[wip] git-root config search concept

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Makefile

@@ -101,7 +101,6 @@ bootstrap-tools: $(TEMPDIR)
 	curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMPDIR)/ v0.2.0
 	curl -sSfL https://raw.githubusercontent.com/anchore/chronicle/main/install.sh | sh -s -- -b $(TEMPDIR)/ v0.3.0
 	.github/scripts/goreleaser-install.sh -b $(TEMPDIR)/ v0.177.0
-	GOBIN="$(shell realpath $(TEMPDIR))" go install github.com/neilpa/yajsv@v1.4.0
 
 .PHONY: bootstrap-go
 bootstrap-go:

README.md

@@ -11,11 +11,15 @@
 
 A CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Exceptional for vulnerability detection when used with a scanner tool like [Grype](https://github.com/anchore/grype).
 
-### Join our community meetings!
+### Join us at the virtual OSS meetup!
 
-- Calendar: https://calendar.google.com/calendar/u/0/r?cid=Y182OTM4dGt0MjRtajI0NnNzOThiaGtnM29qNEBncm91cC5jYWxlbmRhci5nb29nbGUuY29t
-- Agenda: https://docs.google.com/document/d/1ZtSAa6fj2a6KRWviTn3WoJm09edvrNUp4Iz_dOjjyY8/edit?usp=sharing (join [this group](https://groups.google.com/g/anchore-oss-community) for write access)
-- All are welcome!
+When: December 1, 2021 @ 11am-noon PT (2-3pm ET)
+
+We’ve got security experts from VMware and Anchore who will share their tips, tricks, and lessons learned on securing containers using [Syft](https://github.com/anchore/syft), [Grype](https://github.com/anchore/grype), and [Cartographer](https://github.com/vmware-tanzu/cartographer).
+
+Register now: https://get.anchore.com/anchore-oss-meetup-dec-1-2021/
+
+---
 
 ![syft-demo](https://user-images.githubusercontent.com/590471/90277200-2a253000-de33-11ea-893f-32c219eea11a.gif)
 
@@ -93,27 +97,9 @@ file:path/to/yourproject/file          read directly from a path on disk (any si
 registry:yourrepo/yourimage:tag        pull image directly from a registry (no container runtime required)
 ```
 
-### Excluding file paths
-
-Syft can exclude files and paths from being scanned within a source by using glob expressions
-with one or more `--exclude` parameters:
-```
-syft <source> --exclude './out/**/*.json' --exclude /etc
-```
-**Note:** in the case of _image scanning_, since the entire filesystem is scanned it is
-possible to use absolute paths like `/etc` or `/usr/**/*.txt` whereas _directory scans_
-exclude files _relative to the specified directory_. For example: scanning `/usr/foo` with
-`--exclude ./package.json` would exclude `/usr/foo/package.json` and `--exclude '**/package.json'`
-would exclude all `package.json` files under `/usr/foo`. For _directory scans_,
-it is required to begin path expressions with `./`, `*/`, or `**/`, all of which
-will be resolved _relative to the specified scan directory_. Keep in mind, your shell
-may attempt to expand wildcards, so put those parameters in single quotes, like:
-`'**/*.json'`.
-
 ### Output formats
 
-The output format for Syft is configurable as well using the
-`-o` (or `--output`) option:
+The output format for Syft is configurable as well:
 
 ```
 syft packages <image> -o <format>
@@ -122,21 +108,11 @@ syft packages <image> -o <format>
 Where the `formats` available are:
 - `json`: Use this to get as much information out of Syft as possible!
 - `text`: A row-oriented, human-and-machine-friendly output.
-- `cyclonedx`: A XML report conforming to the [CycloneDX 1.3 specification](https://cyclonedx.org/specification/overview/).
-- `cyclonedx-json`: A JSON report conforming to the [CycloneDX 1.3 specification](https://cyclonedx.org/specification/overview/).
+- `cyclonedx`: A XML report conforming to the [CycloneDX 1.2 specification](https://cyclonedx.org/specification/overview/).
 - `spdx`: A tag-value formatted report conforming to the [SPDX 2.2 specification](https://spdx.github.io/spdx-spec/).
 - `spdx-json`: A JSON report conforming to the [SPDX 2.2 JSON Schema](https://github.com/spdx/spdx-spec/blob/v2.2/schemas/spdx-schema.json).
 - `table`: A columnar summary (default).
 
-#### Multiple outputs
-
-Syft can also output _multiple_ files in differing formats by appending
-`=<file>` to the option, for example to output Syft JSON and SPDX JSON:
-
-```shell
-syft packages <image> -o json=sbom.syft.json -o spdx-json=sbom.spdx.json
-```
-
 ## Private Registry Authentication
 
 ### Local Docker Credentials
@@ -225,18 +201,16 @@ Configuration search paths:
 
 - `.syft.yaml`
 - `.syft/config.yaml`
+- `<git repo root>/.syft.yaml`
+- `<git repo root>/.syft/config.yaml`
 - `~/.syft.yaml`
 - `<XDG_CONFIG_HOME>/syft/config.yaml`
 
 Configuration options (example values are the default):
 
 ```yaml
-# the output format(s) of the SBOM report (options: table, text, json, spdx, ...)
-# same as -o, --output, and SYFT_OUTPUT env var
-# to specify multiple output files in differing formats, use a list:
-# output:
-#   - "json=<syft-json-output-file>"
-#   - "spdx-json=<spdx-json-output-file>"
+# the output format of the SBOM report (options: table, text, json)
+# same as -o ; SYFT_OUTPUT env var
 output: "table"
 
 # suppress all output (except for the SBOM report)
@@ -250,26 +224,8 @@ file: ""
 # same as SYFT_CHECK_FOR_APP_UPDATE env var
 check-for-app-update: true
 
-# a list of globs to exclude from scanning. same as --exclude ; for example:
-# exclude:
-#   - "/etc/**"
-#   - "./out/**/*.json"
-exclude:
-
 # cataloging packages is exposed through the packages and power-user subcommands
 package:
-
-  # search within archives that do contain a file index to search against (zip)
-  # note: for now this only applies to the java package cataloger
-  # SYFT_PACKAGE_SEARCH_INDEXED_ARCHIVES env var
-  search-indexed-archives: true
-
-  # search within archives that do not contain a file index to search against (tar, tar.gz, tar.bz2, etc)
-  # note: enabling this may result in a performance impact since all discovered compressed tars will be decompressed
-  # note: for now this only applies to the java package cataloger
-  # SYFT_PACKAGE_SEARCH_UNINDEXED_ARCHIVES env var
-  search-unindexed-archives: false
-   
   cataloger:
     # enable/disable cataloging of packages
     # SYFT_PACKAGE_CATALOGER_ENABLED env var

cmd/check_for_application_update.go

@@ -11,7 +11,6 @@ import (
 
 func checkForApplicationUpdate() {
 	if appConfig.CheckForAppUpdate {
-		log.Debugf("checking if new vesion of %s is available", internal.ApplicationName)
 		isAvailable, newVersion, err := version.IsUpdateAvailable()
 		if err != nil {
 			// this should never stop the application

cmd/cmd.go

@@ -1,19 +1,17 @@
 package cmd
 
 import (
-	"encoding/json"
 	"fmt"
 	"os"
-	"sort"
+
+	"github.com/spf13/cobra"
 
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/internal/config"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/logger"
-	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft"
 	"github.com/gookit/color"
-	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 	"github.com/wagoodman/go-partybus"
 )
@@ -30,8 +28,6 @@ func init() {
 		initAppConfig,
 		initLogging,
 		logAppConfig,
-		checkForApplicationUpdate,
-		logAppVersion,
 		initEventBus,
 	)
 }
@@ -114,33 +110,3 @@ func initEventBus() {
 	stereoscope.SetBus(eventBus)
 	syft.SetBus(eventBus)
 }
-
-func logAppVersion() {
-	versionInfo := version.FromBuild()
-	log.Infof("syft version: %s", versionInfo.Version)
-
-	var fields map[string]interface{}
-	bytes, err := json.Marshal(versionInfo)
-	if err != nil {
-		return
-	}
-	err = json.Unmarshal(bytes, &fields)
-	if err != nil {
-		return
-	}
-
-	keys := make([]string, 0, len(fields))
-	for k := range fields {
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
-
-	for idx, field := range keys {
-		value := fields[field]
-		branch := "├──"
-		if idx == len(fields)-1 {
-			branch = "└──"
-		}
-		log.Debugf("  %s %s: %s", branch, field, value)
-	}
-}

cmd/event_loop_test.go

@@ -50,7 +50,7 @@ func Test_eventLoop_gracefulExit(t *testing.T) {
 		t.Cleanup(testBus.Close)
 
 		finalEvent := partybus.Event{
-			Type: event.Exit,
+			Type: event.PresenterReady,
 		}
 
 		worker := func() <-chan error {
@@ -182,7 +182,7 @@ func Test_eventLoop_unsubscribeError(t *testing.T) {
 		t.Cleanup(testBus.Close)
 
 		finalEvent := partybus.Event{
-			Type: event.Exit,
+			Type: event.PresenterReady,
 		}
 
 		worker := func() <-chan error {
@@ -251,8 +251,8 @@ func Test_eventLoop_handlerError(t *testing.T) {
 		t.Cleanup(testBus.Close)
 
 		finalEvent := partybus.Event{
-			Type:  event.Exit,
-			Error: fmt.Errorf("an exit error occured"),
+			Type:  event.PresenterReady,
+			Error: fmt.Errorf("unable to create presenter"),
 		}
 
 		worker := func() <-chan error {
@@ -376,7 +376,7 @@ func Test_eventLoop_uiTeardownError(t *testing.T) {
 		t.Cleanup(testBus.Close)
 
 		finalEvent := partybus.Event{
-			Type: event.Exit,
+			Type: event.PresenterReady,
 		}
 
 		worker := func() <-chan error {

cmd/output_writer.go

@@ -1,72 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"strings"
-
-	"github.com/anchore/syft/internal/formats"
-	"github.com/anchore/syft/internal/output"
-	"github.com/anchore/syft/syft/format"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/hashicorp/go-multierror"
-)
-
-// makeWriter creates a sbom.Writer for output or returns an error. this will either return a valid writer
-// or an error but neither both and if there is no error, sbom.Writer.Close() should be called
-func makeWriter(outputs []string, defaultFile string) (sbom.Writer, error) {
-	outputOptions, err := parseOptions(outputs, defaultFile)
-	if err != nil {
-		return nil, err
-	}
-
-	writer, err := output.MakeWriter(outputOptions...)
-	if err != nil {
-		return nil, err
-	}
-
-	return writer, nil
-}
-
-// parseOptions utility to parse command-line option strings and retain the existing behavior of default format and file
-func parseOptions(outputs []string, defaultFile string) (out []output.WriterOption, errs error) {
-	// always should have one option -- we generally get the default of "table", but just make sure
-	if len(outputs) == 0 {
-		outputs = append(outputs, string(format.TableOption))
-	}
-
-	for _, name := range outputs {
-		name = strings.TrimSpace(name)
-
-		// split to at most two parts for <format>=<file>
-		parts := strings.SplitN(name, "=", 2)
-
-		// the format option is the first part
-		name = parts[0]
-
-		// default to the --file or empty string if not specified
-		file := defaultFile
-
-		// If a file is specified as part of the output option, use that
-		if len(parts) > 1 {
-			file = parts[1]
-		}
-
-		option := format.ParseOption(name)
-		if option == format.UnknownFormatOption {
-			errs = multierror.Append(errs, fmt.Errorf("bad output format: '%s'", name))
-			continue
-		}
-
-		encoder := formats.ByOption(option)
-		if encoder == nil {
-			errs = multierror.Append(errs, fmt.Errorf("unknown format: %s", outputFormat))
-			continue
-		}
-
-		out = append(out, output.WriterOption{
-			Format: *encoder,
-			Path:   file,
-		})
-	}
-	return out, errs
-}

cmd/output_writer_test.go

@@ -1,78 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestOutputWriterConfig(t *testing.T) {
-	tmp := t.TempDir() + "/"
-
-	tests := []struct {
-		outputs  []string
-		file     string
-		err      bool
-		expected []string
-	}{
-		{
-			outputs:  []string{},
-			expected: []string{""},
-		},
-		{
-			outputs:  []string{"json"},
-			expected: []string{""},
-		},
-		{
-			file:     "test-1.json",
-			expected: []string{"test-1.json"},
-		},
-		{
-			outputs:  []string{"json=test-2.json"},
-			expected: []string{"test-2.json"},
-		},
-		{
-			outputs:  []string{"json=test-3-1.json", "spdx-json=test-3-2.json"},
-			expected: []string{"test-3-1.json", "test-3-2.json"},
-		},
-		{
-			outputs:  []string{"text", "json=test-4.json"},
-			expected: []string{"", "test-4.json"},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(fmt.Sprintf("%s/%s", test.outputs, test.file), func(t *testing.T) {
-			outputs := test.outputs
-			for i, val := range outputs {
-				outputs[i] = strings.Replace(val, "=", "="+tmp, 1)
-			}
-
-			file := test.file
-			if file != "" {
-				file = tmp + file
-			}
-
-			_, err := makeWriter(test.outputs, file)
-
-			if test.err {
-				assert.Error(t, err)
-				return
-			} else {
-				assert.NoError(t, err)
-			}
-
-			for _, expected := range test.expected {
-				if expected != "" {
-					assert.FileExists(t, tmp+expected)
-				} else if file != "" {
-					assert.FileExists(t, file)
-				} else {
-					assert.NoFileExists(t, expected)
-				}
-			}
-		})
-	}
-}

cmd/packages.go

@@ -10,13 +10,13 @@ import (
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/anchore"
 	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/formats"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/ui"
 	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/syft/format"
-	"github.com/anchore/syft/syft/pkg/cataloger"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 	"github.com/pkg/profile"
@@ -50,7 +50,8 @@ const (
 )
 
 var (
-	packagesCmd = &cobra.Command{
+	packagesPresenterOpt format.Option
+	packagesCmd          = &cobra.Command{
 		Use:   "packages [SOURCE]",
 		Short: "Generate a package SBOM",
 		Long:  "Generate a packaged-based Software Bill Of Materials (SBOM) from container images and filesystems",
@@ -61,7 +62,14 @@ var (
 		Args:          validateInputArgs,
 		SilenceUsage:  true,
 		SilenceErrors: true,
-		PreRunE: func(cmd *cobra.Command, args []string) (err error) {
+		PreRunE: func(cmd *cobra.Command, args []string) error {
+			// set the presenter
+			presenterOption := format.ParseOption(appConfig.Output)
+			if presenterOption == format.UnknownFormatOption {
+				return fmt.Errorf("bad --output value '%s'", appConfig.Output)
+			}
+			packagesPresenterOpt = presenterOption
+
 			if appConfig.Dev.ProfileCPU && appConfig.Dev.ProfileMem {
 				return fmt.Errorf("cannot profile CPU and memory simultaneously")
 			}
@@ -90,17 +98,17 @@ func setPackageFlags(flags *pflag.FlagSet) {
 	// Formatting & Input options //////////////////////////////////////////////
 
 	flags.StringP(
-		"scope", "s", cataloger.DefaultSearchConfig().Scope.String(),
+		"scope", "s", source.SquashedScope.String(),
 		fmt.Sprintf("selection of layers to catalog, options=%v", source.AllScopes))
 
-	flags.StringArrayP(
-		"output", "o", []string{string(format.TableOption)},
-		fmt.Sprintf("report output format, options=%v", format.AllOptions),
+	flags.StringP(
+		"output", "o", string(format.TableOption),
+		fmt.Sprintf("report output formatter, options=%v", format.AllOptions),
 	)
 
 	flags.StringP(
 		"file", "", "",
-		"file to write the default report output to (default is STDOUT)",
+		"file to write the report output to (default is STDOUT)",
 	)
 
 	// Upload options //////////////////////////////////////////////////////////
@@ -124,11 +132,6 @@ func setPackageFlags(flags *pflag.FlagSet) {
 		"include dockerfile for upload to Anchore Enterprise",
 	)
 
-	flags.StringArrayP(
-		"exclude", "", nil,
-		"exclude paths from being scanned using a glob expression",
-	)
-
 	flags.Bool(
 		"overwrite-existing-image", false,
 		"overwrite an existing image during the upload to Anchore Enterprise",
@@ -155,10 +158,6 @@ func bindPackagesConfigOptions(flags *pflag.FlagSet) error {
 		return err
 	}
 
-	if err := viper.BindPFlag("exclude", flags.Lookup("exclude")); err != nil {
-		return err
-	}
-
 	// Upload options //////////////////////////////////////////////////////////
 
 	if err := viper.BindPFlag("anchore.host", flags.Lookup("host")); err != nil {
@@ -201,26 +200,26 @@ func validateInputArgs(cmd *cobra.Command, args []string) error {
 }
 
 func packagesExec(_ *cobra.Command, args []string) error {
-	writer, err := makeWriter(appConfig.Output, appConfig.File)
+	// could be an image or a directory, with or without a scheme
+	userInput := args[0]
+
+	reporter, closer, err := reportWriter()
+	defer func() {
+		if err := closer(); err != nil {
+			log.Warnf("unable to write to report destination: %+v", err)
+		}
+	}()
+
 	if err != nil {
 		return err
 	}
 
-	defer func() {
-		if err := writer.Close(); err != nil {
-			log.Warnf("unable to write to report destination: %w", err)
-		}
-	}()
-
-	// could be an image or a directory, with or without a scheme
-	userInput := args[0]
-
 	return eventLoop(
-		packagesExecWorker(userInput, writer),
+		packagesExecWorker(userInput),
 		setupSignals(),
 		eventSubscription,
 		stereoscope.Cleanup,
-		ui.Select(isVerbose(), appConfig.Quiet)...,
+		ui.Select(isVerbose(), appConfig.Quiet, reporter)...,
 	)
 }
 
@@ -235,7 +234,7 @@ func isVerbose() (result bool) {
 	return appConfig.CliOptions.Verbosity > 0 || isPipedInput
 }
 
-func packagesExecWorker(userInput string, writer sbom.Writer) <-chan error {
+func packagesExecWorker(userInput string) <-chan error {
 	errs := make(chan error)
 	go func() {
 		defer close(errs)
@@ -246,9 +245,17 @@ func packagesExecWorker(userInput string, writer sbom.Writer) <-chan error {
 			return
 		}
 
-		src, cleanup, err := source.New(userInput, appConfig.Registry.ToOptions(), appConfig.Exclusions)
+		f := formats.ByOption(packagesPresenterOpt)
+		if f == nil {
+			errs <- fmt.Errorf("unknown format: %s", packagesPresenterOpt)
+			return
+		}
+
+		checkForApplicationUpdate()
+
+		src, cleanup, err := source.New(userInput, appConfig.Registry.ToOptions())
 		if err != nil {
-			errs <- fmt.Errorf("failed to construct source from user input %q: %w", userInput, err)
+			errs <- fmt.Errorf("failed to determine image source: %w", err)
 			return
 		}
 		if cleanup != nil {
@@ -281,8 +288,8 @@ func packagesExecWorker(userInput string, writer sbom.Writer) <-chan error {
 		}
 
 		bus.Publish(partybus.Event{
-			Type:  event.Exit,
-			Value: func() error { return writer.Write(s) },
+			Type:  event.PresenterReady,
+			Value: f.Presenter(s),
 		})
 	}()
 	return errs

cmd/power_user.go

@@ -9,7 +9,6 @@ import (
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/formats/syftjson"
 	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/output"
 	"github.com/anchore/syft/internal/ui"
 	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft/artifact"
@@ -74,16 +73,9 @@ func powerUserExec(_ *cobra.Command, args []string) error {
 	// could be an image or a directory, with or without a scheme
 	userInput := args[0]
 
-	writer, err := output.MakeWriter(output.WriterOption{
-		Format: syftjson.Format(),
-		Path:   appConfig.File,
-	})
-	if err != nil {
-		return err
-	}
-
+	reporter, closer, err := reportWriter()
 	defer func() {
-		if err := writer.Close(); err != nil {
+		if err := closer(); err != nil {
 			log.Warnf("unable to write to report destination: %+v", err)
 		}
 
@@ -92,15 +84,19 @@ func powerUserExec(_ *cobra.Command, args []string) error {
 		fmt.Fprintln(os.Stderr, deprecated)
 	}()
 
+	if err != nil {
+		return err
+	}
+
 	return eventLoop(
-		powerUserExecWorker(userInput, writer),
+		powerUserExecWorker(userInput),
 		setupSignals(),
 		eventSubscription,
 		stereoscope.Cleanup,
-		ui.Select(isVerbose(), appConfig.Quiet)...,
+		ui.Select(isVerbose(), appConfig.Quiet, reporter)...,
 	)
 }
-func powerUserExecWorker(userInput string, writer sbom.Writer) <-chan error {
+func powerUserExecWorker(userInput string) <-chan error {
 	errs := make(chan error)
 	go func() {
 		defer close(errs)
@@ -115,7 +111,9 @@ func powerUserExecWorker(userInput string, writer sbom.Writer) <-chan error {
 			return
 		}
 
-		src, cleanup, err := source.New(userInput, appConfig.Registry.ToOptions(), appConfig.Exclusions)
+		checkForApplicationUpdate()
+
+		src, cleanup, err := source.New(userInput, appConfig.Registry.ToOptions())
 		if err != nil {
 			errs <- err
 			return
@@ -144,8 +142,8 @@ func powerUserExecWorker(userInput string, writer sbom.Writer) <-chan error {
 		s.Relationships = append(s.Relationships, mergeRelationships(relationships...)...)
 
 		bus.Publish(partybus.Event{
-			Type:  event.Exit,
-			Value: func() error { return writer.Write(s) },
+			Type:  event.PresenterReady,
+			Value: syftjson.Format().Presenter(s),
 		})
 	}()
 

cmd/report_writer.go

@@ -0,0 +1,33 @@
+package cmd
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"strings"
+
+	"github.com/anchore/syft/internal/log"
+)
+
+func reportWriter() (io.Writer, func() error, error) {
+	nop := func() error { return nil }
+	path := strings.TrimSpace(appConfig.File)
+
+	switch len(path) {
+	case 0:
+		return os.Stdout, nop, nil
+
+	default:
+		reportFile, err := os.OpenFile(path, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0644)
+
+		if err != nil {
+			return nil, nop, fmt.Errorf("unable to create report file: %w", err)
+		}
+
+		return reportFile, func() error {
+			log.Infof("report written to file=%q", path)
+
+			return reportFile.Close()
+		}, nil
+	}
+}

cmd/root.go

@@ -4,9 +4,7 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/version"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 )
@@ -24,14 +22,12 @@ var rootCmd = &cobra.Command{
 	PreRunE:           packagesCmd.PreRunE,
 	RunE:              packagesCmd.RunE,
 	ValidArgsFunction: packagesCmd.ValidArgsFunction,
-	Version:           version.FromBuild().Version,
 }
 
 func init() {
 	// set universal flags
 	rootCmd.PersistentFlags().StringVarP(&persistentOpts.ConfigPath, "config", "c", "", "application config file")
-	// setting the version template to just print out the string since we already have a templatized version string
-	rootCmd.SetVersionTemplate(fmt.Sprintf("%s {{.Version}}\n", internal.ApplicationName))
+
 	flag := "quiet"
 	rootCmd.PersistentFlags().BoolP(
 		flag, "q", false,

cmd/tasks.go

@@ -45,7 +45,7 @@ func generateCatalogPackagesTask() (task, error) {
 	}
 
 	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
-		packageCatalog, relationships, theDistro, err := syft.CatalogPackages(src, appConfig.Package.ToConfig())
+		packageCatalog, relationships, theDistro, err := syft.CatalogPackages(src, appConfig.Package.Cataloger.ScopeOpt)
 		if err != nil {
 			return nil, err
 		}

go.mod

@@ -3,22 +3,22 @@ module github.com/anchore/syft
 go 1.16
 
 require (
-	github.com/CycloneDX/cyclonedx-go v0.4.0
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
 	github.com/adrg/xdg v0.2.1
 	github.com/alecthomas/jsonschema v0.0.0-20210301060011-54c507b6f074
 	github.com/anchore/client-go v0.0.0-20210222170800-9c70f9b80bcf
+	github.com/anchore/go-presenter v0.0.0-20211102174526-0dbf20f6c7fa
 	github.com/anchore/go-rpmdb v0.0.0-20210914181456-a9c52348da63
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29
-	github.com/anchore/stereoscope v0.0.0-20211222141827-6e663afeef5d
+	github.com/anchore/stereoscope v0.0.0-20211116152349-7e4e1b56a15d
 	// we are hinting brotli to latest due to warning when installing archiver v3:
 	// go: warning: github.com/andybalholm/brotli@v1.0.1: retracted by module author: occasional panics and data corruption
 	github.com/andybalholm/brotli v1.0.4 // indirect
 	github.com/antihax/optional v1.0.0
-	github.com/bmatcuk/doublestar/v4 v4.0.2
-	github.com/docker/docker v20.10.11+incompatible
+	github.com/bmatcuk/doublestar/v2 v2.0.4
+	github.com/docker/docker v20.10.10+incompatible
 	github.com/dustin/go-humanize v1.0.0
 	github.com/facebookincubator/nvdtools v0.1.4
 	github.com/go-test/deep v1.0.7

go.sum

@@ -60,8 +60,6 @@ github.com/Azure/go-autorest/logger v0.2.0/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZ
 github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/CycloneDX/cyclonedx-go v0.4.0 h1:Wz4QZ9B4RXGWIWTypVLEOVJgOdFfy5mcS5PGNzUkZxU=
-github.com/CycloneDX/cyclonedx-go v0.4.0/go.mod h1:rmRcf//gT7PIzovatusbWi377xqCg1FS4jyST0GH20E=
 github.com/Microsoft/go-winio v0.4.11/go.mod h1:VhR8bwka0BXejwEJY73c50VrPtXAaKcyvVC4A4RozmA=
 github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
 github.com/Microsoft/go-winio v0.4.15-0.20190919025122-fc70bd9a86b5/go.mod h1:tTuCMEN+UleMWgg9dVx4Hu52b1bJo+59jBh3ajtinzw=
@@ -80,7 +78,6 @@ github.com/Microsoft/hcsshim v0.8.14/go.mod h1:NtVKoYxQuTLx6gEq0L96c9Ju4JbRJ4nY2
 github.com/Microsoft/hcsshim v0.8.15/go.mod h1:x38A4YbHbdxJtc0sF6oIz+RG0npwSCAvn69iY6URG00=
 github.com/Microsoft/hcsshim v0.8.16/go.mod h1:o5/SZqmR7x9JNKsW3pu+nqHm0MF8vbA+VxGOoXdC600=
 github.com/Microsoft/hcsshim v0.8.21/go.mod h1:+w2gRZ5ReXQhFOrvSQeNfhrYB/dg3oDwTOcER2fw4I4=
-github.com/Microsoft/hcsshim v0.8.23/go.mod h1:4zegtUJth7lAvFyc6cH2gGQ5B3OFQim01nnU2M8jKDg=
 github.com/Microsoft/hcsshim/test v0.0.0-20201218223536-d3e5debf77da/go.mod h1:5hlzMzRKMLyo42nCZ9oml8AdTlq/0cvIaBv6tK1RehU=
 github.com/Microsoft/hcsshim/test v0.0.0-20210227013316-43a75bb4edd3/go.mod h1:mw7qgWloBUl75W/gVH3cQszUg1+gUITj7D6NY7ywVnY=
 github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
@@ -101,6 +98,8 @@ github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRF
 github.com/alexflint/go-filemutex v0.0.0-20171022225611-72bdc8eae2ae/go.mod h1:CgnQgUtFrFz9mxFNtED3jI5tLDjKlOM+oUF/sTk6ps0=
 github.com/anchore/client-go v0.0.0-20210222170800-9c70f9b80bcf h1:DYssiUV1pBmKqzKsm4mqXx8artqC0Q8HgZsVI3lMsAg=
 github.com/anchore/client-go v0.0.0-20210222170800-9c70f9b80bcf/go.mod h1:FaODhIA06mxO1E6R32JE0TL1JWZZkmjRIAd4ULvHUKk=
+github.com/anchore/go-presenter v0.0.0-20211102174526-0dbf20f6c7fa h1:mDLUAkgXsV5Z8D0EEj8eS6FBekolV/A+Xxbs9054bPw=
+github.com/anchore/go-presenter v0.0.0-20211102174526-0dbf20f6c7fa/go.mod h1:29jwxTSAS6pBcrmuwf1U3r1Tqp1o1XpuiOJ0NT9NoGg=
 github.com/anchore/go-rpmdb v0.0.0-20210914181456-a9c52348da63 h1:C9W/LAydEz/qdUhx1MdjO9l8NEcFKYknkxDVyo9LAoM=
 github.com/anchore/go-rpmdb v0.0.0-20210914181456-a9c52348da63/go.mod h1:6qH8c6U/3CBVvDDDBZnPSTbTINq3cIdADUYTaVf75EM=
 github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04 h1:VzprUTpc0vW0nnNKJfJieyH/TZ9UYAnTZs5/gHTdAe8=
@@ -109,8 +108,8 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZV
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29 h1:K9LfnxwhqvihqU0+MF325FNy7fsKV9EGaUxdfR4gnWk=
 github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29/go.mod h1:Oc1UkGaJwY6ND6vtAqPSlYrptKRJngHwkwB6W7l1uP0=
-github.com/anchore/stereoscope v0.0.0-20211222141827-6e663afeef5d h1:ggdC5SRb8rAXmBkwxah8gfSxwpoAVcpp12tQ+XbDi20=
-github.com/anchore/stereoscope v0.0.0-20211222141827-6e663afeef5d/go.mod h1:FNm1rtauEjkC3elA3jr3bJkU+/4QiovApwJdPnHQ9x0=
+github.com/anchore/stereoscope v0.0.0-20211116152349-7e4e1b56a15d h1:ieKMmJk1IcmdviUv/KGO1DAk0yFxoGwDpwGq8ckVeVU=
+github.com/anchore/stereoscope v0.0.0-20211116152349-7e4e1b56a15d/go.mod h1:Zzs5pLx2ZtUctlER7bNDAucDmsc8RO2g/oL3for1tVA=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
 github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY3JY=
@@ -133,17 +132,16 @@ github.com/bits-and-blooms/bitset v1.2.0/go.mod h1:gIdJ4wp64HaoK2YrL1Q5/N7Y16edY
 github.com/bketelsen/crypt v0.0.4/go.mod h1:aI6NrJ0pMGgvZKL1iVgXLnfIFJtfV+bKCoqOes/6LfM=
 github.com/blang/semver v3.1.0+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
 github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
+github.com/bmatcuk/doublestar/v2 v2.0.4 h1:6I6oUiT/sU27eE2OFcWqBhL1SwjyvQuOssxT4a1yidI=
+github.com/bmatcuk/doublestar/v2 v2.0.4/go.mod h1:QMmcs3H2AUQICWhfzLXz+IYln8lRQmTZRptLie8RgRw=
 github.com/bmatcuk/doublestar/v4 v4.0.2 h1:X0krlUVAVmtr2cRoTqR8aDMrDqnB36ht8wpWTiQ3jsA=
 github.com/bmatcuk/doublestar/v4 v4.0.2/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
-github.com/bradleyjkemp/cupaloy/v2 v2.6.0 h1:knToPYa2xtfg42U3I6punFEjaGFKWQRXJwj0JTv4mTs=
-github.com/bradleyjkemp/cupaloy/v2 v2.6.0/go.mod h1:bm7JXdkRd4BHJk9HpwqAI8BoAY1lps46Enkdqw6aRX0=
 github.com/bshuster-repo/logrus-logstash-hook v0.4.1/go.mod h1:zsTqEiSzDgAa/8GZR7E1qaXrhYNDKBYy5/dWPTIflbk=
 github.com/buger/jsonparser v0.0.0-20180808090653-f4dd9f5a6b44/go.mod h1:bbYlZJ7hK1yFx9hf58LP0zeX7UjIGs20ufpu3evjr+s=
 github.com/bugsnag/bugsnag-go v0.0.0-20141110184014-b1d153021fcd/go.mod h1:2oa8nejYd4cQ/b0hMIopN0lCRxU0bueqREvZLWFrtK8=
 github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b/go.mod h1:obH5gd0BsqsP2LwDJ9aOkm/6J86V6lyAXCoQWGw3K50=
 github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0/go.mod h1:D/8v3kj0zr8ZAKg1AQ6crr+5VwKN5eIywRkfhyM/+dE=
-github.com/cenkalti/backoff/v4 v4.1.1/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
@@ -194,15 +192,13 @@ github.com/containerd/containerd v1.3.2/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMX
 github.com/containerd/containerd v1.4.0-beta.2.0.20200729163537-40b22ef07410/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
 github.com/containerd/containerd v1.4.1/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
 github.com/containerd/containerd v1.4.3/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.4.9/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
 github.com/containerd/containerd v1.5.0-beta.1/go.mod h1:5HfvG1V2FsKesEGQ17k5/T7V960Tmcumvqn8Mc+pCYQ=
 github.com/containerd/containerd v1.5.0-beta.3/go.mod h1:/wr9AVtEM7x9c+n0+stptlo/uBBoBORwEx6ardVcmKU=
 github.com/containerd/containerd v1.5.0-beta.4/go.mod h1:GmdgZd2zA2GYIBZ0w09ZvgqEq8EfBp/m3lcVZIvPHhI=
 github.com/containerd/containerd v1.5.0-rc.0/go.mod h1:V/IXoMqNGgBlabz3tHD2TWDoTJseu1FGOKuoA4nNb2s=
 github.com/containerd/containerd v1.5.1/go.mod h1:0DOxVqwDy2iZvrZp2JUx/E+hS0UNTVn7dJnIOwtYR4g=
+github.com/containerd/containerd v1.5.7 h1:rQyoYtj4KddB3bxG6SAqd4+08gePNyJjRqvOIfV3rkM=
 github.com/containerd/containerd v1.5.7/go.mod h1:gyvv6+ugqY25TiXxcZC3L5yOeYgEw0QMhscqVp1AR9c=
-github.com/containerd/containerd v1.5.8 h1:NmkCC1/QxyZFBny8JogwLpOy2f+VEbO/f6bV2Mqtwuw=
-github.com/containerd/containerd v1.5.8/go.mod h1:YdFSv5bTFLpG2HIYmfqDpSYYTDX+mc5qtSuYx1YUb/s=
 github.com/containerd/continuity v0.0.0-20190426062206-aaeac12a7ffc/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
 github.com/containerd/continuity v0.0.0-20190815185530-f2a389ac0a02/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
 github.com/containerd/continuity v0.0.0-20191127005431-f65d91d395eb/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
@@ -237,7 +233,6 @@ github.com/containerd/ttrpc v0.0.0-20190828172938-92c8520ef9f8/go.mod h1:PvCDdDG
 github.com/containerd/ttrpc v0.0.0-20191028202541-4f1b8fe65a5c/go.mod h1:LPm1u0xBw8r8NOKoOdNMeVHSawSsltak+Ihv+etqsE8=
 github.com/containerd/ttrpc v1.0.1/go.mod h1:UAxOpgT9ziI0gJrmKvgcZivgxOp8iFPSk8httJEt98Y=
 github.com/containerd/ttrpc v1.0.2/go.mod h1:UAxOpgT9ziI0gJrmKvgcZivgxOp8iFPSk8httJEt98Y=
-github.com/containerd/ttrpc v1.1.0/go.mod h1:XX4ZTnoOId4HklF4edwc4DcqskFZuvXB1Evzy5KFQpQ=
 github.com/containerd/typeurl v0.0.0-20180627222232-a93fcdb778cd/go.mod h1:Cm3kwCdlkCfMSHURc+r6fwoGH6/F1hH3S4sg0rLFWPc=
 github.com/containerd/typeurl v0.0.0-20190911142611-5eb25027c9fd/go.mod h1:GeKYzf2pQcqv7tJ0AoCuuhtnqhva5LNU3U+OyKxxJpk=
 github.com/containerd/typeurl v1.0.1/go.mod h1:TB1hUtrpaiO88KEK56ijojHS1+NeF0izUACaJW2mdXg=
@@ -295,9 +290,8 @@ github.com/docker/distribution v0.0.0-20190905152932-14b96e55d84c/go.mod h1:0+TT
 github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.7.1+incompatible h1:a5mlkVzth6W5A4fOsS3D2EO5BUmsJpcB+cRlLU7cSug=
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/docker v20.10.10+incompatible h1:GKkP0T7U4ks6X3lmmHKC2QDprnpRJor2Z5a8m62R9ZM=
 github.com/docker/docker v20.10.10+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v20.10.11+incompatible h1:OqzI/g/W54LczvhnccGqniFoQghHx3pklbLuhfXpqGo=
-github.com/docker/docker v20.10.11+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.6.4 h1:axCks+yV+2MR3/kZhAmy07yC56WZ2Pwu/fKWtKuZB0o=
 github.com/docker/docker-credential-helpers v0.6.4/go.mod h1:ofX3UI0Gz1TteYBjtgs07O36Pyasyp66D2uKT7H8W1c=
 github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
@@ -657,9 +651,8 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.0.0/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
 github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
+github.com/opencontainers/image-spec v1.0.2-0.20210730191737-8e42a01fb1b7 h1:axgApq2XShTLwQii2zAnIkMPlhGVHbAXHUcHezu5G/k=
 github.com/opencontainers/image-spec v1.0.2-0.20210730191737-8e42a01fb1b7/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
-github.com/opencontainers/image-spec v1.0.2 h1:9yCKha/T5XdGtO0q9Q9a6T5NUCsTn/DrBg0D7ufOcFM=
-github.com/opencontainers/image-spec v1.0.2/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
 github.com/opencontainers/runc v0.0.0-20190115041553-12f6a991201f/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runc v0.1.1/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runc v1.0.0-rc8.0.20190926000215-3e425f80a8c9/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=

install.sh

@@ -1,5 +1,7 @@
 #!/bin/sh
 set -e
+# Code generated by godownloader on 2020-08-10T20:55:46Z.
+#
 
 usage() {
   this=$1
@@ -21,7 +23,7 @@ EOF
 }
 
 parse_args() {
-  # BINDIR is ./bin unless set be ENV
+  #BINDIR is ./bin unless set be ENV
   # over-ridden by flag below
 
   BINDIR=${BINDIR:-./bin}
@@ -65,10 +67,8 @@ execute() {
 }
 get_binaries() {
   case "$PLATFORM" in
-    darwin/arm64) BINARIES="syft" ;;
     darwin/amd64) BINARIES="syft" ;;
     linux/amd64) BINARIES="syft" ;;
-    linux/arm64) BINARIES="syft" ;;
     windows/amd64) BINARIES="syft" ;;
     *)
       log_crit "platform $PLATFORM is not supported.  Make sure this script is up-to-date and file request at https://github.com/${PREFIX}/issues/new"
@@ -97,9 +97,6 @@ adjust_format() {
     darwin) FORMAT=dmg ;;
     windows) FORMAT=zip ;;
   esac
-  case "${PLATFORM}" in
-    darwin/arm64) FORMAT=zip ;;
-  esac
   true
 }
 adjust_os() {
@@ -247,7 +244,7 @@ extract_from_dmg() {
   dmg_file=$1
   mount_point="/Volumes/tmp-dmg"
   hdiutil attach -quiet -nobrowse -mountpoint "${mount_point}" "${dmg_file}"
-  cp -fR "${mount_point}/." ./
+  cp -fR "${mount_point}/" ./
   hdiutil detach -quiet -force "${mount_point}"
 }
 http_download_curl() {

internal/anchore/import_package_sbom.go

@@ -25,7 +25,7 @@ type packageSBOMImportAPI interface {
 func packageSbomModel(s sbom.SBOM) (*external.ImagePackageManifest, error) {
 	var buf bytes.Buffer
 
-	err := syftjson.Format().Encode(&buf, s)
+	err := syftjson.Format().Presenter(s).Present(&buf)
 	if err != nil {
 		return nil, fmt.Errorf("unable to serialize results: %w", err)
 	}
@@ -33,7 +33,7 @@ func packageSbomModel(s sbom.SBOM) (*external.ImagePackageManifest, error) {
 	// the model is 1:1 the JSON output of today. As the schema changes, this will need to be converted into individual mappings.
 	var model external.ImagePackageManifest
 	if err = json.Unmarshal(buf.Bytes(), &model); err != nil {
-		return nil, fmt.Errorf("unable to convert JSON output to import model: %w", err)
+		return nil, fmt.Errorf("unable to convert JSON presenter output to import model: %w", err)
 	}
 
 	return &model, nil

internal/anchore/import_package_sbom_test.go

@@ -105,7 +105,8 @@ func TestPackageSbomToModel(t *testing.T) {
 	}
 
 	var buf bytes.Buffer
-	if err := syftjson.Format().Encode(&buf, s); err != nil {
+	pres := syftjson.Format().Presenter(s)
+	if err := pres.Present(&buf); err != nil {
 		t.Fatalf("unable to get expected json: %+v", err)
 	}
 

internal/config/application.go

@@ -3,7 +3,10 @@ package config
 import (
 	"errors"
 	"fmt"
+	"os"
+	"os/exec"
 	"path"
+	"path/filepath"
 	"reflect"
 	"strings"
 
@@ -30,7 +33,7 @@ type parser interface {
 // Application is the main syft application configuration.
 type Application struct {
 	ConfigPath         string             `yaml:",omitempty" json:"configPath"`                                                         // the location where the application config was read from (either from -c or discovered while loading)
-	Output             []string           `yaml:"output" json:"output" mapstructure:"output"`                                           // -o, the format to use for output
+	Output             string             `yaml:"output" json:"output" mapstructure:"output"`                                           // -o, the Presenter hint string to use for report formatting
 	File               string             `yaml:"file" json:"file" mapstructure:"file"`                                                 // --file, the file to write report output to
 	Quiet              bool               `yaml:"quiet" json:"quiet" mapstructure:"quiet"`                                              // -q, indicates to not show any status output to stderr (ETUI or logging UI)
 	CheckForAppUpdate  bool               `yaml:"check-for-app-update" json:"check-for-app-update" mapstructure:"check-for-app-update"` // whether to check for an application update on start up or not
@@ -38,13 +41,12 @@ type Application struct {
 	CliOptions         CliOnlyOptions     `yaml:"-" json:"-"`                                                                           // all options only available through the CLI (not via env vars or config)
 	Dev                development        `yaml:"dev" json:"dev" mapstructure:"dev"`
 	Log                logging            `yaml:"log" json:"log" mapstructure:"log"` // all logging-related options
-	Package            pkg                `yaml:"package" json:"package" mapstructure:"package"`
+	Package            packages           `yaml:"package" json:"package" mapstructure:"package"`
 	FileMetadata       FileMetadata       `yaml:"file-metadata" json:"file-metadata" mapstructure:"file-metadata"`
 	FileClassification fileClassification `yaml:"file-classification" json:"file-classification" mapstructure:"file-classification"`
 	FileContents       fileContents       `yaml:"file-contents" json:"file-contents" mapstructure:"file-contents"`
 	Secrets            secrets            `yaml:"secrets" json:"secrets" mapstructure:"secrets"`
 	Registry           registry           `yaml:"registry" json:"registry" mapstructure:"registry"`
-	Exclusions         []string           `yaml:"exclude" json:"exclude" mapstructure:"exclude"`
 }
 
 // PowerUserCatalogerEnabledDefault switches all catalogers to be enabled when running power-user command
@@ -207,44 +209,80 @@ func readConfig(v *viper.Viper, configPath string) error {
 	// 1. look for .<appname>.yaml (in the current directory)
 	v.AddConfigPath(".")
 	v.SetConfigName("." + internal.ApplicationName)
-	if err = v.ReadInConfig(); err == nil {
-		return nil
-	} else if !errors.As(err, &viper.ConfigFileNotFoundError{}) {
-		return fmt.Errorf("unable to parse config=%q: %w", v.ConfigFileUsed(), err)
+	if exists, err := readViperConfig(v); exists || err != nil {
+		return err
 	}
 
 	// 2. look for .<appname>/config.yaml (in the current directory)
 	v.AddConfigPath("." + internal.ApplicationName)
 	v.SetConfigName("config")
-	if err = v.ReadInConfig(); err == nil {
-		return nil
-	} else if !errors.As(err, &viper.ConfigFileNotFoundError{}) {
-		return fmt.Errorf("unable to parse config=%q: %w", v.ConfigFileUsed(), err)
+	if exists, err := readViperConfig(v); exists || err != nil {
+		return err
 	}
 
-	// 3. look for ~/.<appname>.yaml
+	if root := gitRepoRoot(); root != "" {
+		// 3. look for <git repo root>/.<appname>.yaml, where the repo root is defined by "git rev-parse --show-toplevel"
+		v.AddConfigPath(root)
+		v.SetConfigName("." + internal.ApplicationName)
+		if exists, err := readViperConfig(v); exists {
+			if err != nil {
+				return err
+			}
+			return os.Chdir(root)
+		}
+
+		// 4. look for <git repo root>/.<appname>/config.yaml, where the repo root is defined by "git rev-parse --show-toplevel"
+		v.AddConfigPath(filepath.Join(root, "."+internal.ApplicationName))
+		v.SetConfigName("config")
+		if exists, err := readViperConfig(v); exists {
+			if err != nil {
+				return err
+			}
+			return os.Chdir(root)
+		}
+	}
+
+	// 5. look for ~/.<appname>.yaml
 	home, err := homedir.Dir()
 	if err == nil {
 		v.AddConfigPath(home)
 		v.SetConfigName("." + internal.ApplicationName)
-		if err = v.ReadInConfig(); err == nil {
-			return nil
-		} else if !errors.As(err, &viper.ConfigFileNotFoundError{}) {
-			return fmt.Errorf("unable to parse config=%q: %w", v.ConfigFileUsed(), err)
+		if exists, err := readViperConfig(v); exists || err != nil {
+			return err
 		}
 	}
 
-	// 4. look for <appname>/config.yaml in xdg locations (starting with xdg home config dir, then moving upwards)
+	// 6. look for <appname>/config.yaml in xdg locations (starting with xdg home config dir, then moving upwards)
 	v.AddConfigPath(path.Join(xdg.ConfigHome, internal.ApplicationName))
 	for _, dir := range xdg.ConfigDirs {
 		v.AddConfigPath(path.Join(dir, internal.ApplicationName))
 	}
 	v.SetConfigName("config")
-	if err = v.ReadInConfig(); err == nil {
-		return nil
-	} else if !errors.As(err, &viper.ConfigFileNotFoundError{}) {
-		return fmt.Errorf("unable to parse config=%q: %w", v.ConfigFileUsed(), err)
+	if exists, err := readViperConfig(v); exists || err != nil {
+		return err
 	}
 
 	return ErrApplicationConfigNotFound
 }
+
+func readViperConfig(v *viper.Viper) (bool, error) {
+	err := v.ReadInConfig()
+	if err == nil {
+		return true, nil
+	} else if errors.As(err, &viper.ConfigFileNotFoundError{}) {
+		return false, nil
+	}
+	return true, fmt.Errorf("unable to parse config=%q: %w", v.ConfigFileUsed(), err)
+}
+
+func gitRepoRoot() string {
+	root, err := exec.Command("git", "rev-parse", "--show-toplevel").Output()
+	if err != nil {
+		return ""
+	}
+	absRepoRoot, err := filepath.Abs(strings.TrimSpace(string(root)))
+	if err != nil {
+		return ""
+	}
+	return absRepoRoot
+}

internal/config/cataloger_options.go

@@ -3,8 +3,6 @@ package config
 import (
 	"fmt"
 
-	"github.com/spf13/viper"
-
 	"github.com/anchore/syft/syft/source"
 )
 
@@ -14,10 +12,6 @@ type catalogerOptions struct {
 	ScopeOpt source.Scope `yaml:"-" json:"-"`
 }
 
-func (cfg catalogerOptions) loadDefaultValues(v *viper.Viper) {
-	v.SetDefault("package.cataloger.enabled", true)
-}
-
 func (cfg *catalogerOptions) parseConfigValues() error {
 	scopeOption := source.ParseScope(cfg.Scope)
 	if scopeOption == source.UnknownScope {

internal/config/packages.go

@@ -0,0 +1,15 @@
+package config
+
+import "github.com/spf13/viper"
+
+type packages struct {
+	Cataloger catalogerOptions `yaml:"cataloger" json:"cataloger" mapstructure:"cataloger"`
+}
+
+func (cfg packages) loadDefaultValues(v *viper.Viper) {
+	v.SetDefault("package.cataloger.enabled", true)
+}
+
+func (cfg *packages) parseConfigValues() error {
+	return cfg.Cataloger.parseConfigValues()
+}

internal/config/pkg.go

@@ -1,33 +0,0 @@
-package config
-
-import (
-	"github.com/anchore/syft/syft/pkg/cataloger"
-	"github.com/spf13/viper"
-)
-
-type pkg struct {
-	Cataloger               catalogerOptions `yaml:"cataloger" json:"cataloger" mapstructure:"cataloger"`
-	SearchUnindexedArchives bool             `yaml:"search-unindexed-archives" json:"search-unindexed-archives" mapstructure:"search-unindexed-archives"`
-	SearchIndexedArchives   bool             `yaml:"search-indexed-archives" json:"search-indexed-archives" mapstructure:"search-indexed-archives"`
-}
-
-func (cfg pkg) loadDefaultValues(v *viper.Viper) {
-	cfg.Cataloger.loadDefaultValues(v)
-	c := cataloger.DefaultSearchConfig()
-	v.SetDefault("package.search-unindexed-archives", c.IncludeUnindexedArchives)
-	v.SetDefault("package.search-indexed-archives", c.IncludeIndexedArchives)
-}
-
-func (cfg *pkg) parseConfigValues() error {
-	return cfg.Cataloger.parseConfigValues()
-}
-
-func (cfg pkg) ToConfig() cataloger.Config {
-	return cataloger.Config{
-		Search: cataloger.SearchConfig{
-			IncludeIndexedArchives:   cfg.SearchIndexedArchives,
-			IncludeUnindexedArchives: cfg.SearchUnindexedArchives,
-			Scope:                    cfg.Cataloger.ScopeOpt,
-		},
-	}
-}

internal/config/registry_test.go

@@ -2,9 +2,8 @@ package config
 
 import (
 	"fmt"
-	"testing"
-
 	"github.com/anchore/stereoscope/pkg/image"
+	"testing"
 
 	"github.com/stretchr/testify/assert"
 )

internal/constants.go

@@ -4,7 +4,7 @@ const (
 	// ApplicationName is the non-capitalized name of the application (do not change this)
 	ApplicationName = "syft"
 
-	// JSONSchemaVersion is the current schema version output by the JSON encoder
+	// JSONSchemaVersion is the current schema version output by the JSON presenter
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "2.0.2"
+	JSONSchemaVersion = "2.0.0"
 )

internal/file/copy.go

@@ -1,19 +0,0 @@
-package file
-
-import (
-	"errors"
-	"fmt"
-	"io"
-)
-
-const perFileReadLimit = 2 * GB
-
-// safeCopy limits the copy from the reader. This is useful when extracting files from archives to
-// protect against decompression bomb attacks.
-func safeCopy(writer io.Writer, reader io.Reader) error {
-	numBytes, err := io.Copy(writer, io.LimitReader(reader, perFileReadLimit))
-	if numBytes >= perFileReadLimit || errors.Is(err, io.EOF) {
-		return fmt.Errorf("zip read limit hit (potential decompression bomb attack)")
-	}
-	return nil
-}

internal/file/tar_file_traversal.go

@@ -1,64 +0,0 @@
-package file
-
-import (
-	"fmt"
-	"io/ioutil"
-	"path/filepath"
-
-	"github.com/bmatcuk/doublestar/v4"
-	"github.com/mholt/archiver/v3"
-)
-
-// ExtractGlobsFromTarToUniqueTempFile extracts paths matching the given globs within the given archive to a temporary directory, returning file openers for each file extracted.
-func ExtractGlobsFromTarToUniqueTempFile(archivePath, dir string, globs ...string) (map[string]Opener, error) {
-	results := make(map[string]Opener)
-
-	// don't allow for full traversal, only select traversal from given paths
-	if len(globs) == 0 {
-		return results, nil
-	}
-
-	visitor := func(file archiver.File) error {
-		defer file.Close()
-
-		// ignore directories
-		if file.FileInfo.IsDir() {
-			return nil
-		}
-
-		// ignore any filename that doesn't match the given globs...
-		if !matchesAnyGlob(file.Name(), globs...) {
-			return nil
-		}
-
-		// we have a file we want to extract....
-		tempfilePrefix := filepath.Base(filepath.Clean(file.Name())) + "-"
-		tempFile, err := ioutil.TempFile(dir, tempfilePrefix)
-		if err != nil {
-			return fmt.Errorf("unable to create temp file: %w", err)
-		}
-		// we shouldn't try and keep the tempfile open as the returned result may have several files, which takes up
-		// resources (leading to "too many open files"). Instead we'll return a file opener to the caller which
-		// provides a ReadCloser. It is up to the caller to handle closing the file explicitly.
-		defer tempFile.Close()
-
-		if err := safeCopy(tempFile, file.ReadCloser); err != nil {
-			return fmt.Errorf("unable to copy source=%q for tar=%q: %w", file.Name(), archivePath, err)
-		}
-
-		results[file.Name()] = Opener{path: tempFile.Name()}
-
-		return nil
-	}
-
-	return results, archiver.Walk(archivePath, visitor)
-}
-
-func matchesAnyGlob(name string, globs ...string) bool {
-	for _, glob := range globs {
-		if matches, err := doublestar.PathMatch(glob, name); err == nil && matches {
-			return true
-		}
-	}
-	return false
-}

internal/file/zip_file_manifest_test.go

@@ -1,6 +1,3 @@
-//go:build !windows
-// +build !windows
-
 package file
 
 import (

internal/file/zip_file_traversal.go

@@ -3,7 +3,9 @@ package file
 import (
 	"archive/zip"
 	"bytes"
+	"errors"
 	"fmt"
+	"io"
 	"io/ioutil"
 	"os"
 	"path/filepath"
@@ -20,6 +22,8 @@ const (
 	GB
 )
 
+const perFileReadLimit = 2 * GB
+
 type errZipSlipDetected struct {
 	Prefix   string
 	JoinArgs []string
@@ -106,10 +110,21 @@ func ExtractFromZipToUniqueTempFile(archivePath, dir string, paths ...string) (m
 			return fmt.Errorf("unable to extract directories, only files: %s", file.Name)
 		}
 
-		if err := safeCopy(tempFile, zippedFile); err != nil {
+		// limit the zip reader on each file read to prevent decompression bomb attacks
+		numBytes, err := io.Copy(tempFile, io.LimitReader(zippedFile, perFileReadLimit))
+		if numBytes >= perFileReadLimit || errors.Is(err, io.EOF) {
+			return fmt.Errorf("zip read limit hit (potential decompression bomb attack)")
+		}
+		if err != nil {
 			return fmt.Errorf("unable to copy source=%q for zip=%q: %w", file.Name, archivePath, err)
 		}
 
+		// the file pointer is at the end due to the copy operation, reset back to the beginning
+		_, err = tempFile.Seek(0, io.SeekStart)
+		if err != nil {
+			return fmt.Errorf("unable to reset file pointer (%s): %w", tempFile.Name(), err)
+		}
+
 		results[file.Name] = Opener{path: tempFile.Name()}
 
 		return nil
@@ -138,7 +153,13 @@ func ContentsFromZip(archivePath string, paths ...string) (map[string]string, er
 		}
 
 		var buffer bytes.Buffer
-		if err := safeCopy(&buffer, zippedFile); err != nil {
+
+		// limit the zip reader on each file read to prevent decompression bomb attacks
+		numBytes, err := io.Copy(&buffer, io.LimitReader(zippedFile, perFileReadLimit))
+		if numBytes >= perFileReadLimit || errors.Is(err, io.EOF) {
+			return fmt.Errorf("zip read limit hit (potential decompression bomb attack)")
+		}
+		if err != nil {
 			return fmt.Errorf("unable to copy source=%q for zip=%q: %w", file.Name, archivePath, err)
 		}
 
@@ -207,7 +228,12 @@ func extractSingleFile(file *zip.File, expandedFilePath, archivePath string) err
 			return fmt.Errorf("unable to create dest file=%q from zip=%q: %w", expandedFilePath, archivePath, err)
 		}
 
-		if err := safeCopy(outputFile, zippedFile); err != nil {
+		// limit the zip reader on each file read to prevent decompression bomb attacks
+		numBytes, err := io.Copy(outputFile, io.LimitReader(zippedFile, perFileReadLimit))
+		if numBytes >= perFileReadLimit || errors.Is(err, io.EOF) {
+			return fmt.Errorf("zip read limit hit (potential decompression bomb attack)")
+		}
+		if err != nil {
 			return fmt.Errorf("unable to copy source=%q to dest=%q for zip=%q: %w", file.Name, outputFile.Name(), archivePath, err)
 		}
 

internal/file/zip_file_traversal_test.go

@@ -1,6 +1,3 @@
-//go:build !windows
-// +build !windows
-
 package file
 
 import (

internal/file/zip_read_closer_test.go

@@ -1,6 +1,3 @@
-//go:build !windows
-// +build !windows
-
 package file
 
 import (

internal/formats/common/cyclonedxhelpers/format.go

@@ -1,93 +0,0 @@
-package cyclonedxhelpers
-
-import (
-	"time"
-
-	"github.com/CycloneDX/cyclonedx-go"
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/version"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/anchore/syft/syft/source"
-	"github.com/google/uuid"
-)
-
-func ToFormatModel(s sbom.SBOM) *cyclonedx.BOM {
-	cdxBOM := cyclonedx.NewBOM()
-	versionInfo := version.FromBuild()
-
-	// NOTE(jonasagx): cycloneDX requires URN uuids (URN returns the RFC 2141 URN form of uuid):
-	// https://github.com/CycloneDX/specification/blob/master/schema/bom-1.3-strict.schema.json#L36
-	// "pattern": "^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
-	cdxBOM.SerialNumber = uuid.New().URN()
-	cdxBOM.Metadata = toBomDescriptor(internal.ApplicationName, versionInfo.Version, s.Source)
-
-	packages := s.Artifacts.PackageCatalog.Sorted()
-	components := make([]cyclonedx.Component, len(packages))
-	for i, p := range packages {
-		components[i] = toComponent(p)
-	}
-	cdxBOM.Components = &components
-
-	return cdxBOM
-}
-
-// NewBomDescriptor returns a new BomDescriptor tailored for the current time and "syft" tool details.
-func toBomDescriptor(name, version string, srcMetadata source.Metadata) *cyclonedx.Metadata {
-	return &cyclonedx.Metadata{
-		Timestamp: time.Now().Format(time.RFC3339),
-		Tools: &[]cyclonedx.Tool{
-			{
-				Vendor:  "anchore",
-				Name:    name,
-				Version: version,
-			},
-		},
-		Component: toBomDescriptorComponent(srcMetadata),
-	}
-}
-
-func toComponent(p pkg.Package) cyclonedx.Component {
-	return cyclonedx.Component{
-		Type:       cyclonedx.ComponentTypeLibrary,
-		Name:       p.Name,
-		Version:    p.Version,
-		PackageURL: p.PURL,
-		Licenses:   toLicenses(p.Licenses),
-	}
-}
-
-func toBomDescriptorComponent(srcMetadata source.Metadata) *cyclonedx.Component {
-	switch srcMetadata.Scheme {
-	case source.ImageScheme:
-		return &cyclonedx.Component{
-			Type:    cyclonedx.ComponentTypeContainer,
-			Name:    srcMetadata.ImageMetadata.UserInput,
-			Version: srcMetadata.ImageMetadata.ManifestDigest,
-		}
-	case source.DirectoryScheme, source.FileScheme:
-		return &cyclonedx.Component{
-			Type: cyclonedx.ComponentTypeFile,
-			Name: srcMetadata.Path,
-		}
-	}
-
-	return nil
-}
-
-func toLicenses(ls []string) *cyclonedx.Licenses {
-	if len(ls) == 0 {
-		return nil
-	}
-
-	lc := make(cyclonedx.Licenses, len(ls))
-	for i, licenseName := range ls {
-		lc[i] = cyclonedx.LicenseChoice{
-			License: &cyclonedx.License{
-				Name: licenseName,
-			},
-		}
-	}
-
-	return &lc
-}

internal/formats/common/spdxhelpers/document_name.go

@@ -1,31 +0,0 @@
-package spdxhelpers
-
-import (
-	"fmt"
-	"path"
-	"strings"
-
-	"github.com/anchore/syft/syft/source"
-)
-
-func DocumentName(srcMetadata source.Metadata) (string, error) {
-	switch srcMetadata.Scheme {
-	case source.ImageScheme:
-		return cleanName(srcMetadata.ImageMetadata.UserInput), nil
-	case source.DirectoryScheme, source.FileScheme:
-		return cleanName(srcMetadata.Path), nil
-	}
-
-	return "", fmt.Errorf("unable to determine document name from scheme=%q", srcMetadata.Scheme)
-}
-
-func cleanName(name string) string {
-	// remove # according to specification
-	name = strings.ReplaceAll(name, "#", "-")
-
-	// remove : for url construction
-	name = strings.ReplaceAll(name, ":", "-")
-
-	// clean relative pathing
-	return path.Clean(name)
-}

internal/formats/common/spdxhelpers/document_name_test.go

@@ -1,73 +0,0 @@
-package spdxhelpers
-
-import (
-	"fmt"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/anchore/syft/syft/source"
-	"github.com/scylladb/go-set/strset"
-	"github.com/stretchr/testify/assert"
-)
-
-func Test_DocumentName(t *testing.T) {
-	allSchemes := strset.New()
-	for _, s := range source.AllSchemes {
-		allSchemes.Add(string(s))
-	}
-	testedSchemes := strset.New()
-
-	tests := []struct {
-		name        string
-		inputName   string
-		srcMetadata source.Metadata
-		expected    string
-	}{
-		{
-			name:      "image",
-			inputName: "my-name",
-			srcMetadata: source.Metadata{
-				Scheme: source.ImageScheme,
-				ImageMetadata: source.ImageMetadata{
-					UserInput:      "image-repo/name:tag",
-					ID:             "id",
-					ManifestDigest: "digest",
-				},
-			},
-			expected: "image-repo/name-tag",
-		},
-		{
-			name:      "directory",
-			inputName: "my-name",
-			srcMetadata: source.Metadata{
-				Scheme: source.DirectoryScheme,
-				Path:   "some/path/to/place",
-			},
-			expected: "some/path/to/place",
-		},
-		{
-			name:      "file",
-			inputName: "my-name",
-			srcMetadata: source.Metadata{
-				Scheme: source.FileScheme,
-				Path:   "some/path/to/place",
-			},
-			expected: "some/path/to/place",
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			actual, err := DocumentName(test.srcMetadata)
-			require.NoError(t, err)
-			assert.True(t, strings.HasPrefix(actual, test.expected), fmt.Sprintf("actual name %q", actual))
-
-			// track each scheme tested (passed or not)
-			testedSchemes.Add(string(test.srcMetadata.Scheme))
-		})
-	}
-
-	// assert all possible schemes were under test
-	assert.ElementsMatch(t, allSchemes.List(), testedSchemes.List(), "not all source.Schemes are under test")
-}

internal/formats/common/spdxhelpers/document_namespace.go

@@ -1,45 +0,0 @@
-package spdxhelpers
-
-import (
-	"fmt"
-	"net/url"
-	"path"
-
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/syft/source"
-	"github.com/google/uuid"
-)
-
-func DocumentNameAndNamespace(srcMetadata source.Metadata) (string, string, error) {
-	name, err := DocumentName(srcMetadata)
-	if err != nil {
-		return "", "", err
-	}
-	return name, DocumentNamespace(name, srcMetadata), nil
-}
-
-func DocumentNamespace(name string, srcMetadata source.Metadata) string {
-	input := "unknown-source-type"
-	switch srcMetadata.Scheme {
-	case source.ImageScheme:
-		input = "image"
-	case source.DirectoryScheme:
-		input = "dir"
-	case source.FileScheme:
-		input = "file"
-	}
-
-	uniqueID := uuid.Must(uuid.NewRandom())
-	identifier := path.Join(input, uniqueID.String())
-	if name != "." {
-		identifier = path.Join(input, fmt.Sprintf("%s-%s", name, uniqueID.String()))
-	}
-
-	u := url.URL{
-		Scheme: "https",
-		Host:   "anchore.com",
-		Path:   path.Join(internal.ApplicationName, identifier),
-	}
-
-	return u.String()
-}

internal/formats/common/spdxhelpers/document_namespace_test.go

@@ -1,71 +0,0 @@
-package spdxhelpers
-
-import (
-	"fmt"
-	"strings"
-	"testing"
-
-	"github.com/anchore/syft/syft/source"
-	"github.com/scylladb/go-set/strset"
-	"github.com/stretchr/testify/assert"
-)
-
-func Test_documentNamespace(t *testing.T) {
-	allSchemes := strset.New()
-	for _, s := range source.AllSchemes {
-		allSchemes.Add(string(s))
-	}
-	testedSchemes := strset.New()
-
-	tests := []struct {
-		name        string
-		inputName   string
-		srcMetadata source.Metadata
-		expected    string
-	}{
-		{
-			name:      "image",
-			inputName: "my-name",
-			srcMetadata: source.Metadata{
-				Scheme: source.ImageScheme,
-				ImageMetadata: source.ImageMetadata{
-					UserInput:      "image-repo/name:tag",
-					ID:             "id",
-					ManifestDigest: "digest",
-				},
-			},
-			expected: "https://anchore.com/syft/image/my-name-",
-		},
-		{
-			name:      "directory",
-			inputName: "my-name",
-			srcMetadata: source.Metadata{
-				Scheme: source.DirectoryScheme,
-				Path:   "some/path/to/place",
-			},
-			expected: "https://anchore.com/syft/dir/my-name-",
-		},
-		{
-			name:      "file",
-			inputName: "my-name",
-			srcMetadata: source.Metadata{
-				Scheme: source.FileScheme,
-				Path:   "some/path/to/place",
-			},
-			expected: "https://anchore.com/syft/file/my-name-",
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			actual := DocumentNamespace(test.inputName, test.srcMetadata)
-			// note: since the namespace ends with a UUID we check the prefix
-			assert.True(t, strings.HasPrefix(actual, test.expected), fmt.Sprintf("actual namespace %q", actual))
-
-			// track each scheme tested (passed or not)
-			testedSchemes.Add(string(test.srcMetadata.Scheme))
-		})
-	}
-
-	// assert all possible schemes were under test
-	assert.ElementsMatch(t, allSchemes.List(), testedSchemes.List(), "not all source.Schemes are under test")
-}

internal/formats/common/spdxhelpers/external_refs.go

@@ -12,7 +12,7 @@ func ExternalRefs(p pkg.Package) (externalRefs []model.ExternalRef) {
 	for _, c := range p.CPEs {
 		externalRefs = append(externalRefs, model.ExternalRef{
 			ReferenceCategory: model.SecurityReferenceCategory,
-			ReferenceLocator:  pkg.CPEString(c),
+			ReferenceLocator:  c.BindToFmtString(),
 			ReferenceType:     model.Cpe23ExternalRefType,
 		})
 	}

internal/formats/common/spdxhelpers/external_refs_test.go

@@ -26,7 +26,7 @@ func Test_ExternalRefs(t *testing.T) {
 			expected: []model.ExternalRef{
 				{
 					ReferenceCategory: model.SecurityReferenceCategory,
-					ReferenceLocator:  pkg.CPEString(testCPE),
+					ReferenceLocator:  testCPE.BindToFmtString(),
 					ReferenceType:     model.Cpe23ExternalRefType,
 				},
 				{

internal/formats/common/testutils/utils.go

@@ -2,15 +2,14 @@ package testutils
 
 import (
 	"bytes"
-	"strings"
 	"testing"
 
+	"github.com/anchore/go-presenter"
 	"github.com/anchore/go-testutils"
 	"github.com/anchore/stereoscope/pkg/filetree"
 	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/stereoscope/pkg/imagetest"
 	"github.com/anchore/syft/syft/distro"
-	"github.com/anchore/syft/syft/format"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
@@ -32,7 +31,7 @@ func FromSnapshot() ImageOption {
 	}
 }
 
-func AssertEncoderAgainstGoldenImageSnapshot(t *testing.T, format format.Format, sbom sbom.SBOM, testImage string, updateSnapshot bool, redactors ...redactor) {
+func AssertPresenterAgainstGoldenImageSnapshot(t *testing.T, pres presenter.Presenter, testImage string, updateSnapshot bool, redactors ...redactor) {
 	var buffer bytes.Buffer
 
 	// grab the latest image contents and persist
@@ -40,11 +39,11 @@ func AssertEncoderAgainstGoldenImageSnapshot(t *testing.T, format format.Format,
 		imagetest.UpdateGoldenFixtureImage(t, testImage)
 	}
 
-	err := format.Encode(&buffer, sbom)
+	err := pres.Present(&buffer)
 	assert.NoError(t, err)
 	actual := buffer.Bytes()
 
-	// replace the expected snapshot contents with the current encoder contents
+	// replace the expected snapshot contents with the current presenter contents
 	if updateSnapshot {
 		testutils.UpdateGoldenFileContents(t, actual)
 	}
@@ -52,7 +51,6 @@ func AssertEncoderAgainstGoldenImageSnapshot(t *testing.T, format format.Format,
 	var expected = testutils.GetGoldenFileContents(t)
 
 	// remove dynamic values, which should be tested independently
-	redactors = append(redactors, carriageRedactor)
 	for _, r := range redactors {
 		actual = r(actual)
 		expected = r(expected)
@@ -66,14 +64,14 @@ func AssertEncoderAgainstGoldenImageSnapshot(t *testing.T, format format.Format,
 	}
 }
 
-func AssertEncoderAgainstGoldenSnapshot(t *testing.T, format format.Format, sbom sbom.SBOM, updateSnapshot bool, redactors ...redactor) {
+func AssertPresenterAgainstGoldenSnapshot(t *testing.T, pres presenter.Presenter, updateSnapshot bool, redactors ...redactor) {
 	var buffer bytes.Buffer
 
-	err := format.Encode(&buffer, sbom)
+	err := pres.Present(&buffer)
 	assert.NoError(t, err)
 	actual := buffer.Bytes()
 
-	// replace the expected snapshot contents with the current encoder contents
+	// replace the expected snapshot contents with the current presenter contents
 	if updateSnapshot {
 		testutils.UpdateGoldenFileContents(t, actual)
 	}
@@ -81,7 +79,6 @@ func AssertEncoderAgainstGoldenSnapshot(t *testing.T, format format.Format, sbom
 	var expected = testutils.GetGoldenFileContents(t)
 
 	// remove dynamic values, which should be tested independently
-	redactors = append(redactors, carriageRedactor)
 	for _, r := range redactors {
 		actual = r(actual)
 		expected = r(expected)
@@ -90,8 +87,6 @@ func AssertEncoderAgainstGoldenSnapshot(t *testing.T, format format.Format, sbom
 	if !bytes.Equal(expected, actual) {
 		dmp := diffmatchpatch.New()
 		diffs := dmp.DiffMain(string(expected), string(actual), true)
-		t.Logf("len: %d\nexpected: %s", len(expected), expected)
-		t.Logf("len: %d\nactual: %s", len(actual), actual)
 		t.Errorf("mismatched output:\n%s", dmp.DiffPrettyText(diffs))
 	}
 }
@@ -141,11 +136,6 @@ func ImageInput(t testing.TB, testImage string, options ...ImageOption) sbom.SBO
 	}
 }
 
-func carriageRedactor(s []byte) []byte {
-	msg := strings.ReplaceAll(string(s), "\r\n", "\n")
-	return []byte(msg)
-}
-
 func populateImageCatalog(catalog *pkg.Catalog, img *image.Image) {
 	_, ref1, _ := img.SquashedTree().File("/somefile-1.txt", filetree.FollowBasenameLinks)
 	_, ref2, _ := img.SquashedTree().File("/somefile-2.txt", filetree.FollowBasenameLinks)

internal/formats/cyclonedx12xml/encoder.go

@@ -0,0 +1,26 @@
+package cyclonedx12xml
+
+import (
+	"encoding/xml"
+	"io"
+
+	"github.com/anchore/syft/syft/sbom"
+)
+
+func encoder(output io.Writer, s sbom.SBOM) error {
+	enc := xml.NewEncoder(output)
+	enc.Indent("", "  ")
+
+	_, err := output.Write([]byte(xml.Header))
+	if err != nil {
+		return err
+	}
+
+	err = enc.Encode(toFormatModel(s))
+	if err != nil {
+		return err
+	}
+
+	_, err = output.Write([]byte("\n"))
+	return err
+}

internal/formats/cyclonedx12xml/encoder_test.go

@@ -1,4 +1,4 @@
-package cyclonedx13xml
+package cyclonedx12xml
 
 import (
 	"flag"
@@ -8,22 +8,20 @@ import (
 	"github.com/anchore/syft/internal/formats/common/testutils"
 )
 
-var updateCycloneDx = flag.Bool("update-cyclonedx", false, "update the *.golden files for cyclone-dx encoders")
+var updateCycloneDx = flag.Bool("update-cyclonedx", false, "update the *.golden files for cyclone-dx presenters")
 
-func TestCycloneDxDirectoryEncoder(t *testing.T) {
-	testutils.AssertEncoderAgainstGoldenSnapshot(t,
-		Format(),
-		testutils.DirectoryInput(t),
+func TestCycloneDxDirectoryPresenter(t *testing.T) {
+	testutils.AssertPresenterAgainstGoldenSnapshot(t,
+		Format().Presenter(testutils.DirectoryInput(t)),
 		*updateCycloneDx,
 		cycloneDxRedactor,
 	)
 }
 
-func TestCycloneDxImageEncoder(t *testing.T) {
+func TestCycloneDxImagePresenter(t *testing.T) {
 	testImage := "image-simple"
-	testutils.AssertEncoderAgainstGoldenImageSnapshot(t,
-		Format(),
-		testutils.ImageInput(t, testImage),
+	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
+		Format().Presenter(testutils.ImageInput(t, testImage)),
 		testImage,
 		*updateCycloneDx,
 		cycloneDxRedactor,

internal/formats/cyclonedx12xml/format.go

@@ -1,10 +1,10 @@
-package cyclonedx13xml
+package cyclonedx12xml
 
 import "github.com/anchore/syft/syft/format"
 
 func Format() format.Format {
 	return format.NewFormat(
-		format.CycloneDxXMLOption,
+		format.CycloneDxOption,
 		encoder,
 		nil,
 		nil,

internal/formats/cyclonedx12xml/model/bom_descriptor.go

@@ -0,0 +1,31 @@
+package model
+
+import (
+	"encoding/xml"
+)
+
+// Source: https://cyclonedx.org/ext/bom-descriptor/
+
+// BomDescriptor represents all metadata surrounding the BOM report (such as when the BOM was made, with which tool, and the item being cataloged).
+type BomDescriptor struct {
+	XMLName   xml.Name                `xml:"metadata"`
+	Timestamp string                  `xml:"timestamp,omitempty"` // The date and time (timestamp) when the document was created
+	Tools     []BomDescriptorTool     `xml:"tools>tool"`          // The tool used to create the BOM.
+	Component *BomDescriptorComponent `xml:"component"`           // The component that the BOM describes.
+}
+
+// BomDescriptorTool represents the tool that created the BOM report.
+type BomDescriptorTool struct {
+	XMLName xml.Name `xml:"tool"`
+	Vendor  string   `xml:"vendor,omitempty"`  // The vendor of the tool used to create the BOM.
+	Name    string   `xml:"name,omitempty"`    // The name of the tool used to create the BOM.
+	Version string   `xml:"version,omitempty"` // The version of the tool used to create the BOM.
+	// TODO: hashes, author, manufacture, supplier
+	// TODO: add user-defined fields for the remaining build/version parameters
+}
+
+// BomDescriptorComponent represents the software/package being cataloged.
+type BomDescriptorComponent struct {
+	XMLName xml.Name `xml:"component"`
+	Component
+}

internal/formats/cyclonedx12xml/model/component.go

@@ -0,0 +1,20 @@
+package model
+
+import "encoding/xml"
+
+// Component represents a single element in the CycloneDX BOM
+type Component struct {
+	XMLName     xml.Name   `xml:"component"`
+	Type        string     `xml:"type,attr"`             // Required; Describes if the component is a library, framework, application, container, operating system, firmware, hardware device, or file
+	Supplier    string     `xml:"supplier,omitempty"`    // The organization that supplied the component. The supplier may often be the manufacture, but may also be a distributor or repackager.
+	Author      string     `xml:"author,omitempty"`      // The person(s) or organization(s) that authored the component
+	Publisher   string     `xml:"publisher,omitempty"`   // The person(s) or organization(s) that published the component
+	Group       string     `xml:"group,omitempty"`       // The high-level classification that a project self-describes as. This will often be a shortened, single name of the company or project that produced the component, or the source package or domain name.
+	Name        string     `xml:"name"`                  // Required; The name of the component as defined by the project
+	Version     string     `xml:"version"`               // Required; The version of the component as defined by the project
+	Description string     `xml:"description,omitempty"` // A description of the component
+	Licenses    *[]License `xml:"licenses>license"`      // A node describing zero or more license names, SPDX license IDs or expressions
+	PackageURL  string     `xml:"purl,omitempty"`        // Specifies the package-url (PackageURL). The purl, if specified, must be valid and conform to the specification defined at: https://github.com/package-url/purl-spec
+	// TODO: source, hashes, copyright, cpe, purl, swid, modified, pedigree, externalReferences
+	// TODO: add user-defined parameters for syft-specific values (image layer index, cataloger, location path, etc.)
+}

internal/formats/cyclonedx12xml/model/document.go

@@ -0,0 +1,17 @@
+package model
+
+import (
+	"encoding/xml"
+)
+
+// Source: https://github.com/CycloneDX/specification
+
+// Document represents a CycloneDX BOM Document.
+type Document struct {
+	XMLName       xml.Name       `xml:"bom"`
+	XMLNs         string         `xml:"xmlns,attr"`
+	Version       int            `xml:"version,attr"`
+	SerialNumber  string         `xml:"serialNumber,attr"`
+	BomDescriptor *BomDescriptor `xml:"metadata"`             // The BOM descriptor extension
+	Components    []Component    `xml:"components>component"` // The BOM contents
+}

internal/formats/cyclonedx12xml/model/license.go

@@ -0,0 +1,10 @@
+package model
+
+import "encoding/xml"
+
+// License represents a single software license for a Component
+type License struct {
+	XMLName xml.Name `xml:"license"`
+	ID      string   `xml:"id,omitempty"`   // A valid SPDX license ID
+	Name    string   `xml:"name,omitempty"` // If SPDX does not define the license used, this field may be used to provide the license name
+}

internal/formats/cyclonedx12xml/test-fixtures/snapshot/TestCycloneDxDirectoryPresenter.golden

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.3" serialNumber="urn:uuid:7b1c3b1d-ea3b-4022-9dcc-80f4b4cbce36" version="1">
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1" serialNumber="urn:uuid:5404937f-72d6-44a2-8e9b-954305ecb4f6">
   <metadata>
-    <timestamp>2021-12-03T13:16:45-08:00</timestamp>
+    <timestamp>2021-06-23T13:40:33-04:00</timestamp>
     <tools>
       <tool>
         <vendor>anchore</vendor>
@@ -31,4 +31,4 @@
       <purl>a-purl-2</purl>
     </component>
   </components>
-</bom>
+</bom>

internal/formats/cyclonedx12xml/test-fixtures/snapshot/TestCycloneDxImagePresenter.golden

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.3" serialNumber="urn:uuid:66bda3e1-888a-4d43-b906-7fd96d428753" version="1">
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1" serialNumber="urn:uuid:e34bad2e-cd27-483c-86dc-f4e26d6103b0">
   <metadata>
-    <timestamp>2021-12-03T13:16:45-08:00</timestamp>
+    <timestamp>2021-06-23T13:40:33-04:00</timestamp>
     <tools>
       <tool>
         <vendor>anchore</vendor>
@@ -31,4 +31,4 @@
       <purl>a-purl-2</purl>
     </component>
   </components>
-</bom>
+</bom>

internal/formats/cyclonedx12xml/to_format_model.go

@@ -0,0 +1,95 @@
+package cyclonedx12xml
+
+import (
+	"encoding/xml"
+	"time"
+
+	"github.com/anchore/syft/syft/sbom"
+
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/formats/cyclonedx12xml/model"
+	"github.com/anchore/syft/internal/version"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+	"github.com/google/uuid"
+)
+
+// toFormatModel creates and populates a new in-memory representation of a CycloneDX 1.2 document
+func toFormatModel(s sbom.SBOM) model.Document {
+	versionInfo := version.FromBuild()
+
+	doc := model.Document{
+		XMLNs:         "http://cyclonedx.org/schema/bom/1.2",
+		Version:       1,
+		SerialNumber:  uuid.New().URN(),
+		BomDescriptor: toBomDescriptor(internal.ApplicationName, versionInfo.Version, s.Source),
+	}
+
+	// attach components
+	for _, p := range s.Artifacts.PackageCatalog.Sorted() {
+		doc.Components = append(doc.Components, toComponent(p))
+	}
+
+	return doc
+}
+
+func toComponent(p pkg.Package) model.Component {
+	return model.Component{
+		Type:       "library", // TODO: this is not accurate
+		Name:       p.Name,
+		Version:    p.Version,
+		PackageURL: p.PURL,
+		Licenses:   toLicenses(p.Licenses),
+	}
+}
+
+// NewBomDescriptor returns a new BomDescriptor tailored for the current time and "syft" tool details.
+func toBomDescriptor(name, version string, srcMetadata source.Metadata) *model.BomDescriptor {
+	return &model.BomDescriptor{
+		XMLName:   xml.Name{},
+		Timestamp: time.Now().Format(time.RFC3339),
+		Tools: []model.BomDescriptorTool{
+			{
+				Vendor:  "anchore",
+				Name:    name,
+				Version: version,
+			},
+		},
+		Component: toBomDescriptorComponent(srcMetadata),
+	}
+}
+
+func toBomDescriptorComponent(srcMetadata source.Metadata) *model.BomDescriptorComponent {
+	switch srcMetadata.Scheme {
+	case source.ImageScheme:
+		return &model.BomDescriptorComponent{
+			Component: model.Component{
+				Type:    "container",
+				Name:    srcMetadata.ImageMetadata.UserInput,
+				Version: srcMetadata.ImageMetadata.ManifestDigest,
+			},
+		}
+	case source.DirectoryScheme:
+		return &model.BomDescriptorComponent{
+			Component: model.Component{
+				Type: "file",
+				Name: srcMetadata.Path,
+			},
+		}
+	}
+	return nil
+}
+
+func toLicenses(licenses []string) *[]model.License {
+	if len(licenses) == 0 {
+		return nil
+	}
+
+	var result []model.License
+	for _, licenseName := range licenses {
+		result = append(result, model.License{
+			Name: licenseName,
+		})
+	}
+	return &result
+}

internal/formats/cyclonedx13json/encoder.go

@@ -1,18 +0,0 @@
-package cyclonedx13json
-
-import (
-	"io"
-
-	"github.com/CycloneDX/cyclonedx-go"
-	"github.com/anchore/syft/internal/formats/common/cyclonedxhelpers"
-	"github.com/anchore/syft/syft/sbom"
-)
-
-func encoder(output io.Writer, s sbom.SBOM) error {
-	bom := cyclonedxhelpers.ToFormatModel(s)
-	enc := cyclonedx.NewBOMEncoder(output, cyclonedx.BOMFileFormatJSON)
-	enc.SetPretty(true)
-
-	err := enc.Encode(bom)
-	return err
-}

internal/formats/cyclonedx13json/encoder_test.go

@@ -1,41 +0,0 @@
-package cyclonedx13json
-
-import (
-	"flag"
-	"regexp"
-	"testing"
-
-	"github.com/anchore/syft/internal/formats/common/testutils"
-)
-
-var updateCycloneDx = flag.Bool("update-cyclonedx", false, "update the *.golden files for cyclone-dx encoders")
-
-func TestCycloneDxDirectoryEncoder(t *testing.T) {
-	testutils.AssertEncoderAgainstGoldenSnapshot(t,
-		Format(),
-		testutils.DirectoryInput(t),
-		*updateCycloneDx,
-		cycloneDxRedactor,
-	)
-}
-
-func TestCycloneDxImageEncoder(t *testing.T) {
-	testImage := "image-simple"
-	testutils.AssertEncoderAgainstGoldenImageSnapshot(t,
-		Format(),
-		testutils.ImageInput(t, testImage),
-		testImage,
-		*updateCycloneDx,
-		cycloneDxRedactor,
-	)
-}
-
-func cycloneDxRedactor(s []byte) []byte {
-	serialPattern := regexp.MustCompile(`urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}`)
-	rfc3339Pattern := regexp.MustCompile(`([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\.[0-9]+)?(([Zz])|([\+|\-]([01][0-9]|2[0-3]):[0-5][0-9]))`)
-
-	for _, pattern := range []*regexp.Regexp{serialPattern, rfc3339Pattern} {
-		s = pattern.ReplaceAll(s, []byte("redacted"))
-	}
-	return s
-}

internal/formats/cyclonedx13json/format.go

@@ -1,12 +0,0 @@
-package cyclonedx13json
-
-import "github.com/anchore/syft/syft/format"
-
-func Format() format.Format {
-	return format.NewFormat(
-		format.CycloneDxJSONOption,
-		encoder,
-		nil,
-		nil,
-	)
-}

internal/formats/cyclonedx13json/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden

@@ -1,42 +0,0 @@
-{
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.3",
-  "serialNumber": "urn:uuid:a81dc685-cf22-48e0-bda5-65ea1a8bca5b",
-  "version": 1,
-  "metadata": {
-    "timestamp": "2021-12-03T13:17:26-08:00",
-    "tools": [
-      {
-        "vendor": "anchore",
-        "name": "syft",
-        "version": "[not provided]"
-      }
-    ],
-    "component": {
-      "type": "file",
-      "name": "/some/path",
-      "version": ""
-    }
-  },
-  "components": [
-    {
-      "type": "library",
-      "name": "package-1",
-      "version": "1.0.1",
-      "licenses": [
-        {
-          "license": {
-            "name": "MIT"
-          }
-        }
-      ],
-      "purl": "a-purl-2"
-    },
-    {
-      "type": "library",
-      "name": "package-2",
-      "version": "2.0.1",
-      "purl": "a-purl-2"
-    }
-  ]
-}

internal/formats/cyclonedx13json/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden

@@ -1,42 +0,0 @@
-{
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.3",
-  "serialNumber": "urn:uuid:2156ac1f-c838-4e93-8dc5-a3874ffeb967",
-  "version": 1,
-  "metadata": {
-    "timestamp": "2021-12-03T13:17:26-08:00",
-    "tools": [
-      {
-        "vendor": "anchore",
-        "name": "syft",
-        "version": "[not provided]"
-      }
-    ],
-    "component": {
-      "type": "container",
-      "name": "user-image-input",
-      "version": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368"
-    }
-  },
-  "components": [
-    {
-      "type": "library",
-      "name": "package-1",
-      "version": "1.0.1",
-      "licenses": [
-        {
-          "license": {
-            "name": "MIT"
-          }
-        }
-      ],
-      "purl": "a-purl-1"
-    },
-    {
-      "type": "library",
-      "name": "package-2",
-      "version": "2.0.1",
-      "purl": "a-purl-2"
-    }
-  ]
-}

internal/formats/cyclonedx13xml/encoder.go

@@ -1,18 +0,0 @@
-package cyclonedx13xml
-
-import (
-	"io"
-
-	"github.com/CycloneDX/cyclonedx-go"
-	"github.com/anchore/syft/internal/formats/common/cyclonedxhelpers"
-	"github.com/anchore/syft/syft/sbom"
-)
-
-func encoder(output io.Writer, s sbom.SBOM) error {
-	bom := cyclonedxhelpers.ToFormatModel(s)
-	enc := cyclonedx.NewBOMEncoder(output, cyclonedx.BOMFileFormatXML)
-	enc.SetPretty(true)
-
-	err := enc.Encode(bom)
-	return err
-}

internal/formats/cyclonedx13xml/test-fixtures/image-simple/Dockerfile

@@ -1,4 +0,0 @@
-# Note: changes to this file will result in updating several test values. Consider making a new image fixture instead of editing this one.
-FROM scratch
-ADD file-1.txt /somefile-1.txt
-ADD file-2.txt /somefile-2.txt

internal/formats/cyclonedx13xml/test-fixtures/image-simple/file-1.txt

@@ -1 +0,0 @@
-this file has contents

internal/formats/cyclonedx13xml/test-fixtures/image-simple/file-2.txt

@@ -1 +0,0 @@
-file-2 contents!

internal/formats/formats.go

@@ -3,8 +3,7 @@ package formats
 import (
 	"bytes"
 
-	"github.com/anchore/syft/internal/formats/cyclonedx13json"
-	"github.com/anchore/syft/internal/formats/cyclonedx13xml"
+	"github.com/anchore/syft/internal/formats/cyclonedx12xml"
 	"github.com/anchore/syft/internal/formats/spdx22json"
 	"github.com/anchore/syft/internal/formats/spdx22tagvalue"
 	"github.com/anchore/syft/internal/formats/syftjson"
@@ -18,8 +17,7 @@ func All() []format.Format {
 	return []format.Format{
 		syftjson.Format(),
 		table.Format(),
-		cyclonedx13xml.Format(),
-		cyclonedx13json.Format(),
+		cyclonedx12xml.Format(),
 		spdx22json.Format(),
 		spdx22tagvalue.Format(),
 		text.Format(),

internal/formats/spdx22json/encoder.go

@@ -7,16 +7,15 @@ import (
 	"github.com/anchore/syft/syft/sbom"
 )
 
+const anchoreNamespace = "https://anchore.com/syft"
+
 func encoder(output io.Writer, s sbom.SBOM) error {
-	doc, err := toFormatModel(s)
-	if err != nil {
-		return err
-	}
+	doc := toFormatModel(s)
 
 	enc := json.NewEncoder(output)
 	// prevent > and < from being escaped in the payload
 	enc.SetEscapeHTML(false)
 	enc.SetIndent("", " ")
 
-	return enc.Encode(doc)
+	return enc.Encode(&doc)
 }

internal/formats/spdx22json/encoder_test.go

@@ -8,22 +8,20 @@ import (
 	"github.com/anchore/syft/internal/formats/common/testutils"
 )
 
-var updateSpdxJson = flag.Bool("update-spdx-json", false, "update the *.golden files for spdx-json encoders")
+var updateSpdxJson = flag.Bool("update-spdx-json", false, "update the *.golden files for spdx-json presenters")
 
-func TestSPDXJSONDirectoryEncoder(t *testing.T) {
-	testutils.AssertEncoderAgainstGoldenSnapshot(t,
-		Format(),
-		testutils.DirectoryInput(t),
+func TestSPDXJSONDirectoryPresenter(t *testing.T) {
+	testutils.AssertPresenterAgainstGoldenSnapshot(t,
+		Format().Presenter(testutils.DirectoryInput(t)),
 		*updateSpdxJson,
 		spdxJsonRedactor,
 	)
 }
 
-func TestSPDXJSONImageEncoder(t *testing.T) {
+func TestSPDXJSONImagePresenter(t *testing.T) {
 	testImage := "image-simple"
-	testutils.AssertEncoderAgainstGoldenImageSnapshot(t,
-		Format(),
-		testutils.ImageInput(t, testImage, testutils.FromSnapshot()),
+	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
+		Format().Presenter(testutils.ImageInput(t, testImage, testutils.FromSnapshot())),
 		testImage,
 		*updateSpdxJson,
 		spdxJsonRedactor,

internal/formats/spdx22json/test-fixtures/snapshot/TestSPDXJSONDirectoryPresenter.golden

@@ -3,7 +3,7 @@
  "name": "/some/path",
  "spdxVersion": "SPDX-2.2",
  "creationInfo": {
-  "created": "2021-12-20T19:12:47.869816Z",
+  "created": "2021-11-17T19:35:54.834877Z",
   "creators": [
    "Organization: Anchore, Inc",
    "Tool: syft-[not provided]"
@@ -11,10 +11,10 @@
   "licenseListVersion": "3.15"
  },
  "dataLicense": "CC0-1.0",
- "documentNamespace": "https://anchore.com/syft/dir/some/path-4b896ded-7852-4e31-b764-136b53bdf346",
+ "documentNamespace": "https:/anchore.com/syft/dir/some/path-65e2226e-a61e-4ed1-81bb-56022e1ff1eb",
  "packages": [
   {
-   "SPDXID": "SPDXRef-1d97af55efe9512f",
+   "SPDXID": "SPDXRef-2a115ac97d018a0e",
    "name": "package-1",
    "licenseConcluded": "MIT",
    "downloadLocation": "NOASSERTION",
@@ -36,7 +36,7 @@
    "versionInfo": "1.0.1"
   },
   {
-   "SPDXID": "SPDXRef-ad3d1c4abd84bf75",
+   "SPDXID": "SPDXRef-5e920b2bece2c3ae",
    "name": "package-2",
    "licenseConcluded": "NONE",
    "downloadLocation": "NOASSERTION",

internal/formats/spdx22json/test-fixtures/snapshot/TestSPDXJSONImagePresenter.golden

@@ -3,7 +3,7 @@
  "name": "user-image-input",
  "spdxVersion": "SPDX-2.2",
  "creationInfo": {
-  "created": "2021-12-20T19:13:07.647486Z",
+  "created": "2021-11-17T19:35:57.761372Z",
   "creators": [
    "Organization: Anchore, Inc",
    "Tool: syft-[not provided]"
@@ -11,10 +11,10 @@
   "licenseListVersion": "3.15"
  },
  "dataLicense": "CC0-1.0",
- "documentNamespace": "https://anchore.com/syft/image/user-image-input-174da656-1824-4bd3-8604-28919f8a65bc",
+ "documentNamespace": "https:/anchore.com/syft/image/user-image-input-5383918f-ec96-4aa9-b756-ad16e1ada31e",
  "packages": [
   {
-   "SPDXID": "SPDXRef-d16127444133b5c1",
+   "SPDXID": "SPDXRef-888661d4f0362f02",
    "name": "package-1",
    "licenseConcluded": "MIT",
    "downloadLocation": "NOASSERTION",
@@ -36,7 +36,7 @@
    "versionInfo": "1.0.1"
   },
   {
-   "SPDXID": "SPDXRef-24907357f3705420",
+   "SPDXID": "SPDXRef-4068ff5e8926b305",
    "name": "package-2",
    "licenseConcluded": "NONE",
    "downloadLocation": "NOASSERTION",

internal/formats/spdx22json/to_format_model.go

@@ -2,6 +2,7 @@ package spdx22json
 
 import (
 	"fmt"
+	"path"
 	"path/filepath"
 	"sort"
 	"strings"
@@ -18,16 +19,14 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
+	"github.com/google/uuid"
 )
 
 // toFormatModel creates and populates a new JSON document struct that follows the SPDX 2.2 spec from the given cataloging results.
-func toFormatModel(s sbom.SBOM) (*model.Document, error) {
-	name, namespace, err := spdxhelpers.DocumentNameAndNamespace(s.Source)
-	if err != nil {
-		return nil, err
-	}
+func toFormatModel(s sbom.SBOM) model.Document {
+	name := documentName(s.Source)
 
-	return &model.Document{
+	return model.Document{
 		Element: model.Element{
 			SPDXID: model.ElementID("DOCUMENT").String(),
 			Name:   name,
@@ -43,11 +42,52 @@ func toFormatModel(s sbom.SBOM) (*model.Document, error) {
 			LicenseListVersion: spdxlicense.Version,
 		},
 		DataLicense:       "CC0-1.0",
-		DocumentNamespace: namespace,
+		DocumentNamespace: documentNamespace(name, s.Source),
 		Packages:          toPackages(s.Artifacts.PackageCatalog, s.Relationships),
 		Files:             toFiles(s),
 		Relationships:     toRelationships(s.Relationships),
-	}, nil
+	}
+}
+
+func documentName(srcMetadata source.Metadata) string {
+	switch srcMetadata.Scheme {
+	case source.ImageScheme:
+		return cleanSPDXName(srcMetadata.ImageMetadata.UserInput)
+	case source.DirectoryScheme:
+		return cleanSPDXName(srcMetadata.Path)
+	}
+
+	// TODO: is this alright?
+	return uuid.Must(uuid.NewRandom()).String()
+}
+
+func cleanSPDXName(name string) string {
+	// remove # according to specification
+	name = strings.ReplaceAll(name, "#", "-")
+
+	// remove : for url construction
+	name = strings.ReplaceAll(name, ":", "-")
+
+	// clean relative pathing
+	return path.Clean(name)
+}
+
+func documentNamespace(name string, srcMetadata source.Metadata) string {
+	input := "unknown-source-type"
+	switch srcMetadata.Scheme {
+	case source.ImageScheme:
+		input = "image"
+	case source.DirectoryScheme:
+		input = "dir"
+	}
+
+	uniqueID := uuid.Must(uuid.NewRandom())
+	identifier := path.Join(input, uniqueID.String())
+	if name != "." {
+		identifier = path.Join(input, fmt.Sprintf("%s-%s", name, uniqueID.String()))
+	}
+
+	return path.Join(anchoreNamespace, identifier)
 }
 
 func toPackages(catalog *pkg.Catalog, relationships []artifact.Relationship) []model.Package {

internal/formats/spdx22tagvalue/encoder.go

@@ -8,9 +8,6 @@ import (
 )
 
 func encoder(output io.Writer, s sbom.SBOM) error {
-	model, err := toFormatModel(s)
-	if err != nil {
-		return err
-	}
-	return tvsaver.Save2_2(model, output)
+	model := toFormatModel(s)
+	return tvsaver.Save2_2(&model, output)
 }

internal/formats/spdx22tagvalue/encoder_test.go

@@ -8,23 +8,21 @@ import (
 	"github.com/anchore/syft/internal/formats/common/testutils"
 )
 
-var updateSpdxTagValue = flag.Bool("update-spdx-tv", false, "update the *.golden files for spdx-tv encoders")
+var updateSpdxTagValue = flag.Bool("update-spdx-tv", false, "update the *.golden files for spdx-tv presenters")
 
-func TestSPDXTagValueDirectoryEncoder(t *testing.T) {
+func TestSPDXTagValueDirectoryPresenter(t *testing.T) {
 
-	testutils.AssertEncoderAgainstGoldenSnapshot(t,
-		Format(),
-		testutils.DirectoryInput(t),
+	testutils.AssertPresenterAgainstGoldenSnapshot(t,
+		Format().Presenter(testutils.DirectoryInput(t)),
 		*updateSpdxTagValue,
 		spdxTagValueRedactor,
 	)
 }
 
-func TestSPDXTagValueImageEncoder(t *testing.T) {
+func TestSPDXTagValueImagePresenter(t *testing.T) {
 	testImage := "image-simple"
-	testutils.AssertEncoderAgainstGoldenImageSnapshot(t,
-		Format(),
-		testutils.ImageInput(t, testImage, testutils.FromSnapshot()),
+	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
+		Format().Presenter(testutils.ImageInput(t, testImage, testutils.FromSnapshot())),
 		testImage,
 		*updateSpdxTagValue,
 		spdxTagValueRedactor,
@@ -34,10 +32,6 @@ func TestSPDXTagValueImageEncoder(t *testing.T) {
 func spdxTagValueRedactor(s []byte) []byte {
 	// each SBOM reports the time it was generated, which is not useful during snapshot testing
 	s = regexp.MustCompile(`Created: .*`).ReplaceAll(s, []byte("redacted"))
-
-	// each SBOM reports a unique documentNamespace when generated, this is not useful for snapshot testing
-	s = regexp.MustCompile(`DocumentNamespace: https://anchore.com/syft/.*`).ReplaceAll(s, []byte("redacted"))
-
 	// the license list will be updated periodically, the value here should not be directly tested in snapshot tests
 	return regexp.MustCompile(`LicenseListVersion: .*`).ReplaceAll(s, []byte("redacted"))
 }

internal/formats/spdx22tagvalue/test-fixtures/snapshot/TestSPDXTagValueDirectoryPresenter.golden

@@ -1,12 +1,11 @@
 SPDXVersion: SPDX-2.2
 DataLicense: CC0-1.0
 SPDXID: SPDXRef-DOCUMENT
-DocumentName: /some/path
-DocumentNamespace: https://anchore.com/syft/dir/some/path-22f5732a-cab0-4376-9b79-15e413049500
-LicenseListVersion: 3.15
+DocumentNamespace: https://anchore.com/syft/image/
+LicenseListVersion: 3.13
 Creator: Organization: Anchore, Inc
 Creator: Tool: syft-[not provided]
-Created: 2021-12-01T15:08:43Z
+Created: 2021-06-23T17:49:25Z
 
 ##### Package: package-2
 

internal/formats/spdx22tagvalue/test-fixtures/snapshot/TestSPDXTagValueImagePresenter.golden

@@ -2,11 +2,11 @@ SPDXVersion: SPDX-2.2
 DataLicense: CC0-1.0
 SPDXID: SPDXRef-DOCUMENT
 DocumentName: user-image-input
-DocumentNamespace: https://anchore.com/syft/image/user-image-input-ce4d4ae5-9d79-4f84-a410-361e394c2908
-LicenseListVersion: 3.15
+DocumentNamespace: https://anchore.com/syft/image/user-image-input
+LicenseListVersion: 3.13
 Creator: Organization: Anchore, Inc
 Creator: Tool: syft-[not provided]
-Created: 2021-12-01T15:08:44Z
+Created: 2021-06-23T17:49:25Z
 
 ##### Package: package-2
 

internal/formats/spdx22tagvalue/to_format_model.go

@@ -16,12 +16,8 @@ import (
 
 // toFormatModel creates and populates a new JSON document struct that follows the SPDX 2.2 spec from the given cataloging results.
 // nolint:funlen
-func toFormatModel(s sbom.SBOM) (*spdx.Document2_2, error) {
-	name, namespace, err := spdxhelpers.DocumentNameAndNamespace(s.Source)
-	if err != nil {
-		return nil, err
-	}
-	return &spdx.Document2_2{
+func toFormatModel(s sbom.SBOM) spdx.Document2_2 {
+	return spdx.Document2_2{
 		CreationInfo: &spdx.CreationInfo2_2{
 			// 2.1: SPDX Version; should be in the format "SPDX-2.2"
 			// Cardinality: mandatory, one
@@ -37,7 +33,7 @@ func toFormatModel(s sbom.SBOM) (*spdx.Document2_2, error) {
 
 			// 2.4: Document Name
 			// Cardinality: mandatory, one
-			DocumentName: name,
+			DocumentName: s.Source.ImageMetadata.UserInput,
 
 			// 2.5: Document Namespace
 			// Cardinality: mandatory, one
@@ -56,7 +52,7 @@ func toFormatModel(s sbom.SBOM) (*spdx.Document2_2, error) {
 			// In many cases, the URI will point to a web accessible document, but this should not be assumed
 			// to be the case.
 
-			DocumentNamespace: namespace,
+			DocumentNamespace: fmt.Sprintf("https://anchore.com/syft/image/%s", s.Source.ImageMetadata.UserInput),
 
 			// 2.6: External Document References
 			// Cardinality: optional, one or many
@@ -86,7 +82,7 @@ func toFormatModel(s sbom.SBOM) (*spdx.Document2_2, error) {
 			DocumentComment: "",
 		},
 		Packages: toFormatPackages(s.Artifacts.PackageCatalog),
-	}, nil
+	}
 }
 
 // packages populates all Package Information from the package Catalog (see https://spdx.github.io/spdx-spec/3-package-information/)

internal/formats/syftjson/encoder.go

@@ -8,7 +8,7 @@ import (
 )
 
 func encoder(output io.Writer, s sbom.SBOM) error {
-	doc := toFormatModel(s)
+	doc := ToFormatModel(s)
 
 	enc := json.NewEncoder(output)
 	// prevent > and < from being escaped in the payload

internal/formats/syftjson/encoder_test.go

@@ -16,21 +16,19 @@ import (
 	"github.com/anchore/syft/internal/formats/common/testutils"
 )
 
-var updateJson = flag.Bool("update-json", false, "update the *.golden files for json encoders")
+var updateJson = flag.Bool("update-json", false, "update the *.golden files for json presenters")
 
-func TestDirectoryEncoder(t *testing.T) {
-	testutils.AssertEncoderAgainstGoldenSnapshot(t,
-		Format(),
-		testutils.DirectoryInput(t),
+func TestDirectoryPresenter(t *testing.T) {
+	testutils.AssertPresenterAgainstGoldenSnapshot(t,
+		Format().Presenter(testutils.DirectoryInput(t)),
 		*updateJson,
 	)
 }
 
-func TestImageEncoder(t *testing.T) {
+func TestImagePresenter(t *testing.T) {
 	testImage := "image-simple"
-	testutils.AssertEncoderAgainstGoldenImageSnapshot(t,
-		Format(),
-		testutils.ImageInput(t, testImage, testutils.FromSnapshot()),
+	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
+		Format().Presenter(testutils.ImageInput(t, testImage, testutils.FromSnapshot())),
 		testImage,
 		*updateJson,
 	)
@@ -194,9 +192,8 @@ func TestEncodeFullJSONDocument(t *testing.T) {
 		},
 	}
 
-	testutils.AssertEncoderAgainstGoldenSnapshot(t,
-		Format(),
-		s,
+	testutils.AssertPresenterAgainstGoldenSnapshot(t,
+		Format().Presenter(s),
 		*updateJson,
 	)
 }

internal/formats/syftjson/model/package.go

@@ -4,10 +4,9 @@ import (
 	"encoding/json"
 	"fmt"
 
-	"github.com/anchore/syft/syft/source"
-
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
 )
 
 // Package represents a pkg.Package object specialized for JSON marshaling and unmarshalling.

internal/formats/syftjson/test-fixtures/snapshot/TestDirectoryPresenter.golden

@@ -1,7 +1,7 @@
 {
  "artifacts": [
   {
-   "id": "1d97af55efe9512f",
+   "id": "2a115ac97d018a0e",
    "name": "package-1",
    "version": "1.0.1",
    "type": "python",
@@ -36,7 +36,7 @@
    }
   },
   {
-   "id": "ad3d1c4abd84bf75",
+   "id": "5e920b2bece2c3ae",
    "name": "package-2",
    "version": "2.0.1",
    "type": "deb",
@@ -83,7 +83,7 @@
   }
  },
  "schema": {
-  "version": "2.0.2",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-2.0.2.json"
+  "version": "2.0.0",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-2.0.0.json"
  }
 }

internal/formats/syftjson/test-fixtures/snapshot/TestEncodeFullJSONDocument.golden

@@ -1,7 +1,7 @@
 {
  "artifacts": [
   {
-   "id": "d9a7c58726ab4bef",
+   "id": "962403cfb7be50d7",
    "name": "package-1",
    "version": "1.0.1",
    "type": "python",
@@ -31,7 +31,7 @@
    }
   },
   {
-   "id": "ac462e450060da2c",
+   "id": "b11f44847bba0ed1",
    "name": "package-2",
    "version": "2.0.1",
    "type": "deb",
@@ -62,8 +62,8 @@
  ],
  "artifactRelationships": [
   {
-   "parent": "",
-   "child": "",
+   "parent": "962403cfb7be50d7",
+   "child": "b11f44847bba0ed1",
    "type": "ownership-by-file-overlap",
    "metadata": {
     "file": "path"
@@ -179,7 +179,7 @@
   }
  },
  "schema": {
-  "version": "2.0.2",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-2.0.2.json"
+  "version": "2.0.0",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-2.0.0.json"
  }
 }

internal/formats/syftjson/test-fixtures/snapshot/TestImagePresenter.golden

@@ -1,7 +1,7 @@
 {
  "artifacts": [
   {
-   "id": "d16127444133b5c1",
+   "id": "888661d4f0362f02",
    "name": "package-1",
    "version": "1.0.1",
    "type": "python",
@@ -9,7 +9,7 @@
    "locations": [
     {
      "path": "/somefile-1.txt",
-     "layerID": "sha256:16e64541f2ddf59a90391ce7bb8af90313f7d373f2105d88f3d3267b72e0ebab"
+     "layerID": "sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59"
     }
    ],
    "licenses": [
@@ -32,7 +32,7 @@
    }
   },
   {
-   "id": "24907357f3705420",
+   "id": "4068ff5e8926b305",
    "name": "package-2",
    "version": "2.0.1",
    "type": "deb",
@@ -40,7 +40,7 @@
    "locations": [
     {
      "path": "/somefile-2.txt",
-     "layerID": "sha256:de6c235f76ea24c8503ec08891445b5d6a8bdf8249117ed8d8b0b6fb3ebe4f67"
+     "layerID": "sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec"
     }
    ],
    "licenses": [],
@@ -67,7 +67,7 @@
   "type": "image",
   "target": {
    "userInput": "user-image-input",
-   "imageID": "sha256:9624b89704d23fa5f61b427379d172dac91dc7a508c4d7dea7aed0e04a4cf39e",
+   "imageID": "sha256:2480160b55bec40c44d3b145c7b2c1c47160db8575c3dcae086d76b9370ae7ca",
    "manifestDigest": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368",
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
    "tags": [
@@ -77,17 +77,17 @@
    "layers": [
     {
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:16e64541f2ddf59a90391ce7bb8af90313f7d373f2105d88f3d3267b72e0ebab",
+     "digest": "sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59",
      "size": 22
     },
     {
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:de6c235f76ea24c8503ec08891445b5d6a8bdf8249117ed8d8b0b6fb3ebe4f67",
+     "digest": "sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec",
      "size": 16
     }
    ],
-   "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NjcsImRpZ2VzdCI6InNoYTI1Njo5NjI0Yjg5NzA0ZDIzZmE1ZjYxYjQyNzM3OWQxNzJkYWM5MWRjN2E1MDhjNGQ3ZGVhN2FlZDBlMDRhNGNmMzllIn0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1NjoxNmU2NDU0MWYyZGRmNTlhOTAzOTFjZTdiYjhhZjkwMzEzZjdkMzczZjIxMDVkODhmM2QzMjY3YjcyZTBlYmFiIn0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2OmRlNmMyMzVmNzZlYTI0Yzg1MDNlYzA4ODkxNDQ1YjVkNmE4YmRmODI0OTExN2VkOGQ4YjBiNmZiM2ViZTRmNjcifV19",
-   "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8iLCJPbkJ1aWxkIjpudWxsfSwiY3JlYXRlZCI6IjIwMjEtMTItMDFUMTI6MTM6NDMuNDAxMzkxNFoiLCJoaXN0b3J5IjpbeyJjcmVhdGVkIjoiMjAyMS0xMi0wMVQxMjoxMzo0My4zNDM2MzQyWiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0xLnR4dCAvc29tZWZpbGUtMS50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn0seyJjcmVhdGVkIjoiMjAyMS0xMi0wMVQxMjoxMzo0My40MDEzOTE0WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0yLnR4dCAvc29tZWZpbGUtMi50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6MTZlNjQ1NDFmMmRkZjU5YTkwMzkxY2U3YmI4YWY5MDMxM2Y3ZDM3M2YyMTA1ZDg4ZjNkMzI2N2I3MmUwZWJhYiIsInNoYTI1NjpkZTZjMjM1Zjc2ZWEyNGM4NTAzZWMwODg5MTQ0NWI1ZDZhOGJkZjgyNDkxMTdlZDhkOGIwYjZmYjNlYmU0ZjY3Il19fQ==",
+   "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NjcsImRpZ2VzdCI6InNoYTI1NjoyNDgwMTYwYjU1YmVjNDBjNDRkM2IxNDVjN2IyYzFjNDcxNjBkYjg1NzVjM2RjYWUwODZkNzZiOTM3MGFlN2NhIn0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1NjpmYjZiZWVjYjc1YjM5ZjRiYjgxM2RiZjE3N2U1MDFlZGQ1ZGRiM2U2OWJiNDVjZWRlYjc4YzY3NmVlMWI3YTU5In0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2OjMxOWI1ODhjZTY0MjUzYTg3YjUzM2M4ZWQwMWNmMDAyNWUwZWFjOThlN2I1MTZlMTI1MzI5NTdlMTI0NGZkZWMifV19",
+   "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8iLCJPbkJ1aWxkIjpudWxsfSwiY3JlYXRlZCI6IjIwMjEtMTAtMDRUMTE6NDA6MDAuNjM4Mzk0NVoiLCJoaXN0b3J5IjpbeyJjcmVhdGVkIjoiMjAyMS0xMC0wNFQxMTo0MDowMC41OTA3MzE2WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0xLnR4dCAvc29tZWZpbGUtMS50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn0seyJjcmVhdGVkIjoiMjAyMS0xMC0wNFQxMTo0MDowMC42MzgzOTQ1WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0yLnR4dCAvc29tZWZpbGUtMi50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6ZmI2YmVlY2I3NWIzOWY0YmI4MTNkYmYxNzdlNTAxZWRkNWRkYjNlNjliYjQ1Y2VkZWI3OGM2NzZlZTFiN2E1OSIsInNoYTI1NjozMTliNTg4Y2U2NDI1M2E4N2I1MzNjOGVkMDFjZjAwMjVlMGVhYzk4ZTdiNTE2ZTEyNTMyOTU3ZTEyNDRmZGVjIl19fQ==",
    "repoDigests": []
   }
  },
@@ -104,7 +104,7 @@
   }
  },
  "schema": {
-  "version": "2.0.2",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-2.0.2.json"
+  "version": "2.0.0",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-2.0.0.json"
  }
 }

internal/formats/syftjson/to_format_model.go

@@ -19,7 +19,8 @@ import (
 	"github.com/anchore/syft/syft/source"
 )
 
-func toFormatModel(s sbom.SBOM) model.Document {
+// TODO: this is exported for the use of the power-user command (temp)
+func ToFormatModel(s sbom.SBOM) model.Document {
 	src, err := toSourceModel(s.Source)
 	if err != nil {
 		log.Warnf("unable to create syft-json source object: %+v", err)
@@ -142,7 +143,7 @@ func toPackageModels(catalog *pkg.Catalog) []model.Package {
 func toPackageModel(p pkg.Package) model.Package {
 	var cpes = make([]string, len(p.CPEs))
 	for i, c := range p.CPEs {
-		cpes[i] = pkg.CPEString(c)
+		cpes[i] = c.BindToFmtString()
 	}
 
 	var licenses = make([]string, 0)
@@ -201,11 +202,6 @@ func toSourceModel(src source.Metadata) (model.Source, error) {
 			Type:   "directory",
 			Target: src.Path,
 		}, nil
-	case source.FileScheme:
-		return model.Source{
-			Type:   "file",
-			Target: src.Path,
-		}, nil
 	default:
 		return model.Source{}, fmt.Errorf("unsupported source: %q", src.Scheme)
 	}

internal/formats/syftjson/to_format_model_test.go

@@ -1,84 +0,0 @@
-package syftjson
-
-import (
-	"testing"
-
-	"github.com/scylladb/go-set/strset"
-
-	"github.com/anchore/syft/internal/formats/syftjson/model"
-	"github.com/anchore/syft/syft/source"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func Test_toSourceModel(t *testing.T) {
-	allSchemes := strset.New()
-	for _, s := range source.AllSchemes {
-		allSchemes.Add(string(s))
-	}
-	testedSchemes := strset.New()
-
-	tests := []struct {
-		name     string
-		src      source.Metadata
-		expected model.Source
-	}{
-		{
-			name: "directory",
-			src: source.Metadata{
-				Scheme: source.DirectoryScheme,
-				Path:   "some/path",
-			},
-			expected: model.Source{
-				Type:   "directory",
-				Target: "some/path",
-			},
-		},
-		{
-			name: "file",
-			src: source.Metadata{
-				Scheme: source.FileScheme,
-				Path:   "some/path",
-			},
-			expected: model.Source{
-				Type:   "file",
-				Target: "some/path",
-			},
-		},
-		{
-			name: "image",
-			src: source.Metadata{
-				Scheme: source.ImageScheme,
-				ImageMetadata: source.ImageMetadata{
-					UserInput:      "user-input",
-					ID:             "id...",
-					ManifestDigest: "digest...",
-					MediaType:      "type...",
-				},
-			},
-			expected: model.Source{
-				Type: "image",
-				Target: source.ImageMetadata{
-					UserInput:      "user-input",
-					ID:             "id...",
-					ManifestDigest: "digest...",
-					MediaType:      "type...",
-				},
-			},
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			// track each scheme tested (passed or not)
-			testedSchemes.Add(string(test.src.Scheme))
-
-			// assert the model transformation is correct
-			actual, err := toSourceModel(test.src)
-			require.NoError(t, err)
-			assert.Equal(t, test.expected, actual)
-		})
-	}
-
-	// assert all possible schemes were under test
-	assert.ElementsMatch(t, allSchemes.List(), testedSchemes.List(), "not all source.Schemes are under test")
-}

internal/formats/syftjson/to_syft_model.go

@@ -40,11 +40,6 @@ func toSyftSourceData(s model.Source) *source.Metadata {
 			Scheme: source.DirectoryScheme,
 			Path:   s.Target.(string),
 		}
-	case "file":
-		return &source.Metadata{
-			Scheme: source.FileScheme,
-			Path:   s.Target.(string),
-		}
 	case "image":
 		return &source.Metadata{
 			Scheme:        source.ImageScheme,

internal/formats/syftjson/to_syft_model_test.go

@@ -1,81 +0,0 @@
-package syftjson
-
-import (
-	"testing"
-
-	"github.com/anchore/syft/internal/formats/syftjson/model"
-	"github.com/anchore/syft/syft/source"
-	"github.com/scylladb/go-set/strset"
-	"github.com/stretchr/testify/assert"
-)
-
-func Test_toSyftSourceData(t *testing.T) {
-	allSchemes := strset.New()
-	for _, s := range source.AllSchemes {
-		allSchemes.Add(string(s))
-	}
-	testedSchemes := strset.New()
-
-	tests := []struct {
-		name     string
-		src      model.Source
-		expected source.Metadata
-	}{
-		{
-			name: "directory",
-			expected: source.Metadata{
-				Scheme: source.DirectoryScheme,
-				Path:   "some/path",
-			},
-			src: model.Source{
-				Type:   "directory",
-				Target: "some/path",
-			},
-		},
-		{
-			name: "file",
-			expected: source.Metadata{
-				Scheme: source.FileScheme,
-				Path:   "some/path",
-			},
-			src: model.Source{
-				Type:   "file",
-				Target: "some/path",
-			},
-		},
-		{
-			name: "image",
-			expected: source.Metadata{
-				Scheme: source.ImageScheme,
-				ImageMetadata: source.ImageMetadata{
-					UserInput:      "user-input",
-					ID:             "id...",
-					ManifestDigest: "digest...",
-					MediaType:      "type...",
-				},
-			},
-			src: model.Source{
-				Type: "image",
-				Target: source.ImageMetadata{
-					UserInput:      "user-input",
-					ID:             "id...",
-					ManifestDigest: "digest...",
-					MediaType:      "type...",
-				},
-			},
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			// assert the model transformation is correct
-			actual := toSyftSourceData(test.src)
-			assert.Equal(t, test.expected, *actual)
-
-			// track each scheme tested (passed or not)
-			testedSchemes.Add(string(test.expected.Scheme))
-		})
-	}
-
-	// assert all possible schemes were under test
-	assert.ElementsMatch(t, allSchemes.List(), testedSchemes.List(), "not all source.Schemes are under test")
-}

internal/formats/table/encoder_test.go

@@ -10,10 +10,9 @@ import (
 
 var updateTableGoldenFiles = flag.Bool("update-table", false, "update the *.golden files for table format")
 
-func TestTableEncoder(t *testing.T) {
-	testutils.AssertEncoderAgainstGoldenSnapshot(t,
-		Format(),
-		testutils.DirectoryInput(t),
+func TestTablePresenter(t *testing.T) {
+	testutils.AssertPresenterAgainstGoldenSnapshot(t,
+		Format().Presenter(testutils.DirectoryInput(t)),
 		*updateTableGoldenFiles,
 	)
 }

internal/formats/text/encoder.go

@@ -16,7 +16,7 @@ func encoder(output io.Writer, s sbom.SBOM) error {
 	w.Init(output, 0, 8, 0, '\t', tabwriter.AlignRight)
 
 	switch s.Source.Scheme {
-	case source.DirectoryScheme, source.FileScheme:
+	case source.DirectoryScheme:
 		fmt.Fprintf(w, "[Path: %s]\n", s.Source.Path)
 	case source.ImageScheme:
 		fmt.Fprintln(w, "[Image]")

internal/formats/text/encoder_test.go

@@ -7,22 +7,20 @@ import (
 	"github.com/anchore/syft/internal/formats/common/testutils"
 )
 
-var updateTextEncoderGoldenFiles = flag.Bool("update-text", false, "update the *.golden files for text encoder")
+var updateTextPresenterGoldenFiles = flag.Bool("update-text", false, "update the *.golden files for text presenters")
 
-func TestTextDirectoryEncoder(t *testing.T) {
-	testutils.AssertEncoderAgainstGoldenSnapshot(t,
-		Format(),
-		testutils.DirectoryInput(t),
-		*updateTextEncoderGoldenFiles,
+func TestTextDirectoryPresenter(t *testing.T) {
+	testutils.AssertPresenterAgainstGoldenSnapshot(t,
+		Format().Presenter(testutils.DirectoryInput(t)),
+		*updateTextPresenterGoldenFiles,
 	)
 }
 
-func TestTextImageEncoder(t *testing.T) {
+func TestTextImagePresenter(t *testing.T) {
 	testImage := "image-simple"
-	testutils.AssertEncoderAgainstGoldenImageSnapshot(t,
-		Format(),
-		testutils.ImageInput(t, testImage, testutils.FromSnapshot()),
+	testutils.AssertPresenterAgainstGoldenImageSnapshot(t,
+		Format().Presenter(testutils.ImageInput(t, testImage, testutils.FromSnapshot())),
 		testImage,
-		*updateTextEncoderGoldenFiles,
+		*updateTextPresenterGoldenFiles,
 	)
 }

internal/output/writer.go

@@ -1,116 +0,0 @@
-package output
-
-import (
-	"fmt"
-	"io"
-	"os"
-	"path"
-
-	"github.com/anchore/syft/syft/format"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/hashicorp/go-multierror"
-)
-
-// streamWriter implements sbom.Writer for a given format and io.Writer, also providing a close function for cleanup
-type streamWriter struct {
-	format format.Format
-	out    io.Writer
-	close  func() error
-}
-
-// Write the provided SBOM to the data stream
-func (w *streamWriter) Write(s sbom.SBOM) error {
-	return w.format.Encode(w.out, s)
-}
-
-// Close any resources, such as open files
-func (w *streamWriter) Close() error {
-	if w.close != nil {
-		return w.close()
-	}
-	return nil
-}
-
-// multiWriter holds a list of child sbom.Writers to apply all Write and Close operations to
-type multiWriter struct {
-	writers []sbom.Writer
-}
-
-// Write writes the SBOM to all writers
-func (m *multiWriter) Write(s sbom.SBOM) (errs error) {
-	for _, w := range m.writers {
-		err := w.Write(s)
-		if err != nil {
-			errs = multierror.Append(errs, err)
-		}
-	}
-	return errs
-}
-
-// Close closes all writers
-func (m *multiWriter) Close() (errs error) {
-	for _, w := range m.writers {
-		err := w.Close()
-		if err != nil {
-			errs = multierror.Append(errs, err)
-		}
-	}
-	return errs
-}
-
-// WriterOption Format and path strings used to create sbom.Writer
-type WriterOption struct {
-	Format format.Format
-	Path   string
-}
-
-// MakeWriter create all report writers from input options; if a file is not specified, os.Stdout is used
-func MakeWriter(options ...WriterOption) (_ sbom.Writer, errs error) {
-	if len(options) == 0 {
-		return nil, fmt.Errorf("no output options provided")
-	}
-
-	out := &multiWriter{}
-
-	defer func() {
-		if errs != nil {
-			// close any previously opened files; we can't really recover from any errors
-			_ = out.Close()
-		}
-	}()
-
-	for _, option := range options {
-		switch len(option.Path) {
-		case 0:
-			out.writers = append(out.writers, &streamWriter{
-				format: option.Format,
-				out:    os.Stdout,
-			})
-		default:
-			// create any missing subdirectories
-			dir := path.Dir(option.Path)
-			if dir != "" {
-				s, err := os.Stat(dir)
-				if err != nil {
-					err = os.MkdirAll(dir, 0755) // maybe should be os.ModePerm ?
-					if err != nil {
-						return nil, err
-					}
-				} else if !s.IsDir() {
-					return nil, fmt.Errorf("output path does not contain a valid directory: %s", option.Path)
-				}
-			}
-			fileOut, err := os.OpenFile(option.Path, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0644)
-			if err != nil {
-				return nil, fmt.Errorf("unable to create report file: %w", err)
-			}
-			out.writers = append(out.writers, &streamWriter{
-				format: option.Format,
-				out:    fileOut,
-				close:  fileOut.Close,
-			})
-		}
-	}
-
-	return out, nil
-}

internal/output/writer_test.go

@@ -1,168 +0,0 @@
-package output
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/anchore/syft/internal/formats/spdx22json"
-	"github.com/anchore/syft/internal/formats/syftjson"
-	"github.com/anchore/syft/internal/formats/table"
-	"github.com/anchore/syft/internal/formats/text"
-
-	"github.com/stretchr/testify/assert"
-)
-
-type writerConfig struct {
-	format string
-	file   string
-}
-
-func TestOutputWriter(t *testing.T) {
-	tmp := t.TempDir()
-
-	testName := func(options []WriterOption, err bool) string {
-		var out []string
-		for _, opt := range options {
-			out = append(out, string(opt.Format.Option)+"="+opt.Path)
-		}
-		errs := ""
-		if err {
-			errs = "(err)"
-		}
-		return strings.Join(out, ", ") + errs
-	}
-
-	tests := []struct {
-		outputs  []WriterOption
-		err      bool
-		expected []writerConfig
-	}{
-		{
-			outputs: []WriterOption{},
-			err:     true,
-		},
-		{
-			outputs: []WriterOption{
-				{
-					Format: table.Format(),
-					Path:   "",
-				},
-			},
-			expected: []writerConfig{
-				{
-					format: "table",
-				},
-			},
-		},
-		{
-			outputs: []WriterOption{
-				{
-					Format: syftjson.Format(),
-				},
-			},
-			expected: []writerConfig{
-				{
-					format: "json",
-				},
-			},
-		},
-		{
-			outputs: []WriterOption{
-				{
-					Format: syftjson.Format(),
-					Path:   "test-2.json",
-				},
-			},
-			expected: []writerConfig{
-				{
-					format: "json",
-					file:   "test-2.json",
-				},
-			},
-		},
-		{
-			outputs: []WriterOption{
-				{
-					Format: syftjson.Format(),
-					Path:   "test-3/1.json",
-				},
-				{
-					Format: spdx22json.Format(),
-					Path:   "test-3/2.json",
-				},
-			},
-			expected: []writerConfig{
-				{
-					format: "json",
-					file:   "test-3/1.json",
-				},
-				{
-					format: "spdx-json",
-					file:   "test-3/2.json",
-				},
-			},
-		},
-		{
-			outputs: []WriterOption{
-				{
-					Format: text.Format(),
-				},
-				{
-					Format: spdx22json.Format(),
-					Path:   "test-4.json",
-				},
-			},
-			expected: []writerConfig{
-				{
-					format: "text",
-				},
-				{
-					format: "spdx-json",
-					file:   "test-4.json",
-				},
-			},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(testName(test.outputs, test.err), func(t *testing.T) {
-			outputs := test.outputs
-			for i := range outputs {
-				if outputs[i].Path != "" {
-					outputs[i].Path = tmp + outputs[i].Path
-				}
-			}
-
-			writer, err := MakeWriter(outputs...)
-
-			if test.err {
-				assert.Error(t, err)
-				return
-			} else {
-				assert.NoError(t, err)
-			}
-
-			mw := writer.(*multiWriter)
-
-			assert.Len(t, mw.writers, len(test.expected))
-
-			for i, e := range test.expected {
-				w := mw.writers[i].(*streamWriter)
-
-				assert.Equal(t, string(w.format.Option), e.format)
-
-				if e.file != "" {
-					assert.FileExists(t, tmp+e.file)
-				}
-
-				if e.file != "" {
-					assert.NotNil(t, w.out)
-					assert.NotNil(t, w.close)
-				} else {
-					assert.NotNil(t, w.out)
-					assert.Nil(t, w.close)
-				}
-			}
-		})
-	}
-}

internal/ui/common_event_handlers.go

@@ -2,22 +2,23 @@ package ui
 
 import (
 	"fmt"
+	"io"
 
 	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
 	"github.com/wagoodman/go-partybus"
 )
 
-// handleExit is a UI function for processing the Exit bus event,
-// and calling the given function to output the contents.
-func handleExit(event partybus.Event) error {
+// handleCatalogerPresenterReady is a UI function for processing the CatalogerFinished bus event, displaying the catalog
+// via the given presenter to stdout.
+func handleCatalogerPresenterReady(event partybus.Event, reportOutput io.Writer) error {
 	// show the report to stdout
-	fn, err := syftEventParsers.ParseExit(event)
+	pres, err := syftEventParsers.ParsePresenterReady(event)
 	if err != nil {
 		return fmt.Errorf("bad CatalogerFinished event: %w", err)
 	}
 
-	if err := fn(); err != nil {
-		return fmt.Errorf("unable to show package catalog report: %v", err)
+	if err := pres.Present(reportOutput); err != nil {
+		return fmt.Errorf("unable to show package catalog report: %w", err)
 	}
 	return nil
 }

internal/ui/ephemeral_terminal_ui.go

@@ -36,20 +36,22 @@ import (
 // or in the shared ui package as a function on the main handler object. All handler functions should be completed
 // processing an event before the ETUI exits (coordinated with a sync.WaitGroup)
 type ephemeralTerminalUI struct {
-	unsubscribe func() error
-	handler     *ui.Handler
-	waitGroup   *sync.WaitGroup
-	frame       *frame.Frame
-	logBuffer   *bytes.Buffer
-	uiOutput    *os.File
+	unsubscribe  func() error
+	handler      *ui.Handler
+	waitGroup    *sync.WaitGroup
+	frame        *frame.Frame
+	logBuffer    *bytes.Buffer
+	uiOutput     *os.File
+	reportOutput io.Writer
 }
 
 // NewEphemeralTerminalUI writes all events to a TUI and writes the final report to the given writer.
-func NewEphemeralTerminalUI() UI {
+func NewEphemeralTerminalUI(reportWriter io.Writer) UI {
 	return &ephemeralTerminalUI{
-		handler:   ui.NewHandler(),
-		waitGroup: &sync.WaitGroup{},
-		uiOutput:  os.Stderr,
+		handler:      ui.NewHandler(),
+		waitGroup:    &sync.WaitGroup{},
+		uiOutput:     os.Stderr,
+		reportOutput: reportWriter,
 	}
 }
 
@@ -80,12 +82,12 @@ func (h *ephemeralTerminalUI) Handle(event partybus.Event) error {
 			log.Errorf("unable to show %s event: %+v", event.Type, err)
 		}
 
-	case event.Type == syftEvent.Exit:
-		// we need to close the screen now since signaling the sbom is ready means that we
+	case event.Type == syftEvent.PresenterReady:
+		// we need to close the screen now since signaling the the presenter is ready means that we
 		// are about to write bytes to stdout, so we should reset the terminal state first
 		h.closeScreen(false)
 
-		if err := handleExit(event); err != nil {
+		if err := handleCatalogerPresenterReady(event, h.reportOutput); err != nil {
 			log.Errorf("unable to show %s event: %+v", event.Type, err)
 		}
 

internal/ui/logger_ui.go

@@ -1,18 +1,23 @@
 package ui
 
 import (
+	"io"
+
 	"github.com/anchore/syft/internal/log"
 	syftEvent "github.com/anchore/syft/syft/event"
 	"github.com/wagoodman/go-partybus"
 )
 
 type loggerUI struct {
-	unsubscribe func() error
+	unsubscribe  func() error
+	reportOutput io.Writer
 }
 
 // NewLoggerUI writes all events to the common application logger and writes the final report to the given writer.
-func NewLoggerUI() UI {
-	return &loggerUI{}
+func NewLoggerUI(reportWriter io.Writer) UI {
+	return &loggerUI{
+		reportOutput: reportWriter,
+	}
 }
 
 func (l *loggerUI) Setup(unsubscribe func() error) error {
@@ -22,11 +27,11 @@ func (l *loggerUI) Setup(unsubscribe func() error) error {
 
 func (l loggerUI) Handle(event partybus.Event) error {
 	// ignore all events except for the final event
-	if event.Type != syftEvent.Exit {
+	if event.Type != syftEvent.PresenterReady {
 		return nil
 	}
 
-	if err := handleExit(event); err != nil {
+	if err := handleCatalogerPresenterReady(event, l.reportOutput); err != nil {
 		log.Warnf("unable to show catalog image finished event: %+v", err)
 	}
 

internal/ui/select.go

@@ -4,6 +4,7 @@
 package ui
 
 import (
+	"io"
 	"os"
 	"runtime"
 
@@ -15,16 +16,16 @@ import (
 // is intended to be used and the UIs that follow are meant to be attempted only in a fallback posture when there
 // are environmental problems (e.g. cannot write to the terminal). A writer is provided to capture the output of
 // the final SBOM report.
-func Select(verbose, quiet bool) (uis []UI) {
+func Select(verbose, quiet bool, reportWriter io.Writer) (uis []UI) {
 	isStdoutATty := term.IsTerminal(int(os.Stdout.Fd()))
 	isStderrATty := term.IsTerminal(int(os.Stderr.Fd()))
 	notATerminal := !isStderrATty && !isStdoutATty
 
 	switch {
 	case runtime.GOOS == "windows" || verbose || quiet || notATerminal || !isStderrATty:
-		uis = append(uis, NewLoggerUI())
+		uis = append(uis, NewLoggerUI(reportWriter))
 	default:
-		uis = append(uis, NewEphemeralTerminalUI())
+		uis = append(uis, NewEphemeralTerminalUI(reportWriter), NewLoggerUI(reportWriter))
 	}
 
 	return uis

internal/ui/select_windows.go

@@ -3,11 +3,15 @@
 
 package ui
 
+import (
+	"io"
+)
+
 // Select is responsible for determining the specific UI function given select user option, the current platform
 // config values, and environment status (such as a TTY being present). The first UI in the returned slice of UIs
 // is intended to be used and the UIs that follow are meant to be attempted only in a fallback posture when there
 // are environmental problems (e.g. cannot write to the terminal). A writer is provided to capture the output of
 // the final SBOM report.
-func Select(verbose, quiet bool) (uis []UI) {
-	return append(uis, NewLoggerUI())
+func Select(verbose, quiet bool, reportWriter io.Writer) (uis []UI) {
+	return append(uis, NewLoggerUI(reportWriter))
 }

schema/cyclonedx/.gitignore

@@ -1,2 +1 @@
-bom.xml
-bom.json
+bom.xml

schema/cyclonedx/Makefile

@@ -2,6 +2,4 @@
 .PHONY: validate-schema
 validate-schema:
 	go run ../../main.go ubuntu:latest -vv -o cyclonedx > bom.xml
-	xmllint --noout --schema ./cyclonedx.xsd bom.xml
-	go run ../../main.go ubuntu:latest -vv -o cyclonedx-json > bom.json
-	../../.tmp/yajsv -s bom-1.3.schema.json bom.json
+	xmllint --noout --schema ./cyclonedx.xsd bom.xml