repackage all file in notarization temp dir (not from tar output) (#792)

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

.github/scripts/apple-signing/.gitignore

@@ -0,0 +1,2 @@
+dev-pki
+log

.github/scripts/apple-signing/cleanup.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -eu
+
+# grab utilities
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+. "$SCRIPT_DIR"/utils.sh
+
+# cleanup any dev certs left behind
+. "$SCRIPT_DIR"/prep-signing-dev.sh
+cleanup_signing

.github/scripts/apple-signing/notarize.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+set -ue
+
+set +xu
+if [ -z "$AC_USERNAME" ]; then
+  exit_with_error "AC_USERNAME not set"
+fi
+
+if [ -z "$AC_PASSWORD" ]; then
+  exit_with_error "AC_PASSWORD not set"
+fi
+set -u
+
+# repackage [archive-path]
+#
+# returns an archive compatible for Apple's notarization process, repackaging the input archive as needed
+#
+repackage() {
+  archive=$1
+
+  case "$archive" in
+    *.tar.gz)
+      new_archive=${archive%.tar.gz}.zip
+      (
+        tmp_dir=$(mktemp -d)
+        cd "$tmp_dir"
+        # redirect stdout to stderr to preserve the return value
+        tar xzf "$archive" && zip "$new_archive" ./* 1>&2
+        rm -rf "$tmp_dir"
+      )
+      echo "$new_archive"
+      ;;
+    *.zip)
+      echo "$archive"
+      ;;
+    *) return 1
+      ;;
+  esac
+}
+
+# notarize [archive-path]
+#
+notarize() {
+  archive_path=$1
+
+  title "notarizing binaries found in the release archive"
+
+  payload_archive_path=$(repackage "$archive_path")
+  if [ "$?" != "0" ]; then
+    exit_with_error "cannot prepare payload for notarization: $archive_path"
+  fi
+
+  if [ ! -f "$payload_archive_path" ]; then
+    exit_with_error "cannot find payload for notarization: $payload_archive_path"
+  fi
+
+  # install gon
+  which gon || (brew tap mitchellh/gon && brew install mitchellh/gon/gon)
+
+  # create config (note: json via stdin with gon is broken, can only use HCL from file)
+  tmp_file=$(mktemp).hcl
+
+  cat <<EOF > "$tmp_file"
+notarize {
+  path = "$archive_path"
+  bundle_id = "com.anchore.toolbox.syft"
+}
+
+apple_id {
+   username = "$AC_USERNAME"
+   password = "@env:AC_PASSWORD"
+}
+EOF
+
+  gon -log-level info "$tmp_file"
+
+  result="$?"
+
+  rm "$tmp_file"
+
+  if [ "$result" -ne "0" ]; then
+      exit_with_error "notarization failed"
+  fi
+}
+

.github/scripts/apple-signing/prep-signing-dev.sh

@@ -0,0 +1,172 @@
+#!/usr/bin/env bash
+set -eu
+
+NAME=syft-dev
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+DIR=$SCRIPT_DIR/dev-pki
+FILE_PREFIX=$DIR/$NAME
+IDENTITY=${NAME}-id-415d8c69793
+
+## OpenSSL material
+
+KEY_PASSWORD="letthedevin"
+P12_PASSWORD="popeofnope"
+
+KEY_FILE=$FILE_PREFIX-key.pem
+CSR_FILE=$FILE_PREFIX-csr.pem
+CERT_FILE=$FILE_PREFIX-cert.pem
+EXT_FILE=$FILE_PREFIX-ext.cnf
+P12_FILE=$FILE_PREFIX.p12
+
+EXT_SECTION=codesign_reqext
+
+## Keychain material
+
+KEYCHAIN_NAME=$NAME
+KEYCHAIN_PATH=$HOME/Library/Keychains/$KEYCHAIN_NAME-db
+KEYCHAIN_PASSWORD="topsykretts"
+
+# setup_signing
+#
+# preps the MAC_SIGNING_IDENTITY env var for use in the signing process, using ephemeral developer certificate material
+#
+function setup_signing() {
+  # check to see if this has already been done... if so, bail!
+  set +ue
+  if security find-identity -p codesigning "$KEYCHAIN_PATH" | grep $IDENTITY ; then
+      export MAC_SIGNING_IDENTITY=$IDENTITY
+      commentary "skipping creating dev certificate material (already exists)"
+      commentary "setting MAC_SIGNING_IDENTITY=${IDENTITY}"
+      return 0
+  fi
+  set -ue
+
+  title "setting up developer certificate material"
+
+  mkdir -p "${DIR}"
+
+  # configure the openssl extensions
+  cat << EOF > $EXT_FILE
+  [ req ]
+  default_bits          = 2048                  # RSA key size
+  encrypt_key           = yes                   # Protect private key
+  default_md            = sha256                # MD to use
+  utf8                  = yes                   # Input is UTF-8
+  string_mask           = utf8only              # Emit UTF-8 strings
+  prompt                = yes                   # Prompt for DN
+  distinguished_name    = codesign_dn           # DN template
+  req_extensions        = $EXT_SECTION          # Desired extensions
+
+  [ codesign_dn ]
+  commonName            = $IDENTITY
+  commonName_max        = 64
+
+  [ $EXT_SECTION ]
+  keyUsage              = critical,digitalSignature
+  extendedKeyUsage      = critical,codeSigning
+  subjectKeyIdentifier  = hash
+EOF
+
+  title "create the private key"
+  openssl genrsa \
+            -des3 \
+            -out "$KEY_FILE" \
+            -passout "pass:$KEY_PASSWORD" \
+           2048
+
+  title "create the csr"
+  openssl req \
+            -new \
+            -key "$KEY_FILE" \
+            -out "$CSR_FILE" \
+            -passin "pass:$KEY_PASSWORD" \
+            -config "$EXT_FILE" \
+            -subj "/CN=$IDENTITY"
+
+  commentary "verify the csr: we should see X509 v3 extensions for codesigning in the CSR"
+  openssl req -in "$CSR_FILE" -noout -text | grep -A1 "X509v3" || exit_with_error "could not find x509 extensions in CSR"
+
+  title "create the certificate"
+  # note: Extensions in certificates are not transferred to certificate requests and vice versa. This means that
+  # just because the CSR has x509 v3 extensions doesn't mean that you'll see these extensions in the cert output.
+  # To prove this do:
+  # 	openssl x509 -text -noout -in server.crt | grep -A10 "X509v3 extensions:"
+  # ... and you will see no output (if -extensions is not used). (see https://www.openssl.org/docs/man1.1.0/man1/x509.html#BUGS)
+  # To get the extensions, use "-extensions codesign_reqext" when creating the cert. The codesign_reqext value matches
+  # the section name in the ext file used in CSR / cert creation (-extfile and -config).
+  openssl x509 \
+            -req \
+            -days 10000 \
+            -in "$CSR_FILE" \
+            -signkey "$KEY_FILE" \
+            -out "$CERT_FILE" \
+            -extfile "$EXT_FILE" \
+            -passin "pass:$KEY_PASSWORD" \
+            -extensions $EXT_SECTION
+
+  commentary "verify the certificate: we should see our extensions"
+  openssl x509 -text -noout -in $CERT_FILE | grep -A1 'X509v3' || exit_with_error "could not find x509 extensions in certificate"
+
+  title "export cert and private key to .p12 file"
+  # note: this step may be entirely optional, however, I found it useful to follow the prod path which goes the route of using a p12
+  openssl pkcs12 \
+            -export \
+            -out "$P12_FILE" \
+            -inkey "$KEY_FILE" \
+            -in "$CERT_FILE" \
+            -passin "pass:$KEY_PASSWORD" \
+            -passout "pass:$P12_PASSWORD"
+
+
+  title "create the dev keychain"
+
+  # delete the keychain if it already exists
+  if [ -f "$(KEYCHAIN_PATH)" ]; then
+    security delete-keychain "$KEYCHAIN_NAME" &> /dev/null
+  fi
+
+  security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"
+
+  set +e
+  if ! security verify-cert -k "$KEYCHAIN_PATH" -c "$CERT_FILE" &> /dev/null; then
+    set -e
+    title "import the cert into the dev keychain if it is not already trusted by the system"
+
+    security import "$P12_FILE" -P $P12_PASSWORD -f pkcs12 -k "$KEYCHAIN_PATH" -T /usr/bin/codesign
+
+    # note: set the partition list for this certificate's private key to include "apple-tool:" and "apple:" allows the codesign command to access this keychain item without an interactive user prompt.
+    security set-key-partition-list -S "apple-tool:,apple:,codesign:" -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+
+    # note: add-trusted-cert requires user interaction
+    commentary "adding the developer certificate as a trusted certificate... (requires user interaction)"
+    security add-trusted-cert -d -r trustRoot -k "$KEYCHAIN_PATH" "$CERT_FILE"
+  else
+    set -e
+    commentary "...dev cert has already been imported onto the dev keychain"
+  fi
+
+  # remove any generated cert material since the keychain now has all of this material loaded
+  rm -rf "${DIR}"
+
+  commentary "make certain there are identities that can be used for code signing"
+  security find-identity -p codesigning "$KEYCHAIN_PATH" | grep -C 30 "$IDENTITY" || exit_with_error "could not find identity that can be used with codesign"
+
+  title "add the dev keychain to the search path for codesign"
+  add_keychain $KEYCHAIN_NAME
+
+  commentary "verify the keychain actually shows up"
+  security list-keychains | grep "$KEYCHAIN_NAME" || exit_with_error "could not find new keychain"
+
+  export MAC_SIGNING_IDENTITY=$IDENTITY
+  commentary "setting MAC_SIGNING_IDENTITY=${IDENTITY}"
+
+}
+
+
+function cleanup_signing() {
+  title "delete the dev keychain and all certificate material"
+  set -xue
+  security delete-keychain "$KEYCHAIN_NAME"
+  rm -f "$KEYCHAIN_PATH"
+  rm -rf "${DIR}"
+}

.github/scripts/apple-signing/prep-signing-prod.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+set -eu
+
+assert_in_ci
+
+set +xu
+if [ -z "$APPLE_DEVELOPER_ID_CERT" ]; then
+  exit_with_error "APPLE_DEVELOPER_ID_CERT not set"
+fi
+
+if [ -z "$APPLE_DEVELOPER_ID_CERT_PASS" ]; then
+  exit_with_error "APPLE_DEVELOPER_ID_CERT_PASS not set"
+fi
+set -u
+
+# setup_signing
+#
+# preps the MAC_SIGNING_IDENTITY env var for use in the signing process, using production certificate material
+#
+setup_signing() {
+  title "setting up production certificate material"
+
+  # Write signing certificate to disk from environment variable.
+  cert_file="$HOME/developer_id_certificate.p12"
+  echo -n "$APPLE_DEVELOPER_ID_CERT" | base64 --decode > "$cert_file"
+
+  # In order to have all keychain interactions avoid an interactive user prompt, we need to control the password for the keychain in question, which means we need to create a new keychain into which we'll import the signing certificate and from which we'll later access this certificate during code signing.
+  ephemeral_keychain="ci-ephemeral-keychain"
+  ephemeral_keychain_password="$(openssl rand -base64 100)"
+  security create-keychain -p "${ephemeral_keychain_password}" "${ephemeral_keychain}"
+
+  # Import signing certificate into the keychain. (This is a pre-requisite for gon, which is invoked via goreleaser.)
+  ephemeral_keychain_full_path="$HOME/Library/Keychains/${ephemeral_keychain}-db"
+  security import "${cert_file}" -k "${ephemeral_keychain_full_path}" -P "${APPLE_DEVELOPER_ID_CERT_PASS}" -T "$(command -v codesign)"
+
+  # Setting the partition list for this certificate's private key to include "apple-tool:" and "apple:" allows the codesign command to access this keychain item without an interactive user prompt. (codesign is invoked by gon.)
+  security set-key-partition-list -S "apple-tool:,apple:" -s -k "${ephemeral_keychain_password}" "${ephemeral_keychain_full_path}"
+
+  # Make this new keychain the user's default keychain, so that codesign will be able to find this certificate when we specify it during signing.
+  security default-keychain -d "user" -s "${ephemeral_keychain_full_path}"
+
+  # TODO: extract this from the certificate material itself
+  export MAC_SIGNING_IDENTITY="Developer ID Application: ANCHORE, INC. (9MJHKYX5AT)"
+  commentary "setting MAC_SIGNING_IDENTITY=${MAC_SIGNING_IDENTITY}"
+}

.github/scripts/apple-signing/run.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+set -eu
+
+ARCHIVE_PATH="$1"
+IS_SNAPSHOT="$2"
+
+## grab utilities
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+. "$SCRIPT_DIR"/utils.sh
+
+main() {
+  perform_notarization=false
+  archive_abs_path=$(realpath "$ARCHIVE_PATH")
+
+  if [ ! -f "$archive_abs_path" ]; then
+      echo "archive does not exist: $archive_abs_path"
+  fi
+
+  case "$IS_SNAPSHOT" in
+
+    "1" |  "true" | "yes")
+      commentary "assuming development setup..."
+      . "$SCRIPT_DIR"/prep-signing-dev.sh
+      ;;
+
+    "0" |  "false" | "no")
+      commentary "assuming production setup..."
+      . "$SCRIPT_DIR"/prep-signing-prod.sh
+      . "$SCRIPT_DIR"/notarize.sh
+      perform_notarization=true
+      ;;
+
+    *)
+      exit_with_error "could not determine if this was a production build (isSnapshot='$IS_SNAPSHOT')"
+      ;;
+  esac
+
+  . "$SCRIPT_DIR"/sign.sh
+
+  # load up all signing material into a keychain (note: this should set the MAC_SIGNING_IDENTITY env var)
+  setup_signing
+
+  # sign all of the binaries in the archive and recreate the input archive with the signed binaries
+  sign_binaries_in_archive "$archive_abs_path" "$MAC_SIGNING_IDENTITY"
+
+  # send all of the binaries off to apple to bless
+  if $perform_notarization ; then
+    notarize "$archive_abs_path"
+  else
+    commentary "skipping notarization..."
+  fi
+}
+
+set +u
+if [ -z "$SCRIPT" ]
+then
+    set -u
+    # log all output
+    mkdir -p "$SCRIPT_DIR/log"
+    /usr/bin/script "$SCRIPT_DIR/log/signing-$(basename $ARCHIVE_PATH).txt" /bin/bash -c "$0 $*"
+    exit $?
+else
+  set -u
+  main
+fi

.github/scripts/apple-signing/sign.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+set -eu
+
+# sign_binary [binary-path] [signing-identity]
+#
+# signs a single binary with cosign
+#
+sign_binary() {
+  exe_path=$1
+  identity=$2
+
+  if [ -x "$exe_path" ] && file -b "$exe_path" | grep -q "Mach-O"
+  then
+      echo "signing $exe_path ..."
+  else
+      echo "skip signing $exe_path ..."
+      return 0
+  fi
+
+  codesign \
+    -s "$identity" \
+    -f \
+    --verbose=4 \
+    --timestamp \
+    --options runtime \
+      $exe_path
+
+  if [ $? -ne 0 ]; then
+      exit_with_error "signing failed"
+  fi
+
+  codesign --verify "$exe_path"  --verbose=4
+
+  if [ $? -ne 0 ]; then
+      exit_with_error "signing verification failed"
+  fi
+}
+
+# sign_binaries_in_archive [archive-abs-path] [signing-identity]
+#
+# signs all binaries within an archive (there must be at least one)
+#
+sign_binaries_in_archive() {
+  archive_abs_path=$1
+  identity=$2
+  
+  scratch_path=$(mktemp -d)
+  trap "rm -rf -- $scratch_path" EXIT
+
+  title "getting contents from the release archive: $archive_abs_path"
+  tar -C "$scratch_path" -xvf "$archive_abs_path"
+  
+  # invalidate the current archive, we only want an asset with signed binaries from this point forward
+  rm "$archive_abs_path"
+  
+  title "signing binaries found in the release archive"
+  
+  discovered_binaries=0
+  tmp_pipe=$(mktemp -ut pipe.XXX)
+  mkfifo "$tmp_pipe"
+  
+  find "$scratch_path" -perm +111 -type f > "$tmp_pipe" &
+  
+  while IFS= read -r binary; do
+    sign_binary "$binary" "$identity"
+    ((discovered_binaries++))
+  done < "$tmp_pipe"
+  
+  rm "$tmp_pipe"
+  
+  if [ "$discovered_binaries" = "0" ]; then
+      exit_with_error "found no binaries to sign"
+  fi
+  
+  title "recreating the release archive: $archive_abs_path"
+  (cd "$scratch_path" && tar -czvf "$archive_abs_path" .)
+}
+

.github/scripts/apple-signing/utils.sh

@@ -0,0 +1,76 @@
+## terminal goodies
+PURPLE='\033[0;35m'
+GREEN='\033[0;32m'
+RED='\033[0;31m'
+BOLD=$(tput -T linux bold)
+RESET='\033[0m'
+
+function success() {
+  echo -e "\n${GREEN}${BOLD}$@${RESET}"
+}
+
+function title() {
+  success "Task: $@"
+}
+
+function commentary() {
+  echo -e "\n${PURPLE}# $@${RESET}"
+}
+
+function error() {
+  echo -e "${RED}${BOLD}error: $@${RESET}"
+}
+
+function exit_with_error() {
+  error $@
+  exit 1
+}
+
+function exit_with_message() {
+  success $@
+  exit 0
+}
+
+function realpath {
+  echo "$(cd $(dirname $1); pwd)/$(basename $1)";
+}
+
+
+# this function adds all of the existing keychains plus the new one which is the same as going to Keychain Access
+# and selecting "Add Keychain" to make the keychain visible under "Custom Keychains". This is done with
+# "security list-keychains -s" for some reason. The downside is that this sets the search path, not appends
+# to it, so you will loose existing keychains in the search path... which is truly terrible.
+function add_keychain() {
+  keychains=$(security list-keychains -d user)
+  keychainNames=();
+  for keychain in $keychains
+  do
+    basename=$(basename "$keychain")
+    keychainName=${basename::${#basename}-4}
+    keychainNames+=("$keychainName")
+  done
+
+  echo "existing user keychains: ${keychainNames[@]}"
+
+  security -v list-keychains -s "${keychainNames[@]}" "$1"
+}
+
+function exit_not_ci() {
+    printf "WARNING! It looks like this isn't the CI environment. This script modifies the macOS Keychain setup in ways you probably wouldn't want for your own machine. It also requires an Apple Developer ID Certificate that you shouldn't have outside of the CI environment.\n\nExiting early to make sure nothing bad happens.\n"
+    exit 1
+}
+
+CI_HOME="/Users/runner"
+
+function assert_in_ci() {
+
+  if [[ "${HOME}" != "${CI_HOME}" ]]; then
+    exit_not_ci
+  fi
+
+  set +u
+  if [ -z "${GITHUB_ACTIONS}" ]; then
+    exit_not_ci
+  fi
+  set -u
+}

.github/scripts/goreleaser-install.sh

@@ -338,7 +338,7 @@ hash_sha256_verify() {
 		return 1
 	fi
 	BASENAME=${TARGET##*/}
-	want=$(grep "${BASENAME}" "${checksums}" 2>/dev/null | tr '\t' ' ' | cut -d ' ' -f 1)
+	want=$(grep "${BASENAME}$" "${checksums}" 2>/dev/null | tr '\t' ' ' | cut -d ' ' -f 1)
 	if [ -z "$want" ]; then
 		log_err "hash_sha256_verify unable to find checksum for '${TARGET}' in '${checksums}'"
 		return 1

.github/scripts/mac-prepare-for-signing.sh

@@ -1,31 +0,0 @@
-#!/usr/bin/env bash
-set -eu
-
-CI_HOME="/Users/runner"
-if [[ "${HOME}" != "${CI_HOME}" ]]; then
-  printf "WARNING! It looks like this isn't the CI environment. This script modifies the macOS Keychain setup in ways you probably wouldn't want for your own machine. It also requires an Apple Developer ID Certificate that you shouldn't have outside of the CI environment.\n\nExiting early to make sure nothing bad happens.\n"
-  exit 1
-fi
-
-# Install gon (see https://github.com/mitchellh/gon for details).
-brew tap mitchellh/gon
-brew install mitchellh/gon/gon
-
-# Write signing certificate to disk from environment variable.
-CERT_FILE="$HOME/developer_id_certificate.p12"
-echo -n "$APPLE_DEVELOPER_ID_CERT" | base64 --decode > "$CERT_FILE"
-
-# In order to have all keychain interactions avoid an interactive user prompt, we need to control the password for the keychain in question, which means we need to create a new keychain into which we'll import the signing certificate and from which we'll later access this certificate during code signing.
-EPHEMERAL_KEYCHAIN="ci-ephemeral-keychain"
-EPHEMERAL_KEYCHAIN_PASSWORD="$(openssl rand -base64 100)"
-security create-keychain -p "${EPHEMERAL_KEYCHAIN_PASSWORD}" "${EPHEMERAL_KEYCHAIN}"
-
-# Import signing certificate into the keychain. (This is a pre-requisite for gon, which is invoked via goreleaser.)
-EPHEMERAL_KEYCHAIN_FULL_PATH="$HOME/Library/Keychains/${EPHEMERAL_KEYCHAIN}-db"
-security import "${CERT_FILE}" -k "${EPHEMERAL_KEYCHAIN_FULL_PATH}" -P "${APPLE_DEVELOPER_ID_CERT_PASS}" -T "$(command -v codesign)"
-
-# Setting the partition list for this certificate's private key to include "apple-tool:" and "apple:" allows the codesign command to access this keychain item without an interactive user prompt. (codesign is invoked by gon.)
-security set-key-partition-list -S "apple-tool:,apple:" -s -k "${EPHEMERAL_KEYCHAIN_PASSWORD}" "${EPHEMERAL_KEYCHAIN_FULL_PATH}"
-
-# Make this new keychain the user's default keychain, so that codesign will be able to find this certificate when we specify it during signing.
-security default-keychain -d "user" -s "${EPHEMERAL_KEYCHAIN_FULL_PATH}"

.github/scripts/mac-sign-and-notarize.sh

@@ -1,19 +0,0 @@
-#!/usr/bin/env bash
-set -eu
-
-IS_SNAPSHOT="$1"                        # e.g. "true", "false"
-
-if [[ "${IS_SNAPSHOT}" == "true" ]]; then
-  # This is a snapshot build —— skipping signing and notarization...
-  exit 0
-fi
-
-GON_CONFIG="$2"                                       # e.g. "gon.hcl"
-NEW_NAME_WITHOUT_EXTENSION="$3"                       # e.g. "./dist/syft-0.1.0"
-ORIGINAL_NAME_WITHOUT_EXTENSION="./dist/output"       # This should match dmg and zip output_path in the gon config file, without the extension.
-
-gon "${GON_CONFIG}"
-
-# Rename outputs with specified desired name
-mv -v "${ORIGINAL_NAME_WITHOUT_EXTENSION}.dmg" "${NEW_NAME_WITHOUT_EXTENSION}.dmg"
-mv -v "${ORIGINAL_NAME_WITHOUT_EXTENSION}.zip" "${NEW_NAME_WITHOUT_EXTENSION}.zip"

.github/scripts/verify-signature.sh

@@ -1,14 +0,0 @@
-#!/usr/bin/env bash
-set -ue
-
-DISTDIR=$1
-
-export FINGERPRINT=$(gpg --verify ${DISTDIR}/*checksums.txt.sig ${DISTDIR}/*checksums.txt 2>&1 | grep 'using RSA key' | awk '{ print $NF }')
-
-if [[ "${FINGERPRINT}" == "${SIGNING_FINGERPRINT}" ]]; then
-    echo 'verified signature'
-else
-    echo "signed with unknown fingerprint: ${FINGERPRINT}"
-    echo "           expected fingerprint: ${SIGNING_FINGERPRINT}"
-    exit 1
-fi

.github/workflows/release.yaml

@@ -14,7 +14,7 @@ env:
 jobs:
   quality-gate:
     environment: release
-    runs-on: ubuntu-latest # This OS choice is arbitrary. None of the steps in this job are specific to either Linux or macOS.
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
 
@@ -92,7 +92,8 @@ jobs:
 
   release:
     needs: [quality-gate]
-    runs-on: macos-latest # Due to our code signing process, it's vital that we run our release steps on macOS.
+    # due to our code signing process, it's vital that we run our release steps on macOS
+    runs-on: macos-latest
     steps:
       - uses: docker-practice/actions-setup-docker@v1
 
@@ -124,35 +125,21 @@ jobs:
         if: steps.tool-cache.outputs.cache-hit != 'true' || steps.go-cache.outputs.cache-hit != 'true'
         run: make bootstrap
 
-      - name: Import GPG key
-        id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@v2
-        env:
-          GPG_PRIVATE_KEY: ${{ secrets.SIGNING_GPG_PRIVATE_KEY }}
-          PASSPHRASE: ${{ secrets.SIGNING_GPG_PASSPHRASE }}
-
-      - name: GPG signing info
-        run: |
-          echo "fingerprint: ${{ steps.import_gpg.outputs.fingerprint }}"
-          echo "keyid:       ${{ steps.import_gpg.outputs.keyid }}"
-          echo "name:        ${{ steps.import_gpg.outputs.name }}"
-          echo "email:       ${{ steps.import_gpg.outputs.email }}"
-
       - name: Build & publish release artifacts
         run: make release
         env:
           DOCKER_USERNAME: ${{ secrets.TOOLBOX_DOCKER_USER }}
           DOCKER_PASSWORD: ${{ secrets.TOOLBOX_DOCKER_PASS }}
+          # we use a different token than GITHUB_SECRETS to additionally allow updating the homebrew repos
           GITHUB_TOKEN: ${{ secrets.ANCHORE_GIT_READ_TOKEN }}
-          GPG_PRIVATE_KEY: ${{ secrets.SIGNING_GPG_PRIVATE_KEY }}
-          PASSPHRASE: ${{ secrets.SIGNING_GPG_PASSPHRASE }}
-          SIGNING_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
           AWS_ACCESS_KEY_ID: ${{ secrets.TOOLBOX_AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLBOX_AWS_SECRET_ACCESS_KEY }}
-          APPLE_DEVELOPER_ID_CERT: ${{ secrets.APPLE_DEVELOPER_ID_CERT }} # Used during macOS code signing.
-          APPLE_DEVELOPER_ID_CERT_PASS: ${{ secrets.APPLE_DEVELOPER_ID_CERT_PASS }} # Used during macOS code signing.
-          AC_USERNAME: ${{ secrets.ENG_CI_APPLE_ID }} # Used during macOS notarization.
-          AC_PASSWORD: ${{ secrets.ENG_CI_APPLE_ID_PASS }} # Used during macOS notarization.
+          # used during macOS code signing
+          APPLE_DEVELOPER_ID_CERT: ${{ secrets.APPLE_DEVELOPER_ID_CERT }}
+          APPLE_DEVELOPER_ID_CERT_PASS: ${{ secrets.APPLE_DEVELOPER_ID_CERT_PASS }}
+          # used during macOS notarization
+          AC_USERNAME: ${{ secrets.ENG_CI_APPLE_ID }}
+          AC_PASSWORD: ${{ secrets.ENG_CI_APPLE_ID_PASS }}
 
       - uses: anchore/sbom-action@v0
         with:

.github/workflows/validations.yaml

@@ -276,8 +276,30 @@ jobs:
           name: artifacts
           path: snapshot
 
-      - name: Run Acceptance Tests (Linux)
-        run: make acceptance-linux
+      - name: Run comparison tests (Linux)
+        run: make compare-linux
+
+      - name: Build key for image cache
+        run: make install-fingerprint
+
+      - name: Restore install.sh test image cache
+        id: install-test-image-cache
+        uses: actions/cache@v2.1.3
+        with:
+          path: ${{ github.workspace }}/test/install/cache
+          key: ${{ runner.os }}-install-test-image-cache-${{ hashFiles('test/install/cache.fingerprint') }}
+
+      - name: Load test image cache
+        if: steps.install-test-image-cache.outputs.cache-hit == 'true'
+        run: make install-test-cache-load
+
+      - name: Run install.sh tests (Linux)
+        run: make install-test
+
+      - name: (cache-miss) Create test image cache
+        if: steps.install-test-image-cache.outputs.cache-hit != 'true'
+        run: make install-test-cache-save
+
 
   Acceptance-Mac:
     # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
@@ -292,15 +314,18 @@ jobs:
           name: artifacts
           path: snapshot
 
-      - name: Restore docker image cache
-        id: go-cache
+      - name: Restore docker image cache for compare testing
+        id: mac-compare-testing-cache
         uses: actions/cache@v2.1.3
         with:
           path: image.tar
-          key: ${{ runner.os }}-${{ hashFiles('test/acceptance/mac.sh') }}
+          key: ${{ runner.os }}-${{ hashFiles('test/compare/mac.sh') }}
 
-      - name: Run Acceptance Tests (Mac)
-        run: make acceptance-mac
+      - name: Run comparison tests (Mac)
+        run: make compare-mac
+
+      - name: Run install.sh tests (Mac)
+        run: make install-test-ci-mac
 
   Cli-Linux:
     # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline

.gitignore

@@ -18,6 +18,7 @@ CHANGELOG.md
 .images
 .tmp/
 coverage.txt
+bin/
 
 # Binaries for programs and plugins
 *.exe

.goreleaser.yaml

@@ -1,87 +1,77 @@
 release:
-  # If set to auto, will mark the release as not ready for production in case there is an indicator for this in the
-  # tag e.g. v1.0.0-rc1 .If set to true, will mark the release as not ready for production.
   prerelease: auto
-
-  # If set to true, will not auto-publish the release. This is done to allow us to review the changelog before publishing.
   draft: true
 
+env:
+  # required to support multi architecture docker builds
+  - DOCKER_CLI_EXPERIMENTAL=enabled
+
 builds:
-  - binary: syft
-    id: syft
-    env:
-      - CGO_ENABLED=0
+  - id: linux-build
+    binary: syft
     goos:
       - linux
-      - windows
     goarch:
       - amd64
       - arm64
-    # Set the modified timestamp on the output binary to the git timestamp (to ensure a reproducible build)
-    mod_timestamp: '{{ .CommitTimestamp }}'
-    ldflags: |
+    # set the modified timestamp on the output binary to the git timestamp to ensure a reproducible build
+    mod_timestamp: &build-timestamp '{{ .CommitTimestamp }}'
+    env: &build-env
+      - CGO_ENABLED=0
+    ldflags: &build-ldflags |
       -w
       -s
       -extldflags '-static'
       -X github.com/anchore/syft/internal/version.version={{.Version}}
       -X github.com/anchore/syft/internal/version.gitCommit={{.Commit}}
       -X github.com/anchore/syft/internal/version.buildDate={{.Date}}
-      -X github.com/anchore/syft/internal/version.gitTreeState={{.Env.BUILD_GIT_TREE_STATE}}
+      -X github.com/anchore/syft/internal/version.gitDescription={{.Summary}}
 
-    # For more info on this macOS build, see: https://github.com/mitchellh/gon#usage-with-goreleaser
-  - binary: syft
-    id: syft-macos
-    env:
-      - CGO_ENABLED=0
+  - id: darwin-build
+    binary: syft
     goos:
       - darwin
     goarch:
       - amd64
       - arm64
-    # Set the modified timestamp on the output binary to the git timestamp (to ensure a reproducible build)
-    mod_timestamp: '{{ .CommitTimestamp }}'
-    ldflags: |
-      -w
-      -s
-      -extldflags '-static'
-      -X github.com/anchore/syft/internal/version.version={{.Version}}
-      -X github.com/anchore/syft/internal/version.gitCommit={{.Commit}}
-      -X github.com/anchore/syft/internal/version.buildDate={{.Date}}
-      -X github.com/anchore/syft/internal/version.gitTreeState={{.Env.BUILD_GIT_TREE_STATE}}
+    mod_timestamp: *build-timestamp
+    env: *build-env
+    ldflags: *build-ldflags
+
+  - id: windows-build
+    binary: syft
+    goos:
+      - windows
+    goarch:
+      - amd64
+    mod_timestamp: *build-timestamp
+    env: *build-env
+    ldflags: *build-ldflags
 
 archives:
-  - name_template: '{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}'
-    id: syft
-    replacements:
-      windows: Windows
-      amd64: x86_64
-    format_overrides:
-    - goos: windows
-      format: zip
-
-  - format: zip # This is a hack for syft-macos! We don't actually intend to use _this_ ZIP file, we just need goreleaser to consider the ZIP file produced by gon (which will have the same file name) to be an artifact so we can use it downstream in publishing (e.g. to a homebrew tap)
-    id: syft-exception
+  - id: linux-archives
     builds:
-      - syft-macos
+      - linux-build
+
+  # note: the signing process is depending on tar.gz archives. If this format changes then .github/scripts/apple-signing/*.sh will need to be adjusted
+  - id: darwin-archives
+    builds:
+      - darwin-build
+
+  - id: windows-archives
+    format: zip
+    builds:
+      - windows-build
 
 signs:
-  - artifacts: checksum
-    cmd: sh
-    args:
-      - '-c'
-      # we should not include the zip artifact, as the artifact is mutated throughout the next macOS notarization step
-      # note: sed -i is not portable
-      - 'sed "/.*\.zip/d" ${artifact} > tmpfile && mv tmpfile ${artifact} && gpg --output ${signature} --detach-sign ${artifact}'
-  - id: syft-macos-signing
+  - artifacts: archive
     ids:
-      - syft-macos
-    cmd: ./.github/scripts/mac-sign-and-notarize.sh
-    signature: "syft_${VERSION}_darwin_amd64.dmg" # This is somewhat unintuitive. This gets the DMG file recognized as an artifact. In fact, both a DMG and a ZIP file are being produced by this signing step.
+      - darwin-archives
+    signature: "${artifact}"
+    cmd: ./.github/scripts/apple-signing/run.sh
     args:
+      - "${artifact}"
       - "{{ .IsSnapshot }}"
-      - "gon.hcl"
-      - "./dist/syft_{{ .Version }}_darwin_amd64"
-    artifacts: all
 
 nfpms:
   - license: "Apache 2.0"
@@ -97,7 +87,8 @@ brews:
       owner: anchore
       name: homebrew-syft
     ids:
-    - syft
+      - darwin-archives
+      - linux-archives
     homepage: *website
     description: *description
     license: "Apache License 2.0"

DEVELOPING.md

@@ -32,10 +32,10 @@ The main make tasks for common static analysis and testing are `lint`, `lint-fix
   for in-depth testing of code in the `cmd/` package (such as testing the proper behavior of application configuration,
   CLI switches, and glue code before syft library calls).
 
-- `acceptance`: located within `test/acceptance`, these are smoke-like tests that ensure that application packaging
-  and installation works as expected. For example, during release we provide RPM packages as a download artifact. We 
-  also have an accompanying RPM acceptance test that installs the RPM from a snapshot build and ensures the output
-  of a syft invocation matches canned expected output. New acceptance tests should be added for each release artifact
+- `acceptance`: located within `test/compare` and `test/install`, these are smoke-like tests that ensure that application  
+  packaging and installation works as expected. For example, during release we provide RPM packages as a download 
+  artifact. We also have an accompanying RPM acceptance test that installs the RPM from a snapshot build and ensures the 
+  output of a syft invocation matches canned expected output. New acceptance tests should be added for each release artifact
   and architecture supported (when possible).
 
 ### Data diversity and freshness assertions

Dockerfile

@@ -16,13 +16,14 @@ ARG BUILD_VERSION
 ARG VCS_REF
 ARG VCS_URL
 
-LABEL org.label-schema.schema-version="1.0"
-LABEL org.label-schema.build-date=$BUILD_DATE
-LABEL org.label-schema.name="syft"
-LABEL org.label-schema.description="CLI tool and library for generating a Software Bill of Materials from container images and filesystems"
-LABEL org.label-schema.vcs-url=$VCS_URL
-LABEL org.label-schema.vcs-ref=$VCS_REF
-LABEL org.label-schema.vendor="Anchore, Inc."
-LABEL org.label-schema.version=$BUILD_VERSION
+LABEL org.opencontainers.image.created=$BUILD_DATE
+LABEL org.opencontainers.image.title="syft"
+LABEL org.opencontainers.image.description="CLI tool and library for generating a Software Bill of Materials from container images and filesystems"
+LABEL org.opencontainers.image.source=$VCS_URL
+LABEL org.opencontainers.image.revision=$VCS_REF
+LABEL org.opencontainers.image.vendor="Anchore, Inc."
+LABEL org.opencontainers.image.version=$BUILD_VERSION
+LABEL org.opencontainers.image.licenses="Apache-2.0"
+
 
 ENTRYPOINT ["/syft"]

Makefile

@@ -4,8 +4,12 @@ RESULTSDIR = test/results
 COVER_REPORT = $(RESULTSDIR)/unit-coverage-details.txt
 COVER_TOTAL = $(RESULTSDIR)/unit-coverage-summary.txt
 LINTCMD = $(TEMPDIR)/golangci-lint run --tests=false --timeout=2m --config .golangci.yaml
-ACC_TEST_IMAGE = centos:8.2.2004
-ACC_DIR = ./test/acceptance
+RELEASE_CMD=$(TEMPDIR)/goreleaser release --rm-dist
+SNAPSHOT_CMD=$(RELEASE_CMD) --skip-publish --snapshot
+COMPARE_TEST_IMAGE = centos:8.2.2004
+COMPARE_DIR = ./test/compare
+
+# formatting variables
 BOLD := $(shell tput -T linux bold)
 PURPLE := $(shell tput -T linux setaf 5)
 GREEN := $(shell tput -T linux setaf 2)
@@ -14,8 +18,10 @@ RED := $(shell tput -T linux setaf 1)
 RESET := $(shell tput -T linux sgr0)
 TITLE := $(BOLD)$(PURPLE)
 SUCCESS := $(BOLD)$(GREEN)
+
 # the quality gate lower threshold for unit test total % coverage (by function statements)
 COVERAGE_THRESHOLD := 62
+
 # CI cache busting values; change these if you want CI to not use previous stored cache
 INTEGRATION_CACHE_BUSTER="894d8ca"
 CLI_CACHE_BUSTER="894d8ca"
@@ -24,18 +30,8 @@ BOOTSTRAP_CACHE="c7afb99ad"
 ## Build variables
 DISTDIR=./dist
 SNAPSHOTDIR=./snapshot
-GITTREESTATE=$(if $(shell git status --porcelain),dirty,clean)
-OS := $(shell uname)
-
-ifeq ($(OS),Darwin)
-	SNAPSHOT_CMD=$(shell realpath $(shell pwd)/$(SNAPSHOTDIR)/$(BIN)-macos_darwin_amd64/$(BIN))
-else
-	SNAPSHOT_CMD=$(shell realpath $(shell pwd)/$(SNAPSHOTDIR)/$(BIN)_linux_amd64/$(BIN))
-endif
-
-ifeq "$(strip $(VERSION))" ""
- override VERSION = $(shell git describe --always --tags --dirty)
-endif
+OS=$(shell uname | tr '[:upper:]' '[:lower:]')
+SNAPSHOT_BIN=$(shell realpath $(shell pwd)/$(SNAPSHOTDIR)/$(OS)-build_$(OS)_amd64/$(BIN))
 
 ## Variable assertions
 
@@ -47,8 +43,8 @@ ifndef RESULTSDIR
 	$(error RESULTSDIR is not set)
 endif
 
-ifndef ACC_DIR
-	$(error ACC_DIR is not set)
+ifndef COMPARE_DIR
+	$(error COMPARE_DIR is not set)
 endif
 
 ifndef DISTDIR
@@ -67,14 +63,22 @@ define title
     @printf '$(TITLE)$(1)$(RESET)\n'
 endef
 
+define safe_rm_rf
+	bash -c 'test -z "$(1)" && false || rm -rf $(1)'
+endef
+
+define safe_rm_rf_children
+	bash -c 'test -z "$(1)" && false || rm -rf $(1)/*'
+endef
+
 ## Tasks
 
 .PHONY: all
-all: clean static-analysis test ## Run all linux-based checks (linting, license check, unit, integration, and linux acceptance tests)
+all: clean static-analysis test ## Run all linux-based checks (linting, license check, unit, integration, and linux compare tests)
 	@printf '$(SUCCESS)All checks pass!$(RESET)\n'
 
 .PHONY: test
-test: unit validate-cyclonedx-schema integration benchmark acceptance-linux cli ## Run all tests (currently unit, integration, linux acceptance, and cli tests)
+test: unit validate-cyclonedx-schema integration benchmark compare-linux cli ## Run all tests (currently unit, integration, linux compare, and cli tests)
 
 .PHONY: help
 help:
@@ -98,9 +102,9 @@ $(TEMPDIR):
 bootstrap-tools: $(TEMPDIR)
 	GO111MODULE=off GOBIN=$(shell realpath $(TEMPDIR)) go get -u golang.org/x/perf/cmd/benchstat
 	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(TEMPDIR)/ v1.42.1
-	curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMPDIR)/ v0.2.0
+	curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMPDIR)/ v0.3.0
 	curl -sSfL https://raw.githubusercontent.com/anchore/chronicle/main/install.sh | sh -s -- -b $(TEMPDIR)/ v0.3.0
-	.github/scripts/goreleaser-install.sh -b $(TEMPDIR)/ v0.177.0
+	.github/scripts/goreleaser-install.sh -d -b $(TEMPDIR)/ v1.3.1
 	GOBIN="$(shell realpath $(TEMPDIR))" go install github.com/neilpa/yajsv@v1.4.0
 
 .PHONY: bootstrap-go
@@ -167,20 +171,42 @@ benchmark: $(RESULTSDIR) ## Run benchmark tests and compare against the baseline
 show-benchstat:
 	@cat $(RESULTSDIR)/benchstat.txt
 
+# note: this is used by CI to determine if the install test fixture cache (docker image tars) should be busted
+install-fingerprint:
+	cd test/install && \
+		make cache.fingerprint
+
+install-test: $(SNAPSHOTDIR)
+	cd test/install && \
+		make
+
+install-test-cache-save: $(SNAPSHOTDIR)
+	cd test/install && \
+		make save
+
+install-test-cache-load: $(SNAPSHOTDIR)
+	cd test/install && \
+		make load
+
+install-test-ci-mac: $(SNAPSHOTDIR)
+	cd test/install && \
+		make ci-test-mac
+
 .PHONY: integration
 integration: ## Run integration tests
 	$(call title,Running integration tests)
-
 	go test -v ./test/integration
 
 # note: this is used by CI to determine if the integration test fixture cache (docker image tars) should be busted
 integration-fingerprint:
-	find test/integration/test-fixtures/image-* -type f -exec md5sum {} + | awk '{print $1}' | sort | md5sum | tee test/integration/test-fixtures/cache.fingerprint && echo "$(INTEGRATION_CACHE_BUSTER)" >> test/integration/test-fixtures/cache.fingerprint
+	$(call title,Integration test fixture fingerprint)
+	find test/integration/test-fixtures/image-* -type f -exec md5sum {} + | awk '{print $1}' | sort | tee /dev/stderr | md5sum | tee test/integration/test-fixtures/cache.fingerprint && echo "$(INTEGRATION_CACHE_BUSTER)" >> test/integration/test-fixtures/cache.fingerprint
 
 .PHONY: java-packages-fingerprint
 java-packages-fingerprint:
-	@cd syft/pkg/cataloger/java/test-fixtures/java-builds && \
-	make packages.fingerprint
+	$(call title,Java test fixture fingerprint)
+	cd syft/pkg/cataloger/java/test-fixtures/java-builds && \
+		make packages.fingerprint
 
 .PHONY: fixtures
 fixtures:
@@ -201,57 +227,72 @@ build: $(SNAPSHOTDIR) ## Build release snapshot binaries and packages
 
 $(SNAPSHOTDIR): ## Build snapshot release binaries and packages
 	$(call title,Building snapshot artifacts)
+
 	# create a config with the dist dir overridden
 	echo "dist: $(SNAPSHOTDIR)" > $(TEMPDIR)/goreleaser.yaml
 	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml
 
 	# build release snapshots
-	# DOCKER_CLI_EXPERIMENTAL needed to support multi architecture builds for goreleaser
-	BUILD_GIT_TREE_STATE=$(GITTREESTATE) \
-	DOCKER_CLI_EXPERIMENTAL=enabled \
-	$(TEMPDIR)/goreleaser release --skip-publish --skip-sign --rm-dist --snapshot --config $(TEMPDIR)/goreleaser.yaml
+	$(SNAPSHOT_CMD) --skip-sign --config $(TEMPDIR)/goreleaser.yaml
+
+.PHONY: snapshot-with-signing
+snapshot-with-signing: ## Build snapshot release binaries and packages (with dummy signing)
+	$(call title,Building snapshot artifacts (+ signing))
+
+	# create a config with the dist dir overridden
+	echo "dist: $(SNAPSHOTDIR)" > $(TEMPDIR)/goreleaser.yaml
+	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml
+
+	rm -f .github/scripts/apple-signing/log/signing-*
+
+	# build release snapshots
+	bash -c "$(SNAPSHOT_CMD) --config $(TEMPDIR)/goreleaser.yaml || (cat .github/scripts/apple-signing/log/signing-* && false)"
+
+	# remove the keychain with the trusted self-signed cert automatically
+	.github/scripts/apple-signing/cleanup.sh
 
 # note: we cannot clean the snapshot directory since the pipeline builds the snapshot separately
-.PHONY: acceptance-mac
-acceptance-mac: $(RESULTSDIR) $(SNAPSHOTDIR) ## Run acceptance tests on build snapshot binaries and packages (Mac)
-	$(call title,Running acceptance test: Run on Mac)
-	$(ACC_DIR)/mac.sh \
+.PHONY: compare-mac
+compare-mac: $(RESULTSDIR) $(SNAPSHOTDIR) ## Run compare tests on build snapshot binaries and packages (Mac)
+	$(call title,Running compare test: Run on Mac)
+	$(COMPARE_DIR)/mac.sh \
 			$(SNAPSHOTDIR) \
-			$(ACC_DIR) \
-			$(ACC_TEST_IMAGE) \
+			$(COMPARE_DIR) \
+			$(COMPARE_TEST_IMAGE) \
 			$(RESULTSDIR)
 
 # note: we cannot clean the snapshot directory since the pipeline builds the snapshot separately
-.PHONY: acceptance-linux
-acceptance-linux: acceptance-test-deb-package-install acceptance-test-rpm-package-install ## Run acceptance tests on build snapshot binaries and packages (Linux)
+.PHONY: compare-linux
+compare-linux: compare-test-deb-package-install compare-test-rpm-package-install ## Run compare tests on build snapshot binaries and packages (Linux)
 
-.PHONY: acceptance-test-deb-package-install
-acceptance-test-deb-package-install: $(RESULTSDIR) $(SNAPSHOTDIR)
-	$(call title,Running acceptance test: DEB install)
-	$(ACC_DIR)/deb.sh \
+.PHONY: compare-test-deb-package-install
+compare-test-deb-package-install: $(RESULTSDIR) $(SNAPSHOTDIR)
+	$(call title,Running compare test: DEB install)
+	$(COMPARE_DIR)/deb.sh \
 			$(SNAPSHOTDIR) \
-			$(ACC_DIR) \
-			$(ACC_TEST_IMAGE) \
+			$(COMPARE_DIR) \
+			$(COMPARE_TEST_IMAGE) \
 			$(RESULTSDIR)
 
-.PHONY: acceptance-test-rpm-package-install
-acceptance-test-rpm-package-install: $(RESULTSDIR) $(SNAPSHOTDIR)
-	$(call title,Running acceptance test: RPM install)
-	$(ACC_DIR)/rpm.sh \
+.PHONY: compare-test-rpm-package-install
+compare-test-rpm-package-install: $(RESULTSDIR) $(SNAPSHOTDIR)
+	$(call title,Running compare test: RPM install)
+	$(COMPARE_DIR)/rpm.sh \
 			$(SNAPSHOTDIR) \
-			$(ACC_DIR) \
-			$(ACC_TEST_IMAGE) \
+			$(COMPARE_DIR) \
+			$(COMPARE_TEST_IMAGE) \
 			$(RESULTSDIR)
 
 # note: this is used by CI to determine if the integration test fixture cache (docker image tars) should be busted
 cli-fingerprint:
+	$(call title,CLI test fixture fingerprint)
 	find test/cli/test-fixtures/image-* -type f -exec md5sum {} + | awk '{print $1}' | sort | md5sum | tee test/cli/test-fixtures/cache.fingerprint && echo "$(CLI_CACHE_BUSTER)" >> test/cli/test-fixtures/cache.fingerprint
 
 .PHONY: cli
 cli: $(SNAPSHOTDIR) ## Run CLI tests
-	chmod 755 "$(SNAPSHOT_CMD)"
-	$(SNAPSHOT_CMD) version
-	SYFT_BINARY_LOCATION='$(SNAPSHOT_CMD)' \
+	chmod 755 "$(SNAPSHOT_BIN)"
+	$(SNAPSHOT_BIN) version
+	SYFT_BINARY_LOCATION='$(SNAPSHOT_BIN)' \
 		go test -count=1 -v ./test/cli
 
 .PHONY: changelog
@@ -268,10 +309,6 @@ CHANGELOG.md:
 .PHONY: release
 release: clean-dist CHANGELOG.md  ## Build and publish final binaries and packages. Intended to be run only on macOS.
 	$(call title,Publishing release artifacts)
-
-	# Prepare for macOS-specific signing process
-	.github/scripts/mac-prepare-for-signing.sh
-
 	# login to docker
 	# note: the previous step creates a new keychain, so it is important to reauth into docker.io
 	@echo $${DOCKER_PASSWORD} | docker login docker.io -u $${DOCKER_USERNAME}  --password-stdin
@@ -280,19 +317,15 @@ release: clean-dist CHANGELOG.md  ## Build and publish final binaries and packag
 	echo "dist: $(DISTDIR)" > $(TEMPDIR)/goreleaser.yaml
 	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml
 
-	# release (note the version transformation from v0.7.0 --> 0.7.0)
-	# DOCKER_CLI_EXPERIMENTAL needed to support multi architecture builds for goreleaser
-	bash -c "\
-		BUILD_GIT_TREE_STATE=$(GITTREESTATE) \
-		VERSION=$(VERSION:v%=%) \
-		DOCKER_CLI_EXPERIMENTAL=enabled \
-		$(TEMPDIR)/goreleaser \
-			--rm-dist \
-			--config $(TEMPDIR)/goreleaser.yaml \
-			--release-notes <(cat CHANGELOG.md)"
+	rm -f .github/scripts/apple-signing/log/signing-*
 
-	# verify checksum signatures
-	.github/scripts/verify-signature.sh "$(DISTDIR)"
+	bash -c "\
+		$(RELEASE_CMD) \
+			--config $(TEMPDIR)/goreleaser.yaml \
+			--release-notes <(cat CHANGELOG.md)\
+				 || cat .github/scripts/apple-signing/log/signing-* && false"
+
+	cat .github/scripts/apple-signing/log/signing-*
 
 	# upload the version file that supports the application version update check (excluding pre-releases)
 	.github/scripts/update-version-file.sh "$(DISTDIR)" "$(VERSION)"
@@ -300,15 +333,17 @@ release: clean-dist CHANGELOG.md  ## Build and publish final binaries and packag
 
 .PHONY: clean
 clean: clean-dist clean-snapshot clean-test-image-cache ## Remove previous builds, result reports, and test cache
-	rm -rf $(RESULTSDIR)/*
+	$(call safe_rm_rf_children,$(RESULTSDIR))
 
 .PHONY: clean-snapshot
 clean-snapshot:
-	rm -rf $(SNAPSHOTDIR) $(TEMPDIR)/goreleaser.yaml
+	$(call safe_rm_rf,$(SNAPSHOTDIR))
+	rm -f $(TEMPDIR)/goreleaser.yaml
 
 .PHONY: clean-dist
 clean-dist: clean-changelog
-	rm -rf $(DISTDIR) $(TEMPDIR)/goreleaser.yaml
+	$(call safe_rm_rf,$(DISTDIR))
+	rm -f $(TEMPDIR)/goreleaser.yaml
 
 .PHONY: clean-changelog
 clean-changelog:

README.md

@@ -21,7 +21,7 @@ A CLI tool and Go library for generating a Software Bill of Materials (SBOM) fro
 
 ## Features
 - Catalog container images and filesystems to discover packages and libraries.
-- Supports packages and libraries from various ecosystems (APK, DEB, RPM, Ruby Bundles, Python Wheel/Egg/requirements.txt, JavaScript NPM/Yarn, Java JAR/EAR/WAR/PAR/SAR, Jenkins plugins JPI/HPI, Go modules)
+- Supports packages and libraries from various ecosystems (APK, DEB, RPM, Ruby Bundles, Python Wheel/Egg/requirements.txt, JavaScript NPM/Yarn, Java JAR/EAR/WAR/PAR/SAR, Jenkins plugins JPI/HPI, Go modules, PHP Composer)
 - Linux distribution identification (supports Alpine, BusyBox, CentOS/RedHat, Debian/Ubuntu flavored distributions)
 - Supports Docker and OCI image formats
 - Direct support for [Grype](https://github.com/anchore/grype), a fast and powerful vulnerability matcher.
@@ -269,7 +269,7 @@ package:
   # note: for now this only applies to the java package cataloger
   # SYFT_PACKAGE_SEARCH_UNINDEXED_ARCHIVES env var
   search-unindexed-archives: false
-   
+
   cataloger:
     # enable/disable cataloging of packages
     # SYFT_PACKAGE_CATALOGER_ENABLED env var
@@ -366,9 +366,9 @@ registry:
 
   # credentials for specific registries
   auth:
-    - # the URL to the registry (e.g. "docker.io", "localhost:5000", etc.)
+      # the URL to the registry (e.g. "docker.io", "localhost:5000", etc.)
       # SYFT_REGISTRY_AUTH_AUTHORITY env var
-      authority: ""
+    - authority: ""
       # SYFT_REGISTRY_AUTH_USERNAME env var
       username: ""
       # SYFT_REGISTRY_AUTH_PASSWORD env var
@@ -376,7 +376,7 @@ registry:
       # note: token and username/password are mutually exclusive
       # SYFT_REGISTRY_AUTH_TOKEN env var
       token: ""
-    - ... # note, more credentials can be provided via config file only
+      # - ... # note, more credentials can be provided via config file only
 
 log:
   # use structured logging
@@ -412,5 +412,36 @@ anchore:
   # (feature-preview) path to dockerfile to be uploaded with the syft results to Anchore Enterprise (supported on Enterprise 3.0+)
   # same as -d ; SYFT_ANCHORE_DOCKERFILE env var
   dockerfile: ""
-
 ```
+
+### Adding an SBOM to an image as an attestation
+SBOMs themselves can serve as input to different analysis tools. The Anchore organization offers the vulnerability scanner
+[grype](https://github.com/anchore/grype) as one such tool.
+One of the foundational approaches to "trust" between tools is for producers to use the artifacts generated by syft as attestations to their images.
+The SBOM output of syft can be used with the [cosign](https://github.com/sigstore/cosign) tool to generate an attestation that is attached to a signed image.
+
+#### Example attest
+Note for the following example replace `test/image:latest` with an image you own. You should also have push access to 
+its remote reference. Replace $MY_PRIVATE_KEY with a private key you own or have generated with cosign.
+
+```bash
+cosign sign --key $MY_PRIVATE_KEY test/image:latest
+syft test/image:latest -o json > test_latest_sbom.json
+cosign attest --predicate test_latest_sbom.json --key $MY_PRIVATE_KEY test/image:latest
+```
+
+Verify the new attestation exists on your image
+```bash
+cosign verify-attestation -key $MY_PUBLIC_KEY test/image:latest | jq '.payload |= @base64d | .payload | fromjson | .predicate.Data | fromjson | .'
+```
+
+You should see this output along with the attached SBOM.
+```
+Verification for test/image:latest --
+The following checks were performed on each of these signatures:
+  - The cosign claims were validated
+  - The signatures were verified against the specified public key
+  - Any certificates were verified against the Fulcio roots.
+```
+
+Consumers of your image can now trust that the SBOM associated with your image is correct and from a trusted source.

cmd/version.go

@@ -29,14 +29,14 @@ func printVersion(_ *cobra.Command, _ []string) {
 
 	switch outputFormat {
 	case "text":
-		fmt.Println("Application:  ", internal.ApplicationName)
-		fmt.Println("Version:      ", versionInfo.Version)
-		fmt.Println("BuildDate:    ", versionInfo.BuildDate)
-		fmt.Println("GitCommit:    ", versionInfo.GitCommit)
-		fmt.Println("GitTreeState: ", versionInfo.GitTreeState)
-		fmt.Println("Platform:     ", versionInfo.Platform)
-		fmt.Println("GoVersion:    ", versionInfo.GoVersion)
-		fmt.Println("Compiler:     ", versionInfo.Compiler)
+		fmt.Println("Application:    ", internal.ApplicationName)
+		fmt.Println("Version:        ", versionInfo.Version)
+		fmt.Println("BuildDate:      ", versionInfo.BuildDate)
+		fmt.Println("GitCommit:      ", versionInfo.GitCommit)
+		fmt.Println("GitDescription: ", versionInfo.GitDescription)
+		fmt.Println("Platform:       ", versionInfo.Platform)
+		fmt.Println("GoVersion:      ", versionInfo.GoVersion)
+		fmt.Println("Compiler:       ", versionInfo.Compiler)
 
 	case "json":
 		enc := json.NewEncoder(os.Stdout)

go.mod

@@ -13,16 +13,17 @@ require (
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29
-	github.com/anchore/stereoscope v0.0.0-20220110181730-c91cf94a3718
+	github.com/anchore/stereoscope v0.0.0-20220201190559-f162f1e96f45
 	// we are hinting brotli to latest due to warning when installing archiver v3:
 	// go: warning: github.com/andybalholm/brotli@v1.0.1: retracted by module author: occasional panics and data corruption
 	github.com/andybalholm/brotli v1.0.4 // indirect
 	github.com/antihax/optional v1.0.0
 	github.com/bmatcuk/doublestar/v4 v4.0.2
-	github.com/docker/docker v20.10.11+incompatible
+	github.com/containerd/containerd v1.5.9 // indirect
+	github.com/docker/docker v20.10.12+incompatible
 	github.com/dustin/go-humanize v1.0.0
 	github.com/facebookincubator/nvdtools v0.1.4
-	github.com/go-test/deep v1.0.7
+	github.com/go-test/deep v1.0.8
 	github.com/google/go-cmp v0.5.6
 	github.com/google/uuid v1.2.0
 	github.com/gookit/color v1.2.7

go.sum

@@ -111,8 +111,8 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZV
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29 h1:K9LfnxwhqvihqU0+MF325FNy7fsKV9EGaUxdfR4gnWk=
 github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29/go.mod h1:Oc1UkGaJwY6ND6vtAqPSlYrptKRJngHwkwB6W7l1uP0=
-github.com/anchore/stereoscope v0.0.0-20220110181730-c91cf94a3718 h1:46+DtmTaPlOCuY5KY3H6zazuz3+E/DSwc+ZpfPhyj50=
-github.com/anchore/stereoscope v0.0.0-20220110181730-c91cf94a3718/go.mod h1:OHhT0g7HQlELWJgZE80dJ0rCbMPIR+jIM8KNwN7ReKU=
+github.com/anchore/stereoscope v0.0.0-20220201190559-f162f1e96f45 h1:GYwI1qXcGh7fmyUWLK41suUXYfmrvGWWKGh0cw+k6ug=
+github.com/anchore/stereoscope v0.0.0-20220201190559-f162f1e96f45/go.mod h1:QpDHHV2h1NNfu7klzU75XC8RvSlaPK6HHgi0dy8A6sk=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
 github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY3JY=
@@ -291,15 +291,16 @@ github.com/dgrijalva/jwt-go v0.0.0-20170104182250-a601269ab70c/go.mod h1:E3ru+11
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
 github.com/dnaeon/go-vcr v1.0.1/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyGc8n1E=
-github.com/docker/cli v20.10.10+incompatible h1:kcbwdgWbrBOH8QwQzaJmyriHwF7XIl4HT1qh0HTRys4=
 github.com/docker/cli v20.10.10+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v20.10.12+incompatible h1:lZlz0uzG+GH+c0plStMUdF/qk3ppmgnswpR5EbqzVGA=
+github.com/docker/cli v20.10.12+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v0.0.0-20190905152932-14b96e55d84c/go.mod h1:0+TTO4EOBfRPhZXAeF1Vu+W3hHZ8eLp8PgKVZlcvtFY=
 github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.7.1+incompatible h1:a5mlkVzth6W5A4fOsS3D2EO5BUmsJpcB+cRlLU7cSug=
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker v20.10.10+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v20.10.11+incompatible h1:OqzI/g/W54LczvhnccGqniFoQghHx3pklbLuhfXpqGo=
-github.com/docker/docker v20.10.11+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v20.10.12+incompatible h1:CEeNmFM0QZIsJCZKMkZx0ZcahTiewkrgiwfYD+dfl1U=
+github.com/docker/docker v20.10.12+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.6.4 h1:axCks+yV+2MR3/kZhAmy07yC56WZ2Pwu/fKWtKuZB0o=
 github.com/docker/docker-credential-helpers v0.6.4/go.mod h1:ofX3UI0Gz1TteYBjtgs07O36Pyasyp66D2uKT7H8W1c=
 github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
@@ -343,8 +344,8 @@ github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMo
 github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa/go.mod h1:KnogPXtdwXqoenmZCw6S+25EAm2MkxbG0deNDu4cbSA=
-github.com/gabriel-vasile/mimetype v1.3.0 h1:4YOHITFLyYwF+iqG0ybSLGArRItynpfwdlWRmJnd75E=
-github.com/gabriel-vasile/mimetype v1.3.0/go.mod h1:fA8fi6KUiG7MgQQ+mEWotXoEOvmxRtOJlERCzSmRvr8=
+github.com/gabriel-vasile/mimetype v1.4.0 h1:Cn9dkdYsMIu56tGho+fqzh7XmvY2YyGU0FnbhiOsEro=
+github.com/gabriel-vasile/mimetype v1.4.0/go.mod h1:fA8fi6KUiG7MgQQ+mEWotXoEOvmxRtOJlERCzSmRvr8=
 github.com/garyburd/redigo v0.0.0-20150301180006-535138d7bcd7/go.mod h1:NR3MbYisc3/PwhQ00EMzDiPmrwpPxAn5GI05/YaO1SY=
 github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
@@ -368,8 +369,9 @@ github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh
 github.com/go-restruct/restruct v1.2.0-alpha h1:2Lp474S/9660+SJjpVxoKuWX09JsXHSrdV7Nv3/gkvc=
 github.com/go-restruct/restruct v1.2.0-alpha/go.mod h1:KqrpKpn4M8OLznErihXTGLlsXFGeLxHUrLRRI/1YjGk=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
-github.com/go-test/deep v1.0.7 h1:/VSMRlnY/JSyqxQUzQLKVMAskpY/NZKFA5j2P+0pP2M=
 github.com/go-test/deep v1.0.7/go.mod h1:QV8Hv/iy04NyLBxAdO9njL0iVPN1S4d/A3NVv1V36o8=
+github.com/go-test/deep v1.0.8 h1:TDsG77qcSprGbC6vTN8OuXp5g+J+b5Pcguhf7Zt61VM=
+github.com/go-test/deep v1.0.8/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/godbus/dbus v0.0.0-20151105175453-c7fdd8b5cd55/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
 github.com/godbus/dbus v0.0.0-20180201030542-885f9cc04c9c/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
 github.com/godbus/dbus v0.0.0-20190422162347-ade71ed3457e/go.mod h1:bBOAhwG1umN6/6ZUMtDFBMQR8jRg9O75tm9K00oMsK4=

gon.hcl

@@ -1,15 +0,0 @@
-source = ["./dist/syft-macos_darwin_amd64/syft"] # The 'dist' directory path should ideally reference an env var, where the source of truth is the Makefile. I wasn't able to figure out how to solve this.
-bundle_id = "com.anchore.toolbox.syft"
-
-sign {
-  application_identity = "Developer ID Application: ANCHORE, INC. (9MJHKYX5AT)"
-}
-
-dmg {
-  output_path = "./dist/output.dmg"
-  volume_name = "Syft"
-}
-
-zip {
-  output_path = "./dist/output.zip"
-}

install.sh

@@ -1,198 +1,129 @@
 #!/bin/sh
-set -e
+# note: we require errors to propagate (don't set -e)
+set -u
 
-usage() {
+PROJECT_NAME="syft"
+OWNER=anchore
+REPO="${PROJECT_NAME}"
+GITHUB_DOWNLOAD_PREFIX=https://github.com/${OWNER}/${REPO}/releases/download
+
+#
+# usage [script-name]
+#
+usage() (
   this=$1
   cat <<EOF
 $this: download go binaries for anchore/syft
 
-Usage: $this [-b] bindir [-d] [tag]
-  -b sets bindir or installation directory, Defaults to ./bin
-  -d turns on debug logging
-   [tag] is a tag from
-   https://github.com/anchore/syft/releases
-   If tag is missing, then the latest will be used.
-
- Generated by godownloader
-  https://github.com/goreleaser/godownloader
-
+Usage: $this [-b] dir [-d] [tag]
+  -b  the installation directory (dDefaults to ./bin)
+  -d  turns on debug logging
+  -dd turns on trace logging
+  [tag] the specific release to use (if missing, then the latest will be used)
 EOF
   exit 2
-}
+)
 
-parse_args() {
-  # BINDIR is ./bin unless set be ENV
-  # over-ridden by flag below
 
-  BINDIR=${BINDIR:-./bin}
-  while getopts "b:dh?x" arg; do
-    case "$arg" in
-      b) BINDIR="$OPTARG" ;;
-      d) log_set_priority 10 ;;
-      h | \?) usage "$0" ;;
-      x) set -x ;;
-    esac
-  done
-  shift $((OPTIND - 1))
-  TAG=$1
-}
-# this function wraps all the destructive operations
-# if a curl|bash cuts off the end of the script due to
-# network, either nothing will happen or will syntax error
-# out preventing half-done work
-execute() {
-  tmpdir=$(mktemp -d)
-  log_debug "downloading files into ${tmpdir}"
-  http_download "${tmpdir}/${ARCHIVE}" "${ARCHIVE_URL}"
-  http_download "${tmpdir}/${CHECKSUM}" "${CHECKSUM_URL}"
+# ------------------------------------------------------------------------
+# https://github.com/client9/shlib - portable posix shell functions
+# Public domain - http://unlicense.org
+# https://github.com/client9/shlib/blob/master/LICENSE.md
+# but credit (and pull requests) appreciated.
+# ------------------------------------------------------------------------
 
-  # macOS has its own secure verification mechanism, and checksums.txt is not used.
-  if [ "$OS" != "darwin" ]; then
-    hash_sha256_verify "${tmpdir}/${ARCHIVE}" "${tmpdir}/${CHECKSUM}"
-  fi
-
-  srcdir="${tmpdir}"
-  (cd "${tmpdir}" && unpack "${ARCHIVE}")
-  test ! -d "${BINDIR}" && install -d "${BINDIR}"
-  for binexe in $BINARIES; do
-    if [ "$OS" = "windows" ]; then
-      binexe="${binexe}.exe"
-    fi
-    install "${srcdir}/${binexe}" "${BINDIR}/"
-    log_info "installed ${BINDIR}/${binexe}"
-  done
-  rm -rf "${tmpdir}"
-}
-get_binaries() {
-  case "$PLATFORM" in
-    darwin/arm64) BINARIES="syft" ;;
-    darwin/amd64) BINARIES="syft" ;;
-    linux/amd64) BINARIES="syft" ;;
-    linux/arm64) BINARIES="syft" ;;
-    windows/amd64) BINARIES="syft" ;;
-    *)
-      log_crit "platform $PLATFORM is not supported.  Make sure this script is up-to-date and file request at https://github.com/${PREFIX}/issues/new"
-      exit 1
-      ;;
-  esac
-}
-tag_to_version() {
-  if [ -z "${TAG}" ]; then
-    log_info "checking GitHub for latest tag"
-  else
-    log_info "checking GitHub for tag '${TAG}'"
-  fi
-  REALTAG=$(github_release "$OWNER/$REPO" "${TAG}") && true
-  if test -z "$REALTAG"; then
-    log_crit "unable to find '${TAG}' - use 'latest' or see https://github.com/${PREFIX}/releases for details"
-    exit 1
-  fi
-  # if version starts with 'v', remove it
-  TAG="$REALTAG"
-  VERSION=${TAG#v}
-}
-adjust_format() {
-  # change format (tar.gz or zip) based on OS
-  case ${OS} in
-    darwin) FORMAT=dmg ;;
-    windows) FORMAT=zip ;;
-  esac
-  case "${PLATFORM}" in
-    darwin/arm64) FORMAT=zip ;;
-  esac
-  true
-}
-adjust_os() {
-  # adjust archive name based on OS
-  true
-}
-adjust_arch() {
-  # adjust archive name based on ARCH
-  true
-}
-
-cat /dev/null <<EOF
-------------------------------------------------------------------------
-https://github.com/client9/shlib - portable posix shell functions
-Public domain - http://unlicense.org
-https://github.com/client9/shlib/blob/master/LICENSE.md
-but credit (and pull requests) appreciated.
-------------------------------------------------------------------------
-EOF
-is_command() {
+is_command() (
   command -v "$1" >/dev/null
-}
-echoerr() {
+)
+
+echo_stderr() (
   echo "$@" 1>&2
-}
-log_prefix() {
-  echo "$0"
-}
-_logp=6
+)
+
+_logp=2
 log_set_priority() {
   _logp="$1"
 }
-log_priority() {
+
+log_priority() (
   if test -z "$1"; then
     echo "$_logp"
     return
   fi
   [ "$1" -le "$_logp" ]
+)
+
+init_colors() {
+  RED=''
+  BLUE=''
+  PURPLE=''
+  BOLD=''
+  RESET=''
+  # check if stdout is a terminal
+  if test -t 1 && is_command tput; then
+      # see if it supports colors
+      ncolors=$(tput colors)
+      if test -n "$ncolors" && test $ncolors -ge 8; then
+        RED='\033[0;31m'
+        BLUE='\033[0;34m'
+        PURPLE='\033[0;35m'
+        BOLD='\033[1m'
+        RESET='\033[0m'
+      fi
+  fi
 }
-log_tag() {
+
+init_colors
+
+log_tag() (
   case $1 in
-    0) echo "emerg" ;;
-    1) echo "alert" ;;
-    2) echo "crit" ;;
-    3) echo "err" ;;
-    4) echo "warning" ;;
-    5) echo "notice" ;;
-    6) echo "info" ;;
-    7) echo "debug" ;;
-    *) echo "$1" ;;
+    0) echo "${RED}${BOLD}[error]${RESET}" ;;
+    1) echo "${RED}[warn]${RESET}" ;;
+    2) echo "[info]${RESET}" ;;
+    3) echo "${BLUE}[debug]${RESET}" ;;
+    4) echo "${PURPLE}[trace]${RESET}" ;;
+    *) echo "[$1]" ;;
   esac
-}
-log_debug() {
-  log_priority 7 || return 0
-  echoerr "$(log_prefix)" "$(log_tag 7)" "$@"
-}
-log_info() {
-  log_priority 6 || return 0
-  echoerr "$(log_prefix)" "$(log_tag 6)" "$@"
-}
-log_err() {
-  log_priority 3 || return 0
-  echoerr "$(log_prefix)" "$(log_tag 3)" "$@"
-}
-log_crit() {
-  log_priority 2 || return 0
-  echoerr "$(log_prefix)" "$(log_tag 2)" "$@"
-}
-uname_os() {
-  os=$(uname -s | tr '[:upper:]' '[:lower:]')
-  case "$os" in
-    cygwin_nt*) os="windows" ;;
-    mingw*) os="windows" ;;
-    msys_nt*) os="windows" ;;
-  esac
-  echo "$os"
-}
-uname_arch() {
-  arch=$(uname -m)
-  case $arch in
-    x86_64) arch="amd64" ;;
-    x86) arch="386" ;;
-    i686) arch="386" ;;
-    i386) arch="386" ;;
-    aarch64) arch="arm64" ;;
-    armv5*) arch="armv5" ;;
-    armv6*) arch="armv6" ;;
-    armv7*) arch="armv7" ;;
-  esac
-  echo ${arch}
-}
-uname_os_check() {
-  os=$(uname_os)
+)
+
+
+log_trace_priority=4
+log_trace() (
+  priority=$log_trace_priority
+  log_priority "$priority" || return 0
+  echo_stderr "$(log_tag $priority)" "${@}" "${RESET}"
+)
+
+log_debug_priority=3
+log_debug() (
+  priority=$log_debug_priority
+  log_priority "$priority" || return 0
+  echo_stderr "$(log_tag $priority)" "${@}" "${RESET}"
+)
+
+log_info_priority=2
+log_info() (
+  priority=$log_info_priority
+  log_priority "$priority" || return 0
+  echo_stderr "$(log_tag $priority)" "${@}" "${RESET}"
+)
+
+log_warn_priority=1
+log_warn() (
+  priority=$log_warn_priority
+  log_priority "$priority" || return 0
+  echo_stderr "$(log_tag $priority)" "${@}" "${RESET}"
+)
+
+log_err_priority=0
+log_err() (
+  priority=$log_err_priority
+  log_priority "$priority" || return 0
+  echo_stderr "$(log_tag $priority)" "${@}" "${RESET}"
+)
+
+uname_os_check() (
+  os=$1
   case "$os" in
     darwin) return 0 ;;
     dragonfly) return 0 ;;
@@ -206,11 +137,12 @@ uname_os_check() {
     solaris) return 0 ;;
     windows) return 0 ;;
   esac
-  log_crit "uname_os_check '$(uname -s)' got converted to '$os' which is not a GOOS value. Please file bug at https://github.com/client9/shlib"
+  log_err "uname_os_check '$(uname -s)' got converted to '$os' which is not a GOOS value. Please file bug at https://github.com/client9/shlib"
   return 1
-}
-uname_arch_check() {
-  arch=$(uname_arch)
+)
+
+uname_arch_check() (
+  arch=$1
   case "$arch" in
     386) return 0 ;;
     amd64) return 0 ;;
@@ -227,56 +159,72 @@ uname_arch_check() {
     s390x) return 0 ;;
     amd64p32) return 0 ;;
   esac
-  log_crit "uname_arch_check '$(uname -m)' got converted to '$arch' which is not a GOARCH value.  Please file bug report at https://github.com/client9/shlib"
+  log_err "uname_arch_check '$(uname -m)' got converted to '$arch' which is not a GOARCH value.  Please file bug report at https://github.com/client9/shlib"
   return 1
-}
-unpack() {
+)
+
+unpack() (
   archive=$1
+
+  log_trace "unpack(archive=${archive})"
+
   case "${archive}" in
     *.tar.gz | *.tgz) tar --no-same-owner -xzf "${archive}" ;;
     *.tar) tar --no-same-owner -xf "${archive}" ;;
-    *.zip) unzip "${archive}" ;;
+    *.zip) unzip -q "${archive}" ;;
     *.dmg) extract_from_dmg "${archive}" ;;
     *)
       log_err "unpack unknown archive format for ${archive}"
       return 1
       ;;
   esac
-}
-extract_from_dmg() {
+)
+
+extract_from_dmg() (
   dmg_file=$1
+
   mount_point="/Volumes/tmp-dmg"
   hdiutil attach -quiet -nobrowse -mountpoint "${mount_point}" "${dmg_file}"
   cp -fR "${mount_point}/." ./
   hdiutil detach -quiet -force "${mount_point}"
-}
-http_download_curl() {
+)
+
+http_download_curl() (
   local_file=$1
   source_url=$2
   header=$3
+
+  log_trace "http_download_curl(local_file=$local_file, source_url=$source_url, header=$header)"
+
   if [ -z "$header" ]; then
     code=$(curl -w '%{http_code}' -sL -o "$local_file" "$source_url")
   else
     code=$(curl -w '%{http_code}' -sL -H "$header" -o "$local_file" "$source_url")
   fi
+
   if [ "$code" != "200" ]; then
-    log_debug "http_download_curl received HTTP status $code"
+    log_err "received HTTP status=$code for url='$source_url'"
     return 1
   fi
   return 0
-}
-http_download_wget() {
+)
+
+http_download_wget() (
   local_file=$1
   source_url=$2
   header=$3
+
+  log_trace "http_download_wget(local_file=$local_file, source_url=$source_url, header=$header)"
+
   if [ -z "$header" ]; then
     wget -q -O "$local_file" "$source_url"
   else
     wget -q --header "$header" -O "$local_file" "$source_url"
   fi
-}
-http_download() {
-  log_debug "http_download $2"
+)
+
+http_download() (
+  log_debug "http_download(url=$2)"
   if is_command curl; then
     http_download_curl "$@"
     return
@@ -284,28 +232,19 @@ http_download() {
     http_download_wget "$@"
     return
   fi
-  log_crit "http_download unable to find wget or curl"
+  log_err "http_download unable to find wget or curl"
   return 1
-}
-http_copy() {
+)
+
+http_copy() (
   tmp=$(mktemp)
   http_download "${tmp}" "$1" "$2" || return 1
   body=$(cat "$tmp")
   rm -f "${tmp}"
   echo "$body"
-}
-github_release() {
-  owner_repo=$1
-  version=$2
-  test -z "$version" && version="latest"
-  giturl="https://github.com/${owner_repo}/releases/${version}"
-  json=$(http_copy "$giturl" "Accept:application/json")
-  test -z "$json" && return 1
-  version=$(echo "$json" | tr -s '\n' ' ' | sed 's/.*"tag_name":"//' | sed 's/".*//')
-  test -z "$version" && return 1
-  echo "$version"
-}
-hash_sha256() {
+)
+
+hash_sha256() (
   TARGET=${1:-/dev/stdin}
   if is_command gsha256sum; then
     hash=$(gsha256sum "$TARGET") || return 1
@@ -320,11 +259,12 @@ hash_sha256() {
     hash=$(openssl -dst openssl dgst -sha256 "$TARGET") || return 1
     echo "$hash" | cut -d ' ' -f a
   else
-    log_crit "hash_sha256 unable to find command to compute sha-256 hash"
+    log_err "hash_sha256 unable to find command to compute sha-256 hash"
     return 1
   fi
-}
-hash_sha256_verify() {
+)
+
+hash_sha256_verify() (
   TARGET=$1
   checksums=$2
   if [ -z "$checksums" ]; then
@@ -342,51 +282,400 @@ hash_sha256_verify() {
     log_err "hash_sha256_verify checksum for '$TARGET' did not verify ${want} vs $got"
     return 1
   fi
-}
-cat /dev/null <<EOF
-------------------------------------------------------------------------
-End of functions from https://github.com/client9/shlib
-------------------------------------------------------------------------
+)
+
+# ------------------------------------------------------------------------
+# End of functions from https://github.com/client9/shlib
+# ------------------------------------------------------------------------
+
+# asset_file_exists [path]
+#
+# returns 1 if the given file does not exist
+#
+asset_file_exists() (
+  path="$1"
+  if [ ! -f "${path}" ]; then
+      return 1
+  fi
+)
+
+
+# github_release_json [owner] [repo] [version]
+#
+# outputs release json string
+#
+github_release_json() (
+  owner=$1
+  repo=$2
+  version=$3
+  test -z "$version" && version="latest"
+  giturl="https://github.com/${owner}/${repo}/releases/${version}"
+  json=$(http_copy "$giturl" "Accept:application/json")
+
+  log_trace "github_release_json(owner=${owner}, repo=${repo}, version=${version}) returned '${json}'"
+
+  test -z "$json" && return 1
+  echo "${json}"
+)
+
+# extract_value [key-value-pair]
+#
+# outputs value from a colon delimited key-value pair
+#
+extract_value() (
+  key_value="$1"
+  IFS=':' read -r _ value << EOF
+${key_value}
 EOF
+  echo "$value"
+)
 
-PROJECT_NAME="syft"
-OWNER=anchore
-REPO="syft"
-BINARY=syft
-FORMAT=tar.gz
-OS=$(uname_os)
-ARCH=$(uname_arch)
-PREFIX="$OWNER/$REPO"
+# extract_json_value [json] [key]
+#
+# outputs value of the key from the given json string
+#
+extract_json_value() (
+  json="$1"
+  key="$2"
+  key_value=$(echo "${json}" | grep  -o "\"$key\":[^,]*[,}]" | tr -d '",}')
 
-# use in logging routines
-log_prefix() {
-	echo "$PREFIX"
-}
-PLATFORM="${OS}/${ARCH}"
-GITHUB_DOWNLOAD=https://github.com/${OWNER}/${REPO}/releases/download
+  extract_value "$key_value"
+)
 
-uname_os_check "$OS"
-uname_arch_check "$ARCH"
+# github_release_tag [release-json]
+#
+# outputs release tag string
+#
+github_release_tag() (
+  json="$1"
+  tag=$(extract_json_value "${json}" "tag_name")
+  test -z "$tag" && return 1
+  echo "$tag"
+)
 
-parse_args "$@"
+# download_github_release_checksums [release-url-prefix] [name] [version] [output-dir]
+#
+# outputs path to the downloaded checksums file
+#
+download_github_release_checksums() (
+  download_url="$1"
+  name="$2"
+  version="$3"
+  output_dir="$4"
 
-get_binaries
+  log_trace "download_github_release_checksums(url=${download_url}, name=${name}, version=${version}, output_dir=${output_dir})"
 
-tag_to_version
+  checksum_filename=${name}_${version}_checksums.txt
+  checksum_url=${download_url}/${checksum_filename}
+  output_path="${output_dir}/${checksum_filename}"
 
-adjust_format
+  http_download "${output_path}" "${checksum_url}" ""
+  asset_file_exists "${output_path}"
 
-adjust_os
+  log_trace "download_github_release_checksums() returned '${output_path}'"
 
-adjust_arch
+  echo "${output_path}"
+)
 
-log_info "found version: ${VERSION} for ${TAG}/${OS}/${ARCH}"
+# search_for_asset [checksums-file-path] [name] [os] [arch] [format]
+#
+# outputs name of the asset to download
+#
+search_for_asset() (
+  checksum_path="$1"
+  name="$2"
+  os="$3"
+  arch="$4"
+  format="$5"
 
-NAME=${PROJECT_NAME}_${VERSION}_${OS}_${ARCH}
-ARCHIVE=${NAME}.${FORMAT}
-ARCHIVE_URL=${GITHUB_DOWNLOAD}/${TAG}/${ARCHIVE}
-CHECKSUM=${PROJECT_NAME}_${VERSION}_checksums.txt
-CHECKSUM_URL=${GITHUB_DOWNLOAD}/${TAG}/${CHECKSUM}
+  log_trace "search_for_asset(checksum-path=${checksum_path}, name=${name}, os=${os}, arch=${arch}, format=${format})"
+
+  asset_glob="${name}_.*_${os}_${arch}.${format}"
+  output_path=$(grep -o "${asset_glob}" "${checksum_path}" || true)
+
+  log_trace "search_for_asset() returned '${output_path}'"
+
+  echo "${output_path}"
+)
+
+# uname_os
+#
+# outputs an adjusted os value
+#
+uname_os() (
+  os=$(uname -s | tr '[:upper:]' '[:lower:]')
+  case "$os" in
+    cygwin_nt*) os="windows" ;;
+    mingw*) os="windows" ;;
+    msys_nt*) os="windows" ;;
+  esac
+
+  uname_os_check "$os"
+
+  log_trace "uname_os() returned '${os}'"
+
+  echo "$os"
+)
+
+# uname_arch
+#
+# outputs an adjusted architecture value
+#
+uname_arch() (
+  arch=$(uname -m)
+  case $arch in
+    x86_64) arch="amd64" ;;
+    x86) arch="386" ;;
+    i686) arch="386" ;;
+    i386) arch="386" ;;
+    aarch64) arch="arm64" ;;
+    armv5*) arch="armv5" ;;
+    armv6*) arch="armv6" ;;
+    armv7*) arch="armv7" ;;
+  esac
+
+  uname_arch_check "${arch}"
+
+  log_trace "uname_arch() returned '${arch}'"
+
+  echo "${arch}"
+)
+
+# get_release_tag [owner] [repo] [tag]
+#
+# outputs tag string
+#
+get_release_tag() (
+  owner="$1"
+  repo="$2"
+  tag="$3"
+
+  log_trace "get_release_tag(owner=${owner}, repo=${repo}, tag=${tag})"
+
+  json=$(github_release_json "${owner}" "${repo}" "${tag}")
+  real_tag=$(github_release_tag "${json}")
+  if test -z "${real_tag}"; then
+    return 1
+  fi
+
+  log_trace "get_release_tag() returned '${real_tag}'"
+
+  echo "${real_tag}"
+)
+
+# tag_to_version [tag]
+#
+# outputs version string
+#
+tag_to_version() (
+  tag="$1"
+  value="${tag#v}"
+
+  log_trace "tag_to_version(tag=${tag}) returned '${value}'"
+
+  echo "$value"
+)
+
+# get_binary_name [os] [arch] [default-name]
+#
+# outputs a the binary string name
+#
+get_binary_name() (
+  os="$1"
+  arch="$2"
+  binary="$3"
+  original_binary="${binary}"
+
+  case "${os}" in
+    windows) binary="${binary}.exe" ;;
+  esac
+
+  log_trace "get_binary_name(os=${os}, arch=${arch}, binary=${original_binary}) returned '${binary}'"
+
+  echo "${binary}"
+)
 
 
-execute
+# get_format_name [os] [arch] [default-format]
+#
+# outputs an adjusted file format
+#
+get_format_name() (
+  os="$1"
+  arch="$2"
+  format="$3"
+  original_format="${format}"
+
+  case ${os} in
+    windows) format=zip ;;
+  esac
+
+  log_trace "get_format_name(os=${os}, arch=${arch}, format=${original_format}) returned '${format}'"
+
+  echo "${format}"
+)
+
+# download_and_install_asset [release-url-prefix] [download-path] [install-path] [name] [os] [arch] [version] [format] [binary]
+#
+# attempts to download the archive and install it to the given path.
+#
+download_and_install_asset() (
+  download_url="$1"
+  download_path="$2"
+  install_path=$3
+  name="$4"
+  os="$5"
+  arch="$6"
+  version="$7"
+  format="$8"
+  binary="$9"
+
+  asset_filepath=$(download_asset "${download_url}" "${download_path}" "${name}" "${os}" "${arch}" "${version}" "${format}")
+
+  # don't continue if we couldn't download an asset
+  if [ -z "${asset_filepath}" ]; then
+      log_err "could not find release asset for os='${os}' arch='${arch}' format='${format}' "
+      return 1
+  fi
+
+  install_asset "${asset_filepath}" "${install_path}" "${binary}"
+)
+
+# download_asset [release-url-prefix] [download-path] [name] [os] [arch] [version] [format] [binary]
+#
+# outputs the path to the downloaded asset asset_filepath
+#
+download_asset() (
+  download_url="$1"
+  destination="$2"
+  name="$3"
+  os="$4"
+  arch="$5"
+  version="$6"
+  format="$7"
+
+  log_trace "download_asset(url=${download_url}, destination=${destination}, name=${name}, os=${os}, arch=${arch}, version=${version}, format=${format})"
+
+  checksums_filepath=$(download_github_release_checksums "${download_url}" "${name}" "${version}" "${destination}")
+
+  log_trace "checksums content:\n$(cat ${checksums_filepath})"
+
+  asset_filename=$(search_for_asset "${checksums_filepath}" "${name}" "${os}" "${arch}" "${format}")
+
+  # don't continue if we couldn't find a matching asset from the checksums file
+  if [ -z "${asset_filename}" ]; then
+      return 1
+  fi
+
+  asset_url="${download_url}/${asset_filename}"
+  asset_filepath="${destination}/${asset_filename}"
+  http_download "${asset_filepath}" "${asset_url}" ""
+
+  hash_sha256_verify "${asset_filepath}" "${checksums_filepath}"
+
+  log_trace "download_asset_by_checksums_file() returned '${asset_filepath}'"
+
+  echo "${asset_filepath}"
+)
+
+# install_asset [asset-path] [destination-path] [binary]
+#
+install_asset() (
+  asset_filepath="$1"
+  destination="$2"
+  binary="$3"
+
+  log_trace "install_asset(asset=${asset_filepath}, destination=${destination}, binary=${binary})"
+
+  # don't continue if we don't have anything to install
+  if [ -z "${asset_filepath}" ]; then
+      return
+  fi
+
+  archive_dir=$(dirname "${asset_filepath}")
+
+  # unarchive the downloaded archive to the temp dir
+  (cd "${archive_dir}" && unpack "${asset_filepath}")
+
+  # create the destination dir
+  test ! -d "${destination}" && install -d "${destination}"
+
+  # install the binary to the destination dir
+  install "${archive_dir}/${binary}" "${destination}/"
+)
+
+main() (
+  # parse arguments
+
+  install_dir=${install_dir:-./bin}
+  while getopts "b:dh?x" arg; do
+    case "$arg" in
+      b) install_dir="$OPTARG" ;;
+      d)
+        if [ "$_logp" = "$log_info_priority" ]; then
+          # -d == debug
+          log_set_priority $log_debug_priority
+        else
+          # -dd (or -ddd...) == trace
+          log_set_priority $log_trace_priority
+        fi
+        ;;
+      h | \?) usage "$0" ;;
+      x) set -x ;;
+    esac
+  done
+  shift $((OPTIND - 1))
+  set +u
+  tag=$1
+
+  if [ -z "${tag}" ]; then
+    log_info "checking github for the current release tag"
+    tag=""
+  else
+    log_info "checking github for release tag='${tag}'"
+  fi
+  set -u
+
+  tag=$(get_release_tag "${OWNER}" "${REPO}" "${tag}")
+
+  if [ "$?" != "0" ]; then
+      log_err "unable to find tag='${tag}'"
+      log_err "do not specify a version or select a valid version from https://github.com/${OWNER}/${REPO}/releases"
+      return 1
+  fi
+
+  version=$(tag_to_version "${tag}")
+
+  download_dir=$(mktemp -d)
+  trap 'rm -rf -- "$download_dir"' EXIT
+
+  # run the application
+
+  os=$(uname_os)
+  arch=$(uname_arch)
+  format=$(get_format_name "${os}" "${arch}" "tar.gz")
+  binary=$(get_binary_name "${os}" "${arch}" "${PROJECT_NAME}")
+  download_url="${GITHUB_DOWNLOAD_PREFIX}/${tag}"
+
+  log_info "using release tag='${tag}' version='${version}' os='${os}' arch='${arch}'"
+  log_debug "downloading files into ${download_dir}"
+
+  download_and_install_asset "${download_url}" "${download_dir}" "${install_dir}" "${PROJECT_NAME}" "${os}" "${arch}" "${version}" "${format}" "${binary}"
+
+  # don't continue if we couldn't install the asset
+  if [ "$?" != "0" ]; then
+      log_err "failed to install ${PROJECT_NAME}"
+      return 1
+  fi
+
+  log_info "installed ${install_dir}/${binary}"
+)
+
+# entrypoint
+
+set +u
+if [ -z "${TEST_INSTALL_SH}" ]; then
+  set -u
+  main "$@"
+fi
+set -u

internal/formats/common/cyclonedxhelpers/component.go

@@ -9,6 +9,7 @@ func Component(p pkg.Package) cyclonedx.Component {
 	return cyclonedx.Component{
 		Type:               cyclonedx.ComponentTypeLibrary,
 		Name:               p.Name,
+		Group:              Group(p),
 		Version:            p.Version,
 		PackageURL:         p.PURL,
 		Licenses:           Licenses(p),

internal/formats/common/cyclonedxhelpers/format.go

@@ -5,7 +5,9 @@ import (
 
 	"github.com/CycloneDX/cyclonedx-go"
 	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/version"
+	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
@@ -29,6 +31,12 @@ func ToFormatModel(s sbom.SBOM) *cyclonedx.BOM {
 	}
 	components = append(components, toOSComponent(s.Artifacts.LinuxDistribution)...)
 	cdxBOM.Components = &components
+
+	dependencies := toDependencies(s.Relationships)
+	if len(dependencies) > 0 {
+		cdxBOM.Dependencies = &dependencies
+	}
+
 	return cdxBOM
 }
 
@@ -97,18 +105,66 @@ func toBomDescriptor(name, version string, srcMetadata source.Metadata) *cyclone
 	}
 }
 
+// used to indicate that a relationship listed under the syft artifact package can be represented as a cyclonedx dependency.
+// NOTE: CycloneDX provides the ability to describe components and their dependency on other components.
+// The dependency graph is capable of representing both direct and transitive relationships.
+// If a relationship is either direct or transitive it can be included in this function.
+// An example of a relationship to not include would be: OwnershipByFileOverlapRelationship.
+func isExpressiblePackageRelationship(ty artifact.RelationshipType) bool {
+	switch ty {
+	case artifact.RuntimeDependencyOfRelationship:
+		return true
+	case artifact.DevDependencyOfRelationship:
+		return true
+	case artifact.BuildDependencyOfRelationship:
+		return true
+	case artifact.DependencyOfRelationship:
+		return true
+	}
+	return false
+}
+
+func toDependencies(relationships []artifact.Relationship) []cyclonedx.Dependency {
+	result := make([]cyclonedx.Dependency, 0)
+	for _, r := range relationships {
+		exists := isExpressiblePackageRelationship(r.Type)
+		if !exists {
+			log.Warnf("unable to convert relationship from CycloneDX 1.3 JSON, dropping: %+v", r)
+			continue
+		}
+
+		innerDeps := []cyclonedx.Dependency{}
+		innerDeps = append(innerDeps, cyclonedx.Dependency{Ref: string(r.From.ID())})
+		result = append(result, cyclonedx.Dependency{
+			Ref:          string(r.To.ID()),
+			Dependencies: &innerDeps,
+		})
+	}
+	return result
+}
+
 func toBomDescriptorComponent(srcMetadata source.Metadata) *cyclonedx.Component {
 	switch srcMetadata.Scheme {
 	case source.ImageScheme:
+		bomRef, err := artifact.IDByHash(srcMetadata.ImageMetadata.ID)
+		if err != nil {
+			log.Warnf("unable to get fingerprint of image metadata=%s: %+v", srcMetadata.ImageMetadata.ID, err)
+		}
 		return &cyclonedx.Component{
+			BOMRef:  string(bomRef),
 			Type:    cyclonedx.ComponentTypeContainer,
 			Name:    srcMetadata.ImageMetadata.UserInput,
 			Version: srcMetadata.ImageMetadata.ManifestDigest,
 		}
 	case source.DirectoryScheme, source.FileScheme:
+		bomRef, err := artifact.IDByHash(srcMetadata.Path)
+		if err != nil {
+			log.Warnf("unable to get fingerprint of source metadata path=%s: %+v", srcMetadata.Path, err)
+		}
 		return &cyclonedx.Component{
-			Type: cyclonedx.ComponentTypeFile,
-			Name: srcMetadata.Path,
+			BOMRef: string(bomRef),
+			Type:   cyclonedx.ComponentTypeFile,
+			Name:   srcMetadata.Path,
 		}
 	}
 

internal/formats/common/cyclonedxhelpers/group.go

@@ -0,0 +1,12 @@
+package cyclonedxhelpers
+
+import "github.com/anchore/syft/syft/pkg"
+
+func Group(p pkg.Package) string {
+	if hasMetadata(p) {
+		if metadata, ok := p.Metadata.(pkg.JavaMetadata); ok && metadata.PomProperties != nil {
+			return metadata.PomProperties.GroupID
+		}
+	}
+	return ""
+}

internal/formats/common/cyclonedxhelpers/group_test.go

@@ -0,0 +1,52 @@
+package cyclonedxhelpers
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGroup(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    pkg.Package
+		expected string
+	}{
+		{
+			name:     "no metadata",
+			input:    pkg.Package{},
+			expected: "",
+		},
+		{
+			name: "metadata is not Java",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackageJSONMetadata{},
+			},
+			expected: "",
+		},
+		{
+			name: "metadata is Java but pom properties is empty",
+			input: pkg.Package{
+				Metadata: pkg.JavaMetadata{},
+			},
+			expected: "",
+		},
+		{
+			name: "metadata is Java and contains pomProperties",
+			input: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						GroupID: "test",
+					},
+				},
+			},
+			expected: "test",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, Group(test.input))
+		})
+	}
+}

internal/formats/common/cyclonedxhelpers/properties.go

@@ -28,17 +28,22 @@ func Properties(p pkg.Package) *[]cyclonedx.Property {
 func getCycloneDXProperties(m interface{}) *[]cyclonedx.Property {
 	props := []cyclonedx.Property{}
 	structValue := reflect.ValueOf(m)
-	// we can only handle top level structs as interfaces for now
 	if structValue.Kind() != reflect.Struct {
 		return &props
 	}
 	structType := structValue.Type()
 	for i := 0; i < structValue.NumField(); i++ {
 		if name, value := getCycloneDXPropertyName(structType.Field(i)), getCycloneDXPropertyValue(structValue.Field(i)); name != "" && value != "" {
-			props = append(props, cyclonedx.Property{
-				Name:  name,
-				Value: value,
-			})
+			// In the case of the value is a struct and has cyclonedx tag with name "-"
+			// call the getCycloneDXProperties recursively.
+			if name == "-" && reflect.ValueOf(value).Kind() == reflect.Struct {
+				props = append(props, *getCycloneDXProperties(value)...)
+			} else if reflect.ValueOf(value).Kind() == reflect.String {
+				props = append(props, cyclonedx.Property{
+					Name:  name,
+					Value: fmt.Sprint(value),
+				})
+			}
 		}
 	}
 	return &props
@@ -51,7 +56,7 @@ func getCycloneDXPropertyName(field reflect.StructField) string {
 	return ""
 }
 
-func getCycloneDXPropertyValue(field reflect.Value) string {
+func getCycloneDXPropertyValue(field reflect.Value) interface{} {
 	if field.IsZero() {
 		return ""
 	}
@@ -61,6 +66,11 @@ func getCycloneDXPropertyValue(field reflect.Value) string {
 			return fmt.Sprint(field.Interface())
 		}
 		return ""
+	case reflect.Struct:
+		if field.CanInterface() {
+			return field.Interface()
+		}
+		return ""
 	case reflect.Ptr:
 		return getCycloneDXPropertyValue(reflect.Indirect(field))
 	}

internal/formats/cyclonedx13json/encoder_test.go

@@ -37,5 +37,8 @@ func cycloneDxRedactor(s []byte) []byte {
 	for _, pattern := range []*regexp.Regexp{serialPattern, rfc3339Pattern, sha256Pattern} {
 		s = pattern.ReplaceAll(s, []byte("redacted"))
 	}
+	// the bom-ref will be autogenerated every time, the value here should not be directly tested in snapshot tests
+	s = regexp.MustCompile(`      "bom-ref": .*\n`).ReplaceAll(s, []byte(""))
+
 	return s
 }

internal/formats/cyclonedx13xml/encoder_test.go

@@ -38,5 +38,13 @@ func cycloneDxRedactor(s []byte) []byte {
 	for _, pattern := range []*regexp.Regexp{serialPattern, rfc3339Pattern, sha256Pattern} {
 		s = pattern.ReplaceAll(s, []byte("redacted"))
 	}
+
+	// the bom-ref will be autogenerated every time, the value here should not be directly tested in snapshot tests
+	bomRefPattern := regexp.MustCompile(` bom-ref="[a-zA-Z0-9\-:]+"`)
+	bomRef3339Pattern := regexp.MustCompile(`([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\.[0-9]+)?(([Zz])|([\+|\-]([01][0-9]|2[0-3]):[0-5][0-9]))`)
+	for _, pattern := range []*regexp.Regexp{bomRefPattern, bomRef3339Pattern} {
+		s = pattern.ReplaceAll(s, []byte(""))
+	}
+
 	return s
 }

internal/version/build.go

@@ -14,19 +14,19 @@ const valueNotProvided = "[not provided]"
 // all variables here are provided as build-time arguments, with clear default values
 var version = valueNotProvided
 var gitCommit = valueNotProvided
-var gitTreeState = valueNotProvided
+var gitDescription = valueNotProvided
 var buildDate = valueNotProvided
 var platform = fmt.Sprintf("%s/%s", runtime.GOOS, runtime.GOARCH)
 
 // Version defines the application version details (generally from build information)
 type Version struct {
-	Version      string `json:"version"`      // application semantic version
-	GitCommit    string `json:"gitCommit"`    // git SHA at build-time
-	GitTreeState string `json:"gitTreeState"` // indication of git tree (either "clean" or "dirty") at build-time
-	BuildDate    string `json:"buildDate"`    // date of the build
-	GoVersion    string `json:"goVersion"`    // go runtime version at build-time
-	Compiler     string `json:"compiler"`     // compiler used at build-time
-	Platform     string `json:"platform"`     // GOOS and GOARCH at build-time
+	Version        string `json:"version"`        // application semantic version
+	GitCommit      string `json:"gitCommit"`      // git SHA at build-time
+	GitDescription string `json:"gitDescription"` // output of 'git describe --dirty --always --tags'
+	BuildDate      string `json:"buildDate"`      // date of the build
+	GoVersion      string `json:"goVersion"`      // go runtime version at build-time
+	Compiler       string `json:"compiler"`       // compiler used at build-time
+	Platform       string `json:"platform"`       // GOOS and GOARCH at build-time
 }
 
 func (v Version) IsProductionBuild() bool {
@@ -39,12 +39,12 @@ func (v Version) IsProductionBuild() bool {
 // FromBuild provides all version details
 func FromBuild() Version {
 	return Version{
-		Version:      version,
-		GitCommit:    gitCommit,
-		GitTreeState: gitTreeState,
-		BuildDate:    buildDate,
-		GoVersion:    runtime.Version(),
-		Compiler:     runtime.Compiler,
-		Platform:     platform,
+		Version:        version,
+		GitCommit:      gitCommit,
+		GitDescription: gitDescription,
+		BuildDate:      buildDate,
+		GoVersion:      runtime.Version(),
+		Compiler:       runtime.Compiler,
+		Platform:       platform,
 	}
 }

syft/artifact/relationship.go

@@ -9,6 +9,18 @@ const (
 
 	// ContainsRelationship (supports any-to-any linkages) is a proxy for the SPDX 2.2 CONTAINS relationship.
 	ContainsRelationship RelationshipType = "contains"
+
+	// RuntimeDependencyOfRelationship is a proxy for the SPDX 2.2.1 RUNTIME_DEPENDENCY_OF relationship.
+	RuntimeDependencyOfRelationship RelationshipType = "runtime-dependency-of"
+
+	// DevDependencyOfRelationship is a proxy for the SPDX 2.2.1 DEV_DEPENDENCY_OF relationship.
+	DevDependencyOfRelationship RelationshipType = "dev-dependency-of"
+
+	// BuildDependencyOfRelationship is a proxy for the SPDX 2.2.1 BUILD_DEPENDENCY_OF relationship.
+	BuildDependencyOfRelationship RelationshipType = "build-dependency-of"
+
+	// DependencyOfRelationship is a proxy for the SPDX 2.2.1 DEPENDENCY_OF	relationship.
+	DependencyOfRelationship RelationshipType = "dependency-of"
 )
 
 type RelationshipType string

syft/file/metadata_cataloger_test.go

@@ -66,7 +66,7 @@ func TestFileMetadataCataloger(t *testing.T) {
 				LinkDestination: "file-1.txt",
 				UserID:          1,
 				GroupID:         2,
-				MIMEType:        "",
+				MIMEType:        "text/plain",
 			},
 		},
 		{
@@ -78,7 +78,7 @@ func TestFileMetadataCataloger(t *testing.T) {
 				LinkDestination: "file-1.txt",
 				UserID:          0,
 				GroupID:         0,
-				MIMEType:        "",
+				MIMEType:        "text/plain",
 			},
 		},
 		{
@@ -89,7 +89,7 @@ func TestFileMetadataCataloger(t *testing.T) {
 				Type:     "CharacterDevice",
 				UserID:   0,
 				GroupID:  0,
-				MIMEType: "",
+				MIMEType: "text/plain",
 			},
 		},
 		{
@@ -100,7 +100,7 @@ func TestFileMetadataCataloger(t *testing.T) {
 				Type:     "BlockDevice",
 				UserID:   0,
 				GroupID:  0,
-				MIMEType: "",
+				MIMEType: "text/plain",
 			},
 		},
 		{
@@ -111,7 +111,7 @@ func TestFileMetadataCataloger(t *testing.T) {
 				Type:     "FIFONode",
 				UserID:   0,
 				GroupID:  0,
-				MIMEType: "",
+				MIMEType: "text/plain",
 			},
 		},
 		{
@@ -122,7 +122,7 @@ func TestFileMetadataCataloger(t *testing.T) {
 				Type:     "Directory",
 				UserID:   0,
 				GroupID:  0,
-				MIMEType: "",
+				MIMEType: "text/plain",
 			},
 		},
 	}

syft/pkg/apk_metadata.go

@@ -3,15 +3,18 @@ package pkg
 import (
 	"sort"
 
-	"github.com/anchore/syft/syft/file"
-
 	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/linux"
 	"github.com/scylladb/go-set/strset"
 )
 
 const ApkDBGlob = "**/lib/apk/db/installed"
 
-var _ FileOwner = (*ApkMetadata)(nil)
+var (
+	_ FileOwner     = (*ApkMetadata)(nil)
+	_ urlIdentifier = (*ApkMetadata)(nil)
+)
 
 // ApkMetadata represents all captured data for a Alpine DB package entry.
 // See the following sources for more information:
@@ -45,22 +48,28 @@ type ApkFileRecord struct {
 }
 
 // PackageURL returns the PURL for the specific Alpine package (see https://github.com/package-url/purl-spec)
-func (m ApkMetadata) PackageURL() string {
-	pURL := packageurl.NewPackageURL(
+func (m ApkMetadata) PackageURL(distro *linux.Release) string {
+	qualifiers := map[string]string{
+		purlArchQualifier: m.Architecture,
+	}
+
+	if m.OriginPackage != "" {
+		qualifiers[purlUpstreamQualifier] = m.OriginPackage
+	}
+
+	return packageurl.NewPackageURL(
 		// note: this is currently a candidate and not technically within spec
 		// see https://github.com/package-url/purl-spec#other-candidate-types-to-define
 		"alpine",
 		"",
 		m.Package,
 		m.Version,
-		packageurl.Qualifiers{
-			{
-				Key:   "arch",
-				Value: m.Architecture,
-			},
-		},
-		"")
-	return pURL.ToString()
+		purlQualifiers(
+			qualifiers,
+			distro,
+		),
+		"",
+	).ToString()
 }
 
 func (m ApkMetadata) OwnedFiles() (result []string) {

syft/pkg/apk_metadata_test.go

@@ -1,6 +1,7 @@
 package pkg
 
 import (
+	"github.com/anchore/syft/syft/linux"
 	"strings"
 	"testing"
 
@@ -11,16 +12,35 @@ import (
 
 func TestApkMetadata_pURL(t *testing.T) {
 	tests := []struct {
+		name     string
 		metadata ApkMetadata
+		distro   linux.Release
 		expected string
 	}{
 		{
+			name: "gocase",
 			metadata: ApkMetadata{
 				Package:      "p",
 				Version:      "v",
 				Architecture: "a",
 			},
-			expected: "pkg:alpine/p@v?arch=a",
+			distro: linux.Release{
+				ID:        "alpine",
+				VersionID: "3.4.6",
+			},
+			expected: "pkg:alpine/p@v?arch=a&distro=alpine-3.4.6",
+		},
+		{
+			name: "missing architecture",
+			metadata: ApkMetadata{
+				Package: "p",
+				Version: "v",
+			},
+			distro: linux.Release{
+				ID:        "alpine",
+				VersionID: "3.4.6",
+			},
+			expected: "pkg:alpine/p@v?distro=alpine-3.4.6",
 		},
 		// verify #351
 		{
@@ -29,7 +49,11 @@ func TestApkMetadata_pURL(t *testing.T) {
 				Version:      "v84",
 				Architecture: "am86",
 			},
-			expected: "pkg:alpine/g++@v84?arch=am86",
+			distro: linux.Release{
+				ID:        "alpine",
+				VersionID: "3.4.6",
+			},
+			expected: "pkg:alpine/g++@v84?arch=am86&distro=alpine-3.4.6",
 		},
 		{
 			metadata: ApkMetadata{
@@ -37,13 +61,31 @@ func TestApkMetadata_pURL(t *testing.T) {
 				Version:      "v84",
 				Architecture: "am86",
 			},
-			expected: "pkg:alpine/g%20plus%20plus@v84?arch=am86",
+			distro: linux.Release{
+				ID:        "alpine",
+				VersionID: "3.15.0",
+			},
+			expected: "pkg:alpine/g%20plus%20plus@v84?arch=am86&distro=alpine-3.15.0",
+		},
+		{
+			name: "add source information as qualifier",
+			metadata: ApkMetadata{
+				Package:       "p",
+				Version:       "v",
+				Architecture:  "a",
+				OriginPackage: "origin",
+			},
+			distro: linux.Release{
+				ID:        "alpine",
+				VersionID: "3.4.6",
+			},
+			expected: "pkg:alpine/p@v?arch=a&upstream=origin&distro=alpine-3.4.6",
 		},
 	}
 
 	for _, test := range tests {
-		t.Run(test.expected, func(t *testing.T) {
-			actual := test.metadata.PackageURL()
+		t.Run(test.name, func(t *testing.T) {
+			actual := test.metadata.PackageURL(&test.distro)
 			if actual != test.expected {
 				dmp := diffmatchpatch.New()
 				diffs := dmp.DiffMain(test.expected, actual, true)

syft/pkg/cargo_package_metadata.go

@@ -1,5 +1,12 @@
 package pkg
 
+import (
+	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/syft/linux"
+)
+
+var _ urlIdentifier = (*CargoPackageMetadata)(nil)
+
 type CargoPackageMetadata struct {
 	Name         string   `toml:"name" json:"name"`
 	Version      string   `toml:"version" json:"version"`
@@ -19,3 +26,15 @@ func (p CargoPackageMetadata) Pkg() *Package {
 		Metadata:     p,
 	}
 }
+
+// PackageURL returns the PURL for the specific rust package (see https://github.com/package-url/purl-spec)
+func (p CargoPackageMetadata) PackageURL(_ *linux.Release) string {
+	return packageurl.NewPackageURL(
+		"cargo",
+		"",
+		p.Name,
+		p.Version,
+		nil,
+		"",
+	).ToString()
+}

syft/pkg/cataloger/catalog.go

@@ -68,7 +68,7 @@ func Catalog(resolver source.FileResolver, release *linux.Release, catalogers ..
 			p.CPEs = cpe.Generate(p)
 
 			// generate PURL (note: this is excluded from package ID, so is safe to mutate)
-			p.PURL = generatePackageURL(p, release)
+			p.PURL = pkg.URL(p, release)
 
 			// create file-to-package relationships for files owned by the package
 			owningRelationships, err := packageFileOwnershipRelationships(p, resolver)

syft/pkg/cataloger/java/test-fixtures/java-builds/Makefile

@@ -65,5 +65,5 @@ clean-jenkins:
 # we need a way to determine if CI should bust the test cache based on the source material
 $(PKGSDIR).fingerprint: clean-examples
 	mkdir -p $(PKGSDIR)
-	find example-* -type f -exec sha256sum {} \; | sort | tee $(PKGSDIR).fingerprint
+	find example-* -type f -exec sha256sum {} \; | sort | tee /dev/stderr | tee $(PKGSDIR).fingerprint
 	sha256sum $(PKGSDIR).fingerprint

syft/pkg/cataloger/javascript/parse_package_json.go

@@ -21,27 +21,27 @@ import (
 // integrity check
 var _ common.ParserFn = parsePackageJSON
 
-// PackageJSON represents a JavaScript package.json file
-type PackageJSON struct {
+// packageJSON represents a JavaScript package.json file
+type packageJSON struct {
 	Version      string            `json:"version"`
 	Latest       []string          `json:"latest"`
-	Author       Author            `json:"author"`
+	Author       author            `json:"author"`
 	License      json.RawMessage   `json:"license"`
 	Licenses     []license         `json:"licenses"`
 	Name         string            `json:"name"`
 	Homepage     string            `json:"homepage"`
 	Description  string            `json:"description"`
 	Dependencies map[string]string `json:"dependencies"`
-	Repository   Repository        `json:"repository"`
+	Repository   repository        `json:"repository"`
 }
 
-type Author struct {
+type author struct {
 	Name  string `json:"name" mapstruct:"name"`
 	Email string `json:"email" mapstruct:"email"`
 	URL   string `json:"url" mapstruct:"url"`
 }
 
-type Repository struct {
+type repository struct {
 	Type string `json:"type" mapstructure:"type"`
 	URL  string `json:"url" mapstructure:"url"`
 }
@@ -50,10 +50,10 @@ type Repository struct {
 // ---> name: "Isaac Z. Schlueter" email: "i@izs.me" url: "http://blog.izs.me"
 var authorPattern = regexp.MustCompile(`^\s*(?P<name>[^<(]*)(\s+<(?P<email>.*)>)?(\s\((?P<url>.*)\))?\s*$`)
 
-func (a *Author) UnmarshalJSON(b []byte) error {
+func (a *author) UnmarshalJSON(b []byte) error {
 	var authorStr string
 	var fields map[string]string
-	var author Author
+	var auth author
 
 	if err := json.Unmarshal(b, &authorStr); err != nil {
 		// string parsing did not work, assume a map was given
@@ -62,21 +62,21 @@ func (a *Author) UnmarshalJSON(b []byte) error {
 			return fmt.Errorf("unable to parse package.json author: %w", err)
 		}
 	} else {
-		// parse out "name <email> (url)" into an Author struct
+		// parse out "name <email> (url)" into an author struct
 		fields = internal.MatchNamedCaptureGroups(authorPattern, authorStr)
 	}
 
 	// translate the map into a structure
-	if err := mapstructure.Decode(fields, &author); err != nil {
+	if err := mapstructure.Decode(fields, &auth); err != nil {
 		return fmt.Errorf("unable to decode package.json author: %w", err)
 	}
 
-	*a = author
+	*a = auth
 
 	return nil
 }
 
-func (a *Author) AuthorString() string {
+func (a *author) AuthorString() string {
 	result := a.Name
 	if a.Email != "" {
 		result += fmt.Sprintf(" <%s>", a.Email)
@@ -87,10 +87,10 @@ func (a *Author) AuthorString() string {
 	return result
 }
 
-func (r *Repository) UnmarshalJSON(b []byte) error {
+func (r *repository) UnmarshalJSON(b []byte) error {
 	var repositoryStr string
 	var fields map[string]string
-	var repository Repository
+	var repo repository
 
 	if err := json.Unmarshal(b, &repositoryStr); err != nil {
 		// string parsing did not work, assume a map was given
@@ -99,11 +99,11 @@ func (r *Repository) UnmarshalJSON(b []byte) error {
 			return fmt.Errorf("unable to parse package.json author: %w", err)
 		}
 		// translate the map into a structure
-		if err := mapstructure.Decode(fields, &repository); err != nil {
+		if err := mapstructure.Decode(fields, &repo); err != nil {
 			return fmt.Errorf("unable to decode package.json author: %w", err)
 		}
 
-		*r = repository
+		*r = repo
 	} else {
 		r.URL = repositoryStr
 	}
@@ -134,7 +134,7 @@ func licenseFromJSON(b []byte) (string, error) {
 	return "", errors.New("unable to unmarshal license field as either string or object")
 }
 
-func (p PackageJSON) licensesFromJSON() ([]string, error) {
+func (p packageJSON) licensesFromJSON() ([]string, error) {
 	if p.License == nil && p.Licenses == nil {
 		// This package.json doesn't specify any licenses whatsoever
 		return []string{}, nil
@@ -167,7 +167,7 @@ func parsePackageJSON(path string, reader io.Reader) ([]*pkg.Package, []artifact
 	dec := json.NewDecoder(reader)
 
 	for {
-		var p PackageJSON
+		var p packageJSON
 		if err := dec.Decode(&p); err == io.EOF {
 			break
 		} else if err != nil {
@@ -185,7 +185,7 @@ func parsePackageJSON(path string, reader io.Reader) ([]*pkg.Package, []artifact
 	return packages, nil, nil
 }
 
-func newPackageJSONPackage(p PackageJSON) *pkg.Package {
+func newPackageJSONPackage(p packageJSON) *pkg.Package {
 	licenses, err := p.licensesFromJSON()
 	if err != nil {
 		log.Warnf("unable to extract licenses from javascript package.json: %+v", err)
@@ -199,6 +199,8 @@ func newPackageJSONPackage(p PackageJSON) *pkg.Package {
 		Type:         pkg.NpmPkg,
 		MetadataType: pkg.NpmPackageJSONMetadataType,
 		Metadata: pkg.NpmPackageJSONMetadata{
+			Name:     p.Name,
+			Version:  p.Version,
 			Author:   p.Author.AuthorString(),
 			Homepage: p.Homepage,
 			URL:      p.Repository.URL,
@@ -207,7 +209,7 @@ func newPackageJSONPackage(p PackageJSON) *pkg.Package {
 	}
 }
 
-func (p PackageJSON) hasNameAndVersionValues() bool {
+func (p packageJSON) hasNameAndVersionValues() bool {
 	return p.Name != "" && p.Version != ""
 }
 

syft/pkg/cataloger/javascript/parse_package_json_test.go

@@ -24,6 +24,8 @@ func TestParsePackageJSON(t *testing.T) {
 				Language:     pkg.JavaScript,
 				MetadataType: pkg.NpmPackageJSONMetadataType,
 				Metadata: pkg.NpmPackageJSONMetadata{
+					Name:     "npm",
+					Version:  "6.14.6",
 					Author:   "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me)",
 					Homepage: "https://docs.npmjs.com/",
 					URL:      "https://github.com/npm/cli",
@@ -41,6 +43,8 @@ func TestParsePackageJSON(t *testing.T) {
 				Language:     pkg.JavaScript,
 				MetadataType: pkg.NpmPackageJSONMetadataType,
 				Metadata: pkg.NpmPackageJSONMetadata{
+					Name:     "npm",
+					Version:  "6.14.6",
 					Author:   "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me)",
 					Homepage: "https://docs.npmjs.com/",
 					URL:      "https://github.com/npm/cli",
@@ -58,6 +62,8 @@ func TestParsePackageJSON(t *testing.T) {
 				Language:     pkg.JavaScript,
 				MetadataType: pkg.NpmPackageJSONMetadataType,
 				Metadata: pkg.NpmPackageJSONMetadata{
+					Name:     "npm",
+					Version:  "6.14.6",
 					Author:   "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me)",
 					Homepage: "https://docs.npmjs.com/",
 					URL:      "https://github.com/npm/cli",
@@ -75,6 +81,8 @@ func TestParsePackageJSON(t *testing.T) {
 				Language:     pkg.JavaScript,
 				MetadataType: pkg.NpmPackageJSONMetadataType,
 				Metadata: pkg.NpmPackageJSONMetadata{
+					Name:     "npm",
+					Version:  "6.14.6",
 					Author:   "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me)",
 					Homepage: "https://docs.npmjs.com/",
 					URL:      "https://github.com/npm/cli",
@@ -92,6 +100,8 @@ func TestParsePackageJSON(t *testing.T) {
 				Language:     pkg.JavaScript,
 				MetadataType: pkg.NpmPackageJSONMetadataType,
 				Metadata: pkg.NpmPackageJSONMetadata{
+					Name:     "npm",
+					Version:  "6.14.6",
 					Author:   "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me)",
 					Homepage: "https://docs.npmjs.com/",
 					URL:      "https://github.com/npm/cli",
@@ -109,6 +119,8 @@ func TestParsePackageJSON(t *testing.T) {
 				Language:     pkg.JavaScript,
 				MetadataType: pkg.NpmPackageJSONMetadataType,
 				Metadata: pkg.NpmPackageJSONMetadata{
+					Name:     "function-bind",
+					Version:  "1.1.1",
 					Author:   "Raynos <raynos2@gmail.com>",
 					Homepage: "https://github.com/Raynos/function-bind",
 					URL:      "git://github.com/Raynos/function-bind.git",

syft/pkg/cataloger/package_url.go

@@ -1,49 +0,0 @@
-package cataloger
-
-import (
-	"regexp"
-	"strings"
-
-	"github.com/anchore/packageurl-go"
-	"github.com/anchore/syft/syft/linux"
-	"github.com/anchore/syft/syft/pkg"
-)
-
-// generatePackageURL returns a package-URL representation of the given package (see https://github.com/package-url/purl-spec)
-func generatePackageURL(p pkg.Package, release *linux.Release) string {
-	// default to pURLs on the metadata
-	if p.Metadata != nil {
-		if i, ok := p.Metadata.(interface{ PackageURL() string }); ok {
-			return i.PackageURL()
-		} else if i, ok := p.Metadata.(interface{ PackageURL(*linux.Release) string }); ok {
-			return i.PackageURL(release)
-		}
-	}
-
-	var purlType = p.Type.PackageURLType()
-	var name = p.Name
-	var namespace = ""
-
-	switch {
-	case purlType == "":
-		// there is no purl type, don't attempt to craft a purl
-		// TODO: should this be a "generic" purl type instead?
-		return ""
-	case p.Type == pkg.GoModulePkg:
-		re := regexp.MustCompile(`(/)[^/]*$`)
-		fields := re.Split(p.Name, -1)
-		namespace = fields[0]
-		name = strings.TrimPrefix(p.Name, namespace+"/")
-	}
-
-	// generate a purl from the package data
-	pURL := packageurl.NewPackageURL(
-		purlType,
-		namespace,
-		name,
-		p.Version,
-		nil,
-		"")
-
-	return pURL.ToString()
-}

syft/pkg/cataloger/package_url_test.go

@@ -1,166 +0,0 @@
-package cataloger
-
-import (
-	"testing"
-
-	"github.com/anchore/syft/syft/linux"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/sergi/go-diff/diffmatchpatch"
-)
-
-func TestPackageURL(t *testing.T) {
-	tests := []struct {
-		name     string
-		pkg      pkg.Package
-		distro   *linux.Release
-		expected string
-	}{
-		{
-			name: "golang",
-			pkg: pkg.Package{
-				Name:    "github.com/anchore/syft",
-				Version: "v0.1.0",
-				Type:    pkg.GoModulePkg,
-			},
-			expected: "pkg:golang/github.com/anchore/syft@v0.1.0",
-		},
-		{
-			name: "pip with vcs url",
-			pkg: pkg.Package{
-				Name:    "bad-name",
-				Version: "bad-v0.1.0",
-				Type:    pkg.PythonPkg,
-				Metadata: pkg.PythonPackageMetadata{
-					Name:    "name",
-					Version: "v0.1.0",
-					DirectURLOrigin: &pkg.PythonDirectURLOriginInfo{
-						VCS:      "git",
-						URL:      "https://github.com/test/test.git",
-						CommitID: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-					},
-				},
-			},
-			expected: "pkg:pypi/name@v0.1.0?vcs_url=git+https:%2F%2Fgithub.com%2Ftest%2Ftest.git@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-		},
-		{
-			name: "pip without vcs url",
-			pkg: pkg.Package{
-				Name:    "bad-name",
-				Version: "bad-v0.1.0",
-				Type:    pkg.PythonPkg,
-				Metadata: pkg.PythonPackageMetadata{
-					Name:    "name",
-					Version: "v0.1.0",
-				},
-			},
-			expected: "pkg:pypi/name@v0.1.0",
-		},
-		{
-			name: "gem",
-			pkg: pkg.Package{
-				Name:    "name",
-				Version: "v0.1.0",
-				Type:    pkg.GemPkg,
-			},
-			expected: "pkg:gem/name@v0.1.0",
-		},
-		{
-			name: "npm",
-			pkg: pkg.Package{
-				Name:    "name",
-				Version: "v0.1.0",
-				Type:    pkg.NpmPkg,
-			},
-			expected: "pkg:npm/name@v0.1.0",
-		},
-		{
-			name: "deb with arch",
-			distro: &linux.Release{
-				ID: "ubuntu",
-			},
-			pkg: pkg.Package{
-				Name:    "bad-name",
-				Version: "bad-v0.1.0",
-				Type:    pkg.DebPkg,
-				Metadata: pkg.DpkgMetadata{
-					Package:      "name",
-					Version:      "v0.1.0",
-					Architecture: "amd64",
-				},
-			},
-			expected: "pkg:deb/ubuntu/name@v0.1.0?arch=amd64",
-		},
-		{
-			name: "deb with epoch",
-			distro: &linux.Release{
-				ID: "centos",
-			},
-			pkg: pkg.Package{
-				Name:    "bad-name",
-				Version: "bad-v0.1.0",
-				Type:    pkg.RpmPkg,
-				Metadata: pkg.RpmdbMetadata{
-					Name:    "name",
-					Version: "0.1.0",
-					Epoch:   intRef(2),
-					Arch:    "amd64",
-					Release: "3",
-				},
-			},
-			expected: "pkg:rpm/centos/name@0.1.0-3?arch=amd64&epoch=2",
-		},
-		{
-			name: "deb with nil epoch",
-			distro: &linux.Release{
-				ID: "centos",
-			},
-			pkg: pkg.Package{
-				Name:    "bad-name",
-				Version: "bad-v0.1.0",
-				Type:    pkg.RpmPkg,
-				Metadata: pkg.RpmdbMetadata{
-					Name:    "name",
-					Version: "0.1.0",
-					Epoch:   nil,
-					Arch:    "amd64",
-					Release: "3",
-				},
-			},
-			expected: "pkg:rpm/centos/name@0.1.0-3?arch=amd64",
-		},
-		{
-			name:   "deb with unknown distro",
-			distro: nil,
-			pkg: pkg.Package{
-				Name:    "name",
-				Version: "v0.1.0",
-				Type:    pkg.DebPkg,
-			},
-			expected: "pkg:deb/name@v0.1.0",
-		},
-		{
-			name: "cargo",
-			pkg: pkg.Package{
-				Name:    "name",
-				Version: "v0.1.0",
-				Type:    pkg.RustPkg,
-			},
-			expected: "pkg:cargo/name@v0.1.0",
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			actual := generatePackageURL(test.pkg, test.distro)
-			if actual != test.expected {
-				dmp := diffmatchpatch.New()
-				diffs := dmp.DiffMain(test.expected, actual, true)
-				t.Errorf("diff: %s", dmp.DiffPrettyText(diffs))
-			}
-		})
-	}
-}
-
-func intRef(i int) *int {
-	return &i
-}

syft/pkg/dpkg_metadata.go

@@ -1,6 +1,7 @@
 package pkg
 
 import (
+	"fmt"
 	"sort"
 
 	"github.com/anchore/syft/syft/file"
@@ -12,7 +13,10 @@ import (
 
 const DpkgDBGlob = "**/var/lib/dpkg/{status,status.d/**}"
 
-var _ FileOwner = (*DpkgMetadata)(nil)
+var (
+	_ FileOwner     = (*DpkgMetadata)(nil)
+	_ urlIdentifier = (*DpkgMetadata)(nil)
+)
 
 // DpkgMetadata represents all captured data for a Debian package DB entry; available fields are described
 // at http://manpages.ubuntu.com/manpages/xenial/man1/dpkg-query.1.html in the --showformat section.
@@ -36,24 +40,36 @@ type DpkgFileRecord struct {
 
 // PackageURL returns the PURL for the specific Debian package (see https://github.com/package-url/purl-spec)
 func (m DpkgMetadata) PackageURL(distro *linux.Release) string {
-	if distro == nil {
-		return ""
+	var namespace string
+	if distro != nil {
+		namespace = distro.ID
 	}
-	pURL := packageurl.NewPackageURL(
+
+	qualifiers := map[string]string{
+		purlArchQualifier: m.Architecture,
+	}
+
+	if m.Source != "" {
+		if m.SourceVersion != "" {
+			qualifiers[purlUpstreamQualifier] = fmt.Sprintf("%s@%s", m.Source, m.SourceVersion)
+		} else {
+			qualifiers[purlUpstreamQualifier] = m.Source
+		}
+	}
+
+	return packageurl.NewPackageURL(
 		// TODO: replace with `packageurl.TypeDebian` upon merge of https://github.com/package-url/packageurl-go/pull/21
 		// TODO: or, since we're now using an Anchore fork of this module, we could do this sooner.
 		"deb",
-		distro.ID,
+		namespace,
 		m.Package,
 		m.Version,
-		packageurl.Qualifiers{
-			{
-				Key:   "arch",
-				Value: m.Architecture,
-			},
-		},
-		"")
-	return pURL.ToString()
+		purlQualifiers(
+			qualifiers,
+			distro,
+		),
+		"",
+	).ToString()
 }
 
 func (m DpkgMetadata) OwnedFiles() (result []string) {

syft/pkg/dpkg_metadata_test.go

@@ -12,39 +12,76 @@ import (
 
 func TestDpkgMetadata_pURL(t *testing.T) {
 	tests := []struct {
-		distro   linux.Release
+		name     string
+		distro   *linux.Release
 		metadata DpkgMetadata
 		expected string
 	}{
 		{
-			distro: linux.Release{
-				ID: "debian",
+			name: "go case",
+			distro: &linux.Release{
+				ID:        "debian",
+				VersionID: "11",
 			},
 			metadata: DpkgMetadata{
-				Package:      "p",
-				Source:       "s",
-				Version:      "v",
-				Architecture: "a",
+				Package: "p",
+				Version: "v",
 			},
-			expected: "pkg:deb/debian/p@v?arch=a",
+			expected: "pkg:deb/debian/p@v?distro=debian-11",
 		},
 		{
-			distro: linux.Release{
-				ID: "ubuntu",
+			name: "with arch info",
+			distro: &linux.Release{
+				ID:        "ubuntu",
+				VersionID: "16.04",
 			},
 			metadata: DpkgMetadata{
 				Package:      "p",
-				Source:       "s",
 				Version:      "v",
 				Architecture: "a",
 			},
-			expected: "pkg:deb/ubuntu/p@v?arch=a",
+			expected: "pkg:deb/ubuntu/p@v?arch=a&distro=ubuntu-16.04",
+		},
+		{
+			name: "missing distro",
+			metadata: DpkgMetadata{
+				Package: "p",
+				Version: "v",
+			},
+			expected: "pkg:deb/p@v",
+		},
+		{
+			name: "with upstream qualifier with source pkg name info",
+			distro: &linux.Release{
+				ID:        "debian",
+				VersionID: "11",
+			},
+			metadata: DpkgMetadata{
+				Package: "p",
+				Source:  "s",
+				Version: "v",
+			},
+			expected: "pkg:deb/debian/p@v?upstream=s&distro=debian-11",
+		},
+		{
+			name: "with upstream qualifier with source pkg name and version info",
+			distro: &linux.Release{
+				ID:        "debian",
+				VersionID: "11",
+			},
+			metadata: DpkgMetadata{
+				Package:       "p",
+				Source:        "s",
+				Version:       "v",
+				SourceVersion: "2.3",
+			},
+			expected: "pkg:deb/debian/p@v?upstream=s@2.3&distro=debian-11",
 		},
 	}
 
 	for _, test := range tests {
-		t.Run(test.expected, func(t *testing.T) {
-			actual := test.metadata.PackageURL(&test.distro)
+		t.Run(test.name, func(t *testing.T) {
+			actual := test.metadata.PackageURL(test.distro)
 			if actual != test.expected {
 				dmp := diffmatchpatch.New()
 				diffs := dmp.DiffMain(test.expected, actual, true)

syft/pkg/java_metadata.go

@@ -3,10 +3,14 @@ package pkg
 import (
 	"strings"
 
+	"github.com/anchore/syft/syft/linux"
+
 	"github.com/anchore/packageurl-go"
 	"github.com/anchore/syft/internal"
 )
 
+var _ urlIdentifier = (*JavaMetadata)(nil)
+
 var JenkinsPluginPomPropertiesGroupIDs = []string{
 	"io.jenkins.plugins",
 	"org.jenkins.plugins",
@@ -19,7 +23,7 @@ var JenkinsPluginPomPropertiesGroupIDs = []string{
 type JavaMetadata struct {
 	VirtualPath   string         `json:"virtualPath"`
 	Manifest      *JavaManifest  `mapstructure:"Manifest" json:"manifest,omitempty"`
-	PomProperties *PomProperties `mapstructure:"PomProperties" json:"pomProperties,omitempty"`
+	PomProperties *PomProperties `mapstructure:"PomProperties" json:"pomProperties,omitempty" cyclonedx:"-"`
 	PomProject    *PomProject    `mapstructure:"PomProject" json:"pomProject,omitempty"`
 	Parent        *Package       `hash:"ignore" json:"-"` // note: the parent cannot be included in the minimal definition of uniqueness since this field is not reproducible in an encode-decode cycle (is lossy).
 }
@@ -28,8 +32,8 @@ type JavaMetadata struct {
 type PomProperties struct {
 	Path       string            `mapstructure:"path" json:"path"`
 	Name       string            `mapstructure:"name" json:"name"`
-	GroupID    string            `mapstructure:"groupId" json:"groupId"`
-	ArtifactID string            `mapstructure:"artifactId" json:"artifactId"`
+	GroupID    string            `mapstructure:"groupId" json:"groupId" cyclonedx:"groupID"`
+	ArtifactID string            `mapstructure:"artifactId" json:"artifactId" cyclonedx:"artifactID"`
 	Version    string            `mapstructure:"version" json:"version"`
 	Extra      map[string]string `mapstructure:",remain" json:"extraFields"`
 }
@@ -68,8 +72,8 @@ type JavaManifest struct {
 	NamedSections map[string]map[string]string `json:"namedSections,omitempty"`
 }
 
-// PackageURL returns the PURL for the specific Alpine package (see https://github.com/package-url/purl-spec)
-func (m JavaMetadata) PackageURL() string {
+// PackageURL returns the PURL for the specific Maven package (see https://github.com/package-url/purl-spec)
+func (m JavaMetadata) PackageURL(_ *linux.Release) string {
 	if m.PomProperties != nil {
 		pURL := packageurl.NewPackageURL(
 			packageurl.TypeMaven,

syft/pkg/java_metadata_test.go

@@ -136,7 +136,7 @@ func TestJavaMetadata_pURL(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.expected, func(t *testing.T) {
-			actual := test.metadata.PackageURL()
+			actual := test.metadata.PackageURL(nil)
 			if actual != test.expected {
 				dmp := diffmatchpatch.New()
 				diffs := dmp.DiffMain(test.expected, actual, true)

syft/pkg/language.go

@@ -1,5 +1,7 @@
 package pkg
 
+import "github.com/anchore/packageurl-go"
+
 // Language represents a single programming language.
 type Language string
 
@@ -30,3 +32,29 @@ var AllLanguages = []Language{
 func (l Language) String() string {
 	return string(l)
 }
+
+func LanguageFromPURL(p string) Language {
+	purl, err := packageurl.FromString(p)
+	if err != nil {
+		return UnknownLanguage
+	}
+
+	switch purl.Type {
+	case packageurl.TypeMaven, purlGradlePkgType:
+		return Java
+	case packageurl.TypeComposer:
+		return PHP
+	case packageurl.TypeGolang:
+		return Go
+	case packageurl.TypeNPM:
+		return JavaScript
+	case packageurl.TypePyPi:
+		return Python
+	case packageurl.TypeGem:
+		return Ruby
+	case purlCargoPkgType:
+		return Rust
+	default:
+		return UnknownLanguage
+	}
+}

syft/pkg/language_test.go

@@ -0,0 +1,66 @@
+package pkg
+
+import (
+	"github.com/scylladb/go-set/strset"
+	"github.com/stretchr/testify/assert"
+	"testing"
+)
+
+func TestLanguageFromPURL(t *testing.T) {
+
+	tests := []struct {
+		purl string
+		want Language
+	}{
+
+		{
+			purl: "pkg:npm/util@2.32",
+			want: JavaScript,
+		},
+		{
+			purl: "pkg:pypi/util-linux@2.32.1-27.el8",
+			want: Python,
+		},
+		{
+			purl: "pkg:gem/ruby-advisory-db-check@0.12.4",
+			want: Ruby,
+		},
+		{
+			purl: "pkg:golang/github.com/gorilla/context@234fd47e07d1004f0aed9c",
+			want: Go,
+		},
+		{
+			purl: "pkg:cargo/clap@2.33.0",
+			want: Rust,
+		},
+		{
+			purl: "pkg:composer/laravel/laravel@5.5.0",
+			want: PHP,
+		},
+		{
+			purl: "pkg:maven/org.apache.xmlgraphics/batik-anim@1.9.1?type=zip&classifier=dist",
+			want: Java,
+		},
+	}
+
+	var languages []string
+	var expectedLanguages = strset.New()
+	for _, ty := range AllLanguages {
+		expectedLanguages.Add(string(ty))
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.purl, func(t *testing.T) {
+			actual := LanguageFromPURL(tt.purl)
+
+			if actual != "" {
+				languages = append(languages, string(actual))
+			}
+
+			assert.Equalf(t, tt.want, actual, "LanguageFromPURL(%v)", tt.purl)
+		})
+	}
+
+	assert.ElementsMatch(t, expectedLanguages.List(), languages, "missing one or more languages to test against (maybe a package type was added?)")
+
+}

syft/pkg/npm_metadata.go

@@ -1,11 +0,0 @@
-package pkg
-
-// NpmPackageJSONMetadata holds extra information that is used in pkg.Package
-type NpmPackageJSONMetadata struct {
-	Files       []string `mapstructure:"files" json:"files,omitempty"`
-	Author      string   `mapstructure:"author" json:"author"`
-	Licenses    []string `mapstructure:"licenses" json:"licenses"`
-	Homepage    string   `mapstructure:"homepage" json:"homepage"`
-	Description string   `mapstructure:"description" json:"description"`
-	URL         string   `mapstructure:"url" json:"url"`
-}

syft/pkg/npm_package_json_metadata.go

@@ -0,0 +1,32 @@
+package pkg
+
+import (
+	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/syft/linux"
+)
+
+var _ urlIdentifier = (*NpmPackageJSONMetadata)(nil)
+
+// NpmPackageJSONMetadata holds extra information that is used in pkg.Package
+type NpmPackageJSONMetadata struct {
+	Name        string   `mapstructure:"name" json:"name"`
+	Version     string   `mapstructure:"version" json:"version"`
+	Files       []string `mapstructure:"files" json:"files,omitempty"`
+	Author      string   `mapstructure:"author" json:"author"`
+	Licenses    []string `mapstructure:"licenses" json:"licenses"`
+	Homepage    string   `mapstructure:"homepage" json:"homepage"`
+	Description string   `mapstructure:"description" json:"description"`
+	URL         string   `mapstructure:"url" json:"url"`
+}
+
+// PackageURL returns the PURL for the specific NPM package (see https://github.com/package-url/purl-spec)
+func (p NpmPackageJSONMetadata) PackageURL(_ *linux.Release) string {
+	return packageurl.NewPackageURL(
+		packageurl.TypeNPM,
+		"",
+		p.Name,
+		p.Version,
+		nil,
+		"",
+	).ToString()
+}

syft/pkg/php_composer_json_metadata.go

@@ -4,8 +4,11 @@ import (
 	"strings"
 
 	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/syft/linux"
 )
 
+var _ urlIdentifier = (*PhpComposerJSONMetadata)(nil)
+
 // PhpComposerJSONMetadata represents information found from composer v1/v2 "installed.json" files as well as composer.lock files
 type PhpComposerJSONMetadata struct {
 	Name            string                       `json:"name"`
@@ -40,7 +43,7 @@ type PhpComposerAuthors struct {
 	Homepage string `json:"homepage,omitempty"`
 }
 
-func (m PhpComposerJSONMetadata) PackageURL() string {
+func (m PhpComposerJSONMetadata) PackageURL(_ *linux.Release) string {
 	var name, vendor string
 	fields := strings.Split(m.Name, "/")
 	switch len(fields) {

syft/pkg/php_composer_json_metadata_test.go

@@ -20,7 +20,8 @@ func TestPhpComposerJsonMetadata_pURL(t *testing.T) {
 				Version: "1.0.1",
 			},
 			expected: "pkg:composer/ven/name@1.0.1",
-		}, {
+		},
+		{
 			name: "name with slashes (invalid)",
 			metadata: PhpComposerJSONMetadata{
 				Name:    "ven/name/component",
@@ -36,11 +37,23 @@ func TestPhpComposerJsonMetadata_pURL(t *testing.T) {
 			},
 			expected: "pkg:composer/name@1.0.1",
 		},
+		{
+			name: "ignores distro",
+			distro: &linux.Release{
+				ID:        "rhel",
+				VersionID: "8.4",
+			},
+			metadata: PhpComposerJSONMetadata{
+				Name:    "ven/name",
+				Version: "1.0.1",
+			},
+			expected: "pkg:composer/ven/name@1.0.1",
+		},
 	}
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			actual := test.metadata.PackageURL()
+			actual := test.metadata.PackageURL(test.distro)
 			if actual != test.expected {
 				dmp := diffmatchpatch.New()
 				diffs := dmp.DiffMain(test.expected, actual, true)

syft/pkg/python_package_metadata.go

@@ -4,11 +4,16 @@ import (
 	"fmt"
 	"sort"
 
+	"github.com/anchore/syft/syft/linux"
+
 	"github.com/anchore/packageurl-go"
 	"github.com/scylladb/go-set/strset"
 )
 
-var _ FileOwner = (*PythonPackageMetadata)(nil)
+var (
+	_ FileOwner     = (*PythonPackageMetadata)(nil)
+	_ urlIdentifier = (*PythonPackageMetadata)(nil)
+)
 
 // PythonFileDigest represents the file metadata for a single file attributed to a python package.
 type PythonFileDigest struct {
@@ -76,7 +81,7 @@ func (m PythonPackageMetadata) OwnedFiles() (result []string) {
 	return result
 }
 
-func (m PythonPackageMetadata) PackageURL() string {
+func (m PythonPackageMetadata) PackageURL(_ *linux.Release) string {
 	// generate a purl from the package data
 	pURL := packageurl.NewPackageURL(
 		packageurl.TypePyPi,
@@ -101,7 +106,7 @@ func (p PythonDirectURLOriginInfo) vcsURLQualifier() packageurl.Qualifiers {
 	if p.VCS != "" {
 		// Taken from https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst#known-qualifiers-keyvalue-pairs
 		// packageurl-go still doesn't support all qualifier names
-		return packageurl.Qualifiers{{Key: "vcs_url", Value: fmt.Sprintf("%s+%s@%s", p.VCS, p.URL, p.CommitID)}}
+		return packageurl.Qualifiers{{Key: purlVCSURLQualifier, Value: fmt.Sprintf("%s+%s@%s", p.VCS, p.URL, p.CommitID)}}
 	}
-	return packageurl.Qualifiers{}
+	return nil
 }

syft/pkg/python_package_metadata_test.go

@@ -1,12 +1,60 @@
 package pkg
 
 import (
+	"github.com/anchore/syft/syft/linux"
+	"github.com/sergi/go-diff/diffmatchpatch"
 	"strings"
 	"testing"
 
 	"github.com/go-test/deep"
 )
 
+func TestPythonPackageMetadata_pURL(t *testing.T) {
+	tests := []struct {
+		name     string
+		distro   *linux.Release
+		metadata PythonPackageMetadata
+		expected string
+	}{
+		{
+			name: "with vcs info",
+			metadata: PythonPackageMetadata{
+				Name:    "name",
+				Version: "v0.1.0",
+				DirectURLOrigin: &PythonDirectURLOriginInfo{
+					VCS:      "git",
+					URL:      "https://github.com/test/test.git",
+					CommitID: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+				},
+			},
+			expected: "pkg:pypi/name@v0.1.0?vcs_url=git+https:%2F%2Fgithub.com%2Ftest%2Ftest.git@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+		},
+		{
+			name: "should not respond to release info",
+			distro: &linux.Release{
+				ID:        "rhel",
+				VersionID: "8.4",
+			},
+			metadata: PythonPackageMetadata{
+				Name:    "name",
+				Version: "v0.1.0",
+			},
+			expected: "pkg:pypi/name@v0.1.0",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actual := test.metadata.PackageURL(test.distro)
+			if actual != test.expected {
+				dmp := diffmatchpatch.New()
+				diffs := dmp.DiffMain(test.expected, actual, true)
+				t.Errorf("diff: %s", dmp.DiffPrettyText(diffs))
+			}
+		})
+	}
+}
+
 func TestPythonMetadata_FileOwner(t *testing.T) {
 	tests := []struct {
 		metadata PythonPackageMetadata

syft/pkg/rpmdb_metadata.go

@@ -15,7 +15,10 @@ import (
 
 const RpmDBGlob = "**/var/lib/rpm/Packages"
 
-var _ FileOwner = (*RpmdbMetadata)(nil)
+var (
+	_ FileOwner     = (*RpmdbMetadata)(nil)
+	_ urlIdentifier = (*RpmdbMetadata)(nil)
+)
 
 // RpmdbMetadata represents all captured data for a RPM DB package entry.
 type RpmdbMetadata struct {
@@ -47,36 +50,36 @@ type RpmdbFileMode uint16
 
 // PackageURL returns the PURL for the specific RHEL package (see https://github.com/package-url/purl-spec)
 func (m RpmdbMetadata) PackageURL(distro *linux.Release) string {
-	if distro == nil {
-		return ""
+	var namespace string
+	if distro != nil {
+		namespace = distro.ID
 	}
 
-	qualifiers := packageurl.Qualifiers{
-		{
-			Key:   "arch",
-			Value: m.Arch,
-		},
+	qualifiers := map[string]string{
+		purlArchQualifier: m.Arch,
 	}
 
 	if m.Epoch != nil {
-		qualifiers = append(qualifiers,
-			packageurl.Qualifier{
-				Key:   "epoch",
-				Value: strconv.Itoa(*m.Epoch),
-			},
-		)
+		qualifiers[purlEpochQualifier] = strconv.Itoa(*m.Epoch)
 	}
 
-	pURL := packageurl.NewPackageURL(
+	if m.SourceRpm != "" {
+		qualifiers[purlUpstreamQualifier] = m.SourceRpm
+	}
+
+	return packageurl.NewPackageURL(
 		packageurl.TypeRPM,
-		distro.ID,
+		namespace,
 		m.Name,
 		// for purl the epoch is a qualifier, not part of the version
 		// see https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst under the RPM section
 		fmt.Sprintf("%s-%s", m.Version, m.Release),
-		qualifiers,
-		"")
-	return pURL.ToString()
+		purlQualifiers(
+			qualifiers,
+			distro,
+		),
+		"",
+	).ToString()
 }
 
 func (m RpmdbMetadata) OwnedFiles() (result []string) {

syft/pkg/rpmdb_metadata_test.go

@@ -12,13 +12,30 @@ import (
 
 func TestRpmMetadata_pURL(t *testing.T) {
 	tests := []struct {
-		distro   linux.Release
+		name     string
+		distro   *linux.Release
 		metadata RpmdbMetadata
 		expected string
 	}{
 		{
-			distro: linux.Release{
-				ID: "centos",
+			name: "go case",
+			distro: &linux.Release{
+				ID:        "rhel",
+				VersionID: "8.4",
+			},
+			metadata: RpmdbMetadata{
+				Name:    "p",
+				Version: "v",
+				Release: "r",
+				Epoch:   nil,
+			},
+			expected: "pkg:rpm/rhel/p@v-r?distro=rhel-8.4",
+		},
+		{
+			name: "with arch and epoch",
+			distro: &linux.Release{
+				ID:        "centos",
+				VersionID: "7",
 			},
 			metadata: RpmdbMetadata{
 				Name:    "p",
@@ -27,26 +44,37 @@ func TestRpmMetadata_pURL(t *testing.T) {
 				Release: "r",
 				Epoch:   intRef(1),
 			},
-			expected: "pkg:rpm/centos/p@v-r?arch=a&epoch=1",
+			expected: "pkg:rpm/centos/p@v-r?arch=a&epoch=1&distro=centos-7",
 		},
 		{
-			distro: linux.Release{
-				ID: "rhel",
-			},
+			name: "missing distro",
 			metadata: RpmdbMetadata{
 				Name:    "p",
 				Version: "v",
-				Arch:    "a",
 				Release: "r",
 				Epoch:   nil,
 			},
-			expected: "pkg:rpm/rhel/p@v-r?arch=a",
+			expected: "pkg:rpm/p@v-r",
+		},
+		{
+			name: "with upstream source rpm info",
+			distro: &linux.Release{
+				ID:        "rhel",
+				VersionID: "8.4",
+			},
+			metadata: RpmdbMetadata{
+				Name:      "p",
+				Version:   "v",
+				Release:   "r",
+				SourceRpm: "sourcerpm",
+			},
+			expected: "pkg:rpm/rhel/p@v-r?upstream=sourcerpm&distro=rhel-8.4",
 		},
 	}
 
 	for _, test := range tests {
-		t.Run(test.expected, func(t *testing.T) {
-			actual := test.metadata.PackageURL(&test.distro)
+		t.Run(test.name, func(t *testing.T) {
+			actual := test.metadata.PackageURL(test.distro)
 			if actual != test.expected {
 				dmp := diffmatchpatch.New()
 				diffs := dmp.DiffMain(test.expected, actual, true)

syft/pkg/type.go

@@ -66,3 +66,35 @@ func (t Type) PackageURLType() string {
 		return ""
 	}
 }
+
+func TypeFromPURL(p string) Type {
+	purl, err := packageurl.FromString(p)
+	if err != nil {
+		return UnknownPkg
+	}
+
+	switch purl.Type {
+	case packageurl.TypeDebian, "deb":
+		return DebPkg
+	case packageurl.TypeRPM:
+		return RpmPkg
+	case "alpine":
+		return ApkPkg
+	case packageurl.TypeMaven:
+		return JavaPkg
+	case packageurl.TypeComposer:
+		return PhpComposerPkg
+	case packageurl.TypeGolang:
+		return GoModulePkg
+	case packageurl.TypeNPM:
+		return NpmPkg
+	case packageurl.TypePyPi:
+		return PythonPkg
+	case packageurl.TypeGem:
+		return GemPkg
+	case "cargo", "crate":
+		return RustPkg
+	default:
+		return UnknownPkg
+	}
+}

syft/pkg/type_test.go

@@ -0,0 +1,83 @@
+package pkg
+
+import (
+	"github.com/scylladb/go-set/strset"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestTypeFromPURL(t *testing.T) {
+
+	tests := []struct {
+		name     string
+		purl     string
+		expected Type
+	}{
+		{
+			purl:     "pkg:rpm/fedora/util-linux@2.32.1-27.el8-?arch=amd64",
+			expected: RpmPkg,
+		},
+		{
+			purl:     "pkg:alpine/util-linux@2.32.1",
+			expected: ApkPkg,
+		},
+		{
+			purl:     "pkg:deb/debian/curl@7.50.3-1?arch=i386&distro=jessie",
+			expected: DebPkg,
+		},
+		{
+			purl:     "pkg:npm/util@2.32",
+			expected: NpmPkg,
+		},
+		{
+			purl:     "pkg:pypi/util-linux@2.32.1-27.el8",
+			expected: PythonPkg,
+		},
+		{
+			purl:     "pkg:gem/ruby-advisory-db-check@0.12.4",
+			expected: GemPkg,
+		},
+		{
+			purl:     "pkg:golang/github.com/gorilla/context@234fd47e07d1004f0aed9c",
+			expected: GoModulePkg,
+		},
+		{
+			purl:     "pkg:cargo/clap@2.33.0",
+			expected: RustPkg,
+		},
+		{
+			purl:     "pkg:composer/laravel/laravel@5.5.0",
+			expected: PhpComposerPkg,
+		},
+		{
+			purl:     "pkg:maven/org.apache.xmlgraphics/batik-anim@1.9.1?type=zip&classifier=dist",
+			expected: JavaPkg,
+		},
+	}
+
+	var pkgTypes []string
+	var expectedTypes = strset.New()
+	for _, ty := range AllPkgs {
+		expectedTypes.Add(string(ty))
+	}
+
+	// testing microsoft packages and jenkins-plugins is not valid for purl at this time
+	expectedTypes.Remove(string(KbPkg))
+	expectedTypes.Remove(string(JenkinsPluginPkg))
+
+	for _, test := range tests {
+		t.Run(string(test.expected), func(t *testing.T) {
+			actual := TypeFromPURL(test.purl)
+
+			if actual != "" {
+				pkgTypes = append(pkgTypes, string(actual))
+			}
+
+			assert.Equal(t, test.expected, actual)
+		})
+	}
+
+	assert.ElementsMatch(t, expectedTypes.List(), pkgTypes, "missing one or more package types to test against (maybe a package type was added?)")
+
+}

syft/pkg/url.go

@@ -0,0 +1,92 @@
+package pkg
+
+import (
+	"fmt"
+	"regexp"
+	"sort"
+	"strings"
+
+	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/syft/linux"
+)
+
+const (
+	purlArchQualifier   = "arch"
+	purlDistroQualifier = "distro"
+	purlEpochQualifier  = "epoch"
+	purlVCSURLQualifier = "vcs_url"
+
+	// this qualifier is not in the pURL spec, but is used by grype to perform indirect matching based on source information
+	purlUpstreamQualifier = "upstream"
+
+	purlCargoPkgType  = "cargo"
+	purlGradlePkgType = "gradle"
+)
+
+type urlIdentifier interface {
+	PackageURL(*linux.Release) string
+}
+
+func URL(p Package, release *linux.Release) string {
+	if p.Metadata != nil {
+		if i, ok := p.Metadata.(urlIdentifier); ok {
+			return i.PackageURL(release)
+		}
+	}
+
+	// the remaining cases are primarily reserved for packages without metadata struct instances
+
+	var purlType = p.Type.PackageURLType()
+	var name = p.Name
+	var namespace = ""
+
+	switch {
+	case purlType == "":
+		// there is no purl type, don't attempt to craft a purl
+		// TODO: should this be a "generic" purl type instead?
+		return ""
+	case p.Type == GoModulePkg:
+		re := regexp.MustCompile(`(/)[^/]*$`)
+		fields := re.Split(p.Name, -1)
+		namespace = fields[0]
+		name = strings.TrimPrefix(p.Name, namespace+"/")
+	}
+
+	// generate a purl from the package data
+	return packageurl.NewPackageURL(
+		purlType,
+		namespace,
+		name,
+		p.Version,
+		nil,
+		"",
+	).ToString()
+}
+
+func purlQualifiers(vars map[string]string, release *linux.Release) (q packageurl.Qualifiers) {
+	keys := make([]string, 0, len(vars))
+	for k := range vars {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+
+	for _, k := range keys {
+		val := vars[k]
+		if val == "" {
+			continue
+		}
+		q = append(q, packageurl.Qualifier{
+			Key:   k,
+			Value: vars[k],
+		})
+	}
+
+	if release != nil && release.ID != "" && release.VersionID != "" {
+		q = append(q, packageurl.Qualifier{
+			Key:   purlDistroQualifier,
+			Value: fmt.Sprintf("%s-%s", release.ID, release.VersionID),
+		})
+	}
+
+	return q
+}

syft/pkg/url_test.go

@@ -0,0 +1,200 @@
+package pkg
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/linux"
+	"github.com/scylladb/go-set/strset"
+	"github.com/sergi/go-diff/diffmatchpatch"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestPackageURL(t *testing.T) {
+	tests := []struct {
+		name     string
+		pkg      Package
+		distro   *linux.Release
+		expected string
+	}{
+		{
+			name: "golang",
+			pkg: Package{
+				Name:    "github.com/anchore/syft",
+				Version: "v0.1.0",
+				Type:    GoModulePkg,
+			},
+			expected: "pkg:golang/github.com/anchore/syft@v0.1.0",
+		},
+		{
+			name: "python",
+			pkg: Package{
+				Name:    "bad-name",
+				Version: "bad-v0.1.0",
+				Type:    PythonPkg,
+				Metadata: PythonPackageMetadata{
+					Name:    "name",
+					Version: "v0.1.0",
+				},
+			},
+			expected: "pkg:pypi/name@v0.1.0",
+		},
+		{
+			name: "gem",
+			pkg: Package{
+				Name:    "name",
+				Version: "v0.1.0",
+				Type:    GemPkg,
+			},
+			expected: "pkg:gem/name@v0.1.0",
+		},
+		{
+			name: "npm",
+			pkg: Package{
+				Name:    "name",
+				Version: "v0.1.0",
+				Type:    NpmPkg,
+			},
+			expected: "pkg:npm/name@v0.1.0",
+		},
+		{
+			name: "deb",
+			distro: &linux.Release{
+				ID:        "ubuntu",
+				VersionID: "20.04",
+			},
+			pkg: Package{
+				Name:    "bad-name",
+				Version: "bad-v0.1.0",
+				Type:    DebPkg,
+				Metadata: DpkgMetadata{
+					Package:      "name",
+					Version:      "v0.1.0",
+					Architecture: "amd64",
+				},
+			},
+			expected: "pkg:deb/ubuntu/name@v0.1.0?arch=amd64&distro=ubuntu-20.04",
+		},
+		{
+			name: "rpm",
+			distro: &linux.Release{
+				ID:        "centos",
+				VersionID: "7",
+			},
+			pkg: Package{
+				Name:    "bad-name",
+				Version: "bad-v0.1.0",
+				Type:    RpmPkg,
+				Metadata: RpmdbMetadata{
+					Name:    "name",
+					Version: "0.1.0",
+					Epoch:   intRef(2),
+					Arch:    "amd64",
+					Release: "3",
+				},
+			},
+			expected: "pkg:rpm/centos/name@0.1.0-3?arch=amd64&epoch=2&distro=centos-7",
+		},
+		{
+			name: "cargo",
+			pkg: Package{
+				Name:    "name",
+				Version: "v0.1.0",
+				Type:    RustPkg,
+			},
+			expected: "pkg:cargo/name@v0.1.0",
+		},
+		{
+			name: "apk",
+			distro: &linux.Release{
+				ID:        "alpine",
+				VersionID: "3.4.6",
+			},
+			pkg: Package{
+				Name:    "bad-name",
+				Version: "bad-v0.1.0",
+				Type:    ApkPkg,
+				Metadata: ApkMetadata{
+					Package:      "name",
+					Version:      "v0.1.0",
+					Architecture: "amd64",
+				},
+			},
+			expected: "pkg:alpine/name@v0.1.0?arch=amd64&distro=alpine-3.4.6",
+		},
+		{
+			name: "php-composer",
+			pkg: Package{
+				Name:    "bad-name",
+				Version: "bad-v0.1.0",
+				Type:    PhpComposerPkg,
+				Metadata: PhpComposerJSONMetadata{
+					Name:    "vendor/name",
+					Version: "2.0.1",
+				},
+			},
+			expected: "pkg:composer/vendor/name@2.0.1",
+		},
+		{
+			name: "java",
+			pkg: Package{
+				Name:    "bad-name",
+				Version: "bad-v0.1.0",
+				Type:    JavaPkg,
+				Metadata: JavaMetadata{
+					PomProperties: &PomProperties{
+						Path:       "p",
+						Name:       "n",
+						GroupID:    "g.id",
+						ArtifactID: "a",
+						Version:    "v",
+					},
+				},
+			},
+
+			expected: "pkg:maven/g.id/a@v",
+		},
+		{
+			name: "jenkins-plugin",
+			pkg: Package{
+				Name:    "bad-name",
+				Version: "bad-v0.1.0",
+				Type:    JenkinsPluginPkg,
+				Metadata: JavaMetadata{
+					PomProperties: &PomProperties{
+						Path:       "p",
+						Name:       "n",
+						GroupID:    "g.id",
+						ArtifactID: "a",
+						Version:    "v",
+					},
+				},
+			},
+
+			expected: "pkg:maven/g.id/a@v",
+		},
+	}
+
+	var pkgTypes []string
+	var expectedTypes = strset.New()
+	for _, ty := range AllPkgs {
+		expectedTypes.Add(string(ty))
+	}
+
+	// testing microsoft packages is not valid for purl at this time
+	expectedTypes.Remove(string(KbPkg))
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if test.pkg.Type != "" {
+				pkgTypes = append(pkgTypes, string(test.pkg.Type))
+			}
+			actual := URL(test.pkg, test.distro)
+			if actual != test.expected {
+				dmp := diffmatchpatch.New()
+				diffs := dmp.DiffMain(test.expected, actual, true)
+				t.Errorf("diff: %s", dmp.DiffPrettyText(diffs))
+			}
+		})
+	}
+	assert.ElementsMatch(t, expectedTypes.List(), pkgTypes, "missing one or more package types to test against (maybe a package type was added?)")
+}

syft/source/image_squash_resolver_test.go

@@ -239,9 +239,10 @@ func Test_imageSquashResolver_FilesByMIMEType(t *testing.T) {
 		{
 			fixtureName:   "image-simple",
 			mimeType:      "text/plain",
-			expectedPaths: strset.New("/somefile-1.txt", "/somefile-2.txt", "/really/nested/file-3.txt"),
+			expectedPaths: strset.New("/somefile-1.txt", "/somefile-2.txt", "/really/nested/file-3.txt", "/really/nested", "/really"),
 		},
 	}
+
 	for _, test := range tests {
 		t.Run(test.fixtureName, func(t *testing.T) {
 			img := imagetest.GetFixtureImage(t, "docker-archive", test.fixtureName)
@@ -252,7 +253,7 @@ func Test_imageSquashResolver_FilesByMIMEType(t *testing.T) {
 			locations, err := resolver.FilesByMIMEType(test.mimeType)
 			assert.NoError(t, err)
 
-			assert.Equal(t, test.expectedPaths.Size(), len(locations))
+			assert.Len(t, locations, test.expectedPaths.Size())
 			for _, l := range locations {
 				assert.True(t, test.expectedPaths.Has(l.RealPath), "does not have path %q", l.RealPath)
 			}

syft/source/scheme_test.go

@@ -142,6 +142,16 @@ func TestDetectScheme(t *testing.T) {
 			expectedScheme:   ImageScheme,
 			expectedLocation: "some/path-to-dir",
 		},
+		{
+			name:      "found-podman-image-scheme",
+			userInput: "podman:something:latest",
+			detection: detectorResult{
+				src: image.PodmanDaemonSource,
+				ref: "something:latest",
+			},
+			expectedScheme:   ImageScheme,
+			expectedLocation: "something:latest",
+		},
 		{
 			name:      "explicit-dir",
 			userInput: "dir:some/path-to-dir",

test/cli/utils_test.go

@@ -101,10 +101,8 @@ func getSyftBinaryLocation(t testing.TB) string {
 func getSyftBinaryLocationByOS(t testing.TB, goOS string) string {
 	// note: there is a subtle - vs _ difference between these versions
 	switch goOS {
-	case "darwin":
-		return path.Join(repoRoot(t), fmt.Sprintf("snapshot/syft-macos_darwin_%s/syft", runtime.GOARCH))
-	case "linux":
-		return path.Join(repoRoot(t), fmt.Sprintf("snapshot/syft_linux_%s/syft", runtime.GOARCH))
+	case "darwin", "linux":
+		return path.Join(repoRoot(t), fmt.Sprintf("snapshot/%s-build_%s_%s/syft", goOS, goOS, runtime.GOARCH))
 	default:
 		t.Fatalf("unsupported OS: %s", runtime.GOOS)
 	}

test/compare/mac.sh

@@ -39,7 +39,7 @@ else
 fi
 
 # run syft
-SYFT_PATH="${DISTDIR}/syft-macos_darwin_amd64/syft"
+SYFT_PATH="${DISTDIR}/darwin-build_darwin_amd64/syft"
 chmod 755 "${SYFT_PATH}"
 "${SYFT_PATH}" version
 SYFT_CHECK_FOR_APP_UPDATE=0 "${SYFT_PATH}" packages docker-archive:${TEST_IMAGE_TAR} -vv -o json > "${REPORT}"

test/install/.dockerignore

@@ -0,0 +1 @@
+**

test/install/.gitignore

@@ -0,0 +1 @@
+cache/

test/install/0_search_for_asset_test.sh

@@ -0,0 +1,40 @@
+. test_harness.sh
+
+# search for an asset in a release checksums file
+test_search_for_asset_release() {
+  fixture=./test-fixtures/syft_0.36.0_checksums.txt
+
+  # search_for_asset [checksums-file-path] [name] [os] [arch] [format]
+
+  # positive case
+  actual=$(search_for_asset "${fixture}" "syft" "linux" "amd64" "tar.gz")
+  assertEquals "syft_0.36.0_linux_amd64.tar.gz" "${actual}" "unable to find release asset"
+
+  # negative cases
+  actual=$(search_for_asset "${fixture}" "syft" "Linux" "amd64" "tar.gz")
+  assertEquals "" "${actual}" "found a release asset but did not expect to (os)"
+
+  actual=$(search_for_asset "${fixture}" "syft" "darwin" "amd64" "rpm")
+  assertEquals "" "${actual}" "found a release asset but did not expect to (format)"
+
+}
+
+run_test_case test_search_for_asset_release
+
+
+# search for an asset in a snapshot checksums file
+test_search_for_asset_snapshot() {
+  fixture=./test-fixtures/syft_0.35.1-SNAPSHOT-d461f63_checksums.txt
+
+  # search_for_asset [checksums-file-path] [name] [os] [arch] [format]
+
+  # positive case
+  actual=$(search_for_asset "${fixture}" "syft" "linux" "amd64" "rpm")
+  assertEquals "syft_0.35.1-SNAPSHOT-d461f63_linux_amd64.rpm" "${actual}" "unable to find snapshot asset"
+
+  # negative case
+  actual=$(search_for_asset "${fixture}" "syft" "linux" "amd64" "zip")
+  assertEquals "" "${actual}" "found a snapshot asset but did not expect to (format)"
+}
+
+run_test_case test_search_for_asset_snapshot

test/install/1_download_snapshot_asset_test.sh

@@ -0,0 +1,86 @@
+. test_harness.sh
+
+DOWNLOAD_SNAPSHOT_POSITIVE_CASES=0
+
+# helper for asserting test_positive_snapshot_download_asset positive cases
+test_positive_snapshot_download_asset() {
+  os="$1"
+  arch="$2"
+  format="$3"
+
+  # for troubleshooting
+  # log_set_priority 10
+
+  name=${PROJECT_NAME}
+  github_download=$(snapshot_download_url)
+  version=$(snapshot_version)
+
+  tmpdir=$(mktemp -d)
+
+  actual_filepath=$(download_asset "${github_download}" "${tmpdir}" "${name}" "${os}" "${arch}" "${version}" "${format}" )
+
+  assertFileExists "${actual_filepath}" "download_asset os=${os} arch=${arch} format=${format}"
+
+  assertFilesEqual \
+    "$(snapshot_dir)/${name}_${version}_${os}_${arch}.${format}" \
+    "${actual_filepath}" \
+    "unable to download os=${os} arch=${arch} format=${format}"
+
+  ((DOWNLOAD_SNAPSHOT_POSITIVE_CASES++))
+
+  rm -rf -- "$tmpdir"
+}
+
+
+test_download_snapshot_asset_exercised_all_assets() {
+  expected=$(snapshot_assets_count)
+
+  assertEquals "${expected}" "${DOWNLOAD_SNAPSHOT_POSITIVE_CASES}" "did not download all possible assets (missing an os/arch/format variant?)"
+}
+
+# helper for asserting download_asset negative cases
+test_negative_snapshot_download_asset() {
+  os="$1"
+  arch="$2"
+  format="$3"
+
+  # for troubleshooting
+  # log_set_priority 10
+
+  name=${PROJECT_NAME}
+  github_download=$(snapshot_download_url)
+  version=$(snapshot_version)
+
+  tmpdir=$(mktemp -d)
+
+  actual_filepath=$(download_asset "${github_download}" "${tmpdir}" "${name}" "${os}" "${arch}" "${version}" "${format}")
+
+  assertEquals ""  "${actual_filepath}" "unable to download os=${os} arch=${arch} format=${format}"
+
+  rm -rf -- "$tmpdir"
+}
+
+
+worker_pid=$(setup_snapshot_server)
+trap 'teardown_snapshot_server ${worker_pid}' EXIT
+
+# exercise all possible assets
+run_test_case test_positive_snapshot_download_asset "linux" "amd64" "tar.gz"
+run_test_case test_positive_snapshot_download_asset "linux" "amd64" "rpm"
+run_test_case test_positive_snapshot_download_asset "linux" "amd64" "deb"
+run_test_case test_positive_snapshot_download_asset "linux" "arm64" "tar.gz"
+run_test_case test_positive_snapshot_download_asset "linux" "arm64" "rpm"
+run_test_case test_positive_snapshot_download_asset "linux" "arm64" "deb"
+run_test_case test_positive_snapshot_download_asset "darwin" "amd64" "tar.gz"
+run_test_case test_positive_snapshot_download_asset "darwin" "arm64" "tar.gz"
+run_test_case test_positive_snapshot_download_asset "windows" "amd64" "zip"
+# note: the mac signing process produces a dmg which is not part of the snapshot process (thus is not exercised here)
+
+# let's make certain we covered all assets that were expected
+run_test_case test_download_snapshot_asset_exercised_all_assets
+
+# make certain we handle missing assets alright
+run_test_case test_negative_snapshot_download_asset "bogus" "amd64" "zip"
+
+trap - EXIT
+teardown_snapshot_server "${worker_pid}"

test/install/2_download_release_asset_test.sh

@@ -0,0 +1,41 @@
+. test_harness.sh
+
+test_download_release_asset() {
+  release="$1"
+  os="$2"
+  arch="$3"
+  format="$4"
+  expected_mime_type="$5"
+
+  # for troubleshooting
+  # log_set_priority 10
+
+  name=${PROJECT_NAME}
+  version=$(tag_to_version ${release})
+  github_download="https://github.com/${OWNER}/${REPO}/releases/download/${release}"
+
+  tmpdir=$(mktemp -d)
+
+  actual_filepath=$(download_asset "${github_download}" "${tmpdir}" "${name}" "${os}" "${arch}" "${version}" "${format}" )
+
+  assertFileExists "${actual_filepath}" "download_asset os=${os} arch=${arch} format=${format}"
+
+  actual_mime_type=$(file -b --mime-type ${actual_filepath})
+
+  assertEquals "${expected_mime_type}" "${actual_mime_type}" "unexpected mimetype for os=${os} arch=${arch} format=${format}"
+
+  rm -rf -- "$tmpdir"
+}
+
+# always test against the latest release
+release=$(get_release_tag "${OWNER}" "${REPO}" "latest" )
+
+# exercise all possible assets against a real github release (based on asset listing from https://github.com/anchore/syft/releases/tag/v0.36.0)
+run_test_case test_download_release_asset "${release}" "darwin" "amd64" "tar.gz" "application/gzip"
+run_test_case test_download_release_asset "${release}" "darwin" "arm64" "tar.gz" "application/gzip"
+run_test_case test_download_release_asset "${release}" "linux" "amd64" "tar.gz" "application/gzip"
+run_test_case test_download_release_asset "${release}" "linux" "amd64" "rpm" "application/x-rpm"
+run_test_case test_download_release_asset "${release}" "linux" "amd64" "deb" "application/vnd.debian.binary-package"
+run_test_case test_download_release_asset "${release}" "linux" "arm64" "tar.gz" "application/gzip"
+run_test_case test_download_release_asset "${release}" "linux" "arm64" "rpm" "application/x-rpm"
+run_test_case test_download_release_asset "${release}" "linux" "arm64" "deb" "application/vnd.debian.binary-package"

test/install/3_install_asset_test.sh

@@ -0,0 +1,90 @@
+. test_harness.sh
+
+INSTALL_ARCHIVE_POSITIVE_CASES=0
+
+# helper for asserting install_asset positive cases
+test_positive_snapshot_install_asset() {
+  os="$1"
+  arch="$2"
+  format="$3"
+
+  # for troubleshooting
+  # log_set_priority 10
+
+  name=${PROJECT_NAME}
+  binary=$(get_binary_name "${os}" "${arch}" "${PROJECT_NAME}")
+  github_download=$(snapshot_download_url)
+  version=$(snapshot_version)
+
+  download_dir=$(mktemp -d)
+  install_dir=$(mktemp -d)
+
+  download_and_install_asset "${github_download}" "${download_dir}" "${install_dir}" "${name}" "${os}" "${arch}" "${version}" "${format}" "${binary}"
+
+  assertEquals "0" "$?" "download/install did not succeed"
+
+  expected_path="${install_dir}/${binary}"
+  assertFileExists "${expected_path}" "install_asset os=${os} arch=${arch} format=${format}"
+
+  assertFilesEqual \
+    "$(snapshot_dir)/${os}-build_${os}_${arch}/${binary}" \
+    "${expected_path}" \
+    "unable to verify installation of os=${os} arch=${arch} format=${format}"
+
+ ((INSTALL_ARCHIVE_POSITIVE_CASES++))
+
+  rm -rf -- "$download_dir"
+  rm -rf -- "$install_dir"
+}
+
+# helper for asserting install_asset negative cases
+test_negative_snapshot_install_asset() {
+  os="$1"
+  arch="$2"
+  format="$3"
+
+  # for troubleshooting
+  # log_set_priority 10
+
+  name=${PROJECT_NAME}
+  binary=$(get_binary_name "${os}" "${arch}" "${PROJECT_NAME}")
+  github_download=$(snapshot_download_url)
+  version=$(snapshot_version)
+
+  download_dir=$(mktemp -d)
+  install_dir=$(mktemp -d)
+
+  download_and_install_asset "${github_download}" "${download_dir}" "${install_dir}" "${name}" "${os}" "${arch}" "${version}" "${format}" "${binary}"
+
+  assertNotEquals "0" "$?" "download/install should have failed but did not"
+
+  rm -rf -- "$download_dir"
+  rm -rf -- "$install_dir"
+}
+
+
+test_install_asset_exercised_all_archive_assets() {
+  expected=$(snapshot_assets_archive_count)
+
+  assertEquals "${expected}" "${INSTALL_ARCHIVE_POSITIVE_CASES}" "did not download all possible archive assets (missing an os/arch/format variant?)"
+}
+
+
+worker_pid=$(setup_snapshot_server)
+trap 'teardown_snapshot_server ${worker_pid}' EXIT
+
+# exercise all possible archive assets (not rpm/deb/dmg) against a snapshot build
+run_test_case test_positive_snapshot_install_asset "linux" "amd64" "tar.gz"
+run_test_case test_positive_snapshot_install_asset "linux" "arm64" "tar.gz"
+run_test_case test_positive_snapshot_install_asset "darwin" "amd64" "tar.gz"
+run_test_case test_positive_snapshot_install_asset "darwin" "arm64" "tar.gz"
+run_test_case test_positive_snapshot_install_asset "windows" "amd64" "zip"
+
+# let's make certain we covered all assets that were expected
+run_test_case test_install_asset_exercised_all_archive_assets
+
+# make certain we handle missing assets alright
+run_test_case test_negative_snapshot_install_asset "bogus" "amd64" "zip"
+
+trap - EXIT
+teardown_snapshot_server "${worker_pid}"

test/install/Makefile

@@ -0,0 +1,103 @@
+NAME=syft
+
+IMAGE_NAME=$(NAME)-install.sh-env
+UBUNTU_IMAGE=$(IMAGE_NAME):ubuntu-20.04
+ALPINE_IMAGE=$(IMAGE_NAME):alpine-3.6
+BUSYBOX_IMAGE=busybox:1.35
+
+ENVS=./environments
+DOCKER_RUN=docker run --rm -t -w /project/test/install -v $(shell pwd)/../../:/project
+UNIT=make unit-local
+
+# acceptance testing is running the current install.sh against the latest release. Note: this could be a problem down
+# the line if there are breaking changes made that don't align with the latest release (but will be OK with the next
+# release)
+ACCEPTANCE_CMD=sh -c '../../install.sh -b /usr/local/bin  && syft version'
+
+# CI cache busting values; change these if you want CI to not use previous stored cache
+INSTALL_TEST_CACHE_BUSTER=894d8ca
+
+define title
+    @printf '\n≡≡≡[ $(1) ]≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡≡\n'
+endef
+
+.PHONY: test
+test: unit acceptance
+
+.PHONY: ci-test-mac
+ci-test-mac: unit-local acceptance-local
+
+# note: do not add acceptance-local to this list
+acceptance: acceptance-ubuntu-20.04 acceptance-alpine-3.6 acceptance-busybox-1.35
+
+unit: unit-ubuntu-20.04
+
+unit-local:
+	$(call title,unit tests)
+	@for f in $(shell ls *_test.sh); do echo "Running unit test suite '$${f}'"; bash $${f} || exit 1; done
+
+acceptance-local:
+	$(acceptance)
+
+save: ubuntu-20.04 alpine-3.6 busybox-1.35
+	@mkdir cache || true
+	docker image save -o cache/ubuntu-env.tar $(UBUNTU_IMAGE)
+	docker image save -o cache/alpine-env.tar $(ALPINE_IMAGE)
+	docker image save -o cache/busybox-env.tar $(BUSYBOX_IMAGE)
+
+load:
+	docker image load -i cache/ubuntu-env.tar
+	docker image load -i cache/alpine-env.tar
+	docker image load -i cache/busybox-env.tar
+
+## UBUNTU #######################################################
+
+acceptance-ubuntu-20.04: ubuntu-20.04
+	$(call title,ubuntu:20.04 - acceptance)
+	$(DOCKER_RUN) $(UBUNTU_IMAGE) \
+		$(ACCEPTANCE_CMD)
+
+unit-ubuntu-20.04: ubuntu-20.04
+	$(call title,ubuntu:20.04 - unit)
+	$(DOCKER_RUN) $(UBUNTU_IMAGE) \
+		$(UNIT)
+
+ubuntu-20.04:
+	$(call title,ubuntu:20.04 - build environment)
+	docker build -t $(UBUNTU_IMAGE) -f $(ENVS)/Dockerfile-ubuntu-20.04 .
+
+## ALPINE #######################################################
+
+# note: unit tests cannot be run with sh (alpine dosn't have bash by default)
+
+acceptance-alpine-3.6: alpine-3.6
+	$(call title,alpine:3.6 - acceptance)
+	$(DOCKER_RUN) $(ALPINE_IMAGE) \
+		$(ACCEPTANCE_CMD)
+
+alpine-3.6:
+	$(call title,alpine:3.6 - build environment)
+	docker build -t $(ALPINE_IMAGE) -f $(ENVS)/Dockerfile-alpine-3.6 .
+
+## BUSYBOX #######################################################
+
+# note: unit tests cannot be run with sh (busybox dosn't have bash by default)
+
+# note: busybox by default will not have cacerts, so you will get TLS warnings (we want to test under these conditions)
+
+acceptance-busybox-1.35: busybox-1.35
+	$(call title,busybox-1.35 - acceptance)
+	$(DOCKER_RUN) $(BUSYBOX_IMAGE) \
+		$(ACCEPTANCE_CMD)
+	@echo "\n*** test note: you should see syft spit out a 'x509: certificate signed by unknown authority' error --this is expected ***"
+
+busybox-1.35:
+	$(call title,busybox-1.35 - build environment)
+	docker pull $(BUSYBOX_IMAGE)
+
+## For CI ########################################################
+
+.PHONY: cache.fingerprint
+cache.fingerprint:
+	$(call title,Install test fixture fingerprint)
+	@find ./environments/* -type f -exec md5sum {} + | awk '{print $1}' | sort | tee /dev/stderr | md5sum | tee cache.fingerprint && echo "$(INSTALL_TEST_CACHE_BUSTER)" >> cache.fingerprint

test/install/environments/Dockerfile-alpine-3.6

@@ -0,0 +1,2 @@
+FROM alpine:3.6
+RUN apk update && apk add python3 wget unzip make ca-certificates

test/install/environments/Dockerfile-ubuntu-20.04

@@ -0,0 +1,2 @@
+FROM ubuntu:20.04
+RUN apt update -y && apt install make python3 curl unzip -y

test/install/github_test.sh

@@ -0,0 +1,68 @@
+. test_harness.sh
+
+# check that we can extract single json values
+test_extract_json_value() {
+  fixture=./test-fixtures/github-api-syft-v0.36.0-release.json
+  content=$(cat ${fixture})
+
+  actual=$(extract_json_value "${content}" "tag_name")
+  assertEquals "v0.36.0" "${actual}" "unable to find tag_name"
+
+  actual=$(extract_json_value "${content}" "id")
+  assertEquals "57501596" "${actual}" "unable to find tag_name"
+}
+
+run_test_case test_extract_json_value
+
+
+# check that we can extract github release tag from github api json
+test_github_release_tag() {
+  fixture=./test-fixtures/github-api-syft-v0.36.0-release.json
+  content=$(cat ${fixture})
+
+  actual=$(github_release_tag "${content}")
+  assertEquals "v0.36.0" "${actual}" "unable to find release tag"
+}
+
+run_test_case test_github_release_tag
+
+
+# download a known good github release checksums and compare against a test-fixture
+test_download_github_release_checksums() {
+  tmpdir=$(mktemp -d)
+
+  tag=v0.36.0
+  github_download="https://github.com/anchore/syft/releases/download/${tag}"
+  name=${PROJECT_NAME}
+  version=$(tag_to_version "${tag}")
+
+  actual_filepath=$(download_github_release_checksums "${github_download}" "${name}" "${version}" "${tmpdir}")
+  assertFilesEqual \
+    "./test-fixtures/syft_0.36.0_checksums.txt" \
+    "${actual_filepath}" \
+    "unable to find release tag"
+
+  rm -rf -- "$tmpdir"
+}
+
+run_test_case test_download_github_release_checksums
+
+
+# download a checksums file from a locally served-up snapshot directory and compare against the file in the snapshot dir
+test_download_github_release_checksums_snapshot() {
+  tmpdir=$(mktemp -d)
+
+  github_download=$(snapshot_download_url)
+  name=${PROJECT_NAME}
+  version=$(snapshot_version)
+
+  actual_filepath=$(download_github_release_checksums "${github_download}" "${name}" "${version}" "${tmpdir}")
+  assertFilesEqual \
+    "$(snapshot_checksums_path)" \
+    "${actual_filepath}" \
+    "unable to find release tag"
+
+  rm -rf -- "$tmpdir"
+}
+
+run_test_case_with_snapshot_release test_download_github_release_checksums_snapshot

test/install/test-fixtures/github-api-syft-v0.36.0-release.json

@@ -0,0 +1 @@
+{"id":57501596,"tag_name":"v0.36.0","update_url":"/anchore/syft/releases/tag/v0.36.0","update_authenticity_token":"7XbNZgRHpbHegdv-xRlbe84Y983YgyXa3YKWwv_e0ocqTHagsHq5dxCTQUQnuX3vbsgdWQU3A3__hkVNhKGHSg","delete_url":"/anchore/syft/releases/tag/v0.36.0","delete_authenticity_token":"6tLaRtXKUc-zz4tHIwCbbD7CksxIHK5imZE1gnA39oVCe6fYux5a8cPD9J52kGUzM1Hs9JPBjceG7yyszBk_2A","edit_url":"/anchore/syft/releases/edit/v0.36.0"}

test/install/test-fixtures/syft_0.35.1-SNAPSHOT-d461f63_checksums.txt

@@ -0,0 +1,11 @@
+123745ee29779018ab386223a900f8cc704aa577f57ca43c157147c53c998a77  syft_0.35.1-SNAPSHOT-d461f63_linux_arm64.deb
+2083c5ad471028212e5ca72fdd3d60204052dbf3a9148c9579deac6af7865a3a  syft_0.35.1-SNAPSHOT-d461f63_linux_arm64.tar.gz
+6b95e8b17fdbb5da094c2251c8ee5a8e97e6059b6556308f1ff2b657a6a080bc  syft_0.35.1-SNAPSHOT-d461f63_darwin_x86_64.tar.gz
+940ea13dceedfcf3cf0ee2be24447123bf7efdb034c9f923e35549537b094aaa  syft_0.35.1-SNAPSHOT-d461f63_Windows_x86_64.zip
+a96efc4139c79e0ecb526c7ab7c90fc94ee89c871c006c1089eb7c40c345ea65  syft_0.35.1-SNAPSHOT-d461f63_linux_x86_64.tar.gz
+b120a661ae5e24edc4b2c7932d5b4c9a54d6a90ceced6ba0acb9984ac45c0a4e  syft_0.35.1-SNAPSHOT-d461f63_linux_arm64.rpm
+d1bc4ac460d5bd5bc173425e32b974a0a0d06f892bef4ab5b431394063b2963a  syft_0.35.1-SNAPSHOT-d461f63_linux_amd64.rpm
+d65f963160acdc47a0f037bb42993866696181350e9901b8ad3d79f2dea35939  syft_0.35.1-SNAPSHOT-d461f63_darwin_arm64.zip
+d978c2bffaad36ea833203377f808725a4d3f8fd486f15552759f63909b210ba  syft_0.35.1-SNAPSHOT-d461f63_darwin_arm64.tar.gz
+da76cc564d8e597f9c5b33423d2280eb6bf65ba2f2092d7851cdd67718e0cbe1  syft_0.35.1-SNAPSHOT-d461f63_darwin_amd64.zip
+e75f4cbf5c2b05663f49f683f99ed01d8e6ebe0e082631461dceae6641c3103f  syft_0.35.1-SNAPSHOT-d461f63_linux_amd64.deb

test/install/test-fixtures/syft_0.36.0_checksums.txt

@@ -0,0 +1,8 @@
+16541ac64378d4216ac9fe2065d20e188a89e8c9cce4e637940a559daddb213b  syft_0.36.0_linux_amd64.rpm
+4596fdbb491251f6d8e3be38b64d361a9a35cf6a88da6bdad62c019511ffb1a5  syft_0.36.0_linux_amd64.deb
+5a69df410597d8649071b3419c17829f60d9f6f00edc8856b681842c2151f83c  syft_0.36.0_linux_amd64.tar.gz
+5c06f09d370740fb017c6a51657911a87860450d929fa28a9eff1cf00faac303  syft_0.36.0_darwin_arm64.tar.gz
+71403ffa346612f9203ce7657d2d191794a0e4367da355605377b8b5d457b7ef  syft_0.36.0_linux_arm64.tar.gz
+75989a83f0d361969b5f88f3ee3807ed9ddbdf9fae13b6edce1839cf5952a36c  syft_0.36.0_linux_arm64.deb
+860b42c5d7d03e484c87e18031e6a473f48d3b088a6268fcf8f9567d5b5c90d3  syft_0.36.0_linux_arm64.rpm
+fba022c6fac6f2d2f648295af78f86e873488565e41a252a97efafe75622ccf6  syft_0.36.0_darwin_amd64.tar.gz

test/install/test_harness.sh

@@ -0,0 +1,163 @@
+# disable using the install.sh entrypoint such that we can unit test
+# script functions without invoking main()
+TEST_INSTALL_SH=true
+
+. ../../install.sh
+set -u
+
+assertTrue() {
+  if eval "$1"; then
+    echo "assertTrue failed: $2"
+    exit 2
+  fi
+}
+
+assertFalse() {
+  if eval "$1"; then
+    echo "assertFalse failed: $2"
+    exit 2
+  fi
+}
+
+assertEquals() {
+  want=$1
+  got=$2
+  msg=$3
+  if [ "$want" != "$got" ]; then
+    echo "assertEquals failed: want='$want' got='$got' $msg"
+    exit 2
+  fi
+}
+
+assertFilesDoesNotExist() {
+  path="$1"
+  msg=$2
+  if [ -f "${path}" ]; then
+    echo "assertFilesDoesNotExist failed: path exists '$path': $msg"
+    exit 2
+  fi
+}
+
+assertFileExists() {
+  path="$1"
+  msg=$2
+  if [ ! -f "${path}" ]; then
+    echo "assertFileExists failed: path does not exist '$path': $msg"
+    exit 2
+  fi
+}
+
+assertFilesEqual() {
+  want=$1
+  got=$2
+  msg=$3
+
+  diff "$1" "$2"
+  if [ $? -ne 0 ]; then
+    echo "assertFilesEqual failed: $msg"
+    exit 2
+  fi
+}
+
+assertNotEquals() {
+  want=$1
+  got=$2
+  msg=$3
+  if [ "$want" = "$got" ]; then
+    echo "assertNotEquals failed: want='$want' got='$got' $msg"
+    exit 2
+  fi
+}
+
+log_test_case() {
+  echo "  running $@"
+}
+
+run_test_case_with_snapshot_release() {
+  log_test_case ${@:1}
+
+  worker_pid=$(setup_snapshot_server)
+  trap "teardown_snapshot_server $worker_pid" EXIT
+
+  # run test function with all arguments
+  ${@:1}
+
+  trap - EXIT
+  teardown_snapshot_server "${worker_pid}"
+}
+
+serve_port=8000
+
+setup_snapshot_server() {
+  # if you want to see proof in the logs, feel free to adjust the redirection
+  python3 -m http.server --directory "$(snapshot_dir)" $serve_port &> /dev/null &
+  worker_pid=$!
+
+  # it takes some time for the server to be ready...
+  sleep 0.5
+
+  echo "$worker_pid"
+}
+
+teardown_snapshot_server() {
+  worker_pid="$1"
+
+  kill $worker_pid
+}
+
+snapshot_version() {
+  partial=$(ls ../../snapshot/*_checksums.txt | grep -o "_.*_checksums.txt")
+  partial="${partial%_checksums.txt}"
+  echo "${partial#_}"
+}
+
+snapshot_download_url() {
+  echo "localhost:${serve_port}"
+}
+
+snapshot_dir() {
+  echo "../../snapshot"
+}
+
+snapshot_checksums_path() {
+  echo "$(ls $(snapshot_dir)/*_checksums.txt)"
+}
+
+snapshot_assets_count() {
+  # example output before wc -l:
+
+  #  ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_linux_arm64.deb
+  #  ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_linux_arm64.tar.gz
+  #  ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_linux_amd64.rpm
+  #  ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_darwin_arm64.tar.gz
+  #  ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_linux_amd64.deb
+  #  ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_linux_arm64.rpm
+  #  ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_darwin_amd64.zip
+  #  ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_windows_amd64.zip
+  #  ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_darwin_arm64.zip
+  #  ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_linux_amd64.tar.gz
+  #  ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_darwin_amd64.tar.gz
+
+  echo "$(find ../../snapshot -maxdepth 1 -type f | grep 'syft_' | grep -v checksums | wc -l | tr -d '[:space:]')"
+}
+
+
+snapshot_assets_archive_count() {
+  # example output before wc -l:
+
+  #  ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_linux_arm64.tar.gz
+  #  ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_darwin_arm64.tar.gz
+  #  ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_darwin_amd64.zip
+  #  ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_windows_amd64.zip
+  #  ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_darwin_arm64.zip
+  #  ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_linux_amd64.tar.gz
+  #  ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_darwin_amd64.tar.gz
+
+  echo "$(find ../../snapshot -maxdepth 1  -type f | grep 'syft_' | grep 'tar\|zip' | wc -l | tr -d '[:space:]')"
+}
+
+
+run_test_case() {
+  log_test_case ${@:1}
+  ${@:1}
+}