Experimental GitHub export (#836)

* move v1.3.1 => v1.4.1
* go mod tidy

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

.github/workflows/codeql-analysis.yml

@@ -7,10 +7,10 @@ name: "CodeQL Security Scan"
 
 on:
   push:
-    branches: [main]
-  pull_request:
-    # The branches below must be a subset of the branches above
-    branches: [main]
+    branches:
+      # only run when there are pushes to the main branch (not on PRs)
+      - main
+
   schedule:
     - cron: '0 0 * * 3'
 

.github/workflows/validations.yaml

@@ -2,6 +2,8 @@ name: "Validations"
 on:
   workflow_dispatch:
   push:
+    branches:
+      - main
   pull_request:
 
 env:

.gitignore

@@ -19,7 +19,6 @@ CHANGELOG.md
 .tmp/
 coverage.txt
 bin/
-.goreleaser.yaml
 
 # Binaries for programs and plugins
 *.exe

.goreleaser.yaml

@@ -1,11 +1,10 @@
-dist: snapshot
+release:
+  prerelease: auto
+  draft: true
 
 env:
   # required to support multi architecture docker builds
   - DOCKER_CLI_EXPERIMENTAL=enabled
-release:
-  prerelease: auto
-  draft: true
 
 before:
   hooks:
@@ -94,3 +93,41 @@ brews:
     description: *description
     license: "Apache License 2.0"
 
+dockers:
+  - image_templates:
+      - "anchore/syft:latest"
+      - "anchore/syft:{{ .Tag }}-amd64"
+      - "anchore/syft:v{{ .Major }}-amd64"
+      - "anchore/syft:v{{ .Major }}.{{ .Minor }}-amd64"
+    dockerfile: Dockerfile
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/amd64"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - "anchore/syft:{{ .Tag }}-arm64v8"
+      - "anchore/syft:v{{ .Major }}-arm64v8"
+      - "anchore/syft:v{{ .Major }}.{{ .Minor }}-arm64v8"
+    goarch: arm64
+    dockerfile: Dockerfile
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/arm64/v8"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+docker_manifests:
+  - name_template: anchore/syft:{{ .Tag }}
+    image_templates:
+      - anchore/syft:v{{ .Major }}.{{ .Minor }}-amd64
+      - anchore/syft:v{{ .Major }}.{{ .Minor }}-arm64v8
+  - name_template: anchore/syft:latest
+    image_templates:
+      - anchore/syft:v{{ .Major }}.{{ .Minor }}-amd64
+      - anchore/syft:v{{ .Major }}.{{ .Minor }}-arm64v8

.goreleaser/Makefile

@@ -1,24 +0,0 @@
-TARGET=../goreleaser.yaml
-
-.PHONY: snapshot-config
-snapshot-config:
-	cat snapshot.yaml > $(TARGET)
-	cat env-skip-signing.yaml >> $(TARGET)
-	cat main.yaml >> $(TARGET)
-	cat docker.yaml >> $(TARGET)
-	cat $(TARGET)
-
-.PHONY: snapshot-with-signing-config
-snapshot-with-signing-config:
-	# we leave out docker entirely such that this can easily be tested in CI
-	cat snapshot.yaml > $(TARGET)
-	cat env-default.yaml >> $(TARGET)
-	cat main.yaml >> $(TARGET)
-	cat $(TARGET)
-
-.PHONY: release-config
-release-config:
-	cat env-default.yaml > $(TARGET)
-	cat docker.yaml >> $(TARGET)
-	cat main.yaml >> $(TARGET)
-	cat $(TARGET)

.goreleaser/docker.yaml

@@ -1,39 +0,0 @@
-
-dockers:
-  - image_templates:
-      - "anchore/syft:latest"
-      - "anchore/syft:{{ .Tag }}-amd64"
-      - "anchore/syft:v{{ .Major }}-amd64"
-      - "anchore/syft:v{{ .Major }}.{{ .Minor }}-amd64"
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/amd64"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - "anchore/syft:{{ .Tag }}-arm64v8"
-      - "anchore/syft:v{{ .Major }}-arm64v8"
-      - "anchore/syft:v{{ .Major }}.{{ .Minor }}-arm64v8"
-    goarch: arm64
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/arm64/v8"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-docker_manifests:
-  - name_template: anchore/syft:{{ .Tag }}
-    image_templates:
-      - anchore/syft:v{{ .Major }}.{{ .Minor }}-amd64
-      - anchore/syft:v{{ .Major }}.{{ .Minor }}-arm64v8
-  - name_template: anchore/syft:latest
-    image_templates:
-      - anchore/syft:v{{ .Major }}.{{ .Minor }}-amd64
-      - anchore/syft:v{{ .Major }}.{{ .Minor }}-arm64v8

.goreleaser/env-default.yaml

@@ -1,4 +0,0 @@
-
-env:
-  # required to support multi architecture docker builds
-  - DOCKER_CLI_EXPERIMENTAL=enabled

.goreleaser/env-skip-signing.yaml

@@ -1,5 +0,0 @@
-
-env:
-  # required to support multi architecture docker builds
-  - DOCKER_CLI_EXPERIMENTAL=enabled
-  - SKIP_SIGNING=true

.goreleaser/main.yaml

@@ -1,91 +0,0 @@
-release:
-  prerelease: auto
-  draft: true
-
-before:
-  hooks:
-    - ./.github/scripts/apple-signing/setup.sh {{ .IsSnapshot }}
-
-builds:
-  - id: linux-build
-    binary: syft
-    goos:
-      - linux
-    goarch:
-      - amd64
-      - arm64
-    # set the modified timestamp on the output binary to the git timestamp to ensure a reproducible build
-    mod_timestamp: &build-timestamp '{{ .CommitTimestamp }}'
-    env: &build-env
-      - CGO_ENABLED=0
-    ldflags: &build-ldflags |
-      -w
-      -s
-      -extldflags '-static'
-      -X github.com/anchore/syft/internal/version.version={{.Version}}
-      -X github.com/anchore/syft/internal/version.gitCommit={{.Commit}}
-      -X github.com/anchore/syft/internal/version.buildDate={{.Date}}
-      -X github.com/anchore/syft/internal/version.gitDescription={{.Summary}}
-
-  - id: darwin-build
-    binary: syft
-    goos:
-      - darwin
-    goarch:
-      - amd64
-      - arm64
-    mod_timestamp: *build-timestamp
-    env: *build-env
-    ldflags: *build-ldflags
-    hooks:
-      post:
-        # we must have signing as a build hook instead of the signs section. The signs section must register a new
-        # asset, where we want to replace an existing asset. A post-build hook has the advantage of not needing to
-        # unpackage and repackage a tar.gz with a signed binary
-        - ./.github/scripts/apple-signing/sign.sh "{{ .Path }}" "{{ .IsSnapshot }}" "{{ .Target }}"
-
-  - id: windows-build
-    binary: syft
-    goos:
-      - windows
-    goarch:
-      - amd64
-    mod_timestamp: *build-timestamp
-    env: *build-env
-    ldflags: *build-ldflags
-
-archives:
-  - id: linux-archives
-    builds:
-      - linux-build
-
-  # note: the signing process is depending on tar.gz archives. If this format changes then .github/scripts/apple-signing/*.sh will need to be adjusted
-  - id: darwin-archives
-    builds:
-      - darwin-build
-
-  - id: windows-archives
-    format: zip
-    builds:
-      - windows-build
-
-nfpms:
-  - license: "Apache 2.0"
-    maintainer: "Anchore, Inc"
-    homepage: &website "https://github.com/anchore/syft"
-    description: &description "A tool that generates a Software Bill Of Materials (SBOM) from container images and filesystems"
-    formats:
-      - rpm
-      - deb
-
-brews:
-  - tap:
-      owner: anchore
-      name: homebrew-syft
-    ids:
-      - darwin-archives
-      - linux-archives
-    homepage: *website
-    description: *description
-    license: "Apache License 2.0"
-

.goreleaser/snapshot.yaml

@@ -1 +0,0 @@
-dist: snapshot

Makefile

@@ -25,7 +25,7 @@ COVERAGE_THRESHOLD := 62
 
 # CI cache busting values; change these if you want CI to not use previous stored cache
 INTEGRATION_CACHE_BUSTER="894d8ca"
-CLI_CACHE_BUSTER="894d8ca"
+CLI_CACHE_BUSTER="e5cdfd8"
 BOOTSTRAP_CACHE="c7afb99ad"
 
 ## Build variables
@@ -234,24 +234,25 @@ build: $(SNAPSHOTDIR) ## Build release snapshot binaries and packages
 $(SNAPSHOTDIR): ## Build snapshot release binaries and packages
 	$(call title,Building snapshot artifacts)
 
-	cd .goreleaser && make snapshot-config
+	# create a config with the dist dir overridden
+	echo "dist: $(SNAPSHOTDIR)" > $(TEMPDIR)/goreleaser.yaml
+	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml
 
 	# build release snapshots
-	bash -c "$(SNAPSHOT_CMD) --skip-sign"
+	bash -c "SKIP_SIGNING=true $(SNAPSHOT_CMD) --skip-sign --config $(TEMPDIR)/goreleaser.yaml"
 
 .PHONY: snapshot-with-signing
 snapshot-with-signing: ## Build snapshot release binaries and packages (with dummy signing)
 	$(call title,Building snapshot artifacts (+ signing))
 
-	cd .goreleaser && make snapshot-with-signing-config
+	# create a config with the dist dir overridden
+	echo "dist: $(SNAPSHOTDIR)" > $(TEMPDIR)/goreleaser.yaml
+	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml
 
 	rm -f .github/scripts/apple-signing/log/*.txt
 
-	# remove the keychain with the trusted self-signed cert automatically (from failed previous runs)
-	.github/scripts/apple-signing/cleanup.sh
-
 	# build release snapshots
-	bash -c "$(SNAPSHOT_CMD) || (cat .github/scripts/apple-signing/log/*.txt && false)"
+	bash -c "$(SNAPSHOT_CMD) --config $(TEMPDIR)/goreleaser.yaml || (cat .github/scripts/apple-signing/log/*.txt && false)"
 
 	# remove the keychain with the trusted self-signed cert automatically
 	.github/scripts/apple-signing/cleanup.sh
@@ -315,13 +316,16 @@ CHANGELOG.md:
 release: clean-dist CHANGELOG.md  ## Build and publish final binaries and packages. Intended to be run only on macOS.
 	$(call title,Publishing release artifacts)
 
-	cd .goreleaser && make release-config
+	# create a config with the dist dir overridden
+	echo "dist: $(DISTDIR)" > $(TEMPDIR)/goreleaser.yaml
+	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml
 
 	rm -f .github/scripts/apple-signing/log/*.txt
 
 	# note: notarization cannot be done in parallel, thus --parallelism 1
 	bash -c "\
 		$(RELEASE_CMD) \
+			--config $(TEMPDIR)/goreleaser.yaml \
 			--parallelism 1 \
 			--release-notes <(cat CHANGELOG.md)\
 				 || (cat .github/scripts/apple-signing/log/*.txt && false)"

README.md

@@ -114,6 +114,7 @@ Sources can be explicitly provided with a scheme:
 
 ```
 docker:yourrepo/yourimage:tag          use images from the Docker daemon
+podman:yourrepo/yourimage:tag          use images from the Podman daemon
 docker-archive:path/to/yourimage.tar   use a tarball from disk for archives created from "docker save"
 oci-archive:path/to/yourimage.tar      use a tarball from disk for OCI archives (from Skopeo or otherwise)
 oci-dir:path/to/yourimage              read directly from a path on disk for OCI layout directories (from Skopeo or otherwise)

artifacthub-repo.yml

@@ -0,0 +1,5 @@
+# See documentation here: https://github.com/artifacthub/hub/blob/v1.6.0/docs/metadata/artifacthub-repo.yml
+
+owners:
+  - name: wagoodman
+    email: wagoodman@gmail.com

cmd/attest.go

@@ -9,6 +9,10 @@ import (
 	"os"
 	"strings"
 
+	"github.com/anchore/syft/internal/formats/cyclonedxjson"
+	"github.com/anchore/syft/internal/formats/spdx22json"
+	"github.com/anchore/syft/internal/formats/syftjson"
+
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/syft/internal"
@@ -17,9 +21,8 @@ import (
 	"github.com/anchore/syft/internal/ui"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/format"
+	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
-	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/in-toto/in-toto-golang/in_toto"
 	"github.com/pkg/errors"
 	"github.com/pkg/profile"
@@ -27,7 +30,6 @@ import (
 	"github.com/sigstore/cosign/pkg/cosign"
 	"github.com/sigstore/cosign/pkg/cosign/attestation"
 	"github.com/sigstore/sigstore/pkg/signature/dsse"
-	"github.com/spf13/afero"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
 	"github.com/spf13/viper"
@@ -51,7 +53,11 @@ const (
 	intotoJSONDsseType = `application/vnd.in-toto+json`
 )
 
-var attestFormats = []format.Option{format.SPDXJSONOption, format.CycloneDxJSONOption, format.JSONOption}
+var attestFormats = []sbom.FormatID{
+	syftjson.ID,
+	spdx22json.ID,
+	cyclonedxjson.ID,
+}
 
 var (
 	attestCmd = &cobra.Command{
@@ -125,24 +131,36 @@ func selectPassFunc(keypath string) (cosign.PassFunc, error) {
 func attestExec(ctx context.Context, _ *cobra.Command, args []string) error {
 	// can only be an image for attestation or OCI DIR
 	userInput := args[0]
-	fs := afero.NewOsFs()
-	parsedScheme, _, _, err := source.DetectScheme(fs, image.DetectSource, userInput)
+	si, err := source.ParseInput(userInput, appConfig.Platform, false)
 	if err != nil {
-		return err
+		return fmt.Errorf("could not generate source input for attest command: %w", err)
 	}
 
-	if parsedScheme != source.ImageScheme {
-		return fmt.Errorf("attest command can only be used with image sources but discovered %q when given %q", parsedScheme, userInput)
+	switch si.Scheme {
+	case source.ImageScheme, source.UnknownScheme:
+		// at this point we know that it cannot be dir: or file: schemes, so we will assume that the unknown scheme could represent an image
+		si.Scheme = source.ImageScheme
+	default:
+		return fmt.Errorf("attest command can only be used with image sources but discovered %q when given %q", si.Scheme, userInput)
 	}
 
-	if len(appConfig.Output) > 1 {
+	// if the original detection was from a local daemon we want to short circuit
+	// that and attempt to generate the image source from a registry source instead
+	switch si.ImageSource {
+	case image.UnknownSource, image.OciRegistrySource:
+		si.ImageSource = image.OciRegistrySource
+	default:
+		return fmt.Errorf("attest command can only be used with image sources fetch directly from the registry, but discovered an image source of %q when given %q", si.ImageSource, userInput)
+	}
+
+	if len(appConfig.Outputs) > 1 {
 		return fmt.Errorf("unable to generate attestation for more than one output")
 	}
 
-	output := format.ParseOption(appConfig.Output[0])
-	predicateType := assertPredicateType(output)
+	format := syft.FormatByName(appConfig.Outputs[0])
+	predicateType := formatPredicateType(format)
 	if predicateType == "" {
-		return fmt.Errorf("could not produce attestation predicate for given format: %q. Available formats: %+v", output, attestFormats)
+		return fmt.Errorf("could not produce attestation predicate for given format: %q. Available formats: %+v", formatAliases(format.ID()), formatAliases(attestFormats...))
 	}
 
 	passFunc, err := selectPassFunc(appConfig.Attest.Key)
@@ -162,7 +180,7 @@ func attestExec(ctx context.Context, _ *cobra.Command, args []string) error {
 	defer sv.Close()
 
 	return eventLoop(
-		attestationExecWorker(userInput, output, predicateType, sv),
+		attestationExecWorker(*si, format, predicateType, sv),
 		setupSignals(),
 		eventSubscription,
 		stereoscope.Cleanup,
@@ -170,18 +188,27 @@ func attestExec(ctx context.Context, _ *cobra.Command, args []string) error {
 	)
 }
 
-func attestationExecWorker(userInput string, output format.Option, predicateType string, sv *sign.SignerVerifier) <-chan error {
+func attestationExecWorker(sourceInput source.Input, format sbom.Format, predicateType string, sv *sign.SignerVerifier) <-chan error {
 	errs := make(chan error)
 	go func() {
 		defer close(errs)
 
-		s, src, err := generateSBOM(userInput, errs)
+		src, cleanup, err := source.NewFromRegistry(sourceInput, appConfig.Registry.ToOptions(), appConfig.Exclusions)
+		if cleanup != nil {
+			defer cleanup()
+		}
+		if err != nil {
+			errs <- fmt.Errorf("failed to construct source from user input %q: %w", sourceInput.UserInput, err)
+			return
+		}
+
+		s, err := generateSBOM(src, errs)
 		if err != nil {
 			errs <- err
 			return
 		}
 
-		sbomBytes, err := syft.Encode(*s, output)
+		sbomBytes, err := syft.Encode(*s, format)
 		if err != nil {
 			errs <- err
 			return
@@ -196,24 +223,34 @@ func attestationExecWorker(userInput string, output format.Option, predicateType
 	return errs
 }
 
-func assertPredicateType(output format.Option) string {
-	switch output {
-	case format.SPDXJSONOption:
+func formatPredicateType(format sbom.Format) string {
+	switch format.ID() {
+	case spdx22json.ID:
 		return in_toto.PredicateSPDX
-	// Tentative see https://github.com/in-toto/attestation/issues/82
-	case format.CycloneDxJSONOption:
+	case cyclonedxjson.ID:
+		// Tentative see https://github.com/in-toto/attestation/issues/82
 		return "https://cyclonedx.org/bom"
-	case format.JSONOption:
+	case syftjson.ID:
 		return "https://syft.dev/bom"
 	default:
 		return ""
 	}
 }
 
+func findValidDigest(digests []string) string {
+	// since we are only using the OCI repo provider for this source we are safe that this is only 1 value
+	// see https://github.com/anchore/stereoscope/blob/25ebd49a842b5ac0a20c2e2b4b81335b64ad248c/pkg/image/oci/registry_provider.go#L57-L63
+	split := strings.Split(digests[0], "sha256:")
+	return split[1]
+}
+
 func generateAttestation(predicate []byte, src *source.Source, sv *sign.SignerVerifier, predicateType string) error {
-	h, err := v1.NewHash(src.Image.Metadata.ManifestDigest)
-	if err != nil {
-		return errors.Wrap(err, "could not hash manifest digest for image")
+	switch len(src.Image.Metadata.RepoDigests) {
+	case 0:
+		return fmt.Errorf("cannot generate attestation since no repo digests were found; make sure you're passing an OCI registry source for the attest command")
+	case 1:
+	default:
+		return fmt.Errorf("cannot generate attestation since multiple repo digests were found for the image: %+v", src.Image.Metadata.RepoDigests)
 	}
 
 	wrapped := dsse.WrapSigner(sv, intotoJSONDsseType)
@@ -221,7 +258,7 @@ func generateAttestation(predicate []byte, src *source.Source, sv *sign.SignerVe
 	sh, err := attestation.GenerateStatement(attestation.GenerateOpts{
 		Predicate: bytes.NewBuffer(predicate),
 		Type:      predicateType,
-		Digest:    h.Hex,
+		Digest:    findValidDigest(src.Image.Metadata.RepoDigests),
 	})
 	if err != nil {
 		return err
@@ -264,8 +301,13 @@ func setAttestFlags(flags *pflag.FlagSet) {
 
 	// in-toto attestations only support JSON predicates, so not all SBOM formats that syft can output are supported
 	flags.StringP(
-		"output", "o", string(format.JSONOption),
-		fmt.Sprintf("the SBOM format encapsulated within the attestation, available options=%v", attestFormats),
+		"output", "o", formatAliases(syftjson.ID)[0],
+		fmt.Sprintf("the SBOM format encapsulated within the attestation, available options=%v", formatAliases(attestFormats...)),
+	)
+
+	flags.StringP(
+		"platform", "", "",
+		"an optional platform specifier for container image sources (e.g. 'linux/arm64', 'linux/arm64/v8', 'arm64', 'linux')",
 	)
 }
 

cmd/cmd.go

@@ -72,8 +72,8 @@ func initCmdAliasBindings() {
 			panic(err)
 		}
 	case attestCmd:
-		// the --output option is an independently defined flag, but a shared config option
-		if err = bindSharedOutputConfigOption(attestCmd.Flags()); err != nil {
+		// the --output and --platform options are independently defined flags, but a shared config option
+		if err = bindSharedConfigOption(attestCmd.Flags()); err != nil {
 			panic(err)
 		}
 		// even though the root command or packages command is NOT being run, we still need default bindings
@@ -90,11 +90,15 @@ func initCmdAliasBindings() {
 	}
 }
 
-func bindSharedOutputConfigOption(flags *pflag.FlagSet) error {
+func bindSharedConfigOption(flags *pflag.FlagSet) error {
 	if err := viper.BindPFlag("output", flags.Lookup("output")); err != nil {
 		return err
 	}
 
+	if err := viper.BindPFlag("platform", flags.Lookup("platform")); err != nil {
+		return err
+	}
+
 	return nil
 }
 

cmd/format_aliases.go

@@ -0,0 +1,32 @@
+package cmd
+
+import (
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/sbom"
+)
+
+func formatAliases(ids ...sbom.FormatID) (aliases []string) {
+	for _, id := range ids {
+		switch id {
+		case syft.JSONFormatID:
+			aliases = append(aliases, "syft-json")
+		case syft.TextFormatID:
+			aliases = append(aliases, "text")
+		case syft.TableFormatID:
+			aliases = append(aliases, "table")
+		case syft.SPDXJSONFormatID:
+			aliases = append(aliases, "spdx-json")
+		case syft.SPDXTagValueFormatID:
+			aliases = append(aliases, "spdx-tag-value")
+		case syft.CycloneDxXMLFormatID:
+			aliases = append(aliases, "cyclonedx-xml")
+		case syft.CycloneDxJSONFormatID:
+			aliases = append(aliases, "cyclonedx-json")
+		case syft.GitHubID:
+			aliases = append(aliases, "github", "github-json")
+		default:
+			aliases = append(aliases, string(id))
+		}
+	}
+	return aliases
+}

cmd/output_writer.go

@@ -4,9 +4,10 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/anchore/syft/internal/formats"
-	"github.com/anchore/syft/internal/output"
-	"github.com/anchore/syft/syft/format"
+	"github.com/anchore/syft/internal/formats/table"
+
+	"github.com/anchore/syft/syft"
+
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/hashicorp/go-multierror"
 )
@@ -19,7 +20,7 @@ func makeWriter(outputs []string, defaultFile string) (sbom.Writer, error) {
 		return nil, err
 	}
 
-	writer, err := output.MakeWriter(outputOptions...)
+	writer, err := sbom.NewWriter(outputOptions...)
 	if err != nil {
 		return nil, err
 	}
@@ -28,10 +29,10 @@ func makeWriter(outputs []string, defaultFile string) (sbom.Writer, error) {
 }
 
 // parseOptions utility to parse command-line option strings and retain the existing behavior of default format and file
-func parseOptions(outputs []string, defaultFile string) (out []output.WriterOption, errs error) {
+func parseOptions(outputs []string, defaultFile string) (out []sbom.WriterOption, errs error) {
 	// always should have one option -- we generally get the default of "table", but just make sure
 	if len(outputs) == 0 {
-		outputs = append(outputs, string(format.TableOption))
+		outputs = append(outputs, string(table.ID))
 	}
 
 	for _, name := range outputs {
@@ -40,33 +41,24 @@ func parseOptions(outputs []string, defaultFile string) (out []output.WriterOpti
 		// split to at most two parts for <format>=<file>
 		parts := strings.SplitN(name, "=", 2)
 
-		// the format option is the first part
+		// the format name is the first part
 		name = parts[0]
 
 		// default to the --file or empty string if not specified
 		file := defaultFile
 
-		// If a file is specified as part of the output option, use that
+		// If a file is specified as part of the output formatName, use that
 		if len(parts) > 1 {
 			file = parts[1]
 		}
 
-		option := format.ParseOption(name)
-		if option == format.UnknownFormatOption {
+		format := syft.FormatByName(name)
+		if format == nil {
 			errs = multierror.Append(errs, fmt.Errorf("bad output format: '%s'", name))
 			continue
 		}
 
-		encoder := formats.ByOption(option)
-		if encoder == nil {
-			errs = multierror.Append(errs, fmt.Errorf("unknown format: %s", outputFormat))
-			continue
-		}
-
-		out = append(out, output.WriterOption{
-			Format: *encoder,
-			Path:   file,
-		})
+		out = append(out, sbom.NewWriterOption(format, file))
 	}
 	return out, errs
 }

cmd/packages.go

@@ -10,12 +10,13 @@ import (
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/anchore"
 	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/formats/table"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/ui"
 	"github.com/anchore/syft/internal/version"
+	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/format"
 	"github.com/anchore/syft/syft/pkg/cataloger"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
@@ -27,7 +28,7 @@ import (
 )
 
 const (
-	packagesExample = `  {{.appName}} {{.command}} alpine:latest                a summary of discovered packages
+	packagesExample = `  {{.appName}} {{.command}} alpine:latest                    a summary of discovered packages
   {{.appName}} {{.command}} alpine:latest -o json            show all possible cataloging details
   {{.appName}} {{.command}} alpine:latest -o cyclonedx       show a CycloneDX formatted SBOM
   {{.appName}} {{.command}} alpine:latest -o cyclonedx-json  show a CycloneDX JSON formatted SBOM
@@ -42,6 +43,7 @@ const (
 
 	schemeHelpHeader = "You can also explicitly specify the scheme to use:"
 	imageSchemeHelp  = `    {{.appName}} {{.command}} docker:yourrepo/yourimage:tag          explicitly use the Docker daemon
+    {{.appName}} {{.command}} podman:yourrepo/yourimage:tag        	 explicitly use the Podman daemon
     {{.appName}} {{.command}} registry:yourrepo/yourimage:tag        pull image directly from a registry (no container runtime required)
     {{.appName}} {{.command}} docker-archive:path/to/yourimage.tar   use a tarball from disk for archives created from "docker save"
     {{.appName}} {{.command}} oci-archive:path/to/yourimage.tar      use a tarball from disk for OCI archives (from Skopeo or otherwise)
@@ -99,8 +101,8 @@ func setPackageFlags(flags *pflag.FlagSet) {
 		fmt.Sprintf("selection of layers to catalog, options=%v", source.AllScopes))
 
 	flags.StringArrayP(
-		"output", "o", []string{string(format.TableOption)},
-		fmt.Sprintf("report output format, options=%v", format.AllOptions),
+		"output", "o", formatAliases(table.ID),
+		fmt.Sprintf("report output format, options=%v", formatAliases(syft.FormatIDs()...)),
 	)
 
 	flags.StringP(
@@ -108,6 +110,11 @@ func setPackageFlags(flags *pflag.FlagSet) {
 		"file to write the default report output to (default is STDOUT)",
 	)
 
+	flags.StringP(
+		"platform", "", "",
+		"an optional platform specifier for container image sources (e.g. 'linux/arm64', 'linux/arm64/v8', 'arm64', 'linux')",
+	)
+
 	// Upload options //////////////////////////////////////////////////////////
 	flags.StringP(
 		"host", "H", "",
@@ -149,7 +156,7 @@ func bindPackagesConfigOptions(flags *pflag.FlagSet) error {
 	if err := bindExclusivePackagesConfigOptions(flags); err != nil {
 		return err
 	}
-	if err := bindSharedOutputConfigOption(flags); err != nil {
+	if err := bindSharedConfigOption(flags); err != nil {
 		return err
 	}
 	return nil
@@ -215,7 +222,7 @@ func validateInputArgs(cmd *cobra.Command, args []string) error {
 }
 
 func packagesExec(_ *cobra.Command, args []string) error {
-	writer, err := makeWriter(appConfig.Output, appConfig.File)
+	writer, err := makeWriter(appConfig.Outputs, appConfig.File)
 	if err != nil {
 		return err
 	}
@@ -228,9 +235,13 @@ func packagesExec(_ *cobra.Command, args []string) error {
 
 	// could be an image or a directory, with or without a scheme
 	userInput := args[0]
+	si, err := source.ParseInput(userInput, appConfig.Platform, true)
+	if err != nil {
+		return fmt.Errorf("could not generate source input for packages command: %w", err)
+	}
 
 	return eventLoop(
-		packagesExecWorker(userInput, writer),
+		packagesExecWorker(*si, writer),
 		setupSignals(),
 		eventSubscription,
 		stereoscope.Cleanup,
@@ -249,18 +260,10 @@ func isVerbose() (result bool) {
 	return appConfig.CliOptions.Verbosity > 0 || isPipedInput
 }
 
-func generateSBOM(userInput string, errs chan error) (*sbom.SBOM, *source.Source, error) {
+func generateSBOM(src *source.Source, errs chan error) (*sbom.SBOM, error) {
 	tasks, err := tasks()
 	if err != nil {
-		return nil, nil, err
-	}
-
-	src, cleanup, err := source.New(userInput, appConfig.Registry.ToOptions(), appConfig.Exclusions)
-	if err != nil {
-		return nil, nil, fmt.Errorf("failed to construct source from user input %q: %w", userInput, err)
-	}
-	if cleanup != nil {
-		defer cleanup()
+		return nil, err
 	}
 
 	s := sbom.SBOM{
@@ -274,7 +277,7 @@ func generateSBOM(userInput string, errs chan error) (*sbom.SBOM, *source.Source
 
 	buildRelationships(&s, src, tasks, errs)
 
-	return &s, src, nil
+	return &s, nil
 }
 
 func buildRelationships(s *sbom.SBOM, src *source.Source, tasks []task, errs chan error) {
@@ -288,18 +291,28 @@ func buildRelationships(s *sbom.SBOM, src *source.Source, tasks []task, errs cha
 	s.Relationships = append(s.Relationships, mergeRelationships(relationships...)...)
 }
 
-func packagesExecWorker(userInput string, writer sbom.Writer) <-chan error {
+func packagesExecWorker(si source.Input, writer sbom.Writer) <-chan error {
 	errs := make(chan error)
 	go func() {
 		defer close(errs)
-		s, src, err := generateSBOM(userInput, errs)
+
+		src, cleanup, err := source.New(si, appConfig.Registry.ToOptions(), appConfig.Exclusions)
+		if cleanup != nil {
+			defer cleanup()
+		}
+		if err != nil {
+			errs <- fmt.Errorf("failed to construct source from user input %q: %w", si.UserInput, err)
+			return
+		}
+
+		s, err := generateSBOM(src, errs)
 		if err != nil {
 			errs <- err
 			return
 		}
 
 		if s == nil {
-			panic("nil sbomb returned with no error")
+			errs <- fmt.Errorf("no SBOM produced for %q", si.UserInput)
 		}
 
 		if appConfig.Anchore.Host != "" {

cmd/power_user.go

@@ -9,7 +9,6 @@ import (
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/formats/syftjson"
 	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/output"
 	"github.com/anchore/syft/internal/ui"
 	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft/artifact"
@@ -26,7 +25,7 @@ const powerUserExample = `  {{.appName}} {{.command}} <image>
 
   DEPRECATED - THIS COMMAND WILL BE REMOVED in v1.0.0
 
-  Only image sources are supported (e.g. docker: , docker-archive: , oci: , etc.), the directory source (dir:) is not supported.
+  Only image sources are supported (e.g. docker: , podman: , docker-archive: , oci: , etc.), the directory source (dir:) is not supported.
 
   All behavior is controlled via application configuration and environment variables (see https://github.com/anchore/syft#configuration)
 `
@@ -74,10 +73,12 @@ func powerUserExec(_ *cobra.Command, args []string) error {
 	// could be an image or a directory, with or without a scheme
 	userInput := args[0]
 
-	writer, err := output.MakeWriter(output.WriterOption{
-		Format: syftjson.Format(),
-		Path:   appConfig.File,
-	})
+	writer, err := sbom.NewWriter(
+		sbom.NewWriterOption(
+			syftjson.Format(),
+			appConfig.File,
+		),
+	)
 	if err != nil {
 		return err
 	}
@@ -115,7 +116,13 @@ func powerUserExecWorker(userInput string, writer sbom.Writer) <-chan error {
 			return
 		}
 
-		src, cleanup, err := source.New(userInput, appConfig.Registry.ToOptions(), appConfig.Exclusions)
+		si, err := source.ParseInput(userInput, appConfig.Platform, true)
+		if err != nil {
+			errs <- err
+			return
+		}
+
+		src, cleanup, err := source.New(*si, appConfig.Registry.ToOptions(), appConfig.Exclusions)
 		if err != nil {
 			errs <- err
 			return

cmd/version.go

@@ -11,7 +11,7 @@ import (
 	"github.com/spf13/cobra"
 )
 
-var outputFormat string
+var versionCmdOutputFormat string
 
 var versionCmd = &cobra.Command{
 	Use:   "version",
@@ -20,23 +20,24 @@ var versionCmd = &cobra.Command{
 }
 
 func init() {
-	versionCmd.Flags().StringVarP(&outputFormat, "output", "o", "text", "format to show version information (available=[text, json])")
+	versionCmd.Flags().StringVarP(&versionCmdOutputFormat, "output", "o", "text", "format to show version information (available=[text, json])")
 	rootCmd.AddCommand(versionCmd)
 }
 
 func printVersion(_ *cobra.Command, _ []string) {
 	versionInfo := version.FromBuild()
 
-	switch outputFormat {
+	switch versionCmdOutputFormat {
 	case "text":
-		fmt.Println("Application:    ", internal.ApplicationName)
-		fmt.Println("Version:        ", versionInfo.Version)
-		fmt.Println("BuildDate:      ", versionInfo.BuildDate)
-		fmt.Println("GitCommit:      ", versionInfo.GitCommit)
-		fmt.Println("GitDescription: ", versionInfo.GitDescription)
-		fmt.Println("Platform:       ", versionInfo.Platform)
-		fmt.Println("GoVersion:      ", versionInfo.GoVersion)
-		fmt.Println("Compiler:       ", versionInfo.Compiler)
+		fmt.Println("Application:       ", internal.ApplicationName)
+		fmt.Println("Version:           ", versionInfo.Version)
+		fmt.Println("JsonSchemaVersion: ", internal.JSONSchemaVersion)
+		fmt.Println("BuildDate:         ", versionInfo.BuildDate)
+		fmt.Println("GitCommit:         ", versionInfo.GitCommit)
+		fmt.Println("GitDescription:    ", versionInfo.GitDescription)
+		fmt.Println("Platform:          ", versionInfo.Platform)
+		fmt.Println("GoVersion:         ", versionInfo.GoVersion)
+		fmt.Println("Compiler:          ", versionInfo.Compiler)
 
 	case "json":
 		enc := json.NewEncoder(os.Stdout)
@@ -54,7 +55,7 @@ func printVersion(_ *cobra.Command, _ []string) {
 			os.Exit(1)
 		}
 	default:
-		fmt.Printf("unsupported output format: %s\n", outputFormat)
+		fmt.Printf("unsupported output format: %s\n", versionCmdOutputFormat)
 		os.Exit(1)
 	}
 }

go.mod

@@ -3,7 +3,7 @@ module github.com/anchore/syft
 go 1.17
 
 require (
-	github.com/CycloneDX/cyclonedx-go v0.4.0
+	github.com/CycloneDX/cyclonedx-go v0.5.0
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
 	github.com/acobaugh/osrelease v0.1.0
 	github.com/adrg/xdg v0.2.1
@@ -13,10 +13,9 @@ require (
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29
-	github.com/anchore/stereoscope v0.0.0-20220217141419-c6f02aed9ed2
+	github.com/anchore/stereoscope v0.0.0-20220307154759-8a5a70c227d3
 	github.com/antihax/optional v1.0.0
 	github.com/bmatcuk/doublestar/v4 v4.0.2
-	github.com/docker/docker v20.10.12+incompatible
 	github.com/dustin/go-humanize v1.0.0
 	github.com/facebookincubator/nvdtools v0.1.4
 	github.com/go-test/deep v1.0.8
@@ -56,7 +55,10 @@ require (
 	gopkg.in/yaml.v2 v2.4.0
 )
 
-require github.com/sigstore/cosign v1.5.2-0.20220222220736-ec79daf63c24
+require (
+	github.com/docker/docker v20.10.12+incompatible
+	github.com/sigstore/cosign v1.6.0
+)
 
 require (
 	bitbucket.org/creachadair/shell v0.0.6 // indirect
@@ -125,21 +127,21 @@ require (
 	github.com/ghodss/yaml v1.0.0 // indirect
 	github.com/go-chi/chi v4.1.2+incompatible // indirect
 	github.com/go-logr/logr v1.2.2 // indirect
-	github.com/go-openapi/analysis v0.20.1 // indirect
-	github.com/go-openapi/errors v0.20.1 // indirect
+	github.com/go-openapi/analysis v0.21.2 // indirect
+	github.com/go-openapi/errors v0.20.2 // indirect
 	github.com/go-openapi/jsonpointer v0.19.5 // indirect
 	github.com/go-openapi/jsonreference v0.19.6 // indirect
-	github.com/go-openapi/loads v0.21.0 // indirect
-	github.com/go-openapi/runtime v0.23.0 // indirect
+	github.com/go-openapi/loads v0.21.1 // indirect
+	github.com/go-openapi/runtime v0.23.1 // indirect
 	github.com/go-openapi/spec v0.20.4 // indirect
 	github.com/go-openapi/strfmt v0.21.2 // indirect
 	github.com/go-openapi/swag v0.21.1 // indirect
-	github.com/go-openapi/validate v0.20.3 // indirect
+	github.com/go-openapi/validate v0.21.0 // indirect
 	github.com/go-piv/piv-go v1.9.0 // indirect
 	github.com/go-playground/locales v0.14.0 // indirect
 	github.com/go-playground/universal-translator v0.18.0 // indirect
 	github.com/go-playground/validator/v10 v10.10.0 // indirect
-	github.com/go-stack/stack v1.8.0 // indirect
+	github.com/go-stack/stack v1.8.1 // indirect
 	github.com/golang-jwt/jwt/v4 v4.2.0 // indirect
 	github.com/golang/glog v1.0.0 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
@@ -169,8 +171,8 @@ require (
 	github.com/hashicorp/go-uuid v1.0.2 // indirect
 	github.com/hashicorp/go-version v1.4.0 // indirect
 	github.com/hashicorp/golang-lru v0.5.4 // indirect
-	github.com/hashicorp/vault/api v1.3.1 // indirect
-	github.com/hashicorp/vault/sdk v0.3.0 // indirect
+	github.com/hashicorp/vault/api v1.4.1 // indirect
+	github.com/hashicorp/vault/sdk v0.4.1 // indirect
 	github.com/hashicorp/yamux v0.0.0-20211028200310-0bc27b27de87 // indirect
 	github.com/imdario/mergo v0.3.12 // indirect
 	github.com/jedisct1/go-minisign v0.0.0-20210703085342-c1f07ee84431 // indirect
@@ -200,21 +202,21 @@ require (
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/sassoftware/relic v0.0.0-20210427151427-dfb082b79b74 // indirect
-	github.com/secure-systems-lab/go-securesystemslib v0.3.0 // indirect
+	github.com/secure-systems-lab/go-securesystemslib v0.3.1 // indirect
 	github.com/segmentio/ksuid v1.0.4 // indirect
 	github.com/shibumi/go-pathspec v1.3.0 // indirect
 	github.com/sigstore/fulcio v0.1.2-0.20220114150912-86a2036f9bc7 // indirect
 	github.com/sigstore/rekor v0.4.1-0.20220114213500-23f583409af3 // indirect
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
 	github.com/soheilhy/cmux v0.1.5 // indirect
-	github.com/spiffe/go-spiffe/v2 v2.0.0-beta.11 // indirect
+	github.com/spiffe/go-spiffe/v2 v2.0.0-beta.12 // indirect
 	github.com/syndtr/goleveldb v1.0.1-0.20210819022825-2ae1ddf74ef7 // indirect
 	github.com/tent/canonical-json-go v0.0.0-20130607151641-96e4ba3a7613 // indirect
 	github.com/thales-e-security/pool v0.0.2 // indirect
 	github.com/theupdateframework/go-tuf v0.0.0-20220211205608-f0c3294f63b9 // indirect
 	github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802 // indirect
 	github.com/urfave/cli v1.22.5 // indirect
-	github.com/xanzy/go-gitlab v0.55.1 // indirect
+	github.com/xanzy/go-gitlab v0.56.0 // indirect
 	github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2 // indirect
 	github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778 // indirect
 	github.com/zeebo/errs v1.2.2 // indirect
@@ -230,7 +232,7 @@ require (
 	go.etcd.io/etcd/server/v3 v3.5.0 // indirect
 	go.etcd.io/etcd/tests/v3 v3.5.0 // indirect
 	go.etcd.io/etcd/v3 v3.5.0 // indirect
-	go.mongodb.org/mongo-driver v1.7.5 // indirect
+	go.mongodb.org/mongo-driver v1.8.3 // indirect
 	go.opencensus.io v0.23.0 // indirect
 	go.opentelemetry.io/contrib v1.3.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.20.0 // indirect
@@ -244,10 +246,11 @@ require (
 	go.opentelemetry.io/proto/otlp v0.12.0 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
 	go.uber.org/multierr v1.7.0 // indirect
-	go.uber.org/zap v1.20.0 // indirect
+	go.uber.org/zap v1.21.0 // indirect
 	golang.org/x/time v0.0.0-20211116232009-f0f3c7e86c11 // indirect
 	golang.org/x/tools v0.1.8 // indirect
 	google.golang.org/api v0.70.0 // indirect
+	google.golang.org/protobuf v1.27.1 // indirect
 	gopkg.in/cheggaaa/pb.v1 v1.0.28 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.0.0 // indirect
@@ -270,11 +273,11 @@ require (
 	// we are hinting brotli to latest due to warning when installing archiver v3:
 	// go: warning: github.com/andybalholm/brotli@v1.0.1: retracted by module author: occasional panics and data corruption
 	github.com/andybalholm/brotli v1.0.4 // indirect
-	github.com/containerd/containerd v1.5.9 // indirect
+	github.com/containerd/containerd v1.5.10 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.10.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/docker/cli v20.10.12+incompatible // indirect
-	github.com/docker/distribution v2.7.1+incompatible // indirect
+	github.com/docker/distribution v2.8.0+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.6.4 // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
 	github.com/docker/go-units v0.4.0 // indirect
@@ -285,7 +288,7 @@ require (
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
-	github.com/google/go-containerregistry v0.8.1-0.20220209165246-a44adc326839
+	github.com/google/go-containerregistry v0.8.1-0.20220209165246-a44adc326839 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/iancoleman/orderedmap v0.0.0-20190318233801-ac98e3ecb4b0 // indirect
@@ -321,7 +324,6 @@ require (
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20220218161850-94dd64e39d7c // indirect
 	google.golang.org/grpc v1.44.0 // indirect
-	google.golang.org/protobuf v1.27.1 // indirect
 	gopkg.in/ini.v1 v1.66.2 // indirect
 	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
 )

go.sum

@@ -186,8 +186,8 @@ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03
 github.com/BurntSushi/toml v0.4.1 h1:GaI7EiDXDRfa8VshkTj7Fym7ha+y8/XxIgD2okUIjLw=
 github.com/BurntSushi/toml v0.4.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/CycloneDX/cyclonedx-go v0.4.0 h1:Wz4QZ9B4RXGWIWTypVLEOVJgOdFfy5mcS5PGNzUkZxU=
-github.com/CycloneDX/cyclonedx-go v0.4.0/go.mod h1:rmRcf//gT7PIzovatusbWi377xqCg1FS4jyST0GH20E=
+github.com/CycloneDX/cyclonedx-go v0.5.0 h1:RWCnu2OrWUTF5C9DA3L0qVziUD2HlxSUWcL2OXlxfqE=
+github.com/CycloneDX/cyclonedx-go v0.5.0/go.mod h1:nQXAzrejxO39b14JFz2SvsUElegYfwBDowIzqjdUMk4=
 github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
 github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24/go.mod h1:4UJr5HIiMZrwgkSPdsjy2uOQExX/WEILpIrO9UPGuXs=
 github.com/GoogleCloudPlatform/cloudsql-proxy v0.0.0-20191009163259-e802c2cb94ae/go.mod h1:mjwGPas4yKduTyubHvD1Atl9r1rUq8DfVy+gkVvZ+oo=
@@ -234,9 +234,11 @@ github.com/PaesslerAG/gval v1.0.0/go.mod h1:y/nm5yEyTeX6av0OfKJNp9rBNj2XrGhAf5+v
 github.com/PaesslerAG/jsonpath v0.1.0/go.mod h1:4BzmtoM/PI8fPO4aQGIusjGxGir2BzcV0grWtFzq1Y8=
 github.com/PaesslerAG/jsonpath v0.1.1 h1:c1/AToHQMVsduPAa4Vh6xp2U0evy4t8SWp8imEsylIk=
 github.com/PaesslerAG/jsonpath v0.1.1/go.mod h1:lVboNxFGal/VwW6d9JzIy56bUsYAP6tH/x80vjnCseY=
+github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/purell v1.1.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/purell v1.1.1 h1:WEQqlqaGbrPkxLJWfBwQmfEAE1Z7ONdDLqrN38tNFfI=
 github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
+github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
 github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 h1:d+Bc7a5rLufV/sSk/8dngufqelfh6jnri85riMAaF/M=
 github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
 github.com/ReneKroon/ttlcache/v2 v2.10.0/go.mod h1:mBxvsNY+BT8qLLd6CuAJubbKo6r0jh3nb5et22bbfGY=
@@ -282,8 +284,8 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZV
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29 h1:K9LfnxwhqvihqU0+MF325FNy7fsKV9EGaUxdfR4gnWk=
 github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29/go.mod h1:Oc1UkGaJwY6ND6vtAqPSlYrptKRJngHwkwB6W7l1uP0=
-github.com/anchore/stereoscope v0.0.0-20220217141419-c6f02aed9ed2 h1:QuvMG+rqqJmtFRL+jqj5pFgjQcJSnEHEbtj1lKowLLQ=
-github.com/anchore/stereoscope v0.0.0-20220217141419-c6f02aed9ed2/go.mod h1:QpDHHV2h1NNfu7klzU75XC8RvSlaPK6HHgi0dy8A6sk=
+github.com/anchore/stereoscope v0.0.0-20220307154759-8a5a70c227d3 h1:Kx2jlMdENAf4cVjYGYLI+fiavVhzhtmU89GUYDITJ1w=
+github.com/anchore/stereoscope v0.0.0-20220307154759-8a5a70c227d3/go.mod h1:XESZQTgFETDBatmyoet6XZ0zVknoIMDSAhj2INj2a5w=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.0.0/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
 github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
@@ -434,8 +436,8 @@ github.com/bmizerany/perks v0.0.0-20141205001514-d9a9656a3a4b/go.mod h1:ac9efd0D
 github.com/bombsimon/wsl/v3 v3.3.0/go.mod h1:st10JtZYLE4D5sC7b8xV4zTKZwAQjCH/Hy2Pm1FNZIc=
 github.com/bradfitz/gomemcache v0.0.0-20190913173617-a41fca850d0b/go.mod h1:H0wQNHz2YrLsuXOZozoeDmnHXkNCRmMW0gwFWDfEZDA=
 github.com/bradleyfalzon/ghinstallation/v2 v2.0.3/go.mod h1:tlgi+JWCXnKFx/Y4WtnDbZEINo31N5bcvnCoqieefmk=
-github.com/bradleyjkemp/cupaloy/v2 v2.6.0 h1:knToPYa2xtfg42U3I6punFEjaGFKWQRXJwj0JTv4mTs=
-github.com/bradleyjkemp/cupaloy/v2 v2.6.0/go.mod h1:bm7JXdkRd4BHJk9HpwqAI8BoAY1lps46Enkdqw6aRX0=
+github.com/bradleyjkemp/cupaloy/v2 v2.7.0 h1:AT0vOjO68RcLyenLCHOGZzSNiuto7ziqzq6Q1/3xzMQ=
+github.com/bradleyjkemp/cupaloy/v2 v2.7.0/go.mod h1:bm7JXdkRd4BHJk9HpwqAI8BoAY1lps46Enkdqw6aRX0=
 github.com/breml/bidichk v0.1.1/go.mod h1:zbfeitpevDUGI7V91Uzzuwrn4Vls8MoBMrwtt78jmso=
 github.com/bshuster-repo/logrus-logstash-hook v0.4.1/go.mod h1:zsTqEiSzDgAa/8GZR7E1qaXrhYNDKBYy5/dWPTIflbk=
 github.com/buger/jsonparser v0.0.0-20180808090653-f4dd9f5a6b44/go.mod h1:bbYlZJ7hK1yFx9hf58LP0zeX7UjIGs20ufpu3evjr+s=
@@ -550,8 +552,9 @@ github.com/containerd/containerd v1.5.0-rc.0/go.mod h1:V/IXoMqNGgBlabz3tHD2TWDoT
 github.com/containerd/containerd v1.5.1/go.mod h1:0DOxVqwDy2iZvrZp2JUx/E+hS0UNTVn7dJnIOwtYR4g=
 github.com/containerd/containerd v1.5.7/go.mod h1:gyvv6+ugqY25TiXxcZC3L5yOeYgEw0QMhscqVp1AR9c=
 github.com/containerd/containerd v1.5.8/go.mod h1:YdFSv5bTFLpG2HIYmfqDpSYYTDX+mc5qtSuYx1YUb/s=
-github.com/containerd/containerd v1.5.9 h1:rs6Xg1gtIxaeyG+Smsb/0xaSDu1VgFhOCKBXxMxbsF4=
 github.com/containerd/containerd v1.5.9/go.mod h1:fvQqCfadDGga5HZyn3j4+dx56qj2I9YwBrlSdalvJYQ=
+github.com/containerd/containerd v1.5.10 h1:3cQ2uRVCkJVcx5VombsE7105Gl9Wrl7ORAO3+4+ogf4=
+github.com/containerd/containerd v1.5.10/go.mod h1:fvQqCfadDGga5HZyn3j4+dx56qj2I9YwBrlSdalvJYQ=
 github.com/containerd/continuity v0.0.0-20190426062206-aaeac12a7ffc/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
 github.com/containerd/continuity v0.0.0-20190815185530-f2a389ac0a02/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
 github.com/containerd/continuity v0.0.0-20191127005431-f65d91d395eb/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
@@ -679,8 +682,9 @@ github.com/docker/cli v20.10.12+incompatible h1:lZlz0uzG+GH+c0plStMUdF/qk3ppmgns
 github.com/docker/cli v20.10.12+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v0.0.0-20190905152932-14b96e55d84c/go.mod h1:0+TTO4EOBfRPhZXAeF1Vu+W3hHZ8eLp8PgKVZlcvtFY=
 github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/distribution v2.7.1+incompatible h1:a5mlkVzth6W5A4fOsS3D2EO5BUmsJpcB+cRlLU7cSug=
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/distribution v2.8.0+incompatible h1:l9EaZDICImO1ngI+uTifW+ZYvvz7fKISBAKpg+MbWbY=
+github.com/docker/distribution v2.8.0+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker v20.10.10+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker v20.10.11+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker v20.10.12+incompatible h1:CEeNmFM0QZIsJCZKMkZx0ZcahTiewkrgiwfYD+dfl1U=
@@ -831,8 +835,9 @@ github.com/go-openapi/analysis v0.19.5/go.mod h1:hkEAkxagaIvIP7VTn8ygJNkd4kAYON2
 github.com/go-openapi/analysis v0.19.10/go.mod h1:qmhS3VNFxBlquFJ0RGoDtylO9y4pgTAUNE9AEEMdlJQ=
 github.com/go-openapi/analysis v0.19.16/go.mod h1:GLInF007N83Ad3m8a/CbQ5TPzdnGT7workfHwuVjNVk=
 github.com/go-openapi/analysis v0.20.0/go.mod h1:BMchjvaHDykmRMsK40iPtvyOfFdMMxlOmQr9FBZk+Og=
-github.com/go-openapi/analysis v0.20.1 h1:zdVbw8yoD4SWZeq+cWdGgquaB0W4VrsJvDJHJND/Ktc=
 github.com/go-openapi/analysis v0.20.1/go.mod h1:BMchjvaHDykmRMsK40iPtvyOfFdMMxlOmQr9FBZk+Og=
+github.com/go-openapi/analysis v0.21.2 h1:hXFrOYFHUAMQdu6zwAiKKJHJQ8kqZs1ux/ru1P1wLJU=
+github.com/go-openapi/analysis v0.21.2/go.mod h1:HZwRk4RRisyG8vx2Oe6aqeSQcoxRp47Xkp3+K6q+LdY=
 github.com/go-openapi/errors v0.17.0/go.mod h1:LcZQpmvG4wyF5j4IhA73wkLFQg+QJXOQHVjmcZxhka0=
 github.com/go-openapi/errors v0.18.0/go.mod h1:LcZQpmvG4wyF5j4IhA73wkLFQg+QJXOQHVjmcZxhka0=
 github.com/go-openapi/errors v0.19.2/go.mod h1:qX0BLWsyaKfvhluLejVpVNwNRdXZhEbTA4kxxpKBC94=
@@ -841,14 +846,17 @@ github.com/go-openapi/errors v0.19.6/go.mod h1:cM//ZKUKyO06HSwqAelJ5NsEMMcpa6VpX
 github.com/go-openapi/errors v0.19.7/go.mod h1:cM//ZKUKyO06HSwqAelJ5NsEMMcpa6VpXe8DOa1Mi1M=
 github.com/go-openapi/errors v0.19.8/go.mod h1:cM//ZKUKyO06HSwqAelJ5NsEMMcpa6VpXe8DOa1Mi1M=
 github.com/go-openapi/errors v0.19.9/go.mod h1:cM//ZKUKyO06HSwqAelJ5NsEMMcpa6VpXe8DOa1Mi1M=
-github.com/go-openapi/errors v0.20.1 h1:j23mMDtRxMwIobkpId7sWh7Ddcx4ivaoqUbfXx5P+a8=
 github.com/go-openapi/errors v0.20.1/go.mod h1:cM//ZKUKyO06HSwqAelJ5NsEMMcpa6VpXe8DOa1Mi1M=
+github.com/go-openapi/errors v0.20.2 h1:dxy7PGTqEh94zj2E3h1cUmQQWiM1+aeCROfAr02EmK8=
+github.com/go-openapi/errors v0.20.2/go.mod h1:cM//ZKUKyO06HSwqAelJ5NsEMMcpa6VpXe8DOa1Mi1M=
+github.com/go-openapi/jsonpointer v0.0.0-20160704185906-46af16f9f7b1/go.mod h1:+35s3my2LFTysnkMfxsJBAMHj/DoqoB9knIWoYG/Vk0=
 github.com/go-openapi/jsonpointer v0.17.0/go.mod h1:cOnomiV+CVVwFLk0A/MExoFMjwdsUdVpsRhURCKh+3M=
 github.com/go-openapi/jsonpointer v0.18.0/go.mod h1:cOnomiV+CVVwFLk0A/MExoFMjwdsUdVpsRhURCKh+3M=
 github.com/go-openapi/jsonpointer v0.19.2/go.mod h1:3akKfEdA7DF1sugOqz1dVQHBcuDBPKZGEoHC/NkiQRg=
 github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
 github.com/go-openapi/jsonpointer v0.19.5 h1:gZr+CIYByUqjcgeLXnQu2gHYQC9o73G2XUeOFYEICuY=
 github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
+github.com/go-openapi/jsonreference v0.0.0-20160704190145-13c6e3589ad9/go.mod h1:W3Z9FmVs9qj+KR4zFKmDPGiLdk1D9Rlm7cyMvf57TTg=
 github.com/go-openapi/jsonreference v0.17.0/go.mod h1:g4xxGn04lDIRh0GJb5QlpE3HfopLOL6uZrK/VgnsK9I=
 github.com/go-openapi/jsonreference v0.18.0/go.mod h1:g4xxGn04lDIRh0GJb5QlpE3HfopLOL6uZrK/VgnsK9I=
 github.com/go-openapi/jsonreference v0.19.2/go.mod h1:jMjeRr2HHw6nAVajTXJ4eiUwohSTlpa0o73RUL1owJc=
@@ -866,8 +874,9 @@ github.com/go-openapi/loads v0.19.6/go.mod h1:brCsvE6j8mnbmGBh103PT/QLHfbyDxA4hs
 github.com/go-openapi/loads v0.19.7/go.mod h1:brCsvE6j8mnbmGBh103PT/QLHfbyDxA4hsKvYBNEGVc=
 github.com/go-openapi/loads v0.20.0/go.mod h1:2LhKquiE513rN5xC6Aan6lYOSddlL8Mp20AW9kpviM4=
 github.com/go-openapi/loads v0.20.2/go.mod h1:hTVUotJ+UonAMMZsvakEgmWKgtulweO9vYP2bQYKA/o=
-github.com/go-openapi/loads v0.21.0 h1:jYtUO4wwP7psAweisP/MDoOpdzsYEESdoPcsWjHDR68=
 github.com/go-openapi/loads v0.21.0/go.mod h1:rHYve9nZrQ4CJhyeIIFJINGCg1tQpx2yJrrNo8sf1ws=
+github.com/go-openapi/loads v0.21.1 h1:Wb3nVZpdEzDTcly8S4HMkey6fjARRzb7iEaySimlDW0=
+github.com/go-openapi/loads v0.21.1/go.mod h1:/DtAMXXneXFjbQMGEtbamCZb+4x7eGwkvZCvBmwUG+g=
 github.com/go-openapi/runtime v0.0.0-20180920151709-4f900dc2ade9/go.mod h1:6v9a6LTXWQCdL8k1AO3cvqx5OtZY/Y9wKTgaoP6YRfA=
 github.com/go-openapi/runtime v0.19.0/go.mod h1:OwNfisksmmaZse4+gpV3Ne9AyMOlP1lt4sK4FXt0O64=
 github.com/go-openapi/runtime v0.19.4/go.mod h1:X277bwSUBxVlCYR3r7xgZZGKVvBd/29gLDlFGtJ8NL4=
@@ -875,8 +884,9 @@ github.com/go-openapi/runtime v0.19.15/go.mod h1:dhGWCTKRXlAfGnQG0ONViOZpjfg0m2g
 github.com/go-openapi/runtime v0.19.16/go.mod h1:5P9104EJgYcizotuXhEuUrzVc+j1RiSjahULvYmlv98=
 github.com/go-openapi/runtime v0.19.24/go.mod h1:Lm9YGCeecBnUUkFTxPC4s1+lwrkJ0pthx8YvyjCfkgk=
 github.com/go-openapi/runtime v0.21.0/go.mod h1:aQg+kaIQEn+A2CRSY1TxbM8+sT9g2V3aLc1FbIAnbbs=
-github.com/go-openapi/runtime v0.23.0 h1:HX6ET2sHCIvaKeDDQoU01CtO1ekg5EkekHSkLTtWXH0=
-github.com/go-openapi/runtime v0.23.0/go.mod h1:aQg+kaIQEn+A2CRSY1TxbM8+sT9g2V3aLc1FbIAnbbs=
+github.com/go-openapi/runtime v0.23.1 h1:/Drg9R96eMmgKJHVWZADz78XbE39/6QiIiB45mc+epo=
+github.com/go-openapi/runtime v0.23.1/go.mod h1:AKurw9fNre+h3ELZfk6ILsfvPN+bvvlaU/M9q/r9hpk=
+github.com/go-openapi/spec v0.0.0-20160808142527-6aced65f8501/go.mod h1:J8+jY1nAiCcj+friV/PDoE1/3eeccG9LYBs0tYvLOWc=
 github.com/go-openapi/spec v0.17.0/go.mod h1:XkF/MOi14NmjsfZ8VtAKf8pIlbZzyoTvZsdfssdxcBI=
 github.com/go-openapi/spec v0.18.0/go.mod h1:XkF/MOi14NmjsfZ8VtAKf8pIlbZzyoTvZsdfssdxcBI=
 github.com/go-openapi/spec v0.19.2/go.mod h1:sCxk3jxKgioEJikev4fgkNmwS+3kuYdJtcsZsD5zxMY=
@@ -903,6 +913,7 @@ github.com/go-openapi/strfmt v0.21.0/go.mod h1:ZRQ409bWMj+SOgXofQAGTIo2Ebu72Gs+W
 github.com/go-openapi/strfmt v0.21.1/go.mod h1:I/XVKeLc5+MM5oPNN7P6urMOpuLXEcNrCX/rPGuWb0k=
 github.com/go-openapi/strfmt v0.21.2 h1:5NDNgadiX1Vhemth/TH4gCGopWSTdDjxl60H3B7f+os=
 github.com/go-openapi/strfmt v0.21.2/go.mod h1:I/XVKeLc5+MM5oPNN7P6urMOpuLXEcNrCX/rPGuWb0k=
+github.com/go-openapi/swag v0.0.0-20160704191624-1d0bd113de87/go.mod h1:DXUve3Dpr1UfpPtxFw+EFuQ41HhCWZfha5jSVRG7C7I=
 github.com/go-openapi/swag v0.17.0/go.mod h1:AByQ+nYG6gQg71GINrmuDXCPWdL640yX49/kXLo40Tg=
 github.com/go-openapi/swag v0.18.0/go.mod h1:AByQ+nYG6gQg71GINrmuDXCPWdL640yX49/kXLo40Tg=
 github.com/go-openapi/swag v0.19.2/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
@@ -922,8 +933,9 @@ github.com/go-openapi/validate v0.19.10/go.mod h1:RKEZTUWDkxKQxN2jDT7ZnZi2bhZlbN
 github.com/go-openapi/validate v0.19.12/go.mod h1:Rzou8hA/CBw8donlS6WNEUQupNvUZ0waH08tGe6kAQ4=
 github.com/go-openapi/validate v0.19.15/go.mod h1:tbn/fdOwYHgrhPBzidZfJC2MIVvs9GA7monOmWBbeCI=
 github.com/go-openapi/validate v0.20.1/go.mod h1:b60iJT+xNNLfaQJUqLI7946tYiFEOuE9E4k54HpKcJ0=
-github.com/go-openapi/validate v0.20.3 h1:GZPPhhKSZrE8HjB4eEkoYAZmoWA4+tCemSgINH1/vKw=
 github.com/go-openapi/validate v0.20.3/go.mod h1:goDdqVGiigM3jChcrYJxD2joalke3ZXeftD16byIjA4=
+github.com/go-openapi/validate v0.21.0 h1:+Wqk39yKOhfpLqNLEC0/eViCkzM5FVXVqrvt526+wcI=
+github.com/go-openapi/validate v0.21.0/go.mod h1:rjnrwK57VJ7A8xqfpAOEKRH8yQSGUriMu5/zuPSQ1hg=
 github.com/go-piv/piv-go v1.9.0 h1:P6j2gjfP7zO7T3nCk/jwCgsvFRwB8shEqAJ4q85jgXc=
 github.com/go-piv/piv-go v1.9.0/go.mod h1:NZ2zmjVkfFaL/CF8cVQ/pXdXtuj110zEKGdJM6fJZZM=
 github.com/go-playground/assert/v2 v2.0.1 h1:MsBgLAaY856+nPRTKrp3/OZK38U/wa0CcBYNjji3q3A=
@@ -951,8 +963,9 @@ github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG
 github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
 github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
 github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
-github.com/go-stack/stack v1.8.0 h1:5SgMzNM5HxrEjV0ww2lTmX6E2Izsfxas4+YHWRs3Lsk=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/go-stack/stack v1.8.1 h1:ntEHSVwIt7PNXNpgPmVfMrNhLtgjlmnZha2kOpuRiDw=
+github.com/go-stack/stack v1.8.1/go.mod h1:dcoOX6HbPZSZptuspn9bctJ+N/CnF5gGygcUP3XYfe4=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
 github.com/go-test/deep v1.0.2/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
 github.com/go-test/deep v1.0.7/go.mod h1:QV8Hv/iy04NyLBxAdO9njL0iVPN1S4d/A3NVv1V36o8=
@@ -1336,10 +1349,12 @@ github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/J
 github.com/hashicorp/serf v0.9.5/go.mod h1:UWDWwZeL5cuWDJdl0C6wrvrUwEqtQ4ZKBKKENpqIUyk=
 github.com/hashicorp/serf v0.9.6/go.mod h1:TXZNMjZQijwlDvp+r0b63xZ45H7JmCmgg4gpTwn9UV4=
 github.com/hashicorp/vault/api v1.3.0/go.mod h1:EabNQLI0VWbWoGlA+oBLC8PXmR9D60aUVgQGvangFWQ=
-github.com/hashicorp/vault/api v1.3.1 h1:pkDkcgTh47PRjY1NEFeofqR4W/HkNUi9qIakESO2aRM=
 github.com/hashicorp/vault/api v1.3.1/go.mod h1:QeJoWxMFt+MsuWcYhmwRLwKEXrjwAFFywzhptMsTIUw=
-github.com/hashicorp/vault/sdk v0.3.0 h1:kR3dpxNkhh/wr6ycaJYqp6AFT/i2xaftbfnwZduTKEY=
+github.com/hashicorp/vault/api v1.4.1 h1:mWLfPT0RhxBitjKr6swieCEP2v5pp/M//t70S3kMLRo=
+github.com/hashicorp/vault/api v1.4.1/go.mod h1:LkMdrZnWNrFaQyYYazWVn7KshilfDidgVBq6YiTq/bM=
 github.com/hashicorp/vault/sdk v0.3.0/go.mod h1:aZ3fNuL5VNydQk8GcLJ2TV8YCRVvyaakYkhZRoVuhj0=
+github.com/hashicorp/vault/sdk v0.4.1 h1:3SaHOJY687jY1fnB61PtL0cOkKItphrbLmux7T92HBo=
+github.com/hashicorp/vault/sdk v0.4.1/go.mod h1:aZ3fNuL5VNydQk8GcLJ2TV8YCRVvyaakYkhZRoVuhj0=
 github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
 github.com/hashicorp/yamux v0.0.0-20211028200310-0bc27b27de87 h1:xixZ2bWeofWV68J+x6AzmKuVM/JWCQwkWm6GW/MUR6I=
 github.com/hashicorp/yamux v0.0.0-20211028200310-0bc27b27de87/go.mod h1:CtWFDAQgb7dxtzFs4tWbplKIe2jSi3+5vKbgIO0SLnQ=
@@ -1501,6 +1516,7 @@ github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czP
 github.com/magiconair/properties v1.8.4/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
 github.com/magiconair/properties v1.8.5 h1:b6kJs+EmPFMYGkow9GiUyCyOvIwYetYJ3fSaWak/Gls=
 github.com/magiconair/properties v1.8.5/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
+github.com/mailru/easyjson v0.0.0-20160728113105-d5b7844b561a/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20180823135443-60711f1a8329/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20190312143242-1de009706dbe/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
@@ -1910,8 +1926,9 @@ github.com/scylladb/go-set v1.0.2/go.mod h1:DkpGd78rljTxKAnTDPFqXSGxvETQnJyuSOQw
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
 github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvWlF4P2Ca7zGrPiEpWo=
 github.com/secure-systems-lab/go-securesystemslib v0.2.0/go.mod h1:eIjBmIP8LD2MLBL/DkQWayLiz006Q4p+hCu79rvWleY=
-github.com/secure-systems-lab/go-securesystemslib v0.3.0 h1:PH0mUKuUSXVEVDbrKMgGPcrqrnKA8gJii614+EKKi7g=
 github.com/secure-systems-lab/go-securesystemslib v0.3.0/go.mod h1:o8hhjkbNl2gOamKUA/eNW3xUrntHT9L4W89W1nfj43U=
+github.com/secure-systems-lab/go-securesystemslib v0.3.1 h1:LJuyMziazadwmQRRu1M7GMUo5S1oH1+YxU9FjuSFU8k=
+github.com/secure-systems-lab/go-securesystemslib v0.3.1/go.mod h1:o8hhjkbNl2gOamKUA/eNW3xUrntHT9L4W89W1nfj43U=
 github.com/securego/gosec/v2 v2.9.1/go.mod h1:oDcDLcatOJxkCGaCaq8lua1jTnYf6Sou4wdiJ1n4iHc=
 github.com/segmentio/ksuid v1.0.4 h1:sBo2BdShXjmcugAMwjugoGUdUV0pcxY5mW4xKRn3v4c=
 github.com/segmentio/ksuid v1.0.4/go.mod h1:/XUiZBD3kVx5SmUOl55voK5yeAbBNNIed+2O73XgrPE=
@@ -1927,8 +1944,8 @@ github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFR
 github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk=
 github.com/shurcooL/go-goon v0.0.0-20170922171312-37c2f522c041/go.mod h1:N5mDOmsrJOB+vfqUK+7DmDyjhSLIIBnXo9lvZJj3MWQ=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
-github.com/sigstore/cosign v1.5.2-0.20220222220736-ec79daf63c24 h1:DzEiTgBIVtBY8zGLYmSNJltvaCLIOz7hAUbCsClsvRw=
-github.com/sigstore/cosign v1.5.2-0.20220222220736-ec79daf63c24/go.mod h1:eedJzrb6Lf1Bq2nA3ipcNHE61Lgkpvt3hmxfZAMi02I=
+github.com/sigstore/cosign v1.6.0 h1:GBG+asPgsf2iawldL9uO8JDGbFO5yXuvaBTjdejsMzo=
+github.com/sigstore/cosign v1.6.0/go.mod h1:Ocd28z0Pwtd6+A8s/Vb4SbhwuWOqVdeYAW4yCGF4Ndg=
 github.com/sigstore/fulcio v0.1.2-0.20220114150912-86a2036f9bc7 h1:XE7A9lJ+wYhmUFBWYTaw3Ph943zHB4iBYd5R0SX0ZOA=
 github.com/sigstore/fulcio v0.1.2-0.20220114150912-86a2036f9bc7/go.mod h1:ANQivY/lfOp9hN92S813LEthkm/kit96hzeIF3SNoZA=
 github.com/sigstore/rekor v0.4.1-0.20220114213500-23f583409af3 h1:mbqXrm8YZXN/cJMGeBkgPnswtfrOxDE1f7QZdJ+POQE=
@@ -2007,8 +2024,8 @@ github.com/spf13/viper v1.9.0/go.mod h1:+i6ajR7OX2XaiBkrcZJFK21htRk7eDeLg7+O6bhU
 github.com/spf13/viper v1.10.0/go.mod h1:SoyBPwAtKDzypXNDFKN5kzH7ppppbGZtls1UpIy5AsM=
 github.com/spf13/viper v1.10.1 h1:nuJZuYpG7gTj/XqiUwg8bA0cp1+M2mC3J4g5luUYBKk=
 github.com/spf13/viper v1.10.1/go.mod h1:IGlFPqhNAPKRxohIzWpI5QEy4kuI7tcl5WvR+8qy1rU=
-github.com/spiffe/go-spiffe/v2 v2.0.0-beta.11 h1:YBSTauKWMRhexLkyz0QD1wJ3xblC8q3c55xfB8DngAM=
-github.com/spiffe/go-spiffe/v2 v2.0.0-beta.11/go.mod h1:TEfgrEcyFhuSuvqohJt6IxENUNeHfndWCCV1EX7UaVk=
+github.com/spiffe/go-spiffe/v2 v2.0.0-beta.12 h1:Lh9MRyNNsAbGbMiKbVHDw+qk/DlkjS9wBTlH8v7OnaA=
+github.com/spiffe/go-spiffe/v2 v2.0.0-beta.12/go.mod h1:TEfgrEcyFhuSuvqohJt6IxENUNeHfndWCCV1EX7UaVk=
 github.com/src-d/gcfg v1.4.0/go.mod h1:p/UMsR43ujA89BJY9duynAwIpvqEujIH/jFlfL7jWoI=
 github.com/ssgreg/nlreturn/v2 v2.2.1/go.mod h1:E/iiPB78hV7Szg2YfRgyIrk1AD6JVMTRkkxBiELzh2I=
 github.com/stefanberger/go-pkcs11uri v0.0.0-20201008174630-78d3cae3a980/go.mod h1:AO3tvPzVZ/ayst6UlUKUv6rcPQInYe3IknH3jYhAKu8=
@@ -2132,8 +2149,8 @@ github.com/withfig/autocomplete-tools/packages/cobra v0.0.0-20220122124547-31d38
 github.com/x-cray/logrus-prefixed-formatter v0.5.2 h1:00txxvfBM9muc0jiLIEAkAcIMJzfthRT6usrui8uGmg=
 github.com/x-cray/logrus-prefixed-formatter v0.5.2/go.mod h1:2duySbKsL6M18s5GU7VPsoEPHyzalCE06qoARUCeBBE=
 github.com/xanzy/go-gitlab v0.31.0/go.mod h1:sPLojNBn68fMUWSxIJtdVVIP8uSBYqesTfDUseX11Ug=
-github.com/xanzy/go-gitlab v0.55.1 h1:IgX/DS9buV0AUz8fuJPQkdl0fQGfBiAsAHxpun8sNhg=
-github.com/xanzy/go-gitlab v0.55.1/go.mod h1:F0QEXwmqiBUxCgJm8fE9S+1veX4XC9Z4cfaAbqwk4YM=
+github.com/xanzy/go-gitlab v0.56.0 h1:/QHBvk3IKVNwvXB/UOWVb5J6VCN6r2bg9/WxjUbFY/0=
+github.com/xanzy/go-gitlab v0.56.0/go.mod h1:F0QEXwmqiBUxCgJm8fE9S+1veX4XC9Z4cfaAbqwk4YM=
 github.com/xanzy/ssh-agent v0.2.1/go.mod h1:mLlQY/MoOhWBj+gOGMQkOeiEvkx+8pJSI+0Bx9h2kr4=
 github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
 github.com/xdg-go/scram v1.0.2/go.mod h1:1WAq6h33pAW+iRreB34OORO2Nf7qel3VV3fjBj+hCSs=
@@ -2234,8 +2251,9 @@ go.mongodb.org/mongo-driver v1.4.4/go.mod h1:WcMNYLx/IlOxLe6JRJiv2uXuCz6zBLndR4S
 go.mongodb.org/mongo-driver v1.4.6/go.mod h1:WcMNYLx/IlOxLe6JRJiv2uXuCz6zBLndR4SoGjYphSc=
 go.mongodb.org/mongo-driver v1.5.1/go.mod h1:gRXCHX4Jo7J0IJ1oDQyUxF7jfy19UfxniMS4xxMmUqw=
 go.mongodb.org/mongo-driver v1.7.3/go.mod h1:NqaYOwnXWr5Pm7AOpO5QFxKJ503nbMse/R79oO62zWg=
-go.mongodb.org/mongo-driver v1.7.5 h1:ny3p0reEpgsR2cfA5cjgwFZg3Cv/ofFh/8jbhGtz9VI=
 go.mongodb.org/mongo-driver v1.7.5/go.mod h1:VXEWRZ6URJIkUq2SCAyapmhH0ZLRBP+FT4xhp5Zvxng=
+go.mongodb.org/mongo-driver v1.8.3 h1:TDKlTkGDKm9kkJVUOAXDK5/fkqKHJVwYQSpoRfB43R4=
+go.mongodb.org/mongo-driver v1.8.3/go.mod h1:0sQWfOeY63QTntERDJJ/0SuKK0T1uVSgKCuAROlKEPY=
 go.mozilla.org/mozlog v0.0.0-20170222151521-4bb13139d403/go.mod h1:jHoPAGnDrCy6kaI2tAze5Prf0Nr0w/oNkROt2lw3n3o=
 go.mozilla.org/pkcs7 v0.0.0-20200128120323-432b2356ecb1/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk=
 go.opencensus.io v0.15.0/go.mod h1:UffZAU+4sDEINUGP/B7UfBBkq4fqLu9zXAX7ke6CHW0=
@@ -2302,8 +2320,9 @@ go.uber.org/zap v1.13.0/go.mod h1:zwrFLgMcdUuIBviXEYEH1YKNaOBnKXsx2IPda5bBwHM=
 go.uber.org/zap v1.16.0/go.mod h1:MA8QOfq0BHJwdXa996Y4dYkAqRKB8/1K1QMMZVaNZjQ=
 go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
 go.uber.org/zap v1.19.1/go.mod h1:j3DNczoxDZroyBnOT1L/Q79cfUMGZxlv/9dzN7SM1rI=
-go.uber.org/zap v1.20.0 h1:N4oPlghZwYG55MlU6LXk/Zp00FVNE9X9wrYO8CEs4lc=
 go.uber.org/zap v1.20.0/go.mod h1:wjWOCqI0f2ZZrJF/UufIOkiC8ii6tm1iqIsLo76RfJw=
+go.uber.org/zap v1.21.0 h1:WefMeulhovoZ2sYXz7st6K0sLj7bBhpiFaud4r4zST8=
+go.uber.org/zap v1.21.0/go.mod h1:wjWOCqI0f2ZZrJF/UufIOkiC8ii6tm1iqIsLo76RfJw=
 gocloud.dev v0.19.0/go.mod h1:SmKwiR8YwIMMJvQBKLsC3fHNyMwXLw3PMDO+VVteJMI=
 gocloud.dev v0.24.1-0.20211119014450-028788aaaa4c/go.mod h1:EIJSlY7nvfeoWaV2GauF6es27gZfqtTVon47QFueoyE=
 golang.org/x/crypto v0.0.0-20171113213409-9f005a07e0d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
@@ -2339,6 +2358,7 @@ golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20200930160638-afb6bcd081ae/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201112155050-0c6587e931a9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20201216223049-8b5274cf687f/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
 golang.org/x/crypto v0.0.0-20201221181555-eec23a3978ad/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
 golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
@@ -2703,6 +2723,7 @@ golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGm
 golang.org/x/tools v0.0.0-20180525024113-a5b4c53f6e8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20181011042414-1f849cf54d09/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190110163146-51295c7ec13a/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -3136,6 +3157,7 @@ k8s.io/api v0.22.5/go.mod h1:mEhXyLaSD1qTOf40rRiKXkc+2iCem09rWLlFwhCEiAs=
 k8s.io/api v0.23.3 h1:KNrME8KHGr12Ozjf8ytOewKzZh6hl/hHUZeHddT3a38=
 k8s.io/api v0.23.3/go.mod h1:w258XdGyvCmnBj/vGzQMj6kzdufJZVUwEM1U2fRJwSQ=
 k8s.io/apiextensions-apiserver v0.22.5/go.mod h1:tIXeZ0BrDxUb1PoAz+tgOz43Zi1Bp4BEEqVtUccMJbE=
+k8s.io/apimachinery v0.19.7/go.mod h1:6sRbGRAVY5DOCuZwB5XkqguBqpqLU6q/kOaOdk29z6Q=
 k8s.io/apimachinery v0.20.1/go.mod h1:WlLqWAHZGg07AeltaI0MV5uk1Omp8xaN0JGLY6gkRpU=
 k8s.io/apimachinery v0.20.4/go.mod h1:WlLqWAHZGg07AeltaI0MV5uk1Omp8xaN0JGLY6gkRpU=
 k8s.io/apimachinery v0.20.6/go.mod h1:ejZXtW1Ra6V1O5H8xPBGz+T3+4gfkTCeExAHKU57MAc=
@@ -3172,6 +3194,7 @@ k8s.io/klog/v2 v2.9.0/go.mod h1:hy9LJ/NvuK+iVyP4Ehqva4HxZG/oXyIS3n3Jmire4Ec=
 k8s.io/klog/v2 v2.30.0/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
 k8s.io/klog/v2 v2.40.1 h1:P4RRucWk/lFOlDdkAr3mc7iWFkgKrZY9qZMAgek06S4=
 k8s.io/klog/v2 v2.40.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
+k8s.io/kube-openapi v0.0.0-20200805222855-6aeccd4b50c6/go.mod h1:UuqjUnNftUyPE5H64/qeyjQoUZhGpeFDVdxjTeEVN2o=
 k8s.io/kube-openapi v0.0.0-20201113171705-d219536bb9fd/go.mod h1:WOJ3KddDSol4tAGcJo0Tvi+dK12EcqSLqcWsryKMpfM=
 k8s.io/kube-openapi v0.0.0-20211109043538-20434351676c/go.mod h1:vHXdDvt9+2spS2Rx9ql3I8tycm3H9FDfdUoIuKCefvw=
 k8s.io/kube-openapi v0.0.0-20211115234752-e816edb12b65/go.mod h1:sX9MT8g7NVZM5lVL/j8QyCCJe8YSMW30QvGZWaCIDIk=
@@ -3186,6 +3209,7 @@ k8s.io/utils v0.0.0-20211116205334-6203023598ed/go.mod h1:jPW/WVKK9YHAvNhRxK0md/
 k8s.io/utils v0.0.0-20220127004650-9b3446523e65 h1:ONWS0Wgdg5wRiQIAui7L/023aC9+IxrIrydY7l8llsE=
 k8s.io/utils v0.0.0-20220127004650-9b3446523e65/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
 knative.dev/hack v0.0.0-20220118141833-9b2ed8471e30/go.mod h1:PHt8x8yX5Z9pPquBEfIj0X66f8iWkWfR0S/sarACJrI=
+knative.dev/hack/schema v0.0.0-20220224013837-e1785985d364/go.mod h1:ffjwmdcrH5vN3mPhO8RrF2KfNnbHeCE2C60A+2cv3U0=
 knative.dev/pkg v0.0.0-20220202132633-df430fa0dd96 h1:JU0DFa06CaUtwSkAY0b3j47ohEJLIYlpPPgNgbPHlAo=
 knative.dev/pkg v0.0.0-20220202132633-df430fa0dd96/go.mod h1:etVT7Tm8pSDf4RKhGk4r7j/hj3dNBpvT7bO6a6wpahs=
 mvdan.cc/gofumpt v0.1.1/go.mod h1:yXG1r1WqZVKWbVRtBWKWX9+CxGYfA51nSomhM0woR48=
@@ -3206,6 +3230,7 @@ sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2 h1:kDi4JBNAsJWfz1aEXhO8Jg87J
 sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2/go.mod h1:B+TnT182UBxE84DiCz4CVE26eOSDAeYCpfDnC2kdKMY=
 sigs.k8s.io/release-utils v0.4.1-0.20220207182343-6dadf2228617 h1:qbKzP8fFAdlnj4WqB9KrAuW4ply+bUQkdRlVrH4Jus0=
 sigs.k8s.io/release-utils v0.4.1-0.20220207182343-6dadf2228617/go.mod h1:t9pL38kZkTBVDcjL1y7ajrkNQFLiArVAjOVO0sxzFF0=
+sigs.k8s.io/structured-merge-diff/v4 v4.0.1/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
 sigs.k8s.io/structured-merge-diff/v4 v4.0.2/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
 sigs.k8s.io/structured-merge-diff/v4 v4.0.3/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
 sigs.k8s.io/structured-merge-diff/v4 v4.1.2/go.mod h1:j/nl6xW8vLS49O8YvXW1ocPhZawJtm+Yrr7PPRQ0Vg4=

internal/config/application.go

@@ -30,7 +30,7 @@ type parser interface {
 // Application is the main syft application configuration.
 type Application struct {
 	ConfigPath         string             `yaml:",omitempty" json:"configPath"`                                                         // the location where the application config was read from (either from -c or discovered while loading)
-	Output             []string           `yaml:"output" json:"output" mapstructure:"output"`                                           // -o, the format to use for output
+	Outputs            []string           `yaml:"output" json:"output" mapstructure:"output"`                                           // -o, the format to use for output
 	File               string             `yaml:"file" json:"file" mapstructure:"file"`                                                 // --file, the file to write report output to
 	Quiet              bool               `yaml:"quiet" json:"quiet" mapstructure:"quiet"`                                              // -q, indicates to not show any status output to stderr (ETUI or logging UI)
 	CheckForAppUpdate  bool               `yaml:"check-for-app-update" json:"check-for-app-update" mapstructure:"check-for-app-update"` // whether to check for an application update on start up or not
@@ -46,6 +46,7 @@ type Application struct {
 	Registry           registry           `yaml:"registry" json:"registry" mapstructure:"registry"`
 	Exclusions         []string           `yaml:"exclude" json:"exclude" mapstructure:"exclude"`
 	Attest             attest             `yaml:"attest" json:"attest" mapstructure:"attest"`
+	Platform           string             `yaml:"platform" json:"platform" mapstructure:"platform"`
 }
 
 // PowerUserCatalogerEnabledDefault switches all catalogers to be enabled when running power-user command
@@ -103,6 +104,7 @@ func (cfg *Application) parseConfigValues() error {
 	for _, optionFn := range []func() error{
 		cfg.parseUploadOptions,
 		cfg.parseLogLevelOption,
+		cfg.parseFile,
 	} {
 		if err := optionFn(); err != nil {
 			return err
@@ -125,6 +127,17 @@ func (cfg *Application) parseConfigValues() error {
 	return nil
 }
 
+func (cfg *Application) parseFile() error {
+	if cfg.File != "" {
+		expandedPath, err := homedir.Expand(cfg.File)
+		if err != nil {
+			return fmt.Errorf("unable to expand file path=%q: %w", cfg.File, err)
+		}
+		cfg.File = expandedPath
+	}
+	return nil
+}
+
 func (cfg *Application) parseUploadOptions() error {
 	if cfg.Anchore.Host == "" && cfg.Anchore.Dockerfile != "" {
 		return fmt.Errorf("cannot provide dockerfile option without enabling upload")

internal/config/application_test.go

@@ -0,0 +1,52 @@
+package config
+
+import (
+	"github.com/docker/docker/pkg/homedir"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"path/filepath"
+	"testing"
+)
+
+func TestApplication_parseFile(t *testing.T) {
+	tests := []struct {
+		name     string
+		config   Application
+		expected string
+		wantErr  require.ErrorAssertionFunc
+	}{
+		{
+			name: "expand home dir",
+			config: Application{
+				File: "~/place.txt",
+			},
+			expected: filepath.Join(homedir.Get(), "place.txt"),
+		},
+		{
+			name: "passthrough other paths",
+			config: Application{
+				File: "/other/place.txt",
+			},
+			expected: "/other/place.txt",
+		},
+		{
+			name: "no path",
+			config: Application{
+				File: "",
+			},
+			expected: "",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg := tt.config
+
+			if tt.wantErr == nil {
+				tt.wantErr = require.NoError
+			}
+
+			tt.wantErr(t, cfg.parseFile())
+			assert.Equal(t, tt.expected, cfg.File)
+		})
+	}
+}

internal/config/attest.go

@@ -1,19 +1,28 @@
 package config
 
 import (
+	"fmt"
 	"os"
 
+	"github.com/mitchellh/go-homedir"
 	"github.com/spf13/viper"
 )
 
 type attest struct {
-	Key string `yaml:"key" json:"key" mapstructure:"key"`
+	Key string `yaml:"key" json:"key" mapstructure:"key"` // same as --key, file path to the private key
 	// IMPORTANT: do not show the password in any YAML/JSON output (sensitive information)
-	Password string `yaml:"-" json:"-" mapstructure:"password"`
+	Password string `yaml:"-" json:"-" mapstructure:"password"` // password for the private key
 }
 
-//nolint:unparam
 func (cfg *attest) parseConfigValues() error {
+	if cfg.Key != "" {
+		expandedPath, err := homedir.Expand(cfg.Key)
+		if err != nil {
+			return fmt.Errorf("unable to expand key path=%q: %w", cfg.Key, err)
+		}
+		cfg.Key = expandedPath
+	}
+
 	if cfg.Password == "" {
 		// we allow for configuration via syft config/env vars and additionally interop with known cosign config env vars
 		if pw, ok := os.LookupEnv("COSIGN_PASSWORD"); ok {

internal/config/logging.go

@@ -1,6 +1,9 @@
 package config
 
 import (
+	"fmt"
+
+	"github.com/mitchellh/go-homedir"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/viper"
 )
@@ -13,6 +16,17 @@ type logging struct {
 	FileLocation string       `yaml:"file" json:"file-location" mapstructure:"file"`          // the file path to write logs to
 }
 
+func (cfg *logging) parseConfigValues() error {
+	if cfg.FileLocation != "" {
+		expandedPath, err := homedir.Expand(cfg.FileLocation)
+		if err != nil {
+			return fmt.Errorf("unable to expand log file path=%q: %w", cfg.FileLocation, err)
+		}
+		cfg.FileLocation = expandedPath
+	}
+	return nil
+}
+
 func (cfg logging) loadDefaultValues(v *viper.Viper) {
 	v.SetDefault("log.structured", false)
 	v.SetDefault("log.file", "")

internal/constants.go

@@ -6,5 +6,5 @@ const (
 
 	// JSONSchemaVersion is the current schema version output by the JSON encoder
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "3.0.1"
+	JSONSchemaVersion = "3.1.0"
 )

internal/formats/common/cyclonedxhelpers/component.go

@@ -1,18 +1,30 @@
 package cyclonedxhelpers
 
 import (
-	"fmt"
 	"reflect"
-	"strconv"
 
 	"github.com/CycloneDX/cyclonedx-go"
 
-	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/formats/common"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
 )
 
 func encodeComponent(p pkg.Package) cyclonedx.Component {
+	props := encodeProperties(p, "syft:package")
+	props = append(props, encodeCPEs(p)...)
+	if len(p.Locations) > 0 {
+		props = append(props, encodeProperties(p.Locations, "syft:location")...)
+	}
+	if hasMetadata(p) {
+		props = append(props, encodeProperties(p.Metadata, "syft:metadata")...)
+	}
+
+	var properties *[]cyclonedx.Property
+	if len(props) > 0 {
+		properties = &props
+	}
+
 	return cyclonedx.Component{
 		Type:               cyclonedx.ComponentTypeLibrary,
 		Name:               p.Name,
@@ -20,12 +32,12 @@ func encodeComponent(p pkg.Package) cyclonedx.Component {
 		Version:            p.Version,
 		PackageURL:         p.PURL,
 		Licenses:           encodeLicenses(p),
-		CPE:                encodeCPE(p),
+		CPE:                encodeSingleCPE(p),
 		Author:             encodeAuthor(p),
 		Publisher:          encodePublisher(p),
 		Description:        encodeDescription(p),
 		ExternalReferences: encodeExternalReferences(p),
-		Properties:         encodeProperties(p),
+		Properties:         properties,
 	}
 }
 
@@ -34,131 +46,56 @@ func hasMetadata(p pkg.Package) bool {
 }
 
 func decodeComponent(c *cyclonedx.Component) *pkg.Package {
-	typ := pkg.Type(findPropertyValue(c, "type"))
-	purl := c.PackageURL
-	if typ == "" && purl != "" {
-		typ = pkg.TypeFromPURL(purl)
+	values := map[string]string{}
+	for _, p := range *c.Properties {
+		values[p.Name] = p.Value
 	}
 
-	metaType, meta := decodePackageMetadata(c)
-
 	p := &pkg.Package{
-		Name:         c.Name,
-		Version:      c.Version,
-		FoundBy:      findPropertyValue(c, "foundBy"),
-		Locations:    decodeLocations(c),
-		Licenses:     decodeLicenses(c),
-		Language:     pkg.Language(findPropertyValue(c, "language")),
-		Type:         typ,
-		CPEs:         decodeCPEs(c),
-		PURL:         purl,
-		MetadataType: metaType,
-		Metadata:     meta,
+		Name:      c.Name,
+		Version:   c.Version,
+		Locations: decodeLocations(values),
+		Licenses:  decodeLicenses(c),
+		CPEs:      decodeCPEs(c),
+		PURL:      c.PackageURL,
+	}
+
+	common.DecodeInto(p, values, "syft:package", CycloneDXFields)
+
+	p.Metadata = decodePackageMetadata(values, c, p.MetadataType)
+
+	if p.Type == "" {
+		p.Type = pkg.TypeFromPURL(p.PURL)
 	}
 
 	return p
 }
 
-func decodeLocations(c *cyclonedx.Component) (out []source.Location) {
-	if c.Properties != nil {
-		props := *c.Properties
-		for i := 0; i < len(props)-1; i++ {
-			if props[i].Name == "path" && props[i+1].Name == "layerID" {
-				out = append(out, source.Location{
-					Coordinates: source.Coordinates{
-						RealPath:     props[i].Value,
-						FileSystemID: props[i+1].Value,
-					},
-				})
-				i++
-			}
-		}
-	}
-	return
+func decodeLocations(vals map[string]string) []source.Location {
+	v := common.Decode(reflect.TypeOf([]source.Location{}), vals, "syft:location", CycloneDXFields)
+	out, _ := v.([]source.Location)
+	return out
 }
 
-func mapAllProps(c *cyclonedx.Component, obj reflect.Value) {
-	value := obj
-	if value.Kind() == reflect.Ptr {
-		value = value.Elem()
+func decodePackageMetadata(vals map[string]string, c *cyclonedx.Component, typ pkg.MetadataType) interface{} {
+	if typ != "" && c.Properties != nil {
+		metaTyp, ok := pkg.MetadataTypeByName[typ]
+		if !ok {
+			return nil
+		}
+		metaPtrTyp := reflect.PtrTo(metaTyp)
+		metaPtr := common.Decode(metaPtrTyp, vals, "syft:metadata", CycloneDXFields)
+
+		// Map all explicit metadata properties
+		decodeAuthor(c.Author, metaPtr)
+		decodeGroup(c.Group, metaPtr)
+		decodePublisher(c.Publisher, metaPtr)
+		decodeDescription(c.Description, metaPtr)
+		decodeExternalReferences(c, metaPtr)
+
+		// return the actual interface{} -> struct ... not interface{} -> *struct
+		return common.PtrToStruct(metaPtr)
 	}
 
-	structType := value.Type()
-	if structType.Kind() != reflect.Struct {
-		return
-	}
-	for i := 0; i < value.NumField(); i++ {
-		field := structType.Field(i)
-		fieldType := field.Type
-		fieldValue := value.Field(i)
-
-		name, mapped := field.Tag.Lookup("cyclonedx")
-		if !mapped {
-			continue
-		}
-
-		if fieldType.Kind() == reflect.Ptr {
-			fieldType = fieldType.Elem()
-			if fieldValue.IsNil() {
-				newValue := reflect.New(fieldType)
-				fieldValue.Set(newValue)
-			}
-			fieldValue = fieldValue.Elem()
-		}
-
-		propertyValue := findPropertyValue(c, name)
-		switch fieldType.Kind() {
-		case reflect.String:
-			if fieldValue.CanSet() {
-				fieldValue.SetString(propertyValue)
-			} else {
-				msg := fmt.Sprintf("unable to set field: %s.%s", structType.Name(), field.Name)
-				log.Info(msg)
-			}
-		case reflect.Bool:
-			if b, err := strconv.ParseBool(propertyValue); err == nil {
-				fieldValue.SetBool(b)
-			}
-		case reflect.Int:
-			if i, err := strconv.Atoi(propertyValue); err == nil {
-				fieldValue.SetInt(int64(i))
-			}
-		case reflect.Float32, reflect.Float64:
-			if i, err := strconv.ParseFloat(propertyValue, 64); err == nil {
-				fieldValue.SetFloat(i)
-			}
-		case reflect.Struct:
-			mapAllProps(c, fieldValue)
-		case reflect.Complex128, reflect.Complex64:
-			fallthrough
-		case reflect.Ptr:
-			msg := fmt.Sprintf("decoding CycloneDX properties to a pointer is not supported: %s.%s", field.Type.Name(), field.Name)
-			log.Warnf(msg)
-		}
-	}
-}
-
-func decodePackageMetadata(c *cyclonedx.Component) (pkg.MetadataType, interface{}) {
-	if c.Properties != nil {
-		typ := pkg.MetadataType(findPropertyValue(c, "metadataType"))
-		if typ != "" {
-			meta := reflect.New(pkg.MetadataTypeByName[typ])
-			metaPtr := meta.Interface()
-
-			// Map all dynamic properties
-			mapAllProps(c, meta.Elem())
-
-			// Map all explicit metadata properties
-			decodeAuthor(c.Author, metaPtr)
-			decodeGroup(c.Group, metaPtr)
-			decodePublisher(c.Publisher, metaPtr)
-			decodeDescription(c.Description, metaPtr)
-			decodeExternalReferences(c, metaPtr)
-
-			// return the actual interface{} | struct ( not interface{} | *struct )
-			return typ, meta.Elem().Interface()
-		}
-	}
-
-	return pkg.UnknownMetadataType, nil
+	return nil
 }

internal/formats/common/cyclonedxhelpers/component_test.go

@@ -4,12 +4,13 @@ import (
 	"testing"
 
 	"github.com/CycloneDX/cyclonedx-go"
+	"github.com/stretchr/testify/assert"
+
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
-	"github.com/stretchr/testify/assert"
 )
 
-func Test_encodeProperties(t *testing.T) {
+func Test_encodeComponentProperties(t *testing.T) {
 	epoch := 2
 	tests := []struct {
 		name     string
@@ -46,13 +47,14 @@ func Test_encodeProperties(t *testing.T) {
 				},
 			},
 			expected: &[]cyclonedx.Property{
-				{Name: "foundBy", Value: "cataloger"},
-				{Name: "path", Value: "test"},
-				{Name: "originPackage", Value: "libc-dev"},
-				{Name: "installedSize", Value: "4096"},
-				{Name: "pullDependencies", Value: "musl-utils"},
-				{Name: "pullChecksum", Value: "Q1p78yvTLG094tHE1+dToJGbmYzQE="},
-				{Name: "gitCommitOfApkPort", Value: "97b1c2842faa3bfa30f5811ffbf16d5ff9f1a479"},
+				{Name: "syft:package:foundBy", Value: "cataloger"},
+				{Name: "syft:location:0:path", Value: "test"},
+				{Name: "syft:metadata:gitCommitOfApkPort", Value: "97b1c2842faa3bfa30f5811ffbf16d5ff9f1a479"},
+				{Name: "syft:metadata:installedSize", Value: "4096"},
+				{Name: "syft:metadata:originPackage", Value: "libc-dev"},
+				{Name: "syft:metadata:pullChecksum", Value: "Q1p78yvTLG094tHE1+dToJGbmYzQE="},
+				{Name: "syft:metadata:pullDependencies", Value: "musl-utils"},
+				{Name: "syft:metadata:size", Value: "0"},
 			},
 		},
 		{
@@ -71,10 +73,10 @@ func Test_encodeProperties(t *testing.T) {
 				},
 			},
 			expected: &[]cyclonedx.Property{
-				{Name: "metadataType", Value: "DpkgMetadata"},
-				{Name: "source", Value: "tzdata-dev"},
-				{Name: "sourceVersion", Value: "1.0"},
-				{Name: "installedSize", Value: "3036"},
+				{Name: "syft:package:metadataType", Value: "DpkgMetadata"},
+				{Name: "syft:metadata:installedSize", Value: "3036"},
+				{Name: "syft:metadata:source", Value: "tzdata-dev"},
+				{Name: "syft:metadata:sourceVersion", Value: "1.0"},
 			},
 		},
 		{
@@ -92,12 +94,12 @@ func Test_encodeProperties(t *testing.T) {
 				},
 			},
 			expected: &[]cyclonedx.Property{
-				{Name: "language", Value: pkg.Go.String()},
-				{Name: "type", Value: "go-module"},
-				{Name: "metadataType", Value: "GolangBinMetadata"},
-				{Name: "goCompiledVersion", Value: "1.17"},
-				{Name: "architecture", Value: "amd64"},
-				{Name: "h1Digest", Value: "h1:KlOXYy8wQWTUJYFgkUI40Lzr06ofg5IRXUK5C7qZt1k="},
+				{Name: "syft:package:language", Value: pkg.Go.String()},
+				{Name: "syft:package:metadataType", Value: "GolangBinMetadata"},
+				{Name: "syft:package:type", Value: "go-module"},
+				{Name: "syft:metadata:architecture", Value: "amd64"},
+				{Name: "syft:metadata:goCompiledVersion", Value: "1.17"},
+				{Name: "syft:metadata:h1Digest", Value: "h1:KlOXYy8wQWTUJYFgkUI40Lzr06ofg5IRXUK5C7qZt1k="},
 			},
 		},
 		{
@@ -121,18 +123,19 @@ func Test_encodeProperties(t *testing.T) {
 				},
 			},
 			expected: &[]cyclonedx.Property{
-				{Name: "type", Value: "rpm"},
-				{Name: "metadataType", Value: "RpmdbMetadata"},
-				{Name: "epoch", Value: "2"},
-				{Name: "release", Value: "1"},
-				{Name: "sourceRpm", Value: "dive-0.9.2-1.src.rpm"},
-				{Name: "size", Value: "12406784"},
+				{Name: "syft:package:metadataType", Value: "RpmdbMetadata"},
+				{Name: "syft:package:type", Value: "rpm"},
+				{Name: "syft:metadata:epoch", Value: "2"},
+				{Name: "syft:metadata:release", Value: "1"},
+				{Name: "syft:metadata:size", Value: "12406784"},
+				{Name: "syft:metadata:sourceRpm", Value: "dive-0.9.2-1.src.rpm"},
 			},
 		},
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, encodeProperties(test.input))
+			c := encodeComponent(test.input)
+			assert.Equal(t, test.expected, c.Properties)
 		})
 	}
 }

internal/formats/common/cyclonedxhelpers/cpe.go

@@ -2,11 +2,12 @@ package cyclonedxhelpers
 
 import (
 	"github.com/CycloneDX/cyclonedx-go"
+
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/pkg"
 )
 
-func encodeCPE(p pkg.Package) string {
+func encodeSingleCPE(p pkg.Package) string {
 	// Since the CPEs in a package are sorted by specificity
 	// we can extract the first CPE as the one to output in cyclonedx
 	if len(p.CPEs) > 0 {
@@ -15,16 +16,42 @@ func encodeCPE(p pkg.Package) string {
 	return ""
 }
 
-func decodeCPEs(c *cyclonedx.Component) []pkg.CPE {
-	// FIXME we not encoding all the CPEs (see above), so here we just use the single provided one
+func encodeCPEs(p pkg.Package) (out []cyclonedx.Property) {
+	for i, c := range p.CPEs {
+		// first CPE is "most specific" and already encoded as the component CPE
+		if i == 0 {
+			continue
+		}
+		out = append(out, cyclonedx.Property{
+			Name:  "syft:cpe23",
+			Value: pkg.CPEString(c),
+		})
+	}
+	return
+}
+
+func decodeCPEs(c *cyclonedx.Component) (out []pkg.CPE) {
 	if c.CPE != "" {
 		cp, err := pkg.NewCPE(c.CPE)
 		if err != nil {
 			log.Warnf("invalid CPE: %s", c.CPE)
 		} else {
-			return []pkg.CPE{cp}
+			out = append(out, cp)
 		}
 	}
 
-	return []pkg.CPE{}
+	if c.Properties != nil {
+		for _, p := range *c.Properties {
+			if p.Name == "syft:cpe23" {
+				cp, err := pkg.NewCPE(p.Value)
+				if err != nil {
+					log.Warnf("invalid CPE: %s", p.Value)
+				} else {
+					out = append(out, cp)
+				}
+			}
+		}
+	}
+
+	return
 }

internal/formats/common/cyclonedxhelpers/cpe_test.go

@@ -3,8 +3,9 @@ package cyclonedxhelpers
 import (
 	"testing"
 
-	"github.com/anchore/syft/syft/pkg"
 	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/syft/syft/pkg"
 )
 
 func Test_encodeCPE(t *testing.T) {
@@ -51,7 +52,7 @@ func Test_encodeCPE(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, encodeCPE(test.input))
+			assert.Equal(t, test.expected, encodeSingleCPE(test.input))
 		})
 	}
 }

internal/formats/common/cyclonedxhelpers/decoder.go

@@ -6,14 +6,13 @@ import (
 
 	"github.com/CycloneDX/cyclonedx-go"
 	"github.com/anchore/syft/syft/artifact"
-	"github.com/anchore/syft/syft/format"
 	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 )
 
-func GetValidator(format cyclonedx.BOMFileFormat) format.Validator {
+func GetValidator(format cyclonedx.BOMFileFormat) sbom.Validator {
 	return func(reader io.Reader) error {
 		bom := &cyclonedx.BOM{}
 		err := cyclonedx.NewBOMDecoder(reader, format).Decode(bom)
@@ -28,7 +27,7 @@ func GetValidator(format cyclonedx.BOMFileFormat) format.Validator {
 	}
 }
 
-func GetDecoder(format cyclonedx.BOMFileFormat) format.Decoder {
+func GetDecoder(format cyclonedx.BOMFileFormat) sbom.Decoder {
 	return func(reader io.Reader) (*sbom.SBOM, error) {
 		bom := &cyclonedx.BOM{}
 		err := cyclonedx.NewBOMDecoder(reader, format).Decode(bom)

internal/formats/common/cyclonedxhelpers/format.go

@@ -4,6 +4,8 @@ import (
 	"time"
 
 	"github.com/CycloneDX/cyclonedx-go"
+	"github.com/google/uuid"
+
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/version"
@@ -11,7 +13,6 @@ import (
 	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
-	"github.com/google/uuid"
 )
 
 func ToFormatModel(s sbom.SBOM) *cyclonedx.BOM {
@@ -74,9 +75,10 @@ func toOSComponent(distro *linux.Release) []cyclonedx.Component {
 	if len(*eRefs) == 0 {
 		eRefs = nil
 	}
-	props := getCycloneDXProperties(*distro)
-	if len(*props) == 0 {
-		props = nil
+	props := encodeProperties(distro, "syft:distro")
+	var properties *[]cyclonedx.Property
+	if len(props) > 0 {
+		properties = &props
 	}
 	return []cyclonedx.Component{
 		{
@@ -93,7 +95,7 @@ func toOSComponent(distro *linux.Release) []cyclonedx.Component {
 			// TODO should we add a PURL?
 			CPE:                distro.CPEName,
 			ExternalReferences: eRefs,
-			Properties:         props,
+			Properties:         properties,
 		},
 	}
 }

internal/formats/common/cyclonedxhelpers/properties.go

@@ -1,87 +1,21 @@
 package cyclonedxhelpers
 
 import (
-	"fmt"
-	"reflect"
-
 	"github.com/CycloneDX/cyclonedx-go"
-	"github.com/anchore/syft/syft/pkg"
+
+	"github.com/anchore/syft/internal/formats/common"
 )
 
-func encodeProperties(p pkg.Package) *[]cyclonedx.Property {
-	props := []cyclonedx.Property{}
-	props = append(props, *getCycloneDXProperties(p)...)
-	if len(p.Locations) > 0 {
-		for _, l := range p.Locations {
-			props = append(props, *getCycloneDXProperties(l.Coordinates)...)
-		}
-	}
-	if hasMetadata(p) {
-		props = append(props, *getCycloneDXProperties(p.Metadata)...)
-	}
-	if len(props) > 0 {
-		return &props
-	}
-	return nil
-}
+var (
+	CycloneDXFields = common.RequiredTag("cyclonedx")
+)
 
-func getCycloneDXProperties(m interface{}) *[]cyclonedx.Property {
-	props := []cyclonedx.Property{}
-	structValue := reflect.ValueOf(m)
-	if structValue.Kind() != reflect.Struct {
-		return &props
+func encodeProperties(obj interface{}, prefix string) (out []cyclonedx.Property) {
+	for _, p := range common.Sorted(common.Encode(obj, prefix, CycloneDXFields)) {
+		out = append(out, cyclonedx.Property{
+			Name:  p.Name,
+			Value: p.Value,
+		})
 	}
-	structType := structValue.Type()
-	for i := 0; i < structValue.NumField(); i++ {
-		if name, value := getCycloneDXPropertyName(structType.Field(i)), getCycloneDXPropertyValue(structValue.Field(i)); name != "" && value != "" {
-			// In the case of the value is a struct and has cyclonedx tag with name "-"
-			// call the getCycloneDXProperties recursively.
-			if name == "-" && reflect.ValueOf(value).Kind() == reflect.Struct {
-				props = append(props, *getCycloneDXProperties(value)...)
-			} else if reflect.ValueOf(value).Kind() == reflect.String {
-				props = append(props, cyclonedx.Property{
-					Name:  name,
-					Value: fmt.Sprint(value),
-				})
-			}
-		}
-	}
-	return &props
-}
-
-func getCycloneDXPropertyName(field reflect.StructField) string {
-	if value, exists := field.Tag.Lookup("cyclonedx"); exists {
-		return value
-	}
-	return ""
-}
-
-func getCycloneDXPropertyValue(field reflect.Value) interface{} {
-	if field.IsZero() {
-		return ""
-	}
-	switch field.Kind() {
-	case reflect.String, reflect.Bool, reflect.Int, reflect.Float32, reflect.Float64, reflect.Complex128, reflect.Complex64:
-		if field.CanInterface() {
-			return fmt.Sprint(field.Interface())
-		}
-		return ""
-	case reflect.Struct:
-		if field.CanInterface() {
-			return field.Interface()
-		}
-		return ""
-	case reflect.Ptr:
-		return getCycloneDXPropertyValue(reflect.Indirect(field))
-	}
-	return ""
-}
-
-func findPropertyValue(c *cyclonedx.Component, name string) string {
-	for _, p := range *c.Properties {
-		if p.Name == name {
-			return p.Value
-		}
-	}
-	return ""
+	return
 }

internal/formats/common/property_encoder.go

@@ -0,0 +1,322 @@
+package common
+
+import (
+	"fmt"
+	"reflect"
+	"sort"
+	"strconv"
+	"strings"
+
+	"github.com/anchore/syft/internal/log"
+)
+
+// FieldName return a flag to indicate this is a valid field and a name to use
+type FieldName func(field reflect.StructField) (string, bool)
+
+// OptionalTag given a tag name, will return the defined tag or fall back to lower camel case field name
+func OptionalTag(tag string) FieldName {
+	return func(f reflect.StructField) (string, bool) {
+		if n, ok := f.Tag.Lookup(tag); ok {
+			return n, true
+		}
+		return lowerFirst(f.Name), true
+	}
+}
+
+// TrimOmitempty trims `,omitempty` from the name
+func TrimOmitempty(fn FieldName) FieldName {
+	return func(f reflect.StructField) (string, bool) {
+		if v, ok := fn(f); ok {
+			return strings.TrimSuffix(v, ",omitempty"), true
+		}
+		return "", false
+	}
+}
+
+// RequiredTag based on the given tag, only use a field if present
+func RequiredTag(tag string) FieldName {
+	return func(f reflect.StructField) (string, bool) {
+		if n, ok := f.Tag.Lookup(tag); ok {
+			return n, true
+		}
+		return "", false
+	}
+}
+
+var (
+	// OptionalJSONTag uses field names defined in json tags, if available
+	OptionalJSONTag = TrimOmitempty(OptionalTag("json"))
+)
+
+// lowerFirst converts the first character of the string to lower case
+func lowerFirst(s string) string {
+	return strings.ToLower(s[0:1]) + s[1:]
+}
+
+// Encode recursively encodes the object's properties as an ordered set of NameValue pairs
+func Encode(obj interface{}, prefix string, fn FieldName) map[string]string {
+	if obj == nil {
+		return nil
+	}
+	props := map[string]string{}
+	encode(props, reflect.ValueOf(obj), prefix, fn)
+	return props
+}
+
+// NameValue a simple type to store stringified name/value pairs
+type NameValue struct {
+	Name  string
+	Value string
+}
+
+// Sorted returns a sorted set of NameValue pairs
+func Sorted(values map[string]string) (out []NameValue) {
+	var keys []string
+	for k := range values {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	for _, k := range keys {
+		out = append(out, NameValue{
+			Name:  k,
+			Value: values[k],
+		})
+	}
+	return
+}
+
+func encode(out map[string]string, value reflect.Value, prefix string, fn FieldName) {
+	if !value.IsValid() || value.Type() == nil {
+		return
+	}
+
+	typ := value.Type()
+
+	switch typ.Kind() {
+	case reflect.Ptr:
+		if value.IsNil() {
+			return
+		}
+		value = value.Elem()
+		encode(out, value, prefix, fn)
+	case reflect.String:
+		v := value.String()
+		if v != "" {
+			out[prefix] = v
+		}
+	case reflect.Bool:
+		v := value.Bool()
+		out[prefix] = strconv.FormatBool(v)
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		v := value.Int()
+		out[prefix] = strconv.FormatInt(v, 10)
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		v := value.Uint()
+		out[prefix] = strconv.FormatUint(v, 10)
+	case reflect.Float32, reflect.Float64:
+		v := value.Float()
+		out[prefix] = fmt.Sprintf("%f", v)
+	case reflect.Array, reflect.Slice:
+		for idx := 0; idx < value.Len(); idx++ {
+			encode(out, value.Index(idx), fmt.Sprintf("%s:%d", prefix, idx), fn)
+		}
+	case reflect.Struct:
+		for i := 0; i < typ.NumField(); i++ {
+			pv := value.Field(i)
+			f := typ.Field(i)
+			name, ok := fieldName(f, prefix, fn)
+			if !ok {
+				continue
+			}
+			encode(out, pv, name, fn)
+		}
+	default:
+		log.Warnf("skipping encoding of unsupported property: %s", prefix)
+	}
+}
+
+// fieldName gets the name of the field using the provided FieldName function
+func fieldName(f reflect.StructField, prefix string, fn FieldName) (string, bool) {
+	name, ok := fn(f)
+	if !ok {
+		return "", false
+	}
+	if name == "" {
+		return prefix, true
+	}
+	if prefix != "" {
+		name = fmt.Sprintf("%s:%s", prefix, name)
+	}
+	return name, true
+}
+
+// Decode based on the given type, applies all values to hydrate a new instance
+func Decode(typ reflect.Type, values map[string]string, prefix string, fn FieldName) interface{} {
+	isPtr := false
+	for typ.Kind() == reflect.Ptr {
+		typ = typ.Elem()
+		isPtr = true
+	}
+
+	isSlice := false
+	if typ.Kind() == reflect.Slice {
+		typ = reflect.PtrTo(typ)
+		isSlice = true
+	}
+
+	v := reflect.New(typ)
+
+	decode(values, v, prefix, fn)
+
+	switch {
+	case isSlice && isPtr:
+		return v.Elem().Interface()
+	case isSlice:
+		return PtrToStruct(v.Elem().Interface())
+	case isPtr:
+		return v.Interface()
+	}
+	return v.Elem().Interface()
+}
+
+// DecodeInto decodes all values to hydrate the given object instance
+func DecodeInto(obj interface{}, values map[string]string, prefix string, fn FieldName) {
+	value := reflect.ValueOf(obj)
+
+	for value.Type().Kind() == reflect.Ptr {
+		value = value.Elem()
+	}
+
+	decode(values, value, prefix, fn)
+}
+
+// nolint: funlen, gocognit, gocyclo
+func decode(vals map[string]string, value reflect.Value, prefix string, fn FieldName) bool {
+	if !value.IsValid() || value.Type() == nil {
+		return false
+	}
+
+	typ := value.Type()
+
+	incoming, valid := vals[prefix]
+	switch typ.Kind() {
+	case reflect.Ptr:
+		t := typ.Elem()
+		v := value
+		if v.IsNil() {
+			v = reflect.New(t)
+		}
+		if decode(vals, v.Elem(), prefix, fn) && value.CanSet() {
+			o := v.Interface()
+			log.Infof("%v", o)
+			value.Set(v)
+		} else {
+			return false
+		}
+	case reflect.String:
+		if valid {
+			value.SetString(incoming)
+		} else {
+			return false
+		}
+	case reflect.Bool:
+		if !valid {
+			return false
+		}
+		if b, err := strconv.ParseBool(incoming); err == nil {
+			value.SetBool(b)
+		} else {
+			return false
+		}
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		if !valid {
+			return false
+		}
+		if i, err := strconv.ParseInt(incoming, 10, 64); err == nil {
+			value.SetInt(i)
+		} else {
+			return false
+		}
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		if !valid {
+			return false
+		}
+		if i, err := strconv.ParseUint(incoming, 10, 64); err == nil {
+			value.SetUint(i)
+		} else {
+			return false
+		}
+	case reflect.Float32, reflect.Float64:
+		if !valid {
+			return false
+		}
+		if i, err := strconv.ParseFloat(incoming, 64); err == nil {
+			value.SetFloat(i)
+		} else {
+			return false
+		}
+	case reflect.Array, reflect.Slice:
+		values := false
+		t := typ.Elem()
+		slice := reflect.MakeSlice(typ, 0, 0)
+		for idx := 0; ; idx++ {
+			// test for index
+			str := fmt.Sprintf("%s:%d", prefix, idx)
+			// create new placeholder and decode values
+			newType := t
+			if t.Kind() == reflect.Ptr {
+				newType = t.Elem()
+			}
+			v := reflect.New(newType)
+			if decode(vals, v.Elem(), str, fn) {
+				// append to slice
+				if t.Kind() != reflect.Ptr {
+					v = v.Elem()
+				}
+				slice = reflect.Append(slice, v)
+				values = true
+			} else {
+				break
+			}
+		}
+		if values {
+			value.Set(slice)
+		} else {
+			return false
+		}
+	case reflect.Struct:
+		values := false
+		for i := 0; i < typ.NumField(); i++ {
+			f := typ.Field(i)
+			v := value.Field(i)
+
+			name, ok := fieldName(f, prefix, fn)
+			if !ok {
+				continue
+			}
+
+			if decode(vals, v, name, fn) {
+				values = true
+			}
+		}
+		return values
+	default:
+		log.Warnf("unable to set field: %s", prefix)
+		return false
+	}
+	return true
+}
+
+func PtrToStruct(ptr interface{}) interface{} {
+	v := reflect.ValueOf(ptr)
+	if v.IsZero() {
+		return nil
+	}
+	switch v.Type().Kind() {
+	case reflect.Ptr:
+		return PtrToStruct(v.Elem().Interface())
+	case reflect.Interface:
+		return PtrToStruct(v.Elem().Interface())
+	}
+	return v.Interface()
+}

internal/formats/common/property_encoder_test.go

@@ -0,0 +1,143 @@
+package common
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+type T1 struct {
+	Name     string
+	Val      int
+	ValU     uint
+	Flag     bool `json:"bool_flag"`
+	Float    float64
+	T2       T2
+	T2Ptr    *T2
+	T2Arr    []T2
+	T2PtrArr []*T2
+	StrArr   []string
+	IntArr   []int
+	FloatArr []float64
+	BoolArr  []bool
+	T3Arr    []T3
+}
+
+type T2 struct {
+	Name string
+}
+
+type T3 struct {
+	T4Arr []T4
+}
+
+type T4 struct {
+	Typ    string
+	IntPtr *int
+}
+
+func Test_EncodeDecodeCycle(t *testing.T) {
+	val := 99
+
+	tests := []struct {
+		name  string
+		value interface{}
+	}{
+		{
+			name: "all values",
+			value: T1{
+				Name:  "name",
+				Val:   10,
+				ValU:  16,
+				Flag:  true,
+				Float: 1.2,
+				T2: T2{
+					Name: "embedded t2",
+				},
+				T2Ptr: &T2{
+					"t2 ptr",
+				},
+				T2Arr: []T2{
+					{"t2 elem 0"},
+					{"t2 elem 1"},
+				},
+				T2PtrArr: []*T2{
+					{"t2 ptr v1"},
+					{"t2 ptr v2"},
+				},
+				StrArr:   []string{"s 1", "s 2", "s 3"},
+				IntArr:   []int{9, 12, -1},
+				FloatArr: []float64{-23.99, 15.234321, 39912342314},
+				BoolArr:  []bool{false, true, true, true, false},
+				T3Arr: []T3{
+					{
+						T4Arr: []T4{
+							{
+								Typ: "t4 nested typ 1",
+							},
+							{
+								Typ:    "t4 nested typ 2",
+								IntPtr: &val,
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "nil values",
+			value: T1{
+				Name:     "t1 test",
+				Val:      0,
+				ValU:     0,
+				Flag:     false,
+				Float:    0,
+				T2:       T2{},
+				T2Ptr:    nil,
+				T2Arr:    nil,
+				T2PtrArr: nil,
+				StrArr:   nil,
+				IntArr:   nil,
+				FloatArr: nil,
+				BoolArr:  nil,
+				T3Arr:    nil,
+			},
+		},
+		{
+			name: "array values",
+			value: []T2{
+				{"t2 elem 0"},
+				{"t2 elem 1"},
+			},
+		},
+		{
+			name: "array ptr",
+			value: &[]T2{
+				{"t2 elem 0"},
+				{"t2 elem 1"},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			vals := Encode(test.value, "props", OptionalJSONTag)
+
+			typ := reflect.TypeOf(test.value)
+
+			if typ.Kind() != reflect.Slice && typ.Kind() != reflect.Ptr {
+				assert.NotEmpty(t, vals["props:bool_flag"])
+
+				t2 := T1{}
+				DecodeInto(&t2, vals, "props", OptionalJSONTag)
+
+				assert.EqualValues(t, test.value, t2)
+			}
+
+			t3 := Decode(typ, vals, "props", OptionalJSONTag)
+
+			assert.EqualValues(t, test.value, t3)
+		})
+	}
+}

internal/formats/common/testutils/utils.go

@@ -9,7 +9,6 @@ import (
 	"github.com/anchore/stereoscope/pkg/filetree"
 	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/stereoscope/pkg/imagetest"
-	"github.com/anchore/syft/syft/format"
 	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
@@ -32,7 +31,7 @@ func FromSnapshot() ImageOption {
 	}
 }
 
-func AssertEncoderAgainstGoldenImageSnapshot(t *testing.T, format format.Format, sbom sbom.SBOM, testImage string, updateSnapshot bool, redactors ...redactor) {
+func AssertEncoderAgainstGoldenImageSnapshot(t *testing.T, format sbom.Format, sbom sbom.SBOM, testImage string, updateSnapshot bool, redactors ...redactor) {
 	var buffer bytes.Buffer
 
 	// grab the latest image contents and persist
@@ -66,7 +65,7 @@ func AssertEncoderAgainstGoldenImageSnapshot(t *testing.T, format format.Format,
 	}
 }
 
-func AssertEncoderAgainstGoldenSnapshot(t *testing.T, format format.Format, sbom sbom.SBOM, updateSnapshot bool, redactors ...redactor) {
+func AssertEncoderAgainstGoldenSnapshot(t *testing.T, format sbom.Format, sbom sbom.SBOM, updateSnapshot bool, redactors ...redactor) {
 	var buffer bytes.Buffer
 
 	err := format.Encode(&buffer, sbom)

internal/formats/cyclonedx13xml/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden

@@ -1,62 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.3" serialNumber="urn:uuid:e702d78f-9372-4458-ac38-be8e80fc3005" version="1">
-  <metadata>
-    <timestamp>2022-02-10T17:18:31-05:00</timestamp>
-    <tools>
-      <tool>
-        <vendor>anchore</vendor>
-        <name>syft</name>
-        <version>[not provided]</version>
-      </tool>
-    </tools>
-    <component bom-ref="4f9453fd20e0cf80" type="container">
-      <name>user-image-input</name>
-      <version>sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368</version>
-    </component>
-  </metadata>
-  <components>
-    <component type="library">
-      <name>package-1</name>
-      <version>1.0.1</version>
-      <licenses>
-        <license>
-          <id>MIT</id>
-        </license>
-      </licenses>
-      <cpe>cpe:2.3:*:some:package:1:*:*:*:*:*:*:*</cpe>
-      <purl>a-purl-1</purl>
-      <properties>
-        <property name="foundBy">the-cataloger-1</property>
-        <property name="language">python</property>
-        <property name="type">python</property>
-        <property name="metadataType">PythonPackageMetadata</property>
-        <property name="path">/somefile-1.txt</property>
-        <property name="layerID">sha256:41e7295da66c405eb3a4df29188dcf80f622f9304d487033a86d4a22e3f01abe</property>
-      </properties>
-    </component>
-    <component type="library">
-      <name>package-2</name>
-      <version>2.0.1</version>
-      <cpe>cpe:2.3:*:some:package:2:*:*:*:*:*:*:*</cpe>
-      <purl>a-purl-2</purl>
-      <properties>
-        <property name="foundBy">the-cataloger-2</property>
-        <property name="type">deb</property>
-        <property name="metadataType">DpkgMetadata</property>
-        <property name="path">/somefile-2.txt</property>
-        <property name="layerID">sha256:68a2c166dcb3acf6b7303e995ca1fe7d794bd3b5852a0b4048f9c96b796086aa</property>
-      </properties>
-    </component>
-    <component type="operating-system">
-      <name>debian</name>
-      <version>1.2.3</version>
-      <description>debian</description>
-      <swid tagId="debian" name="debian" version="1.2.3"></swid>
-      <properties>
-        <property name="prettyName">debian</property>
-        <property name="id">debian</property>
-        <property name="versionID">1.2.3</property>
-      </properties>
-    </component>
-  </components>
-</bom>

internal/formats/cyclonedxjson/decoder_test.go

@@ -1,4 +1,4 @@
-package cyclonedx13json
+package cyclonedxjson
 
 import (
 	"fmt"

internal/formats/cyclonedxjson/encoder.go

@@ -1,4 +1,4 @@
-package cyclonedx13json
+package cyclonedxjson
 
 import (
 	"io"

internal/formats/cyclonedxjson/encoder_test.go

@@ -1,4 +1,4 @@
-package cyclonedx13json
+package cyclonedxjson
 
 import (
 	"flag"

internal/formats/cyclonedxjson/format.go

@@ -1,14 +1,16 @@
-package cyclonedx13json
+package cyclonedxjson
 
 import (
 	"github.com/CycloneDX/cyclonedx-go"
 	"github.com/anchore/syft/internal/formats/common/cyclonedxhelpers"
-	"github.com/anchore/syft/syft/format"
+	"github.com/anchore/syft/syft/sbom"
 )
 
-func Format() format.Format {
-	return format.NewFormat(
-		format.CycloneDxJSONOption,
+const ID sbom.FormatID = "cyclonedx-1-json"
+
+func Format() sbom.Format {
+	return sbom.NewFormat(
+		ID,
 		encoder,
 		cyclonedxhelpers.GetDecoder(cyclonedx.BOMFileFormatJSON),
 		cyclonedxhelpers.GetValidator(cyclonedx.BOMFileFormatJSON),

internal/formats/cyclonedxjson/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden

@@ -1,10 +1,10 @@
 {
   "bomFormat": "CycloneDX",
-  "specVersion": "1.3",
-  "serialNumber": "urn:uuid:326afa86-5620-4a80-8f2b-7f283b954b9b",
+  "specVersion": "1.4",
+  "serialNumber": "urn:uuid:498e659b-0758-4a7f-816e-91bee18df634",
   "version": 1,
   "metadata": {
-    "timestamp": "2022-02-10T17:19:38-05:00",
+    "timestamp": "2022-03-08T12:30:39Z",
     "tools": [
       {
         "vendor": "anchore",
@@ -15,8 +15,7 @@
     "component": {
       "bom-ref": "163686ac6e30c752",
       "type": "file",
-      "name": "/some/path",
-      "version": ""
+      "name": "/some/path"
     }
   },
   "components": [
@@ -35,23 +34,23 @@
       "purl": "a-purl-2",
       "properties": [
         {
-          "name": "foundBy",
+          "name": "syft:package:foundBy",
           "value": "the-cataloger-1"
         },
         {
-          "name": "language",
+          "name": "syft:package:language",
           "value": "python"
         },
         {
-          "name": "type",
-          "value": "python"
-        },
-        {
-          "name": "metadataType",
+          "name": "syft:package:metadataType",
           "value": "PythonPackageMetadata"
         },
         {
-          "name": "path",
+          "name": "syft:package:type",
+          "value": "python"
+        },
+        {
+          "name": "syft:location:0:path",
           "value": "/some/path/pkg1"
         }
       ]
@@ -64,20 +63,24 @@
       "purl": "a-purl-2",
       "properties": [
         {
-          "name": "foundBy",
+          "name": "syft:package:foundBy",
           "value": "the-cataloger-2"
         },
         {
-          "name": "type",
-          "value": "deb"
-        },
-        {
-          "name": "metadataType",
+          "name": "syft:package:metadataType",
           "value": "DpkgMetadata"
         },
         {
-          "name": "path",
+          "name": "syft:package:type",
+          "value": "deb"
+        },
+        {
+          "name": "syft:location:0:path",
           "value": "/some/path/pkg1"
+        },
+        {
+          "name": "syft:metadata:installedSize",
+          "value": "0"
         }
       ]
     },
@@ -93,15 +96,19 @@
       },
       "properties": [
         {
-          "name": "prettyName",
+          "name": "syft:distro:id",
           "value": "debian"
         },
         {
-          "name": "id",
+          "name": "syft:distro:idLike:0",
+          "value": "like!"
+        },
+        {
+          "name": "syft:distro:prettyName",
           "value": "debian"
         },
         {
-          "name": "versionID",
+          "name": "syft:distro:versionID",
           "value": "1.2.3"
         }
       ]

internal/formats/cyclonedxjson/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden

@@ -1,10 +1,10 @@
 {
   "bomFormat": "CycloneDX",
-  "specVersion": "1.3",
-  "serialNumber": "urn:uuid:761a2036-0f25-4787-bf28-f5e9a7d9a0bf",
+  "specVersion": "1.4",
+  "serialNumber": "urn:uuid:342c3d2c-d26e-47b6-94d6-92fbf41da945",
   "version": 1,
   "metadata": {
-    "timestamp": "2022-02-10T17:19:38-05:00",
+    "timestamp": "2022-03-08T12:30:39Z",
     "tools": [
       {
         "vendor": "anchore",
@@ -13,7 +13,7 @@
       }
     ],
     "component": {
-      "bom-ref": "4f9453fd20e0cf80",
+      "bom-ref": "711095b1cdf90cce",
       "type": "container",
       "name": "user-image-input",
       "version": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368"
@@ -35,28 +35,28 @@
       "purl": "a-purl-1",
       "properties": [
         {
-          "name": "foundBy",
+          "name": "syft:package:foundBy",
           "value": "the-cataloger-1"
         },
         {
-          "name": "language",
+          "name": "syft:package:language",
           "value": "python"
         },
         {
-          "name": "type",
-          "value": "python"
-        },
-        {
-          "name": "metadataType",
+          "name": "syft:package:metadataType",
           "value": "PythonPackageMetadata"
         },
         {
-          "name": "path",
-          "value": "/somefile-1.txt"
+          "name": "syft:package:type",
+          "value": "python"
         },
         {
-          "name": "layerID",
-          "value": "sha256:41e7295da66c405eb3a4df29188dcf80f622f9304d487033a86d4a22e3f01abe"
+          "name": "syft:location:0:layerID",
+          "value": "sha256:16e64541f2ddf59a90391ce7bb8af90313f7d373f2105d88f3d3267b72e0ebab"
+        },
+        {
+          "name": "syft:location:0:path",
+          "value": "/somefile-1.txt"
         }
       ]
     },
@@ -68,24 +68,28 @@
       "purl": "a-purl-2",
       "properties": [
         {
-          "name": "foundBy",
+          "name": "syft:package:foundBy",
           "value": "the-cataloger-2"
         },
         {
-          "name": "type",
-          "value": "deb"
-        },
-        {
-          "name": "metadataType",
+          "name": "syft:package:metadataType",
           "value": "DpkgMetadata"
         },
         {
-          "name": "path",
+          "name": "syft:package:type",
+          "value": "deb"
+        },
+        {
+          "name": "syft:location:0:layerID",
+          "value": "sha256:de6c235f76ea24c8503ec08891445b5d6a8bdf8249117ed8d8b0b6fb3ebe4f67"
+        },
+        {
+          "name": "syft:location:0:path",
           "value": "/somefile-2.txt"
         },
         {
-          "name": "layerID",
-          "value": "sha256:68a2c166dcb3acf6b7303e995ca1fe7d794bd3b5852a0b4048f9c96b796086aa"
+          "name": "syft:metadata:installedSize",
+          "value": "0"
         }
       ]
     },
@@ -101,15 +105,19 @@
       },
       "properties": [
         {
-          "name": "prettyName",
+          "name": "syft:distro:id",
           "value": "debian"
         },
         {
-          "name": "id",
+          "name": "syft:distro:idLike:0",
+          "value": "like!"
+        },
+        {
+          "name": "syft:distro:prettyName",
           "value": "debian"
         },
         {
-          "name": "versionID",
+          "name": "syft:distro:versionID",
           "value": "1.2.3"
         }
       ]

internal/formats/cyclonedxxml/decoder_test.go

@@ -1,4 +1,4 @@
-package cyclonedx13xml
+package cyclonedxxml
 
 import (
 	"fmt"

internal/formats/cyclonedxxml/encoder.go

@@ -1,4 +1,4 @@
-package cyclonedx13xml
+package cyclonedxxml
 
 import (
 	"io"

internal/formats/cyclonedxxml/encoder_test.go

@@ -1,4 +1,4 @@
-package cyclonedx13xml
+package cyclonedxxml
 
 import (
 	"flag"

internal/formats/cyclonedxxml/format.go

@@ -1,14 +1,16 @@
-package cyclonedx13xml
+package cyclonedxxml
 
 import (
 	"github.com/CycloneDX/cyclonedx-go"
 	"github.com/anchore/syft/internal/formats/common/cyclonedxhelpers"
-	"github.com/anchore/syft/syft/format"
+	"github.com/anchore/syft/syft/sbom"
 )
 
-func Format() format.Format {
-	return format.NewFormat(
-		format.CycloneDxXMLOption,
+const ID sbom.FormatID = "cyclonedx-1-xml"
+
+func Format() sbom.Format {
+	return sbom.NewFormat(
+		ID,
 		encoder,
 		cyclonedxhelpers.GetDecoder(cyclonedx.BOMFileFormatXML),
 		cyclonedxhelpers.GetValidator(cyclonedx.BOMFileFormatXML),

internal/formats/cyclonedxxml/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.3" serialNumber="urn:uuid:25133adc-01af-46ad-a198-002034e54097" version="1">
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" serialNumber="urn:uuid:892f8304-0142-45b1-b411-cade3c53057f" version="1">
   <metadata>
-    <timestamp>2022-02-10T17:18:31-05:00</timestamp>
+    <timestamp>2022-03-08T12:30:33Z</timestamp>
     <tools>
       <tool>
         <vendor>anchore</vendor>
@@ -11,7 +11,6 @@
     </tools>
     <component bom-ref="163686ac6e30c752" type="file">
       <name>/some/path</name>
-      <version></version>
     </component>
   </metadata>
   <components>
@@ -26,11 +25,11 @@
       <cpe>cpe:2.3:*:some:package:2:*:*:*:*:*:*:*</cpe>
       <purl>a-purl-2</purl>
       <properties>
-        <property name="foundBy">the-cataloger-1</property>
-        <property name="language">python</property>
-        <property name="type">python</property>
-        <property name="metadataType">PythonPackageMetadata</property>
-        <property name="path">/some/path/pkg1</property>
+        <property name="syft:package:foundBy">the-cataloger-1</property>
+        <property name="syft:package:language">python</property>
+        <property name="syft:package:metadataType">PythonPackageMetadata</property>
+        <property name="syft:package:type">python</property>
+        <property name="syft:location:0:path">/some/path/pkg1</property>
       </properties>
     </component>
     <component type="library">
@@ -39,10 +38,11 @@
       <cpe>cpe:2.3:*:some:package:2:*:*:*:*:*:*:*</cpe>
       <purl>a-purl-2</purl>
       <properties>
-        <property name="foundBy">the-cataloger-2</property>
-        <property name="type">deb</property>
-        <property name="metadataType">DpkgMetadata</property>
-        <property name="path">/some/path/pkg1</property>
+        <property name="syft:package:foundBy">the-cataloger-2</property>
+        <property name="syft:package:metadataType">DpkgMetadata</property>
+        <property name="syft:package:type">deb</property>
+        <property name="syft:location:0:path">/some/path/pkg1</property>
+        <property name="syft:metadata:installedSize">0</property>
       </properties>
     </component>
     <component type="operating-system">
@@ -51,9 +51,10 @@
       <description>debian</description>
       <swid tagId="debian" name="debian" version="1.2.3"></swid>
       <properties>
-        <property name="prettyName">debian</property>
-        <property name="id">debian</property>
-        <property name="versionID">1.2.3</property>
+        <property name="syft:distro:id">debian</property>
+        <property name="syft:distro:idLike:0">like!</property>
+        <property name="syft:distro:prettyName">debian</property>
+        <property name="syft:distro:versionID">1.2.3</property>
       </properties>
     </component>
   </components>

internal/formats/cyclonedxxml/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden

@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" serialNumber="urn:uuid:5fa94827-eb85-4f32-a62d-76fb6e89a2dd" version="1">
+  <metadata>
+    <timestamp>2022-03-08T12:30:33Z</timestamp>
+    <tools>
+      <tool>
+        <vendor>anchore</vendor>
+        <name>syft</name>
+        <version>[not provided]</version>
+      </tool>
+    </tools>
+    <component bom-ref="711095b1cdf90cce" type="container">
+      <name>user-image-input</name>
+      <version>sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368</version>
+    </component>
+  </metadata>
+  <components>
+    <component type="library">
+      <name>package-1</name>
+      <version>1.0.1</version>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <cpe>cpe:2.3:*:some:package:1:*:*:*:*:*:*:*</cpe>
+      <purl>a-purl-1</purl>
+      <properties>
+        <property name="syft:package:foundBy">the-cataloger-1</property>
+        <property name="syft:package:language">python</property>
+        <property name="syft:package:metadataType">PythonPackageMetadata</property>
+        <property name="syft:package:type">python</property>
+        <property name="syft:location:0:layerID">sha256:16e64541f2ddf59a90391ce7bb8af90313f7d373f2105d88f3d3267b72e0ebab</property>
+        <property name="syft:location:0:path">/somefile-1.txt</property>
+      </properties>
+    </component>
+    <component type="library">
+      <name>package-2</name>
+      <version>2.0.1</version>
+      <cpe>cpe:2.3:*:some:package:2:*:*:*:*:*:*:*</cpe>
+      <purl>a-purl-2</purl>
+      <properties>
+        <property name="syft:package:foundBy">the-cataloger-2</property>
+        <property name="syft:package:metadataType">DpkgMetadata</property>
+        <property name="syft:package:type">deb</property>
+        <property name="syft:location:0:layerID">sha256:de6c235f76ea24c8503ec08891445b5d6a8bdf8249117ed8d8b0b6fb3ebe4f67</property>
+        <property name="syft:location:0:path">/somefile-2.txt</property>
+        <property name="syft:metadata:installedSize">0</property>
+      </properties>
+    </component>
+    <component type="operating-system">
+      <name>debian</name>
+      <version>1.2.3</version>
+      <description>debian</description>
+      <swid tagId="debian" name="debian" version="1.2.3"></swid>
+      <properties>
+        <property name="syft:distro:id">debian</property>
+        <property name="syft:distro:idLike:0">like!</property>
+        <property name="syft:distro:prettyName">debian</property>
+        <property name="syft:distro:versionID">1.2.3</property>
+      </properties>
+    </component>
+  </components>
+</bom>

internal/formats/formats.go

@@ -1,46 +0,0 @@
-package formats
-
-import (
-	"bytes"
-
-	"github.com/anchore/syft/internal/formats/cyclonedx13json"
-	"github.com/anchore/syft/internal/formats/cyclonedx13xml"
-	"github.com/anchore/syft/internal/formats/spdx22json"
-	"github.com/anchore/syft/internal/formats/spdx22tagvalue"
-	"github.com/anchore/syft/internal/formats/syftjson"
-	"github.com/anchore/syft/internal/formats/table"
-	"github.com/anchore/syft/internal/formats/text"
-	"github.com/anchore/syft/syft/format"
-)
-
-// TODO: eventually this is the source of truth for all formatters
-func All() []format.Format {
-	return []format.Format{
-		syftjson.Format(),
-		table.Format(),
-		cyclonedx13xml.Format(),
-		cyclonedx13json.Format(),
-		spdx22json.Format(),
-		spdx22tagvalue.Format(),
-		text.Format(),
-	}
-}
-
-func Identify(by []byte) (*format.Format, error) {
-	for _, f := range All() {
-		if err := f.Validate(bytes.NewReader(by)); err != nil {
-			continue
-		}
-		return &f, nil
-	}
-	return nil, nil
-}
-
-func ByOption(option format.Option) *format.Format {
-	for _, f := range All() {
-		if f.Option == option {
-			return &f
-		}
-	}
-	return nil
-}

internal/formats/formats_test.go

@@ -1,34 +0,0 @@
-package formats
-
-import (
-	"io"
-	"os"
-	"testing"
-
-	"github.com/anchore/syft/syft/format"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestIdentify(t *testing.T) {
-	tests := []struct {
-		fixture  string
-		expected format.Option
-	}{
-		{
-			fixture:  "test-fixtures/alpine-syft.json",
-			expected: format.JSONOption,
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.fixture, func(t *testing.T) {
-			f, err := os.Open(test.fixture)
-			assert.NoError(t, err)
-			by, err := io.ReadAll(f)
-			assert.NoError(t, err)
-			frmt, err := Identify(by)
-			assert.NoError(t, err)
-			assert.NotNil(t, frmt)
-			assert.Equal(t, test.expected, frmt.Option)
-		})
-	}
-}

internal/formats/github/encoder.go

@@ -0,0 +1,183 @@
+package github
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/mholt/archiver/v3"
+
+	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/version"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/anchore/syft/syft/source"
+)
+
+// toGithubModel converts the provided SBOM to a GitHub dependency model
+func toGithubModel(s *sbom.SBOM) DependencySnapshot {
+	scanTime := time.Now().Format(time.RFC3339) // TODO is there a record of this somewhere?
+	v := version.FromBuild().Version
+	if v == "[not provided]" {
+		v = "0.0.0-dev"
+	}
+	return DependencySnapshot{
+		Version: 0,
+		// TODO allow property input to specify the Job, Sha, and Ref
+		Detector: DetectorMetadata{
+			Name:    internal.ApplicationName,
+			URL:     "https://github.com/anchore/syft",
+			Version: v,
+		},
+		Metadata:  toSnapshotMetadata(s),
+		Manifests: toGithubManifests(s),
+		Scanned:   scanTime,
+	}
+}
+
+// toSnapshotMetadata captures the linux distribution information and other metadata
+func toSnapshotMetadata(s *sbom.SBOM) Metadata {
+	out := Metadata{}
+
+	if s.Artifacts.LinuxDistribution != nil {
+		d := s.Artifacts.LinuxDistribution
+		qualifiers := packageurl.Qualifiers{}
+		if len(d.IDLike) > 0 {
+			qualifiers = append(qualifiers, packageurl.Qualifier{
+				Key:   "like",
+				Value: strings.Join(d.IDLike, ","),
+			})
+		}
+		purl := packageurl.NewPackageURL("generic", "", d.ID, d.VersionID, qualifiers, "")
+		out["syft:distro"] = purl.ToString()
+	}
+
+	return out
+}
+
+func filesystem(p pkg.Package) string {
+	if len(p.Locations) > 0 {
+		return p.Locations[0].FileSystemID
+	}
+	return ""
+}
+
+// isArchive returns true if the path appears to be an archive
+func isArchive(path string) bool {
+	_, err := archiver.ByExtension(path)
+	return err == nil
+}
+
+// toPath Generates a string representation of the package location, optionally including the layer hash
+func toPath(s source.Metadata, p pkg.Package) string {
+	inputPath := strings.TrimPrefix(s.Path, "./")
+	if inputPath == "." {
+		inputPath = ""
+	}
+	if len(p.Locations) > 0 {
+		location := p.Locations[0]
+		packagePath := location.RealPath
+		if location.VirtualPath != "" {
+			packagePath = location.VirtualPath
+		}
+		packagePath = strings.TrimPrefix(packagePath, "/")
+		switch s.Scheme {
+		case source.ImageScheme:
+			image := strings.ReplaceAll(s.ImageMetadata.UserInput, ":/", "//")
+			return fmt.Sprintf("%s:/%s", image, packagePath)
+		case source.FileScheme:
+			if isArchive(inputPath) {
+				return fmt.Sprintf("%s:/%s", inputPath, packagePath)
+			}
+			return inputPath
+		case source.DirectoryScheme:
+			if inputPath != "" {
+				return fmt.Sprintf("%s/%s", inputPath, packagePath)
+			}
+			return packagePath
+		}
+	}
+	return fmt.Sprintf("%s%s", inputPath, s.ImageMetadata.UserInput)
+}
+
+// toGithubManifests manifests, each of which represents a specific location that has dependencies
+func toGithubManifests(s *sbom.SBOM) Manifests {
+	manifests := map[string]*Manifest{}
+
+	for _, p := range s.Artifacts.PackageCatalog.Sorted() {
+		path := toPath(s.Source, p)
+		manifest, ok := manifests[path]
+		if !ok {
+			manifest = &Manifest{
+				Name: path,
+				File: FileInfo{
+					SourceLocation: path,
+				},
+				Resolved: DependencyGraph{},
+			}
+			fs := filesystem(p)
+			if fs != "" {
+				manifest.Metadata = Metadata{
+					"syft:filesystem": fs,
+				}
+			}
+			manifests[path] = manifest
+		}
+
+		name := dependencyName(p)
+		manifest.Resolved[name] = DependencyNode{
+			Purl:         p.PURL,
+			Metadata:     toDependencyMetadata(p),
+			Relationship: toDependencyRelationshipType(p),
+			Scope:        toDependencyScope(p),
+			Dependencies: toDependencies(s, p),
+		}
+	}
+
+	out := Manifests{}
+	for k, v := range manifests {
+		out[k] = *v
+	}
+	return out
+}
+
+// dependencyName to make things a little nicer to read; this might end up being lossy
+func dependencyName(p pkg.Package) string {
+	purl, err := packageurl.FromString(p.PURL)
+	if err != nil {
+		log.Warnf("Invalid PURL for package: '%s' PURL: '%s' (%w)", p.Name, p.PURL, err)
+		return ""
+	}
+	// don't use qualifiers for this
+	purl.Qualifiers = nil
+	return purl.ToString()
+}
+
+func toDependencyScope(_ pkg.Package) DependencyScope {
+	return DependencyScopeRuntime
+}
+
+func toDependencyRelationshipType(_ pkg.Package) DependencyRelationship {
+	return DependencyRelationshipDirect
+}
+
+func toDependencyMetadata(_ pkg.Package) Metadata {
+	// We have limited properties: up to 8 with reasonably small values
+	// For now, we are encoding the location as part of the key, we are encoding PURLs with most
+	// of the other information Grype might need; and the distro information at the top level
+	// so we don't need anything here yet
+	return Metadata{}
+}
+
+func toDependencies(s *sbom.SBOM, p pkg.Package) (out []string) {
+	for _, r := range s.Relationships {
+		if r.From.ID() == p.ID() {
+			if p, ok := r.To.(pkg.Package); ok {
+				out = append(out, dependencyName(p))
+			}
+		}
+	}
+	return
+}

internal/formats/github/encoder_test.go

@@ -0,0 +1,161 @@
+package github
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/syft/linux"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/anchore/syft/syft/source"
+)
+
+func Test_toGithubModel(t *testing.T) {
+	s := sbom.SBOM{
+		Source: source.Metadata{
+			Scheme: source.ImageScheme,
+			ImageMetadata: source.ImageMetadata{
+				UserInput:    "ubuntu:18.04",
+				Architecture: "amd64",
+			},
+		},
+		Artifacts: sbom.Artifacts{
+			LinuxDistribution: &linux.Release{
+				ID:        "ubuntu",
+				VersionID: "18.04",
+				IDLike:    []string{"debian"},
+			},
+			PackageCatalog: pkg.NewCatalog(),
+		},
+	}
+	for _, p := range []pkg.Package{
+		{
+			Name:    "pkg-1",
+			Version: "1.0.1",
+			Locations: []source.Location{{
+				Coordinates: source.Coordinates{
+					RealPath:     "/usr/lib",
+					FileSystemID: "fsid-1",
+				},
+			}},
+		},
+		{
+			Name:    "pkg-2",
+			Version: "2.0.2",
+			Locations: []source.Location{{
+				Coordinates: source.Coordinates{
+					RealPath:     "/usr/lib",
+					FileSystemID: "fsid-1",
+				},
+			}},
+		},
+		{
+			Name:    "pkg-3",
+			Version: "3.0.3",
+			Locations: []source.Location{{
+				Coordinates: source.Coordinates{
+					RealPath:     "/etc",
+					FileSystemID: "fsid-1",
+				},
+			}},
+		},
+	} {
+		p.PURL = packageurl.NewPackageURL(
+			"generic",
+			"",
+			p.Name,
+			p.Version,
+			nil,
+			"",
+		).ToString()
+		s.Artifacts.PackageCatalog.Add(p)
+	}
+
+	actual := toGithubModel(&s)
+
+	expected := DependencySnapshot{
+		Version: 0,
+		Detector: DetectorMetadata{
+			Name:    "syft",
+			Version: "0.0.0-dev",
+			URL:     "https://github.com/anchore/syft",
+		},
+		Metadata: Metadata{
+			"syft:distro": "pkg:generic/ubuntu@18.04?like=debian",
+		},
+		Scanned: actual.Scanned,
+		Manifests: Manifests{
+			"ubuntu:18.04:/usr/lib": Manifest{
+				Name: "ubuntu:18.04:/usr/lib",
+				File: FileInfo{
+					SourceLocation: "ubuntu:18.04:/usr/lib",
+				},
+				Metadata: Metadata{
+					"syft:filesystem": "fsid-1",
+				},
+				Resolved: DependencyGraph{
+					"pkg:generic/pkg-1@1.0.1": DependencyNode{
+						Purl:         "pkg:generic/pkg-1@1.0.1",
+						Scope:        DependencyScopeRuntime,
+						Relationship: DependencyRelationshipDirect,
+					},
+					"pkg:generic/pkg-2@2.0.2": DependencyNode{
+						Purl:         "pkg:generic/pkg-2@2.0.2",
+						Scope:        DependencyScopeRuntime,
+						Relationship: DependencyRelationshipDirect,
+					},
+				},
+			},
+			"ubuntu:18.04:/etc": Manifest{
+				Name: "ubuntu:18.04:/etc",
+				File: FileInfo{
+					SourceLocation: "ubuntu:18.04:/etc",
+				},
+				Metadata: Metadata{
+					"syft:filesystem": "fsid-1",
+				},
+				Resolved: DependencyGraph{
+					"pkg:generic/pkg-3@3.0.3": DependencyNode{
+						Purl:         "pkg:generic/pkg-3@3.0.3",
+						Scope:        DependencyScopeRuntime,
+						Relationship: DependencyRelationshipDirect,
+					},
+				},
+			},
+		},
+	}
+
+	// just using JSONEq because it gives a comprehensible diff
+	s1, _ := json.Marshal(expected)
+	s2, _ := json.Marshal(actual)
+	assert.JSONEq(t, string(s1), string(s2))
+
+	// Just test the other schemes:
+	s.Source.Path = "."
+	s.Source.Scheme = source.DirectoryScheme
+	actual = toGithubModel(&s)
+	assert.Equal(t, "etc", actual.Manifests["etc"].Name)
+
+	s.Source.Path = "./artifacts"
+	s.Source.Scheme = source.DirectoryScheme
+	actual = toGithubModel(&s)
+	assert.Equal(t, "artifacts/etc", actual.Manifests["artifacts/etc"].Name)
+
+	s.Source.Path = "/artifacts"
+	s.Source.Scheme = source.DirectoryScheme
+	actual = toGithubModel(&s)
+	assert.Equal(t, "/artifacts/etc", actual.Manifests["/artifacts/etc"].Name)
+
+	s.Source.Path = "./executable"
+	s.Source.Scheme = source.FileScheme
+	actual = toGithubModel(&s)
+	assert.Equal(t, "executable", actual.Manifests["executable"].Name)
+
+	s.Source.Path = "./archive.tar.gz"
+	s.Source.Scheme = source.FileScheme
+	actual = toGithubModel(&s)
+	assert.Equal(t, "archive.tar.gz:/etc", actual.Manifests["archive.tar.gz:/etc"].Name)
+}

internal/formats/github/format.go

@@ -0,0 +1,29 @@
+package github
+
+import (
+	"encoding/json"
+	"io"
+
+	"github.com/anchore/syft/syft/sbom"
+)
+
+const ID sbom.FormatID = "github-0-json"
+
+func Format() sbom.Format {
+	return sbom.NewFormat(
+		ID,
+		func(writer io.Writer, sbom sbom.SBOM) error {
+			bom := toGithubModel(&sbom)
+
+			bytes, err := json.MarshalIndent(bom, "", "  ")
+			if err != nil {
+				return err
+			}
+			_, err = writer.Write(bytes)
+
+			return err
+		},
+		nil,
+		nil,
+	)
+}

internal/formats/github/github_dependency_api.go

@@ -0,0 +1,78 @@
+package github
+
+// Derived from: https://gist.github.com/reiddraper/fdab2883db0f372c146d1a750fc1c43f
+
+type DependencySnapshot struct {
+	Version   int              `json:"version"`
+	Job       Job              `json:"job,omitempty"` // !omitempty
+	Sha       string           `json:"sha,omitempty"` // !omitempty sha of the Git commit
+	Ref       string           `json:"ref,omitempty"` // !omitempty ref of the Git commit example "refs/heads/main"
+	Detector  DetectorMetadata `json:"detector,omitempty"`
+	Metadata  Metadata         `json:"metadata,omitempty"`
+	Manifests Manifests        `json:"manifests,omitempty"`
+	Scanned   ISO8601Date      `json:"scanned,omitempty"`
+}
+
+type Job struct {
+	Name    string `json:"name,omitempty"` // !omitempty
+	ID      string `json:"id,omitempty"`   // !omitempty
+	HTMLURL string `json:"html_url,omitempty"`
+}
+
+type DetectorMetadata struct {
+	Name    string `json:"name,omitempty"`
+	URL     string `json:"url,omitempty"`
+	Version string `json:"version,omitempty"`
+}
+
+type Manifests map[string]Manifest
+
+// Manifest A collection of related dependencies, either declared in a file,
+// or representing a logical group of dependencies.
+type Manifest struct {
+	Name     string          `json:"name"`
+	File     FileInfo        `json:"file"`
+	Metadata Metadata        `json:"metadata,omitempty"`
+	Resolved DependencyGraph `json:"resolved,omitempty"`
+}
+
+type FileInfo struct {
+	SourceLocation string `json:"source_location,omitempty"`
+}
+
+// DependencyRelationship A notation of whether a dependency is requested directly
+// by this manifest, or is a dependency of another dependency.
+type DependencyRelationship string
+
+const (
+	DependencyRelationshipDirect   DependencyRelationship = "direct"
+	DependencyRelationshipIndirect DependencyRelationship = "indirect"
+)
+
+// DependencyScope A notation of whether the dependency is required for the primary
+// build artifact (runtime), or is only used for development.
+// Future versions of this specification may allow for more granular
+// scopes, like `runtimeserver`, `runtimeshipped`,
+// `developmenttest`, `developmentbenchmark`.
+type DependencyScope string
+
+const (
+	DependencyScopeRuntime     DependencyScope = "runtime"
+	DependencyScopeDevelopment DependencyScope = "development"
+)
+
+type DependencyNode struct {
+	Purl         string                 `json:"purl,omitempty"`
+	Metadata     Metadata               `json:"metadata,omitempty"`
+	Relationship DependencyRelationship `json:"relationship,omitempty"`
+	Scope        DependencyScope        `json:"scope,omitempty"`
+	Dependencies []string               `json:"dependencies,omitempty"`
+}
+
+type DependencyGraph map[string]DependencyNode
+
+type ISO8601Date = string
+
+type Scalar interface{} // should be: null | boolean | string | number
+
+type Metadata map[string]Scalar

internal/formats/spdx22json/format.go

@@ -1,11 +1,15 @@
 package spdx22json
 
-import "github.com/anchore/syft/syft/format"
+import (
+	"github.com/anchore/syft/syft/sbom"
+)
+
+const ID sbom.FormatID = "spdx-2-json"
 
 // note: this format is LOSSY relative to the syftjson format
-func Format() format.Format {
-	return format.NewFormat(
-		format.SPDXJSONOption,
+func Format() sbom.Format {
+	return sbom.NewFormat(
+		ID,
 		encoder,
 		decoder,
 		validator,

internal/formats/spdx22json/to_format_model.go

@@ -152,13 +152,19 @@ func toFiles(s sbom.SBOM) []model.File {
 func toFileChecksums(digests []file.Digest) (checksums []model.Checksum) {
 	for _, digest := range digests {
 		checksums = append(checksums, model.Checksum{
-			Algorithm:     digest.Algorithm,
+			Algorithm:     toChecksumAlgorithm(digest.Algorithm),
 			ChecksumValue: digest.Value,
 		})
 	}
 	return checksums
 }
 
+func toChecksumAlgorithm(algorithm string) string {
+	// basically, we need an uppercase version of our algorithm:
+	// https://github.com/spdx/spdx-spec/blob/development/v2.2.2/schemas/spdx-schema.json#L165
+	return strings.ToUpper(algorithm)
+}
+
 func toFileTypes(metadata *source.FileMetadata) (ty []string) {
 	if metadata == nil {
 		return nil

internal/formats/spdx22json/to_format_model_test.go

@@ -142,7 +142,7 @@ func Test_toFileChecksums(t *testing.T) {
 			name: "has digests",
 			digests: []file.Digest{
 				{
-					Algorithm: "sha256",
+					Algorithm: "SHA256",
 					Value:     "deadbeefcafe",
 				},
 				{
@@ -152,11 +152,11 @@ func Test_toFileChecksums(t *testing.T) {
 			},
 			expected: []model.Checksum{
 				{
-					Algorithm:     "sha256",
+					Algorithm:     "SHA256",
 					ChecksumValue: "deadbeefcafe",
 				},
 				{
-					Algorithm:     "md5",
+					Algorithm:     "MD5",
 					ChecksumValue: "meh",
 				},
 			},

internal/formats/spdx22tagvalue/format.go

@@ -1,11 +1,15 @@
 package spdx22tagvalue
 
-import "github.com/anchore/syft/syft/format"
+import (
+	"github.com/anchore/syft/syft/sbom"
+)
+
+const ID sbom.FormatID = "spdx-2-tag-value"
 
 // note: this format is LOSSY relative to the syftjson formation, which means that decoding and validation is not supported at this time
-func Format() format.Format {
-	return format.NewFormat(
-		format.SPDXTagValueOption,
+func Format() sbom.Format {
+	return sbom.NewFormat(
+		ID,
 		encoder,
 		decoder,
 		validator,

internal/formats/spdx22tagvalue/to_format_model.go

@@ -221,7 +221,7 @@ func toFormatPackages(catalog *pkg.Catalog) map[spdx.ElementID]*spdx.Package2_2
 
 			// 3.17: Copyright Text: copyright notice(s) text, "NONE" or "NOASSERTION"
 			// Cardinality: mandatory, one
-			// Purpose: Identify the copyright holders of the package, as well as any dates present. This will be a free form text field extracted from package information files. The options to populate this field are limited to:
+			// Purpose: IdentifyFormat the copyright holders of the package, as well as any dates present. This will be a free form text field extracted from package information files. The options to populate this field are limited to:
 			//
 			// Any text related to a copyright notice, even if not complete;
 			// NONE if the package contains no copyright information whatsoever; or

internal/formats/syftjson/format.go

@@ -1,10 +1,14 @@
 package syftjson
 
-import "github.com/anchore/syft/syft/format"
+import (
+	"github.com/anchore/syft/syft/sbom"
+)
 
-func Format() format.Format {
-	return format.NewFormat(
-		format.JSONOption,
+const ID sbom.FormatID = "syft-3-json"
+
+func Format() sbom.Format {
+	return sbom.NewFormat(
+		ID,
 		encoder,
 		decoder,
 		validator,

internal/formats/syftjson/test-fixtures/snapshot/TestDirectoryEncoder.golden

@@ -88,7 +88,7 @@
   }
  },
  "schema": {
-  "version": "3.0.1",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.0.1.json"
+  "version": "3.1.0",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.1.0.json"
  }
 }

internal/formats/syftjson/test-fixtures/snapshot/TestEncodeFullJSONDocument.golden

@@ -163,7 +163,9 @@
    ],
    "manifest": "ZXlKelkyaGxiV0ZXWlhKemFXOXVJam95TENKdFpXUnBZVlI1Y0dVaU9pSmguLi4=",
    "config": "ZXlKaGNtTm9hWFJsWTNSMWNtVWlPaUpoYldRMk5DSXNJbU52Ym1acC4uLg==",
-   "repoDigests": []
+   "repoDigests": [],
+   "architecture": "",
+   "os": ""
   }
  },
  "distro": {
@@ -182,7 +184,7 @@
   }
  },
  "schema": {
-  "version": "3.0.1",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.0.1.json"
+  "version": "3.1.0",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.1.0.json"
  }
 }

internal/formats/syftjson/test-fixtures/snapshot/TestImageEncoder.golden

@@ -1,7 +1,7 @@
 {
  "artifacts": [
   {
-   "id": "3a6c7061f86ac3f7",
+   "id": "d9527e708c11f8b9",
    "name": "package-1",
    "version": "1.0.1",
    "type": "python",
@@ -9,7 +9,7 @@
    "locations": [
     {
      "path": "/somefile-1.txt",
-     "layerID": "sha256:135c16aca35f76c25a18cb6650c621a46b8b79864ad6f2834167de2679bb587d"
+     "layerID": "sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59"
     }
    ],
    "licenses": [
@@ -32,7 +32,7 @@
    }
   },
   {
-   "id": "4e916af2d387ce9",
+   "id": "73f796c846875b9e",
    "name": "package-2",
    "version": "2.0.1",
    "type": "deb",
@@ -40,7 +40,7 @@
    "locations": [
     {
      "path": "/somefile-2.txt",
-     "layerID": "sha256:c751a2f31455b3049bcab3e3af5861c9431116c9f4a46213e44dbeff8ab36985"
+     "layerID": "sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec"
     }
    ],
    "licenses": [],
@@ -67,7 +67,7 @@
   "type": "image",
   "target": {
    "userInput": "user-image-input",
-   "imageID": "sha256:9998e833a66442934ad948e5cbe898630773c369ef16517623254fa46edd171b",
+   "imageID": "sha256:2480160b55bec40c44d3b145c7b2c1c47160db8575c3dcae086d76b9370ae7ca",
    "manifestDigest": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368",
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
    "tags": [
@@ -77,18 +77,20 @@
    "layers": [
     {
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:135c16aca35f76c25a18cb6650c621a46b8b79864ad6f2834167de2679bb587d",
+     "digest": "sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59",
      "size": 22
     },
     {
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:c751a2f31455b3049bcab3e3af5861c9431116c9f4a46213e44dbeff8ab36985",
+     "digest": "sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec",
      "size": 16
     }
    ],
-   "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NzMsImRpZ2VzdCI6InNoYTI1Njo5OTk4ZTgzM2E2NjQ0MjkzNGFkOTQ4ZTVjYmU4OTg2MzA3NzNjMzY5ZWYxNjUxNzYyMzI1NGZhNDZlZGQxNzFiIn0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1NjoxMzVjMTZhY2EzNWY3NmMyNWExOGNiNjY1MGM2MjFhNDZiOGI3OTg2NGFkNmYyODM0MTY3ZGUyNjc5YmI1ODdkIn0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2OmM3NTFhMmYzMTQ1NWIzMDQ5YmNhYjNlM2FmNTg2MWM5NDMxMTE2YzlmNGE0NjIxM2U0NGRiZWZmOGFiMzY5ODUifV19",
-   "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8iLCJPbkJ1aWxkIjpudWxsfSwiY3JlYXRlZCI6IjIwMjItMDEtMThUMjA6MzA6MTMuMDQ0Njg1NTg5WiIsImhpc3RvcnkiOlt7ImNyZWF0ZWQiOiIyMDIyLTAxLTE4VDIwOjMwOjEyLjE5OTA3MjQxOVoiLCJjcmVhdGVkX2J5IjoiQUREIGZpbGUtMS50eHQgL3NvbWVmaWxlLTEudHh0ICMgYnVpbGRraXQiLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCJ9LHsiY3JlYXRlZCI6IjIwMjItMDEtMThUMjA6MzA6MTMuMDQ0Njg1NTg5WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0yLnR4dCAvc29tZWZpbGUtMi50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6MTM1YzE2YWNhMzVmNzZjMjVhMThjYjY2NTBjNjIxYTQ2YjhiNzk4NjRhZDZmMjgzNDE2N2RlMjY3OWJiNTg3ZCIsInNoYTI1NjpjNzUxYTJmMzE0NTViMzA0OWJjYWIzZTNhZjU4NjFjOTQzMTExNmM5ZjRhNDYyMTNlNDRkYmVmZjhhYjM2OTg1Il19fQ==",
-   "repoDigests": []
+   "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NjcsImRpZ2VzdCI6InNoYTI1NjoyNDgwMTYwYjU1YmVjNDBjNDRkM2IxNDVjN2IyYzFjNDcxNjBkYjg1NzVjM2RjYWUwODZkNzZiOTM3MGFlN2NhIn0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1NjpmYjZiZWVjYjc1YjM5ZjRiYjgxM2RiZjE3N2U1MDFlZGQ1ZGRiM2U2OWJiNDVjZWRlYjc4YzY3NmVlMWI3YTU5In0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2OjMxOWI1ODhjZTY0MjUzYTg3YjUzM2M4ZWQwMWNmMDAyNWUwZWFjOThlN2I1MTZlMTI1MzI5NTdlMTI0NGZkZWMifV19",
+   "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8iLCJPbkJ1aWxkIjpudWxsfSwiY3JlYXRlZCI6IjIwMjEtMTAtMDRUMTE6NDA6MDAuNjM4Mzk0NVoiLCJoaXN0b3J5IjpbeyJjcmVhdGVkIjoiMjAyMS0xMC0wNFQxMTo0MDowMC41OTA3MzE2WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0xLnR4dCAvc29tZWZpbGUtMS50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn0seyJjcmVhdGVkIjoiMjAyMS0xMC0wNFQxMTo0MDowMC42MzgzOTQ1WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0yLnR4dCAvc29tZWZpbGUtMi50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6ZmI2YmVlY2I3NWIzOWY0YmI4MTNkYmYxNzdlNTAxZWRkNWRkYjNlNjliYjQ1Y2VkZWI3OGM2NzZlZTFiN2E1OSIsInNoYTI1NjozMTliNTg4Y2U2NDI1M2E4N2I1MzNjOGVkMDFjZjAwMjVlMGVhYzk4ZTdiNTE2ZTEyNTMyOTU3ZTEyNDRmZGVjIl19fQ==",
+   "repoDigests": [],
+   "architecture": "",
+   "os": ""
   }
  },
  "distro": {
@@ -109,7 +111,7 @@
   }
  },
  "schema": {
-  "version": "3.0.1",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.0.1.json"
+  "version": "3.1.0",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.1.0.json"
  }
 }

internal/formats/table/format.go

@@ -1,10 +1,14 @@
 package table
 
-import "github.com/anchore/syft/syft/format"
+import (
+	"github.com/anchore/syft/syft/sbom"
+)
 
-func Format() format.Format {
-	return format.NewFormat(
-		format.TableOption,
+const ID sbom.FormatID = "syft-table"
+
+func Format() sbom.Format {
+	return sbom.NewFormat(
+		ID,
 		encoder,
 		nil,
 		nil,

internal/formats/text/format.go

@@ -1,10 +1,14 @@
 package text
 
-import "github.com/anchore/syft/syft/format"
+import (
+	"github.com/anchore/syft/syft/sbom"
+)
 
-func Format() format.Format {
-	return format.NewFormat(
-		format.TextOption,
+const ID sbom.FormatID = "syft-text"
+
+func Format() sbom.Format {
+	return sbom.NewFormat(
+		ID,
 		encoder,
 		nil,
 		nil,

internal/stringset.go

@@ -6,12 +6,7 @@ import "sort"
 type StringSet map[string]struct{}
 
 // NewStringSet creates a new empty StringSet.
-func NewStringSet() StringSet {
-	return make(StringSet)
-}
-
-// NewStringSetFromSlice creates a StringSet populated with values from the given slice.
-func NewStringSetFromSlice(start []string) StringSet {
+func NewStringSet(start ...string) StringSet {
 	ret := make(StringSet)
 	for _, s := range start {
 		ret.Add(s)

internal/version/build.go

@@ -7,6 +7,8 @@ import (
 	"fmt"
 	"runtime"
 	"strings"
+
+	"github.com/anchore/syft/internal"
 )
 
 const valueNotProvided = "[not provided]"
@@ -20,13 +22,14 @@ var platform = fmt.Sprintf("%s/%s", runtime.GOOS, runtime.GOARCH)
 
 // Version defines the application version details (generally from build information)
 type Version struct {
-	Version        string `json:"version"`        // application semantic version
-	GitCommit      string `json:"gitCommit"`      // git SHA at build-time
-	GitDescription string `json:"gitDescription"` // output of 'git describe --dirty --always --tags'
-	BuildDate      string `json:"buildDate"`      // date of the build
-	GoVersion      string `json:"goVersion"`      // go runtime version at build-time
-	Compiler       string `json:"compiler"`       // compiler used at build-time
-	Platform       string `json:"platform"`       // GOOS and GOARCH at build-time
+	Version           string `json:"version"`           // application semantic version
+	JSONSchemaVersion string `json:"jsonSchemaVersion"` // application semantic JSON schema version
+	GitCommit         string `json:"gitCommit"`         // git SHA at build-time
+	GitDescription    string `json:"gitDescription"`    // output of 'git describe --dirty --always --tags'
+	BuildDate         string `json:"buildDate"`         // date of the build
+	GoVersion         string `json:"goVersion"`         // go runtime version at build-time
+	Compiler          string `json:"compiler"`          // compiler used at build-time
+	Platform          string `json:"platform"`          // GOOS and GOARCH at build-time
 }
 
 func (v Version) IsProductionBuild() bool {
@@ -39,12 +42,13 @@ func (v Version) IsProductionBuild() bool {
 // FromBuild provides all version details
 func FromBuild() Version {
 	return Version{
-		Version:        version,
-		GitCommit:      gitCommit,
-		GitDescription: gitDescription,
-		BuildDate:      buildDate,
-		GoVersion:      runtime.Version(),
-		Compiler:       runtime.Compiler,
-		Platform:       platform,
+		Version:           version,
+		JSONSchemaVersion: internal.JSONSchemaVersion,
+		GitCommit:         gitCommit,
+		GitDescription:    gitDescription,
+		BuildDate:         buildDate,
+		GoVersion:         runtime.Version(),
+		Compiler:          runtime.Compiler,
+		Platform:          platform,
 	}
 }

schema/cyclonedx/Makefile

@@ -4,4 +4,4 @@ validate-schema:
 	go run ../../main.go ubuntu:latest -vv -o cyclonedx > bom.xml
 	xmllint --noout --schema ./cyclonedx.xsd bom.xml
 	go run ../../main.go ubuntu:latest -vv -o cyclonedx-json > bom.json
-	../../.tmp/yajsv -s bom-1.3.schema.json bom.json
+	../../.tmp/yajsv -s cyclonedx.json bom.json

syft/encode_decode.go

@@ -6,18 +6,10 @@ import (
 	"io"
 
 	"github.com/anchore/syft/syft/sbom"
-
-	"github.com/anchore/syft/internal/formats"
-	"github.com/anchore/syft/syft/format"
 )
 
 // Encode takes all SBOM elements and a format option and encodes an SBOM document.
-func Encode(s sbom.SBOM, option format.Option) ([]byte, error) {
-	f := formats.ByOption(option)
-	if f == nil {
-		return nil, fmt.Errorf("unsupported format: %+v", option)
-	}
-
+func Encode(s sbom.SBOM, f sbom.Format) ([]byte, error) {
 	buff := bytes.Buffer{}
 
 	if err := f.Encode(&buff, s); err != nil {
@@ -28,19 +20,17 @@ func Encode(s sbom.SBOM, option format.Option) ([]byte, error) {
 }
 
 // Decode takes a reader for an SBOM and generates all internal SBOM elements.
-func Decode(reader io.Reader) (*sbom.SBOM, format.Option, error) {
+func Decode(reader io.Reader) (*sbom.SBOM, sbom.Format, error) {
 	by, err := io.ReadAll(reader)
 	if err != nil {
-		return nil, format.UnknownFormatOption, fmt.Errorf("unable to read sbom: %w", err)
+		return nil, nil, fmt.Errorf("unable to read sbom: %w", err)
 	}
 
-	f, err := formats.Identify(by)
-	if err != nil {
-		return nil, format.UnknownFormatOption, fmt.Errorf("unable to detect format: %w", err)
-	}
+	f := IdentifyFormat(by)
 	if f == nil {
-		return nil, format.UnknownFormatOption, fmt.Errorf("unable to identify format")
+		return nil, nil, fmt.Errorf("unable to identify format")
 	}
+
 	s, err := f.Decode(bytes.NewReader(by))
-	return s, f.Option, err
+	return s, f, err
 }

syft/format/decoder.go

@@ -1,10 +0,0 @@
-package format
-
-import (
-	"io"
-
-	"github.com/anchore/syft/syft/sbom"
-)
-
-// Decoder is a function that can convert an SBOM document of a specific format from a reader into Syft native objects.
-type Decoder func(reader io.Reader) (*sbom.SBOM, error)

syft/format/encoder.go

@@ -1,10 +0,0 @@
-package format
-
-import (
-	"io"
-
-	"github.com/anchore/syft/syft/sbom"
-)
-
-// Encoder is a function that can transform Syft native objects into an SBOM document of a specific format written to the given writer.
-type Encoder func(io.Writer, sbom.SBOM) error

syft/format/format.go

@@ -1,52 +0,0 @@
-package format
-
-import (
-	"errors"
-	"io"
-
-	"github.com/anchore/syft/syft/sbom"
-)
-
-var (
-	ErrEncodingNotSupported   = errors.New("encoding not supported")
-	ErrDecodingNotSupported   = errors.New("decoding not supported")
-	ErrValidationNotSupported = errors.New("validation not supported")
-)
-
-type Format struct {
-	Option    Option
-	encoder   Encoder
-	decoder   Decoder
-	validator Validator
-}
-
-func NewFormat(option Option, encoder Encoder, decoder Decoder, validator Validator) Format {
-	return Format{
-		Option:    option,
-		encoder:   encoder,
-		decoder:   decoder,
-		validator: validator,
-	}
-}
-
-func (f Format) Encode(output io.Writer, s sbom.SBOM) error {
-	if f.encoder == nil {
-		return ErrEncodingNotSupported
-	}
-	return f.encoder(output, s)
-}
-
-func (f Format) Decode(reader io.Reader) (*sbom.SBOM, error) {
-	if f.decoder == nil {
-		return nil, ErrDecodingNotSupported
-	}
-	return f.decoder(reader)
-}
-
-func (f Format) Validate(reader io.Reader) error {
-	if f.validator == nil {
-		return ErrValidationNotSupported
-	}
-
-	return f.validator(reader)
-}

syft/format/option.go

@@ -1,49 +0,0 @@
-package format
-
-import "strings"
-
-const (
-	UnknownFormatOption Option = "UnknownFormatOption"
-	JSONOption          Option = "json"
-	TextOption          Option = "text"
-	TableOption         Option = "table"
-	CycloneDxXMLOption  Option = "cyclonedx"
-	CycloneDxJSONOption Option = "cyclonedx-json"
-	SPDXTagValueOption  Option = "spdx-tag-value"
-	SPDXJSONOption      Option = "spdx-json"
-)
-
-var AllOptions = []Option{
-	JSONOption,
-	TextOption,
-	TableOption,
-	CycloneDxXMLOption,
-	CycloneDxJSONOption,
-	SPDXTagValueOption,
-	SPDXJSONOption,
-}
-
-type Option string
-
-func ParseOption(userStr string) Option {
-	switch strings.ToLower(userStr) {
-	case string(JSONOption):
-		return JSONOption
-	case string(TextOption):
-		return TextOption
-	case string(TableOption):
-		return TableOption
-	case string(CycloneDxXMLOption), "cyclone", "cyclone-dx", "cyclone-dx-xml", "cyclone-xml":
-		// NOTE(jonasagx): setting "cyclone" to XML by default for retro-compatibility.
-		// If we want to show no preference between XML and JSON please remove it.
-		return CycloneDxXMLOption
-	case string(CycloneDxJSONOption), "cyclone-json", "cyclone-dx-json":
-		return CycloneDxJSONOption
-	case string(SPDXTagValueOption), "spdx", "spdx-tagvalue", "spdxtagvalue", "spdx-tv", "spdxtv":
-		return SPDXTagValueOption
-	case string(SPDXJSONOption), "spdxjson":
-		return SPDXJSONOption
-	default:
-		return UnknownFormatOption
-	}
-}

syft/format/validator.go

@@ -1,12 +0,0 @@
-package format
-
-import "io"
-
-// Validator reads the SBOM from the given reader and assesses whether the document conforms to the specific SBOM format.
-// The validator should positively confirm if the SBOM is not only the format but also has the minimal set of values
-// that the format requires. For example, all syftjson formatted documents have a schema section which should have
-// "anchore/syft" within the version --if this isn't found then the validator should raise an error. These active
-// assertions protect against "simple" format decoding validations that may lead to false positives (e.g. I decoded
-// json successfully therefore this must be the target format, however, all values are their default zero-value and
-// really represent a different format that also uses json)
-type Validator func(reader io.Reader) error

syft/formats.go

@@ -0,0 +1,105 @@
+package syft
+
+import (
+	"bytes"
+	"strings"
+
+	"github.com/anchore/syft/internal/formats/cyclonedxjson"
+	"github.com/anchore/syft/internal/formats/cyclonedxxml"
+	"github.com/anchore/syft/internal/formats/github"
+	"github.com/anchore/syft/internal/formats/spdx22json"
+	"github.com/anchore/syft/internal/formats/spdx22tagvalue"
+	"github.com/anchore/syft/internal/formats/syftjson"
+	"github.com/anchore/syft/internal/formats/table"
+	"github.com/anchore/syft/internal/formats/text"
+	"github.com/anchore/syft/syft/sbom"
+)
+
+// these have been exported for the benefit of API users
+const (
+	JSONFormatID          = syftjson.ID
+	TextFormatID          = text.ID
+	TableFormatID         = table.ID
+	CycloneDxXMLFormatID  = cyclonedxxml.ID
+	CycloneDxJSONFormatID = cyclonedxjson.ID
+	GitHubID              = github.ID
+	SPDXTagValueFormatID  = spdx22tagvalue.ID
+	SPDXJSONFormatID      = spdx22json.ID
+)
+
+var formats []sbom.Format
+
+func init() {
+	formats = []sbom.Format{
+		syftjson.Format(),
+		cyclonedxxml.Format(),
+		cyclonedxjson.Format(),
+		github.Format(),
+		spdx22tagvalue.Format(),
+		spdx22json.Format(),
+		table.Format(),
+		text.Format(),
+	}
+}
+
+func FormatIDs() (ids []sbom.FormatID) {
+	for _, f := range formats {
+		ids = append(ids, f.ID())
+	}
+	return ids
+}
+
+func FormatByID(id sbom.FormatID) sbom.Format {
+	for _, f := range formats {
+		if f.ID() == id {
+			return f
+		}
+	}
+	return nil
+}
+
+func FormatByName(name string) sbom.Format {
+	cleanName := cleanFormatName(name)
+	for _, f := range formats {
+		if cleanFormatName(string(f.ID())) == cleanName {
+			return f
+		}
+	}
+
+	// handle any aliases for any supported format
+	switch cleanName {
+	case "json", "syftjson":
+		return FormatByID(syftjson.ID)
+	case "cyclonedx", "cyclone", "cyclonedxxml":
+		return FormatByID(cyclonedxxml.ID)
+	case "cyclonedxjson":
+		return FormatByID(cyclonedxjson.ID)
+	case "github":
+		return FormatByID(github.ID)
+	case "spdx", "spdxtv", "spdxtagvalue":
+		return FormatByID(spdx22tagvalue.ID)
+	case "spdxjson":
+		return FormatByID(spdx22json.ID)
+	case "table":
+		return FormatByID(table.ID)
+	case "text":
+		return FormatByID(text.ID)
+	}
+
+	return nil
+}
+
+func cleanFormatName(name string) string {
+	r := strings.NewReplacer("-", "", "_", "")
+	return strings.ToLower(r.Replace(name))
+}
+
+func IdentifyFormat(by []byte) sbom.Format {
+	for _, f := range formats {
+		if err := f.Validate(bytes.NewReader(by)); err != nil {
+			continue
+		}
+		return f
+	}
+	return nil
+}

syft/formats_test.go

@@ -0,0 +1,158 @@
+package syft
+
+import (
+	"io"
+	"os"
+	"testing"
+
+	"github.com/anchore/syft/internal/formats/cyclonedxjson"
+	"github.com/anchore/syft/internal/formats/cyclonedxxml"
+	"github.com/anchore/syft/internal/formats/spdx22json"
+	"github.com/anchore/syft/internal/formats/spdx22tagvalue"
+	"github.com/anchore/syft/internal/formats/syftjson"
+	"github.com/anchore/syft/internal/formats/table"
+	"github.com/anchore/syft/internal/formats/text"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/stretchr/testify/require"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIdentify(t *testing.T) {
+	tests := []struct {
+		fixture  string
+		expected sbom.FormatID
+	}{
+		{
+			fixture:  "test-fixtures/alpine-syft.json",
+			expected: syftjson.ID,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.fixture, func(t *testing.T) {
+			f, err := os.Open(test.fixture)
+			assert.NoError(t, err)
+			by, err := io.ReadAll(f)
+			assert.NoError(t, err)
+			frmt := IdentifyFormat(by)
+			assert.NotNil(t, frmt)
+			assert.Equal(t, test.expected, frmt.ID())
+		})
+	}
+}
+
+func TestFormatByName(t *testing.T) {
+
+	tests := []struct {
+		name string
+		want sbom.FormatID
+	}{
+		// SPDX Tag-Value
+		{
+			name: "spdx",
+			want: spdx22tagvalue.ID,
+		},
+		{
+			name: "spdx-tag-value",
+			want: spdx22tagvalue.ID,
+		},
+		{
+			name: "spdx-tv",
+			want: spdx22tagvalue.ID,
+		},
+		{
+			name: "spdxtv", // clean variant
+			want: spdx22tagvalue.ID,
+		},
+		{
+			name: "spdx-2-tag-value", // clean variant
+			want: spdx22tagvalue.ID,
+		},
+		{
+			name: "spdx-2-tagvalue", // clean variant
+			want: spdx22tagvalue.ID,
+		},
+		{
+			name: "spdx2-tagvalue", // clean variant
+			want: spdx22tagvalue.ID,
+		},
+
+		// SPDX JSON
+		{
+			name: "spdx-json",
+			want: spdx22json.ID,
+		},
+		{
+			name: "spdx-2-json",
+			want: spdx22json.ID,
+		},
+
+		// Cyclonedx JSON
+		{
+			name: "cyclonedx-json",
+			want: cyclonedxjson.ID,
+		},
+		{
+			name: "cyclonedx-1-json",
+			want: cyclonedxjson.ID,
+		},
+
+		// Cyclonedx XML
+		{
+			name: "cyclonedx",
+			want: cyclonedxxml.ID,
+		},
+		{
+			name: "cyclonedx-xml",
+			want: cyclonedxxml.ID,
+		},
+		{
+			name: "cyclonedx-1-xml",
+			want: cyclonedxxml.ID,
+		},
+
+		// Syft Table
+		{
+			name: "table",
+			want: table.ID,
+		},
+
+		{
+			name: "syft-table",
+			want: table.ID,
+		},
+
+		// Syft Text
+		{
+			name: "text",
+			want: text.ID,
+		},
+
+		{
+			name: "syft-text",
+			want: text.ID,
+		},
+
+		// Syft JSON
+		{
+			name: "json",
+			want: syftjson.ID,
+		},
+
+		{
+			name: "syft-json",
+			want: syftjson.ID,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			f := FormatByName(tt.name)
+			if tt.want == "" {
+				require.Nil(t, f)
+				return
+			}
+			require.NotNil(t, f)
+			assert.Equal(t, tt.want, f.ID())
+		})
+	}
+}

syft/pkg/cataloger/javascript/parse_yarn_lock.go

@@ -16,18 +16,15 @@ import (
 var _ common.ParserFn = parseYarnLock
 
 var (
-	// composedNameExp matches the "composed" variant of yarn.lock entry names,
-	// where the name appears in quotes and is prefixed with @<some-namespace>.
-	// For example: "@babel/code-frame@^7.0.0"
-	composedNameExp = regexp.MustCompile(`^"(@[^@]+)`)
-
-	// simpleNameExp matches the "simple" variant of yarn.lock entry names, for packages with no namespace prefix.
-	// For example: aws-sdk@2.706.0
-	simpleNameExp = regexp.MustCompile(`^(\w[\w-_.]*)@`)
+	// packageNameExp matches the name of the dependency in yarn.lock
+	// including scope/namespace prefix if found.
+	// For example: "aws-sdk@2.706.0" returns "aws-sdk"
+	//              "@babel/code-frame@^7.0.0" returns "@babel/code-frame"
+	packageNameExp = regexp.MustCompile(`^"?((?:@\w[\w-_.]*\/)?\w[\w-_.]*)@`)
 
 	// versionExp matches the "version" line of a yarn.lock entry and captures the version value.
 	// For example: version "4.10.1" (...and the value "4.10.1" is captured)
-	versionExp = regexp.MustCompile(`^\W+version\W+"([\w-_.]+)"`)
+	versionExp = regexp.MustCompile(`^\W+version(?:\W+"|:\W+)([\w-_.]+)"?`)
 )
 
 const (
@@ -87,11 +84,7 @@ func parseYarnLock(path string, reader io.Reader) ([]*pkg.Package, []artifact.Re
 }
 
 func findPackageName(line string) string {
-	if matches := composedNameExp.FindStringSubmatch(line); len(matches) >= 2 {
-		return matches[1]
-	}
-
-	if matches := simpleNameExp.FindStringSubmatch(line); len(matches) >= 2 {
+	if matches := packageNameExp.FindStringSubmatch(line); len(matches) >= 2 {
 		return matches[1]
 	}
 

syft/pkg/cataloger/javascript/parse_yarn_lock_test.go

@@ -5,6 +5,8 @@ import (
 	"testing"
 
 	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestParseYarnLock(t *testing.T) {
@@ -65,16 +67,182 @@ func TestParseYarnLock(t *testing.T) {
 		},
 	}
 
-	fixture, err := os.Open("test-fixtures/yarn/yarn.lock")
-	if err != nil {
-		t.Fatalf("failed to open fixture: %+v", err)
+	testFixtures := []string{
+		"test-fixtures/yarn/yarn.lock",
+		"test-fixtures/yarn-berry/yarn.lock",
 	}
 
-	// TODO: no relationships are under test yet
-	actual, _, err := parseYarnLock(fixture.Name(), fixture)
-	if err != nil {
-		t.Fatalf("failed to parse yarn.lock: %+v", err)
-	}
+	for _, file := range testFixtures {
+		file := file
+		t.Run(file, func(t *testing.T) {
+			t.Parallel()
 
-	assertPkgsEqual(t, actual, expected)
+			fixture, err := os.Open(file)
+			require.NoError(t, err)
+
+			// TODO: no relationships are under test yet
+			actual, _, err := parseYarnLock(fixture.Name(), fixture)
+			require.NoError(t, err)
+
+			assertPkgsEqual(t, actual, expected)
+		})
+	}
+}
+
+func TestParseYarnFindPackageNames(t *testing.T) {
+	tests := []struct {
+		line     string
+		expected string
+	}{
+		{
+			line:     `"@babel/code-frame@npm:7.10.4":`,
+			expected: "@babel/code-frame",
+		},
+		{
+			line:     `"@babel/code-frame@^7.0.0", "@babel/code-frame@^7.10.4":`,
+			expected: "@babel/code-frame",
+		},
+		{
+			line:     "ajv@^6.10.2, ajv@^6.5.5:",
+			expected: "ajv",
+		},
+		{
+			line:     "aws-sdk@2.706.0:",
+			expected: "aws-sdk",
+		},
+		{
+			line:     "asn1.js@^4.0.0:",
+			expected: "asn1.js",
+		},
+		{
+			line:     "c0n-fab_u.laTION@^7.0.0",
+			expected: "c0n-fab_u.laTION",
+		},
+		{
+			line:     `"newtest@workspace:.":`,
+			expected: "newtest",
+		},
+		{
+			line:     `"color-convert@npm:^1.9.0":`,
+			expected: "color-convert",
+		},
+		{
+			line:     `"@npmcorp/code-frame@^7.1.0", "@npmcorp/code-frame@^7.10.4":`,
+			expected: "@npmcorp/code-frame",
+		},
+		{
+			line:     `"@npmcorp/code-frame@^7.2.3":`,
+			expected: "@npmcorp/code-frame",
+		},
+		{
+			line:     `"@s/odd-name@^7.1.2":`,
+			expected: "@s/odd-name",
+		},
+		{
+			line:     `"@/code-frame@^7.3.4":`,
+			expected: "",
+		},
+		{
+			line:     `"code-frame":`,
+			expected: "",
+		},
+	}
+
+	for _, test := range tests {
+		test := test
+		t.Run(test.expected, func(t *testing.T) {
+			t.Parallel()
+			actual := findPackageName(test.line)
+			assert.Equal(t, test.expected, actual)
+		})
+	}
+}
+
+func TestParseYarnFindPackageVersions(t *testing.T) {
+	tests := []struct {
+		line     string
+		expected string
+	}{
+		{
+			line:     `  version "7.10.4"`,
+			expected: "7.10.4",
+		},
+		{
+			line:     ` version "7.11.5"`,
+			expected: "7.11.5",
+		},
+		{
+			line:     `version "7.12.6"`,
+			expected: "",
+		},
+		{
+			line:     `  version "0.0.0"`,
+			expected: "0.0.0",
+		},
+		{
+			line:     `  version "2" `,
+			expected: "2",
+		},
+		{
+			line:     `  version "9.3"`,
+			expected: "9.3",
+		},
+		{
+			line:     "ajv@^6.10.2, ajv@^6.5.5",
+			expected: "",
+		},
+		{
+			line:     "atob@^2.1.2:",
+			expected: "",
+		},
+		{
+			line:     `"color-convert@npm:^1.9.0":`,
+			expected: "",
+		},
+		{
+			line:     "  version: 1.9.3",
+			expected: "1.9.3",
+		},
+		{
+			line:     "  version: 2",
+			expected: "2",
+		},
+		{
+			line:     "  version: 9.3",
+			expected: "9.3",
+		},
+		{
+			line:     "ajv@^6.10.2, ajv@^6.5.5",
+			expected: "",
+		},
+		{
+			line:     "atob@^2.1.2:",
+			expected: "",
+		},
+		{
+			line:     "  version: 1.0.0-alpha+001",
+			expected: "1.0.0-alpha",
+		},
+		{
+			line:     "  version: 1.0.0-beta_test+exp.sha.5114f85",
+			expected: "1.0.0-beta_test",
+		},
+		{
+			line:     "  version: 1.0.0+21AF26D3-117B344092BD",
+			expected: "1.0.0",
+		},
+		{
+			line:     "  version: 0.0.0-use.local",
+			expected: "0.0.0-use.local",
+		},
+	}
+
+	for _, test := range tests {
+		test := test
+		t.Run(test.expected, func(t *testing.T) {
+			t.Parallel()
+			actual := findPackageVersion(test.line)
+			assert.Equal(t, test.expected, actual)
+		})
+	}
 }

syft/pkg/cataloger/javascript/test-fixtures/yarn-berry/yarn.lock

@@ -0,0 +1,110 @@
+# This file is generated by running "yarn install" inside your project.
+# Manual changes might be lost - proceed with caution!
+
+__metadata:
+  version: 6
+  cacheKey: 8
+
+"@babel/code-frame@npm:7.10.4":
+  version: 7.10.4
+  resolution: "@babel/code-frame@npm:7.10.4"
+  dependencies:
+    "@babel/highlight": ^7.10.4
+  checksum: feb4543c8a509fe30f0f6e8d7aa84f82b41148b963b826cd330e34986f649a85cb63b2f13dd4effdf434ac555d16f14940b8ea5f4433297c2f5ff85486ded019
+  languageName: node
+  linkType: hard
+
+"@types/minimatch@npm:3.0.3":
+  version: 3.0.3
+  resolution: "@types/minimatch@npm:3.0.3"
+  checksum: b80259d55b96ef24cb3bb961b6dc18b943f2bb8838b4d8e7bead204f3173e551a416ffa49f9aaf1dc431277fffe36214118628eacf4aea20119df8835229901b
+  languageName: node
+  linkType: hard
+
+"@types/qs@npm:6.9.4":
+  version: 6.9.4
+  resolution: "@types/qs@npm:6.9.4"
+  checksum: 77e509ed213f7694ae35f84a58b88da8744aad019e93556af6aeab4289287abbe71836c051d00649dbac0289ea199e408442590cfb1785009de11c3c8d0cbbea
+  languageName: node
+  linkType: hard
+
+"@types/qs@npm:6.9.4":
+  version: 6.9.4
+  resolution: "@types/qs@npm:6.9.4"
+  checksum: 77e509ed213f7694ae35f84a58b88da8744aad019e93556af6aeab4289287abbe71836c051d00649dbac0289ea199e408442590cfb1785009de11c3c8d0cbbea
+  languageName: node
+  linkType: hard
+
+"ajv@npm:6.12.3":
+  version: 6.12.3
+  resolution: "ajv@npm:6.12.3"
+  dependencies:
+    fast-deep-equal: ^3.1.1
+    fast-json-stable-stringify: ^2.0.0
+    json-schema-traverse: ^0.4.1
+    uri-js: ^4.2.2
+  checksum: ca559d34710e6969d33bc1316282e1ece4d4d99ff5fdca4bfe31947740f8f90e7824238cdc2954e499cf75b2432e3e6c56b32814ebe04fccf8abcc3fbf36b348
+  languageName: node
+  linkType: hard
+
+"atob@npm:2.1.2":
+  version: 2.1.2
+  resolution: "atob@npm:2.1.2"
+  bin:
+    atob: bin/atob.js
+  checksum: dfeeeb70090c5ebea7be4b9f787f866686c645d9f39a0d184c817252d0cf08455ed25267d79c03254d3be1f03ac399992a792edcd5ffb9c91e097ab5ef42833a
+  languageName: node
+  linkType: hard
+
+"aws-sdk@npm:2.706.0":
+  version: 2.706.0
+  resolution: "aws-sdk@npm:2.706.0"
+  dependencies:
+    buffer: 4.9.2
+    events: 1.1.1
+    ieee754: 1.1.13
+    jmespath: 0.15.0
+    querystring: 0.2.0
+    sax: 1.2.1
+    url: 0.10.3
+    uuid: 3.3.2
+    xml2js: 0.4.19
+  checksum: bf8ca2fc4f758bdebd04051ec15729affad3eb0e18eed4ae41db5b7d6ff2aed2cf3a12ae082c11b955df0125378c57b8406e1f91006e48f0c162fdbe4ee4e330
+  languageName: node
+  linkType: hard
+
+"jhipster-core@npm:7.3.4":
+  version: 7.3.4
+  resolution: "jhipster-core@npm:7.3.4"
+  dependencies:
+    chevrotain: 7.0.1
+    fs-extra: 8.1.0
+    lodash: 4.17.15
+    winston: 3.2.1
+  checksum: 6a97741d574a42a138f98596c668370b41ec8870335bcd758b6b890e279ba30d4d2be447f8cecbf416286f2c53636b406a63a773c7b00709c95af0a9a3f9b397
+  languageName: node
+  linkType: hard
+
+"asn1.js@npm:4.10.1":
+  version: 4.10.1
+  resolution: "asn1.js@npm:4.10.1"
+  dependencies:
+    bn.js: ^4.0.0
+    inherits: ^2.0.1
+    minimalistic-assert: ^1.0.0
+  checksum: 9289a1a55401238755e3142511d7b8f6fc32f08c86ff68bd7100da8b6c186179dd6b14234fba2f7f6099afcd6758a816708485efe44bc5b2a6ec87d9ceeddbb5
+  languageName: node
+  linkType: hard
+
+"c0n-fab_u.laTION@workspace:.":
+  version: 7.7.7
+  resolution: "newtest@workspace:."
+  dependencies:
+    "@babel/code-frame": 7.10.4
+    "@types/minimatch": 3.0.3
+    "@types/qs": 6.9.4
+    ajv: 6.12.3
+    asn1.js: 4.10.1
+    atob: 2.1.2
+  languageName: unknown
+  linkType: soft

syft/pkg/cataloger/ruby/parse_gemfile_lock.go

@@ -14,7 +14,7 @@ import (
 // integrity check
 var _ common.ParserFn = parseGemFileLockEntries
 
-var sectionsOfInterest = internal.NewStringSetFromSlice([]string{"GEM"})
+var sectionsOfInterest = internal.NewStringSet("GEM")
 
 // parseGemFileLockEntries is a parser function for Gemfile.lock contents, returning all Gems discovered.
 func parseGemFileLockEntries(_ string, reader io.Reader) ([]*pkg.Package, []artifact.Relationship, error) {

syft/pkg/rpmdb_metadata.go

@@ -5,12 +5,10 @@ import (
 	"sort"
 	"strconv"
 
-	"github.com/anchore/syft/syft/file"
-
-	"github.com/scylladb/go-set/strset"
-
 	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/linux"
+	"github.com/scylladb/go-set/strset"
 )
 
 const RpmDBGlob = "**/var/lib/rpm/Packages"
@@ -24,7 +22,7 @@ var (
 type RpmdbMetadata struct {
 	Name      string            `json:"name"`
 	Version   string            `json:"version"`
-	Epoch     *int              `json:"epoch"  cyclonedx:"epoch"`
+	Epoch     *int              `json:"epoch"  cyclonedx:"epoch" jsonschema:"nullable"`
 	Arch      string            `json:"architecture"`
 	Release   string            `json:"release" cyclonedx:"release"`
 	SourceRpm string            `json:"sourceRpm" cyclonedx:"sourceRpm"`

syft/sbom/format.go

@@ -0,0 +1,78 @@
+package sbom
+
+import (
+	"errors"
+	"io"
+)
+
+var (
+	ErrEncodingNotSupported   = errors.New("encoding not supported")
+	ErrDecodingNotSupported   = errors.New("decoding not supported")
+	ErrValidationNotSupported = errors.New("validation not supported")
+)
+
+type FormatID string
+
+type Format interface {
+	ID() FormatID
+	Encode(io.Writer, SBOM) error
+	Decode(io.Reader) (*SBOM, error)
+	Validate(io.Reader) error
+}
+
+type format struct {
+	id        FormatID
+	encoder   Encoder
+	decoder   Decoder
+	validator Validator
+}
+
+// Decoder is a function that can convert an SBOM document of a specific format from a reader into Syft native objects.
+type Decoder func(reader io.Reader) (*SBOM, error)
+
+// Encoder is a function that can transform Syft native objects into an SBOM document of a specific format written to the given writer.
+type Encoder func(io.Writer, SBOM) error
+
+// Validator reads the SBOM from the given reader and assesses whether the document conforms to the specific SBOM format.
+// The validator should positively confirm if the SBOM is not only the format but also has the minimal set of values
+// that the format requires. For example, all syftjson formatted documents have a schema section which should have
+// "anchore/syft" within the version --if this isn't found then the validator should raise an error. These active
+// assertions protect against "simple" format decoding validations that may lead to false positives (e.g. I decoded
+// json successfully therefore this must be the target format, however, all values are their default zero-value and
+// really represent a different format that also uses json)
+type Validator func(reader io.Reader) error
+
+func NewFormat(id FormatID, encoder Encoder, decoder Decoder, validator Validator) Format {
+	return &format{
+		id:        id,
+		encoder:   encoder,
+		decoder:   decoder,
+		validator: validator,
+	}
+}
+
+func (f format) ID() FormatID {
+	return f.id
+}
+
+func (f format) Encode(output io.Writer, s SBOM) error {
+	if f.encoder == nil {
+		return ErrEncodingNotSupported
+	}
+	return f.encoder(output, s)
+}
+
+func (f format) Decode(reader io.Reader) (*SBOM, error) {
+	if f.decoder == nil {
+		return nil, ErrDecodingNotSupported
+	}
+	return f.decoder(reader)
+}
+
+func (f format) Validate(reader io.Reader) error {
+	if f.validator == nil {
+		return ErrValidationNotSupported
+	}
+
+	return f.validator(reader)
+}

syft/sbom/multi_writer.go

@@ -1,71 +1,41 @@
-package output
+package sbom
 
 import (
 	"fmt"
-	"io"
 	"os"
 	"path"
 
-	"github.com/anchore/syft/syft/format"
-	"github.com/anchore/syft/syft/sbom"
+	"github.com/anchore/syft/internal/log"
 	"github.com/hashicorp/go-multierror"
+	"github.com/mitchellh/go-homedir"
 )
 
-// streamWriter implements sbom.Writer for a given format and io.Writer, also providing a close function for cleanup
-type streamWriter struct {
-	format format.Format
-	out    io.Writer
-	close  func() error
-}
-
-// Write the provided SBOM to the data stream
-func (w *streamWriter) Write(s sbom.SBOM) error {
-	return w.format.Encode(w.out, s)
-}
-
-// Close any resources, such as open files
-func (w *streamWriter) Close() error {
-	if w.close != nil {
-		return w.close()
-	}
-	return nil
-}
-
 // multiWriter holds a list of child sbom.Writers to apply all Write and Close operations to
 type multiWriter struct {
-	writers []sbom.Writer
-}
-
-// Write writes the SBOM to all writers
-func (m *multiWriter) Write(s sbom.SBOM) (errs error) {
-	for _, w := range m.writers {
-		err := w.Write(s)
-		if err != nil {
-			errs = multierror.Append(errs, err)
-		}
-	}
-	return errs
-}
-
-// Close closes all writers
-func (m *multiWriter) Close() (errs error) {
-	for _, w := range m.writers {
-		err := w.Close()
-		if err != nil {
-			errs = multierror.Append(errs, err)
-		}
-	}
-	return errs
+	writers []Writer
 }
 
 // WriterOption Format and path strings used to create sbom.Writer
 type WriterOption struct {
-	Format format.Format
+	Format Format
 	Path   string
 }
 
-// MakeWriter create all report writers from input options; if a file is not specified, os.Stdout is used
-func MakeWriter(options ...WriterOption) (_ sbom.Writer, errs error) {
+func NewWriterOption(f Format, p string) WriterOption {
+	expandedPath, err := homedir.Expand(p)
+	if err != nil {
+		log.Warnf("could not expand given writer output path=%q: %w", p, err)
+		// ignore errors
+		expandedPath = p
+	}
+	return WriterOption{
+		Format: f,
+		Path:   expandedPath,
+	}
+}
+
+// NewWriter create all report writers from input options; if a file is not specified, os.Stdout is used
+func NewWriter(options ...WriterOption) (_ Writer, err error) {
 	if len(options) == 0 {
 		return nil, fmt.Errorf("no output options provided")
 	}
@@ -73,9 +43,11 @@ func MakeWriter(options ...WriterOption) (_ sbom.Writer, errs error) {
 	out := &multiWriter{}
 
 	defer func() {
-		if errs != nil {
+		if err != nil {
 			// close any previously opened files; we can't really recover from any errors
-			_ = out.Close()
+			if err := out.Close(); err != nil {
+				log.Warnf("unable to close sbom writers: %+v", err)
+			}
 		}
 	}()
 
@@ -114,3 +86,25 @@ func MakeWriter(options ...WriterOption) (_ sbom.Writer, errs error) {
 
 	return out, nil
 }
+
+// Write writes the SBOM to all writers
+func (m *multiWriter) Write(s SBOM) (errs error) {
+	for _, w := range m.writers {
+		err := w.Write(s)
+		if err != nil {
+			errs = multierror.Append(errs, err)
+		}
+	}
+	return errs
+}
+
+// Close closes all writers
+func (m *multiWriter) Close() (errs error) {
+	for _, w := range m.writers {
+		err := w.Close()
+		if err != nil {
+			errs = multierror.Append(errs, err)
+		}
+	}
+	return errs
+}

syft/sbom/multi_writer_test.go

@@ -1,17 +1,23 @@
-package output
+package sbom
 
 import (
+	"io"
+	"path/filepath"
 	"strings"
 	"testing"
 
-	"github.com/anchore/syft/internal/formats/spdx22json"
-	"github.com/anchore/syft/internal/formats/syftjson"
-	"github.com/anchore/syft/internal/formats/table"
-	"github.com/anchore/syft/internal/formats/text"
-
+	"github.com/docker/docker/pkg/homedir"
 	"github.com/stretchr/testify/assert"
 )
 
+func dummyEncoder(io.Writer, SBOM) error {
+	return nil
+}
+
+func dummyFormat(name string) Format {
+	return NewFormat(FormatID(name), dummyEncoder, nil, nil)
+}
+
 type writerConfig struct {
 	format string
 	file   string
@@ -23,7 +29,7 @@ func TestOutputWriter(t *testing.T) {
 	testName := func(options []WriterOption, err bool) string {
 		var out []string
 		for _, opt := range options {
-			out = append(out, string(opt.Format.Option)+"="+opt.Path)
+			out = append(out, string(opt.Format.ID())+"="+opt.Path)
 		}
 		errs := ""
 		if err {
@@ -44,7 +50,7 @@ func TestOutputWriter(t *testing.T) {
 		{
 			outputs: []WriterOption{
 				{
-					Format: table.Format(),
+					Format: dummyFormat("table"),
 					Path:   "",
 				},
 			},
@@ -57,7 +63,7 @@ func TestOutputWriter(t *testing.T) {
 		{
 			outputs: []WriterOption{
 				{
-					Format: syftjson.Format(),
+					Format: dummyFormat("json"),
 				},
 			},
 			expected: []writerConfig{
@@ -69,7 +75,7 @@ func TestOutputWriter(t *testing.T) {
 		{
 			outputs: []WriterOption{
 				{
-					Format: syftjson.Format(),
+					Format: dummyFormat("json"),
 					Path:   "test-2.json",
 				},
 			},
@@ -83,11 +89,11 @@ func TestOutputWriter(t *testing.T) {
 		{
 			outputs: []WriterOption{
 				{
-					Format: syftjson.Format(),
+					Format: dummyFormat("json"),
 					Path:   "test-3/1.json",
 				},
 				{
-					Format: spdx22json.Format(),
+					Format: dummyFormat("spdx-json"),
 					Path:   "test-3/2.json",
 				},
 			},
@@ -105,10 +111,10 @@ func TestOutputWriter(t *testing.T) {
 		{
 			outputs: []WriterOption{
 				{
-					Format: text.Format(),
+					Format: dummyFormat("text"),
 				},
 				{
-					Format: spdx22json.Format(),
+					Format: dummyFormat("spdx-json"),
 					Path:   "test-4.json",
 				},
 			},
@@ -133,7 +139,7 @@ func TestOutputWriter(t *testing.T) {
 				}
 			}
 
-			writer, err := MakeWriter(outputs...)
+			writer, err := NewWriter(outputs...)
 
 			if test.err {
 				assert.Error(t, err)
@@ -149,7 +155,7 @@ func TestOutputWriter(t *testing.T) {
 			for i, e := range test.expected {
 				w := mw.writers[i].(*streamWriter)
 
-				assert.Equal(t, string(w.format.Option), e.format)
+				assert.Equal(t, string(w.format.ID()), e.format)
 
 				if e.file != "" {
 					assert.FileExists(t, tmp+e.file)
@@ -166,3 +172,33 @@ func TestOutputWriter(t *testing.T) {
 		})
 	}
 }
+
+func TestNewWriterOption(t *testing.T) {
+	tests := []struct {
+		name     string
+		path     string
+		expected string
+	}{
+		{
+			name:     "expand home dir",
+			path:     "~/place.txt",
+			expected: filepath.Join(homedir.Get(), "place.txt"),
+		},
+		{
+			name:     "passthrough other paths",
+			path:     "/other/place.txt",
+			expected: "/other/place.txt",
+		},
+		{
+			name:     "no path",
+			path:     "",
+			expected: "",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			o := NewWriterOption(dummyFormat("table"), tt.path)
+			assert.Equal(t, tt.expected, o.Path)
+		})
+	}
+}