
-	}
-
-	// ensure that test cases stay in sync with the distros that can be identified
-	if len(observedDistros) < len(definedDistros) {
-		for _, d := range definedDistros.ToSlice() {
-			t.Logf("   defined: %s", d)
-		}
-		for _, d := range observedDistros.ToSlice() {
-			t.Logf("   observed: %s", d)
-		}
-		t.Errorf("distro coverage incomplete (defined=%d, coverage=%d)", len(definedDistros), len(observedDistros))
-	}
-}
-
-func TestParseOsRelease(t *testing.T) {
-
-	tests := []struct {
-		fixture    string
-		name       string
-		RawVersion string
-	}{
-		{
-			fixture:    "test-fixtures/ubuntu-20.04",
-			name:       "ubuntu",
-			RawVersion: "20.04",
-		},
-		{
-			fixture:    "test-fixtures/debian-8",
-			name:       "debian",
-			RawVersion: "8",
-		},
-		{
-			fixture:    "test-fixtures/centos-8",
-			name:       "centos",
-			RawVersion: "8",
-		},
-		{
-			fixture:    "test-fixtures/rhel-8",
-			name:       "redhat",
-			RawVersion: "8.1",
-		},
-		{
-			fixture:    "test-fixtures/unprintable",
-			name:       "debian",
-			RawVersion: "8",
-		},
-	}
-
-	for _, test := range tests {
-		name := fmt.Sprintf("%s:%s", test.name, test.RawVersion)
-		contents := retrieveFixtureContentsAsString(test.fixture, t)
-
-		t.Run(name, func(t *testing.T) {
-			distro := parseOsRelease(contents)
-			if distro.Name() != test.name {
-				t.Errorf("mismatched name in distro: '%s' != '%s'", distro.Name(), test.name)
-			}
-			if distro.RawVersion != test.RawVersion {
-				t.Errorf("mismatched distro version: '%s' != '%s'", distro.RawVersion, test.RawVersion)
-			}
-		})
-	}
-
-}
-
-func TestParseOsReleaseFailures(t *testing.T) {
-
-	tests := []struct {
-		fixture string
-		name    string
-	}{
-		{
-			fixture: "test-fixtures/bad-id",
-			name:    "No name ID",
-		},
-	}
-
-	for _, test := range tests {
-		name := fmt.Sprintf("%s:%s", test.name, test.fixture)
-		contents := retrieveFixtureContentsAsString(test.fixture, t)
-
-		t.Run(name, func(t *testing.T) {
-			distro := parseOsRelease(contents)
-			if distro != nil {
-				t.Errorf("unexpected non-nil distro: '%s' != nil", distro)
-			}
-		})
-	}
-}
-
-func TestParseSystemReleaseCPE(t *testing.T) {
-	centos6Version, _ := hashiVer.NewVersion("6")
-	tests := []struct {
-		fixture  string
-		name     string
-		expected *Distro
-	}{
-		{
-			fixture: "test-fixtures/os/centos6/etc/system-release-cpe",
-			name:    "Centos 6",
-			expected: &Distro{
-				Type:       CentOS,
-				Version:    centos6Version,
-				RawVersion: "6",
-			},
-		},
-		{
-			fixture:  "test-fixtures/bad-system-release-cpe",
-			name:     "Centos 6 Bad CPE",
-			expected: nil,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			contents := retrieveFixtureContentsAsString(test.fixture, t)
-			actual := parseSystemReleaseCPE(contents)
-
-			if test.expected == nil {
-				assert.Nil(t, actual)
-				return
-			}
-
-			// not comparing the full distro object because the hashiVer is a pointer
-			assert.Equal(t, test.expected.Type, actual.Type)
-			assert.Equal(t, &test.expected.Version, &actual.Version)
-			assert.Equal(t, test.expected.RawVersion, actual.RawVersion)
-		})
-	}
-}
-
-func TestParseRedhatRelease(t *testing.T) {
-	centos5Version, _ := hashiVer.NewVersion("5.7")
-	tests := []struct {
-		fixture  string
-		name     string
-		expected *Distro
-	}{
-		{
-			fixture: "test-fixtures/os/centos5/etc/redhat-release",
-			name:    "Centos 5",
-			expected: &Distro{
-				Type:       CentOS,
-				Version:    centos5Version,
-				RawVersion: "5.7",
-			},
-		},
-		{
-			fixture:  "test-fixtures/bad-redhat-release",
-			name:     "Centos 5 Bad Redhat Release",
-			expected: nil,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			contents := retrieveFixtureContentsAsString(test.fixture, t)
-			actual := parseRedhatRelease(contents)
-
-			if test.expected == nil {
-				assert.Nil(t, actual)
-				return
-			}
-
-			// not comparing the full distro object because the hashiVer is a pointer
-			assert.Equal(t, test.expected.Type, actual.Type)
-			assert.Equal(t, &test.expected.Version, &actual.Version)
-			assert.Equal(t, test.expected.RawVersion, actual.RawVersion)
-		})
-	}
-}
-
-func retrieveFixtureContentsAsString(fixturePath string, t *testing.T) string {
-	fixture, err := os.Open(fixturePath)
-	if err != nil {
-		t.Fatalf("could not open test fixture=%s: %+v", fixturePath, err)
-	}
-	defer fixture.Close()
-
-	b, err := ioutil.ReadAll(fixture)
-	if err != nil {
-		t.Fatalf("unable to read fixture file: %+v", err)
-	}
-
-	return string(b)
-}

syft/distro/test-fixtures/bad-id

@@ -1,15 +0,0 @@
-NAME="Red Hat Enterprise Linux"
-VERSION="8.1 (Ootpa)"
-ID_LIKE="fedora"
-PLATFORM_ID="platform:el8"
-PRETTY_NAME="Red Hat Enterprise Linux 8.1 (Ootpa)"
-ANSI_COLOR="0;31"
-CPE_NAME="cpe:/o:redhat:enterprise_linux:8.1:GA"
-HOME_URL="https://www.redhat.com/"
-BUG_REPORT_URL="https://bugzilla.redhat.com/"
-
-REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 8"
-REDHAT_BUGZILLA_PRODUCT_VERSION=8.1
-REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
-REDHAT_SUPPORT_PRODUCT_VERSION="8.1"
-

syft/distro/type.go

@@ -1,73 +0,0 @@
-package distro
-
-// Type represents the different Linux distribution options
-type Type string
-
-const (
-	// represents the set of valid/supported Linux Distributions
-	UnknownDistroType Type = "UnknownDistroType"
-	Debian            Type = "debian"
-	Ubuntu            Type = "ubuntu"
-	RedHat            Type = "redhat"
-	CentOS            Type = "centos"
-	Fedora            Type = "fedora"
-	Alpine            Type = "alpine"
-	Busybox           Type = "busybox"
-	AmazonLinux       Type = "amazonlinux"
-	OracleLinux       Type = "oraclelinux"
-	ArchLinux         Type = "archlinux"
-	OpenSuseLeap      Type = "opensuseleap"
-	SLES              Type = "sles"
-	Photon            Type = "photon"
-	Windows           Type = "windows"
-	Mariner           Type = "mariner"
-	RockyLinux        Type = "rockylinux"
-	AlmaLinux         Type = "almalinux"
-)
-
-// All contains all Linux distribution options
-var All = []Type{
-	Debian,
-	Ubuntu,
-	RedHat,
-	CentOS,
-	Fedora,
-	Alpine,
-	Busybox,
-	AmazonLinux,
-	OracleLinux,
-	ArchLinux,
-	OpenSuseLeap,
-	SLES,
-	Photon,
-	Windows,
-	Mariner,
-	RockyLinux,
-	AlmaLinux,
-}
-
-// IDMapping connects a distro ID like "ubuntu" to a Distro type
-var IDMapping = map[string]Type{
-	"debian":        Debian,
-	"ubuntu":        Ubuntu,
-	"rhel":          RedHat,
-	"centos":        CentOS,
-	"fedora":        Fedora,
-	"alpine":        Alpine,
-	"busybox":       Busybox,
-	"amzn":          AmazonLinux,
-	"ol":            OracleLinux,
-	"arch":          ArchLinux,
-	"opensuse-leap": OpenSuseLeap,
-	"sles":          SLES,
-	"photon":        Photon,
-	"windows":       Windows,
-	"mariner":       Mariner,
-	"rocky":         RockyLinux,
-	"almalinux":     AlmaLinux,
-}
-
-// String returns the string representation of the given Linux distribution.
-func (t Type) String() string {
-	return string(t)
-}

syft/file/metadata_cataloger_test.go

@@ -66,7 +66,7 @@ func TestFileMetadataCataloger(t *testing.T) {
 				LinkDestination: "file-1.txt",
 				UserID:          1,
 				GroupID:         2,
-				MIMEType:        "",
+				MIMEType:        "text/plain",
 			},
 		},
 		{
@@ -78,7 +78,7 @@ func TestFileMetadataCataloger(t *testing.T) {
 				LinkDestination: "file-1.txt",
 				UserID:          0,
 				GroupID:         0,
-				MIMEType:        "",
+				MIMEType:        "text/plain",
 			},
 		},
 		{
@@ -89,7 +89,7 @@ func TestFileMetadataCataloger(t *testing.T) {
 				Type:     "CharacterDevice",
 				UserID:   0,
 				GroupID:  0,
-				MIMEType: "",
+				MIMEType: "text/plain",
 			},
 		},
 		{
@@ -100,7 +100,7 @@ func TestFileMetadataCataloger(t *testing.T) {
 				Type:     "BlockDevice",
 				UserID:   0,
 				GroupID:  0,
-				MIMEType: "",
+				MIMEType: "text/plain",
 			},
 		},
 		{
@@ -111,7 +111,7 @@ func TestFileMetadataCataloger(t *testing.T) {
 				Type:     "FIFONode",
 				UserID:   0,
 				GroupID:  0,
-				MIMEType: "",
+				MIMEType: "text/plain",
 			},
 		},
 		{
@@ -122,7 +122,7 @@ func TestFileMetadataCataloger(t *testing.T) {
 				Type:     "Directory",
 				UserID:   0,
 				GroupID:  0,
-				MIMEType: "",
+				MIMEType: "text/plain",
 			},
 		},
 	}

syft/lib.go

@@ -18,13 +18,12 @@ package syft
 
 import (
 	"fmt"
-
-	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/go-logger"
 
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/distro"
-	"github.com/anchore/syft/syft/logger"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger"
 	"github.com/anchore/syft/syft/source"
@@ -34,16 +33,16 @@ import (
 // CatalogPackages takes an inventory of packages from the given image from a particular perspective
 // (e.g. squashed source, all-layers source). Returns the discovered  set of packages, the identified Linux
 // distribution, and the source object used to wrap the data source.
-func CatalogPackages(src *source.Source, cfg cataloger.Config) (*pkg.Catalog, []artifact.Relationship, *distro.Distro, error) {
+func CatalogPackages(src *source.Source, cfg cataloger.Config) (*pkg.Catalog, []artifact.Relationship, *linux.Release, error) {
 	resolver, err := src.FileResolver(cfg.Search.Scope)
 	if err != nil {
 		return nil, nil, nil, fmt.Errorf("unable to determine resolver while cataloging packages: %w", err)
 	}
 
 	// find the distro
-	theDistro := distro.Identify(resolver)
-	if theDistro != nil {
-		log.Infof("identified distro: %s", theDistro.String())
+	release := linux.IdentifyRelease(resolver)
+	if release != nil {
+		log.Infof("identified distro: %s", release.String())
 	} else {
 		log.Info("could not identify distro")
 	}
@@ -64,12 +63,12 @@ func CatalogPackages(src *source.Source, cfg cataloger.Config) (*pkg.Catalog, []
 		return nil, nil, nil, fmt.Errorf("unable to determine cataloger set from scheme=%+v", src.Metadata.Scheme)
 	}
 
-	catalog, relationships, err := cataloger.Catalog(resolver, theDistro, catalogers...)
+	catalog, relationships, err := cataloger.Catalog(resolver, release, catalogers...)
 	if err != nil {
 		return nil, nil, nil, err
 	}
 
-	return catalog, relationships, theDistro, nil
+	return catalog, relationships, release, nil
 }
 
 // SetLogger sets the logger object used for all syft logging calls.

syft/linux/identify_release.go

@@ -0,0 +1,184 @@
+package linux
+
+import (
+	"fmt"
+	"io/ioutil"
+	"regexp"
+	"strings"
+
+	"github.com/acobaugh/osrelease"
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/source"
+	"github.com/google/go-cmp/cmp"
+)
+
+// returns a distro or nil
+type parseFunc func(string) (*Release, error)
+
+type parseEntry struct {
+	path string
+	fn   parseFunc
+}
+
+var identityFiles = []parseEntry{
+	{
+		// most distros provide a link at this location
+		path: "/etc/os-release",
+		fn:   parseOsRelease,
+	},
+	{
+		// standard location for rhel & debian distros
+		path: "/usr/lib/os-release",
+		fn:   parseOsRelease,
+	},
+	{
+		// check for centos:6
+		path: "/etc/system-release-cpe",
+		fn:   parseSystemReleaseCPE,
+	},
+	{
+		// last ditch effort for determining older centos version distro information
+		path: "/etc/redhat-release",
+		fn:   parseRedhatRelease,
+	},
+	// /////////////////////////////////////////////////////////////////////////////////////////////////////
+	// IMPORTANT! checking busybox must be last since other distros contain the busybox binary
+	{
+		// check for busybox
+		path: "/bin/busybox",
+		fn:   parseBusyBox,
+	},
+	// /////////////////////////////////////////////////////////////////////////////////////////////////////
+}
+
+// IdentifyRelease parses distro-specific files to discover and raise linux distribution release details.
+func IdentifyRelease(resolver source.FileResolver) *Release {
+	for _, entry := range identityFiles {
+		locations, err := resolver.FilesByPath(entry.path)
+		if err != nil {
+			log.Warnf("unable to get path locations from %s: %+v", entry.path, err)
+			continue
+		}
+
+		for _, location := range locations {
+			contentReader, err := resolver.FileContentsByLocation(location)
+			if err != nil {
+				log.Debugf("unable to get contents from %s: %s", entry.path, err)
+				continue
+			}
+
+			content, err := ioutil.ReadAll(contentReader)
+			internal.CloseAndLogError(contentReader, location.VirtualPath)
+			if err != nil {
+				log.Warnf("unable to read %q: %+v", location.RealPath, err)
+				break
+			}
+
+			release, err := entry.fn(string(content))
+			if err != nil {
+				log.Warnf("unable to parse %q", location.RealPath)
+			}
+
+			if release != nil {
+				return release
+			}
+		}
+	}
+
+	return nil
+}
+
+func parseOsRelease(contents string) (*Release, error) {
+	values, err := osrelease.ReadString(contents)
+	if err != nil {
+		return nil, fmt.Errorf("unable to read os-release file: %w", err)
+	}
+
+	var idLike []string
+	for _, s := range strings.Split(values["ID_LIKE"], " ") {
+		s = strings.TrimSpace(s)
+		if s == "" {
+			continue
+		}
+		idLike = append(idLike, s)
+	}
+
+	r := Release{
+		PrettyName:       values["PRETTY_NAME"],
+		Name:             values["NAME"],
+		ID:               values["ID"],
+		IDLike:           idLike,
+		Version:          values["VERSION"],
+		VersionID:        values["VERSION_ID"],
+		Variant:          values["VARIANT"],
+		VariantID:        values["VARIANT_ID"],
+		HomeURL:          values["HOME_URL"],
+		SupportURL:       values["SUPPORT_URL"],
+		BugReportURL:     values["BUG_REPORT_URL"],
+		PrivacyPolicyURL: values["PRIVACY_POLICY_URL"],
+		CPEName:          values["CPE_NAME"],
+	}
+
+	// don't allow for empty contents to result in a Release object being created
+	if cmp.Equal(r, Release{}) {
+		return nil, nil
+	}
+
+	return &r, nil
+}
+
+var busyboxVersionMatcher = regexp.MustCompile(`BusyBox v[\d.]+`)
+
+func parseBusyBox(contents string) (*Release, error) {
+	matches := busyboxVersionMatcher.FindAllString(contents, -1)
+	for _, match := range matches {
+		parts := strings.Split(match, " ")
+		version := strings.ReplaceAll(parts[1], "v", "")
+
+		return simpleRelease(match, "busybox", version, ""), nil
+	}
+	return nil, nil
+}
+
+// example CPE: cpe:/o:centos:linux:6:GA
+var systemReleaseCpeMatcher = regexp.MustCompile(`cpe:\/o:(.*?):.*?:(.*?):.*?$`)
+
+// parseSystemReleaseCPE parses the older centos (6) file to determine distro metadata
+func parseSystemReleaseCPE(contents string) (*Release, error) {
+	matches := systemReleaseCpeMatcher.FindAllStringSubmatch(contents, -1)
+	for _, match := range matches {
+		if len(match) < 3 {
+			continue
+		}
+		return simpleRelease(match[1], strings.ToLower(match[1]), match[2], match[0]), nil
+	}
+	return nil, nil
+}
+
+// example: "CentOS release 6.10 (Final)"
+var redhatReleaseMatcher = regexp.MustCompile(`(.*?)\srelease\s(\d\.\d+)`)
+
+// parseRedhatRelease is a fallback parsing method for determining distro information in older redhat versions
+func parseRedhatRelease(contents string) (*Release, error) {
+	matches := redhatReleaseMatcher.FindAllStringSubmatch(contents, -1)
+	for _, match := range matches {
+		if len(match) < 3 {
+			continue
+		}
+		return simpleRelease(match[1], strings.ToLower(match[1]), match[2], ""), nil
+	}
+	return nil, nil
+}
+
+func simpleRelease(prettyName, name, version, cpe string) *Release {
+	return &Release{
+		PrettyName: prettyName,
+		Name:       name,
+		ID:         name,
+		IDLike:     []string{name},
+		Version:    version,
+		VersionID:  version,
+		CPEName:    cpe,
+	}
+}

syft/linux/identify_release_test.go

@@ -0,0 +1,533 @@
+package linux
+
+import (
+	"io/ioutil"
+	"os"
+	"testing"
+
+	"github.com/anchore/syft/syft/source"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestIdentifyRelease(t *testing.T) {
+	tests := []struct {
+		fixture string
+		release *Release
+	}{
+		{
+			fixture: "test-fixtures/os/alpine",
+			release: &Release{
+				PrettyName:   "Alpine Linux v3.11",
+				Name:         "Alpine Linux",
+				ID:           "alpine",
+				IDLike:       nil,
+				VersionID:    "3.11.6",
+				HomeURL:      "https://alpinelinux.org/",
+				BugReportURL: "https://bugs.alpinelinux.org/",
+			},
+		},
+		{
+			fixture: "test-fixtures/os/amazon",
+			release: &Release{
+				PrettyName: "Amazon Linux 2",
+				Name:       "Amazon Linux",
+				ID:         "amzn",
+				IDLike: []string{
+					"centos",
+					"rhel",
+					"fedora",
+				},
+				Version:   "2",
+				VersionID: "2",
+				HomeURL:   "https://amazonlinux.com/",
+				CPEName:   "cpe:2.3:o:amazon:amazon_linux:2",
+			},
+		},
+		{
+			fixture: "test-fixtures/os/busybox",
+			release: &Release{
+				PrettyName: "BusyBox v1.31.1",
+				Name:       "busybox",
+				ID:         "busybox",
+				IDLike:     []string{"busybox"},
+				Version:    "1.31.1",
+				VersionID:  "1.31.1",
+			},
+		},
+		{
+			fixture: "test-fixtures/os/centos",
+			release: &Release{
+				PrettyName: "CentOS Linux 8 (Core)",
+				Name:       "CentOS Linux",
+				ID:         "centos",
+				IDLike: []string{"rhel",
+					"fedora",
+				},
+				Version:      "8 (Core)",
+				VersionID:    "8",
+				HomeURL:      "https://www.centos.org/",
+				BugReportURL: "https://bugs.centos.org/",
+				CPEName:      "cpe:/o:centos:centos:8",
+			},
+		},
+		{
+			fixture: "test-fixtures/os/debian",
+			release: &Release{
+				PrettyName:   "Debian GNU/Linux 8 (jessie)",
+				Name:         "Debian GNU/Linux",
+				ID:           "debian",
+				IDLike:       nil,
+				Version:      "8 (jessie)",
+				VersionID:    "8",
+				HomeURL:      "http://www.debian.org/",
+				SupportURL:   "http://www.debian.org/support",
+				BugReportURL: "https://bugs.debian.org/",
+			},
+		},
+		{
+			fixture: "test-fixtures/os/fedora",
+			release: &Release{
+				PrettyName:       "Fedora 31 (Container Image)",
+				Name:             "Fedora",
+				ID:               "fedora",
+				IDLike:           nil,
+				Version:          "31 (Container Image)",
+				VersionID:        "31",
+				Variant:          "Container Image",
+				VariantID:        "container",
+				HomeURL:          "https://fedoraproject.org/",
+				SupportURL:       "https://fedoraproject.org/wiki/Communicating_and_getting_help",
+				BugReportURL:     "https://bugzilla.redhat.com/",
+				PrivacyPolicyURL: "https://fedoraproject.org/wiki/Legal:PrivacyPolicy",
+				CPEName:          "cpe:/o:fedoraproject:fedora:31",
+			},
+		},
+		{
+			fixture: "test-fixtures/os/redhat",
+			release: &Release{
+				PrettyName:   "Red Hat Enterprise Linux Server 7.3 (Maipo)",
+				Name:         "Red Hat Enterprise Linux Server",
+				ID:           "rhel",
+				IDLike:       []string{"fedora"},
+				Version:      "7.3 (Maipo)",
+				VersionID:    "7.3",
+				HomeURL:      "https://www.redhat.com/",
+				BugReportURL: "https://bugzilla.redhat.com/",
+				CPEName:      "cpe:/o:redhat:enterprise_linux:7.3:GA:server",
+			},
+		},
+		{
+			fixture: "test-fixtures/os/ubuntu",
+			release: &Release{
+				PrettyName:       "Ubuntu 20.04 LTS",
+				Name:             "Ubuntu",
+				ID:               "ubuntu",
+				IDLike:           []string{"debian"},
+				Version:          "20.04 LTS (Focal Fossa)",
+				VersionID:        "20.04",
+				HomeURL:          "https://www.ubuntu.com/",
+				SupportURL:       "https://help.ubuntu.com/",
+				BugReportURL:     "https://bugs.launchpad.net/ubuntu/",
+				PrivacyPolicyURL: "https://www.ubuntu.com/legal/terms-and-policies/privacy-policy",
+			},
+		},
+		{
+			fixture: "test-fixtures/os/oraclelinux",
+			release: &Release{
+				PrettyName:   "Oracle Linux Server 8.3",
+				Name:         "Oracle Linux Server",
+				ID:           "ol",
+				IDLike:       []string{"fedora"},
+				Version:      "8.3",
+				VersionID:    "8.3",
+				Variant:      "Server",
+				VariantID:    "server",
+				HomeURL:      "https://linux.oracle.com/",
+				BugReportURL: "https://bugzilla.oracle.com/",
+				CPEName:      "cpe:/o:oracle:linux:8:3:server",
+			},
+		},
+		{
+			fixture: "test-fixtures/os/empty",
+		},
+		{
+			fixture: "test-fixtures/os/custom",
+			release: &Release{
+				PrettyName: "CentOS Linux 8 (Core)",
+				Name:       "Scientific Linux",
+				ID:         "scientific",
+				IDLike: []string{
+					"rhel",
+					"fedora",
+				},
+				Version:      "16 (Core)",
+				VersionID:    "8",
+				HomeURL:      "https://www.centos.org/",
+				BugReportURL: "https://bugs.centos.org/",
+				CPEName:      "cpe:/o:centos:centos:8",
+			},
+		},
+		{
+			fixture: "test-fixtures/os/opensuse-leap",
+			release: &Release{
+				PrettyName: "openSUSE Leap 15.2",
+				Name:       "openSUSE Leap",
+				ID:         "opensuse-leap",
+				IDLike: []string{
+					"suse",
+					"opensuse",
+				},
+				Version:      "15.2",
+				VersionID:    "15.2",
+				HomeURL:      "https://www.opensuse.org/",
+				BugReportURL: "https://bugs.opensuse.org",
+				CPEName:      "cpe:/o:opensuse:leap:15.2",
+			},
+		},
+		{
+			fixture: "test-fixtures/os/sles",
+			release: &Release{
+				PrettyName: "SUSE Linux Enterprise Server 15 SP2",
+				Name:       "SLES",
+				ID:         "sles",
+				IDLike:     []string{"suse"},
+				Version:    "15-SP2",
+				VersionID:  "15.2",
+				CPEName:    "cpe:/o:suse:sles:15:sp2",
+			},
+		},
+		{
+			fixture: "test-fixtures/os/photon",
+			release: &Release{
+				PrettyName:   "VMware Photon OS/Linux",
+				Name:         "VMware Photon OS",
+				ID:           "photon",
+				IDLike:       nil,
+				Version:      "2.0",
+				VersionID:    "2.0",
+				HomeURL:      "https://vmware.github.io/photon/",
+				BugReportURL: "https://github.com/vmware/photon/issues",
+			},
+		},
+		{
+			fixture: "test-fixtures/os/arch",
+			release: &Release{
+				PrettyName:   "Arch Linux",
+				Name:         "Arch Linux",
+				ID:           "arch",
+				IDLike:       nil,
+				HomeURL:      "https://www.archlinux.org/",
+				SupportURL:   "https://bbs.archlinux.org/",
+				BugReportURL: "https://bugs.archlinux.org/",
+			},
+		},
+		{
+			fixture: "test-fixtures/partial-fields/missing-id",
+			release: &Release{
+				Name:      "Debian GNU/Linux",
+				IDLike:    []string{"debian"},
+				VersionID: "8",
+			},
+		},
+		{
+			fixture: "test-fixtures/partial-fields/unknown-id",
+			release: &Release{
+				Name:      "Debian GNU/Linux",
+				ID:        "my-awesome-distro",
+				IDLike:    []string{"debian"},
+				VersionID: "8",
+			},
+		},
+		{
+			fixture: "test-fixtures/partial-fields/missing-version",
+			release: &Release{
+				Name:   "Debian GNU/Linux",
+				IDLike: []string{"debian"},
+			},
+		},
+		{
+			fixture: "test-fixtures/os/centos6",
+			release: &Release{
+				PrettyName: "centos",
+				Name:       "centos",
+				ID:         "centos",
+				IDLike:     []string{"centos"},
+				Version:    "6",
+				VersionID:  "6",
+				CPEName:    "cpe:/o:centos:linux:6:GA",
+			},
+		},
+		{
+			fixture: "test-fixtures/os/centos5",
+			release: &Release{
+				PrettyName: "CentOS",
+				Name:       "centos",
+				ID:         "centos",
+				IDLike:     []string{"centos"},
+				Version:    "5.7",
+				VersionID:  "5.7",
+			},
+		},
+		{
+			fixture: "test-fixtures/os/mariner",
+			release: &Release{
+				PrettyName:   "CBL-Mariner/Linux",
+				Name:         "Common Base Linux Mariner",
+				ID:           "mariner",
+				IDLike:       nil,
+				Version:      "1.0.20210901",
+				VersionID:    "1.0",
+				HomeURL:      "https://aka.ms/cbl-mariner",
+				SupportURL:   "https://aka.ms/cbl-mariner",
+				BugReportURL: "https://aka.ms/cbl-mariner",
+			},
+		},
+		{
+			fixture: "test-fixtures/os/rockylinux",
+			release: &Release{
+				PrettyName: "Rocky Linux 8.4 (Green Obsidian)",
+				Name:       "Rocky Linux",
+				ID:         "rocky",
+				IDLike: []string{
+					"rhel",
+					"fedora",
+				},
+				Version:      "8.4 (Green Obsidian)",
+				VersionID:    "8.4",
+				HomeURL:      "https://rockylinux.org/",
+				BugReportURL: "https://bugs.rockylinux.org/",
+				CPEName:      "cpe:/o:rocky:rocky:8.4:GA",
+			},
+		},
+		{
+			fixture: "test-fixtures/os/almalinux",
+			release: &Release{
+				PrettyName: "AlmaLinux 8.4 (Electric Cheetah)",
+				Name:       "AlmaLinux",
+				ID:         "almalinux",
+				IDLike: []string{
+					"rhel",
+					"centos",
+					"fedora",
+				},
+				Version:      "8.4 (Electric Cheetah)",
+				VersionID:    "8.4",
+				HomeURL:      "https://almalinux.org/",
+				BugReportURL: "https://bugs.almalinux.org/",
+				CPEName:      "cpe:/o:almalinux:almalinux:8.4:GA",
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.fixture, func(t *testing.T) {
+			s, err := source.NewFromDirectory(test.fixture)
+			require.NoError(t, err)
+
+			resolver, err := s.FileResolver(source.SquashedScope)
+			require.NoError(t, err)
+
+			assert.Equal(t, test.release, IdentifyRelease(resolver))
+		})
+	}
+}
+
+func TestParseOsRelease(t *testing.T) {
+
+	tests := []struct {
+		fixture string
+		release *Release
+	}{
+		{
+			fixture: "test-fixtures/ubuntu-20.04",
+
+			release: &Release{
+				PrettyName:       "Ubuntu 20.04 LTS",
+				Name:             "Ubuntu",
+				ID:               "ubuntu",
+				IDLike:           []string{"debian"},
+				Version:          "20.04 LTS (Focal Fossa)",
+				VersionID:        "20.04",
+				HomeURL:          "https://www.ubuntu.com/",
+				SupportURL:       "https://help.ubuntu.com/",
+				BugReportURL:     "https://bugs.launchpad.net/ubuntu/",
+				PrivacyPolicyURL: "https://www.ubuntu.com/legal/terms-and-policies/privacy-policy",
+			},
+		},
+
+		{
+			fixture: "test-fixtures/debian-8",
+
+			release: &Release{
+				PrettyName:   "Debian GNU/Linux 8 (jessie)",
+				Name:         "Debian GNU/Linux",
+				ID:           "debian",
+				IDLike:       nil,
+				Version:      "8 (jessie)",
+				VersionID:    "8",
+				HomeURL:      "http://www.debian.org/",
+				SupportURL:   "http://www.debian.org/support",
+				BugReportURL: "https://bugs.debian.org/",
+			},
+		},
+
+		{
+			fixture: "test-fixtures/centos-8",
+
+			release: &Release{
+				PrettyName: "CentOS Linux 8 (Core)",
+				Name:       "CentOS Linux",
+				ID:         "centos",
+				IDLike: []string{
+					"rhel",
+					"fedora",
+				},
+				Version:      "8 (Core)",
+				VersionID:    "8",
+				HomeURL:      "https://www.centos.org/",
+				BugReportURL: "https://bugs.centos.org/",
+				CPEName:      "cpe:/o:centos:centos:8",
+			},
+		},
+
+		{
+			fixture: "test-fixtures/rhel-8",
+
+			release: &Release{
+				PrettyName:   "Red Hat Enterprise Linux 8.1 (Ootpa)",
+				Name:         "Red Hat Enterprise Linux",
+				ID:           "rhel",
+				IDLike:       []string{"fedora"},
+				Version:      "8.1 (Ootpa)",
+				VersionID:    "8.1",
+				HomeURL:      "https://www.redhat.com/",
+				BugReportURL: "https://bugzilla.redhat.com/",
+				CPEName:      "cpe:/o:redhat:enterprise_linux:8.1:GA",
+			},
+		},
+
+		{
+			fixture: "test-fixtures/unprintable",
+
+			release: &Release{
+				PrettyName:   "Debian GNU/Linux 8 (jessie)",
+				Name:         "Debian GNU/Linux",
+				ID:           "debian",
+				IDLike:       nil,
+				Version:      "8 (jessie)",
+				VersionID:    "8",
+				HomeURL:      "http://www.debian.org/",
+				SupportURL:   "http://www.debian.org/support",
+				BugReportURL: "https://bugs.debian.org/",
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.fixture,
+			func(t *testing.T) {
+				release,
+					err := parseOsRelease(retrieveFixtureContentsAsString(test.fixture,
+					t))
+				require.NoError(t,
+					err)
+				assert.Equal(t,
+					test.release,
+					release)
+			})
+	}
+
+}
+
+func TestParseSystemReleaseCPE(t *testing.T) {
+	tests := []struct {
+		fixture string
+		release *Release
+	}{
+		{
+			fixture: "test-fixtures/os/centos6/etc/system-release-cpe",
+			release: &Release{
+				PrettyName: "centos",
+				Name:       "centos",
+				ID:         "centos",
+				IDLike:     []string{"centos"},
+				Version:    "6",
+				VersionID:  "6",
+				CPEName:    "cpe:/o:centos:linux:6:GA",
+			},
+		},
+		{
+			fixture: "test-fixtures/bad-system-release-cpe",
+			release: nil,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.fixture, func(t *testing.T) {
+			contents := retrieveFixtureContentsAsString(test.fixture, t)
+			release, err := parseSystemReleaseCPE(contents)
+			require.NoError(t, err)
+			if test.release == nil {
+				assert.Nil(t, release)
+				return
+			}
+
+			assert.Equal(t, test.release, release)
+		})
+	}
+}
+
+func TestParseRedhatRelease(t *testing.T) {
+	tests := []struct {
+		fixture string
+		name    string
+		release *Release
+	}{
+		{
+			fixture: "test-fixtures/os/centos5/etc/redhat-release",
+			name:    "Centos 5",
+			release: &Release{
+				PrettyName: "CentOS",
+				Name:       "centos",
+				ID:         "centos",
+				IDLike:     []string{"centos"},
+				Version:    "5.7",
+				VersionID:  "5.7",
+			},
+		},
+		{
+			fixture: "test-fixtures/bad-redhat-release",
+			name:    "Centos 5 Bad Redhat Release",
+			release: nil,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			release, err := parseRedhatRelease(retrieveFixtureContentsAsString(test.fixture, t))
+			require.NoError(t, err)
+			if test.release == nil {
+				assert.Nil(t, release)
+				return
+			}
+
+			assert.Equal(t, test.release, release)
+		})
+	}
+}
+
+func retrieveFixtureContentsAsString(fixturePath string, t *testing.T) string {
+	fixture, err := os.Open(fixturePath)
+	if err != nil {
+		t.Fatalf("could not open test fixture=%s: %+v", fixturePath, err)
+	}
+	defer fixture.Close()
+
+	b, err := ioutil.ReadAll(fixture)
+	if err != nil {
+		t.Fatalf("unable to read fixture file: %+v", err)
+	}
+
+	return string(b)
+}

syft/linux/release.go

@@ -0,0 +1,35 @@
+package linux
+
+// Release represents Linux Distribution release information as specified from https://www.freedesktop.org/software/systemd/man/os-release.html
+type Release struct {
+	PrettyName       string   `cyclonedx:"prettyName"` // A pretty operating system name in a format suitable for presentation to the user.
+	Name             string   // identifies the operating system, without a version component, and suitable for presentation to the user.
+	ID               string   `cyclonedx:"id"`     // identifies the operating system, excluding any version information and suitable for processing by scripts or usage in generated filenames.
+	IDLike           []string `cyclonedx:"idLike"` // list of operating system identifiers in the same syntax as the ID= setting. It should list identifiers of operating systems that are closely related to the local operating system in regards to packaging and programming interfaces.
+	Version          string   // identifies the operating system version, excluding any OS name information, possibly including a release code name, and suitable for presentation to the user.
+	VersionID        string   `cyclonedx:"versionID"` // identifies the operating system version, excluding any OS name information or release code name, and suitable for processing by scripts or usage in generated filenames.
+	Variant          string   `cyclonedx:"variant"`   // identifies a specific variant or edition of the operating system suitable for presentation to the user.
+	VariantID        string   `cyclonedx:"variantID"` // identifies a specific variant or edition of the operating system. This may be interpreted by other packages in order to determine a divergent default configuration.
+	HomeURL          string
+	SupportURL       string
+	BugReportURL     string
+	PrivacyPolicyURL string
+	CPEName          string // A CPE name for the operating system, in URI binding syntax
+}
+
+func (r *Release) String() string {
+	if r == nil {
+		return "unknown"
+	}
+	if r.PrettyName != "" {
+		return r.PrettyName
+	}
+	if r.Name != "" {
+		return r.Name
+	}
+	if r.Version != "" {
+		return r.ID + " " + r.Version
+	}
+
+	return r.ID + " " + r.VersionID
+}