simplify yarn test expressions

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

.github/scripts/apple-signing/cleanup.sh

@@ -6,5 +6,6 @@ SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
 . "$SCRIPT_DIR"/utils.sh
 
 # cleanup any dev certs left behind
+. "$SCRIPT_DIR"/setup-import-cert.sh # defines KEYCHAIN_NAME and KEYCHAIN_PATH
 . "$SCRIPT_DIR"/setup-dev.sh
-cleanup_signing
+cleanup_dev_signing

.github/scripts/apple-signing/setup-dev.sh

@@ -20,12 +20,6 @@ P12_FILE=$FILE_PREFIX.p12
 
 EXT_SECTION=codesign_reqext
 
-## Keychain material
-
-KEYCHAIN_NAME=$NAME
-KEYCHAIN_PATH=$HOME/Library/Keychains/$KEYCHAIN_NAME-db
-KEYCHAIN_PASSWORD="topsykretts"
-
 # setup_signing
 #
 # preps the MAC_SIGNING_IDENTITY env var for use in the signing process, using ephemeral developer certificate material
@@ -46,7 +40,7 @@ function setup_signing() {
   mkdir -p "${DIR}"
 
   # configure the openssl extensions
-  cat << EOF > $EXT_FILE
+  cat << EOF > "$EXT_FILE"
   [ req ]
   default_bits          = 2048                  # RSA key size
   encrypt_key           = yes                   # Protect private key
@@ -105,7 +99,7 @@ EOF
             -extensions $EXT_SECTION
 
   commentary "verify the certificate: we should see our extensions"
-  openssl x509 -text -noout -in $CERT_FILE | grep -A1 'X509v3' || exit_with_error "could not find x509 extensions in certificate"
+  openssl x509 -text -noout -in "$CERT_FILE" | grep -A1 'X509v3' || exit_with_error "could not find x509 extensions in certificate"
 
   title "export cert and private key to .p12 file"
   # note: this step may be entirely optional, however, I found it useful to follow the prod path which goes the route of using a p12
@@ -117,55 +111,18 @@ EOF
             -passin "pass:$KEY_PASSWORD" \
             -passout "pass:$P12_PASSWORD"
 
-
-  title "create the dev keychain"
-
   # delete the keychain if it already exists
-  if [ -f "$(KEYCHAIN_PATH)" ]; then
-    security delete-keychain "$KEYCHAIN_NAME" &> /dev/null
+  if [ -f "${KEYCHAIN_PATH}" ]; then
+    cleanup_dev_signing
   fi
 
-  security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"
-
-  set +e
-  if ! security verify-cert -k "$KEYCHAIN_PATH" -c "$CERT_FILE" &> /dev/null; then
-    set -e
-    title "import the cert into the dev keychain if it is not already trusted by the system"
-
-    security import "$P12_FILE" -P $P12_PASSWORD -f pkcs12 -k "$KEYCHAIN_PATH" -T /usr/bin/codesign
-
-    # note: set the partition list for this certificate's private key to include "apple-tool:" and "apple:" allows the codesign command to access this keychain item without an interactive user prompt.
-    security set-key-partition-list -S "apple-tool:,apple:,codesign:" -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
-
-    # note: add-trusted-cert requires user interaction
-    commentary "adding the developer certificate as a trusted certificate... (requires user interaction)"
-    security add-trusted-cert -d -r trustRoot -k "$KEYCHAIN_PATH" "$CERT_FILE"
-  else
-    set -e
-    commentary "...dev cert has already been imported onto the dev keychain"
-  fi
-
-  # remove any generated cert material since the keychain now has all of this material loaded
-  rm -rf "${DIR}"
-
-  commentary "make certain there are identities that can be used for code signing"
-  security find-identity -p codesigning "$KEYCHAIN_PATH" | grep -C 30 "$IDENTITY" || exit_with_error "could not find identity that can be used with codesign"
-
-  title "add the dev keychain to the search path for codesign"
-  add_keychain $KEYCHAIN_NAME
-
-  commentary "verify the keychain actually shows up"
-  security list-keychains | grep "$KEYCHAIN_NAME" || exit_with_error "could not find new keychain"
-
-  export MAC_SIGNING_IDENTITY=$IDENTITY
-  commentary "setting MAC_SIGNING_IDENTITY=${IDENTITY}"
-
+  import_signing_certificate "$P12_FILE" "$P12_PASSWORD" "$IDENTITY"
 }
 
-function cleanup_signing() {
+function cleanup_dev_signing() {
   title "delete the dev keychain and all certificate material"
   set -xue
-  security delete-keychain "$KEYCHAIN_NAME"
-  rm -f "$KEYCHAIN_PATH"
-  rm -rf "${DIR}"
+  security delete-keychain "$KEYCHAIN_NAME" || true
+  rm -f "$KEYCHAIN_PATH" || true
+  rm -rf "${DIR}" || true
 }

.github/scripts/apple-signing/setup-import-cert.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+set -eu
+
+KEYCHAIN_NAME="syft-ephemeral-keychain"
+KEYCHAIN_PATH="$HOME/Library/Keychains/${KEYCHAIN_NAME}-db"
+
+# import_signing_certificate
+#
+# imports a cert from a p12 file into a keychain used for codesigning
+#
+function import_signing_certificate() {
+  p12_file=$1
+  p12_password=$2
+  identity=$3
+
+  keychain_password="$(openssl rand -base64 100)"
+
+  title "create the a new keychain"
+
+  security create-keychain -p "$keychain_password" "$KEYCHAIN_NAME"
+  security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
+  security unlock-keychain -p "$keychain_password" "$KEYCHAIN_PATH"
+
+  if [ ! -f "$KEYCHAIN_PATH" ]; then
+    exit_with_error "cannot find keychain '$KEYCHAIN_PATH'"
+  fi
+
+  set +e
+  if ! security verify-cert -k "$KEYCHAIN_PATH" -c "$p12_file" &> /dev/null; then
+    set -e
+    title "import the cert into the new keychain if it is not already trusted by the system"
+
+    # '-t cert' is vital since it side-steps the need for user interaction with "security add-trusted-cert" (which has wider security implications)
+    security import "$p12_file" -P "$p12_password" -t cert -f pkcs12 -k "$KEYCHAIN_PATH" -T /usr/bin/codesign
+
+    # note: set the partition list for this certificate's private key to include "apple-tool:" and "apple:" allows the codesign command to access this keychain item without an interactive user prompt.
+    security set-key-partition-list -S "apple-tool:,apple:,codesign:" -s -k "$keychain_password" "$KEYCHAIN_PATH"
+  else
+    set -e
+    commentary "...cert has already been imported onto the new keychain"
+  fi
+
+  commentary "make certain there are identities that can be used for code signing"
+  security find-identity -p codesigning "$KEYCHAIN_PATH" | grep -C 30 "$identity" || exit_with_error "could not find identity that can be used with codesign"
+
+  title "add the new keychain to the search path for codesign"
+  add_keychain "$KEYCHAIN_NAME"
+
+  commentary "verify the new keychain can be found by the security sub-system"
+  security list-keychains | grep "$KEYCHAIN_NAME" || exit_with_error "could not find new keychain"
+
+  export MAC_SIGNING_IDENTITY=$identity
+  commentary "setting MAC_SIGNING_IDENTITY=${identity}"
+
+}

.github/scripts/apple-signing/setup-prod.sh

@@ -3,6 +3,8 @@ set -eu
 
 assert_in_ci
 
+IDENTITY="Developer ID Application: ANCHORE, INC. (9MJHKYX5AT)"
+
 set +xu
 if [ -z "$APPLE_DEVELOPER_ID_CERT" ]; then
   exit_with_error "APPLE_DEVELOPER_ID_CERT not set"
@@ -29,27 +31,13 @@ setup_signing() {
   title "setting up production certificate material"
 
   # Write signing certificate to disk from environment variable.
-  cert_file="$HOME/developer_id_certificate.p12"
-  echo -n "$APPLE_DEVELOPER_ID_CERT" | base64 --decode > "$cert_file"
+  p12_file="$HOME/developer_id_certificate.p12"
+  echo -n "$APPLE_DEVELOPER_ID_CERT" | base64 --decode > "$p12_file"
 
-  # In order to have all keychain interactions avoid an interactive user prompt, we need to control the password for the keychain in question, which means we need to create a new keychain into which we'll import the signing certificate and from which we'll later access this certificate during code signing.
-  ephemeral_keychain="ci-ephemeral-keychain"
-  ephemeral_keychain_password="$(openssl rand -base64 100)"
-  security create-keychain -p "${ephemeral_keychain_password}" "${ephemeral_keychain}"
-
-  # Import signing certificate into the keychain. (This is a pre-requisite for gon, which is invoked via goreleaser.)
-  ephemeral_keychain_full_path="$HOME/Library/Keychains/${ephemeral_keychain}-db"
-  security import "${cert_file}" -k "${ephemeral_keychain_full_path}" -P "${APPLE_DEVELOPER_ID_CERT_PASS}" -T "$(command -v codesign)"
-
-  # Setting the partition list for this certificate's private key to include "apple-tool:" and "apple:" allows the codesign command to access this keychain item without an interactive user prompt. (codesign is invoked by gon.)
-  security set-key-partition-list -S "apple-tool:,apple:" -s -k "${ephemeral_keychain_password}" "${ephemeral_keychain_full_path}"
+  import_signing_certificate "$p12_file" "$APPLE_DEVELOPER_ID_CERT_PASS" "$IDENTITY"
 
   # Make this new keychain the user's default keychain, so that codesign will be able to find this certificate when we specify it during signing.
-  security default-keychain -d "user" -s "${ephemeral_keychain_full_path}"
-
-  # TODO: extract this from the certificate material itself
-  export MAC_SIGNING_IDENTITY="Developer ID Application: ANCHORE, INC. (9MJHKYX5AT)"
-  commentary "setting MAC_SIGNING_IDENTITY=${MAC_SIGNING_IDENTITY}"
+  security default-keychain -d "user" -s "${KEYCHAIN_PATH}"
 
   commentary "log into docker -- required for publishing (since the default keychain has now been replaced)"
   echo "${DOCKER_PASSWORD}" | docker login docker.io -u "${DOCKER_USERNAME}"  --password-stdin

.github/scripts/apple-signing/setup.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -eu
+set -eu -o pipefail
 
 IS_SNAPSHOT="$1"
 
@@ -9,6 +9,8 @@ SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
 mkdir -p "$SCRIPT_DIR/log"
 
 main() {
+  # defines KEYCHAIN_NAME and KEYCHAIN_PATH
+  . "$SCRIPT_DIR"/setup-import-cert.sh
 
   case "$IS_SNAPSHOT" in
 

.github/scripts/apple-signing/sign.sh

@@ -27,19 +27,23 @@ sign_binary() {
       return 0
   fi
 
+  set -x
+
   codesign \
     -s "$identity" \
     -f \
     --verbose=4 \
     --timestamp \
     --options runtime \
-      $exe_path
+      "$exe_path"
 
   if [ $? -ne 0 ]; then
       exit_with_error "signing failed"
   fi
 
   codesign --verify "$exe_path"  --verbose=4
+
+  set +x
 }
 
 

.github/workflows/codeql-analysis.yml

@@ -7,10 +7,10 @@ name: "CodeQL Security Scan"
 
 on:
   push:
-    branches: [main]
-  pull_request:
-    # The branches below must be a subset of the branches above
-    branches: [main]
+    branches:
+      # only run when there are pushes to the main branch (not on PRs)
+      - main
+
   schedule:
     - cron: '0 0 * * 3'
 

.github/workflows/release.yaml

@@ -142,10 +142,12 @@ jobs:
           AC_PASSWORD: ${{ secrets.ENG_CI_APPLE_ID_PASS }}
 
       - uses: anchore/sbom-action@v0
+        continue-on-error: true
         with:
           artifact-name: sbom.spdx.json
 
       - uses: 8398a7/action-slack@v3
+        continue-on-error: true
         with:
           status: ${{ job.status }}
           fields: repo,workflow,action,eventName

.github/workflows/validations.yaml

@@ -2,6 +2,8 @@ name: "Validations"
 on:
   workflow_dispatch:
   push:
+    branches:
+      - main
   pull_request:
 
 env:
@@ -348,9 +350,16 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-go-${{ env.GO_VERSION }}-
 
-      - name: (cache-miss) Bootstrap go dependencies
-        if: steps.go-cache.outputs.cache-hit != 'true'
-        run: make bootstrap-go
+      - name: Restore tool cache
+        id: tool-cache
+        uses: actions/cache@v2.1.3
+        with:
+          path: ${{ github.workspace }}/.tmp
+          key: ${{ runner.os }}-tool-${{ hashFiles('Makefile') }}
+
+      - name: (cache-miss) Bootstrap all project dependencies
+        if: steps.tool-cache.outputs.cache-hit != 'true' || steps.go-cache.outputs.cache-hit != 'true'
+        run: make bootstrap
 
       - name: Build key for tar cache
         run: make cli-fingerprint

.gitignore

@@ -36,4 +36,8 @@ bin/
 # macOS Finder metadata
 .DS_STORE
 
-*.profile
+*.profile
+
+# attestation
+cosign.key
+cosign.pub

.goreleaser.yaml

@@ -43,8 +43,9 @@ builds:
     ldflags: *build-ldflags
     hooks:
       post:
-        # we must have signing as a build hook instead of the signs section. The signs section must register a new asset, where we want to replace an existing asset.
-        # a post-build hook has the advantage of not needing to unpackage and repackage a tar.gz with a signed binary
+        # we must have signing as a build hook instead of the signs section. The signs section must register a new
+        # asset, where we want to replace an existing asset. A post-build hook has the advantage of not needing to
+        # unpackage and repackage a tar.gz with a signed binary
         - ./.github/scripts/apple-signing/sign.sh "{{ .Path }}" "{{ .IsSnapshot }}" "{{ .Target }}"
 
   - id: windows-build

Dockerfile

@@ -24,6 +24,9 @@ LABEL org.opencontainers.image.revision=$VCS_REF
 LABEL org.opencontainers.image.vendor="Anchore, Inc."
 LABEL org.opencontainers.image.version=$BUILD_VERSION
 LABEL org.opencontainers.image.licenses="Apache-2.0"
-
+LABEL io.artifacthub.package.readme-url="https://raw.githubusercontent.com/anchore/syft/main/README.md"
+LABEL io.artifacthub.package.logo-url="https://user-images.githubusercontent.com/5199289/136844524-1527b09f-c5cb-4aa9-be54-5aa92a6086c1.png"
+LABEL io.artifacthub.package.license="Apache-2.0"
+      
 
 ENTRYPOINT ["/syft"]

Makefile

@@ -3,7 +3,7 @@ TEMPDIR = ./.tmp
 RESULTSDIR = test/results
 COVER_REPORT = $(RESULTSDIR)/unit-coverage-details.txt
 COVER_TOTAL = $(RESULTSDIR)/unit-coverage-summary.txt
-LINTCMD = $(TEMPDIR)/golangci-lint run --tests=false --timeout=2m --config .golangci.yaml
+LINTCMD = $(TEMPDIR)/golangci-lint run --tests=false --timeout=4m --config .golangci.yaml
 RELEASE_CMD=$(TEMPDIR)/goreleaser release --rm-dist
 SNAPSHOT_CMD=$(RELEASE_CMD) --skip-publish --snapshot
 VERSION=$(shell git describe --dirty --always --tags)
@@ -25,7 +25,7 @@ COVERAGE_THRESHOLD := 62
 
 # CI cache busting values; change these if you want CI to not use previous stored cache
 INTEGRATION_CACHE_BUSTER="894d8ca"
-CLI_CACHE_BUSTER="894d8ca"
+CLI_CACHE_BUSTER="e5cdfd8"
 BOOTSTRAP_CACHE="c7afb99ad"
 
 ## Build variables
@@ -111,6 +111,7 @@ bootstrap-tools: $(TEMPDIR)
 	curl -sSfL https://raw.githubusercontent.com/anchore/chronicle/main/install.sh | sh -s -- -b $(TEMPDIR)/ v0.3.0
 	.github/scripts/goreleaser-install.sh -d -b $(TEMPDIR)/ v1.4.1
 	GOBIN="$(shell realpath $(TEMPDIR))" go install github.com/neilpa/yajsv@v1.4.0
+	GOBIN="$(shell realpath $(TEMPDIR))" go install github.com/sigstore/cosign/cmd/cosign@v1.5.1
 
 .PHONY: bootstrap-go
 bootstrap-go:

README.md

@@ -21,6 +21,7 @@ A CLI tool and Go library for generating a Software Bill of Materials (SBOM) fro
 
 ## Features
 - Catalog container images and filesystems to discover packages and libraries.
+- Generate in-toto attestations where an SBOM is included as the payload.
 - Supports packages and libraries from various ecosystems (APK, DEB, RPM, Ruby Bundles, Python Wheel/Egg/requirements.txt, JavaScript NPM/Yarn, Java JAR/EAR/WAR/PAR/SAR, Jenkins plugins JPI/HPI, Go modules, PHP Composer)
 - Linux distribution identification (supports Alpine, BusyBox, CentOS/RedHat, Debian/Ubuntu flavored distributions)
 - Supports Docker and OCI image formats
@@ -68,7 +69,8 @@ nix-shell -p syft
 
 ## Getting started
 
-To generate an SBOM for a Docker or OCI image:
+#### SBOM
+To generate an SBOM for an OCI image:
 ```
 syft <image>
 ```
@@ -85,6 +87,17 @@ To include software from all image layers in the SBOM, regardless of its presenc
 syft packages <image> --scope all-layers
 ```
 
+#### SBOM Attestation
+To generate an attested SBOM for an OCI image as the predicate of an in-toto attestation
+```
+syft attest --output [FORMAT] --key [KEY] [SOURCE] [flags]
+```
+
+The above output is in the form of the [DSSE envelope](https://github.com/secure-systems-lab/dsse/blob/master/envelope.md#dsse-envelope).
+The payload is a base64 encoded `in-toto` statement with the SBOM as the predicate, the payload type is `application/vnd.in-toto+json`, and the signatures array is populated
+with the contents needed for public key verification. For details on workflows using this command see [here](#adding-an-sbom-to-an-image-as-an-attestation-using-syft).
+
+
 ### Supported sources
 
 Syft can generate a SBOM from a variety of sources:
@@ -101,6 +114,7 @@ Sources can be explicitly provided with a scheme:
 
 ```
 docker:yourrepo/yourimage:tag          use images from the Docker daemon
+podman:yourrepo/yourimage:tag          use images from the Podman daemon
 docker-archive:path/to/yourimage.tar   use a tarball from disk for archives created from "docker save"
 oci-archive:path/to/yourimage.tar      use a tarball from disk for OCI archives (from Skopeo or otherwise)
 oci-dir:path/to/yourimage              read directly from a path on disk for OCI layout directories (from Skopeo or otherwise)
@@ -396,6 +410,16 @@ registry:
       token: ""
       # - ... # note, more credentials can be provided via config file only
 
+# generate an attested SBOM
+attest:
+  # path to the private key file to use for attestation
+  # SYFT_ATTEST_KEY env var
+  key: "cosign.key"
+
+  # password to decrypt to given private key
+  # SYFT_ATTEST_PASSWORD env var, additionally responds to COSIGN_PASSWORD
+  password: ""
+
 log:
   # use structured logging
   # same as SYFT_LOG_STRUCTURED env var
@@ -432,30 +456,32 @@ anchore:
   dockerfile: ""
 ```
 
-### Adding an SBOM to an image as an attestation
+### Adding an SBOM to an image as an attestation using Syft
+
+`syft attest --output [FORMAT] --key [KEY] [SOURCE] [flags]`
+
 SBOMs themselves can serve as input to different analysis tools. The Anchore organization offers the vulnerability scanner
 [grype](https://github.com/anchore/grype) as one such tool.
 One of the foundational approaches to "trust" between tools is for producers to use the artifacts generated by syft as attestations to their images.
-The SBOM output of syft can be used with the [cosign](https://github.com/sigstore/cosign) tool to generate an attestation that is attached to a signed image.
+The DSSE output of `syft attest` can be used with the [cosign](https://github.com/sigstore/cosign) tool to attach an attestation to an image.
 
 #### Example attest
-Note for the following example replace `test/image:latest` with an image you own. You should also have push access to 
+Note for the following example replace `docker.io/image:latest` with an image you own. You should also have push access to 
 its remote reference. Replace $MY_PRIVATE_KEY with a private key you own or have generated with cosign.
 
 ```bash
-cosign sign --key $MY_PRIVATE_KEY test/image:latest
-syft test/image:latest -o json > test_latest_sbom.json
-cosign attest --predicate test_latest_sbom.json --key $MY_PRIVATE_KEY test/image:latest
+syft attest --key $MY_PRIVATE_KEY docker.io/image:latest > image_latest_sbom_attestation.json
+cosign attach attestation --attestation image_latest_sbom_attestation.json docker.io/image:latest
 ```
 
 Verify the new attestation exists on your image
 ```bash
-cosign verify-attestation -key $MY_PUBLIC_KEY test/image:latest | jq '.payload |= @base64d | .payload | fromjson | .predicate.Data | fromjson | .'
+cosign verify-attestation -key $MY_PUBLIC_KEY docker.io/image:latest | jq '.payload | @base64d | .payload | fromjson | .predicate'
 ```
 
 You should see this output along with the attached SBOM.
 ```
-Verification for test/image:latest --
+Verification for docker.io/image:latest --
 The following checks were performed on each of these signatures:
   - The cosign claims were validated
   - The signatures were verified against the specified public key

cmd/attest.go

@@ -0,0 +1,309 @@
+package cmd
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+
+	"github.com/anchore/stereoscope"
+	"github.com/anchore/stereoscope/pkg/image"
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/ui"
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/format"
+	"github.com/anchore/syft/syft/source"
+	"github.com/in-toto/in-toto-golang/in_toto"
+	"github.com/pkg/errors"
+	"github.com/pkg/profile"
+	"github.com/sigstore/cosign/cmd/cosign/cli/sign"
+	"github.com/sigstore/cosign/pkg/cosign"
+	"github.com/sigstore/cosign/pkg/cosign/attestation"
+	"github.com/sigstore/sigstore/pkg/signature/dsse"
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+	"github.com/spf13/viper"
+	"github.com/wagoodman/go-partybus"
+
+	signatureoptions "github.com/sigstore/sigstore/pkg/signature/options"
+)
+
+const (
+	attestExample = `  {{.appName}} {{.command}} --output [FORMAT] --key [KEY] alpine:latest
+
+  Supports the following image sources:
+    {{.appName}} {{.command}} --key [KEY] yourrepo/yourimage:tag     defaults to using images from a Docker daemon. If Docker is not present, the image is pulled directly from the registry.
+    {{.appName}} {{.command}} --key [KEY] path/to/a/file/or/dir      only for OCI tar or OCI directory
+
+`
+	attestSchemeHelp = "\n" + indent + schemeHelpHeader + "\n" + imageSchemeHelp
+
+	attestHelp = attestExample + attestSchemeHelp
+
+	intotoJSONDsseType = `application/vnd.in-toto+json`
+)
+
+var attestFormats = []format.Option{format.SPDXJSONOption, format.CycloneDxJSONOption, format.JSONOption}
+
+var (
+	attestCmd = &cobra.Command{
+		Use:   "attest --output [FORMAT] --key [KEY] [SOURCE]",
+		Short: "Generate a package SBOM as an attestation for the given [SOURCE] container image",
+		Long:  "Generate a packaged-based Software Bill Of Materials (SBOM) from a container image as the predicate of an in-toto attestation",
+		Example: internal.Tprintf(attestHelp, map[string]interface{}{
+			"appName": internal.ApplicationName,
+			"command": "attest",
+		}),
+		Args:          validateInputArgs,
+		SilenceUsage:  true,
+		SilenceErrors: true,
+		PreRunE: func(cmd *cobra.Command, args []string) (err error) {
+			if appConfig.Dev.ProfileCPU && appConfig.Dev.ProfileMem {
+				return fmt.Errorf("cannot profile CPU and memory simultaneously")
+			}
+			return nil
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if appConfig.Dev.ProfileCPU {
+				defer profile.Start(profile.CPUProfile).Stop()
+			} else if appConfig.Dev.ProfileMem {
+				defer profile.Start(profile.MemProfile).Stop()
+			}
+
+			return attestExec(cmd.Context(), cmd, args)
+		},
+	}
+)
+
+func fetchPassword(_ bool) (b []byte, err error) {
+	potentiallyPipedInput, err := internal.IsPipedInput()
+	if err != nil {
+		log.Warnf("unable to determine if there is piped input: %+v", err)
+	}
+	switch {
+	case appConfig.Attest.Password != "":
+		return []byte(appConfig.Attest.Password), nil
+	case potentiallyPipedInput:
+		// handle piped in passwords
+		pwBytes, err := io.ReadAll(os.Stdin)
+		if err != nil {
+			return nil, fmt.Errorf("unable to get password from stdin: %w", err)
+		}
+		// be resilient to input that may have newline characters (in case someone is using echo without -n)
+		cleanPw := strings.TrimRight(string(pwBytes), "\n")
+		return []byte(cleanPw), nil
+	case internal.IsTerminal():
+		return cosign.GetPassFromTerm(false)
+	}
+	return nil, errors.New("no method available to fetch password")
+}
+
+func selectPassFunc(keypath string) (cosign.PassFunc, error) {
+	keyContents, err := os.ReadFile(keypath)
+	if err != nil {
+		return nil, err
+	}
+
+	var fn cosign.PassFunc = func(bool) (b []byte, err error) { return nil, nil }
+
+	_, err = cosign.LoadPrivateKey(keyContents, nil)
+	if err != nil {
+		fn = fetchPassword
+	}
+
+	return fn, nil
+}
+
+func attestExec(ctx context.Context, _ *cobra.Command, args []string) error {
+	// can only be an image for attestation or OCI DIR
+	userInput := args[0]
+	si, err := source.ParseInput(userInput, false)
+	if err != nil {
+		return fmt.Errorf("could not generate source input for attest command: %w", err)
+	}
+
+	switch si.Scheme {
+	case source.ImageScheme, source.UnknownScheme:
+		// at this point we know that it cannot be dir: or file: schemes, so we will assume that the unknown scheme could represent an image
+		si.Scheme = source.ImageScheme
+	default:
+		return fmt.Errorf("attest command can only be used with image sources but discovered %q when given %q", si.Scheme, userInput)
+	}
+
+	// if the original detection was from a local daemon we want to short circuit
+	// that and attempt to generate the image source from a registry source instead
+	switch si.ImageSource {
+	case image.UnknownSource, image.OciRegistrySource:
+		si.ImageSource = image.OciRegistrySource
+	default:
+		return fmt.Errorf("attest command can only be used with image sources fetch directly from the registry, but discovered an image source of %q when given %q", si.ImageSource, userInput)
+	}
+
+	if len(appConfig.Output) > 1 {
+		return fmt.Errorf("unable to generate attestation for more than one output")
+	}
+
+	output := format.ParseOption(appConfig.Output[0])
+	predicateType := assertPredicateType(output)
+	if predicateType == "" {
+		return fmt.Errorf("could not produce attestation predicate for given format: %q. Available formats: %+v", output, attestFormats)
+	}
+
+	passFunc, err := selectPassFunc(appConfig.Attest.Key)
+	if err != nil {
+		return err
+	}
+
+	ko := sign.KeyOpts{
+		KeyRef:   appConfig.Attest.Key,
+		PassFunc: passFunc,
+	}
+
+	sv, err := sign.SignerFromKeyOpts(ctx, "", ko)
+	if err != nil {
+		return err
+	}
+	defer sv.Close()
+
+	return eventLoop(
+		attestationExecWorker(*si, output, predicateType, sv),
+		setupSignals(),
+		eventSubscription,
+		stereoscope.Cleanup,
+		ui.Select(isVerbose(), appConfig.Quiet)...,
+	)
+}
+
+func attestationExecWorker(sourceInput source.Input, output format.Option, predicateType string, sv *sign.SignerVerifier) <-chan error {
+	errs := make(chan error)
+	go func() {
+		defer close(errs)
+
+		src, cleanup, err := source.NewFromRegistry(sourceInput, appConfig.Registry.ToOptions(), appConfig.Exclusions)
+		if cleanup != nil {
+			defer cleanup()
+		}
+		if err != nil {
+			errs <- fmt.Errorf("failed to construct source from user input %q: %w", sourceInput.UserInput, err)
+			return
+		}
+
+		s, err := generateSBOM(src, errs)
+		if err != nil {
+			errs <- err
+			return
+		}
+
+		sbomBytes, err := syft.Encode(*s, output)
+		if err != nil {
+			errs <- err
+			return
+		}
+
+		err = generateAttestation(sbomBytes, src, sv, predicateType)
+		if err != nil {
+			errs <- err
+			return
+		}
+	}()
+	return errs
+}
+
+func assertPredicateType(output format.Option) string {
+	switch output {
+	case format.SPDXJSONOption:
+		return in_toto.PredicateSPDX
+	// Tentative see https://github.com/in-toto/attestation/issues/82
+	case format.CycloneDxJSONOption:
+		return "https://cyclonedx.org/bom"
+	case format.JSONOption:
+		return "https://syft.dev/bom"
+	default:
+		return ""
+	}
+}
+
+func findValidDigest(digests []string) string {
+	// since we are only using the OCI repo provider for this source we are safe that this is only 1 value
+	// see https://github.com/anchore/stereoscope/blob/25ebd49a842b5ac0a20c2e2b4b81335b64ad248c/pkg/image/oci/registry_provider.go#L57-L63
+	split := strings.Split(digests[0], "sha256:")
+	return split[1]
+}
+
+func generateAttestation(predicate []byte, src *source.Source, sv *sign.SignerVerifier, predicateType string) error {
+	switch len(src.Image.Metadata.RepoDigests) {
+	case 0:
+		return fmt.Errorf("cannot generate attestation since no repo digests were found; make sure you're passing an OCI registry source for the attest command")
+	case 1:
+	default:
+		return fmt.Errorf("cannot generate attestation since multiple repo digests were found for the image: %+v", src.Image.Metadata.RepoDigests)
+	}
+
+	wrapped := dsse.WrapSigner(sv, intotoJSONDsseType)
+
+	sh, err := attestation.GenerateStatement(attestation.GenerateOpts{
+		Predicate: bytes.NewBuffer(predicate),
+		Type:      predicateType,
+		Digest:    findValidDigest(src.Image.Metadata.RepoDigests),
+	})
+	if err != nil {
+		return err
+	}
+
+	payload, err := json.Marshal(sh)
+	if err != nil {
+		return err
+	}
+
+	signedPayload, err := wrapped.SignMessage(bytes.NewReader(payload), signatureoptions.WithContext(context.Background()))
+	if err != nil {
+		return errors.Wrap(err, "unable to sign SBOM")
+	}
+
+	bus.Publish(partybus.Event{
+		Type: event.Exit,
+		Value: func() error {
+			_, err := os.Stdout.Write(signedPayload)
+			return err
+		},
+	})
+
+	return nil
+}
+
+func init() {
+	setAttestFlags(attestCmd.Flags())
+	if err := bindAttestConfigOptions(attestCmd.Flags()); err != nil {
+		panic(err)
+	}
+	rootCmd.AddCommand(attestCmd)
+}
+
+func setAttestFlags(flags *pflag.FlagSet) {
+	// key options
+	flags.StringP("key", "", "cosign.key",
+		"path to the private key file to use for attestation",
+	)
+
+	// in-toto attestations only support JSON predicates, so not all SBOM formats that syft can output are supported
+	flags.StringP(
+		"output", "o", string(format.JSONOption),
+		fmt.Sprintf("the SBOM format encapsulated within the attestation, available options=%v", attestFormats),
+	)
+}
+
+func bindAttestConfigOptions(flags *pflag.FlagSet) error {
+	// note: output is not included since this configuration option is shared between multiple subcommands
+
+	if err := viper.BindPFlag("attest.key", flags.Lookup("key")); err != nil {
+		return err
+	}
+
+	return nil
+}

cmd/cmd.go

@@ -6,6 +6,8 @@ import (
 	"os"
 	"sort"
 
+	"github.com/spf13/pflag"
+
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/internal/config"
 	"github.com/anchore/syft/internal/log"
@@ -57,6 +59,7 @@ func initCmdAliasBindings() {
 		config.PowerUserCatalogerEnabledDefault()
 	}
 
+	// set bindings based on the packages alias
 	switch activeCmd {
 	case packagesCmd, rootCmd:
 		// note: we need to lazily bind config options since they are shared between both the root command
@@ -68,6 +71,16 @@ func initCmdAliasBindings() {
 		if err = bindPackagesConfigOptions(activeCmd.Flags()); err != nil {
 			panic(err)
 		}
+	case attestCmd:
+		// the --output option is an independently defined flag, but a shared config option
+		if err = bindSharedOutputConfigOption(attestCmd.Flags()); err != nil {
+			panic(err)
+		}
+		// even though the root command or packages command is NOT being run, we still need default bindings
+		// such that application config parsing passes.
+		if err = bindExclusivePackagesConfigOptions(packagesCmd.Flags()); err != nil {
+			panic(err)
+		}
 	default:
 		// even though the root command or packages command is NOT being run, we still need default bindings
 		// such that application config parsing passes.
@@ -77,6 +90,14 @@ func initCmdAliasBindings() {
 	}
 }
 
+func bindSharedOutputConfigOption(flags *pflag.FlagSet) error {
+	if err := viper.BindPFlag("output", flags.Lookup("output")); err != nil {
+		return err
+	}
+
+	return nil
+}
+
 func initAppConfig() {
 	cfg, err := config.LoadApplicationConfig(viper.GetViper(), persistentOpts)
 	if err != nil {

cmd/packages.go

@@ -28,25 +28,32 @@ import (
 
 const (
 	packagesExample = `  {{.appName}} {{.command}} alpine:latest                a summary of discovered packages
-  {{.appName}} {{.command}} alpine:latest -o json        show all possible cataloging details
-  {{.appName}} {{.command}} alpine:latest -o cyclonedx   show a CycloneDX formatted SBOM
-  {{.appName}} {{.command}} alpine:latest -o spdx        show a SPDX 2.2 tag-value formatted SBOM
-  {{.appName}} {{.command}} alpine:latest -o spdx-json   show a SPDX 2.2 JSON formatted SBOM
-  {{.appName}} {{.command}} alpine:latest -vv            show verbose debug information
+  {{.appName}} {{.command}} alpine:latest -o json            show all possible cataloging details
+  {{.appName}} {{.command}} alpine:latest -o cyclonedx       show a CycloneDX formatted SBOM
+  {{.appName}} {{.command}} alpine:latest -o cyclonedx-json  show a CycloneDX JSON formatted SBOM
+  {{.appName}} {{.command}} alpine:latest -o spdx            show a SPDX 2.2 Tag-Value formatted SBOM
+  {{.appName}} {{.command}} alpine:latest -o spdx-json       show a SPDX 2.2 JSON formatted SBOM
+  {{.appName}} {{.command}} alpine:latest -vv                show verbose debug information
 
   Supports the following image sources:
     {{.appName}} {{.command}} yourrepo/yourimage:tag     defaults to using images from a Docker daemon. If Docker is not present, the image is pulled directly from the registry.
     {{.appName}} {{.command}} path/to/a/file/or/dir      a Docker tar, OCI tar, OCI directory, or generic filesystem directory
+`
 
-  You can also explicitly specify the scheme to use:
-    {{.appName}} {{.command}} docker:yourrepo/yourimage:tag          explicitly use the Docker daemon
+	schemeHelpHeader = "You can also explicitly specify the scheme to use:"
+	imageSchemeHelp  = `    {{.appName}} {{.command}} docker:yourrepo/yourimage:tag          explicitly use the Docker daemon
+    {{.appName}} {{.command}} podman:yourrepo/yourimage:tag        	 explicitly use the Podman daemon
+    {{.appName}} {{.command}} registry:yourrepo/yourimage:tag        pull image directly from a registry (no container runtime required)
     {{.appName}} {{.command}} docker-archive:path/to/yourimage.tar   use a tarball from disk for archives created from "docker save"
     {{.appName}} {{.command}} oci-archive:path/to/yourimage.tar      use a tarball from disk for OCI archives (from Skopeo or otherwise)
     {{.appName}} {{.command}} oci-dir:path/to/yourimage              read directly from a path on disk for OCI layout directories (from Skopeo or otherwise)
-    {{.appName}} {{.command}} dir:path/to/yourproject                read directly from a path on disk (any directory)
-    {{.appName}} {{.command}} file:path/to/yourproject/file          read directly from a path on disk (any single file)
-    {{.appName}} {{.command}} registry:yourrepo/yourimage:tag        pull image directly from a registry (no container runtime required)
 `
+	nonImageSchemeHelp = `    {{.appName}} {{.command}} dir:path/to/yourproject                read directly from a path on disk (any directory)
+    {{.appName}} {{.command}} file:path/to/yourproject/file          read directly from a path on disk (any single file)
+`
+	packagesSchemeHelp = "\n" + indent + schemeHelpHeader + "\n" + imageSchemeHelp + nonImageSchemeHelp
+
+	packagesHelp = packagesExample + packagesSchemeHelp
 )
 
 var (
@@ -54,7 +61,7 @@ var (
 		Use:   "packages [SOURCE]",
 		Short: "Generate a package SBOM",
 		Long:  "Generate a packaged-based Software Bill Of Materials (SBOM) from container images and filesystems",
-		Example: internal.Tprintf(packagesExample, map[string]interface{}{
+		Example: internal.Tprintf(packagesHelp, map[string]interface{}{
 			"appName": internal.ApplicationName,
 			"command": "packages",
 		}),
@@ -88,7 +95,6 @@ func init() {
 
 func setPackageFlags(flags *pflag.FlagSet) {
 	// Formatting & Input options //////////////////////////////////////////////
-
 	flags.StringP(
 		"scope", "s", cataloger.DefaultSearchConfig().Scope.String(),
 		fmt.Sprintf("selection of layers to catalog, options=%v", source.AllScopes))
@@ -140,15 +146,23 @@ func setPackageFlags(flags *pflag.FlagSet) {
 	)
 }
 
-// NOTE(alex): Write a helper for the binding operation, which can be used to perform the binding but also double check that the intended effect was had or else return an error. Another thought is to somehow provide zero-valued defaults for all values in our config struct (maybe with reflection?). There may be a mechanism that already exists in viper that protects against this that I'm not aware of. ref: https://github.com/anchore/syft/pull/805#discussion_r801931192
 func bindPackagesConfigOptions(flags *pflag.FlagSet) error {
-	// Formatting & Input options //////////////////////////////////////////////
-
-	if err := viper.BindPFlag("package.cataloger.scope", flags.Lookup("scope")); err != nil {
+	if err := bindExclusivePackagesConfigOptions(flags); err != nil {
 		return err
 	}
+	if err := bindSharedOutputConfigOption(flags); err != nil {
+		return err
+	}
+	return nil
+}
 
-	if err := viper.BindPFlag("output", flags.Lookup("output")); err != nil {
+// NOTE(alex): Write a helper for the binding operation, which can be used to perform the binding but also double check that the intended effect was had or else return an error. Another thought is to somehow provide zero-valued defaults for all values in our config struct (maybe with reflection?). There may be a mechanism that already exists in viper that protects against this that I'm not aware of. ref: https://github.com/anchore/syft/pull/805#discussion_r801931192
+func bindExclusivePackagesConfigOptions(flags *pflag.FlagSet) error {
+	// Formatting & Input options //////////////////////////////////////////////
+
+	// note: output is not included since this configuration option is shared between multiple subcommands
+
+	if err := viper.BindPFlag("package.cataloger.scope", flags.Lookup("scope")); err != nil {
 		return err
 	}
 
@@ -215,9 +229,13 @@ func packagesExec(_ *cobra.Command, args []string) error {
 
 	// could be an image or a directory, with or without a scheme
 	userInput := args[0]
+	si, err := source.ParseInput(userInput, true)
+	if err != nil {
+		return fmt.Errorf("could not generate source input for packages command: %w", err)
+	}
 
 	return eventLoop(
-		packagesExecWorker(userInput, writer),
+		packagesExecWorker(*si, writer),
 		setupSignals(),
 		eventSubscription,
 		stereoscope.Cleanup,
@@ -236,46 +254,63 @@ func isVerbose() (result bool) {
 	return appConfig.CliOptions.Verbosity > 0 || isPipedInput
 }
 
-func packagesExecWorker(userInput string, writer sbom.Writer) <-chan error {
+func generateSBOM(src *source.Source, errs chan error) (*sbom.SBOM, error) {
+	tasks, err := tasks()
+	if err != nil {
+		return nil, err
+	}
+
+	s := sbom.SBOM{
+		Source: src.Metadata,
+		Descriptor: sbom.Descriptor{
+			Name:          internal.ApplicationName,
+			Version:       version.FromBuild().Version,
+			Configuration: appConfig,
+		},
+	}
+
+	buildRelationships(&s, src, tasks, errs)
+
+	return &s, nil
+}
+
+func buildRelationships(s *sbom.SBOM, src *source.Source, tasks []task, errs chan error) {
+	var relationships []<-chan artifact.Relationship
+	for _, task := range tasks {
+		c := make(chan artifact.Relationship)
+		relationships = append(relationships, c)
+		go runTask(task, &s.Artifacts, src, c, errs)
+	}
+
+	s.Relationships = append(s.Relationships, mergeRelationships(relationships...)...)
+}
+
+func packagesExecWorker(si source.Input, writer sbom.Writer) <-chan error {
 	errs := make(chan error)
 	go func() {
 		defer close(errs)
 
-		tasks, err := tasks()
+		src, cleanup, err := source.New(si, appConfig.Registry.ToOptions(), appConfig.Exclusions)
+		if cleanup != nil {
+			defer cleanup()
+		}
+		if err != nil {
+			errs <- fmt.Errorf("failed to construct source from user input %q: %w", si.UserInput, err)
+			return
+		}
+
+		s, err := generateSBOM(src, errs)
 		if err != nil {
 			errs <- err
 			return
 		}
 
-		src, cleanup, err := source.New(userInput, appConfig.Registry.ToOptions(), appConfig.Exclusions)
-		if err != nil {
-			errs <- fmt.Errorf("failed to construct source from user input %q: %w", userInput, err)
-			return
+		if s == nil {
+			errs <- fmt.Errorf("no SBOM produced for %q", si.UserInput)
 		}
-		if cleanup != nil {
-			defer cleanup()
-		}
-
-		s := sbom.SBOM{
-			Source: src.Metadata,
-			Descriptor: sbom.Descriptor{
-				Name:          internal.ApplicationName,
-				Version:       version.FromBuild().Version,
-				Configuration: appConfig,
-			},
-		}
-
-		var relationships []<-chan artifact.Relationship
-		for _, task := range tasks {
-			c := make(chan artifact.Relationship)
-			relationships = append(relationships, c)
-
-			go runTask(task, &s.Artifacts, src, c, errs)
-		}
-		s.Relationships = append(s.Relationships, mergeRelationships(relationships...)...)
 
 		if appConfig.Anchore.Host != "" {
-			if err := runPackageSbomUpload(src, s); err != nil {
+			if err := runPackageSbomUpload(src, *s); err != nil {
 				errs <- err
 				return
 			}
@@ -283,7 +318,7 @@ func packagesExecWorker(userInput string, writer sbom.Writer) <-chan error {
 
 		bus.Publish(partybus.Event{
 			Type:  event.Exit,
-			Value: func() error { return writer.Write(s) },
+			Value: func() error { return writer.Write(*s) },
 		})
 	}()
 	return errs

cmd/power_user.go

@@ -26,7 +26,7 @@ const powerUserExample = `  {{.appName}} {{.command}} <image>
 
   DEPRECATED - THIS COMMAND WILL BE REMOVED in v1.0.0
 
-  Only image sources are supported (e.g. docker: , docker-archive: , oci: , etc.), the directory source (dir:) is not supported.
+  Only image sources are supported (e.g. docker: , podman: , docker-archive: , oci: , etc.), the directory source (dir:) is not supported.
 
   All behavior is controlled via application configuration and environment variables (see https://github.com/anchore/syft#configuration)
 `
@@ -115,7 +115,13 @@ func powerUserExecWorker(userInput string, writer sbom.Writer) <-chan error {
 			return
 		}
 
-		src, cleanup, err := source.New(userInput, appConfig.Registry.ToOptions(), appConfig.Exclusions)
+		si, err := source.ParseInput(userInput, true)
+		if err != nil {
+			errs <- err
+			return
+		}
+
+		src, cleanup, err := source.New(*si, appConfig.Registry.ToOptions(), appConfig.Exclusions)
 		if err != nil {
 			errs <- err
 			return

cmd/root.go

@@ -27,6 +27,8 @@ var rootCmd = &cobra.Command{
 	Version:           version.FromBuild().Version,
 }
 
+const indent = "  "
+
 func init() {
 	// set universal flags
 	rootCmd.PersistentFlags().StringVarP(&persistentOpts.ConfigPath, "config", "c", "", "application config file")

go.mod

@@ -13,33 +13,36 @@ require (
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29
-	github.com/anchore/stereoscope v0.0.0-20220214165125-25ebd49a842b
+	github.com/anchore/stereoscope v0.0.0-20220301220648-8aa8a4a0bf50
 	github.com/antihax/optional v1.0.0
 	github.com/bmatcuk/doublestar/v4 v4.0.2
 	github.com/docker/docker v20.10.12+incompatible
 	github.com/dustin/go-humanize v1.0.0
 	github.com/facebookincubator/nvdtools v0.1.4
 	github.com/go-test/deep v1.0.8
-	github.com/google/go-cmp v0.5.6
-	github.com/google/uuid v1.2.0
-	github.com/gookit/color v1.2.7
-	github.com/hashicorp/go-multierror v1.1.0
+	github.com/google/go-cmp v0.5.7
+	github.com/google/uuid v1.3.0
+	github.com/gookit/color v1.4.2
+	github.com/hashicorp/go-multierror v1.1.1
+	github.com/in-toto/in-toto-golang v0.3.4-0.20211211042327-af1f9fb822bf
 	github.com/jinzhu/copier v0.3.2
+	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
 	github.com/mholt/archiver/v3 v3.5.1
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/mitchellh/hashstructure/v2 v2.0.2
-	github.com/mitchellh/mapstructure v1.4.1
-	github.com/olekukonko/tablewriter v0.0.4
-	github.com/pelletier/go-toml v1.9.3
+	github.com/mitchellh/mapstructure v1.4.3
+	github.com/olekukonko/tablewriter v0.0.5
+	github.com/pelletier/go-toml v1.9.4
 	github.com/pkg/profile v1.5.0
 	github.com/scylladb/go-set v1.0.2
-	github.com/sergi/go-diff v1.1.0
+	github.com/sergi/go-diff v1.2.0
+	github.com/sigstore/sigstore v1.1.1-0.20220217212907-e48ca03a5ba7
 	github.com/sirupsen/logrus v1.8.1
 	github.com/spdx/tools-golang v0.2.0
-	github.com/spf13/afero v1.6.0
-	github.com/spf13/cobra v1.2.1
+	github.com/spf13/afero v1.8.0
+	github.com/spf13/cobra v1.3.0
 	github.com/spf13/pflag v1.0.5
-	github.com/spf13/viper v1.8.1
+	github.com/spf13/viper v1.10.1
 	github.com/stretchr/testify v1.7.0
 	github.com/vifraa/gopom v0.1.0
 	github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5
@@ -47,19 +50,228 @@ require (
 	github.com/wagoodman/jotframe v0.0.0-20211129225309-56b0d0a4aebb
 	github.com/x-cray/logrus-prefixed-formatter v0.5.2
 	github.com/xeipuuv/gojsonschema v1.2.0
-	golang.org/x/mod v0.4.2
-	golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2
-	golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b
+	golang.org/x/mod v0.5.1
+	golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd
+	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211
 	gopkg.in/yaml.v2 v2.4.0
 )
 
+require github.com/sigstore/cosign v1.5.2-0.20220302132634-73235ac02e4a
+
+require (
+	bitbucket.org/creachadair/shell v0.0.6 // indirect
+	cloud.google.com/go v0.100.2 // indirect
+	cloud.google.com/go/compute v1.3.0 // indirect
+	cloud.google.com/go/iam v0.1.1 // indirect
+	cloud.google.com/go/kms v1.3.0 // indirect
+	cloud.google.com/go/storage v1.21.0 // indirect
+	github.com/Azure/azure-sdk-for-go v61.5.0+incompatible // indirect
+	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
+	github.com/Azure/go-autorest/autorest v0.11.24 // indirect
+	github.com/Azure/go-autorest/autorest/adal v0.9.18 // indirect
+	github.com/Azure/go-autorest/autorest/azure/auth v0.5.11 // indirect
+	github.com/Azure/go-autorest/autorest/azure/cli v0.4.5 // indirect
+	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
+	github.com/Azure/go-autorest/autorest/to v0.4.0 // indirect
+	github.com/Azure/go-autorest/autorest/validation v0.3.1 // indirect
+	github.com/Azure/go-autorest/logger v0.2.1 // indirect
+	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
+	github.com/PaesslerAG/gval v1.0.0 // indirect
+	github.com/PaesslerAG/jsonpath v0.1.1 // indirect
+	github.com/PuerkitoBio/purell v1.1.1 // indirect
+	github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
+	github.com/ReneKroon/ttlcache/v2 v2.11.0 // indirect
+	github.com/ThalesIgnite/crypto11 v1.2.5 // indirect
+	github.com/armon/go-metrics v0.3.10 // indirect
+	github.com/armon/go-radix v1.0.0 // indirect
+	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
+	github.com/aws/aws-sdk-go v1.43.0 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.13.0 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.13.1 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.8.0 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.10.0 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.4 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.2.0 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ecr v1.14.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.11.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.7.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.9.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.14.0 // indirect
+	github.com/aws/smithy-go v1.10.0 // indirect
+	github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.0.0-20220216180153-3d7835abdf40 // indirect
+	github.com/benbjohnson/clock v1.1.0 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/bgentry/speakeasy v0.1.0 // indirect
+	github.com/blang/semver v3.5.1+incompatible // indirect
+	github.com/cenkalti/backoff/v3 v3.2.2 // indirect
+	github.com/census-instrumentation/opencensus-proto v0.3.0 // indirect
+	github.com/cespare/xxhash/v2 v2.1.2 // indirect
+	github.com/chrismellard/docker-credential-acr-env v0.0.0-20220119192733-fe33c00cee21 // indirect
+	github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4 // indirect
+	github.com/cncf/xds/go v0.0.0-20211130200136-a8f946100490 // indirect
+	github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be // indirect
+	github.com/coreos/go-oidc/v3 v3.1.0 // indirect
+	github.com/coreos/go-semver v0.3.0 // indirect
+	github.com/coreos/go-systemd/v22 v22.3.2 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.1 // indirect
+	github.com/cyberphone/json-canonicalization v0.0.0-20210823021906-dc406ceaf94b // indirect
+	github.com/dimchansky/utfbom v1.1.1 // indirect
+	github.com/envoyproxy/go-control-plane v0.10.1 // indirect
+	github.com/envoyproxy/protoc-gen-validate v0.6.2 // indirect
+	github.com/fatih/color v1.13.0 // indirect
+	github.com/form3tech-oss/jwt-go v3.2.5+incompatible // indirect
+	github.com/fullstorydev/grpcurl v1.8.2 // indirect
+	github.com/ghodss/yaml v1.0.0 // indirect
+	github.com/go-chi/chi v4.1.2+incompatible // indirect
+	github.com/go-logr/logr v1.2.2 // indirect
+	github.com/go-openapi/analysis v0.21.2 // indirect
+	github.com/go-openapi/errors v0.20.2 // indirect
+	github.com/go-openapi/jsonpointer v0.19.5 // indirect
+	github.com/go-openapi/jsonreference v0.19.6 // indirect
+	github.com/go-openapi/loads v0.21.1 // indirect
+	github.com/go-openapi/runtime v0.23.1 // indirect
+	github.com/go-openapi/spec v0.20.4 // indirect
+	github.com/go-openapi/strfmt v0.21.2 // indirect
+	github.com/go-openapi/swag v0.21.1 // indirect
+	github.com/go-openapi/validate v0.21.0 // indirect
+	github.com/go-piv/piv-go v1.9.0 // indirect
+	github.com/go-playground/locales v0.14.0 // indirect
+	github.com/go-playground/universal-translator v0.18.0 // indirect
+	github.com/go-playground/validator/v10 v10.10.0 // indirect
+	github.com/go-stack/stack v1.8.1 // indirect
+	github.com/golang-jwt/jwt/v4 v4.2.0 // indirect
+	github.com/golang/glog v1.0.0 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/golang/mock v1.6.0 // indirect
+	github.com/google/btree v1.0.1 // indirect
+	github.com/google/certificate-transparency-go v1.1.2 // indirect
+	github.com/google/go-github/v42 v42.0.0 // indirect
+	github.com/google/go-querystring v1.1.0 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/google/trillian v1.4.0 // indirect
+	github.com/googleapis/gax-go/v2 v2.1.1 // indirect
+	github.com/googleapis/gnostic v0.5.5 // indirect
+	github.com/gorilla/websocket v1.4.2 // indirect
+	github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 // indirect
+	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway v1.16.0 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-hclog v1.1.0 // indirect
+	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
+	github.com/hashicorp/go-plugin v1.4.3 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.0 // indirect
+	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
+	github.com/hashicorp/go-secure-stdlib/mlock v0.1.2 // indirect
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.2 // indirect
+	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.2 // indirect
+	github.com/hashicorp/go-uuid v1.0.2 // indirect
+	github.com/hashicorp/go-version v1.4.0 // indirect
+	github.com/hashicorp/golang-lru v0.5.4 // indirect
+	github.com/hashicorp/vault/api v1.3.1 // indirect
+	github.com/hashicorp/vault/sdk v0.3.0 // indirect
+	github.com/hashicorp/yamux v0.0.0-20211028200310-0bc27b27de87 // indirect
+	github.com/imdario/mergo v0.3.12 // indirect
+	github.com/jedisct1/go-minisign v0.0.0-20210703085342-c1f07ee84431 // indirect
+	github.com/jhump/protoreflect v1.9.0 // indirect
+	github.com/jmespath/go-jmespath v0.4.0 // indirect
+	github.com/jonboulle/clockwork v0.2.2 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/leodido/go-urn v1.2.1 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
+	github.com/miekg/pkcs11 v1.1.1 // indirect
+	github.com/mitchellh/copystructure v1.2.0 // indirect
+	github.com/mitchellh/go-testing-interface v1.14.1 // indirect
+	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/oklog/run v1.1.0 // indirect
+	github.com/oklog/ulid v1.3.1 // indirect
+	github.com/opentracing/opentracing-go v1.2.0 // indirect
+	github.com/pierrec/lz4 v2.6.1+incompatible // indirect
+	github.com/prometheus/client_golang v1.11.0 // indirect
+	github.com/prometheus/client_model v0.2.0 // indirect
+	github.com/prometheus/common v0.32.1 // indirect
+	github.com/prometheus/procfs v0.7.3 // indirect
+	github.com/rivo/uniseg v0.2.0 // indirect
+	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/ryanuber/go-glob v1.0.0 // indirect
+	github.com/sassoftware/relic v0.0.0-20210427151427-dfb082b79b74 // indirect
+	github.com/secure-systems-lab/go-securesystemslib v0.3.1 // indirect
+	github.com/segmentio/ksuid v1.0.4 // indirect
+	github.com/shibumi/go-pathspec v1.3.0 // indirect
+	github.com/sigstore/fulcio v0.1.2-0.20220114150912-86a2036f9bc7 // indirect
+	github.com/sigstore/rekor v0.4.1-0.20220114213500-23f583409af3 // indirect
+	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
+	github.com/soheilhy/cmux v0.1.5 // indirect
+	github.com/spiffe/go-spiffe/v2 v2.0.0-beta.12 // indirect
+	github.com/syndtr/goleveldb v1.0.1-0.20210819022825-2ae1ddf74ef7 // indirect
+	github.com/tent/canonical-json-go v0.0.0-20130607151641-96e4ba3a7613 // indirect
+	github.com/thales-e-security/pool v0.0.2 // indirect
+	github.com/theupdateframework/go-tuf v0.0.0-20220211205608-f0c3294f63b9 // indirect
+	github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802 // indirect
+	github.com/urfave/cli v1.22.5 // indirect
+	github.com/xanzy/go-gitlab v0.55.1 // indirect
+	github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2 // indirect
+	github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778 // indirect
+	github.com/zeebo/errs v1.2.2 // indirect
+	go.etcd.io/bbolt v1.3.6 // indirect
+	go.etcd.io/etcd/api/v3 v3.5.1 // indirect
+	go.etcd.io/etcd/client/pkg/v3 v3.5.1 // indirect
+	go.etcd.io/etcd/client/v2 v2.305.1 // indirect
+	go.etcd.io/etcd/client/v3 v3.5.0 // indirect
+	go.etcd.io/etcd/etcdctl/v3 v3.5.0 // indirect
+	go.etcd.io/etcd/etcdutl/v3 v3.5.0 // indirect
+	go.etcd.io/etcd/pkg/v3 v3.5.0 // indirect
+	go.etcd.io/etcd/raft/v3 v3.5.0 // indirect
+	go.etcd.io/etcd/server/v3 v3.5.0 // indirect
+	go.etcd.io/etcd/tests/v3 v3.5.0 // indirect
+	go.etcd.io/etcd/v3 v3.5.0 // indirect
+	go.mongodb.org/mongo-driver v1.8.3 // indirect
+	go.opencensus.io v0.23.0 // indirect
+	go.opentelemetry.io/contrib v1.3.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.20.0 // indirect
+	go.opentelemetry.io/otel v0.20.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp v0.20.0 // indirect
+	go.opentelemetry.io/otel/metric v0.20.0 // indirect
+	go.opentelemetry.io/otel/sdk v0.20.0 // indirect
+	go.opentelemetry.io/otel/sdk/export/metric v0.20.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v0.20.0 // indirect
+	go.opentelemetry.io/otel/trace v0.20.0 // indirect
+	go.opentelemetry.io/proto/otlp v0.12.0 // indirect
+	go.uber.org/atomic v1.9.0 // indirect
+	go.uber.org/multierr v1.7.0 // indirect
+	go.uber.org/zap v1.21.0 // indirect
+	golang.org/x/time v0.0.0-20211116232009-f0f3c7e86c11 // indirect
+	golang.org/x/tools v0.1.8 // indirect
+	google.golang.org/api v0.70.0 // indirect
+	gopkg.in/cheggaaa/pb.v1 v1.0.28 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/natefinch/lumberjack.v2 v2.0.0 // indirect
+	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
+	k8s.io/api v0.23.3 // indirect
+	k8s.io/apimachinery v0.23.3 // indirect
+	k8s.io/client-go v0.23.3 // indirect
+	k8s.io/klog/v2 v2.40.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20220124234850-424119656bbf // indirect
+	k8s.io/utils v0.0.0-20220127004650-9b3446523e65 // indirect
+	knative.dev/pkg v0.0.0-20220202132633-df430fa0dd96 // indirect
+	sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2 // indirect
+	sigs.k8s.io/release-utils v0.4.1-0.20220207182343-6dadf2228617 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.2.1 // indirect
+	sigs.k8s.io/yaml v1.3.0 // indirect
+)
+
 require (
 	github.com/Microsoft/go-winio v0.5.1 // indirect
 	// we are hinting brotli to latest due to warning when installing archiver v3:
 	// go: warning: github.com/andybalholm/brotli@v1.0.1: retracted by module author: occasional panics and data corruption
 	github.com/andybalholm/brotli v1.0.4 // indirect
 	github.com/containerd/containerd v1.5.9 // indirect
-	github.com/containerd/stargz-snapshotter/estargz v0.10.0 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.10.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/docker/cli v20.10.12+incompatible // indirect
 	github.com/docker/distribution v2.7.1+incompatible // indirect
@@ -67,50 +279,49 @@ require (
 	github.com/docker/go-connections v0.4.0 // indirect
 	github.com/docker/go-units v0.4.0 // indirect
 	github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 // indirect
-	github.com/fsnotify/fsnotify v1.4.9 // indirect
+	github.com/fsnotify/fsnotify v1.5.1 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.0 // indirect
 	github.com/go-restruct/restruct v1.2.0-alpha // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/golang/snappy v0.0.3 // indirect
-	github.com/google/go-containerregistry v0.7.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/golang/snappy v0.0.4 // indirect
+	github.com/google/go-containerregistry v0.8.1-0.20220209165246-a44adc326839 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/iancoleman/orderedmap v0.0.0-20190318233801-ac98e3ecb4b0 // indirect
 	github.com/inconshreveable/mousetrap v1.0.0 // indirect
-	github.com/klauspost/compress v1.13.6 // indirect
+	github.com/klauspost/compress v1.14.2 // indirect
 	github.com/klauspost/pgzip v1.2.5 // indirect
 	github.com/logrusorgru/aurora v0.0.0-20200102142835-e9ef32dff381 // indirect
 	github.com/magiconair/properties v1.8.5 // indirect
-	github.com/mattn/go-colorable v0.0.9 // indirect
-	github.com/mattn/go-isatty v0.0.6 // indirect
-	github.com/mattn/go-runewidth v0.0.7 // indirect
-	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
+	github.com/mattn/go-colorable v0.1.12 // indirect
+	github.com/mattn/go-isatty v0.0.14 // indirect
+	github.com/mattn/go-runewidth v0.0.13 // indirect
 	github.com/nwaples/rardecode v1.1.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.0.2 // indirect
+	github.com/opencontainers/image-spec v1.0.3-0.20220114050600-8b9d41f48198 // indirect
 	github.com/pierrec/lz4/v4 v4.1.2 // indirect
-	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pkg/errors v0.9.1
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/spf13/cast v1.3.1 // indirect
+	github.com/spf13/cast v1.4.1 // indirect
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
-	github.com/stretchr/objx v0.2.0 // indirect
+	github.com/stretchr/objx v0.3.0 // indirect
 	github.com/subosito/gotenv v1.2.0 // indirect
-	github.com/ulikunitz/xz v0.5.9 // indirect
+	github.com/ulikunitz/xz v0.5.10 // indirect
 	github.com/vbatts/tar-split v0.11.2 // indirect
-	github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect
+	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
-	golang.org/x/crypto v0.0.0-20220210151621-f4118a5b28e2 // indirect
+	golang.org/x/crypto v0.0.0-20220213190939-1e6e3497d506 // indirect
 	golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8 // indirect
 	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirect
-	golang.org/x/sys v0.0.0-20211110154304-99a53858aa08 // indirect
-	golang.org/x/text v0.3.6 // indirect
+	golang.org/x/sys v0.0.0-20220209214540-3681064d5158 // indirect
+	golang.org/x/text v0.3.7 // indirect
 	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20211111162719-482062a4217b // indirect
-	google.golang.org/grpc v1.42.0 // indirect
+	google.golang.org/genproto v0.0.0-20220218161850-94dd64e39d7c // indirect
+	google.golang.org/grpc v1.44.0 // indirect
 	google.golang.org/protobuf v1.27.1 // indirect
-	gopkg.in/ini.v1 v1.62.0 // indirect
+	gopkg.in/ini.v1 v1.66.2 // indirect
 	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
 )

install.sh

@@ -6,6 +6,11 @@ PROJECT_NAME="syft"
 OWNER=anchore
 REPO="${PROJECT_NAME}"
 GITHUB_DOWNLOAD_PREFIX=https://github.com/${OWNER}/${REPO}/releases/download
+INSTALL_SH_BASE_URL=https://raw.githubusercontent.com/${OWNER}/${PROJECT_NAME}
+PROGRAM_ARGS=$@
+
+# do not change the name of this parameter (this must always be backwards compatible)
+DOWNLOAD_TAG_INSTALL_SCRIPT=${DOWNLOAD_TAG_INSTALL_SCRIPT:-true}
 
 #
 # usage [script-name]
@@ -607,7 +612,10 @@ install_asset() (
 main() (
   # parse arguments
 
+  # note: never change default install directory (this must always be backwards compatible)
   install_dir=${install_dir:-./bin}
+
+  # note: never change the program flags or arguments (this must always be backwards compatible)
   while getopts "b:dh?x" arg; do
     case "$arg" in
       b) install_dir="$OPTARG" ;;
@@ -629,10 +637,10 @@ main() (
   tag=$1
 
   if [ -z "${tag}" ]; then
-    log_info "checking github for the current release tag"
+    log_debug "checking github for the current release tag"
     tag=""
   else
-    log_info "checking github for release tag='${tag}'"
+    log_debug "checking github for release tag='${tag}'"
   fi
   set -u
 
@@ -644,20 +652,30 @@ main() (
       return 1
   fi
 
-  version=$(tag_to_version "${tag}")
-
-  download_dir=$(mktemp -d)
-  trap 'rm -rf -- "$download_dir"' EXIT
-
   # run the application
 
+  version=$(tag_to_version "${tag}")
   os=$(uname_os)
   arch=$(uname_arch)
   format=$(get_format_name "${os}" "${arch}" "tar.gz")
   binary=$(get_binary_name "${os}" "${arch}" "${PROJECT_NAME}")
   download_url="${GITHUB_DOWNLOAD_PREFIX}/${tag}"
 
+  # we always use the install.sh script that is associated with the tagged release. Why? the latest install.sh is not
+  # guaranteed to be able to install every version of the application. We use the DOWNLOAD_TAG_INSTALL_SCRIPT env var
+  # to indicate if we should continue processing with the existing script or to download the script from the given tag.
+  if [ "${DOWNLOAD_TAG_INSTALL_SCRIPT}" = "true" ]; then
+      export DOWNLOAD_TAG_INSTALL_SCRIPT=false
+      log_info "fetching release script for tag='${tag}'"
+      http_copy "${INSTALL_SH_BASE_URL}/${tag}/install.sh" "" | sh -s -- ${PROGRAM_ARGS}
+      exit $?
+  fi
+
   log_info "using release tag='${tag}' version='${version}' os='${os}' arch='${arch}'"
+
+  download_dir=$(mktemp -d)
+  trap 'rm -rf -- "$download_dir"' EXIT
+
   log_debug "downloading files into ${download_dir}"
 
   download_and_install_asset "${download_url}" "${download_dir}" "${install_dir}" "${PROJECT_NAME}" "${os}" "${arch}" "${version}" "${format}" "${binary}"

internal/config/application.go

@@ -45,6 +45,7 @@ type Application struct {
 	Secrets            secrets            `yaml:"secrets" json:"secrets" mapstructure:"secrets"`
 	Registry           registry           `yaml:"registry" json:"registry" mapstructure:"registry"`
 	Exclusions         []string           `yaml:"exclude" json:"exclude" mapstructure:"exclude"`
+	Attest             attest             `yaml:"attest" json:"attest" mapstructure:"attest"`
 }
 
 // PowerUserCatalogerEnabledDefault switches all catalogers to be enabled when running power-user command

internal/config/attest.go

@@ -0,0 +1,29 @@
+package config
+
+import (
+	"os"
+
+	"github.com/spf13/viper"
+)
+
+type attest struct {
+	Key string `yaml:"key" json:"key" mapstructure:"key"`
+	// IMPORTANT: do not show the password in any YAML/JSON output (sensitive information)
+	Password string `yaml:"-" json:"-" mapstructure:"password"`
+}
+
+//nolint:unparam
+func (cfg *attest) parseConfigValues() error {
+	if cfg.Password == "" {
+		// we allow for configuration via syft config/env vars and additionally interop with known cosign config env vars
+		if pw, ok := os.LookupEnv("COSIGN_PASSWORD"); ok {
+			cfg.Password = pw
+		}
+	}
+
+	return nil
+}
+
+func (cfg attest) loadDefaultValues(v *viper.Viper) {
+	v.SetDefault("attest.password", "")
+}

internal/err_helper.go

@@ -16,12 +16,13 @@ func CloseAndLogError(closer io.Closer, location string) {
 }
 
 type ErrPath struct {
-	Path string
-	Err  error
+	Context string
+	Path    string
+	Err     error
 }
 
 func (e ErrPath) Error() string {
-	return fmt.Sprintf("unable to observe contents of %+v: %v", e.Path, e.Err)
+	return fmt.Sprintf("%s unable to observe contents of %+v: %v", e.Context, e.Path, e.Err)
 }
 
 func IsErrPath(err error) bool {

internal/formats/common/cyclonedxhelpers/author.go

@@ -7,7 +7,7 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 )
 
-func Author(p pkg.Package) string {
+func encodeAuthor(p pkg.Package) string {
 	if hasMetadata(p) {
 		switch metadata := p.Metadata.(type) {
 		case pkg.NpmPackageJSONMetadata:
@@ -30,3 +30,18 @@ func Author(p pkg.Package) string {
 	}
 	return ""
 }
+
+func decodeAuthor(author string, metadata interface{}) {
+	switch meta := metadata.(type) {
+	case *pkg.NpmPackageJSONMetadata:
+		meta.Author = author
+	case *pkg.PythonPackageMetadata:
+		parts := strings.SplitN(author, " <", 2)
+		meta.Author = parts[0]
+		if len(parts) > 1 {
+			meta.AuthorEmail = strings.TrimSuffix(parts[1], ">")
+		}
+	case *pkg.GemMetadata:
+		meta.Authors = strings.Split(author, ",")
+	}
+}

internal/formats/common/cyclonedxhelpers/author_test.go

@@ -7,7 +7,7 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func Test_Author(t *testing.T) {
+func Test_encodeAuthor(t *testing.T) {
 	tests := []struct {
 		name     string
 		input    pkg.Package
@@ -81,7 +81,7 @@ func Test_Author(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, Author(test.input))
+			assert.Equal(t, test.expected, encodeAuthor(test.input))
 		})
 	}
 }

internal/formats/common/cyclonedxhelpers/component.go

@@ -1,27 +1,101 @@
 package cyclonedxhelpers
 
 import (
+	"reflect"
+
 	"github.com/CycloneDX/cyclonedx-go"
+
+	"github.com/anchore/syft/internal/formats/common"
 	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
 )
 
-func Component(p pkg.Package) cyclonedx.Component {
+func encodeComponent(p pkg.Package) cyclonedx.Component {
+	props := encodeProperties(p, "syft:package")
+	props = append(props, encodeCPEs(p)...)
+	if len(p.Locations) > 0 {
+		props = append(props, encodeProperties(p.Locations, "syft:location")...)
+	}
+	if hasMetadata(p) {
+		props = append(props, encodeProperties(p.Metadata, "syft:metadata")...)
+	}
+
+	var properties *[]cyclonedx.Property
+	if len(props) > 0 {
+		properties = &props
+	}
+
 	return cyclonedx.Component{
 		Type:               cyclonedx.ComponentTypeLibrary,
 		Name:               p.Name,
-		Group:              Group(p),
+		Group:              encodeGroup(p),
 		Version:            p.Version,
 		PackageURL:         p.PURL,
-		Licenses:           Licenses(p),
-		CPE:                CPE(p),
-		Author:             Author(p),
-		Publisher:          Publisher(p),
-		Description:        Description(p),
-		ExternalReferences: ExternalReferences(p),
-		Properties:         Properties(p),
+		Licenses:           encodeLicenses(p),
+		CPE:                encodeSingleCPE(p),
+		Author:             encodeAuthor(p),
+		Publisher:          encodePublisher(p),
+		Description:        encodeDescription(p),
+		ExternalReferences: encodeExternalReferences(p),
+		Properties:         properties,
 	}
 }
 
 func hasMetadata(p pkg.Package) bool {
 	return p.Metadata != nil
 }
+
+func decodeComponent(c *cyclonedx.Component) *pkg.Package {
+	values := map[string]string{}
+	for _, p := range *c.Properties {
+		values[p.Name] = p.Value
+	}
+
+	p := &pkg.Package{
+		Name:      c.Name,
+		Version:   c.Version,
+		Locations: decodeLocations(values),
+		Licenses:  decodeLicenses(c),
+		CPEs:      decodeCPEs(c),
+		PURL:      c.PackageURL,
+	}
+
+	common.DecodeInto(p, values, "syft:package", CycloneDXFields)
+
+	p.Metadata = decodePackageMetadata(values, c, p.MetadataType)
+
+	if p.Type == "" {
+		p.Type = pkg.TypeFromPURL(p.PURL)
+	}
+
+	return p
+}
+
+func decodeLocations(vals map[string]string) []source.Location {
+	v := common.Decode(reflect.TypeOf([]source.Location{}), vals, "syft:location", CycloneDXFields)
+	out, _ := v.([]source.Location)
+	return out
+}
+
+func decodePackageMetadata(vals map[string]string, c *cyclonedx.Component, typ pkg.MetadataType) interface{} {
+	if typ != "" && c.Properties != nil {
+		metaTyp, ok := pkg.MetadataTypeByName[typ]
+		if !ok {
+			return nil
+		}
+		metaPtrTyp := reflect.PtrTo(metaTyp)
+		metaPtr := common.Decode(metaPtrTyp, vals, "syft:metadata", CycloneDXFields)
+
+		// Map all explicit metadata properties
+		decodeAuthor(c.Author, metaPtr)
+		decodeGroup(c.Group, metaPtr)
+		decodePublisher(c.Publisher, metaPtr)
+		decodeDescription(c.Description, metaPtr)
+		decodeExternalReferences(c, metaPtr)
+
+		// return the actual interface{} -> struct ... not interface{} -> *struct
+		return common.PtrToStruct(metaPtr)
+	}
+
+	return nil
+}

internal/formats/common/cyclonedxhelpers/component_test.go

@@ -4,12 +4,13 @@ import (
 	"testing"
 
 	"github.com/CycloneDX/cyclonedx-go"
+	"github.com/stretchr/testify/assert"
+
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
-	"github.com/stretchr/testify/assert"
 )
 
-func Test_Properties(t *testing.T) {
+func Test_encodeComponentProperties(t *testing.T) {
 	epoch := 2
 	tests := []struct {
 		name     string
@@ -46,13 +47,14 @@ func Test_Properties(t *testing.T) {
 				},
 			},
 			expected: &[]cyclonedx.Property{
-				{Name: "foundBy", Value: "cataloger"},
-				{Name: "path", Value: "test"},
-				{Name: "originPackage", Value: "libc-dev"},
-				{Name: "installedSize", Value: "4096"},
-				{Name: "pullDependencies", Value: "musl-utils"},
-				{Name: "pullChecksum", Value: "Q1p78yvTLG094tHE1+dToJGbmYzQE="},
-				{Name: "gitCommitOfApkPort", Value: "97b1c2842faa3bfa30f5811ffbf16d5ff9f1a479"},
+				{Name: "syft:package:foundBy", Value: "cataloger"},
+				{Name: "syft:location:0:path", Value: "test"},
+				{Name: "syft:metadata:gitCommitOfApkPort", Value: "97b1c2842faa3bfa30f5811ffbf16d5ff9f1a479"},
+				{Name: "syft:metadata:installedSize", Value: "4096"},
+				{Name: "syft:metadata:originPackage", Value: "libc-dev"},
+				{Name: "syft:metadata:pullChecksum", Value: "Q1p78yvTLG094tHE1+dToJGbmYzQE="},
+				{Name: "syft:metadata:pullDependencies", Value: "musl-utils"},
+				{Name: "syft:metadata:size", Value: "0"},
 			},
 		},
 		{
@@ -71,10 +73,10 @@ func Test_Properties(t *testing.T) {
 				},
 			},
 			expected: &[]cyclonedx.Property{
-				{Name: "metadataType", Value: "DpkgMetadata"},
-				{Name: "source", Value: "tzdata-dev"},
-				{Name: "sourceVersion", Value: "1.0"},
-				{Name: "installedSize", Value: "3036"},
+				{Name: "syft:package:metadataType", Value: "DpkgMetadata"},
+				{Name: "syft:metadata:installedSize", Value: "3036"},
+				{Name: "syft:metadata:source", Value: "tzdata-dev"},
+				{Name: "syft:metadata:sourceVersion", Value: "1.0"},
 			},
 		},
 		{
@@ -92,12 +94,12 @@ func Test_Properties(t *testing.T) {
 				},
 			},
 			expected: &[]cyclonedx.Property{
-				{Name: "language", Value: pkg.Go.String()},
-				{Name: "type", Value: "go-module"},
-				{Name: "metadataType", Value: "GolangBinMetadata"},
-				{Name: "goCompiledVersion", Value: "1.17"},
-				{Name: "architecture", Value: "amd64"},
-				{Name: "h1Digest", Value: "h1:KlOXYy8wQWTUJYFgkUI40Lzr06ofg5IRXUK5C7qZt1k="},
+				{Name: "syft:package:language", Value: pkg.Go.String()},
+				{Name: "syft:package:metadataType", Value: "GolangBinMetadata"},
+				{Name: "syft:package:type", Value: "go-module"},
+				{Name: "syft:metadata:architecture", Value: "amd64"},
+				{Name: "syft:metadata:goCompiledVersion", Value: "1.17"},
+				{Name: "syft:metadata:h1Digest", Value: "h1:KlOXYy8wQWTUJYFgkUI40Lzr06ofg5IRXUK5C7qZt1k="},
 			},
 		},
 		{
@@ -121,18 +123,19 @@ func Test_Properties(t *testing.T) {
 				},
 			},
 			expected: &[]cyclonedx.Property{
-				{Name: "type", Value: "rpm"},
-				{Name: "metadataType", Value: "RpmdbMetadata"},
-				{Name: "epoch", Value: "2"},
-				{Name: "release", Value: "1"},
-				{Name: "sourceRpm", Value: "dive-0.9.2-1.src.rpm"},
-				{Name: "size", Value: "12406784"},
+				{Name: "syft:package:metadataType", Value: "RpmdbMetadata"},
+				{Name: "syft:package:type", Value: "rpm"},
+				{Name: "syft:metadata:epoch", Value: "2"},
+				{Name: "syft:metadata:release", Value: "1"},
+				{Name: "syft:metadata:size", Value: "12406784"},
+				{Name: "syft:metadata:sourceRpm", Value: "dive-0.9.2-1.src.rpm"},
 			},
 		},
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, Properties(test.input))
+			c := encodeComponent(test.input)
+			assert.Equal(t, test.expected, c.Properties)
 		})
 	}
 }

internal/formats/common/cyclonedxhelpers/cpe.go

@@ -1,8 +1,13 @@
 package cyclonedxhelpers
 
-import "github.com/anchore/syft/syft/pkg"
+import (
+	"github.com/CycloneDX/cyclonedx-go"
 
-func CPE(p pkg.Package) string {
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func encodeSingleCPE(p pkg.Package) string {
 	// Since the CPEs in a package are sorted by specificity
 	// we can extract the first CPE as the one to output in cyclonedx
 	if len(p.CPEs) > 0 {
@@ -10,3 +15,43 @@ func CPE(p pkg.Package) string {
 	}
 	return ""
 }
+
+func encodeCPEs(p pkg.Package) (out []cyclonedx.Property) {
+	for i, c := range p.CPEs {
+		// first CPE is "most specific" and already encoded as the component CPE
+		if i == 0 {
+			continue
+		}
+		out = append(out, cyclonedx.Property{
+			Name:  "syft:cpe23",
+			Value: pkg.CPEString(c),
+		})
+	}
+	return
+}
+
+func decodeCPEs(c *cyclonedx.Component) (out []pkg.CPE) {
+	if c.CPE != "" {
+		cp, err := pkg.NewCPE(c.CPE)
+		if err != nil {
+			log.Warnf("invalid CPE: %s", c.CPE)
+		} else {
+			out = append(out, cp)
+		}
+	}
+
+	if c.Properties != nil {
+		for _, p := range *c.Properties {
+			if p.Name == "syft:cpe23" {
+				cp, err := pkg.NewCPE(p.Value)
+				if err != nil {
+					log.Warnf("invalid CPE: %s", p.Value)
+				} else {
+					out = append(out, cp)
+				}
+			}
+		}
+	}
+
+	return
+}

internal/formats/common/cyclonedxhelpers/cpe_test.go

@@ -3,11 +3,12 @@ package cyclonedxhelpers
 import (
 	"testing"
 
-	"github.com/anchore/syft/syft/pkg"
 	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/syft/syft/pkg"
 )
 
-func Test_CPE(t *testing.T) {
+func Test_encodeCPE(t *testing.T) {
 	testCPE := pkg.MustCPE("cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*")
 	testCPE2 := pkg.MustCPE("cpe:2.3:a:name:name2:3.2:*:*:*:*:*:*:*")
 	tests := []struct {
@@ -51,7 +52,7 @@ func Test_CPE(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, CPE(test.input))
+			assert.Equal(t, test.expected, encodeSingleCPE(test.input))
 		})
 	}
 }

internal/formats/common/cyclonedxhelpers/decoder.go

@@ -0,0 +1,222 @@
+package cyclonedxhelpers
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/CycloneDX/cyclonedx-go"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/format"
+	"github.com/anchore/syft/syft/linux"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/anchore/syft/syft/source"
+)
+
+func GetValidator(format cyclonedx.BOMFileFormat) format.Validator {
+	return func(reader io.Reader) error {
+		bom := &cyclonedx.BOM{}
+		err := cyclonedx.NewBOMDecoder(reader, format).Decode(bom)
+		if err != nil {
+			return err
+		}
+		// random JSON does not necessarily cause an error (e.g. SPDX)
+		if (cyclonedx.BOM{} == *bom) {
+			return fmt.Errorf("not a valid CycloneDX document")
+		}
+		return nil
+	}
+}
+
+func GetDecoder(format cyclonedx.BOMFileFormat) format.Decoder {
+	return func(reader io.Reader) (*sbom.SBOM, error) {
+		bom := &cyclonedx.BOM{}
+		err := cyclonedx.NewBOMDecoder(reader, format).Decode(bom)
+		if err != nil {
+			return nil, err
+		}
+		s, err := toSyftModel(bom)
+		if err != nil {
+			return nil, err
+		}
+		return s, nil
+	}
+}
+
+func toSyftModel(bom *cyclonedx.BOM) (*sbom.SBOM, error) {
+	meta := source.Metadata{}
+	if bom.Metadata != nil {
+		meta = decodeMetadata(bom.Metadata.Component)
+	}
+	s := &sbom.SBOM{
+		Artifacts: sbom.Artifacts{
+			PackageCatalog:    pkg.NewCatalog(),
+			LinuxDistribution: linuxReleaseFromComponents(*bom.Components),
+		},
+		Source: meta,
+		//Descriptor:    sbom.Descriptor{},
+	}
+
+	idMap := make(map[string]interface{})
+
+	if err := collectBomPackages(bom, s, idMap); err != nil {
+		return nil, err
+	}
+
+	collectRelationships(bom, s, idMap)
+
+	return s, nil
+}
+
+func collectBomPackages(bom *cyclonedx.BOM, s *sbom.SBOM, idMap map[string]interface{}) error {
+	if bom.Components == nil {
+		return fmt.Errorf("no components are defined in the CycloneDX BOM")
+	}
+	for i := range *bom.Components {
+		collectPackages(&(*bom.Components)[i], s, idMap)
+	}
+	return nil
+}
+
+func collectPackages(component *cyclonedx.Component, s *sbom.SBOM, idMap map[string]interface{}) {
+	switch component.Type {
+	case cyclonedx.ComponentTypeOS:
+	case cyclonedx.ComponentTypeContainer:
+	case cyclonedx.ComponentTypeApplication, cyclonedx.ComponentTypeFramework, cyclonedx.ComponentTypeLibrary:
+		p := decodeComponent(component)
+		idMap[component.BOMRef] = p
+		// TODO there must be a better way than needing to call this manually:
+		p.SetID()
+		s.Artifacts.PackageCatalog.Add(*p)
+	}
+
+	if component.Components != nil {
+		for i := range *component.Components {
+			collectPackages(&(*component.Components)[i], s, idMap)
+		}
+	}
+}
+
+func linuxReleaseFromComponents(components []cyclonedx.Component) *linux.Release {
+	for i := range components {
+		component := &components[i]
+		if component.Type == cyclonedx.ComponentTypeOS {
+			return linuxReleaseFromOSComponent(component)
+		}
+	}
+	return nil
+}
+
+func linuxReleaseFromOSComponent(component *cyclonedx.Component) *linux.Release {
+	if component == nil {
+		return nil
+	}
+
+	var name string
+	var version string
+	if component.SWID != nil {
+		name = component.SWID.Name
+		version = component.SWID.Version
+	}
+	if name == "" {
+		name = component.Name
+	}
+	if name == "" {
+		name = getPropertyValue(component, "id")
+	}
+	if version == "" {
+		version = component.Version
+	}
+	if version == "" {
+		version = getPropertyValue(component, "versionID")
+	}
+
+	rel := &linux.Release{
+		CPEName:    component.CPE,
+		PrettyName: name,
+		Name:       name,
+		ID:         name,
+		IDLike:     []string{name},
+		Version:    version,
+		VersionID:  version,
+	}
+	if component.ExternalReferences != nil {
+		for _, ref := range *component.ExternalReferences {
+			switch ref.Type {
+			case cyclonedx.ERTypeIssueTracker:
+				rel.BugReportURL = ref.URL
+			case cyclonedx.ERTypeWebsite:
+				rel.HomeURL = ref.URL
+			case cyclonedx.ERTypeOther:
+				switch ref.Comment {
+				case "support":
+					rel.SupportURL = ref.URL
+				case "privacyPolicy":
+					rel.PrivacyPolicyURL = ref.URL
+				}
+			}
+		}
+	}
+
+	return rel
+}
+
+func getPropertyValue(component *cyclonedx.Component, name string) string {
+	if component.Properties != nil {
+		for _, p := range *component.Properties {
+			if p.Name == name {
+				return p.Value
+			}
+		}
+	}
+	return ""
+}
+
+func collectRelationships(bom *cyclonedx.BOM, s *sbom.SBOM, idMap map[string]interface{}) {
+	if bom.Dependencies == nil {
+		return
+	}
+	for _, d := range *bom.Dependencies {
+		from, fromOk := idMap[d.Ref].(artifact.Identifiable)
+		if fromOk {
+			if d.Dependencies == nil {
+				continue
+			}
+			for _, t := range *d.Dependencies {
+				to, toOk := idMap[t.Ref].(artifact.Identifiable)
+				if toOk {
+					s.Relationships = append(s.Relationships, artifact.Relationship{
+						From: from,
+						To:   to,
+						Type: artifact.DependencyOfRelationship, // FIXME this information is lost
+					})
+				}
+			}
+		}
+	}
+}
+
+func decodeMetadata(component *cyclonedx.Component) source.Metadata {
+	switch component.Type {
+	case cyclonedx.ComponentTypeContainer:
+		return source.Metadata{
+			Scheme: source.ImageScheme,
+			ImageMetadata: source.ImageMetadata{
+				UserInput:      component.Name,
+				ID:             component.BOMRef,
+				ManifestDigest: component.Version,
+			},
+		}
+	case cyclonedx.ComponentTypeFile:
+		return source.Metadata{
+			Scheme: source.FileScheme, // or source.DirectoryScheme
+			Path:   component.Name,
+			ImageMetadata: source.ImageMetadata{
+				UserInput:      component.Name,
+				ID:             component.BOMRef,
+				ManifestDigest: component.Version,
+			},
+		}
+	}
+	return source.Metadata{}
+}

internal/formats/common/cyclonedxhelpers/decoder_test.go

@@ -0,0 +1,260 @@
+package cyclonedxhelpers
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/CycloneDX/cyclonedx-go"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_decode(t *testing.T) {
+	type expected struct {
+		os       string
+		pkg      string
+		ver      string
+		relation string
+		purl     string
+		cpe      string
+	}
+	tests := []struct {
+		name     string
+		input    cyclonedx.BOM
+		expected []expected
+	}{
+		{
+			name: "basic mapping from cyclonedx",
+			input: cyclonedx.BOM{
+				Metadata: nil,
+				Components: &[]cyclonedx.Component{
+					{
+						BOMRef:      "p1",
+						Type:        cyclonedx.ComponentTypeLibrary,
+						Name:        "package-1",
+						Version:     "1.0.1",
+						Description: "",
+						Hashes:      nil,
+						Licenses: &cyclonedx.Licenses{
+							{
+								License: &cyclonedx.License{
+									ID: "MIT",
+								},
+							},
+						},
+						CPE:        "cpe:2.3:*:some:package:1:*:*:*:*:*:*:*",
+						PackageURL: "pkg:some/package-1@1.0.1?arch=arm64&upstream=upstream1&distro=alpine-1",
+						ExternalReferences: &[]cyclonedx.ExternalReference{
+							{
+								URL:     "",
+								Comment: "",
+								Hashes:  nil,
+								Type:    "",
+							},
+						},
+						Properties: &[]cyclonedx.Property{
+							{
+								Name:  "foundBy",
+								Value: "the-cataloger-1",
+							},
+							{
+								Name:  "language",
+								Value: "python",
+							},
+							{
+								Name:  "type",
+								Value: "python",
+							},
+							{
+								Name:  "metadataType",
+								Value: "PythonPackageMetadata",
+							},
+							{
+								Name:  "path",
+								Value: "/some/path/pkg1",
+							},
+						},
+						Components: nil,
+						Evidence:   nil,
+					},
+					{
+						BOMRef:  "p2",
+						Type:    cyclonedx.ComponentTypeLibrary,
+						Name:    "package-2",
+						Version: "2.0.2",
+						Hashes:  nil,
+						Licenses: &cyclonedx.Licenses{
+							{
+								License: &cyclonedx.License{
+									ID: "MIT",
+								},
+							},
+						},
+						CPE:        "cpe:2.3:*:another:package:2:*:*:*:*:*:*:*",
+						PackageURL: "pkg:alpine/alpine-baselayout@3.2.0-r16?arch=x86_64&upstream=alpine-baselayout&distro=alpine-3.14.2",
+						Properties: &[]cyclonedx.Property{
+
+							{
+								Name:  "foundBy",
+								Value: "apkdb-cataloger",
+							},
+							{
+								Name:  "type",
+								Value: "apk",
+							},
+							{
+								Name:  "metadataType",
+								Value: "ApkMetadata",
+							},
+							{
+								Name:  "path",
+								Value: "/lib/apk/db/installed",
+							},
+							{
+								Name:  "layerID",
+								Value: "sha256:9fb3aa2f8b8023a4bebbf92aa567caf88e38e969ada9f0ac12643b2847391635",
+							},
+							{
+								Name:  "originPackage",
+								Value: "zlib",
+							},
+							{
+								Name:  "size",
+								Value: "51213",
+							},
+							{
+								Name:  "installedSize",
+								Value: "110592",
+							},
+							{
+								Name:  "pullDependencies",
+								Value: "so:libc.musl-x86_64.so.1",
+							},
+							{
+								Name:  "pullChecksum",
+								Value: "Q1uss4DfpvL16Nw2YUTwmzGBABz3Y=",
+							},
+							{
+								Name:  "gitCommitOfApkPort",
+								Value: "d2bfb22c8e8f67ad7d8d02704f35ec4d2a19f9b9",
+							},
+						},
+					},
+					{
+						Type:    cyclonedx.ComponentTypeOS,
+						Name:    "debian",
+						Version: "1.2.3",
+						Hashes:  nil,
+						Licenses: &cyclonedx.Licenses{
+							{
+								License: &cyclonedx.License{
+									ID: "MIT",
+								},
+							},
+						},
+						Properties: &[]cyclonedx.Property{
+							{
+								Name:  "prettyName",
+								Value: "debian",
+							},
+							{
+								Name:  "id",
+								Value: "debian",
+							},
+							{
+								Name:  "versionID",
+								Value: "1.2.3",
+							},
+						},
+						Components: nil,
+						Evidence:   nil,
+					},
+				},
+				Dependencies: &[]cyclonedx.Dependency{
+					{
+						Ref: "p1",
+						Dependencies: &[]cyclonedx.Dependency{
+							{
+								Ref: "p2",
+							},
+						},
+					},
+				},
+			},
+			expected: []expected{
+				{
+					os:  "debian",
+					ver: "1.2.3",
+				},
+				{
+					pkg:      "package-1",
+					ver:      "1.0.1",
+					cpe:      "cpe:2.3:*:some:package:1:*:*:*:*:*:*:*",
+					purl:     "pkg:some/package-1@1.0.1?arch=arm64&upstream=upstream1&distro=alpine-1",
+					relation: "package-2",
+				},
+				{
+					pkg:  "package-2",
+					ver:  "2.0.2",
+					purl: "pkg:alpine/alpine-baselayout@3.2.0-r16?arch=x86_64&upstream=alpine-baselayout&distro=alpine-3.14.2",
+				},
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			sbom, err := toSyftModel(&test.input)
+			assert.NoError(t, err)
+
+		test:
+			for _, e := range test.expected {
+				if e.os != "" {
+					assert.Equal(t, e.os, sbom.Artifacts.LinuxDistribution.ID)
+					assert.Equal(t, e.ver, sbom.Artifacts.LinuxDistribution.VersionID)
+				}
+				if e.pkg != "" {
+					for p := range sbom.Artifacts.PackageCatalog.Enumerate() {
+						if e.pkg != p.Name {
+							continue
+						}
+
+						assert.Equal(t, e.ver, p.Version)
+
+						if e.cpe != "" {
+							foundCPE := false
+							for _, c := range p.CPEs {
+								cstr := c.BindToFmtString()
+								if e.cpe == cstr {
+									foundCPE = true
+									break
+								}
+							}
+							if !foundCPE {
+								assert.Fail(t, fmt.Sprintf("CPE not found in package: %s", e.cpe))
+							}
+						}
+
+						if e.purl != "" {
+							assert.Equal(t, e.purl, p.PURL)
+						}
+
+						if e.relation != "" {
+							foundRelation := false
+							for _, r := range sbom.Relationships {
+								p := sbom.Artifacts.PackageCatalog.Package(r.To.ID())
+								if e.relation == p.Name {
+									foundRelation = true
+									break
+								}
+							}
+							if !foundRelation {
+								assert.Fail(t, fmt.Sprintf("relation not found: %s", e.relation))
+							}
+						}
+						continue test
+					}
+					assert.Fail(t, fmt.Sprintf("package should be present: %s", e.pkg))
+				}
+			}
+		})
+	}
+}

internal/formats/common/cyclonedxhelpers/description.go

@@ -2,7 +2,7 @@ package cyclonedxhelpers
 
 import "github.com/anchore/syft/syft/pkg"
 
-func Description(p pkg.Package) string {
+func encodeDescription(p pkg.Package) string {
 	if hasMetadata(p) {
 		switch metadata := p.Metadata.(type) {
 		case pkg.ApkMetadata:
@@ -13,3 +13,12 @@ func Description(p pkg.Package) string {
 	}
 	return ""
 }
+
+func decodeDescription(description string, metadata interface{}) {
+	switch meta := metadata.(type) {
+	case *pkg.ApkMetadata:
+		meta.Description = description
+	case *pkg.NpmPackageJSONMetadata:
+		meta.Description = description
+	}
+}

internal/formats/common/cyclonedxhelpers/description_test.go

@@ -7,7 +7,7 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func Test_Description(t *testing.T) {
+func Test_encodeDescription(t *testing.T) {
 	tests := []struct {
 		name     string
 		input    pkg.Package
@@ -50,7 +50,7 @@ func Test_Description(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, Description(test.input))
+			assert.Equal(t, test.expected, encodeDescription(test.input))
 		})
 	}
 }

internal/formats/common/cyclonedxhelpers/external_references.go

@@ -2,12 +2,13 @@ package cyclonedxhelpers
 
 import (
 	"fmt"
+	"strings"
 
 	"github.com/CycloneDX/cyclonedx-go"
 	"github.com/anchore/syft/syft/pkg"
 )
 
-func ExternalReferences(p pkg.Package) *[]cyclonedx.ExternalReference {
+func encodeExternalReferences(p pkg.Package) *[]cyclonedx.ExternalReference {
 	refs := []cyclonedx.ExternalReference{}
 	if hasMetadata(p) {
 		switch metadata := p.Metadata.(type) {
@@ -63,3 +64,51 @@ func ExternalReferences(p pkg.Package) *[]cyclonedx.ExternalReference {
 	}
 	return nil
 }
+
+func decodeExternalReferences(c *cyclonedx.Component, metadata interface{}) {
+	if c.ExternalReferences == nil {
+		return
+	}
+	switch meta := metadata.(type) {
+	case *pkg.ApkMetadata:
+		meta.URL = refURL(c, cyclonedx.ERTypeDistribution)
+	case *pkg.CargoPackageMetadata:
+		meta.Source = refURL(c, cyclonedx.ERTypeDistribution)
+	case *pkg.NpmPackageJSONMetadata:
+		meta.URL = refURL(c, cyclonedx.ERTypeDistribution)
+		meta.Homepage = refURL(c, cyclonedx.ERTypeWebsite)
+	case *pkg.GemMetadata:
+		meta.Homepage = refURL(c, cyclonedx.ERTypeWebsite)
+	case *pkg.PythonPackageMetadata:
+		if meta.DirectURLOrigin == nil {
+			meta.DirectURLOrigin = &pkg.PythonDirectURLOriginInfo{}
+		}
+		meta.DirectURLOrigin.URL = refURL(c, cyclonedx.ERTypeVCS)
+		meta.DirectURLOrigin.CommitID = strings.TrimPrefix(refComment(c, cyclonedx.ERTypeVCS), "commit: ")
+	}
+}
+
+func findExternalRef(c *cyclonedx.Component, typ cyclonedx.ExternalReferenceType) *cyclonedx.ExternalReference {
+	if c.ExternalReferences != nil {
+		for _, r := range *c.ExternalReferences {
+			if r.Type == typ {
+				return &r
+			}
+		}
+	}
+	return nil
+}
+
+func refURL(c *cyclonedx.Component, typ cyclonedx.ExternalReferenceType) string {
+	if r := findExternalRef(c, typ); r != nil {
+		return r.URL
+	}
+	return ""
+}
+
+func refComment(c *cyclonedx.Component, typ cyclonedx.ExternalReferenceType) string {
+	if r := findExternalRef(c, typ); r != nil {
+		return r.Comment
+	}
+	return ""
+}

internal/formats/common/cyclonedxhelpers/external_references_test.go

@@ -8,7 +8,7 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func Test_ExternalReferences(t *testing.T) {
+func Test_encodeExternalReferences(t *testing.T) {
 	tests := []struct {
 		name     string
 		input    pkg.Package
@@ -127,7 +127,7 @@ func Test_ExternalReferences(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, ExternalReferences(test.input))
+			assert.Equal(t, test.expected, encodeExternalReferences(test.input))
 		})
 	}
 }

internal/formats/common/cyclonedxhelpers/format.go

@@ -4,6 +4,8 @@ import (
 	"time"
 
 	"github.com/CycloneDX/cyclonedx-go"
+	"github.com/google/uuid"
+
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/version"
@@ -11,7 +13,6 @@ import (
 	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
-	"github.com/google/uuid"
 )
 
 func ToFormatModel(s sbom.SBOM) *cyclonedx.BOM {
@@ -27,7 +28,7 @@ func ToFormatModel(s sbom.SBOM) *cyclonedx.BOM {
 	packages := s.Artifacts.PackageCatalog.Sorted()
 	components := make([]cyclonedx.Component, len(packages))
 	for i, p := range packages {
-		components[i] = Component(p)
+		components[i] = encodeComponent(p)
 	}
 	components = append(components, toOSComponent(s.Artifacts.LinuxDistribution)...)
 	cdxBOM.Components = &components
@@ -74,18 +75,27 @@ func toOSComponent(distro *linux.Release) []cyclonedx.Component {
 	if len(*eRefs) == 0 {
 		eRefs = nil
 	}
-	props := getCycloneDXProperties(*distro)
-	if len(*props) == 0 {
-		props = nil
+	props := encodeProperties(distro, "syft:distro")
+	var properties *[]cyclonedx.Property
+	if len(props) > 0 {
+		properties = &props
 	}
 	return []cyclonedx.Component{
 		{
-			Type:               cyclonedx.ComponentTypeOS,
-			Name:               distro.Name,
-			Version:            distro.Version,
+			Type: cyclonedx.ComponentTypeOS,
+			// FIXME is it idiomatic to be using SWID here for specific name and version information?
+			SWID: &cyclonedx.SWID{
+				TagID:   distro.ID,
+				Name:    distro.ID,
+				Version: distro.VersionID,
+			},
+			Description: distro.PrettyName,
+			Name:        distro.ID,
+			Version:     distro.VersionID,
+			// TODO should we add a PURL?
 			CPE:                distro.CPEName,
 			ExternalReferences: eRefs,
-			Properties:         props,
+			Properties:         properties,
 		},
 	}
 }

internal/formats/common/cyclonedxhelpers/group.go

@@ -2,7 +2,7 @@ package cyclonedxhelpers
 
 import "github.com/anchore/syft/syft/pkg"
 
-func Group(p pkg.Package) string {
+func encodeGroup(p pkg.Package) string {
 	if hasMetadata(p) {
 		if metadata, ok := p.Metadata.(pkg.JavaMetadata); ok && metadata.PomProperties != nil {
 			return metadata.PomProperties.GroupID
@@ -10,3 +10,12 @@ func Group(p pkg.Package) string {
 	}
 	return ""
 }
+
+func decodeGroup(group string, metadata interface{}) {
+	if meta, ok := metadata.(*pkg.JavaMetadata); ok {
+		if meta.PomProperties == nil {
+			meta.PomProperties = &pkg.PomProperties{}
+		}
+		meta.PomProperties.GroupID = group
+	}
+}

internal/formats/common/cyclonedxhelpers/group_test.go

@@ -7,7 +7,7 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func TestGroup(t *testing.T) {
+func Test_encodeGroup(t *testing.T) {
 	tests := []struct {
 		name     string
 		input    pkg.Package
@@ -46,7 +46,7 @@ func TestGroup(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, Group(test.input))
+			assert.Equal(t, test.expected, encodeGroup(test.input))
 		})
 	}
 }

internal/formats/common/cyclonedxhelpers/licenses.go

@@ -6,7 +6,7 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 )
 
-func Licenses(p pkg.Package) *cyclonedx.Licenses {
+func encodeLicenses(p pkg.Package) *cyclonedx.Licenses {
 	lc := cyclonedx.Licenses{}
 	for _, licenseName := range p.Licenses {
 		if value, exists := spdxlicense.ID(licenseName); exists {
@@ -22,3 +22,12 @@ func Licenses(p pkg.Package) *cyclonedx.Licenses {
 	}
 	return nil
 }
+
+func decodeLicenses(c *cyclonedx.Component) (out []string) {
+	if c.Licenses != nil {
+		for _, l := range *c.Licenses {
+			out = append(out, l.License.ID)
+		}
+	}
+	return
+}

internal/formats/common/cyclonedxhelpers/licenses_test.go

@@ -8,7 +8,7 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func Test_License(t *testing.T) {
+func Test_encodeLicense(t *testing.T) {
 	tests := []struct {
 		name     string
 		input    pkg.Package
@@ -77,7 +77,7 @@ func Test_License(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, Licenses(test.input))
+			assert.Equal(t, test.expected, encodeLicenses(test.input))
 		})
 	}
 }

internal/formats/common/cyclonedxhelpers/properties.go

@@ -1,78 +1,21 @@
 package cyclonedxhelpers
 
 import (
-	"fmt"
-	"reflect"
-
 	"github.com/CycloneDX/cyclonedx-go"
-	"github.com/anchore/syft/syft/pkg"
+
+	"github.com/anchore/syft/internal/formats/common"
 )
 
-func Properties(p pkg.Package) *[]cyclonedx.Property {
-	props := []cyclonedx.Property{}
-	props = append(props, *getCycloneDXProperties(p)...)
-	if len(p.Locations) > 0 {
-		for _, l := range p.Locations {
-			props = append(props, *getCycloneDXProperties(l.Coordinates)...)
-		}
-	}
-	if hasMetadata(p) {
-		props = append(props, *getCycloneDXProperties(p.Metadata)...)
-	}
-	if len(props) > 0 {
-		return &props
-	}
-	return nil
-}
+var (
+	CycloneDXFields = common.RequiredTag("cyclonedx")
+)
 
-func getCycloneDXProperties(m interface{}) *[]cyclonedx.Property {
-	props := []cyclonedx.Property{}
-	structValue := reflect.ValueOf(m)
-	if structValue.Kind() != reflect.Struct {
-		return &props
+func encodeProperties(obj interface{}, prefix string) (out []cyclonedx.Property) {
+	for _, p := range common.Sorted(common.Encode(obj, prefix, CycloneDXFields)) {
+		out = append(out, cyclonedx.Property{
+			Name:  p.Name,
+			Value: p.Value,
+		})
 	}
-	structType := structValue.Type()
-	for i := 0; i < structValue.NumField(); i++ {
-		if name, value := getCycloneDXPropertyName(structType.Field(i)), getCycloneDXPropertyValue(structValue.Field(i)); name != "" && value != "" {
-			// In the case of the value is a struct and has cyclonedx tag with name "-"
-			// call the getCycloneDXProperties recursively.
-			if name == "-" && reflect.ValueOf(value).Kind() == reflect.Struct {
-				props = append(props, *getCycloneDXProperties(value)...)
-			} else if reflect.ValueOf(value).Kind() == reflect.String {
-				props = append(props, cyclonedx.Property{
-					Name:  name,
-					Value: fmt.Sprint(value),
-				})
-			}
-		}
-	}
-	return &props
-}
-
-func getCycloneDXPropertyName(field reflect.StructField) string {
-	if value, exists := field.Tag.Lookup("cyclonedx"); exists {
-		return value
-	}
-	return ""
-}
-
-func getCycloneDXPropertyValue(field reflect.Value) interface{} {
-	if field.IsZero() {
-		return ""
-	}
-	switch field.Kind() {
-	case reflect.String, reflect.Bool, reflect.Int, reflect.Float32, reflect.Float64, reflect.Complex128, reflect.Complex64:
-		if field.CanInterface() {
-			return fmt.Sprint(field.Interface())
-		}
-		return ""
-	case reflect.Struct:
-		if field.CanInterface() {
-			return field.Interface()
-		}
-		return ""
-	case reflect.Ptr:
-		return getCycloneDXPropertyValue(reflect.Indirect(field))
-	}
-	return ""
+	return
 }

internal/formats/common/cyclonedxhelpers/publisher.go

@@ -4,7 +4,7 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 )
 
-func Publisher(p pkg.Package) string {
+func encodePublisher(p pkg.Package) string {
 	if hasMetadata(p) {
 		switch metadata := p.Metadata.(type) {
 		case pkg.ApkMetadata:
@@ -17,3 +17,14 @@ func Publisher(p pkg.Package) string {
 	}
 	return ""
 }
+
+func decodePublisher(publisher string, metadata interface{}) {
+	switch meta := metadata.(type) {
+	case *pkg.ApkMetadata:
+		meta.Maintainer = publisher
+	case *pkg.RpmdbMetadata:
+		meta.Vendor = publisher
+	case *pkg.DpkgMetadata:
+		meta.Maintainer = publisher
+	}
+}

internal/formats/common/cyclonedxhelpers/publisher_test.go

@@ -7,7 +7,7 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func Test_Publisher(t *testing.T) {
+func Test_encodePublisher(t *testing.T) {
 	tests := []struct {
 		name     string
 		input    pkg.Package
@@ -59,7 +59,7 @@ func Test_Publisher(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, Publisher(test.input))
+			assert.Equal(t, test.expected, encodePublisher(test.input))
 		})
 	}
 }

internal/formats/common/property_encoder.go

@@ -0,0 +1,322 @@
+package common
+
+import (
+	"fmt"
+	"reflect"
+	"sort"
+	"strconv"
+	"strings"
+
+	"github.com/anchore/syft/internal/log"
+)
+
+// FieldName return a flag to indicate this is a valid field and a name to use
+type FieldName func(field reflect.StructField) (string, bool)
+
+// OptionalTag given a tag name, will return the defined tag or fall back to lower camel case field name
+func OptionalTag(tag string) FieldName {
+	return func(f reflect.StructField) (string, bool) {
+		if n, ok := f.Tag.Lookup(tag); ok {
+			return n, true
+		}
+		return lowerFirst(f.Name), true
+	}
+}
+
+// TrimOmitempty trims `,omitempty` from the name
+func TrimOmitempty(fn FieldName) FieldName {
+	return func(f reflect.StructField) (string, bool) {
+		if v, ok := fn(f); ok {
+			return strings.TrimSuffix(v, ",omitempty"), true
+		}
+		return "", false
+	}
+}
+
+// RequiredTag based on the given tag, only use a field if present
+func RequiredTag(tag string) FieldName {
+	return func(f reflect.StructField) (string, bool) {
+		if n, ok := f.Tag.Lookup(tag); ok {
+			return n, true
+		}
+		return "", false
+	}
+}
+
+var (
+	// OptionalJSONTag uses field names defined in json tags, if available
+	OptionalJSONTag = TrimOmitempty(OptionalTag("json"))
+)
+
+// lowerFirst converts the first character of the string to lower case
+func lowerFirst(s string) string {
+	return strings.ToLower(s[0:1]) + s[1:]
+}
+
+// Encode recursively encodes the object's properties as an ordered set of NameValue pairs
+func Encode(obj interface{}, prefix string, fn FieldName) map[string]string {
+	if obj == nil {
+		return nil
+	}
+	props := map[string]string{}
+	encode(props, reflect.ValueOf(obj), prefix, fn)
+	return props
+}
+
+// NameValue a simple type to store stringified name/value pairs
+type NameValue struct {
+	Name  string
+	Value string
+}
+
+// Sorted returns a sorted set of NameValue pairs
+func Sorted(values map[string]string) (out []NameValue) {
+	var keys []string
+	for k := range values {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	for _, k := range keys {
+		out = append(out, NameValue{
+			Name:  k,
+			Value: values[k],
+		})
+	}
+	return
+}
+
+func encode(out map[string]string, value reflect.Value, prefix string, fn FieldName) {
+	if !value.IsValid() || value.Type() == nil {
+		return
+	}
+
+	typ := value.Type()
+
+	switch typ.Kind() {
+	case reflect.Ptr:
+		if value.IsNil() {
+			return
+		}
+		value = value.Elem()
+		encode(out, value, prefix, fn)
+	case reflect.String:
+		v := value.String()
+		if v != "" {
+			out[prefix] = v
+		}
+	case reflect.Bool:
+		v := value.Bool()
+		out[prefix] = strconv.FormatBool(v)
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		v := value.Int()
+		out[prefix] = strconv.FormatInt(v, 10)
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		v := value.Uint()
+		out[prefix] = strconv.FormatUint(v, 10)
+	case reflect.Float32, reflect.Float64:
+		v := value.Float()
+		out[prefix] = fmt.Sprintf("%f", v)
+	case reflect.Array, reflect.Slice:
+		for idx := 0; idx < value.Len(); idx++ {
+			encode(out, value.Index(idx), fmt.Sprintf("%s:%d", prefix, idx), fn)
+		}
+	case reflect.Struct:
+		for i := 0; i < typ.NumField(); i++ {
+			pv := value.Field(i)
+			f := typ.Field(i)
+			name, ok := fieldName(f, prefix, fn)
+			if !ok {
+				continue
+			}
+			encode(out, pv, name, fn)
+		}
+	default:
+		log.Warnf("skipping encoding of unsupported property: %s", prefix)
+	}
+}
+
+// fieldName gets the name of the field using the provided FieldName function
+func fieldName(f reflect.StructField, prefix string, fn FieldName) (string, bool) {
+	name, ok := fn(f)
+	if !ok {
+		return "", false
+	}
+	if name == "" {
+		return prefix, true
+	}
+	if prefix != "" {
+		name = fmt.Sprintf("%s:%s", prefix, name)
+	}
+	return name, true
+}
+
+// Decode based on the given type, applies all values to hydrate a new instance
+func Decode(typ reflect.Type, values map[string]string, prefix string, fn FieldName) interface{} {
+	isPtr := false
+	for typ.Kind() == reflect.Ptr {
+		typ = typ.Elem()
+		isPtr = true
+	}
+
+	isSlice := false
+	if typ.Kind() == reflect.Slice {
+		typ = reflect.PtrTo(typ)
+		isSlice = true
+	}
+
+	v := reflect.New(typ)
+
+	decode(values, v, prefix, fn)
+
+	switch {
+	case isSlice && isPtr:
+		return v.Elem().Interface()
+	case isSlice:
+		return PtrToStruct(v.Elem().Interface())
+	case isPtr:
+		return v.Interface()
+	}
+	return v.Elem().Interface()
+}
+
+// DecodeInto decodes all values to hydrate the given object instance
+func DecodeInto(obj interface{}, values map[string]string, prefix string, fn FieldName) {
+	value := reflect.ValueOf(obj)
+
+	for value.Type().Kind() == reflect.Ptr {
+		value = value.Elem()
+	}
+
+	decode(values, value, prefix, fn)
+}
+
+// nolint: funlen, gocognit, gocyclo
+func decode(vals map[string]string, value reflect.Value, prefix string, fn FieldName) bool {
+	if !value.IsValid() || value.Type() == nil {
+		return false
+	}
+
+	typ := value.Type()
+
+	incoming, valid := vals[prefix]
+	switch typ.Kind() {
+	case reflect.Ptr:
+		t := typ.Elem()
+		v := value
+		if v.IsNil() {
+			v = reflect.New(t)
+		}
+		if decode(vals, v.Elem(), prefix, fn) && value.CanSet() {
+			o := v.Interface()
+			log.Infof("%v", o)
+			value.Set(v)
+		} else {
+			return false
+		}
+	case reflect.String:
+		if valid {
+			value.SetString(incoming)
+		} else {
+			return false
+		}
+	case reflect.Bool:
+		if !valid {
+			return false
+		}
+		if b, err := strconv.ParseBool(incoming); err == nil {
+			value.SetBool(b)
+		} else {
+			return false
+		}
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		if !valid {
+			return false
+		}
+		if i, err := strconv.ParseInt(incoming, 10, 64); err == nil {
+			value.SetInt(i)
+		} else {
+			return false
+		}
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		if !valid {
+			return false
+		}
+		if i, err := strconv.ParseUint(incoming, 10, 64); err == nil {
+			value.SetUint(i)
+		} else {
+			return false
+		}
+	case reflect.Float32, reflect.Float64:
+		if !valid {
+			return false
+		}
+		if i, err := strconv.ParseFloat(incoming, 64); err == nil {
+			value.SetFloat(i)
+		} else {
+			return false
+		}
+	case reflect.Array, reflect.Slice:
+		values := false
+		t := typ.Elem()
+		slice := reflect.MakeSlice(typ, 0, 0)
+		for idx := 0; ; idx++ {
+			// test for index
+			str := fmt.Sprintf("%s:%d", prefix, idx)
+			// create new placeholder and decode values
+			newType := t
+			if t.Kind() == reflect.Ptr {
+				newType = t.Elem()
+			}
+			v := reflect.New(newType)
+			if decode(vals, v.Elem(), str, fn) {
+				// append to slice
+				if t.Kind() != reflect.Ptr {
+					v = v.Elem()
+				}
+				slice = reflect.Append(slice, v)
+				values = true
+			} else {
+				break
+			}
+		}
+		if values {
+			value.Set(slice)
+		} else {
+			return false
+		}
+	case reflect.Struct:
+		values := false
+		for i := 0; i < typ.NumField(); i++ {
+			f := typ.Field(i)
+			v := value.Field(i)
+
+			name, ok := fieldName(f, prefix, fn)
+			if !ok {
+				continue
+			}
+
+			if decode(vals, v, name, fn) {
+				values = true
+			}
+		}
+		return values
+	default:
+		log.Warnf("unable to set field: %s", prefix)
+		return false
+	}
+	return true
+}
+
+func PtrToStruct(ptr interface{}) interface{} {
+	v := reflect.ValueOf(ptr)
+	if v.IsZero() {
+		return nil
+	}
+	switch v.Type().Kind() {
+	case reflect.Ptr:
+		return PtrToStruct(v.Elem().Interface())
+	case reflect.Interface:
+		return PtrToStruct(v.Elem().Interface())
+	}
+	return v.Interface()
+}

internal/formats/common/property_encoder_test.go

@@ -0,0 +1,143 @@
+package common
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+type T1 struct {
+	Name     string
+	Val      int
+	ValU     uint
+	Flag     bool `json:"bool_flag"`
+	Float    float64
+	T2       T2
+	T2Ptr    *T2
+	T2Arr    []T2
+	T2PtrArr []*T2
+	StrArr   []string
+	IntArr   []int
+	FloatArr []float64
+	BoolArr  []bool
+	T3Arr    []T3
+}
+
+type T2 struct {
+	Name string
+}
+
+type T3 struct {
+	T4Arr []T4
+}
+
+type T4 struct {
+	Typ    string
+	IntPtr *int
+}
+
+func Test_EncodeDecodeCycle(t *testing.T) {
+	val := 99
+
+	tests := []struct {
+		name  string
+		value interface{}
+	}{
+		{
+			name: "all values",
+			value: T1{
+				Name:  "name",
+				Val:   10,
+				ValU:  16,
+				Flag:  true,
+				Float: 1.2,
+				T2: T2{
+					Name: "embedded t2",
+				},
+				T2Ptr: &T2{
+					"t2 ptr",
+				},
+				T2Arr: []T2{
+					{"t2 elem 0"},
+					{"t2 elem 1"},
+				},
+				T2PtrArr: []*T2{
+					{"t2 ptr v1"},
+					{"t2 ptr v2"},
+				},
+				StrArr:   []string{"s 1", "s 2", "s 3"},
+				IntArr:   []int{9, 12, -1},
+				FloatArr: []float64{-23.99, 15.234321, 39912342314},
+				BoolArr:  []bool{false, true, true, true, false},
+				T3Arr: []T3{
+					{
+						T4Arr: []T4{
+							{
+								Typ: "t4 nested typ 1",
+							},
+							{
+								Typ:    "t4 nested typ 2",
+								IntPtr: &val,
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "nil values",
+			value: T1{
+				Name:     "t1 test",
+				Val:      0,
+				ValU:     0,
+				Flag:     false,
+				Float:    0,
+				T2:       T2{},
+				T2Ptr:    nil,
+				T2Arr:    nil,
+				T2PtrArr: nil,
+				StrArr:   nil,
+				IntArr:   nil,
+				FloatArr: nil,
+				BoolArr:  nil,
+				T3Arr:    nil,
+			},
+		},
+		{
+			name: "array values",
+			value: []T2{
+				{"t2 elem 0"},
+				{"t2 elem 1"},
+			},
+		},
+		{
+			name: "array ptr",
+			value: &[]T2{
+				{"t2 elem 0"},
+				{"t2 elem 1"},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			vals := Encode(test.value, "props", OptionalJSONTag)
+
+			typ := reflect.TypeOf(test.value)
+
+			if typ.Kind() != reflect.Slice && typ.Kind() != reflect.Ptr {
+				assert.NotEmpty(t, vals["props:bool_flag"])
+
+				t2 := T1{}
+				DecodeInto(&t2, vals, "props", OptionalJSONTag)
+
+				assert.EqualValues(t, test.value, t2)
+			}
+
+			t3 := Decode(typ, vals, "props", OptionalJSONTag)
+
+			assert.EqualValues(t, test.value, t3)
+		})
+	}
+}

internal/formats/cyclonedx13json/decoder_test.go

@@ -0,0 +1,70 @@
+package cyclonedx13json
+
+import (
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_decodeJSON(t *testing.T) {
+	tests := []struct {
+		file     string
+		err      bool
+		distro   string
+		packages []string
+	}{
+		{
+			file:     "snapshot/TestCycloneDxDirectoryEncoder.golden",
+			distro:   "debian:1.2.3",
+			packages: []string{"package-1:1.0.1", "package-2:2.0.1"},
+		},
+		{
+			file:     "snapshot/TestCycloneDxImageEncoder.golden",
+			distro:   "debian:1.2.3",
+			packages: []string{"package-1:1.0.1", "package-2:2.0.1"},
+		},
+		{
+			file: "image-simple/Dockerfile",
+			err:  true,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.file, func(t *testing.T) {
+			reader, err := os.Open("test-fixtures/" + test.file)
+			assert.NoError(t, err)
+
+			if test.err {
+				err = Format().Validate(reader)
+				assert.Error(t, err)
+				return
+			}
+
+			bom, err := Format().Decode(reader)
+
+			assert.NoError(t, err)
+
+			split := strings.SplitN(test.distro, ":", 2)
+			name := split[0]
+			version := split[1]
+			assert.Equal(t, bom.Artifacts.LinuxDistribution.ID, name)
+			assert.Equal(t, bom.Artifacts.LinuxDistribution.Version, version)
+
+		pkgs:
+			for _, pkg := range test.packages {
+				split = strings.SplitN(pkg, ":", 2)
+				name = split[0]
+				version = split[1]
+				for p := range bom.Artifacts.PackageCatalog.Enumerate() {
+					if p.Name == name {
+						assert.Equal(t, version, p.Version)
+						continue pkgs
+					}
+				}
+				assert.Fail(t, fmt.Sprintf("package should be present: %s", pkg))
+			}
+		})
+	}
+}

internal/formats/cyclonedx13json/format.go

@@ -1,12 +1,16 @@
 package cyclonedx13json
 
-import "github.com/anchore/syft/syft/format"
+import (
+	"github.com/CycloneDX/cyclonedx-go"
+	"github.com/anchore/syft/internal/formats/common/cyclonedxhelpers"
+	"github.com/anchore/syft/syft/format"
+)
 
 func Format() format.Format {
 	return format.NewFormat(
 		format.CycloneDxJSONOption,
 		encoder,
-		nil,
-		nil,
+		cyclonedxhelpers.GetDecoder(cyclonedx.BOMFileFormatJSON),
+		cyclonedxhelpers.GetValidator(cyclonedx.BOMFileFormatJSON),
 	)
 }

internal/formats/cyclonedx13json/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden

@@ -1,10 +1,10 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.3",
-  "serialNumber": "urn:uuid:258d2616-5b1f-48cd-82a3-d6c95e262950",
+  "serialNumber": "urn:uuid:195a66a2-6d39-472e-b62b-0cafb9bfedd4",
   "version": 1,
   "metadata": {
-    "timestamp": "2022-01-14T22:47:00Z",
+    "timestamp": "2022-02-25T12:54:25-05:00",
     "tools": [
       {
         "vendor": "anchore",
@@ -13,6 +13,7 @@
       }
     ],
     "component": {
+      "bom-ref": "163686ac6e30c752",
       "type": "file",
       "name": "/some/path",
       "version": ""
@@ -34,23 +35,23 @@
       "purl": "a-purl-2",
       "properties": [
         {
-          "name": "foundBy",
+          "name": "syft:package:foundBy",
           "value": "the-cataloger-1"
         },
         {
-          "name": "language",
+          "name": "syft:package:language",
           "value": "python"
         },
         {
-          "name": "type",
-          "value": "python"
-        },
-        {
-          "name": "metadataType",
+          "name": "syft:package:metadataType",
           "value": "PythonPackageMetadata"
         },
         {
-          "name": "path",
+          "name": "syft:package:type",
+          "value": "python"
+        },
+        {
+          "name": "syft:location:0:path",
           "value": "/some/path/pkg1"
         }
       ]
@@ -63,20 +64,24 @@
       "purl": "a-purl-2",
       "properties": [
         {
-          "name": "foundBy",
+          "name": "syft:package:foundBy",
           "value": "the-cataloger-2"
         },
         {
-          "name": "type",
-          "value": "deb"
-        },
-        {
-          "name": "metadataType",
+          "name": "syft:package:metadataType",
           "value": "DpkgMetadata"
         },
         {
-          "name": "path",
+          "name": "syft:package:type",
+          "value": "deb"
+        },
+        {
+          "name": "syft:location:0:path",
           "value": "/some/path/pkg1"
+        },
+        {
+          "name": "syft:metadata:installedSize",
+          "value": "0"
         }
       ]
     },
@@ -84,17 +89,27 @@
       "type": "operating-system",
       "name": "debian",
       "version": "1.2.3",
+      "description": "debian",
+      "swid": {
+        "tagId": "debian",
+        "name": "debian",
+        "version": "1.2.3"
+      },
       "properties": [
         {
-          "name": "prettyName",
+          "name": "syft:distro:id",
           "value": "debian"
         },
         {
-          "name": "id",
+          "name": "syft:distro:idLike:0",
+          "value": "like!"
+        },
+        {
+          "name": "syft:distro:prettyName",
           "value": "debian"
         },
         {
-          "name": "versionID",
+          "name": "syft:distro:versionID",
           "value": "1.2.3"
         }
       ]

internal/formats/cyclonedx13json/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden

@@ -1,10 +1,10 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.3",
-  "serialNumber": "urn:uuid:8a84b1cf-e918-4842-a6a8-c7fdafc55bc0",
+  "serialNumber": "urn:uuid:78116a1b-b709-4734-8411-d0e339308edd",
   "version": 1,
   "metadata": {
-    "timestamp": "2022-01-14T22:47:00Z",
+    "timestamp": "2022-02-25T12:54:25-05:00",
     "tools": [
       {
         "vendor": "anchore",
@@ -13,6 +13,7 @@
       }
     ],
     "component": {
+      "bom-ref": "4f9453fd20e0cf80",
       "type": "container",
       "name": "user-image-input",
       "version": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368"
@@ -34,28 +35,28 @@
       "purl": "a-purl-1",
       "properties": [
         {
-          "name": "foundBy",
+          "name": "syft:package:foundBy",
           "value": "the-cataloger-1"
         },
         {
-          "name": "language",
+          "name": "syft:package:language",
           "value": "python"
         },
         {
-          "name": "type",
-          "value": "python"
-        },
-        {
-          "name": "metadataType",
+          "name": "syft:package:metadataType",
           "value": "PythonPackageMetadata"
         },
         {
-          "name": "path",
-          "value": "/somefile-1.txt"
+          "name": "syft:package:type",
+          "value": "python"
         },
         {
-          "name": "layerID",
-          "value": "sha256:16e64541f2ddf59a90391ce7bb8af90313f7d373f2105d88f3d3267b72e0ebab"
+          "name": "syft:location:0:layerID",
+          "value": "sha256:41e7295da66c405eb3a4df29188dcf80f622f9304d487033a86d4a22e3f01abe"
+        },
+        {
+          "name": "syft:location:0:path",
+          "value": "/somefile-1.txt"
         }
       ]
     },
@@ -67,24 +68,28 @@
       "purl": "a-purl-2",
       "properties": [
         {
-          "name": "foundBy",
+          "name": "syft:package:foundBy",
           "value": "the-cataloger-2"
         },
         {
-          "name": "type",
-          "value": "deb"
-        },
-        {
-          "name": "metadataType",
+          "name": "syft:package:metadataType",
           "value": "DpkgMetadata"
         },
         {
-          "name": "path",
+          "name": "syft:package:type",
+          "value": "deb"
+        },
+        {
+          "name": "syft:location:0:layerID",
+          "value": "sha256:68a2c166dcb3acf6b7303e995ca1fe7d794bd3b5852a0b4048f9c96b796086aa"
+        },
+        {
+          "name": "syft:location:0:path",
           "value": "/somefile-2.txt"
         },
         {
-          "name": "layerID",
-          "value": "sha256:de6c235f76ea24c8503ec08891445b5d6a8bdf8249117ed8d8b0b6fb3ebe4f67"
+          "name": "syft:metadata:installedSize",
+          "value": "0"
         }
       ]
     },
@@ -92,17 +97,27 @@
       "type": "operating-system",
       "name": "debian",
       "version": "1.2.3",
+      "description": "debian",
+      "swid": {
+        "tagId": "debian",
+        "name": "debian",
+        "version": "1.2.3"
+      },
       "properties": [
         {
-          "name": "prettyName",
+          "name": "syft:distro:id",
           "value": "debian"
         },
         {
-          "name": "id",
+          "name": "syft:distro:idLike:0",
+          "value": "like!"
+        },
+        {
+          "name": "syft:distro:prettyName",
           "value": "debian"
         },
         {
-          "name": "versionID",
+          "name": "syft:distro:versionID",
           "value": "1.2.3"
         }
       ]

internal/formats/cyclonedx13xml/decoder_test.go

@@ -0,0 +1,70 @@
+package cyclonedx13xml
+
+import (
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_decodeXML(t *testing.T) {
+	tests := []struct {
+		file     string
+		err      bool
+		distro   string
+		packages []string
+	}{
+		{
+			file:     "snapshot/TestCycloneDxDirectoryEncoder.golden",
+			distro:   "debian:1.2.3",
+			packages: []string{"package-1:1.0.1", "package-2:2.0.1"},
+		},
+		{
+			file:     "snapshot/TestCycloneDxImageEncoder.golden",
+			distro:   "debian:1.2.3",
+			packages: []string{"package-1:1.0.1", "package-2:2.0.1"},
+		},
+		{
+			file: "image-simple/Dockerfile",
+			err:  true,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.file, func(t *testing.T) {
+			reader, err := os.Open("test-fixtures/" + test.file)
+			assert.NoError(t, err)
+
+			if test.err {
+				err = Format().Validate(reader)
+				assert.Error(t, err)
+				return
+			}
+
+			bom, err := Format().Decode(reader)
+
+			assert.NoError(t, err)
+
+			split := strings.SplitN(test.distro, ":", 2)
+			name := split[0]
+			version := split[1]
+			assert.Equal(t, bom.Artifacts.LinuxDistribution.ID, name)
+			assert.Equal(t, bom.Artifacts.LinuxDistribution.Version, version)
+
+		pkgs:
+			for _, pkg := range test.packages {
+				split = strings.SplitN(pkg, ":", 2)
+				name = split[0]
+				version = split[1]
+				for p := range bom.Artifacts.PackageCatalog.Enumerate() {
+					if p.Name == name {
+						assert.Equal(t, version, p.Version)
+						continue pkgs
+					}
+				}
+				assert.Fail(t, fmt.Sprintf("package should be present: %s", pkg))
+			}
+		})
+	}
+}

internal/formats/cyclonedx13xml/format.go

@@ -1,12 +1,16 @@
 package cyclonedx13xml
 
-import "github.com/anchore/syft/syft/format"
+import (
+	"github.com/CycloneDX/cyclonedx-go"
+	"github.com/anchore/syft/internal/formats/common/cyclonedxhelpers"
+	"github.com/anchore/syft/syft/format"
+)
 
 func Format() format.Format {
 	return format.NewFormat(
 		format.CycloneDxXMLOption,
 		encoder,
-		nil,
-		nil,
+		cyclonedxhelpers.GetDecoder(cyclonedx.BOMFileFormatXML),
+		cyclonedxhelpers.GetValidator(cyclonedx.BOMFileFormatXML),
 	)
 }

internal/formats/cyclonedx13xml/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.3" serialNumber="urn:uuid:16a426e7-fcc7-4b94-abd2-66c67569cc44" version="1">
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" serialNumber="urn:uuid:dd1d1863-04be-414c-9b2a-bdc0e0f25e9f" version="1">
   <metadata>
-    <timestamp>2022-01-14T22:46:49Z</timestamp>
+    <timestamp>2022-02-25T12:54:44-05:00</timestamp>
     <tools>
       <tool>
         <vendor>anchore</vendor>
@@ -9,7 +9,7 @@
         <version>[not provided]</version>
       </tool>
     </tools>
-    <component type="file">
+    <component bom-ref="163686ac6e30c752" type="file">
       <name>/some/path</name>
       <version></version>
     </component>
@@ -26,11 +26,11 @@
       <cpe>cpe:2.3:*:some:package:2:*:*:*:*:*:*:*</cpe>
       <purl>a-purl-2</purl>
       <properties>
-        <property name="foundBy">the-cataloger-1</property>
-        <property name="language">python</property>
-        <property name="type">python</property>
-        <property name="metadataType">PythonPackageMetadata</property>
-        <property name="path">/some/path/pkg1</property>
+        <property name="syft:package:foundBy">the-cataloger-1</property>
+        <property name="syft:package:language">python</property>
+        <property name="syft:package:metadataType">PythonPackageMetadata</property>
+        <property name="syft:package:type">python</property>
+        <property name="syft:location:0:path">/some/path/pkg1</property>
       </properties>
     </component>
     <component type="library">
@@ -39,19 +39,23 @@
       <cpe>cpe:2.3:*:some:package:2:*:*:*:*:*:*:*</cpe>
       <purl>a-purl-2</purl>
       <properties>
-        <property name="foundBy">the-cataloger-2</property>
-        <property name="type">deb</property>
-        <property name="metadataType">DpkgMetadata</property>
-        <property name="path">/some/path/pkg1</property>
+        <property name="syft:package:foundBy">the-cataloger-2</property>
+        <property name="syft:package:metadataType">DpkgMetadata</property>
+        <property name="syft:package:type">deb</property>
+        <property name="syft:location:0:path">/some/path/pkg1</property>
+        <property name="syft:metadata:installedSize">0</property>
       </properties>
     </component>
     <component type="operating-system">
       <name>debian</name>
       <version>1.2.3</version>
+      <description>debian</description>
+      <swid tagId="debian" name="debian" version="1.2.3"></swid>
       <properties>
-        <property name="prettyName">debian</property>
-        <property name="id">debian</property>
-        <property name="versionID">1.2.3</property>
+        <property name="syft:distro:id">debian</property>
+        <property name="syft:distro:idLike:0">like!</property>
+        <property name="syft:distro:prettyName">debian</property>
+        <property name="syft:distro:versionID">1.2.3</property>
       </properties>
     </component>
   </components>

internal/formats/cyclonedx13xml/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.3" serialNumber="urn:uuid:a3d776c6-a2ca-4116-8b99-b3538dd1a460" version="1">
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" serialNumber="urn:uuid:153353a9-d9f4-40f6-be23-3d56487930c1" version="1">
   <metadata>
-    <timestamp>2022-01-14T22:46:49Z</timestamp>
+    <timestamp>2022-02-25T12:54:44-05:00</timestamp>
     <tools>
       <tool>
         <vendor>anchore</vendor>
@@ -9,7 +9,7 @@
         <version>[not provided]</version>
       </tool>
     </tools>
-    <component type="container">
+    <component bom-ref="4f9453fd20e0cf80" type="container">
       <name>user-image-input</name>
       <version>sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368</version>
     </component>
@@ -26,12 +26,12 @@
       <cpe>cpe:2.3:*:some:package:1:*:*:*:*:*:*:*</cpe>
       <purl>a-purl-1</purl>
       <properties>
-        <property name="foundBy">the-cataloger-1</property>
-        <property name="language">python</property>
-        <property name="type">python</property>
-        <property name="metadataType">PythonPackageMetadata</property>
-        <property name="path">/somefile-1.txt</property>
-        <property name="layerID">sha256:16e64541f2ddf59a90391ce7bb8af90313f7d373f2105d88f3d3267b72e0ebab</property>
+        <property name="syft:package:foundBy">the-cataloger-1</property>
+        <property name="syft:package:language">python</property>
+        <property name="syft:package:metadataType">PythonPackageMetadata</property>
+        <property name="syft:package:type">python</property>
+        <property name="syft:location:0:layerID">sha256:41e7295da66c405eb3a4df29188dcf80f622f9304d487033a86d4a22e3f01abe</property>
+        <property name="syft:location:0:path">/somefile-1.txt</property>
       </properties>
     </component>
     <component type="library">
@@ -40,20 +40,24 @@
       <cpe>cpe:2.3:*:some:package:2:*:*:*:*:*:*:*</cpe>
       <purl>a-purl-2</purl>
       <properties>
-        <property name="foundBy">the-cataloger-2</property>
-        <property name="type">deb</property>
-        <property name="metadataType">DpkgMetadata</property>
-        <property name="path">/somefile-2.txt</property>
-        <property name="layerID">sha256:de6c235f76ea24c8503ec08891445b5d6a8bdf8249117ed8d8b0b6fb3ebe4f67</property>
+        <property name="syft:package:foundBy">the-cataloger-2</property>
+        <property name="syft:package:metadataType">DpkgMetadata</property>
+        <property name="syft:package:type">deb</property>
+        <property name="syft:location:0:layerID">sha256:68a2c166dcb3acf6b7303e995ca1fe7d794bd3b5852a0b4048f9c96b796086aa</property>
+        <property name="syft:location:0:path">/somefile-2.txt</property>
+        <property name="syft:metadata:installedSize">0</property>
       </properties>
     </component>
     <component type="operating-system">
       <name>debian</name>
       <version>1.2.3</version>
+      <description>debian</description>
+      <swid tagId="debian" name="debian" version="1.2.3"></swid>
       <properties>
-        <property name="prettyName">debian</property>
-        <property name="id">debian</property>
-        <property name="versionID">1.2.3</property>
+        <property name="syft:distro:id">debian</property>
+        <property name="syft:distro:idLike:0">like!</property>
+        <property name="syft:distro:prettyName">debian</property>
+        <property name="syft:distro:versionID">1.2.3</property>
       </properties>
     </component>
   </components>

internal/formats/spdx22json/to_format_model.go

@@ -152,13 +152,19 @@ func toFiles(s sbom.SBOM) []model.File {
 func toFileChecksums(digests []file.Digest) (checksums []model.Checksum) {
 	for _, digest := range digests {
 		checksums = append(checksums, model.Checksum{
-			Algorithm:     digest.Algorithm,
+			Algorithm:     toChecksumAlgorithm(digest.Algorithm),
 			ChecksumValue: digest.Value,
 		})
 	}
 	return checksums
 }
 
+func toChecksumAlgorithm(algorithm string) string {
+	// basically, we need an uppercase version of our algorithm:
+	// https://github.com/spdx/spdx-spec/blob/development/v2.2.2/schemas/spdx-schema.json#L165
+	return strings.ToUpper(algorithm)
+}
+
 func toFileTypes(metadata *source.FileMetadata) (ty []string) {
 	if metadata == nil {
 		return nil

internal/formats/spdx22json/to_format_model_test.go

@@ -142,7 +142,7 @@ func Test_toFileChecksums(t *testing.T) {
 			name: "has digests",
 			digests: []file.Digest{
 				{
-					Algorithm: "sha256",
+					Algorithm: "SHA256",
 					Value:     "deadbeefcafe",
 				},
 				{
@@ -152,11 +152,11 @@ func Test_toFileChecksums(t *testing.T) {
 			},
 			expected: []model.Checksum{
 				{
-					Algorithm:     "sha256",
+					Algorithm:     "SHA256",
 					ChecksumValue: "deadbeefcafe",
 				},
 				{
-					Algorithm:     "md5",
+					Algorithm:     "MD5",
 					ChecksumValue: "meh",
 				},
 			},

internal/input.go

@@ -18,3 +18,9 @@ func IsPipedInput() (bool, error) {
 	// if there *may* be bytes that will show up on stdin that should be used for the analysis source.
 	return fi.Mode()&os.ModeNamedPipe != 0, nil
 }
+
+// IsTerminal returns true if there is a terminal present.
+func IsTerminal() bool {
+	stat, _ := os.Stdin.Stat()
+	return (stat.Mode() & os.ModeCharDevice) != 0
+}

syft/encode_decode.go

@@ -17,6 +17,7 @@ func Encode(s sbom.SBOM, option format.Option) ([]byte, error) {
 	if f == nil {
 		return nil, fmt.Errorf("unsupported format: %+v", option)
 	}
+
 	buff := bytes.Buffer{}
 
 	if err := f.Encode(&buff, s); err != nil {

syft/file/all_regular_files.go

@@ -0,0 +1,30 @@
+package file
+
+import (
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/source"
+)
+
+func allRegularFiles(resolver source.FileResolver) (locations []source.Location) {
+	for location := range resolver.AllLocations() {
+		resolvedLocations, err := resolver.FilesByPath(location.RealPath)
+		if err != nil {
+			log.Warnf("unable to resolve %+v: %+v", location, err)
+			continue
+		}
+
+		for _, resolvedLocation := range resolvedLocations {
+			metadata, err := resolver.FileMetadataByLocation(resolvedLocation)
+			if err != nil {
+				log.Warnf("unable to get metadata for %+v: %+v", location, err)
+				continue
+			}
+
+			if metadata.Type != source.RegularFile {
+				continue
+			}
+			locations = append(locations, resolvedLocation)
+		}
+	}
+	return locations
+}

syft/file/all_regular_files_test.go

@@ -0,0 +1,74 @@
+package file
+
+import (
+	"github.com/anchore/stereoscope/pkg/imagetest"
+	"github.com/anchore/syft/syft/source"
+	"github.com/scylladb/go-set/strset"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"testing"
+)
+
+func Test_allRegularFiles(t *testing.T) {
+	type access struct {
+		realPath    string
+		virtualPath string
+	}
+	tests := []struct {
+		name             string
+		setup            func() source.FileResolver
+		wantRealPaths    *strset.Set
+		wantVirtualPaths *strset.Set
+	}{
+		{
+			name: "image",
+			setup: func() source.FileResolver {
+				testImage := "image-file-type-mix"
+
+				if *updateImageGoldenFiles {
+					imagetest.UpdateGoldenFixtureImage(t, testImage)
+				}
+
+				img := imagetest.GetGoldenFixtureImage(t, testImage)
+
+				s, err := source.NewFromImage(img, "---")
+				require.NoError(t, err)
+
+				r, err := s.FileResolver(source.SquashedScope)
+				require.NoError(t, err)
+
+				return r
+			},
+			wantRealPaths:    strset.New("/file-1.txt"),
+			wantVirtualPaths: strset.New("/file-1.txt", "/symlink-1", "/hardlink-1"),
+		},
+		{
+			name: "directory",
+			setup: func() source.FileResolver {
+				s, err := source.NewFromDirectory("test-fixtures/symlinked-root/nested/link-root")
+				require.NoError(t, err)
+				r, err := s.FileResolver(source.SquashedScope)
+				require.NoError(t, err)
+				return r
+			},
+			wantRealPaths:    strset.New("file1.txt", "nested/file2.txt"),
+			wantVirtualPaths: strset.New("nested/linked-file1.txt"),
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			resolver := tt.setup()
+			locations := allRegularFiles(resolver)
+			realLocations := strset.New()
+			virtualLocations := strset.New()
+			for _, l := range locations {
+				realLocations.Add(l.RealPath)
+				if l.VirtualPath != "" {
+					virtualLocations.Add(l.VirtualPath)
+				}
+			}
+			assert.ElementsMatch(t, tt.wantRealPaths.List(), realLocations.List(), "mismatched real paths")
+			assert.ElementsMatch(t, tt.wantVirtualPaths.List(), virtualLocations.List(), "mismatched virtual paths")
+		})
+	}
+}

syft/file/classification_cataloger.go

@@ -19,11 +19,12 @@ func (i *ClassificationCataloger) Catalog(resolver source.FileResolver) (map[sou
 	results := make(map[source.Coordinates][]Classification)
 
 	numResults := 0
-	for location := range resolver.AllLocations() {
+	for _, location := range allRegularFiles(resolver) {
 		for _, classifier := range i.classifiers {
 			result, err := classifier.Classify(resolver, location)
 			if err != nil {
-				return nil, err
+				log.Warnf("file classification cataloger failed with class=%q at location=%+v: %+v", classifier.Class, location, err)
+				continue
 			}
 			if result != nil {
 				results[location.Coordinates] = append(results[location.Coordinates], *result)

syft/file/classification_cataloger_test.go

@@ -1,6 +1,7 @@
 package file
 
 import (
+	"github.com/anchore/stereoscope/pkg/imagetest"
 	"testing"
 
 	"github.com/anchore/syft/syft/source"
@@ -88,7 +89,7 @@ func TestClassifierCataloger_DefaultClassifiers_PositiveCases(t *testing.T) {
 		{
 			name:       "positive-busybox",
 			fixtureDir: "test-fixtures/classifiers/positive",
-			location:   "busybox",
+			location:   "[", // note: busybox is a link to [
 			expected: []Classification{
 				{
 					Class: "busybox-binary",
@@ -116,13 +117,67 @@ func TestClassifierCataloger_DefaultClassifiers_PositiveCases(t *testing.T) {
 			actualResults, err := c.Catalog(resolver)
 			test.expectedErr(t, err)
 
-			loc := source.NewLocation(test.location)
+			ok := false
+			for actualLoc, actualClassification := range actualResults {
+				if test.location == actualLoc.RealPath {
+					ok = true
+					assert.Equal(t, test.expected, actualClassification)
+				}
+			}
+
+			if !ok {
+				t.Fatalf("could not find test location=%q", test.location)
+			}
+
+		})
+	}
+}
+
+func TestClassifierCataloger_DefaultClassifiers_PositiveCases_Image(t *testing.T) {
+	tests := []struct {
+		name         string
+		fixtureImage string
+		location     string
+		expected     []Classification
+		expectedErr  func(assert.TestingT, error, ...interface{}) bool
+	}{
+		{
+			name:         "busybox-regression",
+			fixtureImage: "image-busybox",
+			location:     "/bin/[",
+			expected: []Classification{
+				{
+					Class: "busybox-binary",
+					Metadata: map[string]string{
+						"version": "1.35.0",
+					},
+				},
+			},
+			expectedErr: assert.NoError,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+
+			c, err := NewClassificationCataloger(DefaultClassifiers)
+			test.expectedErr(t, err)
+
+			img := imagetest.GetFixtureImage(t, "docker-archive", test.fixtureImage)
+			src, err := source.NewFromImage(img, "test-img")
+			test.expectedErr(t, err)
+
+			resolver, err := src.FileResolver(source.SquashedScope)
+			test.expectedErr(t, err)
+
+			actualResults, err := c.Catalog(resolver)
+			test.expectedErr(t, err)
 
 			ok := false
-			for actual_loc, actual_classification := range actualResults {
-				if loc.RealPath == actual_loc.RealPath {
+			for actuaLoc, actualClassification := range actualResults {
+				if actuaLoc.RealPath == test.location {
 					ok = true
-					assert.Equal(t, test.expected, actual_classification)
+					assert.Equal(t, test.expected, actualClassification)
 				}
 			}
 

syft/file/contents_cataloger.go

@@ -3,6 +3,7 @@ package file
 import (
 	"bytes"
 	"encoding/base64"
+	"fmt"
 	"io"
 
 	"github.com/anchore/syft/internal"
@@ -64,8 +65,13 @@ func (i *ContentsCataloger) catalogLocation(resolver source.FileResolver, locati
 	defer internal.CloseAndLogError(contentReader, location.VirtualPath)
 
 	buf := &bytes.Buffer{}
-	if _, err = io.Copy(base64.NewEncoder(base64.StdEncoding, buf), contentReader); err != nil {
-		return "", internal.ErrPath{Path: location.RealPath, Err: err}
+	encoder := base64.NewEncoder(base64.StdEncoding, buf)
+	if _, err = io.Copy(encoder, contentReader); err != nil {
+		return "", internal.ErrPath{Context: "contents-cataloger", Path: location.RealPath, Err: err}
+	}
+	// note: it's important to close the reader before reading from the buffer since closing will flush the remaining bytes
+	if err := encoder.Close(); err != nil {
+		return "", fmt.Errorf("unable to close base64 encoder: %w", err)
 	}
 
 	return buf.String(), nil

syft/file/digest_cataloger.go

@@ -2,6 +2,7 @@ package file
 
 import (
 	"crypto"
+	"errors"
 	"fmt"
 	"hash"
 	"io"
@@ -19,6 +20,8 @@ import (
 	"github.com/anchore/syft/syft/source"
 )
 
+var errUndigestableFile = errors.New("undigestable file")
+
 type DigestsCataloger struct {
 	hashes []crypto.Hash
 }
@@ -31,16 +34,18 @@ func NewDigestsCataloger(hashes []crypto.Hash) (*DigestsCataloger, error) {
 
 func (i *DigestsCataloger) Catalog(resolver source.FileResolver) (map[source.Coordinates][]Digest, error) {
 	results := make(map[source.Coordinates][]Digest)
-	var locations []source.Location
-	for location := range resolver.AllLocations() {
-		locations = append(locations, location)
-	}
+	locations := allRegularFiles(resolver)
 	stage, prog := digestsCatalogingProgress(int64(len(locations)))
 	for _, location := range locations {
 		stage.Current = location.RealPath
 		result, err := i.catalogLocation(resolver, location)
+
+		if errors.Is(err, errUndigestableFile) {
+			continue
+		}
+
 		if internal.IsErrPathPermission(err) {
-			log.Debugf("file digests cataloger skipping - %+v", err)
+			log.Debugf("file digests cataloger skipping %q: %+v", location.RealPath, err)
 			continue
 		}
 
@@ -56,6 +61,16 @@ func (i *DigestsCataloger) Catalog(resolver source.FileResolver) (map[source.Coo
 }
 
 func (i *DigestsCataloger) catalogLocation(resolver source.FileResolver, location source.Location) ([]Digest, error) {
+	meta, err := resolver.FileMetadataByLocation(location)
+	if err != nil {
+		return nil, err
+	}
+
+	// we should only attempt to report digests for files that are regular files (don't attempt to resolve links)
+	if meta.Type != source.RegularFile {
+		return nil, errUndigestableFile
+	}
+
 	contentReader, err := resolver.FileContentsByLocation(location)
 	if err != nil {
 		return nil, err
@@ -72,7 +87,7 @@ func (i *DigestsCataloger) catalogLocation(resolver source.FileResolver, locatio
 
 	size, err := io.Copy(io.MultiWriter(writers...), contentReader)
 	if err != nil {
-		return nil, internal.ErrPath{Path: location.RealPath, Err: err}
+		return nil, internal.ErrPath{Context: "digests-cataloger", Path: location.RealPath, Err: err}
 	}
 
 	if size == 0 {

syft/file/digest_cataloger_test.go

@@ -3,8 +3,10 @@ package file
 import (
 	"crypto"
 	"fmt"
+	"github.com/stretchr/testify/require"
 	"io/ioutil"
 	"os"
+	"path/filepath"
 	"testing"
 
 	"github.com/anchore/stereoscope/pkg/file"
@@ -16,11 +18,11 @@ import (
 	"github.com/anchore/syft/syft/source"
 )
 
-func testDigests(t testing.TB, files []string, hashes ...crypto.Hash) map[source.Coordinates][]Digest {
+func testDigests(t testing.TB, root string, files []string, hashes ...crypto.Hash) map[source.Coordinates][]Digest {
 	digests := make(map[source.Coordinates][]Digest)
 
 	for _, f := range files {
-		fh, err := os.Open(f)
+		fh, err := os.Open(filepath.Join(root, f))
 		if err != nil {
 			t.Fatalf("could not open %q : %+v", f, err)
 		}
@@ -29,6 +31,12 @@ func testDigests(t testing.TB, files []string, hashes ...crypto.Hash) map[source
 			t.Fatalf("could not read %q : %+v", f, err)
 		}
 
+		if len(b) == 0 {
+			// we don't keep digests for empty files
+			digests[source.NewLocation(f).Coordinates] = []Digest{}
+			continue
+		}
+
 		for _, hash := range hashes {
 			h := hash.New()
 			h.Write(b)
@@ -42,55 +50,43 @@ func testDigests(t testing.TB, files []string, hashes ...crypto.Hash) map[source
 	return digests
 }
 
-func TestDigestsCataloger_SimpleContents(t *testing.T) {
-	regularFiles := []string{"test-fixtures/last/path.txt", "test-fixtures/another-path.txt", "test-fixtures/a-path.txt"}
+func TestDigestsCataloger(t *testing.T) {
 
 	tests := []struct {
-		name       string
-		digests    []crypto.Hash
-		files      []string
-		expected   map[source.Coordinates][]Digest
-		catalogErr bool
+		name     string
+		digests  []crypto.Hash
+		files    []string
+		expected map[source.Coordinates][]Digest
 	}{
 		{
 			name:     "md5",
 			digests:  []crypto.Hash{crypto.MD5},
-			files:    regularFiles,
-			expected: testDigests(t, regularFiles, crypto.MD5),
+			files:    []string{"test-fixtures/last/empty/empty", "test-fixtures/last/path.txt"},
+			expected: testDigests(t, "test-fixtures/last", []string{"empty/empty", "path.txt"}, crypto.MD5),
 		},
 		{
 			name:     "md5-sha1-sha256",
 			digests:  []crypto.Hash{crypto.MD5, crypto.SHA1, crypto.SHA256},
-			files:    regularFiles,
-			expected: testDigests(t, regularFiles, crypto.MD5, crypto.SHA1, crypto.SHA256),
-		},
-		{
-			name:       "directory returns error",
-			digests:    []crypto.Hash{crypto.MD5},
-			files:      []string{"test-fixtures/last"},
-			catalogErr: true,
+			files:    []string{"test-fixtures/last/empty/empty", "test-fixtures/last/path.txt"},
+			expected: testDigests(t, "test-fixtures/last", []string{"empty/empty", "path.txt"}, crypto.MD5, crypto.SHA1, crypto.SHA256),
 		},
 	}
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			c, err := NewDigestsCataloger(test.digests)
-			if err != nil {
-				t.Fatalf("could not create cataloger: %+v", err)
-			}
+			require.NoError(t, err)
+
+			src, err := source.NewFromDirectory("test-fixtures/last/")
+			require.NoError(t, err)
+
+			resolver, err := src.FileResolver(source.SquashedScope)
+			require.NoError(t, err)
 
-			resolver := source.NewMockResolverForPaths(test.files...)
 			actual, err := c.Catalog(resolver)
-			if err != nil && !test.catalogErr {
-				t.Fatalf("could not catalog (but should have been able to): %+v", err)
-			} else if err == nil && test.catalogErr {
-				t.Fatalf("expected catalog error but did not get one")
-			} else if test.catalogErr && err != nil {
-				return
-			}
-
-			assert.Equal(t, actual, test.expected, "mismatched digests")
+			require.NoError(t, err)
 
+			assert.Equal(t, test.expected, actual, "mismatched digests")
 		})
 	}
 }

syft/file/metadata_cataloger_test.go

@@ -66,7 +66,7 @@ func TestFileMetadataCataloger(t *testing.T) {
 				LinkDestination: "file-1.txt",
 				UserID:          1,
 				GroupID:         2,
-				MIMEType:        "text/plain",
+				MIMEType:        "",
 			},
 		},
 		{
@@ -78,7 +78,7 @@ func TestFileMetadataCataloger(t *testing.T) {
 				LinkDestination: "file-1.txt",
 				UserID:          0,
 				GroupID:         0,
-				MIMEType:        "text/plain",
+				MIMEType:        "",
 			},
 		},
 		{
@@ -89,7 +89,7 @@ func TestFileMetadataCataloger(t *testing.T) {
 				Type:     "CharacterDevice",
 				UserID:   0,
 				GroupID:  0,
-				MIMEType: "text/plain",
+				MIMEType: "",
 			},
 		},
 		{
@@ -100,7 +100,7 @@ func TestFileMetadataCataloger(t *testing.T) {
 				Type:     "BlockDevice",
 				UserID:   0,
 				GroupID:  0,
-				MIMEType: "text/plain",
+				MIMEType: "",
 			},
 		},
 		{
@@ -111,7 +111,7 @@ func TestFileMetadataCataloger(t *testing.T) {
 				Type:     "FIFONode",
 				UserID:   0,
 				GroupID:  0,
-				MIMEType: "text/plain",
+				MIMEType: "",
 			},
 		},
 		{
@@ -122,7 +122,7 @@ func TestFileMetadataCataloger(t *testing.T) {
 				Type:     "Directory",
 				UserID:   0,
 				GroupID:  0,
-				MIMEType: "text/plain",
+				MIMEType: "",
 			},
 		},
 	}

syft/file/secrets_cataloger.go

@@ -42,10 +42,7 @@ func NewSecretsCataloger(patterns map[string]*regexp.Regexp, revealValues bool,
 
 func (i *SecretsCataloger) Catalog(resolver source.FileResolver) (map[source.Coordinates][]SearchResult, error) {
 	results := make(map[source.Coordinates][]SearchResult)
-	var locations []source.Location
-	for location := range resolver.AllLocations() {
-		locations = append(locations, location)
-	}
+	locations := allRegularFiles(resolver)
 	stage, prog, secretsDiscovered := secretsCatalogingProgress(int64(len(locations)))
 	for _, location := range locations {
 		stage.Current = location.RealPath
@@ -75,6 +72,10 @@ func (i *SecretsCataloger) catalogLocation(resolver source.FileResolver, locatio
 		return nil, err
 	}
 
+	if metadata.Size == 0 {
+		return nil, nil
+	}
+
 	if i.skipFilesAboveSize > 0 && metadata.Size > i.skipFilesAboveSize {
 		return nil, nil
 	}
@@ -82,7 +83,7 @@ func (i *SecretsCataloger) catalogLocation(resolver source.FileResolver, locatio
 	// TODO: in the future we can swap out search strategies here
 	secrets, err := catalogLocationByLine(resolver, location, i.patterns)
 	if err != nil {
-		return nil, internal.ErrPath{Path: location.RealPath, Err: err}
+		return nil, internal.ErrPath{Context: "secrets-cataloger", Path: location.RealPath, Err: err}
 	}
 
 	if i.revealValues {

syft/file/test-fixtures/classifiers/positive/[

@@ -0,0 +1,3 @@
+# note: this SHOULD match as busybox 3.33.3
+
+noise!BusyBox v3.33.3!noise

syft/file/test-fixtures/classifiers/positive/busybox

@@ -1,3 +0,0 @@
-# note: this SHOULD match as busybox 3.33.3
-
-noise!BusyBox v3.33.3!noise

syft/file/test-fixtures/classifiers/positive/busybox

@@ -0,0 +1 @@
+./[

syft/file/test-fixtures/image-busybox/Dockerfile

@@ -0,0 +1 @@
+FROM busybox:1.35

syft/file/test-fixtures/image-file-type-mix/Dockerfile

@@ -9,3 +9,5 @@ RUN ln file-1.txt hardlink-1
 RUN mknod char-device-1 c 89 1
 RUN mknod block-device-1 b 0 1
 RUN mknod fifo-1 p
+RUN mkdir /dir
+RUN rm -rf home etc/group etc/localtime etc/mtab etc/network etc/passwd etc/shadow var usr bin/*

syft/file/test-fixtures/symlinked-root/nested/link-root

@@ -0,0 +1 @@
+../real-root

syft/file/test-fixtures/symlinked-root/real-root/file1.txt

@@ -0,0 +1 @@
+contents!

syft/file/test-fixtures/symlinked-root/real-root/nested/file2.txt

@@ -0,0 +1 @@
+more contents!

syft/file/test-fixtures/symlinked-root/real-root/nested/linked-file1.txt

@@ -0,0 +1 @@
+../file1.txt

syft/pkg/cargo_metadata.go

@@ -1,14 +1,12 @@
-package rust
-
-import "github.com/anchore/syft/syft/pkg"
+package pkg
 
 type CargoMetadata struct {
-	Packages []pkg.CargoPackageMetadata `toml:"package"`
+	Packages []CargoPackageMetadata `toml:"package"`
 }
 
 // Pkgs returns all of the packages referenced within the Cargo.lock metadata.
-func (m CargoMetadata) Pkgs() []*pkg.Package {
-	pkgs := make([]*pkg.Package, 0)
+func (m CargoMetadata) Pkgs() []*Package {
+	pkgs := make([]*Package, 0)
 
 	for _, p := range m.Packages {
 		if p.Dependencies == nil {

syft/pkg/cataloger/common/cpe/candidate_by_package_type.go

@@ -45,7 +45,13 @@ var defaultCandidateAdditions = buildCandidateLookup(
 			candidateKey{PkgName: "apache-cassandra"}, // , Vendor: "apache"},
 			candidateAddition{AdditionalProducts: []string{"cassandra"}},
 		},
-
+		{
+			// example image: cloudbees/cloudbees-core-mm:2.319.3.4
+			// this is a wrapped packaging of the handlebars.js node module
+			pkg.JavaPkg,
+			candidateKey{PkgName: "handlebars"},
+			candidateAddition{AdditionalVendors: []string{"handlebarsjs"}},
+		},
 		// NPM packages
 		{
 			pkg.NpmPkg,

syft/pkg/cataloger/common/cpe/generate.go

@@ -12,14 +12,17 @@ import (
 	"github.com/facebookincubator/nvdtools/wfn"
 )
 
-func newCPE(product, vendor, version, targetSW string) wfn.Attributes {
+func newCPE(product, vendor, version, targetSW string) *wfn.Attributes {
 	cpe := *(wfn.NewAttributesWithAny())
 	cpe.Part = "a"
 	cpe.Product = product
 	cpe.Vendor = vendor
 	cpe.Version = version
 	cpe.TargetSW = targetSW
-	return cpe
+	if pkg.ValidateCPEString(pkg.CPEString(cpe)) != nil {
+		return nil
+	}
+	return &cpe
 }
 
 // Generate Create a list of CPEs for a given package, trying to guess the vendor, product tuple. We should be trying to
@@ -43,7 +46,9 @@ func Generate(p pkg.Package) []pkg.CPE {
 			}
 			keys.Add(key)
 			// add a new entry...
-			cpes = append(cpes, newCPE(product, vendor, p.Version, wfn.Any))
+			if cpe := newCPE(product, vendor, p.Version, wfn.Any); cpe != nil {
+				cpes = append(cpes, *cpe)
+			}
 		}
 	}
 

syft/pkg/cataloger/common/cpe/generate_test.go

@@ -545,6 +545,113 @@ func TestGeneratePackageCPEs(t *testing.T) {
 			},
 			expected: []string{},
 		},
+		{
+			name: "regression: handlebars within java archive",
+			p: pkg.Package{
+				Name:         "handlebars",
+				Version:      "3.0.8",
+				Type:         pkg.JavaPkg,
+				Language:     pkg.Java,
+				FoundBy:      "java-cataloger",
+				MetadataType: pkg.JavaMetadataType,
+				Metadata: pkg.JavaMetadata{
+					Manifest: &pkg.JavaManifest{
+						Main: map[string]string{
+							"Extension-Name":         "handlebars",
+							"Group-Id":               "org.jenkins-ci.ui",
+							"Hudson-Version":         "2.204",
+							"Implementation-Title":   "handlebars",
+							"Implementation-Version": "3.0.8",
+							"Plugin-Version":         "3.0.8",
+							"Short-Name":             "handlebars",
+						},
+					},
+					PomProperties: &pkg.PomProperties{
+						GroupID:    "org.jenkins-ci.ui",
+						ArtifactID: "handlebars",
+						Version:    "3.0.8",
+					},
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:handlebars:handlebars:3.0.8:*:*:*:*:*:*:*",
+				"cpe:2.3:a:handlebarsjs:handlebars:3.0.8:*:*:*:*:*:*:*", // important!
+				"cpe:2.3:a:jenkins-ci:handlebars:3.0.8:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jenkins:handlebars:3.0.8:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jenkins_ci:handlebars:3.0.8:*:*:*:*:*:*:*",
+				"cpe:2.3:a:ui:handlebars:3.0.8:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "regression: jenkins plugin active-directory",
+			p: pkg.Package{
+				Name:         "active-directory",
+				Version:      "2.25.1",
+				Type:         pkg.JenkinsPluginPkg,
+				FoundBy:      "java-cataloger",
+				Language:     pkg.Java,
+				MetadataType: pkg.JavaMetadataType,
+				Metadata: pkg.JavaMetadata{
+					Manifest: &pkg.JavaManifest{
+						Main: map[string]string{
+							"Extension-Name": "active-directory",
+							"Group-Id":       "org.jenkins-ci.plugins",
+						},
+					},
+					PomProperties: &pkg.PomProperties{
+						GroupID:    "org.jenkins-ci.plugins",
+						ArtifactID: "org.jenkins-ci.plugins",
+						Version:    "2.25.1",
+					},
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:active-directory:active-directory:2.25.1:*:*:*:*:*:*:*",
+				"cpe:2.3:a:active-directory:active_directory:2.25.1:*:*:*:*:*:*:*",
+				"cpe:2.3:a:active:active-directory:2.25.1:*:*:*:*:*:*:*",
+				"cpe:2.3:a:active:active_directory:2.25.1:*:*:*:*:*:*:*",
+				"cpe:2.3:a:active_directory:active-directory:2.25.1:*:*:*:*:*:*:*",
+				"cpe:2.3:a:active_directory:active_directory:2.25.1:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jenkins-ci:active-directory:2.25.1:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jenkins-ci:active_directory:2.25.1:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jenkins:active-directory:2.25.1:*:*:*:*:*:*:*", // important!
+				"cpe:2.3:a:jenkins:active_directory:2.25.1:*:*:*:*:*:*:*", // important!
+				"cpe:2.3:a:jenkins_ci:active-directory:2.25.1:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jenkins_ci:active_directory:2.25.1:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "regression: special characters in CPE should result in no generation",
+			p: pkg.Package{
+				Name:         "bundler",
+				Version:      "2.1.4",
+				Type:         pkg.GemPkg,
+				FoundBy:      "gem-cataloger",
+				Language:     pkg.Ruby,
+				MetadataType: pkg.GemMetadataType,
+				Metadata: pkg.GemMetadata{
+					Name:    "bundler",
+					Version: "2.1.4",
+					Authors: []string{
+						"jessica lynn suttles",
+						"stephanie morillo",
+						"david rodríguez",
+						"andré medeiros",
+					},
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:*:bundler:2.1.4:*:*:*:*:*:*:*",
+				"cpe:2.3:a:bundler:bundler:2.1.4:*:*:*:*:*:*:*",
+				"cpe:2.3:a:ruby-lang:bundler:2.1.4:*:*:*:*:*:*:*",
+				"cpe:2.3:a:ruby:bundler:2.1.4:*:*:*:*:*:*:*",
+				"cpe:2.3:a:ruby_lang:bundler:2.1.4:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jessica-lynn-suttles:bundler:2.1.4:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jessica_lynn_suttles:bundler:2.1.4:*:*:*:*:*:*:*",
+				"cpe:2.3:a:stephanie-morillo:bundler:2.1.4:*:*:*:*:*:*:*",
+				"cpe:2.3:a:stephanie_morillo:bundler:2.1.4:*:*:*:*:*:*:*",
+			},
+		},
 	}
 
 	for _, test := range tests {

syft/pkg/cataloger/deb/cataloger.go

@@ -53,7 +53,8 @@ func (c *Cataloger) Catalog(resolver source.FileResolver) ([]pkg.Package, []arti
 		pkgs, err := parseDpkgStatus(dbContents)
 		internal.CloseAndLogError(dbContents, dbLocation.VirtualPath)
 		if err != nil {
-			return nil, nil, fmt.Errorf("unable to catalog dpkg package=%+v: %w", dbLocation.RealPath, err)
+			log.Warnf("dpkg cataloger: unable to catalog package=%+v: %w", dbLocation.RealPath, err)
+			continue
 		}
 
 		for i := range pkgs {

syft/pkg/cataloger/deb/cataloger_test.go

@@ -12,7 +12,6 @@ import (
 )
 
 func TestDpkgCataloger(t *testing.T) {
-
 	tests := []struct {
 		name     string
 		sources  map[string][]string

syft/pkg/cataloger/deb/parse_dpkg_status.go

@@ -6,12 +6,12 @@ import (
 	"fmt"
 	"io"
 	"regexp"
-	"strconv"
 	"strings"
 
 	"github.com/anchore/syft/internal"
-
+	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/pkg"
+	"github.com/dustin/go-humanize"
 	"github.com/mitchellh/mapstructure"
 )
 
@@ -133,7 +133,8 @@ func extractAllFields(reader *bufio.Reader) (map[string]interface{}, error) {
 			var val interface{}
 			key, val, err = handleNewKeyValue(line)
 			if err != nil {
-				return nil, err
+				log.Warnf("parsing dpkg status: extracting key-value from line: %s err: %v", line, err)
+				continue
 			}
 
 			if _, ok := dpkgFields[key]; ok {
@@ -154,9 +155,9 @@ func extractSourceVersion(source string) (string, string) {
 }
 
 // handleNewKeyValue parse a new key-value pair from the given unprocessed line
-func handleNewKeyValue(line string) (string, interface{}, error) {
+func handleNewKeyValue(line string) (key string, val interface{}, err error) {
 	if i := strings.Index(line, ":"); i > 0 {
-		var key = strings.TrimSpace(line[0:i])
+		key = strings.TrimSpace(line[0:i])
 		// mapstruct cant handle "-"
 		key = strings.ReplaceAll(key, "-", "")
 		val := strings.TrimSpace(line[i+1:])
@@ -164,11 +165,11 @@ func handleNewKeyValue(line string) (string, interface{}, error) {
 		// further processing of values based on the key that was discovered
 		switch key {
 		case "InstalledSize":
-			numVal, err := strconv.Atoi(val)
+			s, err := humanize.ParseBytes(val)
 			if err != nil {
 				return "", nil, fmt.Errorf("bad installed-size value=%q: %w", val, err)
 			}
-			return key, numVal, nil
+			return key, int(s), nil
 		default:
 			return key, val, nil
 		}

syft/pkg/cataloger/deb/parse_dpkg_status_test.go

@@ -2,10 +2,15 @@ package deb
 
 import (
 	"bufio"
+	"errors"
+	"fmt"
 	"os"
+	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/anchore/syft/syft/file"
+	"github.com/stretchr/testify/assert"
 
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/go-test/deep"
@@ -20,11 +25,13 @@ func compareEntries(t *testing.T, left, right pkg.DpkgMetadata) {
 
 func TestSinglePackage(t *testing.T) {
 	tests := []struct {
-		name     string
-		expected pkg.DpkgMetadata
+		name        string
+		expected    pkg.DpkgMetadata
+		fixturePath string
 	}{
 		{
-			name: "Test Single Package",
+			name:        "Test Single Package",
+			fixturePath: filepath.Join("test-fixtures", "status", "single"),
 			expected: pkg.DpkgMetadata{
 				Package:       "apt",
 				Source:        "apt-dev",
@@ -68,11 +75,22 @@ func TestSinglePackage(t *testing.T) {
 				},
 			},
 		},
-	}
+		{
+			name:        "parse storage notation",
+			fixturePath: filepath.Join("test-fixtures", "status", "installed-size-4KB"),
+			expected: pkg.DpkgMetadata{
+				Package:       "apt",
+				Source:        "apt-dev",
+				Version:       "1.8.2",
+				Architecture:  "amd64",
+				InstalledSize: 4000,
+				Maintainer:    "APT Development Team <deity@lists.debian.org>",
+			},
+		}}
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			file, err := os.Open("test-fixtures/status/single")
+			file, err := os.Open(test.fixturePath)
 			if err != nil {
 				t.Fatal("Unable to read test_fixtures/single: ", err)
 			}
@@ -204,7 +222,6 @@ func TestMultiplePackages(t *testing.T) {
 }
 
 func TestSourceVersionExtract(t *testing.T) {
-
 	tests := []struct {
 		name     string
 		input    string
@@ -242,3 +259,135 @@ func TestSourceVersionExtract(t *testing.T) {
 		})
 	}
 }
+
+func assertAs(expected error) assert.ErrorAssertionFunc {
+	return func(t assert.TestingT, err error, i ...interface{}) bool {
+		return assert.ErrorAs(t, err, &expected)
+	}
+}
+
+func Test_parseDpkgStatus(t *testing.T) {
+	tests := []struct {
+		name    string
+		input   string
+		want    []pkg.Package
+		wantErr assert.ErrorAssertionFunc
+	}{
+		{
+			name:    "no more packages",
+			input:   `Package: apt`,
+			wantErr: assert.NoError,
+		},
+		{
+			name: "duplicated key",
+			input: `Package: apt
+Package: apt-get
+
+`,
+			wantErr: assertAs(errors.New("duplicate key discovered: Package")),
+		},
+		{
+			name: "no match for continuation",
+			input: `  Package: apt
+
+`,
+			wantErr: assertAs(errors.New("no match for continuation: line: '  Package: apt'")),
+		},
+		{
+			name: "find keys",
+			input: `Package: apt
+Status: install ok installed
+Installed-Size: 10kib
+
+`,
+			want: []pkg.Package{
+				{
+					Name:         "apt",
+					Type:         "deb",
+					MetadataType: "DpkgMetadata",
+					Metadata: pkg.DpkgMetadata{
+						Package:       "apt",
+						InstalledSize: 10240,
+						Files:         []pkg.DpkgFileRecord{},
+					},
+				},
+			},
+			wantErr: assert.NoError,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := bufio.NewReader(strings.NewReader(tt.input))
+			got, err := parseDpkgStatus(r)
+			tt.wantErr(t, err, fmt.Sprintf("parseDpkgStatus"))
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func Test_handleNewKeyValue(t *testing.T) {
+	tests := []struct {
+		name    string
+		line    string
+		wantKey string
+		wantVal interface{}
+		wantErr assert.ErrorAssertionFunc
+	}{
+		{
+			name:    "cannot parse field",
+			line:    "blabla",
+			wantErr: assertAs(errors.New("cannot parse field from line: 'blabla'")),
+		},
+		{
+			name:    "parse field",
+			line:    "key: val",
+			wantKey: "key",
+			wantVal: "val",
+			wantErr: assert.NoError,
+		},
+		{
+			name:    "parse installed size",
+			line:    "InstalledSize: 128",
+			wantKey: "InstalledSize",
+			wantVal: 128,
+			wantErr: assert.NoError,
+		},
+		{
+			name:    "parse installed kib size",
+			line:    "InstalledSize: 1kib",
+			wantKey: "InstalledSize",
+			wantVal: 1024,
+			wantErr: assert.NoError,
+		},
+		{
+			name:    "parse installed kb size",
+			line:    "InstalledSize: 1kb",
+			wantKey: "InstalledSize",
+			wantVal: 1000,
+			wantErr: assert.NoError,
+		},
+		{
+			name:    "parse installed-size mb",
+			line:    "Installed-Size: 1 mb",
+			wantKey: "InstalledSize",
+			wantVal: 1000000,
+			wantErr: assert.NoError,
+		},
+		{
+			name:    "fail parsing installed-size",
+			line:    "Installed-Size: 1bla",
+			wantKey: "",
+			wantErr: assertAs(fmt.Errorf("unhandled size name: %s", "bla")),
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotKey, gotVal, err := handleNewKeyValue(tt.line)
+			tt.wantErr(t, err, fmt.Sprintf("handleNewKeyValue(%v)", tt.line))
+
+			assert.Equalf(t, tt.wantKey, gotKey, "handleNewKeyValue(%v)", tt.line)
+			assert.Equalf(t, tt.wantVal, gotVal, "handleNewKeyValue(%v)", tt.line)
+		})
+	}
+}

syft/pkg/cataloger/deb/test-fixtures/status/installed-size-4KB

@@ -0,0 +1,31 @@
+Package: apt
+Status: install ok installed
+Priority: required
+Section: admin
+Installed-Size: 4KB
+Maintainer: APT Development Team <deity@lists.debian.org>
+Architecture: amd64
+Version: 1.8.2
+Source: apt-dev
+Replaces: apt-transport-https (<< 1.5~alpha4~), apt-utils (<< 1.3~exp2~)
+Provides: apt-transport-https (= 1.8.2)
+Depends: adduser, gpgv | gpgv2 | gpgv1, debian-archive-keyring, libapt-pkg5.0 (>= 1.7.0~alpha3~), libc6 (>= 2.15), libgcc1 (>= 1:3.0), libgnutls30 (>= 3.6.6), libseccomp2 (>= 1.0.1), libstdc++6 (>= 5.2)
+Recommends: ca-certificates
+Suggests: apt-doc, aptitude | synaptic | wajig, dpkg-dev (>= 1.17.2), gnupg | gnupg2 | gnupg1, powermgmt-base
+Breaks: apt-transport-https (<< 1.5~alpha4~), apt-utils (<< 1.3~exp2~), aptitude (<< 0.8.10)
+Conffiles:
+Description: commandline package manager
+ This package provides commandline tools for searching and
+ managing as well as querying information about packages
+ as a low-level access to all features of the libapt-pkg library.
+ .
+ These include:
+  * apt-get for retrieval of packages and information about them
+    from authenticated sources and for installation, upgrade and
+    removal of packages together with their dependencies
+  * apt-cache for querying available information about installed
+    as well as installable packages
+  * apt-cdrom to use removable media as a source for packages
+  * apt-config as an interface to the configuration settings
+  * apt-key as an interface to manage authentication keys
+

syft/pkg/cataloger/javascript/parse_yarn_lock.go

@@ -16,18 +16,15 @@ import (
 var _ common.ParserFn = parseYarnLock
 
 var (
-	// composedNameExp matches the "composed" variant of yarn.lock entry names,
-	// where the name appears in quotes and is prefixed with @<some-namespace>.
-	// For example: "@babel/code-frame@^7.0.0"
-	composedNameExp = regexp.MustCompile(`^"(@[^@]+)`)
-
-	// simpleNameExp matches the "simple" variant of yarn.lock entry names, for packages with no namespace prefix.
-	// For example: aws-sdk@2.706.0
-	simpleNameExp = regexp.MustCompile(`^(\w[\w-_.]*)@`)
+	// packageNameExp matches the name of the dependency in yarn.lock
+	// including scope/namespace prefix if found.
+	// For example: "aws-sdk@2.706.0" returns "aws-sdk"
+	//              "@babel/code-frame@^7.0.0" returns "@babel/code-frame"
+	packageNameExp = regexp.MustCompile(`^"?((?:@\w[\w-_.]*\/)?\w[\w-_.]*)@`)
 
 	// versionExp matches the "version" line of a yarn.lock entry and captures the version value.
 	// For example: version "4.10.1" (...and the value "4.10.1" is captured)
-	versionExp = regexp.MustCompile(`^\W+version\W+"([\w-_.]+)"`)
+	versionExp = regexp.MustCompile(`^\W+version(?:\W+"|:\W+)([\w-_.]+)"?`)
 )
 
 const (
@@ -87,11 +84,7 @@ func parseYarnLock(path string, reader io.Reader) ([]*pkg.Package, []artifact.Re
 }
 
 func findPackageName(line string) string {
-	if matches := composedNameExp.FindStringSubmatch(line); len(matches) >= 2 {
-		return matches[1]
-	}
-
-	if matches := simpleNameExp.FindStringSubmatch(line); len(matches) >= 2 {
+	if matches := packageNameExp.FindStringSubmatch(line); len(matches) >= 2 {
 		return matches[1]
 	}
 

syft/pkg/cataloger/javascript/parse_yarn_lock_test.go

@@ -5,6 +5,8 @@ import (
 	"testing"
 
 	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestParseYarnLock(t *testing.T) {
@@ -65,16 +67,182 @@ func TestParseYarnLock(t *testing.T) {
 		},
 	}
 
-	fixture, err := os.Open("test-fixtures/yarn/yarn.lock")
-	if err != nil {
-		t.Fatalf("failed to open fixture: %+v", err)
+	testFixtures := []string{
+		"test-fixtures/yarn/yarn.lock",
+		"test-fixtures/yarn-berry/yarn.lock",
 	}
 
-	// TODO: no relationships are under test yet
-	actual, _, err := parseYarnLock(fixture.Name(), fixture)
-	if err != nil {
-		t.Fatalf("failed to parse yarn.lock: %+v", err)
-	}
+	for _, file := range testFixtures {
+		file := file
+		t.Run(file, func(t *testing.T) {
+			t.Parallel()
 
-	assertPkgsEqual(t, actual, expected)
+			fixture, err := os.Open(file)
+			require.NoError(t, err)
+
+			// TODO: no relationships are under test yet
+			actual, _, err := parseYarnLock(fixture.Name(), fixture)
+			require.NoError(t, err)
+
+			assertPkgsEqual(t, actual, expected)
+		})
+	}
+}
+
+func TestParseYarnFindPackageNames(t *testing.T) {
+	tests := []struct {
+		line     string
+		expected string
+	}{
+		{
+			line:     `"@babel/code-frame@npm:7.10.4":`,
+			expected: "@babel/code-frame",
+		},
+		{
+			line:     `"@babel/code-frame@^7.0.0", "@babel/code-frame@^7.10.4":`,
+			expected: "@babel/code-frame",
+		},
+		{
+			line:     "ajv@^6.10.2, ajv@^6.5.5:",
+			expected: "ajv",
+		},
+		{
+			line:     "aws-sdk@2.706.0:",
+			expected: "aws-sdk",
+		},
+		{
+			line:     "asn1.js@^4.0.0:",
+			expected: "asn1.js",
+		},
+		{
+			line:     "c0n-fab_u.laTION@^7.0.0",
+			expected: "c0n-fab_u.laTION",
+		},
+		{
+			line:     `"newtest@workspace:.":`,
+			expected: "newtest",
+		},
+		{
+			line:     `"color-convert@npm:^1.9.0":`,
+			expected: "color-convert",
+		},
+		{
+			line:     `"@npmcorp/code-frame@^7.1.0", "@npmcorp/code-frame@^7.10.4":`,
+			expected: "@npmcorp/code-frame",
+		},
+		{
+			line:     `"@npmcorp/code-frame@^7.2.3":`,
+			expected: "@npmcorp/code-frame",
+		},
+		{
+			line:     `"@s/odd-name@^7.1.2":`,
+			expected: "@s/odd-name",
+		},
+		{
+			line:     `"@/code-frame@^7.3.4":`,
+			expected: "",
+		},
+		{
+			line:     `"code-frame":`,
+			expected: "",
+		},
+	}
+
+	for _, test := range tests {
+		test := test
+		t.Run(test.expected, func(t *testing.T) {
+			t.Parallel()
+			actual := findPackageName(test.line)
+			assert.Equal(t, test.expected, actual)
+		})
+	}
+}
+
+func TestParseYarnFindPackageVersions(t *testing.T) {
+	tests := []struct {
+		line     string
+		expected string
+	}{
+		{
+			line:     `  version "7.10.4"`,
+			expected: "7.10.4",
+		},
+		{
+			line:     ` version "7.11.5"`,
+			expected: "7.11.5",
+		},
+		{
+			line:     `version "7.12.6"`,
+			expected: "",
+		},
+		{
+			line:     `  version "0.0.0"`,
+			expected: "0.0.0",
+		},
+		{
+			line:     `  version "2" `,
+			expected: "2",
+		},
+		{
+			line:     `  version "9.3"`,
+			expected: "9.3",
+		},
+		{
+			line:     "ajv@^6.10.2, ajv@^6.5.5",
+			expected: "",
+		},
+		{
+			line:     "atob@^2.1.2:",
+			expected: "",
+		},
+		{
+			line:     `"color-convert@npm:^1.9.0":`,
+			expected: "",
+		},
+		{
+			line:     "  version: 1.9.3",
+			expected: "1.9.3",
+		},
+		{
+			line:     "  version: 2",
+			expected: "2",
+		},
+		{
+			line:     "  version: 9.3",
+			expected: "9.3",
+		},
+		{
+			line:     "ajv@^6.10.2, ajv@^6.5.5",
+			expected: "",
+		},
+		{
+			line:     "atob@^2.1.2:",
+			expected: "",
+		},
+		{
+			line:     "  version: 1.0.0-alpha+001",
+			expected: "1.0.0-alpha",
+		},
+		{
+			line:     "  version: 1.0.0-beta_test+exp.sha.5114f85",
+			expected: "1.0.0-beta_test",
+		},
+		{
+			line:     "  version: 1.0.0+21AF26D3-117B344092BD",
+			expected: "1.0.0",
+		},
+		{
+			line:     "  version: 0.0.0-use.local",
+			expected: "0.0.0-use.local",
+		},
+	}
+
+	for _, test := range tests {
+		test := test
+		t.Run(test.expected, func(t *testing.T) {
+			t.Parallel()
+			actual := findPackageVersion(test.line)
+			assert.Equal(t, test.expected, actual)
+		})
+	}
 }

syft/pkg/cataloger/javascript/test-fixtures/yarn-berry/yarn.lock

@@ -0,0 +1,110 @@
+# This file is generated by running "yarn install" inside your project.
+# Manual changes might be lost - proceed with caution!
+
+__metadata:
+  version: 6
+  cacheKey: 8
+
+"@babel/code-frame@npm:7.10.4":
+  version: 7.10.4
+  resolution: "@babel/code-frame@npm:7.10.4"
+  dependencies:
+    "@babel/highlight": ^7.10.4
+  checksum: feb4543c8a509fe30f0f6e8d7aa84f82b41148b963b826cd330e34986f649a85cb63b2f13dd4effdf434ac555d16f14940b8ea5f4433297c2f5ff85486ded019
+  languageName: node
+  linkType: hard
+
+"@types/minimatch@npm:3.0.3":
+  version: 3.0.3
+  resolution: "@types/minimatch@npm:3.0.3"
+  checksum: b80259d55b96ef24cb3bb961b6dc18b943f2bb8838b4d8e7bead204f3173e551a416ffa49f9aaf1dc431277fffe36214118628eacf4aea20119df8835229901b
+  languageName: node
+  linkType: hard
+
+"@types/qs@npm:6.9.4":
+  version: 6.9.4
+  resolution: "@types/qs@npm:6.9.4"
+  checksum: 77e509ed213f7694ae35f84a58b88da8744aad019e93556af6aeab4289287abbe71836c051d00649dbac0289ea199e408442590cfb1785009de11c3c8d0cbbea
+  languageName: node
+  linkType: hard
+
+"@types/qs@npm:6.9.4":
+  version: 6.9.4
+  resolution: "@types/qs@npm:6.9.4"
+  checksum: 77e509ed213f7694ae35f84a58b88da8744aad019e93556af6aeab4289287abbe71836c051d00649dbac0289ea199e408442590cfb1785009de11c3c8d0cbbea
+  languageName: node
+  linkType: hard
+
+"ajv@npm:6.12.3":
+  version: 6.12.3
+  resolution: "ajv@npm:6.12.3"
+  dependencies:
+    fast-deep-equal: ^3.1.1
+    fast-json-stable-stringify: ^2.0.0
+    json-schema-traverse: ^0.4.1
+    uri-js: ^4.2.2
+  checksum: ca559d34710e6969d33bc1316282e1ece4d4d99ff5fdca4bfe31947740f8f90e7824238cdc2954e499cf75b2432e3e6c56b32814ebe04fccf8abcc3fbf36b348
+  languageName: node
+  linkType: hard
+
+"atob@npm:2.1.2":
+  version: 2.1.2
+  resolution: "atob@npm:2.1.2"
+  bin:
+    atob: bin/atob.js
+  checksum: dfeeeb70090c5ebea7be4b9f787f866686c645d9f39a0d184c817252d0cf08455ed25267d79c03254d3be1f03ac399992a792edcd5ffb9c91e097ab5ef42833a
+  languageName: node
+  linkType: hard
+
+"aws-sdk@npm:2.706.0":
+  version: 2.706.0
+  resolution: "aws-sdk@npm:2.706.0"
+  dependencies:
+    buffer: 4.9.2
+    events: 1.1.1
+    ieee754: 1.1.13
+    jmespath: 0.15.0
+    querystring: 0.2.0
+    sax: 1.2.1
+    url: 0.10.3
+    uuid: 3.3.2
+    xml2js: 0.4.19
+  checksum: bf8ca2fc4f758bdebd04051ec15729affad3eb0e18eed4ae41db5b7d6ff2aed2cf3a12ae082c11b955df0125378c57b8406e1f91006e48f0c162fdbe4ee4e330
+  languageName: node
+  linkType: hard
+
+"jhipster-core@npm:7.3.4":
+  version: 7.3.4
+  resolution: "jhipster-core@npm:7.3.4"
+  dependencies:
+    chevrotain: 7.0.1
+    fs-extra: 8.1.0
+    lodash: 4.17.15
+    winston: 3.2.1
+  checksum: 6a97741d574a42a138f98596c668370b41ec8870335bcd758b6b890e279ba30d4d2be447f8cecbf416286f2c53636b406a63a773c7b00709c95af0a9a3f9b397
+  languageName: node
+  linkType: hard
+
+"asn1.js@npm:4.10.1":
+  version: 4.10.1
+  resolution: "asn1.js@npm:4.10.1"
+  dependencies:
+    bn.js: ^4.0.0
+    inherits: ^2.0.1
+    minimalistic-assert: ^1.0.0
+  checksum: 9289a1a55401238755e3142511d7b8f6fc32f08c86ff68bd7100da8b6c186179dd6b14234fba2f7f6099afcd6758a816708485efe44bc5b2a6ec87d9ceeddbb5
+  languageName: node
+  linkType: hard
+
+"c0n-fab_u.laTION@workspace:.":
+  version: 7.7.7
+  resolution: "newtest@workspace:."
+  dependencies:
+    "@babel/code-frame": 7.10.4
+    "@types/minimatch": 3.0.3
+    "@types/qs": 6.9.4
+    ajv: 6.12.3
+    asn1.js: 4.10.1
+    atob: 2.1.2
+  languageName: unknown
+  linkType: soft

syft/pkg/cataloger/python/parse_pipfile_lock.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"sort"
 	"strings"
 
 	"github.com/anchore/syft/syft/artifact"
@@ -60,5 +61,10 @@ func parsePipfileLock(_ string, reader io.Reader) ([]*pkg.Package, []artifact.Re
 		}
 	}
 
+	// Without sorting the packages slice, the order of packages will be unstable, due to ranging over a map.
+	sort.Slice(packages, func(i, j int) bool {
+		return packages[i].String() < packages[j].String()
+	})
+
 	return packages, nil, nil
 }

syft/pkg/cataloger/python/parse_pipfile_lock_test.go

@@ -4,36 +4,39 @@ import (
 	"os"
 	"testing"
 
+	"github.com/google/go-cmp/cmp"
+
 	"github.com/anchore/syft/syft/pkg"
 )
 
 func TestParsePipFileLock(t *testing.T) {
-	expected := map[string]pkg.Package{
-		"aio-pika": {
+	expected := []*pkg.Package{
+		{
 			Name:     "aio-pika",
 			Version:  "6.8.0",
 			Language: pkg.Python,
 			Type:     pkg.PythonPkg,
 		},
-		"aiodns": {
+		{
 			Name:     "aiodns",
 			Version:  "2.0.0",
 			Language: pkg.Python,
 			Type:     pkg.PythonPkg,
 		},
-		"aiohttp": {
+		{
 			Name:     "aiohttp",
 			Version:  "3.7.4.post0",
 			Language: pkg.Python,
 			Type:     pkg.PythonPkg,
 		},
-		"aiohttp-jinja2": {
+		{
 			Name:     "aiohttp-jinja2",
 			Version:  "1.4.2",
 			Language: pkg.Python,
 			Type:     pkg.PythonPkg,
 		},
 	}
+
 	fixture, err := os.Open("test-fixtures/pipfile-lock/Pipfile.lock")
 	if err != nil {
 		t.Fatalf("failed to open fixture: %+v", err)
@@ -45,6 +48,7 @@ func TestParsePipFileLock(t *testing.T) {
 		t.Fatalf("failed to parse requirements: %+v", err)
 	}
 
-	assertPackagesEqual(t, actual, expected)
-
+	if diff := cmp.Diff(expected, actual, cmp.AllowUnexported(pkg.Package{})); diff != "" {
+		t.Errorf("unexpected result from parsing (-expected +actual)\n%s", diff)
+	}
 }

syft/pkg/cataloger/python/parse_requirements.go

@@ -22,37 +22,34 @@ func parseRequirementsTxt(_ string, reader io.Reader) ([]*pkg.Package, []artifac
 	scanner := bufio.NewScanner(reader)
 	for scanner.Scan() {
 		line := scanner.Text()
+		line = trimRequirementsTxtLine(line)
 
-		line = strings.TrimRight(line, "\n")
-
-		switch {
-		case strings.HasPrefix(line, "#"):
-			// commented out line, skip
-			continue
-		case strings.HasPrefix(line, "-e"):
-			// editable packages aren't parsed (yet)
-			continue
-		case len(strings.Split(line, "==")) < 2:
-			// a package without a version, or a range (unpinned) which
-			// does not tell us exactly what will be installed
-			// XXX only needed if we want to log this, otherwise the next case catches it
-			continue
-		case len(strings.Split(line, "==")) == 2:
-			// remove comments if present
-			uncommented := removeTrailingComment(line)
-			// parse a new requirement
-			parts := strings.Split(uncommented, "==")
-			name := strings.TrimSpace(parts[0])
-			version := strings.TrimSpace(parts[1])
-			packages = append(packages, &pkg.Package{
-				Name:     name,
-				Version:  version,
-				Language: pkg.Python,
-				Type:     pkg.PythonPkg,
-			})
-		default:
+		if line == "" {
+			// nothing to parse on this line
 			continue
 		}
+
+		if strings.HasPrefix(line, "-e") {
+			// editable packages aren't parsed (yet)
+			continue
+		}
+
+		if !strings.Contains(line, "==") {
+			// a package without a version, or a range (unpinned) which does not tell us
+			// exactly what will be installed.
+			continue
+		}
+
+		// parse a new requirement
+		parts := strings.Split(line, "==")
+		name := strings.TrimSpace(parts[0])
+		version := strings.TrimSpace(parts[1])
+		packages = append(packages, &pkg.Package{
+			Name:     name,
+			Version:  version,
+			Language: pkg.Python,
+			Type:     pkg.PythonPkg,
+		})
 	}
 
 	if err := scanner.Err(); err != nil {
@@ -62,16 +59,37 @@ func parseRequirementsTxt(_ string, reader io.Reader) ([]*pkg.Package, []artifac
 	return packages, nil, nil
 }
 
+// trimRequirementsTxtLine removes content from the given requirements.txt line
+// that should not be considered for parsing.
+func trimRequirementsTxtLine(line string) string {
+	line = strings.TrimSpace(line)
+	line = removeTrailingComment(line)
+	line = removeEnvironmentMarkers(line)
+
+	return line
+}
+
 // removeTrailingComment takes a requirements.txt line and strips off comment strings.
 func removeTrailingComment(line string) string {
-	parts := strings.Split(line, "#")
-	switch len(parts) {
-	case 1:
+	parts := strings.SplitN(line, "#", 2)
+	if len(parts) < 2 {
 		// there aren't any comments
+
 		return line
-	default:
-		// any number of "#" means we only want the first part, assuming this
-		// isn't prefixed with "#" (up to the caller)
-		return parts[0]
 	}
+
+	return parts[0]
+}
+
+// removeEnvironmentMarkers removes any instances of environment markers (delimited by ';') from the line.
+// For more information, see https://www.python.org/dev/peps/pep-0508/#environment-markers.
+func removeEnvironmentMarkers(line string) string {
+	parts := strings.SplitN(line, ";", 2)
+	if len(parts) < 2 {
+		// there aren't any environment markers
+
+		return line
+	}
+
+	return parts[0]
 }

syft/pkg/cataloger/python/parse_requirements_test.go

@@ -4,47 +4,33 @@ import (
 	"os"
 	"testing"
 
-	"github.com/stretchr/testify/assert"
-
-	"github.com/go-test/deep"
+	"github.com/google/go-cmp/cmp"
 
 	"github.com/anchore/syft/syft/pkg"
 )
 
-func assertPackagesEqual(t *testing.T, actual []*pkg.Package, expected map[string]pkg.Package) {
-	t.Helper()
-	if len(actual) != len(expected) {
-		for _, a := range actual {
-			t.Log("   ", a)
-		}
-		t.Fatalf("unexpected package count: %d!=%d", len(actual), len(expected))
-	}
-
-	for _, a := range actual {
-		expectedPkg, ok := expected[a.Name]
-		assert.True(t, ok)
-
-		for _, d := range deep.Equal(a, &expectedPkg) {
-			t.Errorf("diff: %+v", d)
-		}
-	}
-}
-
 func TestParseRequirementsTxt(t *testing.T) {
-	expected := map[string]pkg.Package{
-		"foo": {
-			Name:     "foo",
-			Version:  "1.0.0",
-			Language: pkg.Python,
-			Type:     pkg.PythonPkg,
-		},
-		"flask": {
+	expected := []*pkg.Package{
+		{
 			Name:     "flask",
 			Version:  "4.0.0",
 			Language: pkg.Python,
 			Type:     pkg.PythonPkg,
 		},
+		{
+			Name:     "foo",
+			Version:  "1.0.0",
+			Language: pkg.Python,
+			Type:     pkg.PythonPkg,
+		},
+		{
+			Name:     "SomeProject",
+			Version:  "5.4",
+			Language: pkg.Python,
+			Type:     pkg.PythonPkg,
+		},
 	}
+
 	fixture, err := os.Open("test-fixtures/requires/requirements.txt")
 	if err != nil {
 		t.Fatalf("failed to open fixture: %+v", err)
@@ -56,6 +42,7 @@ func TestParseRequirementsTxt(t *testing.T) {
 		t.Fatalf("failed to parse requirements: %+v", err)
 	}
 
-	assertPackagesEqual(t, actual, expected)
-
+	if diff := cmp.Diff(expected, actual, cmp.AllowUnexported(pkg.Package{})); diff != "" {
+		t.Errorf("unexpected result from parsing (-expected +actual)\n%s", diff)
+	}
 }

syft/pkg/cataloger/python/parse_setup_test.go

@@ -4,52 +4,57 @@ import (
 	"os"
 	"testing"
 
+	"github.com/google/go-cmp/cmp"
+
 	"github.com/anchore/syft/syft/pkg"
 )
 
 func TestParseSetup(t *testing.T) {
-	expected := map[string]pkg.Package{
-		"pathlib3": {
+	expected := []*pkg.Package{
+		{
 			Name:     "pathlib3",
 			Version:  "2.2.0",
 			Language: pkg.Python,
 			Type:     pkg.PythonPkg,
 		},
-		"mypy": {
+		{
 			Name:     "mypy",
 			Version:  "v0.770",
 			Language: pkg.Python,
 			Type:     pkg.PythonPkg,
 		},
-		"mypy1": {
+		{
 			Name:     "mypy1",
 			Version:  "v0.770",
 			Language: pkg.Python,
 			Type:     pkg.PythonPkg,
 		},
-		"mypy2": {
+		{
 			Name:     "mypy2",
 			Version:  "v0.770",
 			Language: pkg.Python,
 			Type:     pkg.PythonPkg,
 		},
-		"mypy3": {
+		{
 			Name:     "mypy3",
 			Version:  "v0.770",
 			Language: pkg.Python,
 			Type:     pkg.PythonPkg,
 		},
 	}
+
 	fixture, err := os.Open("test-fixtures/setup/setup.py")
 	if err != nil {
 		t.Fatalf("failed to open fixture: %+v", err)
 	}
 
+	// TODO: no relationships are under test yet
 	actual, _, err := parseSetup(fixture.Name(), fixture)
 	if err != nil {
 		t.Fatalf("failed to parse requirements: %+v", err)
 	}
 
-	assertPackagesEqual(t, actual, expected)
-
+	if diff := cmp.Diff(expected, actual, cmp.AllowUnexported(pkg.Package{})); diff != "" {
+		t.Errorf("unexpected result from parsing (-expected +actual)\n%s", diff)
+	}
 }

syft/pkg/cataloger/python/test-fixtures/requires/requirements.txt

@@ -4,4 +4,9 @@ sqlalchemy >= 1.0.0
  foo == 1.0.0 # a comment that needs to be ignored
 -e https://github.com/pecan/pecan.git
 -r other-requirements.txt
---requirements super-secretrequirements.txt
+--requirements super-secretrequirements.txt
+SomeProject ==5.4 ; python_version < '3.8'
+coverage != 3.5 # Version Exclusion. Anything except version 3.5
+numpyNew; sys_platform == 'win32'
+numpy >= 3.4.1; sys_platform == 'win32'
+Mopidy-Dirble ~= 1.1 # Compatible release. Same as >= 1.1, == 1.*

syft/pkg/cataloger/rust/parse_cargo_lock.go

@@ -20,7 +20,7 @@ func parseCargoLock(_ string, reader io.Reader) ([]*pkg.Package, []artifact.Rela
 		return nil, nil, fmt.Errorf("unable to load Cargo.lock for parsing: %v", err)
 	}
 
-	metadata := CargoMetadata{}
+	metadata := pkg.CargoMetadata{}
 	err = tree.Unmarshal(&metadata)
 	if err != nil {
 		return nil, nil, fmt.Errorf("unable to parse Cargo.lock: %v", err)