add task id to constructor

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

.github/scripts/apple-signing/notarize.sh

@@ -29,7 +29,7 @@ notarize() {
   fi
 
   # install gon
-  which gon || (go install github.com/mitchellh/gon/cmd/gon@latest)
+  which gon || (brew tap mitchellh/gon && brew install mitchellh/gon/gon)
 
   # create config (note: json via stdin with gon is broken, can only use HCL from file)
   hcl_file=$(mktemp).hcl

.github/workflows/release.yaml

@@ -9,7 +9,7 @@ on:
       - "v*"
 
 env:
-  GO_VERSION: "1.18.x"
+  GO_VERSION: "1.17.x"
 
 jobs:
   quality-gate:
@@ -34,16 +34,6 @@ jobs:
           checkName: "Static analysis"
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
-      - name: Check static analysis results - golangci-lint
-        uses: fountainhead/action-wait-for-check@v1.0.0
-        id: static-analysis-golangci-lint
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          # This check name is defined as the github action job name (in .github/workflows/testing.yaml)
-          checkName: "Static analysis - golangci-lint"
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
-
-
       - name: Check unit test results
         uses: fountainhead/action-wait-for-check@v1.0.0
         id: unit
@@ -90,10 +80,9 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Quality gate
-        if: steps.static-analysis.outputs.conclusion != 'success' || steps.static-analysis-golangci-lint.outputs.conclusion != 'success' || steps.unit.outputs.conclusion != 'success' || steps.integration.outputs.conclusion != 'success' || steps.cli-linux.outputs.conclusion != 'success' || steps.acceptance-linux.outputs.conclusion != 'success' || steps.acceptance-mac.outputs.conclusion != 'success'
+        if: steps.static-analysis.outputs.conclusion != 'success' || steps.unit.outputs.conclusion != 'success' || steps.integration.outputs.conclusion != 'success' || steps.cli-linux.outputs.conclusion != 'success' || steps.acceptance-linux.outputs.conclusion != 'success' || steps.acceptance-mac.outputs.conclusion != 'success'
         run: |
           echo "Static Analysis Status: ${{ steps.static-analysis.conclusion }}"
-          echo "Static Analysis Status - Golangci-Lint: ${{ steps.static-analysis-golangci-lint.conclusion }}"
           echo "Unit Test Status: ${{ steps.unit.outputs.conclusion }}"
           echo "Integration Test Status: ${{ steps.integration.outputs.conclusion }}"
           echo "Acceptance Test (Linux) Status: ${{ steps.acceptance-linux.outputs.conclusion }}"

.github/workflows/validations.yaml

@@ -7,49 +7,9 @@ on:
   pull_request:
 
 env:
-  GO_VERSION: "1.18.x"
-  GO_STABLE_VERSION: true
+  GO_VERSION: "1.17.x"
 
 jobs:
-# TODO: remove this job once golanci-lint is compatible with g01.18+
-  Static-Analysis-Golanci-lint:
-    name: "Static analysis - golangci-lint"
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/setup-go@v2
-        with:
-          go-version: "1.17" # NOTE: please use GO_VERSION once golangci supports go1.18+
-          stable: ${{ env.GO_STABLE_VERSION }}
-
-      - uses: actions/checkout@v2
-
-      - name: Restore tool cache
-        id: tool-cache
-        uses: actions/cache@v2.1.3
-        with:
-          path: ${{ github.workspace }}/.tmp
-          key: ${{ runner.os }}-tool-${{ hashFiles('Makefile') }}
-
-      - name: Restore go cache
-        id: go-cache
-        uses: actions/cache@v2.1.3
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-${{ env.GO_VERSION }}-
-
-      - name: (cache-miss) Bootstrap all project dependencies
-        if: steps.tool-cache.outputs.cache-hit != 'true' || steps.go-cache.outputs.cache-hit != 'true'
-        run: make bootstrap
-
-      - name: Bootstrap CI environment dependencies
-        run: make ci-bootstrap
-
-      - name: Run static analysis
-        run: make static-analysis-golanci-lint
-
-
 
   Static-Analysis:
     # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
@@ -59,7 +19,6 @@ jobs:
       - uses: actions/setup-go@v2
         with:
           go-version: ${{ env.GO_VERSION }}
-          stable: ${{ env.GO_STABLE_VERSION }}
 
       - uses: actions/checkout@v2
 
@@ -97,7 +56,6 @@ jobs:
       - uses: actions/setup-go@v2
         with:
           go-version: ${{ env.GO_VERSION }}
-          stable: ${{ env.GO_STABLE_VERSION }}
 
       - uses: actions/checkout@v2
 
@@ -134,16 +92,6 @@ jobs:
           path: syft/pkg/cataloger/java/test-fixtures/java-builds/packages
           key: ${{ runner.os }}-unit-java-cache-${{ hashFiles( 'syft/pkg/cataloger/java/test-fixtures/java-builds/packages.fingerprint' ) }}
 
-      - name: Build cache key for go binary test-fixture blobs (for unit tests)
-        run: make go-binaries-fingerprint
-
-      - name: Restore Go binary test-fixture cache
-        id: unit-go-binary-cache
-        uses: actions/cache@v2.1.3
-        with:
-          path: syft/pkg/cataloger/golang/test-fixtures/archs/binaries
-          key: ${{ runner.os }}-unit-go-binaries-cache-${{ hashFiles( 'syft/pkg/cataloger/golang/test-fixtures/archs/binaries.fingerprint' ) }}
-
       - name: Run unit tests
         run: make unit
 
@@ -160,7 +108,6 @@ jobs:
       - uses: actions/setup-go@v2
         with:
           go-version: ${{ env.GO_VERSION }}
-          stable: ${{ env.GO_STABLE_VERSION }}
 
       - uses: actions/checkout@v2
 
@@ -212,7 +159,6 @@ jobs:
       - uses: actions/setup-go@v2
         with:
           go-version: ${{ env.GO_VERSION }}
-          stable: ${{ env.GO_STABLE_VERSION }}
 
       - uses: actions/checkout@v2
 
@@ -285,7 +231,6 @@ jobs:
       - uses: actions/setup-go@v2
         with:
           go-version: ${{ env.GO_VERSION }}
-          stable: ${{ env.GO_STABLE_VERSION }}
 
       - uses: actions/checkout@v2
 
@@ -393,7 +338,6 @@ jobs:
       - uses: actions/setup-go@v2
         with:
           go-version: ${{ env.GO_VERSION }}
-          stable: ${{ env.GO_STABLE_VERSION }}
 
       - uses: actions/checkout@v2
 

CONTRIBUTING.md

@@ -82,6 +82,12 @@ Date:   Mon Aug 1 11:27:13 2020 -0400
 
 [//]: # (TODO: PR title and description)
 
+## Sign your commits
+
+To ensure the authenticity and integrity of code contributions, **we require that all commits are signed**. Signing commits proves that your commits were truly created by you, as the holder of a private key.
+
+Configuring git to sign your commits is a straightforward process. To get set up, see [GitHub's documentation on signing commits](https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits).
+
 ## Test your changes
 
 This project has a `Makefile` which includes many helpers running both unit and integration tests. Although PRs will have automatic checks for these, it is useful to run them locally, ensuring they pass before submitting changes. Ensure you've bootstrapped once before running tests:

Makefile

@@ -122,12 +122,7 @@ bootstrap: $(RESULTSDIR) bootstrap-go bootstrap-tools ## Download and install al
 	$(call title,Bootstrapping dependencies)
 
 .PHONY: static-analysis
-static-analysis: check-go-mod-tidy check-licenses
-
- # NOTE: isolating golanci-lint so it runs over go1.17 in CI, since it is not compatible with
- # go1.18+
-.PHONY: static-analysis-golanci-lint
-static-analysis-golanci-lint: lint
+static-analysis: lint check-go-mod-tidy check-licenses
 
 .PHONY: lint
 lint: ## Run gofmt + golangci lint checks
@@ -216,19 +211,13 @@ integration-fingerprint:
 .PHONY: java-packages-fingerprint
 java-packages-fingerprint:
 	$(call title,Java test fixture fingerprint)
-	cd syft/pkg/cataloger/java/test-fixtures/java-builds && \
+	cd syft/cataloger/packages/java/test-fixtures/java-builds && \
 		make packages.fingerprint
 
-.PHONY: go-binaries-fingerprint
-go-binaries-fingerprint:
-	$(call title,Go binaries test fixture fingerprint)
-	cd syft/pkg/cataloger/golang/test-fixtures/archs && \
-		make binaries.fingerprint
-
 .PHONY: fixtures
 fixtures:
 	$(call title,Generating test fixtures)
-	cd syft/pkg/cataloger/java/test-fixtures/java-builds && make
+	cd syft/cataloger/packages/java/test-fixtures/java-builds && make
 
 .PHONY: generate-json-schema
 generate-json-schema:  ## Generate a new json schema

README.md

@@ -11,14 +11,6 @@
 
 A CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Exceptional for vulnerability detection when used with a scanner tool like [Grype](https://github.com/anchore/grype).
 
-### Join our Virtual OSS Meetup!
-
-You are invited to join us on March 23rd, 11AM-Noon PT for our virtual open source meetup.  
-
-Hosts Priyanka “Pinky” Ravi of Weaveworks and Dan Luhring from Anchore OSS will explore how open source project Flux is utilizing Syft-generated SBOMs to secure the software supply chain.
-
-[Register here!](https://get.anchore.com/anchore-oss-meetup-mar-23-2022/)
-
 ### Join our community meetings!
 
 - Calendar: https://calendar.google.com/calendar/u/0/r?cid=Y182OTM4dGt0MjRtajI0NnNzOThiaGtnM29qNEBncm91cC5jYWxlbmRhci5nb29nbGUuY29t
@@ -294,11 +286,7 @@ check-for-app-update: true
 # exclude:
 #   - "/etc/**"
 #   - "./out/**/*.json"
-exclude: []
-
-# os and/or architecture to use when referencing container images (e.g. "windows/armv6" or "arm64")
-# same as --platform; SYFT_PLATFORM env var
-platform: ""
+exclude:
 
 # cataloging packages is exposed through the packages and power-user subcommands
 package:

cmd/attest.go

@@ -136,12 +136,12 @@ func attestExec(ctx context.Context, _ *cobra.Command, args []string) error {
 		return fmt.Errorf("could not generate source input for attest command: %w", err)
 	}
 
-	switch si.Scheme {
-	case source.ImageScheme, source.UnknownScheme:
+	switch si.Type {
+	case source.ImageType, source.UnknownType:
 		// at this point we know that it cannot be dir: or file: schemes, so we will assume that the unknown scheme could represent an image
-		si.Scheme = source.ImageScheme
+		si.Type = source.ImageType
 	default:
-		return fmt.Errorf("attest command can only be used with image sources but discovered %q when given %q", si.Scheme, userInput)
+		return fmt.Errorf("attest command can only be used with image sources but discovered %q when given %q", si.Type, userInput)
 	}
 
 	// if the original detection was from a local daemon we want to short circuit
@@ -188,26 +188,37 @@ func attestExec(ctx context.Context, _ *cobra.Command, args []string) error {
 	)
 }
 
-func attestationExecWorker(sourceInput source.Input, format sbom.Format, predicateType string, sv *sign.SignerVerifier) <-chan error {
+func attestationExecWorker(si source.Input, format sbom.Format, predicateType string, sv *sign.SignerVerifier) <-chan error {
 	errs := make(chan error)
 	go func() {
 		defer close(errs)
 
-		src, cleanup, err := source.NewFromRegistry(sourceInput, appConfig.Registry.ToOptions(), appConfig.Exclusions)
+		catalogingOpts, err := appConfig.ToCatalogingOptions()
+		if err != nil {
+			errs <- err
+			return
+		}
+
+		src, cleanup, err := source.NewFromRegistry(si, appConfig.Registry.ToOptions(), appConfig.Exclusions)
 		if cleanup != nil {
 			defer cleanup()
 		}
 		if err != nil {
-			errs <- fmt.Errorf("failed to construct source from user input %q: %w", sourceInput.UserInput, err)
+			errs <- fmt.Errorf("failed to construct source from user input %q: %w", si.UserInput, err)
 			return
 		}
 
-		s, err := generateSBOM(src, errs)
+		s, err := syft.Catalog(src, catalogingOpts...)
 		if err != nil {
 			errs <- err
 			return
 		}
 
+		if s == nil {
+			errs <- fmt.Errorf("no SBOM produced for %q", si.UserInput)
+			return
+		}
+
 		sbomBytes, err := syft.Encode(*s, format)
 		if err != nil {
 			errs <- err

cmd/format_aliases.go

@@ -22,8 +22,6 @@ func formatAliases(ids ...sbom.FormatID) (aliases []string) {
 			aliases = append(aliases, "cyclonedx-xml")
 		case syft.CycloneDxJSONFormatID:
 			aliases = append(aliases, "cyclonedx-json")
-		case syft.GitHubID:
-			aliases = append(aliases, "github", "github-json")
 		default:
 			aliases = append(aliases, string(id))
 		}

cmd/packages.go

@@ -13,11 +13,8 @@ import (
 	"github.com/anchore/syft/internal/formats/table"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/ui"
-	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft"
-	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/pkg/cataloger"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 	"github.com/pkg/profile"
@@ -97,7 +94,7 @@ func init() {
 func setPackageFlags(flags *pflag.FlagSet) {
 	// Formatting & Input options //////////////////////////////////////////////
 	flags.StringP(
-		"scope", "s", cataloger.DefaultSearchConfig().Scope.String(),
+		"scope", "s", syft.DefaultCatalogingConfig().DefaultScope.String(),
 		fmt.Sprintf("selection of layers to catalog, options=%v", source.AllScopes))
 
 	flags.StringArrayP(
@@ -115,6 +112,12 @@ func setPackageFlags(flags *pflag.FlagSet) {
 		"an optional platform specifier for container image sources (e.g. 'linux/arm64', 'linux/arm64/v8', 'arm64', 'linux')",
 	)
 
+	flags.StringArrayP(
+		"cataloger", "", nil,
+		// TODO: have a nice way for a user to get the set of catalogers that exist
+		"set which catalogers to use when generating an SBOM",
+	)
+
 	// Upload options //////////////////////////////////////////////////////////
 	flags.StringP(
 		"host", "H", "",
@@ -168,7 +171,11 @@ func bindExclusivePackagesConfigOptions(flags *pflag.FlagSet) error {
 
 	// note: output is not included since this configuration option is shared between multiple subcommands
 
-	if err := viper.BindPFlag("package.cataloger.scope", flags.Lookup("scope")); err != nil {
+	if err := viper.BindPFlag("scope", flags.Lookup("scope")); err != nil {
+		return err
+	}
+
+	if err := viper.BindPFlag("catalogers", flags.Lookup("cataloger")); err != nil {
 		return err
 	}
 
@@ -260,42 +267,17 @@ func isVerbose() (result bool) {
 	return appConfig.CliOptions.Verbosity > 0 || isPipedInput
 }
 
-func generateSBOM(src *source.Source, errs chan error) (*sbom.SBOM, error) {
-	tasks, err := tasks()
-	if err != nil {
-		return nil, err
-	}
-
-	s := sbom.SBOM{
-		Source: src.Metadata,
-		Descriptor: sbom.Descriptor{
-			Name:          internal.ApplicationName,
-			Version:       version.FromBuild().Version,
-			Configuration: appConfig,
-		},
-	}
-
-	buildRelationships(&s, src, tasks, errs)
-
-	return &s, nil
-}
-
-func buildRelationships(s *sbom.SBOM, src *source.Source, tasks []task, errs chan error) {
-	var relationships []<-chan artifact.Relationship
-	for _, task := range tasks {
-		c := make(chan artifact.Relationship)
-		relationships = append(relationships, c)
-		go runTask(task, &s.Artifacts, src, c, errs)
-	}
-
-	s.Relationships = append(s.Relationships, mergeRelationships(relationships...)...)
-}
-
 func packagesExecWorker(si source.Input, writer sbom.Writer) <-chan error {
 	errs := make(chan error)
 	go func() {
 		defer close(errs)
 
+		catalogingOpts, err := appConfig.ToCatalogingOptions()
+		if err != nil {
+			errs <- err
+			return
+		}
+
 		src, cleanup, err := source.New(si, appConfig.Registry.ToOptions(), appConfig.Exclusions)
 		if cleanup != nil {
 			defer cleanup()
@@ -305,7 +287,7 @@ func packagesExecWorker(si source.Input, writer sbom.Writer) <-chan error {
 			return
 		}
 
-		s, err := generateSBOM(src, errs)
+		s, err := syft.Catalog(src, catalogingOpts...)
 		if err != nil {
 			errs <- err
 			return
@@ -313,6 +295,7 @@ func packagesExecWorker(si source.Input, writer sbom.Writer) <-chan error {
 
 		if s == nil {
 			errs <- fmt.Errorf("no SBOM produced for %q", si.UserInput)
+			return
 		}
 
 		if appConfig.Anchore.Host != "" {
@@ -330,20 +313,10 @@ func packagesExecWorker(si source.Input, writer sbom.Writer) <-chan error {
 	return errs
 }
 
-func mergeRelationships(cs ...<-chan artifact.Relationship) (relationships []artifact.Relationship) {
-	for _, c := range cs {
-		for n := range c {
-			relationships = append(relationships, n)
-		}
-	}
-
-	return relationships
-}
-
 func runPackageSbomUpload(src *source.Source, s sbom.SBOM) error {
 	log.Infof("uploading results to %s", appConfig.Anchore.Host)
 
-	if src.Metadata.Scheme != source.ImageScheme {
+	if src.Metadata.Scheme != source.ImageType {
 		return fmt.Errorf("unable to upload results: only images are supported")
 	}
 

cmd/power_user.go

@@ -2,6 +2,7 @@ package cmd
 
 import (
 	"fmt"
+	"github.com/anchore/syft/syft"
 	"os"
 
 	"github.com/anchore/stereoscope"
@@ -10,8 +11,6 @@ import (
 	"github.com/anchore/syft/internal/formats/syftjson"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/ui"
-	"github.com/anchore/syft/internal/version"
-	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
@@ -106,11 +105,13 @@ func powerUserExecWorker(userInput string, writer sbom.Writer) <-chan error {
 	go func() {
 		defer close(errs)
 
-		appConfig.Secrets.Cataloger.Enabled = true
-		appConfig.FileMetadata.Cataloger.Enabled = true
-		appConfig.FileContents.Cataloger.Enabled = true
-		appConfig.FileClassification.Cataloger.Enabled = true
-		tasks, err := tasks()
+		// TODO: replace
+		//appConfig.Secrets.Cataloger.Enabled = true
+		//appConfig.FileMetadata.Cataloger.Enabled = true
+		//appConfig.FileContents.Cataloger.Enabled = true
+		//appConfig.FileClassification.Cataloger.Enabled = true
+
+		catalogingOpts, err := appConfig.ToCatalogingOptions()
 		if err != nil {
 			errs <- err
 			return
@@ -131,28 +132,20 @@ func powerUserExecWorker(userInput string, writer sbom.Writer) <-chan error {
 			defer cleanup()
 		}
 
-		s := sbom.SBOM{
-			Source: src.Metadata,
-			Descriptor: sbom.Descriptor{
-				Name:          internal.ApplicationName,
-				Version:       version.FromBuild().Version,
-				Configuration: appConfig,
-			},
+		s, err := syft.Catalog(src, catalogingOpts...)
+		if err != nil {
+			errs <- err
+			return
 		}
 
-		var relationships []<-chan artifact.Relationship
-		for _, task := range tasks {
-			c := make(chan artifact.Relationship)
-			relationships = append(relationships, c)
-
-			go runTask(task, &s.Artifacts, src, c, errs)
+		if s == nil {
+			errs <- fmt.Errorf("no SBOM produced for %q", si.UserInput)
+			return
 		}
 
-		s.Relationships = append(s.Relationships, mergeRelationships(relationships...)...)
-
 		bus.Publish(partybus.Event{
 			Type:  event.Exit,
-			Value: func() error { return writer.Write(s) },
+			Value: func() error { return writer.Write(*s) },
 		})
 	}()
 

cmd/tasks.go

@@ -1,231 +0,0 @@
-package cmd
-
-import (
-	"crypto"
-	"fmt"
-
-	"github.com/anchore/syft/syft"
-	"github.com/anchore/syft/syft/artifact"
-	"github.com/anchore/syft/syft/file"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/anchore/syft/syft/source"
-)
-
-type task func(*sbom.Artifacts, *source.Source) ([]artifact.Relationship, error)
-
-func tasks() ([]task, error) {
-	var tasks []task
-
-	generators := []func() (task, error){
-		generateCatalogPackagesTask,
-		generateCatalogFileMetadataTask,
-		generateCatalogFileDigestsTask,
-		generateCatalogSecretsTask,
-		generateCatalogFileClassificationsTask,
-		generateCatalogContentsTask,
-	}
-
-	for _, generator := range generators {
-		task, err := generator()
-		if err != nil {
-			return nil, err
-		}
-
-		if task != nil {
-			tasks = append(tasks, task)
-		}
-	}
-
-	return tasks, nil
-}
-
-func generateCatalogPackagesTask() (task, error) {
-	if !appConfig.Package.Cataloger.Enabled {
-		return nil, nil
-	}
-
-	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
-		packageCatalog, relationships, theDistro, err := syft.CatalogPackages(src, appConfig.Package.ToConfig())
-		if err != nil {
-			return nil, err
-		}
-
-		results.PackageCatalog = packageCatalog
-		results.LinuxDistribution = theDistro
-
-		return relationships, nil
-	}
-
-	return task, nil
-}
-
-func generateCatalogFileMetadataTask() (task, error) {
-	if !appConfig.FileMetadata.Cataloger.Enabled {
-		return nil, nil
-	}
-
-	metadataCataloger := file.NewMetadataCataloger()
-
-	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
-		resolver, err := src.FileResolver(appConfig.FileMetadata.Cataloger.ScopeOpt)
-		if err != nil {
-			return nil, err
-		}
-
-		result, err := metadataCataloger.Catalog(resolver)
-		if err != nil {
-			return nil, err
-		}
-		results.FileMetadata = result
-		return nil, nil
-	}
-
-	return task, nil
-}
-
-func generateCatalogFileDigestsTask() (task, error) {
-	if !appConfig.FileMetadata.Cataloger.Enabled {
-		return nil, nil
-	}
-
-	supportedHashAlgorithms := make(map[string]crypto.Hash)
-	for _, h := range []crypto.Hash{
-		crypto.MD5,
-		crypto.SHA1,
-		crypto.SHA256,
-	} {
-		supportedHashAlgorithms[file.DigestAlgorithmName(h)] = h
-	}
-
-	var hashes []crypto.Hash
-	for _, hashStr := range appConfig.FileMetadata.Digests {
-		name := file.CleanDigestAlgorithmName(hashStr)
-		hashObj, ok := supportedHashAlgorithms[name]
-		if !ok {
-			return nil, fmt.Errorf("unsupported hash algorithm: %s", hashStr)
-		}
-		hashes = append(hashes, hashObj)
-	}
-
-	digestsCataloger, err := file.NewDigestsCataloger(hashes)
-	if err != nil {
-		return nil, err
-	}
-
-	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
-		resolver, err := src.FileResolver(appConfig.FileMetadata.Cataloger.ScopeOpt)
-		if err != nil {
-			return nil, err
-		}
-
-		result, err := digestsCataloger.Catalog(resolver)
-		if err != nil {
-			return nil, err
-		}
-		results.FileDigests = result
-		return nil, nil
-	}
-
-	return task, nil
-}
-
-func generateCatalogSecretsTask() (task, error) {
-	if !appConfig.Secrets.Cataloger.Enabled {
-		return nil, nil
-	}
-
-	patterns, err := file.GenerateSearchPatterns(file.DefaultSecretsPatterns, appConfig.Secrets.AdditionalPatterns, appConfig.Secrets.ExcludePatternNames)
-	if err != nil {
-		return nil, err
-	}
-
-	secretsCataloger, err := file.NewSecretsCataloger(patterns, appConfig.Secrets.RevealValues, appConfig.Secrets.SkipFilesAboveSize)
-	if err != nil {
-		return nil, err
-	}
-
-	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
-		resolver, err := src.FileResolver(appConfig.Secrets.Cataloger.ScopeOpt)
-		if err != nil {
-			return nil, err
-		}
-
-		result, err := secretsCataloger.Catalog(resolver)
-		if err != nil {
-			return nil, err
-		}
-		results.Secrets = result
-		return nil, nil
-	}
-
-	return task, nil
-}
-
-func generateCatalogFileClassificationsTask() (task, error) {
-	if !appConfig.FileClassification.Cataloger.Enabled {
-		return nil, nil
-	}
-
-	// TODO: in the future we could expose out the classifiers via configuration
-	classifierCataloger, err := file.NewClassificationCataloger(file.DefaultClassifiers)
-	if err != nil {
-		return nil, err
-	}
-
-	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
-		resolver, err := src.FileResolver(appConfig.FileClassification.Cataloger.ScopeOpt)
-		if err != nil {
-			return nil, err
-		}
-
-		result, err := classifierCataloger.Catalog(resolver)
-		if err != nil {
-			return nil, err
-		}
-		results.FileClassifications = result
-		return nil, nil
-	}
-
-	return task, nil
-}
-
-func generateCatalogContentsTask() (task, error) {
-	if !appConfig.FileContents.Cataloger.Enabled {
-		return nil, nil
-	}
-
-	contentsCataloger, err := file.NewContentsCataloger(appConfig.FileContents.Globs, appConfig.FileContents.SkipFilesAboveSize)
-	if err != nil {
-		return nil, err
-	}
-
-	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
-		resolver, err := src.FileResolver(appConfig.FileContents.Cataloger.ScopeOpt)
-		if err != nil {
-			return nil, err
-		}
-
-		result, err := contentsCataloger.Catalog(resolver)
-		if err != nil {
-			return nil, err
-		}
-		results.FileContents = result
-		return nil, nil
-	}
-
-	return task, nil
-}
-
-func runTask(t task, a *sbom.Artifacts, src *source.Source, c chan<- artifact.Relationship, errs chan<- error) {
-	defer close(c)
-
-	relationships, err := t(a, src)
-	if err != nil {
-		errs <- err
-		return
-	}
-
-	for _, relationship := range relationships {
-		c <- relationship
-	}
-}

go.mod

@@ -9,12 +9,11 @@ require (
 	github.com/adrg/xdg v0.2.1
 	github.com/alecthomas/jsonschema v0.0.0-20210301060011-54c507b6f074
 	github.com/anchore/client-go v0.0.0-20210222170800-9c70f9b80bcf
-	github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb
 	github.com/anchore/go-rpmdb v0.0.0-20210914181456-a9c52348da63
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
-	github.com/anchore/packageurl-go v0.1.1-0.20220314153042-1bcd40e5206b
-	github.com/anchore/stereoscope v0.0.0-20220321131953-5e4083dd6a09
+	github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29
+	github.com/anchore/stereoscope v0.0.0-20220307154759-8a5a70c227d3
 	github.com/antihax/optional v1.0.0
 	github.com/bmatcuk/doublestar/v4 v4.0.2
 	github.com/dustin/go-humanize v1.0.0
@@ -172,7 +171,7 @@ require (
 	github.com/hashicorp/go-uuid v1.0.2 // indirect
 	github.com/hashicorp/go-version v1.4.0 // indirect
 	github.com/hashicorp/golang-lru v0.5.4 // indirect
-	github.com/hashicorp/vault/api v1.4.1 // indirect
+	github.com/hashicorp/vault/api v1.3.1 // indirect
 	github.com/hashicorp/vault/sdk v0.4.1 // indirect
 	github.com/hashicorp/yamux v0.0.0-20211028200310-0bc27b27de87 // indirect
 	github.com/imdario/mergo v0.3.12 // indirect

go.sum

@@ -276,18 +276,16 @@ github.com/alexflint/go-filemutex v0.0.0-20171022225611-72bdc8eae2ae/go.mod h1:C
 github.com/alexkohler/prealloc v1.0.0/go.mod h1:VetnK3dIgFBBKmg0YnD9F9x6Icjd+9cvfHR56wJVlKE=
 github.com/anchore/client-go v0.0.0-20210222170800-9c70f9b80bcf h1:DYssiUV1pBmKqzKsm4mqXx8artqC0Q8HgZsVI3lMsAg=
 github.com/anchore/client-go v0.0.0-20210222170800-9c70f9b80bcf/go.mod h1:FaODhIA06mxO1E6R32JE0TL1JWZZkmjRIAd4ULvHUKk=
-github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb h1:iDMnx6LIjtjZ46C0akqveX83WFzhpTD3eqOthawb5vU=
-github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb/go.mod h1:DmTY2Mfcv38hsHbG78xMiTDdxFtkHpgYNVDPsF2TgHk=
 github.com/anchore/go-rpmdb v0.0.0-20210914181456-a9c52348da63 h1:C9W/LAydEz/qdUhx1MdjO9l8NEcFKYknkxDVyo9LAoM=
 github.com/anchore/go-rpmdb v0.0.0-20210914181456-a9c52348da63/go.mod h1:6qH8c6U/3CBVvDDDBZnPSTbTINq3cIdADUYTaVf75EM=
 github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04 h1:VzprUTpc0vW0nnNKJfJieyH/TZ9UYAnTZs5/gHTdAe8=
 github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04/go.mod h1:6dK64g27Qi1qGQZ67gFmBFvEHScy0/C8qhQhNe5B5pQ=
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZVsCYMrIZBpFxwV26CbsuoEh5muXD5I1Ods=
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
-github.com/anchore/packageurl-go v0.1.1-0.20220314153042-1bcd40e5206b h1:YJWYt/6KQXR9JR46lLHrTTYi8rcye42tKcyjREA/hvA=
-github.com/anchore/packageurl-go v0.1.1-0.20220314153042-1bcd40e5206b/go.mod h1:Blo6OgJNiYF41ufcgHKkbCKF2MDOMlrqhXv/ij6ocR4=
-github.com/anchore/stereoscope v0.0.0-20220321131953-5e4083dd6a09 h1:as2fIXP5OhxT/r4D5wjKYPm/Z3Sj50gqRQMJmYZlwMg=
-github.com/anchore/stereoscope v0.0.0-20220321131953-5e4083dd6a09/go.mod h1:OVVJ4y/L26pspeeHNvNa7GeQfoLPWxJe13iODl9x5l4=
+github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29 h1:K9LfnxwhqvihqU0+MF325FNy7fsKV9EGaUxdfR4gnWk=
+github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29/go.mod h1:Oc1UkGaJwY6ND6vtAqPSlYrptKRJngHwkwB6W7l1uP0=
+github.com/anchore/stereoscope v0.0.0-20220307154759-8a5a70c227d3 h1:Kx2jlMdENAf4cVjYGYLI+fiavVhzhtmU89GUYDITJ1w=
+github.com/anchore/stereoscope v0.0.0-20220307154759-8a5a70c227d3/go.mod h1:XESZQTgFETDBatmyoet6XZ0zVknoIMDSAhj2INj2a5w=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.0.0/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
 github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
@@ -1351,9 +1349,8 @@ github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/J
 github.com/hashicorp/serf v0.9.5/go.mod h1:UWDWwZeL5cuWDJdl0C6wrvrUwEqtQ4ZKBKKENpqIUyk=
 github.com/hashicorp/serf v0.9.6/go.mod h1:TXZNMjZQijwlDvp+r0b63xZ45H7JmCmgg4gpTwn9UV4=
 github.com/hashicorp/vault/api v1.3.0/go.mod h1:EabNQLI0VWbWoGlA+oBLC8PXmR9D60aUVgQGvangFWQ=
+github.com/hashicorp/vault/api v1.3.1 h1:pkDkcgTh47PRjY1NEFeofqR4W/HkNUi9qIakESO2aRM=
 github.com/hashicorp/vault/api v1.3.1/go.mod h1:QeJoWxMFt+MsuWcYhmwRLwKEXrjwAFFywzhptMsTIUw=
-github.com/hashicorp/vault/api v1.4.1 h1:mWLfPT0RhxBitjKr6swieCEP2v5pp/M//t70S3kMLRo=
-github.com/hashicorp/vault/api v1.4.1/go.mod h1:LkMdrZnWNrFaQyYYazWVn7KshilfDidgVBq6YiTq/bM=
 github.com/hashicorp/vault/sdk v0.3.0/go.mod h1:aZ3fNuL5VNydQk8GcLJ2TV8YCRVvyaakYkhZRoVuhj0=
 github.com/hashicorp/vault/sdk v0.4.1 h1:3SaHOJY687jY1fnB61PtL0cOkKItphrbLmux7T92HBo=
 github.com/hashicorp/vault/sdk v0.4.1/go.mod h1:aZ3fNuL5VNydQk8GcLJ2TV8YCRVvyaakYkhZRoVuhj0=

internal/anchore/import.go

@@ -6,14 +6,15 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/anchore/client-go/pkg/external"
-	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/antihax/optional"
 	"github.com/wagoodman/go-partybus"
 	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/client-go/pkg/external"
+	"github.com/anchore/stereoscope/pkg/image"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/antihax/optional"
 )
 
 type ImportConfig struct {

internal/anchore/import_package_sbom_test.go

@@ -4,6 +4,8 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"github.com/anchore/syft/syft/cpe"
+	"github.com/anchore/syft/syft/file"
 	"net/http"
 	"strings"
 	"testing"
@@ -22,7 +24,7 @@ import (
 	"github.com/wagoodman/go-progress"
 )
 
-func must(c pkg.CPE, e error) pkg.CPE {
+func must(c cpe.CPE, e error) cpe.CPE {
 	if e != nil {
 		panic(e)
 	}
@@ -52,13 +54,13 @@ func (m *mockPackageSBOMImportAPI) ImportImagePackages(ctx context.Context, sess
 func sbomFixture() sbom.SBOM {
 	return sbom.SBOM{
 		Artifacts: sbom.Artifacts{
-			PackageCatalog: pkg.NewCatalog(pkg.Package{
+			Packages: pkg.NewCollection(pkg.Package{
 				Name:    "name",
 				Version: "version",
 				FoundBy: "foundBy",
-				Locations: []source.Location{
+				Locations: []file.Location{
 					{
-						Coordinates: source.Coordinates{
+						Coordinates: file.Coordinates{
 							RealPath:     "path",
 							FileSystemID: "layerID",
 						},
@@ -67,8 +69,8 @@ func sbomFixture() sbom.SBOM {
 				Licenses: []string{"license"},
 				Language: pkg.Python,
 				Type:     pkg.PythonPkg,
-				CPEs: []pkg.CPE{
-					must(pkg.NewCPE("cpe:2.3:*:some:package:1:*:*:*:*:*:*:*")),
+				CPEs: []cpe.CPE{
+					must(cpe.New("cpe:2.3:*:some:package:1:*:*:*:*:*:*:*")),
 				},
 				PURL:         "purl",
 				MetadataType: pkg.PythonPackageMetadataType,
@@ -102,13 +104,13 @@ func sbomFixture() sbom.SBOM {
 		},
 		Relationships: []artifact.Relationship{
 			{
-				From: source.NewLocation("/place1"),
-				To:   source.NewLocation("/place2"),
+				From: file.NewLocation("/place1"),
+				To:   file.NewLocation("/place2"),
 				Type: artifact.ContainsRelationship,
 			},
 		},
 		Source: source.Metadata{
-			Scheme: source.ImageScheme,
+			Scheme: source.ImageType,
 			ImageMetadata: source.ImageMetadata{
 				UserInput:      "user-in",
 				Layers:         nil,

internal/archive/safe_copy.go

@@ -1,12 +1,14 @@
-package file
+package archive
 
 import (
 	"errors"
 	"fmt"
 	"io"
+
+	"github.com/anchore/syft/syft/file"
 )
 
-const perFileReadLimit = 2 * GB
+const perFileReadLimit = 2 * file.GB
 
 // safeCopy limits the copy from the reader. This is useful when extracting files from archives to
 // protect against decompression bomb attacks.

internal/archive/tar_file_traversal.go

@@ -1,38 +1,39 @@
-package file
+package archive
 
 import (
 	"fmt"
 	"io/ioutil"
 	"path/filepath"
 
+	"github.com/anchore/syft/syft/file"
 	"github.com/bmatcuk/doublestar/v4"
 	"github.com/mholt/archiver/v3"
 )
 
 // ExtractGlobsFromTarToUniqueTempFile extracts paths matching the given globs within the given archive to a temporary directory, returning file openers for each file extracted.
-func ExtractGlobsFromTarToUniqueTempFile(archivePath, dir string, globs ...string) (map[string]Opener, error) {
-	results := make(map[string]Opener)
+func ExtractGlobsFromTarToUniqueTempFile(archivePath, dir string, globs ...string) (map[string]file.Opener, error) {
+	results := make(map[string]file.Opener)
 
 	// don't allow for full traversal, only select traversal from given paths
 	if len(globs) == 0 {
 		return results, nil
 	}
 
-	visitor := func(file archiver.File) error {
-		defer file.Close()
+	visitor := func(f archiver.File) error {
+		defer f.Close()
 
 		// ignore directories
-		if file.FileInfo.IsDir() {
+		if f.FileInfo.IsDir() {
 			return nil
 		}
 
 		// ignore any filename that doesn't match the given globs...
-		if !matchesAnyGlob(file.Name(), globs...) {
+		if !matchesAnyGlob(f.Name(), globs...) {
 			return nil
 		}
 
 		// we have a file we want to extract....
-		tempfilePrefix := filepath.Base(filepath.Clean(file.Name())) + "-"
+		tempfilePrefix := filepath.Base(filepath.Clean(f.Name())) + "-"
 		tempFile, err := ioutil.TempFile(dir, tempfilePrefix)
 		if err != nil {
 			return fmt.Errorf("unable to create temp file: %w", err)
@@ -42,11 +43,11 @@ func ExtractGlobsFromTarToUniqueTempFile(archivePath, dir string, globs ...strin
 		// provides a ReadCloser. It is up to the caller to handle closing the file explicitly.
 		defer tempFile.Close()
 
-		if err := safeCopy(tempFile, file.ReadCloser); err != nil {
-			return fmt.Errorf("unable to copy source=%q for tar=%q: %w", file.Name(), archivePath, err)
+		if err := safeCopy(tempFile, f.ReadCloser); err != nil {
+			return fmt.Errorf("unable to copy source=%q for tar=%q: %w", f.Name(), archivePath, err)
 		}
 
-		results[file.Name()] = Opener{path: tempFile.Name()}
+		results[f.Name()] = file.NewOpener(tempFile.Name())
 
 		return nil
 	}

internal/archive/zip_file_helpers_test.go

@@ -1,4 +1,4 @@
-package file
+package archive
 
 import (
 	"io/ioutil"

internal/archive/zip_file_manifest.go

@@ -1,4 +1,4 @@
-package file
+package archive
 
 import (
 	"fmt"
@@ -48,7 +48,7 @@ func (z ZipFileManifest) GlobMatch(patterns ...string) []string {
 			// so that glob logic is consistent inside and outside of ZIP archives
 			normalizedEntry := normalizeZipEntryName(entry)
 
-			if GlobMatch(pattern, normalizedEntry) {
+			if internal.FileNameGlobMatch(pattern, normalizedEntry) {
 				uniqueMatches.Add(entry)
 			}
 		}

internal/archive/zip_file_manifest_test.go

@@ -1,7 +1,7 @@
 //go:build !windows
 // +build !windows
 
-package file
+package archive
 
 import (
 	"encoding/json"

internal/archive/zip_file_traversal.go

@@ -1,4 +1,4 @@
-package file
+package archive
 
 import (
 	"archive/zip"
@@ -9,15 +9,9 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/anchore/syft/internal/log"
-)
+	"github.com/anchore/syft/syft/file"
 
-const (
-	// represents the order of bytes
-	_  = iota
-	KB = 1 << (10 * iota)
-	MB
-	GB
+	"github.com/anchore/syft/internal/log"
 )
 
 type errZipSlipDetected struct {
@@ -71,16 +65,16 @@ func TraverseFilesInZip(archivePath string, visitor func(*zip.File) error, paths
 }
 
 // ExtractFromZipToUniqueTempFile extracts select paths for the given archive to a temporary directory, returning file openers for each file extracted.
-func ExtractFromZipToUniqueTempFile(archivePath, dir string, paths ...string) (map[string]Opener, error) {
-	results := make(map[string]Opener)
+func ExtractFromZipToUniqueTempFile(archivePath, dir string, paths ...string) (map[string]file.Opener, error) {
+	results := make(map[string]file.Opener)
 
 	// don't allow for full traversal, only select traversal from given paths
 	if len(paths) == 0 {
 		return results, nil
 	}
 
-	visitor := func(file *zip.File) error {
-		tempfilePrefix := filepath.Base(filepath.Clean(file.Name)) + "-"
+	visitor := func(f *zip.File) error {
+		tempfilePrefix := filepath.Base(filepath.Clean(f.Name)) + "-"
 
 		tempFile, err := ioutil.TempFile(dir, tempfilePrefix)
 		if err != nil {
@@ -91,26 +85,26 @@ func ExtractFromZipToUniqueTempFile(archivePath, dir string, paths ...string) (m
 		// provides a ReadCloser. It is up to the caller to handle closing the file explicitly.
 		defer tempFile.Close()
 
-		zippedFile, err := file.Open()
+		zippedFile, err := f.Open()
 		if err != nil {
-			return fmt.Errorf("unable to read file=%q from zip=%q: %w", file.Name, archivePath, err)
+			return fmt.Errorf("unable to read file=%q from zip=%q: %w", f.Name, archivePath, err)
 		}
 		defer func() {
 			err := zippedFile.Close()
 			if err != nil {
-				log.Errorf("unable to close source file=%q from zip=%q: %+v", file.Name, archivePath, err)
+				log.Errorf("unable to close source file=%q from zip=%q: %+v", f.Name, archivePath, err)
 			}
 		}()
 
-		if file.FileInfo().IsDir() {
-			return fmt.Errorf("unable to extract directories, only files: %s", file.Name)
+		if f.FileInfo().IsDir() {
+			return fmt.Errorf("unable to extract directories, only files: %s", f.Name)
 		}
 
 		if err := safeCopy(tempFile, zippedFile); err != nil {
-			return fmt.Errorf("unable to copy source=%q for zip=%q: %w", file.Name, archivePath, err)
+			return fmt.Errorf("unable to copy source=%q for zip=%q: %w", f.Name, archivePath, err)
 		}
 
-		results[file.Name] = Opener{path: tempFile.Name()}
+		results[f.Name] = file.NewOpener(tempFile.Name())
 
 		return nil
 	}

internal/archive/zip_file_traversal_test.go

@@ -1,7 +1,7 @@
 //go:build !windows
 // +build !windows
 
-package file
+package archive
 
 import (
 	"crypto/sha256"

internal/archive/zip_read_closer.go

@@ -1,4 +1,4 @@
-package file
+package archive
 
 import (
 	"archive/zip"

internal/archive/zip_read_closer_test.go

@@ -1,7 +1,7 @@
 //go:build !windows
 // +build !windows
 
-package file
+package archive
 
 import (
 	"os"

internal/config/application.go

@@ -3,12 +3,16 @@ package config
 import (
 	"errors"
 	"fmt"
+	"github.com/anchore/syft/syft/source"
 	"path"
 	"reflect"
 	"strings"
 
 	"github.com/adrg/xdg"
 	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/version"
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/file"
 	"github.com/mitchellh/go-homedir"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/viper"
@@ -17,6 +21,7 @@ import (
 
 var ErrApplicationConfigNotFound = fmt.Errorf("application config not found")
 
+// TODO: set all catalogers when this is set
 var catalogerEnabledDefault = false
 
 type defaultValueLoader interface {
@@ -29,24 +34,66 @@ type parser interface {
 
 // Application is the main syft application configuration.
 type Application struct {
-	ConfigPath         string             `yaml:",omitempty" json:"configPath"`                                                         // the location where the application config was read from (either from -c or discovered while loading)
-	Outputs            []string           `yaml:"output" json:"output" mapstructure:"output"`                                           // -o, the format to use for output
-	File               string             `yaml:"file" json:"file" mapstructure:"file"`                                                 // --file, the file to write report output to
-	Quiet              bool               `yaml:"quiet" json:"quiet" mapstructure:"quiet"`                                              // -q, indicates to not show any status output to stderr (ETUI or logging UI)
-	CheckForAppUpdate  bool               `yaml:"check-for-app-update" json:"check-for-app-update" mapstructure:"check-for-app-update"` // whether to check for an application update on start up or not
-	Anchore            anchore            `yaml:"anchore" json:"anchore" mapstructure:"anchore"`                                        // options for interacting with Anchore Engine/Enterprise
-	CliOptions         CliOnlyOptions     `yaml:"-" json:"-"`                                                                           // all options only available through the CLI (not via env vars or config)
-	Dev                development        `yaml:"dev" json:"dev" mapstructure:"dev"`
-	Log                logging            `yaml:"log" json:"log" mapstructure:"log"` // all logging-related options
-	Package            pkg                `yaml:"package" json:"package" mapstructure:"package"`
-	FileMetadata       FileMetadata       `yaml:"file-metadata" json:"file-metadata" mapstructure:"file-metadata"`
-	FileClassification fileClassification `yaml:"file-classification" json:"file-classification" mapstructure:"file-classification"`
-	FileContents       fileContents       `yaml:"file-contents" json:"file-contents" mapstructure:"file-contents"`
-	Secrets            secrets            `yaml:"secrets" json:"secrets" mapstructure:"secrets"`
-	Registry           registry           `yaml:"registry" json:"registry" mapstructure:"registry"`
-	Exclusions         []string           `yaml:"exclude" json:"exclude" mapstructure:"exclude"`
-	Attest             attest             `yaml:"attest" json:"attest" mapstructure:"attest"`
-	Platform           string             `yaml:"platform" json:"platform" mapstructure:"platform"`
+	ConfigPath        string         `yaml:",omitempty" json:"configPath"`                                                         // the location where the application config was read from (either from -c or discovered while loading)
+	Outputs           []string       `yaml:"output" json:"output" mapstructure:"output"`                                           // -o, the format to use for output
+	File              string         `yaml:"file" json:"file" mapstructure:"file"`                                                 // --file, the file to write report output to
+	Quiet             bool           `yaml:"quiet" json:"quiet" mapstructure:"quiet"`                                              // -q, indicates to not show any status output to stderr (ETUI or logging UI)
+	CheckForAppUpdate bool           `yaml:"check-for-app-update" json:"check-for-app-update" mapstructure:"check-for-app-update"` // whether to check for an application update on start up or not
+	Anchore           anchore        `yaml:"anchore" json:"anchore" mapstructure:"anchore"`                                        // options for interacting with Anchore Engine/Enterprise
+	CliOptions        CliOnlyOptions `yaml:"-" json:"-"`                                                                           // all options only available through the CLI (not via env vars or config)
+	Catalogers        []string       `yaml:"catalogers" json:"catalogers" mapstructure:"catalogers"`
+	Scope             string         `yaml:"scope" json:"scope" mapstructure:"scope"`
+	Dev               development    `yaml:"dev" json:"dev" mapstructure:"dev"`
+	Log               logging        `yaml:"log" json:"log" mapstructure:"log"` // all logging-related options
+	Package           pkg            `yaml:"package" json:"package" mapstructure:"package"`
+	FileMetadata      fileMetadata   `yaml:"file-metadata" json:"file-metadata" mapstructure:"file-metadata"`
+	FileContents      fileContents   `yaml:"file-contents" json:"file-contents" mapstructure:"file-contents"`
+	Secrets           secretsCfg     `yaml:"secrets" json:"secrets" mapstructure:"secrets"`
+	Registry          registry       `yaml:"registry" json:"registry" mapstructure:"registry"`
+	Exclusions        []string       `yaml:"exclude" json:"exclude" mapstructure:"exclude"`
+	Attest            attest         `yaml:"attest" json:"attest" mapstructure:"attest"`
+	Platform          string         `yaml:"platform" json:"platform" mapstructure:"platform"`
+}
+
+func (cfg Application) ToCatalogingOptions() ([]syft.CatalogingOption, error) {
+
+	digests, err := file.DigestHashesByName(cfg.FileMetadata.Digests...)
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse config item 'file-metadata.digests': %w", err)
+	}
+
+	scopeOption := source.ParseScope(cfg.Scope)
+	if scopeOption == source.UnknownScope {
+		return nil, fmt.Errorf("bad scope value %q", cfg.Scope)
+	}
+
+	secretsConfig, err := cfg.Secrets.ToConfig()
+	if err != nil {
+		return nil, err
+	}
+
+	secretsScopeOption := source.ParseScope(cfg.Secrets.Scope)
+	if secretsScopeOption == source.UnknownScope {
+		return nil, fmt.Errorf("bad scope value %q", cfg.Secrets.Scope)
+	}
+
+	c := syft.DefaultCatalogingConfig()
+
+	c.ToolVersion = version.FromBuild().Version
+	c.ToolConfiguration = &c
+	c.DefaultScope = scopeOption
+	c.ProcessTasksInSerial = false
+	c.DigestHashes = digests
+	c.SecretsSearch = *secretsConfig
+	c.SecretsScope = secretsScopeOption
+	c.ContentsSearch = cfg.FileContents.ToConfig()
+
+	opts := []syft.CatalogingOption{
+		syft.WithConfig(c),
+		syft.WithCatalogers(cfg.Catalogers...),
+	}
+
+	return opts, nil
 }
 
 // PowerUserCatalogerEnabledDefault switches all catalogers to be enabled when running power-user command
@@ -100,6 +147,15 @@ func (cfg Application) loadDefaultValues(v *viper.Viper) {
 }
 
 func (cfg *Application) parseConfigValues() error {
+	// parse fields on application directyy
+	var catalogers []string
+	for _, c := range cfg.Catalogers {
+		for _, f := range strings.Split(c, ",") {
+			catalogers = append(catalogers, strings.TrimSpace(f))
+		}
+	}
+	cfg.Catalogers = catalogers
+
 	// parse application config options
 	for _, optionFn := range []func() error{
 		cfg.parseUploadOptions,

internal/config/cataloger_options.go

@@ -1,29 +0,0 @@
-package config
-
-import (
-	"fmt"
-
-	"github.com/spf13/viper"
-
-	"github.com/anchore/syft/syft/source"
-)
-
-type catalogerOptions struct {
-	Enabled  bool         `yaml:"enabled" json:"enabled" mapstructure:"enabled"`
-	Scope    string       `yaml:"scope" json:"scope" mapstructure:"scope"`
-	ScopeOpt source.Scope `yaml:"-" json:"-"`
-}
-
-func (cfg catalogerOptions) loadDefaultValues(v *viper.Viper) {
-	v.SetDefault("package.cataloger.enabled", true)
-}
-
-func (cfg *catalogerOptions) parseConfigValues() error {
-	scopeOption := source.ParseScope(cfg.Scope)
-	if scopeOption == source.UnknownScope {
-		return fmt.Errorf("bad scope value %q", cfg.Scope)
-	}
-	cfg.ScopeOpt = scopeOption
-
-	return nil
-}

internal/config/file_classification.go

@@ -1,19 +0,0 @@
-package config
-
-import (
-	"github.com/anchore/syft/syft/source"
-	"github.com/spf13/viper"
-)
-
-type fileClassification struct {
-	Cataloger catalogerOptions `yaml:"cataloger" json:"cataloger" mapstructure:"cataloger"`
-}
-
-func (cfg fileClassification) loadDefaultValues(v *viper.Viper) {
-	v.SetDefault("file-classification.cataloger.enabled", catalogerEnabledDefault)
-	v.SetDefault("file-classification.cataloger.scope", source.SquashedScope)
-}
-
-func (cfg *fileClassification) parseConfigValues() error {
-	return cfg.Cataloger.parseConfigValues()
-}

internal/config/file_contents.go

@@ -1,24 +1,24 @@
 package config
 
 import (
-	"github.com/anchore/syft/internal/file"
-	"github.com/anchore/syft/syft/source"
+	"github.com/anchore/syft/syft/cataloger/files/filecontents"
+	"github.com/anchore/syft/syft/file"
 	"github.com/spf13/viper"
 )
 
 type fileContents struct {
-	Cataloger          catalogerOptions `yaml:"cataloger" json:"cataloger" mapstructure:"cataloger"`
-	SkipFilesAboveSize int64            `yaml:"skip-files-above-size" json:"skip-files-above-size" mapstructure:"skip-files-above-size"`
-	Globs              []string         `yaml:"globs" json:"globs" mapstructure:"globs"`
+	SkipFilesAboveSize int64    `yaml:"skip-files-above-size" json:"skip-files-above-size" mapstructure:"skip-files-above-size"`
+	Globs              []string `yaml:"globs" json:"globs" mapstructure:"globs"`
 }
 
 func (cfg fileContents) loadDefaultValues(v *viper.Viper) {
-	v.SetDefault("file-contents.cataloger.enabled", catalogerEnabledDefault)
-	v.SetDefault("file-contents.cataloger.scope", source.SquashedScope)
 	v.SetDefault("file-contents.skip-files-above-size", 1*file.MB)
 	v.SetDefault("file-contents.globs", []string{})
 }
 
-func (cfg *fileContents) parseConfigValues() error {
-	return cfg.Cataloger.parseConfigValues()
+func (cfg fileContents) ToConfig() filecontents.Config {
+	return filecontents.Config{
+		Globs:                     cfg.Globs,
+		SkipFilesAboveSizeInBytes: cfg.SkipFilesAboveSize,
+	}
 }

internal/config/file_metadata.go

@@ -1,21 +1,17 @@
 package config
 
 import (
-	"github.com/anchore/syft/syft/source"
 	"github.com/spf13/viper"
 )
 
-type FileMetadata struct {
-	Cataloger catalogerOptions `yaml:"cataloger" json:"cataloger" mapstructure:"cataloger"`
-	Digests   []string         `yaml:"digests" json:"digests" mapstructure:"digests"`
+type fileMetadata struct {
+	Digests []string `yaml:"digests" json:"digests" mapstructure:"digests"`
 }
 
-func (cfg FileMetadata) loadDefaultValues(v *viper.Viper) {
-	v.SetDefault("file-metadata.cataloger.enabled", catalogerEnabledDefault)
-	v.SetDefault("file-metadata.cataloger.scope", source.SquashedScope)
+func (cfg fileMetadata) loadDefaultValues(v *viper.Viper) {
 	v.SetDefault("file-metadata.digests", []string{"sha256"})
 }
 
-func (cfg *FileMetadata) parseConfigValues() error {
-	return cfg.Cataloger.parseConfigValues()
+func (cfg *fileMetadata) parseConfigValues() error {
+	return nil
 }

internal/config/pkg.go

@@ -1,33 +1,24 @@
 package config
 
 import (
-	"github.com/anchore/syft/syft/pkg/cataloger"
+	"github.com/anchore/syft/syft/cataloger/packages"
 	"github.com/spf13/viper"
 )
 
 type pkg struct {
-	Cataloger               catalogerOptions `yaml:"cataloger" json:"cataloger" mapstructure:"cataloger"`
-	SearchUnindexedArchives bool             `yaml:"search-unindexed-archives" json:"search-unindexed-archives" mapstructure:"search-unindexed-archives"`
-	SearchIndexedArchives   bool             `yaml:"search-indexed-archives" json:"search-indexed-archives" mapstructure:"search-indexed-archives"`
+	SearchUnindexedArchives bool `yaml:"search-unindexed-archives" json:"search-unindexed-archives" mapstructure:"search-unindexed-archives"`
+	SearchIndexedArchives   bool `yaml:"search-indexed-archives" json:"search-indexed-archives" mapstructure:"search-indexed-archives"`
 }
 
 func (cfg pkg) loadDefaultValues(v *viper.Viper) {
-	cfg.Cataloger.loadDefaultValues(v)
-	c := cataloger.DefaultSearchConfig()
+	c := packages.DefaultSearchConfig()
 	v.SetDefault("package.search-unindexed-archives", c.IncludeUnindexedArchives)
 	v.SetDefault("package.search-indexed-archives", c.IncludeIndexedArchives)
 }
 
-func (cfg *pkg) parseConfigValues() error {
-	return cfg.Cataloger.parseConfigValues()
-}
-
-func (cfg pkg) ToConfig() cataloger.Config {
-	return cataloger.Config{
-		Search: cataloger.SearchConfig{
-			IncludeIndexedArchives:   cfg.SearchIndexedArchives,
-			IncludeUnindexedArchives: cfg.SearchUnindexedArchives,
-			Scope:                    cfg.Cataloger.ScopeOpt,
-		},
+func (cfg pkg) ToConfig() packages.SearchConfig {
+	return packages.SearchConfig{
+		IncludeIndexedArchives:   cfg.SearchIndexedArchives,
+		IncludeUnindexedArchives: cfg.SearchUnindexedArchives,
 	}
 }

internal/config/secrets.go

@@ -1,28 +1,38 @@
 package config
 
 import (
-	"github.com/anchore/syft/internal/file"
+	"fmt"
+	"github.com/anchore/syft/syft/cataloger/files/secrets"
+
+	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/source"
 	"github.com/spf13/viper"
 )
 
-type secrets struct {
-	Cataloger           catalogerOptions  `yaml:"cataloger" json:"cataloger" mapstructure:"cataloger"`
+type secretsCfg struct {
 	AdditionalPatterns  map[string]string `yaml:"additional-patterns" json:"additional-patterns" mapstructure:"additional-patterns"`
 	ExcludePatternNames []string          `yaml:"exclude-pattern-names" json:"exclude-pattern-names" mapstructure:"exclude-pattern-names"`
 	RevealValues        bool              `yaml:"reveal-values" json:"reveal-values" mapstructure:"reveal-values"`
 	SkipFilesAboveSize  int64             `yaml:"skip-files-above-size" json:"skip-files-above-size" mapstructure:"skip-files-above-size"`
+	Scope               string            `yaml:"scope" json:"scope" mapstructure:"scope"`
 }
 
-func (cfg secrets) loadDefaultValues(v *viper.Viper) {
-	v.SetDefault("secrets.cataloger.enabled", catalogerEnabledDefault)
-	v.SetDefault("secrets.cataloger.scope", source.AllLayersScope)
+func (cfg secretsCfg) loadDefaultValues(v *viper.Viper) {
+	v.SetDefault("secrets.scope", source.AllLayersScope)
 	v.SetDefault("secrets.reveal-values", false)
 	v.SetDefault("secrets.skip-files-above-size", 1*file.MB)
 	v.SetDefault("secrets.additional-patterns", map[string]string{})
 	v.SetDefault("secrets.exclude-pattern-names", []string{})
 }
 
-func (cfg *secrets) parseConfigValues() error {
-	return cfg.Cataloger.parseConfigValues()
+func (cfg secretsCfg) ToConfig() (*secrets.Config, error) {
+	patterns, err := file.GenerateSearchPatterns(secrets.DefaultSecretsPatterns, cfg.AdditionalPatterns, cfg.ExcludePatternNames)
+	if err != nil {
+		return nil, fmt.Errorf("unable to process secrets config patterns: %w", err)
+	}
+	return &secrets.Config{
+		Patterns:     patterns,
+		RevealValues: cfg.RevealValues,
+		MaxFileSize:  cfg.SkipFilesAboveSize,
+	}, nil
 }

internal/constants.go

@@ -6,5 +6,5 @@ const (
 
 	// JSONSchemaVersion is the current schema version output by the JSON encoder
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "3.2.1"
+	JSONSchemaVersion = "3.0.1"
 )

internal/filename_glob_match.go

@@ -1,8 +1,8 @@
-package file
+package internal
 
-// GlobMatch evaluates the given glob pattern against the given "name" string, indicating if there is a match or not.
+// FileNameGlobMatch evaluates the given glob pattern against the given "name" string, indicating if there is a match or not.
 // Source: https://research.swtch.com/glob.go
-func GlobMatch(pattern, name string) bool {
+func FileNameGlobMatch(pattern, name string) bool {
 	px := 0
 	nx := 0
 	nextPx := 0

internal/filename_glob_match_test.go

@@ -1,4 +1,4 @@
-package file
+package internal
 
 import (
 	"strings"
@@ -32,7 +32,7 @@ func TestGlobMatch(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		if GlobMatch(test.pattern, test.data) != test.ok {
+		if FileNameGlobMatch(test.pattern, test.data) != test.ok {
 			t.Errorf("failed glob='%s' data='%s'", test.pattern, test.data)
 		}
 	}

internal/formats/common/cyclonedxhelpers/component.go

@@ -3,11 +3,12 @@ package cyclonedxhelpers
 import (
 	"reflect"
 
+	"github.com/anchore/syft/syft/file"
+
 	"github.com/CycloneDX/cyclonedx-go"
 
 	"github.com/anchore/syft/internal/formats/common"
 	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
 )
 
 func encodeComponent(p pkg.Package) cyclonedx.Component {
@@ -47,10 +48,8 @@ func hasMetadata(p pkg.Package) bool {
 
 func decodeComponent(c *cyclonedx.Component) *pkg.Package {
 	values := map[string]string{}
-	if c.Properties != nil {
-		for _, p := range *c.Properties {
-			values[p.Name] = p.Value
-		}
+	for _, p := range *c.Properties {
+		values[p.Name] = p.Value
 	}
 
 	p := &pkg.Package{
@@ -73,9 +72,9 @@ func decodeComponent(c *cyclonedx.Component) *pkg.Package {
 	return p
 }
 
-func decodeLocations(vals map[string]string) []source.Location {
-	v := common.Decode(reflect.TypeOf([]source.Location{}), vals, "syft:location", CycloneDXFields)
-	out, _ := v.([]source.Location)
+func decodeLocations(vals map[string]string) []file.Location {
+	v := common.Decode(reflect.TypeOf([]file.Location{}), vals, "syft:location", CycloneDXFields)
+	out, _ := v.([]file.Location)
 	return out
 }
 

internal/formats/common/cyclonedxhelpers/component_test.go

@@ -1,13 +1,13 @@
 package cyclonedxhelpers
 
 import (
+	"github.com/anchore/syft/syft/file"
 	"testing"
 
 	"github.com/CycloneDX/cyclonedx-go"
 	"github.com/stretchr/testify/assert"
 
 	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
 )
 
 func Test_encodeComponentProperties(t *testing.T) {
@@ -26,8 +26,8 @@ func Test_encodeComponentProperties(t *testing.T) {
 			name: "from apk",
 			input: pkg.Package{
 				FoundBy: "cataloger",
-				Locations: []source.Location{
-					{Coordinates: source.Coordinates{RealPath: "test"}},
+				Locations: []file.Location{
+					{Coordinates: file.Coordinates{RealPath: "test"}},
 				},
 				Metadata: pkg.ApkMetadata{
 					Package:          "libc-utils",

internal/formats/common/cyclonedxhelpers/cpe.go

@@ -2,6 +2,7 @@ package cyclonedxhelpers
 
 import (
 	"github.com/CycloneDX/cyclonedx-go"
+	"github.com/anchore/syft/syft/cpe"
 
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/pkg"
@@ -11,7 +12,7 @@ func encodeSingleCPE(p pkg.Package) string {
 	// Since the CPEs in a package are sorted by specificity
 	// we can extract the first CPE as the one to output in cyclonedx
 	if len(p.CPEs) > 0 {
-		return pkg.CPEString(p.CPEs[0])
+		return cpe.String(p.CPEs[0])
 	}
 	return ""
 }
@@ -24,15 +25,15 @@ func encodeCPEs(p pkg.Package) (out []cyclonedx.Property) {
 		}
 		out = append(out, cyclonedx.Property{
 			Name:  "syft:cpe23",
-			Value: pkg.CPEString(c),
+			Value: cpe.String(c),
 		})
 	}
 	return
 }
 
-func decodeCPEs(c *cyclonedx.Component) (out []pkg.CPE) {
+func decodeCPEs(c *cyclonedx.Component) (out []cpe.CPE) {
 	if c.CPE != "" {
-		cp, err := pkg.NewCPE(c.CPE)
+		cp, err := cpe.New(c.CPE)
 		if err != nil {
 			log.Warnf("invalid CPE: %s", c.CPE)
 		} else {
@@ -43,7 +44,7 @@ func decodeCPEs(c *cyclonedx.Component) (out []pkg.CPE) {
 	if c.Properties != nil {
 		for _, p := range *c.Properties {
 			if p.Name == "syft:cpe23" {
-				cp, err := pkg.NewCPE(p.Value)
+				cp, err := cpe.New(p.Value)
 				if err != nil {
 					log.Warnf("invalid CPE: %s", p.Value)
 				} else {

internal/formats/common/cyclonedxhelpers/cpe_test.go

@@ -1,6 +1,7 @@
 package cyclonedxhelpers
 
 import (
+	"github.com/anchore/syft/syft/cpe"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -9,8 +10,8 @@ import (
 )
 
 func Test_encodeCPE(t *testing.T) {
-	testCPE := pkg.MustCPE("cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*")
-	testCPE2 := pkg.MustCPE("cpe:2.3:a:name:name2:3.2:*:*:*:*:*:*:*")
+	testCPE := cpe.Must("cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*")
+	testCPE2 := cpe.Must("cpe:2.3:a:name:name2:3.2:*:*:*:*:*:*:*")
 	tests := []struct {
 		name     string
 		input    pkg.Package
@@ -20,14 +21,14 @@ func Test_encodeCPE(t *testing.T) {
 			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
 			name: "no metadata",
 			input: pkg.Package{
-				CPEs: []pkg.CPE{},
+				CPEs: []cpe.CPE{},
 			},
 			expected: "",
 		},
 		{
 			name: "single CPE",
 			input: pkg.Package{
-				CPEs: []pkg.CPE{
+				CPEs: []cpe.CPE{
 					testCPE,
 				},
 			},
@@ -36,7 +37,7 @@ func Test_encodeCPE(t *testing.T) {
 		{
 			name: "multiple CPEs",
 			input: pkg.Package{
-				CPEs: []pkg.CPE{
+				CPEs: []cpe.CPE{
 					testCPE2,
 					testCPE,
 				},

internal/formats/common/cyclonedxhelpers/decoder.go

@@ -5,8 +5,6 @@ import (
 	"io"
 
 	"github.com/CycloneDX/cyclonedx-go"
-
-	"github.com/anchore/syft/internal/formats/common"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/pkg"
@@ -46,12 +44,12 @@ func GetDecoder(format cyclonedx.BOMFileFormat) sbom.Decoder {
 
 func toSyftModel(bom *cyclonedx.BOM) (*sbom.SBOM, error) {
 	meta := source.Metadata{}
-	if bom.Metadata != nil && bom.Metadata.Component != nil {
+	if bom.Metadata != nil {
 		meta = decodeMetadata(bom.Metadata.Component)
 	}
 	s := &sbom.SBOM{
 		Artifacts: sbom.Artifacts{
-			PackageCatalog:    pkg.NewCatalog(),
+			Packages:          pkg.NewCollection(),
 			LinuxDistribution: linuxReleaseFromComponents(*bom.Components),
 		},
 		Source: meta,
@@ -88,7 +86,7 @@ func collectPackages(component *cyclonedx.Component, s *sbom.SBOM, idMap map[str
 		idMap[component.BOMRef] = p
 		// TODO there must be a better way than needing to call this manually:
 		p.SetID()
-		s.Artifacts.PackageCatalog.Add(*p)
+		s.Artifacts.Packages.Add(*p)
 	}
 
 	if component.Components != nil {
@@ -159,14 +157,6 @@ func linuxReleaseFromOSComponent(component *cyclonedx.Component) *linux.Release
 		}
 	}
 
-	if component.Properties != nil {
-		values := map[string]string{}
-		for _, p := range *component.Properties {
-			values[p.Name] = p.Value
-		}
-		common.DecodeInto(&rel, values, "syft:distro", CycloneDXFields)
-	}
-
 	return rel
 }
 
@@ -209,7 +199,7 @@ func decodeMetadata(component *cyclonedx.Component) source.Metadata {
 	switch component.Type {
 	case cyclonedx.ComponentTypeContainer:
 		return source.Metadata{
-			Scheme: source.ImageScheme,
+			Scheme: source.ImageType,
 			ImageMetadata: source.ImageMetadata{
 				UserInput:      component.Name,
 				ID:             component.BOMRef,
@@ -218,7 +208,7 @@ func decodeMetadata(component *cyclonedx.Component) source.Metadata {
 		}
 	case cyclonedx.ComponentTypeFile:
 		return source.Metadata{
-			Scheme: source.FileScheme, // or source.DirectoryScheme
+			Scheme: source.FileType, // or source.DirectoryType
 			Path:   component.Name,
 			ImageMetadata: source.ImageMetadata{
 				UserInput:      component.Name,

internal/formats/common/cyclonedxhelpers/decoder_test.go

@@ -212,7 +212,7 @@ func Test_decode(t *testing.T) {
 					assert.Equal(t, e.ver, sbom.Artifacts.LinuxDistribution.VersionID)
 				}
 				if e.pkg != "" {
-					for p := range sbom.Artifacts.PackageCatalog.Enumerate() {
+					for p := range sbom.Artifacts.Packages.Enumerate() {
 						if e.pkg != p.Name {
 							continue
 						}
@@ -240,7 +240,7 @@ func Test_decode(t *testing.T) {
 						if e.relation != "" {
 							foundRelation := false
 							for _, r := range sbom.Relationships {
-								p := sbom.Artifacts.PackageCatalog.Package(r.To.ID())
+								p := sbom.Artifacts.Packages.Package(r.To.ID())
 								if e.relation == p.Name {
 									foundRelation = true
 									break
@@ -258,28 +258,3 @@ func Test_decode(t *testing.T) {
 		})
 	}
 }
-
-func Test_missingDataDecode(t *testing.T) {
-	bom := &cyclonedx.BOM{
-		Metadata:   nil,
-		Components: &[]cyclonedx.Component{},
-	}
-
-	_, err := toSyftModel(bom)
-	assert.NoError(t, err)
-
-	bom.Metadata = &cyclonedx.Metadata{}
-
-	_, err = toSyftModel(bom)
-	assert.NoError(t, err)
-
-	pkg := decodeComponent(&cyclonedx.Component{
-		Licenses: &cyclonedx.Licenses{
-			{
-				License: nil,
-			},
-		},
-	})
-
-	assert.Len(t, pkg.Licenses, 0)
-}

internal/formats/common/cyclonedxhelpers/format.go

@@ -25,7 +25,7 @@ func ToFormatModel(s sbom.SBOM) *cyclonedx.BOM {
 	cdxBOM.SerialNumber = uuid.New().URN()
 	cdxBOM.Metadata = toBomDescriptor(internal.ApplicationName, versionInfo.Version, s.Source)
 
-	packages := s.Artifacts.PackageCatalog.Sorted()
+	packages := s.Artifacts.Packages.Sorted()
 	components := make([]cyclonedx.Component, len(packages))
 	for i, p := range packages {
 		components[i] = encodeComponent(p)
@@ -155,7 +155,7 @@ func toDependencies(relationships []artifact.Relationship) []cyclonedx.Dependenc
 
 func toBomDescriptorComponent(srcMetadata source.Metadata) *cyclonedx.Component {
 	switch srcMetadata.Scheme {
-	case source.ImageScheme:
+	case source.ImageType:
 		bomRef, err := artifact.IDByHash(srcMetadata.ImageMetadata.ID)
 		if err != nil {
 			log.Warnf("unable to get fingerprint of image metadata=%s: %+v", srcMetadata.ImageMetadata.ID, err)
@@ -166,7 +166,7 @@ func toBomDescriptorComponent(srcMetadata source.Metadata) *cyclonedx.Component
 			Name:    srcMetadata.ImageMetadata.UserInput,
 			Version: srcMetadata.ImageMetadata.ManifestDigest,
 		}
-	case source.DirectoryScheme, source.FileScheme:
+	case source.DirectoryType, source.FileType:
 		bomRef, err := artifact.IDByHash(srcMetadata.Path)
 		if err != nil {
 			log.Warnf("unable to get fingerprint of source metadata path=%s: %+v", srcMetadata.Path, err)

internal/formats/common/cyclonedxhelpers/licenses.go

@@ -26,9 +26,7 @@ func encodeLicenses(p pkg.Package) *cyclonedx.Licenses {
 func decodeLicenses(c *cyclonedx.Component) (out []string) {
 	if c.Licenses != nil {
 		for _, l := range *c.Licenses {
-			if l.License != nil {
-				out = append(out, l.License.ID)
-			}
+			out = append(out, l.License.ID)
 		}
 	}
 	return

internal/formats/common/spdxhelpers/document_name.go

@@ -10,9 +10,9 @@ import (
 
 func DocumentName(srcMetadata source.Metadata) (string, error) {
 	switch srcMetadata.Scheme {
-	case source.ImageScheme:
+	case source.ImageType:
 		return cleanName(srcMetadata.ImageMetadata.UserInput), nil
-	case source.DirectoryScheme, source.FileScheme:
+	case source.DirectoryType, source.FileType:
 		return cleanName(srcMetadata.Path), nil
 	}
 

internal/formats/common/spdxhelpers/document_name_test.go

@@ -14,7 +14,7 @@ import (
 
 func Test_DocumentName(t *testing.T) {
 	allSchemes := strset.New()
-	for _, s := range source.AllSchemes {
+	for _, s := range source.AllTypes {
 		allSchemes.Add(string(s))
 	}
 	testedSchemes := strset.New()
@@ -29,7 +29,7 @@ func Test_DocumentName(t *testing.T) {
 			name:      "image",
 			inputName: "my-name",
 			srcMetadata: source.Metadata{
-				Scheme: source.ImageScheme,
+				Scheme: source.ImageType,
 				ImageMetadata: source.ImageMetadata{
 					UserInput:      "image-repo/name:tag",
 					ID:             "id",
@@ -42,7 +42,7 @@ func Test_DocumentName(t *testing.T) {
 			name:      "directory",
 			inputName: "my-name",
 			srcMetadata: source.Metadata{
-				Scheme: source.DirectoryScheme,
+				Scheme: source.DirectoryType,
 				Path:   "some/path/to/place",
 			},
 			expected: "some/path/to/place",
@@ -51,7 +51,7 @@ func Test_DocumentName(t *testing.T) {
 			name:      "file",
 			inputName: "my-name",
 			srcMetadata: source.Metadata{
-				Scheme: source.FileScheme,
+				Scheme: source.FileType,
 				Path:   "some/path/to/place",
 			},
 			expected: "some/path/to/place",

internal/formats/common/spdxhelpers/document_namespace.go

@@ -21,11 +21,11 @@ func DocumentNameAndNamespace(srcMetadata source.Metadata) (string, string, erro
 func DocumentNamespace(name string, srcMetadata source.Metadata) string {
 	input := "unknown-source-type"
 	switch srcMetadata.Scheme {
-	case source.ImageScheme:
+	case source.ImageType:
 		input = "image"
-	case source.DirectoryScheme:
+	case source.DirectoryType:
 		input = "dir"
-	case source.FileScheme:
+	case source.FileType:
 		input = "file"
 	}
 

internal/formats/common/spdxhelpers/document_namespace_test.go

@@ -12,7 +12,7 @@ import (
 
 func Test_documentNamespace(t *testing.T) {
 	allSchemes := strset.New()
-	for _, s := range source.AllSchemes {
+	for _, s := range source.AllTypes {
 		allSchemes.Add(string(s))
 	}
 	testedSchemes := strset.New()
@@ -27,7 +27,7 @@ func Test_documentNamespace(t *testing.T) {
 			name:      "image",
 			inputName: "my-name",
 			srcMetadata: source.Metadata{
-				Scheme: source.ImageScheme,
+				Scheme: source.ImageType,
 				ImageMetadata: source.ImageMetadata{
 					UserInput:      "image-repo/name:tag",
 					ID:             "id",
@@ -40,7 +40,7 @@ func Test_documentNamespace(t *testing.T) {
 			name:      "directory",
 			inputName: "my-name",
 			srcMetadata: source.Metadata{
-				Scheme: source.DirectoryScheme,
+				Scheme: source.DirectoryType,
 				Path:   "some/path/to/place",
 			},
 			expected: "https://anchore.com/syft/dir/my-name-",
@@ -49,7 +49,7 @@ func Test_documentNamespace(t *testing.T) {
 			name:      "file",
 			inputName: "my-name",
 			srcMetadata: source.Metadata{
-				Scheme: source.FileScheme,
+				Scheme: source.FileType,
 				Path:   "some/path/to/place",
 			},
 			expected: "https://anchore.com/syft/file/my-name-",

internal/formats/common/spdxhelpers/external_refs.go

@@ -1,6 +1,7 @@
 package spdxhelpers
 
 import (
+	"github.com/anchore/syft/syft/cpe"
 	"github.com/anchore/syft/syft/pkg"
 )
 
@@ -10,7 +11,7 @@ func ExternalRefs(p pkg.Package) (externalRefs []ExternalRef) {
 	for _, c := range p.CPEs {
 		externalRefs = append(externalRefs, ExternalRef{
 			ReferenceCategory: SecurityReferenceCategory,
-			ReferenceLocator:  pkg.CPEString(c),
+			ReferenceLocator:  cpe.String(c),
 			ReferenceType:     Cpe23ExternalRefType,
 		})
 	}

internal/formats/common/spdxhelpers/external_refs_test.go

@@ -1,6 +1,7 @@
 package spdxhelpers
 
 import (
+	"github.com/anchore/syft/syft/cpe"
 	"testing"
 
 	"github.com/anchore/syft/syft/pkg"
@@ -8,7 +9,7 @@ import (
 )
 
 func Test_ExternalRefs(t *testing.T) {
-	testCPE := pkg.MustCPE("cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*")
+	testCPE := cpe.Must("cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*")
 	tests := []struct {
 		name     string
 		input    pkg.Package
@@ -17,7 +18,7 @@ func Test_ExternalRefs(t *testing.T) {
 		{
 			name: "cpe + purl",
 			input: pkg.Package{
-				CPEs: []pkg.CPE{
+				CPEs: []cpe.CPE{
 					testCPE,
 				},
 				PURL: "a-purl",
@@ -25,7 +26,7 @@ func Test_ExternalRefs(t *testing.T) {
 			expected: []ExternalRef{
 				{
 					ReferenceCategory: SecurityReferenceCategory,
-					ReferenceLocator:  pkg.CPEString(testCPE),
+					ReferenceLocator:  cpe.String(testCPE),
 					ReferenceType:     Cpe23ExternalRefType,
 				},
 				{

internal/formats/common/spdxhelpers/source_info_test.go

@@ -1,10 +1,10 @@
 package spdxhelpers
 
 import (
+	"github.com/anchore/syft/syft/file"
 	"testing"
 
 	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -18,9 +18,9 @@ func Test_SourceInfo(t *testing.T) {
 			name: "locations are captured",
 			input: pkg.Package{
 				// note: no type given
-				Locations: []source.Location{
-					source.NewVirtualLocation("/a-place", "/b-place"),
-					source.NewVirtualLocation("/c-place", "/d-place"),
+				Locations: []file.Location{
+					file.NewVirtualLocation("/a-place", "/b-place"),
+					file.NewVirtualLocation("/c-place", "/d-place"),
 				},
 			},
 			expected: []string{

internal/formats/common/spdxhelpers/to_syft_model.go

@@ -1,6 +1,7 @@
 package spdxhelpers
 
 import (
+	"github.com/anchore/syft/syft/cpe"
 	"strconv"
 	"strings"
 
@@ -13,7 +14,6 @@ import (
 	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
-	"github.com/anchore/syft/syft/source"
 )
 
 func ToSyftModel(doc *spdx.Document2_2) (*sbom.SBOM, error) {
@@ -21,9 +21,9 @@ func ToSyftModel(doc *spdx.Document2_2) (*sbom.SBOM, error) {
 
 	s := &sbom.SBOM{
 		Artifacts: sbom.Artifacts{
-			PackageCatalog:    pkg.NewCatalog(),
-			FileMetadata:      map[source.Coordinates]source.FileMetadata{},
-			FileDigests:       map[source.Coordinates][]file.Digest{},
+			Packages:          pkg.NewCollection(),
+			FileMetadata:      map[file.Coordinates]file.Metadata{},
+			FileDigests:       map[file.Coordinates][]file.Digest{},
 			LinuxDistribution: findLinuxReleaseByPURL(doc),
 		},
 	}
@@ -74,7 +74,7 @@ func collectSyftPackages(s *sbom.SBOM, spdxIDMap map[string]interface{}, doc *sp
 	for _, p := range doc.Packages {
 		syftPkg := toSyftPackage(p)
 		spdxIDMap[string(p.PackageSPDXIdentifier)] = syftPkg
-		s.Artifacts.PackageCatalog.Add(*syftPkg)
+		s.Artifacts.Packages.Add(*syftPkg)
 	}
 }
 
@@ -98,7 +98,7 @@ func toFileDigests(f *spdx.File2_2) (digests []file.Digest) {
 	return digests
 }
 
-func toFileMetadata(f *spdx.File2_2) (meta source.FileMetadata) {
+func toFileMetadata(f *spdx.File2_2) (meta file.Metadata) {
 	// FIXME Syft is currently lossy due to the SPDX 2.2.1 spec not supporting arbitrary mimetypes
 	for _, typ := range f.FileType {
 		switch FileType(typ) {
@@ -132,7 +132,7 @@ func toSyftRelationships(spdxIDMap map[string]interface{}, doc *spdx.Document2_2
 		b := spdxIDMap[string(r.RefB.ElementRefID)]
 		from, fromOk := a.(*pkg.Package)
 		toPackage, toPackageOk := b.(*pkg.Package)
-		toLocation, toLocationOk := b.(*source.Location)
+		toLocation, toLocationOk := b.(*file.Location)
 		if !fromOk || !(toPackageOk || toLocationOk) {
 			log.Debugf("unable to find valid relationship mapping from SPDX 2.2 JSON, ignoring: (from: %+v) (to: %+v)", a, b)
 			continue
@@ -174,7 +174,7 @@ func toSyftRelationships(spdxIDMap map[string]interface{}, doc *spdx.Document2_2
 	return out
 }
 
-func toSyftCoordinates(f *spdx.File2_2) source.Coordinates {
+func toSyftCoordinates(f *spdx.File2_2) file.Coordinates {
 	const layerIDPrefix = "layerID: "
 	var fileSystemID string
 	if strings.Index(f.FileComment, layerIDPrefix) == 0 {
@@ -183,16 +183,16 @@ func toSyftCoordinates(f *spdx.File2_2) source.Coordinates {
 	if strings.Index(string(f.FileSPDXIdentifier), layerIDPrefix) == 0 {
 		fileSystemID = strings.TrimPrefix(string(f.FileSPDXIdentifier), layerIDPrefix)
 	}
-	return source.Coordinates{
+	return file.Coordinates{
 		RealPath:     f.FileName,
 		FileSystemID: fileSystemID,
 	}
 }
 
-func toSyftLocation(f *spdx.File2_2) *source.Location {
-	return &source.Location{
+func toSyftLocation(f *spdx.File2_2) *file.Location {
+	return &file.Location{
 		Coordinates: toSyftCoordinates(f),
-		VirtualPath: f.FileName,
+		AccessPath:  f.FileName,
 	}
 }
 
@@ -317,10 +317,10 @@ func findPURLValue(p *spdx.Package2_2) string {
 	return ""
 }
 
-func extractCPEs(p *spdx.Package2_2) (cpes []pkg.CPE) {
+func extractCPEs(p *spdx.Package2_2) (cpes []cpe.CPE) {
 	for _, r := range p.PackageExternalReferences {
 		if r.RefType == string(Cpe23ExternalRefType) {
-			cpe, err := pkg.NewCPE(r.Locator)
+			cpe, err := cpe.New(r.Locator)
 			if err != nil {
 				log.Warnf("unable to extract SPDX CPE=%q: %+v", r.Locator, err)
 				continue

internal/formats/common/spdxhelpers/to_syft_model_test.go

@@ -94,7 +94,7 @@ func TestToSyftModel(t *testing.T) {
 
 	assert.NotNil(t, sbom)
 
-	pkgs := sbom.Artifacts.PackageCatalog.Sorted()
+	pkgs := sbom.Artifacts.Packages.Sorted()
 
 	assert.Len(t, pkgs, 2)
 

internal/formats/common/testutils/utils.go

@@ -2,9 +2,12 @@ package testutils
 
 import (
 	"bytes"
+	"github.com/anchore/syft/syft/cpe"
 	"strings"
 	"testing"
 
+	"github.com/anchore/syft/syft/file"
+
 	"github.com/anchore/go-testutils"
 	"github.com/anchore/stereoscope/pkg/filetree"
 	"github.com/anchore/stereoscope/pkg/image"
@@ -97,7 +100,7 @@ func AssertEncoderAgainstGoldenSnapshot(t *testing.T, format sbom.Format, sbom s
 
 func ImageInput(t testing.TB, testImage string, options ...ImageOption) sbom.SBOM {
 	t.Helper()
-	catalog := pkg.NewCatalog()
+	catalog := pkg.NewCollection()
 	var cfg imageCfg
 	var img *image.Image
 	for _, opt := range options {
@@ -121,7 +124,7 @@ func ImageInput(t testing.TB, testImage string, options ...ImageOption) sbom.SBO
 
 	return sbom.SBOM{
 		Artifacts: sbom.Artifacts{
-			PackageCatalog: catalog,
+			Packages: catalog,
 			LinuxDistribution: &linux.Release{
 				PrettyName: "debian",
 				Name:       "debian",
@@ -149,7 +152,7 @@ func carriageRedactor(s []byte) []byte {
 	return []byte(msg)
 }
 
-func populateImageCatalog(catalog *pkg.Catalog, img *image.Image) {
+func populateImageCatalog(catalog pkg.Collection, img *image.Image) {
 	_, ref1, _ := img.SquashedTree().File("/somefile-1.txt", filetree.FollowBasenameLinks)
 	_, ref2, _ := img.SquashedTree().File("/somefile-2.txt", filetree.FollowBasenameLinks)
 
@@ -157,8 +160,8 @@ func populateImageCatalog(catalog *pkg.Catalog, img *image.Image) {
 	catalog.Add(pkg.Package{
 		Name:    "package-1",
 		Version: "1.0.1",
-		Locations: []source.Location{
-			source.NewLocationFromImage(string(ref1.RealPath), *ref1, img),
+		Locations: []file.Location{
+			file.NewLocationFromImage(string(ref1.RealPath), *ref1, img),
 		},
 		Type:         pkg.PythonPkg,
 		FoundBy:      "the-cataloger-1",
@@ -170,15 +173,15 @@ func populateImageCatalog(catalog *pkg.Catalog, img *image.Image) {
 			Version: "1.0.1",
 		},
 		PURL: "a-purl-1",
-		CPEs: []pkg.CPE{
-			pkg.MustCPE("cpe:2.3:*:some:package:1:*:*:*:*:*:*:*"),
+		CPEs: []cpe.CPE{
+			cpe.Must("cpe:2.3:*:some:package:1:*:*:*:*:*:*:*"),
 		},
 	})
 	catalog.Add(pkg.Package{
 		Name:    "package-2",
 		Version: "2.0.1",
-		Locations: []source.Location{
-			source.NewLocationFromImage(string(ref2.RealPath), *ref2, img),
+		Locations: []file.Location{
+			file.NewLocationFromImage(string(ref2.RealPath), *ref2, img),
 		},
 		Type:         pkg.DebPkg,
 		FoundBy:      "the-cataloger-2",
@@ -188,8 +191,8 @@ func populateImageCatalog(catalog *pkg.Catalog, img *image.Image) {
 			Version: "2.0.1",
 		},
 		PURL: "a-purl-2",
-		CPEs: []pkg.CPE{
-			pkg.MustCPE("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"),
+		CPEs: []cpe.CPE{
+			cpe.Must("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"),
 		},
 	})
 }
@@ -202,7 +205,7 @@ func DirectoryInput(t testing.TB) sbom.SBOM {
 
 	return sbom.SBOM{
 		Artifacts: sbom.Artifacts{
-			PackageCatalog: catalog,
+			Packages: catalog,
 			LinuxDistribution: &linux.Release{
 				PrettyName: "debian",
 				Name:       "debian",
@@ -225,8 +228,8 @@ func DirectoryInput(t testing.TB) sbom.SBOM {
 	}
 }
 
-func newDirectoryCatalog() *pkg.Catalog {
-	catalog := pkg.NewCatalog()
+func newDirectoryCatalog() pkg.Collection {
+	catalog := pkg.NewCollection()
 
 	// populate catalog with test data
 	catalog.Add(pkg.Package{
@@ -234,8 +237,8 @@ func newDirectoryCatalog() *pkg.Catalog {
 		Version: "1.0.1",
 		Type:    pkg.PythonPkg,
 		FoundBy: "the-cataloger-1",
-		Locations: []source.Location{
-			source.NewLocation("/some/path/pkg1"),
+		Locations: []file.Location{
+			file.NewLocation("/some/path/pkg1"),
 		},
 		Language:     pkg.Python,
 		MetadataType: pkg.PythonPackageMetadataType,
@@ -250,8 +253,8 @@ func newDirectoryCatalog() *pkg.Catalog {
 			},
 		},
 		PURL: "a-purl-2",
-		CPEs: []pkg.CPE{
-			pkg.MustCPE("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"),
+		CPEs: []cpe.CPE{
+			cpe.Must("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"),
 		},
 	})
 	catalog.Add(pkg.Package{
@@ -259,8 +262,8 @@ func newDirectoryCatalog() *pkg.Catalog {
 		Version: "2.0.1",
 		Type:    pkg.DebPkg,
 		FoundBy: "the-cataloger-2",
-		Locations: []source.Location{
-			source.NewLocation("/some/path/pkg1"),
+		Locations: []file.Location{
+			file.NewLocation("/some/path/pkg1"),
 		},
 		MetadataType: pkg.DpkgMetadataType,
 		Metadata: pkg.DpkgMetadata{
@@ -268,8 +271,8 @@ func newDirectoryCatalog() *pkg.Catalog {
 			Version: "2.0.1",
 		},
 		PURL: "a-purl-2",
-		CPEs: []pkg.CPE{
-			pkg.MustCPE("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"),
+		CPEs: []cpe.CPE{
+			cpe.Must("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"),
 		},
 	})
 

internal/formats/cyclonedxjson/decoder_test.go

@@ -57,7 +57,7 @@ func Test_decodeJSON(t *testing.T) {
 				split = strings.SplitN(pkg, ":", 2)
 				name = split[0]
 				version = split[1]
-				for p := range bom.Artifacts.PackageCatalog.Enumerate() {
+				for p := range bom.Artifacts.Packages.Enumerate() {
 					if p.Name == name {
 						assert.Equal(t, version, p.Version)
 						continue pkgs

internal/formats/cyclonedxxml/decoder_test.go

@@ -57,7 +57,7 @@ func Test_decodeXML(t *testing.T) {
 				split = strings.SplitN(pkg, ":", 2)
 				name = split[0]
 				version = split[1]
-				for p := range bom.Artifacts.PackageCatalog.Enumerate() {
+				for p := range bom.Artifacts.Packages.Enumerate() {
 					if p.Name == name {
 						assert.Equal(t, version, p.Version)
 						continue pkgs

internal/formats/github/encoder.go

@@ -1,183 +0,0 @@
-package github
-
-import (
-	"fmt"
-	"strings"
-	"time"
-
-	"github.com/mholt/archiver/v3"
-
-	"github.com/anchore/packageurl-go"
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/version"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/anchore/syft/syft/source"
-)
-
-// toGithubModel converts the provided SBOM to a GitHub dependency model
-func toGithubModel(s *sbom.SBOM) DependencySnapshot {
-	scanTime := time.Now().Format(time.RFC3339) // TODO is there a record of this somewhere?
-	v := version.FromBuild().Version
-	if v == "[not provided]" {
-		v = "0.0.0-dev"
-	}
-	return DependencySnapshot{
-		Version: 0,
-		// TODO allow property input to specify the Job, Sha, and Ref
-		Detector: DetectorMetadata{
-			Name:    internal.ApplicationName,
-			URL:     "https://github.com/anchore/syft",
-			Version: v,
-		},
-		Metadata:  toSnapshotMetadata(s),
-		Manifests: toGithubManifests(s),
-		Scanned:   scanTime,
-	}
-}
-
-// toSnapshotMetadata captures the linux distribution information and other metadata
-func toSnapshotMetadata(s *sbom.SBOM) Metadata {
-	out := Metadata{}
-
-	if s.Artifacts.LinuxDistribution != nil {
-		d := s.Artifacts.LinuxDistribution
-		qualifiers := packageurl.Qualifiers{}
-		if len(d.IDLike) > 0 {
-			qualifiers = append(qualifiers, packageurl.Qualifier{
-				Key:   "like",
-				Value: strings.Join(d.IDLike, ","),
-			})
-		}
-		purl := packageurl.NewPackageURL("generic", "", d.ID, d.VersionID, qualifiers, "")
-		out["syft:distro"] = purl.ToString()
-	}
-
-	return out
-}
-
-func filesystem(p pkg.Package) string {
-	if len(p.Locations) > 0 {
-		return p.Locations[0].FileSystemID
-	}
-	return ""
-}
-
-// isArchive returns true if the path appears to be an archive
-func isArchive(path string) bool {
-	_, err := archiver.ByExtension(path)
-	return err == nil
-}
-
-// toPath Generates a string representation of the package location, optionally including the layer hash
-func toPath(s source.Metadata, p pkg.Package) string {
-	inputPath := strings.TrimPrefix(s.Path, "./")
-	if inputPath == "." {
-		inputPath = ""
-	}
-	if len(p.Locations) > 0 {
-		location := p.Locations[0]
-		packagePath := location.RealPath
-		if location.VirtualPath != "" {
-			packagePath = location.VirtualPath
-		}
-		packagePath = strings.TrimPrefix(packagePath, "/")
-		switch s.Scheme {
-		case source.ImageScheme:
-			image := strings.ReplaceAll(s.ImageMetadata.UserInput, ":/", "//")
-			return fmt.Sprintf("%s:/%s", image, packagePath)
-		case source.FileScheme:
-			if isArchive(inputPath) {
-				return fmt.Sprintf("%s:/%s", inputPath, packagePath)
-			}
-			return inputPath
-		case source.DirectoryScheme:
-			if inputPath != "" {
-				return fmt.Sprintf("%s/%s", inputPath, packagePath)
-			}
-			return packagePath
-		}
-	}
-	return fmt.Sprintf("%s%s", inputPath, s.ImageMetadata.UserInput)
-}
-
-// toGithubManifests manifests, each of which represents a specific location that has dependencies
-func toGithubManifests(s *sbom.SBOM) Manifests {
-	manifests := map[string]*Manifest{}
-
-	for _, p := range s.Artifacts.PackageCatalog.Sorted() {
-		path := toPath(s.Source, p)
-		manifest, ok := manifests[path]
-		if !ok {
-			manifest = &Manifest{
-				Name: path,
-				File: FileInfo{
-					SourceLocation: path,
-				},
-				Resolved: DependencyGraph{},
-			}
-			fs := filesystem(p)
-			if fs != "" {
-				manifest.Metadata = Metadata{
-					"syft:filesystem": fs,
-				}
-			}
-			manifests[path] = manifest
-		}
-
-		name := dependencyName(p)
-		manifest.Resolved[name] = DependencyNode{
-			Purl:         p.PURL,
-			Metadata:     toDependencyMetadata(p),
-			Relationship: toDependencyRelationshipType(p),
-			Scope:        toDependencyScope(p),
-			Dependencies: toDependencies(s, p),
-		}
-	}
-
-	out := Manifests{}
-	for k, v := range manifests {
-		out[k] = *v
-	}
-	return out
-}
-
-// dependencyName to make things a little nicer to read; this might end up being lossy
-func dependencyName(p pkg.Package) string {
-	purl, err := packageurl.FromString(p.PURL)
-	if err != nil {
-		log.Warnf("Invalid PURL for package: '%s' PURL: '%s' (%w)", p.Name, p.PURL, err)
-		return ""
-	}
-	// don't use qualifiers for this
-	purl.Qualifiers = nil
-	return purl.ToString()
-}
-
-func toDependencyScope(_ pkg.Package) DependencyScope {
-	return DependencyScopeRuntime
-}
-
-func toDependencyRelationshipType(_ pkg.Package) DependencyRelationship {
-	return DependencyRelationshipDirect
-}
-
-func toDependencyMetadata(_ pkg.Package) Metadata {
-	// We have limited properties: up to 8 with reasonably small values
-	// For now, we are encoding the location as part of the key, we are encoding PURLs with most
-	// of the other information Grype might need; and the distro information at the top level
-	// so we don't need anything here yet
-	return Metadata{}
-}
-
-func toDependencies(s *sbom.SBOM, p pkg.Package) (out []string) {
-	for _, r := range s.Relationships {
-		if r.From.ID() == p.ID() {
-			if p, ok := r.To.(pkg.Package); ok {
-				out = append(out, dependencyName(p))
-			}
-		}
-	}
-	return
-}

internal/formats/github/encoder_test.go

@@ -1,161 +0,0 @@
-package github
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-
-	"github.com/anchore/packageurl-go"
-	"github.com/anchore/syft/syft/linux"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/anchore/syft/syft/source"
-)
-
-func Test_toGithubModel(t *testing.T) {
-	s := sbom.SBOM{
-		Source: source.Metadata{
-			Scheme: source.ImageScheme,
-			ImageMetadata: source.ImageMetadata{
-				UserInput:    "ubuntu:18.04",
-				Architecture: "amd64",
-			},
-		},
-		Artifacts: sbom.Artifacts{
-			LinuxDistribution: &linux.Release{
-				ID:        "ubuntu",
-				VersionID: "18.04",
-				IDLike:    []string{"debian"},
-			},
-			PackageCatalog: pkg.NewCatalog(),
-		},
-	}
-	for _, p := range []pkg.Package{
-		{
-			Name:    "pkg-1",
-			Version: "1.0.1",
-			Locations: []source.Location{{
-				Coordinates: source.Coordinates{
-					RealPath:     "/usr/lib",
-					FileSystemID: "fsid-1",
-				},
-			}},
-		},
-		{
-			Name:    "pkg-2",
-			Version: "2.0.2",
-			Locations: []source.Location{{
-				Coordinates: source.Coordinates{
-					RealPath:     "/usr/lib",
-					FileSystemID: "fsid-1",
-				},
-			}},
-		},
-		{
-			Name:    "pkg-3",
-			Version: "3.0.3",
-			Locations: []source.Location{{
-				Coordinates: source.Coordinates{
-					RealPath:     "/etc",
-					FileSystemID: "fsid-1",
-				},
-			}},
-		},
-	} {
-		p.PURL = packageurl.NewPackageURL(
-			"generic",
-			"",
-			p.Name,
-			p.Version,
-			nil,
-			"",
-		).ToString()
-		s.Artifacts.PackageCatalog.Add(p)
-	}
-
-	actual := toGithubModel(&s)
-
-	expected := DependencySnapshot{
-		Version: 0,
-		Detector: DetectorMetadata{
-			Name:    "syft",
-			Version: "0.0.0-dev",
-			URL:     "https://github.com/anchore/syft",
-		},
-		Metadata: Metadata{
-			"syft:distro": "pkg:generic/ubuntu@18.04?like=debian",
-		},
-		Scanned: actual.Scanned,
-		Manifests: Manifests{
-			"ubuntu:18.04:/usr/lib": Manifest{
-				Name: "ubuntu:18.04:/usr/lib",
-				File: FileInfo{
-					SourceLocation: "ubuntu:18.04:/usr/lib",
-				},
-				Metadata: Metadata{
-					"syft:filesystem": "fsid-1",
-				},
-				Resolved: DependencyGraph{
-					"pkg:generic/pkg-1@1.0.1": DependencyNode{
-						Purl:         "pkg:generic/pkg-1@1.0.1",
-						Scope:        DependencyScopeRuntime,
-						Relationship: DependencyRelationshipDirect,
-					},
-					"pkg:generic/pkg-2@2.0.2": DependencyNode{
-						Purl:         "pkg:generic/pkg-2@2.0.2",
-						Scope:        DependencyScopeRuntime,
-						Relationship: DependencyRelationshipDirect,
-					},
-				},
-			},
-			"ubuntu:18.04:/etc": Manifest{
-				Name: "ubuntu:18.04:/etc",
-				File: FileInfo{
-					SourceLocation: "ubuntu:18.04:/etc",
-				},
-				Metadata: Metadata{
-					"syft:filesystem": "fsid-1",
-				},
-				Resolved: DependencyGraph{
-					"pkg:generic/pkg-3@3.0.3": DependencyNode{
-						Purl:         "pkg:generic/pkg-3@3.0.3",
-						Scope:        DependencyScopeRuntime,
-						Relationship: DependencyRelationshipDirect,
-					},
-				},
-			},
-		},
-	}
-
-	// just using JSONEq because it gives a comprehensible diff
-	s1, _ := json.Marshal(expected)
-	s2, _ := json.Marshal(actual)
-	assert.JSONEq(t, string(s1), string(s2))
-
-	// Just test the other schemes:
-	s.Source.Path = "."
-	s.Source.Scheme = source.DirectoryScheme
-	actual = toGithubModel(&s)
-	assert.Equal(t, "etc", actual.Manifests["etc"].Name)
-
-	s.Source.Path = "./artifacts"
-	s.Source.Scheme = source.DirectoryScheme
-	actual = toGithubModel(&s)
-	assert.Equal(t, "artifacts/etc", actual.Manifests["artifacts/etc"].Name)
-
-	s.Source.Path = "/artifacts"
-	s.Source.Scheme = source.DirectoryScheme
-	actual = toGithubModel(&s)
-	assert.Equal(t, "/artifacts/etc", actual.Manifests["/artifacts/etc"].Name)
-
-	s.Source.Path = "./executable"
-	s.Source.Scheme = source.FileScheme
-	actual = toGithubModel(&s)
-	assert.Equal(t, "executable", actual.Manifests["executable"].Name)
-
-	s.Source.Path = "./archive.tar.gz"
-	s.Source.Scheme = source.FileScheme
-	actual = toGithubModel(&s)
-	assert.Equal(t, "archive.tar.gz:/etc", actual.Manifests["archive.tar.gz:/etc"].Name)
-}

internal/formats/github/format.go

@@ -1,29 +0,0 @@
-package github
-
-import (
-	"encoding/json"
-	"io"
-
-	"github.com/anchore/syft/syft/sbom"
-)
-
-const ID sbom.FormatID = "github-0-json"
-
-func Format() sbom.Format {
-	return sbom.NewFormat(
-		ID,
-		func(writer io.Writer, sbom sbom.SBOM) error {
-			bom := toGithubModel(&sbom)
-
-			bytes, err := json.MarshalIndent(bom, "", "  ")
-			if err != nil {
-				return err
-			}
-			_, err = writer.Write(bytes)
-
-			return err
-		},
-		nil,
-		nil,
-	)
-}

internal/formats/github/github_dependency_api.go

@@ -1,78 +0,0 @@
-package github
-
-// Derived from: https://gist.github.com/reiddraper/fdab2883db0f372c146d1a750fc1c43f
-
-type DependencySnapshot struct {
-	Version   int              `json:"version"`
-	Job       Job              `json:"job,omitempty"` // !omitempty
-	Sha       string           `json:"sha,omitempty"` // !omitempty sha of the Git commit
-	Ref       string           `json:"ref,omitempty"` // !omitempty ref of the Git commit example "refs/heads/main"
-	Detector  DetectorMetadata `json:"detector,omitempty"`
-	Metadata  Metadata         `json:"metadata,omitempty"`
-	Manifests Manifests        `json:"manifests,omitempty"`
-	Scanned   ISO8601Date      `json:"scanned,omitempty"`
-}
-
-type Job struct {
-	Name    string `json:"name,omitempty"` // !omitempty
-	ID      string `json:"id,omitempty"`   // !omitempty
-	HTMLURL string `json:"html_url,omitempty"`
-}
-
-type DetectorMetadata struct {
-	Name    string `json:"name,omitempty"`
-	URL     string `json:"url,omitempty"`
-	Version string `json:"version,omitempty"`
-}
-
-type Manifests map[string]Manifest
-
-// Manifest A collection of related dependencies, either declared in a file,
-// or representing a logical group of dependencies.
-type Manifest struct {
-	Name     string          `json:"name"`
-	File     FileInfo        `json:"file"`
-	Metadata Metadata        `json:"metadata,omitempty"`
-	Resolved DependencyGraph `json:"resolved,omitempty"`
-}
-
-type FileInfo struct {
-	SourceLocation string `json:"source_location,omitempty"`
-}
-
-// DependencyRelationship A notation of whether a dependency is requested directly
-// by this manifest, or is a dependency of another dependency.
-type DependencyRelationship string
-
-const (
-	DependencyRelationshipDirect   DependencyRelationship = "direct"
-	DependencyRelationshipIndirect DependencyRelationship = "indirect"
-)
-
-// DependencyScope A notation of whether the dependency is required for the primary
-// build artifact (runtime), or is only used for development.
-// Future versions of this specification may allow for more granular
-// scopes, like `runtimeserver`, `runtimeshipped`,
-// `developmenttest`, `developmentbenchmark`.
-type DependencyScope string
-
-const (
-	DependencyScopeRuntime     DependencyScope = "runtime"
-	DependencyScopeDevelopment DependencyScope = "development"
-)
-
-type DependencyNode struct {
-	Purl         string                 `json:"purl,omitempty"`
-	Metadata     Metadata               `json:"metadata,omitempty"`
-	Relationship DependencyRelationship `json:"relationship,omitempty"`
-	Scope        DependencyScope        `json:"scope,omitempty"`
-	Dependencies []string               `json:"dependencies,omitempty"`
-}
-
-type DependencyGraph map[string]DependencyNode
-
-type ISO8601Date = string
-
-type Scalar interface{} // should be: null | boolean | string | number
-
-type Metadata map[string]Scalar

internal/formats/spdx22json/decoder_test.go

@@ -71,11 +71,11 @@ func TestSPDXJSONDecoder(t *testing.T) {
 			}
 
 			if test.packages != nil {
-				assert.Equal(t, sbom.Artifacts.PackageCatalog.PackageCount(), len(test.packages))
+				assert.Equal(t, sbom.Artifacts.Packages.Size(), len(test.packages))
 
 			packages:
 				for _, pkgName := range test.packages {
-					for _, p := range sbom.Artifacts.PackageCatalog.Sorted() {
+					for _, p := range sbom.Artifacts.Packages.Sorted() {
 						if p.Name == pkgName {
 							continue packages
 						}

internal/formats/spdx22json/to_format_model.go

@@ -16,7 +16,6 @@ import (
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
-	"github.com/anchore/syft/syft/source"
 )
 
 // toFormatModel creates and populates a new JSON document struct that follows the SPDX 2.2 spec from the given cataloging results.
@@ -43,13 +42,13 @@ func toFormatModel(s sbom.SBOM) (*model.Document, error) {
 		},
 		DataLicense:       "CC0-1.0",
 		DocumentNamespace: namespace,
-		Packages:          toPackages(s.Artifacts.PackageCatalog, s.Relationships),
+		Packages:          toPackages(s.Artifacts.Packages, s.Relationships),
 		Files:             toFiles(s),
 		Relationships:     toRelationships(s.Relationships),
 	}, nil
 }
 
-func toPackages(catalog *pkg.Catalog, relationships []artifact.Relationship) []model.Package {
+func toPackages(catalog pkg.Collection, relationships []artifact.Relationship) []model.Package {
 	packages := make([]model.Package, 0)
 
 	for _, p := range catalog.Sorted() {
@@ -94,7 +93,7 @@ func fileIDsForPackage(packageSpdxID string, relationships []artifact.Relationsh
 			continue
 		}
 
-		if _, ok := relationship.To.(source.Coordinates); !ok {
+		if _, ok := relationship.To.(file.Coordinates); !ok {
 			continue
 		}
 
@@ -110,7 +109,7 @@ func toFiles(s sbom.SBOM) []model.File {
 	artifacts := s.Artifacts
 
 	for _, coordinates := range sbom.AllCoordinates(s) {
-		var metadata *source.FileMetadata
+		var metadata *file.Metadata
 		if metadataForLocation, exists := artifacts.FileMetadata[coordinates]; exists {
 			metadata = &metadataForLocation
 		}
@@ -165,7 +164,7 @@ func toChecksumAlgorithm(algorithm string) string {
 	return strings.ToUpper(algorithm)
 }
 
-func toFileTypes(metadata *source.FileMetadata) (ty []string) {
+func toFileTypes(metadata *file.Metadata) (ty []string) {
 	if metadata == nil {
 		return nil
 	}

internal/formats/spdx22json/to_format_model_test.go

@@ -11,7 +11,6 @@ import (
 
 	"github.com/anchore/syft/internal/formats/common/spdxhelpers"
 	"github.com/anchore/syft/internal/formats/spdx22json/model"
-	"github.com/anchore/syft/syft/source"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -19,12 +18,12 @@ func Test_toFileTypes(t *testing.T) {
 
 	tests := []struct {
 		name     string
-		metadata source.FileMetadata
+		metadata file.Metadata
 		expected []string
 	}{
 		{
 			name: "application",
-			metadata: source.FileMetadata{
+			metadata: file.Metadata{
 				MIMEType: "application/vnd.unknown",
 			},
 			expected: []string{
@@ -33,7 +32,7 @@ func Test_toFileTypes(t *testing.T) {
 		},
 		{
 			name: "archive",
-			metadata: source.FileMetadata{
+			metadata: file.Metadata{
 				MIMEType: "application/zip",
 			},
 			expected: []string{
@@ -43,7 +42,7 @@ func Test_toFileTypes(t *testing.T) {
 		},
 		{
 			name: "audio",
-			metadata: source.FileMetadata{
+			metadata: file.Metadata{
 				MIMEType: "audio/ogg",
 			},
 			expected: []string{
@@ -52,7 +51,7 @@ func Test_toFileTypes(t *testing.T) {
 		},
 		{
 			name: "video",
-			metadata: source.FileMetadata{
+			metadata: file.Metadata{
 				MIMEType: "video/3gpp",
 			},
 			expected: []string{
@@ -61,7 +60,7 @@ func Test_toFileTypes(t *testing.T) {
 		},
 		{
 			name: "text",
-			metadata: source.FileMetadata{
+			metadata: file.Metadata{
 				MIMEType: "text/html",
 			},
 			expected: []string{
@@ -70,7 +69,7 @@ func Test_toFileTypes(t *testing.T) {
 		},
 		{
 			name: "image",
-			metadata: source.FileMetadata{
+			metadata: file.Metadata{
 				MIMEType: "image/png",
 			},
 			expected: []string{
@@ -79,7 +78,7 @@ func Test_toFileTypes(t *testing.T) {
 		},
 		{
 			name: "binary",
-			metadata: source.FileMetadata{
+			metadata: file.Metadata{
 				MIMEType: "application/x-sharedlib",
 			},
 			expected: []string{
@@ -175,7 +174,7 @@ func Test_fileIDsForPackage(t *testing.T) {
 		Name: "bogus",
 	}
 
-	c := source.Coordinates{
+	c := file.Coordinates{
 		RealPath:     "/path",
 		FileSystemID: "nowhere",
 	}

internal/formats/spdx22tagvalue/to_format_model.go

@@ -85,13 +85,13 @@ func toFormatModel(s sbom.SBOM) (*spdx.Document2_2, error) {
 			// Cardinality: optional, one
 			DocumentComment: "",
 		},
-		Packages: toFormatPackages(s.Artifacts.PackageCatalog),
+		Packages: toFormatPackages(s.Artifacts.Packages),
 	}, nil
 }
 
-// packages populates all Package Information from the package Catalog (see https://spdx.github.io/spdx-spec/3-package-information/)
+// packages populates all Package Information from the package Collection (see https://spdx.github.io/spdx-spec/3-package-information/)
 // nolint: funlen
-func toFormatPackages(catalog *pkg.Catalog) map[spdx.ElementID]*spdx.Package2_2 {
+func toFormatPackages(catalog pkg.Collection) map[spdx.ElementID]*spdx.Package2_2 {
 	results := make(map[spdx.ElementID]*spdx.Package2_2)
 
 	for _, p := range catalog.Sorted() {

internal/formats/syftjson/decoder_test.go

@@ -28,8 +28,8 @@ func TestEncodeDecodeCycle(t *testing.T) {
 		t.Errorf("metadata difference: %+v", d)
 	}
 
-	actualPackages := actualSBOM.Artifacts.PackageCatalog.Sorted()
-	for idx, p := range originalSBOM.Artifacts.PackageCatalog.Sorted() {
+	actualPackages := actualSBOM.Artifacts.Packages.Sorted()
+	for idx, p := range originalSBOM.Artifacts.Packages.Sorted() {
 		if !assert.Equal(t, p.Name, actualPackages[idx].Name) {
 			t.Errorf("different package at idx=%d: %s vs %s", idx, p.Name, actualPackages[idx].Name)
 			continue

internal/formats/syftjson/encoder_test.go

@@ -2,6 +2,7 @@ package syftjson
 
 import (
 	"flag"
+	"github.com/anchore/syft/syft/cpe"
 	"testing"
 
 	"github.com/anchore/syft/syft/file"
@@ -37,14 +38,14 @@ func TestImageEncoder(t *testing.T) {
 }
 
 func TestEncodeFullJSONDocument(t *testing.T) {
-	catalog := pkg.NewCatalog()
+	catalog := pkg.NewCollection()
 
 	p1 := pkg.Package{
 		Name:    "package-1",
 		Version: "1.0.1",
-		Locations: []source.Location{
+		Locations: []file.Location{
 			{
-				Coordinates: source.Coordinates{
+				Coordinates: file.Coordinates{
 					RealPath: "/a/place/a",
 				},
 			},
@@ -60,17 +61,17 @@ func TestEncodeFullJSONDocument(t *testing.T) {
 			Files:   []pkg.PythonFileRecord{},
 		},
 		PURL: "a-purl-1",
-		CPEs: []pkg.CPE{
-			pkg.MustCPE("cpe:2.3:*:some:package:1:*:*:*:*:*:*:*"),
+		CPEs: []cpe.CPE{
+			cpe.Must("cpe:2.3:*:some:package:1:*:*:*:*:*:*:*"),
 		},
 	}
 
 	p2 := pkg.Package{
 		Name:    "package-2",
 		Version: "2.0.1",
-		Locations: []source.Location{
+		Locations: []file.Location{
 			{
-				Coordinates: source.Coordinates{
+				Coordinates: file.Coordinates{
 					RealPath: "/b/place/b",
 				},
 			},
@@ -84,8 +85,8 @@ func TestEncodeFullJSONDocument(t *testing.T) {
 			Files:   []pkg.DpkgFileRecord{},
 		},
 		PURL: "a-purl-2",
-		CPEs: []pkg.CPE{
-			pkg.MustCPE("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"),
+		CPEs: []cpe.CPE{
+			cpe.Must("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"),
 		},
 	}
 
@@ -94,50 +95,50 @@ func TestEncodeFullJSONDocument(t *testing.T) {
 
 	s := sbom.SBOM{
 		Artifacts: sbom.Artifacts{
-			PackageCatalog: catalog,
-			FileMetadata: map[source.Coordinates]source.FileMetadata{
-				source.NewLocation("/a/place").Coordinates: {
+			Packages: catalog,
+			FileMetadata: map[file.Coordinates]file.Metadata{
+				file.NewLocation("/a/place").Coordinates: {
 					Mode:    0775,
 					Type:    "directory",
 					UserID:  0,
 					GroupID: 0,
 				},
-				source.NewLocation("/a/place/a").Coordinates: {
+				file.NewLocation("/a/place/a").Coordinates: {
 					Mode:    0775,
 					Type:    "regularFile",
 					UserID:  0,
 					GroupID: 0,
 				},
-				source.NewLocation("/b").Coordinates: {
+				file.NewLocation("/b").Coordinates: {
 					Mode:            0775,
 					Type:            "symbolicLink",
 					LinkDestination: "/c",
 					UserID:          0,
 					GroupID:         0,
 				},
-				source.NewLocation("/b/place/b").Coordinates: {
+				file.NewLocation("/b/place/b").Coordinates: {
 					Mode:    0644,
 					Type:    "regularFile",
 					UserID:  1,
 					GroupID: 2,
 				},
 			},
-			FileDigests: map[source.Coordinates][]file.Digest{
-				source.NewLocation("/a/place/a").Coordinates: {
+			FileDigests: map[file.Coordinates][]file.Digest{
+				file.NewLocation("/a/place/a").Coordinates: {
 					{
 						Algorithm: "sha256",
 						Value:     "366a3f5653e34673b875891b021647440d0127c2ef041e3b1a22da2a7d4f3703",
 					},
 				},
-				source.NewLocation("/b/place/b").Coordinates: {
+				file.NewLocation("/b/place/b").Coordinates: {
 					{
 						Algorithm: "sha256",
 						Value:     "1b3722da2a7d90d033b87581a2a3f12021647445653e34666ef041e3b4f3707c",
 					},
 				},
 			},
-			FileContents: map[source.Coordinates]string{
-				source.NewLocation("/a/place/a").Coordinates: "the-contents",
+			FileContents: map[file.Coordinates]string{
+				file.NewLocation("/a/place/a").Coordinates: "the-contents",
 			},
 			LinuxDistribution: &linux.Release{
 				ID:        "redhat",
@@ -159,7 +160,7 @@ func TestEncodeFullJSONDocument(t *testing.T) {
 			},
 		},
 		Source: source.Metadata{
-			Scheme: source.ImageScheme,
+			Scheme: source.ImageType,
 			ImageMetadata: source.ImageMetadata{
 				UserInput:      "user-image-input",
 				ID:             "sha256:c2b46b4eb06296933b7cf0722683964e9ecbd93265b9ef6ae9642e3952afbba0",

internal/formats/syftjson/model/file.go

@@ -2,13 +2,11 @@ package model
 
 import (
 	"github.com/anchore/syft/syft/file"
-
-	"github.com/anchore/syft/syft/source"
 )
 
 type File struct {
 	ID              string                `json:"id"`
-	Location        source.Coordinates    `json:"location"`
+	Location        file.Coordinates      `json:"location"`
 	Metadata        *FileMetadataEntry    `json:"metadata,omitempty"`
 	Contents        string                `json:"contents,omitempty"`
 	Digests         []file.Digest         `json:"digests,omitempty"`
@@ -16,10 +14,10 @@ type File struct {
 }
 
 type FileMetadataEntry struct {
-	Mode            int             `json:"mode"`
-	Type            source.FileType `json:"type"`
-	LinkDestination string          `json:"linkDestination,omitempty"`
-	UserID          int             `json:"userID"`
-	GroupID         int             `json:"groupID"`
-	MIMEType        string          `json:"mimeType"`
+	Mode            int       `json:"mode"`
+	Type            file.Type `json:"type"`
+	LinkDestination string    `json:"linkDestination,omitempty"`
+	UserID          int       `json:"userID"`
+	GroupID         int       `json:"groupID"`
+	MIMEType        string    `json:"mimeType"`
 }

internal/formats/syftjson/model/package.go

@@ -4,7 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 
-	"github.com/anchore/syft/syft/source"
+	"github.com/anchore/syft/syft/file"
 
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/pkg"
@@ -18,16 +18,16 @@ type Package struct {
 
 // PackageBasicData contains non-ambiguous values (type-wise) from pkg.Package.
 type PackageBasicData struct {
-	ID        string               `json:"id"`
-	Name      string               `json:"name"`
-	Version   string               `json:"version"`
-	Type      pkg.Type             `json:"type"`
-	FoundBy   string               `json:"foundBy"`
-	Locations []source.Coordinates `json:"locations"`
-	Licenses  []string             `json:"licenses"`
-	Language  pkg.Language         `json:"language"`
-	CPEs      []string             `json:"cpes"`
-	PURL      string               `json:"purl"`
+	ID        string             `json:"id"`
+	Name      string             `json:"name"`
+	Version   string             `json:"version"`
+	Type      pkg.Type           `json:"type"`
+	FoundBy   string             `json:"foundBy"`
+	Locations []file.Coordinates `json:"locations"`
+	Licenses  []string           `json:"licenses"`
+	Language  pkg.Language       `json:"language"`
+	CPEs      []string           `json:"cpes"`
+	PURL      string             `json:"purl"`
 }
 
 // PackageCustomData contains ambiguous values (type-wise) from pkg.Package.
@@ -124,12 +124,6 @@ func (p *Package) UnmarshalJSON(b []byte) error {
 			return err
 		}
 		p.Metadata = payload
-	case pkg.GolangBinMetadataType:
-		var payload pkg.GolangBinMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
 	default:
 		log.Warnf("unknown package metadata type=%q for packageID=%q", p.MetadataType, p.ID)
 	}

internal/formats/syftjson/model/package_test.go

@@ -1,57 +0,0 @@
-package model
-
-import (
-	"testing"
-
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestUnmarshalPackageGolang(t *testing.T) {
-	tests := []struct {
-		name        string
-		p           *Package
-		packageData []byte
-	}{
-		{
-			name: "Package.UnmarshalJSON unmarshals PackageBasicData",
-			p:    &Package{},
-			packageData: []byte(`{
-				"id": "8b594519bc23da50",
-				"name": "gopkg.in/square/go-jose.v2",
-				"version": "v2.6.0",
-				"type": "go-module",
-				"foundBy": "go-module-binary-cataloger",
-				"locations": [
-				  {
-				    "path": "/Users/hal/go/bin/syft"
-				  }
-				],
-				"licenses": [],
-				"language": "go",
-				"cpes": [],
-				"purl": "pkg:golang/gopkg.in/square/go-jose.v2@v2.6.0",
-				"metadataType": "GolangBinMetadata",
-				"metadata": {
-				  "goCompiledVersion": "go1.18",
-				  "architecture": "amd64",
-				  "h1Digest": "h1:NGk74WTnPKBNUhNzQX7PYcTLUjoq7mzKk2OKbvwk2iI="
-				}
-			}`),
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			err := test.p.UnmarshalJSON(test.packageData)
-			if err != nil {
-				t.Fatalf("could not unmarshal packageData: %v", err)
-			}
-
-			assert.NotNil(t, test.p.Metadata)
-			golangMetadata := test.p.Metadata.(pkg.GolangBinMetadata)
-			assert.NotEmpty(t, golangMetadata)
-			assert.Equal(t, "go1.18", golangMetadata.GoCompiledVersion)
-		})
-	}
-}

internal/formats/syftjson/model/secrets.go

@@ -2,10 +2,9 @@ package model
 
 import (
 	"github.com/anchore/syft/syft/file"
-	"github.com/anchore/syft/syft/source"
 )
 
 type Secrets struct {
-	Location source.Coordinates  `json:"location"`
+	Location file.Coordinates    `json:"location"`
 	Secrets  []file.SearchResult `json:"secrets"`
 }

internal/formats/syftjson/test-fixtures/snapshot/TestDirectoryEncoder.golden

@@ -88,7 +88,7 @@
   }
  },
  "schema": {
-  "version": "3.2.1",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.2.1.json"
+  "version": "3.0.1",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.0.1.json"
  }
 }

internal/formats/syftjson/test-fixtures/snapshot/TestEncodeFullJSONDocument.golden

@@ -184,7 +184,7 @@
   }
  },
  "schema": {
-  "version": "3.2.1",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.2.1.json"
+  "version": "3.0.1",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.0.1.json"
  }
 }

internal/formats/syftjson/test-fixtures/snapshot/TestImageEncoder.golden

@@ -111,7 +111,7 @@
   }
  },
  "schema": {
-  "version": "3.2.1",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.2.1.json"
+  "version": "3.0.1",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.0.1.json"
  }
 }

internal/formats/syftjson/to_format_model.go

@@ -2,6 +2,7 @@ package syftjson
 
 import (
 	"fmt"
+	"github.com/anchore/syft/syft/cpe"
 	"sort"
 	"strconv"
 
@@ -30,7 +31,7 @@ func ToFormatModel(s sbom.SBOM) model.Document {
 	}
 
 	return model.Document{
-		Artifacts:             toPackageModels(s.Artifacts.PackageCatalog),
+		Artifacts:             toPackageModels(s.Artifacts.Packages),
 		ArtifactRelationships: toRelationshipModel(s.Relationships),
 		Files:                 toFile(s),
 		Secrets:               toSecrets(s.Artifacts.Secrets),
@@ -73,7 +74,7 @@ func toDescriptor(d sbom.Descriptor) model.Descriptor {
 	}
 }
 
-func toSecrets(data map[source.Coordinates][]file.SearchResult) []model.Secrets {
+func toSecrets(data map[file.Coordinates][]file.SearchResult) []model.Secrets {
 	results := make([]model.Secrets, 0)
 	for coordinates, secrets := range data {
 		results = append(results, model.Secrets{
@@ -94,7 +95,7 @@ func toFile(s sbom.SBOM) []model.File {
 	artifacts := s.Artifacts
 
 	for _, coordinates := range sbom.AllCoordinates(s) {
-		var metadata *source.FileMetadata
+		var metadata *file.Metadata
 		if metadataForLocation, exists := artifacts.FileMetadata[coordinates]; exists {
 			metadata = &metadataForLocation
 		}
@@ -131,7 +132,7 @@ func toFile(s sbom.SBOM) []model.File {
 	return results
 }
 
-func toFileMetadataEntry(coordinates source.Coordinates, metadata *source.FileMetadata) *model.FileMetadataEntry {
+func toFileMetadataEntry(coordinates file.Coordinates, metadata *file.Metadata) *model.FileMetadataEntry {
 	if metadata == nil {
 		return nil
 	}
@@ -152,7 +153,7 @@ func toFileMetadataEntry(coordinates source.Coordinates, metadata *source.FileMe
 	}
 }
 
-func toPackageModels(catalog *pkg.Catalog) []model.Package {
+func toPackageModels(catalog pkg.Collection) []model.Package {
 	artifacts := make([]model.Package, 0)
 	if catalog == nil {
 		return artifacts
@@ -167,7 +168,7 @@ func toPackageModels(catalog *pkg.Catalog) []model.Package {
 func toPackageModel(p pkg.Package) model.Package {
 	var cpes = make([]string, len(p.CPEs))
 	for i, c := range p.CPEs {
-		cpes[i] = pkg.CPEString(c)
+		cpes[i] = cpe.String(c)
 	}
 
 	var licenses = make([]string, 0)
@@ -175,7 +176,7 @@ func toPackageModel(p pkg.Package) model.Package {
 		licenses = p.Licenses
 	}
 
-	var coordinates = make([]source.Coordinates, len(p.Locations))
+	var coordinates = make([]file.Coordinates, len(p.Locations))
 	for i, l := range p.Locations {
 		coordinates[i] = l.Coordinates
 	}
@@ -216,7 +217,7 @@ func toRelationshipModel(relationships []artifact.Relationship) []model.Relation
 // toSourceModel creates a new source object to be represented into JSON.
 func toSourceModel(src source.Metadata) (model.Source, error) {
 	switch src.Scheme {
-	case source.ImageScheme:
+	case source.ImageType:
 		metadata := src.ImageMetadata
 		// ensure that empty collections are not shown as null
 		if metadata.RepoDigests == nil {
@@ -229,12 +230,12 @@ func toSourceModel(src source.Metadata) (model.Source, error) {
 			Type:   "image",
 			Target: metadata,
 		}, nil
-	case source.DirectoryScheme:
+	case source.DirectoryType:
 		return model.Source{
 			Type:   "directory",
 			Target: src.Path,
 		}, nil
-	case source.FileScheme:
+	case source.FileType:
 		return model.Source{
 			Type:   "file",
 			Target: src.Path,

internal/formats/syftjson/to_format_model_test.go

@@ -13,7 +13,7 @@ import (
 
 func Test_toSourceModel(t *testing.T) {
 	allSchemes := strset.New()
-	for _, s := range source.AllSchemes {
+	for _, s := range source.AllTypes {
 		allSchemes.Add(string(s))
 	}
 	testedSchemes := strset.New()
@@ -26,7 +26,7 @@ func Test_toSourceModel(t *testing.T) {
 		{
 			name: "directory",
 			src: source.Metadata{
-				Scheme: source.DirectoryScheme,
+				Scheme: source.DirectoryType,
 				Path:   "some/path",
 			},
 			expected: model.Source{
@@ -37,7 +37,7 @@ func Test_toSourceModel(t *testing.T) {
 		{
 			name: "file",
 			src: source.Metadata{
-				Scheme: source.FileScheme,
+				Scheme: source.FileType,
 				Path:   "some/path",
 			},
 			expected: model.Source{
@@ -48,7 +48,7 @@ func Test_toSourceModel(t *testing.T) {
 		{
 			name: "image",
 			src: source.Metadata{
-				Scheme: source.ImageScheme,
+				Scheme: source.ImageType,
 				ImageMetadata: source.ImageMetadata{
 					UserInput:      "user-input",
 					ID:             "id...",

internal/formats/syftjson/to_syft_model.go

@@ -4,6 +4,8 @@ import (
 	"github.com/anchore/syft/internal/formats/syftjson/model"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/cpe"
+	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
@@ -12,18 +14,16 @@ import (
 )
 
 func toSyftModel(doc model.Document) (*sbom.SBOM, error) {
-	idAliases := make(map[string]string)
-
-	catalog := toSyftCatalog(doc.Artifacts, idAliases)
+	catalog := toSyftCatalog(doc.Artifacts)
 
 	return &sbom.SBOM{
 		Artifacts: sbom.Artifacts{
-			PackageCatalog:    catalog,
+			Packages:          catalog,
 			LinuxDistribution: toSyftLinuxRelease(doc.Distro),
 		},
 		Source:        *toSyftSourceData(doc.Source),
 		Descriptor:    toSyftDescriptor(doc.Descriptor),
-		Relationships: toSyftRelationships(&doc, catalog, doc.ArtifactRelationships, idAliases),
+		Relationships: toSyftRelationships(&doc, catalog, doc.ArtifactRelationships),
 	}, nil
 }
 
@@ -48,7 +48,7 @@ func toSyftLinuxRelease(d model.LinuxRelease) *linux.Release {
 	}
 }
 
-func toSyftRelationships(doc *model.Document, catalog *pkg.Catalog, relationships []model.Relationship, idAliases map[string]string) []artifact.Relationship {
+func toSyftRelationships(doc *model.Document, catalog pkg.Collection, relationships []model.Relationship) []artifact.Relationship {
 	idMap := make(map[string]interface{})
 
 	for _, p := range catalog.Sorted() {
@@ -64,7 +64,7 @@ func toSyftRelationships(doc *model.Document, catalog *pkg.Catalog, relationship
 
 	var out []artifact.Relationship
 	for _, r := range relationships {
-		syftRelationship := toSyftRelationship(idMap, r, idAliases)
+		syftRelationship := toSyftRelationship(idMap, r)
 		if syftRelationship != nil {
 			out = append(out, *syftRelationship)
 		}
@@ -72,20 +72,13 @@ func toSyftRelationships(doc *model.Document, catalog *pkg.Catalog, relationship
 	return out
 }
 
-func toSyftRelationship(idMap map[string]interface{}, relationship model.Relationship, idAliases map[string]string) *artifact.Relationship {
-	id := func(id string) string {
-		aliased, ok := idAliases[id]
-		if ok {
-			return aliased
-		}
-		return id
-	}
-	from, ok := idMap[id(relationship.Parent)].(artifact.Identifiable)
+func toSyftRelationship(idMap map[string]interface{}, relationship model.Relationship) *artifact.Relationship {
+	from, ok := idMap[relationship.Parent].(artifact.Identifiable)
 	if !ok {
 		log.Warnf("relationship mapping from key %s is not a valid artifact.Identifiable type: %+v", relationship.Parent, idMap[relationship.Parent])
 		return nil
 	}
-	to, ok := idMap[id(relationship.Child)].(artifact.Identifiable)
+	to, ok := idMap[relationship.Child].(artifact.Identifiable)
 	if !ok {
 		log.Warnf("relationship mapping to key %s is not a valid artifact.Identifiable type: %+v", relationship.Child, idMap[relationship.Child])
 		return nil
@@ -120,35 +113,35 @@ func toSyftSourceData(s model.Source) *source.Metadata {
 	switch s.Type {
 	case "directory":
 		return &source.Metadata{
-			Scheme: source.DirectoryScheme,
+			Scheme: source.DirectoryType,
 			Path:   s.Target.(string),
 		}
 	case "file":
 		return &source.Metadata{
-			Scheme: source.FileScheme,
+			Scheme: source.FileType,
 			Path:   s.Target.(string),
 		}
 	case "image":
 		return &source.Metadata{
-			Scheme:        source.ImageScheme,
+			Scheme:        source.ImageType,
 			ImageMetadata: s.Target.(source.ImageMetadata),
 		}
 	}
 	return nil
 }
 
-func toSyftCatalog(pkgs []model.Package, idAliases map[string]string) *pkg.Catalog {
-	catalog := pkg.NewCatalog()
+func toSyftCatalog(pkgs []model.Package) pkg.Collection {
+	catalog := pkg.NewCollection()
 	for _, p := range pkgs {
-		catalog.Add(toSyftPackage(p, idAliases))
+		catalog.Add(toSyftPackage(p))
 	}
 	return catalog
 }
 
-func toSyftPackage(p model.Package, idAliases map[string]string) pkg.Package {
-	var cpes []pkg.CPE
+func toSyftPackage(p model.Package) pkg.Package {
+	var cpes []cpe.CPE
 	for _, c := range p.CPEs {
-		value, err := pkg.NewCPE(c)
+		value, err := cpe.New(c)
 		if err != nil {
 			log.Warnf("excluding invalid CPE %q: %v", c, err)
 			continue
@@ -157,12 +150,12 @@ func toSyftPackage(p model.Package, idAliases map[string]string) pkg.Package {
 		cpes = append(cpes, value)
 	}
 
-	var locations = make([]source.Location, len(p.Locations))
+	var locations = make([]file.Location, len(p.Locations))
 	for i, c := range p.Locations {
-		locations[i] = source.NewLocationFromCoordinates(c)
+		locations[i] = file.NewLocationFromCoordinates(c)
 	}
 
-	out := pkg.Package{
+	return pkg.Package{
 		Name:         p.Name,
 		Version:      p.Version,
 		FoundBy:      p.FoundBy,
@@ -175,13 +168,4 @@ func toSyftPackage(p model.Package, idAliases map[string]string) pkg.Package {
 		MetadataType: p.MetadataType,
 		Metadata:     p.Metadata,
 	}
-
-	out.SetID()
-
-	id := string(out.ID())
-	if id != p.ID {
-		idAliases[p.ID] = id
-	}
-
-	return out
 }

internal/formats/syftjson/to_syft_model_test.go

@@ -4,7 +4,6 @@ import (
 	"testing"
 
 	"github.com/anchore/syft/internal/formats/syftjson/model"
-	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/source"
 	"github.com/scylladb/go-set/strset"
 	"github.com/stretchr/testify/assert"
@@ -12,7 +11,7 @@ import (
 
 func Test_toSyftSourceData(t *testing.T) {
 	allSchemes := strset.New()
-	for _, s := range source.AllSchemes {
+	for _, s := range source.AllTypes {
 		allSchemes.Add(string(s))
 	}
 	testedSchemes := strset.New()
@@ -25,7 +24,7 @@ func Test_toSyftSourceData(t *testing.T) {
 		{
 			name: "directory",
 			expected: source.Metadata{
-				Scheme: source.DirectoryScheme,
+				Scheme: source.DirectoryType,
 				Path:   "some/path",
 			},
 			src: model.Source{
@@ -36,7 +35,7 @@ func Test_toSyftSourceData(t *testing.T) {
 		{
 			name: "file",
 			expected: source.Metadata{
-				Scheme: source.FileScheme,
+				Scheme: source.FileType,
 				Path:   "some/path",
 			},
 			src: model.Source{
@@ -47,7 +46,7 @@ func Test_toSyftSourceData(t *testing.T) {
 		{
 			name: "image",
 			expected: source.Metadata{
-				Scheme: source.ImageScheme,
+				Scheme: source.ImageType,
 				ImageMetadata: source.ImageMetadata{
 					UserInput:      "user-input",
 					ID:             "id...",
@@ -80,46 +79,3 @@ func Test_toSyftSourceData(t *testing.T) {
 	// assert all possible schemes were under test
 	assert.ElementsMatch(t, allSchemes.List(), testedSchemes.List(), "not all source.Schemes are under test")
 }
-
-func Test_idsHaveChanged(t *testing.T) {
-	s, err := toSyftModel(model.Document{
-		Source: model.Source{
-			Type:   "file",
-			Target: "some/path",
-		},
-		Artifacts: []model.Package{
-			{
-				PackageBasicData: model.PackageBasicData{
-					ID:   "1",
-					Name: "pkg-1",
-				},
-			},
-			{
-				PackageBasicData: model.PackageBasicData{
-					ID:   "2",
-					Name: "pkg-2",
-				},
-			},
-		},
-		ArtifactRelationships: []model.Relationship{
-			{
-				Parent: "1",
-				Child:  "2",
-				Type:   string(artifact.ContainsRelationship),
-			},
-		},
-	})
-
-	assert.NoError(t, err)
-	assert.Len(t, s.Relationships, 1)
-
-	r := s.Relationships[0]
-
-	from := s.Artifacts.PackageCatalog.Package(r.From.ID())
-	assert.NotNil(t, from)
-	assert.Equal(t, "pkg-1", from.Name)
-
-	to := s.Artifacts.PackageCatalog.Package(r.To.ID())
-	assert.NotNil(t, to)
-	assert.Equal(t, "pkg-2", to.Name)
-}

internal/formats/table/encoder.go

@@ -15,7 +15,7 @@ func encoder(output io.Writer, s sbom.SBOM) error {
 	var rows [][]string
 
 	columns := []string{"Name", "Version", "Type"}
-	for _, p := range s.Artifacts.PackageCatalog.Sorted() {
+	for _, p := range s.Artifacts.Packages.Sorted() {
 		row := []string{
 			p.Name,
 			p.Version,

internal/formats/text/encoder.go

@@ -16,9 +16,9 @@ func encoder(output io.Writer, s sbom.SBOM) error {
 	w.Init(output, 0, 8, 0, '\t', tabwriter.AlignRight)
 
 	switch s.Source.Scheme {
-	case source.DirectoryScheme, source.FileScheme:
+	case source.DirectoryType, source.FileType:
 		fmt.Fprintf(w, "[Path: %s]\n", s.Source.Path)
-	case source.ImageScheme:
+	case source.ImageType:
 		fmt.Fprintln(w, "[Image]")
 
 		for idx, l := range s.Source.ImageMetadata.Layers {
@@ -35,7 +35,7 @@ func encoder(output io.Writer, s sbom.SBOM) error {
 
 	// populate artifacts...
 	rows := 0
-	for _, p := range s.Artifacts.PackageCatalog.Sorted() {
+	for _, p := range s.Artifacts.Packages.Sorted() {
 		fmt.Fprintf(w, "[%s]\n", p.Name)
 		fmt.Fprintln(w, " Version:\t", p.Version)
 		fmt.Fprintln(w, " Type:\t", string(p.Type))

internal/version/guess.go

@@ -0,0 +1,47 @@
+package version
+
+import (
+	"runtime/debug"
+	"strings"
+
+	"github.com/anchore/syft/internal/log"
+)
+
+func Guess() string {
+	v := FromBuild().Version
+	if strings.HasPrefix(v, "v") {
+		return v
+	}
+
+	buildInfo, ok := debug.ReadBuildInfo()
+	if !ok {
+		log.Warn("syft version could not be determined: unable to find the buildinfo section of the binary")
+		return v
+	}
+
+	var found bool
+	for _, d := range buildInfo.Deps {
+		if d.Path == "github.com/anchore/syft" {
+			v = d.Version
+			found = true
+			break
+		}
+	}
+
+	if !found {
+		// look for probable forks
+		for _, d := range buildInfo.Deps {
+			if strings.HasSuffix(d.Path, "/syft") {
+				v = d.Version
+				found = true
+				break
+			}
+		}
+	}
+
+	if !found {
+		log.Warn("syft version could not be determined: unable to find syft within the buildinfo section of the binary")
+	}
+
+	return v
+}

syft/catalog.go

@@ -0,0 +1,172 @@
+package syft
+
+import (
+	"fmt"
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/event/monitor"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/anchore/syft/syft/source"
+	"github.com/hashicorp/go-multierror"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+)
+
+type monitorableCollection struct {
+	pkg.Collection
+	monitor *progress.Manual
+}
+
+func (m *monitorableCollection) Add(p pkg.Package) {
+	m.monitor.N++
+	m.Collection.Add(p)
+}
+
+func Catalog(src *source.Source, options ...CatalogingOption) (*sbom.SBOM, error) {
+	var config = DefaultCatalogingConfig()
+	for _, optFn := range options {
+		if err := optFn(src, &config); err != nil {
+			return nil, fmt.Errorf("unable to apply cataloging option: %w", err)
+		}
+	}
+
+	if config.availableTasks == nil {
+		var err error
+		config.availableTasks, err = newTaskCollection()
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	if len(config.EnabledCatalogers) == 0 {
+		return nil, fmt.Errorf("no cataloging tasks configured to run")
+	}
+
+	catalogingTasks, err := config.availableTasks.tasks(config, config.EnabledCatalogers...)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(catalogingTasks) == 0 {
+		return nil, fmt.Errorf("no cataloging tasks found to run")
+	}
+
+	// special case: we need to identify the linux distro for downstream processing
+	identifyLinuxDistroTask, err := newIdentifyDistroTask(config)
+	if err != nil {
+		return nil, fmt.Errorf("unable to create linux distro identification task: %+v", err)
+	}
+
+	synthesizePackageRelationshipsTask, err := newSynthesizePackageRelationshipsTasks(config)
+	if err != nil {
+		return nil, fmt.Errorf("unable to create task to synthesize package relationships: %+v", err)
+	}
+
+	taskGroups := [][]task{
+		{
+			identifyLinuxDistroTask,
+		},
+		catalogingTasks,
+		{
+			synthesizePackageRelationshipsTask,
+		},
+	}
+
+	files, pkgs := newCatalogerMonitor()
+	defer func() {
+		files.SetCompleted() // TODO: files monitor is unused... should we remove?
+		pkgs.SetCompleted()
+	}()
+
+	s := sbom.SBOM{
+		Source: src.Metadata,
+		Descriptor: sbom.Descriptor{
+			Name:          config.ToolName,
+			Version:       config.ToolVersion,
+			Configuration: config.ToolConfiguration,
+		},
+		Artifacts: sbom.Artifacts{
+			Packages: &monitorableCollection{
+				Collection: pkg.NewCollection(),
+				monitor:    pkgs,
+			},
+		},
+	}
+
+	for _, tasks := range taskGroups {
+		if err := runTasks(&s, src, config.ProcessTasksInSerial, tasks...); err != nil {
+			return &s, err
+		}
+	}
+
+	return &s, nil
+}
+
+// newCatalogerMonitor creates a new CatalogingMonitor object and publishes the object on the bus as a CatalogingStarted event.
+func newCatalogerMonitor() (*progress.Manual, *progress.Manual) {
+	filesProcessed := progress.Manual{}
+	packagesDiscovered := progress.Manual{}
+
+	bus.Publish(partybus.Event{
+		Type: event.CatalogingStarted,
+		Value: monitor.CatalogingMonitor{
+			FilesProcessed:     progress.Monitorable(&filesProcessed),
+			PackagesDiscovered: progress.Monitorable(&packagesDiscovered),
+		},
+	})
+	return &filesProcessed, &packagesDiscovered
+}
+
+func runTasks(s *sbom.SBOM, src *source.Source, serial bool, tasks ...task) error {
+	var relationships []<-chan artifact.Relationship
+	var errs = make(chan error)
+	for _, t := range tasks {
+		r := make(chan artifact.Relationship)
+		relationships = append(relationships, r)
+		if serial {
+			runTask(t, &s.Artifacts, src, r, errs)
+		} else {
+			go runTask(t, &s.Artifacts, src, r, errs)
+		}
+	}
+
+	s.Relationships = append(s.Relationships, mergeRelationships(relationships...)...)
+	close(errs)
+	return mergeErrors(errs)
+}
+
+func mergeRelationships(cs ...<-chan artifact.Relationship) (relationships []artifact.Relationship) {
+	for _, c := range cs {
+		for n := range c {
+			relationships = append(relationships, n)
+		}
+	}
+
+	return relationships
+}
+
+func mergeErrors(errs <-chan error) (allErrs error) {
+	for err := range errs {
+		if err != nil {
+			allErrs = multierror.Append(allErrs, err)
+		}
+	}
+
+	return allErrs
+}
+
+func runTask(t task, a *sbom.Artifacts, src *source.Source, r chan<- artifact.Relationship, errs chan<- error) {
+	defer close(r)
+
+	relationships, err := t.Run(a, src)
+	if err != nil {
+		errs <- err
+		return
+	}
+
+	for _, relationship := range relationships {
+		r <- relationship
+	}
+}

syft/cataloger/files/fileclassifier/cataloger.go

@@ -1,25 +1,26 @@
-package file
+package fileclassifier
 
 import (
 	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/source"
 )
 
-type ClassificationCataloger struct {
+type Cataloger struct {
 	classifiers []Classifier
 }
 
-func NewClassificationCataloger(classifiers []Classifier) (*ClassificationCataloger, error) {
-	return &ClassificationCataloger{
+func NewCataloger(classifiers []Classifier) (*Cataloger, error) {
+	return &Cataloger{
 		classifiers: classifiers,
 	}, nil
 }
 
-func (i *ClassificationCataloger) Catalog(resolver source.FileResolver) (map[source.Coordinates][]Classification, error) {
-	results := make(map[source.Coordinates][]Classification)
+func (i *Cataloger) Catalog(resolver file.Resolver) (map[file.Coordinates][]file.Classification, error) {
+	results := make(map[file.Coordinates][]file.Classification)
 
 	numResults := 0
-	for _, location := range allRegularFiles(resolver) {
+	for _, location := range source.AllRegularFiles(resolver) {
 		for _, classifier := range i.classifiers {
 			result, err := classifier.Classify(resolver, location)
 			if err != nil {

syft/cataloger/files/fileclassifier/cataloger_test.go

@@ -1,9 +1,10 @@
-package file
+package fileclassifier
 
 import (
-	"github.com/anchore/stereoscope/pkg/imagetest"
 	"testing"
 
+	"github.com/anchore/stereoscope/pkg/imagetest"
+	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/source"
 	"github.com/stretchr/testify/assert"
 )
@@ -13,14 +14,14 @@ func TestClassifierCataloger_DefaultClassifiers_PositiveCases(t *testing.T) {
 		name        string
 		fixtureDir  string
 		location    string
-		expected    []Classification
+		expected    []file.Classification
 		expectedErr func(assert.TestingT, error, ...interface{}) bool
 	}{
 		{
 			name:       "positive-libpython3.7.so",
 			fixtureDir: "test-fixtures/classifiers/positive",
 			location:   "libpython3.7.so",
-			expected: []Classification{
+			expected: []file.Classification{
 				{
 					Class: "python-binary",
 					Metadata: map[string]string{
@@ -34,7 +35,7 @@ func TestClassifierCataloger_DefaultClassifiers_PositiveCases(t *testing.T) {
 			name:       "positive-python3.6",
 			fixtureDir: "test-fixtures/classifiers/positive",
 			location:   "python3.6",
-			expected: []Classification{
+			expected: []file.Classification{
 				{
 					Class: "python-binary",
 					Metadata: map[string]string{
@@ -48,7 +49,7 @@ func TestClassifierCataloger_DefaultClassifiers_PositiveCases(t *testing.T) {
 			name:       "positive-patchlevel.h",
 			fixtureDir: "test-fixtures/classifiers/positive",
 			location:   "patchlevel.h",
-			expected: []Classification{
+			expected: []file.Classification{
 				{
 					Class: "cpython-source",
 					Metadata: map[string]string{
@@ -62,7 +63,7 @@ func TestClassifierCataloger_DefaultClassifiers_PositiveCases(t *testing.T) {
 			name:       "positive-go",
 			fixtureDir: "test-fixtures/classifiers/positive",
 			location:   "go",
-			expected: []Classification{
+			expected: []file.Classification{
 				{
 					Class: "go-binary",
 					Metadata: map[string]string{
@@ -76,7 +77,7 @@ func TestClassifierCataloger_DefaultClassifiers_PositiveCases(t *testing.T) {
 			name:       "positive-go-hint",
 			fixtureDir: "test-fixtures/classifiers/positive",
 			location:   "VERSION",
-			expected: []Classification{
+			expected: []file.Classification{
 				{
 					Class: "go-binary-hint",
 					Metadata: map[string]string{
@@ -90,7 +91,7 @@ func TestClassifierCataloger_DefaultClassifiers_PositiveCases(t *testing.T) {
 			name:       "positive-busybox",
 			fixtureDir: "test-fixtures/classifiers/positive",
 			location:   "[", // note: busybox is a link to [
-			expected: []Classification{
+			expected: []file.Classification{
 				{
 					Class: "busybox-binary",
 					Metadata: map[string]string{
@@ -105,7 +106,7 @@ func TestClassifierCataloger_DefaultClassifiers_PositiveCases(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 
-			c, err := NewClassificationCataloger(DefaultClassifiers)
+			c, err := NewCataloger(DefaultClassifiers())
 			test.expectedErr(t, err)
 
 			src, err := source.NewFromDirectory(test.fixtureDir)
@@ -138,14 +139,14 @@ func TestClassifierCataloger_DefaultClassifiers_PositiveCases_Image(t *testing.T
 		name         string
 		fixtureImage string
 		location     string
-		expected     []Classification
+		expected     []file.Classification
 		expectedErr  func(assert.TestingT, error, ...interface{}) bool
 	}{
 		{
 			name:         "busybox-regression",
 			fixtureImage: "image-busybox",
 			location:     "/bin/[",
-			expected: []Classification{
+			expected: []file.Classification{
 				{
 					Class: "busybox-binary",
 					Metadata: map[string]string{
@@ -160,7 +161,7 @@ func TestClassifierCataloger_DefaultClassifiers_PositiveCases_Image(t *testing.T
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 
-			c, err := NewClassificationCataloger(DefaultClassifiers)
+			c, err := NewCataloger(DefaultClassifiers())
 			test.expectedErr(t, err)
 
 			img := imagetest.GetFixtureImage(t, "docker-archive", test.fixtureImage)
@@ -191,7 +192,7 @@ func TestClassifierCataloger_DefaultClassifiers_PositiveCases_Image(t *testing.T
 
 func TestClassifierCataloger_DefaultClassifiers_NegativeCases(t *testing.T) {
 
-	c, err := NewClassificationCataloger(DefaultClassifiers)
+	c, err := NewCataloger(DefaultClassifiers())
 	assert.NoError(t, err)
 
 	src, err := source.NewFromDirectory("test-fixtures/classifiers/negative")

syft/cataloger/files/fileclassifier/classifier.go

@@ -1,4 +1,4 @@
-package file
+package fileclassifier
 
 import (
 	"bytes"
@@ -7,58 +7,10 @@ import (
 	"regexp"
 	"text/template"
 
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/syft/source"
-)
+	"github.com/anchore/syft/syft/file"
 
-var DefaultClassifiers = []Classifier{
-	{
-		Class: "python-binary",
-		FilepathPatterns: []*regexp.Regexp{
-			regexp.MustCompile(`(.*/|^)python(?P<version>[0-9]+\.[0-9]+)$`),
-			regexp.MustCompile(`(.*/|^)libpython(?P<version>[0-9]+\.[0-9]+).so.*$`),
-		},
-		EvidencePatternTemplates: []string{
-			`(?m)(?P<version>{{ .version }}\.[0-9]+[-_a-zA-Z0-9]*)`,
-		},
-	},
-	{
-		Class: "cpython-source",
-		FilepathPatterns: []*regexp.Regexp{
-			regexp.MustCompile(`(.*/|^)patchlevel.h$`),
-		},
-		EvidencePatternTemplates: []string{
-			`(?m)#define\s+PY_VERSION\s+"?(?P<version>[0-9\.\-_a-zA-Z]+)"?`,
-		},
-	},
-	{
-		Class: "go-binary",
-		FilepathPatterns: []*regexp.Regexp{
-			regexp.MustCompile(`(.*/|^)go$`),
-		},
-		EvidencePatternTemplates: []string{
-			`(?m)go(?P<version>[0-9]+\.[0-9]+(\.[0-9]+|beta[0-9]+|alpha[0-9]+|rc[0-9]+)?)`,
-		},
-	},
-	{
-		Class: "go-binary-hint",
-		FilepathPatterns: []*regexp.Regexp{
-			regexp.MustCompile(`(.*/|^)VERSION$`),
-		},
-		EvidencePatternTemplates: []string{
-			`(?m)go(?P<version>[0-9]+\.[0-9]+(\.[0-9]+|beta[0-9]+|alpha[0-9]+|rc[0-9]+)?)`,
-		},
-	},
-	{
-		Class: "busybox-binary",
-		FilepathPatterns: []*regexp.Regexp{
-			regexp.MustCompile(`(.*/|^)busybox$`),
-		},
-		EvidencePatternTemplates: []string{
-			`(?m)BusyBox\s+v(?P<version>[0-9]+\.[0-9]+\.[0-9]+)`,
-		},
-	},
-}
+	"github.com/anchore/syft/internal"
+)
 
 type Classifier struct {
 	Class                    string
@@ -66,12 +18,58 @@ type Classifier struct {
 	EvidencePatternTemplates []string
 }
 
-type Classification struct {
-	Class    string            `json:"class"`
-	Metadata map[string]string `json:"metadata"`
+func DefaultClassifiers() []Classifier {
+	return []Classifier{
+		{
+			Class: "python-binary",
+			FilepathPatterns: []*regexp.Regexp{
+				regexp.MustCompile(`(.*/|^)python(?P<version>[0-9]+\.[0-9]+)$`),
+				regexp.MustCompile(`(.*/|^)libpython(?P<version>[0-9]+\.[0-9]+).so.*$`),
+			},
+			EvidencePatternTemplates: []string{
+				`(?m)(?P<version>{{ .version }}\.[0-9]+[-_a-zA-Z0-9]*)`,
+			},
+		},
+		{
+			Class: "cpython-source",
+			FilepathPatterns: []*regexp.Regexp{
+				regexp.MustCompile(`(.*/|^)patchlevel.h$`),
+			},
+			EvidencePatternTemplates: []string{
+				`(?m)#define\s+PY_VERSION\s+"?(?P<version>[0-9\.\-_a-zA-Z]+)"?`,
+			},
+		},
+		{
+			Class: "go-binary",
+			FilepathPatterns: []*regexp.Regexp{
+				regexp.MustCompile(`(.*/|^)go$`),
+			},
+			EvidencePatternTemplates: []string{
+				`(?m)go(?P<version>[0-9]+\.[0-9]+(\.[0-9]+|beta[0-9]+|alpha[0-9]+|rc[0-9]+)?)`,
+			},
+		},
+		{
+			Class: "go-binary-hint",
+			FilepathPatterns: []*regexp.Regexp{
+				regexp.MustCompile(`(.*/|^)VERSION$`),
+			},
+			EvidencePatternTemplates: []string{
+				`(?m)go(?P<version>[0-9]+\.[0-9]+(\.[0-9]+|beta[0-9]+|alpha[0-9]+|rc[0-9]+)?)`,
+			},
+		},
+		{
+			Class: "busybox-binary",
+			FilepathPatterns: []*regexp.Regexp{
+				regexp.MustCompile(`(.*/|^)busybox$`),
+			},
+			EvidencePatternTemplates: []string{
+				`(?m)BusyBox\s+v(?P<version>[0-9]+\.[0-9]+\.[0-9]+)`,
+			},
+		},
+	}
 }
 
-func (c Classifier) Classify(resolver source.FileResolver, location source.Location) (*Classification, error) {
+func (c Classifier) Classify(resolver file.Resolver, location file.Location) (*file.Classification, error) {
 	doesFilepathMatch, filepathNamedGroupValues := filepathMatches(c.FilepathPatterns, location)
 	if !doesFilepathMatch {
 		return nil, nil
@@ -81,7 +79,7 @@ func (c Classifier) Classify(resolver source.FileResolver, location source.Locat
 	if err != nil {
 		return nil, err
 	}
-	defer internal.CloseAndLogError(contentReader, location.VirtualPath)
+	defer internal.CloseAndLogError(contentReader, location.AccessPath)
 
 	// TODO: there is room for improvement here, as this may use an excessive amount of memory. Alternate approach is to leverage a RuneReader.
 	contents, err := ioutil.ReadAll(contentReader)
@@ -89,7 +87,7 @@ func (c Classifier) Classify(resolver source.FileResolver, location source.Locat
 		return nil, err
 	}
 
-	var result *Classification
+	var result *file.Classification
 	for _, patternTemplate := range c.EvidencePatternTemplates {
 		tmpl, err := template.New("").Parse(patternTemplate)
 		if err != nil {
@@ -113,7 +111,7 @@ func (c Classifier) Classify(resolver source.FileResolver, location source.Locat
 
 		matchMetadata := internal.MatchNamedCaptureGroups(pattern, string(contents))
 		if result == nil {
-			result = &Classification{
+			result = &file.Classification{
 				Class:    c.Class,
 				Metadata: matchMetadata,
 			}
@@ -126,8 +124,8 @@ func (c Classifier) Classify(resolver source.FileResolver, location source.Locat
 	return result, nil
 }
 
-func filepathMatches(patterns []*regexp.Regexp, location source.Location) (bool, map[string]string) {
-	for _, path := range []string{location.RealPath, location.VirtualPath} {
+func filepathMatches(patterns []*regexp.Regexp, location file.Location) (bool, map[string]string) {
+	for _, path := range []string{location.RealPath, location.AccessPath} {
 		if path == "" {
 			continue
 		}

syft/cataloger/files/fileclassifier/classifier_test.go

@@ -1,25 +1,25 @@
-package file
+package fileclassifier
 
 import (
+	"github.com/anchore/syft/syft/file"
 	"regexp"
 	"testing"
 
-	"github.com/anchore/syft/syft/source"
 	"github.com/stretchr/testify/assert"
 )
 
 func TestFilepathMatches(t *testing.T) {
 	tests := []struct {
 		name                string
-		location            source.Location
+		location            file.Location
 		patterns            []string
 		expectedMatches     bool
 		expectedNamedGroups map[string]string
 	}{
 		{
 			name: "simple-filename-match",
-			location: source.Location{
-				Coordinates: source.Coordinates{
+			location: file.Location{
+				Coordinates: file.Coordinates{
 					RealPath: "python2.7",
 				},
 			},
@@ -30,8 +30,8 @@ func TestFilepathMatches(t *testing.T) {
 		},
 		{
 			name: "filepath-match",
-			location: source.Location{
-				Coordinates: source.Coordinates{
+			location: file.Location{
+				Coordinates: file.Coordinates{
 					RealPath: "/usr/bin/python2.7",
 				},
 			},
@@ -42,8 +42,8 @@ func TestFilepathMatches(t *testing.T) {
 		},
 		{
 			name: "virtual-filepath-match",
-			location: source.Location{
-				VirtualPath: "/usr/bin/python2.7",
+			location: file.Location{
+				AccessPath: "/usr/bin/python2.7",
 			},
 			patterns: []string{
 				`python([0-9]+\.[0-9]+)$`,
@@ -52,8 +52,8 @@ func TestFilepathMatches(t *testing.T) {
 		},
 		{
 			name: "full-filepath-match",
-			location: source.Location{
-				VirtualPath: "/usr/bin/python2.7",
+			location: file.Location{
+				AccessPath: "/usr/bin/python2.7",
 			},
 			patterns: []string{
 				`.*/bin/python([0-9]+\.[0-9]+)$`,
@@ -62,8 +62,8 @@ func TestFilepathMatches(t *testing.T) {
 		},
 		{
 			name: "anchored-filename-match-FAILS",
-			location: source.Location{
-				Coordinates: source.Coordinates{
+			location: file.Location{
+				Coordinates: file.Coordinates{
 					RealPath: "/usr/bin/python2.7",
 				},
 			},
@@ -74,7 +74,7 @@ func TestFilepathMatches(t *testing.T) {
 		},
 		{
 			name:     "empty-filename-match-FAILS",
-			location: source.Location{},
+			location: file.Location{},
 			patterns: []string{
 				`^python([0-9]+\.[0-9]+)$`,
 			},