simplify yarn test expressions

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

cmd/attest.go

@@ -9,10 +9,6 @@ import (
 	"os"
 	"strings"
 
-	"github.com/anchore/syft/internal/formats/cyclonedx13json"
-	"github.com/anchore/syft/internal/formats/spdx22json"
-	"github.com/anchore/syft/internal/formats/syftjson"
-
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/syft/internal"
@@ -21,7 +17,7 @@ import (
 	"github.com/anchore/syft/internal/ui"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/sbom"
+	"github.com/anchore/syft/syft/format"
 	"github.com/anchore/syft/syft/source"
 	"github.com/in-toto/in-toto-golang/in_toto"
 	"github.com/pkg/errors"
@@ -53,11 +49,7 @@ const (
 	intotoJSONDsseType = `application/vnd.in-toto+json`
 )
 
-var attestFormats = []sbom.FormatID{
-	syftjson.ID,
-	spdx22json.ID,
-	cyclonedx13json.ID,
-}
+var attestFormats = []format.Option{format.SPDXJSONOption, format.CycloneDxJSONOption, format.JSONOption}
 
 var (
 	attestCmd = &cobra.Command{
@@ -131,7 +123,7 @@ func selectPassFunc(keypath string) (cosign.PassFunc, error) {
 func attestExec(ctx context.Context, _ *cobra.Command, args []string) error {
 	// can only be an image for attestation or OCI DIR
 	userInput := args[0]
-	si, err := source.ParseInput(userInput, appConfig.Platform, false)
+	si, err := source.ParseInput(userInput, false)
 	if err != nil {
 		return fmt.Errorf("could not generate source input for attest command: %w", err)
 	}
@@ -157,10 +149,10 @@ func attestExec(ctx context.Context, _ *cobra.Command, args []string) error {
 		return fmt.Errorf("unable to generate attestation for more than one output")
 	}
 
-	format := syft.FormatByName(appConfig.Output[0])
-	predicateType := formatPredicateType(format)
+	output := format.ParseOption(appConfig.Output[0])
+	predicateType := assertPredicateType(output)
 	if predicateType == "" {
-		return fmt.Errorf("could not produce attestation predicate for given format: %q. Available formats: %+v", formatAliases(format.ID()), formatAliases(attestFormats...))
+		return fmt.Errorf("could not produce attestation predicate for given format: %q. Available formats: %+v", output, attestFormats)
 	}
 
 	passFunc, err := selectPassFunc(appConfig.Attest.Key)
@@ -180,7 +172,7 @@ func attestExec(ctx context.Context, _ *cobra.Command, args []string) error {
 	defer sv.Close()
 
 	return eventLoop(
-		attestationExecWorker(*si, format, predicateType, sv),
+		attestationExecWorker(*si, output, predicateType, sv),
 		setupSignals(),
 		eventSubscription,
 		stereoscope.Cleanup,
@@ -188,7 +180,7 @@ func attestExec(ctx context.Context, _ *cobra.Command, args []string) error {
 	)
 }
 
-func attestationExecWorker(sourceInput source.Input, format sbom.Format, predicateType string, sv *sign.SignerVerifier) <-chan error {
+func attestationExecWorker(sourceInput source.Input, output format.Option, predicateType string, sv *sign.SignerVerifier) <-chan error {
 	errs := make(chan error)
 	go func() {
 		defer close(errs)
@@ -208,7 +200,7 @@ func attestationExecWorker(sourceInput source.Input, format sbom.Format, predica
 			return
 		}
 
-		sbomBytes, err := syft.Encode(*s, format)
+		sbomBytes, err := syft.Encode(*s, output)
 		if err != nil {
 			errs <- err
 			return
@@ -223,14 +215,14 @@ func attestationExecWorker(sourceInput source.Input, format sbom.Format, predica
 	return errs
 }
 
-func formatPredicateType(format sbom.Format) string {
-	switch format.ID() {
-	case spdx22json.ID:
+func assertPredicateType(output format.Option) string {
+	switch output {
+	case format.SPDXJSONOption:
 		return in_toto.PredicateSPDX
-	case cyclonedx13json.ID:
-		// Tentative see https://github.com/in-toto/attestation/issues/82
+	// Tentative see https://github.com/in-toto/attestation/issues/82
+	case format.CycloneDxJSONOption:
 		return "https://cyclonedx.org/bom"
-	case syftjson.ID:
+	case format.JSONOption:
 		return "https://syft.dev/bom"
 	default:
 		return ""
@@ -301,13 +293,8 @@ func setAttestFlags(flags *pflag.FlagSet) {
 
 	// in-toto attestations only support JSON predicates, so not all SBOM formats that syft can output are supported
 	flags.StringP(
-		"output", "o", formatAliases(syftjson.ID)[0],
-		fmt.Sprintf("the SBOM format encapsulated within the attestation, available options=%v", formatAliases(attestFormats...)),
-	)
-
-	flags.StringP(
-		"platform", "", "",
-		"an optional platform specifier for container image sources (e.g. 'linux/arm64', 'linux/arm64/v8', 'arm64', 'linux')",
+		"output", "o", string(format.JSONOption),
+		fmt.Sprintf("the SBOM format encapsulated within the attestation, available options=%v", attestFormats),
 	)
 }
 

cmd/cmd.go

@@ -72,8 +72,8 @@ func initCmdAliasBindings() {
 			panic(err)
 		}
 	case attestCmd:
-		// the --output and --platform options are independently defined flags, but a shared config option
-		if err = bindSharedConfigOption(attestCmd.Flags()); err != nil {
+		// the --output option is an independently defined flag, but a shared config option
+		if err = bindSharedOutputConfigOption(attestCmd.Flags()); err != nil {
 			panic(err)
 		}
 		// even though the root command or packages command is NOT being run, we still need default bindings
@@ -90,15 +90,11 @@ func initCmdAliasBindings() {
 	}
 }
 
-func bindSharedConfigOption(flags *pflag.FlagSet) error {
+func bindSharedOutputConfigOption(flags *pflag.FlagSet) error {
 	if err := viper.BindPFlag("output", flags.Lookup("output")); err != nil {
 		return err
 	}
 
-	if err := viper.BindPFlag("platform", flags.Lookup("platform")); err != nil {
-		return err
-	}
-
 	return nil
 }
 

cmd/format_aliases.go

@@ -1,30 +0,0 @@
-package cmd
-
-import (
-	"github.com/anchore/syft/syft"
-	"github.com/anchore/syft/syft/sbom"
-)
-
-func formatAliases(ids ...sbom.FormatID) (aliases []string) {
-	for _, id := range ids {
-		switch id {
-		case syft.JSONFormatID:
-			aliases = append(aliases, "syft-json")
-		case syft.TextFormatID:
-			aliases = append(aliases, "text")
-		case syft.TableFormatID:
-			aliases = append(aliases, "table")
-		case syft.SPDXJSONFormatID:
-			aliases = append(aliases, "spdx-json")
-		case syft.SPDXTagValueFormatID:
-			aliases = append(aliases, "spdx-tag-value")
-		case syft.CycloneDxXMLFormatID:
-			aliases = append(aliases, "cyclonedx-xml")
-		case syft.CycloneDxJSONFormatID:
-			aliases = append(aliases, "cyclonedx-json")
-		default:
-			aliases = append(aliases, string(id))
-		}
-	}
-	return aliases
-}

cmd/output_writer.go

@@ -4,10 +4,9 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/anchore/syft/internal/formats/table"
-
-	"github.com/anchore/syft/syft"
-
+	"github.com/anchore/syft/internal/formats"
+	"github.com/anchore/syft/internal/output"
+	"github.com/anchore/syft/syft/format"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/hashicorp/go-multierror"
 )
@@ -20,7 +19,7 @@ func makeWriter(outputs []string, defaultFile string) (sbom.Writer, error) {
 		return nil, err
 	}
 
-	writer, err := sbom.NewWriter(outputOptions...)
+	writer, err := output.MakeWriter(outputOptions...)
 	if err != nil {
 		return nil, err
 	}
@@ -29,10 +28,10 @@ func makeWriter(outputs []string, defaultFile string) (sbom.Writer, error) {
 }
 
 // parseOptions utility to parse command-line option strings and retain the existing behavior of default format and file
-func parseOptions(outputs []string, defaultFile string) (out []sbom.WriterOption, errs error) {
+func parseOptions(outputs []string, defaultFile string) (out []output.WriterOption, errs error) {
 	// always should have one option -- we generally get the default of "table", but just make sure
 	if len(outputs) == 0 {
-		outputs = append(outputs, string(table.ID))
+		outputs = append(outputs, string(format.TableOption))
 	}
 
 	for _, name := range outputs {
@@ -41,25 +40,31 @@ func parseOptions(outputs []string, defaultFile string) (out []sbom.WriterOption
 		// split to at most two parts for <format>=<file>
 		parts := strings.SplitN(name, "=", 2)
 
-		// the format name is the first part
+		// the format option is the first part
 		name = parts[0]
 
 		// default to the --file or empty string if not specified
 		file := defaultFile
 
-		// If a file is specified as part of the output formatName, use that
+		// If a file is specified as part of the output option, use that
 		if len(parts) > 1 {
 			file = parts[1]
 		}
 
-		format := syft.FormatByName(name)
-		if format == nil {
+		option := format.ParseOption(name)
+		if option == format.UnknownFormatOption {
 			errs = multierror.Append(errs, fmt.Errorf("bad output format: '%s'", name))
 			continue
 		}
 
-		out = append(out, sbom.WriterOption{
-			Format: format,
+		encoder := formats.ByOption(option)
+		if encoder == nil {
+			errs = multierror.Append(errs, fmt.Errorf("unknown format: %s", outputFormat))
+			continue
+		}
+
+		out = append(out, output.WriterOption{
+			Format: *encoder,
 			Path:   file,
 		})
 	}

cmd/packages.go

@@ -10,13 +10,12 @@ import (
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/anchore"
 	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/internal/formats/table"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/ui"
 	"github.com/anchore/syft/internal/version"
-	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/format"
 	"github.com/anchore/syft/syft/pkg/cataloger"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
@@ -28,7 +27,7 @@ import (
 )
 
 const (
-	packagesExample = `  {{.appName}} {{.command}} alpine:latest                    a summary of discovered packages
+	packagesExample = `  {{.appName}} {{.command}} alpine:latest                a summary of discovered packages
   {{.appName}} {{.command}} alpine:latest -o json            show all possible cataloging details
   {{.appName}} {{.command}} alpine:latest -o cyclonedx       show a CycloneDX formatted SBOM
   {{.appName}} {{.command}} alpine:latest -o cyclonedx-json  show a CycloneDX JSON formatted SBOM
@@ -101,8 +100,8 @@ func setPackageFlags(flags *pflag.FlagSet) {
 		fmt.Sprintf("selection of layers to catalog, options=%v", source.AllScopes))
 
 	flags.StringArrayP(
-		"output", "o", formatAliases(table.ID),
-		fmt.Sprintf("report output format, options=%v", formatAliases(syft.FormatIDs()...)),
+		"output", "o", []string{string(format.TableOption)},
+		fmt.Sprintf("report output format, options=%v", format.AllOptions),
 	)
 
 	flags.StringP(
@@ -110,11 +109,6 @@ func setPackageFlags(flags *pflag.FlagSet) {
 		"file to write the default report output to (default is STDOUT)",
 	)
 
-	flags.StringP(
-		"platform", "", "",
-		"an optional platform specifier for container image sources (e.g. 'linux/arm64', 'linux/arm64/v8', 'arm64', 'linux')",
-	)
-
 	// Upload options //////////////////////////////////////////////////////////
 	flags.StringP(
 		"host", "H", "",
@@ -156,7 +150,7 @@ func bindPackagesConfigOptions(flags *pflag.FlagSet) error {
 	if err := bindExclusivePackagesConfigOptions(flags); err != nil {
 		return err
 	}
-	if err := bindSharedConfigOption(flags); err != nil {
+	if err := bindSharedOutputConfigOption(flags); err != nil {
 		return err
 	}
 	return nil
@@ -235,7 +229,7 @@ func packagesExec(_ *cobra.Command, args []string) error {
 
 	// could be an image or a directory, with or without a scheme
 	userInput := args[0]
-	si, err := source.ParseInput(userInput, appConfig.Platform, true)
+	si, err := source.ParseInput(userInput, true)
 	if err != nil {
 		return fmt.Errorf("could not generate source input for packages command: %w", err)
 	}

cmd/power_user.go

@@ -9,6 +9,7 @@ import (
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/formats/syftjson"
 	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/output"
 	"github.com/anchore/syft/internal/ui"
 	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft/artifact"
@@ -73,7 +74,7 @@ func powerUserExec(_ *cobra.Command, args []string) error {
 	// could be an image or a directory, with or without a scheme
 	userInput := args[0]
 
-	writer, err := sbom.NewWriter(sbom.WriterOption{
+	writer, err := output.MakeWriter(output.WriterOption{
 		Format: syftjson.Format(),
 		Path:   appConfig.File,
 	})
@@ -114,7 +115,7 @@ func powerUserExecWorker(userInput string, writer sbom.Writer) <-chan error {
 			return
 		}
 
-		si, err := source.ParseInput(userInput, appConfig.Platform, true)
+		si, err := source.ParseInput(userInput, true)
 		if err != nil {
 			errs <- err
 			return

cmd/version.go

@@ -11,7 +11,7 @@ import (
 	"github.com/spf13/cobra"
 )
 
-var versionCmdOutputFormat string
+var outputFormat string
 
 var versionCmd = &cobra.Command{
 	Use:   "version",
@@ -20,14 +20,14 @@ var versionCmd = &cobra.Command{
 }
 
 func init() {
-	versionCmd.Flags().StringVarP(&versionCmdOutputFormat, "output", "o", "text", "format to show version information (available=[text, json])")
+	versionCmd.Flags().StringVarP(&outputFormat, "output", "o", "text", "format to show version information (available=[text, json])")
 	rootCmd.AddCommand(versionCmd)
 }
 
 func printVersion(_ *cobra.Command, _ []string) {
 	versionInfo := version.FromBuild()
 
-	switch versionCmdOutputFormat {
+	switch outputFormat {
 	case "text":
 		fmt.Println("Application:    ", internal.ApplicationName)
 		fmt.Println("Version:        ", versionInfo.Version)
@@ -54,7 +54,7 @@ func printVersion(_ *cobra.Command, _ []string) {
 			os.Exit(1)
 		}
 	default:
-		fmt.Printf("unsupported output format: %s\n", versionCmdOutputFormat)
+		fmt.Printf("unsupported output format: %s\n", outputFormat)
 		os.Exit(1)
 	}
 }

go.mod

@@ -13,9 +13,10 @@ require (
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29
-	github.com/anchore/stereoscope v0.0.0-20220307154759-8a5a70c227d3
+	github.com/anchore/stereoscope v0.0.0-20220301220648-8aa8a4a0bf50
 	github.com/antihax/optional v1.0.0
 	github.com/bmatcuk/doublestar/v4 v4.0.2
+	github.com/docker/docker v20.10.12+incompatible
 	github.com/dustin/go-humanize v1.0.0
 	github.com/facebookincubator/nvdtools v0.1.4
 	github.com/go-test/deep v1.0.8
@@ -55,10 +56,7 @@ require (
 	gopkg.in/yaml.v2 v2.4.0
 )
 
-require (
-	github.com/docker/docker v20.10.12+incompatible
-	github.com/sigstore/cosign v1.6.0
-)
+require github.com/sigstore/cosign v1.5.2-0.20220302132634-73235ac02e4a
 
 require (
 	bitbucket.org/creachadair/shell v0.0.6 // indirect
@@ -172,7 +170,7 @@ require (
 	github.com/hashicorp/go-version v1.4.0 // indirect
 	github.com/hashicorp/golang-lru v0.5.4 // indirect
 	github.com/hashicorp/vault/api v1.3.1 // indirect
-	github.com/hashicorp/vault/sdk v0.4.1 // indirect
+	github.com/hashicorp/vault/sdk v0.3.0 // indirect
 	github.com/hashicorp/yamux v0.0.0-20211028200310-0bc27b27de87 // indirect
 	github.com/imdario/mergo v0.3.12 // indirect
 	github.com/jedisct1/go-minisign v0.0.0-20210703085342-c1f07ee84431 // indirect
@@ -216,7 +214,7 @@ require (
 	github.com/theupdateframework/go-tuf v0.0.0-20220211205608-f0c3294f63b9 // indirect
 	github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802 // indirect
 	github.com/urfave/cli v1.22.5 // indirect
-	github.com/xanzy/go-gitlab v0.56.0 // indirect
+	github.com/xanzy/go-gitlab v0.55.1 // indirect
 	github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2 // indirect
 	github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778 // indirect
 	github.com/zeebo/errs v1.2.2 // indirect
@@ -250,7 +248,6 @@ require (
 	golang.org/x/time v0.0.0-20211116232009-f0f3c7e86c11 // indirect
 	golang.org/x/tools v0.1.8 // indirect
 	google.golang.org/api v0.70.0 // indirect
-	google.golang.org/protobuf v1.27.1 // indirect
 	gopkg.in/cheggaaa/pb.v1 v1.0.28 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.0.0 // indirect
@@ -273,11 +270,11 @@ require (
 	// we are hinting brotli to latest due to warning when installing archiver v3:
 	// go: warning: github.com/andybalholm/brotli@v1.0.1: retracted by module author: occasional panics and data corruption
 	github.com/andybalholm/brotli v1.0.4 // indirect
-	github.com/containerd/containerd v1.5.10 // indirect
+	github.com/containerd/containerd v1.5.9 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.10.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/docker/cli v20.10.12+incompatible // indirect
-	github.com/docker/distribution v2.8.0+incompatible // indirect
+	github.com/docker/distribution v2.7.1+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.6.4 // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
 	github.com/docker/go-units v0.4.0 // indirect
@@ -324,6 +321,7 @@ require (
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20220218161850-94dd64e39d7c // indirect
 	google.golang.org/grpc v1.44.0 // indirect
+	google.golang.org/protobuf v1.27.1 // indirect
 	gopkg.in/ini.v1 v1.66.2 // indirect
 	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
 )

go.sum

@@ -284,8 +284,8 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZV
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29 h1:K9LfnxwhqvihqU0+MF325FNy7fsKV9EGaUxdfR4gnWk=
 github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29/go.mod h1:Oc1UkGaJwY6ND6vtAqPSlYrptKRJngHwkwB6W7l1uP0=
-github.com/anchore/stereoscope v0.0.0-20220307154759-8a5a70c227d3 h1:Kx2jlMdENAf4cVjYGYLI+fiavVhzhtmU89GUYDITJ1w=
-github.com/anchore/stereoscope v0.0.0-20220307154759-8a5a70c227d3/go.mod h1:XESZQTgFETDBatmyoet6XZ0zVknoIMDSAhj2INj2a5w=
+github.com/anchore/stereoscope v0.0.0-20220301220648-8aa8a4a0bf50 h1:+Fe67xv6NRLdZ5V9X2kw959XsKQCUx5/6RL/wQZfs44=
+github.com/anchore/stereoscope v0.0.0-20220301220648-8aa8a4a0bf50/go.mod h1:QpDHHV2h1NNfu7klzU75XC8RvSlaPK6HHgi0dy8A6sk=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.0.0/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
 github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
@@ -552,9 +552,8 @@ github.com/containerd/containerd v1.5.0-rc.0/go.mod h1:V/IXoMqNGgBlabz3tHD2TWDoT
 github.com/containerd/containerd v1.5.1/go.mod h1:0DOxVqwDy2iZvrZp2JUx/E+hS0UNTVn7dJnIOwtYR4g=
 github.com/containerd/containerd v1.5.7/go.mod h1:gyvv6+ugqY25TiXxcZC3L5yOeYgEw0QMhscqVp1AR9c=
 github.com/containerd/containerd v1.5.8/go.mod h1:YdFSv5bTFLpG2HIYmfqDpSYYTDX+mc5qtSuYx1YUb/s=
+github.com/containerd/containerd v1.5.9 h1:rs6Xg1gtIxaeyG+Smsb/0xaSDu1VgFhOCKBXxMxbsF4=
 github.com/containerd/containerd v1.5.9/go.mod h1:fvQqCfadDGga5HZyn3j4+dx56qj2I9YwBrlSdalvJYQ=
-github.com/containerd/containerd v1.5.10 h1:3cQ2uRVCkJVcx5VombsE7105Gl9Wrl7ORAO3+4+ogf4=
-github.com/containerd/containerd v1.5.10/go.mod h1:fvQqCfadDGga5HZyn3j4+dx56qj2I9YwBrlSdalvJYQ=
 github.com/containerd/continuity v0.0.0-20190426062206-aaeac12a7ffc/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
 github.com/containerd/continuity v0.0.0-20190815185530-f2a389ac0a02/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
 github.com/containerd/continuity v0.0.0-20191127005431-f65d91d395eb/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
@@ -682,9 +681,8 @@ github.com/docker/cli v20.10.12+incompatible h1:lZlz0uzG+GH+c0plStMUdF/qk3ppmgns
 github.com/docker/cli v20.10.12+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v0.0.0-20190905152932-14b96e55d84c/go.mod h1:0+TTO4EOBfRPhZXAeF1Vu+W3hHZ8eLp8PgKVZlcvtFY=
 github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/distribution v2.7.1+incompatible h1:a5mlkVzth6W5A4fOsS3D2EO5BUmsJpcB+cRlLU7cSug=
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/distribution v2.8.0+incompatible h1:l9EaZDICImO1ngI+uTifW+ZYvvz7fKISBAKpg+MbWbY=
-github.com/docker/distribution v2.8.0+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker v20.10.10+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker v20.10.11+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker v20.10.12+incompatible h1:CEeNmFM0QZIsJCZKMkZx0ZcahTiewkrgiwfYD+dfl1U=
@@ -1351,9 +1349,8 @@ github.com/hashicorp/serf v0.9.6/go.mod h1:TXZNMjZQijwlDvp+r0b63xZ45H7JmCmgg4gpT
 github.com/hashicorp/vault/api v1.3.0/go.mod h1:EabNQLI0VWbWoGlA+oBLC8PXmR9D60aUVgQGvangFWQ=
 github.com/hashicorp/vault/api v1.3.1 h1:pkDkcgTh47PRjY1NEFeofqR4W/HkNUi9qIakESO2aRM=
 github.com/hashicorp/vault/api v1.3.1/go.mod h1:QeJoWxMFt+MsuWcYhmwRLwKEXrjwAFFywzhptMsTIUw=
+github.com/hashicorp/vault/sdk v0.3.0 h1:kR3dpxNkhh/wr6ycaJYqp6AFT/i2xaftbfnwZduTKEY=
 github.com/hashicorp/vault/sdk v0.3.0/go.mod h1:aZ3fNuL5VNydQk8GcLJ2TV8YCRVvyaakYkhZRoVuhj0=
-github.com/hashicorp/vault/sdk v0.4.1 h1:3SaHOJY687jY1fnB61PtL0cOkKItphrbLmux7T92HBo=
-github.com/hashicorp/vault/sdk v0.4.1/go.mod h1:aZ3fNuL5VNydQk8GcLJ2TV8YCRVvyaakYkhZRoVuhj0=
 github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
 github.com/hashicorp/yamux v0.0.0-20211028200310-0bc27b27de87 h1:xixZ2bWeofWV68J+x6AzmKuVM/JWCQwkWm6GW/MUR6I=
 github.com/hashicorp/yamux v0.0.0-20211028200310-0bc27b27de87/go.mod h1:CtWFDAQgb7dxtzFs4tWbplKIe2jSi3+5vKbgIO0SLnQ=
@@ -1943,8 +1940,8 @@ github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFR
 github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk=
 github.com/shurcooL/go-goon v0.0.0-20170922171312-37c2f522c041/go.mod h1:N5mDOmsrJOB+vfqUK+7DmDyjhSLIIBnXo9lvZJj3MWQ=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
-github.com/sigstore/cosign v1.6.0 h1:GBG+asPgsf2iawldL9uO8JDGbFO5yXuvaBTjdejsMzo=
-github.com/sigstore/cosign v1.6.0/go.mod h1:Ocd28z0Pwtd6+A8s/Vb4SbhwuWOqVdeYAW4yCGF4Ndg=
+github.com/sigstore/cosign v1.5.2-0.20220302132634-73235ac02e4a h1:4QV0ZqC9l82QRtDHdm3jYatY3VC70+a+kD9qbQ6Dn2Q=
+github.com/sigstore/cosign v1.5.2-0.20220302132634-73235ac02e4a/go.mod h1:54MEOuZykYBTeq/ds2M/3HIwuWDYJmgjX2GhvMJ8JNc=
 github.com/sigstore/fulcio v0.1.2-0.20220114150912-86a2036f9bc7 h1:XE7A9lJ+wYhmUFBWYTaw3Ph943zHB4iBYd5R0SX0ZOA=
 github.com/sigstore/fulcio v0.1.2-0.20220114150912-86a2036f9bc7/go.mod h1:ANQivY/lfOp9hN92S813LEthkm/kit96hzeIF3SNoZA=
 github.com/sigstore/rekor v0.4.1-0.20220114213500-23f583409af3 h1:mbqXrm8YZXN/cJMGeBkgPnswtfrOxDE1f7QZdJ+POQE=
@@ -2148,8 +2145,8 @@ github.com/withfig/autocomplete-tools/packages/cobra v0.0.0-20220122124547-31d38
 github.com/x-cray/logrus-prefixed-formatter v0.5.2 h1:00txxvfBM9muc0jiLIEAkAcIMJzfthRT6usrui8uGmg=
 github.com/x-cray/logrus-prefixed-formatter v0.5.2/go.mod h1:2duySbKsL6M18s5GU7VPsoEPHyzalCE06qoARUCeBBE=
 github.com/xanzy/go-gitlab v0.31.0/go.mod h1:sPLojNBn68fMUWSxIJtdVVIP8uSBYqesTfDUseX11Ug=
-github.com/xanzy/go-gitlab v0.56.0 h1:/QHBvk3IKVNwvXB/UOWVb5J6VCN6r2bg9/WxjUbFY/0=
-github.com/xanzy/go-gitlab v0.56.0/go.mod h1:F0QEXwmqiBUxCgJm8fE9S+1veX4XC9Z4cfaAbqwk4YM=
+github.com/xanzy/go-gitlab v0.55.1 h1:IgX/DS9buV0AUz8fuJPQkdl0fQGfBiAsAHxpun8sNhg=
+github.com/xanzy/go-gitlab v0.55.1/go.mod h1:F0QEXwmqiBUxCgJm8fE9S+1veX4XC9Z4cfaAbqwk4YM=
 github.com/xanzy/ssh-agent v0.2.1/go.mod h1:mLlQY/MoOhWBj+gOGMQkOeiEvkx+8pJSI+0Bx9h2kr4=
 github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
 github.com/xdg-go/scram v1.0.2/go.mod h1:1WAq6h33pAW+iRreB34OORO2Nf7qel3VV3fjBj+hCSs=

internal/config/application.go

@@ -46,7 +46,6 @@ type Application struct {
 	Registry           registry           `yaml:"registry" json:"registry" mapstructure:"registry"`
 	Exclusions         []string           `yaml:"exclude" json:"exclude" mapstructure:"exclude"`
 	Attest             attest             `yaml:"attest" json:"attest" mapstructure:"attest"`
-	Platform           string             `yaml:"platform" json:"platform" mapstructure:"platform"`
 }
 
 // PowerUserCatalogerEnabledDefault switches all catalogers to be enabled when running power-user command

internal/formats/common/cyclonedxhelpers/decoder.go

@@ -6,13 +6,14 @@ import (
 
 	"github.com/CycloneDX/cyclonedx-go"
 	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/format"
 	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 )
 
-func GetValidator(format cyclonedx.BOMFileFormat) sbom.Validator {
+func GetValidator(format cyclonedx.BOMFileFormat) format.Validator {
 	return func(reader io.Reader) error {
 		bom := &cyclonedx.BOM{}
 		err := cyclonedx.NewBOMDecoder(reader, format).Decode(bom)
@@ -27,7 +28,7 @@ func GetValidator(format cyclonedx.BOMFileFormat) sbom.Validator {
 	}
 }
 
-func GetDecoder(format cyclonedx.BOMFileFormat) sbom.Decoder {
+func GetDecoder(format cyclonedx.BOMFileFormat) format.Decoder {
 	return func(reader io.Reader) (*sbom.SBOM, error) {
 		bom := &cyclonedx.BOM{}
 		err := cyclonedx.NewBOMDecoder(reader, format).Decode(bom)

internal/formats/common/testutils/utils.go

@@ -9,6 +9,7 @@ import (
 	"github.com/anchore/stereoscope/pkg/filetree"
 	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/stereoscope/pkg/imagetest"
+	"github.com/anchore/syft/syft/format"
 	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
@@ -31,7 +32,7 @@ func FromSnapshot() ImageOption {
 	}
 }
 
-func AssertEncoderAgainstGoldenImageSnapshot(t *testing.T, format sbom.Format, sbom sbom.SBOM, testImage string, updateSnapshot bool, redactors ...redactor) {
+func AssertEncoderAgainstGoldenImageSnapshot(t *testing.T, format format.Format, sbom sbom.SBOM, testImage string, updateSnapshot bool, redactors ...redactor) {
 	var buffer bytes.Buffer
 
 	// grab the latest image contents and persist
@@ -65,7 +66,7 @@ func AssertEncoderAgainstGoldenImageSnapshot(t *testing.T, format sbom.Format, s
 	}
 }
 
-func AssertEncoderAgainstGoldenSnapshot(t *testing.T, format sbom.Format, sbom sbom.SBOM, updateSnapshot bool, redactors ...redactor) {
+func AssertEncoderAgainstGoldenSnapshot(t *testing.T, format format.Format, sbom sbom.SBOM, updateSnapshot bool, redactors ...redactor) {
 	var buffer bytes.Buffer
 
 	err := format.Encode(&buffer, sbom)

internal/formats/cyclonedx13json/format.go

@@ -3,14 +3,12 @@ package cyclonedx13json
 import (
 	"github.com/CycloneDX/cyclonedx-go"
 	"github.com/anchore/syft/internal/formats/common/cyclonedxhelpers"
-	"github.com/anchore/syft/syft/sbom"
+	"github.com/anchore/syft/syft/format"
 )
 
-const ID sbom.FormatID = "cyclonedx-1-json"
-
-func Format() sbom.Format {
-	return sbom.NewFormat(
-		ID,
+func Format() format.Format {
+	return format.NewFormat(
+		format.CycloneDxJSONOption,
 		encoder,
 		cyclonedxhelpers.GetDecoder(cyclonedx.BOMFileFormatJSON),
 		cyclonedxhelpers.GetValidator(cyclonedx.BOMFileFormatJSON),

internal/formats/cyclonedx13xml/format.go

@@ -3,14 +3,12 @@ package cyclonedx13xml
 import (
 	"github.com/CycloneDX/cyclonedx-go"
 	"github.com/anchore/syft/internal/formats/common/cyclonedxhelpers"
-	"github.com/anchore/syft/syft/sbom"
+	"github.com/anchore/syft/syft/format"
 )
 
-const ID sbom.FormatID = "cyclonedx-1-xml"
-
-func Format() sbom.Format {
-	return sbom.NewFormat(
-		ID,
+func Format() format.Format {
+	return format.NewFormat(
+		format.CycloneDxXMLOption,
 		encoder,
 		cyclonedxhelpers.GetDecoder(cyclonedx.BOMFileFormatXML),
 		cyclonedxhelpers.GetValidator(cyclonedx.BOMFileFormatXML),

internal/formats/formats.go

@@ -0,0 +1,46 @@
+package formats
+
+import (
+	"bytes"
+
+	"github.com/anchore/syft/internal/formats/cyclonedx13json"
+	"github.com/anchore/syft/internal/formats/cyclonedx13xml"
+	"github.com/anchore/syft/internal/formats/spdx22json"
+	"github.com/anchore/syft/internal/formats/spdx22tagvalue"
+	"github.com/anchore/syft/internal/formats/syftjson"
+	"github.com/anchore/syft/internal/formats/table"
+	"github.com/anchore/syft/internal/formats/text"
+	"github.com/anchore/syft/syft/format"
+)
+
+// TODO: eventually this is the source of truth for all formatters
+func All() []format.Format {
+	return []format.Format{
+		syftjson.Format(),
+		table.Format(),
+		cyclonedx13xml.Format(),
+		cyclonedx13json.Format(),
+		spdx22json.Format(),
+		spdx22tagvalue.Format(),
+		text.Format(),
+	}
+}
+
+func Identify(by []byte) (*format.Format, error) {
+	for _, f := range All() {
+		if err := f.Validate(bytes.NewReader(by)); err != nil {
+			continue
+		}
+		return &f, nil
+	}
+	return nil, nil
+}
+
+func ByOption(option format.Option) *format.Format {
+	for _, f := range All() {
+		if f.Option == option {
+			return &f
+		}
+	}
+	return nil
+}

internal/formats/formats_test.go

@@ -0,0 +1,34 @@
+package formats
+
+import (
+	"io"
+	"os"
+	"testing"
+
+	"github.com/anchore/syft/syft/format"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIdentify(t *testing.T) {
+	tests := []struct {
+		fixture  string
+		expected format.Option
+	}{
+		{
+			fixture:  "test-fixtures/alpine-syft.json",
+			expected: format.JSONOption,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.fixture, func(t *testing.T) {
+			f, err := os.Open(test.fixture)
+			assert.NoError(t, err)
+			by, err := io.ReadAll(f)
+			assert.NoError(t, err)
+			frmt, err := Identify(by)
+			assert.NoError(t, err)
+			assert.NotNil(t, frmt)
+			assert.Equal(t, test.expected, frmt.Option)
+		})
+	}
+}

internal/formats/spdx22json/format.go

@@ -1,15 +1,11 @@
 package spdx22json
 
-import (
-	"github.com/anchore/syft/syft/sbom"
-)
-
-const ID sbom.FormatID = "spdx-2-json"
+import "github.com/anchore/syft/syft/format"
 
 // note: this format is LOSSY relative to the syftjson format
-func Format() sbom.Format {
-	return sbom.NewFormat(
-		ID,
+func Format() format.Format {
+	return format.NewFormat(
+		format.SPDXJSONOption,
 		encoder,
 		decoder,
 		validator,

internal/formats/spdx22tagvalue/format.go

@@ -1,15 +1,11 @@
 package spdx22tagvalue
 
-import (
-	"github.com/anchore/syft/syft/sbom"
-)
-
-const ID sbom.FormatID = "spdx-2-tag-value"
+import "github.com/anchore/syft/syft/format"
 
 // note: this format is LOSSY relative to the syftjson formation, which means that decoding and validation is not supported at this time
-func Format() sbom.Format {
-	return sbom.NewFormat(
-		ID,
+func Format() format.Format {
+	return format.NewFormat(
+		format.SPDXTagValueOption,
 		encoder,
 		decoder,
 		validator,

internal/formats/spdx22tagvalue/to_format_model.go

@@ -221,7 +221,7 @@ func toFormatPackages(catalog *pkg.Catalog) map[spdx.ElementID]*spdx.Package2_2
 
 			// 3.17: Copyright Text: copyright notice(s) text, "NONE" or "NOASSERTION"
 			// Cardinality: mandatory, one
-			// Purpose: IdentifyFormat the copyright holders of the package, as well as any dates present. This will be a free form text field extracted from package information files. The options to populate this field are limited to:
+			// Purpose: Identify the copyright holders of the package, as well as any dates present. This will be a free form text field extracted from package information files. The options to populate this field are limited to:
 			//
 			// Any text related to a copyright notice, even if not complete;
 			// NONE if the package contains no copyright information whatsoever; or

internal/formats/syftjson/format.go

@@ -1,14 +1,10 @@
 package syftjson
 
-import (
-	"github.com/anchore/syft/syft/sbom"
-)
+import "github.com/anchore/syft/syft/format"
 
-const ID sbom.FormatID = "syft-3-json"
-
-func Format() sbom.Format {
-	return sbom.NewFormat(
-		ID,
+func Format() format.Format {
+	return format.NewFormat(
+		format.JSONOption,
 		encoder,
 		decoder,
 		validator,

internal/formats/syftjson/test-fixtures/snapshot/TestEncodeFullJSONDocument.golden

@@ -163,9 +163,7 @@
    ],
    "manifest": "ZXlKelkyaGxiV0ZXWlhKemFXOXVJam95TENKdFpXUnBZVlI1Y0dVaU9pSmguLi4=",
    "config": "ZXlKaGNtTm9hWFJsWTNSMWNtVWlPaUpoYldRMk5DSXNJbU52Ym1acC4uLg==",
-   "repoDigests": [],
-   "architecture": "",
-   "os": ""
+   "repoDigests": []
   }
  },
  "distro": {

internal/formats/syftjson/test-fixtures/snapshot/TestImageEncoder.golden

@@ -1,7 +1,7 @@
 {
  "artifacts": [
   {
-   "id": "d9527e708c11f8b9",
+   "id": "3a6c7061f86ac3f7",
    "name": "package-1",
    "version": "1.0.1",
    "type": "python",
@@ -9,7 +9,7 @@
    "locations": [
     {
      "path": "/somefile-1.txt",
-     "layerID": "sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59"
+     "layerID": "sha256:135c16aca35f76c25a18cb6650c621a46b8b79864ad6f2834167de2679bb587d"
     }
    ],
    "licenses": [
@@ -32,7 +32,7 @@
    }
   },
   {
-   "id": "73f796c846875b9e",
+   "id": "4e916af2d387ce9",
    "name": "package-2",
    "version": "2.0.1",
    "type": "deb",
@@ -40,7 +40,7 @@
    "locations": [
     {
      "path": "/somefile-2.txt",
-     "layerID": "sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec"
+     "layerID": "sha256:c751a2f31455b3049bcab3e3af5861c9431116c9f4a46213e44dbeff8ab36985"
     }
    ],
    "licenses": [],
@@ -67,7 +67,7 @@
   "type": "image",
   "target": {
    "userInput": "user-image-input",
-   "imageID": "sha256:2480160b55bec40c44d3b145c7b2c1c47160db8575c3dcae086d76b9370ae7ca",
+   "imageID": "sha256:9998e833a66442934ad948e5cbe898630773c369ef16517623254fa46edd171b",
    "manifestDigest": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368",
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
    "tags": [
@@ -77,20 +77,18 @@
    "layers": [
     {
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59",
+     "digest": "sha256:135c16aca35f76c25a18cb6650c621a46b8b79864ad6f2834167de2679bb587d",
      "size": 22
     },
     {
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec",
+     "digest": "sha256:c751a2f31455b3049bcab3e3af5861c9431116c9f4a46213e44dbeff8ab36985",
      "size": 16
     }
    ],
-   "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NjcsImRpZ2VzdCI6InNoYTI1NjoyNDgwMTYwYjU1YmVjNDBjNDRkM2IxNDVjN2IyYzFjNDcxNjBkYjg1NzVjM2RjYWUwODZkNzZiOTM3MGFlN2NhIn0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1NjpmYjZiZWVjYjc1YjM5ZjRiYjgxM2RiZjE3N2U1MDFlZGQ1ZGRiM2U2OWJiNDVjZWRlYjc4YzY3NmVlMWI3YTU5In0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2OjMxOWI1ODhjZTY0MjUzYTg3YjUzM2M4ZWQwMWNmMDAyNWUwZWFjOThlN2I1MTZlMTI1MzI5NTdlMTI0NGZkZWMifV19",
-   "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8iLCJPbkJ1aWxkIjpudWxsfSwiY3JlYXRlZCI6IjIwMjEtMTAtMDRUMTE6NDA6MDAuNjM4Mzk0NVoiLCJoaXN0b3J5IjpbeyJjcmVhdGVkIjoiMjAyMS0xMC0wNFQxMTo0MDowMC41OTA3MzE2WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0xLnR4dCAvc29tZWZpbGUtMS50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn0seyJjcmVhdGVkIjoiMjAyMS0xMC0wNFQxMTo0MDowMC42MzgzOTQ1WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0yLnR4dCAvc29tZWZpbGUtMi50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6ZmI2YmVlY2I3NWIzOWY0YmI4MTNkYmYxNzdlNTAxZWRkNWRkYjNlNjliYjQ1Y2VkZWI3OGM2NzZlZTFiN2E1OSIsInNoYTI1NjozMTliNTg4Y2U2NDI1M2E4N2I1MzNjOGVkMDFjZjAwMjVlMGVhYzk4ZTdiNTE2ZTEyNTMyOTU3ZTEyNDRmZGVjIl19fQ==",
-   "repoDigests": [],
-   "architecture": "",
-   "os": ""
+   "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NzMsImRpZ2VzdCI6InNoYTI1Njo5OTk4ZTgzM2E2NjQ0MjkzNGFkOTQ4ZTVjYmU4OTg2MzA3NzNjMzY5ZWYxNjUxNzYyMzI1NGZhNDZlZGQxNzFiIn0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1NjoxMzVjMTZhY2EzNWY3NmMyNWExOGNiNjY1MGM2MjFhNDZiOGI3OTg2NGFkNmYyODM0MTY3ZGUyNjc5YmI1ODdkIn0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2OmM3NTFhMmYzMTQ1NWIzMDQ5YmNhYjNlM2FmNTg2MWM5NDMxMTE2YzlmNGE0NjIxM2U0NGRiZWZmOGFiMzY5ODUifV19",
+   "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8iLCJPbkJ1aWxkIjpudWxsfSwiY3JlYXRlZCI6IjIwMjItMDEtMThUMjA6MzA6MTMuMDQ0Njg1NTg5WiIsImhpc3RvcnkiOlt7ImNyZWF0ZWQiOiIyMDIyLTAxLTE4VDIwOjMwOjEyLjE5OTA3MjQxOVoiLCJjcmVhdGVkX2J5IjoiQUREIGZpbGUtMS50eHQgL3NvbWVmaWxlLTEudHh0ICMgYnVpbGRraXQiLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCJ9LHsiY3JlYXRlZCI6IjIwMjItMDEtMThUMjA6MzA6MTMuMDQ0Njg1NTg5WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0yLnR4dCAvc29tZWZpbGUtMi50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6MTM1YzE2YWNhMzVmNzZjMjVhMThjYjY2NTBjNjIxYTQ2YjhiNzk4NjRhZDZmMjgzNDE2N2RlMjY3OWJiNTg3ZCIsInNoYTI1NjpjNzUxYTJmMzE0NTViMzA0OWJjYWIzZTNhZjU4NjFjOTQzMTExNmM5ZjRhNDYyMTNlNDRkYmVmZjhhYjM2OTg1Il19fQ==",
+   "repoDigests": []
   }
  },
  "distro": {

internal/formats/table/format.go

@@ -1,14 +1,10 @@
 package table
 
-import (
-	"github.com/anchore/syft/syft/sbom"
-)
+import "github.com/anchore/syft/syft/format"
 
-const ID sbom.FormatID = "syft-table"
-
-func Format() sbom.Format {
-	return sbom.NewFormat(
-		ID,
+func Format() format.Format {
+	return format.NewFormat(
+		format.TableOption,
 		encoder,
 		nil,
 		nil,

internal/formats/text/format.go

@@ -1,14 +1,10 @@
 package text
 
-import (
-	"github.com/anchore/syft/syft/sbom"
-)
+import "github.com/anchore/syft/syft/format"
 
-const ID sbom.FormatID = "syft-text"
-
-func Format() sbom.Format {
-	return sbom.NewFormat(
-		ID,
+func Format() format.Format {
+	return format.NewFormat(
+		format.TextOption,
 		encoder,
 		nil,
 		nil,

internal/output/writer.go

@@ -1,28 +1,71 @@
-package sbom
+package output
 
 import (
 	"fmt"
+	"io"
 	"os"
 	"path"
 
-	"github.com/anchore/syft/internal/log"
-
+	"github.com/anchore/syft/syft/format"
+	"github.com/anchore/syft/syft/sbom"
 	"github.com/hashicorp/go-multierror"
 )
 
+// streamWriter implements sbom.Writer for a given format and io.Writer, also providing a close function for cleanup
+type streamWriter struct {
+	format format.Format
+	out    io.Writer
+	close  func() error
+}
+
+// Write the provided SBOM to the data stream
+func (w *streamWriter) Write(s sbom.SBOM) error {
+	return w.format.Encode(w.out, s)
+}
+
+// Close any resources, such as open files
+func (w *streamWriter) Close() error {
+	if w.close != nil {
+		return w.close()
+	}
+	return nil
+}
+
 // multiWriter holds a list of child sbom.Writers to apply all Write and Close operations to
 type multiWriter struct {
-	writers []Writer
+	writers []sbom.Writer
+}
+
+// Write writes the SBOM to all writers
+func (m *multiWriter) Write(s sbom.SBOM) (errs error) {
+	for _, w := range m.writers {
+		err := w.Write(s)
+		if err != nil {
+			errs = multierror.Append(errs, err)
+		}
+	}
+	return errs
+}
+
+// Close closes all writers
+func (m *multiWriter) Close() (errs error) {
+	for _, w := range m.writers {
+		err := w.Close()
+		if err != nil {
+			errs = multierror.Append(errs, err)
+		}
+	}
+	return errs
 }
 
 // WriterOption Format and path strings used to create sbom.Writer
 type WriterOption struct {
-	Format Format
+	Format format.Format
 	Path   string
 }
 
-// NewWriter create all report writers from input options; if a file is not specified, os.Stdout is used
-func NewWriter(options ...WriterOption) (Writer, error) {
+// MakeWriter create all report writers from input options; if a file is not specified, os.Stdout is used
+func MakeWriter(options ...WriterOption) (_ sbom.Writer, errs error) {
 	if len(options) == 0 {
 		return nil, fmt.Errorf("no output options provided")
 	}
@@ -30,9 +73,9 @@ func NewWriter(options ...WriterOption) (Writer, error) {
 	out := &multiWriter{}
 
 	defer func() {
-		// close any previously opened files; we can't really recover from any errors
-		if err := out.Close(); err != nil {
-			log.Warnf("unable to close sbom writers: %+v", err)
+		if errs != nil {
+			// close any previously opened files; we can't really recover from any errors
+			_ = out.Close()
 		}
 	}()
 
@@ -71,25 +114,3 @@ func NewWriter(options ...WriterOption) (Writer, error) {
 
 	return out, nil
 }
-
-// Write writes the SBOM to all writers
-func (m *multiWriter) Write(s SBOM) (errs error) {
-	for _, w := range m.writers {
-		err := w.Write(s)
-		if err != nil {
-			errs = multierror.Append(errs, err)
-		}
-	}
-	return errs
-}
-
-// Close closes all writers
-func (m *multiWriter) Close() (errs error) {
-	for _, w := range m.writers {
-		err := w.Close()
-		if err != nil {
-			errs = multierror.Append(errs, err)
-		}
-	}
-	return errs
-}

internal/output/writer_test.go

@@ -1,21 +1,17 @@
-package sbom
+package output
 
 import (
-	"io"
 	"strings"
 	"testing"
 
+	"github.com/anchore/syft/internal/formats/spdx22json"
+	"github.com/anchore/syft/internal/formats/syftjson"
+	"github.com/anchore/syft/internal/formats/table"
+	"github.com/anchore/syft/internal/formats/text"
+
 	"github.com/stretchr/testify/assert"
 )
 
-func dummyEncoder(io.Writer, SBOM) error {
-	return nil
-}
-
-func dummyFormat(name string) Format {
-	return NewFormat(FormatID(name), dummyEncoder, nil, nil)
-}
-
 type writerConfig struct {
 	format string
 	file   string
@@ -27,7 +23,7 @@ func TestOutputWriter(t *testing.T) {
 	testName := func(options []WriterOption, err bool) string {
 		var out []string
 		for _, opt := range options {
-			out = append(out, string(opt.Format.ID())+"="+opt.Path)
+			out = append(out, string(opt.Format.Option)+"="+opt.Path)
 		}
 		errs := ""
 		if err {
@@ -48,7 +44,7 @@ func TestOutputWriter(t *testing.T) {
 		{
 			outputs: []WriterOption{
 				{
-					Format: dummyFormat("table"),
+					Format: table.Format(),
 					Path:   "",
 				},
 			},
@@ -61,7 +57,7 @@ func TestOutputWriter(t *testing.T) {
 		{
 			outputs: []WriterOption{
 				{
-					Format: dummyFormat("json"),
+					Format: syftjson.Format(),
 				},
 			},
 			expected: []writerConfig{
@@ -73,7 +69,7 @@ func TestOutputWriter(t *testing.T) {
 		{
 			outputs: []WriterOption{
 				{
-					Format: dummyFormat("json"),
+					Format: syftjson.Format(),
 					Path:   "test-2.json",
 				},
 			},
@@ -87,11 +83,11 @@ func TestOutputWriter(t *testing.T) {
 		{
 			outputs: []WriterOption{
 				{
-					Format: dummyFormat("json"),
+					Format: syftjson.Format(),
 					Path:   "test-3/1.json",
 				},
 				{
-					Format: dummyFormat("spdx-json"),
+					Format: spdx22json.Format(),
 					Path:   "test-3/2.json",
 				},
 			},
@@ -109,10 +105,10 @@ func TestOutputWriter(t *testing.T) {
 		{
 			outputs: []WriterOption{
 				{
-					Format: dummyFormat("text"),
+					Format: text.Format(),
 				},
 				{
-					Format: dummyFormat("spdx-json"),
+					Format: spdx22json.Format(),
 					Path:   "test-4.json",
 				},
 			},
@@ -137,7 +133,7 @@ func TestOutputWriter(t *testing.T) {
 				}
 			}
 
-			writer, err := NewWriter(outputs...)
+			writer, err := MakeWriter(outputs...)
 
 			if test.err {
 				assert.Error(t, err)
@@ -153,7 +149,7 @@ func TestOutputWriter(t *testing.T) {
 			for i, e := range test.expected {
 				w := mw.writers[i].(*streamWriter)
 
-				assert.Equal(t, string(w.format.ID()), e.format)
+				assert.Equal(t, string(w.format.Option), e.format)
 
 				if e.file != "" {
 					assert.FileExists(t, tmp+e.file)

internal/stringset.go

@@ -6,7 +6,12 @@ import "sort"
 type StringSet map[string]struct{}
 
 // NewStringSet creates a new empty StringSet.
-func NewStringSet(start ...string) StringSet {
+func NewStringSet() StringSet {
+	return make(StringSet)
+}
+
+// NewStringSetFromSlice creates a StringSet populated with values from the given slice.
+func NewStringSetFromSlice(start []string) StringSet {
 	ret := make(StringSet)
 	for _, s := range start {
 		ret.Add(s)

syft/encode_decode.go

@@ -6,10 +6,18 @@ import (
 	"io"
 
 	"github.com/anchore/syft/syft/sbom"
+
+	"github.com/anchore/syft/internal/formats"
+	"github.com/anchore/syft/syft/format"
 )
 
 // Encode takes all SBOM elements and a format option and encodes an SBOM document.
-func Encode(s sbom.SBOM, f sbom.Format) ([]byte, error) {
+func Encode(s sbom.SBOM, option format.Option) ([]byte, error) {
+	f := formats.ByOption(option)
+	if f == nil {
+		return nil, fmt.Errorf("unsupported format: %+v", option)
+	}
+
 	buff := bytes.Buffer{}
 
 	if err := f.Encode(&buff, s); err != nil {
@@ -20,17 +28,19 @@ func Encode(s sbom.SBOM, f sbom.Format) ([]byte, error) {
 }
 
 // Decode takes a reader for an SBOM and generates all internal SBOM elements.
-func Decode(reader io.Reader) (*sbom.SBOM, sbom.Format, error) {
+func Decode(reader io.Reader) (*sbom.SBOM, format.Option, error) {
 	by, err := io.ReadAll(reader)
 	if err != nil {
-		return nil, nil, fmt.Errorf("unable to read sbom: %w", err)
+		return nil, format.UnknownFormatOption, fmt.Errorf("unable to read sbom: %w", err)
 	}
 
-	f := IdentifyFormat(by)
+	f, err := formats.Identify(by)
+	if err != nil {
+		return nil, format.UnknownFormatOption, fmt.Errorf("unable to detect format: %w", err)
+	}
 	if f == nil {
-		return nil, nil, fmt.Errorf("unable to identify format")
+		return nil, format.UnknownFormatOption, fmt.Errorf("unable to identify format")
 	}
-
 	s, err := f.Decode(bytes.NewReader(by))
-	return s, f, err
+	return s, f.Option, err
 }

syft/format/decoder.go

@@ -0,0 +1,10 @@
+package format
+
+import (
+	"io"
+
+	"github.com/anchore/syft/syft/sbom"
+)
+
+// Decoder is a function that can convert an SBOM document of a specific format from a reader into Syft native objects.
+type Decoder func(reader io.Reader) (*sbom.SBOM, error)

syft/format/encoder.go

@@ -0,0 +1,10 @@
+package format
+
+import (
+	"io"
+
+	"github.com/anchore/syft/syft/sbom"
+)
+
+// Encoder is a function that can transform Syft native objects into an SBOM document of a specific format written to the given writer.
+type Encoder func(io.Writer, sbom.SBOM) error

syft/format/format.go

@@ -0,0 +1,52 @@
+package format
+
+import (
+	"errors"
+	"io"
+
+	"github.com/anchore/syft/syft/sbom"
+)
+
+var (
+	ErrEncodingNotSupported   = errors.New("encoding not supported")
+	ErrDecodingNotSupported   = errors.New("decoding not supported")
+	ErrValidationNotSupported = errors.New("validation not supported")
+)
+
+type Format struct {
+	Option    Option
+	encoder   Encoder
+	decoder   Decoder
+	validator Validator
+}
+
+func NewFormat(option Option, encoder Encoder, decoder Decoder, validator Validator) Format {
+	return Format{
+		Option:    option,
+		encoder:   encoder,
+		decoder:   decoder,
+		validator: validator,
+	}
+}
+
+func (f Format) Encode(output io.Writer, s sbom.SBOM) error {
+	if f.encoder == nil {
+		return ErrEncodingNotSupported
+	}
+	return f.encoder(output, s)
+}
+
+func (f Format) Decode(reader io.Reader) (*sbom.SBOM, error) {
+	if f.decoder == nil {
+		return nil, ErrDecodingNotSupported
+	}
+	return f.decoder(reader)
+}
+
+func (f Format) Validate(reader io.Reader) error {
+	if f.validator == nil {
+		return ErrValidationNotSupported
+	}
+
+	return f.validator(reader)
+}

syft/format/option.go

@@ -0,0 +1,49 @@
+package format
+
+import "strings"
+
+const (
+	UnknownFormatOption Option = "UnknownFormatOption"
+	JSONOption          Option = "json"
+	TextOption          Option = "text"
+	TableOption         Option = "table"
+	CycloneDxXMLOption  Option = "cyclonedx"
+	CycloneDxJSONOption Option = "cyclonedx-json"
+	SPDXTagValueOption  Option = "spdx-tag-value"
+	SPDXJSONOption      Option = "spdx-json"
+)
+
+var AllOptions = []Option{
+	JSONOption,
+	TextOption,
+	TableOption,
+	CycloneDxXMLOption,
+	CycloneDxJSONOption,
+	SPDXTagValueOption,
+	SPDXJSONOption,
+}
+
+type Option string
+
+func ParseOption(userStr string) Option {
+	switch strings.ToLower(userStr) {
+	case string(JSONOption):
+		return JSONOption
+	case string(TextOption):
+		return TextOption
+	case string(TableOption):
+		return TableOption
+	case string(CycloneDxXMLOption), "cyclone", "cyclone-dx", "cyclone-dx-xml", "cyclone-xml":
+		// NOTE(jonasagx): setting "cyclone" to XML by default for retro-compatibility.
+		// If we want to show no preference between XML and JSON please remove it.
+		return CycloneDxXMLOption
+	case string(CycloneDxJSONOption), "cyclone-json", "cyclone-dx-json":
+		return CycloneDxJSONOption
+	case string(SPDXTagValueOption), "spdx", "spdx-tagvalue", "spdxtagvalue", "spdx-tv", "spdxtv":
+		return SPDXTagValueOption
+	case string(SPDXJSONOption), "spdxjson":
+		return SPDXJSONOption
+	default:
+		return UnknownFormatOption
+	}
+}

syft/format/validator.go

@@ -0,0 +1,12 @@
+package format
+
+import "io"
+
+// Validator reads the SBOM from the given reader and assesses whether the document conforms to the specific SBOM format.
+// The validator should positively confirm if the SBOM is not only the format but also has the minimal set of values
+// that the format requires. For example, all syftjson formatted documents have a schema section which should have
+// "anchore/syft" within the version --if this isn't found then the validator should raise an error. These active
+// assertions protect against "simple" format decoding validations that may lead to false positives (e.g. I decoded
+// json successfully therefore this must be the target format, however, all values are their default zero-value and
+// really represent a different format that also uses json)
+type Validator func(reader io.Reader) error

syft/formats.go

@@ -1,100 +0,0 @@
-package syft
-
-import (
-	"bytes"
-	"strings"
-
-	"github.com/anchore/syft/internal/formats/cyclonedx13json"
-	"github.com/anchore/syft/internal/formats/cyclonedx13xml"
-	"github.com/anchore/syft/internal/formats/spdx22json"
-	"github.com/anchore/syft/internal/formats/spdx22tagvalue"
-	"github.com/anchore/syft/internal/formats/syftjson"
-	"github.com/anchore/syft/internal/formats/table"
-	"github.com/anchore/syft/internal/formats/text"
-	"github.com/anchore/syft/syft/sbom"
-)
-
-// these have been exported for the benefit of API users
-const (
-	JSONFormatID          = syftjson.ID
-	TextFormatID          = text.ID
-	TableFormatID         = table.ID
-	CycloneDxXMLFormatID  = cyclonedx13xml.ID
-	CycloneDxJSONFormatID = cyclonedx13json.ID
-	SPDXTagValueFormatID  = spdx22tagvalue.ID
-	SPDXJSONFormatID      = spdx22json.ID
-)
-
-var formats []sbom.Format
-
-func init() {
-	formats = []sbom.Format{
-		syftjson.Format(),
-		cyclonedx13xml.Format(),
-		cyclonedx13json.Format(),
-		spdx22tagvalue.Format(),
-		spdx22json.Format(),
-		table.Format(),
-		text.Format(),
-	}
-}
-
-func FormatIDs() (ids []sbom.FormatID) {
-	for _, f := range formats {
-		ids = append(ids, f.ID())
-	}
-	return ids
-}
-
-func FormatByID(id sbom.FormatID) sbom.Format {
-	for _, f := range formats {
-		if f.ID() == id {
-			return f
-		}
-	}
-	return nil
-}
-
-func FormatByName(name string) sbom.Format {
-	cleanName := cleanFormatName(name)
-	for _, f := range formats {
-		if cleanFormatName(string(f.ID())) == cleanName {
-			return f
-		}
-	}
-
-	// handle any aliases for any supported format
-	switch cleanName {
-	case "json", "syftjson":
-		return FormatByID(syftjson.ID)
-	case "cyclonedx", "cyclone", "cyclonedxxml":
-		return FormatByID(cyclonedx13xml.ID)
-	case "cyclonedxjson":
-		return FormatByID(cyclonedx13json.ID)
-	case "spdx", "spdxtv", "spdxtagvalue":
-		return FormatByID(spdx22tagvalue.ID)
-	case "spdxjson":
-		return FormatByID(spdx22json.ID)
-	case "table":
-		return FormatByID(table.ID)
-	case "text":
-		return FormatByID(text.ID)
-	}
-
-	return nil
-}
-
-func cleanFormatName(name string) string {
-	r := strings.NewReplacer("-", "", "_", "")
-	return strings.ToLower(r.Replace(name))
-}
-
-func IdentifyFormat(by []byte) sbom.Format {
-	for _, f := range formats {
-		if err := f.Validate(bytes.NewReader(by)); err != nil {
-			continue
-		}
-		return f
-	}
-	return nil
-}

syft/formats_test.go

@@ -1,157 +0,0 @@
-package syft
-
-import (
-	"github.com/anchore/syft/internal/formats/cyclonedx13json"
-	"github.com/anchore/syft/internal/formats/cyclonedx13xml"
-	"github.com/anchore/syft/internal/formats/spdx22json"
-	"github.com/anchore/syft/internal/formats/spdx22tagvalue"
-	"github.com/anchore/syft/internal/formats/syftjson"
-	"github.com/anchore/syft/internal/formats/table"
-	"github.com/anchore/syft/internal/formats/text"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/stretchr/testify/require"
-	"io"
-	"os"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestIdentify(t *testing.T) {
-	tests := []struct {
-		fixture  string
-		expected sbom.FormatID
-	}{
-		{
-			fixture:  "test-fixtures/alpine-syft.json",
-			expected: syftjson.ID,
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.fixture, func(t *testing.T) {
-			f, err := os.Open(test.fixture)
-			assert.NoError(t, err)
-			by, err := io.ReadAll(f)
-			assert.NoError(t, err)
-			frmt := IdentifyFormat(by)
-			assert.NotNil(t, frmt)
-			assert.Equal(t, test.expected, frmt.ID())
-		})
-	}
-}
-
-func TestFormatByName(t *testing.T) {
-
-	tests := []struct {
-		name string
-		want sbom.FormatID
-	}{
-		// SPDX Tag-Value
-		{
-			name: "spdx",
-			want: spdx22tagvalue.ID,
-		},
-		{
-			name: "spdx-tag-value",
-			want: spdx22tagvalue.ID,
-		},
-		{
-			name: "spdx-tv",
-			want: spdx22tagvalue.ID,
-		},
-		{
-			name: "spdxtv", // clean variant
-			want: spdx22tagvalue.ID,
-		},
-		{
-			name: "spdx-2-tag-value", // clean variant
-			want: spdx22tagvalue.ID,
-		},
-		{
-			name: "spdx-2-tagvalue", // clean variant
-			want: spdx22tagvalue.ID,
-		},
-		{
-			name: "spdx2-tagvalue", // clean variant
-			want: spdx22tagvalue.ID,
-		},
-
-		// SPDX JSON
-		{
-			name: "spdx-json",
-			want: spdx22json.ID,
-		},
-		{
-			name: "spdx-2-json",
-			want: spdx22json.ID,
-		},
-
-		// Cyclonedx JSON
-		{
-			name: "cyclonedx-json",
-			want: cyclonedx13json.ID,
-		},
-		{
-			name: "cyclonedx-1-json",
-			want: cyclonedx13json.ID,
-		},
-
-		// Cyclonedx XML
-		{
-			name: "cyclonedx",
-			want: cyclonedx13xml.ID,
-		},
-		{
-			name: "cyclonedx-xml",
-			want: cyclonedx13xml.ID,
-		},
-		{
-			name: "cyclonedx-1-xml",
-			want: cyclonedx13xml.ID,
-		},
-
-		// Syft Table
-		{
-			name: "table",
-			want: table.ID,
-		},
-
-		{
-			name: "syft-table",
-			want: table.ID,
-		},
-
-		// Syft Text
-		{
-			name: "text",
-			want: text.ID,
-		},
-
-		{
-			name: "syft-text",
-			want: text.ID,
-		},
-
-		// Syft JSON
-		{
-			name: "json",
-			want: syftjson.ID,
-		},
-
-		{
-			name: "syft-json",
-			want: syftjson.ID,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			f := FormatByName(tt.name)
-			if tt.want == "" {
-				require.Nil(t, f)
-				return
-			}
-			require.NotNil(t, f)
-			assert.Equal(t, tt.want, f.ID())
-		})
-	}
-}

syft/pkg/cataloger/javascript/parse_yarn_lock.go

@@ -16,18 +16,15 @@ import (
 var _ common.ParserFn = parseYarnLock
 
 var (
-	// composedNameExp matches the "composed" variant of yarn.lock entry names,
-	// where the name appears in quotes and is prefixed with @<some-namespace>.
-	// For example: "@babel/code-frame@^7.0.0"
-	composedNameExp = regexp.MustCompile(`^"(@[^@]+)`)
-
-	// simpleNameExp matches the "simple" variant of yarn.lock entry names, for packages with no namespace prefix.
-	// For example: aws-sdk@2.706.0
-	simpleNameExp = regexp.MustCompile(`^(\w[\w-_.]*)@`)
+	// packageNameExp matches the name of the dependency in yarn.lock
+	// including scope/namespace prefix if found.
+	// For example: "aws-sdk@2.706.0" returns "aws-sdk"
+	//              "@babel/code-frame@^7.0.0" returns "@babel/code-frame"
+	packageNameExp = regexp.MustCompile(`^"?((?:@\w[\w-_.]*\/)?\w[\w-_.]*)@`)
 
 	// versionExp matches the "version" line of a yarn.lock entry and captures the version value.
 	// For example: version "4.10.1" (...and the value "4.10.1" is captured)
-	versionExp = regexp.MustCompile(`^\W+version\W+"([\w-_.]+)"`)
+	versionExp = regexp.MustCompile(`^\W+version(?:\W+"|:\W+)([\w-_.]+)"?`)
 )
 
 const (
@@ -87,11 +84,7 @@ func parseYarnLock(path string, reader io.Reader) ([]*pkg.Package, []artifact.Re
 }
 
 func findPackageName(line string) string {
-	if matches := composedNameExp.FindStringSubmatch(line); len(matches) >= 2 {
-		return matches[1]
-	}
-
-	if matches := simpleNameExp.FindStringSubmatch(line); len(matches) >= 2 {
+	if matches := packageNameExp.FindStringSubmatch(line); len(matches) >= 2 {
 		return matches[1]
 	}
 

syft/pkg/cataloger/javascript/parse_yarn_lock_test.go

@@ -5,6 +5,8 @@ import (
 	"testing"
 
 	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestParseYarnLock(t *testing.T) {
@@ -65,16 +67,182 @@ func TestParseYarnLock(t *testing.T) {
 		},
 	}
 
-	fixture, err := os.Open("test-fixtures/yarn/yarn.lock")
-	if err != nil {
-		t.Fatalf("failed to open fixture: %+v", err)
+	testFixtures := []string{
+		"test-fixtures/yarn/yarn.lock",
+		"test-fixtures/yarn-berry/yarn.lock",
 	}
 
-	// TODO: no relationships are under test yet
-	actual, _, err := parseYarnLock(fixture.Name(), fixture)
-	if err != nil {
-		t.Fatalf("failed to parse yarn.lock: %+v", err)
-	}
+	for _, file := range testFixtures {
+		file := file
+		t.Run(file, func(t *testing.T) {
+			t.Parallel()
 
-	assertPkgsEqual(t, actual, expected)
+			fixture, err := os.Open(file)
+			require.NoError(t, err)
+
+			// TODO: no relationships are under test yet
+			actual, _, err := parseYarnLock(fixture.Name(), fixture)
+			require.NoError(t, err)
+
+			assertPkgsEqual(t, actual, expected)
+		})
+	}
+}
+
+func TestParseYarnFindPackageNames(t *testing.T) {
+	tests := []struct {
+		line     string
+		expected string
+	}{
+		{
+			line:     `"@babel/code-frame@npm:7.10.4":`,
+			expected: "@babel/code-frame",
+		},
+		{
+			line:     `"@babel/code-frame@^7.0.0", "@babel/code-frame@^7.10.4":`,
+			expected: "@babel/code-frame",
+		},
+		{
+			line:     "ajv@^6.10.2, ajv@^6.5.5:",
+			expected: "ajv",
+		},
+		{
+			line:     "aws-sdk@2.706.0:",
+			expected: "aws-sdk",
+		},
+		{
+			line:     "asn1.js@^4.0.0:",
+			expected: "asn1.js",
+		},
+		{
+			line:     "c0n-fab_u.laTION@^7.0.0",
+			expected: "c0n-fab_u.laTION",
+		},
+		{
+			line:     `"newtest@workspace:.":`,
+			expected: "newtest",
+		},
+		{
+			line:     `"color-convert@npm:^1.9.0":`,
+			expected: "color-convert",
+		},
+		{
+			line:     `"@npmcorp/code-frame@^7.1.0", "@npmcorp/code-frame@^7.10.4":`,
+			expected: "@npmcorp/code-frame",
+		},
+		{
+			line:     `"@npmcorp/code-frame@^7.2.3":`,
+			expected: "@npmcorp/code-frame",
+		},
+		{
+			line:     `"@s/odd-name@^7.1.2":`,
+			expected: "@s/odd-name",
+		},
+		{
+			line:     `"@/code-frame@^7.3.4":`,
+			expected: "",
+		},
+		{
+			line:     `"code-frame":`,
+			expected: "",
+		},
+	}
+
+	for _, test := range tests {
+		test := test
+		t.Run(test.expected, func(t *testing.T) {
+			t.Parallel()
+			actual := findPackageName(test.line)
+			assert.Equal(t, test.expected, actual)
+		})
+	}
+}
+
+func TestParseYarnFindPackageVersions(t *testing.T) {
+	tests := []struct {
+		line     string
+		expected string
+	}{
+		{
+			line:     `  version "7.10.4"`,
+			expected: "7.10.4",
+		},
+		{
+			line:     ` version "7.11.5"`,
+			expected: "7.11.5",
+		},
+		{
+			line:     `version "7.12.6"`,
+			expected: "",
+		},
+		{
+			line:     `  version "0.0.0"`,
+			expected: "0.0.0",
+		},
+		{
+			line:     `  version "2" `,
+			expected: "2",
+		},
+		{
+			line:     `  version "9.3"`,
+			expected: "9.3",
+		},
+		{
+			line:     "ajv@^6.10.2, ajv@^6.5.5",
+			expected: "",
+		},
+		{
+			line:     "atob@^2.1.2:",
+			expected: "",
+		},
+		{
+			line:     `"color-convert@npm:^1.9.0":`,
+			expected: "",
+		},
+		{
+			line:     "  version: 1.9.3",
+			expected: "1.9.3",
+		},
+		{
+			line:     "  version: 2",
+			expected: "2",
+		},
+		{
+			line:     "  version: 9.3",
+			expected: "9.3",
+		},
+		{
+			line:     "ajv@^6.10.2, ajv@^6.5.5",
+			expected: "",
+		},
+		{
+			line:     "atob@^2.1.2:",
+			expected: "",
+		},
+		{
+			line:     "  version: 1.0.0-alpha+001",
+			expected: "1.0.0-alpha",
+		},
+		{
+			line:     "  version: 1.0.0-beta_test+exp.sha.5114f85",
+			expected: "1.0.0-beta_test",
+		},
+		{
+			line:     "  version: 1.0.0+21AF26D3-117B344092BD",
+			expected: "1.0.0",
+		},
+		{
+			line:     "  version: 0.0.0-use.local",
+			expected: "0.0.0-use.local",
+		},
+	}
+
+	for _, test := range tests {
+		test := test
+		t.Run(test.expected, func(t *testing.T) {
+			t.Parallel()
+			actual := findPackageVersion(test.line)
+			assert.Equal(t, test.expected, actual)
+		})
+	}
 }

syft/pkg/cataloger/javascript/test-fixtures/yarn-berry/yarn.lock

@@ -0,0 +1,110 @@
+# This file is generated by running "yarn install" inside your project.
+# Manual changes might be lost - proceed with caution!
+
+__metadata:
+  version: 6
+  cacheKey: 8
+
+"@babel/code-frame@npm:7.10.4":
+  version: 7.10.4
+  resolution: "@babel/code-frame@npm:7.10.4"
+  dependencies:
+    "@babel/highlight": ^7.10.4
+  checksum: feb4543c8a509fe30f0f6e8d7aa84f82b41148b963b826cd330e34986f649a85cb63b2f13dd4effdf434ac555d16f14940b8ea5f4433297c2f5ff85486ded019
+  languageName: node
+  linkType: hard
+
+"@types/minimatch@npm:3.0.3":
+  version: 3.0.3
+  resolution: "@types/minimatch@npm:3.0.3"
+  checksum: b80259d55b96ef24cb3bb961b6dc18b943f2bb8838b4d8e7bead204f3173e551a416ffa49f9aaf1dc431277fffe36214118628eacf4aea20119df8835229901b
+  languageName: node
+  linkType: hard
+
+"@types/qs@npm:6.9.4":
+  version: 6.9.4
+  resolution: "@types/qs@npm:6.9.4"
+  checksum: 77e509ed213f7694ae35f84a58b88da8744aad019e93556af6aeab4289287abbe71836c051d00649dbac0289ea199e408442590cfb1785009de11c3c8d0cbbea
+  languageName: node
+  linkType: hard
+
+"@types/qs@npm:6.9.4":
+  version: 6.9.4
+  resolution: "@types/qs@npm:6.9.4"
+  checksum: 77e509ed213f7694ae35f84a58b88da8744aad019e93556af6aeab4289287abbe71836c051d00649dbac0289ea199e408442590cfb1785009de11c3c8d0cbbea
+  languageName: node
+  linkType: hard
+
+"ajv@npm:6.12.3":
+  version: 6.12.3
+  resolution: "ajv@npm:6.12.3"
+  dependencies:
+    fast-deep-equal: ^3.1.1
+    fast-json-stable-stringify: ^2.0.0
+    json-schema-traverse: ^0.4.1
+    uri-js: ^4.2.2
+  checksum: ca559d34710e6969d33bc1316282e1ece4d4d99ff5fdca4bfe31947740f8f90e7824238cdc2954e499cf75b2432e3e6c56b32814ebe04fccf8abcc3fbf36b348
+  languageName: node
+  linkType: hard
+
+"atob@npm:2.1.2":
+  version: 2.1.2
+  resolution: "atob@npm:2.1.2"
+  bin:
+    atob: bin/atob.js
+  checksum: dfeeeb70090c5ebea7be4b9f787f866686c645d9f39a0d184c817252d0cf08455ed25267d79c03254d3be1f03ac399992a792edcd5ffb9c91e097ab5ef42833a
+  languageName: node
+  linkType: hard
+
+"aws-sdk@npm:2.706.0":
+  version: 2.706.0
+  resolution: "aws-sdk@npm:2.706.0"
+  dependencies:
+    buffer: 4.9.2
+    events: 1.1.1
+    ieee754: 1.1.13
+    jmespath: 0.15.0
+    querystring: 0.2.0
+    sax: 1.2.1
+    url: 0.10.3
+    uuid: 3.3.2
+    xml2js: 0.4.19
+  checksum: bf8ca2fc4f758bdebd04051ec15729affad3eb0e18eed4ae41db5b7d6ff2aed2cf3a12ae082c11b955df0125378c57b8406e1f91006e48f0c162fdbe4ee4e330
+  languageName: node
+  linkType: hard
+
+"jhipster-core@npm:7.3.4":
+  version: 7.3.4
+  resolution: "jhipster-core@npm:7.3.4"
+  dependencies:
+    chevrotain: 7.0.1
+    fs-extra: 8.1.0
+    lodash: 4.17.15
+    winston: 3.2.1
+  checksum: 6a97741d574a42a138f98596c668370b41ec8870335bcd758b6b890e279ba30d4d2be447f8cecbf416286f2c53636b406a63a773c7b00709c95af0a9a3f9b397
+  languageName: node
+  linkType: hard
+
+"asn1.js@npm:4.10.1":
+  version: 4.10.1
+  resolution: "asn1.js@npm:4.10.1"
+  dependencies:
+    bn.js: ^4.0.0
+    inherits: ^2.0.1
+    minimalistic-assert: ^1.0.0
+  checksum: 9289a1a55401238755e3142511d7b8f6fc32f08c86ff68bd7100da8b6c186179dd6b14234fba2f7f6099afcd6758a816708485efe44bc5b2a6ec87d9ceeddbb5
+  languageName: node
+  linkType: hard
+
+"c0n-fab_u.laTION@workspace:.":
+  version: 7.7.7
+  resolution: "newtest@workspace:."
+  dependencies:
+    "@babel/code-frame": 7.10.4
+    "@types/minimatch": 3.0.3
+    "@types/qs": 6.9.4
+    ajv: 6.12.3
+    asn1.js: 4.10.1
+    atob: 2.1.2
+  languageName: unknown
+  linkType: soft

syft/pkg/cataloger/ruby/parse_gemfile_lock.go

@@ -14,7 +14,7 @@ import (
 // integrity check
 var _ common.ParserFn = parseGemFileLockEntries
 
-var sectionsOfInterest = internal.NewStringSet("GEM")
+var sectionsOfInterest = internal.NewStringSetFromSlice([]string{"GEM"})
 
 // parseGemFileLockEntries is a parser function for Gemfile.lock contents, returning all Gems discovered.
 func parseGemFileLockEntries(_ string, reader io.Reader) ([]*pkg.Package, []artifact.Relationship, error) {

syft/sbom/format.go

@@ -1,78 +0,0 @@
-package sbom
-
-import (
-	"errors"
-	"io"
-)
-
-var (
-	ErrEncodingNotSupported   = errors.New("encoding not supported")
-	ErrDecodingNotSupported   = errors.New("decoding not supported")
-	ErrValidationNotSupported = errors.New("validation not supported")
-)
-
-type FormatID string
-
-type Format interface {
-	ID() FormatID
-	Encode(io.Writer, SBOM) error
-	Decode(io.Reader) (*SBOM, error)
-	Validate(io.Reader) error
-}
-
-type format struct {
-	id        FormatID
-	encoder   Encoder
-	decoder   Decoder
-	validator Validator
-}
-
-// Decoder is a function that can convert an SBOM document of a specific format from a reader into Syft native objects.
-type Decoder func(reader io.Reader) (*SBOM, error)
-
-// Encoder is a function that can transform Syft native objects into an SBOM document of a specific format written to the given writer.
-type Encoder func(io.Writer, SBOM) error
-
-// Validator reads the SBOM from the given reader and assesses whether the document conforms to the specific SBOM format.
-// The validator should positively confirm if the SBOM is not only the format but also has the minimal set of values
-// that the format requires. For example, all syftjson formatted documents have a schema section which should have
-// "anchore/syft" within the version --if this isn't found then the validator should raise an error. These active
-// assertions protect against "simple" format decoding validations that may lead to false positives (e.g. I decoded
-// json successfully therefore this must be the target format, however, all values are their default zero-value and
-// really represent a different format that also uses json)
-type Validator func(reader io.Reader) error
-
-func NewFormat(id FormatID, encoder Encoder, decoder Decoder, validator Validator) Format {
-	return &format{
-		id:        id,
-		encoder:   encoder,
-		decoder:   decoder,
-		validator: validator,
-	}
-}
-
-func (f format) ID() FormatID {
-	return f.id
-}
-
-func (f format) Encode(output io.Writer, s SBOM) error {
-	if f.encoder == nil {
-		return ErrEncodingNotSupported
-	}
-	return f.encoder(output, s)
-}
-
-func (f format) Decode(reader io.Reader) (*SBOM, error) {
-	if f.decoder == nil {
-		return nil, ErrDecodingNotSupported
-	}
-	return f.decoder(reader)
-}
-
-func (f format) Validate(reader io.Reader) error {
-	if f.validator == nil {
-		return ErrValidationNotSupported
-	}
-
-	return f.validator(reader)
-}

syft/sbom/stream_writer.go

@@ -1,25 +0,0 @@
-package sbom
-
-import (
-	"io"
-)
-
-// streamWriter implements sbom.Writer for a given format and io.Writer, also providing a close function for cleanup
-type streamWriter struct {
-	format Format
-	out    io.Writer
-	close  func() error
-}
-
-// Write the provided SBOM to the data stream
-func (w *streamWriter) Write(s SBOM) error {
-	return w.format.Encode(w.out, s)
-}
-
-// Close any resources, such as open files
-func (w *streamWriter) Close() error {
-	if w.close != nil {
-		return w.close()
-	}
-	return nil
-}

syft/source/directory_resolver.go

@@ -147,7 +147,7 @@ func (r *directoryResolver) indexPath(path string, info os.FileInfo, err error)
 	}
 
 	// link cycles could cause a revisit --we should not allow this
-	if r.hasBeenIndexed(path) {
+	if r.fileTree.HasPath(file.Path(path)) {
 		return "", nil
 	}
 
@@ -193,23 +193,6 @@ func (r directoryResolver) addPathToIndex(p string, info os.FileInfo) (string, e
 	}
 }
 
-func (r directoryResolver) hasBeenIndexed(p string) bool {
-	filePath := file.Path(p)
-	if !r.fileTree.HasPath(filePath) {
-		return false
-	}
-
-	exists, ref, err := r.fileTree.File(filePath)
-	if err != nil || !exists || ref == nil {
-		return false
-	}
-
-	// cases like "/" will be in the tree, but not been indexed yet (a special case). We want to capture
-	// these cases as new paths to index.
-	_, exists = r.metadata[ref.ID()]
-	return exists
-}
-
 func (r directoryResolver) addDirectoryToIndex(p string, info os.FileInfo) error {
 	ref, err := r.fileTree.AddDir(file.Path(p))
 	if err != nil {

syft/source/directory_resolver_test.go

@@ -848,20 +848,3 @@ func testWithTimeout(t *testing.T, timeout time.Duration, test func(*testing.T))
 	case <-done:
 	}
 }
-
-func Test_IncludeRootPathInIndex(t *testing.T) {
-	filterFn := func(path string, _ os.FileInfo) bool {
-		return path != "/"
-	}
-
-	resolver, err := newDirectoryResolver("/", filterFn)
-	require.NoError(t, err)
-
-	exists, ref, err := resolver.fileTree.File(file.Path("/"))
-	require.NoError(t, err)
-	require.NotNil(t, ref)
-	assert.True(t, exists)
-
-	_, exists = resolver.metadata[ref.ID()]
-	require.True(t, exists)
-}

syft/source/image_metadata.go

@@ -15,9 +15,6 @@ type ImageMetadata struct {
 	RawManifest    []byte          `json:"manifest"`
 	RawConfig      []byte          `json:"config"`
 	RepoDigests    []string        `json:"repoDigests"`
-	Architecture   string          `json:"architecture"`
-	Variant        string          `json:"architectureVariant,omitempty"`
-	OS             string          `json:"os"`
 }
 
 // LayerMetadata represents all static metadata that defines what a container image layer is.
@@ -45,9 +42,6 @@ func NewImageMetadata(img *image.Image, userInput string) ImageMetadata {
 		RawConfig:      img.Metadata.RawConfig,
 		RawManifest:    img.Metadata.RawManifest,
 		RepoDigests:    img.Metadata.RepoDigests,
-		Architecture:   img.Metadata.Architecture,
-		Variant:        img.Metadata.Variant,
-		OS:             img.Metadata.OS,
 	}
 
 	// populate image metadata

syft/source/source.go

@@ -40,13 +40,12 @@ type Input struct {
 	Scheme                          Scheme
 	ImageSource                     image.Source
 	Location                        string
-	Platform                        string
 	autoDetectAvailableImageSources bool
 }
 
 // ParseInput generates a source Input that can be used as an argument to generate a new source
 // from specific providers including a registry.
-func ParseInput(userInput string, platform string, detectAvailableImageSources bool) (*Input, error) {
+func ParseInput(userInput string, detectAvailableImageSources bool) (*Input, error) {
 	fs := afero.NewOsFs()
 	scheme, source, location, err := DetectScheme(fs, image.DetectSource, userInput)
 	if err != nil {
@@ -72,17 +71,12 @@ func ParseInput(userInput string, platform string, detectAvailableImageSources b
 		}
 	}
 
-	if scheme != ImageScheme && platform != "" {
-		return nil, fmt.Errorf("cannot specify a platform for a non-image source")
-	}
-
 	// collect user input for downstream consumption
 	return &Input{
 		UserInput:                       userInput,
 		Scheme:                          scheme,
 		ImageSource:                     source,
 		Location:                        location,
-		Platform:                        platform,
 		autoDetectAvailableImageSources: detectAvailableImageSources,
 	}, nil
 }
@@ -153,19 +147,10 @@ func getImageWithRetryStrategy(in Input, registryOptions *image.RegistryOptions)
 		opts = append(opts, stereoscope.WithRegistryOptions(*registryOptions))
 	}
 
-	if in.Platform != "" {
-		opts = append(opts, stereoscope.WithPlatform(in.Platform))
-	}
-
 	img, err := stereoscope.GetImageFromSource(ctx, in.Location, in.ImageSource, opts...)
-	cleanup := func() {
-		if err := img.Cleanup(); err != nil {
-			log.Warnf("unable to cleanup image=%q: %w", in.UserInput, err)
-		}
-	}
 	if err == nil {
 		// Success on the first try!
-		return img, cleanup, nil
+		return img, stereoscope.Cleanup, nil
 	}
 
 	scheme := parseScheme(in.UserInput)
@@ -195,12 +180,11 @@ func getImageWithRetryStrategy(in Input, registryOptions *image.RegistryOptions)
 		in.ImageSource = image.DetermineDefaultImagePullSource(in.UserInput)
 	}
 	img, err = stereoscope.GetImageFromSource(ctx, in.UserInput, in.ImageSource, opts...)
-	cleanup = func() {
-		if err := img.Cleanup(); err != nil {
-			log.Warnf("unable to cleanup image=%q: %w", in.UserInput, err)
-		}
+	if err != nil {
+		return nil, nil, err
 	}
-	return img, cleanup, err
+
+	return img, stereoscope.Cleanup, nil
 }
 
 func generateDirectorySource(fs afero.Fs, location string) (*Source, func(), error) {

syft/source/source_test.go

@@ -26,34 +26,22 @@ func TestParseInput(t *testing.T) {
 	tests := []struct {
 		name     string
 		input    string
-		platform string
 		expected Scheme
-		errFn    require.ErrorAssertionFunc
 	}{
 		{
 			name:     "ParseInput parses a file input",
 			input:    "test-fixtures/image-simple/file-1.txt",
 			expected: FileScheme,
 		},
-		{
-			name:     "errors out when using platform for non-image scheme",
-			input:    "test-fixtures/image-simple/file-1.txt",
-			platform: "arm64",
-			errFn:    require.Error,
-		},
 	}
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			if test.errFn == nil {
-				test.errFn = require.NoError
-			}
-			sourceInput, err := ParseInput(test.input, test.platform, true)
-			test.errFn(t, err)
-			if test.expected != "" {
-				require.NotNil(t, sourceInput)
-				assert.Equal(t, sourceInput.Scheme, test.expected)
+			sourceInput, err := ParseInput(test.input, true)
+			if err != nil {
+				t.Errorf("failed to ParseInput")
 			}
+			assert.Equal(t, sourceInput.Scheme, test.expected)
 		})
 	}
 }
@@ -464,7 +452,7 @@ func TestDirectoryExclusions(t *testing.T) {
 	registryOpts := &image.RegistryOptions{}
 	for _, test := range testCases {
 		t.Run(test.desc, func(t *testing.T) {
-			sourceInput, err := ParseInput("dir:"+test.input, "", false)
+			sourceInput, err := ParseInput("dir:"+test.input, false)
 			require.NoError(t, err)
 			src, fn, err := New(*sourceInput, registryOpts, test.exclusions)
 			defer fn()
@@ -558,7 +546,7 @@ func TestImageExclusions(t *testing.T) {
 	for _, test := range testCases {
 		t.Run(test.desc, func(t *testing.T) {
 			archiveLocation := imagetest.PrepareFixtureImage(t, "docker-archive", test.input)
-			sourceInput, err := ParseInput(archiveLocation, "", false)
+			sourceInput, err := ParseInput(archiveLocation, false)
 			require.NoError(t, err)
 			src, fn, err := New(*sourceInput, registryOpts, test.exclusions)
 			defer fn()

test/cli/all_formats_expressible_test.go

@@ -2,11 +2,10 @@ package cli
 
 import (
 	"fmt"
-	"github.com/stretchr/testify/require"
 	"strings"
 	"testing"
 
-	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/format"
 )
 
 func TestAllFormatsExpressible(t *testing.T) {
@@ -19,9 +18,8 @@ func TestAllFormatsExpressible(t *testing.T) {
 		},
 		assertSuccessfulReturnCode,
 	}
-	formats := syft.FormatIDs()
-	require.NotEmpty(t, formats)
-	for _, o := range formats {
+
+	for _, o := range format.AllOptions {
 		t.Run(fmt.Sprintf("format:%s", o), func(t *testing.T) {
 			cmd, stdout, stderr := runSyft(t, nil, "dir:./test-fixtures/image-pkg-coverage", "-o", string(o))
 			for _, traitFn := range commonAssertions {

test/cli/packages_cmd_test.go

@@ -184,14 +184,6 @@ func TestPackagesCmdFlags(t *testing.T) {
 				assertInOutput("search-indexed-archives: false"),
 			},
 		},
-		{
-			name: "platform-option-wired-up",
-			args: []string{"packages", "--platform", "arm64", "-o", "json", "registry:busybox:1.31"},
-			assertions: []traitAssertion{
-				assertInOutput("sha256:1ee006886991ad4689838d3a288e0dd3fd29b70e276622f16b67a8922831a853"), // linux/arm64 image digest
-				assertSuccessfulReturnCode,
-			},
-		},
 	}
 
 	for _, test := range tests {

test/cli/root_cmd_test.go

@@ -122,6 +122,8 @@ func TestLogFile(t *testing.T) {
 	request := "docker-archive:" + getFixtureImage(t, "image-pkg-coverage")
 
 	envLogFile := filepath.Join(os.TempDir(), "a-pretty-log-file.log")
+	t.Logf("log file path: %s", envLogFile)
+
 	tests := []struct {
 		name       string
 		args       []string

test/integration/catalog_packages_test.go

@@ -24,7 +24,7 @@ func BenchmarkImagePackageCatalogers(b *testing.B) {
 	for _, c := range cataloger.ImageCatalogers(cataloger.DefaultConfig()) {
 		// in case of future alteration where state is persisted, assume no dependency is safe to reuse
 		userInput := "docker-archive:" + tarPath
-		sourceInput, err := source.ParseInput(userInput, "", false)
+		sourceInput, err := source.ParseInput(userInput, false)
 		require.NoError(b, err)
 		theSource, cleanupSource, err := source.New(*sourceInput, nil, nil)
 		b.Cleanup(cleanupSource)

test/integration/encode_decode_cycle_test.go

@@ -2,11 +2,6 @@ package integration
 
 import (
 	"bytes"
-	"github.com/anchore/syft/internal/formats/cyclonedx13json"
-	"github.com/anchore/syft/internal/formats/cyclonedx13xml"
-	"github.com/anchore/syft/internal/formats/syftjson"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/stretchr/testify/require"
 	"regexp"
 	"testing"
 
@@ -14,6 +9,7 @@ import (
 
 	"github.com/sergi/go-diff/diffmatchpatch"
 
+	"github.com/anchore/syft/syft/format"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -25,16 +21,16 @@ import (
 // encode-decode-encode loop which will detect lossy behavior in both directions.
 func TestEncodeDecodeEncodeCycleComparison(t *testing.T) {
 	tests := []struct {
-		formatOption sbom.FormatID
-		redactor     func(in []byte) []byte
-		json         bool
+		format   format.Option
+		redactor func(in []byte) []byte
+		json     bool
 	}{
 		{
-			formatOption: syftjson.ID,
-			json:         true,
+			format: format.JSONOption,
+			json:   true,
 		},
 		{
-			formatOption: cyclonedx13json.ID,
+			format: format.CycloneDxJSONOption,
 			redactor: func(in []byte) []byte {
 				in = regexp.MustCompile("\"(timestamp|serialNumber|bom-ref)\": \"[^\"]+\",").ReplaceAll(in, []byte{})
 				return in
@@ -42,7 +38,7 @@ func TestEncodeDecodeEncodeCycleComparison(t *testing.T) {
 			json: true,
 		},
 		{
-			formatOption: cyclonedx13xml.ID,
+			format: format.CycloneDxXMLOption,
 			redactor: func(in []byte) []byte {
 				in = regexp.MustCompile("(serialNumber|bom-ref)=\"[^\"]+\"").ReplaceAll(in, []byte{})
 				in = regexp.MustCompile("<timestamp>[^<]+</timestamp>").ReplaceAll(in, []byte{})
@@ -51,21 +47,18 @@ func TestEncodeDecodeEncodeCycleComparison(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		t.Run(string(test.formatOption), func(t *testing.T) {
+		t.Run(string(test.format), func(t *testing.T) {
 
 			originalSBOM, _ := catalogFixtureImage(t, "image-pkg-coverage")
 
-			format := syft.FormatByID(test.formatOption)
-			require.NotNil(t, format)
-
-			by1, err := syft.Encode(originalSBOM, format)
+			by1, err := syft.Encode(originalSBOM, test.format)
 			assert.NoError(t, err)
 
 			newSBOM, newFormat, err := syft.Decode(bytes.NewReader(by1))
 			assert.NoError(t, err)
-			assert.Equal(t, format.ID(), newFormat.ID())
+			assert.Equal(t, test.format, newFormat)
 
-			by2, err := syft.Encode(*newSBOM, format)
+			by2, err := syft.Encode(*newSBOM, test.format)
 			assert.NoError(t, err)
 
 			if test.redactor != nil {

test/integration/utils_test.go

@@ -17,7 +17,7 @@ func catalogFixtureImage(t *testing.T, fixtureImageName string) (sbom.SBOM, *sou
 	imagetest.GetFixtureImage(t, "docker-archive", fixtureImageName)
 	tarPath := imagetest.GetFixtureImageTarPath(t, fixtureImageName)
 	userInput := "docker-archive:" + tarPath
-	sourceInput, err := source.ParseInput(userInput, "", false)
+	sourceInput, err := source.ParseInput(userInput, false)
 	require.NoError(t, err)
 	theSource, cleanupSource, err := source.New(*sourceInput, nil, nil)
 	t.Cleanup(cleanupSource)
@@ -52,7 +52,7 @@ func catalogFixtureImage(t *testing.T, fixtureImageName string) (sbom.SBOM, *sou
 
 func catalogDirectory(t *testing.T, dir string) (sbom.SBOM, *source.Source) {
 	userInput := "dir:" + dir
-	sourceInput, err := source.ParseInput(userInput, "", false)
+	sourceInput, err := source.ParseInput(userInput, false)
 	require.NoError(t, err)
 	theSource, cleanupSource, err := source.New(*sourceInput, nil, nil)
 	t.Cleanup(cleanupSource)