Update write permissions and log into ghcr.io for release (#942)

Co-authored-by: Alex Goodman <alex.goodman@anchore.com>

.github/scripts/apple-signing/setup-prod.sh

@@ -21,6 +21,14 @@ fi
 if [ -z "$DOCKER_PASSWORD" ]; then
   exit_with_error "DOCKER_PASSWORD not set"
 fi
+
+if [ -z "$GHCR_USERNAME" ]; then
+  exit_with_error "GHCR_USERNAME not set"
+fi
+
+if [ -z "$GHCR_PASSWORD" ]; then
+  exit_with_error "GHCR_PASSWORD not set"
+fi
 set -u
 
 # setup_signing
@@ -41,4 +49,5 @@ setup_signing() {
 
   commentary "log into docker -- required for publishing (since the default keychain has now been replaced)"
   echo "${DOCKER_PASSWORD}" | docker login docker.io -u "${DOCKER_USERNAME}"  --password-stdin
+  echo "${GHCR_PASSWORD}" | docker login ghcr.io -u "${GHCR_USERNAME}"  --password-stdin
 }

.github/workflows/release.yaml

@@ -94,6 +94,8 @@ jobs:
     needs: [quality-gate]
     # due to our code signing process, it's vital that we run our release steps on macOS
     runs-on: macos-latest
+    permissions:
+      packages: write
     steps:
       - uses: docker-practice/actions-setup-docker@v1
 
@@ -128,6 +130,8 @@ jobs:
       - name: Build & publish release artifacts
         run: make release
         env:
+          GHCR_USERNAME: ${{ github.actor }}
+          GHCR_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
           DOCKER_USERNAME: ${{ secrets.TOOLBOX_DOCKER_USER }}
           DOCKER_PASSWORD: ${{ secrets.TOOLBOX_DOCKER_PASS }}
           # we use a different token than GITHUB_SECRETS to additionally allow updating the homebrew repos

.goreleaser.yaml

@@ -99,6 +99,11 @@ dockers:
       - "anchore/syft:{{ .Tag }}-amd64"
       - "anchore/syft:v{{ .Major }}-amd64"
       - "anchore/syft:v{{ .Major }}.{{ .Minor }}-amd64"
+      - "ghcr.io/anchore/syft:latest"
+      - "ghcr.io/anchore/syft:{{ .Tag }}-amd64"
+      - "ghcr.io/anchore/syft:v{{ .Major }}-amd64"
+      - "ghcr.io/anchore/syft:v{{ .Major }}.{{ .Minor }}-amd64"
+    goarch: amd64
     dockerfile: Dockerfile
     use: buildx
     build_flag_templates:
@@ -112,6 +117,9 @@ dockers:
       - "anchore/syft:{{ .Tag }}-arm64v8"
       - "anchore/syft:v{{ .Major }}-arm64v8"
       - "anchore/syft:v{{ .Major }}.{{ .Minor }}-arm64v8"
+      - "ghcr.io/anchore/syft:{{ .Tag }}-arm64v8"
+      - "ghcr.io/anchore/syft:v{{ .Major }}-arm64v8"
+      - "ghcr.io/anchore/syft:v{{ .Major }}.{{ .Minor }}-arm64v8"
     goarch: arm64
     dockerfile: Dockerfile
     use: buildx
@@ -131,3 +139,11 @@ docker_manifests:
     image_templates:
       - anchore/syft:v{{ .Major }}.{{ .Minor }}-amd64
       - anchore/syft:v{{ .Major }}.{{ .Minor }}-arm64v8
+  - name_template: ghcr.io/anchore/syft:{{ .Tag }}
+    image_templates:
+      - ghcr.io/anchore/syft:v{{ .Major }}.{{ .Minor }}-amd64
+      - ghcr.io/anchore/syft:v{{ .Major }}.{{ .Minor }}-arm64v8
+  - name_template: ghcr.io/anchore/syft:latest
+    image_templates:
+      - ghcr.io/anchore/syft:v{{ .Major }}.{{ .Minor }}-amd64
+      - ghcr.io/anchore/syft:v{{ .Major }}.{{ .Minor }}-arm64v8

README.md

@@ -9,15 +9,7 @@
 [![License: Apache-2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://github.com/anchore/syft/blob/main/LICENSE)
 [![Slack Invite](https://img.shields.io/badge/Slack-Join-blue?logo=slack)](https://anchore.com/slack)
 
-A CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Exceptional for vulnerability detection when used with a scanner tool like [Grype](https://github.com/anchore/grype).
-
-### Join our Virtual OSS Meetup!
-
-You are invited to join us on March 23rd, 11AM-Noon PT for our virtual open source meetup.  
-
-Hosts Priyanka “Pinky” Ravi of Weaveworks and Dan Luhring from Anchore OSS will explore how open source project Flux is utilizing Syft-generated SBOMs to secure the software supply chain.
-
-[Register here!](https://get.anchore.com/anchore-oss-meetup-mar-23-2022/)
+A CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Exceptional for vulnerability detection when used with a scanner like [Grype](https://github.com/anchore/grype).
 
 ### Join our community meetings!
 
@@ -28,15 +20,26 @@ Hosts Priyanka “Pinky” Ravi of Weaveworks and Dan Luhring from Anchore OSS w
 ![syft-demo](https://user-images.githubusercontent.com/590471/90277200-2a253000-de33-11ea-893f-32c219eea11a.gif)
 
 ## Features
-- Catalog container images and filesystems to discover packages and libraries.
-- Generate in-toto attestations where an SBOM is included as the payload.
-- Supports packages and libraries from various ecosystems (APK, DEB, RPM, Ruby Bundles, Python Wheel/Egg/requirements.txt, JavaScript NPM/Yarn, Java JAR/EAR/WAR/PAR/SAR, Jenkins plugins JPI/HPI, Go modules, PHP Composer)
-- Linux distribution identification (supports Alpine, BusyBox, CentOS/RedHat, Debian/Ubuntu flavored distributions)
-- Supports Docker and OCI image formats
-- Direct support for [Grype](https://github.com/anchore/grype), a fast and powerful vulnerability matcher.
+- Generates SBOMs for container images, filesystems, archives, and more to discover packages and libraries
+- Supports OCI and Docker image formats
+- Linux distribution identification
+- Works seamlessly with [Grype](https://github.com/anchore/grype) (a fast, modern vulnerability scanner)
+- Able to create signed SBOM attestations using the [in-toto specification](https://github.com/in-toto/attestation/blob/main/spec/README.md)
 
+### Supported Ecosystems
 
-If you encounter an issue, please [let us know using the issue tracker](https://github.com/anchore/syft/issues).
+- Alpine (apk)
+- Dart (pubs)
+- Debian (dpkg)
+- Go (go.mod, Go binaries)
+- Java (jar, ear, war, par, sar)
+- JavaScript (npm, yarn)
+- Jenkins Plugins (jpi, hpi)
+- PHP (composer)
+- Python (wheel, egg, poetry, requirements.txt)
+- Red Hat (rpm)
+- Ruby (gem)
+- Rust (cargo.lock)
 
 ## Installation
 
@@ -61,15 +64,13 @@ brew install syft
 
 ### Nix
 
-**Note**: nix packaging of Syft is [community maintained](https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/admin/syft/default.nix)
-
-Also syft is currently only in the [unstable channel](https://nixos.wiki/wiki/Nix_channels#The_official_channels) awaiting the `22.05` release
+**Note**: Nix packaging of Syft is [community maintained](https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/admin/syft/default.nix). Syft is currently only in the [unstable channel](https://nixos.wiki/wiki/Nix_channels#The_official_channels) awaiting the `22.05` release
 
 ```bash
 nix-env -i syft
 ```
 
-... or, just try it out in an ephemeral nix shell
+... or, just try it out in an ephemeral nix shell:
 
 ```bash
 nix-shell -p syft
@@ -78,33 +79,28 @@ nix-shell -p syft
 ## Getting started
 
 #### SBOM
-To generate an SBOM for an OCI image:
+
+To generate an SBOM for a container image:
+
 ```
 syft <image>
 ```
 
-**Note**: This is equivalent to specifying the `packages` subcommand:
-```
-syft packages <image>
-```
-
-The above output includes only software that is visible in the container (i.e., the squashed representation of the image).
-To include software from all image layers in the SBOM, regardless of its presence in the final image, provide `--scope all-layers`:
+The above output includes only software that is visible in the container (i.e., the squashed representation of the image). To include software from all image layers in the SBOM, regardless of its presence in the final image, provide `--scope all-layers`:
 
 ```
-syft packages <image> --scope all-layers
+syft <image> --scope all-layers
 ```
 
-#### SBOM Attestation
-To generate an attested SBOM for an OCI image as the predicate of an in-toto attestation
+#### SBOM attestation
+
+To generate an SBOM attestation for a container image:
 ```
 syft attest --output [FORMAT] --key [KEY] [SOURCE] [flags]
 ```
 
 The above output is in the form of the [DSSE envelope](https://github.com/secure-systems-lab/dsse/blob/master/envelope.md#dsse-envelope).
-The payload is a base64 encoded `in-toto` statement with the SBOM as the predicate, the payload type is `application/vnd.in-toto+json`, and the signatures array is populated
-with the contents needed for public key verification. For details on workflows using this command see [here](#adding-an-sbom-to-an-image-as-an-attestation-using-syft).
-
+The payload is a base64 encoded `in-toto` statement with the generated SBOM as the predicate. For details on workflows using this command see [here](#adding-an-sbom-to-an-image-as-an-attestation-using-syft).
 
 ### Supported sources
 
@@ -112,10 +108,10 @@ Syft can generate a SBOM from a variety of sources:
 
 ```
 # catalog a container image archive (from the result of `docker image save ...`, `podman save ...`, or `skopeo copy` commands)
-syft packages path/to/image.tar
+syft path/to/image.tar
 
 # catalog a directory
-syft packages path/to/dir
+syft path/to/dir
 ```
 
 Sources can be explicitly provided with a scheme:
@@ -154,7 +150,7 @@ The output format for Syft is configurable as well using the
 `-o` (or `--output`) option:
 
 ```
-syft packages <image> -o <format>
+syft <image> -o <format>
 ```
 
 Where the `formats` available are:
@@ -172,20 +168,16 @@ Syft can also output _multiple_ files in differing formats by appending
 `=<file>` to the option, for example to output Syft JSON and SPDX JSON:
 
 ```shell
-syft packages <image> -o json=sbom.syft.json -o spdx-json=sbom.spdx.json
+syft <image> -o json=sbom.syft.json -o spdx-json=sbom.spdx.json
 ```
 
 ## Private Registry Authentication
 
 ### Local Docker Credentials
-When a container runtime is not present, Syft can still utilize credentials configured in common credential sources (such as `~/.docker/config.json`). 
-It will pull images from private registries using these credentials. The config file is where your credentials are stored when authenticating with private registries via some command like `docker login`. 
-For more information see the `go-containerregistry` [documentation](https://github.com/google/go-containerregistry/tree/main/pkg/authn).
-
+When a container runtime is not present, Syft can still utilize credentials configured in common credential sources (such as `~/.docker/config.json`). It will pull images from private registries using these credentials. The config file is where your credentials are stored when authenticating with private registries via some command like `docker login`. For more information see the `go-containerregistry` [documentation](https://github.com/google/go-containerregistry/tree/main/pkg/authn).
 
 An example `config.json` looks something like this:
-```
-// config.json
+```json
 {
 	"auths": {
 		"registry.example.com": {
@@ -198,15 +190,17 @@ An example `config.json` looks something like this:
 
 You can run the following command as an example. It details the mount/environment configuration a container needs to access a private registry:
 
-`docker run -v ./config.json:/config/config.json -e "DOCKER_CONFIG=/config" anchore/syft:latest  <private_image>`
-
+```
+docker run -v ./config.json:/config/config.json -e "DOCKER_CONFIG=/config" anchore/syft:latest  <private_image>
+```
 
 ### Docker Credentials in Kubernetes
-The below section shows a simple workflow on how to mount this config file as a secret into a container on kubernetes.
-1. Create a secret. The value of `config.json` is important. It refers to the specification detailed [here](https://github.com/google/go-containerregistry/tree/main/pkg/authn#the-config-file). 
-Below this section is the `secret.yaml` file that the pod configuration will consume as a volume. 
-The key `config.json` is important. It will end up being the name of the file when mounted into the pod.
-    ```
+
+Here's a simple workflow to mount this config file as a secret into a container on Kubernetes.
+
+1. Create a secret. The value of `config.json` is important. It refers to the specification detailed [here](https://github.com/google/go-containerregistry/tree/main/pkg/authn#the-config-file). Below this section is the `secret.yaml` file that the pod configuration will consume as a volume. The key `config.json` is important. It will end up being the name of the file when mounted into the pod.
+
+    ```yaml
     # secret.yaml
     
     apiVersion: v1
@@ -221,11 +215,9 @@ The key `config.json` is important. It will end up being the name of the file wh
     `kubectl apply -f secret.yaml`
 
 
-2. Create your pod running syft. The env `DOCKER_CONFIG` is important because it advertises where to look for the credential file. 
-In the below example, setting `DOCKER_CONFIG=/config` informs syft that credentials can be found at `/config/config.json`. 
-This is why we used `config.json` as the key for our secret. When mounted into containers the secrets' key is used as the filename. 
-The `volumeMounts` section mounts our secret to `/config`. The `volumes` section names our volume and leverages the secret we created in step one.
-    ```
+2. Create your pod running syft. The env `DOCKER_CONFIG` is important because it advertises where to look for the credential file. In the below example, setting `DOCKER_CONFIG=/config` informs syft that credentials can be found at `/config/config.json`. This is why we used `config.json` as the key for our secret. When mounted into containers the secrets' key is used as the filename. The `volumeMounts` section mounts our secret to `/config`. The `volumes` section names our volume and leverages the secret we created in step one.
+
+    ```yaml
     # pod.yaml
     
     apiVersion: v1
@@ -254,10 +246,9 @@ The `volumeMounts` section mounts our secret to `/config`. The `volumes` section
     `kubectl apply -f pod.yaml`
 
 
-3. The user can now run `kubectl logs syft-private-registry-demo`. The logs should show the syft analysis for the `<private_image>` provided in the pod configuration.
+3. The user can now run `kubectl logs syft-private-registry-demo`. The logs should show the Syft analysis for the `<private_image>` provided in the pod configuration.
 
-Using the above information, users should be able to configure private registry access without having to do so in the `grype` or `syft` configuration files.
-They will also not be dependent on a docker daemon, (or some other runtime software) for registry configuration and access.
+Using the above information, users should be able to configure private registry access without having to do so in the `grype` or `syft` configuration files.  They will also not be dependent on a Docker daemon, (or some other runtime software) for registry configuration and access.
 
 ## Configuration
 
@@ -472,26 +463,25 @@ anchore:
 
 `syft attest --output [FORMAT] --key [KEY] [SOURCE] [flags]`
 
-SBOMs themselves can serve as input to different analysis tools. The Anchore organization offers the vulnerability scanner
-[grype](https://github.com/anchore/grype) as one such tool.
-One of the foundational approaches to "trust" between tools is for producers to use the artifacts generated by syft as attestations to their images.
-The DSSE output of `syft attest` can be used with the [cosign](https://github.com/sigstore/cosign) tool to attach an attestation to an image.
+SBOMs themselves can serve as input to different analysis tools. [Grype](https://github.com/anchore/grype), a vulnerability scanner CLI tool from Anchore, is one such tool. Publishers of container images can use attestations to enable their consumers to trust Syft-generated SBOM descriptions of those container images. To create and provide these attestations, image publishers can run `syft attest` in conjunction with the [cosign](https://github.com/sigstore/cosign) tool to attach SBOM attestations to their images.
 
-#### Example attest
+#### Example attestation
 Note for the following example replace `docker.io/image:latest` with an image you own. You should also have push access to 
-its remote reference. Replace $MY_PRIVATE_KEY with a private key you own or have generated with cosign.
+its remote reference. Replace `$MY_PRIVATE_KEY` with a private key you own or have generated with cosign.
 
 ```bash
 syft attest --key $MY_PRIVATE_KEY docker.io/image:latest > image_latest_sbom_attestation.json
 cosign attach attestation --attestation image_latest_sbom_attestation.json docker.io/image:latest
 ```
 
-Verify the new attestation exists on your image
+Verify the new attestation exists on your image.
+
 ```bash
 cosign verify-attestation -key $MY_PUBLIC_KEY docker.io/image:latest | jq '.payload | @base64d | .payload | fromjson | .predicate'
 ```
 
-You should see this output along with the attached SBOM.
+You should see this output along with the attached SBOM:
+
 ```
 Verification for docker.io/image:latest --
 The following checks were performed on each of these signatures:

go.mod

@@ -14,7 +14,7 @@ require (
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.1.1-0.20220314153042-1bcd40e5206b
-	github.com/anchore/stereoscope v0.0.0-20220322123031-7a744f443e99
+	github.com/anchore/stereoscope v0.0.0-20220406160859-c03a18a6b270
 	github.com/antihax/optional v1.0.0
 	github.com/bmatcuk/doublestar/v4 v4.0.2
 	github.com/dustin/go-humanize v1.0.0
@@ -34,7 +34,8 @@ require (
 	github.com/olekukonko/tablewriter v0.0.5
 	github.com/pelletier/go-toml v1.9.4
 	github.com/pkg/profile v1.5.0
-	github.com/scylladb/go-set v1.0.2
+	// pinned to pull in 386 arch fix: https://github.com/scylladb/go-set/commit/cc7b2070d91ebf40d233207b633e28f5bd8f03a5
+	github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e
 	github.com/sergi/go-diff v1.2.0
 	github.com/sigstore/sigstore v1.1.1-0.20220217212907-e48ca03a5ba7
 	github.com/sirupsen/logrus v1.8.1
@@ -69,7 +70,6 @@ require (
 	cloud.google.com/go/kms v1.3.0 // indirect
 	cloud.google.com/go/storage v1.21.0 // indirect
 	github.com/Azure/azure-sdk-for-go v61.5.0+incompatible // indirect
-	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
 	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
 	github.com/Azure/go-autorest/autorest v0.11.24 // indirect
 	github.com/Azure/go-autorest/autorest/adal v0.9.18 // indirect
@@ -80,7 +80,6 @@ require (
 	github.com/Azure/go-autorest/autorest/validation v0.3.1 // indirect
 	github.com/Azure/go-autorest/logger v0.2.1 // indirect
 	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
-	github.com/Microsoft/hcsshim v0.8.23 // indirect
 	github.com/PaesslerAG/gval v1.0.0 // indirect
 	github.com/PaesslerAG/jsonpath v0.1.1 // indirect
 	github.com/PuerkitoBio/purell v1.1.1 // indirect
@@ -122,14 +121,11 @@ require (
 	github.com/cpuguy83/go-md2man/v2 v2.0.1 // indirect
 	github.com/cyberphone/json-canonicalization v0.0.0-20210823021906-dc406ceaf94b // indirect
 	github.com/dimchansky/utfbom v1.1.1 // indirect
-	github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c // indirect
-	github.com/docker/go-metrics v0.0.1 // indirect
 	github.com/envoyproxy/go-control-plane v0.10.1 // indirect
 	github.com/envoyproxy/protoc-gen-validate v0.6.2 // indirect
 	github.com/fatih/color v1.13.0 // indirect
 	github.com/form3tech-oss/jwt-go v3.2.5+incompatible // indirect
 	github.com/fullstorydev/grpcurl v1.8.2 // indirect
-	github.com/fvbommel/sortorder v1.0.2 // indirect
 	github.com/ghodss/yaml v1.0.0 // indirect
 	github.com/go-chi/chi v4.1.2+incompatible // indirect
 	github.com/go-logr/logr v1.2.2 // indirect
@@ -160,7 +156,6 @@ require (
 	github.com/google/trillian v1.4.0 // indirect
 	github.com/googleapis/gax-go/v2 v2.1.1 // indirect
 	github.com/googleapis/gnostic v0.5.5 // indirect
-	github.com/gorilla/mux v1.8.0 // indirect
 	github.com/gorilla/websocket v1.4.2 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
@@ -195,12 +190,8 @@ require (
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-testing-interface v1.14.1 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
-	github.com/moby/sys/mount v0.3.1 // indirect
-	github.com/moby/sys/mountinfo v0.6.0 // indirect
-	github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
-	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/oklog/run v1.1.0 // indirect
 	github.com/oklog/ulid v1.3.1 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
@@ -225,7 +216,6 @@ require (
 	github.com/tent/canonical-json-go v0.0.0-20130607151641-96e4ba3a7613 // indirect
 	github.com/thales-e-security/pool v0.0.2 // indirect
 	github.com/theupdateframework/go-tuf v0.0.0-20220211205608-f0c3294f63b9 // indirect
-	github.com/theupdateframework/notary v0.7.0 // indirect
 	github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802 // indirect
 	github.com/urfave/cli v1.22.5 // indirect
 	github.com/xanzy/go-gitlab v0.56.0 // indirect

go.sum

@@ -218,7 +218,6 @@ github.com/Microsoft/hcsshim v0.8.14/go.mod h1:NtVKoYxQuTLx6gEq0L96c9Ju4JbRJ4nY2
 github.com/Microsoft/hcsshim v0.8.15/go.mod h1:x38A4YbHbdxJtc0sF6oIz+RG0npwSCAvn69iY6URG00=
 github.com/Microsoft/hcsshim v0.8.16/go.mod h1:o5/SZqmR7x9JNKsW3pu+nqHm0MF8vbA+VxGOoXdC600=
 github.com/Microsoft/hcsshim v0.8.21/go.mod h1:+w2gRZ5ReXQhFOrvSQeNfhrYB/dg3oDwTOcER2fw4I4=
-github.com/Microsoft/hcsshim v0.8.23 h1:47MSwtKGXet80aIn+7h4YI6fwPmwIghAnsx2aOUrG2M=
 github.com/Microsoft/hcsshim v0.8.23/go.mod h1:4zegtUJth7lAvFyc6cH2gGQ5B3OFQim01nnU2M8jKDg=
 github.com/Microsoft/hcsshim/test v0.0.0-20201218223536-d3e5debf77da/go.mod h1:5hlzMzRKMLyo42nCZ9oml8AdTlq/0cvIaBv6tK1RehU=
 github.com/Microsoft/hcsshim/test v0.0.0-20210227013316-43a75bb4edd3/go.mod h1:mw7qgWloBUl75W/gVH3cQszUg1+gUITj7D6NY7ywVnY=
@@ -239,8 +238,6 @@ github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdko
 github.com/ReneKroon/ttlcache/v2 v2.10.0/go.mod h1:mBxvsNY+BT8qLLd6CuAJubbKo6r0jh3nb5et22bbfGY=
 github.com/ReneKroon/ttlcache/v2 v2.11.0 h1:OvlcYFYi941SBN3v9dsDcC2N8vRxyHcCmJb3Vl4QMoM=
 github.com/ReneKroon/ttlcache/v2 v2.11.0/go.mod h1:mBxvsNY+BT8qLLd6CuAJubbKo6r0jh3nb5et22bbfGY=
-github.com/Shopify/logrus-bugsnag v0.0.0-20170309145241-6dbc35f2c30d/go.mod h1:HI8ITrYtUY+O+ZhtlqUnD8+KwNPOyugEhfP9fdUIaEQ=
-github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d h1:UrqY+r/OJnIp5u0s1SbQ8dVfLCZJsnvazdBP5hS4iRs=
 github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d/go.mod h1:HI8ITrYtUY+O+ZhtlqUnD8+KwNPOyugEhfP9fdUIaEQ=
 github.com/Shopify/sarama v1.19.0/go.mod h1:FVkBWblsNy7DGZRfXLU0O9RCGt5g3g3yEuWXgklEdEo=
 github.com/Shopify/sarama v1.30.0/go.mod h1:zujlQQx1kzHsh4jfV1USnptCQrHAEZ2Hk8fTKCulPVs=
@@ -283,8 +280,8 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZV
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/packageurl-go v0.1.1-0.20220314153042-1bcd40e5206b h1:YJWYt/6KQXR9JR46lLHrTTYi8rcye42tKcyjREA/hvA=
 github.com/anchore/packageurl-go v0.1.1-0.20220314153042-1bcd40e5206b/go.mod h1:Blo6OgJNiYF41ufcgHKkbCKF2MDOMlrqhXv/ij6ocR4=
-github.com/anchore/stereoscope v0.0.0-20220322123031-7a744f443e99 h1:npngzwfM+fmA56VslKxrcKNhGa2W8MMnASQ1CpuZ1ZA=
-github.com/anchore/stereoscope v0.0.0-20220322123031-7a744f443e99/go.mod h1:By2EeOMx9BCf44Wu92W/gsarFKB2Yj921IANAw2Pj1k=
+github.com/anchore/stereoscope v0.0.0-20220406160859-c03a18a6b270 h1:NmxPDR6vo3xjwCL6o+tpF1vUad/BVo+WaVSwueB9W9w=
+github.com/anchore/stereoscope v0.0.0-20220406160859-c03a18a6b270/go.mod h1:yoCLUZY0k/pYLNIy0L80p2Ko0PKVNXm8rHtgxp4OiSc=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.0.0/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
 github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
@@ -409,7 +406,6 @@ github.com/beevik/etree v1.1.0/go.mod h1:r8Aw8JqVegEf0w2fDnATrX9VpkMcyFeM0FhwO62
 github.com/benbjohnson/clock v1.0.3/go.mod h1:bGMdMPoPVvcYyt1gHDf4J2KE153Yf9BuiUKYMaxlTDM=
 github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLju8=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
-github.com/beorn7/perks v0.0.0-20150223135152-b965b613227f/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v0.0.0-20160804104726-4c0e84591b9a/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
@@ -417,7 +413,6 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQkY=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/bitly/go-hostpool v0.1.0/go.mod h1:4gOCgp6+NZnVqlKyZ/iBZFTAJKembaVENUpMkpg42fw=
 github.com/bitly/go-simplejson v0.5.0/go.mod h1:cXHtHw4XUPsvGaxgjIAn8PhEWG9NfngEKAMDJEczWVA=
 github.com/bits-and-blooms/bitset v1.2.0/go.mod h1:gIdJ4wp64HaoK2YrL1Q5/N7Y16edYb8uY+O0FJTyyDA=
 github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c/go.mod h1:MKsuJmJgSg28kpZDP6UIiPt0e0Oz0kqKNGyRaWEPv84=
@@ -442,11 +437,7 @@ github.com/breml/bidichk v0.1.1/go.mod h1:zbfeitpevDUGI7V91Uzzuwrn4Vls8MoBMrwtt7
 github.com/bshuster-repo/logrus-logstash-hook v0.4.1/go.mod h1:zsTqEiSzDgAa/8GZR7E1qaXrhYNDKBYy5/dWPTIflbk=
 github.com/buger/jsonparser v0.0.0-20180808090653-f4dd9f5a6b44/go.mod h1:bbYlZJ7hK1yFx9hf58LP0zeX7UjIGs20ufpu3evjr+s=
 github.com/bugsnag/bugsnag-go v0.0.0-20141110184014-b1d153021fcd/go.mod h1:2oa8nejYd4cQ/b0hMIopN0lCRxU0bueqREvZLWFrtK8=
-github.com/bugsnag/bugsnag-go v1.0.5-0.20150529004307-13fd6b8acda0 h1:s7+5BfS4WFJoVF9pnB8kBk03S7pZXRdKamnV0FOl5Sc=
-github.com/bugsnag/bugsnag-go v1.0.5-0.20150529004307-13fd6b8acda0/go.mod h1:2oa8nejYd4cQ/b0hMIopN0lCRxU0bueqREvZLWFrtK8=
-github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b h1:otBG+dV+YK+Soembjv71DPz3uX/V/6MMlSyD9JBQ6kQ=
 github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b/go.mod h1:obH5gd0BsqsP2LwDJ9aOkm/6J86V6lyAXCoQWGw3K50=
-github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0 h1:nvj0OLI3YqYXer/kZD8Ri1aaunCxIEsOst1BVJswV0o=
 github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0/go.mod h1:D/8v3kj0zr8ZAKg1AQ6crr+5VwKN5eIywRkfhyM/+dE=
 github.com/butuzov/ireturn v0.1.1/go.mod h1:Wh6Zl3IMtTpaIKbmwzqi6olnM9ptYQxxVacMsOEFPoc=
 github.com/c2h5oh/datasize v0.0.0-20171227191756-4eba002a5eae/go.mod h1:S/7n9copUssQ56c7aAgHqftWO4LTf4xY6CGWt8Bc+3M=
@@ -491,8 +482,6 @@ github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6D
 github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I=
 github.com/clbanning/x2j v0.0.0-20191024224557-825249438eec/go.mod h1:jMjuTZXRI4dUb/I5gc9Hdhagfvm9+RyrPryS/auMzxE=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cloudflare/cfssl v0.0.0-20180223231731-4e2dcbde5004 h1:lkAMpLVBDaj17e85keuznYcH5rqI438v41pKcBl4ZxQ=
-github.com/cloudflare/cfssl v0.0.0-20180223231731-4e2dcbde5004/go.mod h1:yMWuSON2oQp+43nFtAV/uvKQIFpSPerB57DCt9t8sSA=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
@@ -561,7 +550,6 @@ github.com/containerd/continuity v0.0.0-20191127005431-f65d91d395eb/go.mod h1:GL
 github.com/containerd/continuity v0.0.0-20200710164510-efbc4488d8fe/go.mod h1:cECdGN1O8G9bgKTlLhuPJimka6Xb/Gg7vYzCTNVxhvo=
 github.com/containerd/continuity v0.0.0-20201208142359-180525291bb7/go.mod h1:kR3BEg7bDFaEddKm54WSmrol1fKWDU1nKYkgrcgZT7Y=
 github.com/containerd/continuity v0.0.0-20210208174643-50096c924a4e/go.mod h1:EXlVlkqNba9rJe3j7w3Xa924itAMLgZH4UD/Q4PExuQ=
-github.com/containerd/continuity v0.1.0 h1:UFRRY5JemiAhPZrr/uE0n8fMTLcZsUvySPr1+D7pgr8=
 github.com/containerd/continuity v0.1.0/go.mod h1:ICJu0PwR54nI0yPEnJ6jcS+J7CZAUXrLh8lPo2knzsM=
 github.com/containerd/fifo v0.0.0-20180307165137-3d5202aec260/go.mod h1:ODA38xgv3Kuk8dQz2ZQXpnv/UZZUHUCL7pnLehbXgQI=
 github.com/containerd/fifo v0.0.0-20190226154929-a9fb20d87448/go.mod h1:ODA38xgv3Kuk8dQz2ZQXpnv/UZZUHUCL7pnLehbXgQI=
@@ -638,7 +626,6 @@ github.com/cpuguy83/go-md2man/v2 v2.0.1 h1:r/myEWzV9lfsM1tFLgDyu0atFtJ1fXn261LKY
 github.com/cpuguy83/go-md2man/v2 v2.0.1/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/creack/pty v1.1.11 h1:07n33Z8lZxZ2qwegKbObQohDhXDQxiMMz1NOUGYlesw=
 github.com/creack/pty v1.1.11/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/cyberphone/json-canonicalization v0.0.0-20210303052042-6bc126869bf4/go.mod h1:uzvlm1mxhHkdfqitSA92i7Se+S9ksOn3a3qmv/kyOCw=
 github.com/cyberphone/json-canonicalization v0.0.0-20210823021906-dc406ceaf94b h1:lMzA7yYThpwx7iYNpTeiQnRH6h5JSfSYMJdz+pxZOW8=
@@ -658,7 +645,6 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/denis-tingajkin/go-header v0.4.2/go.mod h1:eLRHAVXzE5atsKAnNRDB90WHCFFnBUn4RN0nRcs1LJA=
-github.com/denisenkom/go-mssqldb v0.0.0-20191128021309-1d7a30a10f73/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
 github.com/denisenkom/go-mssqldb v0.11.0/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
 github.com/denverdino/aliyungo v0.0.0-20190125010748-a747050bb1ba/go.mod h1:dV8lFg6daOBZbT6/BDGIz6Y3WFGn8juu6G+CQ6LHtl0=
 github.com/devigned/tab v0.1.1/go.mod h1:XG9mPq0dFghrYvoBF3xdRrJzSTX1b7IQrvaL9mzjeJY=
@@ -688,21 +674,16 @@ github.com/docker/docker v20.10.12+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05
 github.com/docker/docker-credential-helpers v0.6.3/go.mod h1:WRaJzqw3CTB9bk10avuGsjVBZsD05qeibJ1/TYlvc0Y=
 github.com/docker/docker-credential-helpers v0.6.4 h1:axCks+yV+2MR3/kZhAmy07yC56WZ2Pwu/fKWtKuZB0o=
 github.com/docker/docker-credential-helpers v0.6.4/go.mod h1:ofX3UI0Gz1TteYBjtgs07O36Pyasyp66D2uKT7H8W1c=
-github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c h1:lzqkGL9b3znc+ZUgi7FlLnqjQhcXxkNM/quxIjBVMD0=
-github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c/go.mod h1:CADgU4DSXK5QUlFslkQu2yW2TKzFZcXq/leZfM0UH5Q=
 github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
 github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
 github.com/docker/go-events v0.0.0-20170721190031-9461782956ad/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-metrics v0.0.0-20180209012529-399ea8c73916/go.mod h1:/u0gXw0Gay3ceNrsHubL3BtdOL2fHf93USgMTe0W5dI=
-github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8=
 github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHzueweSI3Vw=
 github.com/docker/go-units v0.3.3/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/docker/go-units v0.4.0 h1:3uh0PgVws3nIA0Q+MwDC8yjEPf9zjRfZZWXZYDct3Tw=
 github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/docker/libtrust v0.0.0-20150114040149-fa567046d9b1/go.mod h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE=
-github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 h1:UhxFibDNY/bfvqU5CAUmr9zpesgbU6SWc8/B4mflAE4=
-github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7/go.mod h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE=
 github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
 github.com/dsnet/compress v0.0.1/go.mod h1:Aw8dCMJ7RioblQeTqt88akK31OvO8Dhf5JflhBbQEHo=
@@ -712,7 +693,6 @@ github.com/dsnet/golib v0.0.0-20171103203638-1ea166775780/go.mod h1:Lj+Z9rebOhdf
 github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/dustin/go-humanize v1.0.0 h1:VSnTsYCnlFHaM2/igO1h6X3HA71jcobQuxemgkq4zYo=
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
-github.com/dvsekhvalnov/jose2go v0.0.0-20170216131308-f21a8cedbbae/go.mod h1:7BvyPhdbLxMXIYTFPLsyJRFMsKmOZnQmzh6Gb+uquuM=
 github.com/dvyukov/go-fuzz v0.0.0-20210914135545-4980593459a1/go.mod h1:11Gm+ccJnvAhCNLlf5+cS9KjtbaD5I5zaZpFMsTHWTw=
 github.com/eapache/go-resiliency v1.1.0/go.mod h1:kFI+JgMyC7bLPUVY133qvEBtVayf5mFgVsvEsIPBvNs=
 github.com/eapache/go-resiliency v1.2.0/go.mod h1:kFI+JgMyC7bLPUVY133qvEBtVayf5mFgVsvEsIPBvNs=
@@ -739,7 +719,6 @@ github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7
 github.com/envoyproxy/protoc-gen-validate v0.3.0-java/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/envoyproxy/protoc-gen-validate v0.6.2 h1:JiO+kJTpmYGjEodY7O1Zk8oZcNz1+f30UtwtXoFUPzE=
 github.com/envoyproxy/protoc-gen-validate v0.6.2/go.mod h1:2t7qjJNvHPx8IjnBOzl9E9/baC+qXE/TeeyBRzgJDws=
-github.com/erikstmartin/go-testdb v0.0.0-20160219214506-8d10e4a1bae5/go.mod h1:a2zkGnVExMxdzMo3M0Hi/3sEU+cWnZpSni0O6/Yb/P0=
 github.com/esimonov/ifshort v1.0.3/go.mod h1:yZqNJUrNn20K8Q9n2CrjTKYyVEmX209Hgu+M1LBpeZE=
 github.com/etcd-io/gofail v0.0.0-20190801230047-ad7f989257ca/go.mod h1:49H/RkXP8pKaZy4h0d+NW16rSLhyVBt4o6VLJbmOqDE=
 github.com/ettle/strcase v0.1.1/go.mod h1:hzDLsPC7/lwKyBOywSHEP89nt2pDgdy+No1NBA9o9VY=
@@ -786,8 +765,6 @@ github.com/fullstorydev/grpcurl v1.8.0/go.mod h1:Mn2jWbdMrQGJQ8UD62uNyMumT2acsZU
 github.com/fullstorydev/grpcurl v1.8.1/go.mod h1:3BWhvHZwNO7iLXaQlojdg5NA6SxUDePli4ecpK1N7gw=
 github.com/fullstorydev/grpcurl v1.8.2 h1:2II5e++aFnctnPJir3GL6cPSwF69Ord1u/9O+fv1vrI=
 github.com/fullstorydev/grpcurl v1.8.2/go.mod h1:YvWNT3xRp2KIRuvCphFodG0fKkMXwaxA9CJgKCcyzUQ=
-github.com/fvbommel/sortorder v1.0.2 h1:mV4o8B2hKboCdkJm+a7uX/SIpZob4JzUpc5GGnM45eo=
-github.com/fvbommel/sortorder v1.0.2/go.mod h1:uk88iVf1ovNn1iLfgUVU2F9o5eO30ui720w+kxuqRs0=
 github.com/fzipp/gocyclo v0.3.1/go.mod h1:DJHO6AUmbdqj2ET4Z9iArSuwWgYDRryYt2wASxc7x3E=
 github.com/gabriel-vasile/mimetype v1.4.0 h1:Cn9dkdYsMIu56tGho+fqzh7XmvY2YyGU0FnbhiOsEro=
 github.com/gabriel-vasile/mimetype v1.4.0/go.mod h1:fA8fi6KUiG7MgQQ+mEWotXoEOvmxRtOJlERCzSmRvr8=
@@ -957,7 +934,6 @@ github.com/go-restruct/restruct v1.2.0-alpha h1:2Lp474S/9660+SJjpVxoKuWX09JsXHSr
 github.com/go-restruct/restruct v1.2.0-alpha/go.mod h1:KqrpKpn4M8OLznErihXTGLlsXFGeLxHUrLRRI/1YjGk=
 github.com/go-rod/rod v0.101.8/go.mod h1:N/zlT53CfSpq74nb6rOR0K8UF0SPUPBmzBnArrms+mY=
 github.com/go-rod/rod v0.102.1/go.mod h1:RXSLAlPodTFOmZnwaAQJIcOJ1i835r0uuTGPLO09t/M=
-github.com/go-sql-driver/mysql v1.3.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-sql-driver/mysql v1.4.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
@@ -1022,7 +998,6 @@ github.com/gofrs/flock v0.8.1/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14j
 github.com/gogo/googleapis v1.1.0/go.mod h1:gf4bu3Q80BeJ6H1S1vYPm8/ELATdvryBaNFGgqEef3s=
 github.com/gogo/googleapis v1.2.0/go.mod h1:Njal3psf3qN6dwBtQfUmBZh2ybovJ0tlu3o/AC7HYjU=
 github.com/gogo/googleapis v1.4.0/go.mod h1:5YRNX2z1oM5gXdAkurHa942MDgEJyk02w4OecKY87+c=
-github.com/gogo/protobuf v1.0.0/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.2.0/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
@@ -1105,7 +1080,6 @@ github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Z
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.1 h1:gK4Kx5IaGY9CD5sPJ36FHiBJ6ZXl0kilRiiCj+jdYp4=
 github.com/google/btree v1.0.1/go.mod h1:xXMiIv4Fb/0kKde4SpL7qlzvu5cMJDRkFDxJfI9uaxA=
-github.com/google/certificate-transparency-go v1.0.10-0.20180222191210-5ab67e519c93/go.mod h1:QeJfpSbVSfYc7RgB3gJFj9cbuQMMchQxrWXz8Ruopmg=
 github.com/google/certificate-transparency-go v1.0.21/go.mod h1:QeJfpSbVSfYc7RgB3gJFj9cbuQMMchQxrWXz8Ruopmg=
 github.com/google/certificate-transparency-go v1.1.1/go.mod h1:FDKqPvSXawb2ecErVRrD+nfy23RCzyl7eqVCEmlT1Zs=
 github.com/google/certificate-transparency-go v1.1.2-0.20210422104406-9f33727a7a18/go.mod h1:6CKh9dscIRoqc2kC6YUFICHZMT9NrClyPrRVFrdw1QQ=
@@ -1215,7 +1189,6 @@ github.com/gorhill/cronexpr v0.0.0-20180427100037-88b0669f7d75/go.mod h1:g2644b0
 github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
 github.com/gorilla/handlers v0.0.0-20150720190736-60c7bfde3e33/go.mod h1:Qkdc/uu4tH4g6mTK6auzZ766c4CA0Ng8+o/OAirnOIQ=
 github.com/gorilla/mux v1.6.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
-github.com/gorilla/mux v1.7.0/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
 github.com/gorilla/mux v1.7.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
 github.com/gorilla/mux v1.7.3/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
 github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI=
@@ -1256,8 +1229,6 @@ github.com/grpc-ecosystem/grpc-gateway v1.12.1/go.mod h1:8XEsbTttt/W+VvjtQhLACqC
 github.com/grpc-ecosystem/grpc-gateway v1.14.6/go.mod h1:zdiPV4Yse/1gnckTHtghG4GkDEdKCRJduHpTxT3/jcw=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4M0+kPpLofRdBo=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed h1:5upAirOpQc1Q53c0bnx2ufif5kANL7bfZWcc6VJWJd8=
-github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4=
 github.com/hanwen/go-fuse v1.0.0/go.mod h1:unqXarDXqzAk0rt98O2tVndEPIpUgLD9+rwFisZH3Ok=
 github.com/hanwen/go-fuse/v2 v2.1.0/go.mod h1:oRyA5eK+pvJyv5otpO/DgccS8y/RvYMaO00GgRLGryc=
 github.com/hashicorp/consul/api v1.1.0/go.mod h1:VmuI/Lkw1nC05EYQWNKwWGbkg+FbDBtguAZLlVdkD9Q=
@@ -1402,11 +1373,6 @@ github.com/jhump/protoreflect v1.9.0/go.mod h1:7GcYQDdMU/O/BBrl/cX6PNHpXh6cenjd8
 github.com/jingyugao/rowserrcheck v1.1.1/go.mod h1:4yvlZSDb3IyDTUZJUmpZfm2Hwok+Dtp+nu2qOq+er9c=
 github.com/jinzhu/copier v0.3.2 h1:QdBOCbaouLDYaIPFfi1bKv5F5tPpeTwXe4sD0jqtz5w=
 github.com/jinzhu/copier v0.3.2/go.mod h1:24xnZezI2Yqac9J61UC6/dG/k76ttpq0DdJI3QmUvro=
-github.com/jinzhu/gorm v0.0.0-20170222002820-5409931a1bb8 h1:CZkYfurY6KGhVtlalI4QwQ6T0Cu6iuY3e0x5RLu96WE=
-github.com/jinzhu/gorm v0.0.0-20170222002820-5409931a1bb8/go.mod h1:Vla75njaFJ8clLU1W44h34PjIkijhjHIYnZxMqCdxqo=
-github.com/jinzhu/inflection v0.0.0-20170102125226-1c35d901db3d h1:jRQLvyVGL+iVtDElaEIDdKwpPqUIZJfzkNLV34htpEc=
-github.com/jinzhu/inflection v0.0.0-20170102125226-1c35d901db3d/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
-github.com/jinzhu/now v1.1.1/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
 github.com/jirfag/go-printf-func-name v0.0.0-20200119135958-7558a9eaa5af/go.mod h1:HEWGJkRDzjJY2sqdDwxccsGicWEf9BQOZsq2tV+xzM0=
 github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
 github.com/jmespath/go-jmespath v0.0.0-20160803190731-bd40a432e4c7/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
@@ -1437,7 +1403,6 @@ github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHm
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
 github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
-github.com/juju/loggo v0.0.0-20190526231331-6e530bcce5d8/go.mod h1:vgyd7OREkbtVEN/8IXZe5Ooef3LQePvuBm9UWj6ZL8U=
 github.com/juju/ratelimit v1.0.1/go.mod h1:qapgC/Gy+xNh9UxzV13HGGl/6UXNN+ct+vwSgWNm/qk=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
@@ -1498,7 +1463,6 @@ github.com/leodido/go-urn v1.2.0/go.mod h1:+8+nEpDfqqsY+g338gtMEUOtuK+4dEMhiQEgx
 github.com/leodido/go-urn v1.2.1 h1:BqpAaACuzVSgi/VLzGZIobT2z4v53pjosyNd9Yv6n/w=
 github.com/leodido/go-urn v1.2.1/go.mod h1:zt4jvISO2HfUBqxjfIshjdMTYS56ZS/qv49ictyFfxY=
 github.com/letsencrypt/pkcs11key/v4 v4.0.0/go.mod h1:EFUvBDay26dErnNb70Nd0/VW3tJiIbETBPTl9ATXQag=
-github.com/lib/pq v0.0.0-20150723085316-0dad96c0b94f/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.1.1/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.8.0/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
@@ -1514,7 +1478,6 @@ github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2
 github.com/lyft/protoc-gen-star v0.5.3/go.mod h1:V0xaHgaf5oCCqmcxYcWiDfTiKsZsRc87/1qhoTACD8w=
 github.com/lyft/protoc-gen-validate v0.0.13/go.mod h1:XbGvPuh87YZc5TdIa2/I4pLk0QoUACkjt2znoq26NVQ=
 github.com/magefile/mage v1.11.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A=
-github.com/magiconair/properties v1.5.3/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/magiconair/properties v1.8.4/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
@@ -1567,7 +1530,6 @@ github.com/mattn/go-runewidth v0.0.13 h1:lTGmDsbAYt5DmK6OnoV7EuIF1wEIFAcxld6ypU4
 github.com/mattn/go-runewidth v0.0.13/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mattn/go-shellwords v1.0.3/go.mod h1:3xCvwCdWdlDJUrvuMn7Wuy9eWs4pE8vqg+NOMyg4B2o=
 github.com/mattn/go-shellwords v1.0.10/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
-github.com/mattn/go-sqlite3 v1.6.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
 github.com/mattn/go-sqlite3 v1.9.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
 github.com/mattn/go-zglob v0.0.1/go.mod h1:9fxibJccNxU2cnpIKLRRFA7zX7qhkJIQWBb449FYHOo=
 github.com/mattn/goveralls v0.0.2/go.mod h1:8d1ZMHsd7fW6IRPKQh46F2WRpyib5/X4FOpevwGNQEw=
@@ -1614,7 +1576,6 @@ github.com/mitchellh/gox v0.4.0/go.mod h1:Sd9lOJ0+aimLBi73mGofS1ycjY8lL3uZM3JPS4
 github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4NcD46KavDd4=
 github.com/mitchellh/hashstructure/v2 v2.0.2/go.mod h1:MG3aRVU/N29oo/V/IhBX8GR/zz4kQkprJgF2EVszyDE=
 github.com/mitchellh/iochan v1.0.0/go.mod h1:JwYml1nuB7xOzsp52dPpHFffvOCDupsG0QubkSMEySY=
-github.com/mitchellh/mapstructure v0.0.0-20150613213606-2caf8efc9366/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.3.2/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
@@ -1631,12 +1592,8 @@ github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zx
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
 github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c=
-github.com/moby/sys/mount v0.3.1 h1:RX1K0x95oR8j5P1YefKDt7tE1C2kCCixV0H8Aza3GaI=
-github.com/moby/sys/mount v0.3.1/go.mod h1:6IZknFQiqjLpwuYJD5Zk0qYEuJiws36M88MIXnZHya0=
 github.com/moby/sys/mountinfo v0.4.0/go.mod h1:rEr8tzG/lsIZHBtN/JjGG+LMYx9eXgW2JI+6q0qou+A=
 github.com/moby/sys/mountinfo v0.4.1/go.mod h1:rEr8tzG/lsIZHBtN/JjGG+LMYx9eXgW2JI+6q0qou+A=
-github.com/moby/sys/mountinfo v0.6.0 h1:gUDhXQx58YNrpHlK4nSL+7y2pxFZkUcXqzFDKWdC0Oo=
-github.com/moby/sys/mountinfo v0.6.0/go.mod h1:3bMD3Rg+zkqx8MRYPi7Pyb0Ie97QEBmdxbhnCLlSvSU=
 github.com/moby/sys/symlink v0.1.0/go.mod h1:GGDODQmbFOjFsXvfLVn3+ZRxkch54RkSiGqsZeMYowQ=
 github.com/moby/term v0.0.0-20200312100748-672ec06f55cd/go.mod h1:DdlQx2hp0Ss5/fLikoLlEeIYiATotOjgB//nb973jeo=
 github.com/moby/term v0.0.0-20201216013528-df9cb8a40635/go.mod h1:FBS0z0QWA44HXygs7VXDUOGoN/1TV3RuWkLO04am3wc=
@@ -1705,7 +1662,6 @@ github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+W
 github.com/onsi/ginkgo v1.10.1/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.10.3/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.11.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.12.0/go.mod h1:oUhWkIvk5aDxtKvDDuw8gItl8pKl42LzjC9KZE0HfGg=
 github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
 github.com/onsi/ginkgo v1.14.0/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
 github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
@@ -1718,7 +1674,6 @@ github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1Cpa
 github.com/onsi/gomega v1.5.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
-github.com/onsi/gomega v1.9.0/go.mod h1:Ho0h+IUsWyvy1OpqCwxlQ/21gkhVunqlU8fDGcoTdcA=
 github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
 github.com/onsi/gomega v1.10.3/go.mod h1:V9xEwhxec5O8UDM77eCW8vLymOMltsqPVYWrpDsH8xc=
 github.com/onsi/gomega v1.11.0/go.mod h1:azGKhqFUon9Vuj0YmTfLSmx0FUwqXYSTl5re8lQLTUg=
@@ -1815,7 +1770,6 @@ github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndr
 github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s=
 github.com/pquerna/cachecontrol v0.0.0-20171018203845-0dec1b30a021/go.mod h1:prYjPmNq4d1NPVmpShWobRqXY3q7Vp+80DqgxxUrUIA=
 github.com/prometheus/client_golang v0.0.0-20180209125602-c332b6f63c06/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
-github.com/prometheus/client_golang v0.9.0-pre1.0.20180209125602-c332b6f63c06/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.3-0.20190127221311-3c4408c8b829/go.mod h1:p2iRAGwDERtqlqzRXnrOVns+ignqQo//hLXqYxZYVNs=
 github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso=
@@ -1923,8 +1877,8 @@ github.com/sassoftware/relic v0.0.0-20210427151427-dfb082b79b74 h1:sUNzanSKA9z/h
 github.com/sassoftware/relic v0.0.0-20210427151427-dfb082b79b74/go.mod h1:YlB8wFIZmFLZ1JllNBfSURzz52fBxbliNgYALk1UDmk=
 github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
 github.com/sclevine/spec v1.4.0/go.mod h1:LvpgJaFyvQzRvc1kaDs0bulYwzC70PbiYjC4QnFHkOM=
-github.com/scylladb/go-set v1.0.2 h1:SkvlMCKhP0wyyct6j+0IHJkBkSZL+TDzZ4E7f7BCcRE=
-github.com/scylladb/go-set v1.0.2/go.mod h1:DkpGd78rljTxKAnTDPFqXSGxvETQnJyuSOQwsHycqfs=
+github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e h1:7q6NSFZDeGfvvtIRwBrU/aegEYJYmvev0cHAwo17zZQ=
+github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e/go.mod h1:DkpGd78rljTxKAnTDPFqXSGxvETQnJyuSOQwsHycqfs=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
 github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvWlF4P2Ca7zGrPiEpWo=
 github.com/secure-systems-lab/go-securesystemslib v0.2.0/go.mod h1:eIjBmIP8LD2MLBL/DkQWayLiz006Q4p+hCu79rvWleY=
@@ -1994,12 +1948,10 @@ github.com/spf13/afero v1.4.1/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z
 github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
 github.com/spf13/afero v1.8.0 h1:5MmtuhAgYeU6qpa7w7bP0dv6MBYuup0vekhSpSkoq60=
 github.com/spf13/afero v1.8.0/go.mod h1:CtAatgMJh6bJEIs48Ay/FOnkljP3WeGUG0MC1RfAqwo=
-github.com/spf13/cast v0.0.0-20150508191742-4d07383ffe94/go.mod h1:r2rcYCSwa1IExKTDiTfzaxqT2FNHs8hODu4LnUfgKEg=
 github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cast v1.4.1 h1:s0hze+J0196ZfEMTs80N7UlFt0BDuQ7Q+JDnHiMWKdA=
 github.com/spf13/cast v1.4.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
-github.com/spf13/cobra v0.0.1/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
 github.com/spf13/cobra v0.0.2-0.20171109065643-2da4a54c5cee/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
 github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
 github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU=
@@ -2009,18 +1961,15 @@ github.com/spf13/cobra v1.1.3/go.mod h1:pGADOWyqRD/YMrPZigI/zbliZ2wVD/23d+is3pSW
 github.com/spf13/cobra v1.2.1/go.mod h1:ExllRjgxM/piMAM+3tAZvg8fsklGAf3tPfi+i8t68Nk=
 github.com/spf13/cobra v1.3.0 h1:R7cSvGu+Vv+qX0gW5R/85dx2kmmJT5z5NM8ifdYjdn0=
 github.com/spf13/cobra v1.3.0/go.mod h1:BrRVncBjOJa/eUcVVm9CE+oC6as8k+VYr4NY7WCi9V4=
-github.com/spf13/jwalterweatherman v0.0.0-20141219030609-3d60171a6431/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
 github.com/spf13/jwalterweatherman v1.1.0 h1:ue6voC5bR5F8YxI5S67j9i582FU4Qvo2bmqnqMYADFk=
 github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
 github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
-github.com/spf13/pflag v1.0.0/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.1-0.20171106142849-4c012f6dcd95/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.1/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/viper v0.0.0-20150530192845-be5ff3e4840c/go.mod h1:A8kyI5cUJhb8N+3pkfONlcEcZbueH6nhAm0Fq7SrnBM=
 github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s=
 github.com/spf13/viper v1.4.0/go.mod h1:PTJ7Z/lr49W6bUbkmS1V3by4uWynFiR9p7+dSq/yZzE=
 github.com/spf13/viper v1.7.0/go.mod h1:8WkrPz2fc9jxqZNCJI/76HCieCp4Q8HaLFoCha5qpdg=
@@ -2080,8 +2029,6 @@ github.com/theupdateframework/go-tuf v0.0.0-20211203210025-7ded50136bf9/go.mod h
 github.com/theupdateframework/go-tuf v0.0.0-20220127213825-87caa18db2a6/go.mod h1:I0Gs4Tev4hYQ5wiNqN8VJ7qS0gw7KOZNQuckC624RmE=
 github.com/theupdateframework/go-tuf v0.0.0-20220211205608-f0c3294f63b9 h1:U8bHY5mmNuZHc3+e7l2/LAmfTk7oiMiB3Qn8fsp4z5g=
 github.com/theupdateframework/go-tuf v0.0.0-20220211205608-f0c3294f63b9/go.mod h1:ENa0O55YQfI0U/nn4AAuqPydrbkqQCiq9GDw6YLCyXU=
-github.com/theupdateframework/notary v0.7.0 h1:QyagRZ7wlSpjT5N2qQAh/pN+DVqgekv4DzbAiAiEL3c=
-github.com/theupdateframework/notary v0.7.0/go.mod h1:c9DRxcmhHmVLDay4/2fUYdISnHqbFDGRSlXPO0AhYWw=
 github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
 github.com/tidwall/pretty v1.2.0 h1:RWIZEg2iJ8/g6fDDYzMpobmaoGh5OLl4AXtGUGPcqCs=
 github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
@@ -2363,7 +2310,6 @@ golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20200930160638-afb6bcd081ae/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201112155050-0c6587e931a9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20201117144127-c1f2f97bffc9/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
 golang.org/x/crypto v0.0.0-20201216223049-8b5274cf687f/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
 golang.org/x/crypto v0.0.0-20201221181555-eec23a3978ad/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
 golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
@@ -3017,7 +2963,6 @@ google.golang.org/genproto v0.0.0-20220216160803-4663080d8bc8/go.mod h1:kGP+zUP2
 google.golang.org/genproto v0.0.0-20220218161850-94dd64e39d7c h1:TU4rFa5APdKTq0s6B7WTsH6Xmx0Knj86s6Biz56mErE=
 google.golang.org/genproto v0.0.0-20220218161850-94dd64e39d7c/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
 google.golang.org/grpc v0.0.0-20160317175043-d3ddb4469d5a/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
-google.golang.org/grpc v1.0.5/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.8.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
@@ -3077,8 +3022,6 @@ google.golang.org/protobuf v1.27.1 h1:SnqbnDw1V7RiZcXPx5MEeqPv2s79L9i7BJUlG/+Rur
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 gopkg.in/airbrake/gobrake.v2 v2.0.9/go.mod h1:/h5ZAUhDkGaJfjzjKLSjv6zCL6O0LLBxU4K+aSYdM/U=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
-gopkg.in/cenkalti/backoff.v2 v2.2.1 h1:eJ9UAg01/HIHG987TwxvnzK2MgxXq97YY6rYDpY9aII=
-gopkg.in/cenkalti/backoff.v2 v2.2.1/go.mod h1:S0QdOvT2AlerfSBkp0O+dk+bbIMaNbEmVk876gPCthU=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20141024133853-64131543e789/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -3106,8 +3049,6 @@ gopkg.in/ini.v1 v1.66.2/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/natefinch/lumberjack.v2 v2.0.0 h1:1Lc07Kr7qY4U2YPouBjpCLxpiyxIVoxqXgkXLknAOE8=
 gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=
 gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
-gopkg.in/rethinkdb/rethinkdb-go.v6 v6.2.1 h1:d4KQkxAaAiRY2h5Zqis161Pv91A37uZyJOx73duwUwM=
-gopkg.in/rethinkdb/rethinkdb-go.v6 v6.2.1/go.mod h1:WbjuEoo1oadwzQ4apSDU+JTvmllEHtsNHS6y7vFc7iw=
 gopkg.in/square/go-jose.v2 v2.2.2/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
 gopkg.in/square/go-jose.v2 v2.3.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
 gopkg.in/square/go-jose.v2 v2.4.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=

internal/anchore/import_package_sbom_test.go

@@ -56,14 +56,14 @@ func sbomFixture() sbom.SBOM {
 				Name:    "name",
 				Version: "version",
 				FoundBy: "foundBy",
-				Locations: []source.Location{
-					{
+				Locations: source.NewLocationSet(
+					source.Location{
 						Coordinates: source.Coordinates{
 							RealPath:     "path",
 							FileSystemID: "layerID",
 						},
 					},
-				},
+				),
 				Licenses: []string{"license"},
 				Language: pkg.Python,
 				Type:     pkg.PythonPkg,

internal/constants.go

@@ -6,5 +6,5 @@ const (
 
 	// JSONSchemaVersion is the current schema version output by the JSON encoder
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "3.2.1"
+	JSONSchemaVersion = "3.2.2"
 )

internal/formats/common/cyclonedxhelpers/component.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/CycloneDX/cyclonedx-go"
 
+	"github.com/anchore/packageurl-go"
 	"github.com/anchore/syft/internal/formats/common"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
@@ -13,8 +14,9 @@ import (
 func encodeComponent(p pkg.Package) cyclonedx.Component {
 	props := encodeProperties(p, "syft:package")
 	props = append(props, encodeCPEs(p)...)
-	if len(p.Locations) > 0 {
-		props = append(props, encodeProperties(p.Locations, "syft:location")...)
+	locations := p.Locations.ToSlice()
+	if len(locations) > 0 {
+		props = append(props, encodeProperties(locations, "syft:location")...)
 	}
 	if hasMetadata(p) {
 		props = append(props, encodeProperties(p.Metadata, "syft:metadata")...)
@@ -38,9 +40,23 @@ func encodeComponent(p pkg.Package) cyclonedx.Component {
 		Description:        encodeDescription(p),
 		ExternalReferences: encodeExternalReferences(p),
 		Properties:         properties,
+		BOMRef:             deriveBomRef(p),
 	}
 }
 
+func deriveBomRef(p pkg.Package) string {
+	// try and parse the PURL if possible and append syft id to it, to make
+	// the purl unique in the BOM.
+	// TODO: In the future we may want to dedupe by PURL and combine components with
+	// the same PURL while preserving their unique metadata.
+	if parsedPURL, err := packageurl.FromString(p.PURL); err == nil {
+		parsedPURL.Qualifiers = append(parsedPURL.Qualifiers, packageurl.Qualifier{Key: "syft-id", Value: string(p.ID())})
+		return parsedPURL.ToString()
+	}
+	// fallback is to use strictly the ID if there is no valid pURL
+	return string(p.ID())
+}
+
 func hasMetadata(p pkg.Package) bool {
 	return p.Metadata != nil
 }
@@ -73,10 +89,13 @@ func decodeComponent(c *cyclonedx.Component) *pkg.Package {
 	return p
 }
 
-func decodeLocations(vals map[string]string) []source.Location {
+func decodeLocations(vals map[string]string) source.LocationSet {
 	v := common.Decode(reflect.TypeOf([]source.Location{}), vals, "syft:location", CycloneDXFields)
-	out, _ := v.([]source.Location)
-	return out
+	out, ok := v.([]source.Location)
+	if !ok {
+		out = nil
+	}
+	return source.NewLocationSet(out...)
 }
 
 func decodePackageMetadata(vals map[string]string, c *cyclonedx.Component, typ pkg.MetadataType) interface{} {

internal/formats/common/cyclonedxhelpers/component_test.go

@@ -1,6 +1,7 @@
 package cyclonedxhelpers
 
 import (
+	"fmt"
 	"testing"
 
 	"github.com/CycloneDX/cyclonedx-go"
@@ -26,9 +27,9 @@ func Test_encodeComponentProperties(t *testing.T) {
 			name: "from apk",
 			input: pkg.Package{
 				FoundBy: "cataloger",
-				Locations: []source.Location{
-					{Coordinates: source.Coordinates{RealPath: "test"}},
-				},
+				Locations: source.NewLocationSet(
+					source.Location{Coordinates: source.Coordinates{RealPath: "test"}},
+				),
 				Metadata: pkg.ApkMetadata{
 					Package:          "libc-utils",
 					OriginPackage:    "libc-dev",
@@ -139,3 +140,54 @@ func Test_encodeComponentProperties(t *testing.T) {
 		})
 	}
 }
+
+func Test_deriveBomRef(t *testing.T) {
+	pkgWithPurl := pkg.Package{
+		Name:    "django",
+		Version: "1.11.1",
+		PURL:    "pkg:pypi/django@1.11.1",
+	}
+	pkgWithPurl.SetID()
+
+	pkgWithOutPurl := pkg.Package{
+		Name:    "django",
+		Version: "1.11.1",
+		PURL:    "",
+	}
+	pkgWithOutPurl.SetID()
+
+	pkgWithBadPurl := pkg.Package{
+		Name:    "django",
+		Version: "1.11.1",
+		PURL:    "pkg:pyjango@1.11.1",
+	}
+	pkgWithBadPurl.SetID()
+
+	tests := []struct {
+		name string
+		pkg  pkg.Package
+		want string
+	}{
+		{
+			name: "use pURL-id hybrid",
+			pkg:  pkgWithPurl,
+			want: fmt.Sprintf("pkg:pypi/django@1.11.1?syft-id=%s", pkgWithPurl.ID()),
+		},
+		{
+			name: "fallback to ID when pURL is invalid",
+			pkg:  pkgWithBadPurl,
+			want: string(pkgWithBadPurl.ID()),
+		},
+		{
+			name: "fallback to ID when pURL is missing",
+			pkg:  pkgWithOutPurl,
+			want: string(pkgWithOutPurl.ID()),
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			tt.pkg.ID()
+			assert.Equal(t, tt.want, deriveBomRef(tt.pkg))
+		})
+	}
+}

internal/formats/common/spdxhelpers/source_info.go

@@ -13,6 +13,8 @@ func SourceInfo(p pkg.Package) string {
 		answer = "acquired package info from RPM DB"
 	case pkg.ApkPkg:
 		answer = "acquired package info from APK DB"
+	case pkg.DartPubPkg:
+		answer = "acquired package info from pubspec manifest"
 	case pkg.DebPkg:
 		answer = "acquired package info from DPKG DB"
 	case pkg.NpmPkg:
@@ -33,7 +35,7 @@ func SourceInfo(p pkg.Package) string {
 		answer = "acquired package info from the following paths"
 	}
 	var paths []string
-	for _, l := range p.Locations {
+	for _, l := range p.Locations.ToSlice() {
 		paths = append(paths, l.RealPath)
 	}
 

internal/formats/common/spdxhelpers/source_info_test.go

@@ -18,10 +18,10 @@ func Test_SourceInfo(t *testing.T) {
 			name: "locations are captured",
 			input: pkg.Package{
 				// note: no type given
-				Locations: []source.Location{
+				Locations: source.NewLocationSet(
 					source.NewVirtualLocation("/a-place", "/b-place"),
 					source.NewVirtualLocation("/c-place", "/d-place"),
-				},
+				),
 			},
 			expected: []string{
 				"from the following paths",
@@ -126,6 +126,14 @@ func Test_SourceInfo(t *testing.T) {
 				"from PHP composer manifest",
 			},
 		},
+		{
+			input: pkg.Package{
+				Type: pkg.DartPubPkg,
+			},
+			expected: []string{
+				"from pubspec manifest",
+			},
+		},
 	}
 	var pkgTypes []pkg.Type
 	for _, test := range tests {

internal/formats/common/spdxhelpers/to_syft_model.go

@@ -1,6 +1,7 @@
 package spdxhelpers
 
 import (
+	"errors"
 	"strconv"
 	"strings"
 
@@ -17,6 +18,10 @@ import (
 )
 
 func ToSyftModel(doc *spdx.Document2_2) (*sbom.SBOM, error) {
+	if doc == nil {
+		return nil, errors.New("cannot convert SPDX document to Syft model because document is nil")
+	}
+
 	spdxIDMap := make(map[string]interface{})
 
 	s := &sbom.SBOM{

internal/formats/common/testutils/utils.go

@@ -157,9 +157,9 @@ func populateImageCatalog(catalog *pkg.Catalog, img *image.Image) {
 	catalog.Add(pkg.Package{
 		Name:    "package-1",
 		Version: "1.0.1",
-		Locations: []source.Location{
+		Locations: source.NewLocationSet(
 			source.NewLocationFromImage(string(ref1.RealPath), *ref1, img),
-		},
+		),
 		Type:         pkg.PythonPkg,
 		FoundBy:      "the-cataloger-1",
 		Language:     pkg.Python,
@@ -169,7 +169,7 @@ func populateImageCatalog(catalog *pkg.Catalog, img *image.Image) {
 			Name:    "package-1",
 			Version: "1.0.1",
 		},
-		PURL: "a-purl-1",
+		PURL: "a-purl-1", // intentionally a bad pURL for test fixtures
 		CPEs: []pkg.CPE{
 			pkg.MustCPE("cpe:2.3:*:some:package:1:*:*:*:*:*:*:*"),
 		},
@@ -177,9 +177,9 @@ func populateImageCatalog(catalog *pkg.Catalog, img *image.Image) {
 	catalog.Add(pkg.Package{
 		Name:    "package-2",
 		Version: "2.0.1",
-		Locations: []source.Location{
+		Locations: source.NewLocationSet(
 			source.NewLocationFromImage(string(ref2.RealPath), *ref2, img),
-		},
+		),
 		Type:         pkg.DebPkg,
 		FoundBy:      "the-cataloger-2",
 		MetadataType: pkg.DpkgMetadataType,
@@ -187,7 +187,7 @@ func populateImageCatalog(catalog *pkg.Catalog, img *image.Image) {
 			Package: "package-2",
 			Version: "2.0.1",
 		},
-		PURL: "a-purl-2",
+		PURL: "pkg:deb/debian/package-2@2.0.1",
 		CPEs: []pkg.CPE{
 			pkg.MustCPE("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"),
 		},
@@ -234,9 +234,9 @@ func newDirectoryCatalog() *pkg.Catalog {
 		Version: "1.0.1",
 		Type:    pkg.PythonPkg,
 		FoundBy: "the-cataloger-1",
-		Locations: []source.Location{
+		Locations: source.NewLocationSet(
 			source.NewLocation("/some/path/pkg1"),
-		},
+		),
 		Language:     pkg.Python,
 		MetadataType: pkg.PythonPackageMetadataType,
 		Licenses:     []string{"MIT"},
@@ -249,7 +249,7 @@ func newDirectoryCatalog() *pkg.Catalog {
 				},
 			},
 		},
-		PURL: "a-purl-2",
+		PURL: "a-purl-2", // intentionally a bad pURL for test fixtures
 		CPEs: []pkg.CPE{
 			pkg.MustCPE("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"),
 		},
@@ -259,15 +259,15 @@ func newDirectoryCatalog() *pkg.Catalog {
 		Version: "2.0.1",
 		Type:    pkg.DebPkg,
 		FoundBy: "the-cataloger-2",
-		Locations: []source.Location{
+		Locations: source.NewLocationSet(
 			source.NewLocation("/some/path/pkg1"),
-		},
+		),
 		MetadataType: pkg.DpkgMetadataType,
 		Metadata: pkg.DpkgMetadata{
 			Package: "package-2",
 			Version: "2.0.1",
 		},
-		PURL: "a-purl-2",
+		PURL: "pkg:deb/debian/package-2@2.0.1",
 		CPEs: []pkg.CPE{
 			pkg.MustCPE("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"),
 		},

internal/formats/cyclonedxjson/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden

@@ -1,10 +1,10 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.4",
-  "serialNumber": "urn:uuid:498e659b-0758-4a7f-816e-91bee18df634",
+  "serialNumber": "urn:uuid:dec3f6b4-8458-48bb-b60d-dfd312f6ec4e",
   "version": 1,
   "metadata": {
-    "timestamp": "2022-03-08T12:30:39Z",
+    "timestamp": "2022-04-01T11:48:04-04:00",
     "tools": [
       {
         "vendor": "anchore",
@@ -20,6 +20,7 @@
   },
   "components": [
     {
+      "bom-ref": "b85dbb4e6ece5082",
       "type": "library",
       "name": "package-1",
       "version": "1.0.1",
@@ -56,11 +57,12 @@
       ]
     },
     {
+      "bom-ref": "pkg:deb/debian/package-2@2.0.1?syft-id=ceda99598967ae8d",
       "type": "library",
       "name": "package-2",
       "version": "2.0.1",
       "cpe": "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*",
-      "purl": "a-purl-2",
+      "purl": "pkg:deb/debian/package-2@2.0.1",
       "properties": [
         {
           "name": "syft:package:foundBy",

internal/formats/cyclonedxjson/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden

@@ -1,10 +1,10 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.4",
-  "serialNumber": "urn:uuid:342c3d2c-d26e-47b6-94d6-92fbf41da945",
+  "serialNumber": "urn:uuid:054d973e-fe99-4762-92e4-eaf01997ae41",
   "version": 1,
   "metadata": {
-    "timestamp": "2022-03-08T12:30:39Z",
+    "timestamp": "2022-04-01T11:48:04-04:00",
     "tools": [
       {
         "vendor": "anchore",
@@ -13,7 +13,7 @@
       }
     ],
     "component": {
-      "bom-ref": "711095b1cdf90cce",
+      "bom-ref": "e777314b02b362e4",
       "type": "container",
       "name": "user-image-input",
       "version": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368"
@@ -21,6 +21,7 @@
   },
   "components": [
     {
+      "bom-ref": "2a46171f91c8d4bc",
       "type": "library",
       "name": "package-1",
       "version": "1.0.1",
@@ -52,7 +53,7 @@
         },
         {
           "name": "syft:location:0:layerID",
-          "value": "sha256:16e64541f2ddf59a90391ce7bb8af90313f7d373f2105d88f3d3267b72e0ebab"
+          "value": "sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59"
         },
         {
           "name": "syft:location:0:path",
@@ -61,11 +62,12 @@
       ]
     },
     {
+      "bom-ref": "pkg:deb/debian/package-2@2.0.1?syft-id=ae77680e9b1d087e",
       "type": "library",
       "name": "package-2",
       "version": "2.0.1",
       "cpe": "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*",
-      "purl": "a-purl-2",
+      "purl": "pkg:deb/debian/package-2@2.0.1",
       "properties": [
         {
           "name": "syft:package:foundBy",
@@ -81,7 +83,7 @@
         },
         {
           "name": "syft:location:0:layerID",
-          "value": "sha256:de6c235f76ea24c8503ec08891445b5d6a8bdf8249117ed8d8b0b6fb3ebe4f67"
+          "value": "sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec"
         },
         {
           "name": "syft:location:0:path",

internal/formats/cyclonedxxml/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.4" serialNumber="urn:uuid:892f8304-0142-45b1-b411-cade3c53057f" version="1">
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" serialNumber="urn:uuid:554fd820-210b-40c8-8c0b-75690274e21c" version="1">
   <metadata>
-    <timestamp>2022-03-08T12:30:33Z</timestamp>
+    <timestamp>2022-04-01T11:57:46-04:00</timestamp>
     <tools>
       <tool>
         <vendor>anchore</vendor>
@@ -14,7 +14,7 @@
     </component>
   </metadata>
   <components>
-    <component type="library">
+    <component bom-ref="b85dbb4e6ece5082" type="library">
       <name>package-1</name>
       <version>1.0.1</version>
       <licenses>
@@ -32,11 +32,11 @@
         <property name="syft:location:0:path">/some/path/pkg1</property>
       </properties>
     </component>
-    <component type="library">
+    <component bom-ref="pkg:deb/debian/package-2@2.0.1?syft-id=ceda99598967ae8d" type="library">
       <name>package-2</name>
       <version>2.0.1</version>
       <cpe>cpe:2.3:*:some:package:2:*:*:*:*:*:*:*</cpe>
-      <purl>a-purl-2</purl>
+      <purl>pkg:deb/debian/package-2@2.0.1</purl>
       <properties>
         <property name="syft:package:foundBy">the-cataloger-2</property>
         <property name="syft:package:metadataType">DpkgMetadata</property>

internal/formats/cyclonedxxml/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.4" serialNumber="urn:uuid:5fa94827-eb85-4f32-a62d-76fb6e89a2dd" version="1">
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" serialNumber="urn:uuid:1535f940-172f-4d97-8280-d5a5764d1557" version="1">
   <metadata>
-    <timestamp>2022-03-08T12:30:33Z</timestamp>
+    <timestamp>2022-04-01T11:57:46-04:00</timestamp>
     <tools>
       <tool>
         <vendor>anchore</vendor>
@@ -9,13 +9,13 @@
         <version>[not provided]</version>
       </tool>
     </tools>
-    <component bom-ref="711095b1cdf90cce" type="container">
+    <component bom-ref="e777314b02b362e4" type="container">
       <name>user-image-input</name>
       <version>sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368</version>
     </component>
   </metadata>
   <components>
-    <component type="library">
+    <component bom-ref="2a46171f91c8d4bc" type="library">
       <name>package-1</name>
       <version>1.0.1</version>
       <licenses>
@@ -30,20 +30,20 @@
         <property name="syft:package:language">python</property>
         <property name="syft:package:metadataType">PythonPackageMetadata</property>
         <property name="syft:package:type">python</property>
-        <property name="syft:location:0:layerID">sha256:16e64541f2ddf59a90391ce7bb8af90313f7d373f2105d88f3d3267b72e0ebab</property>
+        <property name="syft:location:0:layerID">sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59</property>
         <property name="syft:location:0:path">/somefile-1.txt</property>
       </properties>
     </component>
-    <component type="library">
+    <component bom-ref="pkg:deb/debian/package-2@2.0.1?syft-id=ae77680e9b1d087e" type="library">
       <name>package-2</name>
       <version>2.0.1</version>
       <cpe>cpe:2.3:*:some:package:2:*:*:*:*:*:*:*</cpe>
-      <purl>a-purl-2</purl>
+      <purl>pkg:deb/debian/package-2@2.0.1</purl>
       <properties>
         <property name="syft:package:foundBy">the-cataloger-2</property>
         <property name="syft:package:metadataType">DpkgMetadata</property>
         <property name="syft:package:type">deb</property>
-        <property name="syft:location:0:layerID">sha256:de6c235f76ea24c8503ec08891445b5d6a8bdf8249117ed8d8b0b6fb3ebe4f67</property>
+        <property name="syft:location:0:layerID">sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec</property>
         <property name="syft:location:0:path">/somefile-2.txt</property>
         <property name="syft:metadata:installedSize">0</property>
       </properties>

internal/formats/github/encoder.go

@@ -58,8 +58,9 @@ func toSnapshotMetadata(s *sbom.SBOM) Metadata {
 }
 
 func filesystem(p pkg.Package) string {
-	if len(p.Locations) > 0 {
-		return p.Locations[0].FileSystemID
+	locations := p.Locations.ToSlice()
+	if len(locations) > 0 {
+		return locations[0].FileSystemID
 	}
 	return ""
 }
@@ -76,8 +77,9 @@ func toPath(s source.Metadata, p pkg.Package) string {
 	if inputPath == "." {
 		inputPath = ""
 	}
-	if len(p.Locations) > 0 {
-		location := p.Locations[0]
+	locations := p.Locations.ToSlice()
+	if len(locations) > 0 {
+		location := locations[0]
 		packagePath := location.RealPath
 		if location.VirtualPath != "" {
 			packagePath = location.VirtualPath

internal/formats/github/encoder_test.go

@@ -35,32 +35,38 @@ func Test_toGithubModel(t *testing.T) {
 		{
 			Name:    "pkg-1",
 			Version: "1.0.1",
-			Locations: []source.Location{{
-				Coordinates: source.Coordinates{
-					RealPath:     "/usr/lib",
-					FileSystemID: "fsid-1",
+			Locations: source.NewLocationSet(
+				source.Location{
+					Coordinates: source.Coordinates{
+						RealPath:     "/usr/lib",
+						FileSystemID: "fsid-1",
+					},
 				},
-			}},
+			),
 		},
 		{
 			Name:    "pkg-2",
 			Version: "2.0.2",
-			Locations: []source.Location{{
-				Coordinates: source.Coordinates{
-					RealPath:     "/usr/lib",
-					FileSystemID: "fsid-1",
+			Locations: source.NewLocationSet(
+				source.Location{
+					Coordinates: source.Coordinates{
+						RealPath:     "/usr/lib",
+						FileSystemID: "fsid-1",
+					},
 				},
-			}},
+			),
 		},
 		{
 			Name:    "pkg-3",
 			Version: "3.0.3",
-			Locations: []source.Location{{
-				Coordinates: source.Coordinates{
-					RealPath:     "/etc",
-					FileSystemID: "fsid-1",
+			Locations: source.NewLocationSet(
+				source.Location{
+					Coordinates: source.Coordinates{
+						RealPath:     "/etc",
+						FileSystemID: "fsid-1",
+					},
 				},
-			}},
+			),
 		},
 	} {
 		p.PURL = packageurl.NewPackageURL(

internal/formats/spdx22json/test-fixtures/snapshot/TestSPDXJSONDirectoryEncoder.golden

@@ -3,18 +3,18 @@
  "name": "/some/path",
  "spdxVersion": "SPDX-2.2",
  "creationInfo": {
-  "created": "2021-12-20T19:12:47.869816Z",
+  "created": "2022-04-01T15:48:39.459232Z",
   "creators": [
    "Organization: Anchore, Inc",
    "Tool: syft-[not provided]"
   ],
-  "licenseListVersion": "3.15"
+  "licenseListVersion": "3.16"
  },
  "dataLicense": "CC0-1.0",
- "documentNamespace": "https://anchore.com/syft/dir/some/path-4b896ded-7852-4e31-b764-136b53bdf346",
+ "documentNamespace": "https://anchore.com/syft/dir/some/path-8d335d81-29c9-4236-84f1-2292ea92aaf5",
  "packages": [
   {
-   "SPDXID": "SPDXRef-1d97af55efe9512f",
+   "SPDXID": "SPDXRef-b85dbb4e6ece5082",
    "name": "package-1",
    "licenseConcluded": "MIT",
    "downloadLocation": "NOASSERTION",
@@ -36,7 +36,7 @@
    "versionInfo": "1.0.1"
   },
   {
-   "SPDXID": "SPDXRef-ad3d1c4abd84bf75",
+   "SPDXID": "SPDXRef-ceda99598967ae8d",
    "name": "package-2",
    "licenseConcluded": "NONE",
    "downloadLocation": "NOASSERTION",
@@ -48,7 +48,7 @@
     },
     {
      "referenceCategory": "PACKAGE_MANAGER",
-     "referenceLocator": "a-purl-2",
+     "referenceLocator": "pkg:deb/debian/package-2@2.0.1",
      "referenceType": "purl"
     }
    ],

internal/formats/spdx22json/test-fixtures/snapshot/TestSPDXJSONImageEncoder.golden

@@ -3,18 +3,18 @@
  "name": "user-image-input",
  "spdxVersion": "SPDX-2.2",
  "creationInfo": {
-  "created": "2021-12-20T19:13:07.647486Z",
+  "created": "2022-04-01T15:48:39.465643Z",
   "creators": [
    "Organization: Anchore, Inc",
    "Tool: syft-[not provided]"
   ],
-  "licenseListVersion": "3.15"
+  "licenseListVersion": "3.16"
  },
  "dataLicense": "CC0-1.0",
- "documentNamespace": "https://anchore.com/syft/image/user-image-input-174da656-1824-4bd3-8604-28919f8a65bc",
+ "documentNamespace": "https://anchore.com/syft/image/user-image-input-e64e0be8-5031-4eec-842d-e59fb6deb518",
  "packages": [
   {
-   "SPDXID": "SPDXRef-d16127444133b5c1",
+   "SPDXID": "SPDXRef-2a46171f91c8d4bc",
    "name": "package-1",
    "licenseConcluded": "MIT",
    "downloadLocation": "NOASSERTION",
@@ -36,7 +36,7 @@
    "versionInfo": "1.0.1"
   },
   {
-   "SPDXID": "SPDXRef-24907357f3705420",
+   "SPDXID": "SPDXRef-ae77680e9b1d087e",
    "name": "package-2",
    "licenseConcluded": "NONE",
    "downloadLocation": "NOASSERTION",
@@ -48,7 +48,7 @@
     },
     {
      "referenceCategory": "PACKAGE_MANAGER",
-     "referenceLocator": "a-purl-2",
+     "referenceLocator": "pkg:deb/debian/package-2@2.0.1",
      "referenceType": "purl"
     }
    ],

internal/formats/spdx22tagvalue/test-fixtures/snapshot/TestSPDXTagValueDirectoryEncoder.golden

@@ -2,16 +2,16 @@ SPDXVersion: SPDX-2.2
 DataLicense: CC0-1.0
 SPDXID: SPDXRef-DOCUMENT
 DocumentName: /some/path
-DocumentNamespace: https://anchore.com/syft/dir/some/path-4b90f56d-d596-4ad8-b6a5-17f7d801350d
+DocumentNamespace: https://anchore.com/syft/dir/some/path-d227b0f2-4ee8-4e10-ac43-019db86d16ff
 LicenseListVersion: 3.16
 Creator: Organization: Anchore, Inc
 Creator: Tool: syft-[not provided]
-Created: 2022-02-10T21:09:27Z
+Created: 2022-04-01T15:48:44Z
 
 ##### Package: package-2
 
 PackageName: package-2
-SPDXID: SPDXRef-Package-deb-package-2-ad3d1c4abd84bf75
+SPDXID: SPDXRef-Package-deb-package-2-ceda99598967ae8d
 PackageVersion: 2.0.1
 PackageDownloadLocation: NOASSERTION
 FilesAnalyzed: false
@@ -19,12 +19,12 @@ PackageLicenseConcluded: NONE
 PackageLicenseDeclared: NONE
 PackageCopyrightText: NOASSERTION
 ExternalRef: SECURITY cpe23Type cpe:2.3:*:some:package:2:*:*:*:*:*:*:*
-ExternalRef: PACKAGE_MANAGER purl a-purl-2
+ExternalRef: PACKAGE_MANAGER purl pkg:deb/debian/package-2@2.0.1
 
 ##### Package: package-1
 
 PackageName: package-1
-SPDXID: SPDXRef-Package-python-package-1-1d97af55efe9512f
+SPDXID: SPDXRef-Package-python-package-1-b85dbb4e6ece5082
 PackageVersion: 1.0.1
 PackageDownloadLocation: NOASSERTION
 FilesAnalyzed: false

internal/formats/spdx22tagvalue/test-fixtures/snapshot/TestSPDXTagValueImageEncoder.golden

@@ -2,16 +2,16 @@ SPDXVersion: SPDX-2.2
 DataLicense: CC0-1.0
 SPDXID: SPDXRef-DOCUMENT
 DocumentName: user-image-input
-DocumentNamespace: https://anchore.com/syft/image/user-image-input-26a2def6-53d0-4504-b99a-a046832508ac
+DocumentNamespace: https://anchore.com/syft/image/user-image-input-49f98c61-3418-4427-9e00-8b1c735e9799
 LicenseListVersion: 3.16
 Creator: Organization: Anchore, Inc
 Creator: Tool: syft-[not provided]
-Created: 2022-02-10T21:09:27Z
+Created: 2022-04-01T15:48:44Z
 
 ##### Package: package-2
 
 PackageName: package-2
-SPDXID: SPDXRef-Package-deb-package-2-73f796c846875b9e
+SPDXID: SPDXRef-Package-deb-package-2-ae77680e9b1d087e
 PackageVersion: 2.0.1
 PackageDownloadLocation: NOASSERTION
 FilesAnalyzed: false
@@ -19,12 +19,12 @@ PackageLicenseConcluded: NONE
 PackageLicenseDeclared: NONE
 PackageCopyrightText: NOASSERTION
 ExternalRef: SECURITY cpe23Type cpe:2.3:*:some:package:2:*:*:*:*:*:*:*
-ExternalRef: PACKAGE_MANAGER purl a-purl-2
+ExternalRef: PACKAGE_MANAGER purl pkg:deb/debian/package-2@2.0.1
 
 ##### Package: package-1
 
 PackageName: package-1
-SPDXID: SPDXRef-Package-python-package-1-d9527e708c11f8b9
+SPDXID: SPDXRef-Package-python-package-1-2a46171f91c8d4bc
 PackageVersion: 1.0.1
 PackageDownloadLocation: NOASSERTION
 FilesAnalyzed: false

internal/formats/syftjson/encoder_test.go

@@ -42,13 +42,13 @@ func TestEncodeFullJSONDocument(t *testing.T) {
 	p1 := pkg.Package{
 		Name:    "package-1",
 		Version: "1.0.1",
-		Locations: []source.Location{
-			{
+		Locations: source.NewLocationSet(
+			source.Location{
 				Coordinates: source.Coordinates{
 					RealPath: "/a/place/a",
 				},
 			},
-		},
+		),
 		Type:         pkg.PythonPkg,
 		FoundBy:      "the-cataloger-1",
 		Language:     pkg.Python,
@@ -68,13 +68,13 @@ func TestEncodeFullJSONDocument(t *testing.T) {
 	p2 := pkg.Package{
 		Name:    "package-2",
 		Version: "2.0.1",
-		Locations: []source.Location{
-			{
+		Locations: source.NewLocationSet(
+			source.Location{
 				Coordinates: source.Coordinates{
 					RealPath: "/b/place/b",
 				},
 			},
-		},
+		),
 		Type:         pkg.DebPkg,
 		FoundBy:      "the-cataloger-2",
 		MetadataType: pkg.DpkgMetadataType,

internal/formats/syftjson/model/package.go

@@ -130,6 +130,12 @@ func (p *Package) UnmarshalJSON(b []byte) error {
 			return err
 		}
 		p.Metadata = payload
+	case pkg.DartPubMetadataType:
+		var payload pkg.DartPubMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
 	default:
 		log.Warnf("unknown package metadata type=%q for packageID=%q", p.MetadataType, p.ID)
 	}

internal/formats/syftjson/test-fixtures/snapshot/TestDirectoryEncoder.golden

@@ -1,7 +1,7 @@
 {
  "artifacts": [
   {
-   "id": "1d97af55efe9512f",
+   "id": "b85dbb4e6ece5082",
    "name": "package-1",
    "version": "1.0.1",
    "type": "python",
@@ -36,7 +36,7 @@
    }
   },
   {
-   "id": "ad3d1c4abd84bf75",
+   "id": "ceda99598967ae8d",
    "name": "package-2",
    "version": "2.0.1",
    "type": "deb",
@@ -51,7 +51,7 @@
    "cpes": [
     "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"
    ],
-   "purl": "a-purl-2",
+   "purl": "pkg:deb/debian/package-2@2.0.1",
    "metadataType": "DpkgMetadata",
    "metadata": {
     "package": "package-2",
@@ -88,7 +88,7 @@
   }
  },
  "schema": {
-  "version": "3.2.1",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.2.1.json"
+  "version": "3.2.2",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.2.2.json"
  }
 }

internal/formats/syftjson/test-fixtures/snapshot/TestEncodeFullJSONDocument.golden

@@ -1,7 +1,7 @@
 {
  "artifacts": [
   {
-   "id": "d9a7c58726ab4bef",
+   "id": "b3fa3ee64756b0c6",
    "name": "package-1",
    "version": "1.0.1",
    "type": "python",
@@ -31,7 +31,7 @@
    }
   },
   {
-   "id": "ac462e450060da2c",
+   "id": "b324f4d9ee5413fe",
    "name": "package-2",
    "version": "2.0.1",
    "type": "deb",
@@ -184,7 +184,7 @@
   }
  },
  "schema": {
-  "version": "3.2.1",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.2.1.json"
+  "version": "3.2.2",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.2.2.json"
  }
 }

internal/formats/syftjson/test-fixtures/snapshot/TestImageEncoder.golden

@@ -1,7 +1,7 @@
 {
  "artifacts": [
   {
-   "id": "d9527e708c11f8b9",
+   "id": "2a46171f91c8d4bc",
    "name": "package-1",
    "version": "1.0.1",
    "type": "python",
@@ -32,7 +32,7 @@
    }
   },
   {
-   "id": "73f796c846875b9e",
+   "id": "ae77680e9b1d087e",
    "name": "package-2",
    "version": "2.0.1",
    "type": "deb",
@@ -48,7 +48,7 @@
    "cpes": [
     "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"
    ],
-   "purl": "a-purl-2",
+   "purl": "pkg:deb/debian/package-2@2.0.1",
    "metadataType": "DpkgMetadata",
    "metadata": {
     "package": "package-2",
@@ -111,7 +111,7 @@
   }
  },
  "schema": {
-  "version": "3.2.1",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.2.1.json"
+  "version": "3.2.2",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.2.2.json"
  }
 }

internal/formats/syftjson/to_format_model.go

@@ -175,8 +175,9 @@ func toPackageModel(p pkg.Package) model.Package {
 		licenses = p.Licenses
 	}
 
-	var coordinates = make([]source.Coordinates, len(p.Locations))
-	for i, l := range p.Locations {
+	locations := p.Locations.ToSlice()
+	var coordinates = make([]source.Coordinates, len(locations))
+	for i, l := range locations {
 		coordinates[i] = l.Coordinates
 	}
 

internal/formats/syftjson/to_syft_model.go

@@ -53,7 +53,8 @@ func toSyftRelationships(doc *model.Document, catalog *pkg.Catalog, relationship
 
 	for _, p := range catalog.Sorted() {
 		idMap[string(p.ID())] = p
-		for _, l := range p.Locations {
+		locations := p.Locations.ToSlice()
+		for _, l := range locations {
 			idMap[string(l.Coordinates.ID())] = l.Coordinates
 		}
 	}
@@ -166,7 +167,7 @@ func toSyftPackage(p model.Package, idAliases map[string]string) pkg.Package {
 		Name:         p.Name,
 		Version:      p.Version,
 		FoundBy:      p.FoundBy,
-		Locations:    locations,
+		Locations:    source.NewLocationSet(locations...),
 		Licenses:     p.Licenses,
 		Language:     p.Language,
 		Type:         p.Type,

schema/json/generate.go

@@ -37,6 +37,7 @@ type artifactMetadataContainer struct {
 	Cargo  pkg.CargoPackageMetadata
 	Go     pkg.GolangBinMetadata
 	Php    pkg.PhpComposerJSONMetadata
+	Dart   pkg.DartPubMetadata
 }
 
 func main() {

syft/formats_test.go

@@ -1,6 +1,7 @@
 package syft
 
 import (
+	"bytes"
 	"io"
 	"os"
 	"testing"
@@ -41,6 +42,31 @@ func TestIdentify(t *testing.T) {
 	}
 }
 
+func TestFormats_EmptyInput(t *testing.T) {
+	for _, format := range formats {
+		t.Run(format.ID().String(), func(t *testing.T) {
+			t.Run("format.Decode", func(t *testing.T) {
+				input := bytes.NewReader(nil)
+
+				assert.NotPanics(t, func() {
+					decodedSBOM, err := format.Decode(input)
+					assert.Error(t, err)
+					assert.Nil(t, decodedSBOM)
+				})
+			})
+
+			t.Run("format.Validate", func(t *testing.T) {
+				input := bytes.NewReader(nil)
+
+				assert.NotPanics(t, func() {
+					err := format.Validate(input)
+					assert.Error(t, err)
+				})
+			})
+		})
+	}
+}
+
 func TestFormatByName(t *testing.T) {
 
 	tests := []struct {

syft/pkg/catalog.go

@@ -10,11 +10,28 @@ import (
 	"github.com/jinzhu/copier"
 )
 
+type orderedIDSet struct {
+	slice []artifact.ID
+}
+
+func (s *orderedIDSet) add(ids ...artifact.ID) {
+loopNewIDs:
+	for _, newID := range ids {
+		for _, existingID := range s.slice {
+			if existingID == newID {
+				continue loopNewIDs
+			}
+		}
+		s.slice = append(s.slice, newID)
+	}
+}
+
 // Catalog represents a collection of Packages.
 type Catalog struct {
 	byID      map[artifact.ID]Package
-	idsByType map[Type][]artifact.ID
-	idsByPath map[string][]artifact.ID // note: this is real path or virtual path
+	idsByName map[string]orderedIDSet
+	idsByType map[Type]orderedIDSet
+	idsByPath map[string]orderedIDSet // note: this is real path or virtual path
 	lock      sync.RWMutex
 }
 
@@ -22,8 +39,9 @@ type Catalog struct {
 func NewCatalog(pkgs ...Package) *Catalog {
 	catalog := Catalog{
 		byID:      make(map[artifact.ID]Package),
-		idsByType: make(map[Type][]artifact.ID),
-		idsByPath: make(map[string][]artifact.ID),
+		idsByName: make(map[string]orderedIDSet),
+		idsByType: make(map[Type]orderedIDSet),
+		idsByPath: make(map[string]orderedIDSet),
 	}
 
 	for _, p := range pkgs {
@@ -55,7 +73,12 @@ func (c *Catalog) Package(id artifact.ID) *Package {
 
 // PackagesByPath returns all packages that were discovered from the given path.
 func (c *Catalog) PackagesByPath(path string) []Package {
-	return c.Packages(c.idsByPath[path])
+	return c.Packages(c.idsByPath[path].slice)
+}
+
+// PackagesByName returns all packages that were discovered with a matching name.
+func (c *Catalog) PackagesByName(name string) []Package {
+	return c.Packages(c.idsByName[name].slice)
 }
 
 // Packages returns all packages for the given ID.
@@ -81,26 +104,58 @@ func (c *Catalog) Add(p Package) {
 		id = p.ID()
 	}
 
-	// store by package ID
-	c.byID[id] = p
+	if existing, exists := c.byID[id]; exists {
+		// there is already a package with this fingerprint merge the existing record with the new one
+		if err := existing.merge(p); err != nil {
+			log.Warnf("failed to merge packages: %+v", err)
+		} else {
+			c.addPathsToIndex(p)
+		}
+		return
+	}
 
-	// store by package type
-	c.idsByType[p.Type] = append(c.idsByType[p.Type], id)
+	c.addToIndex(p)
+}
 
-	// store by file location paths
+func (c *Catalog) addToIndex(p Package) {
+	c.byID[p.id] = p
+	c.addNameToIndex(p)
+	c.addTypeToIndex(p)
+	c.addPathsToIndex(p)
+}
+
+func (c *Catalog) addNameToIndex(p Package) {
+	nameIndex := c.idsByName[p.Name]
+	nameIndex.add(p.id)
+	c.idsByName[p.Name] = nameIndex
+}
+
+func (c *Catalog) addTypeToIndex(p Package) {
+	typeIndex := c.idsByType[p.Type]
+	typeIndex.add(p.id)
+	c.idsByType[p.Type] = typeIndex
+}
+
+func (c *Catalog) addPathsToIndex(p Package) {
 	observedPaths := internal.NewStringSet()
-	for _, l := range p.Locations {
+	for _, l := range p.Locations.ToSlice() {
 		if l.RealPath != "" && !observedPaths.Contains(l.RealPath) {
-			c.idsByPath[l.RealPath] = append(c.idsByPath[l.RealPath], id)
+			c.addPathToIndex(p.id, l.RealPath)
 			observedPaths.Add(l.RealPath)
 		}
 		if l.VirtualPath != "" && l.RealPath != l.VirtualPath && !observedPaths.Contains(l.VirtualPath) {
-			c.idsByPath[l.VirtualPath] = append(c.idsByPath[l.VirtualPath], id)
+			c.addPathToIndex(p.id, l.VirtualPath)
 			observedPaths.Add(l.VirtualPath)
 		}
 	}
 }
 
+func (c *Catalog) addPathToIndex(id artifact.ID, path string) {
+	pathIndex := c.idsByPath[path]
+	pathIndex.add(id)
+	c.idsByPath[path] = pathIndex
+}
+
 // Enumerate all packages for the given type(s), enumerating all packages if no type is specified.
 func (c *Catalog) Enumerate(types ...Type) <-chan Package {
 	channel := make(chan Package)
@@ -124,7 +179,7 @@ func (c *Catalog) Enumerate(types ...Type) <-chan Package {
 					continue
 				}
 			}
-			for _, id := range ids {
+			for _, id := range ids.slice {
 				p := c.Package(id)
 				if p != nil {
 					channel <- *p
@@ -145,8 +200,10 @@ func (c *Catalog) Sorted(types ...Type) (pkgs []Package) {
 	sort.SliceStable(pkgs, func(i, j int) bool {
 		if pkgs[i].Name == pkgs[j].Name {
 			if pkgs[i].Version == pkgs[j].Version {
-				if pkgs[i].Type == pkgs[j].Type && len(pkgs[i].Locations) > 0 && len(pkgs[j].Locations) > 0 {
-					return pkgs[i].Locations[0].String() < pkgs[j].Locations[0].String()
+				iLocations := pkgs[i].Locations.ToSlice()
+				jLocations := pkgs[j].Locations.ToSlice()
+				if pkgs[i].Type == pkgs[j].Type && len(iLocations) > 0 && len(jLocations) > 0 {
+					return iLocations[0].String() < jLocations[0].String()
 				}
 				return pkgs[i].Type < pkgs[j].Type
 			}

syft/pkg/catalog_test.go

@@ -3,11 +3,11 @@ package pkg
 import (
 	"testing"
 
-	"github.com/stretchr/testify/assert"
-
-	"github.com/scylladb/go-set/strset"
-
+	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/source"
+	"github.com/scylladb/go-set/strset"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 type expectedIndexes struct {
@@ -19,17 +19,17 @@ func TestCatalogAddPopulatesIndex(t *testing.T) {
 
 	var pkgs = []Package{
 		{
-			Locations: []source.Location{
+			Locations: source.NewLocationSet(
 				source.NewVirtualLocation("/a/path", "/another/path"),
 				source.NewVirtualLocation("/b/path", "/bee/path"),
-			},
+			),
 			Type: RpmPkg,
 		},
 		{
-			Locations: []source.Location{
+			Locations: source.NewLocationSet(
 				source.NewVirtualLocation("/c/path", "/another/path"),
 				source.NewVirtualLocation("/d/path", "/another/path"),
-			},
+			),
 			Type: NpmPkg,
 		},
 	}
@@ -106,47 +106,169 @@ func assertIndexes(t *testing.T, c *Catalog, expectedIndexes expectedIndexes) {
 
 func TestCatalog_PathIndexDeduplicatesRealVsVirtualPaths(t *testing.T) {
 	p1 := Package{
-		Locations: []source.Location{
+		Locations: source.NewLocationSet(
 			source.NewVirtualLocation("/b/path", "/another/path"),
 			source.NewVirtualLocation("/b/path", "/b/path"),
-		},
+		),
 		Type: RpmPkg,
 		Name: "Package-1",
 	}
 
 	p2 := Package{
-		Locations: []source.Location{
+		Locations: source.NewLocationSet(
 			source.NewVirtualLocation("/b/path", "/b/path"),
-		},
+		),
 		Type: RpmPkg,
 		Name: "Package-2",
 	}
+	p2Dup := Package{
+		Locations: source.NewLocationSet(
+			source.NewVirtualLocation("/b/path", "/another/path"),
+			source.NewVirtualLocation("/b/path", "/c/path/b/dup"),
+		),
+		Type: RpmPkg,
+		Name: "Package-2",
+	}
+
 	tests := []struct {
-		name string
-		pkg  Package
+		name  string
+		pkgs  []Package
+		paths []string
 	}{
 		{
 			name: "multiple locations with shared path",
-			pkg:  p1,
+			pkgs: []Package{p1},
+			paths: []string{
+				"/b/path",
+				"/another/path",
+			},
 		},
 		{
 			name: "one location with shared path",
-			pkg:  p2,
+			pkgs: []Package{p2},
+			paths: []string{
+				"/b/path",
+			},
+		},
+		{
+			name: "two instances with similar locations",
+			pkgs: []Package{p2, p2Dup},
+			paths: []string{
+				"/b/path",
+				"/another/path",
+				"/c/path/b/dup", // this updated the path index on merge
+			},
 		},
 	}
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			actual := NewCatalog(test.pkg).PackagesByPath("/b/path")
-			if len(actual) != 1 {
-				t.Errorf("expected exactly one package path, got %d", len(actual))
+			for _, path := range test.paths {
+				actualPackages := NewCatalog(test.pkgs...).PackagesByPath(path)
+				require.Len(t, actualPackages, 1)
 			}
 		})
 	}
 
 }
 
+func TestCatalog_MergeRecords(t *testing.T) {
+	var tests = []struct {
+		name              string
+		pkgs              []Package
+		expectedLocations []source.Location
+	}{
+		{
+			name: "multiple Locations with shared path",
+			pkgs: []Package{
+				{
+					Locations: source.NewLocationSet(
+						source.Location{
+							Coordinates: source.Coordinates{
+								RealPath:     "/b/path",
+								FileSystemID: "a",
+							},
+							VirtualPath: "/another/path",
+						},
+					),
+					Type: RpmPkg,
+				},
+				{
+					Locations: source.NewLocationSet(
+						source.Location{
+							Coordinates: source.Coordinates{
+								RealPath:     "/b/path",
+								FileSystemID: "b",
+							},
+							VirtualPath: "/another/path",
+						},
+					),
+					Type: RpmPkg,
+				},
+			},
+			expectedLocations: []source.Location{
+				{
+					Coordinates: source.Coordinates{
+						RealPath:     "/b/path",
+						FileSystemID: "a",
+					},
+					VirtualPath: "/another/path",
+				},
+				{
+					Coordinates: source.Coordinates{
+						RealPath:     "/b/path",
+						FileSystemID: "b",
+					},
+					VirtualPath: "/another/path",
+				},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			actual := NewCatalog(tt.pkgs...).PackagesByPath("/b/path")
+			require.Len(t, actual, 1)
+			assert.Equal(t, tt.expectedLocations, actual[0].Locations.ToSlice())
+		})
+	}
+}
+
 func TestCatalog_EnumerateNilCatalog(t *testing.T) {
 	var c *Catalog
 	assert.Empty(t, c.Enumerate())
 }
+
+func Test_idOrderedSet_add(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    []artifact.ID
+		expected []artifact.ID
+	}{
+		{
+			name: "elements deduplicated when added",
+			input: []artifact.ID{
+				"1", "2", "3", "4", "1", "2", "3", "4", "1", "2", "3", "4",
+			},
+			expected: []artifact.ID{
+				"1", "2", "3", "4",
+			},
+		},
+		{
+			name: "elements retain ordering when added",
+			input: []artifact.ID{
+				"4", "3", "2", "1",
+			},
+			expected: []artifact.ID{
+				"4", "3", "2", "1",
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var s orderedIDSet
+			s.add(tt.input...)
+			assert.Equal(t, tt.expected, s.slice)
+		})
+	}
+}

syft/pkg/cataloger/cataloger.go

@@ -9,6 +9,7 @@ import (
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/apkdb"
+	"github.com/anchore/syft/syft/pkg/cataloger/dart"
 	"github.com/anchore/syft/syft/pkg/cataloger/deb"
 	"github.com/anchore/syft/syft/pkg/cataloger/golang"
 	"github.com/anchore/syft/syft/pkg/cataloger/java"
@@ -61,6 +62,7 @@ func DirectoryCatalogers(cfg Config) []Cataloger {
 		golang.NewGoModuleBinaryCataloger(),
 		golang.NewGoModFileCataloger(),
 		rust.NewCargoLockCataloger(),
+		dart.NewPubspecLockCataloger(),
 	}
 }
 
@@ -80,5 +82,6 @@ func AllCatalogers(cfg Config) []Cataloger {
 		golang.NewGoModuleBinaryCataloger(),
 		golang.NewGoModFileCataloger(),
 		rust.NewCargoLockCataloger(),
+		dart.NewPubspecLockCataloger(),
 	}
 }

syft/pkg/cataloger/common/cpe/filter_test.go

@@ -16,7 +16,7 @@ func Test_disallowJenkinsServerCPEForPluginPackage(t *testing.T) {
 	}{
 		{
 			name: "go case (filter out)",
-			cpe:  mustCPE("cpe:2.3:a:name:jenkins:3.2:*:*:*:*:*:*:*"),
+			cpe:  pkg.MustCPE("cpe:2.3:a:name:jenkins:3.2:*:*:*:*:*:*:*"),
 			pkg: pkg.Package{
 				Type: pkg.JenkinsPluginPkg,
 			},
@@ -24,7 +24,7 @@ func Test_disallowJenkinsServerCPEForPluginPackage(t *testing.T) {
 		},
 		{
 			name: "ignore jenkins plugins with unique name",
-			cpe:  mustCPE("cpe:2.3:a:name:ci-jenkins:3.2:*:*:*:*:*:*:*"),
+			cpe:  pkg.MustCPE("cpe:2.3:a:name:ci-jenkins:3.2:*:*:*:*:*:*:*"),
 			pkg: pkg.Package{
 				Type: pkg.JenkinsPluginPkg,
 			},
@@ -32,7 +32,7 @@ func Test_disallowJenkinsServerCPEForPluginPackage(t *testing.T) {
 		},
 		{
 			name: "ignore java packages",
-			cpe:  mustCPE("cpe:2.3:a:name:jenkins:3.2:*:*:*:*:*:*:*"),
+			cpe:  pkg.MustCPE("cpe:2.3:a:name:jenkins:3.2:*:*:*:*:*:*:*"),
 			pkg: pkg.Package{
 				Type: pkg.JavaPkg,
 			},
@@ -55,7 +55,7 @@ func Test_disallowJenkinsCPEsNotAssociatedWithJenkins(t *testing.T) {
 	}{
 		{
 			name: "filter out mismatched name (cloudbees vendor)",
-			cpe:  mustCPE("cpe:2.3:a:cloudbees:jenkins:3.2:*:*:*:*:*:*:*"),
+			cpe:  pkg.MustCPE("cpe:2.3:a:cloudbees:jenkins:3.2:*:*:*:*:*:*:*"),
 			pkg: pkg.Package{
 				Name: "not-j*nkins",
 				Type: pkg.JavaPkg,
@@ -64,7 +64,7 @@ func Test_disallowJenkinsCPEsNotAssociatedWithJenkins(t *testing.T) {
 		},
 		{
 			name: "filter out mismatched name (jenkins vendor)",
-			cpe:  mustCPE("cpe:2.3:a:jenkins:jenkins:3.2:*:*:*:*:*:*:*"),
+			cpe:  pkg.MustCPE("cpe:2.3:a:jenkins:jenkins:3.2:*:*:*:*:*:*:*"),
 			pkg: pkg.Package{
 				Name: "not-j*nkins",
 				Type: pkg.JavaPkg,
@@ -73,7 +73,7 @@ func Test_disallowJenkinsCPEsNotAssociatedWithJenkins(t *testing.T) {
 		},
 		{
 			name: "filter out mismatched name (any vendor)",
-			cpe:  mustCPE("cpe:2.3:a:*:jenkins:3.2:*:*:*:*:*:*:*"),
+			cpe:  pkg.MustCPE("cpe:2.3:a:*:jenkins:3.2:*:*:*:*:*:*:*"),
 			pkg: pkg.Package{
 				Name: "not-j*nkins",
 				Type: pkg.JavaPkg,
@@ -82,7 +82,7 @@ func Test_disallowJenkinsCPEsNotAssociatedWithJenkins(t *testing.T) {
 		},
 		{
 			name: "ignore packages with the name jenkins",
-			cpe:  mustCPE("cpe:2.3:a:*:jenkins:3.2:*:*:*:*:*:*:*"),
+			cpe:  pkg.MustCPE("cpe:2.3:a:*:jenkins:3.2:*:*:*:*:*:*:*"),
 			pkg: pkg.Package{
 				Name: "jenkins-thing",
 				Type: pkg.JavaPkg,
@@ -91,7 +91,7 @@ func Test_disallowJenkinsCPEsNotAssociatedWithJenkins(t *testing.T) {
 		},
 		{
 			name: "ignore product names that are not exactly 'jenkins'",
-			cpe:  mustCPE("cpe:2.3:a:*:jenkins-something-else:3.2:*:*:*:*:*:*:*"),
+			cpe:  pkg.MustCPE("cpe:2.3:a:*:jenkins-something-else:3.2:*:*:*:*:*:*:*"),
 			pkg: pkg.Package{
 				Name: "not-j*nkins",
 				Type: pkg.JavaPkg,
@@ -115,7 +115,7 @@ func Test_disallowJiraClientServerMismatch(t *testing.T) {
 	}{
 		{
 			name: "filter out mismatched name (atlassian vendor)",
-			cpe:  mustCPE("cpe:2.3:a:atlassian:jira:3.2:*:*:*:*:*:*:*"),
+			cpe:  pkg.MustCPE("cpe:2.3:a:atlassian:jira:3.2:*:*:*:*:*:*:*"),
 			pkg: pkg.Package{
 				Name: "something-client",
 				Type: pkg.JavaPkg,
@@ -124,7 +124,7 @@ func Test_disallowJiraClientServerMismatch(t *testing.T) {
 		},
 		{
 			name: "filter out mismatched name (jira vendor)",
-			cpe:  mustCPE("cpe:2.3:a:jira:jira:3.2:*:*:*:*:*:*:*"),
+			cpe:  pkg.MustCPE("cpe:2.3:a:jira:jira:3.2:*:*:*:*:*:*:*"),
 			pkg: pkg.Package{
 				Name: "something-client",
 				Type: pkg.JavaPkg,
@@ -133,7 +133,7 @@ func Test_disallowJiraClientServerMismatch(t *testing.T) {
 		},
 		{
 			name: "filter out mismatched name (any vendor)",
-			cpe:  mustCPE("cpe:2.3:a:*:jira:3.2:*:*:*:*:*:*:*"),
+			cpe:  pkg.MustCPE("cpe:2.3:a:*:jira:3.2:*:*:*:*:*:*:*"),
 			pkg: pkg.Package{
 				Name: "something-client",
 				Type: pkg.JavaPkg,
@@ -142,7 +142,7 @@ func Test_disallowJiraClientServerMismatch(t *testing.T) {
 		},
 		{
 			name: "ignore package names that do not have 'client'",
-			cpe:  mustCPE("cpe:2.3:a:*:jira:3.2:*:*:*:*:*:*:*"),
+			cpe:  pkg.MustCPE("cpe:2.3:a:*:jira:3.2:*:*:*:*:*:*:*"),
 			pkg: pkg.Package{
 				Name: "jira-thing",
 				Type: pkg.JavaPkg,
@@ -151,7 +151,7 @@ func Test_disallowJiraClientServerMismatch(t *testing.T) {
 		},
 		{
 			name: "ignore product names that are not exactly 'jira'",
-			cpe:  mustCPE("cpe:2.3:a:*:jira-something-else:3.2:*:*:*:*:*:*:*"),
+			cpe:  pkg.MustCPE("cpe:2.3:a:*:jira-something-else:3.2:*:*:*:*:*:*:*"),
 			pkg: pkg.Package{
 				Name: "not-j*ra",
 				Type: pkg.JavaPkg,

syft/pkg/cataloger/common/cpe/generate.go

@@ -55,7 +55,7 @@ func Generate(p pkg.Package) []pkg.CPE {
 	// filter out any known combinations that don't accurately represent this package
 	cpes = filter(cpes, p, cpeFilters...)
 
-	sort.Sort(BySpecificity(cpes))
+	sort.Sort(pkg.CPEBySpecificity(cpes))
 
 	return cpes
 }

syft/pkg/cataloger/common/generic_cataloger.go

@@ -58,9 +58,8 @@ func (c *GenericCataloger) Catalog(resolver source.FileResolver) ([]pkg.Package,
 
 		for _, p := range discoveredPackages {
 			p.FoundBy = c.upstreamCataloger
-			p.Locations = append(p.Locations, location)
+			p.Locations.Add(location)
 			p.SetID()
-
 			packages = append(packages, *p)
 		}
 

syft/pkg/cataloger/common/generic_cataloger_test.go

@@ -53,7 +53,7 @@ func TestGenericCataloger(t *testing.T) {
 	assert.Len(t, actualPkgs, len(expectedPkgs))
 
 	for _, p := range actualPkgs {
-		ref := p.Locations[0]
+		ref := p.Locations.ToSlice()[0]
 		exP, ok := expectedPkgs[ref.RealPath]
 		if !ok {
 			t.Errorf("missing expected pkg: ref=%+v", ref)

syft/pkg/cataloger/dart/cataloger.go

@@ -0,0 +1,14 @@
+package dart
+
+import (
+	"github.com/anchore/syft/syft/pkg/cataloger/common"
+)
+
+// NewPubspecLockCataloger returns a new Dartlang cataloger object base on pubspec lock files.
+func NewPubspecLockCataloger() *common.GenericCataloger {
+	globParsers := map[string]common.ParserFn{
+		"**/pubspec.lock": parsePubspecLock,
+	}
+
+	return common.NewGenericCataloger(nil, globParsers, "dartlang-lock-cataloger")
+}

syft/pkg/cataloger/dart/parse_pubspec_lock.go

@@ -0,0 +1,96 @@
+package dart
+
+import (
+	"fmt"
+	"io"
+	"net/url"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/common"
+	"gopkg.in/yaml.v2"
+)
+
+// integrity check
+var _ common.ParserFn = parsePubspecLock
+
+const defaultPubRegistry string = "https://pub.dartlang.org"
+
+type pubspecLock struct {
+	Packages map[string]pubspecLockPackage `yaml:"packages"`
+	Sdks     map[string]string             `yaml:"sdks"`
+}
+
+type pubspecLockPackage struct {
+	Dependency  string                 `yaml:"dependency" mapstructure:"dependency"`
+	Description pubspecLockDescription `yaml:"description" mapstructure:"description"`
+	Source      string                 `yaml:"source" mapstructure:"source"`
+	Version     string                 `yaml:"version" mapstructure:"version"`
+}
+
+type pubspecLockDescription struct {
+	Name        string `yaml:"name" mapstructure:"name"`
+	URL         string `yaml:"url" mapstructure:"url"`
+	Path        string `yaml:"path" mapstructure:"path"`
+	Ref         string `yaml:"ref" mapstructure:"ref"`
+	ResolvedRef string `yaml:"resolved-ref" mapstructure:"resolved-ref"`
+}
+
+func parsePubspecLock(path string, reader io.Reader) ([]*pkg.Package, []artifact.Relationship, error) {
+	var packages []*pkg.Package
+
+	dec := yaml.NewDecoder(reader)
+
+	var p pubspecLock
+	if err := dec.Decode(&p); err != nil {
+		return nil, nil, fmt.Errorf("failed to parse pubspec.lock file: %w", err)
+	}
+
+	for name, pubPkg := range p.Packages {
+		packages = append(packages, newPubspecLockPackage(name, pubPkg))
+	}
+
+	return packages, nil, nil
+}
+
+func newPubspecLockPackage(name string, p pubspecLockPackage) *pkg.Package {
+	return &pkg.Package{
+		Name:         name,
+		Version:      p.Version,
+		Language:     pkg.Dart,
+		Type:         pkg.DartPubPkg,
+		MetadataType: pkg.DartPubMetadataType,
+		Metadata: &pkg.DartPubMetadata{
+			Name:      name,
+			Version:   p.Version,
+			HostedURL: p.getHostedURL(),
+			VcsURL:    p.getVcsURL(),
+		},
+	}
+}
+
+func (p *pubspecLockPackage) getVcsURL() string {
+	if p.Source == "git" {
+		if p.Description.Path == "." {
+			return fmt.Sprintf("%s@%s", p.Description.URL, p.Description.ResolvedRef)
+		}
+
+		return fmt.Sprintf("%s@%s#%s", p.Description.URL, p.Description.ResolvedRef, p.Description.Path)
+	}
+
+	return ""
+}
+
+func (p *pubspecLockPackage) getHostedURL() string {
+	if p.Source == "hosted" && p.Description.URL != defaultPubRegistry {
+		u, err := url.Parse(p.Description.URL)
+		if err != nil {
+			log.Debugf("Unable to parse registry url %w", err)
+			return p.Description.URL
+		}
+		return u.Host
+	}
+
+	return ""
+}

syft/pkg/cataloger/dart/parse_pubspec_lock_test.go

@@ -0,0 +1,99 @@
+package dart
+
+import (
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func assertPackagesEqual(t *testing.T, actual []*pkg.Package, expected map[string]*pkg.Package) {
+	assert.Len(t, actual, len(expected))
+}
+
+func TestParsePubspecLock(t *testing.T) {
+	expected := map[string]*pkg.Package{
+		"ale": {
+			Name:         "ale",
+			Version:      "3.3.0",
+			Language:     pkg.Dart,
+			Type:         pkg.DartPubPkg,
+			MetadataType: pkg.DartPubMetadataType,
+			Metadata: pkg.DartPubMetadata{
+				Name:      "ale",
+				Version:   "3.3.0",
+				HostedURL: "pub.hosted.org",
+			},
+		},
+		"analyzer": {
+			Name:         "analyzer",
+			Version:      "0.40.7",
+			Language:     pkg.Dart,
+			Type:         pkg.DartPubPkg,
+			MetadataType: pkg.DartPubMetadataType,
+			Metadata: pkg.DartPubMetadata{
+				Name:    "analyzer",
+				Version: "0.40.7",
+			},
+		},
+		"ansicolor": {
+			Name:         "ansicolor",
+			Version:      "1.1.1",
+			Language:     pkg.Dart,
+			Type:         pkg.DartPubPkg,
+			MetadataType: pkg.DartPubMetadataType,
+			Metadata: pkg.DartPubMetadata{
+				Name:    "ansicolor",
+				Version: "1.1.1",
+			},
+		},
+		"archive": {
+			Name:         "archive",
+			Version:      "2.0.13",
+			Language:     pkg.Dart,
+			Type:         pkg.DartPubPkg,
+			MetadataType: pkg.DartPubMetadataType,
+			Metadata: pkg.DartPubMetadata{
+				Name:    "archive",
+				Version: "2.0.13",
+			},
+		},
+		"args": {
+			Name:         "args",
+			Version:      "1.6.0",
+			Language:     pkg.Dart,
+			Type:         pkg.DartPubPkg,
+			MetadataType: pkg.DartPubMetadataType,
+			Metadata: pkg.DartPubMetadata{
+				Name:    "args",
+				Version: "1.6.0",
+			},
+		},
+		"key_binder": {
+			Name:         "key_binder",
+			Version:      "1.11.20",
+			Language:     pkg.Dart,
+			Type:         pkg.DartPubPkg,
+			MetadataType: pkg.DartPubMetadataType,
+			Metadata: pkg.DartPubMetadata{
+				Name:    "key_binder",
+				Version: "1.11.20",
+				VcsURL:  "git@github.com:Workiva/key_binder.git#3f7b3a6350e73c7dcac45301c0e18fbd42af02f7",
+			},
+		},
+	}
+
+	fixture, err := os.Open("test-fixtures/pubspec.lock")
+	if err != nil {
+		t.Fatalf("failed to open fixture: %+v", err)
+	}
+
+	actual, _, err := parsePubspecLock(fixture.Name(), fixture)
+	if err != nil {
+		t.Fatalf("failed to parse pubspec.lock: %+v", err)
+	}
+
+	assertPackagesEqual(t, actual, expected)
+}

syft/pkg/cataloger/dart/test-fixtures/pubspec.lock

@@ -0,0 +1,49 @@
+# Generated by pub
+# See https://dart.dev/tools/pub/glossary#lockfile
+packages:
+  ale:
+    dependency: transitive
+    description:
+      name: ale
+      url: "https://pub.hosted.org"
+    source: hosted
+    version: "3.3.0"
+  analyzer:
+    dependency: transitive
+    description:
+      name: analyzer
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "0.40.7"
+  ansicolor:
+    dependency: transitive
+    description:
+      name: ansicolor
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.1.1"
+  archive:
+    dependency: transitive
+    description:
+      name: archive
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "2.0.13"
+  args:
+    dependency: transitive
+    description:
+      name: args
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.6.0"
+  key_binder:
+    dependency: "direct main"
+    description:
+      path: "."
+      ref: HEAD
+      resolved-ref: "3f7b3a6350e73c7dcac45301c0e18fbd42af02f7"
+      url: "git@github.com:Workiva/key_binder.git"
+    source: git
+    version: "1.11.20"
+sdks:
+  dart: ">=2.12.0 <3.0.0"

syft/pkg/cataloger/deb/cataloger.go

@@ -60,7 +60,7 @@ func (c *Cataloger) Catalog(resolver source.FileResolver) ([]pkg.Package, []arti
 		for i := range pkgs {
 			p := &pkgs[i]
 			p.FoundBy = c.Name()
-			p.Locations = []source.Location{dbLocation}
+			p.Locations.Add(dbLocation)
 
 			// the current entry only has what may have been listed in the status file, however, there are additional
 			// files that are listed in multiple other locations. We should retrieve them all and merge the file lists
@@ -88,7 +88,7 @@ func addLicenses(resolver source.FileResolver, dbLocation source.Location, p *pk
 		p.Licenses = parseLicensesFromCopyright(copyrightReader)
 
 		// keep a record of the file where this was discovered
-		p.Locations = append(p.Locations, *copyrightLocation)
+		p.Locations.Add(*copyrightLocation)
 	}
 }
 
@@ -117,7 +117,7 @@ loopNewFiles:
 	p.Metadata = metadata
 
 	// persist location information from each new source of information
-	p.Locations = append(p.Locations, infoLocations...)
+	p.Locations.Add(infoLocations...)
 }
 
 func getAdditionalFileListing(resolver source.FileResolver, dbLocation source.Location, p *pkg.Package) ([]pkg.DpkgFileRecord, []source.Location) {

syft/pkg/cataloger/deb/cataloger_test.go

@@ -1,6 +1,7 @@
 package deb
 
 import (
+	"github.com/stretchr/testify/assert"
 	"testing"
 
 	"github.com/anchore/syft/syft/file"
@@ -115,15 +116,13 @@ func TestDpkgCataloger(t *testing.T) {
 			for idx := range actual {
 				a := &actual[idx]
 				// we will test the sources separately
-				var sourcesList = make([]string, len(a.Locations))
-				for i, s := range a.Locations {
+				var sourcesList = make([]string, len(a.Locations.ToSlice()))
+				for i, s := range a.Locations.ToSlice() {
 					sourcesList[i] = s.RealPath
 				}
-				a.Locations = nil
+				a.Locations = source.NewLocationSet()
 
-				for _, d := range deep.Equal(sourcesList, test.sources[a.Name]) {
-					t.Errorf("diff: %+v", d)
-				}
+				assert.ElementsMatch(t, sourcesList, test.sources[a.Name])
 			}
 
 			// test remaining fields...

syft/pkg/cataloger/golang/parse_go_bin.go

@@ -44,14 +44,12 @@ func newGoBinaryPackage(dep *debug.Module, goVersion, architecture string, locat
 	}
 
 	p := pkg.Package{
-		FoundBy:  catalogerName,
-		Name:     dep.Path,
-		Version:  dep.Version,
-		Language: pkg.Go,
-		Type:     pkg.GoModulePkg,
-		Locations: []source.Location{
-			location,
-		},
+		FoundBy:      catalogerName,
+		Name:         dep.Path,
+		Version:      dep.Version,
+		Language:     pkg.Go,
+		Type:         pkg.GoModulePkg,
+		Locations:    source.NewLocationSet(location),
 		MetadataType: pkg.GolangBinMetadataType,
 		Metadata: pkg.GolangBinMetadata{
 			GoCompiledVersion: goVersion,

syft/pkg/cataloger/golang/parse_go_bin_test.go

@@ -133,14 +133,14 @@ func TestBuildGoPkgInfo(t *testing.T) {
 		FoundBy:  catalogerName,
 		Language: pkg.Go,
 		Type:     pkg.GoModulePkg,
-		Locations: []source.Location{
-			{
+		Locations: source.NewLocationSet(
+			source.Location{
 				Coordinates: source.Coordinates{
 					RealPath:     "/a-path",
 					FileSystemID: "layer-id",
 				},
 			},
-		},
+		),
 		MetadataType: pkg.GolangBinMetadataType,
 		Metadata: pkg.GolangBinMetadata{
 			GoCompiledVersion: goCompiledVersion,
@@ -190,14 +190,14 @@ func TestBuildGoPkgInfo(t *testing.T) {
 					Version:  "v0.2.1",
 					Language: pkg.Go,
 					Type:     pkg.GoModulePkg,
-					Locations: []source.Location{
-						{
+					Locations: source.NewLocationSet(
+						source.Location{
 							Coordinates: source.Coordinates{
 								RealPath:     "/a-path",
 								FileSystemID: "layer-id",
 							},
 						},
-					},
+					),
 					MetadataType: pkg.GolangBinMetadataType,
 					Metadata: pkg.GolangBinMetadata{
 						GoCompiledVersion: goCompiledVersion,
@@ -252,14 +252,14 @@ func TestBuildGoPkgInfo(t *testing.T) {
 					Version:  "v0.2.1",
 					Language: pkg.Go,
 					Type:     pkg.GoModulePkg,
-					Locations: []source.Location{
-						{
+					Locations: source.NewLocationSet(
+						source.Location{
 							Coordinates: source.Coordinates{
 								RealPath:     "/a-path",
 								FileSystemID: "layer-id",
 							},
 						},
-					},
+					),
 					MetadataType: pkg.GolangBinMetadataType,
 					Metadata: pkg.GolangBinMetadata{
 						GoCompiledVersion: goCompiledVersion,
@@ -273,14 +273,14 @@ func TestBuildGoPkgInfo(t *testing.T) {
 					Version:  "v0.0.0-20210222170800-9c70f9b80bcf",
 					Language: pkg.Go,
 					Type:     pkg.GoModulePkg,
-					Locations: []source.Location{
-						{
+					Locations: source.NewLocationSet(
+						source.Location{
 							Coordinates: source.Coordinates{
 								RealPath:     "/a-path",
 								FileSystemID: "layer-id",
 							},
 						},
-					},
+					),
 					MetadataType: pkg.GolangBinMetadataType,
 					Metadata: pkg.GolangBinMetadata{
 						GoCompiledVersion: goCompiledVersion,
@@ -327,12 +327,14 @@ func TestBuildGoPkgInfo(t *testing.T) {
 					Version:  "v0.0.0-20211006194710-c8a6f5223071",
 					Language: pkg.Go,
 					Type:     pkg.GoModulePkg,
-					Locations: []source.Location{
-						{
+					Locations: source.NewLocationSet(
+						source.Location{
 							Coordinates: source.Coordinates{
 								RealPath:     "/a-path",
 								FileSystemID: "layer-id",
-							}}},
+							},
+						},
+					),
 					MetadataType: pkg.GolangBinMetadataType,
 					Metadata: pkg.GolangBinMetadata{
 						GoCompiledVersion: goCompiledVersion,
@@ -344,14 +346,14 @@ func TestBuildGoPkgInfo(t *testing.T) {
 					Version:  "v0.0.0-20210916214954-140adaaadfaf",
 					Language: pkg.Go,
 					Type:     pkg.GoModulePkg,
-					Locations: []source.Location{
-						{
+					Locations: source.NewLocationSet(
+						source.Location{
 							Coordinates: source.Coordinates{
 								RealPath:     "/a-path",
 								FileSystemID: "layer-id",
 							},
 						},
-					},
+					),
 					MetadataType: pkg.GolangBinMetadataType,
 					Metadata: pkg.GolangBinMetadata{
 						GoCompiledVersion: goCompiledVersion,

syft/pkg/cataloger/java/save_archive_to_tmp.go

@@ -5,14 +5,13 @@ import (
 	"io"
 	"io/ioutil"
 	"os"
-	"path"
 	"path/filepath"
 
 	"github.com/anchore/syft/internal/log"
 )
 
 func saveArchiveToTmp(archiveVirtualPath string, reader io.Reader) (string, string, func(), error) {
-	name := path.Base(archiveVirtualPath)
+	name := filepath.Base(archiveVirtualPath)
 	tempDir, err := ioutil.TempDir("", "syft-archive-contents-")
 	if err != nil {
 		return "", "", func() {}, fmt.Errorf("unable to create tempdir for archive processing: %w", err)

syft/pkg/cataloger/python/package_cataloger.go

@@ -80,7 +80,7 @@ func (c *PackageCataloger) catalogEggOrWheel(resolver source.FileResolver, metad
 		Name:         metadata.Name,
 		Version:      metadata.Version,
 		FoundBy:      c.Name(),
-		Locations:    sources,
+		Locations:    source.NewLocationSet(sources...),
 		Licenses:     licenses,
 		Language:     pkg.Python,
 		Type:         pkg.PythonPkg,

syft/pkg/cataloger/python/package_cataloger_test.go

@@ -144,7 +144,7 @@ func TestPythonPackageWheelCataloger(t *testing.T) {
 				t.Fatal(err)
 			}
 
-			test.expectedPackage.Locations = locations
+			test.expectedPackage.Locations = source.NewLocationSet(locations...)
 
 			actual, _, err := NewPythonPackageCataloger().Catalog(resolver)
 			if err != nil {

syft/pkg/cataloger/python/parse_pipfile_lock_test.go

@@ -1,6 +1,7 @@
 package python
 
 import (
+	"github.com/anchore/syft/syft/source"
 	"os"
 	"testing"
 
@@ -48,7 +49,14 @@ func TestParsePipFileLock(t *testing.T) {
 		t.Fatalf("failed to parse requirements: %+v", err)
 	}
 
-	if diff := cmp.Diff(expected, actual, cmp.AllowUnexported(pkg.Package{})); diff != "" {
+	if diff := cmp.Diff(expected, actual,
+		cmp.AllowUnexported(pkg.Package{}),
+		cmp.Comparer(
+			func(x, y source.LocationSet) bool {
+				return cmp.Equal(x.ToSlice(), y.ToSlice())
+			},
+		),
+	); diff != "" {
 		t.Errorf("unexpected result from parsing (-expected +actual)\n%s", diff)
 	}
 }

syft/pkg/cataloger/python/parse_requirements_test.go

@@ -1,6 +1,7 @@
 package python
 
 import (
+	"github.com/anchore/syft/syft/source"
 	"os"
 	"testing"
 
@@ -42,7 +43,14 @@ func TestParseRequirementsTxt(t *testing.T) {
 		t.Fatalf("failed to parse requirements: %+v", err)
 	}
 
-	if diff := cmp.Diff(expected, actual, cmp.AllowUnexported(pkg.Package{})); diff != "" {
+	if diff := cmp.Diff(expected, actual,
+		cmp.AllowUnexported(pkg.Package{}),
+		cmp.Comparer(
+			func(x, y source.LocationSet) bool {
+				return cmp.Equal(x.ToSlice(), y.ToSlice())
+			},
+		),
+	); diff != "" {
 		t.Errorf("unexpected result from parsing (-expected +actual)\n%s", diff)
 	}
 }

syft/pkg/cataloger/python/parse_setup_test.go

@@ -1,6 +1,7 @@
 package python
 
 import (
+	"github.com/anchore/syft/syft/source"
 	"os"
 	"testing"
 
@@ -54,7 +55,14 @@ func TestParseSetup(t *testing.T) {
 		t.Fatalf("failed to parse requirements: %+v", err)
 	}
 
-	if diff := cmp.Diff(expected, actual, cmp.AllowUnexported(pkg.Package{})); diff != "" {
+	if diff := cmp.Diff(expected, actual,
+		cmp.AllowUnexported(pkg.Package{}),
+		cmp.Comparer(
+			func(x, y source.LocationSet) bool {
+				return cmp.Equal(x.ToSlice(), y.ToSlice())
+			},
+		),
+	); diff != "" {
 		t.Errorf("unexpected result from parsing (-expected +actual)\n%s", diff)
 	}
 }

syft/pkg/cataloger/rpmdb/parse_rpmdb.go

@@ -63,7 +63,7 @@ func parseRpmDB(resolver source.FilePathResolver, dbLocation source.Location, re
 		p := pkg.Package{
 			Name:         entry.Name,
 			Version:      toELVersion(metadata),
-			Locations:    []source.Location{dbLocation},
+			Locations:    source.NewLocationSet(dbLocation),
 			FoundBy:      catalogerName,
 			Type:         pkg.RpmPkg,
 			MetadataType: pkg.RpmdbMetadataType,

syft/pkg/cataloger/rpmdb/parse_rpmdb_test.go

@@ -71,7 +71,7 @@ func TestParseRpmDB(t *testing.T) {
 				"dive": {
 					Name:         "dive",
 					Version:      "0.9.2-1",
-					Locations:    []source.Location{dbLocation},
+					Locations:    source.NewLocationSet(dbLocation),
 					FoundBy:      catalogerName,
 					Type:         pkg.RpmPkg,
 					MetadataType: pkg.RpmdbMetadataType,
@@ -98,7 +98,7 @@ func TestParseRpmDB(t *testing.T) {
 				"dive": {
 					Name:         "dive",
 					Version:      "0.9.2-1",
-					Locations:    []source.Location{dbLocation},
+					Locations:    source.NewLocationSet(dbLocation),
 					FoundBy:      catalogerName,
 					Type:         pkg.RpmPkg,
 					MetadataType: pkg.RpmdbMetadataType,

syft/pkg/cpe_by_specificity.go

@@ -1,4 +1,4 @@
-package cpe
+package pkg
 
 import (
 	"sort"
@@ -6,15 +6,15 @@ import (
 	"github.com/facebookincubator/nvdtools/wfn"
 )
 
-var _ sort.Interface = (*BySpecificity)(nil)
+var _ sort.Interface = (*CPEBySpecificity)(nil)
 
-type BySpecificity []wfn.Attributes
+type CPEBySpecificity []wfn.Attributes
 
-func (c BySpecificity) Len() int { return len(c) }
+func (c CPEBySpecificity) Len() int { return len(c) }
 
-func (c BySpecificity) Swap(i, j int) { c[i], c[j] = c[j], c[i] }
+func (c CPEBySpecificity) Swap(i, j int) { c[i], c[j] = c[j], c[i] }
 
-func (c BySpecificity) Less(i, j int) bool {
+func (c CPEBySpecificity) Less(i, j int) bool {
 	iScore := weightedCountForSpecifiedFields(c[i])
 	jScore := weightedCountForSpecifiedFields(c[j])
 

syft/pkg/cpe_by_specificity_test.go

@@ -1,40 +1,32 @@
-package cpe
+package pkg
 
 import (
 	"sort"
 	"testing"
 
-	"github.com/anchore/syft/syft/pkg"
 	"github.com/stretchr/testify/assert"
 )
 
-func mustCPE(c string) pkg.CPE {
-	return must(pkg.NewCPE(c))
-}
-
-func must(c pkg.CPE, e error) pkg.CPE {
-	if e != nil {
-		panic(e)
-	}
-	return c
+func mustCPE(c string) CPE {
+	return must(NewCPE(c))
 }
 
 func TestCPESpecificity(t *testing.T) {
 	tests := []struct {
 		name     string
-		input    []pkg.CPE
-		expected []pkg.CPE
+		input    []CPE
+		expected []CPE
 	}{
 		{
 			name: "sort strictly by wfn *",
-			input: []pkg.CPE{
+			input: []CPE{
 				mustCPE("cpe:2.3:a:*:package:1:*:*:*:*:*:*:*"),
 				mustCPE("cpe:2.3:a:some:package:1:*:*:*:*:*:*:*"),
 				mustCPE("cpe:2.3:a:*:package:1:*:*:*:*:some:*:*"),
 				mustCPE("cpe:2.3:a:some:package:1:*:*:*:*:some:*:*"),
 				mustCPE("cpe:2.3:a:some:package:*:*:*:*:*:*:*:*"),
 			},
-			expected: []pkg.CPE{
+			expected: []CPE{
 				mustCPE("cpe:2.3:a:some:package:1:*:*:*:*:some:*:*"),
 				mustCPE("cpe:2.3:a:some:package:1:*:*:*:*:*:*:*"),
 				mustCPE("cpe:2.3:a:some:package:*:*:*:*:*:*:*:*"),
@@ -44,7 +36,7 @@ func TestCPESpecificity(t *testing.T) {
 		},
 		{
 			name: "sort strictly by field length",
-			input: []pkg.CPE{
+			input: []CPE{
 				mustCPE("cpe:2.3:a:1:22:1:*:*:*:*:1:*:*"),
 				mustCPE("cpe:2.3:a:55555:1:1:*:*:*:*:1:*:*"),
 				mustCPE("cpe:2.3:a:1:1:333:*:*:*:*:1:*:*"),
@@ -52,7 +44,7 @@ func TestCPESpecificity(t *testing.T) {
 				mustCPE("cpe:2.3:a:1:1:1:*:*:*:*:1:*:*"),
 				mustCPE("cpe:2.3:a:1:1:1:*:*:*:*:4444:*:*"),
 			},
-			expected: []pkg.CPE{
+			expected: []CPE{
 				mustCPE("cpe:2.3:a:1:666666:1:*:*:*:*:1:*:*"),
 				mustCPE("cpe:2.3:a:55555:1:1:*:*:*:*:1:*:*"),
 				mustCPE("cpe:2.3:a:1:1:1:*:*:*:*:4444:*:*"),
@@ -63,7 +55,7 @@ func TestCPESpecificity(t *testing.T) {
 		},
 		{
 			name: "sort by mix of field length and specificity",
-			input: []pkg.CPE{
+			input: []CPE{
 				mustCPE("cpe:2.3:a:1:666666:*:*:*:*:*:1:*:*"),
 				mustCPE("cpe:2.3:a:*:1:1:*:*:*:*:4444:*:*"),
 				mustCPE("cpe:2.3:a:1:*:333:*:*:*:*:*:*:*"),
@@ -71,7 +63,7 @@ func TestCPESpecificity(t *testing.T) {
 				mustCPE("cpe:2.3:a:1:22:1:*:*:*:*:1:*:*"),
 				mustCPE("cpe:2.3:a:55555:1:1:*:*:*:*:1:*:*"),
 			},
-			expected: []pkg.CPE{
+			expected: []CPE{
 				mustCPE("cpe:2.3:a:55555:1:1:*:*:*:*:1:*:*"),
 				mustCPE("cpe:2.3:a:1:22:1:*:*:*:*:1:*:*"),
 				mustCPE("cpe:2.3:a:1:1:1:*:*:*:*:1:*:*"),
@@ -82,7 +74,7 @@ func TestCPESpecificity(t *testing.T) {
 		},
 		{
 			name: "sort by mix of field length, specificity, dash",
-			input: []pkg.CPE{
+			input: []CPE{
 				mustCPE("cpe:2.3:a:alpine:alpine_keys:2.3-r1:*:*:*:*:*:*:*"),
 				mustCPE("cpe:2.3:a:alpine_keys:alpine_keys:2.3-r1:*:*:*:*:*:*:*"),
 				mustCPE("cpe:2.3:a:alpine-keys:alpine_keys:2.3-r1:*:*:*:*:*:*:*"),
@@ -90,7 +82,7 @@ func TestCPESpecificity(t *testing.T) {
 				mustCPE("cpe:2.3:a:alpine-keys:alpine-keys:2.3-r1:*:*:*:*:*:*:*"),
 				mustCPE("cpe:2.3:a:alpine_keys:alpine-keys:2.3-r1:*:*:*:*:*:*:*"),
 			},
-			expected: []pkg.CPE{
+			expected: []CPE{
 				mustCPE("cpe:2.3:a:alpine-keys:alpine-keys:2.3-r1:*:*:*:*:*:*:*"),
 				mustCPE("cpe:2.3:a:alpine-keys:alpine_keys:2.3-r1:*:*:*:*:*:*:*"),
 				mustCPE("cpe:2.3:a:alpine_keys:alpine-keys:2.3-r1:*:*:*:*:*:*:*"),
@@ -103,7 +95,7 @@ func TestCPESpecificity(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			sort.Sort(BySpecificity(test.input))
+			sort.Sort(CPEBySpecificity(test.input))
 			assert.Equal(t, test.expected, test.input)
 		})
 	}

syft/pkg/dart_pub_metadata.go

@@ -0,0 +1,38 @@
+package pkg
+
+import (
+	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/syft/linux"
+)
+
+type DartPubMetadata struct {
+	Name      string `mapstructure:"name" json:"name"`
+	Version   string `mapstructure:"version" json:"version"`
+	HostedURL string `mapstructure:"hosted_url" json:"hosted_url,omitempty"`
+	VcsURL    string `mapstructure:"vcs_url" json:"vcs_url,omitempty"`
+}
+
+func (m DartPubMetadata) PackageURL(_ *linux.Release) string {
+	var qualifiers packageurl.Qualifiers
+
+	if m.HostedURL != "" {
+		qualifiers = append(qualifiers, packageurl.Qualifier{
+			Key:   "hosted_url",
+			Value: m.HostedURL,
+		})
+	} else if m.VcsURL != "" { // Default to using Hosted if somehow both are provided
+		qualifiers = append(qualifiers, packageurl.Qualifier{
+			Key:   "vcs_url",
+			Value: m.VcsURL,
+		})
+	}
+
+	return packageurl.NewPackageURL(
+		packageurl.TypePub,
+		"",
+		m.Name,
+		m.Version,
+		qualifiers,
+		"",
+	).ToString()
+}

syft/pkg/java_metadata.go

@@ -20,7 +20,7 @@ var jenkinsPluginPomPropertiesGroupIDs = []string{
 
 // JavaMetadata encapsulates all Java ecosystem metadata for a package as well as an (optional) parent relationship.
 type JavaMetadata struct {
-	VirtualPath   string         `json:"virtualPath"`
+	VirtualPath   string         `json:"virtualPath" cyclonedx:"virtualPath"` // we need to include the virtual path in cyclonedx documents to prevent deduplication of jars within jars
 	Manifest      *JavaManifest  `mapstructure:"Manifest" json:"manifest,omitempty"`
 	PomProperties *PomProperties `mapstructure:"PomProperties" json:"pomProperties,omitempty" cyclonedx:"-"`
 	PomProject    *PomProject    `mapstructure:"PomProject" json:"pomProject,omitempty"`

syft/pkg/language.go

@@ -19,6 +19,7 @@ const (
 	Ruby            Language = "ruby"
 	Go              Language = "go"
 	Rust            Language = "rust"
+	Dart            Language = "dart"
 )
 
 // AllLanguages is a set of all programming languages detected by syft.
@@ -30,6 +31,7 @@ var AllLanguages = []Language{
 	Ruby,
 	Go,
 	Rust,
+	Dart,
 }
 
 // String returns the string representation of the language.
@@ -62,6 +64,8 @@ func LanguageByName(name string) Language {
 		return Ruby
 	case purlCargoPkgType:
 		return Rust
+	case packageurl.TypePub, string(Dart):
+		return Dart
 	default:
 		return UnknownLanguage
 	}

syft/pkg/language_test.go

@@ -1,9 +1,10 @@
 package pkg
 
 import (
+	"testing"
+
 	"github.com/scylladb/go-set/strset"
 	"github.com/stretchr/testify/assert"
-	"testing"
 )
 
 func TestLanguageFromPURL(t *testing.T) {
@@ -29,6 +30,10 @@ func TestLanguageFromPURL(t *testing.T) {
 			purl: "pkg:golang/github.com/gorilla/context@234fd47e07d1004f0aed9c",
 			want: Go,
 		},
+		{
+			purl: "pkg:pub/util@1.2.34",
+			want: Dart,
+		},
 		{
 			purl: "pkg:cargo/clap@2.33.0",
 			want: Rust,

syft/pkg/merge_cpes.go

@@ -0,0 +1,25 @@
+package pkg
+
+import (
+	"sort"
+)
+
+func mergeCPEs(a, b []CPE) (result []CPE) {
+	aCPEs := make(map[string]CPE)
+
+	// keep all CPEs from a and create a quick string-based lookup
+	for _, aCPE := range a {
+		aCPEs[aCPE.BindToFmtString()] = aCPE
+		result = append(result, aCPE)
+	}
+
+	// keep all unique CPEs from b
+	for _, bCPE := range b {
+		if _, exists := aCPEs[bCPE.BindToFmtString()]; !exists {
+			result = append(result, bCPE)
+		}
+	}
+
+	sort.Sort(CPEBySpecificity(result))
+	return result
+}

syft/pkg/metadata.go

@@ -17,6 +17,7 @@ const (
 	JavaMetadataType             MetadataType = "JavaMetadata"
 	NpmPackageJSONMetadataType   MetadataType = "NpmPackageJsonMetadata"
 	RpmdbMetadataType            MetadataType = "RpmdbMetadata"
+	DartPubMetadataType          MetadataType = "DartPubMetadata"
 	PythonPackageMetadataType    MetadataType = "PythonPackageMetadata"
 	RustCargoPackageMetadataType MetadataType = "RustCargoPackageMetadata"
 	KbPackageMetadataType        MetadataType = "KbPackageMetadata"
@@ -31,6 +32,7 @@ var AllMetadataTypes = []MetadataType{
 	JavaMetadataType,
 	NpmPackageJSONMetadataType,
 	RpmdbMetadataType,
+	DartPubMetadataType,
 	PythonPackageMetadataType,
 	RustCargoPackageMetadataType,
 	KbPackageMetadataType,
@@ -45,6 +47,7 @@ var MetadataTypeByName = map[MetadataType]reflect.Type{
 	JavaMetadataType:             reflect.TypeOf(JavaMetadata{}),
 	NpmPackageJSONMetadataType:   reflect.TypeOf(NpmPackageJSONMetadata{}),
 	RpmdbMetadataType:            reflect.TypeOf(RpmdbMetadata{}),
+	DartPubMetadataType:          reflect.TypeOf(DartPubMetadata{}),
 	PythonPackageMetadataType:    reflect.TypeOf(PythonPackageMetadata{}),
 	RustCargoPackageMetadataType: reflect.TypeOf(CargoMetadata{}),
 	KbPackageMetadataType:        reflect.TypeOf(KbPackageMetadata{}),

syft/pkg/package.go

@@ -14,18 +14,18 @@ import (
 // Package represents an application or library that has been bundled into a distributable format.
 // TODO: if we ignore FoundBy for ID generation should we merge the field to show it was found in two places?
 type Package struct {
-	id           artifact.ID       `hash:"ignore"`
-	Name         string            // the package name
-	Version      string            // the version of the package
-	FoundBy      string            `cyclonedx:"foundBy"` // the specific cataloger that discovered this package
-	Locations    []source.Location // the locations that lead to the discovery of this package (note: this is not necessarily the locations that make up this package)
-	Licenses     []string          // licenses discovered with the package metadata
-	Language     Language          `cyclonedx:"language"`     // the language ecosystem this package belongs to (e.g. JavaScript, Python, etc)
-	Type         Type              `cyclonedx:"type"`         // the package type (e.g. Npm, Yarn, Python, Rpm, Deb, etc)
-	CPEs         []CPE             `hash:"ignore"`            // all possible Common Platform Enumerators (note: this is NOT included in the definition of the ID since all fields on a CPE are derived from other fields)
-	PURL         string            `hash:"ignore"`            // the Package URL (see https://github.com/package-url/purl-spec) (note: this is NOT included in the definition of the ID since all fields on a pURL are derived from other fields)
-	MetadataType MetadataType      `cyclonedx:"metadataType"` // the shape of the additional data in the "metadata" field
-	Metadata     interface{}       // additional data found while parsing the package source
+	id           artifact.ID        `hash:"ignore"`
+	Name         string             // the package name
+	Version      string             // the version of the package
+	FoundBy      string             `cyclonedx:"foundBy"` // the specific cataloger that discovered this package
+	Locations    source.LocationSet // the locations that lead to the discovery of this package (note: this is not necessarily the locations that make up this package)
+	Licenses     []string           // licenses discovered with the package metadata
+	Language     Language           `cyclonedx:"language"`     // the language ecosystem this package belongs to (e.g. JavaScript, Python, etc)
+	Type         Type               `cyclonedx:"type"`         // the package type (e.g. Npm, Yarn, Python, Rpm, Deb, etc)
+	CPEs         []CPE              `hash:"ignore"`            // all possible Common Platform Enumerators (note: this is NOT included in the definition of the ID since all fields on a CPE are derived from other fields)
+	PURL         string             `hash:"ignore"`            // the Package URL (see https://github.com/package-url/purl-spec)
+	MetadataType MetadataType       `cyclonedx:"metadataType"` // the shape of the additional data in the "metadata" field
+	Metadata     interface{}        // additional data found while parsing the package source
 }
 
 func (p *Package) SetID() {
@@ -46,3 +46,21 @@ func (p Package) ID() artifact.ID {
 func (p Package) String() string {
 	return fmt.Sprintf("Pkg(name=%q version=%q type=%q id=%q)", p.Name, p.Version, p.Type, p.id)
 }
+
+func (p *Package) merge(other Package) error {
+	if p.id != other.id {
+		return fmt.Errorf("cannot merge packages with different IDs: %q vs %q", p.id, other.id)
+	}
+	if p.PURL != other.PURL {
+		log.Warnf("merging packages have with different pURLs: %q=%q vs %q=%q", p.id, p.PURL, other.id, other.PURL)
+	}
+
+	p.Locations.Add(other.Locations.ToSlice()...)
+
+	p.CPEs = mergeCPEs(p.CPEs, other.CPEs)
+
+	if p.PURL == "" {
+		p.PURL = other.PURL
+	}
+	return nil
+}

syft/pkg/package_test.go

@@ -3,24 +3,28 @@ package pkg
 import (
 	"testing"
 
+	"github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/syft/syft/source"
+	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
-func TestFingerprint(t *testing.T) {
+func TestIDUniqueness(t *testing.T) {
+	originalLocation := source.Location{
+		Coordinates: source.Coordinates{
+			RealPath:     "39.0742° N, 21.8243° E",
+			FileSystemID: "Earth",
+		},
+		VirtualPath: "/Ancient-Greece",
+	}
 	originalPkg := Package{
 		Name:    "pi",
 		Version: "3.14",
 		FoundBy: "Archimedes",
-		Locations: []source.Location{
-			{
-				Coordinates: source.Coordinates{
-					RealPath:     "39.0742° N, 21.8243° E",
-					FileSystemID: "Earth",
-				},
-				VirtualPath: "/Ancient-Greece",
-			},
-		},
+		Locations: source.NewLocationSet(
+			originalLocation,
+		),
 		Licenses: []string{
 			"cc0-1.0",
 			"MIT",
@@ -45,9 +49,9 @@ func TestFingerprint(t *testing.T) {
 
 	// this is a set of differential tests, ensuring that select mutations are reflected in the fingerprint (or not)
 	tests := []struct {
-		name            string
-		transform       func(pkg Package) Package
-		expectIdentical bool
+		name                 string
+		transform            func(pkg Package) Package
+		expectedIDComparison assert.ComparisonAssertionFunc
 	}{
 		{
 			name: "go case (no transform)",
@@ -55,7 +59,7 @@ func TestFingerprint(t *testing.T) {
 				// do nothing!
 				return pkg
 			},
-			expectIdentical: true,
+			expectedIDComparison: assert.Equal,
 		},
 		{
 			name: "same metadata is ignored",
@@ -72,7 +76,7 @@ func TestFingerprint(t *testing.T) {
 				}
 				return pkg
 			},
-			expectIdentical: true,
+			expectedIDComparison: assert.Equal,
 		},
 		{
 			name: "licenses order is ignored",
@@ -84,7 +88,7 @@ func TestFingerprint(t *testing.T) {
 				}
 				return pkg
 			},
-			expectIdentical: true,
+			expectedIDComparison: assert.Equal,
 		},
 		{
 			name: "name is reflected",
@@ -92,7 +96,42 @@ func TestFingerprint(t *testing.T) {
 				pkg.Name = "new!"
 				return pkg
 			},
-			expectIdentical: false,
+			expectedIDComparison: assert.NotEqual,
+		},
+		{
+			name: "location is reflected",
+			transform: func(pkg Package) Package {
+				locations := source.NewLocationSet(pkg.Locations.ToSlice()...)
+				locations.Add(source.NewLocation("/somewhere/new"))
+				pkg.Locations = locations
+				return pkg
+			},
+			expectedIDComparison: assert.NotEqual,
+		},
+		{
+			name: "same path for different filesystem is NOT reflected",
+			transform: func(pkg Package) Package {
+				newLocation := originalLocation
+				newLocation.FileSystemID = "Mars"
+
+				pkg.Locations = source.NewLocationSet(newLocation)
+				return pkg
+			},
+			expectedIDComparison: assert.Equal,
+		},
+		{
+			name: "multiple equivalent paths for different filesystem is NOT reflected",
+			transform: func(pkg Package) Package {
+				newLocation := originalLocation
+				newLocation.FileSystemID = "Mars"
+
+				locations := source.NewLocationSet(pkg.Locations.ToSlice()...)
+				locations.Add(newLocation, originalLocation)
+
+				pkg.Locations = locations
+				return pkg
+			},
+			expectedIDComparison: assert.Equal,
 		},
 		{
 			name: "version is reflected",
@@ -100,7 +139,7 @@ func TestFingerprint(t *testing.T) {
 				pkg.Version = "new!"
 				return pkg
 			},
-			expectIdentical: false,
+			expectedIDComparison: assert.NotEqual,
 		},
 		{
 			name: "licenses is reflected",
@@ -108,7 +147,7 @@ func TestFingerprint(t *testing.T) {
 				pkg.Licenses = []string{"new!"}
 				return pkg
 			},
-			expectIdentical: false,
+			expectedIDComparison: assert.NotEqual,
 		},
 		{
 			name: "type is reflected",
@@ -116,7 +155,7 @@ func TestFingerprint(t *testing.T) {
 				pkg.Type = RustPkg
 				return pkg
 			},
-			expectIdentical: false,
+			expectedIDComparison: assert.NotEqual,
 		},
 		{
 			name: "metadata type is reflected",
@@ -124,7 +163,7 @@ func TestFingerprint(t *testing.T) {
 				pkg.MetadataType = RustCargoPackageMetadataType
 				return pkg
 			},
-			expectIdentical: false,
+			expectedIDComparison: assert.NotEqual,
 		},
 		{
 			name: "CPEs is ignored",
@@ -132,7 +171,7 @@ func TestFingerprint(t *testing.T) {
 				pkg.CPEs = []CPE{}
 				return pkg
 			},
-			expectIdentical: true,
+			expectedIDComparison: assert.Equal,
 		},
 		{
 			name: "pURL is ignored",
@@ -140,7 +179,7 @@ func TestFingerprint(t *testing.T) {
 				pkg.PURL = "new!"
 				return pkg
 			},
-			expectIdentical: true,
+			expectedIDComparison: assert.Equal,
 		},
 		{
 			name: "language is reflected",
@@ -148,7 +187,7 @@ func TestFingerprint(t *testing.T) {
 				pkg.Language = Rust
 				return pkg
 			},
-			expectIdentical: false,
+			expectedIDComparison: assert.NotEqual,
 		},
 		{
 			name: "foundBy is reflected",
@@ -156,7 +195,7 @@ func TestFingerprint(t *testing.T) {
 				pkg.FoundBy = "new!"
 				return pkg
 			},
-			expectIdentical: false,
+			expectedIDComparison: assert.NotEqual,
 		},
 		{
 			name: "metadata mutation is reflected",
@@ -166,7 +205,7 @@ func TestFingerprint(t *testing.T) {
 				pkg.Metadata = metadata
 				return pkg
 			},
-			expectIdentical: false,
+			expectedIDComparison: assert.NotEqual,
 		},
 		{
 			name: "new metadata is reflected",
@@ -176,7 +215,7 @@ func TestFingerprint(t *testing.T) {
 				}
 				return pkg
 			},
-			expectIdentical: false,
+			expectedIDComparison: assert.NotEqual,
 		},
 		{
 			name: "nil metadata is reflected",
@@ -184,7 +223,7 @@ func TestFingerprint(t *testing.T) {
 				pkg.Metadata = nil
 				return pkg
 			},
-			expectIdentical: false,
+			expectedIDComparison: assert.NotEqual,
 		},
 	}
 
@@ -199,12 +238,207 @@ func TestFingerprint(t *testing.T) {
 			transformedFingerprint := transformedPkg.ID()
 			assert.NotEmpty(t, transformedFingerprint)
 
-			if test.expectIdentical {
-				assert.Equal(t, originalFingerprint, transformedFingerprint)
-			} else {
-				assert.NotEqual(t, originalFingerprint, transformedFingerprint)
+			test.expectedIDComparison(t, originalFingerprint, transformedFingerprint)
+		})
+	}
+}
+
+func TestPackage_Merge(t *testing.T) {
+	originalLocation := source.Location{
+		Coordinates: source.Coordinates{
+			RealPath:     "39.0742° N, 21.8243° E",
+			FileSystemID: "Earth",
+		},
+		VirtualPath: "/Ancient-Greece",
+	}
+
+	similarLocation := originalLocation
+	similarLocation.FileSystemID = "Mars"
+
+	tests := []struct {
+		name     string
+		subject  Package
+		other    Package
+		expected *Package
+	}{
+		{
+			name: "merge two packages (different cpes + locations)",
+			subject: Package{
+				Name:    "pi",
+				Version: "3.14",
+				FoundBy: "Archimedes",
+				Locations: source.NewLocationSet(
+					originalLocation,
+				),
+				Licenses: []string{
+					"cc0-1.0",
+					"MIT",
+				},
+				Language: "math",
+				Type:     PythonPkg,
+				CPEs: []CPE{
+					must(NewCPE(`cpe:2.3:a:Archimedes:pi:3.14:*:*:*:*:math:*:*`)),
+				},
+				PURL:         "pkg:pypi/pi@3.14",
+				MetadataType: PythonPackageMetadataType,
+				Metadata: PythonPackageMetadata{
+					Name:                 "pi",
+					Version:              "3.14",
+					License:              "cc0-1.0",
+					Author:               "Archimedes",
+					AuthorEmail:          "Archimedes@circles.io",
+					Platform:             "universe",
+					SitePackagesRootPath: "Pi",
+				},
+			},
+			other: Package{
+				Name:    "pi",
+				Version: "3.14",
+				FoundBy: "Archimedes",
+				Locations: source.NewLocationSet(
+					similarLocation, // NOTE: difference; we have a different layer but the same path
+				),
+				Licenses: []string{
+					"cc0-1.0",
+					"MIT",
+				},
+				Language: "math",
+				Type:     PythonPkg,
+				CPEs: []CPE{
+					must(NewCPE(`cpe:2.3:a:DIFFERENT:pi:3.14:*:*:*:*:math:*:*`)), // NOTE: difference
+				},
+				PURL:         "pkg:pypi/pi@3.14",
+				MetadataType: PythonPackageMetadataType,
+				Metadata: PythonPackageMetadata{
+					Name:                 "pi",
+					Version:              "3.14",
+					License:              "cc0-1.0",
+					Author:               "Archimedes",
+					AuthorEmail:          "Archimedes@circles.io",
+					Platform:             "universe",
+					SitePackagesRootPath: "Pi",
+				},
+			},
+			expected: &Package{
+				Name:    "pi",
+				Version: "3.14",
+				FoundBy: "Archimedes",
+				Locations: source.NewLocationSet(
+					originalLocation,
+					similarLocation, // NOTE: merge!
+				),
+				Licenses: []string{
+					"cc0-1.0",
+					"MIT",
+				},
+				Language: "math",
+				Type:     PythonPkg,
+				CPEs: []CPE{
+					must(NewCPE(`cpe:2.3:a:Archimedes:pi:3.14:*:*:*:*:math:*:*`)),
+					must(NewCPE(`cpe:2.3:a:DIFFERENT:pi:3.14:*:*:*:*:math:*:*`)), // NOTE: merge!
+				},
+				PURL:         "pkg:pypi/pi@3.14",
+				MetadataType: PythonPackageMetadataType,
+				Metadata: PythonPackageMetadata{
+					Name:                 "pi",
+					Version:              "3.14",
+					License:              "cc0-1.0",
+					Author:               "Archimedes",
+					AuthorEmail:          "Archimedes@circles.io",
+					Platform:             "universe",
+					SitePackagesRootPath: "Pi",
+				},
+			},
+		},
+		{
+			name: "error when there are different IDs",
+			subject: Package{
+				Name:    "pi",
+				Version: "3.14",
+				FoundBy: "Archimedes",
+				Locations: source.NewLocationSet(
+					originalLocation,
+				),
+				Licenses: []string{
+					"cc0-1.0",
+					"MIT",
+				},
+				Language: "math",
+				Type:     PythonPkg,
+				CPEs: []CPE{
+					must(NewCPE(`cpe:2.3:a:Archimedes:pi:3.14:*:*:*:*:math:*:*`)),
+				},
+				PURL:         "pkg:pypi/pi@3.14",
+				MetadataType: PythonPackageMetadataType,
+				Metadata: PythonPackageMetadata{
+					Name:                 "pi",
+					Version:              "3.14",
+					License:              "cc0-1.0",
+					Author:               "Archimedes",
+					AuthorEmail:          "Archimedes@circles.io",
+					Platform:             "universe",
+					SitePackagesRootPath: "Pi",
+				},
+			},
+			other: Package{
+				Name:    "pi-DIFFERENT", // difference
+				Version: "3.14",
+				FoundBy: "Archimedes",
+				Locations: source.NewLocationSet(
+					originalLocation,
+				),
+				Licenses: []string{
+					"cc0-1.0",
+					"MIT",
+				},
+				Language: "math",
+				Type:     PythonPkg,
+				CPEs: []CPE{
+					must(NewCPE(`cpe:2.3:a:Archimedes:pi:3.14:*:*:*:*:math:*:*`)),
+				},
+				PURL:         "pkg:pypi/pi@3.14",
+				MetadataType: PythonPackageMetadataType,
+				Metadata: PythonPackageMetadata{
+					Name:                 "pi",
+					Version:              "3.14",
+					License:              "cc0-1.0",
+					Author:               "Archimedes",
+					AuthorEmail:          "Archimedes@circles.io",
+					Platform:             "universe",
+					SitePackagesRootPath: "Pi",
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			tt.subject.SetID()
+			tt.other.SetID()
+
+			err := tt.subject.merge(tt.other)
+			if tt.expected == nil {
+				require.Error(t, err)
+				return
 			}
+			require.NoError(t, err)
+
+			tt.expected.SetID()
+			require.Equal(t, tt.expected.id, tt.subject.id)
 
+			if diff := cmp.Diff(*tt.expected, tt.subject,
+				cmp.AllowUnexported(Package{}),
+				cmp.Comparer(
+					func(x, y source.LocationSet) bool {
+						return cmp.Equal(
+							x.ToSlice(), y.ToSlice(),
+							cmp.AllowUnexported(source.Location{}),
+							cmp.AllowUnexported(file.Reference{}),
+						)
+					},
+				),
+			); diff != "" {
+				t.Errorf("unexpected result from parsing (-expected +actual)\n%s", diff)
+			}
 		})
 	}
 }

syft/pkg/relationships_by_file_ownership_test.go

@@ -18,10 +18,10 @@ func TestOwnershipByFilesRelationship(t *testing.T) {
 			name: "owns-by-real-path",
 			setup: func(t testing.TB) ([]Package, []artifact.Relationship) {
 				parent := Package{
-					Locations: []source.Location{
+					Locations: source.NewLocationSet(
 						source.NewVirtualLocation("/a/path", "/another/path"),
 						source.NewVirtualLocation("/b/path", "/bee/path"),
-					},
+					),
 					Type:         RpmPkg,
 					MetadataType: RpmdbMetadataType,
 					Metadata: RpmdbMetadata{
@@ -35,10 +35,10 @@ func TestOwnershipByFilesRelationship(t *testing.T) {
 				parent.SetID()
 
 				child := Package{
-					Locations: []source.Location{
+					Locations: source.NewLocationSet(
 						source.NewVirtualLocation("/c/path", "/another/path"),
 						source.NewVirtualLocation("/d/path", "/another/path"),
-					},
+					),
 					Type: NpmPkg,
 				}
 				child.SetID()
@@ -61,10 +61,10 @@ func TestOwnershipByFilesRelationship(t *testing.T) {
 			name: "owns-by-virtual-path",
 			setup: func(t testing.TB) ([]Package, []artifact.Relationship) {
 				parent := Package{
-					Locations: []source.Location{
+					Locations: source.NewLocationSet(
 						source.NewVirtualLocation("/a/path", "/some/other/path"),
 						source.NewVirtualLocation("/b/path", "/bee/path"),
-					},
+					),
 					Type:         RpmPkg,
 					MetadataType: RpmdbMetadataType,
 					Metadata: RpmdbMetadata{
@@ -78,10 +78,10 @@ func TestOwnershipByFilesRelationship(t *testing.T) {
 				parent.SetID()
 
 				child := Package{
-					Locations: []source.Location{
+					Locations: source.NewLocationSet(
 						source.NewVirtualLocation("/c/path", "/another/path"),
 						source.NewLocation("/d/path"),
-					},
+					),
 					Type: NpmPkg,
 				}
 				child.SetID()
@@ -103,10 +103,10 @@ func TestOwnershipByFilesRelationship(t *testing.T) {
 			name: "ignore-empty-path",
 			setup: func(t testing.TB) ([]Package, []artifact.Relationship) {
 				parent := Package{
-					Locations: []source.Location{
+					Locations: source.NewLocationSet(
 						source.NewVirtualLocation("/a/path", "/some/other/path"),
 						source.NewVirtualLocation("/b/path", "/bee/path"),
-					},
+					),
 					Type:         RpmPkg,
 					MetadataType: RpmdbMetadataType,
 					Metadata: RpmdbMetadata{
@@ -121,10 +121,10 @@ func TestOwnershipByFilesRelationship(t *testing.T) {
 				parent.SetID()
 
 				child := Package{
-					Locations: []source.Location{
+					Locations: source.NewLocationSet(
 						source.NewVirtualLocation("/c/path", "/another/path"),
 						source.NewLocation("/d/path"),
-					},
+					),
 					Type: NpmPkg,
 				}
 

syft/pkg/type.go

@@ -20,6 +20,7 @@ const (
 	GoModulePkg      Type = "go-module"
 	RustPkg          Type = "rust-crate"
 	KbPkg            Type = "msrc-kb"
+	DartPubPkg       Type = "dart-pub"
 )
 
 // AllPkgs represents all supported package types
@@ -36,6 +37,7 @@ var AllPkgs = []Type{
 	GoModulePkg,
 	RustPkg,
 	KbPkg,
+	DartPubPkg,
 }
 
 // PackageURLType returns the PURL package type for the current package.
@@ -61,6 +63,8 @@ func (t Type) PackageURLType() string {
 		return packageurl.TypeGolang
 	case RustPkg:
 		return "cargo"
+	case DartPubPkg:
+		return packageurl.TypePub
 	default:
 		// TODO: should this be a "generic" purl type instead?
 		return ""
@@ -98,6 +102,8 @@ func TypeByName(name string) Type {
 		return GemPkg
 	case "cargo", "crate":
 		return RustPkg
+	case packageurl.TypePub:
+		return DartPubPkg
 	default:
 		return UnknownPkg
 	}

syft/pkg/type_test.go

@@ -1,9 +1,10 @@
 package pkg
 
 import (
-	"github.com/scylladb/go-set/strset"
 	"testing"
 
+	"github.com/scylladb/go-set/strset"
+
 	"github.com/stretchr/testify/assert"
 )
 
@@ -46,6 +47,10 @@ func TestTypeFromPURL(t *testing.T) {
 			purl:     "pkg:cargo/clap@2.33.0",
 			expected: RustPkg,
 		},
+		{
+			purl:     "pkg:pub/util@1.2.34?hosted_url=pub.hosted.org",
+			expected: DartPubPkg,
+		},
 		{
 			purl:     "pkg:composer/laravel/laravel@5.5.0",
 			expected: PhpComposerPkg,

syft/pkg/url_test.go

@@ -25,6 +25,20 @@ func TestPackageURL(t *testing.T) {
 			},
 			expected: "pkg:golang/github.com/anchore/syft@v0.1.0",
 		},
+		{
+			name: "pub",
+			pkg: Package{
+				Name:    "bad-name",
+				Version: "0.1.0",
+				Type:    DartPubPkg,
+				Metadata: DartPubMetadata{
+					Name:      "name",
+					Version:   "0.2.0",
+					HostedURL: "pub.hosted.org",
+				},
+			},
+			expected: "pkg:pub/name@0.2.0?hosted_url=pub.hosted.org",
+		},
 		{
 			name: "python",
 			pkg: Package{

syft/sbom/format.go

@@ -13,6 +13,11 @@ var (
 
 type FormatID string
 
+// String returns a string representation of the FormatID.
+func (f FormatID) String() string {
+	return string(f)
+}
+
 type Format interface {
 	ID() FormatID
 	Encode(io.Writer, SBOM) error

syft/source/coordinate_set.go

@@ -0,0 +1,86 @@
+package source
+
+import (
+	"sort"
+
+	"github.com/mitchellh/hashstructure/v2"
+	"github.com/scylladb/go-set/strset"
+)
+
+type CoordinateSet struct {
+	set map[Coordinates]struct{}
+}
+
+func NewCoordinateSet(coordinates ...Coordinates) (s CoordinateSet) {
+	for _, l := range coordinates {
+		s.Add(l)
+	}
+
+	return s
+}
+
+func (s *CoordinateSet) Add(coordinates ...Coordinates) {
+	if s.set == nil {
+		s.set = make(map[Coordinates]struct{})
+	}
+	for _, l := range coordinates {
+		s.set[l] = struct{}{}
+	}
+}
+
+func (s CoordinateSet) Remove(coordinates ...Coordinates) {
+	if s.set == nil {
+		return
+	}
+	for _, l := range coordinates {
+		delete(s.set, l)
+	}
+}
+
+func (s CoordinateSet) Contains(l Coordinates) bool {
+	if s.set == nil {
+		return false
+	}
+	_, ok := s.set[l]
+	return ok
+}
+
+func (s CoordinateSet) Paths() []string {
+	if s.set == nil {
+		return nil
+	}
+
+	paths := strset.New()
+	for _, c := range s.ToSlice() {
+		paths.Add(c.RealPath)
+	}
+	pathSlice := paths.List()
+	sort.Strings(pathSlice)
+	return pathSlice
+}
+
+func (s CoordinateSet) ToSlice() []Coordinates {
+	if s.set == nil {
+		return nil
+	}
+	coordinates := make([]Coordinates, len(s.set))
+	idx := 0
+	for v := range s.set {
+		coordinates[idx] = v
+		idx++
+	}
+	sort.SliceStable(coordinates, func(i, j int) bool {
+		if coordinates[i].RealPath == coordinates[j].RealPath {
+			return coordinates[i].FileSystemID < coordinates[j].FileSystemID
+		}
+		return coordinates[i].RealPath < coordinates[j].RealPath
+	})
+	return coordinates
+}
+
+func (s CoordinateSet) Hash() (uint64, error) {
+	return hashstructure.Hash(s.ToSlice(), hashstructure.FormatV2, &hashstructure.HashOptions{
+		ZeroNil:      true,
+		SlicesAsSets: true,
+	})
+}

syft/source/coordinate_set_test.go

@@ -0,0 +1,117 @@
+package source
+
+import (
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/stretchr/testify/require"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestCoordinatesSet(t *testing.T) {
+
+	binA := Coordinates{
+		RealPath:     "/bin",
+		FileSystemID: "a",
+	}
+
+	binB := Coordinates{
+		RealPath:     "/bin",
+		FileSystemID: "b",
+	}
+
+	tests := []struct {
+		name     string
+		input    []Coordinates
+		expected []Coordinates
+	}{
+		{
+			name: "de-dup same location",
+			input: []Coordinates{
+				binA, binA, binA,
+			},
+			expected: []Coordinates{
+				binA,
+			},
+		},
+		{
+			name: "dont de-dup different filesystem",
+			input: []Coordinates{
+				binB, binA,
+			},
+			expected: []Coordinates{
+				binA, binB,
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			set := NewCoordinateSet(test.input...)
+			assert.Equal(t, test.expected, set.ToSlice())
+		})
+	}
+}
+
+func TestCoordinateSet_Hash(t *testing.T) {
+	etcA := Coordinates{
+		RealPath:     "/etc",
+		FileSystemID: "a",
+	}
+
+	etcB := Coordinates{
+		RealPath:     "/etc",
+		FileSystemID: "b",
+	}
+
+	binA := Coordinates{
+		RealPath:     "/bin",
+		FileSystemID: "a",
+	}
+
+	binB := Coordinates{
+		RealPath:     "/bin",
+		FileSystemID: "b",
+	}
+
+	tests := []struct {
+		name string
+		setA CoordinateSet
+		setB CoordinateSet
+		want assert.ComparisonAssertionFunc
+	}{
+		{
+			name: "empty sets have the same hash",
+			setA: NewCoordinateSet(),
+			setB: NewCoordinateSet(),
+			want: assert.Equal,
+		},
+		{
+			name: "sets with same elements have the same hash",
+			setA: NewCoordinateSet(binA, etcA),
+			setB: NewCoordinateSet(etcA, binA),
+			want: assert.Equal,
+		},
+		{
+			name: "sets with different elements have different hashes",
+			setA: NewCoordinateSet(binA, etcA),
+			setB: NewCoordinateSet(binA),
+			want: assert.NotEqual,
+		},
+		{
+			name: "sets with same paths but different FS IDs have different hashes",
+			setA: NewCoordinateSet(etcA, binA),
+			setB: NewCoordinateSet(etcB, binB),
+			want: assert.NotEqual,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotA, err := artifact.IDByHash(tt.setA)
+			require.NoError(t, err)
+			gotB, err := artifact.IDByHash(tt.setB)
+			require.NoError(t, err)
+			tt.want(t, gotA, gotB)
+		})
+	}
+}

syft/source/coordinates.go

@@ -2,7 +2,6 @@ package source
 
 import (
 	"fmt"
-	"sort"
 
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
@@ -14,18 +13,6 @@ type Coordinates struct {
 	FileSystemID string `json:"layerID,omitempty" cyclonedx:"layerID"` // An ID representing the filesystem. For container images, this is a layer digest. For directories or a root filesystem, this is blank.
 }
 
-// CoordinateSet represents a set of string types.
-type CoordinateSet map[Coordinates]struct{}
-
-// NewCoordinateSet creates a CoordinateSet populated with values from the given slice.
-func NewCoordinateSet(start ...Coordinates) CoordinateSet {
-	ret := make(CoordinateSet)
-	for _, s := range start {
-		ret.Add(s)
-	}
-	return ret
-}
-
 func (c Coordinates) ID() artifact.ID {
 	f, err := artifact.IDByHash(c)
 	if err != nil {
@@ -45,37 +32,3 @@ func (c Coordinates) String() string {
 	}
 	return fmt.Sprintf("Location<%s>", str)
 }
-
-// Add a string to the set.
-func (s CoordinateSet) Add(i Coordinates) {
-	s[i] = struct{}{}
-}
-
-// Remove a string from the set.
-func (s CoordinateSet) Remove(i Coordinates) {
-	delete(s, i)
-}
-
-// Contains indicates if the given string is contained within the set.
-func (s CoordinateSet) Contains(i Coordinates) bool {
-	_, ok := s[i]
-	return ok
-}
-
-// ToSlice returns a sorted slice of Locations that are contained within the set.
-func (s CoordinateSet) ToSlice() []Coordinates {
-	ret := make([]Coordinates, len(s))
-	idx := 0
-	for v := range s {
-		ret[idx] = v
-		idx++
-	}
-
-	sort.SliceStable(ret, func(i, j int) bool {
-		if ret[i].RealPath == ret[j].RealPath {
-			return ret[i].FileSystemID < ret[j].FileSystemID
-		}
-		return ret[i].RealPath < ret[j].RealPath
-	})
-	return ret
-}

syft/source/coordinates_test.go

@@ -1,51 +0,0 @@
-package source
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestCoordinateSet(t *testing.T) {
-
-	binA := Coordinates{
-		RealPath:     "/bin",
-		FileSystemID: "a",
-	}
-
-	binB := Coordinates{
-		RealPath:     "/bin",
-		FileSystemID: "b",
-	}
-
-	tests := []struct {
-		name     string
-		input    []Coordinates
-		expected []Coordinates
-	}{
-		{
-			name: "de-dup same location",
-			input: []Coordinates{
-				binA, binA, binA,
-			},
-			expected: []Coordinates{
-				binA,
-			},
-		},
-		{
-			name: "dont de-dup different filesystem",
-			input: []Coordinates{
-				binB, binA,
-			},
-			expected: []Coordinates{
-				binA, binB,
-			},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, NewCoordinateSet(test.input...).ToSlice())
-		})
-	}
-}

syft/source/directory_resolver.go

@@ -132,10 +132,15 @@ func (r *directoryResolver) indexTree(root string, stager *progress.Stage) ([]st
 }
 
 func (r *directoryResolver) indexPath(path string, info os.FileInfo, err error) (string, error) {
+	// link cycles could cause a revisit --we should not allow this
+	if r.hasBeenIndexed(path) {
+		return "", nil
+	}
+
 	// ignore any path which a filter function returns true
 	for _, filterFn := range r.pathFilterFns {
 		if filterFn != nil && filterFn(path, info) {
-			if info.IsDir() {
+			if info != nil && info.IsDir() {
 				return "", fs.SkipDir
 			}
 			return "", nil
@@ -146,11 +151,6 @@ func (r *directoryResolver) indexPath(path string, info os.FileInfo, err error)
 		return "", nil
 	}
 
-	// link cycles could cause a revisit --we should not allow this
-	if r.hasBeenIndexed(path) {
-		return "", nil
-	}
-
 	if info == nil {
 		// walk may not be able to provide a FileInfo object, don't allow for this to stop indexing; keep track of the paths and continue.
 		r.errPaths[path] = fmt.Errorf("no file info observable at path=%q", path)

syft/source/directory_resolver_test.go

@@ -865,3 +865,24 @@ func Test_IncludeRootPathInIndex(t *testing.T) {
 	_, exists = resolver.metadata[ref.ID()]
 	require.True(t, exists)
 }
+
+func TestDirectoryResolver_indexPath(t *testing.T) {
+	// TODO: Ideally we can use an OS abstraction, which would obviate the need for real FS setup.
+	tempFile, err := os.CreateTemp("", "")
+	require.NoError(t, err)
+
+	resolver, err := newDirectoryResolver(tempFile.Name())
+	require.NoError(t, err)
+
+	t.Run("filtering path with nil os.FileInfo", func(t *testing.T) {
+		// We use one of these prefixes in order to trigger a pathFilterFn
+		filteredPath := unixSystemRuntimePrefixes[0]
+
+		var fileInfo os.FileInfo = nil
+
+		assert.NotPanics(t, func() {
+			_, err := resolver.indexPath(filteredPath, fileInfo, nil)
+			assert.NoError(t, err)
+		})
+	})
+}

syft/source/location.go

@@ -109,3 +109,9 @@ func (l Location) String() string {
 	}
 	return fmt.Sprintf("Location<%s>", str)
 }
+
+func (l Location) Equals(other Location) bool {
+	return l.RealPath == other.RealPath &&
+		l.VirtualPath == other.VirtualPath &&
+		l.FileSystemID == other.FileSystemID
+}

syft/source/location_set.go

@@ -0,0 +1,78 @@
+package source
+
+import (
+	"sort"
+
+	"github.com/mitchellh/hashstructure/v2"
+)
+
+type LocationSet struct {
+	set map[Location]struct{}
+}
+
+func NewLocationSet(locations ...Location) (s LocationSet) {
+	for _, l := range locations {
+		s.Add(l)
+	}
+
+	return s
+}
+
+func (s *LocationSet) Add(locations ...Location) {
+	if s.set == nil {
+		s.set = make(map[Location]struct{})
+	}
+	for _, l := range locations {
+		s.set[l] = struct{}{}
+	}
+}
+
+func (s LocationSet) Remove(locations ...Location) {
+	if s.set == nil {
+		return
+	}
+	for _, l := range locations {
+		delete(s.set, l)
+	}
+}
+
+func (s LocationSet) Contains(l Location) bool {
+	if s.set == nil {
+		return false
+	}
+	_, ok := s.set[l]
+	return ok
+}
+
+func (s LocationSet) ToSlice() []Location {
+	if s.set == nil {
+		return nil
+	}
+	locations := make([]Location, len(s.set))
+	idx := 0
+	for v := range s.set {
+		locations[idx] = v
+		idx++
+	}
+	sort.Sort(Locations(locations))
+	return locations
+}
+
+func (s *LocationSet) CoordinateSet() CoordinateSet {
+	if s.set == nil {
+		return NewCoordinateSet()
+	}
+	set := NewCoordinateSet()
+	for l := range s.set {
+		set.Add(l.Coordinates)
+	}
+	return set
+}
+
+func (s LocationSet) Hash() (uint64, error) {
+	// access paths and filesystem IDs are not considered when hashing a location set, only the real paths
+	return hashstructure.Hash(s.CoordinateSet().Paths(), hashstructure.FormatV2, &hashstructure.HashOptions{
+		ZeroNil:      true,
+		SlicesAsSets: true,
+	})
+}

syft/source/location_set_test.go

@@ -0,0 +1,178 @@
+package source
+
+import (
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/stretchr/testify/require"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestLocationSet(t *testing.T) {
+
+	etcHostsLinkVar := Location{
+		Coordinates: Coordinates{
+			RealPath:     "/etc/hosts",
+			FileSystemID: "a",
+		},
+		VirtualPath: "/var/etc/hosts",
+	}
+
+	etcHostsLinkHome := Location{
+		Coordinates: Coordinates{
+			RealPath:     "/etc/hosts",
+			FileSystemID: "a",
+		},
+		VirtualPath: "/home/wagoodman/hosts",
+	}
+
+	binA := Location{
+		Coordinates: Coordinates{
+			RealPath:     "/bin",
+			FileSystemID: "a",
+		},
+		VirtualPath: "/usr/bin",
+	}
+
+	binB := Location{
+		Coordinates: Coordinates{
+			RealPath:     "/bin",
+			FileSystemID: "b",
+		},
+		VirtualPath: "/usr/bin",
+	}
+
+	tests := []struct {
+		name     string
+		input    []Location
+		expected []Location
+	}{
+		{
+			name: "de-dup same location",
+			input: []Location{
+				binA, binA, binA,
+			},
+			expected: []Location{
+				binA,
+			},
+		},
+		{
+			name: "dont de-dup different filesystem",
+			input: []Location{
+				binB, binA,
+			},
+			expected: []Location{
+				binA, binB,
+			},
+		},
+		{
+			name: "dont de-dup different virtual paths",
+			input: []Location{
+				etcHostsLinkVar, etcHostsLinkHome,
+			},
+			expected: []Location{
+				etcHostsLinkHome, etcHostsLinkVar,
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			set := NewLocationSet(test.input...)
+			assert.Equal(t, test.expected, set.ToSlice())
+		})
+	}
+}
+
+func TestLocationSet_Hash(t *testing.T) {
+	etcAlink := Location{
+		Coordinates: Coordinates{
+			RealPath:     "/etc/hosts",
+			FileSystemID: "a",
+		},
+		VirtualPath: "/var/etc/hosts",
+	}
+
+	etcA := Location{
+		Coordinates: Coordinates{
+			RealPath:     "/etc/hosts",
+			FileSystemID: "a",
+		},
+	}
+
+	etcB := Location{
+		Coordinates: Coordinates{
+			RealPath:     "/etc/hosts",
+			FileSystemID: "b",
+		},
+	}
+
+	binA := Location{
+		Coordinates: Coordinates{
+			RealPath:     "/bin",
+			FileSystemID: "a",
+		},
+		VirtualPath: "/usr/bin",
+	}
+
+	binB := Location{
+		Coordinates: Coordinates{
+			RealPath:     "/bin",
+			FileSystemID: "b",
+		},
+		VirtualPath: "/usr/bin",
+	}
+
+	tests := []struct {
+		name string
+		setA LocationSet
+		setB LocationSet
+		want assert.ComparisonAssertionFunc
+	}{
+		{
+			name: "empty sets have the same hash",
+			setA: NewLocationSet(),
+			setB: NewLocationSet(),
+			want: assert.Equal,
+		},
+		{
+			name: "sets with same elements accessed through different paths have the same hash",
+			setA: NewLocationSet(binA, etcA),
+			setB: NewLocationSet(etcAlink, binA),
+			want: assert.Equal,
+		},
+		{
+			name: "sets with same elements have the same hash",
+			setA: NewLocationSet(binA, etcA),
+			setB: NewLocationSet(etcA, binA),
+			want: assert.Equal,
+		},
+		{
+			name: "sets with different element counts have different hashes",
+			setA: NewLocationSet(binA, etcA),
+			setB: NewLocationSet(binA),
+			want: assert.NotEqual,
+		},
+		{
+			name: "sets with same path but different FS IDs have the same hash",
+			setA: NewLocationSet(binA),
+			setB: NewLocationSet(binB),
+			want: assert.Equal,
+		},
+		{
+			name: "sets with same paths but different FS IDs have the same hash",
+			setA: NewLocationSet(etcA, binA),
+			setB: NewLocationSet(binB, etcB),
+			want: assert.Equal,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotA, err := artifact.IDByHash(tt.setA)
+			require.NoError(t, err)
+			gotB, err := artifact.IDByHash(tt.setB)
+			require.NoError(t, err)
+			tt.want(t, gotA, gotB)
+		})
+	}
+}

syft/source/locations.go

@@ -0,0 +1,21 @@
+package source
+
+type Locations []Location
+
+func (l Locations) Len() int {
+	return len(l)
+}
+
+func (l Locations) Less(i, j int) bool {
+	if l[i].RealPath == l[j].RealPath {
+		if l[i].VirtualPath == l[j].VirtualPath {
+			return l[i].FileSystemID < l[j].FileSystemID
+		}
+		return l[i].VirtualPath < l[j].VirtualPath
+	}
+	return l[i].RealPath < l[j].RealPath
+}
+
+func (l Locations) Swap(i, j int) {
+	l[i], l[j] = l[j], l[i]
+}

test/cli/packages_cmd_test.go

@@ -8,6 +8,7 @@ import (
 )
 
 func TestPackagesCmdFlags(t *testing.T) {
+	hiddenPackagesImage := "docker-archive:" + getFixtureImage(t, "image-hidden-packages")
 	coverageImage := "docker-archive:" + getFixtureImage(t, "image-pkg-coverage")
 	//badBinariesImage := "docker-archive:" + getFixtureImage(t, "image-bad-binaries")
 	tmp := t.TempDir() + "/"
@@ -100,21 +101,34 @@ func TestPackagesCmdFlags(t *testing.T) {
 			},
 		},
 		{
-			name: "all-layers-scope-flag",
-			args: []string{"packages", "-o", "json", "-s", "all-layers", coverageImage},
+			name: "squashed-scope-flag-hidden-packages",
+			args: []string{"packages", "-o", "json", "-s", "squashed", hiddenPackagesImage},
 			assertions: []traitAssertion{
-				assertPackageCount(22),
+				assertPackageCount(162),
+				assertNotInOutput("vsftpd"), // hidden package
+				assertSuccessfulReturnCode,
+			},
+		},
+		{
+			name: "all-layers-scope-flag",
+			args: []string{"packages", "-o", "json", "-s", "all-layers", hiddenPackagesImage},
+			assertions: []traitAssertion{
+				assertPackageCount(163), // packages are now deduplicated for this case
+				assertInOutput("all-layers"),
+				assertInOutput("vsftpd"), // hidden package
 				assertSuccessfulReturnCode,
 			},
 		},
 		{
 			name: "all-layers-scope-flag-by-env",
-			args: []string{"packages", "-o", "json", coverageImage},
+			args: []string{"packages", "-o", "json", hiddenPackagesImage},
 			env: map[string]string{
 				"SYFT_PACKAGE_CATALOGER_SCOPE": "all-layers",
 			},
 			assertions: []traitAssertion{
-				assertPackageCount(22),
+				assertPackageCount(163), // packages are now deduplicated for this case
+				assertInOutput("all-layers"),
+				assertInOutput("vsftpd"), // hidden package
 				assertSuccessfulReturnCode,
 			},
 		},

test/cli/test-fixtures/image-hidden-packages/Dockerfile

@@ -0,0 +1,4 @@
+FROM centos:7.9.2009
+# all-layers scope should pickup on vsftpd
+RUN yum install -y vsftpd
+RUN yum remove -y vsftpd

test/integration/catalog_packages_cases_test.go

@@ -186,6 +186,19 @@ var dirOnlyTestCases = []testCase{
 			"alcaeus/mongo-php-adapter": "1.1.11",
 		},
 	},
+	{
+		name:        "find pubspec lock packages",
+		pkgType:     pkg.DartPubPkg,
+		pkgLanguage: pkg.Dart,
+		pkgInfo: map[string]string{
+			"ansicolor":  "1.1.1",
+			"archive":    "2.0.13",
+			"args":       "1.6.0",
+			"key_binder": "1.11.20",
+			"ale":        "3.3.0",
+			"analyzer":   "0.40.7",
+		},
+	},
 }
 
 var commonTestCases = []testCase{

test/integration/catalog_packages_test.go

@@ -1,9 +1,10 @@
 package integration
 
 import (
-	"github.com/stretchr/testify/require"
 	"testing"
 
+	"github.com/stretchr/testify/require"
+
 	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/pkg/cataloger"
 	"github.com/google/go-cmp/cmp"
@@ -53,7 +54,7 @@ func BenchmarkImagePackageCatalogers(b *testing.B) {
 }
 
 func TestPkgCoverageImage(t *testing.T) {
-	sbom, _ := catalogFixtureImage(t, "image-pkg-coverage")
+	sbom, _ := catalogFixtureImage(t, "image-pkg-coverage", source.SquashedScope)
 
 	observedLanguages := internal.NewStringSet()
 	definedLanguages := internal.NewStringSet()
@@ -64,6 +65,7 @@ func TestPkgCoverageImage(t *testing.T) {
 	// for image scans we should not expect to see any of the following package types
 	definedLanguages.Remove(pkg.Go.String())
 	definedLanguages.Remove(pkg.Rust.String())
+	definedLanguages.Remove(pkg.Dart.String())
 
 	observedPkgs := internal.NewStringSet()
 	definedPkgs := internal.NewStringSet()
@@ -75,6 +77,7 @@ func TestPkgCoverageImage(t *testing.T) {
 	definedPkgs.Remove(string(pkg.KbPkg))
 	definedPkgs.Remove(string(pkg.GoModulePkg))
 	definedPkgs.Remove(string(pkg.RustPkg))
+	definedPkgs.Remove(string(pkg.DartPubPkg))
 
 	var cases []testCase
 	cases = append(cases, commonTestCases...)

test/integration/distro_test.go

@@ -1,6 +1,7 @@
 package integration
 
 import (
+	"github.com/anchore/syft/syft/source"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -9,7 +10,7 @@ import (
 )
 
 func TestDistroImage(t *testing.T) {
-	sbom, _ := catalogFixtureImage(t, "image-distro-id")
+	sbom, _ := catalogFixtureImage(t, "image-distro-id", source.SquashedScope)
 
 	expected := &linux.Release{
 		PrettyName: "BusyBox v1.31.1",

test/integration/encode_decode_cycle_test.go

@@ -2,12 +2,14 @@ package integration
 
 import (
 	"bytes"
-	"regexp"
-	"testing"
-
+	"fmt"
 	"github.com/anchore/syft/internal/formats/cyclonedxjson"
 	"github.com/anchore/syft/internal/formats/cyclonedxxml"
 	"github.com/anchore/syft/internal/formats/syftjson"
+	"github.com/anchore/syft/syft/source"
+	"regexp"
+	"testing"
+
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/stretchr/testify/require"
 
@@ -51,12 +53,12 @@ func TestEncodeDecodeEncodeCycleComparison(t *testing.T) {
 			},
 		},
 	}
-	for _, test := range tests {
-		t.Run(string(test.formatOption), func(t *testing.T) {
 
-			// use second image for relationships
-			for _, image := range []string{"image-pkg-coverage", "image-owning-package"} {
-				originalSBOM, _ := catalogFixtureImage(t, image)
+	for _, test := range tests {
+		// use second image for relationships
+		for _, image := range []string{"image-pkg-coverage", "image-owning-package"} {
+			t.Run(fmt.Sprintf("%s/%s", test.formatOption, image), func(t *testing.T) {
+				originalSBOM, _ := catalogFixtureImage(t, image, source.SquashedScope)
 
 				format := syft.FormatByID(test.formatOption)
 				require.NotNil(t, format)
@@ -87,7 +89,7 @@ func TestEncodeDecodeEncodeCycleComparison(t *testing.T) {
 						t.Errorf("diff: %s", dmp.DiffPrettyText(diffs))
 					}
 				}
-			}
-		})
+			})
+		}
 	}
 }

test/integration/node_packages_test.go

@@ -14,7 +14,7 @@ func TestNpmPackageLockDirectory(t *testing.T) {
 	foundPackages := internal.NewStringSet()
 
 	for actualPkg := range sbom.Artifacts.PackageCatalog.Enumerate(pkg.NpmPkg) {
-		for _, actualLocation := range actualPkg.Locations {
+		for _, actualLocation := range actualPkg.Locations.ToSlice() {
 			if strings.Contains(actualLocation.RealPath, "node_modules") {
 				t.Errorf("found packages from package-lock.json in node_modules: %s", actualLocation)
 			}
@@ -35,7 +35,7 @@ func TestYarnPackageLockDirectory(t *testing.T) {
 	foundPackages := internal.NewStringSet()
 
 	for actualPkg := range sbom.Artifacts.PackageCatalog.Enumerate(pkg.NpmPkg) {
-		for _, actualLocation := range actualPkg.Locations {
+		for _, actualLocation := range actualPkg.Locations.ToSlice() {
 			if strings.Contains(actualLocation.RealPath, "node_modules") {
 				t.Errorf("found packages from yarn.lock in node_modules: %s", actualLocation)
 			}

test/integration/package_deduplication_test.go

@@ -0,0 +1,84 @@
+package integration
+
+import (
+	"fmt"
+	"github.com/anchore/syft/syft/source"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"testing"
+)
+
+func TestPackageDeduplication(t *testing.T) {
+	tests := []struct {
+		scope         source.Scope
+		packageCount  int
+		instanceCount map[string]int
+		locationCount map[string]int
+	}{
+		{
+			scope:        source.AllLayersScope,
+			packageCount: 172, // without deduplication this would be 618
+			instanceCount: map[string]int{
+				"basesystem": 1,
+				"wget":       1,
+				"curl":       2, // upgraded in the image
+				"vsftpd":     1,
+				"httpd":      1,
+			},
+			locationCount: map[string]int{
+				"basesystem-10.0-7.el7.centos": 4,
+				"curl-7.29.0-59.el7":           1, // from base image
+				"curl-7.29.0-59.el7_9.1":       3, // upgrade
+				"wget-1.14-18.el7_6.1":         3,
+				"vsftpd-3.0.2-29.el7_9":        2,
+				"httpd-2.4.6-97.el7.centos.5":  1,
+			},
+		},
+		{
+			scope:        source.SquashedScope,
+			packageCount: 170,
+			instanceCount: map[string]int{
+				"basesystem": 1,
+				"wget":       1,
+				"curl":       1, // upgraded, but the most recent
+				"vsftpd":     1,
+				"httpd":      1,
+			},
+			locationCount: map[string]int{
+				"basesystem-10.0-7.el7.centos": 1,
+				"curl-7.29.0-59.el7_9.1":       1, // upgrade
+				"wget-1.14-18.el7_6.1":         1,
+				"vsftpd-3.0.2-29.el7_9":        1,
+				"httpd-2.4.6-97.el7.centos.5":  1,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(string(tt.scope), func(t *testing.T) {
+			sbom, _ := catalogFixtureImage(t, "image-vertical-package-dups", tt.scope)
+
+			assert.Equal(t, tt.packageCount, sbom.Artifacts.PackageCatalog.PackageCount())
+			for name, expectedInstanceCount := range tt.instanceCount {
+				pkgs := sbom.Artifacts.PackageCatalog.PackagesByName(name)
+
+				// with multiple packages with the same name, something is wrong (or this is the wrong fixture)
+				require.Len(t, pkgs, expectedInstanceCount)
+				for _, p := range pkgs {
+					nameVersion := fmt.Sprintf("%s-%s", name, p.Version)
+					expectedLocationCount, ok := tt.locationCount[nameVersion]
+					if !ok {
+						t.Fatalf("missing name-version: %s", nameVersion)
+					}
+
+					// we should see merged locations (assumption, there was 1 location for each package)
+					assert.Len(t, p.Locations.ToSlice(), expectedLocationCount)
+
+					// all paths should match
+					assert.Len(t, p.Locations.CoordinateSet().Paths(), 1)
+				}
+			}
+
+		})
+	}
+}

test/integration/package_ownership_relationship_test.go

@@ -3,6 +3,7 @@ package integration
 import (
 	"bytes"
 	"encoding/json"
+	"github.com/anchore/syft/syft/source"
 	"testing"
 
 	"github.com/anchore/syft/internal/formats/syftjson"
@@ -22,7 +23,7 @@ func TestPackageOwnershipRelationships(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.fixture, func(t *testing.T) {
-			sbom, _ := catalogFixtureImage(t, test.fixture)
+			sbom, _ := catalogFixtureImage(t, test.fixture, source.SquashedScope)
 
 			output := bytes.NewBufferString("")
 			err := syftjson.Format().Encode(output, sbom)

test/integration/regression_apk_scanner_buffer_size_test.go

@@ -1,6 +1,7 @@
 package integration
 
 import (
+	"github.com/anchore/syft/syft/source"
 	"testing"
 
 	"github.com/anchore/syft/syft/pkg"
@@ -9,7 +10,7 @@ import (
 func TestRegression212ApkBufferSize(t *testing.T) {
 	// This is a regression test for issue #212 (https://github.com/anchore/syft/issues/212) in which the apk db could
 	// not be processed due to a scanner buffer that was too small
-	sbom, _ := catalogFixtureImage(t, "image-large-apk-data")
+	sbom, _ := catalogFixtureImage(t, "image-large-apk-data", source.SquashedScope)
 
 	expectedPkgs := 58
 	actualPkgs := 0

test/integration/regression_go_bin_scanner_arch_test.go

@@ -1,6 +1,7 @@
 package integration
 
 import (
+	"github.com/anchore/syft/syft/source"
 	"strings"
 	"testing"
 
@@ -15,12 +16,12 @@ func TestRegressionGoArchDiscovery(t *testing.T) {
 	)
 	// This is a regression test to make sure the way we detect go binary packages
 	// stays consistent and reproducible as the tool chain evolves
-	sbom, _ := catalogFixtureImage(t, "image-go-bin-arch-coverage")
+	sbom, _ := catalogFixtureImage(t, "image-go-bin-arch-coverage", source.SquashedScope)
 
 	var actualELF, actualWIN, actualMACOS int
 
 	for p := range sbom.Artifacts.PackageCatalog.Enumerate(pkg.GoModulePkg) {
-		for _, l := range p.Locations {
+		for _, l := range p.Locations.ToSlice() {
 			switch {
 			case strings.Contains(l.RealPath, "elf"):
 				actualELF++

test/integration/regression_java_no_main_package_test.go

@@ -1,9 +1,10 @@
 package integration
 
 import (
+	"github.com/anchore/syft/syft/source"
 	"testing"
 )
 
 func TestRegressionJavaNoMainPackage(t *testing.T) { // Regression: https://github.com/anchore/syft/issues/252
-	catalogFixtureImage(t, "image-java-no-main-package")
+	catalogFixtureImage(t, "image-java-no-main-package", source.SquashedScope)
 }

test/integration/test-fixtures/image-pkg-coverage/pkgs/dart/pubspec.lock

@@ -0,0 +1,49 @@
+# Generated by pub
+# See https://dart.dev/tools/pub/glossary#lockfile
+packages:
+  ale:
+    dependency: transitive
+    description:
+      name: ale
+      url: "https://pub.hosted.org"
+    source: hosted
+    version: "3.3.0"
+  analyzer:
+    dependency: transitive
+    description:
+      name: analyzer
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "0.40.7"
+  ansicolor:
+    dependency: transitive
+    description:
+      name: ansicolor
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.1.1"
+  archive:
+    dependency: transitive
+    description:
+      name: archive
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "2.0.13"
+  args:
+    dependency: transitive
+    description:
+      name: args
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.6.0"
+  key_binder:
+    dependency: "direct main"
+    description:
+      path: "."
+      ref: HEAD
+      resolved-ref: "3f7b3a6350e73c7dcac45301c0e18fbd42af02f7"
+      url: "git@github.com:Workiva/key_binder.git"
+    source: git
+    version: "1.11.20"
+sdks:
+  dart: ">=2.12.0 <3.0.0"

test/integration/test-fixtures/image-vertical-package-dups/Dockerfile

@@ -0,0 +1,6 @@
+FROM centos:7.9.2009
+# modifying the RPM DB multiple times will result in duplicate packages when using all-layers (if there was no de-dup logic)
+# curl is tricky, it already exists in the image and is being upgraded
+RUN yum install -y wget curl
+RUN yum install -y vsftpd
+RUN yum install -y httpd

test/integration/utils_test.go

@@ -13,7 +13,7 @@ import (
 	"github.com/anchore/syft/syft/source"
 )
 
-func catalogFixtureImage(t *testing.T, fixtureImageName string) (sbom.SBOM, *source.Source) {
+func catalogFixtureImage(t *testing.T, fixtureImageName string, scope source.Scope) (sbom.SBOM, *source.Source) {
 	imagetest.GetFixtureImage(t, "docker-archive", fixtureImageName)
 	tarPath := imagetest.GetFixtureImageTarPath(t, fixtureImageName)
 	userInput := "docker-archive:" + tarPath
@@ -25,7 +25,7 @@ func catalogFixtureImage(t *testing.T, fixtureImageName string) (sbom.SBOM, *sou
 
 	// TODO: this would be better with functional options (after/during API refactor)
 	c := cataloger.DefaultConfig()
-	c.Search.Scope = source.SquashedScope
+	c.Search.Scope = scope
 	pkgCatalog, relationships, actualDistro, err := syft.CatalogPackages(theSource, c)
 	if err != nil {
 		t.Fatalf("failed to catalog image: %+v", err)